diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
index bbb1fd0adc5..15936e05aa9 100644
--- a/.github/CODEOWNERS
+++ b/.github/CODEOWNERS
@@ -35,7 +35,6 @@
 
 # net
 
-/deps/ada @nodejs/url
 /deps/cares @nodejs/net
 /doc/api/dgram.md @nodejs/net
 /doc/api/dns.md @nodejs/net
@@ -47,14 +46,11 @@
 /lib/internal/js_stream_socket.js @nodejs/net
 /lib/internal/net.js @nodejs/net
 /lib/internal/socket_list.js @nodejs/net
-/lib/internal/url.js @nodejs/url
 /lib/net.js @nodejs/net
-/lib/url.js @nodejs/url
 /src/cares_wrap.cc @nodejs/net
 /src/connect_wrap.* @nodejs/net
 /src/connection_wrap.* @nodejs/net
 /src/node_sockaddr* @nodejs/net
-/src/node_url.* @nodejs/url
 /src/tcp_wrap.* @nodejs/net
 /src/udp_wrap.* @nodejs/net
 
@@ -186,3 +182,10 @@
 /lib/internal/navigator.js @nodejs/web-standards
 /test/fixtures/wpt/ @nodejs/web-standards
 /test/wpt/ @nodejs/web-standards
+
+# URL
+/deps/ada @nodejs/url
+/lib/internal/url.js @nodejs/url
+/lib/url.js @nodejs/url
+/src/node_url.* @nodejs/url
+/test/fixtures/wpt/url @nodejs/url
diff --git a/.github/workflows/auto-start-ci.yml b/.github/workflows/auto-start-ci.yml
index 3703a28abbc..2588bc82da3 100644
--- a/.github/workflows/auto-start-ci.yml
+++ b/.github/workflows/auto-start-ci.yml
@@ -50,7 +50,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/build-tarball.yml b/.github/workflows/build-tarball.yml
index 0c739387641..14121a09cc4 100644
--- a/.github/workflows/build-tarball.yml
+++ b/.github/workflows/build-tarball.yml
@@ -46,7 +46,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55  # v5.5.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: Set up sccache
@@ -76,7 +76,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55  # v5.5.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: Set up sccache
@@ -86,7 +86,7 @@ jobs:
       - name: Environment Information
         run: npx envinfo
       - name: Download tarball
-        uses: actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e  # v4.2.1
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4.3.0
         with:
           name: tarballs
           path: tarballs
diff --git a/.github/workflows/close-stale-feature-requests.yml b/.github/workflows/close-stale-feature-requests.yml
index 301dbff620c..17bac3b83f5 100644
--- a/.github/workflows/close-stale-feature-requests.yml
+++ b/.github/workflows/close-stale-feature-requests.yml
@@ -41,7 +41,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e  # v9.0.0
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639  # v9.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: 180
diff --git a/.github/workflows/close-stalled.yml b/.github/workflows/close-stalled.yml
index 7ece19e2e2d..6bf526baf01 100644
--- a/.github/workflows/close-stalled.yml
+++ b/.github/workflows/close-stalled.yml
@@ -20,7 +20,7 @@ jobs:
     if: github.repository == 'nodejs/node'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e  # v9.0.0
+      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639  # v9.1.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-close: 30
diff --git a/.github/workflows/commit-lint.yml b/.github/workflows/commit-lint.yml
index 1eb5622358e..4cd44c6d185 100644
--- a/.github/workflows/commit-lint.yml
+++ b/.github/workflows/commit-lint.yml
@@ -23,7 +23,7 @@ jobs:
           persist-credentials: false
       - run: git reset HEAD^2
       - name: Install Node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Validate commit message
diff --git a/.github/workflows/commit-queue.yml b/.github/workflows/commit-queue.yml
index 3276e4ec793..498f60f0c92 100644
--- a/.github/workflows/commit-queue.yml
+++ b/.github/workflows/commit-queue.yml
@@ -72,7 +72,7 @@ jobs:
 
       # Install dependencies
       - name: Install Node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Install @node-core/utils
diff --git a/.github/workflows/coverage-linux-without-intl.yml b/.github/workflows/coverage-linux-without-intl.yml
index 99295a96764..23b7a3fc7cd 100644
--- a/.github/workflows/coverage-linux-without-intl.yml
+++ b/.github/workflows/coverage-linux-without-intl.yml
@@ -47,14 +47,15 @@ permissions:
 
 jobs:
   coverage-linux-without-intl:
-    if: github.event.pull_request.draft == false
+    # Disabled because "Report JS" step was crashing.
+    if: false
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55  # v5.5.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: Set up sccache
@@ -77,6 +78,6 @@ jobs:
       - name: Clean tmp
         run: rm -rf coverage/tmp && rm -rf out
       - name: Upload
-        uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574  # v5.4.0
+        uses: codecov/codecov-action@39a2af19d997be74586469d4062e173ecae614f6  # v5.4.3+
         with:
           directory: ./coverage
diff --git a/.github/workflows/coverage-linux.yml b/.github/workflows/coverage-linux.yml
index 06013222037..8b85c2946cd 100644
--- a/.github/workflows/coverage-linux.yml
+++ b/.github/workflows/coverage-linux.yml
@@ -47,14 +47,15 @@ permissions:
 
 jobs:
   coverage-linux:
-    if: github.event.pull_request.draft == false
+    # Disabled because "Report JS" step was crashing.
+    if: false
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55  # v5.5.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: Set up sccache
@@ -77,6 +78,6 @@ jobs:
       - name: Clean tmp
         run: rm -rf coverage/tmp && rm -rf out
       - name: Upload
-        uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574  # v5.4.0
+        uses: codecov/codecov-action@39a2af19d997be74586469d4062e173ecae614f6  # v5.4.3+
         with:
           directory: ./coverage
diff --git a/.github/workflows/coverage-windows.yml b/.github/workflows/coverage-windows.yml
index dd28730657e..8d41809b395 100644
--- a/.github/workflows/coverage-windows.yml
+++ b/.github/workflows/coverage-windows.yml
@@ -51,7 +51,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b  # v5.3.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: Install deps
@@ -73,6 +73,6 @@ jobs:
       - name: Clean tmp
         run: npx rimraf ./coverage/tmp
       - name: Upload
-        uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a  # v5.0.7
+        uses: codecov/codecov-action@39a2af19d997be74586469d4062e173ecae614f6  # v5.4.3+
         with:
           directory: ./coverage
diff --git a/.github/workflows/create-release-proposal.yml b/.github/workflows/create-release-proposal.yml
index 0b580eab81a..58cf5a0bba5 100644
--- a/.github/workflows/create-release-proposal.yml
+++ b/.github/workflows/create-release-proposal.yml
@@ -40,7 +40,7 @@ jobs:
 
       # Install dependencies
       - name: Install Node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/daily-wpt-fyi.yml b/.github/workflows/daily-wpt-fyi.yml
index ebac102f63e..3cc6e6c54cd 100644
--- a/.github/workflows/daily-wpt-fyi.yml
+++ b/.github/workflows/daily-wpt-fyi.yml
@@ -39,7 +39,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b  # v5.3.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: Environment Information
@@ -51,7 +51,7 @@ jobs:
         run: echo "NIGHTLY=$(curl -s https://nodejs.org/download/nightly/index.json | jq -r '[.[] | select(.files[] | contains("linux-x64"))][0].version')" >> $GITHUB_ENV
       - name: Install Node.js
         id: setup-node
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: ${{ env.NIGHTLY || matrix.node-version }}
           check-latest: true
@@ -127,7 +127,7 @@ jobs:
         run: cp wptreport.json wptreport-${{ steps.setup-node.outputs.node-version }}.json
       - name: Upload GitHub Actions artifact
         if: ${{ env.WPT_REPORT != '' }}
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882  # v4.4.3
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         with:
           path: out/wpt/wptreport-*.json
           name: WPT Report for ${{ steps.setup-node.outputs.node-version }}
diff --git a/.github/workflows/daily.yml b/.github/workflows/daily.yml
index e929e8168b0..ae2b7a577f7 100644
--- a/.github/workflows/daily.yml
+++ b/.github/workflows/daily.yml
@@ -19,7 +19,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Environment Information
diff --git a/.github/workflows/doc.yml b/.github/workflows/doc.yml
index 6bf6254abf3..481224e670a 100644
--- a/.github/workflows/doc.yml
+++ b/.github/workflows/doc.yml
@@ -28,14 +28,14 @@ jobs:
         with:
           persist-credentials: false
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Environment Information
         run: npx envinfo
       - name: Build
         run: NODE=$(command -v node) make doc-only
-      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882  # v4.4.3
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         with:
           name: docs
           path: out/doc
diff --git a/.github/workflows/find-inactive-collaborators.yml b/.github/workflows/find-inactive-collaborators.yml
index 30ae63ee115..269bc2db172 100644
--- a/.github/workflows/find-inactive-collaborators.yml
+++ b/.github/workflows/find-inactive-collaborators.yml
@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/find-inactive-tsc.yml b/.github/workflows/find-inactive-tsc.yml
index 85c16ad0648..9e294994ba8 100644
--- a/.github/workflows/find-inactive-tsc.yml
+++ b/.github/workflows/find-inactive-tsc.yml
@@ -34,7 +34,7 @@ jobs:
           repository: nodejs/TSC
 
       - name: Use Node.js ${{ env.NODE_VERSION }}
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/notify-on-push.yml b/.github/workflows/notify-on-push.yml
index 14b184deb51..a05738f0c5d 100644
--- a/.github/workflows/notify-on-push.yml
+++ b/.github/workflows/notify-on-push.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Slack Notification
-        uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990  # 2.3.2
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661  # 2.3.3
         env:
           SLACK_COLOR: '#DE512A'
           SLACK_ICON: https://github.com/nodejs.png?size=48
@@ -56,7 +56,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
       - name: Slack Notification
         if: ${{ env.INVALID_COMMIT_MESSAGE }}
-        uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990  # 2.3.2
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661  # 2.3.3
         env:
           SLACK_COLOR: '#DE512A'
           SLACK_ICON: https://github.com/nodejs.png?size=48
diff --git a/.github/workflows/notify-on-review-wanted.yml b/.github/workflows/notify-on-review-wanted.yml
index b4e3490f31f..96eee3096d8 100644
--- a/.github/workflows/notify-on-review-wanted.yml
+++ b/.github/workflows/notify-on-review-wanted.yml
@@ -33,7 +33,7 @@ jobs:
           fi
 
       - name: Slack Notification
-        uses: rtCamp/action-slack-notify@c33737706dea87cd7784c687dadc9adf1be59990  # 2.3.2
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661  # 2.3.3
         env:
           MSG_MINIMAL: actions url
           SLACK_COLOR: '#3d85c6'
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 75c67cc238d..45a5ab30e74 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@0080882f6c36860b6ba35c610c98ce87d4e2f26f  # v2.10.2
+        uses: step-security/harden-runner@6c439dc8bdf85cadbbce9ed30d1c7b959517bc49  # v2.12.2
         with:
           egress-policy: audit  # TODO: change to 'egress-policy: block' after couple of runs
 
@@ -43,7 +43,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46  # v2.4.0
+        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde  # v2.4.2
         with:
           results_file: results.sarif
           results_format: sarif
@@ -65,7 +65,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: Upload artifact
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882  # v4.4.3
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4.6.2
         with:
           name: SARIF file
           path: results.sarif
@@ -73,6 +73,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@f09c1c0a94de965c15400f5634aa42fac8fb8f88  # v3.27.5
+        uses: github/codeql-action/upload-sarif@181d5eefc20863364f96762470ba6f862bdef56b  # v3.29.2
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/test-internet.yml b/.github/workflows/test-internet.yml
index eced01cfbda..7d25113c024 100644
--- a/.github/workflows/test-internet.yml
+++ b/.github/workflows/test-internet.yml
@@ -48,7 +48,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b  # v5.3.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: Environment Information
diff --git a/.github/workflows/test-linux.yml b/.github/workflows/test-linux.yml
index 6e8ff1fd649..bd8569c8dc6 100644
--- a/.github/workflows/test-linux.yml
+++ b/.github/workflows/test-linux.yml
@@ -3,6 +3,7 @@ name: Test Linux
 on:
   pull_request:
     paths-ignore:
+      - .mailmap
       - README.md
       - .github/**
       - '!.github/workflows/test-linux.yml'
@@ -14,6 +15,7 @@ on:
       - v[0-9]+.x-staging
       - v[0-9]+.x
     paths-ignore:
+      - .mailmap
       - README.md
       - .github/**
       - '!.github/workflows/test-linux.yml'
@@ -41,7 +43,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@8d9ed9ac5c53483de85588cdf95a591a75ab9f55  # v5.5.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: Set up sccache
diff --git a/.github/workflows/test-macos.yml b/.github/workflows/test-macos.yml
index 285d67bdb85..969b73e0c3a 100644
--- a/.github/workflows/test-macos.yml
+++ b/.github/workflows/test-macos.yml
@@ -52,7 +52,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b  # v5.3.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - name: Set up sccache
diff --git a/.github/workflows/tools.yml b/.github/workflows/tools.yml
index c4bf9d16151..7ec9da38630 100644
--- a/.github/workflows/tools.yml
+++ b/.github/workflows/tools.yml
@@ -298,7 +298,7 @@ jobs:
           persist-credentials: false
       - name: Set up Python ${{ env.PYTHON_VERSION }}
         if: matrix.id == 'icu' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id)
-        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b  # v5.3.0
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065  # v5.6.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
       - run: ${{ matrix.run }}
@@ -309,7 +309,7 @@ jobs:
         if: env.COMMIT_MSG == '' && (github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id)
         run: |
           echo "COMMIT_MSG=${{ matrix.subsystem }}: update ${{ matrix.id }} to ${{ env.NEW_VERSION }}" >> "$GITHUB_ENV"
-      - uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+      - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e  # v7.0.8
         if: github.event_name == 'schedule' || inputs.id == 'all' || inputs.id == matrix.id
         # Creates a PR or update the Action's existing PR, or
         # no-op if the base branch is already up-to-date.
diff --git a/.github/workflows/update-v8.yml b/.github/workflows/update-v8.yml
index 2d28ae5d602..70977609d29 100644
--- a/.github/workflows/update-v8.yml
+++ b/.github/workflows/update-v8.yml
@@ -20,7 +20,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Cache node modules and update-v8
-        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a  # v4.1.2
+        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684  # v4.2.3
         id: cache-v8-npm
         env:
           cache-name: cache-v8-npm
@@ -30,7 +30,7 @@ jobs:
             ~/.npm
           key: ${{ runner.os }}-build-${{ env.cache-name }}
       - name: Install Node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Install @node-core/utils
@@ -45,7 +45,7 @@ jobs:
             cat temp-output
             tail -n1 temp-output | grep "NEW_VERSION=" >> "$GITHUB_ENV" || true
             rm temp-output
-      - uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f  # v7.0.5
+      - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e  # v7.0.8
         # Creates a PR or update the Action's existing PR, or
         # no-op if the base branch is already up-to-date.
         with:
diff --git a/.github/workflows/update-wpt.yml b/.github/workflows/update-wpt.yml
index 72ec030e9d6..aba9b274120 100644
--- a/.github/workflows/update-wpt.yml
+++ b/.github/workflows/update-wpt.yml
@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: Install Node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af  # v4.1.0
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020  # v4.4.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.mailmap b/.mailmap
index c197dd83e27..ec877b4c767 100644
--- a/.mailmap
+++ b/.mailmap
@@ -204,6 +204,7 @@ George Adams <gadams@microsoft.com> <george.adams@uk.ibm.com>
 Gerhard Stöbich <deb2001-github@yahoo.de>
 Gibson Fahnestock <gibfahn@gmail.com> <gib@uk.ibm.com>
 Gil Pedersen <git@gpost.dk> <github@gpost.dk>
+Giovanni Bucci <github@puskin.it>
 Graham Fairweather <xotic750@gmail.com> <xotic750@gmail>
 Greg Sabia Tucker <greg@narrowlabs.com> <greg@tucke.rs>
 Gregor Martynus <gregor@martynus.net>
@@ -240,7 +241,8 @@ James Ide <ide@jameside.com> <ide@users.noreply.github.com>
 James M Snell <jasnell@gmail.com>
 James Nimlos <james@nimlos.com>
 James Sumners <james@sumners.email> <james.sumners@gmail.com>
-Jan Krems <jan.krems@gmail.com> <jan.krems@groupon.com>
+Jan Martin <jan.krems@gmail.com>
+Jan Martin <jan.krems@gmail.com> <jankrems@google.com>
 Jem Bezooyen <github@jem.dev> <jem@hipmedia.ca>
 Jem Bezooyen <github@jem.dev> <jem@sendwithus.com>
 Jenna Vuong <jennavuong@gmail.com> <hello@jennavuong.com>
@@ -269,6 +271,7 @@ John McGuirk <johnmac81@gmail.com>
 John Musgrave <musgravejw@gmail.com>
 Johnny Ray Austin <johnny@johnnyray.me> <http://johnnyray.me>
 Jon Tippens <jwtippens@gmail.com>
+Jonas Badalic <jonas.badalic@gmail.com> <jonas@badalic.com>
 Jonas Pfenniger <jonas@pfenniger.name> <jonas@stvs.ch>
 Jonathan Gourlay <gourlayjd@linux.com>
 Jonathan Ong <jonathanrichardong@gmail.com> <jonathanong@users.noreply.github.com>
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b19299d2e56..a561912c77d 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,7 +35,8 @@ release.
 </tr>
 <tr>
   <td valign="top">
-<b><a href="doc/changelogs/CHANGELOG_V20.md#20.19.4">20.19.4</a></b><br/>
+<b><a href="doc/changelogs/CHANGELOG_V20.md#20.19.5">20.19.5</a></b><br/>
+<a href="doc/changelogs/CHANGELOG_V20.md#20.19.4">20.19.4</a><br/>
 <a href="doc/changelogs/CHANGELOG_V20.md#20.19.3">20.19.3</a><br/>
 <a href="doc/changelogs/CHANGELOG_V20.md#20.19.2">20.19.2</a><br/>
 <a href="doc/changelogs/CHANGELOG_V20.md#20.19.1">20.19.1</a><br/>
diff --git a/GOVERNANCE.md b/GOVERNANCE.md
index 382b6391956..b100b58701f 100644
--- a/GOVERNANCE.md
+++ b/GOVERNANCE.md
@@ -148,10 +148,71 @@ Contributions can be:
 * Participation in other projects, teams, and working groups of the Node.js
   organization.
 
+Collaborators should be people volunteering to do unglamorous work because it's
+the right thing to do, they find the work itself satisfying, and they care about
+Node.js and its users. People should get collaborator status because they're
+doing work and are likely to continue doing work where having the abilities that
+come with collaborator status are helpful (abilities like starting CI jobs,
+reviewing and approving PRs, etc.). That will usually--but, very importantly, not
+always--be work involving committing to the `nodejs/node` repository. For an example
+of an exception, someone working primarily on the website might benefit from being
+able to start Jenkins CI jobs to test changes to documentation tooling. That,
+along with signals indicating commitment to Node.js, personal integrity, etc.,
+should be enough for a successful nomination.
+
+It is important to understand that potential collaborators may have vastly
+different areas and levels of expertise, interest, and skill. The Node.js
+project is large and complex, and it is not expected that every collaborator
+will have the same level of expertise in every area of the project. The
+complexity or "sophistication" of an individual’s contributions, or even their
+relative engineering "skill" level, are not primary factors in determining
+whether they should be a collaborator. The primary factors do include the quality
+of their contributions (do the contributions make sense, do they add value, do
+they follow documented guidelines, are they authentic and well-intentioned,
+etc.), their commitment to the project, can their judgement be trusted, and do
+they have the ability to work well with others.
+
+#### The Authenticity of Contributors
+
+The Node.js project does not require that contributors use their legal names or
+provide any personal information verifying their identity.
+
+It is not uncommon for malicious actors to attempt to gain commit access to
+open-source projects in order to inject malicious code or for other nefarious
+purposes. The Node.js project has a number of mechanisms in place to prevent
+this, but it is important to be vigilant. If you have concerns about the
+authenticity of a contributor, please raise them with the TSC. Anyone nominating
+a new collaborator should take reasonable steps to verify that the contributions
+of the nominee are authentic and made in good faith. This is not always easy,
+but it is important.
+
 ### Nominating a new Collaborator
 
-To nominate a new Collaborator, open an issue in the [nodejs/node][] repository.
-Provide a summary of the nominee's contributions. For example:
+To nominate a new Collaborator:
+
+1. **Optional but strongly recommended**: open a
+   [discussion in the nodejs/collaborators][] repository. Provide a summary of
+   the nominee's contributions (see below for an example).
+2. **Optional but strongly recommended**: After sufficient wait time (e.g. 72
+   hours), if the nomination proposal has received some support and no explicit
+   block, and any questions/concerns have been addressed, add a comment in the
+   private discussion stating you're planning on opening a public issue, e.g.
+   "I see a number of approvals and no block, I'll be opening a public
+   nomination issue if I don't hear any objections in the next 72 hours".
+3. **Optional but strongly recommended**: Privately contact the nominee to make
+   sure they're comfortable with the nomination.
+4. Open an issue in the [nodejs/node][] repository. Provide a summary of
+   the nominee's contributions (see below for an example). Mention
+   @nodejs/collaborators in the issue to notify other collaborators about
+   the nomination.
+
+The _Optional but strongly recommended_ steps are optional in the sense that
+skipping them would not invalidate the nomination, but it could put the nominee
+in a very awkward situation if a nomination they didn't ask for pops out of
+nowhere only to be rejected. Do not skip those steps unless you're absolutely
+certain the nominee is fine with the public scrutiny.
+
+Example of list of contributions:
 
 * Commits in the [nodejs/node][] repository.
   * Use the link `https://github.com/nodejs/node/commits?author=GITHUB_ID`
@@ -170,22 +231,93 @@ Provide a summary of the nominee's contributions. For example:
   organization
 * Other participation in the wider Node.js community
 
-Mention @nodejs/collaborators in the issue to notify other collaborators about
-the nomination.
-
-The nomination passes if no collaborators oppose it after one week. In the case
-of an objection, the TSC is responsible for working with the individuals
-involved and finding a resolution.
-
-There are steps a nominator can take in advance to make a nomination as
-frictionless as possible. To request feedback from other collaborators in
-private, use the [collaborators discussion page][]
-(which only collaborators may view). A nominator may also work with the
-nominee to improve their contribution profile.
-
-Collaborators might overlook someone with valuable contributions. In that case,
-the contributor may open an issue or contact a collaborator to request a
-nomination.
+The nomination passes if no collaborators oppose it (as described in the
+following section) after one week. In the case of an objection, the TSC is
+responsible for working with the individuals involved and finding a resolution.
+The TSC may, following typical TSC consensus seeking processes, choose to
+advance a nomination that has otherwise failed to reach a natural consensus or
+clear path forward even if there are outstanding objections. The TSC may also
+choose to prevent a nomination from advancing if the TSC determines that any
+objections have not been adequately addressed.
+
+#### How to review a collaborator nomination
+
+A collaborator nomination can be reviewed in the same way one would review a PR
+adding a feature:
+
+* If you see the nomination as something positive to the project, say so!
+* If you are neutral, or feel you don't know enough to have an informed opinion,
+  it's certainly OK to not interact with the nomination.
+* If you think the nomination was made too soon, or can be detrimental to the
+  project, share your concerns. See the section "How to oppose a collaborator
+  nomination" below.
+
+Our goal is to keep gate-keeping at a minimal, but it cannot be zero since being
+a collaborator requires trust (collaborators can start CI jobs, use their veto,
+push commits, etc.), so what's the minimal amount is subjective, and there will
+be cases where collaborators disagree on whether a nomination should move
+forward.
+
+Refrain from discussing or debating aspects of the nomination process
+itself directly within a nomination private discussion or public issue.
+Such discussions can derail and frustrate the nomination causing unnecessary
+friction. Move such discussions to a separate issue or discussion thread.
+
+##### How to oppose a collaborator nomination
+
+An important rule of thumb is that the nomination process is intended to be
+biased strongly towards implicit approval of the nomination. This means
+discussion and review around the proposal should be more geared towards "I have
+reasons to say no..." as opposed to "Give me reasons to say yes...".
+
+Given that there is no "Request for changes" feature in discussions and issues,
+try to be explicit when your comment is expressing a blocking concern.
+Similarly, once the blocking concern has been addressed, explicitly say so.
+
+Explicit opposition would typically be signaled as some form of clear
+and unambiguous comment like, "I don't believe this nomination should pass".
+Asking clarifying questions or expressing general concerns is not the same as
+explicit opposition; however, a best effort should be made to answer such
+questions or addressing those concerns before advancing the nomination.
+
+Opposition does not need to be public. Ideally, the comment showing opposition,
+and any discussion thereof, should be done in the private discussion _before_
+the public issue is opened. Opposition _should_ be paired with clear suggestions
+for positive, concrete, and unambiguous next steps that the nominee can take to
+overcome the objection and allow it to move forward. While such suggestions are
+technically optional, they are _strongly encouraged_ to prevent the nomination
+from stalling indefinitely or objections from being overridden by the TSC.
+
+Remember that all private discussions about a nomination will be visible to
+the nominee once they are onboarded.
+
+#### How to review a collaborator nomination
+
+A collaborator nomination can be reviewed in the same way one would review a PR
+adding a feature:
+
+* If you see the nomination as something positive to the project, say so!
+* If you are neutral, or feel you don't know enough to have an informed opinion,
+  it's certainly OK to not interact with the nomination.
+* If you think the nomination was made too soon, or can be detrimental to the
+  project, share your concerns, ideally before the public nomination is opened,
+  and avoid sharing those concerns outside of the Collaborator discussion area.
+  Ideally, list what step(s) the nominee could take that would make you
+  approve their nomination.
+  Given that there is no "Request for changes" feature in discussions and issues,
+  try to be explicit when your comment is expressing a blocking concern.
+  Similarly, once the blocking concern has been addressed, explicitly say so.
+
+Our goal is to keep gate-keeping at a minimal, but it cannot be zero since being
+a collaborator requires trust (collaborators can start CI jobs, use their veto,
+push commits, etc.), so what's the minimal amount is subjective, and there will
+be cases where collaborators disagree on whether a nomination should move
+forward.
+
+When concerns have been raised on the private discussion, refrain from opening
+the public issue. If no one has explicitly blocked the nomination and you'd like
+it to move forward, comment something like "If I don't hear any objections
+before (some time), I will open the public issue".
 
 ### Onboarding
 
@@ -200,6 +332,6 @@ The TSC follows a [Consensus Seeking][] decision-making model per the
 
 [Consensus Seeking]: https://en.wikipedia.org/wiki/Consensus-seeking_decision-making
 [TSC Charter]: https://github.com/nodejs/TSC/blob/HEAD/TSC-Charter.md
-[collaborators discussion page]: https://github.com/nodejs/collaborators/discussions/categories/collaborator-nominations
+[discussion in the nodejs/collaborators]: https://github.com/nodejs/collaborators/discussions/categories/collaborator-nominations
 [nodejs/help]: https://github.com/nodejs/help
 [nodejs/node]: https://github.com/nodejs/node
diff --git a/Makefile b/Makefile
index 237f9096b7b..085025424bb 100644
--- a/Makefile
+++ b/Makefile
@@ -1645,7 +1645,7 @@ test-agents-prereqs:
 	env npm_config_nodedir=$(PWD) $(NODE) ./deps/npm install zeromq@5 base85 --prefix test/common/nsolid-zmq-agent --no-save --no-package-lock
 	env npm_config_nodedir=$(PWD) $(NODE) ./deps/npm run build:libzmq --prefix test/common/nsolid-zmq-agent/node_modules/zeromq
 	env npm_config_nodedir=$(PWD) $(NODE) ./deps/npm install @opentelemetry/otlp-proto-exporter-base @grpc/grpc-js @grpc/proto-loader --prefix test/common/nsolid-otlp-agent --no-save --no-package-lock
-	env npm_config_nodedir=$(PWD) $(NODE) ./deps/npm install @grpc/grpc-js @grpc/proto-loader@0.7 --prefix test/common/nsolid-grpc-agent --no-save --no-package-lock
+	env npm_config_nodedir=$(PWD) $(NODE) ./deps/npm install @grpc/grpc-js @grpc/proto-loader --prefix test/common/nsolid-grpc-agent --no-save --no-package-lock
 
 .PHONY: test-agents-prereqs-clean
 test-agents-prereqs-clean:
diff --git a/agents/grpc/src/asset_stream.cc b/agents/grpc/src/asset_stream.cc
index a9136e7e257..2d4f3e38354 100644
--- a/agents/grpc/src/asset_stream.cc
+++ b/agents/grpc/src/asset_stream.cc
@@ -1,6 +1,10 @@
 #include "asset_stream.h"
-#include "debug_utils-inl.h"
+
+#include <cinttypes>
+
 #include "asserts-cpp/asserts.h"
+#include "grpc_utils.h"
+#include "uv.h"
 
 using grpc::Status;
 using grpcagent::NSolidService;
@@ -9,12 +13,6 @@ namespace node {
 namespace nsolid {
 namespace grpc {
 
-template <typename... Args>
-inline void Debug(Args&&... args) {
-  per_process::Debug(DebugCategory::NSOLID_GRPC_AGENT,
-                     std::forward<Args>(args)...);
-}
-
 AssetStream::AssetStream(
     NSolidService::StubInterface* stub,
     AssetStor&& stor,
@@ -44,8 +42,21 @@ AssetStream::~AssetStream() {
 }
 
 void AssetStream::OnDone(const Status& s) {
-  if (!s.ok()) {
-    Debug("AssetStream::OnDone error: %d. %s:%s\n",
+  const bool debug_enabled =
+    per_process::enabled_debug_list.enabled(DebugCategory::NSOLID_GRPC_AGENT);
+  if (debug_enabled) {
+    uint64_t total_duration = 0;
+    if (stream_stats_.stream_start > 0) {
+      total_duration = uv_hrtime() - stream_stats_.stream_start;
+    }
+
+    Debug("[AssetStream] completion status=%s duration_ns=%" PRIu64
+          " writes=%zu total_bytes=%zu error_code=%d error_message=%s "
+          "error_details=%s\n",
+          s.ok() ? "ok" : "error",
+          total_duration,
+          stream_stats_.write_count,
+          stream_stats_.total_bytes,
           s.error_code(),
           s.error_message().c_str(),
           s.error_details().c_str());
@@ -64,11 +75,32 @@ void AssetStream::OnDone(const Status& s) {
 void AssetStream::OnWriteDone(bool ok/*ok*/) {
   nsuv::ns_mutex::scoped_lock lock(lock_);
   write_state_.write_done = true;
+
+  // Calculate and log latency for this write only when debug is enabled
+  if (per_process::enabled_debug_list.enabled(
+        DebugCategory::NSOLID_GRPC_AGENT) &&
+      write_state_.write_start > 0) {
+    uint64_t latency = uv_hrtime() - write_state_.write_start;
+    Debug("[out] [%" PRIu64 "] %s command=%s requestId=%s data.length=%zu\n",
+          latency,
+          ok ? "ok" : "not ok",
+          write_state_.asset.common().command().c_str(),
+          write_state_.asset.common().requestid().c_str(),
+          write_state_.asset.data().length());
+    write_state_.write_start = 0;
+
+    // Update stream statistics
+    stream_stats_.write_count++;
+    stream_stats_.total_bytes += write_state_.asset.data().length();
+  }
+
   if (!ok) {
-    Debug("AssetStream::OnWriteDone not ok\n");
     write_state_.done = true;
-    StartWritesDone();
-    RemoveHold();
+    if (!write_state_.writes_done) {
+      write_state_.writes_done = true;
+      StartWritesDone();
+      RemoveHold();
+    }
   } else {
     NextWrite();
   }
@@ -77,11 +109,22 @@ void AssetStream::OnWriteDone(bool ok/*ok*/) {
 void AssetStream::NextWrite() {
   if (!write_state_.done && write_state_.write_done) {
     if (assets_q_.dequeue(write_state_.asset)) {
+      if (per_process::enabled_debug_list.enabled(
+            DebugCategory::NSOLID_GRPC_AGENT)) {
+        // Capture stream start time on first write
+        if (stream_stats_.stream_start == 0) {
+          stream_stats_.stream_start = uv_hrtime();
+        }
+        write_state_.write_start = uv_hrtime();
+      }
       StartWrite(&write_state_.asset);
       write_state_.write_done = false;
     } else if (write_state_.write_done_called) {
-      StartWritesDone();
-      RemoveHold();
+      if (!write_state_.writes_done) {
+        write_state_.writes_done = true;
+        StartWritesDone();
+        RemoveHold();
+      }
     }
   }
 }
diff --git a/agents/grpc/src/asset_stream.h b/agents/grpc/src/asset_stream.h
index d561fc2d2eb..587eac37b18 100644
--- a/agents/grpc/src/asset_stream.h
+++ b/agents/grpc/src/asset_stream.h
@@ -39,7 +39,15 @@ class AssetStream: public ::grpc::ClientWriteReactor<grpcagent::Asset> {
     bool done = false;
     bool write_done = true;
     bool write_done_called = false;
+    bool writes_done = false;
     grpcagent::Asset asset;
+    uint64_t write_start = 0;
+  };
+
+  struct StreamStats {
+    uint64_t stream_start = 0;
+    size_t write_count = 0;
+    size_t total_bytes = 0;
   };
 
  public:
@@ -69,6 +77,7 @@ class AssetStream: public ::grpc::ClientWriteReactor<grpcagent::Asset> {
   ::grpc::ClientContext context_;
   grpcagent::EventResponse event_response_;
   WriteState write_state_;
+  StreamStats stream_stats_;
   TSQueue<grpcagent::Asset> assets_q_;
   nsuv::ns_mutex lock_;
 };
diff --git a/agents/grpc/src/command_stream.cc b/agents/grpc/src/command_stream.cc
index ce30d39f0ae..6a1de61c2ed 100644
--- a/agents/grpc/src/command_stream.cc
+++ b/agents/grpc/src/command_stream.cc
@@ -1,6 +1,7 @@
 #include "command_stream.h"
-#include "debug_utils-inl.h"
+
 #include "asserts-cpp/asserts.h"
+#include "grpc_utils.h"
 
 using grpc::Status;
 using grpcagent::NSolidService;
@@ -9,12 +10,6 @@ namespace node {
 namespace nsolid {
 namespace grpc {
 
-template <typename... Args>
-inline void Debug(Args&&... args) {
-  per_process::Debug(DebugCategory::NSOLID_GRPC_AGENT,
-                     std::forward<Args>(args)...);
-}
-
 CommandStream::CommandStream(NSolidService::StubInterface* stub,
                              std::weak_ptr<CommandStreamObserver> observer,
                              const std::string& agent_id,
@@ -79,8 +74,14 @@ void CommandStream::OnReadDone(bool ok) {
     Debug("CommandStream::OnReadDone not ok\n");
   }
 
-  StartWritesDone();
-  RemoveHold();
+  {
+    nsuv::ns_mutex::scoped_lock lock(lock_);
+    if (!write_state_.writes_done) {
+      write_state_.writes_done = true;
+      StartWritesDone();
+      RemoveHold();
+    }
+  }
 }
 
 void CommandStream::OnWriteDone(bool ok/*ok*/) {
@@ -88,8 +89,11 @@ void CommandStream::OnWriteDone(bool ok/*ok*/) {
   write_state_.write_done = true;
   if (!ok) {
     Debug("CommandStream::OnWriteDone not ok\n");
-    StartWritesDone();
-    RemoveHold();
+    if (!write_state_.writes_done) {
+      write_state_.writes_done = true;
+      StartWritesDone();
+      RemoveHold();
+    }
   } else {
     NextWrite();
   }
diff --git a/agents/grpc/src/command_stream.h b/agents/grpc/src/command_stream.h
index 200baed0388..6dea9ff7689 100644
--- a/agents/grpc/src/command_stream.h
+++ b/agents/grpc/src/command_stream.h
@@ -23,6 +23,7 @@ class CommandStream:
                                    grpcagent::CommandRequest> {
   struct WriteState {
     bool write_done = true;
+    bool writes_done = false;
     bool done = false;
     grpcagent::CommandResponse resp;
   };
diff --git a/agents/grpc/src/grpc_agent.cc b/agents/grpc/src/grpc_agent.cc
index 23567fc4492..eff2553b6bc 100644
--- a/agents/grpc/src/grpc_agent.cc
+++ b/agents/grpc/src/grpc_agent.cc
@@ -1,7 +1,6 @@
 #include "grpc_agent.h"
 
 #include "asserts-cpp/asserts.h"
-#include "debug_utils-inl.h"
 #include "nsolid/nsolid_api.h"
 #include "nsolid/nsolid_util.h"
 #include "../../otlp/src/otlp_common.h"
@@ -74,20 +73,6 @@ const size_t GRPC_MAX_SIZE = 4L * 1024 * 1024;  // 4GB
 const int PUB_KEY_SIZE = 40;
 const int CONSOLE_ID_SIZE = 36;
 
-template <typename... Args>
-inline void Debug(Args&&... args) {
-  per_process::Debug(DebugCategory::NSOLID_GRPC_AGENT,
-                     std::forward<Args>(args)...);
-}
-
-
-inline void DebugJSON(const char* str, const json& msg) {
-  if (UNLIKELY(per_process::enabled_debug_list.enabled(
-        DebugCategory::NSOLID_GRPC_AGENT))) {
-    Debug(str, msg.dump(4).c_str());
-  }
-}
-
 JSThreadMetrics::JSThreadMetrics(SharedEnvInst envinst):
     metrics_(ThreadMetrics::Create(envinst)) {
 }
@@ -144,6 +129,8 @@ void PopulateCommon(grpcagent::CommonResponse* common,
   time->set_nanoseconds(recorded.second);
   if (req_id) {
     common->set_requestid(req_id);
+  } else {
+    common->set_requestid(utils::generate_unique_id());
   }
 }
 
@@ -191,8 +178,6 @@ void PopulateBlockedLoopEvent(grpcagent::BlockedLoopEvent* blocked_loop_event,
 void PopulateInfoEvent(grpcagent::InfoEvent* info_event,
                        const nlohmann::json& info,
                        const char* req_id) {
-  DebugJSON("Process Info: \n%s\n", info);
-
   // Fill in the fields of the InfoResponse.
   PopulateCommon(info_event->mutable_common(), "info", req_id);
 
@@ -302,7 +287,6 @@ void PopulatePackagesEvent(grpcagent::PackagesEvent* packages_event,
 
   grpcagent::PackagesBody* body = packages_event->mutable_body();
   for (const auto& package : packages) {
-    DebugJSON("Populating Package: \n%s\n", package);
     grpcagent::Package* proto_package = body->add_packages();
     if (package.contains("path") && package["path"].is_string()) {
       proto_package->set_path(package["path"].get<std::string>());
@@ -1613,7 +1597,7 @@ void GrpcAgent::got_continuous_profile(
 
 void GrpcAgent::handle_command_request(CommandRequestStor&& req) {
   const grpcagent::CommandRequest& request = req.request;
-  Debug("Command Received: %s\n", request.DebugString().c_str());
+  DebugProtobufMsg("[in] ", request);
   command_stream_->Write(grpcagent::CommandResponse());
   const std::string cmd = request.command();
   if (cmd == "info") {
diff --git a/agents/grpc/src/grpc_agent.h b/agents/grpc/src/grpc_agent.h
index 4b3516dcdb7..73495579270 100644
--- a/agents/grpc/src/grpc_agent.h
+++ b/agents/grpc/src/grpc_agent.h
@@ -4,7 +4,6 @@
 #include <nsolid.h>
 #include <nsolid/async_ts_queue.h>
 #include <nsolid/thread_safe.h>
-#include "nlohmann/json.hpp"
 #include <memory>
 #include "grpcpp/grpcpp.h"
 #include "./proto/nsolid_service.grpc.pb.h"
diff --git a/agents/grpc/src/grpc_client.cc b/agents/grpc/src/grpc_client.cc
index fae49d52912..b65773bdbb0 100644
--- a/agents/grpc/src/grpc_client.cc
+++ b/agents/grpc/src/grpc_client.cc
@@ -16,12 +16,6 @@ namespace node {
 namespace nsolid {
 namespace grpc {
 
-template <typename... Args>
-inline void Debug(Args&&... args) {
-  per_process::Debug(DebugCategory::NSOLID_GRPC_AGENT,
-                     std::forward<Args>(args)...);
-}
-
 /**
   * Create gRPC channel.
   */
diff --git a/agents/grpc/src/grpc_client.h b/agents/grpc/src/grpc_client.h
index 2b49f304e37..6d27472d0e0 100644
--- a/agents/grpc/src/grpc_client.h
+++ b/agents/grpc/src/grpc_client.h
@@ -1,9 +1,13 @@
 #ifndef AGENTS_GRPC_SRC_GRPC_CLIENT_H_
 #define AGENTS_GRPC_SRC_GRPC_CLIENT_H_
 
+#include <cinttypes>
+
 #include "asserts-cpp/asserts.h"
 #include "../../src/profile_collector.h"
 #include "./proto/nsolid_service.grpc.pb.h"
+#include "google/protobuf/util/json_util.h"
+#include "grpc_utils.h"
 #include "grpcpp/grpcpp.h"
 #include "opentelemetry/version.h"
 
@@ -39,6 +43,7 @@ class GrpcAsyncCallData {
 
   EventType* event = nullptr;
   grpcagent::EventResponse* event_response = nullptr;
+  uint64_t start;
 
   GrpcAsyncCallData() = default;
   ~GrpcAsyncCallData() = default;
@@ -107,6 +112,10 @@ class GrpcClient {
       return -1;
     }
 
+    if (per_process::enabled_debug_list.enabled(
+          DebugCategory::NSOLID_GRPC_AGENT)) {
+      call_data->start = uv_hrtime();
+    }
     call_data->grpc_context.swap(context);
 
     // Call the correct async export method on the stub
@@ -115,6 +124,20 @@ class GrpcClient {
                                  call_data->event_response,
                                  [call_data](::grpc::Status status) {
         call_data->grpc_status = status;
+        if (per_process::enabled_debug_list.enabled(
+              DebugCategory::NSOLID_GRPC_AGENT) &&
+            call_data->start > 0) {
+          uint64_t latency = uv_hrtime() - call_data->start;
+          if (!call_data->grpc_status.ok()) {
+            DebugProtobufMsg("[out] [%" PRIu64 "] error code %d - %s ",
+                             *call_data->event,
+                             latency,
+                             call_data->grpc_status.error_code(),
+                             call_data->grpc_status.error_message().c_str());
+          } else {
+            DebugProtobufMsg("[out] [%" PRIu64 "]", *call_data->event, latency);
+          }
+        }
         call_data->result_callback(call_data->grpc_status,
                                    std::move(call_data->arena),
                                    *call_data->event,
diff --git a/agents/grpc/src/grpc_utils.h b/agents/grpc/src/grpc_utils.h
new file mode 100644
index 00000000000..2a5dca172d6
--- /dev/null
+++ b/agents/grpc/src/grpc_utils.h
@@ -0,0 +1,56 @@
+#ifndef AGENTS_GRPC_SRC_GRPC_UTILS_H_
+#define AGENTS_GRPC_SRC_GRPC_UTILS_H_
+
+#include "debug_utils-inl.h"
+#include "google/protobuf/util/json_util.h"
+#include "nlohmann/json.hpp"
+
+using google::protobuf::Message;
+using google::protobuf::util::MessageToJsonString;
+
+namespace node {
+namespace nsolid {
+namespace grpc {
+
+template <typename... Args>
+inline void Debug(Args&&... args) {
+  per_process::Debug(DebugCategory::NSOLID_GRPC_AGENT,
+                     std::forward<Args>(args)...);
+}
+
+inline void DebugJSON(const char* str, const nlohmann::json& msg) {
+  if (per_process::enabled_debug_list.enabled(
+        DebugCategory::NSOLID_GRPC_AGENT)) {
+    Debug(str, msg.dump(4).c_str());
+  }
+}
+
+template <typename... Args>
+inline void DebugProtobufMsg(const char* format,
+                             const Message& msg,
+                             Args&&... args) {
+  if (per_process::enabled_debug_list.enabled(
+        DebugCategory::NSOLID_GRPC_AGENT)) {
+    std::string json_payload;
+    const auto status = MessageToJsonString(msg, &json_payload);
+    if (status.ok()) {
+      // Build complete message with format args + JSON
+      std::string formatted_prefix;
+      if constexpr (sizeof...(args) > 0) {
+        char buffer[512];
+        snprintf(buffer, sizeof(buffer), format, std::forward<Args>(args)...);
+        formatted_prefix = buffer;
+      } else {
+        formatted_prefix = format;
+      }
+      Debug("%s%s\n", formatted_prefix.c_str(), json_payload.c_str());
+      return;
+    }
+  }
+}
+
+}  // namespace grpc
+}  // namespace nsolid
+}  // namespace node
+
+#endif  // AGENTS_GRPC_SRC_GRPC_UTILS_H_
diff --git a/benchmark/fixtures/simple-error-stack.js b/benchmark/fixtures/simple-error-stack.js
index 0057807795b..74aae191800 100644
--- a/benchmark/fixtures/simple-error-stack.js
+++ b/benchmark/fixtures/simple-error-stack.js
@@ -1,15 +1,16 @@
 'use strict';
-exports.__esModule = true;
-exports.simpleErrorStack = void 0;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.simpleErrorStack = simpleErrorStack;
 // Compile with `tsc --inlineSourceMap benchmark/fixtures/simple-error-stack.ts`.
 var lorem = 'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.';
 function simpleErrorStack() {
-    try {
-        lorem.BANG();
-    }
-    catch (e) {
-        return e.stack;
-    }
+    [1].map(function () {
+        try {
+            lorem.BANG();
+        }
+        catch (e) {
+            return e.stack;
+        }
+    });
 }
-exports.simpleErrorStack = simpleErrorStack;
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2ltcGxlLWVycm9yLXN0YWNrLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsic2ltcGxlLWVycm9yLXN0YWNrLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLFlBQVksQ0FBQzs7O0FBRWIsaUZBQWlGO0FBRWpGLElBQU0sS0FBSyxHQUFHLCtiQUErYixDQUFDO0FBRTljLFNBQVMsZ0JBQWdCO0lBQ3ZCLElBQUk7UUFDRCxLQUFhLENBQUMsSUFBSSxFQUFFLENBQUM7S0FDdkI7SUFBQyxPQUFPLENBQUMsRUFBRTtRQUNWLE9BQU8sQ0FBQyxDQUFDLEtBQUssQ0FBQztLQUNoQjtBQUNILENBQUM7QUFHQyw0Q0FBZ0IifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic2ltcGxlLWVycm9yLXN0YWNrLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsic2ltcGxlLWVycm9yLXN0YWNrLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLFlBQVksQ0FBQzs7QUFpQlgsNENBQWdCO0FBZmxCLGlGQUFpRjtBQUVqRixJQUFNLEtBQUssR0FBRywrYkFBK2IsQ0FBQztBQUU5YyxTQUFTLGdCQUFnQjtJQUN2QixDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztRQUNOLElBQUksQ0FBQztZQUNGLEtBQWEsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN4QixDQUFDO1FBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNYLE9BQU8sQ0FBQyxDQUFDLEtBQUssQ0FBQztRQUNqQixDQUFDO0lBQ0gsQ0FBQyxDQUFDLENBQUE7QUFDSixDQUFDIn0=
\ No newline at end of file
diff --git a/benchmark/fixtures/simple-error-stack.ts b/benchmark/fixtures/simple-error-stack.ts
index 58034e92f24..1335df3478b 100644
--- a/benchmark/fixtures/simple-error-stack.ts
+++ b/benchmark/fixtures/simple-error-stack.ts
@@ -5,11 +5,13 @@
 const lorem = 'Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non proident, sunt in culpa qui officia deserunt mollit anim id est laborum.';
 
 function simpleErrorStack() {
-  try {
-    (lorem as any).BANG();
-  } catch (e) {
-    return e.stack;
-  }
+  [1].map(() => {
+    try {
+      (lorem as any).BANG();
+    } catch (e) {
+      return e.stack;
+    }
+  })
 }
 
 export {
diff --git a/benchmark/fixtures/valid.env b/benchmark/fixtures/valid.env
index 120488d5791..6df454da653 100644
--- a/benchmark/fixtures/valid.env
+++ b/benchmark/fixtures/valid.env
@@ -6,6 +6,8 @@ BASIC=basic
 
 # previous line intentionally left blank
 AFTER_LINE=after_line
+A="B=C"
+B=C=D
 EMPTY=
 EMPTY_SINGLE_QUOTES=''
 EMPTY_DOUBLE_QUOTES=""
diff --git a/common.gypi b/common.gypi
index b487998f79b..b8b46dba3a8 100644
--- a/common.gypi
+++ b/common.gypi
@@ -36,7 +36,7 @@
 
     # Reset this number to 0 on major V8 upgrades.
     # Increment by one for each non-official patch applied to deps/v8.
-    'v8_embedder_string': '-node.29',
+    'v8_embedder_string': '-node.30',
 
     ##### V8 defaults for Node.js #####
 
@@ -80,6 +80,7 @@
     'v8_enable_direct_local%': 0,
     'v8_enable_map_packing%': 0,
     'v8_enable_pointer_compression_shared_cage%': 0,
+    'v8_enable_external_code_space%': 0,
     'v8_enable_sandbox%': 0,
     'v8_enable_v8_checks%': 0,
     'v8_enable_zone_compression%': 0,
@@ -115,7 +116,9 @@
       # V8 pointer compression only supports 64bit architectures.
       ['target_arch in "arm ia32 mips mipsel ppc"', {
         'v8_enable_pointer_compression': 0,
+        'v8_enable_pointer_compression_shared_cage': 0,
         'v8_enable_31bit_smis_on_64bit_arch': 0,
+        'v8_enable_external_code_space': 0,
         'v8_enable_sandbox': 0
       }],
       ['target_arch in "ppc64 s390x"', {
@@ -426,6 +429,9 @@
       ['v8_enable_sandbox == 1', {
         'defines': ['V8_ENABLE_SANDBOX',],
       }],
+      ['v8_enable_external_code_space == 1', {
+        'defines': ['V8_EXTERNAL_CODE_SPACE',],
+      }],
       ['v8_deprecation_warnings == 1', {
         'defines': ['V8_DEPRECATION_WARNINGS',],
       }],
diff --git a/configure.py b/configure.py
index caea1673282..5f7044be38d 100755
--- a/configure.py
+++ b/configure.py
@@ -1626,7 +1626,15 @@ def configure_v8(o):
   o['variables']['v8_use_siphash'] = 0 if options.without_siphash else 1
   o['variables']['v8_enable_maglev'] = 1 if options.v8_enable_maglev else 0
   o['variables']['v8_enable_pointer_compression'] = 1 if options.enable_pointer_compression else 0
-  o['variables']['v8_enable_sandbox'] = 1 if options.enable_pointer_compression else 0
+  # Using the sandbox requires always allocating array buffer backing stores in the sandbox.
+  # We currently have many backing stores tied to pointers from C++ land that are not
+  # even necessarily dynamic (e.g. in static storage) for fast communication between JS and C++.
+  # Until we manage to get rid of all those, v8_enable_sandbox cannot be used.
+  # Note that enabling pointer compression without enabling sandbox is unsupported by V8,
+  # so this can be broken at any time.
+  o['variables']['v8_enable_sandbox'] = 0
+  o['variables']['v8_enable_pointer_compression_shared_cage'] = 1 if options.enable_pointer_compression else 0
+  o['variables']['v8_enable_external_code_space'] = 1 if options.enable_pointer_compression else 0
   o['variables']['v8_enable_31bit_smis_on_64bit_arch'] = 1 if options.enable_pointer_compression else 0
   o['variables']['v8_enable_shared_ro_heap'] = 0 if options.enable_pointer_compression or options.disable_shared_ro_heap else 1
   o['variables']['v8_enable_extensible_ro_snapshot'] = 0
@@ -2171,7 +2179,7 @@ def make_bin_override():
 configure_library('nghttp2', output, pkgname='libnghttp2')
 configure_library('nghttp3', output, pkgname='libnghttp3')
 configure_library('ngtcp2', output, pkgname='libngtcp2')
-configure_library('uvwasi', output, pkgname='libuvwasi')
+configure_library('uvwasi', output)
 configure_v8(output)
 configure_openssl(output)
 configure_intl(output)
diff --git a/deps/acorn/acorn/CHANGELOG.md b/deps/acorn/acorn/CHANGELOG.md
index 313718616b5..c86068cd71a 100644
--- a/deps/acorn/acorn/CHANGELOG.md
+++ b/deps/acorn/acorn/CHANGELOG.md
@@ -1,3 +1,29 @@
+## 8.15.0 (2025-06-08)
+
+### New features
+
+Support `using` and `await using` syntax.
+
+The `AnyNode` type is now defined in such a way that plugins can extend it.
+
+### Bug fixes
+
+Fix an issue where the `bigint` property of literal nodes for non-decimal bigints had the wrong format.
+
+The `acorn` CLI tool no longer crashes when emitting a tree that contains a bigint.
+
+## 8.14.1 (2025-03-05)
+
+### Bug fixes
+
+Fix an issue where `await` expressions in class field initializers were inappropriately allowed.
+
+Properly allow await inside an async arrow function inside a class field initializer.
+
+Mention the source file name in syntax error messages when given.
+
+Properly add an empty `attributes` property to every form of `ExportNamedDeclaration`.
+
 ## 8.14.0 (2024-10-27)
 
 ### New features
diff --git a/deps/acorn/acorn/dist/acorn.d.mts b/deps/acorn/acorn/dist/acorn.d.mts
index 81f4e38fdbf..f2ec5243bcb 100644
--- a/deps/acorn/acorn/dist/acorn.d.mts
+++ b/deps/acorn/acorn/dist/acorn.d.mts
@@ -169,7 +169,7 @@ export interface FunctionDeclaration extends Function {
 export interface VariableDeclaration extends Node {
   type: "VariableDeclaration"
   declarations: Array<VariableDeclarator>
-  kind: "var" | "let" | "const"
+  kind: "var" | "let" | "const" | "using" | "await using"
 }
 
 export interface VariableDeclarator extends Node {
@@ -572,7 +572,24 @@ export type ModuleDeclaration =
 | ExportDefaultDeclaration
 | ExportAllDeclaration
 
-export type AnyNode = Statement | Expression | Declaration | ModuleDeclaration | Literal | Program | SwitchCase | CatchClause | Property | Super | SpreadElement | TemplateElement | AssignmentProperty | ObjectPattern | ArrayPattern | RestElement | AssignmentPattern | ClassBody | MethodDefinition | MetaProperty | ImportAttribute | ImportSpecifier | ImportDefaultSpecifier | ImportNamespaceSpecifier | ExportSpecifier | AnonymousFunctionDeclaration | AnonymousClassDeclaration | PropertyDefinition | PrivateIdentifier | StaticBlock | VariableDeclarator
+/**
+  * This interface is only used for defining {@link AnyNode}.
+  * It exists so that it can be extended by plugins:
+  *
+  * @example
+  * ```typescript
+  * declare module 'acorn' {
+  *   interface NodeTypes {
+  *     pluginName: FirstNode | SecondNode | ThirdNode | ... | LastNode
+  *   }
+  * }
+  * ```
+  */
+interface NodeTypes {
+  core: Statement | Expression | Declaration | ModuleDeclaration | Literal | Program | SwitchCase | CatchClause | Property | Super | SpreadElement | TemplateElement | AssignmentProperty | ObjectPattern | ArrayPattern | RestElement | AssignmentPattern | ClassBody | MethodDefinition | MetaProperty | ImportAttribute | ImportSpecifier | ImportDefaultSpecifier | ImportNamespaceSpecifier | ExportSpecifier | AnonymousFunctionDeclaration | AnonymousClassDeclaration | PropertyDefinition | PrivateIdentifier | StaticBlock | VariableDeclarator
+}
+
+export type AnyNode = NodeTypes[keyof NodeTypes]
 
 export function parse(input: string, options: Options): Program
 
@@ -583,7 +600,7 @@ export function tokenizer(input: string, options: Options): {
   [Symbol.iterator](): Iterator<Token>
 }
 
-export type ecmaVersion = 3 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 | 2022 | 2023 | 2024 | 2025 | "latest"
+export type ecmaVersion = 3 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 | 2022 | 2023 | 2024 | 2025 | 2026 | "latest"
 
 export interface Options {
   /**
diff --git a/deps/acorn/acorn/dist/acorn.d.ts b/deps/acorn/acorn/dist/acorn.d.ts
index 81f4e38fdbf..f2ec5243bcb 100644
--- a/deps/acorn/acorn/dist/acorn.d.ts
+++ b/deps/acorn/acorn/dist/acorn.d.ts
@@ -169,7 +169,7 @@ export interface FunctionDeclaration extends Function {
 export interface VariableDeclaration extends Node {
   type: "VariableDeclaration"
   declarations: Array<VariableDeclarator>
-  kind: "var" | "let" | "const"
+  kind: "var" | "let" | "const" | "using" | "await using"
 }
 
 export interface VariableDeclarator extends Node {
@@ -572,7 +572,24 @@ export type ModuleDeclaration =
 | ExportDefaultDeclaration
 | ExportAllDeclaration
 
-export type AnyNode = Statement | Expression | Declaration | ModuleDeclaration | Literal | Program | SwitchCase | CatchClause | Property | Super | SpreadElement | TemplateElement | AssignmentProperty | ObjectPattern | ArrayPattern | RestElement | AssignmentPattern | ClassBody | MethodDefinition | MetaProperty | ImportAttribute | ImportSpecifier | ImportDefaultSpecifier | ImportNamespaceSpecifier | ExportSpecifier | AnonymousFunctionDeclaration | AnonymousClassDeclaration | PropertyDefinition | PrivateIdentifier | StaticBlock | VariableDeclarator
+/**
+  * This interface is only used for defining {@link AnyNode}.
+  * It exists so that it can be extended by plugins:
+  *
+  * @example
+  * ```typescript
+  * declare module 'acorn' {
+  *   interface NodeTypes {
+  *     pluginName: FirstNode | SecondNode | ThirdNode | ... | LastNode
+  *   }
+  * }
+  * ```
+  */
+interface NodeTypes {
+  core: Statement | Expression | Declaration | ModuleDeclaration | Literal | Program | SwitchCase | CatchClause | Property | Super | SpreadElement | TemplateElement | AssignmentProperty | ObjectPattern | ArrayPattern | RestElement | AssignmentPattern | ClassBody | MethodDefinition | MetaProperty | ImportAttribute | ImportSpecifier | ImportDefaultSpecifier | ImportNamespaceSpecifier | ExportSpecifier | AnonymousFunctionDeclaration | AnonymousClassDeclaration | PropertyDefinition | PrivateIdentifier | StaticBlock | VariableDeclarator
+}
+
+export type AnyNode = NodeTypes[keyof NodeTypes]
 
 export function parse(input: string, options: Options): Program
 
@@ -583,7 +600,7 @@ export function tokenizer(input: string, options: Options): {
   [Symbol.iterator](): Iterator<Token>
 }
 
-export type ecmaVersion = 3 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 | 2022 | 2023 | 2024 | 2025 | "latest"
+export type ecmaVersion = 3 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17 | 2015 | 2016 | 2017 | 2018 | 2019 | 2020 | 2021 | 2022 | 2023 | 2024 | 2025 | 2026 | "latest"
 
 export interface Options {
   /**
diff --git a/deps/acorn/acorn/dist/acorn.js b/deps/acorn/acorn/dist/acorn.js
index 2bfc15b5ef2..cb5628bf83c 100644
--- a/deps/acorn/acorn/dist/acorn.js
+++ b/deps/acorn/acorn/dist/acorn.js
@@ -493,6 +493,7 @@
       SCOPE_SUPER = 64,
       SCOPE_DIRECT_SUPER = 128,
       SCOPE_CLASS_STATIC_BLOCK = 256,
+      SCOPE_CLASS_FIELD_INIT = 512,
       SCOPE_VAR = SCOPE_TOP | SCOPE_FUNCTION | SCOPE_CLASS_STATIC_BLOCK;
 
   function functionFlags(async, generator) {
@@ -603,15 +604,16 @@
 
   prototypeAccessors.inFunction.get = function () { return (this.currentVarScope().flags & SCOPE_FUNCTION) > 0 };
 
-  prototypeAccessors.inGenerator.get = function () { return (this.currentVarScope().flags & SCOPE_GENERATOR) > 0 && !this.currentVarScope().inClassFieldInit };
+  prototypeAccessors.inGenerator.get = function () { return (this.currentVarScope().flags & SCOPE_GENERATOR) > 0 };
 
-  prototypeAccessors.inAsync.get = function () { return (this.currentVarScope().flags & SCOPE_ASYNC) > 0 && !this.currentVarScope().inClassFieldInit };
+  prototypeAccessors.inAsync.get = function () { return (this.currentVarScope().flags & SCOPE_ASYNC) > 0 };
 
   prototypeAccessors.canAwait.get = function () {
     for (var i = this.scopeStack.length - 1; i >= 0; i--) {
-      var scope = this.scopeStack[i];
-      if (scope.inClassFieldInit || scope.flags & SCOPE_CLASS_STATIC_BLOCK) { return false }
-      if (scope.flags & SCOPE_FUNCTION) { return (scope.flags & SCOPE_ASYNC) > 0 }
+      var ref = this.scopeStack[i];
+        var flags = ref.flags;
+      if (flags & (SCOPE_CLASS_STATIC_BLOCK | SCOPE_CLASS_FIELD_INIT)) { return false }
+      if (flags & SCOPE_FUNCTION) { return (flags & SCOPE_ASYNC) > 0 }
     }
     return (this.inModule && this.options.ecmaVersion >= 13) || this.options.allowAwaitOutsideFunction
   };
@@ -619,8 +621,7 @@
   prototypeAccessors.allowSuper.get = function () {
     var ref = this.currentThisScope();
       var flags = ref.flags;
-      var inClassFieldInit = ref.inClassFieldInit;
-    return (flags & SCOPE_SUPER) > 0 || inClassFieldInit || this.options.allowSuperOutsideMethod
+    return (flags & SCOPE_SUPER) > 0 || this.options.allowSuperOutsideMethod
   };
 
   prototypeAccessors.allowDirectSuper.get = function () { return (this.currentThisScope().flags & SCOPE_DIRECT_SUPER) > 0 };
@@ -628,10 +629,13 @@
   prototypeAccessors.treatFunctionsAsVar.get = function () { return this.treatFunctionsAsVarInScope(this.currentScope()) };
 
   prototypeAccessors.allowNewDotTarget.get = function () {
-    var ref = this.currentThisScope();
-      var flags = ref.flags;
-      var inClassFieldInit = ref.inClassFieldInit;
-    return (flags & (SCOPE_FUNCTION | SCOPE_CLASS_STATIC_BLOCK)) > 0 || inClassFieldInit
+    for (var i = this.scopeStack.length - 1; i >= 0; i--) {
+      var ref = this.scopeStack[i];
+        var flags = ref.flags;
+      if (flags & (SCOPE_CLASS_STATIC_BLOCK | SCOPE_CLASS_FIELD_INIT) ||
+          ((flags & SCOPE_FUNCTION) && !(flags & SCOPE_ARROW))) { return true }
+    }
+    return false
   };
 
   prototypeAccessors.inClassStaticBlock.get = function () {
@@ -883,6 +887,49 @@
        !(isIdentifierChar(after = this.input.charCodeAt(next + 8)) || after > 0xd7ff && after < 0xdc00))
   };
 
+  pp$8.isUsingKeyword = function(isAwaitUsing, isFor) {
+    if (this.options.ecmaVersion < 17 || !this.isContextual(isAwaitUsing ? "await" : "using"))
+      { return false }
+
+    skipWhiteSpace.lastIndex = this.pos;
+    var skip = skipWhiteSpace.exec(this.input);
+    var next = this.pos + skip[0].length;
+
+    if (lineBreak.test(this.input.slice(this.pos, next))) { return false }
+
+    if (isAwaitUsing) {
+      var awaitEndPos = next + 5 /* await */, after;
+      if (this.input.slice(next, awaitEndPos) !== "using" ||
+        awaitEndPos === this.input.length ||
+        isIdentifierChar(after = this.input.charCodeAt(awaitEndPos)) ||
+        (after > 0xd7ff && after < 0xdc00)
+      ) { return false }
+
+      skipWhiteSpace.lastIndex = awaitEndPos;
+      var skipAfterUsing = skipWhiteSpace.exec(this.input);
+      if (skipAfterUsing && lineBreak.test(this.input.slice(awaitEndPos, awaitEndPos + skipAfterUsing[0].length))) { return false }
+    }
+
+    if (isFor) {
+      var ofEndPos = next + 2 /* of */, after$1;
+      if (this.input.slice(next, ofEndPos) === "of") {
+        if (ofEndPos === this.input.length ||
+          (!isIdentifierChar(after$1 = this.input.charCodeAt(ofEndPos)) && !(after$1 > 0xd7ff && after$1 < 0xdc00))) { return false }
+      }
+    }
+
+    var ch = this.input.charCodeAt(next);
+    return isIdentifierStart(ch, true) || ch === 92 // '\'
+  };
+
+  pp$8.isAwaitUsing = function(isFor) {
+    return this.isUsingKeyword(true, isFor)
+  };
+
+  pp$8.isUsing = function(isFor) {
+    return this.isUsingKeyword(false, isFor)
+  };
+
   // Parse a single statement.
   //
   // If expecting a statement and finding a slash operator, parse a
@@ -959,6 +1006,23 @@
         return this.parseFunctionStatement(node, true, !context)
       }
 
+      var usingKind = this.isAwaitUsing(false) ? "await using" : this.isUsing(false) ? "using" : null;
+      if (usingKind) {
+        if (topLevel && this.options.sourceType === "script") {
+          this.raise(this.start, "Using declaration cannot appear in the top level when source type is `script`");
+        }
+        if (usingKind === "await using") {
+          if (!this.canAwait) {
+            this.raise(this.start, "Await using cannot appear outside of async function");
+          }
+          this.next();
+        }
+        this.next();
+        this.parseVar(node, false, usingKind);
+        this.semicolon();
+        return this.finishNode(node, "VariableDeclaration")
+      }
+
       var maybeName = this.value, expr = this.parseExpression();
       if (starttype === types$1.name && expr.type === "Identifier" && this.eat(types$1.colon))
         { return this.parseLabeledStatement(node, maybeName, expr, context) }
@@ -1034,18 +1098,19 @@
       this.next();
       this.parseVar(init$1, true, kind);
       this.finishNode(init$1, "VariableDeclaration");
-      if ((this.type === types$1._in || (this.options.ecmaVersion >= 6 && this.isContextual("of"))) && init$1.declarations.length === 1) {
-        if (this.options.ecmaVersion >= 9) {
-          if (this.type === types$1._in) {
-            if (awaitAt > -1) { this.unexpected(awaitAt); }
-          } else { node.await = awaitAt > -1; }
-        }
-        return this.parseForIn(node, init$1)
-      }
-      if (awaitAt > -1) { this.unexpected(awaitAt); }
-      return this.parseFor(node, init$1)
+      return this.parseForAfterInit(node, init$1, awaitAt)
     }
     var startsWithLet = this.isContextual("let"), isForOf = false;
+
+    var usingKind = this.isUsing(true) ? "using" : this.isAwaitUsing(true) ? "await using" : null;
+    if (usingKind) {
+      var init$2 = this.startNode();
+      this.next();
+      if (usingKind === "await using") { this.next(); }
+      this.parseVar(init$2, true, usingKind);
+      this.finishNode(init$2, "VariableDeclaration");
+      return this.parseForAfterInit(node, init$2, awaitAt)
+    }
     var containsEsc = this.containsEsc;
     var refDestructuringErrors = new DestructuringErrors;
     var initPos = this.start;
@@ -1071,6 +1136,20 @@
     return this.parseFor(node, init)
   };
 
+  // Helper method to parse for loop after variable initialization
+  pp$8.parseForAfterInit = function(node, init, awaitAt) {
+    if ((this.type === types$1._in || (this.options.ecmaVersion >= 6 && this.isContextual("of"))) && init.declarations.length === 1) {
+      if (this.options.ecmaVersion >= 9) {
+        if (this.type === types$1._in) {
+          if (awaitAt > -1) { this.unexpected(awaitAt); }
+        } else { node.await = awaitAt > -1; }
+      }
+      return this.parseForIn(node, init)
+    }
+    if (awaitAt > -1) { this.unexpected(awaitAt); }
+    return this.parseFor(node, init)
+  };
+
   pp$8.parseFunctionStatement = function(node, isAsync, declarationPosition) {
     this.next();
     return this.parseFunction(node, FUNC_STATEMENT | (declarationPosition ? 0 : FUNC_HANGING_STATEMENT), false, isAsync)
@@ -1327,6 +1406,8 @@
         decl.init = this.parseMaybeAssign(isFor);
       } else if (!allowMissingInitializer && kind === "const" && !(this.type === types$1._in || (this.options.ecmaVersion >= 6 && this.isContextual("of")))) {
         this.unexpected();
+      } else if (!allowMissingInitializer && (kind === "using" || kind === "await using") && this.options.ecmaVersion >= 17 && this.type !== types$1._in && !this.isContextual("of")) {
+        this.raise(this.lastTokEnd, ("Missing initializer in " + kind + " declaration"));
       } else if (!allowMissingInitializer && decl.id.type !== "Identifier" && !(isFor && (this.type === types$1._in || this.isContextual("of")))) {
         this.raise(this.lastTokEnd, "Complex binding patterns require an initialization value");
       } else {
@@ -1339,7 +1420,10 @@
   };
 
   pp$8.parseVarId = function(decl, kind) {
-    decl.id = this.parseBindingAtom();
+    decl.id = kind === "using" || kind === "await using"
+      ? this.parseIdent()
+      : this.parseBindingAtom();
+
     this.checkLValPattern(decl.id, kind === "var" ? BIND_VAR : BIND_LEXICAL, false);
   };
 
@@ -1558,11 +1642,9 @@
 
     if (this.eat(types$1.eq)) {
       // To raise SyntaxError if 'arguments' exists in the initializer.
-      var scope = this.currentThisScope();
-      var inClassFieldInit = scope.inClassFieldInit;
-      scope.inClassFieldInit = true;
+      this.enterScope(SCOPE_CLASS_FIELD_INIT | SCOPE_SUPER);
       field.value = this.parseMaybeAssign();
-      scope.inClassFieldInit = inClassFieldInit;
+      this.exitScope();
     } else {
       field.value = null;
     }
@@ -1704,6 +1786,8 @@
         { this.checkExport(exports, node.declaration.id, node.declaration.id.start); }
       node.specifiers = [];
       node.source = null;
+      if (this.options.ecmaVersion >= 16)
+        { node.attributes = []; }
     } else { // export { x, y as z } [from '...']
       node.declaration = null;
       node.specifiers = this.parseExportSpecifiers(exports);
@@ -1727,6 +1811,8 @@
         }
 
         node.source = null;
+        if (this.options.ecmaVersion >= 16)
+          { node.attributes = []; }
       }
       this.semicolon();
     }
@@ -3068,7 +3154,8 @@
     var node = this.startNode();
     node.value = value;
     node.raw = this.input.slice(this.start, this.end);
-    if (node.raw.charCodeAt(node.raw.length - 1) === 110) { node.bigint = node.raw.slice(0, -1).replace(/_/g, ""); }
+    if (node.raw.charCodeAt(node.raw.length - 1) === 110)
+      { node.bigint = node.value != null ? node.value.toString() : node.raw.slice(0, -1).replace(/_/g, ""); }
     this.next();
     return this.finishNode(node, "Literal")
   };
@@ -3306,9 +3393,10 @@
   };
 
   pp$5.parseGetterSetter = function(prop) {
-    prop.kind = prop.key.name;
+    var kind = prop.key.name;
     this.parsePropertyName(prop);
     prop.value = this.parseMethod(false);
+    prop.kind = kind;
     var paramCount = prop.kind === "get" ? 0 : 1;
     if (prop.value.params.length !== paramCount) {
       var start = prop.value.start;
@@ -3331,9 +3419,9 @@
       prop.kind = "init";
     } else if (this.options.ecmaVersion >= 6 && this.type === types$1.parenL) {
       if (isPattern) { this.unexpected(); }
-      prop.kind = "init";
       prop.method = true;
       prop.value = this.parseMethod(isGenerator, isAsync);
+      prop.kind = "init";
     } else if (!isPattern && !containsEsc &&
                this.options.ecmaVersion >= 5 && !prop.computed && prop.key.type === "Identifier" &&
                (prop.key.name === "get" || prop.key.name === "set") &&
@@ -3345,7 +3433,6 @@
       this.checkUnreserved(prop.key);
       if (prop.key.name === "await" && !this.awaitIdentPos)
         { this.awaitIdentPos = startPos; }
-      prop.kind = "init";
       if (isPattern) {
         prop.value = this.parseMaybeDefault(startPos, startLoc, this.copyNode(prop.key));
       } else if (this.type === types$1.eq && refDestructuringErrors) {
@@ -3355,6 +3442,7 @@
       } else {
         prop.value = this.copyNode(prop.key);
       }
+      prop.kind = "init";
       prop.shorthand = true;
     } else { this.unexpected(); }
   };
@@ -3530,7 +3618,7 @@
       { this.raiseRecoverable(start, "Cannot use 'yield' as identifier inside a generator"); }
     if (this.inAsync && name === "await")
       { this.raiseRecoverable(start, "Cannot use 'await' as identifier inside an async function"); }
-    if (this.currentThisScope().inClassFieldInit && name === "arguments")
+    if (!(this.currentThisScope().flags & SCOPE_VAR) && name === "arguments")
       { this.raiseRecoverable(start, "Cannot use 'arguments' in class field initializer"); }
     if (this.inClassStaticBlock && (name === "arguments" || name === "await"))
       { this.raise(start, ("Cannot use " + name + " in class static initialization block")); }
@@ -3643,6 +3731,9 @@
   pp$4.raise = function(pos, message) {
     var loc = getLineInfo(this.input, pos);
     message += " (" + loc.line + ":" + loc.column + ")";
+    if (this.sourceFile) {
+      message += " in " + this.sourceFile;
+    }
     var err = new SyntaxError(message);
     err.pos = pos; err.loc = loc; err.raisedAt = this.pos;
     throw err
@@ -3666,8 +3757,6 @@
     this.lexical = [];
     // A list of lexically-declared FunctionDeclaration names in the current lexical scope
     this.functions = [];
-    // A switch to disallow the identifier reference 'arguments'
-    this.inClassFieldInit = false;
   };
 
   // The functions in this module keep track of declared variables in the current scope in order to detect duplicate variable names.
@@ -3737,7 +3826,7 @@
   pp$3.currentVarScope = function() {
     for (var i = this.scopeStack.length - 1;; i--) {
       var scope = this.scopeStack[i];
-      if (scope.flags & SCOPE_VAR) { return scope }
+      if (scope.flags & (SCOPE_VAR | SCOPE_CLASS_FIELD_INIT | SCOPE_CLASS_STATIC_BLOCK)) { return scope }
     }
   };
 
@@ -3745,7 +3834,8 @@
   pp$3.currentThisScope = function() {
     for (var i = this.scopeStack.length - 1;; i--) {
       var scope = this.scopeStack[i];
-      if (scope.flags & SCOPE_VAR && !(scope.flags & SCOPE_ARROW)) { return scope }
+      if (scope.flags & (SCOPE_VAR | SCOPE_CLASS_FIELD_INIT | SCOPE_CLASS_STATIC_BLOCK) &&
+          !(scope.flags & SCOPE_ARROW)) { return scope }
     }
   };
 
@@ -6095,11 +6185,9 @@
   // Please use the [github bug tracker][ghbt] to report issues.
   //
   // [ghbt]: https://github.com/acornjs/acorn/issues
-  //
-  // [walk]: util/walk.js
 
 
-  var version = "8.14.0";
+  var version = "8.15.0";
 
   Parser.acorn = {
     Parser: Parser,
diff --git a/deps/acorn/acorn/dist/acorn.mjs b/deps/acorn/acorn/dist/acorn.mjs
index 43e58efe7f0..74d5fc431be 100644
--- a/deps/acorn/acorn/dist/acorn.mjs
+++ b/deps/acorn/acorn/dist/acorn.mjs
@@ -487,6 +487,7 @@ var
     SCOPE_SUPER = 64,
     SCOPE_DIRECT_SUPER = 128,
     SCOPE_CLASS_STATIC_BLOCK = 256,
+    SCOPE_CLASS_FIELD_INIT = 512,
     SCOPE_VAR = SCOPE_TOP | SCOPE_FUNCTION | SCOPE_CLASS_STATIC_BLOCK;
 
 function functionFlags(async, generator) {
@@ -597,15 +598,16 @@ Parser.prototype.parse = function parse () {
 
 prototypeAccessors.inFunction.get = function () { return (this.currentVarScope().flags & SCOPE_FUNCTION) > 0 };
 
-prototypeAccessors.inGenerator.get = function () { return (this.currentVarScope().flags & SCOPE_GENERATOR) > 0 && !this.currentVarScope().inClassFieldInit };
+prototypeAccessors.inGenerator.get = function () { return (this.currentVarScope().flags & SCOPE_GENERATOR) > 0 };
 
-prototypeAccessors.inAsync.get = function () { return (this.currentVarScope().flags & SCOPE_ASYNC) > 0 && !this.currentVarScope().inClassFieldInit };
+prototypeAccessors.inAsync.get = function () { return (this.currentVarScope().flags & SCOPE_ASYNC) > 0 };
 
 prototypeAccessors.canAwait.get = function () {
   for (var i = this.scopeStack.length - 1; i >= 0; i--) {
-    var scope = this.scopeStack[i];
-    if (scope.inClassFieldInit || scope.flags & SCOPE_CLASS_STATIC_BLOCK) { return false }
-    if (scope.flags & SCOPE_FUNCTION) { return (scope.flags & SCOPE_ASYNC) > 0 }
+    var ref = this.scopeStack[i];
+      var flags = ref.flags;
+    if (flags & (SCOPE_CLASS_STATIC_BLOCK | SCOPE_CLASS_FIELD_INIT)) { return false }
+    if (flags & SCOPE_FUNCTION) { return (flags & SCOPE_ASYNC) > 0 }
   }
   return (this.inModule && this.options.ecmaVersion >= 13) || this.options.allowAwaitOutsideFunction
 };
@@ -613,8 +615,7 @@ prototypeAccessors.canAwait.get = function () {
 prototypeAccessors.allowSuper.get = function () {
   var ref = this.currentThisScope();
     var flags = ref.flags;
-    var inClassFieldInit = ref.inClassFieldInit;
-  return (flags & SCOPE_SUPER) > 0 || inClassFieldInit || this.options.allowSuperOutsideMethod
+  return (flags & SCOPE_SUPER) > 0 || this.options.allowSuperOutsideMethod
 };
 
 prototypeAccessors.allowDirectSuper.get = function () { return (this.currentThisScope().flags & SCOPE_DIRECT_SUPER) > 0 };
@@ -622,10 +623,13 @@ prototypeAccessors.allowDirectSuper.get = function () { return (this.currentThis
 prototypeAccessors.treatFunctionsAsVar.get = function () { return this.treatFunctionsAsVarInScope(this.currentScope()) };
 
 prototypeAccessors.allowNewDotTarget.get = function () {
-  var ref = this.currentThisScope();
-    var flags = ref.flags;
-    var inClassFieldInit = ref.inClassFieldInit;
-  return (flags & (SCOPE_FUNCTION | SCOPE_CLASS_STATIC_BLOCK)) > 0 || inClassFieldInit
+  for (var i = this.scopeStack.length - 1; i >= 0; i--) {
+    var ref = this.scopeStack[i];
+      var flags = ref.flags;
+    if (flags & (SCOPE_CLASS_STATIC_BLOCK | SCOPE_CLASS_FIELD_INIT) ||
+        ((flags & SCOPE_FUNCTION) && !(flags & SCOPE_ARROW))) { return true }
+  }
+  return false
 };
 
 prototypeAccessors.inClassStaticBlock.get = function () {
@@ -877,6 +881,49 @@ pp$8.isAsyncFunction = function() {
      !(isIdentifierChar(after = this.input.charCodeAt(next + 8)) || after > 0xd7ff && after < 0xdc00))
 };
 
+pp$8.isUsingKeyword = function(isAwaitUsing, isFor) {
+  if (this.options.ecmaVersion < 17 || !this.isContextual(isAwaitUsing ? "await" : "using"))
+    { return false }
+
+  skipWhiteSpace.lastIndex = this.pos;
+  var skip = skipWhiteSpace.exec(this.input);
+  var next = this.pos + skip[0].length;
+
+  if (lineBreak.test(this.input.slice(this.pos, next))) { return false }
+
+  if (isAwaitUsing) {
+    var awaitEndPos = next + 5 /* await */, after;
+    if (this.input.slice(next, awaitEndPos) !== "using" ||
+      awaitEndPos === this.input.length ||
+      isIdentifierChar(after = this.input.charCodeAt(awaitEndPos)) ||
+      (after > 0xd7ff && after < 0xdc00)
+    ) { return false }
+
+    skipWhiteSpace.lastIndex = awaitEndPos;
+    var skipAfterUsing = skipWhiteSpace.exec(this.input);
+    if (skipAfterUsing && lineBreak.test(this.input.slice(awaitEndPos, awaitEndPos + skipAfterUsing[0].length))) { return false }
+  }
+
+  if (isFor) {
+    var ofEndPos = next + 2 /* of */, after$1;
+    if (this.input.slice(next, ofEndPos) === "of") {
+      if (ofEndPos === this.input.length ||
+        (!isIdentifierChar(after$1 = this.input.charCodeAt(ofEndPos)) && !(after$1 > 0xd7ff && after$1 < 0xdc00))) { return false }
+    }
+  }
+
+  var ch = this.input.charCodeAt(next);
+  return isIdentifierStart(ch, true) || ch === 92 // '\'
+};
+
+pp$8.isAwaitUsing = function(isFor) {
+  return this.isUsingKeyword(true, isFor)
+};
+
+pp$8.isUsing = function(isFor) {
+  return this.isUsingKeyword(false, isFor)
+};
+
 // Parse a single statement.
 //
 // If expecting a statement and finding a slash operator, parse a
@@ -953,6 +1000,23 @@ pp$8.parseStatement = function(context, topLevel, exports) {
       return this.parseFunctionStatement(node, true, !context)
     }
 
+    var usingKind = this.isAwaitUsing(false) ? "await using" : this.isUsing(false) ? "using" : null;
+    if (usingKind) {
+      if (topLevel && this.options.sourceType === "script") {
+        this.raise(this.start, "Using declaration cannot appear in the top level when source type is `script`");
+      }
+      if (usingKind === "await using") {
+        if (!this.canAwait) {
+          this.raise(this.start, "Await using cannot appear outside of async function");
+        }
+        this.next();
+      }
+      this.next();
+      this.parseVar(node, false, usingKind);
+      this.semicolon();
+      return this.finishNode(node, "VariableDeclaration")
+    }
+
     var maybeName = this.value, expr = this.parseExpression();
     if (starttype === types$1.name && expr.type === "Identifier" && this.eat(types$1.colon))
       { return this.parseLabeledStatement(node, maybeName, expr, context) }
@@ -1028,18 +1092,19 @@ pp$8.parseForStatement = function(node) {
     this.next();
     this.parseVar(init$1, true, kind);
     this.finishNode(init$1, "VariableDeclaration");
-    if ((this.type === types$1._in || (this.options.ecmaVersion >= 6 && this.isContextual("of"))) && init$1.declarations.length === 1) {
-      if (this.options.ecmaVersion >= 9) {
-        if (this.type === types$1._in) {
-          if (awaitAt > -1) { this.unexpected(awaitAt); }
-        } else { node.await = awaitAt > -1; }
-      }
-      return this.parseForIn(node, init$1)
-    }
-    if (awaitAt > -1) { this.unexpected(awaitAt); }
-    return this.parseFor(node, init$1)
+    return this.parseForAfterInit(node, init$1, awaitAt)
   }
   var startsWithLet = this.isContextual("let"), isForOf = false;
+
+  var usingKind = this.isUsing(true) ? "using" : this.isAwaitUsing(true) ? "await using" : null;
+  if (usingKind) {
+    var init$2 = this.startNode();
+    this.next();
+    if (usingKind === "await using") { this.next(); }
+    this.parseVar(init$2, true, usingKind);
+    this.finishNode(init$2, "VariableDeclaration");
+    return this.parseForAfterInit(node, init$2, awaitAt)
+  }
   var containsEsc = this.containsEsc;
   var refDestructuringErrors = new DestructuringErrors;
   var initPos = this.start;
@@ -1065,6 +1130,20 @@ pp$8.parseForStatement = function(node) {
   return this.parseFor(node, init)
 };
 
+// Helper method to parse for loop after variable initialization
+pp$8.parseForAfterInit = function(node, init, awaitAt) {
+  if ((this.type === types$1._in || (this.options.ecmaVersion >= 6 && this.isContextual("of"))) && init.declarations.length === 1) {
+    if (this.options.ecmaVersion >= 9) {
+      if (this.type === types$1._in) {
+        if (awaitAt > -1) { this.unexpected(awaitAt); }
+      } else { node.await = awaitAt > -1; }
+    }
+    return this.parseForIn(node, init)
+  }
+  if (awaitAt > -1) { this.unexpected(awaitAt); }
+  return this.parseFor(node, init)
+};
+
 pp$8.parseFunctionStatement = function(node, isAsync, declarationPosition) {
   this.next();
   return this.parseFunction(node, FUNC_STATEMENT | (declarationPosition ? 0 : FUNC_HANGING_STATEMENT), false, isAsync)
@@ -1321,6 +1400,8 @@ pp$8.parseVar = function(node, isFor, kind, allowMissingInitializer) {
       decl.init = this.parseMaybeAssign(isFor);
     } else if (!allowMissingInitializer && kind === "const" && !(this.type === types$1._in || (this.options.ecmaVersion >= 6 && this.isContextual("of")))) {
       this.unexpected();
+    } else if (!allowMissingInitializer && (kind === "using" || kind === "await using") && this.options.ecmaVersion >= 17 && this.type !== types$1._in && !this.isContextual("of")) {
+      this.raise(this.lastTokEnd, ("Missing initializer in " + kind + " declaration"));
     } else if (!allowMissingInitializer && decl.id.type !== "Identifier" && !(isFor && (this.type === types$1._in || this.isContextual("of")))) {
       this.raise(this.lastTokEnd, "Complex binding patterns require an initialization value");
     } else {
@@ -1333,7 +1414,10 @@ pp$8.parseVar = function(node, isFor, kind, allowMissingInitializer) {
 };
 
 pp$8.parseVarId = function(decl, kind) {
-  decl.id = this.parseBindingAtom();
+  decl.id = kind === "using" || kind === "await using"
+    ? this.parseIdent()
+    : this.parseBindingAtom();
+
   this.checkLValPattern(decl.id, kind === "var" ? BIND_VAR : BIND_LEXICAL, false);
 };
 
@@ -1552,11 +1636,9 @@ pp$8.parseClassField = function(field) {
 
   if (this.eat(types$1.eq)) {
     // To raise SyntaxError if 'arguments' exists in the initializer.
-    var scope = this.currentThisScope();
-    var inClassFieldInit = scope.inClassFieldInit;
-    scope.inClassFieldInit = true;
+    this.enterScope(SCOPE_CLASS_FIELD_INIT | SCOPE_SUPER);
     field.value = this.parseMaybeAssign();
-    scope.inClassFieldInit = inClassFieldInit;
+    this.exitScope();
   } else {
     field.value = null;
   }
@@ -1698,6 +1780,8 @@ pp$8.parseExport = function(node, exports) {
       { this.checkExport(exports, node.declaration.id, node.declaration.id.start); }
     node.specifiers = [];
     node.source = null;
+    if (this.options.ecmaVersion >= 16)
+      { node.attributes = []; }
   } else { // export { x, y as z } [from '...']
     node.declaration = null;
     node.specifiers = this.parseExportSpecifiers(exports);
@@ -1721,6 +1805,8 @@ pp$8.parseExport = function(node, exports) {
       }
 
       node.source = null;
+      if (this.options.ecmaVersion >= 16)
+        { node.attributes = []; }
     }
     this.semicolon();
   }
@@ -3062,7 +3148,8 @@ pp$5.parseLiteral = function(value) {
   var node = this.startNode();
   node.value = value;
   node.raw = this.input.slice(this.start, this.end);
-  if (node.raw.charCodeAt(node.raw.length - 1) === 110) { node.bigint = node.raw.slice(0, -1).replace(/_/g, ""); }
+  if (node.raw.charCodeAt(node.raw.length - 1) === 110)
+    { node.bigint = node.value != null ? node.value.toString() : node.raw.slice(0, -1).replace(/_/g, ""); }
   this.next();
   return this.finishNode(node, "Literal")
 };
@@ -3300,9 +3387,10 @@ pp$5.parseProperty = function(isPattern, refDestructuringErrors) {
 };
 
 pp$5.parseGetterSetter = function(prop) {
-  prop.kind = prop.key.name;
+  var kind = prop.key.name;
   this.parsePropertyName(prop);
   prop.value = this.parseMethod(false);
+  prop.kind = kind;
   var paramCount = prop.kind === "get" ? 0 : 1;
   if (prop.value.params.length !== paramCount) {
     var start = prop.value.start;
@@ -3325,9 +3413,9 @@ pp$5.parsePropertyValue = function(prop, isPattern, isGenerator, isAsync, startP
     prop.kind = "init";
   } else if (this.options.ecmaVersion >= 6 && this.type === types$1.parenL) {
     if (isPattern) { this.unexpected(); }
-    prop.kind = "init";
     prop.method = true;
     prop.value = this.parseMethod(isGenerator, isAsync);
+    prop.kind = "init";
   } else if (!isPattern && !containsEsc &&
              this.options.ecmaVersion >= 5 && !prop.computed && prop.key.type === "Identifier" &&
              (prop.key.name === "get" || prop.key.name === "set") &&
@@ -3339,7 +3427,6 @@ pp$5.parsePropertyValue = function(prop, isPattern, isGenerator, isAsync, startP
     this.checkUnreserved(prop.key);
     if (prop.key.name === "await" && !this.awaitIdentPos)
       { this.awaitIdentPos = startPos; }
-    prop.kind = "init";
     if (isPattern) {
       prop.value = this.parseMaybeDefault(startPos, startLoc, this.copyNode(prop.key));
     } else if (this.type === types$1.eq && refDestructuringErrors) {
@@ -3349,6 +3436,7 @@ pp$5.parsePropertyValue = function(prop, isPattern, isGenerator, isAsync, startP
     } else {
       prop.value = this.copyNode(prop.key);
     }
+    prop.kind = "init";
     prop.shorthand = true;
   } else { this.unexpected(); }
 };
@@ -3524,7 +3612,7 @@ pp$5.checkUnreserved = function(ref) {
     { this.raiseRecoverable(start, "Cannot use 'yield' as identifier inside a generator"); }
   if (this.inAsync && name === "await")
     { this.raiseRecoverable(start, "Cannot use 'await' as identifier inside an async function"); }
-  if (this.currentThisScope().inClassFieldInit && name === "arguments")
+  if (!(this.currentThisScope().flags & SCOPE_VAR) && name === "arguments")
     { this.raiseRecoverable(start, "Cannot use 'arguments' in class field initializer"); }
   if (this.inClassStaticBlock && (name === "arguments" || name === "await"))
     { this.raise(start, ("Cannot use " + name + " in class static initialization block")); }
@@ -3637,6 +3725,9 @@ var pp$4 = Parser.prototype;
 pp$4.raise = function(pos, message) {
   var loc = getLineInfo(this.input, pos);
   message += " (" + loc.line + ":" + loc.column + ")";
+  if (this.sourceFile) {
+    message += " in " + this.sourceFile;
+  }
   var err = new SyntaxError(message);
   err.pos = pos; err.loc = loc; err.raisedAt = this.pos;
   throw err
@@ -3660,8 +3751,6 @@ var Scope = function Scope(flags) {
   this.lexical = [];
   // A list of lexically-declared FunctionDeclaration names in the current lexical scope
   this.functions = [];
-  // A switch to disallow the identifier reference 'arguments'
-  this.inClassFieldInit = false;
 };
 
 // The functions in this module keep track of declared variables in the current scope in order to detect duplicate variable names.
@@ -3731,7 +3820,7 @@ pp$3.currentScope = function() {
 pp$3.currentVarScope = function() {
   for (var i = this.scopeStack.length - 1;; i--) {
     var scope = this.scopeStack[i];
-    if (scope.flags & SCOPE_VAR) { return scope }
+    if (scope.flags & (SCOPE_VAR | SCOPE_CLASS_FIELD_INIT | SCOPE_CLASS_STATIC_BLOCK)) { return scope }
   }
 };
 
@@ -3739,7 +3828,8 @@ pp$3.currentVarScope = function() {
 pp$3.currentThisScope = function() {
   for (var i = this.scopeStack.length - 1;; i--) {
     var scope = this.scopeStack[i];
-    if (scope.flags & SCOPE_VAR && !(scope.flags & SCOPE_ARROW)) { return scope }
+    if (scope.flags & (SCOPE_VAR | SCOPE_CLASS_FIELD_INIT | SCOPE_CLASS_STATIC_BLOCK) &&
+        !(scope.flags & SCOPE_ARROW)) { return scope }
   }
 };
 
@@ -6089,11 +6179,9 @@ pp.readWord = function() {
 // Please use the [github bug tracker][ghbt] to report issues.
 //
 // [ghbt]: https://github.com/acornjs/acorn/issues
-//
-// [walk]: util/walk.js
 
 
-var version = "8.14.0";
+var version = "8.15.0";
 
 Parser.acorn = {
   Parser: Parser,
diff --git a/deps/acorn/acorn/dist/bin.js b/deps/acorn/acorn/dist/bin.js
index 0bf3e5f8d12..c7d9b9f8ed8 100644
--- a/deps/acorn/acorn/dist/bin.js
+++ b/deps/acorn/acorn/dist/bin.js
@@ -77,7 +77,7 @@ function run(codeList) {
     console.error(fileMode ? e.message.replace(/\(\d+:\d+\)$/, function (m) { return m.slice(0, 1) + inputFilePaths[fileIdx] + " " + m.slice(1); }) : e.message);
     process.exit(1);
   }
-  if (!silent) { console.log(JSON.stringify(result, null, compact ? null : 2)); }
+  if (!silent) { console.log(JSON.stringify(result, function (_, value) { return typeof value === "bigint" ? null : value; }, compact ? null : 2)); }
 }
 
 if (fileMode = inputFilePaths.length && (forceFileName || !inputFilePaths.includes("-") || inputFilePaths.length !== 1)) {
diff --git a/deps/acorn/acorn/package.json b/deps/acorn/acorn/package.json
index 795cf83eff6..6f63ddbf620 100644
--- a/deps/acorn/acorn/package.json
+++ b/deps/acorn/acorn/package.json
@@ -16,7 +16,7 @@
     ],
     "./package.json": "./package.json"
   },
-  "version": "8.14.0",
+  "version": "8.15.0",
   "engines": {
     "node": ">=0.4.0"
   },
diff --git a/deps/cjs-module-lexer/LICENSE b/deps/cjs-module-lexer/LICENSE
index b31c17aa33c..935b357962d 100644
--- a/deps/cjs-module-lexer/LICENSE
+++ b/deps/cjs-module-lexer/LICENSE
@@ -1,10 +1,10 @@
-MIT License
------------
-
-Copyright (C) 2018-2020 Guy Bedford
-
-Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+MIT License
+-----------
+
+Copyright (C) 2018-2020 Guy Bedford
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/deps/cjs-module-lexer/README.md b/deps/cjs-module-lexer/README.md
index 2af01279ed2..addf5edc6b1 100644
--- a/deps/cjs-module-lexer/README.md
+++ b/deps/cjs-module-lexer/README.md
@@ -1,462 +1,483 @@
-# CJS Module Lexer
-
-[![Build Status][travis-image]][travis-url]
-
-A [very fast](#benchmarks) JS CommonJS module syntax lexer used to detect the most likely list of named exports of a CommonJS module.
-
-Outputs the list of named exports (`exports.name = ...`) and possible module reexports (`module.exports = require('...')`), including the common transpiler variations of these cases.
-
-Forked from https://github.com/guybedford/es-module-lexer.
-
-_Comprehensively handles the JS language grammar while remaining small and fast. - ~90ms per MB of JS cold and ~15ms per MB of JS warm, [see benchmarks](#benchmarks) for more info._
-
-### Project Status
-
-This project is used in Node.js core for detecting the named exports available when importing a CJS module into ESM, and is maintained for this purpose.
-
-PRs will be accepted and upstreamed for parser bugs, performance improvements or new syntax support only.
-
-_Detection patterns for this project are **frozen**_. This is because adding any new export detection patterns would result in fragmented backwards-compatibility. Specifically, it would be very difficult to figure out why an ES module named export for CommonJS might work in newer Node.js versions but not older versions. This problem would only be discovered downstream of module authors, with the fix for module authors being to then have to understand which patterns in this project provide full backwards-compatibily. Rather, by fully freezing the detected patterns, if it works in any Node.js version it will work in any other. Build tools can also reliably treat the supported syntax for this project as a part of their output target for ensuring syntax support.
-
-### Usage
-
-```
-npm install cjs-module-lexer
-```
-
-For use in CommonJS:
-
-```js
-const { parse } = require('cjs-module-lexer');
-
-// `init` return a promise for parity with the ESM API, but you do not have to call it
-
-const { exports, reexports } = parse(`
-  // named exports detection
-  module.exports.a = 'a';
-  (function () {
-    exports.b = 'b';
-  })();
-  Object.defineProperty(exports, 'c', { value: 'c' });
-  /* exports.d = 'not detected'; */
-
-  // reexports detection
-  if (maybe) module.exports = require('./dep1.js');
-  if (another) module.exports = require('./dep2.js');
-
-  // literal exports assignments
-  module.exports = { a, b: c, d, 'e': f }
-
-  // __esModule detection
-  Object.defineProperty(module.exports, '__esModule', { value: true })
-`);
-
-// exports === ['a', 'b', 'c', '__esModule']
-// reexports === ['./dep1.js', './dep2.js']
-```
-
-When using the ESM version, Wasm is supported instead:
-
-```js
-import { parse, init } from 'cjs-module-lexer';
-// init() needs to be called and waited upon, or use initSync() to compile
-// Wasm blockingly and synchronously.
-await init();
-const { exports, reexports } = parse(source);
-```
-
-The Wasm build is around 1.5x faster and without a cold start.
-
-### Grammar
-
-CommonJS exports matches are run against the source token stream.
-
-The token grammar is:
-
-```
-IDENTIFIER: As defined by ECMA-262, without support for identifier `\` escapes, filtered to remove strict reserved words:
-            "implements", "interface", "let", "package", "private", "protected", "public", "static", "yield", "enum"
-
-STRING_LITERAL: A `"` or `'` bounded ECMA-262 string literal.
-
-MODULE_EXPORTS: `module` `.` `exports`
-
-EXPORTS_IDENTIFIER: MODULE_EXPORTS_IDENTIFIER | `exports`
-
-EXPORTS_DOT_ASSIGN: EXPORTS_IDENTIFIER `.` IDENTIFIER `=`
-
-EXPORTS_LITERAL_COMPUTED_ASSIGN: EXPORTS_IDENTIFIER `[` STRING_LITERAL `]` `=`
-
-EXPORTS_LITERAL_PROP: (IDENTIFIER  (`:` IDENTIFIER)?) | (STRING_LITERAL `:` IDENTIFIER)
-
-EXPORTS_SPREAD: `...` (IDENTIFIER | REQUIRE)
-
-EXPORTS_MEMBER: EXPORTS_DOT_ASSIGN | EXPORTS_LITERAL_COMPUTED_ASSIGN
-
-EXPORTS_DEFINE: `Object` `.` `defineProperty `(` EXPORTS_IDENFITIER `,` STRING_LITERAL
-
-EXPORTS_DEFINE_VALUE: EXPORTS_DEFINE `, {`
-  (`enumerable: true,`)?
-  (
-    `value:` |
-    `get` (`: function` IDENTIFIER? )?  `() {` return IDENTIFIER (`.` IDENTIFIER | `[` STRING_LITERAL `]`)? `;`? `}` `,`?
-  )
-  `})`
-
-EXPORTS_LITERAL: MODULE_EXPORTS `=` `{` (EXPORTS_LITERAL_PROP | EXPORTS_SPREAD) `,`)+ `}`
-
-REQUIRE: `require` `(` STRING_LITERAL `)`
-
-EXPORTS_ASSIGN: (`var` | `const` | `let`) IDENTIFIER `=` (`_interopRequireWildcard (`)? REQUIRE
-
-MODULE_EXPORTS_ASSIGN: MODULE_EXPORTS `=` REQUIRE
-
-EXPORT_STAR: (`__export` | `__exportStar`) `(` REQUIRE
-
-EXPORT_STAR_LIB: `Object.keys(` IDENTIFIER$1 `).forEach(function (` IDENTIFIER$2 `) {`
-  (
-    (
-      `if (` IDENTIFIER$2 `===` ( `'default'` | `"default"` ) `||` IDENTIFIER$2 `===` ( '__esModule' | `"__esModule"` ) `) return` `;`?
-      (
-        (`if (Object` `.prototype`? `.hasOwnProperty.call(`  IDENTIFIER `, ` IDENTIFIER$2 `)) return` `;`?)?
-        (`if (` IDENTIFIER$2 `in` EXPORTS_IDENTIFIER `&&` EXPORTS_IDENTIFIER `[` IDENTIFIER$2 `] ===` IDENTIFIER$1 `[` IDENTIFIER$2 `]) return` `;`)?
-      )?
-    ) |
-    `if (` IDENTIFIER$2 `!==` ( `'default'` | `"default"` ) (`&& !` (`Object` `.prototype`? `.hasOwnProperty.call(`  IDENTIFIER `, ` IDENTIFIER$2 `)` | IDENTIFIER `.hasOwnProperty(` IDENTIFIER$2 `)`))? `)`
-  )
-  (
-    EXPORTS_IDENTIFIER `[` IDENTIFIER$2 `] =` IDENTIFIER$1 `[` IDENTIFIER$2 `]` `;`? |
-    `Object.defineProperty(` EXPORTS_IDENTIFIER `, ` IDENTIFIER$2 `, { enumerable: true, get` (`: function` IDENTIFIER? )?  `() { return ` IDENTIFIER$1 `[` IDENTIFIER$2 `]` `;`? `}` `,`? `})` `;`?
-  )
-  `})`
-```
-
-Spacing between tokens is taken to be any ECMA-262 whitespace, ECMA-262 block comment or ECMA-262 line comment.
-
-* The returned export names are taken to be the combination of:
-  1. All `IDENTIFIER` and `STRING_LITERAL` slots for `EXPORTS_MEMBER` and `EXPORTS_LITERAL` matches.
-  2. The first `STRING_LITERAL` slot for all `EXPORTS_DEFINE_VALUE` matches where that same string is not an `EXPORTS_DEFINE` match that is not also an `EXPORTS_DEFINE_VALUE` match.
-* The reexport specifiers are taken to be the combination of:
-  1. The `REQUIRE` matches of the last matched of either `MODULE_EXPORTS_ASSIGN` or `EXPORTS_LITERAL`.
-  2. All _top-level_ `EXPORT_STAR` `REQUIRE` matches and `EXPORTS_ASSIGN` matches whose `IDENTIFIER` also matches the first `IDENTIFIER` in `EXPORT_STAR_LIB`.
-
-### Parsing Examples
-
-#### Named Exports Parsing
-
-The basic matching rules for named exports are `exports.name`, `exports['name']` or `Object.defineProperty(exports, 'name', ...)`. This matching is done without scope analysis and regardless of the expression position:
-
-```js
-// DETECTS EXPORTS: a, b
-(function (exports) {
-  exports.a = 'a'; 
-  exports['b'] = 'b';
-})(exports);
-```
-
-Because there is no scope analysis, the above detection may overclassify:
-
-```js
-// DETECTS EXPORTS: a, b, c
-(function (exports, Object) {
-  exports.a = 'a';
-  exports['b'] = 'b';
-  if (false)
-    exports.c = 'c';
-})(NOT_EXPORTS, NOT_OBJECT);
-```
-
-It will in turn underclassify in cases where the identifiers are renamed:
-
-```js
-// DETECTS: NO EXPORTS
-(function (e) {
-  e.a = 'a';
-  e['b'] = 'b';
-})(exports);
-```
-
-#### Getter Exports Parsing
-
-`Object.defineProperty` is detected for specifically value and getter forms returning an identifier or member expression:
-
-```js
-// DETECTS: a, b, c, d, __esModule
-Object.defineProperty(exports, 'a', {
-  enumerable: true,
-  get: function () {
-    return q.p;
-  }
-});
-Object.defineProperty(exports, 'b', {
-  enumerable: true,
-  get: function () {
-    return q['p'];
-  }
-});
-Object.defineProperty(exports, 'c', {
-  enumerable: true,
-  get () {
-    return b;
-  }
-});
-Object.defineProperty(exports, 'd', { value: 'd' });
-Object.defineProperty(exports, '__esModule', { value: true });
-```
-
-Value properties are also detected specifically:
-
-```js
-Object.defineProperty(exports, 'a', {
-  value: 'no problem'
-});
-```
-
-To avoid matching getters that have side effects, any getter for an export name that does not support the forms above will
-opt-out of the getter matching:
-
-```js
-// DETECTS: NO EXPORTS
-Object.defineProperty(exports, 'a', {
-  get () {
-    return 'nope';
-  }
-});
-
-if (false) {
-  Object.defineProperty(module.exports, 'a', {
-    get () {
-      return dynamic();
-    }
-  })
-}
-```
-
-Alternative object definition structures or getter function bodies are not detected:
-
-```js
-// DETECTS: NO EXPORTS
-Object.defineProperty(exports, 'a', {
-  enumerable: false,
-  get () {
-    return p;
-  }
-});
-Object.defineProperty(exports, 'b', {
-  configurable: true,
-  get () {
-    return p;
-  }
-});
-Object.defineProperty(exports, 'c', {
-  get: () => p
-});
-Object.defineProperty(exports, 'd', {
-  enumerable: true,
-  get: function () {
-    return dynamic();
-  }
-});
-Object.defineProperty(exports, 'e', {
-  enumerable: true,
-  get () {
-    return 'str';
-  }
-});
-```
-
-`Object.defineProperties` is also not supported.
-
-#### Exports Object Assignment
-
-A best-effort is made to detect `module.exports` object assignments, but because this is not a full parser, arbitrary expressions are not handled in the
-object parsing process.
-
-Simple object definitions are supported:
-
-```js
-// DETECTS EXPORTS: a, b, c
-module.exports = {
-  a,
-  'b': b,
-  c: c,
-  ...d
-};
-```
-
-Object properties that are not identifiers or string expressions will bail out of the object detection, while spreads are ignored:
-
-```js
-// DETECTS EXPORTS: a, b
-module.exports = {
-  a,
-  ...d,
-  b: require('c'),
-  c: "not detected since require('c') above bails the object detection"
-}
-```
-
-`Object.defineProperties` is not currently supported either.
-
-#### module.exports reexport assignment
-
-Any `module.exports = require('mod')` assignment is detected as a reexport, but only the last one is returned:
-
-```js
-// DETECTS REEXPORTS: c
-module.exports = require('a');
-(module => module.exports = require('b'))(NOT_MODULE);
-if (false) module.exports = require('c');
-```
-
-This is to avoid over-classification in Webpack bundles with externals which include `module.exports = require('external')` in their source for every external dependency.
-
-In exports object assignment, any spread of `require()` are detected as multiple separate reexports:
-
-```js
-// DETECTS REEXPORTS: a, b
-module.exports = require('ignored');
-module.exports = {
-  ...require('a'),
-  ...require('b')
-};
-```
-
-#### Transpiler Re-exports
-
-For named exports, transpiler output works well with the rules described above.
-
-But for star re-exports, special care is taken to support common patterns of transpiler outputs from Babel and TypeScript as well as bundlers like RollupJS.
-These reexport and star reexport patterns are restricted to only be detected at the top-level as provided by the direct output of these tools.
-
-For example, `export * from 'external'` is output by Babel as:
-
-```js
-"use strict";
-
-exports.__esModule = true;
-
-var _external = require("external");
-
-Object.keys(_external).forEach(function (key) {
-  if (key === "default" || key === "__esModule") return;
-  exports[key] = _external[key];
-});
-```
-
-Where the `var _external = require("external")` is specifically detected as well as the `Object.keys(_external)` statement, down to the exact
-for of that entire expression including minor variations of the output. The `_external` and `key` identifiers are carefully matched in this
-detection.
-
-Similarly for TypeScript, `export * from 'external'` is output as:
-
-```js
-"use strict";
-function __export(m) {
-    for (var p in m) if (!exports.hasOwnProperty(p)) exports[p] = m[p];
-}
-Object.defineProperty(exports, "__esModule", { value: true });
-__export(require("external"));
-```
-
-Where the `__export(require("external"))` statement is explicitly detected as a reexport, including variations `tslib.__export` and `__exportStar`.
-
-### Environment Support
-
-Node.js 10+, and [all browsers with Web Assembly support](https://caniuse.com/#feat=wasm).
-
-### JS Grammar Support
-
-* Token state parses all line comments, block comments, strings, template strings, blocks, parens and punctuators.
-* Division operator / regex token ambiguity is handled via backtracking checks against punctuator prefixes, including closing brace or paren backtracking.
-* Always correctly parses valid JS source, but may parse invalid JS source without errors.
-
-### Benchmarks
-
-Benchmarks can be run with `npm run bench`.
-
-Current results:
-
-JS Build:
-
-```
-Module load time
-> 4ms
-Cold Run, All Samples
-test/samples/*.js (3635 KiB)
-> 299ms
-
-Warm Runs (average of 25 runs)
-test/samples/angular.js (1410 KiB)
-> 13.96ms
-test/samples/angular.min.js (303 KiB)
-> 4.72ms
-test/samples/d3.js (553 KiB)
-> 6.76ms
-test/samples/d3.min.js (250 KiB)
-> 4ms
-test/samples/magic-string.js (34 KiB)
-> 0.64ms
-test/samples/magic-string.min.js (20 KiB)
-> 0ms
-test/samples/rollup.js (698 KiB)
-> 8.48ms
-test/samples/rollup.min.js (367 KiB)
-> 5.36ms
-
-Warm Runs, All Samples (average of 25 runs)
-test/samples/*.js (3635 KiB)
-> 40.28ms
-```
-
-Wasm Build:
-```
-Module load time
-> 10ms
-Cold Run, All Samples
-test/samples/*.js (3635 KiB)
-> 43ms
-
-Warm Runs (average of 25 runs)
-test/samples/angular.js (1410 KiB)
-> 9.32ms
-test/samples/angular.min.js (303 KiB)
-> 3.16ms
-test/samples/d3.js (553 KiB)
-> 5ms
-test/samples/d3.min.js (250 KiB)
-> 2.32ms
-test/samples/magic-string.js (34 KiB)
-> 0.16ms
-test/samples/magic-string.min.js (20 KiB)
-> 0ms
-test/samples/rollup.js (698 KiB)
-> 6.28ms
-test/samples/rollup.min.js (367 KiB)
-> 3.6ms
-
-Warm Runs, All Samples (average of 25 runs)
-test/samples/*.js (3635 KiB)
-> 27.76ms
-```
-
-### Wasm Build Steps
-
-To build download the WASI SDK from https://github.com/WebAssembly/wasi-sdk/releases.
-
-The Makefile assumes the existence of "wasi-sdk-11.0" and "wabt" (optional) as sibling folders to this project.
-
-The build through the Makefile is then run via `make lib/lexer.wasm`, which can also be triggered via `npm run build-wasm` to create `dist/lexer.js`.
-
-On Windows it may be preferable to use the Linux subsystem.
-
-After the Web Assembly build, the CJS build can be triggered via `npm run build`.
-
-Optimization passes are run with [Binaryen](https://github.com/WebAssembly/binaryen) prior to publish to reduce the Web Assembly footprint.
-
-### License
-
-MIT
-
-[travis-url]: https://travis-ci.org/guybedford/es-module-lexer
-[travis-image]: https://travis-ci.org/guybedford/es-module-lexer.svg?branch=master
+# CJS Module Lexer
+
+[![Build Status][travis-image]][travis-url]
+
+A [very fast](#benchmarks) JS CommonJS module syntax lexer used to detect the most likely list of named exports of a CommonJS module.
+
+Outputs the list of named exports (`exports.name = ...`) and possible module reexports (`module.exports = require('...')`), including the common transpiler variations of these cases.
+
+Forked from https://github.com/guybedford/es-module-lexer.
+
+_Comprehensively handles the JS language grammar while remaining small and fast. - ~90ms per MB of JS cold and ~15ms per MB of JS warm, [see benchmarks](#benchmarks) for more info._
+
+### Project Status
+
+This project is used in Node.js core for detecting the named exports available when importing a CJS module into ESM, and is maintained for this purpose.
+
+PRs will be accepted and upstreamed for parser bugs, performance improvements or new syntax support only.
+
+_Detection patterns for this project are **frozen**_. This is because adding any new export detection patterns would result in fragmented backwards-compatibility. Specifically, it would be very difficult to figure out why an ES module named export for CommonJS might work in newer Node.js versions but not older versions. This problem would only be discovered downstream of module authors, with the fix for module authors being to then have to understand which patterns in this project provide full backwards-compatibily. Rather, by fully freezing the detected patterns, if it works in any Node.js version it will work in any other. Build tools can also reliably treat the supported syntax for this project as a part of their output target for ensuring syntax support.
+
+### Usage
+
+```
+npm install cjs-module-lexer
+```
+
+For use in CommonJS:
+
+```js
+const { parse } = require('cjs-module-lexer');
+
+// `init` return a promise for parity with the ESM API, but you do not have to call it
+
+const { exports, reexports } = parse(`
+  // named exports detection
+  module.exports.a = 'a';
+  (function () {
+    exports.b = 'b';
+  })();
+  Object.defineProperty(exports, 'c', { value: 'c' });
+  /* exports.d = 'not detected'; */
+
+  // reexports detection
+  if (maybe) module.exports = require('./dep1.js');
+  if (another) module.exports = require('./dep2.js');
+
+  // literal exports assignments
+  module.exports = { a, b: c, d, 'e': f }
+
+  // __esModule detection
+  Object.defineProperty(module.exports, '__esModule', { value: true })
+`);
+
+// exports === ['a', 'b', 'c', '__esModule']
+// reexports === ['./dep1.js', './dep2.js']
+```
+
+When using the ESM version, Wasm is supported instead:
+
+```js
+import { parse, init } from 'cjs-module-lexer';
+// init() needs to be called and waited upon, or use initSync() to compile
+// Wasm blockingly and synchronously.
+await init();
+const { exports, reexports } = parse(source);
+```
+
+The Wasm build is around 1.5x faster and without a cold start.
+
+### Grammar
+
+CommonJS exports matches are run against the source token stream.
+
+The token grammar is:
+
+```
+IDENTIFIER: As defined by ECMA-262, without support for identifier `\` escapes, filtered to remove strict reserved words:
+            "implements", "interface", "let", "package", "private", "protected", "public", "static", "yield", "enum"
+
+STRING_LITERAL: A `"` or `'` bounded ECMA-262 string literal.
+
+MODULE_EXPORTS: `module` `.` `exports`
+
+EXPORTS_IDENTIFIER: MODULE_EXPORTS_IDENTIFIER | `exports`
+
+EXPORTS_DOT_ASSIGN: EXPORTS_IDENTIFIER `.` IDENTIFIER `=`
+
+EXPORTS_LITERAL_COMPUTED_ASSIGN: EXPORTS_IDENTIFIER `[` STRING_LITERAL `]` `=`
+
+EXPORTS_LITERAL_PROP: (IDENTIFIER  (`:` IDENTIFIER)?) | (STRING_LITERAL `:` IDENTIFIER)
+
+EXPORTS_SPREAD: `...` (IDENTIFIER | REQUIRE)
+
+EXPORTS_MEMBER: EXPORTS_DOT_ASSIGN | EXPORTS_LITERAL_COMPUTED_ASSIGN
+
+EXPORTS_DEFINE: `Object` `.` `defineProperty `(` EXPORTS_IDENFITIER `,` STRING_LITERAL
+
+EXPORTS_DEFINE_VALUE: EXPORTS_DEFINE `, {`
+  (`enumerable: true,`)?
+  (
+    `value:` |
+    `get` (`: function` IDENTIFIER? )?  `() {` return IDENTIFIER (`.` IDENTIFIER | `[` STRING_LITERAL `]`)? `;`? `}` `,`?
+  )
+  `})`
+
+EXPORTS_LITERAL: MODULE_EXPORTS `=` `{` (EXPORTS_LITERAL_PROP | EXPORTS_SPREAD) `,`)+ `}`
+
+REQUIRE: `require` `(` STRING_LITERAL `)`
+
+EXPORTS_ASSIGN: (`var` | `const` | `let`) IDENTIFIER `=` (`_interopRequireWildcard (`)? REQUIRE
+
+MODULE_EXPORTS_ASSIGN: MODULE_EXPORTS `=` REQUIRE
+
+EXPORT_STAR: (`__export` | `__exportStar`) `(` REQUIRE
+
+EXPORT_STAR_LIB: `Object.keys(` IDENTIFIER$1 `).forEach(function (` IDENTIFIER$2 `) {`
+  (
+    (
+      `if (` IDENTIFIER$2 `===` ( `'default'` | `"default"` ) `||` IDENTIFIER$2 `===` ( '__esModule' | `"__esModule"` ) `) return` `;`?
+      (
+        (`if (Object` `.prototype`? `.hasOwnProperty.call(`  IDENTIFIER `, ` IDENTIFIER$2 `)) return` `;`?)?
+        (`if (` IDENTIFIER$2 `in` EXPORTS_IDENTIFIER `&&` EXPORTS_IDENTIFIER `[` IDENTIFIER$2 `] ===` IDENTIFIER$1 `[` IDENTIFIER$2 `]) return` `;`)?
+      )?
+    ) |
+    `if (` IDENTIFIER$2 `!==` ( `'default'` | `"default"` ) (`&& !` (`Object` `.prototype`? `.hasOwnProperty.call(`  IDENTIFIER `, ` IDENTIFIER$2 `)` | IDENTIFIER `.hasOwnProperty(` IDENTIFIER$2 `)`))? `)`
+  )
+  (
+    EXPORTS_IDENTIFIER `[` IDENTIFIER$2 `] =` IDENTIFIER$1 `[` IDENTIFIER$2 `]` `;`? |
+    `Object.defineProperty(` EXPORTS_IDENTIFIER `, ` IDENTIFIER$2 `, { enumerable: true, get` (`: function` IDENTIFIER? )?  `() { return ` IDENTIFIER$1 `[` IDENTIFIER$2 `]` `;`? `}` `,`? `})` `;`?
+  )
+  `})`
+```
+
+Spacing between tokens is taken to be any ECMA-262 whitespace, ECMA-262 block comment or ECMA-262 line comment.
+
+* The returned export names are taken to be the combination of:
+  1. All `IDENTIFIER` and `STRING_LITERAL` slots for `EXPORTS_MEMBER` and `EXPORTS_LITERAL` matches.
+  2. The first `STRING_LITERAL` slot for all `EXPORTS_DEFINE_VALUE` matches where that same string is not an `EXPORTS_DEFINE` match that is not also an `EXPORTS_DEFINE_VALUE` match.
+* The reexport specifiers are taken to be the combination of:
+  1. The `REQUIRE` matches of the last matched of either `MODULE_EXPORTS_ASSIGN` or `EXPORTS_LITERAL`.
+  2. All _top-level_ `EXPORT_STAR` `REQUIRE` matches and `EXPORTS_ASSIGN` matches whose `IDENTIFIER` also matches the first `IDENTIFIER` in `EXPORT_STAR_LIB`.
+
+### Parsing Examples
+
+#### Named Exports Parsing
+
+The basic matching rules for named exports are `exports.name`, `exports['name']` or `Object.defineProperty(exports, 'name', ...)`. This matching is done without scope analysis and regardless of the expression position:
+
+```js
+// DETECTS EXPORTS: a, b
+(function (exports) {
+  exports.a = 'a'; 
+  exports['b'] = 'b';
+})(exports);
+```
+
+Because there is no scope analysis, the above detection may overclassify:
+
+```js
+// DETECTS EXPORTS: a, b, c
+(function (exports, Object) {
+  exports.a = 'a';
+  exports['b'] = 'b';
+  if (false)
+    exports.c = 'c';
+})(NOT_EXPORTS, NOT_OBJECT);
+```
+
+It will in turn underclassify in cases where the identifiers are renamed:
+
+```js
+// DETECTS: NO EXPORTS
+(function (e) {
+  e.a = 'a';
+  e['b'] = 'b';
+})(exports);
+```
+
+#### Getter Exports Parsing
+
+`Object.defineProperty` is detected for specifically value and getter forms returning an identifier or member expression:
+
+```js
+// DETECTS: a, b, c, d, __esModule
+Object.defineProperty(exports, 'a', {
+  enumerable: true,
+  get: function () {
+    return q.p;
+  }
+});
+Object.defineProperty(exports, 'b', {
+  enumerable: true,
+  get: function () {
+    return q['p'];
+  }
+});
+Object.defineProperty(exports, 'c', {
+  enumerable: true,
+  get () {
+    return b;
+  }
+});
+Object.defineProperty(exports, 'd', { value: 'd' });
+Object.defineProperty(exports, '__esModule', { value: true });
+```
+
+Value properties are also detected specifically:
+
+```js
+Object.defineProperty(exports, 'a', {
+  value: 'no problem'
+});
+```
+
+To avoid matching getters that have side effects, any getter for an export name that does not support the forms above will
+opt-out of the getter matching:
+
+```js
+// DETECTS: NO EXPORTS
+Object.defineProperty(exports, 'a', {
+  get () {
+    return 'nope';
+  }
+});
+
+if (false) {
+  Object.defineProperty(module.exports, 'a', {
+    get () {
+      return dynamic();
+    }
+  })
+}
+```
+
+Alternative object definition structures or getter function bodies are not detected:
+
+```js
+// DETECTS: NO EXPORTS
+Object.defineProperty(exports, 'a', {
+  enumerable: false,
+  get () {
+    return p;
+  }
+});
+Object.defineProperty(exports, 'b', {
+  configurable: true,
+  get () {
+    return p;
+  }
+});
+Object.defineProperty(exports, 'c', {
+  get: () => p
+});
+Object.defineProperty(exports, 'd', {
+  enumerable: true,
+  get: function () {
+    return dynamic();
+  }
+});
+Object.defineProperty(exports, 'e', {
+  enumerable: true,
+  get () {
+    return 'str';
+  }
+});
+```
+
+`Object.defineProperties` is also not supported.
+
+#### Exports Object Assignment
+
+A best-effort is made to detect `module.exports` object assignments, but because this is not a full parser, arbitrary expressions are not handled in the
+object parsing process.
+
+Simple object definitions are supported:
+
+```js
+// DETECTS EXPORTS: a, b, c
+module.exports = {
+  a,
+  'b': b,
+  c: c,
+  ...d
+};
+```
+
+Object properties that are not identifiers or string expressions will bail out of the object detection, while spreads are ignored:
+
+```js
+// DETECTS EXPORTS: a, b
+module.exports = {
+  a,
+  ...d,
+  b: require('c'),
+  c: "not detected since require('c') above bails the object detection"
+}
+```
+
+`Object.defineProperties` is not currently supported either.
+
+#### module.exports reexport assignment
+
+Any `module.exports = require('mod')` assignment is detected as a reexport, but only the last one is returned:
+
+```js
+// DETECTS REEXPORTS: c
+module.exports = require('a');
+(module => module.exports = require('b'))(NOT_MODULE);
+if (false) module.exports = require('c');
+```
+
+This is to avoid over-classification in Webpack bundles with externals which include `module.exports = require('external')` in their source for every external dependency.
+
+In exports object assignment, any spread of `require()` are detected as multiple separate reexports:
+
+```js
+// DETECTS REEXPORTS: a, b
+module.exports = require('ignored');
+module.exports = {
+  ...require('a'),
+  ...require('b')
+};
+```
+
+#### Transpiler Re-exports
+
+For named exports, transpiler output works well with the rules described above.
+
+But for star re-exports, special care is taken to support common patterns of transpiler outputs from Babel and TypeScript as well as bundlers like RollupJS.
+These reexport and star reexport patterns are restricted to only be detected at the top-level as provided by the direct output of these tools.
+
+For example, `export * from 'external'` is output by Babel as:
+
+```js
+"use strict";
+
+exports.__esModule = true;
+
+var _external = require("external");
+
+Object.keys(_external).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  exports[key] = _external[key];
+});
+```
+
+Where the `var _external = require("external")` is specifically detected as well as the `Object.keys(_external)` statement, down to the exact
+for of that entire expression including minor variations of the output. The `_external` and `key` identifiers are carefully matched in this
+detection.
+
+Similarly for TypeScript, `export * from 'external'` is output as:
+
+```js
+"use strict";
+function __export(m) {
+    for (var p in m) if (!exports.hasOwnProperty(p)) exports[p] = m[p];
+}
+Object.defineProperty(exports, "__esModule", { value: true });
+__export(require("external"));
+```
+
+Where the `__export(require("external"))` statement is explicitly detected as a reexport, including variations `tslib.__export` and `__exportStar`.
+
+### Environment Support
+
+Node.js 10+, and [all browsers with Web Assembly support](https://caniuse.com/#feat=wasm).
+
+### JS Grammar Support
+
+* Token state parses all line comments, block comments, strings, template strings, blocks, parens and punctuators.
+* Division operator / regex token ambiguity is handled via backtracking checks against punctuator prefixes, including closing brace or paren backtracking.
+* Always correctly parses valid JS source, but may parse invalid JS source without errors.
+
+### Benchmarks
+
+Benchmarks can be run with `npm run bench`.
+
+Current results:
+
+JS Build:
+
+```
+Module load time
+> 4ms
+Cold Run, All Samples
+test/samples/*.js (3635 KiB)
+> 299ms
+
+Warm Runs (average of 25 runs)
+test/samples/angular.js (1410 KiB)
+> 13.96ms
+test/samples/angular.min.js (303 KiB)
+> 4.72ms
+test/samples/d3.js (553 KiB)
+> 6.76ms
+test/samples/d3.min.js (250 KiB)
+> 4ms
+test/samples/magic-string.js (34 KiB)
+> 0.64ms
+test/samples/magic-string.min.js (20 KiB)
+> 0ms
+test/samples/rollup.js (698 KiB)
+> 8.48ms
+test/samples/rollup.min.js (367 KiB)
+> 5.36ms
+
+Warm Runs, All Samples (average of 25 runs)
+test/samples/*.js (3635 KiB)
+> 40.28ms
+```
+
+Wasm Build:
+```
+Module load time
+> 10ms
+Cold Run, All Samples
+test/samples/*.js (3635 KiB)
+> 43ms
+
+Warm Runs (average of 25 runs)
+test/samples/angular.js (1410 KiB)
+> 9.32ms
+test/samples/angular.min.js (303 KiB)
+> 3.16ms
+test/samples/d3.js (553 KiB)
+> 5ms
+test/samples/d3.min.js (250 KiB)
+> 2.32ms
+test/samples/magic-string.js (34 KiB)
+> 0.16ms
+test/samples/magic-string.min.js (20 KiB)
+> 0ms
+test/samples/rollup.js (698 KiB)
+> 6.28ms
+test/samples/rollup.min.js (367 KiB)
+> 3.6ms
+
+Warm Runs, All Samples (average of 25 runs)
+test/samples/*.js (3635 KiB)
+> 27.76ms
+```
+
+### Wasm Build Steps
+
+The build uses docker and make, they must be installed first.
+
+To build the lexer wasm run `npm run build-wasm`.
+
+Optimization passes are run with [Binaryen](https://github.com/WebAssembly/binaryen)
+prior to publish to reduce the Web Assembly footprint.
+
+After building the lexer wasm, build the final distribution components
+(lexer.js and lexer.mjs) by running `npm run build`.
+
+If you need to build lib/lexer.wat (optional) you must first install
+[wabt](https://github.com/WebAssembly/wabt) as a sibling folder to this
+project. The wat file is then build by running `make lib/lexer.wat`
+
+### Creating a Release
+These are the steps to create and publish a release. You will need docker
+installed as well as having installed [wabt](https://github.com/WebAssembly/wabt)
+as outlined above:
+
+- [ ] Figure out if the release should be semver patch, minor or major based on the changes since
+  the last release and determine the new version.
+- [ ] Update the package.json version, and run a full build and test
+  - npm install
+  - npm run build
+  - npm run test
+- [ ] Commit and tag the changes, pushing up to main and the tag
+  - For example
+    - `git tag -a 1.4.2 -m "1.4.2"`
+    - `git push origin tag 1.4.2`
+- [ ] Create the GitHub release
+- [ ] Run npm publish from an account with access (asking somebody with access
+      the nodejs-foundation account is an option if you don't have access.
+      
+### License
+
+MIT
+
+[travis-url]: https://travis-ci.org/guybedford/es-module-lexer
+[travis-image]: https://travis-ci.org/guybedford/es-module-lexer.svg?branch=master
diff --git a/deps/cjs-module-lexer/dist/lexer-external.js b/deps/cjs-module-lexer/dist/lexer-external.js
deleted file mode 100644
index 1e5f49de622..00000000000
--- a/deps/cjs-module-lexer/dist/lexer-external.js
+++ /dev/null
@@ -1,91 +0,0 @@
-"use strict";
-
-exports.init = init;
-exports.parse = parse;
-let wasm;
-const isLE = new Uint8Array(new Uint16Array([1]).buffer)[0] === 1;
-function parse(source, name = '@') {
-  if (!wasm) throw new Error('Not initialized');
-  const len = source.length + 1;
-
-  // need 2 bytes per code point plus analysis space so we double again
-  const extraMem = (wasm.__heap_base.value || wasm.__heap_base) + len * 4 - wasm.memory.buffer.byteLength;
-  if (extraMem > 0) wasm.memory.grow(Math.ceil(extraMem / 65536));
-  const addr = wasm.sa(len);
-  (isLE ? copyLE : copyBE)(source, new Uint16Array(wasm.memory.buffer, addr, len));
-  const err_code = wasm.parseCJS(addr, source.length, 0, 0, 0);
-  if (err_code) {
-    const err = new Error(`Parse error ${name}${wasm.e()}:${source.slice(0, wasm.e()).split('\n').length}:${wasm.e() - source.lastIndexOf('\n', wasm.e() - 1)}`);
-    Object.assign(err, {
-      idx: wasm.e()
-    });
-    if (err_code === 5 || err_code === 6 || err_code === 7) Object.assign(err, {
-      code: 'ERR_LEXER_ESM_SYNTAX'
-    });
-    throw err;
-  }
-  let exports = new Set(),
-    reexports = new Set(),
-    unsafeGetters = new Set();
-  while (wasm.rre()) {
-    const reexptStr = decode(source.slice(wasm.res(), wasm.ree()));
-    if (reexptStr) reexports.add(reexptStr);
-  }
-  while (wasm.ru()) unsafeGetters.add(decode(source.slice(wasm.us(), wasm.ue())));
-  while (wasm.re()) {
-    let exptStr = decode(source.slice(wasm.es(), wasm.ee()));
-    if (exptStr !== undefined && !unsafeGetters.has(exptStr)) exports.add(exptStr);
-  }
-  return {
-    exports: [...exports],
-    reexports: [...reexports]
-  };
-}
-function decode(str) {
-  if (str[0] === '"' || str[0] === '\'') {
-    try {
-      const decoded = (0, eval)(str);
-      // Filter to exclude non-matching UTF-16 surrogate strings
-      for (let i = 0; i < decoded.length; i++) {
-        const surrogatePrefix = decoded.charCodeAt(i) & 0xFC00;
-        if (surrogatePrefix < 0xD800) {
-          // Not a surrogate
-          continue;
-        } else if (surrogatePrefix === 0xD800) {
-          // Validate surrogate pair
-          if ((decoded.charCodeAt(++i) & 0xFC00) !== 0xDC00) return;
-        } else {
-          // Out-of-range surrogate code (above 0xD800)
-          return;
-        }
-      }
-      return decoded;
-    } catch {}
-  } else {
-    return str;
-  }
-}
-function copyBE(src, outBuf16) {
-  const len = src.length;
-  let i = 0;
-  while (i < len) {
-    const ch = src.charCodeAt(i);
-    outBuf16[i++] = (ch & 0xff) << 8 | ch >>> 8;
-  }
-}
-function copyLE(src, outBuf16) {
-  const len = src.length;
-  let i = 0;
-  while (i < len) outBuf16[i] = src.charCodeAt(i++);
-}
-let initPromise;
-function init() {
-  if (initPromise) return initPromise;
-  return initPromise = (async () => {
-    const compiled = await WebAssembly.compile((await import('node:fs')).readFileSync(new URL(import.meta.resolve('../lib/lexer.wasm'))));
-    const {
-      exports
-    } = await WebAssembly.instantiate(compiled);
-    wasm = exports;
-  })();
-}
\ No newline at end of file
diff --git a/deps/cjs-module-lexer/dist/lexer.js b/deps/cjs-module-lexer/dist/lexer.js
index 7c9b7124ae2..d59aaf1bc47 100644
--- a/deps/cjs-module-lexer/dist/lexer.js
+++ b/deps/cjs-module-lexer/dist/lexer.js
@@ -1 +1 @@
-"use strict";exports.init=init;exports.initSync=initSync;exports.parse=parse;let A;const Q=1===new Uint8Array(new Uint16Array([1]).buffer)[0];function parse(g,I="@"){if(!A)throw new Error("Not initialized");const D=g.length+1,N=(A.__heap_base.value||A.__heap_base)+4*D-A.memory.buffer.byteLength;N>0&&A.memory.grow(Math.ceil(N/65536));const k=A.sa(D);(Q?C:E)(g,new Uint16Array(A.memory.buffer,k,D));const w=A.parseCJS(k,g.length,0,0,0);if(w){const Q=new Error(`Parse error ${I}${A.e()}:${g.slice(0,A.e()).split("\n").length}:${A.e()-g.lastIndexOf("\n",A.e()-1)}`);throw Object.assign(Q,{idx:A.e()}),5!==w&&6!==w&&7!==w||Object.assign(Q,{code:"ERR_LEXER_ESM_SYNTAX"}),Q}let H=new Set,J=new Set,o=new Set;for(;A.rre();){const Q=B(g.slice(A.res(),A.ree()));Q&&J.add(Q)}for(;A.ru();)o.add(B(g.slice(A.us(),A.ue())));for(;A.re();){let Q=B(g.slice(A.es(),A.ee()));void 0===Q||o.has(Q)||H.add(Q)}return{exports:[...H],reexports:[...J]}}function B(A){if('"'!==A[0]&&"'"!==A[0])return A;try{const Q=(0,eval)(A);for(let A=0;A<Q.length;A++){const B=64512&Q.charCodeAt(A);if(!(B<55296)){if(55296!==B)return;if(56320!=(64512&Q.charCodeAt(++A)))return}}return Q}catch{}}function E(A,Q){const B=A.length;let E=0;for(;E<B;){const B=A.charCodeAt(E);Q[E++]=(255&B)<<8|B>>>8}}function C(A,Q){const B=A.length;let E=0;for(;E<B;)Q[E]=A.charCodeAt(E++)}function g(){const A="AGFzbQEAAAABrAERYAJ/fwBgAABgAX8Bf2AAAX9gBn9/f39/fwF/YAF/AGAXf39/f39/f39/f39/f39/f39/f39/f38Bf2AIf39/f39/f38Bf2AHf39/f39/fwF/YAN/f38Bf2AFf39/f38Bf2AOf39/f39/f39/f39/f38Bf2AKf39/f39/f39/fwF/YAt/f39/f39/f39/fwF/YAJ/fwF/YAR/f39/AX9gCX9/f39/f39/fwF/A0NCAgMDAwMDAwMDAwMAAAABBAICBQQBBgcBBQEFBQUBAQICAgIBAQIIAwICAgkKAgELAgwNDgQPCA4HAgICAhACAgMJBAUBcAEFBQUDAQABBg8CfwFB0JgCC38AQdCYAgsHXA4GbWVtb3J5AgACc2EAAAFlAAECZXMAAgJlZQADA3JlcwAEA3JlZQAFAnVzAAYCdWUABwJyZQAIA3JyZQAJAnJ1AAoIcGFyc2VDSlMADwtfX2hlYXBfYmFzZQMBCQoBAEEBCwQLDA0OCt2fAUJ4AQF/QQAoApgfIgEgAEEBdGoiAEEAOwEAQQAgAEECaiIANgLkH0EAIAA2AugfQQBBADYCwB9BAEEANgLIH0EAQQA2AsQfQQBBADYCzB9BAEEANgLUH0EAQQA2AtAfQQBBADYC2B9BAEEANgLgH0EAQQA2AtwfIAELCABBACgC7B8LFQBBACgCxB8oAgBBACgCmB9rQQF1CxUAQQAoAsQfKAIEQQAoApgfa0EBdQsVAEEAKALQHygCAEEAKAKYH2tBAXULFQBBACgC0B8oAgRBACgCmB9rQQF1CxUAQQAoAtwfKAIAQQAoApgfa0EBdQsVAEEAKALcHygCBEEAKAKYH2tBAXULJQEBf0EAQQAoAsQfIgBBCGpBwB8gABsoAgAiADYCxB8gAEEARwslAQF/QQBBACgC0B8iAEEIakHMHyAAGygCACIANgLQHyAAQQBHCyUBAX9BAEEAKALcHyIAQQhqQdgfIAAbKAIAIgA2AtwfIABBAEcLSAEBf0EAKALIHyICQQhqQcAfIAIbQQAoAugfIgI2AgBBACACNgLIH0EAIAJBDGo2AugfIAJBADYCCCACIAE2AgQgAiAANgIAC0gBAX9BACgC1B8iAkEIakHMHyACG0EAKALoHyICNgIAQQAgAjYC1B9BACACQQxqNgLoHyACQQA2AgggAiABNgIEIAIgADYCAAtIAQF/QQAoAuAfIgJBCGpB2B8gAhtBACgC6B8iAjYCAEEAIAI2AuAfQQAgAkEMajYC6B8gAkEANgIIIAIgATYCBCACIAA2AgALEgBBAEEANgLMH0EAQQA2AtQfC50PAEEAIAE2AoBAQQAgADYCmB8CQCACRQ0AQQAgAjYCnB8LAkAgA0UNAEEAIAM2AqAfCwJAIARFDQBBACAENgKkHwtBAEH//wM7AYhAQQBBoMAANgKgYEEAQbDgADYCsKABQQBBgCA2ArSgAUEAQQAoAqwfNgKMQEEAIABBfmoiAjYCvKABQQAgAiABQQF0aiIDNgLAoAFBAEEAOwGGQEEAQQA7AYRAQQBBADoAkEBBAEEANgLsH0EAQQA2AvAfQQBBADoAuKABAkACQCAALwEAQSNHDQAgAC8BAkEhRw0AQQAhAiABQQJGDQFBACAAQQJqNgK8oAEgAEEEaiEAAkADQCAAIgJBfmogA08NASACQQJqIQAgAi8BAEF2ag4EAQAAAQALC0EAIAI2ArygAQsDQEEAIAJBAmoiADYCvKABAkACQAJAAkACQAJAIAIgA08NAAJAIAAvAQAiAUF3aiIDQRdLDQBBASADdEGfgIAEcQ0GCwJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkBBAC8BhkAiAw0AAkACQAJAIAFBoX9qDg8CEBUVBhUFFRUVARUVFQQACwJAIAFBWWoOCQ4ICRUVFRUVDwALAkAgAUGFf2oOAwsVDAALIAFBIkYNDSABQc8ARg0GIAFB8gBHDRQCQEEAEBBFDQAgABARRQ0AIAIQEgtBAEEAKAK8oAE2AoxADBULAkAgAkEEakHtAEHwAEHvAEHyAEH0ABATRQ0AIAAQEUUNABAUQQAoArygASEAC0EAIAA2AoxADBQLAkACQCACQQRqIgNB6QBB7gBB9ABB5QBB8gBB7wBB8ABB0gBB5QBB8QBB9QBB6QBB8gBB5QBB1wBB6QBB7ABB5ABB4wBB4QBB8gBB5AAQFUUNAAJAIAAQEQ0AIAIvAQBBLkcNAQtBACACQTBqNgK8oAEgAi8BMEEoRw0BQQAgAkEyajYCvKABQQBBATsBhkBBACgCsKABQQAoAoxANgIAQQAQEEUNASAAEBFFDQEgAhASDAELIANB3wBB5QBB+ABB8ABB7wBB8gBB9AAQFkUNAAJAIAAQEQ0AIAIvAQBBLkcNAQtBACACQRJqNgK8oAECQCACLwESIgNB0wBHDQAgAi8BFEH0AEcNASACLwEWQeEARw0BIAIvARhB8gBHDQFBACACQRpqNgK8oAEgAi8BGiEDCyADQf//A3FBKEcNAEEAKAKwoAFBACgCjEA2AgBBAEEBOwGGQEEAQQAoArygASICQQJqNgK8oAEgAi8BAkHyAEcNAEECEBAaC0EAQQAoArygATYCjEAMEwsCQCABQVlqDgkLBQcSEhISEgwACwJAIAFBoH9qDgYNEhIDEgIACwJAIAFBhX9qDgMIEgoACyABQSJGDQogAUHPAEYNAyABQe0ARw0RCyACQQRqQe8AQeQAQfUAQewAQeUAEBNFDRAgABARRQ0QEBcMEAsgAkEEakH4AEHwAEHvAEHyAEH0ABATRQ0PIAAQEUUNDwJAIAIvAQ5B8wBHDQBBABAYDBALIAMNDxAZDA8LIAAQEUUNDiACLwEEQewARw0OIAIvAQZB4QBHDQ4gAi8BCEHzAEcNDiACLwEKQfMARw0OIAIvAQwiA0F3aiICQRdLDQxBASACdEGfgIAEcUUNDAwNCyACQQRqQeIAQeoAQeUAQeMAQfQAEBNFDQ0gABARRQ0NIANFEBoMDQtBACADQQFqOwGGQEEAKAKwoAEgA0ECdGpBACgCjEA2AgAMDAtBCBAbQQAoAvAfDwtBACADQX9qOwGGQAwKCyADQdCgAWpBAC0AuKABOgAAQQAgA0EBajsBhkBBACgCsKABIANBAnRqQQAoAoxANgIAQQBBADoAuKABDAkLQQIQG0EADwtBACADQX9qIgA7AYZAAkAgA0EALwGIQCICRw0AQQBBAC8BhEBBf2oiAjsBhEBBAEEAKAKgYCACQf//A3FBAXRqLwEAOwGIQAwFCyACQf//A0YNByAAQf//A3EgAk8NB0EDEBtBACgC8B8PCyABEBwMBgsCQAJAIAIvAQQiAkEqRg0AIAJBL0cNARAdDAgLEB4MBwsCQAJAAkACQEEAKAKMQCIALwEAIgIQH0UNAAJAAkACQCACQVVqDgQBBQIABQsgAEF+ai8BAEFQakH//wNxQQpJDQMMBAsgAEF+ai8BAEErRg0CDAMLIABBfmovAQBBLUYNAQwCCwJAAkAgAkH9AEYNACACQS9GDQEgAkEpRw0CQQAoArCgASADQQJ0aigCABAgRQ0CDAMLQQAoArCgASADQQJ0aigCABAhDQIgA0HQoAFqLQAARQ0BDAILQQAtAJBADQELIAAQIiEDIAJFDQBBASECIANFDQELECNBACECC0EAIAI6AJBADAULQQAvAYhAQf7/A0cNAUEEEBtBACgC8B8PC0EAIQICQAJAQQAvAYhAQf//A0YNAEEAKALwHyEDDAELQQAoAvAfIQNBAC8BhkANACADRQ0HCyADIQIMBgsQJAwCCyADQaABRw0BC0EAQQE6ALigAQtBAEEAKAK8oAE2AoxAC0EAKALAoAEhA0EAKAK8oAEhAgwACwsgAgvuAQEEf0EAIQECQEEAKAK8oAEiAkECakHlAEHxAEH1AEHpAEHyAEHlABAmRQ0AQQAhAUEAIAJBDmo2ArygAQJAECdBKEcNAEEAQQAoArygAUECajYCvKABECchA0EAKAK8oAEhBAJAIANBJ0YNACADQSJHDQELIAMQHEEAQQAoArygAUECaiIDNgK8oAEQJ0EpRw0AAkACQAJAIABBf2oOAgEAAgsgBCADQQAoAqAfEQAAQQEPCyAEIANBACgCoB8RAABBAQ8LQQAoArSgASAENgIAQQAoArSgASADNgIEQQEPC0EAIAI2ArygAQsgAQsdAAJAQQAoApgfIABHDQBBAQ8LIABBfmovAQAQJQv1AgEEf0EAKAKYHyEBAkADQCAAQX5qIQIgAC8BACIDQSBHDQEgACABSyEEIAIhACAEDQALCwJAIANBPUcNAAJAA0AgAkF+aiEAIAIvAQBBIEcNASACIAFLIQQgACECIAQNAAsLIABBAmohAiAAQQRqIQNBACEEAkADQCACECghACACIAFNDQEgAEUNASAAQdwARg0CIAAQKUUNASACQX5BfCAAQYCABEkbaiECIAAQKiEEDAALCyAEQQFxRQ0AIAIvAQBBIEcNAEEAKAK0oAEiBEEAKAKwH0YNACAEIAM2AgwgBCACQQJqNgIIIAJBfmohAEEgIQICQANAIABBAmogAU0NASACQf//A3FBIEcNASAALwEAIQIgAEF+aiEADAALCwJAAkACQCACQf//A3FBjn9qDgMAAwEDCyAAQfYAQeEAECsNAQwCCyAAQewAQeUAECsNACAAQeMAQe8AQe4AQfMAECxFDQELQQAgBEEQajYCtKABCws/AQF/QQAhBgJAIAAvAQAgAUcNACAALwECIAJHDQAgAC8BBCADRw0AIAAvAQYgBEcNACAALwEIIAVGIQYLIAYLowEBA39BAEEAKAK8oAEiAEEMaiIBNgK8oAECQAJAAkACQAJAAkACQBAnIgJBWWoOCAIDAQIBAQEEAAsgAkEiRg0BIAJB+wBGDQELQQAoArygASABRg0EC0EALwGGQEUNAkEAQQAoArygAUF+ajYCvKABDwtBAEEALwGGQCICQQFqOwGGQEEAKAKwoAEgAkECdGogADYCAA8LQQUQGw8LQQYQGwsL6QEBAX9BACEXAkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUcNACAALwEKIAZHDQAgAC8BDCAHRw0AIAAvAQ4gCEcNACAALwEQIAlHDQAgAC8BEiAKRw0AIAAvARQgC0cNACAALwEWIAxHDQAgAC8BGCANRw0AIAAvARogDkcNACAALwEcIA9HDQAgAC8BHiAQRw0AIAAvASAgEUcNACAALwEiIBJHDQAgAC8BJCATRw0AIAAvASYgFEcNACAALwEoIBVHDQAgAC8BKiAWRiEXCyAXC1MBAX9BACEIAkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUcNACAALwEKIAZHDQAgAC8BDCAHRiEICyAIC2wBAX9BAEEAKAK8oAEiAEEMajYCvKABAkAQJ0EuRw0AQQBBACgCvKABQQJqNgK8oAEQJ0HlAEcNAEEAKAK8oAFBAmpB+ABB8ABB7wBB8gBB9ABB8wAQJkUNAEEBEBgPC0EAIABBCmo2ArygAQu2AgECf0EAQQAoArygASIBQQ5qNgK8oAECQAJAAkAQJyICQdsARg0AIAJBPUYNASACQS5HDQJBAEEAKAK8oAFBAmo2ArygARAnIQJBACgCvKABIQAgAhAtRQ0CQQAoArygASECECdBPUcNAiAAIAJBACgCnB8RAAAPC0EAQQAoArygAUECajYCvKABAkAQJyICQSdGDQAgAkEiRw0CC0EAKAK8oAEhACACEBxBAEEAKAK8oAFBAmoiAjYCvKABECdB3QBHDQFBAEEAKAK8oAFBAmo2ArygARAnQT1HDQEgACACQQAoApwfEQAADAELIABFDQBBACgCqB8RAQBBAEEAKAK8oAFBAmo2ArygAQJAECciAkHyAEYNACACQfsARw0BEC4PC0EBEBAaC0EAIAFBDGo2ArygAQs4AQJ/QQBBACgCvKABQQxqIgA2ArygARAnIQECQAJAQQAoArygASAARw0AIAEQP0UNAQtBBxAbCwukJgEIf0EAQQAoArygASIBQQxqNgK8oAEgAUEKaiEBAkAQJ0EuRw0AQQBBACgCvKABQQJqNgK8oAECQAJAECciAkHkAEcNAEEAKAK8oAEiAEECakHlAEHmAEHpAEHuAEHlAEHQAEHyAEHvAEHwAEHlAEHyAEH0AEH5ABAvRQ0CQQAgAEEcajYCvKABIABBGmohARAnQShHDQJBAEEAKAK8oAFBAmo2ArygARAnEDBFDQIQJ0EsRw0CQQBBACgCvKABQQJqNgK8oAECQBAnIgBBJ0YNACAAQSJHDQMLQQAoArygASECIAAQHEEAQQAoArygAUECaiIANgK8oAEQJ0EsRw0BQQBBACgCvKABQQJqNgK8oAEQJ0H7AEcNAUEAQQAoArygAUECajYCvKABAkAQJyIDQeUARw0AQQAoArygASIDQQJqQe4AQfUAQe0AQeUAQfIAQeEAQeIAQewAQeUAEDFFDQJBACADQRRqNgK8oAEQJ0E6Rw0CQQBBACgCvKABQQJqNgK8oAEQJ0H0AEcNAkEAKAK8oAEiAy8BAkHyAEcNAiADLwEEQfUARw0CIAMvAQZB5QBHDQJBACADQQhqNgK8oAEQJ0EsRw0CQQBBACgCvKABQQJqNgK8oAEQJyEDCwJAIANB5wBGDQAgA0H2AEcNAkEAKAK8oAEiAy8BAkHhAEcNAiADLwEEQewARw0CIAMvAQZB9QBHDQIgAy8BCEHlAEcNAkEAIANBCmo2ArygARAnQTpHDQIgAiAAQQAoApwfEQAAQQAgATYCvKABDwtBACgCvKABIgMvAQJB5QBHDQEgAy8BBEH0AEcNAUEAIANBBmo2ArygAQJAECciA0E6Rw0AQQBBACgCvKABQQJqNgK8oAEQJ0HmAEcNAkEAKAK8oAEiA0ECakH1AEHuAEHjAEH0AEHpAEHvAEHuABAWRQ0CQQAgA0EQaiIDNgK8oAECQBAnIgRBKEYNACADQQAoArygAUYNAyAEEC1FDQMLECchAwsgA0EoRw0BQQBBACgCvKABQQJqNgK8oAEQJ0EpRw0BQQBBACgCvKABQQJqNgK8oAEQJ0H7AEcNAUEAQQAoArygAUECajYCvKABECdB8gBHDQFBACgCvKABIgNBAmpB5QBB9ABB9QBB8gBB7gAQE0UNAUEAIANBDGo2ArygARAnEC1FDQECQAJAAkAQJyIDQdsARg0AIANBLkcNAkEAQQAoArygAUECajYCvKABECcQLQ0BDAQLQQBBACgCvKABQQJqNgK8oAECQBAnIgNBJ0YNACADQSJHDQQLIAMQHEEAQQAoArygAUECajYCvKABECdB3QBHDQNBAEEAKAK8oAFBAmo2ArygAQsQJyEDCwJAIANBO0cNAEEAQQAoArygAUECajYCvKABECchAwsgA0H9AEcNAUEAQQAoArygAUECajYCvKABAkAQJyIDQSxHDQBBAEEAKAK8oAFBAmo2ArygARAnIQMLIANB/QBHDQFBAEEAKAK8oAFBAmo2ArygARAnQSlHDQEgAiAAQQAoApwfEQAADwsgAkHrAEcNASAARQ0BQQAoArygASIALwECQeUARw0BIAAvAQRB+QBHDQEgAC8BBkHzAEcNASAAQQZqIQFBACAAQQhqNgK8oAEQJ0EoRw0BQQBBACgCvKABQQJqNgK8oAEQJyEAQQAoArygASECIAAQLUUNAUEAKAK8oAEhABAnQSlHDQFBAEEAKAK8oAEiAUECajYCvKABECdBLkcNAUEAQQAoArygAUECajYCvKABECdB5gBHDQFBACgCvKABIgNBAmpB7wBB8gBBxQBB4QBB4wBB6AAQJkUNAUEAIANBDmo2ArygARAnIQNBACgCvKABIgRBfmohASADQShHDQFBACAEQQJqNgK8oAEQJ0HmAEcNAUEAKAK8oAEiA0ECakH1AEHuAEHjAEH0AEHpAEHvAEHuABAWRQ0BQQAgA0EQajYCvKABECdBKEcNAUEAQQAoArygAUECajYCvKABECchA0EAKAK8oAEhBCADEC1FDQFBACgCvKABIQMQJ0EpRw0BQQBBACgCvKABQQJqNgK8oAEQJ0H7AEcNAUEAQQAoArygAUECajYCvKABECdB6QBHDQFBACgCvKABIgUvAQJB5gBHDQFBACAFQQRqNgK8oAEQJ0EoRw0BQQBBACgCvKABQQJqNgK8oAEQJxpBACgCvKABIgUgBCADIARrIgMQQQ0BIAAgAmsiBkEBdSEHQQAgBSADQQF1IghBAXRqNgK8oAECQAJAAkAQJyIAQSFGDQAgAEE9Rw0EQQAoArygASIALwECQT1HDQQgAC8BBEE9Rw0EQQAgAEEGajYCvKABAkAQJyIAQSdGDQAgAEEiRw0FC0EAKAK8oAEiBUECakHkAEHlAEHmAEHhAEH1AEHsAEH0ABAWRQ0EQQAgBUEQajYCvKABECcgAEcNBEEAQQAoArygAUECajYCvKABECdB/ABHDQRBACgCvKABIgAvAQJB/ABHDQRBACAAQQRqNgK8oAEQJxpBACgCvKABIgAgBCADEEENBEEAIAAgCEEBdGo2ArygARAnQT1HDQRBACgCvKABIgAvAQJBPUcNBCAALwEEQT1HDQRBACAAQQZqNgK8oAECQBAnIgBBJ0YNACAAQSJHDQULQQAoArygASIFQQJqQd8AQd8AQeUAQfMAQc0AQe8AQeQAQfUAQewAQeUAEDJFDQRBACAFQRZqNgK8oAEQJyAARw0EQQBBACgCvKABQQJqNgK8oAEQJ0EpRw0EQQBBACgCvKABQQJqNgK8oAEQJ0HyAEcNBEEAKAK8oAEiAEECakHlAEH0AEH1AEHyAEHuABATRQ0EQQAgAEEMajYCvKABAkAQJ0E7Rw0AQQBBACgCvKABQQJqNgK8oAELECciAEHpAEcNAkHpACEAQQAoArygASIFLwECQeYARw0CQQAgBUEEajYCvKABECdBKEcNBEEAQQAoArygAUECaiIANgK8oAECQCAEIAgQM0UNABAnQSlHDQVBAEEAKAK8oAFBAmo2ArygARAnQfIARw0FQQAoArygASIAQQJqQeUAQfQAQfUAQfIAQe4AEBNFDQVBACAAQQxqNgK8oAECQBAnQTtHDQBBAEEAKAK8oAFBAmo2ArygAQsQJyIAQekARw0DQekAIQBBACgCvKABIgUvAQJB5gBHDQNBACAFQQRqNgK8oAEQJ0EoRw0FQQAoArygAUECaiEAC0EAIAA2ArygASAAIAQgAxBBDQRBACAAIAhBAXRqNgK8oAEQJ0HpAEcNBEEAKAK8oAEiAC8BAkHuAEcNBCAALwEEQSBHDQRBACAAQQZqNgK8oAEQJxAwRQ0EECdBJkcNBEEAKAK8oAEiAC8BAkEmRw0EQQAgAEEEajYCvKABECcQMEUNBBAnQdsARw0EQQBBACgCvKABQQJqNgK8oAEQJxpBACgCvKABIgAgBCADEEENBEEAIAAgCEEBdGo2ArygARAnQd0ARw0EQQBBACgCvKABQQJqNgK8oAEQJ0E9Rw0EQQAoArygASIALwECQT1HDQQgAC8BBEE9Rw0EQQAgAEEGajYCvKABECcaQQAoArygASIAIAIgBhBBDQRBACAAIAdBAXRqNgK8oAEQJ0HbAEcNBEEAQQAoArygAUECajYCvKABECcaQQAoArygASIAIAQgAxBBDQRBACAAIAhBAXRqNgK8oAEQJ0HdAEcNBEEAQQAoArygAUECajYCvKABECdBKUcNBEEAQQAoArygAUECajYCvKABECdB8gBHDQRBACgCvKABIgBBAmpB5QBB9ABB9QBB8gBB7gAQE0UNBEEAIABBDGo2ArygARAnQTtHDQFBAEEAKAK8oAFBAmo2ArygAQwBC0EAKAK8oAEiAC8BAkE9Rw0DIAAvAQRBPUcNA0EAIABBBmo2ArygAQJAECciAEEnRg0AIABBIkcNBAtBACgCvKABIgVBAmpB5ABB5QBB5gBB4QBB9QBB7ABB9AAQFkUNA0EAIAVBEGo2ArygARAnIABHDQNBAEEAKAK8oAFBAmo2ArygAQJAECciAEEmRw0AQQAoArygASIALwECQSZHDQRBACAAQQRqNgK8oAEQJ0EhRw0EQQBBACgCvKABQQJqNgK8oAECQAJAECciAEHPAEcNAEEAKAK8oAFBAmpB4gBB6gBB5QBB4wBB9ABBLhAmRQ0AIAQgCBAzRQ0GDAELIAAQLUUNABAnQS5HDQVBAEEAKAK8oAFBAmo2ArygARAnQegARw0FQQAoArygASIAQQJqQeEAQfMAQc8AQfcAQe4AQdAAQfIAQe8AQfAAQeUAQfIAQfQAQfkAEC9FDQVBACAAQRxqNgK8oAEQJ0EoRw0FQQBBACgCvKABQQJqNgK8oAEQJxpBACgCvKABIgAgBCADEEENBUEAIAAgCEEBdGo2ArygARAnQSlHDQVBAEEAKAK8oAFBAmo2ArygAQsQJyEACyAAQSlHDQNBAEEAKAK8oAFBAmo2ArygAQsQJyEACwJAAkACQCAAEDBFDQAQJ0HbAEcNBEEAQQAoArygAUECajYCvKABECcaQQAoArygASIAIAQgAxBBDQRBACAAIAhBAXRqNgK8oAEQJ0HdAEcNBEEAQQAoArygAUECajYCvKABECdBPUcNBEEAQQAoArygAUECajYCvKABECcaQQAoArygASIAIAIgBhBBDQRBACAAIAdBAXRqNgK8oAEQJ0HbAEcNBEEAQQAoArygAUECajYCvKABECcaQQAoArygASIAIAQgAxBBDQRBACAAIAhBAXRqNgK8oAEQJ0HdAEcNBEEAQQAoArygAUECajYCvKABECciAEE7Rw0CQQBBACgCvKABQQJqNgK8oAEMAQsgAEHPAEcNA0EAKAK8oAEiAEECakHiAEHqAEHlAEHjAEH0ABATRQ0DQQAgAEEMajYCvKABECdBLkcNA0EAQQAoArygAUECajYCvKABECdB5ABHDQNBACgCvKABIgBBAmpB5QBB5gBB6QBB7gBB5QBB0ABB8gBB7wBB8ABB5QBB8gBB9ABB+QAQL0UNA0EAIABBHGo2ArygARAnQShHDQNBAEEAKAK8oAFBAmo2ArygARAnEDBFDQMQJ0EsRw0DQQBBACgCvKABQQJqNgK8oAEQJxpBACgCvKABIgAgBCADEEENA0EAIAAgCEEBdGo2ArygARAnQSxHDQNBAEEAKAK8oAFBAmo2ArygARAnQfsARw0DQQBBACgCvKABQQJqNgK8oAEQJ0HlAEcNA0EAKAK8oAEiAEECakHuAEH1AEHtAEHlAEHyAEHhAEHiAEHsAEHlABAxRQ0DQQAgAEEUajYCvKABECdBOkcNA0EAQQAoArygAUECajYCvKABECchBUEAKAK8oAEhAAJAIAVB9ABGDQAgAC8BAkHyAEcNBCAALwEEQfUARw0EIAAvAQZB5QBHDQQLQQAgAEEIajYCvKABECdBLEcNA0EAQQAoArygAUECajYCvKABECdB5wBHDQNBACgCvKABIgAvAQJB5QBHDQMgAC8BBEH0AEcNA0EAIABBBmo2ArygAQJAECciAEE6Rw0AQQBBACgCvKABQQJqNgK8oAEQJ0HmAEcNBEEAKAK8oAEiAEECakH1AEHuAEHjAEH0AEHpAEHvAEHuABAWRQ0EQQAgAEEQaiIANgK8oAECQBAnIgVBKEYNACAAQQAoArygAUYNBSAFEC1FDQULECchAAsgAEEoRw0DQQBBACgCvKABQQJqNgK8oAEQJ0EpRw0DQQBBACgCvKABQQJqNgK8oAEQJ0H7AEcNA0EAQQAoArygAUECajYCvKABECdB8gBHDQNBACgCvKABIgBBAmpB5QBB9ABB9QBB8gBB7gAQE0UNA0EAIABBDGo2ArygARAnGkEAKAK8oAEiACACIAYQQQ0DQQAgACAHQQF0ajYCvKABECdB2wBHDQNBAEEAKAK8oAFBAmo2ArygARAnGkEAKAK8oAEiACAEIAMQQQ0DQQAgACAIQQF0ajYCvKABECdB3QBHDQNBAEEAKAK8oAFBAmo2ArygAQJAECciAEE7Rw0AQQBBACgCvKABQQJqNgK8oAEQJyEACyAAQf0ARw0DQQBBACgCvKABQQJqNgK8oAECQBAnIgBBLEcNAEEAQQAoArygAUECajYCvKABECchAAsgAEH9AEcNA0EAQQAoArygAUECajYCvKABECdBKUcNA0EAQQAoArygAUECajYCvKABECciAEE7Rw0BQQBBACgCvKABQQJqNgK8oAELECchAAsgAEH9AEcNAUEAQQAoArygAUECajYCvKABECdBKUcNAUEAKAK0oAEhBEGAICEAA0ACQAJAIAQgAEYNACAHIABBDGooAgAgAEEIaigCACIDa0EBdUcNASACIAMgBhBBDQEgACgCACAAQQRqKAIAQQAoAqAfEQAAQQAgATYCvKABCw8LIABBEGohAAwACwsgAiAAQQAoAqQfEQAAC0EAIAE2ArygAQtBAAJAQQAoAvAfDQBBACAANgLwHwtBACgCvKABIQBBAEEAKALAoAFBAmo2ArygAUEAIABBACgCmB9rQQF1NgLsHwuOAQEEf0EAKAK8oAEhAUEAKALAoAEhAgJAAkADQCABIgNBAmohASADIAJPDQEgAS8BACIEIABGDQICQCAEQdwARg0AIARBdmoOBAIBAQIBCyADQQRqIQEgAy8BBEENRw0AIANBBmogASADLwEGQQpGGyEBDAALC0EAIAE2ArygAUEJEBsPC0EAIAE2ArygAQtKAQN/QQAoArygAUECaiEAQQAoAsCgASEBAkADQCAAIgJBfmogAU8NASACQQJqIQAgAi8BAEF2ag4EAQAAAQALC0EAIAI2ArygAQt8AQJ/QQBBACgCvKABIgBBAmo2ArygASAAQQZqIQBBACgCwKABIQEDQAJAAkACQCAAQXxqIAFPDQAgAEF+ai8BAEEqRw0CIAAvAQBBL0cNAkEAIABBfmo2ArygAQwBCyAAQX5qIQALQQAgADYCvKABDwsgAEECaiEADAALC2wBAX8CQAJAIABBX2oiAUEFSw0AQQEgAXRBMXENAQsgAEFGakH//wNxQQZJDQAgAEEpRyAAQVhqQf//A3FBB0lxDQACQCAAQaV/ag4EAQAAAQALIABB/QBHIABBhX9qQf//A3FBBElxDwtBAQs9AQF/QQEhAQJAIABB9wBB6ABB6QBB7ABB5QAQNA0AIABB5gBB7wBB8gAQNQ0AIABB6QBB5gAQKyEBCyABC5sBAQJ/QQEhAQJAAkACQAJAAkACQCAALwEAIgJBRWoOBAUEBAEACwJAIAJBm39qDgQDBAQCAAsgAkEpRg0EIAJB+QBHDQMgAEF+akHmAEHpAEHuAEHhAEHsAEHsABA2DwsgAEF+ai8BAEE9Rg8LIABBfmpB4wBB4QBB9ABB4wAQLA8LIABBfmpB5QBB7ABB8wAQNQ8LQQAhAQsgAQvSAwECf0EAIQECQAJAAkACQAJAAkACQAJAAkAgAC8BAEGcf2oOFAABAggICAgICAgDBAgIBQgGCAgHCAsCQAJAIABBfmovAQBBl39qDgQACQkBCQsgAEF8akH2AEHvABArDwsgAEF8akH5AEHpAEHlABA1DwsCQAJAIABBfmovAQBBjX9qDgIAAQgLAkAgAEF8ai8BACICQeEARg0AIAJB7ABHDQggAEF6akHlABA3DwsgAEF6akHjABA3DwsgAEF8akHkAEHlAEHsAEHlABAsDwsgAEF+ai8BAEHvAEcNBSAAQXxqLwEAQeUARw0FAkAgAEF6ai8BACICQfAARg0AIAJB4wBHDQYgAEF4akHpAEHuAEHzAEH0AEHhAEHuABA2DwsgAEF4akH0AEH5ABArDwtBASEBIABBfmoiAEHpABA3DQQgAEHyAEHlAEH0AEH1AEHyABA0DwsgAEF+akHkABA3DwsgAEF+akHkAEHlAEHiAEH1AEHnAEHnAEHlABA4DwsgAEF+akHhAEH3AEHhAEHpABAsDwsCQCAAQX5qLwEAIgJB7wBGDQAgAkHlAEcNASAAQXxqQe4AEDcPCyAAQXxqQfQAQegAQfIAEDUhAQsgAQt2AQJ/AkACQANAQQBBACgCvKABIgBBAmoiATYCvKABIABBACgCwKABTw0BAkACQAJAIAEvAQAiAUGlf2oOAgECAAsCQCABQXZqDgQEAwMEAAsgAUEvRw0CDAQLEEAaDAELQQAgAEEEajYCvKABDAALC0ELEBsLC8YBAQR/QQAoArygASEAQQAoAsCgASEBAkACQANAIAAiAkECaiEAIAIgAU8NAQJAAkAgAC8BACIDQaR/ag4FAQICAgQACyADQSRHDQEgAi8BBEH7AEcNAUEAQQAvAYRAIgBBAWo7AYRAQQAoAqBgIABBAXRqQQAvAYhAOwEAQQAgAkEEajYCvKABQQBBAC8BhkBBAWoiADsBiEBBACAAOwGGQA8LIAJBBGohAAwACwtBACAANgK8oAFBCBAbDwtBACAANgK8oAELNAEBf0EBIQECQCAAQXdqQf//A3FBBUkNACAAQYABckGgAUYNACAAQS5HIAAQP3EhAQsgAQtJAQF/QQAhBwJAIAAvAQAgAUcNACAALwECIAJHDQAgAC8BBCADRw0AIAAvAQYgBEcNACAALwEIIAVHDQAgAC8BCiAGRiEHCyAHC3oBA39BACgCvKABIQACQANAAkAgAC8BACIBQXdqQQVJDQAgAUEgRg0AIAFBoAFGDQAgAUEvRw0CAkAgAC8BAiIAQSpGDQAgAEEvRw0DEB0MAQsQHgtBAEEAKAK8oAEiAkECaiIANgK8oAEgAkEAKALAoAFJDQALCyABCzkBAX8CQCAALwEAIgFBgPgDcUGAuANHDQAgAEF+ai8BAEH/B3FBCnQgAUH/B3FyQYCABGohAQsgAQt9AQF/AkAgAEEvSw0AIABBJEYPCwJAIABBOkkNAEEAIQECQCAAQcEASQ0AIABB2wBJDQECQCAAQeAASw0AIABB3wBGDwsgAEH7AEkNAQJAIABB//8DSw0AIABBqgFJDQEgABA5DwtBASEBIAAQOg0AIAAQOyEBCyABDwtBAQtjAQF/AkAgAEHAAEsNACAAQSRGDwtBASEBAkAgAEHbAEkNAAJAIABB4ABLDQAgAEHfAEYPCyAAQfsASQ0AAkAgAEH//wNLDQBBACEBIABBqgFJDQEgABA8DwsgABA6IQELIAELTAEDf0EAIQMCQCAAQX5qIgRBACgCmB8iBUkNACAELwEAIAFHDQAgAC8BACACRw0AAkAgBCAFRw0AQQEPCyAAQXxqLwEAECUhAwsgAwtmAQN/QQAhBQJAIABBemoiBkEAKAKYHyIHSQ0AIAYvAQAgAUcNACAAQXxqLwEAIAJHDQAgAEF+ai8BACADRw0AIAAvAQAgBEcNAAJAIAYgB0cNAEEBDwsgAEF4ai8BABAlIQULIAULhQEBAn8gABA+IgAQKiEBAkACQCAAQdwARg0AQQAhAiABRQ0BC0EAKAK8oAFBAkEEIABBgIAESRtqIQACQANAQQAgADYCvKABIAAvAQAQPiIBRQ0BAkAgARApRQ0AIABBAkEEIAFBgIAESRtqIQAMAQsLQQAhAiABQdwARg0BC0EBIQILIAIL2gMBBH9BACgCvKABIgBBfmohAQNAQQAgAEECajYCvKABAkACQAJAIABBACgCwKABTw0AECchAEEAKAK8oAEhAgJAAkAgABAtRQ0AQQAoArygASEDAkACQBAnIgBBOkcNAEEAQQAoArygAUECajYCvKABECcQLUUNAUEAKAK8oAEvAQAhAAsgAiADQQAoApwfEQAADAILQQAgATYCvKABDwsCQAJAIABBIkYNACAAQS5GDQEgAEEnRw0EC0EAKAK8oAEhAiAAEBxBAEEAKAK8oAFBAmoiAzYCvKABECciAEE6Rw0BQQBBACgCvKABQQJqNgK8oAECQBAnEC1FDQBBACgCvKABLwEAIQAgAiADQQAoApwfEQAADAILQQAgATYCvKABDwtBACgCvKABIgAvAQJBLkcNAiAALwEEQS5HDQJBACAAQQZqNgK8oAECQAJAAkAgAC8BBiIAQfIARw0AQQEQECEAQQAoArygASECIAANASACLwEAIQALIABB//8DcRAtDQFBACABNgK8oAEPC0EAIAJBAmo2ArygAQsQJyEACyAAQf//A3EiAEEsRg0CIABB/QBGDQBBACABNgK8oAELDwtBACABNgK8oAEPC0EAKAK8oAEhAAwACwuPAQEBf0EAIQ4CQCAALwEAIAFHDQAgAC8BAiACRw0AIAAvAQQgA0cNACAALwEGIARHDQAgAC8BCCAFRw0AIAAvAQogBkcNACAALwEMIAdHDQAgAC8BDiAIRw0AIAAvARAgCUcNACAALwESIApHDQAgAC8BFCALRw0AIAAvARYgDEcNACAALwEYIA1GIQ4LIA4LqAEBAn9BACEBQQAoArygASECAkACQCAAQe0ARw0AIAJBAmpB7wBB5ABB9QBB7ABB5QAQE0UNAUEAIAJBDGo2ArygAQJAECdBLkYNAEEAIQEMAgtBAEEAKAK8oAFBAmo2ArygARAnIQALIABB5QBHDQBBACgCvKABIgBBDmogAiAAQQJqQfgAQfAAQe8AQfIAQfQAQfMAECYiARshAgtBACACNgK8oAEgAQtnAQF/QQAhCgJAIAAvAQAgAUcNACAALwECIAJHDQAgAC8BBCADRw0AIAAvAQYgBEcNACAALwEIIAVHDQAgAC8BCiAGRw0AIAAvAQwgB0cNACAALwEOIAhHDQAgAC8BECAJRiEKCyAKC3EBAX9BACELAkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUcNACAALwEKIAZHDQAgAC8BDCAHRw0AIAAvAQ4gCEcNACAALwEQIAlHDQAgAC8BEiAKRiELCyALC4MEAQJ/QQAhAgJAECdBzwBHDQBBACECQQAoArygASIDQQJqQeIAQeoAQeUAQeMAQfQAEBNFDQBBACECQQAgA0EMajYCvKABECdBLkcNAEEAQQAoArygAUECajYCvKABAkAQJyIDQfAARw0AQQAhAkEAKAK8oAEiA0ECakHyAEHvAEH0AEHvAEH0AEH5AEHwAEHlABA9RQ0BQQAhAkEAIANBEmo2ArygARAnQS5HDQFBAEEAKAK8oAFBAmo2ArygARAnIQMLQQAhAiADQegARw0AQQAhAkEAKAK8oAEiA0ECakHhAEHzAEHPAEH3AEHuAEHQAEHyAEHvAEHwAEHlAEHyAEH0AEH5ABAvRQ0AQQAhAkEAIANBHGo2ArygARAnQS5HDQBBACECQQBBACgCvKABQQJqNgK8oAEQJ0HjAEcNAEEAIQJBACgCvKABIgMvAQJB4QBHDQAgAy8BBEHsAEcNACADLwEGQewARw0AQQAhAkEAIANBCGo2ArygARAnQShHDQBBACECQQBBACgCvKABQQJqNgK8oAEQJxAtRQ0AECdBLEcNAEEAIQJBAEEAKAK8oAFBAmo2ArygARAnGkEAKAK8oAEiAyAAIAFBAXQiARBBDQBBACECQQAgAyABajYCvKABECdBKUcNAEEAQQAoArygAUECajYCvKABQQEhAgsgAgtJAQN/QQAhBgJAIABBeGoiB0EAKAKYHyIISQ0AIAcgASACIAMgBCAFEBNFDQACQCAHIAhHDQBBAQ8LIABBdmovAQAQJSEGCyAGC1kBA39BACEEAkAgAEF8aiIFQQAoApgfIgZJDQAgBS8BACABRw0AIABBfmovAQAgAkcNACAALwEAIANHDQACQCAFIAZHDQBBAQ8LIABBemovAQAQJSEECyAEC0sBA39BACEHAkAgAEF2aiIIQQAoApgfIglJDQAgCCABIAIgAyAEIAUgBhAmRQ0AAkAgCCAJRw0AQQEPCyAAQXRqLwEAECUhBwsgBws9AQJ/QQAhAgJAQQAoApgfIgMgAEsNACAALwEAIAFHDQACQCADIABHDQBBAQ8LIABBfmovAQAQJSECCyACC00BA39BACEIAkAgAEF0aiIJQQAoApgfIgpJDQAgCSABIAIgAyAEIAUgBiAHEBZFDQACQCAJIApHDQBBAQ8LIABBcmovAQAQJSEICyAIC64SAQN/AkAgABA8DQAgAEH0v39qQQJJDQAgAEG3AUYNACAAQYB6akHwAEkNACAAQf12akEFSQ0AIABBhwdGDQAgAEHvdGpBLUkNAAJAIABBwXRqIgFBCEsNAEEBIAF0Qe0CcQ0BCyAAQfBzakELSQ0AIABBtXNqQR9JDQACQCAAQapyaiIBQRJLDQBBASABdEH//BlxDQELIABB8AxGDQAgAEGWcmpBBEkNACAAQcBwakEKSQ0AIABB2nBqQQtJDQAgAEHQcWpBG0kNACAAQZEORg0AIABBkHJqQQpJDQAgAEHCbWpBEkkNACAAQcZtakEDSQ0AIABBnW5qQSFJDQAgAEGtbmpBD0kNACAAQadvakEDSQ0AIABB129qQQVJDQAgAEHbb2pBA0kNACAAQeVvakEJSQ0AIABB6m9qQQRJDQAgAEH9D0YNACAAQZVwakEJSQ0AAkAgAEGvbWoiAUESSw0AQQEgAXRB/4AYcQ0BCyAAQZptakEKSQ0AAkACQCAAQcRsag4oAgECAgICAgICAQECAgEBAgICAQEBAQEBAQEBAgEBAQEBAQEBAQECAgALIABB/2xqQQNJDQELIABB/hNGDQAgAEGabGpBCkkNAAJAIABBxGtqIgFBFUsNAEEBIAF0Qf2wjgFxDQELIABB/2tqQQNJDQAgAEH1FEYNACAAQZprakEMSQ0AAkACQCAAQcRqag4oAgECAgICAgICAgECAgIBAgICAQEBAQEBAQEBAQEBAQEBAQEBAQECAgALIABB/2pqQQNJDQELIABBmmpqQQpJDQAgAEGGampBBkkNAAJAAkAgAEHEaWoOKAIBAgICAgICAgEBAgIBAQICAgEBAQEBAQEBAgIBAQEBAQEBAQEBAgIACyAAQf9pakEDSQ0BCyAAQZppakEKSQ0AAkAgAEHCaGoiAUEZSw0AQQEgAXRBn+6DEHENAQsgAEGCF0YNACAAQZpoakEKSQ0AAkACQCAAQcJnag4mAgICAgICAgECAgIBAgICAgEBAQEBAQECAgEBAQEBAQEBAQEBAgIACyAAQYBoakEFSQ0BCyAAQZpnakEKSQ0AAkACQCAAQcRmag4oAgECAgICAgICAQICAgECAgICAQEBAQEBAQICAQEBAQEBAQEBAQECAgALIABB/2ZqQQNJDQELIABBmmZqQQpJDQAgAEF8cSIBQYAaRg0AAkAgAEHFZWoOKQEBAAEBAQEBAQEAAQEBAAEBAQEAAAAAAAAAAAABAAAAAAAAAAAAAAEBAAsgAEGaZWpBCkkNAAJAIABBtmRqIgJBDEsNAEEBIAJ0QeEvcQ0BCyAAQf5kakECSQ0AIABBeHFB2BtGDQAgAEGaZGpBCkkNAAJAIABBz2NqIgJBHUsNAEEBIAJ0QfmHgP4DcQ0BCyAAQY5kakECSQ0AIABBsR1GDQAgAEGwY2pBCkkNAAJAIABBzGJqIgJBCEsNACACQQZHDQELIABBuGJqQQZJDQAgAEHgYWpBCkkNACAAQX5xIgJBmB5GDQAgAEGwYmpBCkkNAAJAIABBy2FqIgNBCksNAEEBIAN0QZUMcQ0BCyAAQfNgakELSQ0AIAJBhh9GDQAgAEGPYWpBFEkNACAAQe5RakEDSQ0AIABBl1lqQQlJDQAgAEGjWWpBA0kNACAAQfFeakEPSQ0AIABB/l5qQQxJDQAgAEGPX2pBBEkNACAAQZlfakEHSQ0AIABBnl9qQQNJDQAgAEGiX2pBA0kNACAAQapfakEESQ0AIABBwF9qQQpJDQAgAEHVX2pBFEkNACAAQcYfRg0AIABB52BqQSRJDQAgAEHOUWpBA0kNACAAQa5RakECSQ0AIABBjlFqQQJJDQAgAEH1T2pBA0kNACAAQaBQakEKSQ0AIABB3S9GDQAgAEHMUGpBIEkNACAAQbBGakEDSQ0AIABBsEdqQQpJDQAgAEHAR2pBCkkNACAAQdxHakEUSQ0AIABBmkhqQQ5JDQAgAEHQSGpBCkkNACAAQd9IakENSQ0AIABBgElqQQNJDQAgAEGVSWpBCUkNACAAQbBJakEKSQ0AIABBzElqQRFJDQAgAEGASmpBBUkNACAAQdBKakEOSQ0AIABB8EpqQQpJDQAgAEGBS2pBC0kNACAAQaBLakEdSQ0AIABBq0tqQQpJDQAgAEHpS2pBBUkNACAAQbBMakELSQ0AIABBuk1qQQpJDQAgAEHQTWpBDEkNACAAQeBNakEMSQ0AIABBqTFGDQAgAEHwT2pBCkkNACAAQcBEakE6SQ0AIABBiUZqQQNJDQAgAEGORmpBA0kNACAAQe05Rg0AIABBrEZqQRVJDQAgAEGFRGpBBUkNAAJAIABBwb9/aiICQRVLDQBBASACdEGDgIABcQ0BCyAAQZu+f2pBDEkNACAAQeHBAEYNACAAQbC+f2pBDUkNACAAQZGmf2pBA0kNACAAQf/aAEYNACAAQWBxQeDbAEYNACAAQdaff2pBBkkNACAAQeeef2pBAkkNACAAQYyzfWpBCkkNACAAQe/MAkYNACAAQeCzfWpBCkkNAAJAIABB9a99aiICQRxLDQBBASACdEGBgID4AXENAQsgAEHisn1qQQJJDQAgAEGQsn1qQQJJDQACQAJAIABB/q99ag4FAgEBAQIACyAAQYCvfWpBAkkNAQsgAEHNrH1qQQ5JDQAgAUGA0wJGDQAgAEG5rX1qQQ1JDQAgAEHarX1qQQhJDQAgAEGBrn1qQQtJDQAgAEGgrn1qQRJJDQAgAEHMrn1qQRJJDQAgAEGwrn1qQQpJDQAgAEHXq31qQQ5JDQAgAEHl0wJGDQAgAEFfcUGwrH1qQQpJDQACQCAAQb2rfWoiAUEKSw0AQQEgAXRBgQxxDQELIABBsKt9akEKSQ0AAkAgAEGdqH1qIgFBCksNACABQQhHDQELAkAgAEHQqn1qIgFBEUsNAEEBIAF0QZ2DC3ENAQsCQCAAQZWqfWoiAUELSw0AQQEgAXRBnxhxDQELIABBhat9akEDSQ0AIABBcHEiAUGA/ANGDQAgAEGe9gNGDQAgAEGQqH1qQQpJDQAgAEG//gNGIABB8IF8akEKSSAAQbODfGpBA0kgAEHNg3xqQQJJIAFBoPwDRnJycnIPC0EBC1wBBH9BgIAEIQFBkAghAkF+IQMCQANAQQAhBCADQQJqIgNB5wNLDQEgAigCACABaiIBIABLDQEgAkEEaiEEIAJBCGohAiAEKAIAIAFqIgEgAEkNAAtBASEECyAEC1wBBH9BgIAEIQFBsBchAkF+IQMCQANAQQAhBCADQQJqIgNB+QFLDQEgAigCACABaiIBIABLDQEgAkEEaiEEIAJBCGohAiAEKAIAIAFqIgEgAEkNAAtBASEECyAEC8YfAQZ/AkACQAJAAkACQAJAIABB1n5qIgFBEEsNAEEBIAF0QYGQBHENAQsgAEG6empBDEkNACAAQYh+akHKA0kNACAAQcB+akEXSQ0AIABBqH5qQR9JDQACQCAAQZB5aiIBQRxLDQBBASABdEHf+YK6AXENAQsCQCAAQaB6aiIBQQ5LDQBBASABdEGfoAFxDQELIABB9nZqQaYBSQ0AIABBiXhqQYsBSQ0AIABB8nhqQRRJDQAgAEHdeGpB0wBJDQAgAEGRdGpBBEkNACAAQbB0akEbSQ0AIABBoHVqQSlJDQAgAEHZCkYNACAAQc91akEmSQ0AIABBj3NqQeMASQ0AIABBfnEiAkHuDEYNACAAQeBzakErSQ0AAkAgAEGrcmoiAUE8Tw0AQoGAjLCAnIGACCABrYhCAYNQRQ0BCyAAQe5xakEeSQ0AIABBtnBqQSFJDQAgAEGxD0YNACAAQbNxakHZAEkNAAJAIABBjHBqIgFBBksNAEEBIAF0QcMAcQ0BCyAAQYBwakEWSQ0AQQEhAQJAAkAgAEHcb2oOBQUBAQEFAAsgAEGaEEYNAQsgAEH8bWpBNkkNACAAQcpuakEISQ0AIABB4G5qQRVJDQAgAEHAb2pBGUkNACAAQaBvakELSQ0AIABBvRJGDQAgAEHQEkYNACAAQahtakEKSQ0AIABBj21qQRBJDQACQCAAQftsaiIDQQxPDQBBASEBQf8ZIANB//8DcXZBAXENBAsgAEHtbGpBFkkNAAJAIABBhGxqIgFBFEsNAEEBIAF0QYH84QBxDQELIABB1mxqQQdJDQACQCAAQc5saiIBQRxLDQBBASABdEHxkYCAAXENAQsCQCAAQaRsaiIBQRVLDQBBASABdEG7gMABcQ0BCyAAQe1rakEWSQ0AAkAgAEHWa2oiAUE1Tw0AQv+2g4CAgOALIAGtiEIBg1BFDQELIABB7WpqQRZJDQAgAEHxampBA0kNACAAQY5rakEDSQ0AIABB+2pqQQlJDQBBASEBAkACQCAAQdZqag4nBQUFBQUFBQEFBQEFBQUFBQEBAQUBAQEBAQEBAQEBAQEBAQEBAQEFAAsCQCAAQYdqaiIBQRdLDQBBASABdEGB4L8GcQ0CCyAAQaBqakECSQ0BCyAAQe1pakEWSQ0AQQEhAQJAAkAgAEGPaWoONAUBAQEBAQEBAQEBAQEBAQEBAQUBBQUFBQUFAQEBBQUFAQUFBQUBAQEFBQEFAQUFAQEBBQUACwJAIABB1mlqIgFBE0sNAEEBIAF0Qf/2I3ENAgsgAEGkaWoiAUEFSw0AIAFBAkcNAQsgAEHYaGpBA0kNACAAQe5nakEXSQ0AIABB8mdqQQNJDQAgAEH7Z2pBCEkNACAAQdAXRg0AIABB0mhqQQxJDQAgAEG9GEYNACAAQdZnakEQSQ0AAkAgAEGoZ2oiAUEpTw0AQoeGgICAICABrYhCAYNQRQ0BCyAAQdZmakEKSQ0AIABB7mZqQRdJDQAgAEH7ZmpBCEkNACAAQfJmakEDSQ0AAkAgAEH7ZWoiAUELSw0AIAFBCEcNAQsCQCAAQctmaiIBQQhLDQBBASABdEGfAnENAQsCQCAAQaJmaiIBQRRLDQBBASABdEGNgOAAcQ0BCyAAQe5lakEpSQ0AIABBvRpGDQAgAEHOGkYNACAAQc1kakEJSQ0AIABB5mRqQRhJDQAgAEH7ZGpBEkkNACAAQYZlakEGSQ0AIABBrGVqQQNJDQAgAEGhZWpBA0kNAAJAIABBw2RqIgNBCk8NAEEBIQFB+QcgA0H//wNxdkEBcQ0ECyACQbIcRg0AIABB/2NqQTBJDQAgAEHAY2pBB0kNAAJAIABB/2JqIgFBDEsNAEEBIAF0QcslcQ0BCyAAQXxxIgNBlB1GDQAgAEHnYmpBB0kNAAJAIABB32JqIgFBJk8NAELX7JuA+QUgAa2IQgGDUEUNAQsgAEGAYGpBK0kNACAAQfhgakEFSQ0AIABBt2FqQSRJDQAgAEF4cSIEQcAeRg0AIABBgB5GDQAgA0HcHUYNAAJAIABBwV9qIgFBKE8NAEKBgPjDxxggAa2IQgGDUEUNAQsgAEGSX2pBA0kNACAAQeBeakEmSQ0AIABBjiFGDQAgAEGLX2pBDUkNACAAQcchRg0AIABBzSFGDQAgAEG2W2pBBEkNACAAQbBeakErSQ0AIABBhF5qQc0CSQ0AAkAgAEGwW2oiBUEJTw0AQQEhAUH/AiAFQf//A3F2QQFxDQQLIABBzlpqQQRJDQAgAEHwWmpBIUkNACAAQfZaakEESQ0AIABBpltqQQRJDQAgAEGgW2pBKUkNAAJAIABByFpqIgVBCU8NAEEBIQFB/wIgBUH//wNxdkEBcQ0ECyAAQYBRakE0SQ0AIABBklFqQQNJDQAgAEGgUWpBDUkNACAAQcBRakESSQ0AIABB4FFqQRJJDQAgAEHyUWpBBEkNACAAQYBSakENSQ0AIABBklJqQQtJDQAgAEHgUmpBywBJDQAgAEH/UmpBGkkNACAAQZFTakERSQ0AIABB/1dqQewESQ0AIABBiFhqQQZJDQAgAEHgWGpB1gBJDQAgAEFwcSIFQYAnRg0AIABB6FlqQcMASQ0AIABB7llqQQRJDQAgAEGoWmpBOUkNACAAQb5aakEESQ0AIABBuFpqQQ9JDQAgAEHXL0YNACAAQdwvRg0AIABB4E9qQdkASQ0AIABBgExqQRdJDQAgAEHQTGpBGkkNACAAQYBNakEsSQ0AIABBkE1qQQVJDQAgAEGwTWpBHkkNACAAQYBOakEfSQ0AIABB0E5qQcYASQ0AIABBqjFGDQQgAEGAT2pBKUkNBCAAQbtJakEHSQ0EIABB+0lqQS9JDQQgAEGnNUYNBCAAQeBLakE1SQ0EIABBl0ZqQQRJDQQgAEHDRmpBA0kNBCAAQfBGakErSQ0EIABBgEdqQQlJDQQgAEGmR2pBJEkNBCAAQbNHakEDSQ0EIABBgEhqQSRJDQQgAEHGSGpBLEkNBCACQa43Rg0EIABB/UhqQR5JDQQgAEGSRmoiBkEJSQ0BDAILQQEhAQwCC0EBIQFBjwMgBkH//wNxdkEBcQ0BCyAEQdA+Rg0BIABBuEFqQQZJDQEgAEHgQWpBJkkNASAAQehBakEGSQ0BIABBgEZqQcABSQ0BIABBgERqQZYCSQ0BAkAgAEGnQWoiAUEESw0AQQEgAXRBFXENAgsgAEGhQWpBH0kNASAAQYBBakE1SQ0BAkAgAEHKQGoiBEEJTw0AQQEhAUH/AiAEQf//A3F2QQFxDQELIABBjkBqQQNJDQEgAEGgQGpBDUkNASAAQapAakEGSQ0BIANB0D9GDQEgAEG+QGpBA0kNASAAQbpAakEHSQ0BIABBikBqQQdJDQEgAEHxwABGDQEgAEH/wABGDQEgAEHwvn9qQQ1JDQEgAEGCwgBGDQEgAEGHwgBGDQEgAEGVwgBGDQEgAEH2vX9qQQpJDQECQCAAQei9f2oiBEERTw0AQQEhAUG/oAUgBHZBAXENAQsgAEHWvX9qQRBJDQEgA0G8wgBGDQECQCAAQbu9f2oiBEEKTw0AQQEhAUGfBCAEQf//A3F2QQFxDQELIABBoKd/akGFAUkNASAAQdCnf2pBL0kNASAAQaC9f2pBKUkNASAAQYCof2pBL0kNAQJAIABBlaZ/aiIEQQlPDQBBASEBQY8DIARB//8DcXZBAXENAQsgAEGApn9qQSZJDQEgAEGn2gBGDQEgAEGt2gBGDQEgAEGAtn1qQY0CSQ0BIABBsLZ9akEuSQ0BIABBgMB9akGNCUkNASAAQYDkfmpB8KMBSQ0BIABBgJh/akG2M0kNASAFQfDjAEYNASAAQeCcf2pBG0kNASAAQc+df2pB3gBJDQEgAEH7nX9qQStJDQEgA0H84QBGDQEgAEHfnn9qQdoASQ0BIABB5Z5/akEFSQ0BIABBv59/akHWAEkNASAAQciff2pBBUkNASAAQc+ff2pBBUkNASAAQd+ff2pBCUkNASAAQfuff2pBA0kNASAAQaikf2pBB0kNASAAQbCkf2pBB0kNASAAQbikf2pBB0kNASAAQcCkf2pBB0kNASAAQcikf2pBB0kNASAAQdCkf2pBB0kNASAAQdikf2pBB0kNASAAQeCkf2pBB0kNASAAQYClf2pBF0kNASAAQe/aAEYNASAAQdClf2pBOEkNASAAQf6ufWpBMkkNASAAQcCvfWpBNEkNASAAQfSvfWpBF0kNASAAQfmvfWpBBEkNASAAQf2vfWpBA0kNASAAQYmwfWpBC0kNASAAQfWwfWpBL0kNASAAQd6xfWpB5wBJDQEgAEHpsX1qQQlJDQEgAEHgsn1qQdAASQ0BIABBgbN9akEfSQ0BIABBwLN9akEvSQ0BIAJBqswCRg0BIAVBkMwCRg0BAkAgAEGOrn1qIgJBDU8NAEEBIQFBvzQgAkH//wNxdkEBcQ0BCyAAQaCtfWpBHUkNASAAQfatfWpBHEkNASAAQdCtfWpBF0kNASAAQbyrfWpBCEkNASAAQcCrfWpBA0kNASAAQYCsfWpBKUkNASAAQYasfWpBBUkNASAAQZqsfWpBCkkNASAAQaCsfWpBBUkNASAAQc/TAkYNASAAQfysfWpBL0kNASAAQYKrfWpBMkkNASAAQfrUAkYNASAAQaCrfWpBF0kNAQJAIABBz6p9aiICQRJPDQBBASEBQbG+CiACdkEBcQ0BCyAAQYCKfGpBB0kNASAAQZCLfGpB6gBJDQEgAEGAjnxqQe4CSQ0BIABBtdB8akExSQ0BIABB0NB8akEXSQ0BIABBgKh9akGk1wBJDQEgAEGQqX1qQfMASQ0BIABBpKl9akEKSQ0BIABB0Kl9akErSQ0BIABB2Kl9akEHSQ0BIABB4Kl9akEHSQ0BIABB76l9akEGSQ0BIABBd3FB/6l9akEGSQ0BIABBjqp9akEDSQ0BIABBpap9akEDSQ0BIABBoKp9akELSQ0BAkAgAEHtiXxqIgJBC08NAEEBIQFBnwggAkH//wNxdkEBcQ0BCyAAQeGJfGpBCkkNASAAQdaJfGpBDUkNAQJAIABByIl8aiICQQ1PDQBBASEBQd82IAJB//8DcXZBAXENAQsgAEGugHxqQQZJDQEgAEG2gHxqQQZJDQEgAEG+gHxqQQZJDQEgAEGagXxqQdkASQ0BIABBv4F8akEaSQ0BIABB34F8akEaSQ0BIABBioN8akGHAUkNASAAQZCDfGpBBUkNASAAQZCEfGpBDEkNASAAQe6EfGpBNkkNASAAQbCFfGpBwABJDQEgAEG6iXxqQewASQ0BQQEhASAAQa2IfGpB6wJJDQAgAEGmgHxqQQNJDwsgAQ8LQQELXQEBf0EAIQkCQCAALwEAIAFHDQAgAC8BAiACRw0AIAAvAQQgA0cNACAALwEGIARHDQAgAC8BCCAFRw0AIAAvAQogBkcNACAALwEMIAdHDQAgAC8BDiAIRiEJCyAJCzUAAkAgAEGA+ANxQYCwA0cNACAAQQp0QYD4P3FBACgCvKABLwECQf8HcXJBgIAEaiEACyAAC2gBAn9BASEBAkACQCAAQV9qIgJBBUsNAEEBIAJ0QTFxDQELIABB+P8DcUEoRg0AIABBRmpB//8DcUEGSQ0AAkAgAEGlf2oiAkEDSw0AIAJBAUcNAQsgAEGFf2pB//8DcUEESSEBCyABC3gBBH9BACgCvKABIQBBACgCwKABIQECQAJAA0AgAEECaiECIAAgAU8NAQJAAkAgAi8BACIDQaR/ag4CAQQACyACIQAgA0F2ag4EAgEBAgELIABBBGohAAwACwtBACACNgK8oAFBChAbQQAPC0EAIAI2ArygAUHdAAtJAQN/QQAhAwJAIAJFDQACQANAIAAtAAAiBCABLQAAIgVHDQEgAUEBaiEBIABBAWohACACQX9qIgINAAwCCwsgBCAFayEDCyADCwvCFwIAQYAIC5gXAAAAAAAAAAAAAAAAAAAAAAAAAAALAAAAAgAAABkAAAACAAAAEgAAAAIAAAABAAAAAgAAAA4AAAADAAAADQAAACMAAAB6AAAARgAAADQAAAAMAQAAHAAAAAQAAAAwAAAAMAAAAB8AAAAOAAAAHQAAAAYAAAAlAAAACwAAAB0AAAADAAAAIwAAAAUAAAAHAAAAAgAAAAQAAAArAAAAnQAAABMAAAAjAAAABQAAACMAAAAFAAAAJwAAAAkAAAAzAAAAnQAAADYBAAAKAAAAFQAAAAsAAAAHAAAAmQAAAAUAAAADAAAAAAAAAAIAAAArAAAAAgAAAAEAAAAEAAAAAAAAAAMAAAAWAAAACwAAABYAAAAKAAAAHgAAAEIAAAASAAAAAgAAAAEAAAALAAAAFQAAAAsAAAAZAAAARwAAADcAAAAHAAAAAQAAAEEAAAAAAAAAEAAAAAMAAAACAAAAAgAAAAIAAAAcAAAAKwAAABwAAAAEAAAAHAAAACQAAAAHAAAAAgAAABsAAAAcAAAANQAAAAsAAAAVAAAACwAAABIAAAAOAAAAEQAAAG8AAABIAAAAOAAAADIAAAAOAAAAMgAAAA4AAAAjAAAAXQEAACkAAAAHAAAAAQAAAE8AAAAcAAAACwAAAAAAAAAJAAAAFQAAAGsAAAAUAAAAHAAAABYAAAANAAAANAAAAEwAAAAsAAAAIQAAABgAAAAbAAAAIwAAAB4AAAAAAAAAAwAAAAAAAAAJAAAAIgAAAAQAAAAAAAAADQAAAC8AAAAPAAAAAwAAABYAAAAAAAAAAgAAAAAAAAAkAAAAEQAAAAIAAAAYAAAAVQAAAAYAAAACAAAAAAAAAAIAAAADAAAAAgAAAA4AAAACAAAACQAAAAgAAAAuAAAAJwAAAAcAAAADAAAAAQAAAAMAAAAVAAAAAgAAAAYAAAACAAAAAQAAAAIAAAAEAAAABAAAAAAAAAATAAAAAAAAAA0AAAAEAAAAnwAAADQAAAATAAAAAwAAABUAAAACAAAAHwAAAC8AAAAVAAAAAQAAAAIAAAAAAAAAuQAAAC4AAAAqAAAAAwAAACUAAAAvAAAAFQAAAAAAAAA8AAAAKgAAAA4AAAAAAAAASAAAABoAAADmAAAAKwAAAHUAAAA/AAAAIAAAAAcAAAADAAAAAAAAAAMAAAAHAAAAAgAAAAEAAAACAAAAFwAAABAAAAAAAAAAAgAAAAAAAABfAAAABwAAAAMAAAAmAAAAEQAAAAAAAAACAAAAAAAAAB0AAAAAAAAACwAAACcAAAAIAAAAAAAAABYAAAAAAAAADAAAAC0AAAAUAAAAAAAAACMAAAA4AAAACAEAAAgAAAACAAAAJAAAABIAAAAAAAAAMgAAAB0AAABxAAAABgAAAAIAAAABAAAAAgAAACUAAAAWAAAAAAAAABoAAAAFAAAAAgAAAAEAAAACAAAAHwAAAA8AAAAAAAAASAEAABIAAAC+AAAAAAAAAFAAAACZAwAAZwAAAG4AAAASAAAAwwAAAL0KAAAuBAAA0g8AAEYCAAC6IQAAOAIAAAgAAAAeAAAAcgAAAB0AAAATAAAALwAAABEAAAADAAAAIAAAABQAAAAGAAAAEgAAALECAAA/AAAAgQAAAEoAAAAGAAAAAAAAAEMAAAAMAAAAQQAAAAEAAAACAAAAAAAAAB0AAAD3FwAACQAAANUEAAArAAAACAAAAPgiAAAeAQAAMgAAAAIAAAASAAAAAwAAAAkAAACLAQAABQkAAGoAAAAGAAAADAAAAAQAAAAIAAAACAAAAAkAAABnFwAAVAAAAAIAAABGAAAAAgAAAAEAAAADAAAAAAAAAAMAAAABAAAAAwAAAAMAAAACAAAACwAAAAIAAAAAAAAAAgAAAAYAAAACAAAAQAAAAAIAAAADAAAAAwAAAAcAAAACAAAABgAAAAIAAAAbAAAAAgAAAAMAAAACAAAABAAAAAIAAAAAAAAABAAAAAYAAAACAAAAUwEAAAMAAAAYAAAAAgAAABgAAAACAAAAHgAAAAIAAAAYAAAAAgAAAB4AAAACAAAAGAAAAAIAAAAeAAAAAgAAABgAAAACAAAAHgAAAAIAAAAYAAAAAgAAAAcAAAA1CQAALAAAAAsAAAAGAAAAEQAAAAAAAAByAQAAKwAAABUFAADEAAAAPAAAAEMAAAAIAAAAAAAAALUEAAADAAAAAgAAABoAAAACAAAAAQAAAAIAAAAAAAAAAwAAAAAAAAACAAAACQAAAAIAAAADAAAAAgAAAAAAAAACAAAAAAAAAAcAAAAAAAAABQAAAAAAAAACAAAAAAAAAAIAAAAAAAAAAgAAAAIAAAACAAAAAQAAAAIAAAAAAAAAAwAAAAAAAAACAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAABAAAAAgAAAAAAAAADAAAAAwAAAAIAAAAGAAAAAgAAAAMAAAACAAAAAwAAAAIAAAAAAAAAAgAAAAkAAAACAAAAEAAAAAYAAAACAAAAAgAAAAQAAAACAAAAEAAAAEURAADdpgAAIwAAADQQAAAMAAAA3QAAAAMAAACBFgAADwAAADAdAAAgDAAAHQIAAOMFAABKEwAA/QEAAAAAAADjAAAAAAAAAJYAAAAEAAAAJgEAAAkAAABYBQAAAgAAAAIAAAABAAAABgAAAAMAAAApAAAAAgAAAAUAAAAAAAAApgAAAAEAAAA+AgAAAwAAAAkAAAAJAAAAcgEAAAEAAACaAAAACgAAALAAAAACAAAANgAAAA4AAAAgAAAACQAAABAAAAADAAAALgAAAAoAAAA2AAAACQAAAAcAAAACAAAAJQAAAA0AAAACAAAACQAAAAYAAAABAAAALQAAAAAAAAANAAAAAgAAADEAAAANAAAACQAAAAMAAAACAAAACwAAAFMAAAALAAAABwAAAAAAAAChAAAACwAAAAYAAAAJAAAABwAAAAMAAAA4AAAAAQAAAAIAAAAGAAAAAwAAAAEAAAADAAAAAgAAAAoAAAAAAAAACwAAAAEAAAADAAAABgAAAAQAAAAEAAAAwQAAABEAAAAKAAAACQAAAAUAAAAAAAAAUgAAABMAAAANAAAACQAAANYAAAAGAAAAAwAAAAgAAAAcAAAAAQAAAFMAAAAQAAAAEAAAAAkAAABSAAAADAAAAAkAAAAJAAAAVAAAAA4AAAAFAAAACQAAAPMAAAAOAAAApgAAAAkAAABHAAAABQAAAAIAAAABAAAAAwAAAAMAAAACAAAAAAAAAAIAAAABAAAADQAAAAkAAAB4AAAABgAAAAMAAAAGAAAABAAAAAAAAAAdAAAACQAAACkAAAAGAAAAAgAAAAMAAAAJAAAAAAAAAAoAAAAKAAAALwAAAA8AAACWAQAABwAAAAIAAAAHAAAAEQAAAAkAAAA5AAAAFQAAAAIAAAANAAAAewAAAAUAAAAEAAAAAAAAAAIAAAABAAAAAgAAAAYAAAACAAAAAAAAAAkAAAAJAAAAMQAAAAQAAAACAAAAAQAAAAIAAAAEAAAACQAAAAkAAABKAQAAAwAAAGpLAAAJAAAAhwAAAAQAAAA8AAAABgAAABoAAAAJAAAA9gMAAAAAAAACAAAANgAAAAgAAAADAAAAUgAAAAAAAAAMAAAAAQAAAKxMAAABAAAAxxQAAAQAAAAEAAAABQAAAAkAAAAHAAAAAwAAAAYAAAAfAAAAAwAAAJUAAAACAAAAigUAADEAAAABAgAANgAAAAUAAAAxAAAACQAAAAAAAAAPAAAAAAAAABcAAAAEAAAAAgAAAA4AAABRBQAABgAAAAIAAAAQAAAAAwAAAAYAAAACAAAAAQAAAAIAAAAEAAAABgEAAAYAAAAKAAAACQAAAKMBAAANAAAA1wUAAAYAAABuAAAABgAAAAYAAAAJAAAAlxIAAAkAAAAHBQwA7wAAAABBmB8LHFCMAAABAAAAAgAAAAMAAAAEAAAAAAQAAPAfAAA=";return"undefined"!=typeof Buffer?Buffer.from(A,"base64"):Uint8Array.from(atob(A),A=>A.charCodeAt(0))}let I;function init(){return I||(I=(async()=>{const Q=await WebAssembly.compile(g()),{exports:B}=await WebAssembly.instantiate(Q);A=B})())}function initSync(){if(A)return;const Q=new WebAssembly.Module(g()),{exports:B}=new WebAssembly.Instance(Q);A=B}
\ No newline at end of file
+"use strict";exports.init=init;exports.initSync=initSync;exports.parse=parse;let A;const B=1===new Uint8Array(new Uint16Array([1]).buffer)[0];function parse(I,C="@"){if(!A)throw new Error("Not initialized");const w=I.length+1,D=(A.__heap_base.value||A.__heap_base)+4*w-A.memory.buffer.byteLength;D>0&&A.memory.grow(Math.ceil(D/65536));const G=A.sa(w);(B?g:E)(I,new Uint16Array(A.memory.buffer,G,w));const S=A.parseCJS(G,I.length,0,0,0);if(S){const B=new Error(`Parse error ${C}${A.e()}:${I.slice(0,A.e()).split("\n").length}:${A.e()-I.lastIndexOf("\n",A.e()-1)}`);throw Object.assign(B,{idx:A.e()}),5!==S&&6!==S&&7!==S||Object.assign(B,{code:"ERR_LEXER_ESM_SYNTAX"}),B}let R=new Set,o=new Set,H=new Set;for(;A.rre();){const B=Q(I.slice(A.res(),A.ree()));B&&o.add(B)}for(;A.ru();)H.add(Q(I.slice(A.us(),A.ue())));for(;A.re();){let B=Q(I.slice(A.es(),A.ee()));void 0===B||H.has(B)||R.add(B)}return{exports:[...R],reexports:[...o]}}function Q(A){if('"'!==A[0]&&"'"!==A[0])return A;try{const B=(0,eval)(A);for(let A=0;A<B.length;A++){const Q=64512&B.charCodeAt(A);if(!(Q<55296)){if(55296!==Q)return;if(56320!=(64512&B.charCodeAt(++A)))return}}return B}catch{}}function E(A,B){const Q=A.length;let E=0;for(;E<Q;){const Q=A.charCodeAt(E);B[E++]=(255&Q)<<8|Q>>>8}}function g(A,B){const Q=A.length;let E=0;for(;E<Q;)B[E]=A.charCodeAt(E++)}function I(){const A="AGFzbQEAAAABXA1gAX8Bf2ACf38AYAABf2AAAGABfwBgBn9/f39/fwF/YAJ/fwF/YAd/f39/f39/AX9gA39/fwF/YAh/f39/f39/fwF/YAV/f39/fwF/YAR/f39/AX9gBH9/f38AAzMyAQEBAwAABAUJBAAEBAMDAAcCAAAICgAFAAAGBQsHBgAAAAAIAAICAgICAgICAgIFDAYEBQFwAQUFBQMBAAEGCAF/AEHQmAILB1wOBm1lbW9yeQIAC19faGVhcF9iYXNlAwACc2EAJAFlACUCZXMAJgJlZQAnA3JlcwAoA3JlZQApAnVzACoCdWUAKwJyZQAsA3JyZQAtAnJ1AC4IcGFyc2VDSlMALwkKAQBBAQsEAAECAwrJkwEyDgAgACABQcgfQcAfEDALDgAgACABQdQfQcwfEDALDgAgACABQeAfQdgfEDALEgBBzB9BADYCAEHUH0EANgIAC8wBAQN/AkBBvKABKAIAIgNBAmpB5QBB8QBB9QBB6QBB8gBB5QAQEARAQbygASADQQ5qNgIAAkAQEUEoRw0AQbygAUG8oAEoAgBBAmo2AgAQESEBQbygASgCACECIAFBJ0cgAUEiR3ENACABEAxBvKABQbygASgCAEECaiIBNgIAEBFBKUcNAAJAIABBAWsOAgMDAAtBtKABKAIAIAI2AgBBtKABKAIAIAE2AgRBAQ8LQbygASADNgIAC0EADwsgAiABQaAfKAIAEQEAQQELGwAgAEGYHygCAEYEQEEBDwsgAEECay8BABAPC/8CAQV/QZgfKAIAIQQDQAJAIABBAmshASAALwEAIgJBIEcNACAAIARLIAEhAA0BCwsCQCACQT1HDQADQAJAIAFBAmshACABLwEAQSBHDQAgASAESyAAIQENAQsLIABBAmohASAAQQRqIQNBACECA0ACQCABLwEAIgBBgPgDcUGAuANGBEAgAEH/B3EgAUECay8BAEH/B3FBCnRyQYCABGohAAsgAEUgASAETXINACAAQdwARg0CIAAQEkUNACABQX5BfCAAQYCABEkbaiEBIAAQEyECDAELCyACQQFxRQ0AIAEvAQBBIEcNAEG0oAEoAgAiAkGwHygCAEYNACACIAM2AgwgAiABQQJqNgIIA0ACQCABQQJrIQAgAS8BACIDQSBHDQAgASAESyAAIQENAQsLAkACQAJAIANB8gBrDgMAAwEDCyAAQfYAQeEAEBQNAQwCCyAAQewAQeUAEBQNACAAQeMAQe8AQe4AQfMAEBVFDQELQbSgASACQRBqNgIACws7AQF/AkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUYhBgsgBgtPAQF/AkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUcNACAALwEKIAZHDQAgAC8BDCAHRiEICyAIC7MFAQN/QbygAUG8oAEoAgAiAkEOajYCAAJAAkAQESIBQdsARwRAIAFBPUYNASABQS5HDQJBvKABQbygASgCAEECajYCABARQbygASgCACEBEBZFDQJBvKABKAIAIQAQEUE9Rw0CIAEgAEGcHygCABEBAA8LQbygAUG8oAEoAgBBAmo2AgAQESIAQSdHIABBIkdxDQFBvKABKAIAIAAQDEG8oAFBvKABKAIAQQJqIgA2AgAQEUHdAEcNAUG8oAFBvKABKAIAQQJqNgIAEBFBPUcNASAAQZwfKAIAEQEADAELIABFDQBBqB8oAgARAwBBvKABQbygASgCAEECajYCABARIgBB8gBHBEAgAEH7AEcNAUG8oAEoAgBBAmshAQJAAkADQEG8oAFBvKABKAIAIgBBAmo2AgAgAEHAoAEoAgBPDQIQESEAQbygASgCACECAkAgABAWBEBBvKABKAIAIQMQESIAQTpGBEBBvKABQbygASgCAEECajYCABAREBZFDQRBvKABKAIALwEAIQALIAIgA0GcHygCABEBAAwBCwJAIABBIkcEQCAAQS5GDQEgAEEnRw0EC0G8oAEoAgAgABAMQbygAUG8oAEoAgBBAmoiAzYCABARIgBBOkcNAUG8oAFBvKABKAIAQQJqNgIAEBEQFkUNA0G8oAEoAgAvAQAhACADQZwfKAIAEQEADAELQbygASgCACIALwECQS5HDQIgAC8BBEEuRw0CQbygASAAQQZqNgIAAkACQCAALwEGIgBB8gBGBH9BARAEQbygASgCACEADQEgAC8BAAUgAAtB//8DcRAWRQ0EDAELQbygASAAQQJqNgIACxARIQALIABB//8DcSIAQSxGDQALIABB/QBGDQELQbygASABNgIACw8LQQEQBBoLQbygASACQQxqNgIACywBAX8gAEGgAUYgAEEJayIBQRdNQQBBASABdEGfgIAEcRtyRQRAQQAPC0EBC0AAQfAfKAIARQRAQfAfIAA2AgALQbygASgCACEAQbygAUHAoAEoAgBBAmo2AgBB7B8gAEGYHygCAGtBAXU2AgALjAEBBH9BvKABKAIAIQFBwKABKAIAIQQCQANAAkAgASICQQJqIQEgAiAETw0AIAEvAQAiAyAARg0CIANB3ABHBEAgA0EKaw4EAQICAQILIAJBBGohASACLwEEQQ1HDQEgAkEGaiABIAIvAQZBCkYbIQEMAQsLQbygASABNgIAQQkQCw8LQbygASABNgIAC0oBA39BvKABKAIAQQJqIQFBwKABKAIAIQIDQAJAIAEiAEECayACTw0AIABBAmohASAALwEAQQprDgQAAQEAAQsLQbygASAANgIAC2EBAn9BvKABKAIAQQZqIQBBwKABKAIAIQEDQAJAAkAgASAAQQRrSwRAIABBAmsvAQBBKkcNAiAALwEAQS9HDQIMAQsgAEECayEAC0G8oAEgADYCAA8LIABBAmohAAwACwALNAEBfyAAQaABRiAAQQlrIgFBF01BAEEBIAF0QZ+AgARxG3JFBEAgABAiIABBLkdxDwtBAQtFAQF/AkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUcNACAALwEKIAZGIQcLIAcLaQEDf0G8oAEoAgAhAANAAkACQCAALwEAIgFBL0YEQCAALwECIgBBKkcEQCAAQS9HDQMQDQwCCxAODAELIAEQCkUNAQtBvKABQbygASgCACICQQJqIgA2AgAgAkHAoAEoAgBJDQELCyABC4ETAQR/IABBL00EQCAAQSRGDwsCQCAAQTpJDQACQCAAQcEASQ0AIABB2wBJDQEgAEHgAE0EQCAAQd8ARg8LIABB+wBJDQEgAEH//wNNBEAgAEGqAUkNAQJ/AkAgABAgIABBjMAAa0ECSXIgAEG3AUYgAEGABmtB8ABJcnIgAEGHB0YgAEGDCWtBBUlyIABBkQtrQS1JcnINAAJAAkAgAEG/C2siAUEJSUHtAiABdkEBcXENACAAQZAMa0ELSSAAQcsMa0EfSXINAiAAQfAMRiAAQeoNa0EESXIgAEHWDWsiAUESTUEAQQEgAXRB//wZcRtyIABBwA9rQQpJIABBpg9rQQtJciAAQZEORiAAQbAOa0EbSXJyciAAQfANa0EKSSAAQb4Sa0ESSXIgAEG6EmtBA0kgAEHjEWtBIUlyciAAQdMRa0EPSSAAQdkQa0EDSXIgAEGpEGtBBUkgAEGlEGtBA0lycnJyIABBmxBrQQlJIABBlhBrQQRJciAAQf0PRiAAQesPa0EJSXJycg0CAkAgAEHREmsiAUETTwRAIABB5hJrQQpJDQQMAQtB/4AYIAF2QQFxIABB5hJrQQpJcg0BCwJAAkAgAEG8E2sOKAIBAgICAgICAgEBAgIBAQICAgEBAQEBAQEBAQIBAQEBAQEBAQEBAgIACyAAQYETa0EDSQ0DCyAAQf4TRiAAQeYTa0EKSXINAiAAQfUURiAAQYEUa0EDSXIgAEG8FGsiAUEVTUEAQQEgAXRB/bCOAXEbciAAQeYUa0EMSXINAgJAAkAgAEG8FWsOKAIBAgICAgICAgIBAgICAQICAgEBAQEBAQEBAQEBAQEBAQEBAQEBAgIACyAAQYEVa0EDSQ0DCyAAQeYVa0EKSSAAQfoVa0EGSXINAgJAAkAgAEG8FmsOKAIBAgICAgICAgEBAgIBAQICAgEBAQEBAQEBAgIBAQEBAQEBAQEBAgIACyAAQYEWa0EDSQ0DCyAAQeYWa0EKSQ0CIABBghdGIABB5hdrQQpJciAAQb4XayIBQRlNQQBBASABdEGf7oMQcRtyDQICQAJAIABBvhhrDiYCAgICAgICAQICAgECAgICAQEBAQEBAQICAQEBAQEBAQEBAQECAgALIABBgBhrQQVJDQMLIABB5hhrQQpJDQICQAJAIABBvBlrDigCAQICAgICAgIBAgICAQICAgIBAQEBAQEBAgIBAQEBAQEBAQEBAQICAAsgAEGBGWtBA0kNAwsgAEHmGWtBCkkNAiAAQXxxIgFBgBpGDQICQCAAQbsaayICQSlPBEAgAEHmGmtBCkkNBAwBC0L7956AgTAgAq2Ip0EBcSAAQeYaa0EKSXINAQsgAEF4cUHYG0YgAEGCG2tBAklyIABByhtrIgJBDE1BAEEBIAJ0QeEvcRtyIABB5htrQQpJcg0CIABBsR1GIABB8htrQQJJciAAQbEcayICQR1NQQBBASACdEH5h4D+A3EbciAAQdAca0EKSXINAgJAIABBtB1rIgJBCU8EQCAAQcgda0EGSQ0EDAELQb8DIAJ2QQFxIABByB1rQQZJcg0BCyAAQaAea0EKSSAAQdAda0EKSXINAiAAQX5xIgJBmB5GDQIgAEG1HmsiA0ELSUGVDCADdkEBcXENACAAQY0fa0ELSSAAQfEea0EUSXIgAkGGH0YgAEGSLmtBA0lyciAAQekma0EJSSAAQd0ma0EDSXIgAEGPIWtBD0kgAEGCIWtBDElycnIgAEHxIGtBBEkgAEHnIGtBB0lyIABB4iBrQQNJIABB3iBrQQNJcnIgAEHWIGtBBEkgAEHAIGtBCklyIABBxh9GIABBqyBrQRRJcnJyciAAQZkfa0EkSSAAQbIua0EDSXIgAEHSLmtBAkkgAEHyLmtBAklyciAAQYswa0EDSSAAQeAva0EKSXIgAEHdL0YgAEG0L2tBIElycnIgAEHQOWtBA0kgAEFucUHAOGtBCklyIABBpDhrQRRJIABB5jdrQQ5JcnIgAEGwN2tBCkkgAEGhN2tBDUlyIABBgDdrQQNJIABB6zZrQQlJcnJycnIgAEHQNmtBCkkgAEG0NmtBEUlyIABBgDZrQQVJIABBsDVrQQ5JcnIgAEGQNWtBCkkgAEH/NGtBC0lyIABB4DRrQR1JIABB1TRrQQpJcnJyIABBlzRrQQVJIABB0DNrQQtJciAAQakxRiAAQcYya0EKSXJyIABBkDBrQQpJIABBbHFBoDJrQQxJciAAQcA7a0E6SSAAQfc5a0EDSXJycnIgAEHtOUYgAEHyOWtBA0lyIABB1DlrQRVJIABB+ztrQQVJcnJycg0CIABB4cEARiAAQeXBAGtBDElyIABBv8AAayICQRVNQQBBASACdEGDgIABcRtyIABB0MEAa0ENSSAAQe/ZAGtBA0lyIABB/9oARiAAQWBxQeDbAEZycnIgAEGq4ABrQQZJIABBmeEAa0ECSXIgAEHvzAJGIABB9MwCa0EKSXJyIABBoMwCa0EKSXJyDQIgAEGezQJrQQJJIABB8M0Ca0ECSXIgAEGL0AJrIgJBHE1BAEEBIAJ0QYGAgPgBcRtyDQICQAJAIABBgtACaw4FAgEBAQIACyAAQYDRAmtBAkkNAwsgAUGA0wJGIABBs9MCa0EOSXIgAEHH0gJrQQ1JIABBptICa0EISXJyIABB/9ECa0ELSSAAQeDRAmtBEklyIABBtNECa0ESSSAAQdDRAmtBCklycnIgAEHl0wJGIABBqdQCa0EOSXJyDQIgAEFecUHQ0wJrQQpJDQEgAEHQ1AJrQQpJIABBw9QCayIBQQpNQQBBASABdEGBDHEbcg0BIABB49cCayIBQQpNIAFBCEdxDQEgAEGw1QJrIgFBEU1BAEEBIAF0QZ2DC3EbDQEgAEH71AJrQQNJIABB69UCayIBQQtNQQBBASABdEGfGHEbcg0BIABBcHEiAUGA/ANGIABBnvYDRnINASAAQfDXAmtBCkkNACABQaD8A0YgAEGz/ANrQQJJciAAQc38A2tBA0lyIABBkP4Da0EKSXIgAEG//gNGcgwDC0EBDAILQQEMAQtBAQsPC0EBIQEgABAfDQBBACEBQYCABCEEQX4hA0GwFyECAkADQCADQQJqIgNB+QFLDQEgACACKAIAIARqIgRJBEBBACEBDAILIAJBBGohASACQQhqIQIgASgCACAEaiIEIABJDQALQQEhAQsgA0H6AUkgAXEhAQsgAQ8LQQELXQEBfyAAQcAATQRAIABBJEYPC0EBIQECQCAAQdsASQ0AIABB4ABNBEAgAEHfAEYPCyAAQfsASQ0AIABB//8DTQRAQQAhASAAQaoBSQ0BIAAQIA8LIAAQHyEBCyABC0YBA38CQCAAQQJrIgRBmB8oAgAiBUkNACAELwEAIAFHDQAgAC8BACACRw0AIAQgBUYEQEEBDwsgAEEEay8BABAPIQMLIAMLYAEDfwJAIABBBmsiBkGYHygCACIHSQ0AIAYvAQAgAUcNACAAQQRrLwEAIAJHDQAgAEECay8BACADRw0AIAAvAQAgBEcNACAGIAdGBEBBAQ8LIABBCGsvAQAQDyEFCyAFC3oBAX8gABAhIgEQEyEAAn8gAUHcAEcEQEEAIABFDQEaC0G8oAEoAgBBAkEEIAFBgIAESRtqIQACQANAQbygASAANgIAIAAvAQAQISIBRQ0BIAEQEgRAIABBAkEEIAFBgIAESRtqIQAMAQsLQQAgAUHcAEYNARoLQQELC5MBAQF/AkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUcNACAALwEKQdAARw0AIAAvAQxB8gBHDQAgAC8BDkHvAEcNACAALwEQQfAARw0AIAAvARJB5QBHDQAgAC8BFEHyAEcNACAALwEWQfQARw0AIAAvARhB+QBGIQYLIAYLmwEBAn9BvKABKAIAIQECQCAAQe0ARgR/IAFBAmpB7wBB5ABB9QBB7ABB5QAQB0UNAUG8oAEgAUEMajYCABARQS5HBEAMAgtBvKABQbygASgCAEECajYCABARBSAAC0HlAEcNAEG8oAEoAgAiAEEOaiABIABBAmpB+ABB8ABB7wBB8gBB9ABB8wAQECICGyEBC0G8oAEgATYCACACC2wBAX8CQCAALwEAQe4ARw0AIAAvAQJB9QBHDQAgAC8BBEHtAEcNACAALwEGQeUARw0AIAAvAQhB8gBHDQAgAC8BCkHhAEcNACAALwEMQeIARw0AIAAvAQ5B7ABHDQAgAC8BEEHlAEYhAQsgAQvzAwEEfwJAEBFBzwBHDQBBvKABKAIAIgJBAmpB4gBB6gBB5QBB4wBB9AAQB0UNAEG8oAEgAkEMajYCABARQS5HDQBBvKABQbygASgCAEECajYCABARIgJB8ABGBH8CQEG8oAEoAgAiBEECaiICLwEAQfIARw0AIAIvAQJB7wBHDQAgAi8BBEH0AEcNACACLwEGQe8ARw0AIAIvAQhB9ABHDQAgAi8BCkH5AEcNACACLwEMQfAARw0AIAIvAQ5B5QBGIQMLIANFDQFBvKABIARBEmo2AgAQEUEuRw0BQbygAUG8oAEoAgBBAmo2AgAQEQUgAgtB6ABHDQBBvKABKAIAIgJBAmpB4QBB8wBBzwBB9wBB7gAQF0UNAEG8oAEgAkEcajYCABARQS5HDQBBvKABQbygASgCAEECajYCABARQeMARw0AQbygASgCACICLwECQeEARw0AIAIvAQRB7ABHDQAgAi8BBkHsAEcNAEG8oAEgAkEIajYCABARQShHDQBBvKABQbygASgCAEECajYCABAREBZFDQAQEUEsRw0AQbygAUG8oAEoAgBBAmo2AgAQERpBvKABKAIAIgIgACABQQF0IgAQIw0AQbygASAAIAJqNgIAEBFBKUcNAEG8oAFBvKABKAIAQQJqNgIAQQEhBQsgBQtDAQN/AkAgAEEIayIHQZgfKAIAIghJDQAgByABIAIgAyAEIAUQB0UNACAHIAhGBEBBAQ8LIABBCmsvAQAQDyEGCyAGC1MBA38CQCAAQQRrIgVBmB8oAgAiBkkNACAFLwEAIAFHDQAgAEECay8BACACRw0AIAAvAQAgA0cNACAFIAZGBEBBAQ8LIABBBmsvAQAQDyEECyAEC0UBA38CQCAAQQprIghBmB8oAgAiCUkNACAIIAEgAiADIAQgBSAGEBBFDQAgCCAJRgRAQQEPCyAAQQxrLwEAEA8hBwsgBws3AQJ/AkBBmB8oAgAiAyAASw0AIAAvAQAgAUcNACAAIANGBEBBAQ8LIABBAmsvAQAQDyECCyACC2YBBH9BgIAEIQFBfiEEQZAIIQICQANAIARBAmoiBEHnA0sNASAAIAIoAgAgAWoiAUkEQEEAIQMMAgsgAkEEaiEDIAJBCGohAiADKAIAIAFqIgEgAEkNAAtBASEDCyAEQegDSSADcQv/GwEFfwJAIABBxgVrQQxJIABB+AFrQcoDSXIgAEGqAWsiAUEQTUEAQQEgAXRBgZAEcRtyIABBwAFrQRdJIABB2AFrQR9JcnINACAAQfAGayIBQRxNQQBBASABdEHf+YK6AXEbDQAgAEGKCWtBpgFJIABB9wdrQYsBSXIgAEHgBWsiAUEOTUEAQQEgAXRBn6ABcRtyIABBjgdrQRRJIABBowdrQdMASXIgAEHvC2tBBEkgAEHQC2tBG0lycnINACAAQdkKRiAAQeAKa0EpSXIgAEGxCmtBJkkgAEHxDGtB4wBJcnIgAEGgDGtBK0lyDQAgAEF+cSIEQe4MRg0AAkACQAJAIABB1Q1rIgFBPE8EQCAAQZIOa0EeSQ0EDAELQoGAjLCAnIGACCABrYinQQFxIABBkg5rQR5Jcg0BCyAAQbEPRiAAQcoPa0EhSXIgAEHNDmtB2QBJcg0CIABBgBBrQRZJIABB9A9rIgFBBk1BAEEBIAF0QcMAcRtyDQICQAJAIABBpBBrDgUCAQEBAgALIABBmhBGDQMLIABBhBJrQTZJIABBthFrQQhJciAAQaARa0EVSSAAQcAQa0EZSXJyIABBvRJGIABB4BBrQQtJciAAQdASRiAAQdgSa0EKSXJycg0CIABB8RJrQRBJDQICQCAAQYUTayIBQQxPBEAgAEGTE2tBFkkNBAwBC0H/GSABdkEBcSAAQZMTa0EWSXINAQsgAEGqE2tBB0kgAEH8E2siAUEUTUEAQQEgAXRBgfzhAHEbcg0CIABBshNrIgFBHE1BAEEBIAF0QfGRgIABcRsNAiAAQZMUa0EWSSAAQdwTayIBQRVNQQBBASABdEG7gMABcRtyDQIgAEGqFGsiAUE1SUL/toOAgIDgCyABrYhCAYNQRXEgAEGTFWtBFkkgAEGPFWtBA0lyciAAQfIUa0EDSSAAQYUVa0EJSXJyDQICQAJAIABBqhVrDicCAgICAgICAQICAQICAgICAQEBAgEBAQEBAQEBAQEBAQEBAQEBAQIACyAAQeAVa0ECSSAAQfkVayIBQRdNQQBBASABdEGB4L8GcRtyDQMLIABBkxZrQRZJDQICQAJAIABB8RZrDjQCAQEBAQEBAQEBAQEBAQEBAQECAQICAgICAgEBAQICAgECAgICAQEBAgIBAgECAgEBAQICAAsgAEGqFmsiAUETTUEAQQEgAXRB//YjcRsNAyAAQdwWayIBQQVLDQAgAUECRw0DCyAAQagXa0EDSSAAQZIYa0EXSXIgAEGOGGtBA0kgAEGFGGtBCElyciAAQdAXRiAAQa4Xa0EMSXIgAEG9GEYgAEGqGGtBEElycnINAiAAQdgYayIBQSlJQoeGgICAICABrYhCAYNQRXEgAEGqGWtBCkkgAEGSGWtBF0lyciAAQYUZa0EISSAAQY4Za0EDSXJyDQIgAEGFGmsiAUELTSABQQhHcQ0CIABBtRlrIgFBCE1BAEEBIAF0QZ8CcRsNAiAAQb0aRiAAQZIaa0EpSXIgAEHeGWsiAUEUTUEAQQEgAXRBjYDgAHEbciAAQc4aRiAAQbMba0EJSXIgAEGaG2tBGEkgAEGFG2tBEklycnINAiAAQfoaa0EGSSAAQdQaa0EDSXIgAEHfGmtBA0lyDQIgAEG9G2siAUEKSUH5ByABdkEBcXENACAEQbIcRiAAQYEca0EwSXIgAEHAHGtBB0lyDQIgAEGBHWsiAUEMTUEAQQEgAXRByyVxGw0CIABBfHEiAUGUHUYgAEGZHWtBB0lyDQIgAEGhHWsiAkEmSULX7JuA+QUgAq2IQgGDUEVxIABBgCBrQStJIABBiB9rQQVJcnIgAEHJHmtBJElyDQIgAEF4cSIDQcAeRiAAQYAeRnIgAUHcHUZyDQICQCAAQb8gayICQShPBEAgAEHuIGtBA0kNBAwBC0KBgPjDxxggAq2Ip0EBcSAAQe4ga0EDSXINAQsgAEGOIUYgAEGgIWtBJklyIABBxyFGIABB9SBrQQ1JcnIgAEHNIUYgAEHKJGtBBElyIABB0CFrQStJIABB/CFrQc0CSXJycg0CIABB0CRrIgJBCUlB/wIgAnZBAXFxDQAgAEGyJWtBBEkgAEGQJWtBIUlyIABBiiVrQQRJIABB2iRrQQRJcnIgAEHgJGtBKUlyDQIgAEG4JWsiAkEJSUH/AiACdkEBcXENACAAQYAva0E0SSAAQe4ua0EDSXIgAEHgLmtBDUkgAEHALmtBEklyciAAQaAua0ESSSAAQY4ua0EESXIgAEGALmtBDUkgAEHuLWtBC0lycnINAiAAQaAta0HLAEkgAEGBLWtBGklyIABB7yxrQRFJIABBgShrQewESXJyIABB+CdrQQZJIABBoCdrQdYASXJyDQIgAEFwcSICQYAnRiAAQZgma0HDAElyIABBkiZrQQRJIABB2CVrQTlJcnIgAEHCJWtBBEkgAEHIJWtBD0lyIABB1y9GIABB3C9GcnJyDQIgAEGgMGtB2QBJIABBgDRrQRdJciAAQbAza0EaSSAAQYAza0EsSXJyIABB8DJrQQVJcg0CIABB0DJrQR5JIABBgDJrQR9JciAAQaoxRiAAQbAxa0HGAElyciAAQYAxa0EpSSAAQcU2a0EHSXIgAEGnNUYgAEGFNmtBL0lycnINASAAQaA0a0E1SSAAQek5a0EESXIgAEG9OWtBA0kgAEGQOWtBK0lyciAAQYA5a0EJSSAAQdo4a0EkSXIgAEHNOGtBA0kgAEGAOGtBJElycnINASAAQbo3a0EsSSAAQYM3a0EeSXIgBEGuN0ZyDQEgAEHuOWsiBUEJSUGPAyAFdkEBcXENACAAQcg+a0EGSSAAQaA+a0EmSXIgAEGYPmtBBkkgAEGAOmtBwAFJcnIgAEGAPGtBlgJJIABBgD9rQTVJciAAQd0+RiAAQd8+a0EfSXJycg0BIANB0D5GIABBfXFB2T5Gcg0BIABBtj9rIgNBCUlB/wIgA3ZBAXFxDQAgAEHyP2tBA0kgAEHgP2tBDUlyIAFB0D9GIABB1j9rQQZJcnIgAEHCP2tBA0kgAEHGP2tBB0lyIABB8cAARiAAQfY/a0EHSXJycg0BIABB/8AARiAAQZDBAGtBDUlyIABBgsIARiAAQYfCAEZyciAAQZXCAEYgAEGKwgBrQQpJcnINASAAQZjCAGsiA0ERSUG/oAUgA3ZBAXFxDQAgAUG8wgBGIABBqsIAa0EQSXINASAAQcXCAGsiA0EKSUGfBCADdkEBcXENACAAQeDYAGtBhQFJIABBsNgAa0EvSXIgAEHgwgBrQSlJIABBgNgAa0EvSXJyDQECQCAAQevZAGsiA0EJTwRAIABBgNoAa0EmSQ0DDAELQY8DIAN2QQFxIABBgNoAa0EmSXINAQsgAEGn2gBGIABBrdoARnIgAEGAygJrQY0CSSAAQdDJAmtBLklyciAAQYDAAmtBjQlJIABBgJwBa0HwowFJciACQfDjAEYgAEGA6ABrQbYzSXJycg0BIABBoOMAa0EbSSAAQbHiAGtB3gBJciABQfzhAEYgAEGF4gBrQStJcnIgAEGh4QBrQdoASSAAQZvhAGtBBUlyIABBweAAa0HWAEkgAEG44ABrQQVJcnJyDQEgAEGx4ABrQQVJIABBoeAAa0EJSXIgAEGF4ABrQQNJcg0BIABBZ3EiAUHA2wBrQQdJIAFBoNsAa0EHSXIgAEHv2gBGIABBgNsAa0EXSXJyIABBsNoAa0E4SSAAQYLRAmtBMklyIABBwNACa0E0SSAAQYzQAmtBF0lycnINASAAQYfQAmtBBEkgAEGD0AJrQQNJciAAQffPAmtBC0kgAEGLzwJrQS9JcnIgAEGizgJrQecASSAAQZfOAmtBCUlyIABBoM0Ca0HQAEkgAEH/zAJrQR9JcnJyDQEgAkGQzAJGIABBwMwCa0EvSXIgBEGqzAJGcg0BIABB8tECayIBQQ1JQb80IAF2QQFxcQ0AIABB4NICa0EdSSAAQYrSAmtBHElyIABBsNICa0EXSSAAQcTUAmtBCElyciAAQcDUAmtBA0kgAEGA1AJrQSlJciAAQfrTAmtBBUkgAEHm0wJrQQpJcnJyDQEgAEHP0wJGIABB4NMCa0EFSXIgAEGE0wJrQS9JIABB/tQCa0EySXJyIABB+tQCRiAAQeDUAmtBF0lycg0BIABBsdUCayIBQRJJQbG+CiABdkEBcXENACAAQYD2A2tBB0kgAEHw9ANrQeoASXIgAEGA8gNrQe4CSSAAQcuvA2tBMUlyciAAQbCvA2tBF0kgAEGA2AJrQaTXAElyIABB8NYCa0HzAEkgAEHc1gJrQQpJcnJyDQEgAEGw1gJrQStJDQEgAEF3cSIBQaDWAmtBB0kgAEGR1gJrQQZJciABQYHWAmtBBkkgAEHy1QJrQQNJcnIgAEHb1QJrQQNJIABB4NUCa0ELSXJyDQEgAEGT9gNrIgFBC0lBnwggAXZBAXFxDQAgAEGf9gNrQQpJIABBqvYDa0ENSXINASAAQbj2A2siAUENSUHfNiABdkEBcXENACAAQdL/A2tBBkkgAEF2cUHC/wNrQQZJciAAQeb+A2tB2QBJIABBwf4Da0EaSXJyIABBof4Da0EaSSAAQfb8A2tBhwFJciAAQfD8A2tBBUkgAEHw+wNrQQxJcnJyDQEgAEGS+wNrQTZJIABB0PoDa0HAAElyIABBxvYDa0HsAElyDQEgAEHT9wNrQesCSQ0AIABB2v8Da0EDSQ8LQQEPC0EBDwtBAQsyACAAQYD4A3FBgLADRgR/IABBCnRBgPg/cUG8oAEoAgAvAQJB/wdxckGAgARqBSAACwtdAQF/AkAgAEH4/wNxQShGIABBIWsiAUEFTUEAQQEgAXRBMXEbckUEQCAAQTprIgFB//8DcUElT0K/gICAoAMgAa2IQgGDUHINAQtBAQ8LIABB+wBrQf//A3FBBEkLQwEDfwJAIAJFDQADQCAALQAAIgQgAS0AACIFRgRAIAFBAWohASAAQQFqIQAgAkEBayICDQEMAgsLIAQgBWshAwsgAwt4AQF/QZgfKAIAIgEgAEEBdGoiAEEAOwEAQeQfIABBAmoiADYCAEHoHyAANgIAQcAfQQA2AgBByB9BADYCAEHEH0EANgIAQcwfQQA2AgBB1B9BADYCAEHQH0EANgIAQdgfQQA2AgBB4B9BADYCAEHcH0EANgIAIAELCABB7B8oAgALFQBBxB8oAgAoAgBBmB8oAgBrQQF1CxUAQcQfKAIAKAIEQZgfKAIAa0EBdQsVAEHQHygCACgCAEGYHygCAGtBAXULFQBB0B8oAgAoAgRBmB8oAgBrQQF1CxUAQdwfKAIAKAIAQZgfKAIAa0EBdQsVAEHcHygCACgCBEGYHygCAGtBAXULCgBBwB9BxB8QMQsKAEHMH0HQHxAxCwoAQdgfQdwfEDEL0UEBBX8Cf0GAwAAgATYCAEGYHyAANgIAIAIEQEGcHyACNgIACyADBEBBoB8gAzYCAAsgBARAQaQfIAQ2AgALQYjAAEH//wM7AQBBoOAAQaDAADYCAEGwoAFBsOAANgIAQbSgAUGAIDYCAEGMwABBrB8oAgA2AgBBvKABIABBAmsiAjYCAEHAoAEgAiABQQF0aiIDNgIAQYbAAEEAOwEAQYTAAEEAOwEAQZDAAEEAOgAAQewfQQA2AgBB8B9BADYCAEG4oAFBADoAAAJAAkAgAC8BAEEjRw0AIAAvAQJBIUcNAEEAIQIgAUECRg0BIABBBGohAANAIAAiAkECayADTw0BIABBAmohACACLwEAQQprDgQBAAABAAsACwNAQbygASACQQJqIgA2AgACQAJAAkAgAiADSQRAIAAvAQAiA0EJayIBQRdNQQBBASABdEGfgIAEcRsNAwJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAQYbAAC8BACIFRQRAAkACQAJAIANB3wBrDg8CEBMTBhMFExMTARMTEwQACwJAIANBJ2sOCQ4ICRMTExMTDwALAkAgA0H7AGsOAwsTDAALIANBIkYNDSADQc8ARg0GIANB8gBHDRICQEEAEARFDQAgABAFRQ0AIAIQBgtBjMAAQbygASgCADYCAAwTCwJAIAJBBGpB7QBB8ABB7wBB8gBB9AAQB0UNACAAEAVFDQBBvKABQbygASgCACIBQQxqIgA2AgACQAJAAkACQAJAAkACQBARIgJBJ2sOCAIDAQIBAQEEAAsgAkEiRiACQfsARnINAQtBvKABKAIAIABGDQQLQYbAAC8BAEUNAkG8oAFBvKABKAIAQQJrNgIADAMLQYbAAEGGwAAvAQAiAEEBajsBAEGwoAEoAgAgAEECdGogATYCAAwCC0EFEAsMAQtBBhALC0G8oAEoAgAhAAtBjMAAIAA2AgAMEgtBACEDAkAgAkEEaiIBLwEAQekARw0AIAEvAQJB7gBHDQAgAS8BBEH0AEcNACABLwEGQeUARw0AIAEvAQhB8gBHDQAgAS8BCkHvAEcNACABLwEMQfAARw0AIAEvAQ5B0gBHDQAgAS8BEEHlAEcNACABLwESQfEARw0AIAEvARRB9QBHDQAgAS8BFkHpAEcNACABLwEYQfIARw0AIAEvARpB5QBHDQAgAS8BHEHXAEcNACABLwEeQekARw0AIAEvASBB7ABHDQAgAS8BIkHkAEcNACABLwEkQeMARw0AIAEvASZB4QBHDQAgAS8BKEHyAEcNACABLwEqQeQARiEDCwJAAkAgA0UNACAAEAVFBEAgAi8BAEEuRw0BC0G8oAEgAkEwajYCACACLwEwQShHDQFBvKABIAJBMmo2AgBBhsAAQQE7AQBBsKABKAIAQYzAACgCADYCAEEAEARFDQEgABAFRQ0BIAIQBgwBCyABQd8AQeUAQfgAQfAAQe8AQfIAQfQAEAhFDQAgABAFRQRAIAIvAQBBLkcNAQtBvKABIAJBEmo2AgAgAi8BEiIAQdMARgR/IAIvARRB9ABHDQEgAi8BFkHhAEcNASACLwEYQfIARw0BQbygASACQRpqNgIAIAIvARoFIAALQf//A3FBKEcNAEGwoAEoAgBBjMAAKAIANgIAQYbAAEEBOwEAQbygAUG8oAEoAgAiAEECajYCACAALwECQfIARw0AQQIQBBoLQYzAAEG8oAEoAgA2AgAMEQsCQCADQSdrDgkLBQcQEBAQEAwACwJAIANB4ABrDgYNEBADEAIACwJAIANB+wBrDgMIEAoACyADQSJGDQogA0HPAEYNAyADQe0ARw0PCyACQQRqQe8AQeQAQfUAQewAQeUAEAdFDQ4gABAFRQ0OQbygAUG8oAEoAgAiAEEMajYCAAJAAkAQEUEuRw0AQbygAUG8oAEoAgBBAmo2AgAQEUHlAEcNAEG8oAEoAgBBAmpB+ABB8ABB7wBB8gBB9ABB8wAQEEUNAEEBEAkMAQtBvKABIABBCmo2AgALDA4LIAJBBGpB+ABB8ABB7wBB8gBB9AAQB0UNDSAAEAVFDQ0gAi8BDkHzAEYEQEEAEAkMDgsgBQ0NQbygAUG8oAEoAgBBDGoiATYCABARIQACQCABQbygASgCAEYEQCAAECJFDQELQQcQCwsMDQsgABAFRQ0MIAIvAQRB7ABHDQwgAi8BBkHhAEcNDCACLwEIQfMARw0MIAIvAQpB8wBHDQwgAi8BDBAKRQ0MQbigAUEBOgAADAwLIAJBBGpB4gBB6gBB5QBB4wBB9AAQB0UNCyAAEAVFDQsgBUUhAUG8oAFBvKABKAIAIgBBDGo2AgAgAEEKaiECAkACQBARQS5HDQBBvKABQbygASgCAEECajYCAAJAEBEiAEHkAEYEQEG8oAEoAgAiAEECakHlAEHmAEHpAEHuAEHlABAXRQ0CQbygASAAQRxqNgIAIABBGmohAhARQShHDQJBvKABQbygASgCAEECajYCABAREBhFDQIQEUEsRw0CQbygAUG8oAEoAgBBAmo2AgAQESIAQSdHIABBIkdxDQJBvKABKAIAIQQgABAMQbygAUG8oAEoAgBBAmoiAzYCABARQSxHDQFBvKABQbygASgCAEECajYCABARQfsARw0BQbygAUG8oAEoAgBBAmo2AgAQESIAQeUARgRAQbygASgCACIAQQJqEBlFDQJBvKABIABBFGo2AgAQEUE6Rw0CQbygAUG8oAEoAgBBAmo2AgAQEUH0AEcNAkG8oAEoAgAiAC8BAkHyAEcNAiAALwEEQfUARw0CIAAvAQZB5QBHDQJBvKABIABBCGo2AgAQEUEsRw0CQbygAUG8oAEoAgBBAmo2AgAQESEACyAAQecARwRAIABB9gBHDQJBvKABKAIAIgAvAQJB4QBHDQIgAC8BBEHsAEcNAiAALwEGQfUARw0CIAAvAQhB5QBHDQJBvKABIABBCmo2AgAQEUE6Rw0CIAQgA0GcHygCABEBAEG8oAEgAjYCAAwEC0G8oAEoAgAiAC8BAkHlAEcNASAALwEEQfQARw0BQbygASAAQQZqNgIAEBEiAEE6RgR/QbygAUG8oAEoAgBBAmo2AgAQEUHmAEcNAkG8oAEoAgAiAEECakH1AEHuAEHjAEH0AEHpAEHvAEHuABAIRQ0CQbygASAAQRBqIgE2AgAQESIAQShHBEAgAUG8oAEoAgBGDQMgABAWRQ0DCxARBSAAC0EoRw0BQbygAUG8oAEoAgBBAmo2AgAQEUEpRw0BQbygAUG8oAEoAgBBAmo2AgAQEUH7AEcNAUG8oAFBvKABKAIAQQJqNgIAEBFB8gBHDQFBvKABKAIAIgBBAmpB5QBB9ABB9QBB8gBB7gAQB0UNAUG8oAEgAEEMajYCABAREBZFDQECQAJAEBEiAEHbAEcEQCAAQS5HDQJBvKABQbygASgCAEECajYCABAREBYNAQwEC0G8oAFBvKABKAIAQQJqNgIAEBEiAEEnRyAAQSJHcQ0DIAAQDEG8oAFBvKABKAIAQQJqNgIAEBFB3QBHDQNBvKABQbygASgCAEECajYCAAsQESEACyAAQTtGBH9BvKABQbygASgCAEECajYCABARBSAAC0H9AEcNAUG8oAFBvKABKAIAQQJqNgIAEBEiAEEsRgR/QbygAUG8oAEoAgBBAmo2AgAQEQUgAAtB/QBHDQFBvKABQbygASgCAEECajYCABARQSlHDQEgBCADQZwfKAIAEQEADAMLIAFFIABB6wBHcg0BQbygASgCACIALwECQeUARw0BIAAvAQRB+QBHDQEgAC8BBkHzAEcNASAAQQZqIQJBvKABIABBCGo2AgAQEUEoRw0BQbygAUG8oAEoAgBBAmo2AgAQEUG8oAEoAgAhBhAWRQ0BQbygASgCABARQSlHDQFBvKABQbygASgCACICQQJqNgIAEBFBLkcNAUG8oAFBvKABKAIAQQJqNgIAEBFB5gBHDQFBvKABKAIAIgBBAmpB7wBB8gBBxQBB4QBB4wBB6AAQEEUNAUG8oAEgAEEOajYCABARQbygASgCACIAQQJrIQJBKEcNAUG8oAEgAEECajYCABARQeYARw0BQbygASgCACIAQQJqQfUAQe4AQeMAQfQAQekAQe8AQe4AEAhFDQFBvKABIABBEGo2AgAQEUEoRw0BQbygAUG8oAEoAgBBAmo2AgAQEUG8oAEoAgAhBxAWRQ0BQbygASgCACEBEBFBKUcNAUG8oAFBvKABKAIAQQJqNgIAEBFB+wBHDQFBvKABQbygASgCAEECajYCABARQekARw0BQbygASgCACIALwECQeYARw0BQbygASAAQQRqNgIAEBFBKEcNAUG8oAFBvKABKAIAQQJqNgIAEBEaQbygASgCACIAIAcgASAHayIJECMNASAGayIFQQF1IQRBvKABIAAgCUEBdSIIQQF0ajYCAAJAAkACQBARIgBBIUcEQCAAQT1HDQVBvKABKAIAIgAvAQJBPUcNBSAALwEEQT1HDQVBvKABIABBBmo2AgAQESIBQSdHIAFBIkdxDQVBvKABKAIAIgBBAmpB5ABB5QBB5gBB4QBB9QBB7ABB9AAQCEUNBUG8oAEgAEEQajYCABARIAFHDQVBvKABQbygASgCAEECajYCABARQfwARw0FQbygASgCACIALwECQfwARw0FQbygASAAQQRqNgIAEBEaQbygASgCACIAIAcgCRAjDQVBvKABIAAgCEEBdGo2AgAQEUE9Rw0FQbygASgCACIALwECQT1HDQUgAC8BBEE9Rw0FQbygASAAQQZqNgIAEBEiA0EnRyADQSJHcQ0FQQAhAQJAQbygASgCACIAQQJqIgovAQBB3wBHDQAgCi8BAkHfAEcNACAKLwEEQeUARw0AIAovAQZB8wBHDQAgCi8BCEHNAEcNACAKLwEKQe8ARw0AIAovAQxB5ABHDQAgCi8BDkH1AEcNACAKLwEQQewARw0AIAovARJB5QBGIQELIAFFDQVBvKABIABBFmo2AgAQESADRw0FQbygAUG8oAEoAgBBAmo2AgAQEUEpRw0FQbygAUG8oAEoAgBBAmo2AgAQEUHyAEcNBUG8oAEoAgAiAEECakHlAEH0AEH1AEHyAEHuABAHRQ0FQbygASAAQQxqNgIAEBFBO0YEQEG8oAFBvKABKAIAQQJqNgIACxARIgBB6QBHDQNB6QAhAEG8oAEoAgAiAS8BAkHmAEcNA0G8oAEgAUEEajYCABARQShHDQVBvKABQbygASgCAEECaiIANgIAIAcgCBAaBEAQEUEpRw0GQbygAUG8oAEoAgBBAmo2AgAQEUHyAEcNBkG8oAEoAgAiAEECakHlAEH0AEH1AEHyAEHuABAHRQ0GQbygASAAQQxqNgIAEBFBO0YEQEG8oAFBvKABKAIAQQJqNgIACxARIgBB6QBHDQRB6QAhAEG8oAEoAgAiAS8BAkHmAEcNBEG8oAEgAUEEajYCABARQShHDQZBvKABKAIAQQJqIQALQbygASAANgIAIAAgByAJECMNBUG8oAEgACAIQQF0ajYCABARQekARw0FQbygASgCACIALwECQe4ARw0FIAAvAQRBIEcNBUG8oAEgAEEGajYCABAREBhFDQUQEUEmRw0FQbygASgCACIALwECQSZHDQVBvKABIABBBGo2AgAQERAYRQ0FEBFB2wBHDQVBvKABQbygASgCAEECajYCABARGkG8oAEoAgAiACAHIAkQIw0FQbygASAAIAhBAXRqNgIAEBFB3QBHDQVBvKABQbygASgCAEECajYCABARQT1HDQVBvKABKAIAIgAvAQJBPUcNBSAALwEEQT1HDQVBvKABIABBBmo2AgAQERpBvKABKAIAIgAgBiAFECMNBUG8oAEgACAEQQF0ajYCABARQdsARw0FQbygAUG8oAEoAgBBAmo2AgAQERpBvKABKAIAIgAgByAJECMNBUG8oAEgACAIQQF0ajYCABARQd0ARw0FQbygAUG8oAEoAgBBAmo2AgAQEUEpRw0FQbygAUG8oAEoAgBBAmo2AgAQEUHyAEcNBUG8oAEoAgAiAEECakHlAEH0AEH1AEHyAEHuABAHRQ0FQbygASAAQQxqNgIAEBFBO0YNAQwCC0G8oAEoAgAiAC8BAkE9Rw0EIAAvAQRBPUcNBEG8oAEgAEEGajYCABARIgFBJ0cgAUEiR3ENBEG8oAEoAgAiAEECakHkAEHlAEHmAEHhAEH1AEHsAEH0ABAIRQ0EQbygASAAQRBqNgIAEBEgAUcNBEG8oAFBvKABKAIAQQJqNgIAEBEiAEEmRgR/QbygASgCACIALwECQSZHDQVBvKABIABBBGo2AgAQEUEhRw0FQbygAUG8oAEoAgBBAmo2AgACQAJAEBEiAEHPAEcNAEG8oAEoAgBBAmpB4gBB6gBB5QBB4wBB9ABBLhAQRQ0AIAcgCBAaRQ0HDAELIAAQFkUNABARQS5HDQZBvKABQbygASgCAEECajYCABARQegARw0GQbygASgCACIAQQJqQeEAQfMAQc8AQfcAQe4AEBdFDQZBvKABIABBHGo2AgAQEUEoRw0GQbygAUG8oAEoAgBBAmo2AgAQERpBvKABKAIAIgAgByAJECMNBkG8oAEgACAIQQF0ajYCABARQSlHDQZBvKABQbygASgCAEECajYCAAsQEQUgAAtBKUcNBAtBvKABQbygASgCAEECajYCAAsQESEACwJAAkAgABAYBEAQEUHbAEcNBEG8oAFBvKABKAIAQQJqNgIAEBEaQbygASgCACIAIAcgCRAjDQRBvKABIAAgCEEBdGo2AgAQEUHdAEcNBEG8oAFBvKABKAIAQQJqNgIAEBFBPUcNBEG8oAFBvKABKAIAQQJqNgIAEBEaQbygASgCACIAIAYgBRAjDQRBvKABIAAgBEEBdGo2AgAQEUHbAEcNBEG8oAFBvKABKAIAQQJqNgIAEBEaQbygASgCACIAIAcgCRAjDQRBvKABIAAgCEEBdGo2AgAQEUHdAEcNBEG8oAFBvKABKAIAQQJqNgIAEBEiAEE7Rg0BDAILIABBzwBHDQNBvKABKAIAIgBBAmpB4gBB6gBB5QBB4wBB9AAQB0UNA0G8oAEgAEEMajYCABARQS5HDQNBvKABQbygASgCAEECajYCABARQeQARw0DQbygASgCACIAQQJqQeUAQeYAQekAQe4AQeUAEBdFDQNBvKABIABBHGo2AgAQEUEoRw0DQbygAUG8oAEoAgBBAmo2AgAQERAYRQ0DEBFBLEcNA0G8oAFBvKABKAIAQQJqNgIAEBEaQbygASgCACIAIAcgCRAjDQNBvKABIAAgCEEBdGo2AgAQEUEsRw0DQbygAUG8oAEoAgBBAmo2AgAQEUH7AEcNA0G8oAFBvKABKAIAQQJqNgIAEBFB5QBHDQNBvKABKAIAIgBBAmoQGUUNA0G8oAEgAEEUajYCABARQTpHDQNBvKABQbygASgCAEECajYCABARQbygASgCACEBQfQARwRAIAEvAQJB8gBHDQQgAS8BBEH1AEcNBCABLwEGQeUARw0EC0G8oAEgAUEIajYCABARQSxHDQNBvKABQbygASgCAEECajYCABARQecARw0DQbygASgCACIALwECQeUARw0DIAAvAQRB9ABHDQNBvKABIABBBmo2AgAQESIAQTpGBH9BvKABQbygASgCAEECajYCABARQeYARw0EQbygASgCACIAQQJqQfUAQe4AQeMAQfQAQekAQe8AQe4AEAhFDQRBvKABIABBEGoiATYCABARIgBBKEcEQCABQbygASgCAEYNBSAAEBZFDQULEBEFIAALQShHDQNBvKABQbygASgCAEECajYCABARQSlHDQNBvKABQbygASgCAEECajYCABARQfsARw0DQbygAUG8oAEoAgBBAmo2AgAQEUHyAEcNA0G8oAEoAgAiAEECakHlAEH0AEH1AEHyAEHuABAHRQ0DQbygASAAQQxqNgIAEBEaQbygASgCACIAIAYgBRAjDQNBvKABIAAgBEEBdGo2AgAQEUHbAEcNA0G8oAFBvKABKAIAQQJqNgIAEBEaQbygASgCACIAIAcgCRAjDQNBvKABIAAgCEEBdGo2AgAQEUHdAEcNA0G8oAFBvKABKAIAQQJqNgIAEBEiAEE7RgR/QbygAUG8oAEoAgBBAmo2AgAQEQUgAAtB/QBHDQNBvKABQbygASgCAEECajYCABARIgBBLEYEf0G8oAFBvKABKAIAQQJqNgIAEBEFIAALQf0ARw0DQbygAUG8oAEoAgBBAmo2AgAQEUEpRw0DQbygAUG8oAEoAgBBAmo2AgAQESIAQTtHDQELQbygAUG8oAEoAgBBAmo2AgAQESEACyAAQf0ARw0BQbygAUG8oAEoAgBBAmo2AgAQEUEpRw0BQbSgASgCACEDQYAgIQADQAJAIAAgA0cEQCAEIABBDGooAgAgAEEIaigCACIBa0EBdUcNASAGIAEgBRAjDQEgACgCACAAQQRqKAIAQaAfKAIAEQEAQbygASACNgIACwwECyAAQRBqIQAMAAsACyAEIANBpB8oAgARAQALQbygASACNgIACwwLC0GGwAAgBUEBajsBAEGwoAEoAgAgBUECdGpBjMAAKAIANgIADAoLQQgQC0HwHygCAAwNC0GGwAAgBUEBazsBAAwICyAFQdCgAWpBuKABLQAAOgAAQYbAACAFQQFqOwEAQbCgASgCACAFQQJ0akGMwAAoAgA2AgBBuKABQQA6AAAMBwtBAhALQQAMCgtBhsAAIAVBAWsiADsBAEGIwAAvAQAiASAFRgRAQYTAAEGEwAAvAQBBAWsiADsBAEGIwABBoOAAKAIAIABB//8DcUEBdGovAQA7AQAMBQsgAUH//wNGIABB//8DcSABT3INBUEDEAtB8B8oAgAMCQsgAxAMDAQLAkAgAi8BBCIAQSpHBEAgAEEvRw0BEA0MBgsQDgwFC0GQwAACfwJAAkACfwJAQYzAACgCACIGLwEAIgRBKUcgBEEoa0H//wNxQQdJcSAEQSFrIgBBBU1BAEEBIAB0QTFxG3JFBEAgBEE6ayIAQf//A3FBJU9Cv4CAgKACIACtiEIBg1ByDQELQQEMAQsgBEH9AEcgBEH7AGtB//8DcUEESXELBEACQAJAAkAgBEEraw4EAQUCAAULIAZBAmsvAQBBMGtB//8DcUEKSQ0DDAQLIAZBAmsvAQBBK0YNAgwDCyAGQQJrLwEAQS1GDQEMAgsCQCAEQf0ARwRAIARBL0YNASAEQSlHDQJBASEDAkBBsKABKAIAIAVBAnRqKAIAIgBB9wBB6ABB6QBB7ABB5QAQGw0AIABB5gBB7wBB8gAQHA0AIABB6QBB5gAQFCEDCyADRQ0CDAMLAn9BASEAAkACQAJAAkACQAJAQbCgASgCACAFQQJ0aigCACICLwEAIgFBO2sOBAUEBAEACwJAIAFB5QBrDgQDBAQCAAsgAUEpRg0EIAFB+QBHDQMgAkECa0HmAEHpAEHuAEHhAEHsAEHsABAdDAULIAJBAmsvAQBBPUYMBAsgAkECa0HjAEHhAEH0AEHjABAVDAMLIAJBAmtB5QBB7ABB8wAQHAwCC0EAIQALIAALDQIgBUHQoAFqLQAARQ0BDAILQZDAAC0AAA0BCwJ/QQAhAwJAAkACQAJAAkACQAJAAkACQCAGLwEAQeQAaw4UAAECCAgICAgICAMECAgFCAYICAcICwJAAkAgBkECay8BAEHpAGsOBAAJCQEJCyAGQQRrQfYAQe8AEBQMCQsgBkEEa0H5AEHpAEHlABAcDAgLAkACQCAGQQJrLwEAQfMAaw4CAAEICyAGQQRrLwEAIgBB4QBHBEAgAEHsAEcNCCAGQQZrQeUAEB4MCQsgBkEGa0HjABAeDAgLIAZBBGtB5ABB5QBB7ABB5QAQFQwHCyAGQQJrLwEAQe8ARw0FIAZBBGsvAQBB5QBHDQUgBkEGay8BACIAQfAARwRAIABB4wBHDQYgBkEIa0HpAEHuAEHzAEH0AEHhAEHuABAdDAcLIAZBCGtB9ABB+QAQFAwGC0EBIQMgBkECayIAQekAEB4NBCAAQfIAQeUAQfQAQfUAQfIAEBsMBQsgBkECa0HkABAeDAQLAn8CQCAGQQJrIgFBDGsiAkGYHygCACIASQ0AIAJB5ABB5QBB4gBB9QBB5wBB5wBB5QAQCEUNAEEBIAAgAkYNARogAUEOay8BABAPIQMLIAMLDAMLIAZBAmtB4QBB9wBB4QBB6QAQFQwCCyAGQQJrLwEAIgBB7wBHBEAgAEHlAEcNASAGQQRrQe4AEB4MAgsgBkEEa0H0AEHoAEHyABAcIQMLIAMLIQAgBEUNAEEBIABFDQEaCwJAA0BBwKABKAIAIQJBvKABKAIAIQADQCAAQQJqIQECQAJAIAAgAk8NAAJAAkACQCABLwEAIgNB2wBrDgIBAgALIAEhACADQQprDgQCBAQCAwtBvKABIAE2AgBBvKABKAIAIQBBwKABKAIAIQMCQAJAA0ACQCAAQQJqIQEgACADTw0AAkACQCABLwEAIgJB3ABrDgIBBAALIAEhACACQQprDgQBAgIBAgsgAEEEaiEADAELC0G8oAEgATYCAEEKEAsMAQtBvKABIAE2AgALDAQLIABBBGohAAwCC0G8oAEgATYCAEELEAsMAwsgA0EvRw0ACwtBvKABIAE2AgALQQALOgAADAMLQYjAAC8BAEH+/wNHDQFBBBALQfAfKAIADAYLQYbAAC8BABpB8B8oAgAiACAAQYjAAC8BAEH//wNHGyECDAQLQbygASgCACEAQcCgASgCACEDAkACQANAAkAgACIBQQJqIQAgASADTw0AAkACQCAALwEAIgJB3ABrDgUBAwMDBAALIAJBJEcNAiABLwEEQfsARw0CQYTAAEGEwAAvAQAiAEEBajsBAEGg4AAoAgAgAEEBdGpBiMAALwEAOwEAQbygASABQQRqNgIAQYjAAEGGwAAvAQBBAWoiADsBAEGGwAAgADsBAAwECyABQQRqIQAMAQsLQbygASAANgIAQQgQCwwBC0G8oAEgADYCAAsLQYzAAEG8oAEoAgA2AgALQcCgASgCACEDQbygASgCACECDAALAAsgAgsLRQEBfyACKAIAIgRBCGogAyAEG0HoHygCACIENgIAIAIgBDYCAEHoHyAEQQxqNgIAIARBADYCCCAEIAE2AgQgBCAANgIACyIBAX8gASABKAIAIgJBCGogACACGygCACICNgIAIAJBAEcLC6kXAgBBlAgLgRcLAAAAAgAAABkAAAACAAAAEgAAAAIAAAABAAAAAgAAAA4AAAADAAAADQAAACMAAAB6AAAARgAAADQAAAAMAQAAHAAAAAQAAAAwAAAAMAAAAB8AAAAOAAAAHQAAAAYAAAAlAAAACwAAAB0AAAADAAAAIwAAAAUAAAAHAAAAAgAAAAQAAAArAAAAnQAAABMAAAAjAAAABQAAACMAAAAFAAAAJwAAAAkAAAAzAAAAnQAAADYBAAAKAAAAFQAAAAsAAAAHAAAAmQAAAAUAAAADAAAAAAAAAAIAAAArAAAAAgAAAAEAAAAEAAAAAAAAAAMAAAAWAAAACwAAABYAAAAKAAAAHgAAAEIAAAASAAAAAgAAAAEAAAALAAAAFQAAAAsAAAAZAAAARwAAADcAAAAHAAAAAQAAAEEAAAAAAAAAEAAAAAMAAAACAAAAAgAAAAIAAAAcAAAAKwAAABwAAAAEAAAAHAAAACQAAAAHAAAAAgAAABsAAAAcAAAANQAAAAsAAAAVAAAACwAAABIAAAAOAAAAEQAAAG8AAABIAAAAOAAAADIAAAAOAAAAMgAAAA4AAAAjAAAAXQEAACkAAAAHAAAAAQAAAE8AAAAcAAAACwAAAAAAAAAJAAAAFQAAAGsAAAAUAAAAHAAAABYAAAANAAAANAAAAEwAAAAsAAAAIQAAABgAAAAbAAAAIwAAAB4AAAAAAAAAAwAAAAAAAAAJAAAAIgAAAAQAAAAAAAAADQAAAC8AAAAPAAAAAwAAABYAAAAAAAAAAgAAAAAAAAAkAAAAEQAAAAIAAAAYAAAAVQAAAAYAAAACAAAAAAAAAAIAAAADAAAAAgAAAA4AAAACAAAACQAAAAgAAAAuAAAAJwAAAAcAAAADAAAAAQAAAAMAAAAVAAAAAgAAAAYAAAACAAAAAQAAAAIAAAAEAAAABAAAAAAAAAATAAAAAAAAAA0AAAAEAAAAnwAAADQAAAATAAAAAwAAABUAAAACAAAAHwAAAC8AAAAVAAAAAQAAAAIAAAAAAAAAuQAAAC4AAAAqAAAAAwAAACUAAAAvAAAAFQAAAAAAAAA8AAAAKgAAAA4AAAAAAAAASAAAABoAAADmAAAAKwAAAHUAAAA/AAAAIAAAAAcAAAADAAAAAAAAAAMAAAAHAAAAAgAAAAEAAAACAAAAFwAAABAAAAAAAAAAAgAAAAAAAABfAAAABwAAAAMAAAAmAAAAEQAAAAAAAAACAAAAAAAAAB0AAAAAAAAACwAAACcAAAAIAAAAAAAAABYAAAAAAAAADAAAAC0AAAAUAAAAAAAAACMAAAA4AAAACAEAAAgAAAACAAAAJAAAABIAAAAAAAAAMgAAAB0AAABxAAAABgAAAAIAAAABAAAAAgAAACUAAAAWAAAAAAAAABoAAAAFAAAAAgAAAAEAAAACAAAAHwAAAA8AAAAAAAAASAEAABIAAAC+AAAAAAAAAFAAAACZAwAAZwAAAG4AAAASAAAAwwAAAL0KAAAuBAAA0g8AAEYCAAC6IQAAOAIAAAgAAAAeAAAAcgAAAB0AAAATAAAALwAAABEAAAADAAAAIAAAABQAAAAGAAAAEgAAALECAAA/AAAAgQAAAEoAAAAGAAAAAAAAAEMAAAAMAAAAQQAAAAEAAAACAAAAAAAAAB0AAAD3FwAACQAAANUEAAArAAAACAAAAPgiAAAeAQAAMgAAAAIAAAASAAAAAwAAAAkAAACLAQAABQkAAGoAAAAGAAAADAAAAAQAAAAIAAAACAAAAAkAAABnFwAAVAAAAAIAAABGAAAAAgAAAAEAAAADAAAAAAAAAAMAAAABAAAAAwAAAAMAAAACAAAACwAAAAIAAAAAAAAAAgAAAAYAAAACAAAAQAAAAAIAAAADAAAAAwAAAAcAAAACAAAABgAAAAIAAAAbAAAAAgAAAAMAAAACAAAABAAAAAIAAAAAAAAABAAAAAYAAAACAAAAUwEAAAMAAAAYAAAAAgAAABgAAAACAAAAHgAAAAIAAAAYAAAAAgAAAB4AAAACAAAAGAAAAAIAAAAeAAAAAgAAABgAAAACAAAAHgAAAAIAAAAYAAAAAgAAAAcAAAA1CQAALAAAAAsAAAAGAAAAEQAAAAAAAAByAQAAKwAAABUFAADEAAAAPAAAAEMAAAAIAAAAAAAAALUEAAADAAAAAgAAABoAAAACAAAAAQAAAAIAAAAAAAAAAwAAAAAAAAACAAAACQAAAAIAAAADAAAAAgAAAAAAAAACAAAAAAAAAAcAAAAAAAAABQAAAAAAAAACAAAAAAAAAAIAAAAAAAAAAgAAAAIAAAACAAAAAQAAAAIAAAAAAAAAAwAAAAAAAAACAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAABAAAAAgAAAAAAAAADAAAAAwAAAAIAAAAGAAAAAgAAAAMAAAACAAAAAwAAAAIAAAAAAAAAAgAAAAkAAAACAAAAEAAAAAYAAAACAAAAAgAAAAQAAAACAAAAEAAAAEURAADdpgAAIwAAADQQAAAMAAAA3QAAAAMAAACBFgAADwAAADAdAAAgDAAAHQIAAOMFAABKEwAA/QEAAAAAAADjAAAAAAAAAJYAAAAEAAAAJgEAAAkAAABYBQAAAgAAAAIAAAABAAAABgAAAAMAAAApAAAAAgAAAAUAAAAAAAAApgAAAAEAAAA+AgAAAwAAAAkAAAAJAAAAcgEAAAEAAACaAAAACgAAALAAAAACAAAANgAAAA4AAAAgAAAACQAAABAAAAADAAAALgAAAAoAAAA2AAAACQAAAAcAAAACAAAAJQAAAA0AAAACAAAACQAAAAYAAAABAAAALQAAAAAAAAANAAAAAgAAADEAAAANAAAACQAAAAMAAAACAAAACwAAAFMAAAALAAAABwAAAAAAAAChAAAACwAAAAYAAAAJAAAABwAAAAMAAAA4AAAAAQAAAAIAAAAGAAAAAwAAAAEAAAADAAAAAgAAAAoAAAAAAAAACwAAAAEAAAADAAAABgAAAAQAAAAEAAAAwQAAABEAAAAKAAAACQAAAAUAAAAAAAAAUgAAABMAAAANAAAACQAAANYAAAAGAAAAAwAAAAgAAAAcAAAAAQAAAFMAAAAQAAAAEAAAAAkAAABSAAAADAAAAAkAAAAJAAAAVAAAAA4AAAAFAAAACQAAAPMAAAAOAAAApgAAAAkAAABHAAAABQAAAAIAAAABAAAAAwAAAAMAAAACAAAAAAAAAAIAAAABAAAADQAAAAkAAAB4AAAABgAAAAMAAAAGAAAABAAAAAAAAAAdAAAACQAAACkAAAAGAAAAAgAAAAMAAAAJAAAAAAAAAAoAAAAKAAAALwAAAA8AAACWAQAABwAAAAIAAAAHAAAAEQAAAAkAAAA5AAAAFQAAAAIAAAANAAAAewAAAAUAAAAEAAAAAAAAAAIAAAABAAAAAgAAAAYAAAACAAAAAAAAAAkAAAAJAAAAMQAAAAQAAAACAAAAAQAAAAIAAAAEAAAACQAAAAkAAABKAQAAAwAAAGpLAAAJAAAAhwAAAAQAAAA8AAAABgAAABoAAAAJAAAA9gMAAAAAAAACAAAANgAAAAgAAAADAAAAUgAAAAAAAAAMAAAAAQAAAKxMAAABAAAAxxQAAAQAAAAEAAAABQAAAAkAAAAHAAAAAwAAAAYAAAAfAAAAAwAAAJUAAAACAAAAigUAADEAAAABAgAANgAAAAUAAAAxAAAACQAAAAAAAAAPAAAAAAAAABcAAAAEAAAAAgAAAA4AAABRBQAABgAAAAIAAAAQAAAAAwAAAAYAAAACAAAAAQAAAAIAAAAEAAAABgEAAAYAAAAKAAAACQAAAKMBAAANAAAA1wUAAAYAAABuAAAABgAAAAYAAAAJAAAAlxIAAAkAAAAHBQwA7wBBmB8LGlCMAAABAAAAAgAAAAMAAAAEAAAAAAQAAPAf";return"undefined"!=typeof Buffer?Buffer.from(A,"base64"):Uint8Array.from(atob(A),A=>A.charCodeAt(0))}let C;function init(){return C||(C=(async()=>{const B=await WebAssembly.compile(I()),{exports:Q}=await WebAssembly.instantiate(B);A=Q})())}function initSync(){if(A)return;const B=new WebAssembly.Module(I()),{exports:Q}=new WebAssembly.Instance(B);A=Q}
\ No newline at end of file
diff --git a/deps/cjs-module-lexer/dist/lexer.mjs b/deps/cjs-module-lexer/dist/lexer.mjs
index 964b74cfa78..b6f5fb548bb 100644
--- a/deps/cjs-module-lexer/dist/lexer.mjs
+++ b/deps/cjs-module-lexer/dist/lexer.mjs
@@ -1,2 +1,2 @@
-/* cjs-module-lexer 1.4.1 */
-let A;const Q=1===new Uint8Array(new Uint16Array([1]).buffer)[0];export function parse(g,I="@"){if(!A)throw new Error("Not initialized");const D=g.length+1,N=(A.__heap_base.value||A.__heap_base)+4*D-A.memory.buffer.byteLength;N>0&&A.memory.grow(Math.ceil(N/65536));const k=A.sa(D);(Q?C:E)(g,new Uint16Array(A.memory.buffer,k,D));const w=A.parseCJS(k,g.length,0,0,0);if(w){const Q=new Error(`Parse error ${I}${A.e()}:${g.slice(0,A.e()).split("\n").length}:${A.e()-g.lastIndexOf("\n",A.e()-1)}`);throw Object.assign(Q,{idx:A.e()}),5!==w&&6!==w&&7!==w||Object.assign(Q,{code:"ERR_LEXER_ESM_SYNTAX"}),Q}let H=new Set,J=new Set,o=new Set;for(;A.rre();){const Q=B(g.slice(A.res(),A.ree()));Q&&J.add(Q)}for(;A.ru();)o.add(B(g.slice(A.us(),A.ue())));for(;A.re();){let Q=B(g.slice(A.es(),A.ee()));void 0===Q||o.has(Q)||H.add(Q)}return{exports:[...H],reexports:[...J]}}function B(A){if('"'!==A[0]&&"'"!==A[0])return A;try{const Q=(0,eval)(A);for(let A=0;A<Q.length;A++){const B=64512&Q.charCodeAt(A);if(!(B<55296)){if(55296!==B)return;if(56320!=(64512&Q.charCodeAt(++A)))return}}return Q}catch{}}function E(A,Q){const B=A.length;let E=0;for(;E<B;){const B=A.charCodeAt(E);Q[E++]=(255&B)<<8|B>>>8}}function C(A,Q){const B=A.length;let E=0;for(;E<B;)Q[E]=A.charCodeAt(E++)}function g(){const A="AGFzbQEAAAABrAERYAJ/fwBgAABgAX8Bf2AAAX9gBn9/f39/fwF/YAF/AGAXf39/f39/f39/f39/f39/f39/f39/f38Bf2AIf39/f39/f38Bf2AHf39/f39/fwF/YAN/f38Bf2AFf39/f38Bf2AOf39/f39/f39/f39/f38Bf2AKf39/f39/f39/fwF/YAt/f39/f39/f39/fwF/YAJ/fwF/YAR/f39/AX9gCX9/f39/f39/fwF/A0NCAgMDAwMDAwMDAwMAAAABBAICBQQBBgcBBQEFBQUBAQICAgIBAQIIAwICAgkKAgELAgwNDgQPCA4HAgICAhACAgMJBAUBcAEFBQUDAQABBg8CfwFB0JgCC38AQdCYAgsHXA4GbWVtb3J5AgACc2EAAAFlAAECZXMAAgJlZQADA3JlcwAEA3JlZQAFAnVzAAYCdWUABwJyZQAIA3JyZQAJAnJ1AAoIcGFyc2VDSlMADwtfX2hlYXBfYmFzZQMBCQoBAEEBCwQLDA0OCt2fAUJ4AQF/QQAoApgfIgEgAEEBdGoiAEEAOwEAQQAgAEECaiIANgLkH0EAIAA2AugfQQBBADYCwB9BAEEANgLIH0EAQQA2AsQfQQBBADYCzB9BAEEANgLUH0EAQQA2AtAfQQBBADYC2B9BAEEANgLgH0EAQQA2AtwfIAELCABBACgC7B8LFQBBACgCxB8oAgBBACgCmB9rQQF1CxUAQQAoAsQfKAIEQQAoApgfa0EBdQsVAEEAKALQHygCAEEAKAKYH2tBAXULFQBBACgC0B8oAgRBACgCmB9rQQF1CxUAQQAoAtwfKAIAQQAoApgfa0EBdQsVAEEAKALcHygCBEEAKAKYH2tBAXULJQEBf0EAQQAoAsQfIgBBCGpBwB8gABsoAgAiADYCxB8gAEEARwslAQF/QQBBACgC0B8iAEEIakHMHyAAGygCACIANgLQHyAAQQBHCyUBAX9BAEEAKALcHyIAQQhqQdgfIAAbKAIAIgA2AtwfIABBAEcLSAEBf0EAKALIHyICQQhqQcAfIAIbQQAoAugfIgI2AgBBACACNgLIH0EAIAJBDGo2AugfIAJBADYCCCACIAE2AgQgAiAANgIAC0gBAX9BACgC1B8iAkEIakHMHyACG0EAKALoHyICNgIAQQAgAjYC1B9BACACQQxqNgLoHyACQQA2AgggAiABNgIEIAIgADYCAAtIAQF/QQAoAuAfIgJBCGpB2B8gAhtBACgC6B8iAjYCAEEAIAI2AuAfQQAgAkEMajYC6B8gAkEANgIIIAIgATYCBCACIAA2AgALEgBBAEEANgLMH0EAQQA2AtQfC50PAEEAIAE2AoBAQQAgADYCmB8CQCACRQ0AQQAgAjYCnB8LAkAgA0UNAEEAIAM2AqAfCwJAIARFDQBBACAENgKkHwtBAEH//wM7AYhAQQBBoMAANgKgYEEAQbDgADYCsKABQQBBgCA2ArSgAUEAQQAoAqwfNgKMQEEAIABBfmoiAjYCvKABQQAgAiABQQF0aiIDNgLAoAFBAEEAOwGGQEEAQQA7AYRAQQBBADoAkEBBAEEANgLsH0EAQQA2AvAfQQBBADoAuKABAkACQCAALwEAQSNHDQAgAC8BAkEhRw0AQQAhAiABQQJGDQFBACAAQQJqNgK8oAEgAEEEaiEAAkADQCAAIgJBfmogA08NASACQQJqIQAgAi8BAEF2ag4EAQAAAQALC0EAIAI2ArygAQsDQEEAIAJBAmoiADYCvKABAkACQAJAAkACQAJAIAIgA08NAAJAIAAvAQAiAUF3aiIDQRdLDQBBASADdEGfgIAEcQ0GCwJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAAkBBAC8BhkAiAw0AAkACQAJAIAFBoX9qDg8CEBUVBhUFFRUVARUVFQQACwJAIAFBWWoOCQ4ICRUVFRUVDwALAkAgAUGFf2oOAwsVDAALIAFBIkYNDSABQc8ARg0GIAFB8gBHDRQCQEEAEBBFDQAgABARRQ0AIAIQEgtBAEEAKAK8oAE2AoxADBULAkAgAkEEakHtAEHwAEHvAEHyAEH0ABATRQ0AIAAQEUUNABAUQQAoArygASEAC0EAIAA2AoxADBQLAkACQCACQQRqIgNB6QBB7gBB9ABB5QBB8gBB7wBB8ABB0gBB5QBB8QBB9QBB6QBB8gBB5QBB1wBB6QBB7ABB5ABB4wBB4QBB8gBB5AAQFUUNAAJAIAAQEQ0AIAIvAQBBLkcNAQtBACACQTBqNgK8oAEgAi8BMEEoRw0BQQAgAkEyajYCvKABQQBBATsBhkBBACgCsKABQQAoAoxANgIAQQAQEEUNASAAEBFFDQEgAhASDAELIANB3wBB5QBB+ABB8ABB7wBB8gBB9AAQFkUNAAJAIAAQEQ0AIAIvAQBBLkcNAQtBACACQRJqNgK8oAECQCACLwESIgNB0wBHDQAgAi8BFEH0AEcNASACLwEWQeEARw0BIAIvARhB8gBHDQFBACACQRpqNgK8oAEgAi8BGiEDCyADQf//A3FBKEcNAEEAKAKwoAFBACgCjEA2AgBBAEEBOwGGQEEAQQAoArygASICQQJqNgK8oAEgAi8BAkHyAEcNAEECEBAaC0EAQQAoArygATYCjEAMEwsCQCABQVlqDgkLBQcSEhISEgwACwJAIAFBoH9qDgYNEhIDEgIACwJAIAFBhX9qDgMIEgoACyABQSJGDQogAUHPAEYNAyABQe0ARw0RCyACQQRqQe8AQeQAQfUAQewAQeUAEBNFDRAgABARRQ0QEBcMEAsgAkEEakH4AEHwAEHvAEHyAEH0ABATRQ0PIAAQEUUNDwJAIAIvAQ5B8wBHDQBBABAYDBALIAMNDxAZDA8LIAAQEUUNDiACLwEEQewARw0OIAIvAQZB4QBHDQ4gAi8BCEHzAEcNDiACLwEKQfMARw0OIAIvAQwiA0F3aiICQRdLDQxBASACdEGfgIAEcUUNDAwNCyACQQRqQeIAQeoAQeUAQeMAQfQAEBNFDQ0gABARRQ0NIANFEBoMDQtBACADQQFqOwGGQEEAKAKwoAEgA0ECdGpBACgCjEA2AgAMDAtBCBAbQQAoAvAfDwtBACADQX9qOwGGQAwKCyADQdCgAWpBAC0AuKABOgAAQQAgA0EBajsBhkBBACgCsKABIANBAnRqQQAoAoxANgIAQQBBADoAuKABDAkLQQIQG0EADwtBACADQX9qIgA7AYZAAkAgA0EALwGIQCICRw0AQQBBAC8BhEBBf2oiAjsBhEBBAEEAKAKgYCACQf//A3FBAXRqLwEAOwGIQAwFCyACQf//A0YNByAAQf//A3EgAk8NB0EDEBtBACgC8B8PCyABEBwMBgsCQAJAIAIvAQQiAkEqRg0AIAJBL0cNARAdDAgLEB4MBwsCQAJAAkACQEEAKAKMQCIALwEAIgIQH0UNAAJAAkACQCACQVVqDgQBBQIABQsgAEF+ai8BAEFQakH//wNxQQpJDQMMBAsgAEF+ai8BAEErRg0CDAMLIABBfmovAQBBLUYNAQwCCwJAAkAgAkH9AEYNACACQS9GDQEgAkEpRw0CQQAoArCgASADQQJ0aigCABAgRQ0CDAMLQQAoArCgASADQQJ0aigCABAhDQIgA0HQoAFqLQAARQ0BDAILQQAtAJBADQELIAAQIiEDIAJFDQBBASECIANFDQELECNBACECC0EAIAI6AJBADAULQQAvAYhAQf7/A0cNAUEEEBtBACgC8B8PC0EAIQICQAJAQQAvAYhAQf//A0YNAEEAKALwHyEDDAELQQAoAvAfIQNBAC8BhkANACADRQ0HCyADIQIMBgsQJAwCCyADQaABRw0BC0EAQQE6ALigAQtBAEEAKAK8oAE2AoxAC0EAKALAoAEhA0EAKAK8oAEhAgwACwsgAgvuAQEEf0EAIQECQEEAKAK8oAEiAkECakHlAEHxAEH1AEHpAEHyAEHlABAmRQ0AQQAhAUEAIAJBDmo2ArygAQJAECdBKEcNAEEAQQAoArygAUECajYCvKABECchA0EAKAK8oAEhBAJAIANBJ0YNACADQSJHDQELIAMQHEEAQQAoArygAUECaiIDNgK8oAEQJ0EpRw0AAkACQAJAIABBf2oOAgEAAgsgBCADQQAoAqAfEQAAQQEPCyAEIANBACgCoB8RAABBAQ8LQQAoArSgASAENgIAQQAoArSgASADNgIEQQEPC0EAIAI2ArygAQsgAQsdAAJAQQAoApgfIABHDQBBAQ8LIABBfmovAQAQJQv1AgEEf0EAKAKYHyEBAkADQCAAQX5qIQIgAC8BACIDQSBHDQEgACABSyEEIAIhACAEDQALCwJAIANBPUcNAAJAA0AgAkF+aiEAIAIvAQBBIEcNASACIAFLIQQgACECIAQNAAsLIABBAmohAiAAQQRqIQNBACEEAkADQCACECghACACIAFNDQEgAEUNASAAQdwARg0CIAAQKUUNASACQX5BfCAAQYCABEkbaiECIAAQKiEEDAALCyAEQQFxRQ0AIAIvAQBBIEcNAEEAKAK0oAEiBEEAKAKwH0YNACAEIAM2AgwgBCACQQJqNgIIIAJBfmohAEEgIQICQANAIABBAmogAU0NASACQf//A3FBIEcNASAALwEAIQIgAEF+aiEADAALCwJAAkACQCACQf//A3FBjn9qDgMAAwEDCyAAQfYAQeEAECsNAQwCCyAAQewAQeUAECsNACAAQeMAQe8AQe4AQfMAECxFDQELQQAgBEEQajYCtKABCws/AQF/QQAhBgJAIAAvAQAgAUcNACAALwECIAJHDQAgAC8BBCADRw0AIAAvAQYgBEcNACAALwEIIAVGIQYLIAYLowEBA39BAEEAKAK8oAEiAEEMaiIBNgK8oAECQAJAAkACQAJAAkACQBAnIgJBWWoOCAIDAQIBAQEEAAsgAkEiRg0BIAJB+wBGDQELQQAoArygASABRg0EC0EALwGGQEUNAkEAQQAoArygAUF+ajYCvKABDwtBAEEALwGGQCICQQFqOwGGQEEAKAKwoAEgAkECdGogADYCAA8LQQUQGw8LQQYQGwsL6QEBAX9BACEXAkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUcNACAALwEKIAZHDQAgAC8BDCAHRw0AIAAvAQ4gCEcNACAALwEQIAlHDQAgAC8BEiAKRw0AIAAvARQgC0cNACAALwEWIAxHDQAgAC8BGCANRw0AIAAvARogDkcNACAALwEcIA9HDQAgAC8BHiAQRw0AIAAvASAgEUcNACAALwEiIBJHDQAgAC8BJCATRw0AIAAvASYgFEcNACAALwEoIBVHDQAgAC8BKiAWRiEXCyAXC1MBAX9BACEIAkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUcNACAALwEKIAZHDQAgAC8BDCAHRiEICyAIC2wBAX9BAEEAKAK8oAEiAEEMajYCvKABAkAQJ0EuRw0AQQBBACgCvKABQQJqNgK8oAEQJ0HlAEcNAEEAKAK8oAFBAmpB+ABB8ABB7wBB8gBB9ABB8wAQJkUNAEEBEBgPC0EAIABBCmo2ArygAQu2AgECf0EAQQAoArygASIBQQ5qNgK8oAECQAJAAkAQJyICQdsARg0AIAJBPUYNASACQS5HDQJBAEEAKAK8oAFBAmo2ArygARAnIQJBACgCvKABIQAgAhAtRQ0CQQAoArygASECECdBPUcNAiAAIAJBACgCnB8RAAAPC0EAQQAoArygAUECajYCvKABAkAQJyICQSdGDQAgAkEiRw0CC0EAKAK8oAEhACACEBxBAEEAKAK8oAFBAmoiAjYCvKABECdB3QBHDQFBAEEAKAK8oAFBAmo2ArygARAnQT1HDQEgACACQQAoApwfEQAADAELIABFDQBBACgCqB8RAQBBAEEAKAK8oAFBAmo2ArygAQJAECciAkHyAEYNACACQfsARw0BEC4PC0EBEBAaC0EAIAFBDGo2ArygAQs4AQJ/QQBBACgCvKABQQxqIgA2ArygARAnIQECQAJAQQAoArygASAARw0AIAEQP0UNAQtBBxAbCwukJgEIf0EAQQAoArygASIBQQxqNgK8oAEgAUEKaiEBAkAQJ0EuRw0AQQBBACgCvKABQQJqNgK8oAECQAJAECciAkHkAEcNAEEAKAK8oAEiAEECakHlAEHmAEHpAEHuAEHlAEHQAEHyAEHvAEHwAEHlAEHyAEH0AEH5ABAvRQ0CQQAgAEEcajYCvKABIABBGmohARAnQShHDQJBAEEAKAK8oAFBAmo2ArygARAnEDBFDQIQJ0EsRw0CQQBBACgCvKABQQJqNgK8oAECQBAnIgBBJ0YNACAAQSJHDQMLQQAoArygASECIAAQHEEAQQAoArygAUECaiIANgK8oAEQJ0EsRw0BQQBBACgCvKABQQJqNgK8oAEQJ0H7AEcNAUEAQQAoArygAUECajYCvKABAkAQJyIDQeUARw0AQQAoArygASIDQQJqQe4AQfUAQe0AQeUAQfIAQeEAQeIAQewAQeUAEDFFDQJBACADQRRqNgK8oAEQJ0E6Rw0CQQBBACgCvKABQQJqNgK8oAEQJ0H0AEcNAkEAKAK8oAEiAy8BAkHyAEcNAiADLwEEQfUARw0CIAMvAQZB5QBHDQJBACADQQhqNgK8oAEQJ0EsRw0CQQBBACgCvKABQQJqNgK8oAEQJyEDCwJAIANB5wBGDQAgA0H2AEcNAkEAKAK8oAEiAy8BAkHhAEcNAiADLwEEQewARw0CIAMvAQZB9QBHDQIgAy8BCEHlAEcNAkEAIANBCmo2ArygARAnQTpHDQIgAiAAQQAoApwfEQAAQQAgATYCvKABDwtBACgCvKABIgMvAQJB5QBHDQEgAy8BBEH0AEcNAUEAIANBBmo2ArygAQJAECciA0E6Rw0AQQBBACgCvKABQQJqNgK8oAEQJ0HmAEcNAkEAKAK8oAEiA0ECakH1AEHuAEHjAEH0AEHpAEHvAEHuABAWRQ0CQQAgA0EQaiIDNgK8oAECQBAnIgRBKEYNACADQQAoArygAUYNAyAEEC1FDQMLECchAwsgA0EoRw0BQQBBACgCvKABQQJqNgK8oAEQJ0EpRw0BQQBBACgCvKABQQJqNgK8oAEQJ0H7AEcNAUEAQQAoArygAUECajYCvKABECdB8gBHDQFBACgCvKABIgNBAmpB5QBB9ABB9QBB8gBB7gAQE0UNAUEAIANBDGo2ArygARAnEC1FDQECQAJAAkAQJyIDQdsARg0AIANBLkcNAkEAQQAoArygAUECajYCvKABECcQLQ0BDAQLQQBBACgCvKABQQJqNgK8oAECQBAnIgNBJ0YNACADQSJHDQQLIAMQHEEAQQAoArygAUECajYCvKABECdB3QBHDQNBAEEAKAK8oAFBAmo2ArygAQsQJyEDCwJAIANBO0cNAEEAQQAoArygAUECajYCvKABECchAwsgA0H9AEcNAUEAQQAoArygAUECajYCvKABAkAQJyIDQSxHDQBBAEEAKAK8oAFBAmo2ArygARAnIQMLIANB/QBHDQFBAEEAKAK8oAFBAmo2ArygARAnQSlHDQEgAiAAQQAoApwfEQAADwsgAkHrAEcNASAARQ0BQQAoArygASIALwECQeUARw0BIAAvAQRB+QBHDQEgAC8BBkHzAEcNASAAQQZqIQFBACAAQQhqNgK8oAEQJ0EoRw0BQQBBACgCvKABQQJqNgK8oAEQJyEAQQAoArygASECIAAQLUUNAUEAKAK8oAEhABAnQSlHDQFBAEEAKAK8oAEiAUECajYCvKABECdBLkcNAUEAQQAoArygAUECajYCvKABECdB5gBHDQFBACgCvKABIgNBAmpB7wBB8gBBxQBB4QBB4wBB6AAQJkUNAUEAIANBDmo2ArygARAnIQNBACgCvKABIgRBfmohASADQShHDQFBACAEQQJqNgK8oAEQJ0HmAEcNAUEAKAK8oAEiA0ECakH1AEHuAEHjAEH0AEHpAEHvAEHuABAWRQ0BQQAgA0EQajYCvKABECdBKEcNAUEAQQAoArygAUECajYCvKABECchA0EAKAK8oAEhBCADEC1FDQFBACgCvKABIQMQJ0EpRw0BQQBBACgCvKABQQJqNgK8oAEQJ0H7AEcNAUEAQQAoArygAUECajYCvKABECdB6QBHDQFBACgCvKABIgUvAQJB5gBHDQFBACAFQQRqNgK8oAEQJ0EoRw0BQQBBACgCvKABQQJqNgK8oAEQJxpBACgCvKABIgUgBCADIARrIgMQQQ0BIAAgAmsiBkEBdSEHQQAgBSADQQF1IghBAXRqNgK8oAECQAJAAkAQJyIAQSFGDQAgAEE9Rw0EQQAoArygASIALwECQT1HDQQgAC8BBEE9Rw0EQQAgAEEGajYCvKABAkAQJyIAQSdGDQAgAEEiRw0FC0EAKAK8oAEiBUECakHkAEHlAEHmAEHhAEH1AEHsAEH0ABAWRQ0EQQAgBUEQajYCvKABECcgAEcNBEEAQQAoArygAUECajYCvKABECdB/ABHDQRBACgCvKABIgAvAQJB/ABHDQRBACAAQQRqNgK8oAEQJxpBACgCvKABIgAgBCADEEENBEEAIAAgCEEBdGo2ArygARAnQT1HDQRBACgCvKABIgAvAQJBPUcNBCAALwEEQT1HDQRBACAAQQZqNgK8oAECQBAnIgBBJ0YNACAAQSJHDQULQQAoArygASIFQQJqQd8AQd8AQeUAQfMAQc0AQe8AQeQAQfUAQewAQeUAEDJFDQRBACAFQRZqNgK8oAEQJyAARw0EQQBBACgCvKABQQJqNgK8oAEQJ0EpRw0EQQBBACgCvKABQQJqNgK8oAEQJ0HyAEcNBEEAKAK8oAEiAEECakHlAEH0AEH1AEHyAEHuABATRQ0EQQAgAEEMajYCvKABAkAQJ0E7Rw0AQQBBACgCvKABQQJqNgK8oAELECciAEHpAEcNAkHpACEAQQAoArygASIFLwECQeYARw0CQQAgBUEEajYCvKABECdBKEcNBEEAQQAoArygAUECaiIANgK8oAECQCAEIAgQM0UNABAnQSlHDQVBAEEAKAK8oAFBAmo2ArygARAnQfIARw0FQQAoArygASIAQQJqQeUAQfQAQfUAQfIAQe4AEBNFDQVBACAAQQxqNgK8oAECQBAnQTtHDQBBAEEAKAK8oAFBAmo2ArygAQsQJyIAQekARw0DQekAIQBBACgCvKABIgUvAQJB5gBHDQNBACAFQQRqNgK8oAEQJ0EoRw0FQQAoArygAUECaiEAC0EAIAA2ArygASAAIAQgAxBBDQRBACAAIAhBAXRqNgK8oAEQJ0HpAEcNBEEAKAK8oAEiAC8BAkHuAEcNBCAALwEEQSBHDQRBACAAQQZqNgK8oAEQJxAwRQ0EECdBJkcNBEEAKAK8oAEiAC8BAkEmRw0EQQAgAEEEajYCvKABECcQMEUNBBAnQdsARw0EQQBBACgCvKABQQJqNgK8oAEQJxpBACgCvKABIgAgBCADEEENBEEAIAAgCEEBdGo2ArygARAnQd0ARw0EQQBBACgCvKABQQJqNgK8oAEQJ0E9Rw0EQQAoArygASIALwECQT1HDQQgAC8BBEE9Rw0EQQAgAEEGajYCvKABECcaQQAoArygASIAIAIgBhBBDQRBACAAIAdBAXRqNgK8oAEQJ0HbAEcNBEEAQQAoArygAUECajYCvKABECcaQQAoArygASIAIAQgAxBBDQRBACAAIAhBAXRqNgK8oAEQJ0HdAEcNBEEAQQAoArygAUECajYCvKABECdBKUcNBEEAQQAoArygAUECajYCvKABECdB8gBHDQRBACgCvKABIgBBAmpB5QBB9ABB9QBB8gBB7gAQE0UNBEEAIABBDGo2ArygARAnQTtHDQFBAEEAKAK8oAFBAmo2ArygAQwBC0EAKAK8oAEiAC8BAkE9Rw0DIAAvAQRBPUcNA0EAIABBBmo2ArygAQJAECciAEEnRg0AIABBIkcNBAtBACgCvKABIgVBAmpB5ABB5QBB5gBB4QBB9QBB7ABB9AAQFkUNA0EAIAVBEGo2ArygARAnIABHDQNBAEEAKAK8oAFBAmo2ArygAQJAECciAEEmRw0AQQAoArygASIALwECQSZHDQRBACAAQQRqNgK8oAEQJ0EhRw0EQQBBACgCvKABQQJqNgK8oAECQAJAECciAEHPAEcNAEEAKAK8oAFBAmpB4gBB6gBB5QBB4wBB9ABBLhAmRQ0AIAQgCBAzRQ0GDAELIAAQLUUNABAnQS5HDQVBAEEAKAK8oAFBAmo2ArygARAnQegARw0FQQAoArygASIAQQJqQeEAQfMAQc8AQfcAQe4AQdAAQfIAQe8AQfAAQeUAQfIAQfQAQfkAEC9FDQVBACAAQRxqNgK8oAEQJ0EoRw0FQQBBACgCvKABQQJqNgK8oAEQJxpBACgCvKABIgAgBCADEEENBUEAIAAgCEEBdGo2ArygARAnQSlHDQVBAEEAKAK8oAFBAmo2ArygAQsQJyEACyAAQSlHDQNBAEEAKAK8oAFBAmo2ArygAQsQJyEACwJAAkACQCAAEDBFDQAQJ0HbAEcNBEEAQQAoArygAUECajYCvKABECcaQQAoArygASIAIAQgAxBBDQRBACAAIAhBAXRqNgK8oAEQJ0HdAEcNBEEAQQAoArygAUECajYCvKABECdBPUcNBEEAQQAoArygAUECajYCvKABECcaQQAoArygASIAIAIgBhBBDQRBACAAIAdBAXRqNgK8oAEQJ0HbAEcNBEEAQQAoArygAUECajYCvKABECcaQQAoArygASIAIAQgAxBBDQRBACAAIAhBAXRqNgK8oAEQJ0HdAEcNBEEAQQAoArygAUECajYCvKABECciAEE7Rw0CQQBBACgCvKABQQJqNgK8oAEMAQsgAEHPAEcNA0EAKAK8oAEiAEECakHiAEHqAEHlAEHjAEH0ABATRQ0DQQAgAEEMajYCvKABECdBLkcNA0EAQQAoArygAUECajYCvKABECdB5ABHDQNBACgCvKABIgBBAmpB5QBB5gBB6QBB7gBB5QBB0ABB8gBB7wBB8ABB5QBB8gBB9ABB+QAQL0UNA0EAIABBHGo2ArygARAnQShHDQNBAEEAKAK8oAFBAmo2ArygARAnEDBFDQMQJ0EsRw0DQQBBACgCvKABQQJqNgK8oAEQJxpBACgCvKABIgAgBCADEEENA0EAIAAgCEEBdGo2ArygARAnQSxHDQNBAEEAKAK8oAFBAmo2ArygARAnQfsARw0DQQBBACgCvKABQQJqNgK8oAEQJ0HlAEcNA0EAKAK8oAEiAEECakHuAEH1AEHtAEHlAEHyAEHhAEHiAEHsAEHlABAxRQ0DQQAgAEEUajYCvKABECdBOkcNA0EAQQAoArygAUECajYCvKABECchBUEAKAK8oAEhAAJAIAVB9ABGDQAgAC8BAkHyAEcNBCAALwEEQfUARw0EIAAvAQZB5QBHDQQLQQAgAEEIajYCvKABECdBLEcNA0EAQQAoArygAUECajYCvKABECdB5wBHDQNBACgCvKABIgAvAQJB5QBHDQMgAC8BBEH0AEcNA0EAIABBBmo2ArygAQJAECciAEE6Rw0AQQBBACgCvKABQQJqNgK8oAEQJ0HmAEcNBEEAKAK8oAEiAEECakH1AEHuAEHjAEH0AEHpAEHvAEHuABAWRQ0EQQAgAEEQaiIANgK8oAECQBAnIgVBKEYNACAAQQAoArygAUYNBSAFEC1FDQULECchAAsgAEEoRw0DQQBBACgCvKABQQJqNgK8oAEQJ0EpRw0DQQBBACgCvKABQQJqNgK8oAEQJ0H7AEcNA0EAQQAoArygAUECajYCvKABECdB8gBHDQNBACgCvKABIgBBAmpB5QBB9ABB9QBB8gBB7gAQE0UNA0EAIABBDGo2ArygARAnGkEAKAK8oAEiACACIAYQQQ0DQQAgACAHQQF0ajYCvKABECdB2wBHDQNBAEEAKAK8oAFBAmo2ArygARAnGkEAKAK8oAEiACAEIAMQQQ0DQQAgACAIQQF0ajYCvKABECdB3QBHDQNBAEEAKAK8oAFBAmo2ArygAQJAECciAEE7Rw0AQQBBACgCvKABQQJqNgK8oAEQJyEACyAAQf0ARw0DQQBBACgCvKABQQJqNgK8oAECQBAnIgBBLEcNAEEAQQAoArygAUECajYCvKABECchAAsgAEH9AEcNA0EAQQAoArygAUECajYCvKABECdBKUcNA0EAQQAoArygAUECajYCvKABECciAEE7Rw0BQQBBACgCvKABQQJqNgK8oAELECchAAsgAEH9AEcNAUEAQQAoArygAUECajYCvKABECdBKUcNAUEAKAK0oAEhBEGAICEAA0ACQAJAIAQgAEYNACAHIABBDGooAgAgAEEIaigCACIDa0EBdUcNASACIAMgBhBBDQEgACgCACAAQQRqKAIAQQAoAqAfEQAAQQAgATYCvKABCw8LIABBEGohAAwACwsgAiAAQQAoAqQfEQAAC0EAIAE2ArygAQtBAAJAQQAoAvAfDQBBACAANgLwHwtBACgCvKABIQBBAEEAKALAoAFBAmo2ArygAUEAIABBACgCmB9rQQF1NgLsHwuOAQEEf0EAKAK8oAEhAUEAKALAoAEhAgJAAkADQCABIgNBAmohASADIAJPDQEgAS8BACIEIABGDQICQCAEQdwARg0AIARBdmoOBAIBAQIBCyADQQRqIQEgAy8BBEENRw0AIANBBmogASADLwEGQQpGGyEBDAALC0EAIAE2ArygAUEJEBsPC0EAIAE2ArygAQtKAQN/QQAoArygAUECaiEAQQAoAsCgASEBAkADQCAAIgJBfmogAU8NASACQQJqIQAgAi8BAEF2ag4EAQAAAQALC0EAIAI2ArygAQt8AQJ/QQBBACgCvKABIgBBAmo2ArygASAAQQZqIQBBACgCwKABIQEDQAJAAkACQCAAQXxqIAFPDQAgAEF+ai8BAEEqRw0CIAAvAQBBL0cNAkEAIABBfmo2ArygAQwBCyAAQX5qIQALQQAgADYCvKABDwsgAEECaiEADAALC2wBAX8CQAJAIABBX2oiAUEFSw0AQQEgAXRBMXENAQsgAEFGakH//wNxQQZJDQAgAEEpRyAAQVhqQf//A3FBB0lxDQACQCAAQaV/ag4EAQAAAQALIABB/QBHIABBhX9qQf//A3FBBElxDwtBAQs9AQF/QQEhAQJAIABB9wBB6ABB6QBB7ABB5QAQNA0AIABB5gBB7wBB8gAQNQ0AIABB6QBB5gAQKyEBCyABC5sBAQJ/QQEhAQJAAkACQAJAAkACQCAALwEAIgJBRWoOBAUEBAEACwJAIAJBm39qDgQDBAQCAAsgAkEpRg0EIAJB+QBHDQMgAEF+akHmAEHpAEHuAEHhAEHsAEHsABA2DwsgAEF+ai8BAEE9Rg8LIABBfmpB4wBB4QBB9ABB4wAQLA8LIABBfmpB5QBB7ABB8wAQNQ8LQQAhAQsgAQvSAwECf0EAIQECQAJAAkACQAJAAkACQAJAAkAgAC8BAEGcf2oOFAABAggICAgICAgDBAgIBQgGCAgHCAsCQAJAIABBfmovAQBBl39qDgQACQkBCQsgAEF8akH2AEHvABArDwsgAEF8akH5AEHpAEHlABA1DwsCQAJAIABBfmovAQBBjX9qDgIAAQgLAkAgAEF8ai8BACICQeEARg0AIAJB7ABHDQggAEF6akHlABA3DwsgAEF6akHjABA3DwsgAEF8akHkAEHlAEHsAEHlABAsDwsgAEF+ai8BAEHvAEcNBSAAQXxqLwEAQeUARw0FAkAgAEF6ai8BACICQfAARg0AIAJB4wBHDQYgAEF4akHpAEHuAEHzAEH0AEHhAEHuABA2DwsgAEF4akH0AEH5ABArDwtBASEBIABBfmoiAEHpABA3DQQgAEHyAEHlAEH0AEH1AEHyABA0DwsgAEF+akHkABA3DwsgAEF+akHkAEHlAEHiAEH1AEHnAEHnAEHlABA4DwsgAEF+akHhAEH3AEHhAEHpABAsDwsCQCAAQX5qLwEAIgJB7wBGDQAgAkHlAEcNASAAQXxqQe4AEDcPCyAAQXxqQfQAQegAQfIAEDUhAQsgAQt2AQJ/AkACQANAQQBBACgCvKABIgBBAmoiATYCvKABIABBACgCwKABTw0BAkACQAJAIAEvAQAiAUGlf2oOAgECAAsCQCABQXZqDgQEAwMEAAsgAUEvRw0CDAQLEEAaDAELQQAgAEEEajYCvKABDAALC0ELEBsLC8YBAQR/QQAoArygASEAQQAoAsCgASEBAkACQANAIAAiAkECaiEAIAIgAU8NAQJAAkAgAC8BACIDQaR/ag4FAQICAgQACyADQSRHDQEgAi8BBEH7AEcNAUEAQQAvAYRAIgBBAWo7AYRAQQAoAqBgIABBAXRqQQAvAYhAOwEAQQAgAkEEajYCvKABQQBBAC8BhkBBAWoiADsBiEBBACAAOwGGQA8LIAJBBGohAAwACwtBACAANgK8oAFBCBAbDwtBACAANgK8oAELNAEBf0EBIQECQCAAQXdqQf//A3FBBUkNACAAQYABckGgAUYNACAAQS5HIAAQP3EhAQsgAQtJAQF/QQAhBwJAIAAvAQAgAUcNACAALwECIAJHDQAgAC8BBCADRw0AIAAvAQYgBEcNACAALwEIIAVHDQAgAC8BCiAGRiEHCyAHC3oBA39BACgCvKABIQACQANAAkAgAC8BACIBQXdqQQVJDQAgAUEgRg0AIAFBoAFGDQAgAUEvRw0CAkAgAC8BAiIAQSpGDQAgAEEvRw0DEB0MAQsQHgtBAEEAKAK8oAEiAkECaiIANgK8oAEgAkEAKALAoAFJDQALCyABCzkBAX8CQCAALwEAIgFBgPgDcUGAuANHDQAgAEF+ai8BAEH/B3FBCnQgAUH/B3FyQYCABGohAQsgAQt9AQF/AkAgAEEvSw0AIABBJEYPCwJAIABBOkkNAEEAIQECQCAAQcEASQ0AIABB2wBJDQECQCAAQeAASw0AIABB3wBGDwsgAEH7AEkNAQJAIABB//8DSw0AIABBqgFJDQEgABA5DwtBASEBIAAQOg0AIAAQOyEBCyABDwtBAQtjAQF/AkAgAEHAAEsNACAAQSRGDwtBASEBAkAgAEHbAEkNAAJAIABB4ABLDQAgAEHfAEYPCyAAQfsASQ0AAkAgAEH//wNLDQBBACEBIABBqgFJDQEgABA8DwsgABA6IQELIAELTAEDf0EAIQMCQCAAQX5qIgRBACgCmB8iBUkNACAELwEAIAFHDQAgAC8BACACRw0AAkAgBCAFRw0AQQEPCyAAQXxqLwEAECUhAwsgAwtmAQN/QQAhBQJAIABBemoiBkEAKAKYHyIHSQ0AIAYvAQAgAUcNACAAQXxqLwEAIAJHDQAgAEF+ai8BACADRw0AIAAvAQAgBEcNAAJAIAYgB0cNAEEBDwsgAEF4ai8BABAlIQULIAULhQEBAn8gABA+IgAQKiEBAkACQCAAQdwARg0AQQAhAiABRQ0BC0EAKAK8oAFBAkEEIABBgIAESRtqIQACQANAQQAgADYCvKABIAAvAQAQPiIBRQ0BAkAgARApRQ0AIABBAkEEIAFBgIAESRtqIQAMAQsLQQAhAiABQdwARg0BC0EBIQILIAIL2gMBBH9BACgCvKABIgBBfmohAQNAQQAgAEECajYCvKABAkACQAJAIABBACgCwKABTw0AECchAEEAKAK8oAEhAgJAAkAgABAtRQ0AQQAoArygASEDAkACQBAnIgBBOkcNAEEAQQAoArygAUECajYCvKABECcQLUUNAUEAKAK8oAEvAQAhAAsgAiADQQAoApwfEQAADAILQQAgATYCvKABDwsCQAJAIABBIkYNACAAQS5GDQEgAEEnRw0EC0EAKAK8oAEhAiAAEBxBAEEAKAK8oAFBAmoiAzYCvKABECciAEE6Rw0BQQBBACgCvKABQQJqNgK8oAECQBAnEC1FDQBBACgCvKABLwEAIQAgAiADQQAoApwfEQAADAILQQAgATYCvKABDwtBACgCvKABIgAvAQJBLkcNAiAALwEEQS5HDQJBACAAQQZqNgK8oAECQAJAAkAgAC8BBiIAQfIARw0AQQEQECEAQQAoArygASECIAANASACLwEAIQALIABB//8DcRAtDQFBACABNgK8oAEPC0EAIAJBAmo2ArygAQsQJyEACyAAQf//A3EiAEEsRg0CIABB/QBGDQBBACABNgK8oAELDwtBACABNgK8oAEPC0EAKAK8oAEhAAwACwuPAQEBf0EAIQ4CQCAALwEAIAFHDQAgAC8BAiACRw0AIAAvAQQgA0cNACAALwEGIARHDQAgAC8BCCAFRw0AIAAvAQogBkcNACAALwEMIAdHDQAgAC8BDiAIRw0AIAAvARAgCUcNACAALwESIApHDQAgAC8BFCALRw0AIAAvARYgDEcNACAALwEYIA1GIQ4LIA4LqAEBAn9BACEBQQAoArygASECAkACQCAAQe0ARw0AIAJBAmpB7wBB5ABB9QBB7ABB5QAQE0UNAUEAIAJBDGo2ArygAQJAECdBLkYNAEEAIQEMAgtBAEEAKAK8oAFBAmo2ArygARAnIQALIABB5QBHDQBBACgCvKABIgBBDmogAiAAQQJqQfgAQfAAQe8AQfIAQfQAQfMAECYiARshAgtBACACNgK8oAEgAQtnAQF/QQAhCgJAIAAvAQAgAUcNACAALwECIAJHDQAgAC8BBCADRw0AIAAvAQYgBEcNACAALwEIIAVHDQAgAC8BCiAGRw0AIAAvAQwgB0cNACAALwEOIAhHDQAgAC8BECAJRiEKCyAKC3EBAX9BACELAkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUcNACAALwEKIAZHDQAgAC8BDCAHRw0AIAAvAQ4gCEcNACAALwEQIAlHDQAgAC8BEiAKRiELCyALC4MEAQJ/QQAhAgJAECdBzwBHDQBBACECQQAoArygASIDQQJqQeIAQeoAQeUAQeMAQfQAEBNFDQBBACECQQAgA0EMajYCvKABECdBLkcNAEEAQQAoArygAUECajYCvKABAkAQJyIDQfAARw0AQQAhAkEAKAK8oAEiA0ECakHyAEHvAEH0AEHvAEH0AEH5AEHwAEHlABA9RQ0BQQAhAkEAIANBEmo2ArygARAnQS5HDQFBAEEAKAK8oAFBAmo2ArygARAnIQMLQQAhAiADQegARw0AQQAhAkEAKAK8oAEiA0ECakHhAEHzAEHPAEH3AEHuAEHQAEHyAEHvAEHwAEHlAEHyAEH0AEH5ABAvRQ0AQQAhAkEAIANBHGo2ArygARAnQS5HDQBBACECQQBBACgCvKABQQJqNgK8oAEQJ0HjAEcNAEEAIQJBACgCvKABIgMvAQJB4QBHDQAgAy8BBEHsAEcNACADLwEGQewARw0AQQAhAkEAIANBCGo2ArygARAnQShHDQBBACECQQBBACgCvKABQQJqNgK8oAEQJxAtRQ0AECdBLEcNAEEAIQJBAEEAKAK8oAFBAmo2ArygARAnGkEAKAK8oAEiAyAAIAFBAXQiARBBDQBBACECQQAgAyABajYCvKABECdBKUcNAEEAQQAoArygAUECajYCvKABQQEhAgsgAgtJAQN/QQAhBgJAIABBeGoiB0EAKAKYHyIISQ0AIAcgASACIAMgBCAFEBNFDQACQCAHIAhHDQBBAQ8LIABBdmovAQAQJSEGCyAGC1kBA39BACEEAkAgAEF8aiIFQQAoApgfIgZJDQAgBS8BACABRw0AIABBfmovAQAgAkcNACAALwEAIANHDQACQCAFIAZHDQBBAQ8LIABBemovAQAQJSEECyAEC0sBA39BACEHAkAgAEF2aiIIQQAoApgfIglJDQAgCCABIAIgAyAEIAUgBhAmRQ0AAkAgCCAJRw0AQQEPCyAAQXRqLwEAECUhBwsgBws9AQJ/QQAhAgJAQQAoApgfIgMgAEsNACAALwEAIAFHDQACQCADIABHDQBBAQ8LIABBfmovAQAQJSECCyACC00BA39BACEIAkAgAEF0aiIJQQAoApgfIgpJDQAgCSABIAIgAyAEIAUgBiAHEBZFDQACQCAJIApHDQBBAQ8LIABBcmovAQAQJSEICyAIC64SAQN/AkAgABA8DQAgAEH0v39qQQJJDQAgAEG3AUYNACAAQYB6akHwAEkNACAAQf12akEFSQ0AIABBhwdGDQAgAEHvdGpBLUkNAAJAIABBwXRqIgFBCEsNAEEBIAF0Qe0CcQ0BCyAAQfBzakELSQ0AIABBtXNqQR9JDQACQCAAQapyaiIBQRJLDQBBASABdEH//BlxDQELIABB8AxGDQAgAEGWcmpBBEkNACAAQcBwakEKSQ0AIABB2nBqQQtJDQAgAEHQcWpBG0kNACAAQZEORg0AIABBkHJqQQpJDQAgAEHCbWpBEkkNACAAQcZtakEDSQ0AIABBnW5qQSFJDQAgAEGtbmpBD0kNACAAQadvakEDSQ0AIABB129qQQVJDQAgAEHbb2pBA0kNACAAQeVvakEJSQ0AIABB6m9qQQRJDQAgAEH9D0YNACAAQZVwakEJSQ0AAkAgAEGvbWoiAUESSw0AQQEgAXRB/4AYcQ0BCyAAQZptakEKSQ0AAkACQCAAQcRsag4oAgECAgICAgICAQECAgEBAgICAQEBAQEBAQEBAgEBAQEBAQEBAQECAgALIABB/2xqQQNJDQELIABB/hNGDQAgAEGabGpBCkkNAAJAIABBxGtqIgFBFUsNAEEBIAF0Qf2wjgFxDQELIABB/2tqQQNJDQAgAEH1FEYNACAAQZprakEMSQ0AAkACQCAAQcRqag4oAgECAgICAgICAgECAgIBAgICAQEBAQEBAQEBAQEBAQEBAQEBAQECAgALIABB/2pqQQNJDQELIABBmmpqQQpJDQAgAEGGampBBkkNAAJAAkAgAEHEaWoOKAIBAgICAgICAgEBAgIBAQICAgEBAQEBAQEBAgIBAQEBAQEBAQEBAgIACyAAQf9pakEDSQ0BCyAAQZppakEKSQ0AAkAgAEHCaGoiAUEZSw0AQQEgAXRBn+6DEHENAQsgAEGCF0YNACAAQZpoakEKSQ0AAkACQCAAQcJnag4mAgICAgICAgECAgIBAgICAgEBAQEBAQECAgEBAQEBAQEBAQEBAgIACyAAQYBoakEFSQ0BCyAAQZpnakEKSQ0AAkACQCAAQcRmag4oAgECAgICAgICAQICAgECAgICAQEBAQEBAQICAQEBAQEBAQEBAQECAgALIABB/2ZqQQNJDQELIABBmmZqQQpJDQAgAEF8cSIBQYAaRg0AAkAgAEHFZWoOKQEBAAEBAQEBAQEAAQEBAAEBAQEAAAAAAAAAAAABAAAAAAAAAAAAAAEBAAsgAEGaZWpBCkkNAAJAIABBtmRqIgJBDEsNAEEBIAJ0QeEvcQ0BCyAAQf5kakECSQ0AIABBeHFB2BtGDQAgAEGaZGpBCkkNAAJAIABBz2NqIgJBHUsNAEEBIAJ0QfmHgP4DcQ0BCyAAQY5kakECSQ0AIABBsR1GDQAgAEGwY2pBCkkNAAJAIABBzGJqIgJBCEsNACACQQZHDQELIABBuGJqQQZJDQAgAEHgYWpBCkkNACAAQX5xIgJBmB5GDQAgAEGwYmpBCkkNAAJAIABBy2FqIgNBCksNAEEBIAN0QZUMcQ0BCyAAQfNgakELSQ0AIAJBhh9GDQAgAEGPYWpBFEkNACAAQe5RakEDSQ0AIABBl1lqQQlJDQAgAEGjWWpBA0kNACAAQfFeakEPSQ0AIABB/l5qQQxJDQAgAEGPX2pBBEkNACAAQZlfakEHSQ0AIABBnl9qQQNJDQAgAEGiX2pBA0kNACAAQapfakEESQ0AIABBwF9qQQpJDQAgAEHVX2pBFEkNACAAQcYfRg0AIABB52BqQSRJDQAgAEHOUWpBA0kNACAAQa5RakECSQ0AIABBjlFqQQJJDQAgAEH1T2pBA0kNACAAQaBQakEKSQ0AIABB3S9GDQAgAEHMUGpBIEkNACAAQbBGakEDSQ0AIABBsEdqQQpJDQAgAEHAR2pBCkkNACAAQdxHakEUSQ0AIABBmkhqQQ5JDQAgAEHQSGpBCkkNACAAQd9IakENSQ0AIABBgElqQQNJDQAgAEGVSWpBCUkNACAAQbBJakEKSQ0AIABBzElqQRFJDQAgAEGASmpBBUkNACAAQdBKakEOSQ0AIABB8EpqQQpJDQAgAEGBS2pBC0kNACAAQaBLakEdSQ0AIABBq0tqQQpJDQAgAEHpS2pBBUkNACAAQbBMakELSQ0AIABBuk1qQQpJDQAgAEHQTWpBDEkNACAAQeBNakEMSQ0AIABBqTFGDQAgAEHwT2pBCkkNACAAQcBEakE6SQ0AIABBiUZqQQNJDQAgAEGORmpBA0kNACAAQe05Rg0AIABBrEZqQRVJDQAgAEGFRGpBBUkNAAJAIABBwb9/aiICQRVLDQBBASACdEGDgIABcQ0BCyAAQZu+f2pBDEkNACAAQeHBAEYNACAAQbC+f2pBDUkNACAAQZGmf2pBA0kNACAAQf/aAEYNACAAQWBxQeDbAEYNACAAQdaff2pBBkkNACAAQeeef2pBAkkNACAAQYyzfWpBCkkNACAAQe/MAkYNACAAQeCzfWpBCkkNAAJAIABB9a99aiICQRxLDQBBASACdEGBgID4AXENAQsgAEHisn1qQQJJDQAgAEGQsn1qQQJJDQACQAJAIABB/q99ag4FAgEBAQIACyAAQYCvfWpBAkkNAQsgAEHNrH1qQQ5JDQAgAUGA0wJGDQAgAEG5rX1qQQ1JDQAgAEHarX1qQQhJDQAgAEGBrn1qQQtJDQAgAEGgrn1qQRJJDQAgAEHMrn1qQRJJDQAgAEGwrn1qQQpJDQAgAEHXq31qQQ5JDQAgAEHl0wJGDQAgAEFfcUGwrH1qQQpJDQACQCAAQb2rfWoiAUEKSw0AQQEgAXRBgQxxDQELIABBsKt9akEKSQ0AAkAgAEGdqH1qIgFBCksNACABQQhHDQELAkAgAEHQqn1qIgFBEUsNAEEBIAF0QZ2DC3ENAQsCQCAAQZWqfWoiAUELSw0AQQEgAXRBnxhxDQELIABBhat9akEDSQ0AIABBcHEiAUGA/ANGDQAgAEGe9gNGDQAgAEGQqH1qQQpJDQAgAEG//gNGIABB8IF8akEKSSAAQbODfGpBA0kgAEHNg3xqQQJJIAFBoPwDRnJycnIPC0EBC1wBBH9BgIAEIQFBkAghAkF+IQMCQANAQQAhBCADQQJqIgNB5wNLDQEgAigCACABaiIBIABLDQEgAkEEaiEEIAJBCGohAiAEKAIAIAFqIgEgAEkNAAtBASEECyAEC1wBBH9BgIAEIQFBsBchAkF+IQMCQANAQQAhBCADQQJqIgNB+QFLDQEgAigCACABaiIBIABLDQEgAkEEaiEEIAJBCGohAiAEKAIAIAFqIgEgAEkNAAtBASEECyAEC8YfAQZ/AkACQAJAAkACQAJAIABB1n5qIgFBEEsNAEEBIAF0QYGQBHENAQsgAEG6empBDEkNACAAQYh+akHKA0kNACAAQcB+akEXSQ0AIABBqH5qQR9JDQACQCAAQZB5aiIBQRxLDQBBASABdEHf+YK6AXENAQsCQCAAQaB6aiIBQQ5LDQBBASABdEGfoAFxDQELIABB9nZqQaYBSQ0AIABBiXhqQYsBSQ0AIABB8nhqQRRJDQAgAEHdeGpB0wBJDQAgAEGRdGpBBEkNACAAQbB0akEbSQ0AIABBoHVqQSlJDQAgAEHZCkYNACAAQc91akEmSQ0AIABBj3NqQeMASQ0AIABBfnEiAkHuDEYNACAAQeBzakErSQ0AAkAgAEGrcmoiAUE8Tw0AQoGAjLCAnIGACCABrYhCAYNQRQ0BCyAAQe5xakEeSQ0AIABBtnBqQSFJDQAgAEGxD0YNACAAQbNxakHZAEkNAAJAIABBjHBqIgFBBksNAEEBIAF0QcMAcQ0BCyAAQYBwakEWSQ0AQQEhAQJAAkAgAEHcb2oOBQUBAQEFAAsgAEGaEEYNAQsgAEH8bWpBNkkNACAAQcpuakEISQ0AIABB4G5qQRVJDQAgAEHAb2pBGUkNACAAQaBvakELSQ0AIABBvRJGDQAgAEHQEkYNACAAQahtakEKSQ0AIABBj21qQRBJDQACQCAAQftsaiIDQQxPDQBBASEBQf8ZIANB//8DcXZBAXENBAsgAEHtbGpBFkkNAAJAIABBhGxqIgFBFEsNAEEBIAF0QYH84QBxDQELIABB1mxqQQdJDQACQCAAQc5saiIBQRxLDQBBASABdEHxkYCAAXENAQsCQCAAQaRsaiIBQRVLDQBBASABdEG7gMABcQ0BCyAAQe1rakEWSQ0AAkAgAEHWa2oiAUE1Tw0AQv+2g4CAgOALIAGtiEIBg1BFDQELIABB7WpqQRZJDQAgAEHxampBA0kNACAAQY5rakEDSQ0AIABB+2pqQQlJDQBBASEBAkACQCAAQdZqag4nBQUFBQUFBQEFBQEFBQUFBQEBAQUBAQEBAQEBAQEBAQEBAQEBAQEFAAsCQCAAQYdqaiIBQRdLDQBBASABdEGB4L8GcQ0CCyAAQaBqakECSQ0BCyAAQe1pakEWSQ0AQQEhAQJAAkAgAEGPaWoONAUBAQEBAQEBAQEBAQEBAQEBAQUBBQUFBQUFAQEBBQUFAQUFBQUBAQEFBQEFAQUFAQEBBQUACwJAIABB1mlqIgFBE0sNAEEBIAF0Qf/2I3ENAgsgAEGkaWoiAUEFSw0AIAFBAkcNAQsgAEHYaGpBA0kNACAAQe5nakEXSQ0AIABB8mdqQQNJDQAgAEH7Z2pBCEkNACAAQdAXRg0AIABB0mhqQQxJDQAgAEG9GEYNACAAQdZnakEQSQ0AAkAgAEGoZ2oiAUEpTw0AQoeGgICAICABrYhCAYNQRQ0BCyAAQdZmakEKSQ0AIABB7mZqQRdJDQAgAEH7ZmpBCEkNACAAQfJmakEDSQ0AAkAgAEH7ZWoiAUELSw0AIAFBCEcNAQsCQCAAQctmaiIBQQhLDQBBASABdEGfAnENAQsCQCAAQaJmaiIBQRRLDQBBASABdEGNgOAAcQ0BCyAAQe5lakEpSQ0AIABBvRpGDQAgAEHOGkYNACAAQc1kakEJSQ0AIABB5mRqQRhJDQAgAEH7ZGpBEkkNACAAQYZlakEGSQ0AIABBrGVqQQNJDQAgAEGhZWpBA0kNAAJAIABBw2RqIgNBCk8NAEEBIQFB+QcgA0H//wNxdkEBcQ0ECyACQbIcRg0AIABB/2NqQTBJDQAgAEHAY2pBB0kNAAJAIABB/2JqIgFBDEsNAEEBIAF0QcslcQ0BCyAAQXxxIgNBlB1GDQAgAEHnYmpBB0kNAAJAIABB32JqIgFBJk8NAELX7JuA+QUgAa2IQgGDUEUNAQsgAEGAYGpBK0kNACAAQfhgakEFSQ0AIABBt2FqQSRJDQAgAEF4cSIEQcAeRg0AIABBgB5GDQAgA0HcHUYNAAJAIABBwV9qIgFBKE8NAEKBgPjDxxggAa2IQgGDUEUNAQsgAEGSX2pBA0kNACAAQeBeakEmSQ0AIABBjiFGDQAgAEGLX2pBDUkNACAAQcchRg0AIABBzSFGDQAgAEG2W2pBBEkNACAAQbBeakErSQ0AIABBhF5qQc0CSQ0AAkAgAEGwW2oiBUEJTw0AQQEhAUH/AiAFQf//A3F2QQFxDQQLIABBzlpqQQRJDQAgAEHwWmpBIUkNACAAQfZaakEESQ0AIABBpltqQQRJDQAgAEGgW2pBKUkNAAJAIABByFpqIgVBCU8NAEEBIQFB/wIgBUH//wNxdkEBcQ0ECyAAQYBRakE0SQ0AIABBklFqQQNJDQAgAEGgUWpBDUkNACAAQcBRakESSQ0AIABB4FFqQRJJDQAgAEHyUWpBBEkNACAAQYBSakENSQ0AIABBklJqQQtJDQAgAEHgUmpBywBJDQAgAEH/UmpBGkkNACAAQZFTakERSQ0AIABB/1dqQewESQ0AIABBiFhqQQZJDQAgAEHgWGpB1gBJDQAgAEFwcSIFQYAnRg0AIABB6FlqQcMASQ0AIABB7llqQQRJDQAgAEGoWmpBOUkNACAAQb5aakEESQ0AIABBuFpqQQ9JDQAgAEHXL0YNACAAQdwvRg0AIABB4E9qQdkASQ0AIABBgExqQRdJDQAgAEHQTGpBGkkNACAAQYBNakEsSQ0AIABBkE1qQQVJDQAgAEGwTWpBHkkNACAAQYBOakEfSQ0AIABB0E5qQcYASQ0AIABBqjFGDQQgAEGAT2pBKUkNBCAAQbtJakEHSQ0EIABB+0lqQS9JDQQgAEGnNUYNBCAAQeBLakE1SQ0EIABBl0ZqQQRJDQQgAEHDRmpBA0kNBCAAQfBGakErSQ0EIABBgEdqQQlJDQQgAEGmR2pBJEkNBCAAQbNHakEDSQ0EIABBgEhqQSRJDQQgAEHGSGpBLEkNBCACQa43Rg0EIABB/UhqQR5JDQQgAEGSRmoiBkEJSQ0BDAILQQEhAQwCC0EBIQFBjwMgBkH//wNxdkEBcQ0BCyAEQdA+Rg0BIABBuEFqQQZJDQEgAEHgQWpBJkkNASAAQehBakEGSQ0BIABBgEZqQcABSQ0BIABBgERqQZYCSQ0BAkAgAEGnQWoiAUEESw0AQQEgAXRBFXENAgsgAEGhQWpBH0kNASAAQYBBakE1SQ0BAkAgAEHKQGoiBEEJTw0AQQEhAUH/AiAEQf//A3F2QQFxDQELIABBjkBqQQNJDQEgAEGgQGpBDUkNASAAQapAakEGSQ0BIANB0D9GDQEgAEG+QGpBA0kNASAAQbpAakEHSQ0BIABBikBqQQdJDQEgAEHxwABGDQEgAEH/wABGDQEgAEHwvn9qQQ1JDQEgAEGCwgBGDQEgAEGHwgBGDQEgAEGVwgBGDQEgAEH2vX9qQQpJDQECQCAAQei9f2oiBEERTw0AQQEhAUG/oAUgBHZBAXENAQsgAEHWvX9qQRBJDQEgA0G8wgBGDQECQCAAQbu9f2oiBEEKTw0AQQEhAUGfBCAEQf//A3F2QQFxDQELIABBoKd/akGFAUkNASAAQdCnf2pBL0kNASAAQaC9f2pBKUkNASAAQYCof2pBL0kNAQJAIABBlaZ/aiIEQQlPDQBBASEBQY8DIARB//8DcXZBAXENAQsgAEGApn9qQSZJDQEgAEGn2gBGDQEgAEGt2gBGDQEgAEGAtn1qQY0CSQ0BIABBsLZ9akEuSQ0BIABBgMB9akGNCUkNASAAQYDkfmpB8KMBSQ0BIABBgJh/akG2M0kNASAFQfDjAEYNASAAQeCcf2pBG0kNASAAQc+df2pB3gBJDQEgAEH7nX9qQStJDQEgA0H84QBGDQEgAEHfnn9qQdoASQ0BIABB5Z5/akEFSQ0BIABBv59/akHWAEkNASAAQciff2pBBUkNASAAQc+ff2pBBUkNASAAQd+ff2pBCUkNASAAQfuff2pBA0kNASAAQaikf2pBB0kNASAAQbCkf2pBB0kNASAAQbikf2pBB0kNASAAQcCkf2pBB0kNASAAQcikf2pBB0kNASAAQdCkf2pBB0kNASAAQdikf2pBB0kNASAAQeCkf2pBB0kNASAAQYClf2pBF0kNASAAQe/aAEYNASAAQdClf2pBOEkNASAAQf6ufWpBMkkNASAAQcCvfWpBNEkNASAAQfSvfWpBF0kNASAAQfmvfWpBBEkNASAAQf2vfWpBA0kNASAAQYmwfWpBC0kNASAAQfWwfWpBL0kNASAAQd6xfWpB5wBJDQEgAEHpsX1qQQlJDQEgAEHgsn1qQdAASQ0BIABBgbN9akEfSQ0BIABBwLN9akEvSQ0BIAJBqswCRg0BIAVBkMwCRg0BAkAgAEGOrn1qIgJBDU8NAEEBIQFBvzQgAkH//wNxdkEBcQ0BCyAAQaCtfWpBHUkNASAAQfatfWpBHEkNASAAQdCtfWpBF0kNASAAQbyrfWpBCEkNASAAQcCrfWpBA0kNASAAQYCsfWpBKUkNASAAQYasfWpBBUkNASAAQZqsfWpBCkkNASAAQaCsfWpBBUkNASAAQc/TAkYNASAAQfysfWpBL0kNASAAQYKrfWpBMkkNASAAQfrUAkYNASAAQaCrfWpBF0kNAQJAIABBz6p9aiICQRJPDQBBASEBQbG+CiACdkEBcQ0BCyAAQYCKfGpBB0kNASAAQZCLfGpB6gBJDQEgAEGAjnxqQe4CSQ0BIABBtdB8akExSQ0BIABB0NB8akEXSQ0BIABBgKh9akGk1wBJDQEgAEGQqX1qQfMASQ0BIABBpKl9akEKSQ0BIABB0Kl9akErSQ0BIABB2Kl9akEHSQ0BIABB4Kl9akEHSQ0BIABB76l9akEGSQ0BIABBd3FB/6l9akEGSQ0BIABBjqp9akEDSQ0BIABBpap9akEDSQ0BIABBoKp9akELSQ0BAkAgAEHtiXxqIgJBC08NAEEBIQFBnwggAkH//wNxdkEBcQ0BCyAAQeGJfGpBCkkNASAAQdaJfGpBDUkNAQJAIABByIl8aiICQQ1PDQBBASEBQd82IAJB//8DcXZBAXENAQsgAEGugHxqQQZJDQEgAEG2gHxqQQZJDQEgAEG+gHxqQQZJDQEgAEGagXxqQdkASQ0BIABBv4F8akEaSQ0BIABB34F8akEaSQ0BIABBioN8akGHAUkNASAAQZCDfGpBBUkNASAAQZCEfGpBDEkNASAAQe6EfGpBNkkNASAAQbCFfGpBwABJDQEgAEG6iXxqQewASQ0BQQEhASAAQa2IfGpB6wJJDQAgAEGmgHxqQQNJDwsgAQ8LQQELXQEBf0EAIQkCQCAALwEAIAFHDQAgAC8BAiACRw0AIAAvAQQgA0cNACAALwEGIARHDQAgAC8BCCAFRw0AIAAvAQogBkcNACAALwEMIAdHDQAgAC8BDiAIRiEJCyAJCzUAAkAgAEGA+ANxQYCwA0cNACAAQQp0QYD4P3FBACgCvKABLwECQf8HcXJBgIAEaiEACyAAC2gBAn9BASEBAkACQCAAQV9qIgJBBUsNAEEBIAJ0QTFxDQELIABB+P8DcUEoRg0AIABBRmpB//8DcUEGSQ0AAkAgAEGlf2oiAkEDSw0AIAJBAUcNAQsgAEGFf2pB//8DcUEESSEBCyABC3gBBH9BACgCvKABIQBBACgCwKABIQECQAJAA0AgAEECaiECIAAgAU8NAQJAAkAgAi8BACIDQaR/ag4CAQQACyACIQAgA0F2ag4EAgEBAgELIABBBGohAAwACwtBACACNgK8oAFBChAbQQAPC0EAIAI2ArygAUHdAAtJAQN/QQAhAwJAIAJFDQACQANAIAAtAAAiBCABLQAAIgVHDQEgAUEBaiEBIABBAWohACACQX9qIgINAAwCCwsgBCAFayEDCyADCwvCFwIAQYAIC5gXAAAAAAAAAAAAAAAAAAAAAAAAAAALAAAAAgAAABkAAAACAAAAEgAAAAIAAAABAAAAAgAAAA4AAAADAAAADQAAACMAAAB6AAAARgAAADQAAAAMAQAAHAAAAAQAAAAwAAAAMAAAAB8AAAAOAAAAHQAAAAYAAAAlAAAACwAAAB0AAAADAAAAIwAAAAUAAAAHAAAAAgAAAAQAAAArAAAAnQAAABMAAAAjAAAABQAAACMAAAAFAAAAJwAAAAkAAAAzAAAAnQAAADYBAAAKAAAAFQAAAAsAAAAHAAAAmQAAAAUAAAADAAAAAAAAAAIAAAArAAAAAgAAAAEAAAAEAAAAAAAAAAMAAAAWAAAACwAAABYAAAAKAAAAHgAAAEIAAAASAAAAAgAAAAEAAAALAAAAFQAAAAsAAAAZAAAARwAAADcAAAAHAAAAAQAAAEEAAAAAAAAAEAAAAAMAAAACAAAAAgAAAAIAAAAcAAAAKwAAABwAAAAEAAAAHAAAACQAAAAHAAAAAgAAABsAAAAcAAAANQAAAAsAAAAVAAAACwAAABIAAAAOAAAAEQAAAG8AAABIAAAAOAAAADIAAAAOAAAAMgAAAA4AAAAjAAAAXQEAACkAAAAHAAAAAQAAAE8AAAAcAAAACwAAAAAAAAAJAAAAFQAAAGsAAAAUAAAAHAAAABYAAAANAAAANAAAAEwAAAAsAAAAIQAAABgAAAAbAAAAIwAAAB4AAAAAAAAAAwAAAAAAAAAJAAAAIgAAAAQAAAAAAAAADQAAAC8AAAAPAAAAAwAAABYAAAAAAAAAAgAAAAAAAAAkAAAAEQAAAAIAAAAYAAAAVQAAAAYAAAACAAAAAAAAAAIAAAADAAAAAgAAAA4AAAACAAAACQAAAAgAAAAuAAAAJwAAAAcAAAADAAAAAQAAAAMAAAAVAAAAAgAAAAYAAAACAAAAAQAAAAIAAAAEAAAABAAAAAAAAAATAAAAAAAAAA0AAAAEAAAAnwAAADQAAAATAAAAAwAAABUAAAACAAAAHwAAAC8AAAAVAAAAAQAAAAIAAAAAAAAAuQAAAC4AAAAqAAAAAwAAACUAAAAvAAAAFQAAAAAAAAA8AAAAKgAAAA4AAAAAAAAASAAAABoAAADmAAAAKwAAAHUAAAA/AAAAIAAAAAcAAAADAAAAAAAAAAMAAAAHAAAAAgAAAAEAAAACAAAAFwAAABAAAAAAAAAAAgAAAAAAAABfAAAABwAAAAMAAAAmAAAAEQAAAAAAAAACAAAAAAAAAB0AAAAAAAAACwAAACcAAAAIAAAAAAAAABYAAAAAAAAADAAAAC0AAAAUAAAAAAAAACMAAAA4AAAACAEAAAgAAAACAAAAJAAAABIAAAAAAAAAMgAAAB0AAABxAAAABgAAAAIAAAABAAAAAgAAACUAAAAWAAAAAAAAABoAAAAFAAAAAgAAAAEAAAACAAAAHwAAAA8AAAAAAAAASAEAABIAAAC+AAAAAAAAAFAAAACZAwAAZwAAAG4AAAASAAAAwwAAAL0KAAAuBAAA0g8AAEYCAAC6IQAAOAIAAAgAAAAeAAAAcgAAAB0AAAATAAAALwAAABEAAAADAAAAIAAAABQAAAAGAAAAEgAAALECAAA/AAAAgQAAAEoAAAAGAAAAAAAAAEMAAAAMAAAAQQAAAAEAAAACAAAAAAAAAB0AAAD3FwAACQAAANUEAAArAAAACAAAAPgiAAAeAQAAMgAAAAIAAAASAAAAAwAAAAkAAACLAQAABQkAAGoAAAAGAAAADAAAAAQAAAAIAAAACAAAAAkAAABnFwAAVAAAAAIAAABGAAAAAgAAAAEAAAADAAAAAAAAAAMAAAABAAAAAwAAAAMAAAACAAAACwAAAAIAAAAAAAAAAgAAAAYAAAACAAAAQAAAAAIAAAADAAAAAwAAAAcAAAACAAAABgAAAAIAAAAbAAAAAgAAAAMAAAACAAAABAAAAAIAAAAAAAAABAAAAAYAAAACAAAAUwEAAAMAAAAYAAAAAgAAABgAAAACAAAAHgAAAAIAAAAYAAAAAgAAAB4AAAACAAAAGAAAAAIAAAAeAAAAAgAAABgAAAACAAAAHgAAAAIAAAAYAAAAAgAAAAcAAAA1CQAALAAAAAsAAAAGAAAAEQAAAAAAAAByAQAAKwAAABUFAADEAAAAPAAAAEMAAAAIAAAAAAAAALUEAAADAAAAAgAAABoAAAACAAAAAQAAAAIAAAAAAAAAAwAAAAAAAAACAAAACQAAAAIAAAADAAAAAgAAAAAAAAACAAAAAAAAAAcAAAAAAAAABQAAAAAAAAACAAAAAAAAAAIAAAAAAAAAAgAAAAIAAAACAAAAAQAAAAIAAAAAAAAAAwAAAAAAAAACAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAABAAAAAgAAAAAAAAADAAAAAwAAAAIAAAAGAAAAAgAAAAMAAAACAAAAAwAAAAIAAAAAAAAAAgAAAAkAAAACAAAAEAAAAAYAAAACAAAAAgAAAAQAAAACAAAAEAAAAEURAADdpgAAIwAAADQQAAAMAAAA3QAAAAMAAACBFgAADwAAADAdAAAgDAAAHQIAAOMFAABKEwAA/QEAAAAAAADjAAAAAAAAAJYAAAAEAAAAJgEAAAkAAABYBQAAAgAAAAIAAAABAAAABgAAAAMAAAApAAAAAgAAAAUAAAAAAAAApgAAAAEAAAA+AgAAAwAAAAkAAAAJAAAAcgEAAAEAAACaAAAACgAAALAAAAACAAAANgAAAA4AAAAgAAAACQAAABAAAAADAAAALgAAAAoAAAA2AAAACQAAAAcAAAACAAAAJQAAAA0AAAACAAAACQAAAAYAAAABAAAALQAAAAAAAAANAAAAAgAAADEAAAANAAAACQAAAAMAAAACAAAACwAAAFMAAAALAAAABwAAAAAAAAChAAAACwAAAAYAAAAJAAAABwAAAAMAAAA4AAAAAQAAAAIAAAAGAAAAAwAAAAEAAAADAAAAAgAAAAoAAAAAAAAACwAAAAEAAAADAAAABgAAAAQAAAAEAAAAwQAAABEAAAAKAAAACQAAAAUAAAAAAAAAUgAAABMAAAANAAAACQAAANYAAAAGAAAAAwAAAAgAAAAcAAAAAQAAAFMAAAAQAAAAEAAAAAkAAABSAAAADAAAAAkAAAAJAAAAVAAAAA4AAAAFAAAACQAAAPMAAAAOAAAApgAAAAkAAABHAAAABQAAAAIAAAABAAAAAwAAAAMAAAACAAAAAAAAAAIAAAABAAAADQAAAAkAAAB4AAAABgAAAAMAAAAGAAAABAAAAAAAAAAdAAAACQAAACkAAAAGAAAAAgAAAAMAAAAJAAAAAAAAAAoAAAAKAAAALwAAAA8AAACWAQAABwAAAAIAAAAHAAAAEQAAAAkAAAA5AAAAFQAAAAIAAAANAAAAewAAAAUAAAAEAAAAAAAAAAIAAAABAAAAAgAAAAYAAAACAAAAAAAAAAkAAAAJAAAAMQAAAAQAAAACAAAAAQAAAAIAAAAEAAAACQAAAAkAAABKAQAAAwAAAGpLAAAJAAAAhwAAAAQAAAA8AAAABgAAABoAAAAJAAAA9gMAAAAAAAACAAAANgAAAAgAAAADAAAAUgAAAAAAAAAMAAAAAQAAAKxMAAABAAAAxxQAAAQAAAAEAAAABQAAAAkAAAAHAAAAAwAAAAYAAAAfAAAAAwAAAJUAAAACAAAAigUAADEAAAABAgAANgAAAAUAAAAxAAAACQAAAAAAAAAPAAAAAAAAABcAAAAEAAAAAgAAAA4AAABRBQAABgAAAAIAAAAQAAAAAwAAAAYAAAACAAAAAQAAAAIAAAAEAAAABgEAAAYAAAAKAAAACQAAAKMBAAANAAAA1wUAAAYAAABuAAAABgAAAAYAAAAJAAAAlxIAAAkAAAAHBQwA7wAAAABBmB8LHFCMAAABAAAAAgAAAAMAAAAEAAAAAAQAAPAfAAA=";return"undefined"!=typeof Buffer?Buffer.from(A,"base64"):Uint8Array.from(atob(A),A=>A.charCodeAt(0))}let I;export function init(){return I||(I=(async()=>{const Q=await WebAssembly.compile(g()),{exports:B}=await WebAssembly.instantiate(Q);A=B})())}export function initSync(){if(A)return;const Q=new WebAssembly.Module(g()),{exports:B}=new WebAssembly.Instance(Q);A=B}
\ No newline at end of file
+/* cjs-module-lexer 2.1.0 */
+let A;const B=1===new Uint8Array(new Uint16Array([1]).buffer)[0];export function parse(I,C="@"){if(!A)throw new Error("Not initialized");const w=I.length+1,D=(A.__heap_base.value||A.__heap_base)+4*w-A.memory.buffer.byteLength;D>0&&A.memory.grow(Math.ceil(D/65536));const G=A.sa(w);(B?g:E)(I,new Uint16Array(A.memory.buffer,G,w));const S=A.parseCJS(G,I.length,0,0,0);if(S){const B=new Error(`Parse error ${C}${A.e()}:${I.slice(0,A.e()).split("\n").length}:${A.e()-I.lastIndexOf("\n",A.e()-1)}`);throw Object.assign(B,{idx:A.e()}),5!==S&&6!==S&&7!==S||Object.assign(B,{code:"ERR_LEXER_ESM_SYNTAX"}),B}let R=new Set,o=new Set,H=new Set;for(;A.rre();){const B=Q(I.slice(A.res(),A.ree()));B&&o.add(B)}for(;A.ru();)H.add(Q(I.slice(A.us(),A.ue())));for(;A.re();){let B=Q(I.slice(A.es(),A.ee()));void 0===B||H.has(B)||R.add(B)}return{exports:[...R],reexports:[...o]}}function Q(A){if('"'!==A[0]&&"'"!==A[0])return A;try{const B=(0,eval)(A);for(let A=0;A<B.length;A++){const Q=64512&B.charCodeAt(A);if(!(Q<55296)){if(55296!==Q)return;if(56320!=(64512&B.charCodeAt(++A)))return}}return B}catch{}}function E(A,B){const Q=A.length;let E=0;for(;E<Q;){const Q=A.charCodeAt(E);B[E++]=(255&Q)<<8|Q>>>8}}function g(A,B){const Q=A.length;let E=0;for(;E<Q;)B[E]=A.charCodeAt(E++)}function I(){const A="AGFzbQEAAAABXA1gAX8Bf2ACf38AYAABf2AAAGABfwBgBn9/f39/fwF/YAJ/fwF/YAd/f39/f39/AX9gA39/fwF/YAh/f39/f39/fwF/YAV/f39/fwF/YAR/f39/AX9gBH9/f38AAzMyAQEBAwAABAUJBAAEBAMDAAcCAAAICgAFAAAGBQsHBgAAAAAIAAICAgICAgICAgIFDAYEBQFwAQUFBQMBAAEGCAF/AEHQmAILB1wOBm1lbW9yeQIAC19faGVhcF9iYXNlAwACc2EAJAFlACUCZXMAJgJlZQAnA3JlcwAoA3JlZQApAnVzACoCdWUAKwJyZQAsA3JyZQAtAnJ1AC4IcGFyc2VDSlMALwkKAQBBAQsEAAECAwrJkwEyDgAgACABQcgfQcAfEDALDgAgACABQdQfQcwfEDALDgAgACABQeAfQdgfEDALEgBBzB9BADYCAEHUH0EANgIAC8wBAQN/AkBBvKABKAIAIgNBAmpB5QBB8QBB9QBB6QBB8gBB5QAQEARAQbygASADQQ5qNgIAAkAQEUEoRw0AQbygAUG8oAEoAgBBAmo2AgAQESEBQbygASgCACECIAFBJ0cgAUEiR3ENACABEAxBvKABQbygASgCAEECaiIBNgIAEBFBKUcNAAJAIABBAWsOAgMDAAtBtKABKAIAIAI2AgBBtKABKAIAIAE2AgRBAQ8LQbygASADNgIAC0EADwsgAiABQaAfKAIAEQEAQQELGwAgAEGYHygCAEYEQEEBDwsgAEECay8BABAPC/8CAQV/QZgfKAIAIQQDQAJAIABBAmshASAALwEAIgJBIEcNACAAIARLIAEhAA0BCwsCQCACQT1HDQADQAJAIAFBAmshACABLwEAQSBHDQAgASAESyAAIQENAQsLIABBAmohASAAQQRqIQNBACECA0ACQCABLwEAIgBBgPgDcUGAuANGBEAgAEH/B3EgAUECay8BAEH/B3FBCnRyQYCABGohAAsgAEUgASAETXINACAAQdwARg0CIAAQEkUNACABQX5BfCAAQYCABEkbaiEBIAAQEyECDAELCyACQQFxRQ0AIAEvAQBBIEcNAEG0oAEoAgAiAkGwHygCAEYNACACIAM2AgwgAiABQQJqNgIIA0ACQCABQQJrIQAgAS8BACIDQSBHDQAgASAESyAAIQENAQsLAkACQAJAIANB8gBrDgMAAwEDCyAAQfYAQeEAEBQNAQwCCyAAQewAQeUAEBQNACAAQeMAQe8AQe4AQfMAEBVFDQELQbSgASACQRBqNgIACws7AQF/AkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUYhBgsgBgtPAQF/AkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUcNACAALwEKIAZHDQAgAC8BDCAHRiEICyAIC7MFAQN/QbygAUG8oAEoAgAiAkEOajYCAAJAAkAQESIBQdsARwRAIAFBPUYNASABQS5HDQJBvKABQbygASgCAEECajYCABARQbygASgCACEBEBZFDQJBvKABKAIAIQAQEUE9Rw0CIAEgAEGcHygCABEBAA8LQbygAUG8oAEoAgBBAmo2AgAQESIAQSdHIABBIkdxDQFBvKABKAIAIAAQDEG8oAFBvKABKAIAQQJqIgA2AgAQEUHdAEcNAUG8oAFBvKABKAIAQQJqNgIAEBFBPUcNASAAQZwfKAIAEQEADAELIABFDQBBqB8oAgARAwBBvKABQbygASgCAEECajYCABARIgBB8gBHBEAgAEH7AEcNAUG8oAEoAgBBAmshAQJAAkADQEG8oAFBvKABKAIAIgBBAmo2AgAgAEHAoAEoAgBPDQIQESEAQbygASgCACECAkAgABAWBEBBvKABKAIAIQMQESIAQTpGBEBBvKABQbygASgCAEECajYCABAREBZFDQRBvKABKAIALwEAIQALIAIgA0GcHygCABEBAAwBCwJAIABBIkcEQCAAQS5GDQEgAEEnRw0EC0G8oAEoAgAgABAMQbygAUG8oAEoAgBBAmoiAzYCABARIgBBOkcNAUG8oAFBvKABKAIAQQJqNgIAEBEQFkUNA0G8oAEoAgAvAQAhACADQZwfKAIAEQEADAELQbygASgCACIALwECQS5HDQIgAC8BBEEuRw0CQbygASAAQQZqNgIAAkACQCAALwEGIgBB8gBGBH9BARAEQbygASgCACEADQEgAC8BAAUgAAtB//8DcRAWRQ0EDAELQbygASAAQQJqNgIACxARIQALIABB//8DcSIAQSxGDQALIABB/QBGDQELQbygASABNgIACw8LQQEQBBoLQbygASACQQxqNgIACywBAX8gAEGgAUYgAEEJayIBQRdNQQBBASABdEGfgIAEcRtyRQRAQQAPC0EBC0AAQfAfKAIARQRAQfAfIAA2AgALQbygASgCACEAQbygAUHAoAEoAgBBAmo2AgBB7B8gAEGYHygCAGtBAXU2AgALjAEBBH9BvKABKAIAIQFBwKABKAIAIQQCQANAAkAgASICQQJqIQEgAiAETw0AIAEvAQAiAyAARg0CIANB3ABHBEAgA0EKaw4EAQICAQILIAJBBGohASACLwEEQQ1HDQEgAkEGaiABIAIvAQZBCkYbIQEMAQsLQbygASABNgIAQQkQCw8LQbygASABNgIAC0oBA39BvKABKAIAQQJqIQFBwKABKAIAIQIDQAJAIAEiAEECayACTw0AIABBAmohASAALwEAQQprDgQAAQEAAQsLQbygASAANgIAC2EBAn9BvKABKAIAQQZqIQBBwKABKAIAIQEDQAJAAkAgASAAQQRrSwRAIABBAmsvAQBBKkcNAiAALwEAQS9HDQIMAQsgAEECayEAC0G8oAEgADYCAA8LIABBAmohAAwACwALNAEBfyAAQaABRiAAQQlrIgFBF01BAEEBIAF0QZ+AgARxG3JFBEAgABAiIABBLkdxDwtBAQtFAQF/AkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUcNACAALwEKIAZGIQcLIAcLaQEDf0G8oAEoAgAhAANAAkACQCAALwEAIgFBL0YEQCAALwECIgBBKkcEQCAAQS9HDQMQDQwCCxAODAELIAEQCkUNAQtBvKABQbygASgCACICQQJqIgA2AgAgAkHAoAEoAgBJDQELCyABC4ETAQR/IABBL00EQCAAQSRGDwsCQCAAQTpJDQACQCAAQcEASQ0AIABB2wBJDQEgAEHgAE0EQCAAQd8ARg8LIABB+wBJDQEgAEH//wNNBEAgAEGqAUkNAQJ/AkAgABAgIABBjMAAa0ECSXIgAEG3AUYgAEGABmtB8ABJcnIgAEGHB0YgAEGDCWtBBUlyIABBkQtrQS1JcnINAAJAAkAgAEG/C2siAUEJSUHtAiABdkEBcXENACAAQZAMa0ELSSAAQcsMa0EfSXINAiAAQfAMRiAAQeoNa0EESXIgAEHWDWsiAUESTUEAQQEgAXRB//wZcRtyIABBwA9rQQpJIABBpg9rQQtJciAAQZEORiAAQbAOa0EbSXJyciAAQfANa0EKSSAAQb4Sa0ESSXIgAEG6EmtBA0kgAEHjEWtBIUlyciAAQdMRa0EPSSAAQdkQa0EDSXIgAEGpEGtBBUkgAEGlEGtBA0lycnJyIABBmxBrQQlJIABBlhBrQQRJciAAQf0PRiAAQesPa0EJSXJycg0CAkAgAEHREmsiAUETTwRAIABB5hJrQQpJDQQMAQtB/4AYIAF2QQFxIABB5hJrQQpJcg0BCwJAAkAgAEG8E2sOKAIBAgICAgICAgEBAgIBAQICAgEBAQEBAQEBAQIBAQEBAQEBAQEBAgIACyAAQYETa0EDSQ0DCyAAQf4TRiAAQeYTa0EKSXINAiAAQfUURiAAQYEUa0EDSXIgAEG8FGsiAUEVTUEAQQEgAXRB/bCOAXEbciAAQeYUa0EMSXINAgJAAkAgAEG8FWsOKAIBAgICAgICAgIBAgICAQICAgEBAQEBAQEBAQEBAQEBAQEBAQEBAgIACyAAQYEVa0EDSQ0DCyAAQeYVa0EKSSAAQfoVa0EGSXINAgJAAkAgAEG8FmsOKAIBAgICAgICAgEBAgIBAQICAgEBAQEBAQEBAgIBAQEBAQEBAQEBAgIACyAAQYEWa0EDSQ0DCyAAQeYWa0EKSQ0CIABBghdGIABB5hdrQQpJciAAQb4XayIBQRlNQQBBASABdEGf7oMQcRtyDQICQAJAIABBvhhrDiYCAgICAgICAQICAgECAgICAQEBAQEBAQICAQEBAQEBAQEBAQECAgALIABBgBhrQQVJDQMLIABB5hhrQQpJDQICQAJAIABBvBlrDigCAQICAgICAgIBAgICAQICAgIBAQEBAQEBAgIBAQEBAQEBAQEBAQICAAsgAEGBGWtBA0kNAwsgAEHmGWtBCkkNAiAAQXxxIgFBgBpGDQICQCAAQbsaayICQSlPBEAgAEHmGmtBCkkNBAwBC0L7956AgTAgAq2Ip0EBcSAAQeYaa0EKSXINAQsgAEF4cUHYG0YgAEGCG2tBAklyIABByhtrIgJBDE1BAEEBIAJ0QeEvcRtyIABB5htrQQpJcg0CIABBsR1GIABB8htrQQJJciAAQbEcayICQR1NQQBBASACdEH5h4D+A3EbciAAQdAca0EKSXINAgJAIABBtB1rIgJBCU8EQCAAQcgda0EGSQ0EDAELQb8DIAJ2QQFxIABByB1rQQZJcg0BCyAAQaAea0EKSSAAQdAda0EKSXINAiAAQX5xIgJBmB5GDQIgAEG1HmsiA0ELSUGVDCADdkEBcXENACAAQY0fa0ELSSAAQfEea0EUSXIgAkGGH0YgAEGSLmtBA0lyciAAQekma0EJSSAAQd0ma0EDSXIgAEGPIWtBD0kgAEGCIWtBDElycnIgAEHxIGtBBEkgAEHnIGtBB0lyIABB4iBrQQNJIABB3iBrQQNJcnIgAEHWIGtBBEkgAEHAIGtBCklyIABBxh9GIABBqyBrQRRJcnJyciAAQZkfa0EkSSAAQbIua0EDSXIgAEHSLmtBAkkgAEHyLmtBAklyciAAQYswa0EDSSAAQeAva0EKSXIgAEHdL0YgAEG0L2tBIElycnIgAEHQOWtBA0kgAEFucUHAOGtBCklyIABBpDhrQRRJIABB5jdrQQ5JcnIgAEGwN2tBCkkgAEGhN2tBDUlyIABBgDdrQQNJIABB6zZrQQlJcnJycnIgAEHQNmtBCkkgAEG0NmtBEUlyIABBgDZrQQVJIABBsDVrQQ5JcnIgAEGQNWtBCkkgAEH/NGtBC0lyIABB4DRrQR1JIABB1TRrQQpJcnJyIABBlzRrQQVJIABB0DNrQQtJciAAQakxRiAAQcYya0EKSXJyIABBkDBrQQpJIABBbHFBoDJrQQxJciAAQcA7a0E6SSAAQfc5a0EDSXJycnIgAEHtOUYgAEHyOWtBA0lyIABB1DlrQRVJIABB+ztrQQVJcnJycg0CIABB4cEARiAAQeXBAGtBDElyIABBv8AAayICQRVNQQBBASACdEGDgIABcRtyIABB0MEAa0ENSSAAQe/ZAGtBA0lyIABB/9oARiAAQWBxQeDbAEZycnIgAEGq4ABrQQZJIABBmeEAa0ECSXIgAEHvzAJGIABB9MwCa0EKSXJyIABBoMwCa0EKSXJyDQIgAEGezQJrQQJJIABB8M0Ca0ECSXIgAEGL0AJrIgJBHE1BAEEBIAJ0QYGAgPgBcRtyDQICQAJAIABBgtACaw4FAgEBAQIACyAAQYDRAmtBAkkNAwsgAUGA0wJGIABBs9MCa0EOSXIgAEHH0gJrQQ1JIABBptICa0EISXJyIABB/9ECa0ELSSAAQeDRAmtBEklyIABBtNECa0ESSSAAQdDRAmtBCklycnIgAEHl0wJGIABBqdQCa0EOSXJyDQIgAEFecUHQ0wJrQQpJDQEgAEHQ1AJrQQpJIABBw9QCayIBQQpNQQBBASABdEGBDHEbcg0BIABB49cCayIBQQpNIAFBCEdxDQEgAEGw1QJrIgFBEU1BAEEBIAF0QZ2DC3EbDQEgAEH71AJrQQNJIABB69UCayIBQQtNQQBBASABdEGfGHEbcg0BIABBcHEiAUGA/ANGIABBnvYDRnINASAAQfDXAmtBCkkNACABQaD8A0YgAEGz/ANrQQJJciAAQc38A2tBA0lyIABBkP4Da0EKSXIgAEG//gNGcgwDC0EBDAILQQEMAQtBAQsPC0EBIQEgABAfDQBBACEBQYCABCEEQX4hA0GwFyECAkADQCADQQJqIgNB+QFLDQEgACACKAIAIARqIgRJBEBBACEBDAILIAJBBGohASACQQhqIQIgASgCACAEaiIEIABJDQALQQEhAQsgA0H6AUkgAXEhAQsgAQ8LQQELXQEBfyAAQcAATQRAIABBJEYPC0EBIQECQCAAQdsASQ0AIABB4ABNBEAgAEHfAEYPCyAAQfsASQ0AIABB//8DTQRAQQAhASAAQaoBSQ0BIAAQIA8LIAAQHyEBCyABC0YBA38CQCAAQQJrIgRBmB8oAgAiBUkNACAELwEAIAFHDQAgAC8BACACRw0AIAQgBUYEQEEBDwsgAEEEay8BABAPIQMLIAMLYAEDfwJAIABBBmsiBkGYHygCACIHSQ0AIAYvAQAgAUcNACAAQQRrLwEAIAJHDQAgAEECay8BACADRw0AIAAvAQAgBEcNACAGIAdGBEBBAQ8LIABBCGsvAQAQDyEFCyAFC3oBAX8gABAhIgEQEyEAAn8gAUHcAEcEQEEAIABFDQEaC0G8oAEoAgBBAkEEIAFBgIAESRtqIQACQANAQbygASAANgIAIAAvAQAQISIBRQ0BIAEQEgRAIABBAkEEIAFBgIAESRtqIQAMAQsLQQAgAUHcAEYNARoLQQELC5MBAQF/AkAgAC8BACABRw0AIAAvAQIgAkcNACAALwEEIANHDQAgAC8BBiAERw0AIAAvAQggBUcNACAALwEKQdAARw0AIAAvAQxB8gBHDQAgAC8BDkHvAEcNACAALwEQQfAARw0AIAAvARJB5QBHDQAgAC8BFEHyAEcNACAALwEWQfQARw0AIAAvARhB+QBGIQYLIAYLmwEBAn9BvKABKAIAIQECQCAAQe0ARgR/IAFBAmpB7wBB5ABB9QBB7ABB5QAQB0UNAUG8oAEgAUEMajYCABARQS5HBEAMAgtBvKABQbygASgCAEECajYCABARBSAAC0HlAEcNAEG8oAEoAgAiAEEOaiABIABBAmpB+ABB8ABB7wBB8gBB9ABB8wAQECICGyEBC0G8oAEgATYCACACC2wBAX8CQCAALwEAQe4ARw0AIAAvAQJB9QBHDQAgAC8BBEHtAEcNACAALwEGQeUARw0AIAAvAQhB8gBHDQAgAC8BCkHhAEcNACAALwEMQeIARw0AIAAvAQ5B7ABHDQAgAC8BEEHlAEYhAQsgAQvzAwEEfwJAEBFBzwBHDQBBvKABKAIAIgJBAmpB4gBB6gBB5QBB4wBB9AAQB0UNAEG8oAEgAkEMajYCABARQS5HDQBBvKABQbygASgCAEECajYCABARIgJB8ABGBH8CQEG8oAEoAgAiBEECaiICLwEAQfIARw0AIAIvAQJB7wBHDQAgAi8BBEH0AEcNACACLwEGQe8ARw0AIAIvAQhB9ABHDQAgAi8BCkH5AEcNACACLwEMQfAARw0AIAIvAQ5B5QBGIQMLIANFDQFBvKABIARBEmo2AgAQEUEuRw0BQbygAUG8oAEoAgBBAmo2AgAQEQUgAgtB6ABHDQBBvKABKAIAIgJBAmpB4QBB8wBBzwBB9wBB7gAQF0UNAEG8oAEgAkEcajYCABARQS5HDQBBvKABQbygASgCAEECajYCABARQeMARw0AQbygASgCACICLwECQeEARw0AIAIvAQRB7ABHDQAgAi8BBkHsAEcNAEG8oAEgAkEIajYCABARQShHDQBBvKABQbygASgCAEECajYCABAREBZFDQAQEUEsRw0AQbygAUG8oAEoAgBBAmo2AgAQERpBvKABKAIAIgIgACABQQF0IgAQIw0AQbygASAAIAJqNgIAEBFBKUcNAEG8oAFBvKABKAIAQQJqNgIAQQEhBQsgBQtDAQN/AkAgAEEIayIHQZgfKAIAIghJDQAgByABIAIgAyAEIAUQB0UNACAHIAhGBEBBAQ8LIABBCmsvAQAQDyEGCyAGC1MBA38CQCAAQQRrIgVBmB8oAgAiBkkNACAFLwEAIAFHDQAgAEECay8BACACRw0AIAAvAQAgA0cNACAFIAZGBEBBAQ8LIABBBmsvAQAQDyEECyAEC0UBA38CQCAAQQprIghBmB8oAgAiCUkNACAIIAEgAiADIAQgBSAGEBBFDQAgCCAJRgRAQQEPCyAAQQxrLwEAEA8hBwsgBws3AQJ/AkBBmB8oAgAiAyAASw0AIAAvAQAgAUcNACAAIANGBEBBAQ8LIABBAmsvAQAQDyECCyACC2YBBH9BgIAEIQFBfiEEQZAIIQICQANAIARBAmoiBEHnA0sNASAAIAIoAgAgAWoiAUkEQEEAIQMMAgsgAkEEaiEDIAJBCGohAiADKAIAIAFqIgEgAEkNAAtBASEDCyAEQegDSSADcQv/GwEFfwJAIABBxgVrQQxJIABB+AFrQcoDSXIgAEGqAWsiAUEQTUEAQQEgAXRBgZAEcRtyIABBwAFrQRdJIABB2AFrQR9JcnINACAAQfAGayIBQRxNQQBBASABdEHf+YK6AXEbDQAgAEGKCWtBpgFJIABB9wdrQYsBSXIgAEHgBWsiAUEOTUEAQQEgAXRBn6ABcRtyIABBjgdrQRRJIABBowdrQdMASXIgAEHvC2tBBEkgAEHQC2tBG0lycnINACAAQdkKRiAAQeAKa0EpSXIgAEGxCmtBJkkgAEHxDGtB4wBJcnIgAEGgDGtBK0lyDQAgAEF+cSIEQe4MRg0AAkACQAJAIABB1Q1rIgFBPE8EQCAAQZIOa0EeSQ0EDAELQoGAjLCAnIGACCABrYinQQFxIABBkg5rQR5Jcg0BCyAAQbEPRiAAQcoPa0EhSXIgAEHNDmtB2QBJcg0CIABBgBBrQRZJIABB9A9rIgFBBk1BAEEBIAF0QcMAcRtyDQICQAJAIABBpBBrDgUCAQEBAgALIABBmhBGDQMLIABBhBJrQTZJIABBthFrQQhJciAAQaARa0EVSSAAQcAQa0EZSXJyIABBvRJGIABB4BBrQQtJciAAQdASRiAAQdgSa0EKSXJycg0CIABB8RJrQRBJDQICQCAAQYUTayIBQQxPBEAgAEGTE2tBFkkNBAwBC0H/GSABdkEBcSAAQZMTa0EWSXINAQsgAEGqE2tBB0kgAEH8E2siAUEUTUEAQQEgAXRBgfzhAHEbcg0CIABBshNrIgFBHE1BAEEBIAF0QfGRgIABcRsNAiAAQZMUa0EWSSAAQdwTayIBQRVNQQBBASABdEG7gMABcRtyDQIgAEGqFGsiAUE1SUL/toOAgIDgCyABrYhCAYNQRXEgAEGTFWtBFkkgAEGPFWtBA0lyciAAQfIUa0EDSSAAQYUVa0EJSXJyDQICQAJAIABBqhVrDicCAgICAgICAQICAQICAgICAQEBAgEBAQEBAQEBAQEBAQEBAQEBAQIACyAAQeAVa0ECSSAAQfkVayIBQRdNQQBBASABdEGB4L8GcRtyDQMLIABBkxZrQRZJDQICQAJAIABB8RZrDjQCAQEBAQEBAQEBAQEBAQEBAQECAQICAgICAgEBAQICAgECAgICAQEBAgIBAgECAgEBAQICAAsgAEGqFmsiAUETTUEAQQEgAXRB//YjcRsNAyAAQdwWayIBQQVLDQAgAUECRw0DCyAAQagXa0EDSSAAQZIYa0EXSXIgAEGOGGtBA0kgAEGFGGtBCElyciAAQdAXRiAAQa4Xa0EMSXIgAEG9GEYgAEGqGGtBEElycnINAiAAQdgYayIBQSlJQoeGgICAICABrYhCAYNQRXEgAEGqGWtBCkkgAEGSGWtBF0lyciAAQYUZa0EISSAAQY4Za0EDSXJyDQIgAEGFGmsiAUELTSABQQhHcQ0CIABBtRlrIgFBCE1BAEEBIAF0QZ8CcRsNAiAAQb0aRiAAQZIaa0EpSXIgAEHeGWsiAUEUTUEAQQEgAXRBjYDgAHEbciAAQc4aRiAAQbMba0EJSXIgAEGaG2tBGEkgAEGFG2tBEklycnINAiAAQfoaa0EGSSAAQdQaa0EDSXIgAEHfGmtBA0lyDQIgAEG9G2siAUEKSUH5ByABdkEBcXENACAEQbIcRiAAQYEca0EwSXIgAEHAHGtBB0lyDQIgAEGBHWsiAUEMTUEAQQEgAXRByyVxGw0CIABBfHEiAUGUHUYgAEGZHWtBB0lyDQIgAEGhHWsiAkEmSULX7JuA+QUgAq2IQgGDUEVxIABBgCBrQStJIABBiB9rQQVJcnIgAEHJHmtBJElyDQIgAEF4cSIDQcAeRiAAQYAeRnIgAUHcHUZyDQICQCAAQb8gayICQShPBEAgAEHuIGtBA0kNBAwBC0KBgPjDxxggAq2Ip0EBcSAAQe4ga0EDSXINAQsgAEGOIUYgAEGgIWtBJklyIABBxyFGIABB9SBrQQ1JcnIgAEHNIUYgAEHKJGtBBElyIABB0CFrQStJIABB/CFrQc0CSXJycg0CIABB0CRrIgJBCUlB/wIgAnZBAXFxDQAgAEGyJWtBBEkgAEGQJWtBIUlyIABBiiVrQQRJIABB2iRrQQRJcnIgAEHgJGtBKUlyDQIgAEG4JWsiAkEJSUH/AiACdkEBcXENACAAQYAva0E0SSAAQe4ua0EDSXIgAEHgLmtBDUkgAEHALmtBEklyciAAQaAua0ESSSAAQY4ua0EESXIgAEGALmtBDUkgAEHuLWtBC0lycnINAiAAQaAta0HLAEkgAEGBLWtBGklyIABB7yxrQRFJIABBgShrQewESXJyIABB+CdrQQZJIABBoCdrQdYASXJyDQIgAEFwcSICQYAnRiAAQZgma0HDAElyIABBkiZrQQRJIABB2CVrQTlJcnIgAEHCJWtBBEkgAEHIJWtBD0lyIABB1y9GIABB3C9GcnJyDQIgAEGgMGtB2QBJIABBgDRrQRdJciAAQbAza0EaSSAAQYAza0EsSXJyIABB8DJrQQVJcg0CIABB0DJrQR5JIABBgDJrQR9JciAAQaoxRiAAQbAxa0HGAElyciAAQYAxa0EpSSAAQcU2a0EHSXIgAEGnNUYgAEGFNmtBL0lycnINASAAQaA0a0E1SSAAQek5a0EESXIgAEG9OWtBA0kgAEGQOWtBK0lyciAAQYA5a0EJSSAAQdo4a0EkSXIgAEHNOGtBA0kgAEGAOGtBJElycnINASAAQbo3a0EsSSAAQYM3a0EeSXIgBEGuN0ZyDQEgAEHuOWsiBUEJSUGPAyAFdkEBcXENACAAQcg+a0EGSSAAQaA+a0EmSXIgAEGYPmtBBkkgAEGAOmtBwAFJcnIgAEGAPGtBlgJJIABBgD9rQTVJciAAQd0+RiAAQd8+a0EfSXJycg0BIANB0D5GIABBfXFB2T5Gcg0BIABBtj9rIgNBCUlB/wIgA3ZBAXFxDQAgAEHyP2tBA0kgAEHgP2tBDUlyIAFB0D9GIABB1j9rQQZJcnIgAEHCP2tBA0kgAEHGP2tBB0lyIABB8cAARiAAQfY/a0EHSXJycg0BIABB/8AARiAAQZDBAGtBDUlyIABBgsIARiAAQYfCAEZyciAAQZXCAEYgAEGKwgBrQQpJcnINASAAQZjCAGsiA0ERSUG/oAUgA3ZBAXFxDQAgAUG8wgBGIABBqsIAa0EQSXINASAAQcXCAGsiA0EKSUGfBCADdkEBcXENACAAQeDYAGtBhQFJIABBsNgAa0EvSXIgAEHgwgBrQSlJIABBgNgAa0EvSXJyDQECQCAAQevZAGsiA0EJTwRAIABBgNoAa0EmSQ0DDAELQY8DIAN2QQFxIABBgNoAa0EmSXINAQsgAEGn2gBGIABBrdoARnIgAEGAygJrQY0CSSAAQdDJAmtBLklyciAAQYDAAmtBjQlJIABBgJwBa0HwowFJciACQfDjAEYgAEGA6ABrQbYzSXJycg0BIABBoOMAa0EbSSAAQbHiAGtB3gBJciABQfzhAEYgAEGF4gBrQStJcnIgAEGh4QBrQdoASSAAQZvhAGtBBUlyIABBweAAa0HWAEkgAEG44ABrQQVJcnJyDQEgAEGx4ABrQQVJIABBoeAAa0EJSXIgAEGF4ABrQQNJcg0BIABBZ3EiAUHA2wBrQQdJIAFBoNsAa0EHSXIgAEHv2gBGIABBgNsAa0EXSXJyIABBsNoAa0E4SSAAQYLRAmtBMklyIABBwNACa0E0SSAAQYzQAmtBF0lycnINASAAQYfQAmtBBEkgAEGD0AJrQQNJciAAQffPAmtBC0kgAEGLzwJrQS9JcnIgAEGizgJrQecASSAAQZfOAmtBCUlyIABBoM0Ca0HQAEkgAEH/zAJrQR9JcnJyDQEgAkGQzAJGIABBwMwCa0EvSXIgBEGqzAJGcg0BIABB8tECayIBQQ1JQb80IAF2QQFxcQ0AIABB4NICa0EdSSAAQYrSAmtBHElyIABBsNICa0EXSSAAQcTUAmtBCElyciAAQcDUAmtBA0kgAEGA1AJrQSlJciAAQfrTAmtBBUkgAEHm0wJrQQpJcnJyDQEgAEHP0wJGIABB4NMCa0EFSXIgAEGE0wJrQS9JIABB/tQCa0EySXJyIABB+tQCRiAAQeDUAmtBF0lycg0BIABBsdUCayIBQRJJQbG+CiABdkEBcXENACAAQYD2A2tBB0kgAEHw9ANrQeoASXIgAEGA8gNrQe4CSSAAQcuvA2tBMUlyciAAQbCvA2tBF0kgAEGA2AJrQaTXAElyIABB8NYCa0HzAEkgAEHc1gJrQQpJcnJyDQEgAEGw1gJrQStJDQEgAEF3cSIBQaDWAmtBB0kgAEGR1gJrQQZJciABQYHWAmtBBkkgAEHy1QJrQQNJcnIgAEHb1QJrQQNJIABB4NUCa0ELSXJyDQEgAEGT9gNrIgFBC0lBnwggAXZBAXFxDQAgAEGf9gNrQQpJIABBqvYDa0ENSXINASAAQbj2A2siAUENSUHfNiABdkEBcXENACAAQdL/A2tBBkkgAEF2cUHC/wNrQQZJciAAQeb+A2tB2QBJIABBwf4Da0EaSXJyIABBof4Da0EaSSAAQfb8A2tBhwFJciAAQfD8A2tBBUkgAEHw+wNrQQxJcnJyDQEgAEGS+wNrQTZJIABB0PoDa0HAAElyIABBxvYDa0HsAElyDQEgAEHT9wNrQesCSQ0AIABB2v8Da0EDSQ8LQQEPC0EBDwtBAQsyACAAQYD4A3FBgLADRgR/IABBCnRBgPg/cUG8oAEoAgAvAQJB/wdxckGAgARqBSAACwtdAQF/AkAgAEH4/wNxQShGIABBIWsiAUEFTUEAQQEgAXRBMXEbckUEQCAAQTprIgFB//8DcUElT0K/gICAoAMgAa2IQgGDUHINAQtBAQ8LIABB+wBrQf//A3FBBEkLQwEDfwJAIAJFDQADQCAALQAAIgQgAS0AACIFRgRAIAFBAWohASAAQQFqIQAgAkEBayICDQEMAgsLIAQgBWshAwsgAwt4AQF/QZgfKAIAIgEgAEEBdGoiAEEAOwEAQeQfIABBAmoiADYCAEHoHyAANgIAQcAfQQA2AgBByB9BADYCAEHEH0EANgIAQcwfQQA2AgBB1B9BADYCAEHQH0EANgIAQdgfQQA2AgBB4B9BADYCAEHcH0EANgIAIAELCABB7B8oAgALFQBBxB8oAgAoAgBBmB8oAgBrQQF1CxUAQcQfKAIAKAIEQZgfKAIAa0EBdQsVAEHQHygCACgCAEGYHygCAGtBAXULFQBB0B8oAgAoAgRBmB8oAgBrQQF1CxUAQdwfKAIAKAIAQZgfKAIAa0EBdQsVAEHcHygCACgCBEGYHygCAGtBAXULCgBBwB9BxB8QMQsKAEHMH0HQHxAxCwoAQdgfQdwfEDEL0UEBBX8Cf0GAwAAgATYCAEGYHyAANgIAIAIEQEGcHyACNgIACyADBEBBoB8gAzYCAAsgBARAQaQfIAQ2AgALQYjAAEH//wM7AQBBoOAAQaDAADYCAEGwoAFBsOAANgIAQbSgAUGAIDYCAEGMwABBrB8oAgA2AgBBvKABIABBAmsiAjYCAEHAoAEgAiABQQF0aiIDNgIAQYbAAEEAOwEAQYTAAEEAOwEAQZDAAEEAOgAAQewfQQA2AgBB8B9BADYCAEG4oAFBADoAAAJAAkAgAC8BAEEjRw0AIAAvAQJBIUcNAEEAIQIgAUECRg0BIABBBGohAANAIAAiAkECayADTw0BIABBAmohACACLwEAQQprDgQBAAABAAsACwNAQbygASACQQJqIgA2AgACQAJAAkAgAiADSQRAIAAvAQAiA0EJayIBQRdNQQBBASABdEGfgIAEcRsNAwJAAkACQAJAAkACQAJAAkACQAJAAkACQAJAQYbAAC8BACIFRQRAAkACQAJAIANB3wBrDg8CEBMTBhMFExMTARMTEwQACwJAIANBJ2sOCQ4ICRMTExMTDwALAkAgA0H7AGsOAwsTDAALIANBIkYNDSADQc8ARg0GIANB8gBHDRICQEEAEARFDQAgABAFRQ0AIAIQBgtBjMAAQbygASgCADYCAAwTCwJAIAJBBGpB7QBB8ABB7wBB8gBB9AAQB0UNACAAEAVFDQBBvKABQbygASgCACIBQQxqIgA2AgACQAJAAkACQAJAAkACQBARIgJBJ2sOCAIDAQIBAQEEAAsgAkEiRiACQfsARnINAQtBvKABKAIAIABGDQQLQYbAAC8BAEUNAkG8oAFBvKABKAIAQQJrNgIADAMLQYbAAEGGwAAvAQAiAEEBajsBAEGwoAEoAgAgAEECdGogATYCAAwCC0EFEAsMAQtBBhALC0G8oAEoAgAhAAtBjMAAIAA2AgAMEgtBACEDAkAgAkEEaiIBLwEAQekARw0AIAEvAQJB7gBHDQAgAS8BBEH0AEcNACABLwEGQeUARw0AIAEvAQhB8gBHDQAgAS8BCkHvAEcNACABLwEMQfAARw0AIAEvAQ5B0gBHDQAgAS8BEEHlAEcNACABLwESQfEARw0AIAEvARRB9QBHDQAgAS8BFkHpAEcNACABLwEYQfIARw0AIAEvARpB5QBHDQAgAS8BHEHXAEcNACABLwEeQekARw0AIAEvASBB7ABHDQAgAS8BIkHkAEcNACABLwEkQeMARw0AIAEvASZB4QBHDQAgAS8BKEHyAEcNACABLwEqQeQARiEDCwJAAkAgA0UNACAAEAVFBEAgAi8BAEEuRw0BC0G8oAEgAkEwajYCACACLwEwQShHDQFBvKABIAJBMmo2AgBBhsAAQQE7AQBBsKABKAIAQYzAACgCADYCAEEAEARFDQEgABAFRQ0BIAIQBgwBCyABQd8AQeUAQfgAQfAAQe8AQfIAQfQAEAhFDQAgABAFRQRAIAIvAQBBLkcNAQtBvKABIAJBEmo2AgAgAi8BEiIAQdMARgR/IAIvARRB9ABHDQEgAi8BFkHhAEcNASACLwEYQfIARw0BQbygASACQRpqNgIAIAIvARoFIAALQf//A3FBKEcNAEGwoAEoAgBBjMAAKAIANgIAQYbAAEEBOwEAQbygAUG8oAEoAgAiAEECajYCACAALwECQfIARw0AQQIQBBoLQYzAAEG8oAEoAgA2AgAMEQsCQCADQSdrDgkLBQcQEBAQEAwACwJAIANB4ABrDgYNEBADEAIACwJAIANB+wBrDgMIEAoACyADQSJGDQogA0HPAEYNAyADQe0ARw0PCyACQQRqQe8AQeQAQfUAQewAQeUAEAdFDQ4gABAFRQ0OQbygAUG8oAEoAgAiAEEMajYCAAJAAkAQEUEuRw0AQbygAUG8oAEoAgBBAmo2AgAQEUHlAEcNAEG8oAEoAgBBAmpB+ABB8ABB7wBB8gBB9ABB8wAQEEUNAEEBEAkMAQtBvKABIABBCmo2AgALDA4LIAJBBGpB+ABB8ABB7wBB8gBB9AAQB0UNDSAAEAVFDQ0gAi8BDkHzAEYEQEEAEAkMDgsgBQ0NQbygAUG8oAEoAgBBDGoiATYCABARIQACQCABQbygASgCAEYEQCAAECJFDQELQQcQCwsMDQsgABAFRQ0MIAIvAQRB7ABHDQwgAi8BBkHhAEcNDCACLwEIQfMARw0MIAIvAQpB8wBHDQwgAi8BDBAKRQ0MQbigAUEBOgAADAwLIAJBBGpB4gBB6gBB5QBB4wBB9AAQB0UNCyAAEAVFDQsgBUUhAUG8oAFBvKABKAIAIgBBDGo2AgAgAEEKaiECAkACQBARQS5HDQBBvKABQbygASgCAEECajYCAAJAEBEiAEHkAEYEQEG8oAEoAgAiAEECakHlAEHmAEHpAEHuAEHlABAXRQ0CQbygASAAQRxqNgIAIABBGmohAhARQShHDQJBvKABQbygASgCAEECajYCABAREBhFDQIQEUEsRw0CQbygAUG8oAEoAgBBAmo2AgAQESIAQSdHIABBIkdxDQJBvKABKAIAIQQgABAMQbygAUG8oAEoAgBBAmoiAzYCABARQSxHDQFBvKABQbygASgCAEECajYCABARQfsARw0BQbygAUG8oAEoAgBBAmo2AgAQESIAQeUARgRAQbygASgCACIAQQJqEBlFDQJBvKABIABBFGo2AgAQEUE6Rw0CQbygAUG8oAEoAgBBAmo2AgAQEUH0AEcNAkG8oAEoAgAiAC8BAkHyAEcNAiAALwEEQfUARw0CIAAvAQZB5QBHDQJBvKABIABBCGo2AgAQEUEsRw0CQbygAUG8oAEoAgBBAmo2AgAQESEACyAAQecARwRAIABB9gBHDQJBvKABKAIAIgAvAQJB4QBHDQIgAC8BBEHsAEcNAiAALwEGQfUARw0CIAAvAQhB5QBHDQJBvKABIABBCmo2AgAQEUE6Rw0CIAQgA0GcHygCABEBAEG8oAEgAjYCAAwEC0G8oAEoAgAiAC8BAkHlAEcNASAALwEEQfQARw0BQbygASAAQQZqNgIAEBEiAEE6RgR/QbygAUG8oAEoAgBBAmo2AgAQEUHmAEcNAkG8oAEoAgAiAEECakH1AEHuAEHjAEH0AEHpAEHvAEHuABAIRQ0CQbygASAAQRBqIgE2AgAQESIAQShHBEAgAUG8oAEoAgBGDQMgABAWRQ0DCxARBSAAC0EoRw0BQbygAUG8oAEoAgBBAmo2AgAQEUEpRw0BQbygAUG8oAEoAgBBAmo2AgAQEUH7AEcNAUG8oAFBvKABKAIAQQJqNgIAEBFB8gBHDQFBvKABKAIAIgBBAmpB5QBB9ABB9QBB8gBB7gAQB0UNAUG8oAEgAEEMajYCABAREBZFDQECQAJAEBEiAEHbAEcEQCAAQS5HDQJBvKABQbygASgCAEECajYCABAREBYNAQwEC0G8oAFBvKABKAIAQQJqNgIAEBEiAEEnRyAAQSJHcQ0DIAAQDEG8oAFBvKABKAIAQQJqNgIAEBFB3QBHDQNBvKABQbygASgCAEECajYCAAsQESEACyAAQTtGBH9BvKABQbygASgCAEECajYCABARBSAAC0H9AEcNAUG8oAFBvKABKAIAQQJqNgIAEBEiAEEsRgR/QbygAUG8oAEoAgBBAmo2AgAQEQUgAAtB/QBHDQFBvKABQbygASgCAEECajYCABARQSlHDQEgBCADQZwfKAIAEQEADAMLIAFFIABB6wBHcg0BQbygASgCACIALwECQeUARw0BIAAvAQRB+QBHDQEgAC8BBkHzAEcNASAAQQZqIQJBvKABIABBCGo2AgAQEUEoRw0BQbygAUG8oAEoAgBBAmo2AgAQEUG8oAEoAgAhBhAWRQ0BQbygASgCABARQSlHDQFBvKABQbygASgCACICQQJqNgIAEBFBLkcNAUG8oAFBvKABKAIAQQJqNgIAEBFB5gBHDQFBvKABKAIAIgBBAmpB7wBB8gBBxQBB4QBB4wBB6AAQEEUNAUG8oAEgAEEOajYCABARQbygASgCACIAQQJrIQJBKEcNAUG8oAEgAEECajYCABARQeYARw0BQbygASgCACIAQQJqQfUAQe4AQeMAQfQAQekAQe8AQe4AEAhFDQFBvKABIABBEGo2AgAQEUEoRw0BQbygAUG8oAEoAgBBAmo2AgAQEUG8oAEoAgAhBxAWRQ0BQbygASgCACEBEBFBKUcNAUG8oAFBvKABKAIAQQJqNgIAEBFB+wBHDQFBvKABQbygASgCAEECajYCABARQekARw0BQbygASgCACIALwECQeYARw0BQbygASAAQQRqNgIAEBFBKEcNAUG8oAFBvKABKAIAQQJqNgIAEBEaQbygASgCACIAIAcgASAHayIJECMNASAGayIFQQF1IQRBvKABIAAgCUEBdSIIQQF0ajYCAAJAAkACQBARIgBBIUcEQCAAQT1HDQVBvKABKAIAIgAvAQJBPUcNBSAALwEEQT1HDQVBvKABIABBBmo2AgAQESIBQSdHIAFBIkdxDQVBvKABKAIAIgBBAmpB5ABB5QBB5gBB4QBB9QBB7ABB9AAQCEUNBUG8oAEgAEEQajYCABARIAFHDQVBvKABQbygASgCAEECajYCABARQfwARw0FQbygASgCACIALwECQfwARw0FQbygASAAQQRqNgIAEBEaQbygASgCACIAIAcgCRAjDQVBvKABIAAgCEEBdGo2AgAQEUE9Rw0FQbygASgCACIALwECQT1HDQUgAC8BBEE9Rw0FQbygASAAQQZqNgIAEBEiA0EnRyADQSJHcQ0FQQAhAQJAQbygASgCACIAQQJqIgovAQBB3wBHDQAgCi8BAkHfAEcNACAKLwEEQeUARw0AIAovAQZB8wBHDQAgCi8BCEHNAEcNACAKLwEKQe8ARw0AIAovAQxB5ABHDQAgCi8BDkH1AEcNACAKLwEQQewARw0AIAovARJB5QBGIQELIAFFDQVBvKABIABBFmo2AgAQESADRw0FQbygAUG8oAEoAgBBAmo2AgAQEUEpRw0FQbygAUG8oAEoAgBBAmo2AgAQEUHyAEcNBUG8oAEoAgAiAEECakHlAEH0AEH1AEHyAEHuABAHRQ0FQbygASAAQQxqNgIAEBFBO0YEQEG8oAFBvKABKAIAQQJqNgIACxARIgBB6QBHDQNB6QAhAEG8oAEoAgAiAS8BAkHmAEcNA0G8oAEgAUEEajYCABARQShHDQVBvKABQbygASgCAEECaiIANgIAIAcgCBAaBEAQEUEpRw0GQbygAUG8oAEoAgBBAmo2AgAQEUHyAEcNBkG8oAEoAgAiAEECakHlAEH0AEH1AEHyAEHuABAHRQ0GQbygASAAQQxqNgIAEBFBO0YEQEG8oAFBvKABKAIAQQJqNgIACxARIgBB6QBHDQRB6QAhAEG8oAEoAgAiAS8BAkHmAEcNBEG8oAEgAUEEajYCABARQShHDQZBvKABKAIAQQJqIQALQbygASAANgIAIAAgByAJECMNBUG8oAEgACAIQQF0ajYCABARQekARw0FQbygASgCACIALwECQe4ARw0FIAAvAQRBIEcNBUG8oAEgAEEGajYCABAREBhFDQUQEUEmRw0FQbygASgCACIALwECQSZHDQVBvKABIABBBGo2AgAQERAYRQ0FEBFB2wBHDQVBvKABQbygASgCAEECajYCABARGkG8oAEoAgAiACAHIAkQIw0FQbygASAAIAhBAXRqNgIAEBFB3QBHDQVBvKABQbygASgCAEECajYCABARQT1HDQVBvKABKAIAIgAvAQJBPUcNBSAALwEEQT1HDQVBvKABIABBBmo2AgAQERpBvKABKAIAIgAgBiAFECMNBUG8oAEgACAEQQF0ajYCABARQdsARw0FQbygAUG8oAEoAgBBAmo2AgAQERpBvKABKAIAIgAgByAJECMNBUG8oAEgACAIQQF0ajYCABARQd0ARw0FQbygAUG8oAEoAgBBAmo2AgAQEUEpRw0FQbygAUG8oAEoAgBBAmo2AgAQEUHyAEcNBUG8oAEoAgAiAEECakHlAEH0AEH1AEHyAEHuABAHRQ0FQbygASAAQQxqNgIAEBFBO0YNAQwCC0G8oAEoAgAiAC8BAkE9Rw0EIAAvAQRBPUcNBEG8oAEgAEEGajYCABARIgFBJ0cgAUEiR3ENBEG8oAEoAgAiAEECakHkAEHlAEHmAEHhAEH1AEHsAEH0ABAIRQ0EQbygASAAQRBqNgIAEBEgAUcNBEG8oAFBvKABKAIAQQJqNgIAEBEiAEEmRgR/QbygASgCACIALwECQSZHDQVBvKABIABBBGo2AgAQEUEhRw0FQbygAUG8oAEoAgBBAmo2AgACQAJAEBEiAEHPAEcNAEG8oAEoAgBBAmpB4gBB6gBB5QBB4wBB9ABBLhAQRQ0AIAcgCBAaRQ0HDAELIAAQFkUNABARQS5HDQZBvKABQbygASgCAEECajYCABARQegARw0GQbygASgCACIAQQJqQeEAQfMAQc8AQfcAQe4AEBdFDQZBvKABIABBHGo2AgAQEUEoRw0GQbygAUG8oAEoAgBBAmo2AgAQERpBvKABKAIAIgAgByAJECMNBkG8oAEgACAIQQF0ajYCABARQSlHDQZBvKABQbygASgCAEECajYCAAsQEQUgAAtBKUcNBAtBvKABQbygASgCAEECajYCAAsQESEACwJAAkAgABAYBEAQEUHbAEcNBEG8oAFBvKABKAIAQQJqNgIAEBEaQbygASgCACIAIAcgCRAjDQRBvKABIAAgCEEBdGo2AgAQEUHdAEcNBEG8oAFBvKABKAIAQQJqNgIAEBFBPUcNBEG8oAFBvKABKAIAQQJqNgIAEBEaQbygASgCACIAIAYgBRAjDQRBvKABIAAgBEEBdGo2AgAQEUHbAEcNBEG8oAFBvKABKAIAQQJqNgIAEBEaQbygASgCACIAIAcgCRAjDQRBvKABIAAgCEEBdGo2AgAQEUHdAEcNBEG8oAFBvKABKAIAQQJqNgIAEBEiAEE7Rg0BDAILIABBzwBHDQNBvKABKAIAIgBBAmpB4gBB6gBB5QBB4wBB9AAQB0UNA0G8oAEgAEEMajYCABARQS5HDQNBvKABQbygASgCAEECajYCABARQeQARw0DQbygASgCACIAQQJqQeUAQeYAQekAQe4AQeUAEBdFDQNBvKABIABBHGo2AgAQEUEoRw0DQbygAUG8oAEoAgBBAmo2AgAQERAYRQ0DEBFBLEcNA0G8oAFBvKABKAIAQQJqNgIAEBEaQbygASgCACIAIAcgCRAjDQNBvKABIAAgCEEBdGo2AgAQEUEsRw0DQbygAUG8oAEoAgBBAmo2AgAQEUH7AEcNA0G8oAFBvKABKAIAQQJqNgIAEBFB5QBHDQNBvKABKAIAIgBBAmoQGUUNA0G8oAEgAEEUajYCABARQTpHDQNBvKABQbygASgCAEECajYCABARQbygASgCACEBQfQARwRAIAEvAQJB8gBHDQQgAS8BBEH1AEcNBCABLwEGQeUARw0EC0G8oAEgAUEIajYCABARQSxHDQNBvKABQbygASgCAEECajYCABARQecARw0DQbygASgCACIALwECQeUARw0DIAAvAQRB9ABHDQNBvKABIABBBmo2AgAQESIAQTpGBH9BvKABQbygASgCAEECajYCABARQeYARw0EQbygASgCACIAQQJqQfUAQe4AQeMAQfQAQekAQe8AQe4AEAhFDQRBvKABIABBEGoiATYCABARIgBBKEcEQCABQbygASgCAEYNBSAAEBZFDQULEBEFIAALQShHDQNBvKABQbygASgCAEECajYCABARQSlHDQNBvKABQbygASgCAEECajYCABARQfsARw0DQbygAUG8oAEoAgBBAmo2AgAQEUHyAEcNA0G8oAEoAgAiAEECakHlAEH0AEH1AEHyAEHuABAHRQ0DQbygASAAQQxqNgIAEBEaQbygASgCACIAIAYgBRAjDQNBvKABIAAgBEEBdGo2AgAQEUHbAEcNA0G8oAFBvKABKAIAQQJqNgIAEBEaQbygASgCACIAIAcgCRAjDQNBvKABIAAgCEEBdGo2AgAQEUHdAEcNA0G8oAFBvKABKAIAQQJqNgIAEBEiAEE7RgR/QbygAUG8oAEoAgBBAmo2AgAQEQUgAAtB/QBHDQNBvKABQbygASgCAEECajYCABARIgBBLEYEf0G8oAFBvKABKAIAQQJqNgIAEBEFIAALQf0ARw0DQbygAUG8oAEoAgBBAmo2AgAQEUEpRw0DQbygAUG8oAEoAgBBAmo2AgAQESIAQTtHDQELQbygAUG8oAEoAgBBAmo2AgAQESEACyAAQf0ARw0BQbygAUG8oAEoAgBBAmo2AgAQEUEpRw0BQbSgASgCACEDQYAgIQADQAJAIAAgA0cEQCAEIABBDGooAgAgAEEIaigCACIBa0EBdUcNASAGIAEgBRAjDQEgACgCACAAQQRqKAIAQaAfKAIAEQEAQbygASACNgIACwwECyAAQRBqIQAMAAsACyAEIANBpB8oAgARAQALQbygASACNgIACwwLC0GGwAAgBUEBajsBAEGwoAEoAgAgBUECdGpBjMAAKAIANgIADAoLQQgQC0HwHygCAAwNC0GGwAAgBUEBazsBAAwICyAFQdCgAWpBuKABLQAAOgAAQYbAACAFQQFqOwEAQbCgASgCACAFQQJ0akGMwAAoAgA2AgBBuKABQQA6AAAMBwtBAhALQQAMCgtBhsAAIAVBAWsiADsBAEGIwAAvAQAiASAFRgRAQYTAAEGEwAAvAQBBAWsiADsBAEGIwABBoOAAKAIAIABB//8DcUEBdGovAQA7AQAMBQsgAUH//wNGIABB//8DcSABT3INBUEDEAtB8B8oAgAMCQsgAxAMDAQLAkAgAi8BBCIAQSpHBEAgAEEvRw0BEA0MBgsQDgwFC0GQwAACfwJAAkACfwJAQYzAACgCACIGLwEAIgRBKUcgBEEoa0H//wNxQQdJcSAEQSFrIgBBBU1BAEEBIAB0QTFxG3JFBEAgBEE6ayIAQf//A3FBJU9Cv4CAgKACIACtiEIBg1ByDQELQQEMAQsgBEH9AEcgBEH7AGtB//8DcUEESXELBEACQAJAAkAgBEEraw4EAQUCAAULIAZBAmsvAQBBMGtB//8DcUEKSQ0DDAQLIAZBAmsvAQBBK0YNAgwDCyAGQQJrLwEAQS1GDQEMAgsCQCAEQf0ARwRAIARBL0YNASAEQSlHDQJBASEDAkBBsKABKAIAIAVBAnRqKAIAIgBB9wBB6ABB6QBB7ABB5QAQGw0AIABB5gBB7wBB8gAQHA0AIABB6QBB5gAQFCEDCyADRQ0CDAMLAn9BASEAAkACQAJAAkACQAJAQbCgASgCACAFQQJ0aigCACICLwEAIgFBO2sOBAUEBAEACwJAIAFB5QBrDgQDBAQCAAsgAUEpRg0EIAFB+QBHDQMgAkECa0HmAEHpAEHuAEHhAEHsAEHsABAdDAULIAJBAmsvAQBBPUYMBAsgAkECa0HjAEHhAEH0AEHjABAVDAMLIAJBAmtB5QBB7ABB8wAQHAwCC0EAIQALIAALDQIgBUHQoAFqLQAARQ0BDAILQZDAAC0AAA0BCwJ/QQAhAwJAAkACQAJAAkACQAJAAkACQCAGLwEAQeQAaw4UAAECCAgICAgICAMECAgFCAYICAcICwJAAkAgBkECay8BAEHpAGsOBAAJCQEJCyAGQQRrQfYAQe8AEBQMCQsgBkEEa0H5AEHpAEHlABAcDAgLAkACQCAGQQJrLwEAQfMAaw4CAAEICyAGQQRrLwEAIgBB4QBHBEAgAEHsAEcNCCAGQQZrQeUAEB4MCQsgBkEGa0HjABAeDAgLIAZBBGtB5ABB5QBB7ABB5QAQFQwHCyAGQQJrLwEAQe8ARw0FIAZBBGsvAQBB5QBHDQUgBkEGay8BACIAQfAARwRAIABB4wBHDQYgBkEIa0HpAEHuAEHzAEH0AEHhAEHuABAdDAcLIAZBCGtB9ABB+QAQFAwGC0EBIQMgBkECayIAQekAEB4NBCAAQfIAQeUAQfQAQfUAQfIAEBsMBQsgBkECa0HkABAeDAQLAn8CQCAGQQJrIgFBDGsiAkGYHygCACIASQ0AIAJB5ABB5QBB4gBB9QBB5wBB5wBB5QAQCEUNAEEBIAAgAkYNARogAUEOay8BABAPIQMLIAMLDAMLIAZBAmtB4QBB9wBB4QBB6QAQFQwCCyAGQQJrLwEAIgBB7wBHBEAgAEHlAEcNASAGQQRrQe4AEB4MAgsgBkEEa0H0AEHoAEHyABAcIQMLIAMLIQAgBEUNAEEBIABFDQEaCwJAA0BBwKABKAIAIQJBvKABKAIAIQADQCAAQQJqIQECQAJAIAAgAk8NAAJAAkACQCABLwEAIgNB2wBrDgIBAgALIAEhACADQQprDgQCBAQCAwtBvKABIAE2AgBBvKABKAIAIQBBwKABKAIAIQMCQAJAA0ACQCAAQQJqIQEgACADTw0AAkACQCABLwEAIgJB3ABrDgIBBAALIAEhACACQQprDgQBAgIBAgsgAEEEaiEADAELC0G8oAEgATYCAEEKEAsMAQtBvKABIAE2AgALDAQLIABBBGohAAwCC0G8oAEgATYCAEELEAsMAwsgA0EvRw0ACwtBvKABIAE2AgALQQALOgAADAMLQYjAAC8BAEH+/wNHDQFBBBALQfAfKAIADAYLQYbAAC8BABpB8B8oAgAiACAAQYjAAC8BAEH//wNHGyECDAQLQbygASgCACEAQcCgASgCACEDAkACQANAAkAgACIBQQJqIQAgASADTw0AAkACQCAALwEAIgJB3ABrDgUBAwMDBAALIAJBJEcNAiABLwEEQfsARw0CQYTAAEGEwAAvAQAiAEEBajsBAEGg4AAoAgAgAEEBdGpBiMAALwEAOwEAQbygASABQQRqNgIAQYjAAEGGwAAvAQBBAWoiADsBAEGGwAAgADsBAAwECyABQQRqIQAMAQsLQbygASAANgIAQQgQCwwBC0G8oAEgADYCAAsLQYzAAEG8oAEoAgA2AgALQcCgASgCACEDQbygASgCACECDAALAAsgAgsLRQEBfyACKAIAIgRBCGogAyAEG0HoHygCACIENgIAIAIgBDYCAEHoHyAEQQxqNgIAIARBADYCCCAEIAE2AgQgBCAANgIACyIBAX8gASABKAIAIgJBCGogACACGygCACICNgIAIAJBAEcLC6kXAgBBlAgLgRcLAAAAAgAAABkAAAACAAAAEgAAAAIAAAABAAAAAgAAAA4AAAADAAAADQAAACMAAAB6AAAARgAAADQAAAAMAQAAHAAAAAQAAAAwAAAAMAAAAB8AAAAOAAAAHQAAAAYAAAAlAAAACwAAAB0AAAADAAAAIwAAAAUAAAAHAAAAAgAAAAQAAAArAAAAnQAAABMAAAAjAAAABQAAACMAAAAFAAAAJwAAAAkAAAAzAAAAnQAAADYBAAAKAAAAFQAAAAsAAAAHAAAAmQAAAAUAAAADAAAAAAAAAAIAAAArAAAAAgAAAAEAAAAEAAAAAAAAAAMAAAAWAAAACwAAABYAAAAKAAAAHgAAAEIAAAASAAAAAgAAAAEAAAALAAAAFQAAAAsAAAAZAAAARwAAADcAAAAHAAAAAQAAAEEAAAAAAAAAEAAAAAMAAAACAAAAAgAAAAIAAAAcAAAAKwAAABwAAAAEAAAAHAAAACQAAAAHAAAAAgAAABsAAAAcAAAANQAAAAsAAAAVAAAACwAAABIAAAAOAAAAEQAAAG8AAABIAAAAOAAAADIAAAAOAAAAMgAAAA4AAAAjAAAAXQEAACkAAAAHAAAAAQAAAE8AAAAcAAAACwAAAAAAAAAJAAAAFQAAAGsAAAAUAAAAHAAAABYAAAANAAAANAAAAEwAAAAsAAAAIQAAABgAAAAbAAAAIwAAAB4AAAAAAAAAAwAAAAAAAAAJAAAAIgAAAAQAAAAAAAAADQAAAC8AAAAPAAAAAwAAABYAAAAAAAAAAgAAAAAAAAAkAAAAEQAAAAIAAAAYAAAAVQAAAAYAAAACAAAAAAAAAAIAAAADAAAAAgAAAA4AAAACAAAACQAAAAgAAAAuAAAAJwAAAAcAAAADAAAAAQAAAAMAAAAVAAAAAgAAAAYAAAACAAAAAQAAAAIAAAAEAAAABAAAAAAAAAATAAAAAAAAAA0AAAAEAAAAnwAAADQAAAATAAAAAwAAABUAAAACAAAAHwAAAC8AAAAVAAAAAQAAAAIAAAAAAAAAuQAAAC4AAAAqAAAAAwAAACUAAAAvAAAAFQAAAAAAAAA8AAAAKgAAAA4AAAAAAAAASAAAABoAAADmAAAAKwAAAHUAAAA/AAAAIAAAAAcAAAADAAAAAAAAAAMAAAAHAAAAAgAAAAEAAAACAAAAFwAAABAAAAAAAAAAAgAAAAAAAABfAAAABwAAAAMAAAAmAAAAEQAAAAAAAAACAAAAAAAAAB0AAAAAAAAACwAAACcAAAAIAAAAAAAAABYAAAAAAAAADAAAAC0AAAAUAAAAAAAAACMAAAA4AAAACAEAAAgAAAACAAAAJAAAABIAAAAAAAAAMgAAAB0AAABxAAAABgAAAAIAAAABAAAAAgAAACUAAAAWAAAAAAAAABoAAAAFAAAAAgAAAAEAAAACAAAAHwAAAA8AAAAAAAAASAEAABIAAAC+AAAAAAAAAFAAAACZAwAAZwAAAG4AAAASAAAAwwAAAL0KAAAuBAAA0g8AAEYCAAC6IQAAOAIAAAgAAAAeAAAAcgAAAB0AAAATAAAALwAAABEAAAADAAAAIAAAABQAAAAGAAAAEgAAALECAAA/AAAAgQAAAEoAAAAGAAAAAAAAAEMAAAAMAAAAQQAAAAEAAAACAAAAAAAAAB0AAAD3FwAACQAAANUEAAArAAAACAAAAPgiAAAeAQAAMgAAAAIAAAASAAAAAwAAAAkAAACLAQAABQkAAGoAAAAGAAAADAAAAAQAAAAIAAAACAAAAAkAAABnFwAAVAAAAAIAAABGAAAAAgAAAAEAAAADAAAAAAAAAAMAAAABAAAAAwAAAAMAAAACAAAACwAAAAIAAAAAAAAAAgAAAAYAAAACAAAAQAAAAAIAAAADAAAAAwAAAAcAAAACAAAABgAAAAIAAAAbAAAAAgAAAAMAAAACAAAABAAAAAIAAAAAAAAABAAAAAYAAAACAAAAUwEAAAMAAAAYAAAAAgAAABgAAAACAAAAHgAAAAIAAAAYAAAAAgAAAB4AAAACAAAAGAAAAAIAAAAeAAAAAgAAABgAAAACAAAAHgAAAAIAAAAYAAAAAgAAAAcAAAA1CQAALAAAAAsAAAAGAAAAEQAAAAAAAAByAQAAKwAAABUFAADEAAAAPAAAAEMAAAAIAAAAAAAAALUEAAADAAAAAgAAABoAAAACAAAAAQAAAAIAAAAAAAAAAwAAAAAAAAACAAAACQAAAAIAAAADAAAAAgAAAAAAAAACAAAAAAAAAAcAAAAAAAAABQAAAAAAAAACAAAAAAAAAAIAAAAAAAAAAgAAAAIAAAACAAAAAQAAAAIAAAAAAAAAAwAAAAAAAAACAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAABAAAAAgAAAAAAAAADAAAAAwAAAAIAAAAGAAAAAgAAAAMAAAACAAAAAwAAAAIAAAAAAAAAAgAAAAkAAAACAAAAEAAAAAYAAAACAAAAAgAAAAQAAAACAAAAEAAAAEURAADdpgAAIwAAADQQAAAMAAAA3QAAAAMAAACBFgAADwAAADAdAAAgDAAAHQIAAOMFAABKEwAA/QEAAAAAAADjAAAAAAAAAJYAAAAEAAAAJgEAAAkAAABYBQAAAgAAAAIAAAABAAAABgAAAAMAAAApAAAAAgAAAAUAAAAAAAAApgAAAAEAAAA+AgAAAwAAAAkAAAAJAAAAcgEAAAEAAACaAAAACgAAALAAAAACAAAANgAAAA4AAAAgAAAACQAAABAAAAADAAAALgAAAAoAAAA2AAAACQAAAAcAAAACAAAAJQAAAA0AAAACAAAACQAAAAYAAAABAAAALQAAAAAAAAANAAAAAgAAADEAAAANAAAACQAAAAMAAAACAAAACwAAAFMAAAALAAAABwAAAAAAAAChAAAACwAAAAYAAAAJAAAABwAAAAMAAAA4AAAAAQAAAAIAAAAGAAAAAwAAAAEAAAADAAAAAgAAAAoAAAAAAAAACwAAAAEAAAADAAAABgAAAAQAAAAEAAAAwQAAABEAAAAKAAAACQAAAAUAAAAAAAAAUgAAABMAAAANAAAACQAAANYAAAAGAAAAAwAAAAgAAAAcAAAAAQAAAFMAAAAQAAAAEAAAAAkAAABSAAAADAAAAAkAAAAJAAAAVAAAAA4AAAAFAAAACQAAAPMAAAAOAAAApgAAAAkAAABHAAAABQAAAAIAAAABAAAAAwAAAAMAAAACAAAAAAAAAAIAAAABAAAADQAAAAkAAAB4AAAABgAAAAMAAAAGAAAABAAAAAAAAAAdAAAACQAAACkAAAAGAAAAAgAAAAMAAAAJAAAAAAAAAAoAAAAKAAAALwAAAA8AAACWAQAABwAAAAIAAAAHAAAAEQAAAAkAAAA5AAAAFQAAAAIAAAANAAAAewAAAAUAAAAEAAAAAAAAAAIAAAABAAAAAgAAAAYAAAACAAAAAAAAAAkAAAAJAAAAMQAAAAQAAAACAAAAAQAAAAIAAAAEAAAACQAAAAkAAABKAQAAAwAAAGpLAAAJAAAAhwAAAAQAAAA8AAAABgAAABoAAAAJAAAA9gMAAAAAAAACAAAANgAAAAgAAAADAAAAUgAAAAAAAAAMAAAAAQAAAKxMAAABAAAAxxQAAAQAAAAEAAAABQAAAAkAAAAHAAAAAwAAAAYAAAAfAAAAAwAAAJUAAAACAAAAigUAADEAAAABAgAANgAAAAUAAAAxAAAACQAAAAAAAAAPAAAAAAAAABcAAAAEAAAAAgAAAA4AAABRBQAABgAAAAIAAAAQAAAAAwAAAAYAAAACAAAAAQAAAAIAAAAEAAAABgEAAAYAAAAKAAAACQAAAKMBAAANAAAA1wUAAAYAAABuAAAABgAAAAYAAAAJAAAAlxIAAAkAAAAHBQwA7wBBmB8LGlCMAAABAAAAAgAAAAMAAAAEAAAAAAQAAPAf";return"undefined"!=typeof Buffer?Buffer.from(A,"base64"):Uint8Array.from(atob(A),A=>A.charCodeAt(0))}let C;export function init(){return C||(C=(async()=>{const B=await WebAssembly.compile(I()),{exports:Q}=await WebAssembly.instantiate(B);A=Q})())}export function initSync(){if(A)return;const B=new WebAssembly.Module(I()),{exports:Q}=new WebAssembly.Instance(B);A=Q}
\ No newline at end of file
diff --git a/deps/cjs-module-lexer/lexer.js b/deps/cjs-module-lexer/lexer.js
old mode 100644
new mode 100755
diff --git a/deps/cjs-module-lexer/src/.babelrc b/deps/cjs-module-lexer/src/.babelrc
new file mode 100755
index 00000000000..ac89f952694
--- /dev/null
+++ b/deps/cjs-module-lexer/src/.babelrc
@@ -0,0 +1,10 @@
+{
+  "plugins": [
+    [
+      "@babel/plugin-transform-modules-commonjs",
+      {
+        "strict": true
+      },
+    ]
+  ]
+}
diff --git a/deps/cjs-module-lexer/src/CHANGELOG.md b/deps/cjs-module-lexer/src/CHANGELOG.md
new file mode 100644
index 00000000000..5a24d193fd4
--- /dev/null
+++ b/deps/cjs-module-lexer/src/CHANGELOG.md
@@ -0,0 +1,40 @@
+1.2.2
+- Fix RollupJS reexports bug (https://github.com/nodejs/cjs-module-lexer/pull/59)
+
+1.2.1
+- Support Unicode escapes in strings (https://github.com/nodejs/cjs-module-lexer/pull/55)
+- Filter export strings to valid surrogate pairs (https://github.com/nodejs/cjs-module-lexer/pull/56)
+
+1.2.0
+- Support for non-identifier exports (https://github.com/nodejs/cjs-module-lexer/pull/54, @nicolo-ribaudo)
+
+1.1.1
+- Better support for Babel reexport getter function forms (https://github.com/nodejs/cjs-module-lexer/issues/50)
+- Support Babel interopRequireWildcard reexports patterns (https://github.com/nodejs/cjs-module-lexer/issues/52)
+
+1.1.0
+- Support for Babel reexport conflict filter (https://github.com/nodejs/cjs-module-lexer/issues/36, @nicolo-ribaudo)
+- Support trailing commas in getter patterns (https://github.com/nodejs/cjs-module-lexer/issues/31)
+- Support for RollupJS reexports property checks (https://github.com/nodejs/cjs-module-lexer/issues/38)
+
+1.0.0
+- Unsafe getter tracking (https://github.com/nodejs/cjs-module-lexer/pull/29)
+
+0.6.0
+- API-only breaking change: Unify JS and Wasm interfaces (https://github.com/nodejs/cjs-module-lexer/pull/27)
+- Add type definitions (https://github.com/nodejs/cjs-module-lexer/pull/28)
+
+0.5.2
+- Support named getter functions (https://github.com/nodejs/cjs-module-lexer/pull/26)
+
+0.5.1:
+- Feature: Implement specific reexport getter forms (https://github.com/nodejs/cjs-module-lexer/pull/25)
+
+0.5.0
+- Breaking Change: No longer emit Object.defineProperty exports (https://github.com/nodejs/cjs-module-lexer/pull/24)
+- Doc: Update link to WASI SDK (https://github.com/nodejs/cjs-module-lexer/pull/19)
+
+0.4.3
+- Support for Babel 7.12 reexports (https://github.com/nodejs/cjs-module-lexer/pull/16)
+- Support module.exports = { ...require('x') } reexports (https://github.com/nodejs/cjs-module-lexer/pull/18)
+- "if" keyword space parsing in exports matching (https://github.com/nodejs/cjs-module-lexer/pull/17)
diff --git a/deps/cjs-module-lexer/src/LICENSE b/deps/cjs-module-lexer/src/LICENSE
new file mode 100755
index 00000000000..935b357962d
--- /dev/null
+++ b/deps/cjs-module-lexer/src/LICENSE
@@ -0,0 +1,10 @@
+MIT License
+-----------
+
+Copyright (C) 2018-2020 Guy Bedford
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/deps/cjs-module-lexer/src/Makefile b/deps/cjs-module-lexer/src/Makefile
new file mode 100755
index 00000000000..9a75850f73a
--- /dev/null
+++ b/deps/cjs-module-lexer/src/Makefile
@@ -0,0 +1,16 @@
+WASM2WAT := ../wabt/bin/wasm2wat
+WASM_OPT := ../binaryen/bin/wasm-opt
+
+.PHONY: optimize clean
+
+lib/lexer.wat: lib/lexer.wasm
+	$(WASM2WAT) lib/lexer.wasm -o lib/lexer.wat
+
+lib/lexer.wasm: include-wasm/cjs-module-lexer.h src/lexer.c | lib/
+	node build/wasm.js --docker
+
+lib/:
+	@mkdir -p $@
+
+clean:
+	$(RM) lib/*
diff --git a/deps/cjs-module-lexer/src/README.md b/deps/cjs-module-lexer/src/README.md
new file mode 100755
index 00000000000..addf5edc6b1
--- /dev/null
+++ b/deps/cjs-module-lexer/src/README.md
@@ -0,0 +1,483 @@
+# CJS Module Lexer
+
+[![Build Status][travis-image]][travis-url]
+
+A [very fast](#benchmarks) JS CommonJS module syntax lexer used to detect the most likely list of named exports of a CommonJS module.
+
+Outputs the list of named exports (`exports.name = ...`) and possible module reexports (`module.exports = require('...')`), including the common transpiler variations of these cases.
+
+Forked from https://github.com/guybedford/es-module-lexer.
+
+_Comprehensively handles the JS language grammar while remaining small and fast. - ~90ms per MB of JS cold and ~15ms per MB of JS warm, [see benchmarks](#benchmarks) for more info._
+
+### Project Status
+
+This project is used in Node.js core for detecting the named exports available when importing a CJS module into ESM, and is maintained for this purpose.
+
+PRs will be accepted and upstreamed for parser bugs, performance improvements or new syntax support only.
+
+_Detection patterns for this project are **frozen**_. This is because adding any new export detection patterns would result in fragmented backwards-compatibility. Specifically, it would be very difficult to figure out why an ES module named export for CommonJS might work in newer Node.js versions but not older versions. This problem would only be discovered downstream of module authors, with the fix for module authors being to then have to understand which patterns in this project provide full backwards-compatibily. Rather, by fully freezing the detected patterns, if it works in any Node.js version it will work in any other. Build tools can also reliably treat the supported syntax for this project as a part of their output target for ensuring syntax support.
+
+### Usage
+
+```
+npm install cjs-module-lexer
+```
+
+For use in CommonJS:
+
+```js
+const { parse } = require('cjs-module-lexer');
+
+// `init` return a promise for parity with the ESM API, but you do not have to call it
+
+const { exports, reexports } = parse(`
+  // named exports detection
+  module.exports.a = 'a';
+  (function () {
+    exports.b = 'b';
+  })();
+  Object.defineProperty(exports, 'c', { value: 'c' });
+  /* exports.d = 'not detected'; */
+
+  // reexports detection
+  if (maybe) module.exports = require('./dep1.js');
+  if (another) module.exports = require('./dep2.js');
+
+  // literal exports assignments
+  module.exports = { a, b: c, d, 'e': f }
+
+  // __esModule detection
+  Object.defineProperty(module.exports, '__esModule', { value: true })
+`);
+
+// exports === ['a', 'b', 'c', '__esModule']
+// reexports === ['./dep1.js', './dep2.js']
+```
+
+When using the ESM version, Wasm is supported instead:
+
+```js
+import { parse, init } from 'cjs-module-lexer';
+// init() needs to be called and waited upon, or use initSync() to compile
+// Wasm blockingly and synchronously.
+await init();
+const { exports, reexports } = parse(source);
+```
+
+The Wasm build is around 1.5x faster and without a cold start.
+
+### Grammar
+
+CommonJS exports matches are run against the source token stream.
+
+The token grammar is:
+
+```
+IDENTIFIER: As defined by ECMA-262, without support for identifier `\` escapes, filtered to remove strict reserved words:
+            "implements", "interface", "let", "package", "private", "protected", "public", "static", "yield", "enum"
+
+STRING_LITERAL: A `"` or `'` bounded ECMA-262 string literal.
+
+MODULE_EXPORTS: `module` `.` `exports`
+
+EXPORTS_IDENTIFIER: MODULE_EXPORTS_IDENTIFIER | `exports`
+
+EXPORTS_DOT_ASSIGN: EXPORTS_IDENTIFIER `.` IDENTIFIER `=`
+
+EXPORTS_LITERAL_COMPUTED_ASSIGN: EXPORTS_IDENTIFIER `[` STRING_LITERAL `]` `=`
+
+EXPORTS_LITERAL_PROP: (IDENTIFIER  (`:` IDENTIFIER)?) | (STRING_LITERAL `:` IDENTIFIER)
+
+EXPORTS_SPREAD: `...` (IDENTIFIER | REQUIRE)
+
+EXPORTS_MEMBER: EXPORTS_DOT_ASSIGN | EXPORTS_LITERAL_COMPUTED_ASSIGN
+
+EXPORTS_DEFINE: `Object` `.` `defineProperty `(` EXPORTS_IDENFITIER `,` STRING_LITERAL
+
+EXPORTS_DEFINE_VALUE: EXPORTS_DEFINE `, {`
+  (`enumerable: true,`)?
+  (
+    `value:` |
+    `get` (`: function` IDENTIFIER? )?  `() {` return IDENTIFIER (`.` IDENTIFIER | `[` STRING_LITERAL `]`)? `;`? `}` `,`?
+  )
+  `})`
+
+EXPORTS_LITERAL: MODULE_EXPORTS `=` `{` (EXPORTS_LITERAL_PROP | EXPORTS_SPREAD) `,`)+ `}`
+
+REQUIRE: `require` `(` STRING_LITERAL `)`
+
+EXPORTS_ASSIGN: (`var` | `const` | `let`) IDENTIFIER `=` (`_interopRequireWildcard (`)? REQUIRE
+
+MODULE_EXPORTS_ASSIGN: MODULE_EXPORTS `=` REQUIRE
+
+EXPORT_STAR: (`__export` | `__exportStar`) `(` REQUIRE
+
+EXPORT_STAR_LIB: `Object.keys(` IDENTIFIER$1 `).forEach(function (` IDENTIFIER$2 `) {`
+  (
+    (
+      `if (` IDENTIFIER$2 `===` ( `'default'` | `"default"` ) `||` IDENTIFIER$2 `===` ( '__esModule' | `"__esModule"` ) `) return` `;`?
+      (
+        (`if (Object` `.prototype`? `.hasOwnProperty.call(`  IDENTIFIER `, ` IDENTIFIER$2 `)) return` `;`?)?
+        (`if (` IDENTIFIER$2 `in` EXPORTS_IDENTIFIER `&&` EXPORTS_IDENTIFIER `[` IDENTIFIER$2 `] ===` IDENTIFIER$1 `[` IDENTIFIER$2 `]) return` `;`)?
+      )?
+    ) |
+    `if (` IDENTIFIER$2 `!==` ( `'default'` | `"default"` ) (`&& !` (`Object` `.prototype`? `.hasOwnProperty.call(`  IDENTIFIER `, ` IDENTIFIER$2 `)` | IDENTIFIER `.hasOwnProperty(` IDENTIFIER$2 `)`))? `)`
+  )
+  (
+    EXPORTS_IDENTIFIER `[` IDENTIFIER$2 `] =` IDENTIFIER$1 `[` IDENTIFIER$2 `]` `;`? |
+    `Object.defineProperty(` EXPORTS_IDENTIFIER `, ` IDENTIFIER$2 `, { enumerable: true, get` (`: function` IDENTIFIER? )?  `() { return ` IDENTIFIER$1 `[` IDENTIFIER$2 `]` `;`? `}` `,`? `})` `;`?
+  )
+  `})`
+```
+
+Spacing between tokens is taken to be any ECMA-262 whitespace, ECMA-262 block comment or ECMA-262 line comment.
+
+* The returned export names are taken to be the combination of:
+  1. All `IDENTIFIER` and `STRING_LITERAL` slots for `EXPORTS_MEMBER` and `EXPORTS_LITERAL` matches.
+  2. The first `STRING_LITERAL` slot for all `EXPORTS_DEFINE_VALUE` matches where that same string is not an `EXPORTS_DEFINE` match that is not also an `EXPORTS_DEFINE_VALUE` match.
+* The reexport specifiers are taken to be the combination of:
+  1. The `REQUIRE` matches of the last matched of either `MODULE_EXPORTS_ASSIGN` or `EXPORTS_LITERAL`.
+  2. All _top-level_ `EXPORT_STAR` `REQUIRE` matches and `EXPORTS_ASSIGN` matches whose `IDENTIFIER` also matches the first `IDENTIFIER` in `EXPORT_STAR_LIB`.
+
+### Parsing Examples
+
+#### Named Exports Parsing
+
+The basic matching rules for named exports are `exports.name`, `exports['name']` or `Object.defineProperty(exports, 'name', ...)`. This matching is done without scope analysis and regardless of the expression position:
+
+```js
+// DETECTS EXPORTS: a, b
+(function (exports) {
+  exports.a = 'a'; 
+  exports['b'] = 'b';
+})(exports);
+```
+
+Because there is no scope analysis, the above detection may overclassify:
+
+```js
+// DETECTS EXPORTS: a, b, c
+(function (exports, Object) {
+  exports.a = 'a';
+  exports['b'] = 'b';
+  if (false)
+    exports.c = 'c';
+})(NOT_EXPORTS, NOT_OBJECT);
+```
+
+It will in turn underclassify in cases where the identifiers are renamed:
+
+```js
+// DETECTS: NO EXPORTS
+(function (e) {
+  e.a = 'a';
+  e['b'] = 'b';
+})(exports);
+```
+
+#### Getter Exports Parsing
+
+`Object.defineProperty` is detected for specifically value and getter forms returning an identifier or member expression:
+
+```js
+// DETECTS: a, b, c, d, __esModule
+Object.defineProperty(exports, 'a', {
+  enumerable: true,
+  get: function () {
+    return q.p;
+  }
+});
+Object.defineProperty(exports, 'b', {
+  enumerable: true,
+  get: function () {
+    return q['p'];
+  }
+});
+Object.defineProperty(exports, 'c', {
+  enumerable: true,
+  get () {
+    return b;
+  }
+});
+Object.defineProperty(exports, 'd', { value: 'd' });
+Object.defineProperty(exports, '__esModule', { value: true });
+```
+
+Value properties are also detected specifically:
+
+```js
+Object.defineProperty(exports, 'a', {
+  value: 'no problem'
+});
+```
+
+To avoid matching getters that have side effects, any getter for an export name that does not support the forms above will
+opt-out of the getter matching:
+
+```js
+// DETECTS: NO EXPORTS
+Object.defineProperty(exports, 'a', {
+  get () {
+    return 'nope';
+  }
+});
+
+if (false) {
+  Object.defineProperty(module.exports, 'a', {
+    get () {
+      return dynamic();
+    }
+  })
+}
+```
+
+Alternative object definition structures or getter function bodies are not detected:
+
+```js
+// DETECTS: NO EXPORTS
+Object.defineProperty(exports, 'a', {
+  enumerable: false,
+  get () {
+    return p;
+  }
+});
+Object.defineProperty(exports, 'b', {
+  configurable: true,
+  get () {
+    return p;
+  }
+});
+Object.defineProperty(exports, 'c', {
+  get: () => p
+});
+Object.defineProperty(exports, 'd', {
+  enumerable: true,
+  get: function () {
+    return dynamic();
+  }
+});
+Object.defineProperty(exports, 'e', {
+  enumerable: true,
+  get () {
+    return 'str';
+  }
+});
+```
+
+`Object.defineProperties` is also not supported.
+
+#### Exports Object Assignment
+
+A best-effort is made to detect `module.exports` object assignments, but because this is not a full parser, arbitrary expressions are not handled in the
+object parsing process.
+
+Simple object definitions are supported:
+
+```js
+// DETECTS EXPORTS: a, b, c
+module.exports = {
+  a,
+  'b': b,
+  c: c,
+  ...d
+};
+```
+
+Object properties that are not identifiers or string expressions will bail out of the object detection, while spreads are ignored:
+
+```js
+// DETECTS EXPORTS: a, b
+module.exports = {
+  a,
+  ...d,
+  b: require('c'),
+  c: "not detected since require('c') above bails the object detection"
+}
+```
+
+`Object.defineProperties` is not currently supported either.
+
+#### module.exports reexport assignment
+
+Any `module.exports = require('mod')` assignment is detected as a reexport, but only the last one is returned:
+
+```js
+// DETECTS REEXPORTS: c
+module.exports = require('a');
+(module => module.exports = require('b'))(NOT_MODULE);
+if (false) module.exports = require('c');
+```
+
+This is to avoid over-classification in Webpack bundles with externals which include `module.exports = require('external')` in their source for every external dependency.
+
+In exports object assignment, any spread of `require()` are detected as multiple separate reexports:
+
+```js
+// DETECTS REEXPORTS: a, b
+module.exports = require('ignored');
+module.exports = {
+  ...require('a'),
+  ...require('b')
+};
+```
+
+#### Transpiler Re-exports
+
+For named exports, transpiler output works well with the rules described above.
+
+But for star re-exports, special care is taken to support common patterns of transpiler outputs from Babel and TypeScript as well as bundlers like RollupJS.
+These reexport and star reexport patterns are restricted to only be detected at the top-level as provided by the direct output of these tools.
+
+For example, `export * from 'external'` is output by Babel as:
+
+```js
+"use strict";
+
+exports.__esModule = true;
+
+var _external = require("external");
+
+Object.keys(_external).forEach(function (key) {
+  if (key === "default" || key === "__esModule") return;
+  exports[key] = _external[key];
+});
+```
+
+Where the `var _external = require("external")` is specifically detected as well as the `Object.keys(_external)` statement, down to the exact
+for of that entire expression including minor variations of the output. The `_external` and `key` identifiers are carefully matched in this
+detection.
+
+Similarly for TypeScript, `export * from 'external'` is output as:
+
+```js
+"use strict";
+function __export(m) {
+    for (var p in m) if (!exports.hasOwnProperty(p)) exports[p] = m[p];
+}
+Object.defineProperty(exports, "__esModule", { value: true });
+__export(require("external"));
+```
+
+Where the `__export(require("external"))` statement is explicitly detected as a reexport, including variations `tslib.__export` and `__exportStar`.
+
+### Environment Support
+
+Node.js 10+, and [all browsers with Web Assembly support](https://caniuse.com/#feat=wasm).
+
+### JS Grammar Support
+
+* Token state parses all line comments, block comments, strings, template strings, blocks, parens and punctuators.
+* Division operator / regex token ambiguity is handled via backtracking checks against punctuator prefixes, including closing brace or paren backtracking.
+* Always correctly parses valid JS source, but may parse invalid JS source without errors.
+
+### Benchmarks
+
+Benchmarks can be run with `npm run bench`.
+
+Current results:
+
+JS Build:
+
+```
+Module load time
+> 4ms
+Cold Run, All Samples
+test/samples/*.js (3635 KiB)
+> 299ms
+
+Warm Runs (average of 25 runs)
+test/samples/angular.js (1410 KiB)
+> 13.96ms
+test/samples/angular.min.js (303 KiB)
+> 4.72ms
+test/samples/d3.js (553 KiB)
+> 6.76ms
+test/samples/d3.min.js (250 KiB)
+> 4ms
+test/samples/magic-string.js (34 KiB)
+> 0.64ms
+test/samples/magic-string.min.js (20 KiB)
+> 0ms
+test/samples/rollup.js (698 KiB)
+> 8.48ms
+test/samples/rollup.min.js (367 KiB)
+> 5.36ms
+
+Warm Runs, All Samples (average of 25 runs)
+test/samples/*.js (3635 KiB)
+> 40.28ms
+```
+
+Wasm Build:
+```
+Module load time
+> 10ms
+Cold Run, All Samples
+test/samples/*.js (3635 KiB)
+> 43ms
+
+Warm Runs (average of 25 runs)
+test/samples/angular.js (1410 KiB)
+> 9.32ms
+test/samples/angular.min.js (303 KiB)
+> 3.16ms
+test/samples/d3.js (553 KiB)
+> 5ms
+test/samples/d3.min.js (250 KiB)
+> 2.32ms
+test/samples/magic-string.js (34 KiB)
+> 0.16ms
+test/samples/magic-string.min.js (20 KiB)
+> 0ms
+test/samples/rollup.js (698 KiB)
+> 6.28ms
+test/samples/rollup.min.js (367 KiB)
+> 3.6ms
+
+Warm Runs, All Samples (average of 25 runs)
+test/samples/*.js (3635 KiB)
+> 27.76ms
+```
+
+### Wasm Build Steps
+
+The build uses docker and make, they must be installed first.
+
+To build the lexer wasm run `npm run build-wasm`.
+
+Optimization passes are run with [Binaryen](https://github.com/WebAssembly/binaryen)
+prior to publish to reduce the Web Assembly footprint.
+
+After building the lexer wasm, build the final distribution components
+(lexer.js and lexer.mjs) by running `npm run build`.
+
+If you need to build lib/lexer.wat (optional) you must first install
+[wabt](https://github.com/WebAssembly/wabt) as a sibling folder to this
+project. The wat file is then build by running `make lib/lexer.wat`
+
+### Creating a Release
+These are the steps to create and publish a release. You will need docker
+installed as well as having installed [wabt](https://github.com/WebAssembly/wabt)
+as outlined above:
+
+- [ ] Figure out if the release should be semver patch, minor or major based on the changes since
+  the last release and determine the new version.
+- [ ] Update the package.json version, and run a full build and test
+  - npm install
+  - npm run build
+  - npm run test
+- [ ] Commit and tag the changes, pushing up to main and the tag
+  - For example
+    - `git tag -a 1.4.2 -m "1.4.2"`
+    - `git push origin tag 1.4.2`
+- [ ] Create the GitHub release
+- [ ] Run npm publish from an account with access (asking somebody with access
+      the nodejs-foundation account is an option if you don't have access.
+      
+### License
+
+MIT
+
+[travis-url]: https://travis-ci.org/guybedford/es-module-lexer
+[travis-image]: https://travis-ci.org/guybedford/es-module-lexer.svg?branch=master
diff --git a/deps/cjs-module-lexer/src/build.js b/deps/cjs-module-lexer/src/build.js
new file mode 100755
index 00000000000..da024d1a6cb
--- /dev/null
+++ b/deps/cjs-module-lexer/src/build.js
@@ -0,0 +1,25 @@
+const fs = require('fs');
+const terser = require('terser');
+
+const MINIFY = true;
+
+try { fs.mkdirSync('./dist'); }
+catch (e) {}
+
+const wasmBuffer = fs.readFileSync('./lib/lexer.wasm');
+const jsSource = fs.readFileSync('./src/lexer.js').toString();
+const pjson = JSON.parse(fs.readFileSync('./package.json').toString());
+
+const jsSourceProcessed = jsSource.replace('WASM_BINARY', wasmBuffer.toString('base64'));
+
+const minified = MINIFY && terser.minify(jsSourceProcessed, {
+  module: true,
+  output: {
+    preamble: `/* cjs-module-lexer ${pjson.version} */`
+  }
+});
+
+if (minified.error)
+  throw minified.error;
+
+fs.writeFileSync('./dist/lexer.mjs', minified ? minified.code : jsSourceProcessed);
diff --git a/deps/cjs-module-lexer/src/build/Makefile b/deps/cjs-module-lexer/src/build/Makefile
new file mode 100755
index 00000000000..b8e96d82534
--- /dev/null
+++ b/deps/cjs-module-lexer/src/build/Makefile
@@ -0,0 +1,24 @@
+# These flags depend on the system and may be overridden
+WASM_CC := clang
+WASM_CFLAGS := --sysroot=/usr/share/wasi-sysroot
+WASM_LDFLAGS := -nostartfiles
+
+# These are project-specific and are expected to be kept intact
+WASM_TARGET := -target wasm32-unknown-wasi
+WASM_EXTRA_CFLAGS := -I include-wasm/ -Wno-logical-op-parentheses -Wno-parentheses -Oz
+WASM_EXTRA_LDFLAGS := -Wl,-z,stack-size=13312,--no-entry,--compress-relocations,--strip-all
+WASM_EXTRA_LDFLAGS += -Wl,--export=__heap_base,--export=parseCJS,--export=sa
+WASM_EXTRA_LDFLAGS += -Wl,--export=e,--export=re,--export=es,--export=ee
+WASM_EXTRA_LDFLAGS += -Wl,--export=rre,--export=ree,--export=res,--export=ru,--export=us,--export=ue
+
+lib/lexer.wasm: include-wasm/cjs-module-lexer.h src/lexer.c
+	@mkdir -p lib
+	$(WASM_CC) $(WASM_CFLAGS) $(WASM_TARGET) $(WASM_EXTRA_CFLAGS) \
+        src/lexer.c -o lib/lexer.wasm \
+        $(WASM_LDFLAGS) $(WASM_EXTRA_LDFLAGS)
+
+optimize: lib/lexer.wasm
+	${WASM_OPT} -Oz lib/lexer.wasm -o lib/lexer.wasm
+
+clean:
+	rm lib/*
diff --git a/deps/cjs-module-lexer/src/build/wasm.js b/deps/cjs-module-lexer/src/build/wasm.js
new file mode 100644
index 00000000000..58fb64041d7
--- /dev/null
+++ b/deps/cjs-module-lexer/src/build/wasm.js
@@ -0,0 +1,54 @@
+'use strict'
+
+const WASM_BUILDER_CONTAINER = 'ghcr.io/nodejs/wasm-builder@sha256:975f391d907e42a75b8c72eb77c782181e941608687d4d8694c3e9df415a0970' // v0.0.9
+
+const WASM_OPT = './wasm-opt'
+
+const { execSync } = require('node:child_process')
+const { writeFileSync, readFileSync, existsSync, mkdirSync } = require('node:fs')
+const { join, resolve } = require('node:path')
+
+const ROOT = resolve(__dirname, '../')
+
+let platform = process.env.WASM_PLATFORM
+if (!platform && process.argv[2]) {
+  platform = execSync('docker info -f "{{.OSType}}/{{.Architecture}}"').toString().trim()
+}
+
+if (process.argv[2] === '--docker') {
+  let cmd = `docker run --rm --platform=${platform.toString().trim()} `
+  if (process.platform === 'linux') {
+    cmd += ` --user ${process.getuid()}:${process.getegid()}`
+  }
+
+  if (!existsSync(`${ROOT}/dist`)){
+    mkdirSync(`${ROOT}/dist`);
+  }
+
+  cmd += ` --mount type=bind,source=${ROOT}/lib,target=/home/node/build/lib \
+           --mount type=bind,source=${ROOT}/src,target=/home/node/build/src \
+           --mount type=bind,source=${ROOT}/dist,target=/home/node/build/dist \
+           --mount type=bind,source=${ROOT}/node_modules,target=/home/node/build/node_modules \
+           --mount type=bind,source=${ROOT}/build/wasm.js,target=/home/node/build/wasm.js \
+           --mount type=bind,source=${ROOT}/build/Makefile,target=/home/node/build/Makefile \
+           --mount type=bind,source=${ROOT}/build.js,target=/home/node/build/build.js \
+           --mount type=bind,source=${ROOT}/package.json,target=/home/node/build/package.json \
+           --mount type=bind,source=${ROOT}/include-wasm,target=/home/node/build/include-wasm \
+           -t ${WASM_BUILDER_CONTAINER} node wasm.js`
+  console.log(`> ${cmd}\n\n`)
+  execSync(cmd, { stdio: 'inherit' })
+  process.exit(0)
+}
+
+const hasOptimizer = (function () {
+  try { execSync(`${WASM_OPT} --version`); return true } catch (error) { return false }
+})()
+
+// Build wasm binary
+console.log('Building wasm');
+execSync(`make lib/lexer.wasm`, { stdio: 'inherit' })
+if (hasOptimizer) {
+  console.log('Optimizing wasm');
+  execSync(`make optimize`, { stdio: 'inherit' })
+}
+execSync(`node build.js`, { stdio: 'inherit' })
diff --git a/deps/cjs-module-lexer/src/include-wasm/cjs-module-lexer.h b/deps/cjs-module-lexer/src/include-wasm/cjs-module-lexer.h
new file mode 100755
index 00000000000..ab2adca3c75
--- /dev/null
+++ b/deps/cjs-module-lexer/src/include-wasm/cjs-module-lexer.h
@@ -0,0 +1,238 @@
+#include <stdint.h>
+#include <stdbool.h>
+#include <stddef.h>
+#include <limits.h>
+#include <string.h>
+
+extern unsigned char __heap_base;
+
+const uint16_t* source = (void*)&__heap_base;
+uint32_t parse_error;
+
+struct Slice {
+  const uint16_t* start;
+  const uint16_t* end;
+  struct Slice* next;
+};
+typedef struct Slice Slice;
+
+struct StarExportBinding {
+  const uint16_t* specifier_start;
+  const uint16_t* specifier_end;
+  const uint16_t* id_start;
+  const uint16_t* id_end;
+};
+typedef struct StarExportBinding StarExportBinding;
+
+Slice* first_export = NULL;
+Slice* export_read_head = NULL;
+Slice* export_write_head = NULL;
+Slice* first_reexport = NULL;
+Slice* reexport_read_head = NULL;
+Slice* reexport_write_head = NULL;
+Slice* first_unsafe_getter = NULL;
+Slice* unsafe_getter_read_head = NULL;
+Slice* unsafe_getter_write_head = NULL;
+void* analysis_base;
+void* analysis_head;
+
+void bail (uint32_t err);
+
+// allocateSource
+const uint16_t* sa (uint32_t utf16Len) {
+  const uint16_t* sourceEnd = source + utf16Len + 1;
+  // ensure source is null terminated
+  *(uint16_t*)(source + utf16Len) = '\0';
+  analysis_base = (void*)sourceEnd;
+  analysis_head = analysis_base;
+  first_export = NULL;
+  export_write_head = NULL;
+  export_read_head = NULL;
+  first_reexport = NULL;
+  reexport_write_head = NULL;
+  reexport_read_head = NULL;
+  first_unsafe_getter = NULL;
+  unsafe_getter_write_head = NULL;
+  unsafe_getter_read_head = NULL;
+  return source;
+}
+
+// getErr
+uint32_t e () {
+  return parse_error;
+}
+
+// getExportStart
+uint32_t es () {
+  return export_read_head->start - source;
+}
+// getExportEnd
+uint32_t ee () {
+  return export_read_head->end - source;
+}
+// getReexportStart
+uint32_t res () {
+  return reexport_read_head->start - source;
+}
+// getReexportEnd
+uint32_t ree () {
+  return reexport_read_head->end - source;
+}
+// getUnsafeGetterStart
+uint32_t us () {
+  return unsafe_getter_read_head->start - source;
+}
+// getUnsafeGetterEnd
+uint32_t ue () {
+  return unsafe_getter_read_head->end - source;
+}
+// readExport
+bool re () {
+  if (export_read_head == NULL)
+    export_read_head = first_export;
+  else
+    export_read_head = export_read_head->next;
+  if (export_read_head == NULL)
+    return false;
+  return true;
+}
+// readReexport
+bool rre () {
+  if (reexport_read_head == NULL)
+    reexport_read_head = first_reexport;
+  else
+    reexport_read_head = reexport_read_head->next;
+  if (reexport_read_head == NULL)
+    return false;
+  return true;
+}
+// readUnsafeGetter
+bool ru () {
+  if (unsafe_getter_read_head == NULL)
+    unsafe_getter_read_head = first_unsafe_getter;
+  else
+    unsafe_getter_read_head = unsafe_getter_read_head->next;
+  if (unsafe_getter_read_head == NULL)
+    return false;
+  return true;
+}
+
+void _addExport (const uint16_t* start, const uint16_t* end) {
+  Slice* export = (Slice*)(analysis_head);
+  analysis_head = analysis_head + sizeof(Slice);
+  if (export_write_head == NULL)
+    first_export = export;
+  else
+    export_write_head->next = export;
+  export_write_head = export;
+  export->start = start;
+  export->end = end;
+  export->next = NULL;
+}
+void _addReexport (const uint16_t* start, const uint16_t* end) {
+  Slice* reexport = (Slice*)(analysis_head);
+  analysis_head = analysis_head + sizeof(Slice);
+  if (reexport_write_head == NULL)
+    first_reexport = reexport;
+  else
+    reexport_write_head->next = reexport;
+  reexport_write_head = reexport;
+  reexport->start = start;
+  reexport->end = end;
+  reexport->next = NULL;
+}
+void _addUnsafeGetter (const uint16_t* start, const uint16_t* end) {
+  Slice* unsafe_getter = (Slice*)(analysis_head);
+  analysis_head = analysis_head + sizeof(Slice);
+  if (unsafe_getter_write_head == NULL)
+    first_unsafe_getter = unsafe_getter;
+  else
+    unsafe_getter_write_head->next = unsafe_getter;
+  unsafe_getter_write_head = unsafe_getter;
+  unsafe_getter->start = start;
+  unsafe_getter->end = end;
+  unsafe_getter->next = NULL;
+}
+void _clearReexports () {
+  reexport_write_head = NULL;
+  first_reexport = NULL;
+}
+void (*addExport)(const uint16_t*, const uint16_t*) = &_addExport;
+void (*addReexport)(const uint16_t*, const uint16_t*) = &_addReexport;
+void (*addUnsafeGetter)(const uint16_t*, const uint16_t*) = &_addUnsafeGetter;
+void (*clearReexports)() = &_clearReexports;
+uint32_t parseCJS (uint16_t* source, uint32_t sourceLen, void (*addExport)(const uint16_t* start, const uint16_t* end), void (*addReexport)(const uint16_t* start, const uint16_t* end), void (*addUnsafeGetter)(const uint16_t*, const uint16_t*), void (*clearReexports)());
+
+enum RequireType {
+  Import,
+  ExportAssign,
+  ExportStar
+};
+
+void tryBacktrackAddStarExportBinding (uint16_t* pos);
+bool tryParseRequire (enum RequireType requireType);
+void tryParseLiteralExports ();
+bool readExportsOrModuleDotExports (uint16_t ch);
+void tryParseModuleExportsDotAssign ();
+void tryParseExportsDotAssign (bool assign);
+void tryParseObjectDefineOrKeys (bool keys);
+bool identifier (uint16_t ch);
+
+void throwIfImportStatement ();
+void throwIfExportStatement ();
+
+void readImportString (const uint16_t* ss, uint16_t ch);
+uint16_t readExportAs (uint16_t* startPos, uint16_t* endPos);
+
+uint16_t commentWhitespace ();
+void stringLiteral (uint16_t quote);
+void regularExpression ();
+void templateString ();
+void blockComment ();
+void lineComment ();
+
+uint16_t readToWsOrPunctuator (uint16_t ch);
+
+uint32_t fullCharCode (uint16_t ch);
+uint32_t fullCharCodeAtLast (uint16_t* pos);
+bool isIdentifierStart (uint32_t code);
+bool isIdentifierChar (uint32_t code);
+int charCodeByteLen (uint32_t ch);
+
+bool isBr (uint16_t c);
+bool isBrOrWs (uint16_t c);
+bool isBrOrWsOrPunctuator (uint16_t c);
+bool isBrOrWsOrPunctuatorNotDot (uint16_t c);
+
+bool str_eq2 (uint16_t* pos, uint16_t c1, uint16_t c2);
+bool str_eq3 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3);
+bool str_eq4 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4);
+bool str_eq5 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5);
+bool str_eq6 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6);
+bool str_eq7 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7);
+bool str_eq8 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7, uint16_t c8);
+bool str_eq9 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7, uint16_t c8, uint16_t c9);
+bool str_eq10 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7, uint16_t c8, uint16_t c9, uint16_t c10);
+bool str_eq13 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7, uint16_t c8, uint16_t c9, uint16_t c10, uint16_t c11, uint16_t c12, uint16_t c13);
+bool str_eq18 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7, uint16_t c8, uint16_t c9, uint16_t c10, uint16_t c11, uint16_t c12, uint16_t c13, uint16_t c14, uint16_t c15, uint16_t c16, uint16_t c17, uint16_t c18);
+bool str_eq22 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7, uint16_t c8, uint16_t c9, uint16_t c10, uint16_t c11, uint16_t c12, uint16_t c13, uint16_t c14, uint16_t c15, uint16_t c16, uint16_t c17, uint16_t c18, uint16_t c19, uint16_t c20, uint16_t c21, uint16_t c22);
+
+bool readPrecedingKeyword2(uint16_t* pos, uint16_t c1, uint16_t c2);
+bool readPrecedingKeyword3(uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3);
+bool readPrecedingKeyword4(uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4);
+bool readPrecedingKeyword5(uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5);
+bool readPrecedingKeyword6(uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6);
+bool readPrecedingKeyword7(uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7);
+
+bool keywordStart (uint16_t* pos);
+bool isExpressionKeyword (uint16_t* pos);
+bool isParenKeyword (uint16_t* pos);
+bool isPunctuator (uint16_t charCode);
+bool isExpressionPunctuator (uint16_t charCode);
+bool isExpressionTerminator (uint16_t* pos);
+
+void nextChar (uint16_t ch);
+void nextCharSurrogate (uint16_t ch);
+uint16_t readChar ();
+
+void syntaxError (uint32_t code);
diff --git a/deps/cjs-module-lexer/src/lexer.d.mts b/deps/cjs-module-lexer/src/lexer.d.mts
new file mode 100644
index 00000000000..98e01424641
--- /dev/null
+++ b/deps/cjs-module-lexer/src/lexer.d.mts
@@ -0,0 +1 @@
+export * from './lexer.js'
diff --git a/deps/cjs-module-lexer/lexer.d.ts b/deps/cjs-module-lexer/src/lexer.d.ts
old mode 100644
new mode 100755
similarity index 96%
rename from deps/cjs-module-lexer/lexer.d.ts
rename to deps/cjs-module-lexer/src/lexer.d.ts
index c7d8a523f36..cda07d80af9
--- a/deps/cjs-module-lexer/lexer.d.ts
+++ b/deps/cjs-module-lexer/src/lexer.d.ts
@@ -1,8 +1,8 @@
-export interface Exports {
-  exports: string[];
-  reexports: string[];
-}
-
-export declare function parse(source: string, name?: string): Exports;
-export declare function init(): Promise<void>;
-export declare function initSync(): void;
+export interface Exports {
+  exports: string[];
+  reexports: string[];
+}
+
+export declare function parse(source: string, name?: string): Exports;
+export declare function init(): Promise<void>;
+export declare function initSync(): void;
diff --git a/deps/cjs-module-lexer/src/lexer.js b/deps/cjs-module-lexer/src/lexer.js
new file mode 100755
index 00000000000..aaf7dde807f
--- /dev/null
+++ b/deps/cjs-module-lexer/src/lexer.js
@@ -0,0 +1,1443 @@
+let source, pos, end;
+let openTokenDepth,
+  templateDepth,
+  lastTokenPos,
+  lastSlashWasDivision,
+  templateStack,
+  templateStackDepth,
+  openTokenPosStack,
+  openClassPosStack,
+  nextBraceIsClass,
+  starExportMap,
+  lastStarExportSpecifier,
+  _exports,
+  unsafeGetters,
+  reexports;
+
+function resetState () {
+  openTokenDepth = 0;
+  templateDepth = -1;
+  lastTokenPos = -1;
+  lastSlashWasDivision = false;
+  templateStack = new Array(1024);
+  templateStackDepth = 0;
+  openTokenPosStack = new Array(1024);
+  openClassPosStack = new Array(1024);
+  nextBraceIsClass = false;
+  starExportMap = Object.create(null);
+  lastStarExportSpecifier = null;
+
+  _exports = new Set();
+  unsafeGetters = new Set();
+  reexports = new Set();
+}
+
+// RequireType
+const Import = 0;
+const ExportAssign = 1;
+const ExportStar = 2;
+
+function parseCJS (source, name = '@') {
+  resetState();
+  try {
+    parseSource(source);
+  }
+  catch (e) {
+    e.message += `\n  at ${name}:${source.slice(0, pos).split('\n').length}:${pos - source.lastIndexOf('\n', pos - 1)}`;
+    e.loc = pos;
+    throw e;
+  }
+  const result = { exports: [..._exports].filter(expt => expt !== undefined && !unsafeGetters.has(expt)), reexports: [...reexports].filter(reexpt => reexpt !== undefined) };
+  resetState();
+  return result;
+}
+
+function decode (str) {
+  if (str[0] === '"' || str[0] === '\'') {
+    try {
+      const decoded = (0, eval)(str);
+      // Filter to exclude non-matching UTF-16 surrogate strings
+      for (let i = 0; i < decoded.length; i++) {
+        const surrogatePrefix = decoded.charCodeAt(i) & 0xFC00;
+        if (surrogatePrefix < 0xD800) {
+          // Not a surrogate
+          continue;
+        }
+        else if (surrogatePrefix === 0xD800) {
+          // Validate surrogate pair
+          if ((decoded.charCodeAt(++i) & 0xFC00) !== 0xDC00)
+            return;
+        }
+        else {
+          // Out-of-range surrogate code (above 0xD800)
+          return;
+        }
+      }
+      return decoded;
+    }
+    catch {}
+  }
+  else {
+    return str;
+  }
+}
+
+function parseSource (cjsSource) {
+  source = cjsSource;
+  pos = -1;
+  end = source.length - 1;
+  let ch = 0;
+
+  // Handle #!
+  if (source.charCodeAt(0) === 35/*#*/ && source.charCodeAt(1) === 33/*!*/) {
+    if (source.length === 2)
+      return true;
+    pos += 2;
+    while (pos++ < end) {
+      ch = source.charCodeAt(pos);
+      if (ch === 10/*\n*/ || ch === 13/*\r*/)
+        break;
+    }
+  }
+
+  while (pos++ < end) {
+    ch = source.charCodeAt(pos);
+
+    if (ch === 32 || ch < 14 && ch > 8)
+      continue;
+
+    if (openTokenDepth === 0) {
+      switch (ch) {
+        case 105/*i*/:
+          if (source.startsWith('mport', pos + 1) && keywordStart(pos))
+            throwIfImportStatement();
+          lastTokenPos = pos;
+          continue;
+        case 114/*r*/:
+          const startPos = pos;
+          if (tryParseRequire(Import) && keywordStart(startPos))
+            tryBacktrackAddStarExportBinding(startPos - 1);
+          lastTokenPos = pos;
+          continue;
+        case 95/*_*/:
+          if (source.startsWith('interopRequireWildcard', pos + 1) && (keywordStart(pos) || source.charCodeAt(pos - 1) === 46/*.*/)) {
+            const startPos = pos;
+            pos += 23;
+            if (source.charCodeAt(pos) === 40/*(*/) {
+              pos++;
+              openTokenPosStack[openTokenDepth++] = lastTokenPos;
+              if (tryParseRequire(Import) && keywordStart(startPos)) {
+                tryBacktrackAddStarExportBinding(startPos - 1);
+              }
+            }
+          }
+          else if (source.startsWith('_export', pos + 1) && (keywordStart(pos) || source.charCodeAt(pos - 1) === 46/*.*/)) {
+            pos += 8;
+            if (source.startsWith('Star', pos))
+              pos += 4;
+            if (source.charCodeAt(pos) === 40/*(*/) {
+              openTokenPosStack[openTokenDepth++] = lastTokenPos;
+              if (source.charCodeAt(++pos) === 114/*r*/)
+                tryParseRequire(ExportStar);
+            }
+          }
+          lastTokenPos = pos;
+          continue;
+      }
+    }
+
+    switch (ch) {
+      case 101/*e*/:
+        if (source.startsWith('xport', pos + 1) && keywordStart(pos)) {
+          if (source.charCodeAt(pos + 6) === 115/*s*/)
+            tryParseExportsDotAssign(false);
+          else if (openTokenDepth === 0)
+            throwIfExportStatement();
+        }
+        break;
+      case 99/*c*/:
+        if (keywordStart(pos) && source.startsWith('lass', pos + 1) && isBrOrWs(source.charCodeAt(pos + 5)))
+          nextBraceIsClass = true;
+        break;
+      case 109/*m*/:
+        if (source.startsWith('odule', pos + 1) && keywordStart(pos))
+          tryParseModuleExportsDotAssign();
+        break;
+      case 79/*O*/:
+        if (source.startsWith('bject', pos + 1) && keywordStart(pos))
+          tryParseObjectDefineOrKeys(openTokenDepth === 0);
+        break;
+      case 40/*(*/:
+        openTokenPosStack[openTokenDepth++] = lastTokenPos;
+        break;
+      case 41/*)*/:
+        if (openTokenDepth === 0)
+          throw new Error('Unexpected closing bracket.');
+        openTokenDepth--;
+        break;
+      case 123/*{*/:
+        openClassPosStack[openTokenDepth] = nextBraceIsClass;
+        nextBraceIsClass = false;
+        openTokenPosStack[openTokenDepth++] = lastTokenPos;
+        break;
+      case 125/*}*/:
+        if (openTokenDepth === 0)
+          throw new Error('Unexpected closing brace.');
+        if (openTokenDepth-- === templateDepth) {
+          templateDepth = templateStack[--templateStackDepth];
+          templateString();
+        }
+        else {
+          if (templateDepth !== -1 && openTokenDepth < templateDepth)
+            throw new Error('Unexpected closing brace.');
+        }
+        break;
+      case 60/*>*/:
+        // TODO: <!-- XML comment support
+        break;
+      case 39/*'*/:
+      case 34/*"*/:
+        stringLiteral(ch);
+        break;
+      case 47/*/*/: {
+        const next_ch = source.charCodeAt(pos + 1);
+        if (next_ch === 47/*/*/) {
+          lineComment();
+          // dont update lastToken
+          continue;
+        }
+        else if (next_ch === 42/***/) {
+          blockComment();
+          // dont update lastToken
+          continue;
+        }
+        else {
+          // Division / regex ambiguity handling based on checking backtrack analysis of:
+          // - what token came previously (lastToken)
+          // - if a closing brace or paren, what token came before the corresponding
+          //   opening brace or paren (lastOpenTokenIndex)
+          const lastToken = source.charCodeAt(lastTokenPos);
+          if (isExpressionPunctuator(lastToken) &&
+              !(lastToken === 46/*.*/ && (source.charCodeAt(lastTokenPos - 1) >= 48/*0*/ && source.charCodeAt(lastTokenPos - 1) <= 57/*9*/)) &&
+              !(lastToken === 43/*+*/ && source.charCodeAt(lastTokenPos - 1) === 43/*+*/) && !(lastToken === 45/*-*/ && source.charCodeAt(lastTokenPos - 1) === 45/*-*/) ||
+              lastToken === 41/*)*/ && isParenKeyword(openTokenPosStack[openTokenDepth]) ||
+              lastToken === 125/*}*/ && (isExpressionTerminator(openTokenPosStack[openTokenDepth]) || openClassPosStack[openTokenDepth]) ||
+              lastToken === 47/*/*/ && lastSlashWasDivision ||
+              isExpressionKeyword(lastTokenPos) ||
+              !lastToken) {
+            regularExpression();
+            lastSlashWasDivision = false;
+          }
+          else {
+            lastSlashWasDivision = true;
+          }
+        }
+        break;
+      }
+      case 96/*`*/:
+        templateString();
+        break;
+    }
+    lastTokenPos = pos;
+  }
+
+  if (templateDepth !== -1)
+    throw new Error('Unterminated template.');
+
+  if (openTokenDepth)
+    throw new Error('Unterminated braces.');
+}
+
+function tryBacktrackAddStarExportBinding (bPos) {
+  while (source.charCodeAt(bPos) === 32/* */ && bPos >= 0)
+    bPos--;
+  if (source.charCodeAt(bPos) === 61/*=*/) {
+    bPos--;
+    while (source.charCodeAt(bPos) === 32/* */ && bPos >= 0)
+      bPos--;
+    let codePoint;
+    const id_end = bPos;
+    let identifierStart = false;
+    while ((codePoint = codePointAtLast(bPos)) && bPos >= 0) {
+      if (codePoint === 92/*\*/)
+        return;
+      if (!isIdentifierChar(codePoint, true))
+        break;
+      identifierStart = isIdentifierStart(codePoint, true);
+      bPos -= codePointLen(codePoint);
+    }
+    if (identifierStart && source.charCodeAt(bPos) === 32/* */) {
+      const starExportId = source.slice(bPos + 1, id_end + 1);
+      while (source.charCodeAt(bPos) === 32/* */ && bPos >= 0)
+        bPos--;
+      switch (source.charCodeAt(bPos)) {
+        case 114/*r*/:
+          if (!source.startsWith('va', bPos - 2))
+            return;
+          break;
+        case 116/*t*/:
+          if (!source.startsWith('le', bPos - 2) && !source.startsWith('cons', bPos - 4))
+            return;
+          break;
+        default: return;
+      }
+      starExportMap[starExportId] = lastStarExportSpecifier;
+    }
+  }
+}
+
+// `Object.` `prototype.`? hasOwnProperty.call(`  IDENTIFIER `, ` IDENTIFIER$2 `)`
+function tryParseObjectHasOwnProperty (it_id) {
+  ch = commentWhitespace();
+  if (ch !== 79/*O*/ || !source.startsWith('bject', pos + 1)) return false;
+  pos += 6;
+  ch = commentWhitespace();
+  if (ch !== 46/*.*/) return false;
+  pos++;
+  ch = commentWhitespace();
+  if (ch === 112/*p*/) {
+    if (!source.startsWith('rototype', pos + 1)) return false;
+    pos += 9;
+    ch = commentWhitespace();
+    if (ch !== 46/*.*/) return false;
+    pos++;
+    ch = commentWhitespace();
+  }
+  if (ch !== 104/*h*/ || !source.startsWith('asOwnProperty', pos + 1)) return false;
+  pos += 14;
+  ch = commentWhitespace();
+  if (ch !== 46/*.*/) return false;
+  pos++;
+  ch = commentWhitespace();
+  if (ch !== 99/*c*/ || !source.startsWith('all', pos + 1)) return false;
+  pos += 4;
+  ch = commentWhitespace();
+  if (ch !== 40/*(*/) return false;
+  pos++;
+  ch = commentWhitespace();
+  if (!identifier()) return false;
+  ch = commentWhitespace();
+  if (ch !== 44/*,*/) return false;
+  pos++;
+  ch = commentWhitespace();
+  if (!source.startsWith(it_id, pos)) return false;
+  pos += it_id.length;
+  ch = commentWhitespace();
+  if (ch !== 41/*)*/) return false;
+  pos++;
+  return true;
+}
+
+function tryParseObjectDefineOrKeys (keys) {
+  pos += 6;
+  let revertPos = pos - 1;
+  let ch = commentWhitespace();
+  if (ch === 46/*.*/) {
+    pos++;
+    ch = commentWhitespace();
+    if (ch === 100/*d*/ && source.startsWith('efineProperty', pos + 1)) {
+      let expt;
+      while (true) {
+        pos += 14;
+        revertPos = pos - 1;
+        ch = commentWhitespace();
+        if (ch !== 40/*(*/) break;
+        pos++;
+        ch = commentWhitespace();
+        if (!readExportsOrModuleDotExports(ch)) break;
+        ch = commentWhitespace();
+        if (ch !== 44/*,*/) break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch !== 39/*'*/ && ch !== 34/*"*/) break;
+        const exportPos = pos;
+        stringLiteral(ch);
+        expt = source.slice(exportPos, ++pos);
+        ch = commentWhitespace();
+        if (ch !== 44/*,*/) break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch !== 123/*{*/) break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch === 101/*e*/) {
+          if (!source.startsWith('numerable', pos + 1)) break;
+          pos += 10;
+          ch = commentWhitespace();
+          if (ch !== 58/*:*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 116/*t*/ || !source.startsWith('rue', pos + 1)) break;
+          pos += 4;
+          ch = commentWhitespace();
+          if (ch !== 44) break;
+          pos++;
+          ch = commentWhitespace();
+        }
+        if (ch === 118/*v*/) {
+          if (!source.startsWith('alue', pos + 1)) break;
+          pos += 5;
+          ch = commentWhitespace();
+          if (ch !== 58/*:*/) break;
+          _exports.add(decode(expt));
+          pos = revertPos;
+          return;
+        }
+        else if (ch === 103/*g*/) {
+          if (!source.startsWith('et', pos + 1)) break;
+          pos += 3;
+          ch = commentWhitespace();
+          if (ch === 58/*:*/) {
+            pos++;
+            ch = commentWhitespace();
+            if (ch !== 102/*f*/) break;
+            if (!source.startsWith('unction', pos + 1)) break;
+            pos += 8;
+            let lastPos = pos;
+            ch = commentWhitespace();
+            if (ch !== 40 && (lastPos === pos || !identifier())) break;
+            ch = commentWhitespace();
+          }
+          if (ch !== 40/*(*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 41/*)*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 123/*{*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 114/*r*/) break;
+          if (!source.startsWith('eturn', pos + 1)) break;
+          pos += 6;
+          ch = commentWhitespace();
+          if (!identifier()) break;
+          ch = commentWhitespace();
+          if (ch === 46/*.*/) {
+            pos++;
+            commentWhitespace();
+            if (!identifier()) break;
+            ch = commentWhitespace();
+          }
+          else if (ch === 91/*[*/) {
+            pos++;
+            ch = commentWhitespace();
+            if (ch === 39/*'*/ || ch === 34/*"*/) stringLiteral(ch);
+            else break;
+            pos++;
+            ch = commentWhitespace();
+            if (ch !== 93/*]*/) break;
+            pos++;
+            ch = commentWhitespace();
+          }
+          if (ch === 59/*;*/) {
+            pos++;
+            ch = commentWhitespace();
+          }
+          if (ch !== 125/*}*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch === 44/*,*/) {
+            pos++;
+            ch = commentWhitespace();
+          }
+          if (ch !== 125/*}*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 41/*)*/) break;
+          _exports.add(decode(expt));
+          return;
+        }
+        break;
+      }
+      if (expt) {
+        unsafeGetters.add(decode(expt));
+      }
+    }
+    else if (keys && ch === 107/*k*/ && source.startsWith('eys', pos + 1)) {
+      while (true) {
+        pos += 4;
+        revertPos = pos - 1;
+        ch = commentWhitespace();
+        if (ch !== 40/*(*/) break;
+        pos++;
+        ch = commentWhitespace();
+        const id_start = pos;
+        if (!identifier()) break;
+        const id = source.slice(id_start, pos);
+        ch = commentWhitespace();
+        if (ch !== 41/*)*/) break;
+
+        revertPos = pos++;
+        ch = commentWhitespace();
+        if (ch !== 46/*.*/) break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch !== 102/*f*/ || !source.startsWith('orEach', pos + 1)) break;
+        pos += 7;
+        ch = commentWhitespace();
+        revertPos = pos - 1;
+        if (ch !== 40/*(*/) break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch !== 102/*f*/ || !source.startsWith('unction', pos + 1)) break;
+        pos += 8;
+        ch = commentWhitespace();
+        if (ch !== 40/*(*/) break;
+        pos++;
+        ch = commentWhitespace();
+        const it_id_start = pos;
+        if (!identifier()) break;
+        const it_id = source.slice(it_id_start, pos);
+        ch = commentWhitespace();
+        if (ch !== 41/*)*/) break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch !== 123/*{*/) break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch !== 105/*i*/ || source.charCodeAt(pos + 1) !== 102/*f*/) break;
+        pos += 2;
+        ch = commentWhitespace();
+        if (ch !== 40/*(*/) break;
+        pos++;
+        ch = commentWhitespace();
+        if (!source.startsWith(it_id, pos)) break;
+        pos += it_id.length;
+        ch = commentWhitespace();
+        // `if (` IDENTIFIER$2 `===` ( `'default'` | `"default"` ) `||` IDENTIFIER$2 `===` ( '__esModule' | `"__esModule"` ) `) return` `;`? |
+        if (ch === 61/*=*/) {
+          if (!source.startsWith('==', pos + 1)) break;
+          pos += 3;
+          ch = commentWhitespace();
+          if (ch !== 34/*"*/ && ch !== 39/*'*/) break;
+          let quot = ch;
+          if (!source.startsWith('default', pos + 1)) break;
+          pos += 8;
+          ch = commentWhitespace();
+          if (ch !== quot) break;
+          pos += 1;
+          ch = commentWhitespace();
+          if (ch !== 124/*|*/ || source.charCodeAt(pos + 1) !== 124/*|*/) break;
+          pos += 2;
+          ch = commentWhitespace();
+          if (source.slice(pos, pos + it_id.length) !== it_id) break;
+          pos += it_id.length;
+          ch = commentWhitespace();
+          if (ch !== 61/*=*/ || source.slice(pos + 1, pos + 3) !== '==') break;
+          pos += 3;
+          ch = commentWhitespace();
+          if (ch !== 34/*"*/ && ch !== 39/*'*/) break;
+          quot = ch;
+          if (!source.startsWith('__esModule', pos + 1)) break;
+          pos += 11;
+          ch = commentWhitespace();
+          if (ch !== quot) break;
+          pos += 1;
+          ch = commentWhitespace();
+          if (ch !== 41/*)*/) break;
+          pos += 1;
+          ch = commentWhitespace();
+          if (ch !== 114/*r*/ || !source.startsWith('eturn', pos + 1)) break;
+          pos += 6;
+          ch = commentWhitespace();
+          if (ch === 59/*;*/)
+            pos++;
+          ch = commentWhitespace();
+
+          // `if (`
+          if (ch === 105/*i*/ && source.charCodeAt(pos + 1) === 102/*f*/) {
+            let inIf = true;
+            pos += 2;
+            ch = commentWhitespace();
+            if (ch !== 40/*(*/) break;
+            pos++;
+            const ifInnerPos = pos;
+            // `Object.prototype.hasOwnProperty.call(`  IDENTIFIER `, ` IDENTIFIER$2 `)) return` `;`?
+            if (tryParseObjectHasOwnProperty(it_id)) {
+              ch = commentWhitespace();
+              if (ch !== 41/*)*/) break;
+              pos++;
+              ch = commentWhitespace();
+              if (ch !== 114/*r*/ || !source.startsWith('eturn', pos + 1)) break;
+              pos += 6;
+              ch = commentWhitespace();
+              if (ch === 59/*;*/)
+                pos++;
+              ch = commentWhitespace();
+              // match next if
+              if (ch === 105/*i*/ && source.charCodeAt(pos + 1) === 102/*f*/) {
+                pos += 2;
+                ch = commentWhitespace();
+                if (ch !== 40/*(*/) break;
+                pos++;
+              }
+              else {
+                inIf = false;
+              }
+            }
+            else {
+              pos = ifInnerPos;
+            }
+
+            // IDENTIFIER$2 `in` EXPORTS_IDENTIFIER `&&` EXPORTS_IDENTIFIER `[` IDENTIFIER$2 `] ===` IDENTIFIER$1 `[` IDENTIFIER$2 `]) return` `;`?
+            if (inIf) {
+              if (!source.startsWith(it_id, pos)) break;
+              pos += it_id.length;
+              ch = commentWhitespace();
+              if (ch !== 105/*i*/ || !source.startsWith('n ', pos + 1)) break;
+              pos += 3;
+              ch = commentWhitespace();
+              if (!readExportsOrModuleDotExports(ch)) break;
+              ch = commentWhitespace();
+              if (ch !== 38/*&*/ || source.charCodeAt(pos + 1) !== 38/*&*/) break;
+              pos += 2;
+              ch = commentWhitespace();
+              if (!readExportsOrModuleDotExports(ch)) break;
+              ch = commentWhitespace();
+              if (ch !== 91/*[*/) break;
+              pos++;
+              ch = commentWhitespace();
+              if (!source.startsWith(it_id, pos)) break;
+              pos += it_id.length;
+              ch = commentWhitespace();
+              if (ch !== 93/*]*/) break;
+              pos++;
+              ch = commentWhitespace();
+              if (ch !== 61/*=*/ || !source.startsWith('==', pos + 1)) break;
+              pos += 3;
+              ch = commentWhitespace();
+              if (!source.startsWith(id, pos)) break;
+              pos += id.length;
+              ch = commentWhitespace();
+              if (ch !== 91/*[*/) break;
+              pos++;
+              ch = commentWhitespace();
+              if (!source.startsWith(it_id, pos)) break;
+              pos += it_id.length;
+              ch = commentWhitespace();
+              if (ch !== 93/*]*/) break;
+              pos++;
+              ch = commentWhitespace();
+              if (ch !== 41/*)*/) break;
+              pos++;
+              ch = commentWhitespace();
+              if (ch !== 114/*r*/ || !source.startsWith('eturn', pos + 1)) break;
+              pos += 6;
+              ch = commentWhitespace();
+              if (ch === 59/*;*/)
+                pos++;
+              ch = commentWhitespace();
+            }
+          }
+        }
+        // `if (` IDENTIFIER$2 `!==` ( `'default'` | `"default"` ) (`&& !` IDENTIFIER `.hasOwnProperty(` IDENTIFIER$2 `)`  )? `)`
+        else if (ch === 33/*!*/) {
+          if (!source.startsWith('==', pos + 1)) break;
+          pos += 3;
+          ch = commentWhitespace();
+          if (ch !== 34/*"*/ && ch !== 39/*'*/) break;
+          const quot = ch;
+          if (!source.startsWith('default', pos + 1)) break;
+          pos += 8;
+          ch = commentWhitespace();
+          if (ch !== quot) break;
+          pos += 1;
+          ch = commentWhitespace();
+          if (ch === 38/*&*/) {
+            if (source.charCodeAt(pos + 1) !== 38/*&*/) break;
+            pos += 2;
+            ch = commentWhitespace();
+            if (ch !== 33/*!*/) break;
+            pos += 1;
+            ch = commentWhitespace();
+            if (ch === 79/*O*/ && source.startsWith('bject', pos + 1) && source[pos + 6] === '.') {
+              if (!tryParseObjectHasOwnProperty(it_id)) break;
+            }
+            else if (identifier()) {
+              ch = commentWhitespace();
+              if (ch !== 46/*.*/) break;
+              pos++;
+              ch = commentWhitespace();
+              if (ch !== 104/*h*/ || !source.startsWith('asOwnProperty', pos + 1)) break;
+              pos += 14;
+              ch = commentWhitespace();
+              if (ch !== 40/*(*/) break;
+              pos += 1;
+              ch = commentWhitespace();
+              if (!source.startsWith(it_id, pos)) break;
+              pos += it_id.length;
+              ch = commentWhitespace();
+              if (ch !== 41/*)*/) break;
+              pos += 1;
+            }
+            else break;
+            ch = commentWhitespace();
+          }
+          if (ch !== 41/*)*/) break;
+          pos += 1;
+          ch = commentWhitespace();
+        }
+        else break;
+
+        // EXPORTS_IDENTIFIER `[` IDENTIFIER$2 `] =` IDENTIFIER$1 `[` IDENTIFIER$2 `]`
+        if (readExportsOrModuleDotExports(ch)) {
+          ch = commentWhitespace();
+          if (ch !== 91/*[*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (source.slice(pos, pos + it_id.length) !== it_id) break;
+          pos += it_id.length;
+          ch = commentWhitespace();
+          if (ch !== 93/*]*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 61/*=*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (source.slice(pos, pos + id.length) !== id) break;
+          pos += id.length;
+          ch = commentWhitespace();
+          if (ch !== 91/*[*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (source.slice(pos, pos + it_id.length) !== it_id) break;
+          pos += it_id.length;
+          ch = commentWhitespace();
+          if (ch !== 93/*]*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch === 59/*;*/) {
+            pos++;
+            ch = commentWhitespace();
+          }
+        }
+        // `Object.defineProperty(` EXPORTS_IDENTIFIER `, ` IDENTIFIER$2 `, { enumerable: true, get: function () { return ` IDENTIFIER$1 `[` IDENTIFIER$2 `]; } })`
+        else if (ch === 79/*O*/) {
+          if (source.slice(pos + 1, pos + 6) !== 'bject') break;
+          pos += 6;
+          ch = commentWhitespace();
+          if (ch !== 46/*.*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 100/*d*/ || !source.startsWith('efineProperty', pos + 1)) break;
+          pos += 14;
+          ch = commentWhitespace();
+          if (ch !== 40/*(*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (!readExportsOrModuleDotExports(ch)) break;
+          ch = commentWhitespace();
+          if (ch !== 44/*,*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (!source.startsWith(it_id, pos)) break;
+          pos += it_id.length;
+          ch = commentWhitespace();
+          if (ch !== 44/*,*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 123/*{*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 101/*e*/ || !source.startsWith('numerable', pos + 1)) break;
+          pos += 10;
+          ch = commentWhitespace();
+          if (ch !== 58/*:*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 116/*t*/ && !source.startsWith('rue', pos + 1)) break;
+          pos += 4;
+          ch = commentWhitespace();
+          if (ch !== 44/*,*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 103/*g*/ || !source.startsWith('et', pos + 1)) break;
+          pos += 3;
+          ch = commentWhitespace();
+          if (ch === 58/*:*/) {
+            pos++;
+            ch = commentWhitespace();
+            if (ch !== 102/*f*/) break;
+            if (!source.startsWith('unction', pos + 1)) break;
+            pos += 8;
+            let lastPos = pos;
+            ch = commentWhitespace();
+            if (ch !== 40 && (lastPos === pos || !identifier())) break;
+            ch = commentWhitespace();
+          }
+          if (ch !== 40/*(*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 41/*)*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 123/*{*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 114/*r*/ || !source.startsWith('eturn', pos + 1)) break;
+          pos += 6;
+          ch = commentWhitespace();
+          if (!source.startsWith(id, pos)) break;
+          pos += id.length;
+          ch = commentWhitespace();
+          if (ch !== 91/*[*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (!source.startsWith(it_id, pos)) break;
+          pos += it_id.length;
+          ch = commentWhitespace();
+          if (ch !== 93/*]*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch === 59/*;*/) {
+            pos++;
+            ch = commentWhitespace();
+          }
+          if (ch !== 125/*}*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch === 44/*,*/) {
+            pos++;
+            ch = commentWhitespace();
+          }
+          if (ch !== 125/*}*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch !== 41/*)*/) break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch === 59/*;*/) {
+            pos++;
+            ch = commentWhitespace();
+          }
+        }
+        else break;
+
+        if (ch !== 125/*}*/) break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch !== 41/*)*/) break;
+
+        const starExportSpecifier = starExportMap[id];
+        if (starExportSpecifier) {
+          reexports.add(decode(starExportSpecifier));
+          pos = revertPos;
+          return;
+        }
+        return;
+      }
+    }
+  }
+  pos = revertPos;
+}
+
+function readExportsOrModuleDotExports (ch) {
+  const revertPos = pos;
+  if (ch === 109/*m*/ && source.startsWith('odule', pos + 1)) {
+    pos += 6;
+    ch = commentWhitespace();
+    if (ch !== 46/*.*/) {
+      pos = revertPos;
+      return false;
+    }
+    pos++;
+    ch = commentWhitespace();
+  }
+  if (ch === 101/*e*/ && source.startsWith('xports', pos + 1)) {
+    pos += 7;
+    return true;
+  }
+  else {
+    pos = revertPos;
+    return false;
+  }
+}
+
+function tryParseModuleExportsDotAssign () {
+  pos += 6;
+  const revertPos = pos - 1;
+  let ch = commentWhitespace();
+  if (ch === 46/*.*/) {
+    pos++;
+    ch = commentWhitespace();
+    if (ch === 101/*e*/ && source.startsWith('xports', pos + 1)) {
+      tryParseExportsDotAssign(true);
+      return;
+    }
+  }
+  pos = revertPos;
+}
+
+function tryParseExportsDotAssign (assign) {
+  pos += 7;
+  const revertPos = pos - 1;
+  let ch = commentWhitespace();
+  switch (ch) {
+    // exports.asdf
+    case 46/*.*/: {
+      pos++;
+      ch = commentWhitespace();
+      const startPos = pos;
+      if (identifier()) {
+        const endPos = pos;
+        ch = commentWhitespace();
+        if (ch === 61/*=*/) {
+          _exports.add(decode(source.slice(startPos, endPos)));
+          return;
+        }
+      }
+      break;
+    }
+    // exports['asdf']
+    case 91/*[*/: {
+      pos++;
+      ch = commentWhitespace();
+      if (ch === 39/*'*/ || ch === 34/*"*/) {
+        const startPos = pos;
+        stringLiteral(ch);
+        const endPos = ++pos;
+        ch = commentWhitespace();
+        if (ch !== 93/*]*/) break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch !== 61/*=*/) break;
+        _exports.add(decode(source.slice(startPos, endPos)));
+      }
+      break;
+    }
+    // module.exports =
+    case 61/*=*/: {
+      if (assign) {
+        if (reexports.size)
+          reexports = new Set();
+        pos++;
+        ch = commentWhitespace();
+        // { ... }
+        if (ch === 123/*{*/) {
+          tryParseLiteralExports();
+          return;
+        }
+
+        // require('...')
+        if (ch === 114/*r*/)
+          tryParseRequire(ExportAssign);
+      }
+    }
+  }
+  pos = revertPos;
+}
+
+function tryParseRequire (requireType) {
+  // require('...')
+  const revertPos = pos;
+  if (source.startsWith('equire', pos + 1)) {
+    pos += 7;
+    let ch = commentWhitespace();
+    if (ch === 40/*(*/) {
+      pos++;
+      ch = commentWhitespace();
+      const reexportStart = pos;
+      if (ch === 39/*'*/ || ch === 34/*"*/) {
+        stringLiteral(ch);
+        const reexportEnd = ++pos;
+        ch = commentWhitespace();
+        if (ch === 41/*)*/) {
+          switch (requireType) {
+            case ExportAssign:
+              reexports.add(decode(source.slice(reexportStart, reexportEnd)));
+              return true;
+            case ExportStar:
+              reexports.add(decode(source.slice(reexportStart, reexportEnd)));
+              return true;
+            default:
+              lastStarExportSpecifier = decode(source.slice(reexportStart, reexportEnd));
+              return true;
+          }
+        }
+      }
+    }
+    pos = revertPos;
+  }
+  return false;
+}
+
+function tryParseLiteralExports () {
+  const revertPos = pos - 1;
+  while (pos++ < end) {
+    let ch = commentWhitespace();
+    const startPos = pos;
+    if (identifier()) {
+      const endPos = pos;
+      ch = commentWhitespace();
+      if (ch === 58/*:*/) {
+        pos++;
+        ch = commentWhitespace();
+        // nothing more complex than identifier expressions for now
+        if (!identifier()) {
+          pos = revertPos;
+          return;
+        }
+        ch = source.charCodeAt(pos);
+      }
+      _exports.add(decode(source.slice(startPos, endPos)));
+    }
+    else if (ch === 46/*.*/ && source.startsWith('..', pos + 1)) {
+      pos += 3;
+      if (source.charCodeAt(pos) === 114/*r*/ && tryParseRequire(ExportAssign)) {
+        pos++;
+      }
+      else if (!identifier()) {
+        pos = revertPos;
+        return;
+      }
+      ch = commentWhitespace();
+    }
+    else if (ch === 39/*'*/ || ch === 34/*"*/) {
+      const startPos = pos;
+      stringLiteral(ch);
+      const endPos = ++pos;
+      ch = commentWhitespace();
+      if (ch === 58/*:*/) {
+        pos++;
+        ch = commentWhitespace();
+        // nothing more complex than identifier expressions for now
+        if (!identifier()) {
+          pos = revertPos;
+          return;
+        }
+        ch = source.charCodeAt(pos);
+        _exports.add(decode(source.slice(startPos, endPos)));
+      }
+    }
+    else {
+      pos = revertPos;
+      return;
+    }
+
+    if (ch === 125/*}*/)
+      return;
+
+    if (ch !== 44/*,*/) {
+      pos = revertPos;
+      return;
+    }
+  }
+}
+
+// --- Extracted from AcornJS ---
+//(https://github.com/acornjs/acorn/blob/master/acorn/src/identifier.js#L23
+//
+// MIT License
+
+// Copyright (C) 2012-2018 by various contributors (see AUTHORS)
+
+// Permission is hereby granted, free of charge, to any person obtaining a copy
+// of this software and associated documentation files (the "Software"), to deal
+// in the Software without restriction, including without limitation the rights
+// to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+// copies of the Software, and to permit persons to whom the Software is
+// furnished to do so, subject to the following conditions:
+
+// The above copyright notice and this permission notice shall be included in
+// all copies or substantial portions of the Software.
+
+// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+// IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+// FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+// LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+// OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+// THE SOFTWARE.
+
+// ## Character categories
+
+// Big ugly regular expressions that match characters in the
+// whitespace, identifier, and identifier-start categories. These
+// are only applied when a character is found to actually have a
+// code point above 128.
+// Generated by `bin/generate-identifier-regex.js`.
+let nonASCIIidentifierStartChars = "\xaa\xb5\xba\xc0-\xd6\xd8-\xf6\xf8-\u02c1\u02c6-\u02d1\u02e0-\u02e4\u02ec\u02ee\u0370-\u0374\u0376\u0377\u037a-\u037d\u037f\u0386\u0388-\u038a\u038c\u038e-\u03a1\u03a3-\u03f5\u03f7-\u0481\u048a-\u052f\u0531-\u0556\u0559\u0560-\u0588\u05d0-\u05ea\u05ef-\u05f2\u0620-\u064a\u066e\u066f\u0671-\u06d3\u06d5\u06e5\u06e6\u06ee\u06ef\u06fa-\u06fc\u06ff\u0710\u0712-\u072f\u074d-\u07a5\u07b1\u07ca-\u07ea\u07f4\u07f5\u07fa\u0800-\u0815\u081a\u0824\u0828\u0840-\u0858\u0860-\u086a\u08a0-\u08b4\u08b6-\u08c7\u0904-\u0939\u093d\u0950\u0958-\u0961\u0971-\u0980\u0985-\u098c\u098f\u0990\u0993-\u09a8\u09aa-\u09b0\u09b2\u09b6-\u09b9\u09bd\u09ce\u09dc\u09dd\u09df-\u09e1\u09f0\u09f1\u09fc\u0a05-\u0a0a\u0a0f\u0a10\u0a13-\u0a28\u0a2a-\u0a30\u0a32\u0a33\u0a35\u0a36\u0a38\u0a39\u0a59-\u0a5c\u0a5e\u0a72-\u0a74\u0a85-\u0a8d\u0a8f-\u0a91\u0a93-\u0aa8\u0aaa-\u0ab0\u0ab2\u0ab3\u0ab5-\u0ab9\u0abd\u0ad0\u0ae0\u0ae1\u0af9\u0b05-\u0b0c\u0b0f\u0b10\u0b13-\u0b28\u0b2a-\u0b30\u0b32\u0b33\u0b35-\u0b39\u0b3d\u0b5c\u0b5d\u0b5f-\u0b61\u0b71\u0b83\u0b85-\u0b8a\u0b8e-\u0b90\u0b92-\u0b95\u0b99\u0b9a\u0b9c\u0b9e\u0b9f\u0ba3\u0ba4\u0ba8-\u0baa\u0bae-\u0bb9\u0bd0\u0c05-\u0c0c\u0c0e-\u0c10\u0c12-\u0c28\u0c2a-\u0c39\u0c3d\u0c58-\u0c5a\u0c60\u0c61\u0c80\u0c85-\u0c8c\u0c8e-\u0c90\u0c92-\u0ca8\u0caa-\u0cb3\u0cb5-\u0cb9\u0cbd\u0cde\u0ce0\u0ce1\u0cf1\u0cf2\u0d04-\u0d0c\u0d0e-\u0d10\u0d12-\u0d3a\u0d3d\u0d4e\u0d54-\u0d56\u0d5f-\u0d61\u0d7a-\u0d7f\u0d85-\u0d96\u0d9a-\u0db1\u0db3-\u0dbb\u0dbd\u0dc0-\u0dc6\u0e01-\u0e30\u0e32\u0e33\u0e40-\u0e46\u0e81\u0e82\u0e84\u0e86-\u0e8a\u0e8c-\u0ea3\u0ea5\u0ea7-\u0eb0\u0eb2\u0eb3\u0ebd\u0ec0-\u0ec4\u0ec6\u0edc-\u0edf\u0f00\u0f40-\u0f47\u0f49-\u0f6c\u0f88-\u0f8c\u1000-\u102a\u103f\u1050-\u1055\u105a-\u105d\u1061\u1065\u1066\u106e-\u1070\u1075-\u1081\u108e\u10a0-\u10c5\u10c7\u10cd\u10d0-\u10fa\u10fc-\u1248\u124a-\u124d\u1250-\u1256\u1258\u125a-\u125d\u1260-\u1288\u128a-\u128d\u1290-\u12b0\u12b2-\u12b5\u12b8-\u12be\u12c0\u12c2-\u12c5\u12c8-\u12d6\u12d8-\u1310\u1312-\u1315\u1318-\u135a\u1380-\u138f\u13a0-\u13f5\u13f8-\u13fd\u1401-\u166c\u166f-\u167f\u1681-\u169a\u16a0-\u16ea\u16ee-\u16f8\u1700-\u170c\u170e-\u1711\u1720-\u1731\u1740-\u1751\u1760-\u176c\u176e-\u1770\u1780-\u17b3\u17d7\u17dc\u1820-\u1878\u1880-\u18a8\u18aa\u18b0-\u18f5\u1900-\u191e\u1950-\u196d\u1970-\u1974\u1980-\u19ab\u19b0-\u19c9\u1a00-\u1a16\u1a20-\u1a54\u1aa7\u1b05-\u1b33\u1b45-\u1b4b\u1b83-\u1ba0\u1bae\u1baf\u1bba-\u1be5\u1c00-\u1c23\u1c4d-\u1c4f\u1c5a-\u1c7d\u1c80-\u1c88\u1c90-\u1cba\u1cbd-\u1cbf\u1ce9-\u1cec\u1cee-\u1cf3\u1cf5\u1cf6\u1cfa\u1d00-\u1dbf\u1e00-\u1f15\u1f18-\u1f1d\u1f20-\u1f45\u1f48-\u1f4d\u1f50-\u1f57\u1f59\u1f5b\u1f5d\u1f5f-\u1f7d\u1f80-\u1fb4\u1fb6-\u1fbc\u1fbe\u1fc2-\u1fc4\u1fc6-\u1fcc\u1fd0-\u1fd3\u1fd6-\u1fdb\u1fe0-\u1fec\u1ff2-\u1ff4\u1ff6-\u1ffc\u2071\u207f\u2090-\u209c\u2102\u2107\u210a-\u2113\u2115\u2118-\u211d\u2124\u2126\u2128\u212a-\u2139\u213c-\u213f\u2145-\u2149\u214e\u2160-\u2188\u2c00-\u2c2e\u2c30-\u2c5e\u2c60-\u2ce4\u2ceb-\u2cee\u2cf2\u2cf3\u2d00-\u2d25\u2d27\u2d2d\u2d30-\u2d67\u2d6f\u2d80-\u2d96\u2da0-\u2da6\u2da8-\u2dae\u2db0-\u2db6\u2db8-\u2dbe\u2dc0-\u2dc6\u2dc8-\u2dce\u2dd0-\u2dd6\u2dd8-\u2dde\u3005-\u3007\u3021-\u3029\u3031-\u3035\u3038-\u303c\u3041-\u3096\u309b-\u309f\u30a1-\u30fa\u30fc-\u30ff\u3105-\u312f\u3131-\u318e\u31a0-\u31bf\u31f0-\u31ff\u3400-\u4dbf\u4e00-\u9ffc\ua000-\ua48c\ua4d0-\ua4fd\ua500-\ua60c\ua610-\ua61f\ua62a\ua62b\ua640-\ua66e\ua67f-\ua69d\ua6a0-\ua6ef\ua717-\ua71f\ua722-\ua788\ua78b-\ua7bf\ua7c2-\ua7ca\ua7f5-\ua801\ua803-\ua805\ua807-\ua80a\ua80c-\ua822\ua840-\ua873\ua882-\ua8b3\ua8f2-\ua8f7\ua8fb\ua8fd\ua8fe\ua90a-\ua925\ua930-\ua946\ua960-\ua97c\ua984-\ua9b2\ua9cf\ua9e0-\ua9e4\ua9e6-\ua9ef\ua9fa-\ua9fe\uaa00-\uaa28\uaa40-\uaa42\uaa44-\uaa4b\uaa60-\uaa76\uaa7a\uaa7e-\uaaaf\uaab1\uaab5\uaab6\uaab9-\uaabd\uaac0\uaac2\uaadb-\uaadd\uaae0-\uaaea\uaaf2-\uaaf4\uab01-\uab06\uab09-\uab0e\uab11-\uab16\uab20-\uab26\uab28-\uab2e\uab30-\uab5a\uab5c-\uab69\uab70-\uabe2\uac00-\ud7a3\ud7b0-\ud7c6\ud7cb-\ud7fb\uf900-\ufa6d\ufa70-\ufad9\ufb00-\ufb06\ufb13-\ufb17\ufb1d\ufb1f-\ufb28\ufb2a-\ufb36\ufb38-\ufb3c\ufb3e\ufb40\ufb41\ufb43\ufb44\ufb46-\ufbb1\ufbd3-\ufd3d\ufd50-\ufd8f\ufd92-\ufdc7\ufdf0-\ufdfb\ufe70-\ufe74\ufe76-\ufefc\uff21-\uff3a\uff41-\uff5a\uff66-\uffbe\uffc2-\uffc7\uffca-\uffcf\uffd2-\uffd7\uffda-\uffdc"
+let nonASCIIidentifierChars = "\u200c\u200d\xb7\u0300-\u036f\u0387\u0483-\u0487\u0591-\u05bd\u05bf\u05c1\u05c2\u05c4\u05c5\u05c7\u0610-\u061a\u064b-\u0669\u0670\u06d6-\u06dc\u06df-\u06e4\u06e7\u06e8\u06ea-\u06ed\u06f0-\u06f9\u0711\u0730-\u074a\u07a6-\u07b0\u07c0-\u07c9\u07eb-\u07f3\u07fd\u0816-\u0819\u081b-\u0823\u0825-\u0827\u0829-\u082d\u0859-\u085b\u08d3-\u08e1\u08e3-\u0903\u093a-\u093c\u093e-\u094f\u0951-\u0957\u0962\u0963\u0966-\u096f\u0981-\u0983\u09bc\u09be-\u09c4\u09c7\u09c8\u09cb-\u09cd\u09d7\u09e2\u09e3\u09e6-\u09ef\u09fe\u0a01-\u0a03\u0a3c\u0a3e-\u0a42\u0a47\u0a48\u0a4b-\u0a4d\u0a51\u0a66-\u0a71\u0a75\u0a81-\u0a83\u0abc\u0abe-\u0ac5\u0ac7-\u0ac9\u0acb-\u0acd\u0ae2\u0ae3\u0ae6-\u0aef\u0afa-\u0aff\u0b01-\u0b03\u0b3c\u0b3e-\u0b44\u0b47\u0b48\u0b4b-\u0b4d\u0b55-\u0b57\u0b62\u0b63\u0b66-\u0b6f\u0b82\u0bbe-\u0bc2\u0bc6-\u0bc8\u0bca-\u0bcd\u0bd7\u0be6-\u0bef\u0c00-\u0c04\u0c3e-\u0c44\u0c46-\u0c48\u0c4a-\u0c4d\u0c55\u0c56\u0c62\u0c63\u0c66-\u0c6f\u0c81-\u0c83\u0cbc\u0cbe-\u0cc4\u0cc6-\u0cc8\u0cca-\u0ccd\u0cd5\u0cd6\u0ce2\u0ce3\u0ce6-\u0cef\u0d00-\u0d03\u0d3b\u0d3c\u0d3e-\u0d44\u0d46-\u0d48\u0d4a-\u0d4d\u0d57\u0d62\u0d63\u0d66-\u0d6f\u0d81-\u0d83\u0dca\u0dcf-\u0dd4\u0dd6\u0dd8-\u0ddf\u0de6-\u0def\u0df2\u0df3\u0e31\u0e34-\u0e3a\u0e47-\u0e4e\u0e50-\u0e59\u0eb1\u0eb4-\u0ebc\u0ec8-\u0ecd\u0ed0-\u0ed9\u0f18\u0f19\u0f20-\u0f29\u0f35\u0f37\u0f39\u0f3e\u0f3f\u0f71-\u0f84\u0f86\u0f87\u0f8d-\u0f97\u0f99-\u0fbc\u0fc6\u102b-\u103e\u1040-\u1049\u1056-\u1059\u105e-\u1060\u1062-\u1064\u1067-\u106d\u1071-\u1074\u1082-\u108d\u108f-\u109d\u135d-\u135f\u1369-\u1371\u1712-\u1714\u1732-\u1734\u1752\u1753\u1772\u1773\u17b4-\u17d3\u17dd\u17e0-\u17e9\u180b-\u180d\u1810-\u1819\u18a9\u1920-\u192b\u1930-\u193b\u1946-\u194f\u19d0-\u19da\u1a17-\u1a1b\u1a55-\u1a5e\u1a60-\u1a7c\u1a7f-\u1a89\u1a90-\u1a99\u1ab0-\u1abd\u1abf\u1ac0\u1b00-\u1b04\u1b34-\u1b44\u1b50-\u1b59\u1b6b-\u1b73\u1b80-\u1b82\u1ba1-\u1bad\u1bb0-\u1bb9\u1be6-\u1bf3\u1c24-\u1c37\u1c40-\u1c49\u1c50-\u1c59\u1cd0-\u1cd2\u1cd4-\u1ce8\u1ced\u1cf4\u1cf7-\u1cf9\u1dc0-\u1df9\u1dfb-\u1dff\u203f\u2040\u2054\u20d0-\u20dc\u20e1\u20e5-\u20f0\u2cef-\u2cf1\u2d7f\u2de0-\u2dff\u302a-\u302f\u3099\u309a\ua620-\ua629\ua66f\ua674-\ua67d\ua69e\ua69f\ua6f0\ua6f1\ua802\ua806\ua80b\ua823-\ua827\ua82c\ua880\ua881\ua8b4-\ua8c5\ua8d0-\ua8d9\ua8e0-\ua8f1\ua8ff-\ua909\ua926-\ua92d\ua947-\ua953\ua980-\ua983\ua9b3-\ua9c0\ua9d0-\ua9d9\ua9e5\ua9f0-\ua9f9\uaa29-\uaa36\uaa43\uaa4c\uaa4d\uaa50-\uaa59\uaa7b-\uaa7d\uaab0\uaab2-\uaab4\uaab7\uaab8\uaabe\uaabf\uaac1\uaaeb-\uaaef\uaaf5\uaaf6\uabe3-\uabea\uabec\uabed\uabf0-\uabf9\ufb1e\ufe00-\ufe0f\ufe20-\ufe2f\ufe33\ufe34\ufe4d-\ufe4f\uff10-\uff19\uff3f"
+
+const nonASCIIidentifierStart = new RegExp("[" + nonASCIIidentifierStartChars + "]")
+const nonASCIIidentifier = new RegExp("[" + nonASCIIidentifierStartChars + nonASCIIidentifierChars + "]")
+
+nonASCIIidentifierStartChars = nonASCIIidentifierChars = null
+
+// These are a run-length and offset encoded representation of the
+// >0xffff code points that are a valid part of identifiers. The
+// offset starts at 0x10000, and each pair of numbers represents an
+// offset to the next range, and then a size of the range. They were
+// generated by bin/generate-identifier-regex.js
+
+// eslint-disable-next-line comma-spacing
+const astralIdentifierStartCodes = [0,11,2,25,2,18,2,1,2,14,3,13,35,122,70,52,268,28,4,48,48,31,14,29,6,37,11,29,3,35,5,7,2,4,43,157,19,35,5,35,5,39,9,51,157,310,10,21,11,7,153,5,3,0,2,43,2,1,4,0,3,22,11,22,10,30,66,18,2,1,11,21,11,25,71,55,7,1,65,0,16,3,2,2,2,28,43,28,4,28,36,7,2,27,28,53,11,21,11,18,14,17,111,72,56,50,14,50,14,35,349,41,7,1,79,28,11,0,9,21,107,20,28,22,13,52,76,44,33,24,27,35,30,0,3,0,9,34,4,0,13,47,15,3,22,0,2,0,36,17,2,24,85,6,2,0,2,3,2,14,2,9,8,46,39,7,3,1,3,21,2,6,2,1,2,4,4,0,19,0,13,4,159,52,19,3,21,2,31,47,21,1,2,0,185,46,42,3,37,47,21,0,60,42,14,0,72,26,230,43,117,63,32,7,3,0,3,7,2,1,2,23,16,0,2,0,95,7,3,38,17,0,2,0,29,0,11,39,8,0,22,0,12,45,20,0,35,56,264,8,2,36,18,0,50,29,113,6,2,1,2,37,22,0,26,5,2,1,2,31,15,0,328,18,190,0,80,921,103,110,18,195,2749,1070,4050,582,8634,568,8,30,114,29,19,47,17,3,32,20,6,18,689,63,129,74,6,0,67,12,65,1,2,0,29,6135,9,1237,43,8,8952,286,50,2,18,3,9,395,2309,106,6,12,4,8,8,9,5991,84,2,70,2,1,3,0,3,1,3,3,2,11,2,0,2,6,2,64,2,3,3,7,2,6,2,27,2,3,2,4,2,0,4,6,2,339,3,24,2,24,2,30,2,24,2,30,2,24,2,30,2,24,2,30,2,24,2,7,2357,44,11,6,17,0,370,43,1301,196,60,67,8,0,1205,3,2,26,2,1,2,0,3,0,2,9,2,3,2,0,2,0,7,0,5,0,2,0,2,0,2,2,2,1,2,0,3,0,2,0,2,0,2,0,2,0,2,1,2,0,3,3,2,6,2,3,2,3,2,0,2,9,2,16,6,2,2,4,2,16,4421,42717,35,4148,12,221,3,5761,15,7472,3104,541,1507,4938]
+
+// eslint-disable-next-line comma-spacing
+const astralIdentifierCodes = [509,0,227,0,150,4,294,9,1368,2,2,1,6,3,41,2,5,0,166,1,574,3,9,9,370,1,154,10,176,2,54,14,32,9,16,3,46,10,54,9,7,2,37,13,2,9,6,1,45,0,13,2,49,13,9,3,2,11,83,11,7,0,161,11,6,9,7,3,56,1,2,6,3,1,3,2,10,0,11,1,3,6,4,4,193,17,10,9,5,0,82,19,13,9,214,6,3,8,28,1,83,16,16,9,82,12,9,9,84,14,5,9,243,14,166,9,71,5,2,1,3,3,2,0,2,1,13,9,120,6,3,6,4,0,29,9,41,6,2,3,9,0,10,10,47,15,406,7,2,7,17,9,57,21,2,13,123,5,4,0,2,1,2,6,2,0,9,9,49,4,2,1,2,4,9,9,330,3,19306,9,135,4,60,6,26,9,1014,0,2,54,8,3,82,0,12,1,19628,1,5319,4,4,5,9,7,3,6,31,3,149,2,1418,49,513,54,5,49,9,0,15,0,23,4,2,14,1361,6,2,16,3,6,2,1,2,4,262,6,10,9,419,13,1495,6,110,6,6,9,4759,9,787719,239]
+
+// This has a complexity linear to the value of the code. The
+// assumption is that looking up astral identifier characters is
+// rare.
+function isInAstralSet(code, set) {
+  let pos = 0x10000
+  for (let i = 0; i < set.length; i += 2) {
+    pos += set[i]
+    if (pos > code) return false
+    pos += set[i + 1]
+    if (pos >= code) return true
+  }
+}
+
+// Test whether a given character code starts an identifier.
+
+function isIdentifierStart(code, astral) {
+  if (code < 65) return code === 36
+  if (code < 91) return true
+  if (code < 97) return code === 95
+  if (code < 123) return true
+  if (code <= 0xffff) return code >= 0xaa && nonASCIIidentifierStart.test(String.fromCharCode(code))
+  if (astral === false) return false
+  return isInAstralSet(code, astralIdentifierStartCodes)
+}
+
+// Test whether a given character is part of an identifier.
+
+function isIdentifierChar(code, astral) {
+  if (code < 48) return code === 36
+  if (code < 58) return true
+  if (code < 65) return false
+  if (code < 91) return true
+  if (code < 97) return code === 95
+  if (code < 123) return true
+  if (code <= 0xffff) return code >= 0xaa && nonASCIIidentifier.test(String.fromCharCode(code))
+  if (astral === false) return false
+  return isInAstralSet(code, astralIdentifierStartCodes) || isInAstralSet(code, astralIdentifierCodes)
+}
+
+function identifier () {
+  let ch = source.codePointAt(pos);
+  if (!isIdentifierStart(ch, true) || ch === '\\')
+    return false;
+  pos += codePointLen(ch);
+  while (ch = source.codePointAt(pos)) {
+    if (isIdentifierChar(ch, true)) {
+      pos += codePointLen(ch);
+    }
+    else if (ch === '\\') {
+      // no identifier escapes support for now
+      return false;
+    }
+    else {
+      break;
+    }
+  }
+  return true;
+}
+
+function codePointLen (ch) {
+  if (ch < 0x10000) return 1;
+  return 2;
+}
+
+function codePointAtLast (bPos) {
+  // Gives the UTF char for backtracking surrogates
+  const ch = source.charCodeAt(bPos);
+  if ((ch & 0xFC00) === 0xDC00)
+    return (((source.charCodeAt(bPos - 1) & 0x3FF) << 10) | (ch & 0x3FF)) + 0x10000;
+  return ch;
+}
+
+function esmSyntaxErr (msg) {
+  return Object.assign(new Error(msg), { code: 'ERR_LEXER_ESM_SYNTAX' });
+}
+
+function throwIfImportStatement () {
+  const startPos = pos;
+  pos += 6;
+  const ch = commentWhitespace();
+  switch (ch) {
+    // dynamic import
+    case 40/*(*/:
+      openTokenPosStack[openTokenDepth++] = startPos;
+      return;
+    // import.meta
+    case 46/*.*/:
+      throw esmSyntaxErr('Unexpected import.meta in CJS module.');
+
+    default:
+      // no space after "import" -> not an import keyword
+      if (pos === startPos + 6)
+        break;
+    case 34/*"*/:
+    case 39/*'*/:
+    case 123/*{*/:
+    case 42/***/:
+      // import statement only permitted at base-level
+      if (openTokenDepth !== 0) {
+        pos--;
+        return;
+      }
+      // import statements are a syntax error in CommonJS
+      throw esmSyntaxErr('Unexpected import statement in CJS module.');
+  }
+}
+
+function throwIfExportStatement () {
+  pos += 6;
+  const curPos = pos;
+  const ch = commentWhitespace();
+  if (pos === curPos && !isPunctuator(ch))
+    return;
+  throw esmSyntaxErr('Unexpected export statement in CJS module.');
+}
+
+function commentWhitespace () {
+  let ch;
+  do {
+    ch = source.charCodeAt(pos);
+    if (ch === 47/*/*/) {
+      const next_ch = source.charCodeAt(pos + 1);
+      if (next_ch === 47/*/*/)
+        lineComment();
+      else if (next_ch === 42/***/)
+        blockComment();
+      else
+        return ch;
+    }
+    else if (!isBrOrWs(ch)) {
+      return ch;
+    }
+  } while (pos++ < end);
+  return ch;
+}
+
+function templateString () {
+  while (pos++ < end) {
+    const ch = source.charCodeAt(pos);
+    if (ch === 36/*$*/ && source.charCodeAt(pos + 1) === 123/*{*/) {
+      pos++;
+      templateStack[templateStackDepth++] = templateDepth;
+      templateDepth = ++openTokenDepth;
+      return;
+    }
+    if (ch === 96/*`*/)
+      return;
+    if (ch === 92/*\*/)
+      pos++;
+  }
+  syntaxError();
+}
+
+function blockComment () {
+  pos++;
+  while (pos++ < end) {
+    const ch = source.charCodeAt(pos);
+    if (ch === 42/***/ && source.charCodeAt(pos + 1) === 47/*/*/) {
+      pos++;
+      return;
+    }
+  }
+}
+
+function lineComment () {
+  while (pos++ < end) {
+    const ch = source.charCodeAt(pos);
+    if (ch === 10/*\n*/ || ch === 13/*\r*/)
+      return;
+  }
+}
+
+function stringLiteral (quote) {
+  while (pos++ < end) {
+    let ch = source.charCodeAt(pos);
+    if (ch === quote)
+      return;
+    if (ch === 92/*\*/) {
+      ch = source.charCodeAt(++pos);
+      if (ch === 13/*\r*/ && source.charCodeAt(pos + 1) === 10/*\n*/)
+        pos++;
+    }
+    else if (isBr(ch))
+      break;
+  }
+  throw new Error('Unterminated string.');
+}
+
+function regexCharacterClass () {
+  while (pos++ < end) {
+    let ch = source.charCodeAt(pos);
+    if (ch === 93/*]*/)
+      return ch;
+    if (ch === 92/*\*/)
+      pos++;
+    else if (ch === 10/*\n*/ || ch === 13/*\r*/)
+      break;
+  }
+  throw new Error('Syntax error reading regular expression class.');
+}
+
+function regularExpression () {
+  while (pos++ < end) {
+    let ch = source.charCodeAt(pos);
+    if (ch === 47/*/*/)
+      return;
+    if (ch === 91/*[*/)
+      ch = regexCharacterClass();
+    else if (ch === 92/*\*/)
+      pos++;
+    else if (ch === 10/*\n*/ || ch === 13/*\r*/)
+      break;
+  }
+  throw new Error('Syntax error reading regular expression.');
+}
+
+// Note: non-asii BR and whitespace checks omitted for perf / footprint
+// if there is a significant user need this can be reconsidered
+function isBr (c) {
+  return c === 13/*\r*/ || c === 10/*\n*/;
+}
+
+function isBrOrWs (c) {
+  return c > 8 && c < 14 || c === 32 || c === 160;
+}
+
+function isBrOrWsOrPunctuatorNotDot (c) {
+  return c > 8 && c < 14 || c === 32 || c === 160 || isPunctuator(c) && c !== 46/*.*/;
+}
+
+function keywordStart (pos) {
+  return pos === 0 || isBrOrWsOrPunctuatorNotDot(source.charCodeAt(pos - 1));
+}
+
+function readPrecedingKeyword (pos, match) {
+  if (pos < match.length - 1)
+    return false;
+  return source.startsWith(match, pos - match.length + 1) && (pos === 0 || isBrOrWsOrPunctuatorNotDot(source.charCodeAt(pos - match.length)));
+}
+
+function readPrecedingKeyword1 (pos, ch) {
+  return source.charCodeAt(pos) === ch && (pos === 0 || isBrOrWsOrPunctuatorNotDot(source.charCodeAt(pos - 1)));
+}
+
+// Detects one of case, debugger, delete, do, else, in, instanceof, new,
+//   return, throw, typeof, void, yield, await
+function isExpressionKeyword (pos) {
+  switch (source.charCodeAt(pos)) {
+    case 100/*d*/:
+      switch (source.charCodeAt(pos - 1)) {
+        case 105/*i*/:
+          // void
+          return readPrecedingKeyword(pos - 2, 'vo');
+        case 108/*l*/:
+          // yield
+          return readPrecedingKeyword(pos - 2, 'yie');
+        default:
+          return false;
+      }
+    case 101/*e*/:
+      switch (source.charCodeAt(pos - 1)) {
+        case 115/*s*/:
+          switch (source.charCodeAt(pos - 2)) {
+            case 108/*l*/:
+              // else
+              return readPrecedingKeyword1(pos - 3, 101/*e*/);
+            case 97/*a*/:
+              // case
+              return readPrecedingKeyword1(pos - 3, 99/*c*/);
+            default:
+              return false;
+          }
+        case 116/*t*/:
+          // delete
+          return readPrecedingKeyword(pos - 2, 'dele');
+        default:
+          return false;
+      }
+    case 102/*f*/:
+      if (source.charCodeAt(pos - 1) !== 111/*o*/ || source.charCodeAt(pos - 2) !== 101/*e*/)
+        return false;
+      switch (source.charCodeAt(pos - 3)) {
+        case 99/*c*/:
+          // instanceof
+          return readPrecedingKeyword(pos - 4, 'instan');
+        case 112/*p*/:
+          // typeof
+          return readPrecedingKeyword(pos - 4, 'ty');
+        default:
+          return false;
+      }
+    case 110/*n*/:
+      // in, return
+      return readPrecedingKeyword1(pos - 1, 105/*i*/) || readPrecedingKeyword(pos - 1, 'retur');
+    case 111/*o*/:
+      // do
+      return readPrecedingKeyword1(pos - 1, 100/*d*/);
+    case 114/*r*/:
+      // debugger
+      return readPrecedingKeyword(pos - 1, 'debugge');
+    case 116/*t*/:
+      // await
+      return readPrecedingKeyword(pos - 1, 'awai');
+    case 119/*w*/:
+      switch (source.charCodeAt(pos - 1)) {
+        case 101/*e*/:
+          // new
+          return readPrecedingKeyword1(pos - 2, 110/*n*/);
+        case 111/*o*/:
+          // throw
+          return readPrecedingKeyword(pos - 2, 'thr');
+        default:
+          return false;
+      }
+  }
+  return false;
+}
+
+function isParenKeyword (curPos) {
+  return source.charCodeAt(curPos) === 101/*e*/ && source.startsWith('whil', curPos - 4) ||
+      source.charCodeAt(curPos) === 114/*r*/ && source.startsWith('fo', curPos - 2) ||
+      source.charCodeAt(curPos - 1) === 105/*i*/ && source.charCodeAt(curPos) === 102/*f*/;
+}
+
+function isPunctuator (ch) {
+  // 23 possible punctuator endings: !%&()*+,-./:;<=>?[]^{}|~
+  return ch === 33/*!*/ || ch === 37/*%*/ || ch === 38/*&*/ ||
+    ch > 39 && ch < 48 || ch > 57 && ch < 64 ||
+    ch === 91/*[*/ || ch === 93/*]*/ || ch === 94/*^*/ ||
+    ch > 122 && ch < 127;
+}
+
+function isExpressionPunctuator (ch) {
+  // 20 possible expression endings: !%&(*+,-.:;<=>?[^{|~
+  return ch === 33/*!*/ || ch === 37/*%*/ || ch === 38/*&*/ ||
+    ch > 39 && ch < 47 && ch !== 41 || ch > 57 && ch < 64 ||
+    ch === 91/*[*/ || ch === 94/*^*/ || ch > 122 && ch < 127 && ch !== 125/*}*/;
+}
+
+function isExpressionTerminator (curPos) {
+  // detects:
+  // => ; ) finally catch else
+  // as all of these followed by a { will indicate a statement brace
+  switch (source.charCodeAt(curPos)) {
+    case 62/*>*/:
+      return source.charCodeAt(curPos - 1) === 61/*=*/;
+    case 59/*;*/:
+    case 41/*)*/:
+      return true;
+    case 104/*h*/:
+      return source.startsWith('catc', curPos - 4);
+    case 121/*y*/:
+      return source.startsWith('finall', curPos - 6);
+    case 101/*e*/:
+      return source.startsWith('els', curPos - 3);
+  }
+  return false;
+}
+
+const initPromise = Promise.resolve();
+
+module.exports.init = () => initPromise;
+module.exports.initSync = () => {};
+module.exports.parse = parseCJS;
diff --git a/deps/cjs-module-lexer/src/lib/lexer.wasm b/deps/cjs-module-lexer/src/lib/lexer.wasm
new file mode 100755
index 00000000000..ae6ac5a0f43
Binary files /dev/null and b/deps/cjs-module-lexer/src/lib/lexer.wasm differ
diff --git a/deps/cjs-module-lexer/src/package-lock.json b/deps/cjs-module-lexer/src/package-lock.json
new file mode 100644
index 00000000000..e8de2e3e921
--- /dev/null
+++ b/deps/cjs-module-lexer/src/package-lock.json
@@ -0,0 +1,1901 @@
+{
+  "name": "cjs-module-lexer",
+  "version": "2.1.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "cjs-module-lexer",
+      "version": "2.1.0",
+      "license": "MIT",
+      "devDependencies": {
+        "@babel/cli": "^7.5.5",
+        "@babel/core": "^7.5.5",
+        "@babel/plugin-transform-modules-commonjs": "^7.5.0",
+        "cross-env": "^7.0.3",
+        "kleur": "^2.0.2",
+        "mocha": "^9.1.3",
+        "terser": "^4.1.4"
+      }
+    },
+    "node_modules/@ampproject/remapping": {
+      "version": "2.2.1",
+      "resolved": "https://registry.npmjs.org/@ampproject/remapping/-/remapping-2.2.1.tgz",
+      "integrity": "sha512-lFMjJTrFL3j7L9yBxwYfCq2k6qqwHyzuUl/XBnif78PWTJYyL/dfowQHWE3sp6U6ZzqWiiIZnpTMO96zhkjwtg==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/gen-mapping": "^0.3.0",
+        "@jridgewell/trace-mapping": "^0.3.9"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/cli": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/cli/-/cli-7.22.5.tgz",
+      "integrity": "sha512-N5d7MjzwsQ2wppwjhrsicVDhJSqF9labEP/swYiHhio4Ca2XjEehpgPmerjnLQl7BPE59BLud0PTWGYwqFl/cQ==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/trace-mapping": "^0.3.17",
+        "commander": "^4.0.1",
+        "convert-source-map": "^1.1.0",
+        "fs-readdir-recursive": "^1.1.0",
+        "glob": "^7.2.0",
+        "make-dir": "^2.1.0",
+        "slash": "^2.0.0"
+      },
+      "bin": {
+        "babel": "bin/babel.js",
+        "babel-external-helpers": "bin/babel-external-helpers.js"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "optionalDependencies": {
+        "@nicolo-ribaudo/chokidar-2": "2.1.8-no-fsevents.3",
+        "chokidar": "^3.4.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/code-frame": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/code-frame/-/code-frame-7.22.5.tgz",
+      "integrity": "sha512-Xmwn266vad+6DAqEB2A6V/CcZVp62BbwVmcOJc2RPuwih1kw02TjQvWVWlcKGbBPd+8/0V5DEkOcizRGYsspYQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/highlight": "^7.22.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/compat-data": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/compat-data/-/compat-data-7.22.5.tgz",
+      "integrity": "sha512-4Jc/YuIaYqKnDDz892kPIledykKg12Aw1PYX5i/TY28anJtacvM1Rrr8wbieB9GfEJwlzqT0hUEao0CxEebiDA==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/core": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/core/-/core-7.22.5.tgz",
+      "integrity": "sha512-SBuTAjg91A3eKOvD+bPEz3LlhHZRNu1nFOVts9lzDJTXshHTjII0BAtDS3Y2DAkdZdDKWVZGVwkDfc4Clxn1dg==",
+      "dev": true,
+      "dependencies": {
+        "@ampproject/remapping": "^2.2.0",
+        "@babel/code-frame": "^7.22.5",
+        "@babel/generator": "^7.22.5",
+        "@babel/helper-compilation-targets": "^7.22.5",
+        "@babel/helper-module-transforms": "^7.22.5",
+        "@babel/helpers": "^7.22.5",
+        "@babel/parser": "^7.22.5",
+        "@babel/template": "^7.22.5",
+        "@babel/traverse": "^7.22.5",
+        "@babel/types": "^7.22.5",
+        "convert-source-map": "^1.7.0",
+        "debug": "^4.1.0",
+        "gensync": "^1.0.0-beta.2",
+        "json5": "^2.2.2",
+        "semver": "^6.3.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/babel"
+      }
+    },
+    "node_modules/@babel/generator": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/generator/-/generator-7.22.5.tgz",
+      "integrity": "sha512-+lcUbnTRhd0jOewtFSedLyiPsD5tswKkbgcezOqqWFUVNEwoUTlpPOBmvhG7OXWLR4jMdv0czPGH5XbflnD1EA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.22.5",
+        "@jridgewell/gen-mapping": "^0.3.2",
+        "@jridgewell/trace-mapping": "^0.3.17",
+        "jsesc": "^2.5.1"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-compilation-targets": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-compilation-targets/-/helper-compilation-targets-7.22.5.tgz",
+      "integrity": "sha512-Ji+ywpHeuqxB8WDxraCiqR0xfhYjiDE/e6k7FuIaANnoOFxAHskHChz4vA1mJC9Lbm01s1PVAGhQY4FUKSkGZw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/compat-data": "^7.22.5",
+        "@babel/helper-validator-option": "^7.22.5",
+        "browserslist": "^4.21.3",
+        "lru-cache": "^5.1.1",
+        "semver": "^6.3.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0"
+      }
+    },
+    "node_modules/@babel/helper-environment-visitor": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-environment-visitor/-/helper-environment-visitor-7.22.5.tgz",
+      "integrity": "sha512-XGmhECfVA/5sAt+H+xpSg0mfrHq6FzNr9Oxh7PSEBBRUb/mL7Kz3NICXb194rCqAEdxkhPT1a88teizAFyvk8Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-function-name": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-function-name/-/helper-function-name-7.22.5.tgz",
+      "integrity": "sha512-wtHSq6jMRE3uF2otvfuD3DIvVhOsSNshQl0Qrd7qC9oQJzHvOL4qQXlQn2916+CXGywIjpGuIkoyZRRxHPiNQQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/template": "^7.22.5",
+        "@babel/types": "^7.22.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-hoist-variables": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-hoist-variables/-/helper-hoist-variables-7.22.5.tgz",
+      "integrity": "sha512-wGjk9QZVzvknA6yKIUURb8zY3grXCcOZt+/7Wcy8O2uctxhplmUPkOdlgoNhmdVee2c92JXbf1xpMtVNbfoxRw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.22.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-imports": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-imports/-/helper-module-imports-7.22.5.tgz",
+      "integrity": "sha512-8Dl6+HD/cKifutF5qGd/8ZJi84QeAKh+CEe1sBzz8UayBBGg1dAIJrdHOcOM5b2MpzWL2yuotJTtGjETq0qjXg==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.22.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-module-transforms": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-module-transforms/-/helper-module-transforms-7.22.5.tgz",
+      "integrity": "sha512-+hGKDt/Ze8GFExiVHno/2dvG5IdstpzCq0y4Qc9OJ25D4q3pKfiIP/4Vp3/JvhDkLKsDK2api3q3fpIgiIF5bw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-environment-visitor": "^7.22.5",
+        "@babel/helper-module-imports": "^7.22.5",
+        "@babel/helper-simple-access": "^7.22.5",
+        "@babel/helper-split-export-declaration": "^7.22.5",
+        "@babel/helper-validator-identifier": "^7.22.5",
+        "@babel/template": "^7.22.5",
+        "@babel/traverse": "^7.22.5",
+        "@babel/types": "^7.22.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-plugin-utils": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-plugin-utils/-/helper-plugin-utils-7.22.5.tgz",
+      "integrity": "sha512-uLls06UVKgFG9QD4OeFYLEGteMIAa5kpTPcFL28yuCIIzsf6ZyKZMllKVOCZFhiZ5ptnwX4mtKdWCBE/uT4amg==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-simple-access": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-simple-access/-/helper-simple-access-7.22.5.tgz",
+      "integrity": "sha512-n0H99E/K+Bika3++WNL17POvo4rKWZ7lZEp1Q+fStVbUi8nxPQEBOlTmCOxW/0JsS56SKKQ+ojAe2pHKJHN35w==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.22.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-split-export-declaration": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-split-export-declaration/-/helper-split-export-declaration-7.22.5.tgz",
+      "integrity": "sha512-thqK5QFghPKWLhAV321lxF95yCg2K3Ob5yw+M3VHWfdia0IkPXUtoLH8x/6Fh486QUvzhb8YOWHChTVen2/PoQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/types": "^7.22.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-string-parser": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-string-parser/-/helper-string-parser-7.22.5.tgz",
+      "integrity": "sha512-mM4COjgZox8U+JcXQwPijIZLElkgEpO5rsERVDJTc2qfCDfERyob6k5WegS14SX18IIjv+XD+GrqNumY5JRCDw==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-identifier": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-identifier/-/helper-validator-identifier-7.22.5.tgz",
+      "integrity": "sha512-aJXu+6lErq8ltp+JhkJUfk1MTGyuA4v7f3pA+BJ5HLfNC6nAQ0Cpi9uOquUj8Hehg0aUiHzWQbOVJGao6ztBAQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helper-validator-option": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/helper-validator-option/-/helper-validator-option-7.22.5.tgz",
+      "integrity": "sha512-R3oB6xlIVKUnxNUxbmgq7pKjxpru24zlimpE8WK47fACIlM0II/Hm1RS8IaOI7NgCr6LNS+jl5l75m20npAziw==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/helpers": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/helpers/-/helpers-7.22.5.tgz",
+      "integrity": "sha512-pSXRmfE1vzcUIDFQcSGA5Mr+GxBV9oiRKDuDxXvWQQBCh8HoIjs/2DlDB7H8smac1IVrB9/xdXj2N3Wol9Cr+Q==",
+      "dev": true,
+      "dependencies": {
+        "@babel/template": "^7.22.5",
+        "@babel/traverse": "^7.22.5",
+        "@babel/types": "^7.22.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/highlight": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/highlight/-/highlight-7.22.5.tgz",
+      "integrity": "sha512-BSKlD1hgnedS5XRnGOljZawtag7H1yPfQp0tdNJCHoH6AZ+Pcm9VvkrK59/Yy593Ypg0zMxH2BxD1VPYUQ7UIw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-validator-identifier": "^7.22.5",
+        "chalk": "^2.0.0",
+        "js-tokens": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/parser": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/parser/-/parser-7.22.5.tgz",
+      "integrity": "sha512-DFZMC9LJUG9PLOclRC32G63UXwzqS2koQC8dkx+PLdmt1xSePYpbT/NbsrJy8Q/muXz7o/h/d4A7Fuyixm559Q==",
+      "dev": true,
+      "bin": {
+        "parser": "bin/babel-parser.js"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@babel/plugin-transform-modules-commonjs": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/plugin-transform-modules-commonjs/-/plugin-transform-modules-commonjs-7.22.5.tgz",
+      "integrity": "sha512-B4pzOXj+ONRmuaQTg05b3y/4DuFz3WcCNAXPLb2Q0GT0TrGKGxNKV4jwsXts+StaM0LQczZbOpj8o1DLPDJIiA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-module-transforms": "^7.22.5",
+        "@babel/helper-plugin-utils": "^7.22.5",
+        "@babel/helper-simple-access": "^7.22.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      },
+      "peerDependencies": {
+        "@babel/core": "^7.0.0-0"
+      }
+    },
+    "node_modules/@babel/template": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/template/-/template-7.22.5.tgz",
+      "integrity": "sha512-X7yV7eiwAxdj9k94NEylvbVHLiVG1nvzCV2EAowhxLTwODV1jl9UzZ48leOC0sH7OnuHrIkllaBgneUykIcZaw==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.22.5",
+        "@babel/parser": "^7.22.5",
+        "@babel/types": "^7.22.5"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/traverse": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/traverse/-/traverse-7.22.5.tgz",
+      "integrity": "sha512-7DuIjPgERaNo6r+PZwItpjCZEa5vyw4eJGufeLxrPdBXBoLcCJCIasvK6pK/9DVNrLZTLFhUGqaC6X/PA007TQ==",
+      "dev": true,
+      "dependencies": {
+        "@babel/code-frame": "^7.22.5",
+        "@babel/generator": "^7.22.5",
+        "@babel/helper-environment-visitor": "^7.22.5",
+        "@babel/helper-function-name": "^7.22.5",
+        "@babel/helper-hoist-variables": "^7.22.5",
+        "@babel/helper-split-export-declaration": "^7.22.5",
+        "@babel/parser": "^7.22.5",
+        "@babel/types": "^7.22.5",
+        "debug": "^4.1.0",
+        "globals": "^11.1.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@babel/types": {
+      "version": "7.22.5",
+      "resolved": "https://registry.npmjs.org/@babel/types/-/types-7.22.5.tgz",
+      "integrity": "sha512-zo3MIHGOkPOfoRXitsgHLjEXmlDaD/5KU1Uzuc9GNiZPhSqVxVRtxuPaSBZDsYZ9qV88AjtMtWW7ww98loJ9KA==",
+      "dev": true,
+      "dependencies": {
+        "@babel/helper-string-parser": "^7.22.5",
+        "@babel/helper-validator-identifier": "^7.22.5",
+        "to-fast-properties": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/@jridgewell/gen-mapping": {
+      "version": "0.3.3",
+      "resolved": "https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.3.tgz",
+      "integrity": "sha512-HLhSWOLRi875zjjMG/r+Nv0oCW8umGb0BgEhyX3dDX3egwZtB8PqLnjz3yedt8R5StBrzcg4aBpnh8UA9D1BoQ==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/set-array": "^1.0.1",
+        "@jridgewell/sourcemap-codec": "^1.4.10",
+        "@jridgewell/trace-mapping": "^0.3.9"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/resolve-uri": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.0.tgz",
+      "integrity": "sha512-F2msla3tad+Mfht5cJq7LSXcdudKTWCVYUgw6pLFOOHSTtZlj6SWNYAp+AhuqLmWdBO2X5hPrLcu8cVP8fy28w==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/set-array": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.1.2.tgz",
+      "integrity": "sha512-xnkseuNADM0gt2bs+BvhO0p78Mk762YnZdsuzFV018NoG1Sj1SCQvpSqa7XUaTam5vAGasABV9qXASMKnFMwMw==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.4.15",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.15.tgz",
+      "integrity": "sha512-eF2rxCRulEKXHTRiDrDy6erMYWqNw4LPdQ8UQA4huuxaQsVeRPFl2oM8oDGxMFhJUWZf9McpLtJasDDZb/Bpeg==",
+      "dev": true
+    },
+    "node_modules/@jridgewell/trace-mapping": {
+      "version": "0.3.18",
+      "resolved": "https://registry.npmjs.org/@jridgewell/trace-mapping/-/trace-mapping-0.3.18.tgz",
+      "integrity": "sha512-w+niJYzMHdd7USdiH2U6869nqhD2nbfZXND5Yp93qIbEmnDNk7PD48o+YchRVpzMU7M6jVCbenTR7PA1FLQ9pA==",
+      "dev": true,
+      "dependencies": {
+        "@jridgewell/resolve-uri": "3.1.0",
+        "@jridgewell/sourcemap-codec": "1.4.14"
+      }
+    },
+    "node_modules/@jridgewell/trace-mapping/node_modules/@jridgewell/sourcemap-codec": {
+      "version": "1.4.14",
+      "resolved": "https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.4.14.tgz",
+      "integrity": "sha512-XPSJHWmi394fuUuzDnGz1wiKqWfo1yXecHQMRf2l6hztTO+nPru658AyDngaBe7isIxEkRsPR3FZh+s7iVa4Uw==",
+      "dev": true
+    },
+    "node_modules/@nicolo-ribaudo/chokidar-2": {
+      "version": "2.1.8-no-fsevents.3",
+      "resolved": "https://registry.npmjs.org/@nicolo-ribaudo/chokidar-2/-/chokidar-2-2.1.8-no-fsevents.3.tgz",
+      "integrity": "sha512-s88O1aVtXftvp5bCPB7WnmXc5IwOZZ7YPuwNPt+GtOOXpPvad1LfbmjYv+qII7zP6RU2QGnqve27dnLycEnyEQ==",
+      "dev": true,
+      "optional": true
+    },
+    "node_modules/@ungap/promise-all-settled": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/@ungap/promise-all-settled/-/promise-all-settled-1.1.2.tgz",
+      "integrity": "sha512-sL/cEvJWAnClXw0wHk85/2L0G6Sj8UB0Ctc1TEMbKSsmpRosqhwj9gWgFRZSrBr2f9tiXISwNhCPmlfqUqyb9Q==",
+      "dev": true
+    },
+    "node_modules/ansi-colors": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/ansi-colors/-/ansi-colors-4.1.1.tgz",
+      "integrity": "sha512-JoX0apGbHaUJBNl6yF+p6JAFYZ666/hhCGKN5t9QFjbJQKUU/g8MNbFDbvfrgKXvI1QpZplPOnwIo99lX/AAmA==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/ansi-regex": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.1.tgz",
+      "integrity": "sha512-quJQXlTSUGL2LH9SUXo8VwsY4soanhgo6LNSm84E1LBcE8s3O0wpdiRzyR9z/ZZJMlMWv37qOOb9pdJlMUEKFQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/ansi-styles": {
+      "version": "3.2.1",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-3.2.1.tgz",
+      "integrity": "sha512-VT0ZI6kZRdTh8YyJw3SMbYm/u+NqfsAxEpWO0Pf9sq8/e94WxxOpPKx9FR1FlyCtOVDNOQ+8ntlqFxiRc+r5qA==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^1.9.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/anymatch": {
+      "version": "3.1.3",
+      "resolved": "https://registry.npmjs.org/anymatch/-/anymatch-3.1.3.tgz",
+      "integrity": "sha512-KMReFUr0B4t+D+OBkjR3KYqvocp2XaSzO55UcB6mgQMd3KbcE+mWTyvVV7D/zsdEbNnV6acZUutkiHQXvTr1Rw==",
+      "dev": true,
+      "dependencies": {
+        "normalize-path": "^3.0.0",
+        "picomatch": "^2.0.4"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/argparse": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/argparse/-/argparse-2.0.1.tgz",
+      "integrity": "sha512-8+9WqebbFzpX9OR+Wa6O29asIogeRMzcGtAINdpMHHyAg10f05aSFVBbcEqGf/PXw1EjAZ+q2/bEBg3DvurK3Q==",
+      "dev": true
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "dev": true
+    },
+    "node_modules/binary-extensions": {
+      "version": "2.2.0",
+      "resolved": "https://registry.npmjs.org/binary-extensions/-/binary-extensions-2.2.0.tgz",
+      "integrity": "sha512-jDctJ/IVQbZoJykoeHbhXpOlNBqGNcwXJKJog42E5HDPUwQTSdjCHdihjj0DlnheQ7blbT6dHOafNAiS8ooQKA==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/brace-expansion": {
+      "version": "1.1.11",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.11.tgz",
+      "integrity": "sha512-iCuPHDFgrHX7H2vEI/5xpz07zSHB00TpugqhmYtVmMO6518mCuRMoOYFldEBl0g187ufozdaHgWKcYFb61qGiA==",
+      "dev": true,
+      "dependencies": {
+        "balanced-match": "^1.0.0",
+        "concat-map": "0.0.1"
+      }
+    },
+    "node_modules/braces": {
+      "version": "3.0.2",
+      "resolved": "https://registry.npmjs.org/braces/-/braces-3.0.2.tgz",
+      "integrity": "sha512-b8um+L1RzM3WDSzvhm6gIz1yfTbBt6YTlcEKAvsmqCZZFw46z626lVj9j1yEPW33H5H+lBQpZMP1k8l+78Ha0A==",
+      "dev": true,
+      "dependencies": {
+        "fill-range": "^7.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/browser-stdout": {
+      "version": "1.3.1",
+      "resolved": "https://registry.npmjs.org/browser-stdout/-/browser-stdout-1.3.1.tgz",
+      "integrity": "sha512-qhAVI1+Av2X7qelOfAIYwXONood6XlZE/fXaBSmW/T5SzLAmCgzi+eiWE7fUvbHaeNBQH13UftjpXxsfLkMpgw==",
+      "dev": true
+    },
+    "node_modules/browserslist": {
+      "version": "4.21.7",
+      "resolved": "https://registry.npmjs.org/browserslist/-/browserslist-4.21.7.tgz",
+      "integrity": "sha512-BauCXrQ7I2ftSqd2mvKHGo85XR0u7Ru3C/Hxsy/0TkfCtjrmAbPdzLGasmoiBxplpDXlPvdjX9u7srIMfgasNA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "dependencies": {
+        "caniuse-lite": "^1.0.30001489",
+        "electron-to-chromium": "^1.4.411",
+        "node-releases": "^2.0.12",
+        "update-browserslist-db": "^1.0.11"
+      },
+      "bin": {
+        "browserslist": "cli.js"
+      },
+      "engines": {
+        "node": "^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7"
+      }
+    },
+    "node_modules/buffer-from": {
+      "version": "1.1.2",
+      "resolved": "https://registry.npmjs.org/buffer-from/-/buffer-from-1.1.2.tgz",
+      "integrity": "sha512-E+XQCRwSbaaiChtv6k6Dwgc+bx+Bs6vuKJHHl5kox/BaKbhiXzqQOwK4cO22yElGp2OCmjwVhT3HmxgyPGnJfQ==",
+      "dev": true
+    },
+    "node_modules/camelcase": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz",
+      "integrity": "sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/caniuse-lite": {
+      "version": "1.0.30001498",
+      "resolved": "https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001498.tgz",
+      "integrity": "sha512-LFInN2zAwx3ANrGCDZ5AKKJroHqNKyjXitdV5zRIVIaQlXKj3GmxUKagoKsjqUfckpAObPCEWnk5EeMlyMWcgw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/caniuse-lite"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ]
+    },
+    "node_modules/chalk": {
+      "version": "2.4.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-2.4.2.tgz",
+      "integrity": "sha512-Mti+f9lpJNcwF4tWV8/OrTTtF1gZi+f8FqlyAdouralcFWFQWF2+NgCHShjkCb+IFBLq9buZwE1xckQU4peSuQ==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^3.2.1",
+        "escape-string-regexp": "^1.0.5",
+        "supports-color": "^5.3.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/chokidar": {
+      "version": "3.5.3",
+      "resolved": "https://registry.npmjs.org/chokidar/-/chokidar-3.5.3.tgz",
+      "integrity": "sha512-Dr3sfKRP6oTcjf2JmUmFJfeVMvXBdegxB0iVQ5eb2V10uFJUCAS8OByZdVAyVb8xXNz3GjjTgj9kLWsZTqE6kw==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "individual",
+          "url": "https://paulmillr.com/funding/"
+        }
+      ],
+      "dependencies": {
+        "anymatch": "~3.1.2",
+        "braces": "~3.0.2",
+        "glob-parent": "~5.1.2",
+        "is-binary-path": "~2.1.0",
+        "is-glob": "~4.0.1",
+        "normalize-path": "~3.0.0",
+        "readdirp": "~3.6.0"
+      },
+      "engines": {
+        "node": ">= 8.10.0"
+      },
+      "optionalDependencies": {
+        "fsevents": "~2.3.2"
+      }
+    },
+    "node_modules/cliui": {
+      "version": "7.0.4",
+      "resolved": "https://registry.npmjs.org/cliui/-/cliui-7.0.4.tgz",
+      "integrity": "sha512-OcRE68cOsVMXp1Yvonl/fzkQOyjLSu/8bhPDfQt0e0/Eb283TKP20Fs2MqoPsr9SwA595rRCA+QMzYc9nBP+JQ==",
+      "dev": true,
+      "dependencies": {
+        "string-width": "^4.2.0",
+        "strip-ansi": "^6.0.0",
+        "wrap-ansi": "^7.0.0"
+      }
+    },
+    "node_modules/color-convert": {
+      "version": "1.9.3",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-1.9.3.tgz",
+      "integrity": "sha512-QfAUtd+vFdAtFQcC8CCyYt1fYWxSqAiK2cSD6zDB8N3cpsEBAvRxp9zOGg6G/SHHJYAT88/az/IuDGALsNVbGg==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "1.1.3"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.3",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.3.tgz",
+      "integrity": "sha512-72fSenhMw2HZMTVHeCA9KCmpEIbzWiQsjN+BHcBbS9vr1mtt+vJjPdksIBNUmKAW8TFUDPJK5SUU3QhE9NEXDw==",
+      "dev": true
+    },
+    "node_modules/commander": {
+      "version": "4.1.1",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-4.1.1.tgz",
+      "integrity": "sha512-NOKm8xhkzAjzFx8B2v5OAHT+u5pRQc2UCa2Vq9jYL/31o2wi9mxBA7LIFs3sV5VSC49z6pEhfbMULvShKj26WA==",
+      "dev": true,
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/concat-map": {
+      "version": "0.0.1",
+      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
+      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
+      "dev": true
+    },
+    "node_modules/convert-source-map": {
+      "version": "1.9.0",
+      "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-1.9.0.tgz",
+      "integrity": "sha512-ASFBup0Mz1uyiIjANan1jzLQami9z1PoYSZCiiYW2FczPbenXc45FZdBZLzOT+r6+iciuEModtmCti+hjaAk0A==",
+      "dev": true
+    },
+    "node_modules/cross-env": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/cross-env/-/cross-env-7.0.3.tgz",
+      "integrity": "sha512-+/HKd6EgcQCJGh2PSjZuUitQBQynKor4wrFbRg4DtAgS1aWO+gU52xpH7M9ScGgXSYmAVS9bIJ8EzuaGw0oNAw==",
+      "dev": true,
+      "dependencies": {
+        "cross-spawn": "^7.0.1"
+      },
+      "bin": {
+        "cross-env": "src/bin/cross-env.js",
+        "cross-env-shell": "src/bin/cross-env-shell.js"
+      },
+      "engines": {
+        "node": ">=10.14",
+        "npm": ">=6",
+        "yarn": ">=1"
+      }
+    },
+    "node_modules/cross-spawn": {
+      "version": "7.0.3",
+      "resolved": "https://registry.npmjs.org/cross-spawn/-/cross-spawn-7.0.3.tgz",
+      "integrity": "sha512-iRDPJKUPVEND7dHPO8rkbOnPpyDygcDFtWjpeWNCgy8WP2rXcxXL8TskReQl6OrB2G7+UJrags1q15Fudc7G6w==",
+      "dev": true,
+      "dependencies": {
+        "path-key": "^3.1.0",
+        "shebang-command": "^2.0.0",
+        "which": "^2.0.1"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/debug": {
+      "version": "4.3.4",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.4.tgz",
+      "integrity": "sha512-PRWFHuSU3eDtQJPvnNY7Jcket1j0t5OuOsFzPPzsekD52Zl8qUfFIPEiswXqIvHWGVHOgX+7G/vCNNhehwxfkQ==",
+      "dev": true,
+      "dependencies": {
+        "ms": "2.1.2"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/decamelize": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/decamelize/-/decamelize-4.0.0.tgz",
+      "integrity": "sha512-9iE1PgSik9HeIIw2JO94IidnE3eBoQrFJ3w7sFuzSX4DpmZ3v5sZpUiV5Swcf6mQEF+Y0ru8Neo+p+nyh2J+hQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/diff": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/diff/-/diff-5.0.0.tgz",
+      "integrity": "sha512-/VTCrvm5Z0JGty/BWHljh+BAiw3IK+2j87NGMu8Nwc/f48WoDAC395uomO9ZD117ZOBaHmkX1oyLvkVM/aIT3w==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.3.1"
+      }
+    },
+    "node_modules/electron-to-chromium": {
+      "version": "1.4.427",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.4.427.tgz",
+      "integrity": "sha512-HK3r9l+Jm8dYAm1ctXEWIC+hV60zfcjS9UA5BDlYvnI5S7PU/yytjpvSrTNrSSRRkuu3tDyZhdkwIczh+0DWaw==",
+      "dev": true
+    },
+    "node_modules/emoji-regex": {
+      "version": "8.0.0",
+      "resolved": "https://registry.npmjs.org/emoji-regex/-/emoji-regex-8.0.0.tgz",
+      "integrity": "sha512-MSjYzcWNOA0ewAHpz0MxpYFvwg6yjy1NG3xteoqz644VCo/RPgnr1/GGt+ic3iJTzQ8Eu3TdM14SawnVUmGE6A==",
+      "dev": true
+    },
+    "node_modules/escalade": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/escalade/-/escalade-3.1.1.tgz",
+      "integrity": "sha512-k0er2gUkLf8O0zKJiAhmkTnJlTvINGv7ygDNPbeIsX/TJjGJZHuh9B2UxbsaEkmlEo9MfhrSzmhIlhRlI2GXnw==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/escape-string-regexp": {
+      "version": "1.0.5",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-1.0.5.tgz",
+      "integrity": "sha512-vbRorB5FUQWvla16U8R/qgaFIya2qGzwDrNmCZuYKrbdSUMG6I1ZCGQRefkRVhuOkIGVne7BQ35DSfo1qvJqFg==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.8.0"
+      }
+    },
+    "node_modules/fill-range": {
+      "version": "7.0.1",
+      "resolved": "https://registry.npmjs.org/fill-range/-/fill-range-7.0.1.tgz",
+      "integrity": "sha512-qOo9F+dMUmC2Lcb4BbVvnKJxTPjCm+RRpe4gDuGrzkL7mEVl/djYSu2OdQ2Pa302N4oqkSg9ir6jaLWJ2USVpQ==",
+      "dev": true,
+      "dependencies": {
+        "to-regex-range": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/find-up": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/find-up/-/find-up-5.0.0.tgz",
+      "integrity": "sha512-78/PXT1wlLLDgTzDs7sjq9hzz0vXD+zn+7wypEe4fXQxCmdmqfGsEPQxmiCSQI3ajFV91bVSsvNtrJRiW6nGng==",
+      "dev": true,
+      "dependencies": {
+        "locate-path": "^6.0.0",
+        "path-exists": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/flat": {
+      "version": "5.0.2",
+      "resolved": "https://registry.npmjs.org/flat/-/flat-5.0.2.tgz",
+      "integrity": "sha512-b6suED+5/3rTpUBdG1gupIl8MPFCAMA0QXwmljLhvCUKcUvdE4gWky9zpuGCcXHOsz4J9wPGNWq6OKpmIzz3hQ==",
+      "dev": true,
+      "bin": {
+        "flat": "cli.js"
+      }
+    },
+    "node_modules/fs-readdir-recursive": {
+      "version": "1.1.0",
+      "resolved": "https://registry.npmjs.org/fs-readdir-recursive/-/fs-readdir-recursive-1.1.0.tgz",
+      "integrity": "sha512-GNanXlVr2pf02+sPN40XN8HG+ePaNcvM0q5mZBd668Obwb0yD5GiUbZOFgwn8kGMY6I3mdyDJzieUy3PTYyTRA==",
+      "dev": true
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
+      "dev": true
+    },
+    "node_modules/fsevents": {
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/fsevents/-/fsevents-2.3.2.tgz",
+      "integrity": "sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==",
+      "dev": true,
+      "hasInstallScript": true,
+      "optional": true,
+      "os": [
+        "darwin"
+      ],
+      "engines": {
+        "node": "^8.16.0 || ^10.6.0 || >=11.0.0"
+      }
+    },
+    "node_modules/gensync": {
+      "version": "1.0.0-beta.2",
+      "resolved": "https://registry.npmjs.org/gensync/-/gensync-1.0.0-beta.2.tgz",
+      "integrity": "sha512-3hN7NaskYvMDLQY55gnW3NQ+mesEAepTqlg+VEbj7zzqEMBVNhzcGYYeqFo/TlYz6eQiFcp1HcsCZO+nGgS8zg==",
+      "dev": true,
+      "engines": {
+        "node": ">=6.9.0"
+      }
+    },
+    "node_modules/get-caller-file": {
+      "version": "2.0.5",
+      "resolved": "https://registry.npmjs.org/get-caller-file/-/get-caller-file-2.0.5.tgz",
+      "integrity": "sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==",
+      "dev": true,
+      "engines": {
+        "node": "6.* || 8.* || >= 10.*"
+      }
+    },
+    "node_modules/glob": {
+      "version": "7.2.3",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.3.tgz",
+      "integrity": "sha512-nFR0zLpU2YCaRxwoCJvL6UvCH2JFyFVIvwTLsIf21AuHlMskA1hhTdk+LlYJtOlYt9v6dvszD2BGRqBL+iQK9Q==",
+      "dev": true,
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.1.1",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/glob-parent": {
+      "version": "5.1.2",
+      "resolved": "https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.2.tgz",
+      "integrity": "sha512-AOIgSQCepiJYwP3ARnGx+5VnTu2HBYdzbGP45eLw1vr3zB3vZLeyed1sC9hnbcOc9/SrMyM5RPQrkGz4aS9Zow==",
+      "dev": true,
+      "dependencies": {
+        "is-glob": "^4.0.1"
+      },
+      "engines": {
+        "node": ">= 6"
+      }
+    },
+    "node_modules/globals": {
+      "version": "11.12.0",
+      "resolved": "https://registry.npmjs.org/globals/-/globals-11.12.0.tgz",
+      "integrity": "sha512-WOBp/EEGUiIsJSp7wcv/y6MO+lV9UoncWqxuFfm8eBwzWNgyfBd6Gz+IeKQ9jCmyhoH99g15M3T+QaVHFjizVA==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/growl": {
+      "version": "1.10.5",
+      "resolved": "https://registry.npmjs.org/growl/-/growl-1.10.5.tgz",
+      "integrity": "sha512-qBr4OuELkhPenW6goKVXiv47US3clb3/IbuWF9KNKEijAy9oeHxU9IgzjvJhHkUzhaj7rOUD7+YGWqUjLp5oSA==",
+      "dev": true,
+      "engines": {
+        "node": ">=4.x"
+      }
+    },
+    "node_modules/has-flag": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-3.0.0.tgz",
+      "integrity": "sha512-sKJf1+ceQBr4SMkvQnBDNDtf4TXpVhVGateu0t918bl30FnbE2m4vNLX+VWe/dpjlb+HugGYzW7uQXH98HPEYw==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/he": {
+      "version": "1.2.0",
+      "resolved": "https://registry.npmjs.org/he/-/he-1.2.0.tgz",
+      "integrity": "sha512-F/1DnUGPopORZi0ni+CvrCgHQ5FyEAHRLSApuYWMmrbSwoN2Mn/7k+Gl38gJnR7yyDZk6WLXwiGod1JOWNDKGw==",
+      "dev": true,
+      "bin": {
+        "he": "bin/he"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "dev": true,
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "dev": true
+    },
+    "node_modules/is-binary-path": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-binary-path/-/is-binary-path-2.1.0.tgz",
+      "integrity": "sha512-ZMERYes6pDydyuGidse7OsHxtbI7WVeUEozgR/g7rd0xUimYNlvZRE/K2MgZTjWy725IfelLeVcEM97mmtRGXw==",
+      "dev": true,
+      "dependencies": {
+        "binary-extensions": "^2.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-extglob": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/is-extglob/-/is-extglob-2.1.1.tgz",
+      "integrity": "sha512-SbKbANkN603Vi4jEZv49LeVJMn4yGwsbzZworEoyEiutsN3nJYdbO36zfhGJ6QEDpOZIFkDtnq5JRxmvl3jsoQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-fullwidth-code-point": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/is-fullwidth-code-point/-/is-fullwidth-code-point-3.0.0.tgz",
+      "integrity": "sha512-zymm5+u+sCsSWyD9qNaejV3DFvhCKclKdizYaJUuHA83RLjb7nSuGnddCHGv0hk+KY7BMAlsWeK4Ueg6EV6XQg==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-glob": {
+      "version": "4.0.3",
+      "resolved": "https://registry.npmjs.org/is-glob/-/is-glob-4.0.3.tgz",
+      "integrity": "sha512-xelSayHH36ZgE7ZWhli7pW34hNbNl8Ojv5KVmkJD4hBdD3th8Tfk9vYasLM+mXWOZhFkgZfxhLSnrwRr4elSSg==",
+      "dev": true,
+      "dependencies": {
+        "is-extglob": "^2.1.1"
+      },
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/is-number": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/is-number/-/is-number-7.0.0.tgz",
+      "integrity": "sha512-41Cifkg6e8TylSpdtTpeLVMqvSBEVzTttHvERD741+pnZ8ANv0004MRL43QKPDlK9cGvNp6NZWZUBlbGXYxxng==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.12.0"
+      }
+    },
+    "node_modules/is-plain-obj": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/is-plain-obj/-/is-plain-obj-2.1.0.tgz",
+      "integrity": "sha512-YWnfyRwxL/+SsrWYfOpUtz5b3YD+nyfkHvjbcanzk8zgyO4ASD67uVMRt8k5bM4lLMDnXfriRhOpemw+NfT1eA==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/is-unicode-supported": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/is-unicode-supported/-/is-unicode-supported-0.1.0.tgz",
+      "integrity": "sha512-knxG2q4UC3u8stRGyAVJCOdxFmv5DZiRcdlIaAQXAbSfJya+OhopNotLQrstBhququ4ZpuKbDc/8S6mgXgPFPw==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/isexe": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/isexe/-/isexe-2.0.0.tgz",
+      "integrity": "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw==",
+      "dev": true
+    },
+    "node_modules/js-tokens": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/js-tokens/-/js-tokens-4.0.0.tgz",
+      "integrity": "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ==",
+      "dev": true
+    },
+    "node_modules/js-yaml": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/js-yaml/-/js-yaml-4.1.0.tgz",
+      "integrity": "sha512-wpxZs9NoxZaJESJGIZTyDEaYpl0FKSA+FB9aJiyemKhMwkxQg63h4T1KJgUGHpTqPDNRcmmYLugrRjJlBtWvRA==",
+      "dev": true,
+      "dependencies": {
+        "argparse": "^2.0.1"
+      },
+      "bin": {
+        "js-yaml": "bin/js-yaml.js"
+      }
+    },
+    "node_modules/jsesc": {
+      "version": "2.5.2",
+      "resolved": "https://registry.npmjs.org/jsesc/-/jsesc-2.5.2.tgz",
+      "integrity": "sha512-OYu7XEzjkCQ3C5Ps3QIZsQfNpqoJyZZA99wd9aWd05NCtC5pWOkShK2mkL6HXQR6/Cy2lbNdPlZBpuQHXE63gA==",
+      "dev": true,
+      "bin": {
+        "jsesc": "bin/jsesc"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/json5": {
+      "version": "2.2.3",
+      "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz",
+      "integrity": "sha512-XmOWe7eyHYH14cLdVPoyg+GOH3rYX++KpzrylJwSW98t3Nk+U8XOl8FWKOgwtzdb8lXGf6zYwDUzeHMWfxasyg==",
+      "dev": true,
+      "bin": {
+        "json5": "lib/cli.js"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/kleur": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/kleur/-/kleur-2.0.2.tgz",
+      "integrity": "sha512-77XF9iTllATmG9lSlIv0qdQ2BQ/h9t0bJllHlbvsQ0zUWfU7Yi0S8L5JXzPZgkefIiajLmBJJ4BsMJmqcf7oxQ==",
+      "deprecated": "Please upgrade to kleur@3 or migrate to 'ansi-colors' if you prefer the old syntax. Visit <https://github.com/lukeed/kleur/releases/tag/v3.0.0\\> for migration path(s).",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/locate-path": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/locate-path/-/locate-path-6.0.0.tgz",
+      "integrity": "sha512-iPZK6eYjbxRu3uB4/WZ3EsEIMJFMqAoopl3R+zuq0UjcAm/MO6KCweDgPfP3elTztoKP3KtnVHxTn2NHBSDVUw==",
+      "dev": true,
+      "dependencies": {
+        "p-locate": "^5.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/log-symbols": {
+      "version": "4.1.0",
+      "resolved": "https://registry.npmjs.org/log-symbols/-/log-symbols-4.1.0.tgz",
+      "integrity": "sha512-8XPvpAA8uyhfteu8pIvQxpJZ7SYYdpUivZpGy6sFsBuKRY/7rQGavedeB8aK+Zkyq6upMFVL/9AW6vOYzfRyLg==",
+      "dev": true,
+      "dependencies": {
+        "chalk": "^4.1.0",
+        "is-unicode-supported": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/log-symbols/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/log-symbols/node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/log-symbols/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/log-symbols/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/log-symbols/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/log-symbols/node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/lru-cache": {
+      "version": "5.1.1",
+      "resolved": "https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz",
+      "integrity": "sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==",
+      "dev": true,
+      "dependencies": {
+        "yallist": "^3.0.2"
+      }
+    },
+    "node_modules/make-dir": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/make-dir/-/make-dir-2.1.0.tgz",
+      "integrity": "sha512-LS9X+dc8KLxXCb8dni79fLIIUA5VyZoyjSMCwTluaXA0o27cCK0bhXkpgw+sTXVpPy/lSO57ilRixqk0vDmtRA==",
+      "dev": true,
+      "dependencies": {
+        "pify": "^4.0.1",
+        "semver": "^5.6.0"
+      },
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/make-dir/node_modules/semver": {
+      "version": "5.7.1",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-5.7.1.tgz",
+      "integrity": "sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ==",
+      "dev": true,
+      "bin": {
+        "semver": "bin/semver"
+      }
+    },
+    "node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dev": true,
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/mocha": {
+      "version": "9.2.2",
+      "resolved": "https://registry.npmjs.org/mocha/-/mocha-9.2.2.tgz",
+      "integrity": "sha512-L6XC3EdwT6YrIk0yXpavvLkn8h+EU+Y5UcCHKECyMbdUIxyMuZj4bX4U9e1nvnvUUvQVsV2VHQr5zLdcUkhW/g==",
+      "dev": true,
+      "dependencies": {
+        "@ungap/promise-all-settled": "1.1.2",
+        "ansi-colors": "4.1.1",
+        "browser-stdout": "1.3.1",
+        "chokidar": "3.5.3",
+        "debug": "4.3.3",
+        "diff": "5.0.0",
+        "escape-string-regexp": "4.0.0",
+        "find-up": "5.0.0",
+        "glob": "7.2.0",
+        "growl": "1.10.5",
+        "he": "1.2.0",
+        "js-yaml": "4.1.0",
+        "log-symbols": "4.1.0",
+        "minimatch": "4.2.1",
+        "ms": "2.1.3",
+        "nanoid": "3.3.1",
+        "serialize-javascript": "6.0.0",
+        "strip-json-comments": "3.1.1",
+        "supports-color": "8.1.1",
+        "which": "2.0.2",
+        "workerpool": "6.2.0",
+        "yargs": "16.2.0",
+        "yargs-parser": "20.2.4",
+        "yargs-unparser": "2.0.0"
+      },
+      "bin": {
+        "_mocha": "bin/_mocha",
+        "mocha": "bin/mocha"
+      },
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/mochajs"
+      }
+    },
+    "node_modules/mocha/node_modules/debug": {
+      "version": "4.3.3",
+      "resolved": "https://registry.npmjs.org/debug/-/debug-4.3.3.tgz",
+      "integrity": "sha512-/zxw5+vh1Tfv+4Qn7a5nsbcJKPaSvCDhojn6FEl9vupwK2VCSDtEiEtqr8DFtzYFOdz63LBkxec7DYuc2jon6Q==",
+      "dev": true,
+      "dependencies": {
+        "ms": "2.1.2"
+      },
+      "engines": {
+        "node": ">=6.0"
+      },
+      "peerDependenciesMeta": {
+        "supports-color": {
+          "optional": true
+        }
+      }
+    },
+    "node_modules/mocha/node_modules/debug/node_modules/ms": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+      "dev": true
+    },
+    "node_modules/mocha/node_modules/escape-string-regexp": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/escape-string-regexp/-/escape-string-regexp-4.0.0.tgz",
+      "integrity": "sha512-TtpcNJ3XAzx3Gq8sWRzJaVajRs0uVxA2YAkdb1jm2YkPz4G6egUFAyA3n5vtEIZefPk5Wa4UXbKuS5fKkJWdgA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/mocha/node_modules/glob": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-7.2.0.tgz",
+      "integrity": "sha512-lmLf6gtyrPq8tTjSmrO94wBeQbFR3HbLHbuyD69wuyQkImp2hWqMGB47OX65FBkPffO641IP9jWa1z4ivqG26Q==",
+      "dev": true,
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^3.0.4",
+        "once": "^1.3.0",
+        "path-is-absolute": "^1.0.0"
+      },
+      "engines": {
+        "node": "*"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/mocha/node_modules/glob/node_modules/minimatch": {
+      "version": "3.1.2",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-3.1.2.tgz",
+      "integrity": "sha512-J7p63hRiAjw1NDEww1W7i37+ByIrOWO5XQQAzZ3VOcL0PNybwpfmV/N05zFAzwQ9USyEcX6t3UO+K5aqBQOIHw==",
+      "dev": true,
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": "*"
+      }
+    },
+    "node_modules/mocha/node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/mocha/node_modules/minimatch": {
+      "version": "4.2.1",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-4.2.1.tgz",
+      "integrity": "sha512-9Uq1ChtSZO+Mxa/CL1eGizn2vRn3MlLgzhT0Iz8zaY8NdvxvB0d5QdPFmCKf7JKA9Lerx5vRrnwO03jsSfGG9g==",
+      "dev": true,
+      "dependencies": {
+        "brace-expansion": "^1.1.7"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/mocha/node_modules/ms": {
+      "version": "2.1.3",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.3.tgz",
+      "integrity": "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==",
+      "dev": true
+    },
+    "node_modules/mocha/node_modules/supports-color": {
+      "version": "8.1.1",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-8.1.1.tgz",
+      "integrity": "sha512-MpUEN2OodtUzxvKQl72cUF7RQ5EiHsGvSsVG0ia9c5RbWGL2CI4C7EpPS8UTBIplnlzZiNuV56w+FuNxy3ty2Q==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/supports-color?sponsor=1"
+      }
+    },
+    "node_modules/ms": {
+      "version": "2.1.2",
+      "resolved": "https://registry.npmjs.org/ms/-/ms-2.1.2.tgz",
+      "integrity": "sha512-sGkPx+VjMtmA6MX27oA4FBFELFCZZ4S4XqeGOXCv68tT+jb3vk/RyaKWP0PTKyWtmLSM0b+adUTEvbs1PEaH2w==",
+      "dev": true
+    },
+    "node_modules/nanoid": {
+      "version": "3.3.1",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.1.tgz",
+      "integrity": "sha512-n6Vs/3KGyxPQd6uO0eH4Bv0ojGSUvuLlIHtC3Y0kEO23YRge8H9x1GCzLn28YX0H66pMkxuaeESFq4tKISKwdw==",
+      "dev": true,
+      "bin": {
+        "nanoid": "bin/nanoid.cjs"
+      },
+      "engines": {
+        "node": "^10 || ^12 || ^13.7 || ^14 || >=15.0.1"
+      }
+    },
+    "node_modules/node-releases": {
+      "version": "2.0.12",
+      "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.12.tgz",
+      "integrity": "sha512-QzsYKWhXTWx8h1kIvqfnC++o0pEmpRQA/aenALsL2F4pqNVr7YzcdMlDij5WBnwftRbJCNJL/O7zdKaxKPHqgQ==",
+      "dev": true
+    },
+    "node_modules/normalize-path": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/normalize-path/-/normalize-path-3.0.0.tgz",
+      "integrity": "sha512-6eZs5Ls3WtCisHWp9S2GUy8dqkpGi4BVSz3GaqiE6ezub0512ESztXUwUB6C6IKbQkY2Pnb/mD4WYojCRwcwLA==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "dev": true,
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/p-limit": {
+      "version": "3.1.0",
+      "resolved": "https://registry.npmjs.org/p-limit/-/p-limit-3.1.0.tgz",
+      "integrity": "sha512-TYOanM3wGwNGsZN2cVTYPArw454xnXj5qmWF1bEoAc4+cU/ol7GVh7odevjp1FNHduHc3KZMcFduxU5Xc6uJRQ==",
+      "dev": true,
+      "dependencies": {
+        "yocto-queue": "^0.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/p-locate": {
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/p-locate/-/p-locate-5.0.0.tgz",
+      "integrity": "sha512-LaNjtRWUBY++zB5nE/NwcaoMylSPk+S+ZHNB1TzdbMJMny6dynpAGt7X/tl/QYq3TIeE6nxHppbo2LGymrG5Pw==",
+      "dev": true,
+      "dependencies": {
+        "p-limit": "^3.0.2"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/path-exists": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
+      "integrity": "sha512-ak9Qy5Q7jYb2Wwcey5Fpvg2KoAc/ZIhLSLOSBmRmygPsGwkVVt0fZa0qrtMz+m6tJTAHfZQ8FnmB4MG4LWy7/w==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/path-is-absolute": {
+      "version": "1.0.1",
+      "resolved": "https://registry.npmjs.org/path-is-absolute/-/path-is-absolute-1.0.1.tgz",
+      "integrity": "sha512-AVbw3UJ2e9bq64vSaS9Am0fje1Pa8pbGqTTsmXfaIiMpnr5DlDhfJOuLj9Sf95ZPVDAUerDfEk88MPmPe7UCQg==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/path-key": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/path-key/-/path-key-3.1.1.tgz",
+      "integrity": "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/picocolors": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/picocolors/-/picocolors-1.0.0.tgz",
+      "integrity": "sha512-1fygroTLlHu66zi26VoTDv8yRgm0Fccecssto+MhsZ0D/DGW2sm8E8AjW7NU5VVTRt5GxbeZ5qBuJr+HyLYkjQ==",
+      "dev": true
+    },
+    "node_modules/picomatch": {
+      "version": "2.3.1",
+      "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-2.3.1.tgz",
+      "integrity": "sha512-JU3teHTNjmE2VCGFzuY8EXzCDVwEqB2a8fsIvwaStHhAWJEeVd1o1QD80CU6+ZdEXXSLbSsuLwJjkCBWqRQUVA==",
+      "dev": true,
+      "engines": {
+        "node": ">=8.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/jonschlinkert"
+      }
+    },
+    "node_modules/pify": {
+      "version": "4.0.1",
+      "resolved": "https://registry.npmjs.org/pify/-/pify-4.0.1.tgz",
+      "integrity": "sha512-uB80kBFb/tfd68bVleG9T5GGsGPjJrLAUpR5PZIrhBnIaRTQRjqdJSsIKkOP6OAIFbj7GOrcudc5pNjZ+geV2g==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/randombytes": {
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/randombytes/-/randombytes-2.1.0.tgz",
+      "integrity": "sha512-vYl3iOX+4CKUWuxGi9Ukhie6fsqXqS9FE2Zaic4tNFD2N2QQaXOMFbuKK4QmDHC0JO6B1Zp41J0LpT0oR68amQ==",
+      "dev": true,
+      "dependencies": {
+        "safe-buffer": "^5.1.0"
+      }
+    },
+    "node_modules/readdirp": {
+      "version": "3.6.0",
+      "resolved": "https://registry.npmjs.org/readdirp/-/readdirp-3.6.0.tgz",
+      "integrity": "sha512-hOS089on8RduqdbhvQ5Z37A0ESjsqz6qnRcffsMU3495FuTdqSm+7bhJ29JvIOsBDEEnan5DPu9t3To9VRlMzA==",
+      "dev": true,
+      "dependencies": {
+        "picomatch": "^2.2.1"
+      },
+      "engines": {
+        "node": ">=8.10.0"
+      }
+    },
+    "node_modules/require-directory": {
+      "version": "2.1.1",
+      "resolved": "https://registry.npmjs.org/require-directory/-/require-directory-2.1.1.tgz",
+      "integrity": "sha512-fGxEI7+wsG9xrvdjsrlmL22OMTTiHRwAMroiEeMgq8gzoLC/PQr7RsRDSTLUg/bZAZtF+TVIkHc6/4RIKrui+Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/safe-buffer": {
+      "version": "5.2.1",
+      "resolved": "https://registry.npmjs.org/safe-buffer/-/safe-buffer-5.2.1.tgz",
+      "integrity": "sha512-rp3So07KcdmmKbGvgaNxQSJr7bGVSVk5S9Eq1F+ppbRo70+YeaDxkw5Dd8NPN+GD6bjnYm2VuPuCXmpuYvmCXQ==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/feross"
+        },
+        {
+          "type": "patreon",
+          "url": "https://www.patreon.com/feross"
+        },
+        {
+          "type": "consulting",
+          "url": "https://feross.org/support"
+        }
+      ]
+    },
+    "node_modules/semver": {
+      "version": "6.3.0",
+      "resolved": "https://registry.npmjs.org/semver/-/semver-6.3.0.tgz",
+      "integrity": "sha512-b39TBaTSfV6yBrapU89p5fKekE2m/NwnDocOVruQFS1/veMgdzuPcnOM34M6CwxW8jH/lxEa5rBoDeUwu5HHTw==",
+      "dev": true,
+      "bin": {
+        "semver": "bin/semver.js"
+      }
+    },
+    "node_modules/serialize-javascript": {
+      "version": "6.0.0",
+      "resolved": "https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-6.0.0.tgz",
+      "integrity": "sha512-Qr3TosvguFt8ePWqsvRfrKyQXIiW+nGbYpy8XK24NQHE83caxWt+mIymTT19DGFbNWNLfEwsrkSmN64lVWB9ag==",
+      "dev": true,
+      "dependencies": {
+        "randombytes": "^2.1.0"
+      }
+    },
+    "node_modules/shebang-command": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-command/-/shebang-command-2.0.0.tgz",
+      "integrity": "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA==",
+      "dev": true,
+      "dependencies": {
+        "shebang-regex": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/shebang-regex": {
+      "version": "3.0.0",
+      "resolved": "https://registry.npmjs.org/shebang-regex/-/shebang-regex-3.0.0.tgz",
+      "integrity": "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/slash": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/slash/-/slash-2.0.0.tgz",
+      "integrity": "sha512-ZYKh3Wh2z1PpEXWr0MpSBZ0V6mZHAQfYevttO11c51CaWjGTaadiKZ+wVt1PbMlDV5qhMFslpZCemhwOK7C89A==",
+      "dev": true,
+      "engines": {
+        "node": ">=6"
+      }
+    },
+    "node_modules/source-map": {
+      "version": "0.6.1",
+      "resolved": "https://registry.npmjs.org/source-map/-/source-map-0.6.1.tgz",
+      "integrity": "sha512-UjgapumWlbMhkBgzT7Ykc5YXUT46F0iKu8SGXq0bcwP5dz/h0Plj6enJqjz1Zbq2l5WaqYnrVbwWOWMyF3F47g==",
+      "dev": true,
+      "engines": {
+        "node": ">=0.10.0"
+      }
+    },
+    "node_modules/source-map-support": {
+      "version": "0.5.21",
+      "resolved": "https://registry.npmjs.org/source-map-support/-/source-map-support-0.5.21.tgz",
+      "integrity": "sha512-uBHU3L3czsIyYXKX88fdrGovxdSCoTGDRZ6SYXtSRxLZUzHg5P/66Ht6uoUlHu9EZod+inXhKo3qQgwXUT/y1w==",
+      "dev": true,
+      "dependencies": {
+        "buffer-from": "^1.0.0",
+        "source-map": "^0.6.0"
+      }
+    },
+    "node_modules/string-width": {
+      "version": "4.2.3",
+      "resolved": "https://registry.npmjs.org/string-width/-/string-width-4.2.3.tgz",
+      "integrity": "sha512-wKyQRQpjJ0sIp62ErSZdGsjMJWsap5oRNihHhu6G7JVO/9jIB6UyevL+tXuOqrng8j/cxKTWyWUwvSTriiZz/g==",
+      "dev": true,
+      "dependencies": {
+        "emoji-regex": "^8.0.0",
+        "is-fullwidth-code-point": "^3.0.0",
+        "strip-ansi": "^6.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-ansi": {
+      "version": "6.0.1",
+      "resolved": "https://registry.npmjs.org/strip-ansi/-/strip-ansi-6.0.1.tgz",
+      "integrity": "sha512-Y38VPSHcqkFrCpFnQ9vuSXmquuv5oXOKpGeT6aGrr3o3Gc9AlVa6JBfUSOCnbxGGZF+/0ooI7KrPuUSztUdU5A==",
+      "dev": true,
+      "dependencies": {
+        "ansi-regex": "^5.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/strip-json-comments": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/strip-json-comments/-/strip-json-comments-3.1.1.tgz",
+      "integrity": "sha512-6fPc+R4ihwqP6N/aIv2f1gMH8lOVtWQHoqC4yK6oSDVVocumAsfCqjkXnqiYMhmMwS/mEHLp7Vehlt3ql6lEig==",
+      "dev": true,
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    },
+    "node_modules/supports-color": {
+      "version": "5.5.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-5.5.0.tgz",
+      "integrity": "sha512-QjVjwdXIt408MIiAqCX4oUKsgU2EqAGzs2Ppkm4aQYbjm+ZEWEcW4SfFNTr4uMNZma0ey4f5lgLrkB0aX0QMow==",
+      "dev": true,
+      "dependencies": {
+        "has-flag": "^3.0.0"
+      },
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/terser": {
+      "version": "4.8.1",
+      "resolved": "https://registry.npmjs.org/terser/-/terser-4.8.1.tgz",
+      "integrity": "sha512-4GnLC0x667eJG0ewJTa6z/yXrbLGv80D9Ru6HIpCQmO+Q4PfEtBFi0ObSckqwL6VyQv/7ENJieXHo2ANmdQwgw==",
+      "dev": true,
+      "dependencies": {
+        "commander": "^2.20.0",
+        "source-map": "~0.6.1",
+        "source-map-support": "~0.5.12"
+      },
+      "bin": {
+        "terser": "bin/terser"
+      },
+      "engines": {
+        "node": ">=6.0.0"
+      }
+    },
+    "node_modules/terser/node_modules/commander": {
+      "version": "2.20.3",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-2.20.3.tgz",
+      "integrity": "sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ==",
+      "dev": true
+    },
+    "node_modules/to-fast-properties": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/to-fast-properties/-/to-fast-properties-2.0.0.tgz",
+      "integrity": "sha512-/OaKK0xYrs3DmxRYqL/yDc+FxFUVYhDlXMhRmv3z915w2HF1tnN1omB354j8VUGO/hbRzyD6Y3sA7v7GS/ceog==",
+      "dev": true,
+      "engines": {
+        "node": ">=4"
+      }
+    },
+    "node_modules/to-regex-range": {
+      "version": "5.0.1",
+      "resolved": "https://registry.npmjs.org/to-regex-range/-/to-regex-range-5.0.1.tgz",
+      "integrity": "sha512-65P7iz6X5yEr1cwcgvQxbbIw7Uk3gOy5dIdtZ4rDveLqhrdJP+Li/Hx6tyK0NEb+2GCyneCMJiGqrADCSNk8sQ==",
+      "dev": true,
+      "dependencies": {
+        "is-number": "^7.0.0"
+      },
+      "engines": {
+        "node": ">=8.0"
+      }
+    },
+    "node_modules/update-browserslist-db": {
+      "version": "1.0.11",
+      "resolved": "https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.0.11.tgz",
+      "integrity": "sha512-dCwEFf0/oT85M1fHBg4F0jtLwJrutGoHSQXCh7u4o2t1drG+c0a9Flnqww6XUKSfQMPpJBRjU8d4RXB09qtvaA==",
+      "dev": true,
+      "funding": [
+        {
+          "type": "opencollective",
+          "url": "https://opencollective.com/browserslist"
+        },
+        {
+          "type": "tidelift",
+          "url": "https://tidelift.com/funding/github/npm/browserslist"
+        },
+        {
+          "type": "github",
+          "url": "https://github.com/sponsors/ai"
+        }
+      ],
+      "dependencies": {
+        "escalade": "^3.1.1",
+        "picocolors": "^1.0.0"
+      },
+      "bin": {
+        "update-browserslist-db": "cli.js"
+      },
+      "peerDependencies": {
+        "browserslist": ">= 4.21.0"
+      }
+    },
+    "node_modules/which": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/which/-/which-2.0.2.tgz",
+      "integrity": "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA==",
+      "dev": true,
+      "dependencies": {
+        "isexe": "^2.0.0"
+      },
+      "bin": {
+        "node-which": "bin/node-which"
+      },
+      "engines": {
+        "node": ">= 8"
+      }
+    },
+    "node_modules/workerpool": {
+      "version": "6.2.0",
+      "resolved": "https://registry.npmjs.org/workerpool/-/workerpool-6.2.0.tgz",
+      "integrity": "sha512-Rsk5qQHJ9eowMH28Jwhe8HEbmdYDX4lwoMWshiCXugjtHqMD9ZbiqSDLxcsfdqsETPzVUtX5s1Z5kStiIM6l4A==",
+      "dev": true
+    },
+    "node_modules/wrap-ansi": {
+      "version": "7.0.0",
+      "resolved": "https://registry.npmjs.org/wrap-ansi/-/wrap-ansi-7.0.0.tgz",
+      "integrity": "sha512-YVGIj2kamLSTxw6NsZjoBxfSwsn0ycdesmc4p+Q21c5zPuZ1pl+NfxVdxPtdHvmNVOQ6XSYG4AUtyt/Fi7D16Q==",
+      "dev": true,
+      "dependencies": {
+        "ansi-styles": "^4.0.0",
+        "string-width": "^4.1.0",
+        "strip-ansi": "^6.0.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/wrap-ansi?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi/node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "dev": true,
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/wrap-ansi/node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "dev": true,
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/wrap-ansi/node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "dev": true
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "dev": true
+    },
+    "node_modules/y18n": {
+      "version": "5.0.8",
+      "resolved": "https://registry.npmjs.org/y18n/-/y18n-5.0.8.tgz",
+      "integrity": "sha512-0pfFzegeDWJHJIAmTLRP2DwHjdF5s7jo9tuztdQxAhINCdvS+3nGINqPd00AphqJR/0LhANUS6/+7SCb98YOfA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/yallist": {
+      "version": "3.1.1",
+      "resolved": "https://registry.npmjs.org/yallist/-/yallist-3.1.1.tgz",
+      "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
+      "dev": true
+    },
+    "node_modules/yargs": {
+      "version": "16.2.0",
+      "resolved": "https://registry.npmjs.org/yargs/-/yargs-16.2.0.tgz",
+      "integrity": "sha512-D1mvvtDG0L5ft/jGWkLpG1+m0eQxOfaBvTNELraWj22wSVUMWxZUvYgJYcKh6jGGIkJFhH4IZPQhR4TKpc8mBw==",
+      "dev": true,
+      "dependencies": {
+        "cliui": "^7.0.2",
+        "escalade": "^3.1.1",
+        "get-caller-file": "^2.0.5",
+        "require-directory": "^2.1.1",
+        "string-width": "^4.2.0",
+        "y18n": "^5.0.5",
+        "yargs-parser": "^20.2.2"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/yargs-parser": {
+      "version": "20.2.4",
+      "resolved": "https://registry.npmjs.org/yargs-parser/-/yargs-parser-20.2.4.tgz",
+      "integrity": "sha512-WOkpgNhPTlE73h4VFAFsOnomJVaovO8VqLDzy5saChRBFQFBoMYirowyW+Q9HB4HFF4Z7VZTiG3iSzJJA29yRA==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/yargs-unparser": {
+      "version": "2.0.0",
+      "resolved": "https://registry.npmjs.org/yargs-unparser/-/yargs-unparser-2.0.0.tgz",
+      "integrity": "sha512-7pRTIA9Qc1caZ0bZ6RYRGbHJthJWuakf+WmHK0rVeLkNrrGhfoabBNdue6kdINI6r4if7ocq9aD/n7xwKOdzOA==",
+      "dev": true,
+      "dependencies": {
+        "camelcase": "^6.0.0",
+        "decamelize": "^4.0.0",
+        "flat": "^5.0.2",
+        "is-plain-obj": "^2.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/yocto-queue": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/yocto-queue/-/yocto-queue-0.1.0.tgz",
+      "integrity": "sha512-rVksvsnNCdJ/ohGc6xgPwyN8eheCxsiLM8mxuE/t/mOVqJewPuO1miLpTHQiRgTKCLexL4MeAFVagts7HmNZ2Q==",
+      "dev": true,
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/sindresorhus"
+      }
+    }
+  }
+}
diff --git a/deps/cjs-module-lexer/package.json b/deps/cjs-module-lexer/src/package.json
old mode 100644
new mode 100755
similarity index 95%
rename from deps/cjs-module-lexer/package.json
rename to deps/cjs-module-lexer/src/package.json
index 6b9a771168e..9ef0db81e12
--- a/deps/cjs-module-lexer/package.json
+++ b/deps/cjs-module-lexer/src/package.json
@@ -1,48 +1,48 @@
-{
-  "name": "cjs-module-lexer",
-  "version": "1.4.1",
-  "description": "Lexes CommonJS modules, returning their named exports metadata",
-  "main": "lexer.js",
-  "exports": {
-    "import": {
-      "types": "./lexer.d.mts",
-      "default": "./dist/lexer.mjs"
-    },
-    "default": "./lexer.js"
-  },
-  "types": "lexer.d.ts",
-  "scripts": {
-    "test-js": "mocha -b -u tdd test/*.js",
-    "test-wasm": "cross-env WASM=1 mocha -b -u tdd test/*.js",
-    "test-wasm-sync": "cross-env WASM_SYNC=1 mocha -b -u tdd test/*.js",
-    "test": "npm run test-wasm ; npm run test-wasm-sync ; npm run test-js",
-    "bench": "node --expose-gc bench/index.mjs",
-    "build": "node build.js ; babel dist/lexer.mjs -o dist/lexer.js ; terser dist/lexer.js -o dist/lexer.js",
-    "build-wasm": "make lib/lexer.wasm ; node build.js",
-    "prepublishOnly": "make && npm run build",
-    "footprint": "npm run build && cat dist/lexer.js | gzip -9f | wc -c"
-  },
-  "author": "Guy Bedford",
-  "license": "MIT",
-  "devDependencies": {
-    "@babel/cli": "^7.5.5",
-    "@babel/core": "^7.5.5",
-    "@babel/plugin-transform-modules-commonjs": "^7.5.0",
-    "cross-env": "^7.0.3",
-    "kleur": "^2.0.2",
-    "mocha": "^9.1.3",
-    "terser": "^4.1.4"
-  },
-  "files": [
-    "dist",
-    "lexer.d.ts"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/nodejs/cjs-module-lexer.git"
-  },
-  "bugs": {
-    "url": "https://github.com/nodejs/cjs-module-lexer/issues"
-  },
-  "homepage": "https://github.com/nodejs/cjs-module-lexer#readme"
-}
+{
+  "name": "cjs-module-lexer",
+  "version": "2.1.0",
+  "description": "Lexes CommonJS modules, returning their named exports metadata",
+  "main": "lexer.js",
+  "exports": {
+    "import": {
+      "types": "./lexer.d.mts",
+      "default": "./dist/lexer.mjs"
+    },
+    "default": "./lexer.js"
+  },
+  "types": "lexer.d.ts",
+  "scripts": {
+    "test-js": "mocha -b -u tdd test/*.js",
+    "test-wasm": "cross-env WASM=1 mocha -b -u tdd test/*.js",
+    "test-wasm-sync": "cross-env WASM_SYNC=1 mocha -b -u tdd test/*.js",
+    "test": "npm run test-wasm ; npm run test-wasm-sync ; npm run test-js",
+    "bench": "node --expose-gc bench/index.mjs",
+    "build": "node build.js ; babel dist/lexer.mjs -o dist/lexer.js ; terser dist/lexer.js -o dist/lexer.js",
+    "build-wasm": "make lib/lexer.wasm ; node build.js",
+    "prepublishOnly": "make && npm run build",
+    "footprint": "npm run build && cat dist/lexer.js | gzip -9f | wc -c"
+  },
+  "author": "Guy Bedford",
+  "license": "MIT",
+  "devDependencies": {
+    "@babel/cli": "^7.5.5",
+    "@babel/core": "^7.5.5",
+    "@babel/plugin-transform-modules-commonjs": "^7.5.0",
+    "cross-env": "^7.0.3",
+    "kleur": "^2.0.2",
+    "mocha": "^9.1.3",
+    "terser": "^4.1.4"
+  },
+  "files": [
+    "dist",
+    "lexer.d.ts"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nodejs/cjs-module-lexer.git"
+  },
+  "bugs": {
+    "url": "https://github.com/nodejs/cjs-module-lexer/issues"
+  },
+  "homepage": "https://github.com/nodejs/cjs-module-lexer#readme"
+}
diff --git a/deps/cjs-module-lexer/src/src/lexer.c b/deps/cjs-module-lexer/src/src/lexer.c
new file mode 100755
index 00000000000..78c6849f9c9
--- /dev/null
+++ b/deps/cjs-module-lexer/src/src/lexer.c
@@ -0,0 +1,1516 @@
+#include "cjs-module-lexer.h"
+
+const uint16_t* STANDARD_IMPORT = (uint16_t*)0x1;
+const uint16_t* IMPORT_META = (uint16_t*)0x2;
+const uint16_t __empty_char = '\0';
+const uint16_t* EMPTY_CHAR = &__empty_char;
+// tracked depth of template and brackets
+#define STACK_DEPTH 2048
+// tracked number of star exports
+#define MAX_STAR_EXPORTS 256
+const uint16_t* source;
+
+bool lastSlashWasDivision;
+uint16_t templateStackDepth;
+uint16_t openTokenDepth;
+uint16_t templateDepth;
+uint16_t braceDepth;
+uint16_t* lastTokenPos;
+uint16_t* pos;
+uint16_t* end;
+uint16_t* templateStack;
+uint16_t** openTokenPosStack;
+StarExportBinding* starExportStack;
+bool nextBraceIsClass;
+
+uint16_t* lastReexportStart;
+uint16_t* lastReexportEnd;
+
+// Memory Structure:
+// -> source
+// -> analysis starts after source
+uint32_t parse_error;
+uint32_t error = 0;
+uint32_t sourceLen;
+
+uint16_t templateStack_[STACK_DEPTH];
+uint16_t* openTokenPosStack_[STACK_DEPTH];
+bool openClassPosStack[STACK_DEPTH];
+StarExportBinding starExportStack_[MAX_STAR_EXPORTS];
+const StarExportBinding* STAR_EXPORT_STACK_END = &starExportStack_[MAX_STAR_EXPORTS - 1];
+
+void (*addExport)(const uint16_t*, const uint16_t*);
+void (*addReexport)(const uint16_t*, const uint16_t*);
+void (*addUnsafeGetter)(const uint16_t*, const uint16_t*);
+void (*clearReexports)();
+
+// Note: parsing is based on the _assumption_ that the source is already valid
+uint32_t parseCJS (uint16_t* _source, uint32_t _sourceLen, void (*_addExport)(const uint16_t*, const uint16_t*), void (*_addReexport)(const uint16_t*, const uint16_t*), void (*_addUnsafeGetter)(const uint16_t*, const uint16_t*), void (*_clearReexports)()) {
+  source = _source;
+  sourceLen = _sourceLen;
+  if (_addExport)
+    addExport = _addExport;
+  if (_addReexport)
+    addReexport = _addReexport;
+  if (_addUnsafeGetter)
+    addUnsafeGetter = _addUnsafeGetter;
+
+  templateStackDepth = 0;
+  openTokenDepth = 0;
+  templateDepth = UINT16_MAX;
+  lastTokenPos = (uint16_t*)EMPTY_CHAR;
+  lastSlashWasDivision = false;
+  parse_error = 0;
+  error = 0;
+  templateStack = &templateStack_[0];
+  openTokenPosStack = &openTokenPosStack_[0];
+  starExportStack = &starExportStack_[0];
+  nextBraceIsClass = false;
+
+  pos = (uint16_t*)(source - 1);
+  uint16_t ch = '\0';
+  end = pos + sourceLen;
+
+  // Handle #!
+  if (*source == '#' && *(source + 1) == '!') {
+    if (sourceLen == 2)
+      return 0;
+    pos += 2;
+    while (pos++ < end) {
+      ch = *pos;
+      if (ch == '\n' || ch == '\r')
+        break;
+    }
+  }
+
+  while (pos++ < end) {
+    ch = *pos;
+
+    if (ch == 32 || ch < 14 && ch > 8)
+      continue;
+
+    if (openTokenDepth == 0) {
+      switch (ch) {
+        case 'i':
+          if (str_eq5(pos + 1, 'm', 'p', 'o', 'r', 't') && keywordStart(pos))
+            throwIfImportStatement();
+          lastTokenPos = pos;
+          continue;
+        case 'r': {
+          uint16_t* startPos = pos;
+          if (tryParseRequire(Import) && keywordStart(startPos))
+            tryBacktrackAddStarExportBinding(startPos - 1);
+          lastTokenPos = pos;
+          continue;
+        }
+        case '_':
+          if (str_eq22(pos + 1, 'i', 'n', 't', 'e', 'r', 'o', 'p', 'R', 'e', 'q', 'u', 'i', 'r', 'e', 'W', 'i', 'l', 'd', 'c', 'a', 'r', 'd') && (keywordStart(pos) || *(pos - 1) == '.')) {
+            uint16_t* startPos = pos;
+            pos += 23;
+            if (*pos == '(') {
+              pos++;
+              openTokenPosStack[openTokenDepth++] = lastTokenPos;
+              if (tryParseRequire(Import) && keywordStart(startPos))
+                tryBacktrackAddStarExportBinding(startPos - 1);
+            }
+          }
+          else if (str_eq7(pos + 1, '_', 'e', 'x', 'p', 'o', 'r', 't') && (keywordStart(pos) || *(pos - 1) == '.')) {
+            pos += 8;
+            if (str_eq4(pos, 'S', 't', 'a', 'r'))
+              pos += 4;
+            if (*pos == '(') {
+              openTokenPosStack[openTokenDepth++] = lastTokenPos;
+              if (*(++pos) == 'r')
+                tryParseRequire(ExportStar);
+            }
+          }
+          lastTokenPos = pos;
+          continue;
+      }
+    }
+
+    switch (ch) {
+      case 'e':
+        if (str_eq5(pos + 1, 'x', 'p', 'o', 'r', 't') && keywordStart(pos)) {
+          if (*(pos + 6) == 's')
+            tryParseExportsDotAssign(false);
+          else if (openTokenDepth == 0)
+            throwIfExportStatement();
+        }
+        break;
+      case 'c':
+        if (keywordStart(pos) && str_eq4(pos + 1, 'l', 'a', 's', 's') && isBrOrWs(*(pos + 5)))
+          nextBraceIsClass = true;
+        break;
+      case 'm':
+        if (str_eq5(pos + 1, 'o', 'd', 'u', 'l', 'e') && keywordStart(pos))
+          tryParseModuleExportsDotAssign();
+        break;
+      case 'O':
+        if (str_eq5(pos + 1, 'b', 'j', 'e', 'c', 't') && keywordStart(pos))
+          tryParseObjectDefineOrKeys(openTokenDepth == 0);
+        break;
+      case '(':
+        openTokenPosStack[openTokenDepth++] = lastTokenPos;
+        break;
+      case ')':
+        if (openTokenDepth == 0)
+          return syntaxError(8), error;
+        openTokenDepth--;
+        break;
+      case '{':
+        openClassPosStack[openTokenDepth] = nextBraceIsClass;
+        nextBraceIsClass = false;
+        openTokenPosStack[openTokenDepth++] = lastTokenPos;
+        break;
+      case '}':
+        if (openTokenDepth == 0)
+          return syntaxError(2), false;
+        if (openTokenDepth-- == templateDepth) {
+          templateDepth = templateStack[--templateStackDepth];
+          templateString();
+        }
+        else {
+          if (templateDepth != UINT16_MAX && openTokenDepth < templateDepth)
+            return syntaxError(3), error;
+        }
+        break;
+      case '<':
+        // TODO: <!-- XML comment support
+        break;
+      case '\'':
+      case '"':
+        stringLiteral(ch);
+        break;
+      case '/': {
+        uint16_t next_ch = *(pos + 1);
+        if (next_ch == '/') {
+          lineComment();
+          // dont update lastToken
+          continue;
+        }
+        else if (next_ch == '*') {
+          blockComment();
+          // dont update lastToken
+          continue;
+        }
+        else {
+          // Division / regex ambiguity handling based on checking backtrack analysis of:
+          // - what token came previously (lastToken)
+          // - if a closing brace or paren, what token came before the corresponding
+          //   opening brace or paren (lastOpenTokenIndex)
+          uint16_t lastToken = *lastTokenPos;
+          if (isExpressionPunctuator(lastToken) &&
+              !(lastToken == '.' && (*(lastTokenPos - 1) >= '0' && *(lastTokenPos - 1) <= '9')) &&
+              !(lastToken == '+' && *(lastTokenPos - 1) == '+') && !(lastToken == '-' && *(lastTokenPos - 1) == '-') ||
+              lastToken == ')' && isParenKeyword(openTokenPosStack[openTokenDepth]) ||
+              lastToken == '}' && (isExpressionTerminator(openTokenPosStack[openTokenDepth]) || openClassPosStack[openTokenDepth]) ||
+              lastToken == '/' && lastSlashWasDivision ||
+              isExpressionKeyword(lastTokenPos) ||
+              !lastToken) {
+            regularExpression();
+            lastSlashWasDivision = false;
+          }
+          else {
+            lastSlashWasDivision = true;
+          }
+        }
+        break;
+      }
+      case '`':
+        if (templateDepth == UINT16_MAX - 1)
+          return syntaxError(4), error;
+        templateString();
+        break;
+    }
+    lastTokenPos = pos;
+  }
+
+  if (templateDepth != UINT16_MAX || openTokenDepth || error)
+    return error;
+
+  // success
+  return 0;
+}
+
+void tryBacktrackAddStarExportBinding (uint16_t* bPos) {
+  while (*bPos == ' ' && bPos > source)
+    bPos--;
+  if (*bPos == '=') {
+    bPos--;
+    while (*bPos == ' ' && bPos > source)
+      bPos--;
+    uint32_t charCode;
+    uint16_t* id_end = bPos;
+    bool identifierStart = false;
+    while ((charCode = fullCharCodeAtLast(bPos)) && bPos > source) {
+      if (charCode == '\\')
+        return;
+      if (!isIdentifierChar(charCode))
+        break;
+      identifierStart = isIdentifierStart(charCode);
+      bPos -= charCodeByteLen(charCode);
+    }
+    if (identifierStart && *bPos == ' ') {
+      // gracefully overflow if there are too many star export bindings to track
+      if (starExportStack == STAR_EXPORT_STACK_END)
+        return;
+      starExportStack->id_start = bPos + 1;
+      starExportStack->id_end = id_end + 1;
+      while (*bPos == ' ' && bPos > source)
+        bPos--;
+      switch (*bPos) {
+        case 'r':
+          if (!readPrecedingKeyword2(bPos - 1, 'v', 'a'))
+            return;
+          break;
+        case 't':
+          if (!readPrecedingKeyword2(bPos - 1, 'l', 'e') && !readPrecedingKeyword4(bPos - 1, 'c', 'o', 'n', 's'))
+            return;
+          break;
+        default: return;
+      }
+      starExportStack++;
+    }
+  }
+}
+
+bool tryParseObjectHasOwnProperty (uint16_t* it_id_start, ptrdiff_t it_id_len) {
+  uint16_t ch = commentWhitespace();
+  if (ch != 'O' || !str_eq5(pos + 1, 'b', 'j', 'e', 'c', 't')) return false;
+  pos += 6;
+  ch = commentWhitespace();
+  if (ch != '.') return false;
+  pos++;
+  ch = commentWhitespace();
+  if (ch == 'p') {
+    if (!str_eq8(pos + 1, 'r', 'o', 't', 'o', 't', 'y', 'p', 'e')) return false;
+    pos += 9;
+    ch = commentWhitespace();
+    if (ch != '.') return false;
+    pos++;
+    ch = commentWhitespace();
+  }
+  if (ch != 'h' || !str_eq13(pos + 1, 'a', 's', 'O', 'w', 'n', 'P', 'r', 'o', 'p', 'e', 'r', 't', 'y')) return false;
+  pos += 14;
+  ch = commentWhitespace();
+  if (ch != '.') return false;
+  pos++;
+  ch = commentWhitespace();
+  if (ch != 'c' || !str_eq3(pos + 1, 'a', 'l', 'l')) return false;
+  pos += 4;
+  ch = commentWhitespace();
+  if (ch != '(') return false;
+  pos++;
+  ch = commentWhitespace();
+  if (!identifier(ch)) return false;
+  ch = commentWhitespace();
+  if (ch != ',') return false;
+  pos++;
+  ch = commentWhitespace();
+  if (memcmp(pos, it_id_start, it_id_len * sizeof(uint16_t)) != 0) return false;
+  pos += it_id_len;
+  ch = commentWhitespace();
+  if (ch != ')') return false;
+  pos++;
+  return true;
+}
+
+void tryParseObjectDefineOrKeys (bool keys) {
+  pos += 6;
+  uint16_t* revertPos = pos - 1;
+  uint16_t ch = commentWhitespace();
+  if (ch == '.') {
+    pos++;
+    ch = commentWhitespace();
+    if (ch == 'd' && str_eq13(pos + 1, 'e', 'f', 'i', 'n', 'e', 'P', 'r', 'o', 'p', 'e', 'r', 't', 'y')) {
+      uint16_t* exportStart = 0;
+      uint16_t* exportEnd = 0;
+      while (true) {
+        pos += 14;
+        revertPos = pos - 1;
+        ch = commentWhitespace();
+        if (ch != '(') break;
+        pos++;
+        ch = commentWhitespace();
+        if (!readExportsOrModuleDotExports(ch)) break;
+        ch = commentWhitespace();
+        if (ch != ',') break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch != '\'' && ch != '"') break;
+        exportStart = pos;
+        stringLiteral(ch);
+        exportEnd = ++pos;
+        ch = commentWhitespace();
+        if (ch != ',') break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch != '{') break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch == 'e') {
+          if (!str_eq9(pos + 1, 'n', 'u', 'm', 'e', 'r', 'a', 'b', 'l', 'e')) break;
+          pos += 10;
+          ch = commentWhitespace();
+          if (ch != ':') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != 't' || !str_eq3(pos + 1, 'r', 'u', 'e')) break;
+          pos += 4;
+          ch = commentWhitespace();
+          if (ch != 44) break;
+          pos++;
+          ch = commentWhitespace();
+        }
+        if (ch == 'v') {
+          if (!str_eq4(pos + 1, 'a', 'l', 'u', 'e')) break;
+          pos += 5;
+          ch = commentWhitespace();
+          if (ch != ':') break;
+          addExport(exportStart, exportEnd);
+          pos = revertPos;
+          return;
+        }
+        else if (ch == 'g') {
+          if (!str_eq2(pos + 1, 'e', 't')) break;
+          pos += 3;
+          ch = commentWhitespace();
+          if (ch == ':') {
+            pos++;
+            ch = commentWhitespace();
+            if (ch != 'f') break;
+            if (!str_eq7(pos + 1, 'u', 'n', 'c', 't', 'i', 'o', 'n')) break;
+            pos += 8;
+            uint16_t* lastPos = pos;
+            ch = commentWhitespace();
+            if (ch != '(' && (lastPos == pos || !identifier(ch))) break;
+            ch = commentWhitespace();
+          }
+          if (ch != '(') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != ')') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != '{') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != 'r') break;
+          if (!str_eq5(pos + 1, 'e', 't', 'u', 'r', 'n')) break;
+          pos += 6;
+          ch = commentWhitespace();
+          if (!identifier(ch)) break;
+          ch = commentWhitespace();
+          if (ch == '.') {
+            pos++;
+            ch = commentWhitespace();
+            if (!identifier(ch)) break;
+            ch = commentWhitespace();
+          }
+          else if (ch == '[') {
+            pos++;
+            ch = commentWhitespace();
+            if (ch == '\'' || ch == '"') stringLiteral(ch);
+            else break;
+            pos++;
+            ch = commentWhitespace();
+            if (ch != ']') break;
+            pos++;
+            ch = commentWhitespace();
+          }
+          if (ch == ';') {
+            pos++;
+            ch = commentWhitespace();
+          }
+          if (ch != '}') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch == ',') {
+            pos++;
+            ch = commentWhitespace();
+          }
+          if (ch != '}') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != ')') break;
+          addExport(exportStart, exportEnd);
+          return;
+        }
+        break;
+      }
+      if (exportEnd > 0) {
+        addUnsafeGetter(exportStart, exportEnd);
+      }
+    }
+    else if (keys && ch == 'k' && str_eq3(pos + 1, 'e', 'y', 's')) {
+      while (true) {
+        pos += 4;
+        revertPos = pos - 1;
+        ch = commentWhitespace();
+        if (ch != '(') break;
+        pos++;
+        ch = commentWhitespace();
+        uint16_t* id_start = pos;
+        if (!identifier(ch)) break;
+        ptrdiff_t id_len = pos - id_start;
+        ch = commentWhitespace();
+        if (ch != ')') break;
+
+        revertPos = pos++;
+        ch = commentWhitespace();
+        if (ch != '.') break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch != 'f' || !str_eq6(pos + 1, 'o', 'r', 'E', 'a', 'c', 'h')) break;
+        pos += 7;
+        ch = commentWhitespace();
+        revertPos = pos - 1;
+        if (ch != '(') break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch != 'f' || !str_eq7(pos + 1, 'u', 'n', 'c', 't', 'i', 'o', 'n')) break;
+        pos += 8;
+        ch = commentWhitespace();
+        if (ch != '(') break;
+        pos++;
+        ch = commentWhitespace();
+        uint16_t* it_id_start = pos;
+        if (!identifier(ch)) break;
+        ptrdiff_t it_id_len = pos - it_id_start;
+        ch = commentWhitespace();
+        if (ch != ')') break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch != '{') break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch != 'i' || *(pos + 1) != 'f') break;
+        pos += 2;
+        ch = commentWhitespace();
+        if (ch != '(') break;
+        pos++;
+        ch = commentWhitespace();
+        if (memcmp(pos, it_id_start, it_id_len * sizeof(uint16_t)) != 0) break;
+        pos += it_id_len;
+        ch = commentWhitespace();
+        // `if (` IDENTIFIER$2 `===` ( `'default'` | `"default"` ) `||` IDENTIFIER$2 `===` ( '__esModule' | `"__esModule"` ) `) return` `;`? |
+        if (ch == '=') {
+          if (!str_eq2(pos + 1, '=', '=')) break;
+          pos += 3;
+          ch = commentWhitespace();
+          if (ch != '"' && ch != '\'') break;
+          uint16_t quot = ch;
+          if (!str_eq7(pos + 1, 'd', 'e', 'f', 'a', 'u', 'l', 't')) break;
+          pos += 8;
+          ch = commentWhitespace();
+          if (ch != quot) break;
+          pos += 1;
+          ch = commentWhitespace();
+          if (ch != '|' || *(pos + 1) != '|') break;
+          pos += 2;
+          ch = commentWhitespace();
+          if (memcmp(pos, it_id_start, it_id_len * sizeof(uint16_t)) != 0) break;
+          pos += it_id_len;
+          ch = commentWhitespace();
+          if (ch != '=' || !str_eq2(pos + 1, '=', '=')) break;
+          pos += 3;
+          ch = commentWhitespace();
+          if (ch != '"' && ch != '\'') break;
+          quot = ch;
+          if (!str_eq10(pos + 1, '_', '_', 'e', 's', 'M', 'o', 'd', 'u', 'l', 'e')) break;
+          pos += 11;
+          ch = commentWhitespace();
+          if (ch != quot) break;
+          pos += 1;
+          ch = commentWhitespace();
+          if (ch != ')') break;
+          pos += 1;
+          ch = commentWhitespace();
+          if (ch != 'r' || !str_eq5(pos + 1, 'e', 't', 'u', 'r', 'n')) break;
+          pos += 6;
+          ch = commentWhitespace();
+          if (ch == ';')
+            pos++;
+          ch = commentWhitespace();
+
+          // `if (`
+          if (ch == 'i' && *(pos + 1) == 'f') {
+            bool inIf = true;
+            pos += 2;
+            ch = commentWhitespace();
+            if (ch != '(') break;
+            pos++;
+            uint16_t *ifInnerPos = pos;
+
+            // `Object.prototype.hasOwnProperty.call(`  IDENTIFIER `, ` IDENTIFIER$2 `)) return` `;`?
+            if (tryParseObjectHasOwnProperty(it_id_start, it_id_len)) {
+              ch = commentWhitespace();
+              if (ch != ')') break;
+              pos++;
+              ch = commentWhitespace();
+              if (ch != 'r' || !str_eq5(pos + 1, 'e', 't', 'u', 'r', 'n')) break;
+              pos += 6;
+              ch = commentWhitespace();
+              if (ch == ';')
+                pos++;
+              ch = commentWhitespace();
+              // match next if
+              if (ch == 'i' && *(pos + 1) == 'f') {
+                pos += 2;
+                ch = commentWhitespace();
+                if (ch != '(') break;
+                pos++;
+              }
+              else {
+                inIf = false;
+              }
+            }
+            else {
+              pos = ifInnerPos;
+            }
+
+            // `if (` IDENTIFIER$2 `in` EXPORTS_IDENTIFIER `&&` EXPORTS_IDENTIFIER `[` IDENTIFIER$2 `] ===` IDENTIFIER$1 `[` IDENTIFIER$2 `]) return` `;`?
+            if (inIf) {
+              if (memcmp(pos, it_id_start, it_id_len * sizeof(uint16_t)) != 0) break;
+              pos += it_id_len;
+              ch = commentWhitespace();
+              if (ch != 'i' || !str_eq2(pos + 1, 'n', ' ')) break;
+              pos += 3;
+              ch = commentWhitespace();
+              if (!readExportsOrModuleDotExports(ch)) break;
+              ch = commentWhitespace();
+              if (ch != '&' || *(pos + 1) != '&') break;
+              pos += 2;
+              ch = commentWhitespace();
+              if (!readExportsOrModuleDotExports(ch)) break;
+              ch = commentWhitespace();
+              if (ch != '[') break;
+              pos++;
+              ch = commentWhitespace();
+              if (memcmp(pos, it_id_start, it_id_len * sizeof(uint16_t)) != 0) break;
+              pos += it_id_len;
+              ch = commentWhitespace();
+              if (ch != ']') break;
+              pos++;
+              ch = commentWhitespace();
+              if (ch != '=' || !str_eq2(pos + 1, '=', '=')) break;
+              pos += 3;
+              ch = commentWhitespace();
+              if (memcmp(pos, id_start, id_len * sizeof(uint16_t)) != 0) break;
+              pos += id_len;
+              ch = commentWhitespace();
+              if (ch != '[') break;
+              pos++;
+              ch = commentWhitespace();
+              if (memcmp(pos, it_id_start, it_id_len * sizeof(uint16_t)) != 0) break;
+              pos += it_id_len;
+              ch = commentWhitespace();
+              if (ch != ']') break;
+              pos++;
+              ch = commentWhitespace();
+              if (ch != ')') break;
+              pos++;
+              ch = commentWhitespace();
+              if (ch != 'r' || !str_eq5(pos + 1, 'e', 't', 'u', 'r', 'n')) break;
+              pos += 6;
+              ch = commentWhitespace();
+              if (ch == ';')
+                pos++;
+              ch = commentWhitespace();
+            }
+          }
+        }
+        // `if (` IDENTIFIER$2 `!==` ( `'default'` | `"default"` ) (`&& !` IDENTIFIER `.hasOwnProperty(` IDENTIFIER$2 `)`  )? `)`
+        else if (ch == '!') {
+          if (!str_eq2(pos + 1, '=', '=')) break;
+          pos += 3;
+          ch = commentWhitespace();
+          if (ch != '"' && ch != '\'') break;
+          uint16_t quot = ch;
+          if (!str_eq7(pos + 1, 'd', 'e', 'f', 'a', 'u', 'l', 't')) break;
+          pos += 8;
+          ch = commentWhitespace();
+          if (ch != quot) break;
+          pos += 1;
+          ch = commentWhitespace();
+          if (ch == '&') {
+            if (*(pos + 1) != '&') break;
+            pos += 2;
+            ch = commentWhitespace();
+            if (ch != '!') break;
+            pos += 1;
+            ch = commentWhitespace();
+            if (ch == 'O' && str_eq6(pos + 1, 'b', 'j', 'e', 'c', 't', '.')) {
+              if (!tryParseObjectHasOwnProperty(it_id_start, it_id_len)) break;
+            }
+            else if (identifier(ch)) {
+              ch = commentWhitespace();
+              if (ch != '.') break;
+              pos++;
+              ch = commentWhitespace();
+              if (ch != 'h' || !str_eq13(pos + 1, 'a', 's', 'O', 'w', 'n', 'P', 'r', 'o', 'p', 'e', 'r', 't', 'y')) break;
+              pos += 14;
+              ch = commentWhitespace();
+              if (ch != '(') break;
+              pos += 1;
+              ch = commentWhitespace();
+              if (memcmp(pos, it_id_start, it_id_len * sizeof(uint16_t)) != 0) break;
+              pos += it_id_len;
+              ch = commentWhitespace();
+              if (ch != ')') break;
+              pos += 1;
+            }
+            ch = commentWhitespace();
+          }
+          if (ch != ')') break;
+          pos += 1;
+          ch = commentWhitespace();
+        }
+        else break;
+
+        // EXPORTS_IDENTIFIER `[` IDENTIFIER$2 `] =` IDENTIFIER$1 `[` IDENTIFIER$2 `]`
+        if (readExportsOrModuleDotExports(ch)) {
+          ch = commentWhitespace();
+          if (ch != '[') break;
+          pos++;
+          ch = commentWhitespace();
+          if (memcmp(pos, it_id_start, it_id_len * sizeof(uint16_t)) != 0) break;
+          pos += it_id_len;
+          ch = commentWhitespace();
+          if (ch != ']') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != '=') break;
+          pos++;
+          ch = commentWhitespace();
+          if (memcmp(pos, id_start, id_len * sizeof(uint16_t)) != 0) break;
+          pos += id_len;
+          ch = commentWhitespace();
+          if (ch != '[') break;
+          pos++;
+          ch = commentWhitespace();
+          if (memcmp(pos, it_id_start, it_id_len * sizeof(uint16_t)) != 0) break;
+          pos += it_id_len;
+          ch = commentWhitespace();
+          if (ch != ']') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch == ';') {
+            pos++;
+            ch = commentWhitespace();
+          }
+        }
+        // `Object.defineProperty(` EXPORTS_IDENTIFIER `, ` IDENTIFIER$2 `, { enumerable: true, get: function () { return ` IDENTIFIER$1 `[` IDENTIFIER$2 `]; } })`
+        else if (ch == 'O') {
+          if (!str_eq5(pos + 1, 'b', 'j', 'e', 'c', 't')) break;
+          pos += 6;
+          ch = commentWhitespace();
+          if (ch != '.') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != 'd' || !str_eq13(pos + 1, 'e', 'f', 'i', 'n', 'e', 'P', 'r', 'o', 'p', 'e', 'r', 't', 'y')) break;
+          pos += 14;
+          ch = commentWhitespace();
+          if (ch != '(') break;
+          pos++;
+          ch = commentWhitespace();
+          if (!readExportsOrModuleDotExports(ch)) break;
+          ch = commentWhitespace();
+          if (ch != ',') break;
+          pos++;
+          ch = commentWhitespace();
+          if (memcmp(pos, it_id_start, it_id_len * sizeof(uint16_t)) != 0) break;
+          pos += it_id_len;
+          ch = commentWhitespace();
+          if (ch != ',') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != '{') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != 'e' || !str_eq9(pos + 1, 'n', 'u', 'm', 'e', 'r', 'a', 'b', 'l', 'e')) break;
+          pos += 10;
+          ch = commentWhitespace();
+          if (ch != ':') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != 't' && !str_eq3(pos + 1, 'r', 'u', 'e')) break;
+          pos += 4;
+          ch = commentWhitespace();
+          if (ch != ',') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != 'g' || !str_eq2(pos + 1, 'e', 't')) break;
+          pos += 3;
+          ch = commentWhitespace();
+          if (ch == ':') {
+            pos++;
+            ch = commentWhitespace();
+            if (ch != 'f') break;
+            if (!str_eq7(pos + 1, 'u', 'n', 'c', 't', 'i', 'o', 'n')) break;
+            pos += 8;
+            uint16_t* lastPos = pos;
+            ch = commentWhitespace();
+            if (ch != '(' && (lastPos == pos || !identifier(ch))) break;
+            ch = commentWhitespace();
+          }
+          if (ch != '(') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != ')') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != '{') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != 'r' || !str_eq5(pos + 1, 'e', 't', 'u', 'r', 'n')) break;
+          pos += 6;
+          ch = commentWhitespace();
+          if (memcmp(pos, id_start, id_len * sizeof(uint16_t)) != 0) break;
+          pos += id_len;
+          ch = commentWhitespace();
+          if (ch != '[') break;
+          pos++;
+          ch = commentWhitespace();
+          if (memcmp(pos, it_id_start, it_id_len * sizeof(uint16_t)) != 0) break;
+          pos += it_id_len;
+          ch = commentWhitespace();
+          if (ch != ']') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch == ';') {
+            pos++;
+            ch = commentWhitespace();
+          }
+          if (ch != '}') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch == ',') {
+            pos++;
+            ch = commentWhitespace();
+          }
+          if (ch != '}') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch != ')') break;
+          pos++;
+          ch = commentWhitespace();
+          if (ch == ';') {
+            pos++;
+            ch = commentWhitespace();
+          }
+        }
+        else break;
+
+        if (ch != '}') break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch != ')') break;
+
+        // search through export bindings to see if this is a star export
+        // this is done last because it is a linear search through all require bindings
+        // and by doing this search last after verifying the structure match,
+        // we don't have to worry about the slow search algorithm
+        StarExportBinding* curCheckBinding = &starExportStack_[0];
+        while (curCheckBinding != starExportStack) {
+          if (id_len == curCheckBinding->id_end - curCheckBinding->id_start &&
+              0 == memcmp(id_start, curCheckBinding->id_start, id_len * sizeof(uint16_t))) {
+            addReexport(curCheckBinding->specifier_start, curCheckBinding->specifier_end);
+            pos = revertPos;
+            return;
+          }
+          curCheckBinding++;
+        }
+        return;
+      }
+    }
+  }
+  pos = revertPos;
+}
+
+bool readExportsOrModuleDotExports (uint16_t ch) {
+  uint16_t* revertPos = pos;
+  if (ch == 'm' && str_eq5(pos + 1, 'o', 'd', 'u', 'l', 'e')) {
+    pos += 6;
+    ch = commentWhitespace();
+    if (ch != '.') {
+      pos = revertPos;
+      return false;
+    }
+    pos++;
+    ch = commentWhitespace();
+  }
+  if (ch == 'e' && str_eq6(pos + 1, 'x', 'p', 'o', 'r', 't', 's')) {
+    pos += 7;
+    return true;
+  }
+  else {
+    pos = revertPos;
+    return false;
+  }
+}
+
+void tryParseModuleExportsDotAssign () {
+  pos += 6;
+  uint16_t* revertPos = pos - 1;
+  uint16_t ch = commentWhitespace();
+  if (ch == '.') {
+    pos++;
+    ch = commentWhitespace();
+    if (ch == 'e' && str_eq6(pos + 1, 'x', 'p', 'o', 'r', 't', 's')) {
+      tryParseExportsDotAssign(true);
+      return;
+    }
+  }
+  pos = revertPos;
+}
+
+void tryParseExportsDotAssign (bool assign) {
+  pos += 7;
+  uint16_t* revertPos = pos - 1;
+  uint16_t ch = commentWhitespace();
+  switch (ch) {
+    // exports.asdf
+    case '.': {
+      pos++;
+      ch = commentWhitespace();
+      uint16_t* startPos = pos;
+      if (identifier(ch)) {
+        uint16_t* endPos = pos;
+        ch = commentWhitespace();
+        if (ch == '=') {
+          addExport(startPos, endPos);
+          return;
+        }
+      }
+      break;
+    }
+    // exports['asdf']
+    case '[': {
+      pos++;
+      ch = commentWhitespace();
+      if (ch == '\'' || ch == '"') {
+        uint16_t* startPos = pos;
+        stringLiteral(ch);
+        uint16_t* endPos = ++pos;
+        ch = commentWhitespace();
+        if (ch != ']') break;
+        pos++;
+        ch = commentWhitespace();
+        if (ch != '=') break;
+        addExport(startPos, endPos);
+      }
+      break;
+    }
+    // module.exports =
+    case '=': {
+      if (assign) {
+        clearReexports();
+        pos++;
+        ch = commentWhitespace();
+        // { ... }
+        if (ch == '{') {
+          tryParseLiteralExports();
+          return;
+        }
+
+        // require('...')
+        if (ch == 'r')
+          tryParseRequire(ExportAssign);
+      }
+    }
+  }
+  pos = revertPos;
+}
+
+bool tryParseRequire (enum RequireType requireType) {
+  uint16_t* revertPos = pos;
+  // require('...')
+  if (str_eq6(pos + 1, 'e', 'q', 'u', 'i', 'r', 'e')) {
+    pos += 7;
+    uint16_t ch = commentWhitespace();
+    if (ch == '(') {
+      pos++;
+      ch = commentWhitespace();
+      uint16_t* reexportStart = pos;
+      if (ch == '\'' || ch == '"') {
+        stringLiteral(ch);
+        uint16_t* reexportEnd = ++pos;
+        ch = commentWhitespace();
+        if (ch == ')') {
+          switch (requireType) {
+            case ExportStar:
+              addReexport(reexportStart, reexportEnd);
+              return true;
+            case ExportAssign:
+              addReexport(reexportStart, reexportEnd);
+              return true;
+            default:
+              starExportStack->specifier_start = reexportStart;
+              starExportStack->specifier_end = reexportEnd;
+              return true;
+          }
+        }
+      }
+    }
+    pos = revertPos;
+  }
+  return false;
+}
+
+void tryParseLiteralExports () {
+  uint16_t* revertPos = pos - 1;
+  while (pos++ < end) {
+    uint16_t ch = commentWhitespace();
+    uint16_t* startPos = pos;
+    if (identifier(ch)) {
+      uint16_t* endPos = pos;
+      ch = commentWhitespace();
+      if (ch == ':') {
+        pos++;
+        ch = commentWhitespace();
+        // nothing more complex than identifier expressions for now
+        if (!identifier(ch)) {
+          pos = revertPos;
+          return;
+        }
+        ch = *pos;
+      }
+      addExport(startPos, endPos);
+    }
+    else if (ch == '\'' || ch == '"') {
+      uint16_t* startPos = pos;
+      stringLiteral(ch);
+      uint16_t* endPos = ++pos;
+      ch = commentWhitespace();
+      if (ch == ':') {
+        pos++;
+        ch = commentWhitespace();
+        // nothing more complex than identifier expressions for now
+        if (!identifier(ch)) {
+          pos = revertPos;
+          return;
+        }
+        ch = *pos;
+        addExport(startPos, endPos);
+      }
+    }
+    else if (ch == '.' && str_eq2(pos + 1, '.', '.')) {
+      pos += 3;
+      if (*pos == 'r' && tryParseRequire(ExportAssign)) {
+        pos++;
+      }
+      else if (!identifier(*pos)) {
+        pos = revertPos;
+        return;
+      }
+      ch = commentWhitespace();
+    }
+    else {
+      pos = revertPos;
+      return;
+    }
+
+    if (ch == '}')
+      return;
+
+    if (ch != ',') {
+      pos = revertPos;
+      return;
+    }
+  }
+}
+
+// Identifier detection, ported from Acorn
+// ## Character categories
+
+// Big ugly regular expressions that match characters in the
+// whitespace, identifier, and identifier-start categories. These
+// are only applied when a character is found to actually have a
+// code point above 128.
+// Generated by `bin/generate-identifier-regex.js`.
+
+bool isNonASCIIidentifierStartChar (uint32_t ch) {
+  return ch == 0xaa || ch == 0xb5 || ch == 0xba || ch >= 0xc0 && ch <= 0xd6 || ch >= 0xd8 && ch <= 0xf6 || ch >= 0xf8 && ch <= 0x02c1 ||
+      ch >= 0x02c6 && ch <= 0x02d1 || ch >= 0x02e0 && ch <= 0x02e4 || ch == 0x02ec || ch == 0x02ee || ch >= 0x0370 && ch <= 0x0374 || ch == 0x0376 || ch == 0x0377 || ch >= 0x037a && ch <= 0x037d || ch == 0x037f || ch == 0x0386 || ch >= 0x0388 && ch <= 0x038a || ch == 0x038c || ch >= 0x038e && ch <= 0x03a1 || ch >= 0x03a3 && ch <= 0x03f5 || ch >= 0x03f7 && ch <= 0x0481 || ch >= 0x048a && ch <= 0x052f || ch >= 0x0531 && ch <= 0x0556 || ch == 0x0559 || ch >= 0x0560 && ch <= 0x0588 || ch >= 0x05d0 && ch <= 0x05ea || ch >= 0x05ef && ch <= 0x05f2 || ch >= 0x0620 && ch <= 0x064a || ch == 0x066e || ch == 0x066f || ch >= 0x0671 && ch <= 0x06d3 || ch == 0x06d5 || ch == 0x06e5 || ch == 0x06e6 || ch == 0x06ee || ch == 0x06ef || ch >= 0x06fa && ch <= 0x06fc || ch == 0x06ff || ch == 0x0710 || ch >= 0x0712 && ch <= 0x072f || ch >= 0x074d && ch <= 0x07a5 || ch == 0x07b1 || ch >= 0x07ca && ch <= 0x07ea || ch == 0x07f4 || ch == 0x07f5 || ch == 0x07fa || ch >= 0x0800 && ch <= 0x0815 || ch == 0x081a || ch == 0x0824 || ch == 0x0828 || ch >= 0x0840 && ch <= 0x0858 || ch >= 0x0860 && ch <= 0x086a || ch >= 0x08a0 && ch <= 0x08b4 || ch >= 0x08b6 && ch <= 0x08bd || ch >= 0x0904 && ch <= 0x0939 || ch == 0x093d || ch == 0x0950 || ch >= 0x0958 && ch <= 0x0961 || ch >= 0x0971 && ch <= 0x0980 || ch >= 0x0985 && ch <= 0x098c || ch == 0x098f || ch == 0x0990 || ch >= 0x0993 && ch <= 0x09a8 || ch >= 0x09aa && ch <= 0x09b0 || ch == 0x09b2 || ch >= 0x09b6 && ch <= 0x09b9 || ch == 0x09bd || ch == 0x09ce || ch == 0x09dc || ch == 0x09dd || ch >= 0x09df && ch <= 0x09e1 || ch == 0x09f0 || ch == 0x09f1 || ch == 0x09fc || ch >= 0x0a05 && ch <= 0x0a0a || ch == 0x0a0f || ch == 0x0a10 || ch >= 0x0a13 && ch <= 0x0a28 || ch >= 0x0a2a && ch <= 0x0a30 || ch == 0x0a32 || ch == 0x0a33 || ch == 0x0a35 || ch == 0x0a36 || ch == 0x0a38 || ch == 0x0a39 || ch >= 0x0a59 && ch <= 0x0a5c || ch == 0x0a5e || ch >= 0x0a72 && ch <= 0x0a74 || ch >= 0x0a85 && ch <= 0x0a8d || ch >= 0x0a8f && ch <= 0x0a91 || ch >= 0x0a93 && ch <= 0x0aa8 || ch >= 0x0aaa && ch <= 0x0ab0 || ch == 0x0ab2 || ch == 0x0ab3 || ch >= 0x0ab5 && ch <= 0x0ab9 || ch == 0x0abd || ch == 0x0ad0 || ch == 0x0ae0 || ch == 0x0ae1 || ch == 0x0af9 || ch >= 0x0b05 && ch <= 0x0b0c || ch == 0x0b0f || ch == 0x0b10 || ch >= 0x0b13 && ch <= 0x0b28 || ch >= 0x0b2a && ch <= 0x0b30 || ch == 0x0b32 || ch == 0x0b33 || ch >= 0x0b35 && ch <= 0x0b39 || ch == 0x0b3d || ch == 0x0b5c || ch == 0x0b5d || ch >= 0x0b5f && ch <= 0x0b61 || ch == 0x0b71 || ch == 0x0b83 || ch >= 0x0b85 && ch <= 0x0b8a || ch >= 0x0b8e && ch <= 0x0b90 || ch >= 0x0b92 && ch <= 0x0b95 || ch == 0x0b99 || ch == 0x0b9a || ch == 0x0b9c || ch == 0x0b9e || ch == 0x0b9f || ch == 0x0ba3 || ch == 0x0ba4 || ch >= 0x0ba8 && ch <= 0x0baa || ch >= 0x0bae && ch <= 0x0bb9 || ch == 0x0bd0 || ch >= 0x0c05 && ch <= 0x0c0c || ch >= 0x0c0e && ch <= 0x0c10 || ch >= 0x0c12 && ch <= 0x0c28 || ch >= 0x0c2a && ch <= 0x0c39 || ch == 0x0c3d || ch >= 0x0c58 && ch <= 0x0c5a || ch == 0x0c60 || ch == 0x0c61 || ch == 0x0c80 || ch >= 0x0c85 && ch <= 0x0c8c || ch >= 0x0c8e && ch <= 0x0c90 || ch >= 0x0c92 && ch <= 0x0ca8 || ch >= 0x0caa && ch <= 0x0cb3 || ch >= 0x0cb5 && ch <= 0x0cb9 || ch == 0x0cbd || ch == 0x0cde || ch == 0x0ce0 || ch == 0x0ce1 || ch == 0x0cf1 || ch == 0x0cf2 || ch >= 0x0d05 && ch <= 0x0d0c || ch >= 0x0d0e && ch <= 0x0d10 || ch >= 0x0d12 && ch <= 0x0d3a || ch == 0x0d3d || ch == 0x0d4e || ch >= 0x0d54 && ch <= 0x0d56 || ch >= 0x0d5f && ch <= 0x0d61 || ch >= 0x0d7a && ch <= 0x0d7f || ch >= 0x0d85 && ch <= 0x0d96 || ch >= 0x0d9a && ch <= 0x0db1 || ch >= 0x0db3 && ch <= 0x0dbb || ch == 0x0dbd || ch >= 0x0dc0 && ch <= 0x0dc6 || ch >= 0x0e01 && ch <= 0x0e30 || ch == 0x0e32 || ch == 0x0e33 || ch >= 0x0e40 && ch <= 0x0e46 || ch == 0x0e81 || ch == 0x0e82 || ch == 0x0e84 || ch == 0x0e87 || ch == 0x0e88 || ch == 0x0e8a || ch == 0x0e8d || ch >= 0x0e94 && ch <= 0x0e97 || ch >= 0x0e99 && ch <= 0x0e9f || ch >= 0x0ea1 && ch <= 0x0ea3 || ch == 0x0ea5 || ch == 0x0ea7 || ch == 0x0eaa || ch == 0x0eab || ch >= 0x0ead && ch <= 0x0eb0 || ch == 0x0eb2 || ch == 0x0eb3 || ch == 0x0ebd || ch >= 0x0ec0 && ch <= 0x0ec4 || ch == 0x0ec6 || ch >= 0x0edc && ch <= 0x0edf || ch == 0x0f00 || ch >= 0x0f40 && ch <= 0x0f47 || ch >= 0x0f49 && ch <= 0x0f6c || ch >= 0x0f88 && ch <= 0x0f8c || ch >= 0x1000 && ch <= 0x102a || ch == 0x103f || ch >= 0x1050 && ch <= 0x1055 || ch >= 0x105a && ch <= 0x105d || ch == 0x1061 || ch == 0x1065 || ch == 0x1066 || ch >= 0x106e && ch <= 0x1070 || ch >= 0x1075 && ch <= 0x1081 || ch == 0x108e || ch >= 0x10a0 && ch <= 0x10c5 || ch == 0x10c7 || ch == 0x10cd || ch >= 0x10d0 && ch <= 0x10fa || ch >= 0x10fc && ch <= 0x1248 || ch >= 0x124a && ch <= 0x124d || ch >= 0x1250 && ch <= 0x1256 || ch == 0x1258 || ch >= 0x125a && ch <= 0x125d || ch >= 0x1260 && ch <= 0x1288 || ch >= 0x128a && ch <= 0x128d || ch >= 0x1290 && ch <= 0x12b0 || ch >= 0x12b2 && ch <= 0x12b5 || ch >= 0x12b8 && ch <= 0x12be || ch == 0x12c0 || ch >= 0x12c2 && ch <= 0x12c5 || ch >= 0x12c8 && ch <= 0x12d6 || ch >= 0x12d8 && ch <= 0x1310 || ch >= 0x1312 && ch <= 0x1315 || ch >= 0x1318 && ch <= 0x135a || ch >= 0x1380 && ch <= 0x138f || ch >= 0x13a0 && ch <= 0x13f5 || ch >= 0x13f8 && ch <= 0x13fd || ch >= 0x1401 && ch <= 0x166c || ch >= 0x166f && ch <= 0x167f || ch >= 0x1681 && ch <= 0x169a || ch >= 0x16a0 && ch <= 0x16ea || ch >= 0x16ee && ch <= 0x16f8 || ch >= 0x1700 && ch <= 0x170c || ch >= 0x170e && ch <= 0x1711 || ch >= 0x1720 && ch <= 0x1731 || ch >= 0x1740 && ch <= 0x1751 || ch >= 0x1760 && ch <= 0x176c || ch >= 0x176e && ch <= 0x1770 || ch >= 0x1780 && ch <= 0x17b3 || ch == 0x17d7 || ch == 0x17dc || ch >= 0x1820 && ch <= 0x1878 || ch >= 0x1880 && ch <= 0x18a8 || ch == 0x18aa || ch >= 0x18b0 && ch <= 0x18f5 || ch >= 0x1900 && ch <= 0x191e || ch >= 0x1950 && ch <= 0x196d || ch >= 0x1970 && ch <= 0x1974 || ch >= 0x1980 && ch <= 0x19ab || ch >= 0x19b0 && ch <= 0x19c9 || ch >= 0x1a00 && ch <= 0x1a16 || ch >= 0x1a20 && ch <= 0x1a54 || ch == 0x1aa7 || ch >= 0x1b05 && ch <= 0x1b33 || ch >= 0x1b45 && ch <= 0x1b4b || ch >= 0x1b83 && ch <= 0x1ba0 || ch == 0x1bae || ch == 0x1baf || ch >= 0x1bba && ch <= 0x1be5 || ch >= 0x1c00 && ch <= 0x1c23 || ch >= 0x1c4d && ch <= 0x1c4f || ch >= 0x1c5a && ch <= 0x1c7d || ch >= 0x1c80 && ch <= 0x1c88 || ch >= 0x1c90 && ch <= 0x1cba || ch >= 0x1cbd && ch <= 0x1cbf || ch >= 0x1ce9 && ch <= 0x1cec || ch >= 0x1cee && ch <= 0x1cf1 || ch == 0x1cf5 || ch == 0x1cf6 || ch >= 0x1d00 && ch <= 0x1dbf || ch >= 0x1e00 && ch <= 0x1f15 || ch >= 0x1f18 && ch <= 0x1f1d || ch >= 0x1f20 && ch <= 0x1f45 || ch >= 0x1f48 && ch <= 0x1f4d || ch >= 0x1f50 && ch <= 0x1f57 || ch == 0x1f59 || ch == 0x1f5b || ch == 0x1f5d || ch >= 0x1f5f && ch <= 0x1f7d || ch >= 0x1f80 && ch <= 0x1fb4 || ch >= 0x1fb6 && ch <= 0x1fbc || ch == 0x1fbe || ch >= 0x1fc2 && ch <= 0x1fc4 || ch >= 0x1fc6 && ch <= 0x1fcc || ch >= 0x1fd0 && ch <= 0x1fd3 || ch >= 0x1fd6 && ch <= 0x1fdb || ch >= 0x1fe0 && ch <= 0x1fec || ch >= 0x1ff2 && ch <= 0x1ff4 || ch >= 0x1ff6 && ch <= 0x1ffc || ch == 0x2071 || ch == 0x207f || ch >= 0x2090 && ch <= 0x209c || ch == 0x2102 || ch == 0x2107 || ch >= 0x210a && ch <= 0x2113 || ch == 0x2115 || ch >= 0x2118 && ch <= 0x211d || ch == 0x2124 || ch == 0x2126 || ch == 0x2128 || ch >= 0x212a && ch <= 0x2139 || ch >= 0x213c && ch <= 0x213f || ch >= 0x2145 && ch <= 0x2149 || ch == 0x214e || ch >= 0x2160 && ch <= 0x2188 || ch >= 0x2c00 && ch <= 0x2c2e || ch >= 0x2c30 && ch <= 0x2c5e || ch >= 0x2c60 && ch <= 0x2ce4 || ch >= 0x2ceb && ch <= 0x2cee || ch == 0x2cf2 || ch == 0x2cf3 || ch >= 0x2d00 && ch <= 0x2d25 || ch == 0x2d27 || ch == 0x2d2d || ch >= 0x2d30 && ch <= 0x2d67 || ch == 0x2d6f || ch >= 0x2d80 && ch <= 0x2d96 || ch >= 0x2da0 && ch <= 0x2da6 || ch >= 0x2da8 && ch <= 0x2dae || ch >= 0x2db0 && ch <= 0x2db6 || ch >= 0x2db8 && ch <= 0x2dbe || ch >= 0x2dc0 && ch <= 0x2dc6 || ch >= 0x2dc8 && ch <= 0x2dce || ch >= 0x2dd0 && ch <= 0x2dd6 || ch >= 0x2dd8 && ch <= 0x2dde || ch >= 0x3005 && ch <= 0x3007 || ch >= 0x3021 && ch <= 0x3029 || ch >= 0x3031 && ch <= 0x3035 || ch >= 0x3038 && ch <= 0x303c || ch >= 0x3041 && ch <= 0x3096 || ch >= 0x309b && ch <= 0x309f || ch >= 0x30a1 && ch <= 0x30fa || ch >= 0x30fc && ch <= 0x30ff || ch >= 0x3105 && ch <= 0x312f || ch >= 0x3131 && ch <= 0x318e || ch >= 0x31a0 && ch <= 0x31ba || ch >= 0x31f0 && ch <= 0x31ff || ch >= 0x3400 && ch <= 0x4db5 || ch >= 0x4e00 && ch <= 0x9fef || ch >= 0xa000 && ch <= 0xa48c || ch >= 0xa4d0 && ch <= 0xa4fd || ch >= 0xa500 && ch <= 0xa60c || ch >= 0xa610 && ch <= 0xa61f || ch == 0xa62a || ch == 0xa62b || ch >= 0xa640 && ch <= 0xa66e || ch >= 0xa67f && ch <= 0xa69d || ch >= 0xa6a0 && ch <= 0xa6ef || ch >= 0xa717 && ch <= 0xa71f || ch >= 0xa722 && ch <= 0xa788 || ch >= 0xa78b && ch <= 0xa7b9 || ch >= 0xa7f7 && ch <= 0xa801 || ch >= 0xa803 && ch <= 0xa805 || ch >= 0xa807 && ch <= 0xa80a || ch >= 0xa80c && ch <= 0xa822 || ch >= 0xa840 && ch <= 0xa873 || ch >= 0xa882 && ch <= 0xa8b3 || ch >= 0xa8f2 && ch <= 0xa8f7 || ch == 0xa8fb || ch == 0xa8fd || ch == 0xa8fe || ch >= 0xa90a && ch <= 0xa925 || ch >= 0xa930 && ch <= 0xa946 || ch >= 0xa960 && ch <= 0xa97c || ch >= 0xa984 && ch <= 0xa9b2 || ch == 0xa9cf || ch >= 0xa9e0 && ch <= 0xa9e4 || ch >= 0xa9e6 && ch <= 0xa9ef || ch >= 0xa9fa && ch <= 0xa9fe || ch >= 0xaa00 && ch <= 0xaa28 || ch >= 0xaa40 && ch <= 0xaa42 || ch >= 0xaa44 && ch <= 0xaa4b || ch >= 0xaa60 && ch <= 0xaa76 || ch == 0xaa7a || ch >= 0xaa7e && ch <= 0xaaaf || ch == 0xaab1 || ch == 0xaab5 || ch == 0xaab6 || ch >= 0xaab9 && ch <= 0xaabd || ch == 0xaac0 || ch == 0xaac2 || ch >= 0xaadb && ch <= 0xaadd || ch >= 0xaae0 && ch <= 0xaaea || ch >= 0xaaf2 && ch <= 0xaaf4 || ch >= 0xab01 && ch <= 0xab06 || ch >= 0xab09 && ch <= 0xab0e || ch >= 0xab11 && ch <= 0xab16 || ch >= 0xab20 && ch <= 0xab26 || ch >= 0xab28 && ch <= 0xab2e ||
+      ch >= 0xab30 && ch <= 0xab5a || ch >= 0xab5c && ch <= 0xab65 || ch >= 0xab70 && ch <= 0xabe2 || ch >= 0xac00 && ch <= 0xd7a3 || ch >= 0xd7b0 && ch <= 0xd7c6 || ch >= 0xd7cb && ch <= 0xd7fb || ch >= 0xf900 && ch <= 0xfa6d || ch >= 0xfa70 && ch <= 0xfad9 || ch >= 0xfb00 && ch <= 0xfb06 || ch >= 0xfb13 && ch <= 0xfb17 || ch == 0xfb1d || ch >= 0xfb1f && ch <= 0xfb28 || ch >= 0xfb2a && ch <= 0xfb36 || ch >= 0xfb38 && ch <= 0xfb3c || ch == 0xfb3e || ch == 0xfb40 || ch == 0xfb41 || ch == 0xfb43 || ch == 0xfb44 || ch >= 0xfb46 && ch <= 0xfbb1 || ch >= 0xfbd3 && ch <= 0xfd3d || ch >= 0xfd50 && ch <= 0xfd8f || ch >= 0xfd92 && ch <= 0xfdc7 || ch >= 0xfdf0 && ch <= 0xfdfb || ch >= 0xfe70 && ch <= 0xfe74 || ch >= 0xfe76 && ch <= 0xfefc || ch >= 0xff21 && ch <= 0xff3a || ch >= 0xff41 && ch <= 0xff5a || ch >= 0xff66 && ch <= 0xffbe || ch >= 0xffc2 && ch <= 0xffc7 || ch >= 0xffca && ch <= 0xffcf || ch >= 0xffd2 && ch <= 0xffd7 || ch >= 0xffda && ch <= 0xffdc;
+}
+
+bool isNonASCIIidentifierChar (uint32_t ch) {
+  return isNonASCIIidentifierStartChar(ch) || ch == 0x200c || ch == 0x200d || ch == 0xb7 || ch >= 0x0300 && ch <= 0x036f || ch == 0x0387 || ch >= 0x0483 && ch <= 0x0487 || ch >= 0x0591 && ch <= 0x05bd || ch == 0x05bf || ch == 0x05c1 || ch == 0x05c2 || ch == 0x05c4 || ch == 0x05c5 || ch == 0x05c7 || ch >= 0x0610 && ch <= 0x061a || ch >= 0x064b && ch <= 0x0669 || ch == 0x0670 || ch >= 0x06d6 && ch <= 0x06dc || ch >= 0x06df && ch <= 0x06e4 || ch == 0x06e7 || ch == 0x06e8 || ch >= 0x06ea && ch <= 0x06ed || ch >= 0x06f0 && ch <= 0x06f9 || ch == 0x0711 || ch >= 0x0730 && ch <= 0x074a || ch >= 0x07a6 && ch <= 0x07b0 || ch >= 0x07c0 && ch <= 0x07c9 || ch >= 0x07eb && ch <= 0x07f3 || ch == 0x07fd || ch >= 0x0816 && ch <= 0x0819 || ch >= 0x081b && ch <= 0x0823 || ch >= 0x0825 && ch <= 0x0827 || ch >= 0x0829 && ch <= 0x082d || ch >= 0x0859 && ch <= 0x085b || ch >= 0x08d3 && ch <= 0x08e1 || ch >= 0x08e3 && ch <= 0x0903 || ch >= 0x093a && ch <= 0x093c || ch >= 0x093e && ch <= 0x094f || ch >= 0x0951 && ch <= 0x0957 || ch == 0x0962 || ch == 0x0963 || ch >= 0x0966 && ch <= 0x096f || ch >= 0x0981 && ch <= 0x0983 || ch == 0x09bc || ch >= 0x09be && ch <= 0x09c4 || ch == 0x09c7 || ch == 0x09c8 || ch >= 0x09cb && ch <= 0x09cd || ch == 0x09d7 || ch == 0x09e2 || ch == 0x09e3 || ch >= 0x09e6 && ch <= 0x09ef || ch == 0x09fe || ch >= 0x0a01 && ch <= 0x0a03 || ch == 0x0a3c || ch >= 0x0a3e && ch <= 0x0a42 || ch == 0x0a47 || ch == 0x0a48 || ch >= 0x0a4b && ch <= 0x0a4d || ch == 0x0a51 || ch >= 0x0a66 && ch <= 0x0a71 || ch == 0x0a75 || ch >= 0x0a81 && ch <= 0x0a83 || ch == 0x0abc || ch >= 0x0abe && ch <= 0x0ac5 || ch >= 0x0ac7 && ch <= 0x0ac9 || ch >= 0x0acb && ch <= 0x0acd || ch == 0x0ae2 || ch == 0x0ae3 || ch >= 0x0ae6 && ch <= 0x0aef || ch >= 0x0afa && ch <= 0x0aff || ch >= 0x0b01 && ch <= 0x0b03 || ch == 0x0b3c || ch >= 0x0b3e && ch <= 0x0b44 || ch == 0x0b47 || ch == 0x0b48 || ch >= 0x0b4b && ch <= 0x0b4d || ch == 0x0b56 || ch == 0x0b57 || ch == 0x0b62 || ch == 0x0b63 || ch >= 0x0b66 && ch <= 0x0b6f || ch == 0x0b82 || ch >= 0x0bbe && ch <= 0x0bc2 || ch >= 0x0bc6 && ch <= 0x0bc8 || ch >= 0x0bca && ch <= 0x0bcd || ch == 0x0bd7 || ch >= 0x0be6 && ch <= 0x0bef || ch >= 0x0c00 && ch <= 0x0c04 || ch >= 0x0c3e && ch <= 0x0c44 || ch >= 0x0c46 && ch <= 0x0c48 || ch >= 0x0c4a && ch <= 0x0c4d || ch == 0x0c55 || ch == 0x0c56 || ch == 0x0c62 || ch == 0x0c63 || ch >= 0x0c66 && ch <= 0x0c6f || ch >= 0x0c81 && ch <= 0x0c83 || ch == 0x0cbc || ch >= 0x0cbe && ch <= 0x0cc4 || ch >= 0x0cc6 && ch <= 0x0cc8 || ch >= 0x0cca && ch <= 0x0ccd || ch == 0x0cd5 || ch == 0x0cd6 || ch == 0x0ce2 || ch == 0x0ce3 || ch >= 0x0ce6 && ch <= 0x0cef || ch >= 0x0d00 && ch <= 0x0d03 || ch == 0x0d3b || ch == 0x0d3c || ch >= 0x0d3e && ch <= 0x0d44 || ch >= 0x0d46 && ch <= 0x0d48 || ch >= 0x0d4a && ch <= 0x0d4d || ch == 0x0d57 || ch == 0x0d62 || ch == 0x0d63 || ch >= 0x0d66 && ch <= 0x0d6f || ch == 0x0d82 || ch == 0x0d83 || ch == 0x0dca || ch >= 0x0dcf && ch <= 0x0dd4 || ch == 0x0dd6 || ch >= 0x0dd8 && ch <= 0x0ddf || ch >= 0x0de6 && ch <= 0x0def || ch == 0x0df2 || ch == 0x0df3 || ch == 0x0e31 || ch >= 0x0e34 && ch <= 0x0e3a || ch >= 0x0e47 && ch <= 0x0e4e || ch >= 0x0e50 && ch <= 0x0e59 || ch == 0x0eb1 || ch >= 0x0eb4 && ch <= 0x0eb9 || ch == 0x0ebb || ch == 0x0ebc || ch >= 0x0ec8 && ch <= 0x0ecd || ch >= 0x0ed0 && ch <= 0x0ed9 || ch == 0x0f18 || ch == 0x0f19 || ch >= 0x0f20 && ch <= 0x0f29 || ch == 0x0f35 || ch == 0x0f37 || ch == 0x0f39 || ch == 0x0f3e || ch == 0x0f3f || ch >= 0x0f71 && ch <= 0x0f84 || ch == 0x0f86 || ch == 0x0f87 || ch >= 0x0f8d && ch <= 0x0f97 || ch >= 0x0f99 && ch <= 0x0fbc || ch == 0x0fc6 || ch >= 0x102b && ch <= 0x103e || ch >= 0x1040 && ch <= 0x1049 || ch >= 0x1056 && ch <= 0x1059 || ch >= 0x105e && ch <= 0x1060 || ch >= 0x1062 && ch <= 0x1064 || ch >= 0x1067 && ch <= 0x106d || ch >= 0x1071 && ch <= 0x1074 || ch >= 0x1082 && ch <= 0x108d || ch >= 0x108f && ch <= 0x109d || ch >= 0x135d && ch <= 0x135f || ch >= 0x1369 && ch <= 0x1371 || ch >= 0x1712 && ch <= 0x1714 || ch >= 0x1732 && ch <= 0x1734 || ch == 0x1752 || ch == 0x1753 || ch == 0x1772 || ch == 0x1773 || ch >= 0x17b4 && ch <= 0x17d3 || ch == 0x17dd || ch >= 0x17e0 && ch <= 0x17e9 || ch >= 0x180b && ch <= 0x180d || ch >= 0x1810 && ch <= 0x1819 || ch == 0x18a9 || ch >= 0x1920 && ch <= 0x192b || ch >= 0x1930 && ch <= 0x193b || ch >= 0x1946 && ch <= 0x194f || ch >= 0x19d0 && ch <= 0x19da || ch >= 0x1a17 && ch <= 0x1a1b || ch >= 0x1a55 && ch <= 0x1a5e || ch >= 0x1a60 && ch <= 0x1a7c || ch >= 0x1a7f && ch <= 0x1a89 || ch >= 0x1a90 && ch <= 0x1a99 || ch >= 0x1ab0 && ch <= 0x1abd || ch >= 0x1b00 && ch <= 0x1b04 || ch >= 0x1b34 && ch <= 0x1b44 || ch >= 0x1b50 && ch <= 0x1b59 || ch >= 0x1b6b && ch <= 0x1b73 || ch >= 0x1b80 && ch <= 0x1b82 || ch >= 0x1ba1 && ch <= 0x1bad || ch >= 0x1bb0 && ch <= 0x1bb9 || ch >= 0x1be6 && ch <= 0x1bf3 || ch >= 0x1c24 && ch <= 0x1c37 || ch >= 0x1c40 && ch <= 0x1c49 || ch >= 0x1c50 && ch <= 0x1c59 || ch >= 0x1cd0 && ch <= 0x1cd2 || ch >= 0x1cd4 && ch <= 0x1ce8 || ch == 0x1ced || ch >= 0x1cf2 && ch <= 0x1cf4 || ch >= 0x1cf7 && ch <= 0x1cf9 || ch >= 0x1dc0 && ch <= 0x1df9 || ch >= 0x1dfb && ch <= 0x1dff || ch == 0x203f || ch == 0x2040 || ch == 0x2054 || ch >= 0x20d0 && ch <= 0x20dc || ch == 0x20e1 || ch >= 0x20e5 && ch <= 0x20f0 || ch >= 0x2cef && ch <= 0x2cf1 || ch == 0x2d7f || ch >= 0x2de0 && ch <= 0x2dff || ch >= 0x302a && ch <= 0x302f || ch == 0x3099 || ch == 0x309a || ch >= 0xa620 && ch <= 0xa629 || ch == 0xa66f || ch >= 0xa674 && ch <= 0xa67d || ch == 0xa69e || ch == 0xa69f || ch == 0xa6f0 || ch == 0xa6f1 || ch == 0xa802 || ch == 0xa806 || ch == 0xa80b || ch >= 0xa823 && ch <= 0xa827 || ch == 0xa880 || ch == 0xa881 || ch >= 0xa8b4 && ch <= 0xa8c5 || ch >= 0xa8d0 && ch <= 0xa8d9 || ch >= 0xa8e0 && ch <= 0xa8f1 || ch >= 0xa8ff && ch <= 0xa909 || ch >= 0xa926 && ch <= 0xa92d || ch >= 0xa947 && ch <= 0xa953 || ch >= 0xa980 && ch <= 0xa983 || ch >= 0xa9b3 && ch <= 0xa9c0 || ch >= 0xa9d0 && ch <= 0xa9d9 || ch == 0xa9e5 || ch >= 0xa9f0 && ch <= 0xa9f9 || ch >= 0xaa29 && ch <= 0xaa36 || ch == 0xaa43 || ch == 0xaa4c || ch == 0xaa4d || ch >= 0xaa50 && ch <= 0xaa59 || ch >= 0xaa7b && ch <= 0xaa7d || ch == 0xaab0 || ch >= 0xaab2 && ch <= 0xaab4 || ch == 0xaab7 || ch == 0xaab8 || ch == 0xaabe || ch == 0xaabf || ch == 0xaac1 || ch >= 0xaaeb && ch <= 0xaaef || ch == 0xaaf5 || ch == 0xaaf6 || ch >= 0xabe3 && ch <= 0xabea || ch == 0xabec || ch == 0xabed || ch >= 0xabf0 && ch <= 0xabf9 || ch == 0xfb1e || ch >= 0xfe00 && ch <= 0xfe0f || ch >= 0xfe20 && ch <= 0xfe2f || ch == 0xfe33 || ch == 0xfe34 || ch >= 0xfe4d && ch <= 0xfe4f || ch >= 0xff10 && ch <= 0xff19 || ch == 0xff3f;
+}
+
+// These are a run-length and offset encoded representation of the
+// >0xffff code points that are a valid part of identifiers. The
+// offset starts at 0x10000, and each pair of numbers represents an
+// offset to the next range, and then a size of the range. They were
+// generated by bin/generate-identifier-regex.js
+
+static uint32_t astralIdentifierStartCodes[] = { 0,11,2,25,2,18,2,1,2,14,3,13,35,122,70,52,268,28,4,48,48,31,14,29,6,37,11,29,3,35,5,7,2,4,43,157,19,35,5,35,5,39,9,51,157,310,10,21,11,7,153,5,3,0,2,43,2,1,4,0,3,22,11,22,10,30,66,18,2,1,11,21,11,25,71,55,7,1,65,0,16,3,2,2,2,28,43,28,4,28,36,7,2,27,28,53,11,21,11,18,14,17,111,72,56,50,14,50,14,35,349,41,7,1,79,28,11,0,9,21,107,20,28,22,13,52,76,44,33,24,27,35,30,0,3,0,9,34,4,0,13,47,15,3,22,0,2,0,36,17,2,24,85,6,2,0,2,3,2,14,2,9,8,46,39,7,3,1,3,21,2,6,2,1,2,4,4,0,19,0,13,4,159,52,19,3,21,2,31,47,21,1,2,0,185,46,42,3,37,47,21,0,60,42,14,0,72,26,230,43,117,63,32,7,3,0,3,7,2,1,2,23,16,0,2,0,95,7,3,38,17,0,2,0,29,0,11,39,8,0,22,0,12,45,20,0,35,56,264,8,2,36,18,0,50,29,113,6,2,1,2,37,22,0,26,5,2,1,2,31,15,0,328,18,190,0,80,921,103,110,18,195,2749,1070,4050,582,8634,568,8,30,114,29,19,47,17,3,32,20,6,18,689,63,129,74,6,0,67,12,65,1,2,0,29,6135,9,1237,43,8,8952,286,50,2,18,3,9,395,2309,106,6,12,4,8,8,9,5991,84,2,70,2,1,3,0,3,1,3,3,2,11,2,0,2,6,2,64,2,3,3,7,2,6,2,27,2,3,2,4,2,0,4,6,2,339,3,24,2,24,2,30,2,24,2,30,2,24,2,30,2,24,2,30,2,24,2,7,2357,44,11,6,17,0,370,43,1301,196,60,67,8,0,1205,3,2,26,2,1,2,0,3,0,2,9,2,3,2,0,2,0,7,0,5,0,2,0,2,0,2,2,2,1,2,0,3,0,2,0,2,0,2,0,2,0,2,1,2,0,3,3,2,6,2,3,2,3,2,0,2,9,2,16,6,2,2,4,2,16,4421,42717,35,4148,12,221,3,5761,15,7472,3104,541,1507,4938 };
+
+static uint32_t astralIdentifierCodes[] = { 509,0,227,0,150,4,294,9,1368,2,2,1,6,3,41,2,5,0,166,1,574,3,9,9,370,1,154,10,176,2,54,14,32,9,16,3,46,10,54,9,7,2,37,13,2,9,6,1,45,0,13,2,49,13,9,3,2,11,83,11,7,0,161,11,6,9,7,3,56,1,2,6,3,1,3,2,10,0,11,1,3,6,4,4,193,17,10,9,5,0,82,19,13,9,214,6,3,8,28,1,83,16,16,9,82,12,9,9,84,14,5,9,243,14,166,9,71,5,2,1,3,3,2,0,2,1,13,9,120,6,3,6,4,0,29,9,41,6,2,3,9,0,10,10,47,15,406,7,2,7,17,9,57,21,2,13,123,5,4,0,2,1,2,6,2,0,9,9,49,4,2,1,2,4,9,9,330,3,19306,9,135,4,60,6,26,9,1014,0,2,54,8,3,82,0,12,1,19628,1,5319,4,4,5,9,7,3,6,31,3,149,2,1418,49,513,54,5,49,9,0,15,0,23,4,2,14,1361,6,2,16,3,6,2,1,2,4,262,6,10,9,419,13,1495,6,110,6,6,9,4759,9,787719,239 };
+
+// This has a complexity linear to the value of the code. The
+// assumption is that looking up astral identifier characters is
+// rare.
+bool isInAstralIdentifierStartCodes (uint32_t code) {
+  uint32_t cur = 0x10000;
+  for (unsigned int i = 0; i < sizeof(astralIdentifierStartCodes) / sizeof(uint32_t); i += 2) {
+    cur += astralIdentifierStartCodes[i];
+    if (cur > code)
+      return false;
+    cur += astralIdentifierStartCodes[i + 1];
+    if (cur >= code)
+      return true;
+  }
+  return false;
+}
+
+bool isInAstralIdentifierCodes (uint32_t code) {
+  uint32_t cur = 0x10000;
+  for (unsigned int i = 0; i < sizeof(astralIdentifierCodes) / sizeof(uint32_t); i += 2) {
+    cur += astralIdentifierCodes[i];
+    if (cur > code)
+      return false;
+    cur += astralIdentifierCodes[i + 1];
+    if (cur >= code)
+      return true;
+  }
+  return false;
+}
+
+// Test whether a given character code starts an identifier.
+bool isIdentifierStart(uint32_t code) {
+  if (code < 65) return code == 36;
+  if (code < 91) return true;
+  if (code < 97) return code == 95;
+  if (code < 123) return true;
+  if (code <= 0xffff) return code >= 0xaa && isNonASCIIidentifierStartChar(code);
+  return isInAstralIdentifierStartCodes(code);
+}
+
+// Test whether a given character is part of an identifier.
+
+bool isIdentifierChar(uint32_t code) {
+  if (code < 48) return code == 36;
+  if (code < 58) return true;
+  if (code < 65) return false;
+  if (code < 91) return true;
+  if (code < 97) return code == 95;
+  if (code < 123) return true;
+  if (code <= 0xffff) return code >= 0xaa && isNonASCIIidentifierChar(code);
+  return isInAstralIdentifierStartCodes(code) || isInAstralIdentifierCodes(code);
+}
+
+inline int charCodeByteLen(uint32_t ch) {
+  if (ch < 0x10000) return 1;
+  return 2;
+}
+
+uint32_t fullCharCodeAtLast(uint16_t* bPos) {
+  // Gives the UTF char for backtracking surrogates
+  uint16_t ch = *bPos;
+  if ((ch & 0xFC00) == 0xDC00)
+    return (((*(bPos - 1) & 0x3FF) << 10) | (ch & 0x3FF)) + 0x10000;
+  return ch;
+}
+
+uint32_t fullCharCode(uint16_t ch) {
+  // Read UTF Surrogates if necessary
+  if ((ch & 0xFC00) == 0xD800)
+    return (((ch & 0x3FF) << 10) | (*(pos + 1) & 0x3FF)) + 0x10000;
+  return ch;
+}
+
+bool identifier (uint16_t startCh) {
+  uint32_t ch = fullCharCode(startCh);
+  if (!isIdentifierStart(ch) && ch != '\\')
+    return false;
+  pos += charCodeByteLen(ch);
+  while (ch = fullCharCode(*pos)) {
+    if (isIdentifierChar(ch)) {
+      pos += charCodeByteLen(ch);
+    }
+    else if (ch == '\\') {
+      // no identifier escapes support for now
+      return false;
+    }
+    else {
+      break;
+    }
+  }
+  return true;
+}
+
+void throwIfImportStatement () {
+  uint16_t* startPos = pos;
+  pos += 6;
+  uint16_t ch = commentWhitespace();
+  switch (ch) {
+    // dynamic import
+    case '(':
+      openTokenPosStack[openTokenDepth++] = startPos;
+      return;
+    // import.meta
+    case '.':
+      syntaxError(5);
+      return;
+    
+    default:
+      // no space after "import" -> not an import keyword
+      if (pos == startPos + 6)
+        break;
+    case '"':
+    case '\'':
+    case '{':
+    case '*':
+      // import statement only permitted at base-level
+      if (openTokenDepth != 0) {
+        pos--;
+        return;
+      }
+      // import statements are a syntax error in CommonJS
+      syntaxError(6);
+  }
+}
+
+void throwIfExportStatement () {
+  pos += 6;
+  uint16_t* curPos = pos;
+  uint16_t ch = commentWhitespace();
+  if (pos == curPos && !isPunctuator(ch))
+    return;
+  syntaxError(7);
+}
+
+uint16_t commentWhitespace () {
+  uint16_t ch;
+  do {
+    ch = *pos;
+    if (ch == '/') {
+      uint16_t next_ch = *(pos + 1);
+      if (next_ch == '/')
+        lineComment();
+      else if (next_ch == '*')
+        blockComment();
+      else
+        return ch;
+    }
+    else if (!isBrOrWs(ch)) {
+      return ch;
+    }
+  } while (pos++ < end);
+  return ch;
+}
+
+void templateString () {
+  while (pos++ < end) {
+    uint16_t ch = *pos;
+    if (ch == '$' && *(pos + 1) == '{') {
+      pos++;
+      templateStack[templateStackDepth++] = templateDepth;
+      templateDepth = ++openTokenDepth;
+      return;
+    }
+    if (ch == '`')
+      return;
+    if (ch == '\\')
+      pos++;
+  }
+  syntaxError(8);
+}
+
+void blockComment () {
+  pos++;
+  while (pos++ < end) {
+    uint16_t ch = *pos;
+    if (ch == '*' && *(pos + 1) == '/') {
+      pos++;
+      return;
+    }
+  }
+}
+
+void lineComment () {
+  while (pos++ < end) {
+    uint16_t ch = *pos;
+    if (ch == '\n' || ch == '\r')
+      return;
+  }
+}
+
+void stringLiteral (uint16_t quote) {
+  while (pos++ < end) {
+    uint16_t ch = *pos;
+    if (ch == quote)
+      return;
+    if (ch == '\\') {
+      ch = *++pos;
+      if (ch == '\r' && *(pos + 1) == '\n')
+        pos++;
+    }
+    else if (isBr(ch))
+      break;
+  }
+  syntaxError(9);
+}
+
+uint16_t regexCharacterClass () {
+  while (pos++ < end) {
+    uint16_t ch = *pos;
+    if (ch == ']')
+      return ch;
+    if (ch == '\\')
+      pos++;
+    else if (ch == '\n' || ch == '\r')
+      break;
+  }
+  syntaxError(10);
+  return '\0';
+}
+
+void regularExpression () {
+  while (pos++ < end) {
+    uint16_t ch = *pos;
+    if (ch == '/')
+      return;
+    if (ch == '[')
+      ch = regexCharacterClass();
+    else if (ch == '\\')
+      pos++;
+    else if (ch == '\n' || ch == '\r')
+      break;
+  }
+  syntaxError(11);
+}
+
+uint16_t readToWsOrPunctuator (uint16_t ch) {
+  do {
+    if (isBrOrWs(ch) || isPunctuator(ch))
+      return ch;
+  } while (ch = *(++pos));
+  return ch;
+}
+
+// Note: non-asii BR and whitespace checks omitted for perf / footprint
+// if there is a significant user need this can be reconsidered
+bool isBr (uint16_t c) {
+  return c == '\r' || c == '\n';
+}
+
+bool isBrOrWs (uint16_t c) {
+  return c > 8 && c < 14 || c == 32 || c == 160;
+}
+
+bool isBrOrWsOrPunctuatorNotDot (uint16_t c) {
+  return c > 8 && c < 14 || c == 32 || c == 160 || isPunctuator(c) && c != '.';
+}
+
+bool str_eq2 (uint16_t* pos, uint16_t c1, uint16_t c2) {
+  return *pos == c1 && *(pos + 1) == c2;
+}
+
+bool str_eq3 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3) {
+  return *pos == c1 && *(pos + 1) == c2 && *(pos + 2) == c3;
+}
+
+bool str_eq4 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4) {
+  return *pos == c1 && *(pos + 1) == c2 && *(pos + 2) == c3 && *(pos + 3) == c4;
+}
+
+bool str_eq5 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5) {
+  return *pos == c1 && *(pos + 1) == c2 && *(pos + 2) == c3 && *(pos + 3) == c4 && *(pos + 4) == c5;
+}
+
+bool str_eq6 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6) {
+  return *pos == c1 && *(pos + 1) == c2 && *(pos + 2) == c3 && *(pos + 3) == c4 && *(pos + 4) == c5 && *(pos + 5) == c6;
+}
+
+bool str_eq7 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7) {
+  return *pos == c1 && *(pos + 1) == c2 && *(pos + 2) == c3 && *(pos + 3) == c4 && *(pos + 4) == c5 && *(pos + 5) == c6 && *(pos + 6) == c7;
+}
+
+bool str_eq8 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7, uint16_t c8) {
+  return *pos == c1 && *(pos + 1) == c2 && *(pos + 2) == c3 && *(pos + 3) == c4 && *(pos + 4) == c5 && *(pos + 5) == c6 && *(pos + 6) == c7 && *(pos + 7) == c8;
+}
+
+bool str_eq9 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7, uint16_t c8, uint16_t c9) {
+  return *pos == c1 && *(pos + 1) == c2 && *(pos + 2) == c3 && *(pos + 3) == c4 && *(pos + 4) == c5 && *(pos + 5) == c6 && *(pos + 6) == c7 && *(pos + 7) == c8 && *(pos + 8) == c9;
+}
+
+bool str_eq10 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7, uint16_t c8, uint16_t c9, uint16_t c10) {
+  return *pos == c1 && *(pos + 1) == c2 && *(pos + 2) == c3 && *(pos + 3) == c4 && *(pos + 4) == c5 && *(pos + 5) == c6 && *(pos + 6) == c7 && *(pos + 7) == c8 && *(pos + 8) == c9 && *(pos + 9) == c10;
+}
+
+bool str_eq13 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7, uint16_t c8, uint16_t c9, uint16_t c10, uint16_t c11, uint16_t c12, uint16_t c13) {
+  return *pos == c1 && *(pos + 1) == c2 && *(pos + 2) == c3 && *(pos + 3) == c4 && *(pos + 4) == c5 && *(pos + 5) == c6 && *(pos + 6) == c7 && *(pos + 7) == c8 && *(pos + 8) == c9 && *(pos + 9) == c10 && *(pos + 10) == c11 && *(pos + 11) == c12 && *(pos + 12) == c13;
+}
+
+bool str_eq18 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7, uint16_t c8, uint16_t c9, uint16_t c10, uint16_t c11, uint16_t c12, uint16_t c13, uint16_t c14, uint16_t c15, uint16_t c16, uint16_t c17, uint16_t c18) {
+  return *pos == c1 && *(pos + 1) == c2 && *(pos + 2) == c3 && *(pos + 3) == c4 && *(pos + 4) == c5 && *(pos + 5) == c6 && *(pos + 6) == c7 && *(pos + 7) == c8 && *(pos + 8) == c9 && *(pos + 9) == c10 && *(pos + 10) == c11 && *(pos + 11) == c12 && *(pos + 12) == c13 && *(pos + 13) == c14 && *(pos + 14) == c15 && *(pos + 15) == c16 && *(pos + 16) == c17 && *(pos + 17) == c18;
+}
+
+bool str_eq22 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7, uint16_t c8, uint16_t c9, uint16_t c10, uint16_t c11, uint16_t c12, uint16_t c13, uint16_t c14, uint16_t c15, uint16_t c16, uint16_t c17, uint16_t c18, uint16_t c19, uint16_t c20, uint16_t c21, uint16_t c22) {
+  return *pos == c1 && *(pos + 1) == c2 && *(pos + 2) == c3 && *(pos + 3) == c4 && *(pos + 4) == c5 && *(pos + 5) == c6 && *(pos + 6) == c7 && *(pos + 7) == c8 && *(pos + 8) == c9 && *(pos + 9) == c10 && *(pos + 10) == c11 && *(pos + 11) == c12 && *(pos + 12) == c13 && *(pos + 13) == c14 && *(pos + 14) == c15 && *(pos + 15) == c16 && *(pos + 16) == c17 && *(pos + 17) == c18 && *(pos + 18) == c19 && *(pos + 19) == c20 && *(pos + 20) == c21 && *(pos + 21) == c22;
+}
+
+bool keywordStart (uint16_t* pos) {
+  return pos == source || isBrOrWsOrPunctuatorNotDot(*(pos - 1));
+}
+
+bool readPrecedingKeyword1 (uint16_t* pos, uint16_t c1) {
+  if (pos < source) return false;
+  return *pos == c1 && (pos == source || isBrOrWsOrPunctuatorNotDot(*(pos - 1)));
+}
+bool readPrecedingKeyword2 (uint16_t* pos, uint16_t c1, uint16_t c2) {
+  if (pos - 1 < source) return false;
+  return str_eq2(pos - 1, c1, c2) && (pos - 1 == source || isBrOrWsOrPunctuatorNotDot(*(pos - 2)));
+}
+bool readPrecedingKeyword3 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3) {
+  if (pos - 2 < source) return false;
+  return str_eq3(pos - 2, c1, c2, c3) && (pos - 2 == source || isBrOrWsOrPunctuatorNotDot(*(pos - 3)));
+}
+bool readPrecedingKeyword4 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4) {
+  if (pos - 3 < source) return false;
+  return str_eq4(pos - 3, c1, c2, c3, c4) && (pos - 3 == source || isBrOrWsOrPunctuatorNotDot(*(pos - 4)));
+}
+bool readPrecedingKeyword5 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5) {
+  if (pos - 4 < source) return false;
+  return str_eq5(pos - 4, c1, c2, c3, c4, c5) && (pos - 4 == source || isBrOrWsOrPunctuatorNotDot(*(pos - 5)));
+}
+bool readPrecedingKeyword6 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6) {
+  if (pos - 5 < source) return false;
+  return str_eq6(pos - 5, c1, c2, c3, c4, c5, c6) && (pos - 5 == source || isBrOrWsOrPunctuatorNotDot(*(pos - 6)));
+}
+bool readPrecedingKeyword7 (uint16_t* pos, uint16_t c1, uint16_t c2, uint16_t c3, uint16_t c4, uint16_t c5, uint16_t c6, uint16_t c7) {
+  if (pos - 6 < source) return false;
+  return str_eq7(pos - 6, c1, c2, c3, c4, c5, c6, c7) && (pos - 6 == source || isBrOrWsOrPunctuatorNotDot(*(pos - 7)));
+}
+
+// Detects one of case, debugger, delete, do, else, in, instanceof, new,
+//   return, throw, typeof, void, yield ,await
+bool isExpressionKeyword (uint16_t* pos) {
+  switch (*pos) {
+    case 'd':
+      switch (*(pos - 1)) {
+        case 'i':
+          // void
+          return readPrecedingKeyword2(pos - 2, 'v', 'o');
+        case 'l':
+          // yield
+          return readPrecedingKeyword3(pos - 2, 'y', 'i', 'e');
+        default:
+          return false;
+      }
+    case 'e':
+      switch (*(pos - 1)) {
+        case 's':
+          switch (*(pos - 2)) {
+            case 'l':
+              // else
+              return readPrecedingKeyword1(pos - 3, 'e');
+            case 'a':
+              // case
+              return readPrecedingKeyword1(pos - 3, 'c');
+            default:
+              return false;
+          }
+        case 't':
+          // delete
+          return readPrecedingKeyword4(pos - 2, 'd', 'e', 'l', 'e');
+        default:
+          return false;
+      }
+    case 'f':
+      if (*(pos - 1) != 'o' || *(pos - 2) != 'e')
+        return false;
+      switch (*(pos - 3)) {
+        case 'c':
+          // instanceof
+          return readPrecedingKeyword6(pos - 4, 'i', 'n', 's', 't', 'a', 'n');
+        case 'p':
+          // typeof
+          return readPrecedingKeyword2(pos - 4, 't', 'y');
+        default:
+          return false;
+      }
+    case 'n':
+      // in, return
+      return readPrecedingKeyword1(pos - 1, 'i') || readPrecedingKeyword5(pos - 1, 'r', 'e', 't', 'u', 'r');
+    case 'o':
+      // do
+      return readPrecedingKeyword1(pos - 1, 'd');
+    case 'r':
+      // debugger
+      return readPrecedingKeyword7(pos - 1, 'd', 'e', 'b', 'u', 'g', 'g', 'e');
+    case 't':
+      // await
+      return readPrecedingKeyword4(pos - 1, 'a', 'w', 'a', 'i');
+    case 'w':
+      switch (*(pos - 1)) {
+        case 'e':
+          // new
+          return readPrecedingKeyword1(pos - 2, 'n');
+        case 'o':
+          // throw
+          return readPrecedingKeyword3(pos - 2, 't', 'h', 'r');
+        default:
+          return false; 
+      }
+  }
+  return false;
+}
+
+bool isParenKeyword (uint16_t* curPos) {
+  return readPrecedingKeyword5(curPos, 'w', 'h', 'i', 'l', 'e') ||
+      readPrecedingKeyword3(curPos, 'f', 'o', 'r') ||
+      readPrecedingKeyword2(curPos, 'i', 'f');
+}
+
+bool isPunctuator (uint16_t ch) {
+  // 23 possible punctuator endings: !%&()*+,-./:;<=>?[]^{}|~
+  return ch == '!' || ch == '%' || ch == '&' ||
+    ch > 39 && ch < 48 || ch > 57 && ch < 64 ||
+    ch == '[' || ch == ']' || ch == '^' ||
+    ch > 122 && ch < 127;
+}
+
+bool isExpressionPunctuator (uint16_t ch) {
+  // 20 possible expression endings: !%&(*+,-.:;<=>?[^{|~
+  return ch == '!' || ch == '%' || ch == '&' ||
+    ch > 39 && ch < 47 && ch != 41 || ch > 57 && ch < 64 ||
+    ch == '[' || ch == '^' || ch > 122 && ch < 127 && ch != '}';
+}
+
+bool isExpressionTerminator (uint16_t* curPos) {
+  // detects:
+  // > ; ) -1 finally catch
+  // as all of these followed by a { will indicate a statement brace
+  switch (*curPos) {
+    case '>':
+      return *(curPos - 1) == '=';
+    case ';':
+    case ')':
+      return true;
+    case 'h':
+      return readPrecedingKeyword4(curPos - 1, 'c', 'a', 't', 'c');
+    case 'y':
+      return readPrecedingKeyword6(curPos - 1, 'f', 'i', 'n', 'a', 'l', 'l');
+    case 'e':
+      return readPrecedingKeyword3(curPos - 1, 'e', 'l', 's');
+  }
+  return false;
+}
+
+void bail (uint32_t err) {
+  error = 1;
+  parse_error = err;
+  pos = end + 1;
+}
+
+void syntaxError (uint32_t code) {
+  if (error == 0) error = code;
+  parse_error = pos - source;
+  pos = end + 1;
+}
diff --git a/deps/cjs-module-lexer/dist/lexer-external.mjs b/deps/cjs-module-lexer/src/src/lexer.js
old mode 100644
new mode 100755
similarity index 84%
rename from deps/cjs-module-lexer/dist/lexer-external.mjs
rename to deps/cjs-module-lexer/src/src/lexer.js
index 89450a3b60b..1fc557dd1ef
--- a/deps/cjs-module-lexer/dist/lexer-external.mjs
+++ b/deps/cjs-module-lexer/src/src/lexer.js
@@ -1,104 +1,119 @@
-let wasm;
-
-const isLE = new Uint8Array(new Uint16Array([1]).buffer)[0] === 1;
-
-export function parse (source, name = '@') {
-  if (!wasm)
-    throw new Error('Not initialized');
-
-  const len = source.length + 1;
-
-  // need 2 bytes per code point plus analysis space so we double again
-  const extraMem = (wasm.__heap_base.value || wasm.__heap_base) + len * 4 - wasm.memory.buffer.byteLength;
-  if (extraMem > 0)
-    wasm.memory.grow(Math.ceil(extraMem / 65536));
-    
-  const addr = wasm.sa(len);
-  (isLE ? copyLE : copyBE)(source, new Uint16Array(wasm.memory.buffer, addr, len));
-
-  const err_code = wasm.parseCJS(addr, source.length, 0, 0, 0);
-
-  if (err_code) {
-    const err = new Error(`Parse error ${name}${wasm.e()}:${source.slice(0, wasm.e()).split('\n').length}:${wasm.e() - source.lastIndexOf('\n', wasm.e() - 1)}`);
-    Object.assign(err, { idx: wasm.e() });
-    if (err_code === 5 || err_code === 6 || err_code === 7)
-      Object.assign(err, { code: 'ERR_LEXER_ESM_SYNTAX' });
-    throw err;
-  }
-
-  let exports = new Set(), reexports = new Set(), unsafeGetters = new Set();
-  
-  while (wasm.rre()) {
-    const reexptStr = decode(source.slice(wasm.res(), wasm.ree()));
-    if (reexptStr)
-      reexports.add(reexptStr);
-  }
-  while (wasm.ru())
-    unsafeGetters.add(decode(source.slice(wasm.us(), wasm.ue())));
-  while (wasm.re()) {
-    let exptStr = decode(source.slice(wasm.es(), wasm.ee()));
-    if (exptStr !== undefined && !unsafeGetters.has(exptStr))
-      exports.add(exptStr);
-  }
-
-  return { exports: [...exports], reexports: [...reexports] };
-}
-
-function decode (str) {
-  if (str[0] === '"' || str[0] === '\'') {
-    try {
-      const decoded = (0, eval)(str);
-      // Filter to exclude non-matching UTF-16 surrogate strings
-      for (let i = 0; i < decoded.length; i++) {
-        const surrogatePrefix = decoded.charCodeAt(i) & 0xFC00;
-        if (surrogatePrefix < 0xD800) {
-          // Not a surrogate
-          continue;
-        }
-        else if (surrogatePrefix === 0xD800) {
-          // Validate surrogate pair
-          if ((decoded.charCodeAt(++i) & 0xFC00) !== 0xDC00)
-            return;
-        }
-        else {
-          // Out-of-range surrogate code (above 0xD800)
-          return;
-        }
-      }
-      return decoded;
-    }
-    catch {}
-  }
-  else {
-    return str;
-  }
-}
-
-function copyBE (src, outBuf16) {
-  const len = src.length;
-  let i = 0;
-  while (i < len) {
-    const ch = src.charCodeAt(i);
-    outBuf16[i++] = (ch & 0xff) << 8 | ch >>> 8;
-  }
-}
-
-function copyLE (src, outBuf16) {
-  const len = src.length;
-  let i = 0;
-  while (i < len)
-    outBuf16[i] = src.charCodeAt(i++);
-}
-
-let initPromise;
-export function init () {
-  if (initPromise)
-    return initPromise;
-  return initPromise = (async () => {
-    const compiled = await WebAssembly.compile(
-      (await import('node:fs')).readFileSync(new URL(import.meta.resolve('../lib/lexer.wasm')))
-    );
-    const { exports } = await WebAssembly.instantiate(compiled);
-    wasm = exports;
-  })();
-}
+let wasm;
+
+const isLE = new Uint8Array(new Uint16Array([1]).buffer)[0] === 1;
+
+export function parse (source, name = '@') {
+  if (!wasm)
+    throw new Error('Not initialized');
+
+  const len = source.length + 1;
+
+  // need 2 bytes per code point plus analysis space so we double again
+  const extraMem = (wasm.__heap_base.value || wasm.__heap_base) + len * 4 - wasm.memory.buffer.byteLength;
+  if (extraMem > 0)
+    wasm.memory.grow(Math.ceil(extraMem / 65536));
+    
+  const addr = wasm.sa(len);
+  (isLE ? copyLE : copyBE)(source, new Uint16Array(wasm.memory.buffer, addr, len));
+
+  const err_code = wasm.parseCJS(addr, source.length, 0, 0, 0);
+
+  if (err_code) {
+    const err = new Error(`Parse error ${name}${wasm.e()}:${source.slice(0, wasm.e()).split('\n').length}:${wasm.e() - source.lastIndexOf('\n', wasm.e() - 1)}`);
+    Object.assign(err, { idx: wasm.e() });
+    if (err_code === 5 || err_code === 6 || err_code === 7)
+      Object.assign(err, { code: 'ERR_LEXER_ESM_SYNTAX' });
+    throw err;
+  }
+
+  let exports = new Set(), reexports = new Set(), unsafeGetters = new Set();
+  
+  while (wasm.rre()) {
+    const reexptStr = decode(source.slice(wasm.res(), wasm.ree()));
+    if (reexptStr)
+      reexports.add(reexptStr);
+  }
+  while (wasm.ru())
+    unsafeGetters.add(decode(source.slice(wasm.us(), wasm.ue())));
+  while (wasm.re()) {
+    let exptStr = decode(source.slice(wasm.es(), wasm.ee()));
+    if (exptStr !== undefined && !unsafeGetters.has(exptStr))
+      exports.add(exptStr);
+  }
+
+  return { exports: [...exports], reexports: [...reexports] };
+}
+
+function decode (str) {
+  if (str[0] === '"' || str[0] === '\'') {
+    try {
+      const decoded = (0, eval)(str);
+      // Filter to exclude non-matching UTF-16 surrogate strings
+      for (let i = 0; i < decoded.length; i++) {
+        const surrogatePrefix = decoded.charCodeAt(i) & 0xFC00;
+        if (surrogatePrefix < 0xD800) {
+          // Not a surrogate
+          continue;
+        }
+        else if (surrogatePrefix === 0xD800) {
+          // Validate surrogate pair
+          if ((decoded.charCodeAt(++i) & 0xFC00) !== 0xDC00)
+            return;
+        }
+        else {
+          // Out-of-range surrogate code (above 0xD800)
+          return;
+        }
+      }
+      return decoded;
+    }
+    catch {}
+  }
+  else {
+    return str;
+  }
+}
+
+function copyBE (src, outBuf16) {
+  const len = src.length;
+  let i = 0;
+  while (i < len) {
+    const ch = src.charCodeAt(i);
+    outBuf16[i++] = (ch & 0xff) << 8 | ch >>> 8;
+  }
+}
+
+function copyLE (src, outBuf16) {
+  const len = src.length;
+  let i = 0;
+  while (i < len)
+    outBuf16[i] = src.charCodeAt(i++);
+}
+
+function getWasmBytes() {
+  const binary = 'WASM_BINARY';  // This string will be replaced by build.js.
+  if (typeof Buffer !== 'undefined')
+    return Buffer.from(binary, 'base64');
+  return Uint8Array.from(atob(binary), x => x.charCodeAt(0));
+}
+
+let initPromise;
+export function init () {
+  if (initPromise)
+    return initPromise;
+  return initPromise = (async () => {
+    const compiled = await WebAssembly.compile(getWasmBytes());
+    const { exports } = await WebAssembly.instantiate(compiled);
+    wasm = exports;
+  })();
+}
+
+export function initSync () {
+  if (wasm) {
+    return;
+  }
+  const compiled = new WebAssembly.Module(getWasmBytes());
+  const { exports } = new WebAssembly.Instance(compiled);
+  wasm = exports;
+  return;
+}
diff --git a/deps/corepack/CHANGELOG.md b/deps/corepack/CHANGELOG.md
index ad0bba51c6b..e4f0b185a73 100644
--- a/deps/corepack/CHANGELOG.md
+++ b/deps/corepack/CHANGELOG.md
@@ -1,5 +1,18 @@
 # Changelog
 
+## [0.33.0](https://github.com/nodejs/corepack/compare/v0.32.0...v0.33.0) (2025-06-02)
+
+
+### Features
+
+* Adds guard to avoid stepping on Yarn's feet ([#714](https://github.com/nodejs/corepack/issues/714)) ([5fc3691](https://github.com/nodejs/corepack/commit/5fc3691354eb5bdeca17a9495b234584353f0151))
+* update package manager versions ([#671](https://github.com/nodejs/corepack/issues/671)) ([b45b3a3](https://github.com/nodejs/corepack/commit/b45b3a3244bacfbaf65188ae8c04209a1e98307d))
+
+
+### Bug Fixes
+
+* debug text typo ([#698](https://github.com/nodejs/corepack/issues/698)) ([0b94797](https://github.com/nodejs/corepack/commit/0b94797f96e30e46e466873fe7d437d0471cd92c))
+
 ## [0.32.0](https://github.com/nodejs/corepack/compare/v0.31.0...v0.32.0) (2025-02-28)
 
 
diff --git a/deps/corepack/README.md b/deps/corepack/README.md
index 67d396d5ca9..079746ee796 100644
--- a/deps/corepack/README.md
+++ b/deps/corepack/README.md
@@ -286,8 +286,8 @@ same major line. Should you need to upgrade to a new major, use an explicit
   package manager, and to not update the Last Known Good version when it
   downloads a new version of the same major line.
 
-- `COREPACK_ENABLE_AUTO_PIN` can be set to `0` to prevent Corepack from
-  updating the `packageManager` field when it detects that the local package
+- `COREPACK_ENABLE_AUTO_PIN` can be set to `1` to instruct Corepack to
+  update the `packageManager` field when it detects that the local package
   doesn't list it. In general we recommend to always list a `packageManager`
   field (which you can easily set through `corepack use [name]@[version]`), as
   it ensures that your project installs are always deterministic.
diff --git a/deps/corepack/dist/lib/corepack.cjs b/deps/corepack/dist/lib/corepack.cjs
index 7a098cbe250..c6854077d0f 100644
--- a/deps/corepack/dist/lib/corepack.cjs
+++ b/deps/corepack/dist/lib/corepack.cjs
@@ -21683,7 +21683,7 @@ function String2(descriptor, ...args) {
 }
 
 // package.json
-var version = "0.32.0";
+var version = "0.33.0";
 
 // sources/Engine.ts
 var import_fs9 = __toESM(require("fs"));
@@ -21697,7 +21697,7 @@ var import_valid4 = __toESM(require_valid2());
 var config_default = {
   definitions: {
     npm: {
-      default: "11.1.0+sha1.dba08f7d0f5301ebedaf968b4f74b2282f97a750",
+      default: "11.4.1+sha1.80350af543069991de20657ebcd07d9624cfad06",
       fetchLatestFrom: {
         type: "npm",
         package: "npm"
@@ -21734,7 +21734,7 @@ var config_default = {
       }
     },
     pnpm: {
-      default: "10.5.2+sha1.ca68c0441df195b7e2992f1d1cb12fb731f82d78",
+      default: "10.11.0+sha1.4048eeefd564ff1ab248fac3e2854d38245fe2f1",
       fetchLatestFrom: {
         type: "npm",
         package: "pnpm"
@@ -21798,7 +21798,7 @@ var config_default = {
         package: "yarn"
       },
       transparent: {
-        default: "4.6.0+sha224.acd0786f07ffc6c933940eb65fc1d627131ddf5455bddcc295dc90fd",
+        default: "4.9.1+sha224.4285002185abb91fe2b781f27fd1e078086c37a7b095f6ea4ee25971",
         commands: [
           [
             "yarn",
@@ -22105,6 +22105,10 @@ async function getProxyAgent(input) {
 }
 
 // sources/corepackUtils.ts
+var YARN_SWITCH_REGEX = /[/\\]switch[/\\]bin[/\\]/;
+function isYarnSwitchPath(p) {
+  return YARN_SWITCH_REGEX.test(p);
+}
 function getRegistryFromPackageManagerSpec(spec) {
   return process.env.COREPACK_NPM_REGISTRY ? spec.npmRegistry ?? spec.registry : spec.registry;
 }
@@ -22896,7 +22900,7 @@ var Engine = class {
         case `NoSpec`: {
           if (typeof locator.reference === `function`)
             fallbackDescriptor.range = await locator.reference();
-          if (import_process3.default.env.COREPACK_ENABLE_AUTO_PIN !== `0`) {
+          if (import_process3.default.env.COREPACK_ENABLE_AUTO_PIN === `1`) {
             const resolved = await this.resolveDescriptor(fallbackDescriptor, { allowTags: true });
             if (resolved === null)
               throw new UsageError(`Failed to successfully resolve '${fallbackDescriptor.range}' to a valid ${fallbackDescriptor.name} release`);
@@ -22906,7 +22910,7 @@ var Engine = class {
             console.error();
             await setLocalPackageManager(import_path9.default.dirname(result.target), installSpec);
           }
-          log(`Falling back to ${fallbackDescriptor.name}@${fallbackDescriptor.range} in the absence of "packageManage" field in ${result.target}`);
+          log(`Falling back to ${fallbackDescriptor.name}@${fallbackDescriptor.range} in the absence of "packageManager" field in ${result.target}`);
           return fallbackDescriptor;
         }
         case `Found`: {
@@ -23070,6 +23074,10 @@ var DisableCommand = class extends Command {
   async removePosixLink(installDirectory, binName) {
     const file = import_path10.default.join(installDirectory, binName);
     try {
+      if (binName.includes(`yarn`) && isYarnSwitchPath(await import_fs11.default.promises.realpath(file))) {
+        console.warn(`${binName} is already installed in ${file} and points to a Yarn Switch install - skipping`);
+        return;
+      }
       await import_fs11.default.promises.unlink(file);
     } catch (err) {
       if (err.code !== `ENOENT`) {
@@ -23147,6 +23155,10 @@ var EnableCommand = class extends Command {
     const symlink = import_path11.default.relative(installDirectory, import_path11.default.join(distFolder, `${binName}.js`));
     if (import_fs12.default.existsSync(file)) {
       const currentSymlink = await import_fs12.default.promises.readlink(file);
+      if (binName.includes(`yarn`) && isYarnSwitchPath(await import_fs12.default.promises.realpath(file))) {
+        console.warn(`${binName} is already installed in ${file} and points to a Yarn Switch install - skipping`);
+        return;
+      }
       if (currentSymlink !== symlink) {
         await import_fs12.default.promises.unlink(file);
       } else {
diff --git a/deps/corepack/package.json b/deps/corepack/package.json
index 75f5725328a..7bf3d9e6604 100644
--- a/deps/corepack/package.json
+++ b/deps/corepack/package.json
@@ -1,6 +1,6 @@
 {
   "name": "corepack",
-  "version": "0.32.0",
+  "version": "0.33.0",
   "homepage": "https://github.com/nodejs/corepack#readme",
   "bugs": {
     "url": "https://github.com/nodejs/corepack/issues"
@@ -16,21 +16,21 @@
     "./package.json": "./package.json"
   },
   "license": "MIT",
-  "packageManager": "yarn@4.6.0+sha512.5383cc12567a95f1d668fbe762dfe0075c595b4bfff433be478dbbe24e05251a8e8c3eb992a986667c1d53b6c3a9c85b8398c35a960587fbd9fa3a0915406728",
+  "packageManager": "yarn@4.9.0+sha224.dce6c5df199861784bd9b0eecb2a228df97e3f18a02b1bb75ff98383",
   "devDependencies": {
     "@types/debug": "^4.1.5",
     "@types/node": "^20.4.6",
     "@types/proxy-from-env": "^1",
     "@types/semver": "^7.1.0",
     "@types/which": "^3.0.0",
-    "@yarnpkg/eslint-config": "^2.0.0",
+    "@yarnpkg/eslint-config": "^3.0.0",
     "@yarnpkg/fslib": "^3.0.0-rc.48",
     "@zkochan/cmd-shim": "^6.0.0",
     "better-sqlite3": "^11.7.2",
     "clipanion": "patch:clipanion@npm%3A3.2.1#~/.yarn/patches/clipanion-npm-3.2.1-fc9187f56c.patch",
     "debug": "^4.1.1",
     "esbuild": "^0.25.0",
-    "eslint": "^8.57.0",
+    "eslint": "^9.22.0",
     "proxy-from-env": "^1.1.0",
     "semver": "^7.6.3",
     "supports-color": "^10.0.0",
diff --git a/deps/curl/.editorconfig b/deps/curl/.editorconfig
new file mode 100644
index 00000000000..edcc4629fba
--- /dev/null
+++ b/deps/curl/.editorconfig
@@ -0,0 +1,18 @@
+# Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+#
+# SPDX-License-Identifier: curl
+
+root = true
+
+[*]
+charset = utf-8
+insert_final_newline = true
+indent_style = space
+trim_trailing_whitespace = true
+
+[*.{c,h}]
+indent_size = 2
+max_line_length = 79
+
+[*.{pl,pm}]
+indent_size = 4
diff --git a/deps/curl/curl.gyp b/deps/curl/curl.gyp
index 0e1f749a0d2..c3a0faed44d 100644
--- a/deps/curl/curl.gyp
+++ b/deps/curl/curl.gyp
@@ -12,6 +12,7 @@
         'lib/bufref.c',
         'lib/bufq.c',
         'lib/cf-https-connect.c',
+        'lib/cf-ip-happy.c',
         'lib/cf-socket.c',
         'lib/cfilters.c',
         'lib/conncache.c',
@@ -127,6 +128,7 @@
         'lib/version.c',
         'lib/curlx/base64.c',
         'lib/curlx/dynbuf.c',
+        'lib/curlx/inet_ntop.c',
         'lib/curlx/inet_pton.c',
         'lib/curlx/multibyte.c',
         'lib/curlx/nonblock.c',
diff --git a/deps/curl/include/Makefile.in b/deps/curl/include/Makefile.in
index 3bfa56e75a8..2169d15a23b 100644
--- a/deps/curl/include/Makefile.in
+++ b/deps/curl/include/Makefile.in
@@ -232,6 +232,7 @@ CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX = @CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX@
 CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME = @CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME@
 CURL_NETWORK_AND_TIME_LIBS = @CURL_NETWORK_AND_TIME_LIBS@
 CYGPATH_W = @CYGPATH_W@
+DANTED = @DANTED@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
 DLLTOOL = @DLLTOOL@
diff --git a/deps/curl/include/curl/Makefile.in b/deps/curl/include/curl/Makefile.in
index aa203e458e7..2d3e435a940 100644
--- a/deps/curl/include/curl/Makefile.in
+++ b/deps/curl/include/curl/Makefile.in
@@ -219,6 +219,7 @@ CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX = @CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX@
 CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME = @CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME@
 CURL_NETWORK_AND_TIME_LIBS = @CURL_NETWORK_AND_TIME_LIBS@
 CYGPATH_W = @CYGPATH_W@
+DANTED = @DANTED@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
 DLLTOOL = @DLLTOOL@
diff --git a/deps/curl/include/curl/curl.h b/deps/curl/include/curl/curl.h
index 7ef5b993498..6f4aa90f134 100644
--- a/deps/curl/include/curl/curl.h
+++ b/deps/curl/include/curl/curl.h
@@ -102,7 +102,7 @@
 #include <sys/time.h>
 #endif
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
@@ -124,7 +124,7 @@ typedef void CURLSH;
 #elif defined(_WIN32) || \
      (CURL_HAS_DECLSPEC_ATTRIBUTE(dllexport) && \
       CURL_HAS_DECLSPEC_ATTRIBUTE(dllimport))
-#  if defined(BUILDING_LIBCURL)
+#  ifdef BUILDING_LIBCURL
 #    define CURL_EXTERN  __declspec(dllexport)
 #  else
 #    define CURL_EXTERN  __declspec(dllimport)
@@ -788,20 +788,24 @@ typedef CURLcode (*curl_ssl_ctx_callback)(CURL *curl,    /* easy handle */
                                                           mbedtls_ssl_config */
                                           void *userptr);
 
+#define CURLPROXY_HTTP            0L /* added in 7.10, new in 7.19.4 default is
+                                        to use CONNECT HTTP/1.1 */
+#define CURLPROXY_HTTP_1_0        1L /* force to use CONNECT HTTP/1.0
+                                        added in 7.19.4 */
+#define CURLPROXY_HTTPS           2L /* HTTPS but stick to HTTP/1
+                                        added in 7.52.0 */
+#define CURLPROXY_HTTPS2          3L /* HTTPS and attempt HTTP/2
+                                        added in 8.2.0 */
+#define CURLPROXY_SOCKS4          4L /* support added in 7.15.2, enum existed
+                                        already in 7.10 */
+#define CURLPROXY_SOCKS5          5L /* added in 7.10 */
+#define CURLPROXY_SOCKS4A         6L /* added in 7.18.0 */
+#define CURLPROXY_SOCKS5_HOSTNAME 7L /* Use the SOCKS5 protocol but pass along
+                                        the hostname rather than the IP
+                                        address. added in 7.18.0 */
+
 typedef enum {
-  CURLPROXY_HTTP = 0,   /* added in 7.10, new in 7.19.4 default is to use
-                           CONNECT HTTP/1.1 */
-  CURLPROXY_HTTP_1_0 = 1,   /* added in 7.19.4, force to use CONNECT
-                               HTTP/1.0  */
-  CURLPROXY_HTTPS = 2,  /* HTTPS but stick to HTTP/1 added in 7.52.0 */
-  CURLPROXY_HTTPS2 = 3, /* HTTPS and attempt HTTP/2 added in 8.2.0 */
-  CURLPROXY_SOCKS4 = 4, /* support added in 7.15.2, enum existed already
-                           in 7.10 */
-  CURLPROXY_SOCKS5 = 5, /* added in 7.10 */
-  CURLPROXY_SOCKS4A = 6, /* added in 7.18.0 */
-  CURLPROXY_SOCKS5_HOSTNAME = 7 /* Use the SOCKS5 protocol but pass along the
-                                   hostname rather than the IP address. added
-                                   in 7.18.0 */
+  CURLPROXY_LAST = 8 /* never use */
 } curl_proxytype;  /* this enum was added in 7.10 */
 
 /*
@@ -842,19 +846,19 @@ typedef enum {
 #define CURLAUTH_ANY          (~CURLAUTH_DIGEST_IE)
 #define CURLAUTH_ANYSAFE      (~(CURLAUTH_BASIC|CURLAUTH_DIGEST_IE))
 
-#define CURLSSH_AUTH_ANY       ~0     /* all types supported by the server */
-#define CURLSSH_AUTH_NONE      0      /* none allowed, silly but complete */
-#define CURLSSH_AUTH_PUBLICKEY (1<<0) /* public/private key files */
-#define CURLSSH_AUTH_PASSWORD  (1<<1) /* password */
-#define CURLSSH_AUTH_HOST      (1<<2) /* host key files */
-#define CURLSSH_AUTH_KEYBOARD  (1<<3) /* keyboard interactive */
-#define CURLSSH_AUTH_AGENT     (1<<4) /* agent (ssh-agent, pageant...) */
-#define CURLSSH_AUTH_GSSAPI    (1<<5) /* gssapi (kerberos, ...) */
+#define CURLSSH_AUTH_ANY       ~0L     /* all types supported by the server */
+#define CURLSSH_AUTH_NONE      0L      /* none allowed, silly but complete */
+#define CURLSSH_AUTH_PUBLICKEY (1L<<0) /* public/private key files */
+#define CURLSSH_AUTH_PASSWORD  (1L<<1) /* password */
+#define CURLSSH_AUTH_HOST      (1L<<2) /* host key files */
+#define CURLSSH_AUTH_KEYBOARD  (1L<<3) /* keyboard interactive */
+#define CURLSSH_AUTH_AGENT     (1L<<4) /* agent (ssh-agent, pageant...) */
+#define CURLSSH_AUTH_GSSAPI    (1L<<5) /* gssapi (kerberos, ...) */
 #define CURLSSH_AUTH_DEFAULT CURLSSH_AUTH_ANY
 
-#define CURLGSSAPI_DELEGATION_NONE        0      /* no delegation (default) */
-#define CURLGSSAPI_DELEGATION_POLICY_FLAG (1<<0) /* if permitted by policy */
-#define CURLGSSAPI_DELEGATION_FLAG        (1<<1) /* delegate always */
+#define CURLGSSAPI_DELEGATION_NONE        0L      /* no delegation (default) */
+#define CURLGSSAPI_DELEGATION_POLICY_FLAG (1L<<0) /* if permitted by policy */
+#define CURLGSSAPI_DELEGATION_FLAG        (1L<<1) /* delegate always */
 
 #define CURL_ERROR_SIZE 256
 
@@ -979,50 +983,55 @@ typedef enum {
 #endif /* !CURL_NO_OLDIES */
 
 /* parameter for the CURLOPT_FTP_SSL_CCC option */
+#define CURLFTPSSL_CCC_NONE    0L /* do not send CCC */
+#define CURLFTPSSL_CCC_PASSIVE 1L /* Let the server initiate the shutdown */
+#define CURLFTPSSL_CCC_ACTIVE  2L /* Initiate the shutdown */
+
 typedef enum {
-  CURLFTPSSL_CCC_NONE,    /* do not send CCC */
-  CURLFTPSSL_CCC_PASSIVE, /* Let the server initiate the shutdown */
-  CURLFTPSSL_CCC_ACTIVE,  /* Initiate the shutdown */
-  CURLFTPSSL_CCC_LAST     /* not an option, never use */
+  CURLFTPSSL_CCC_LAST = 3 /* not an option, never use */
 } curl_ftpccc;
 
 /* parameter for the CURLOPT_FTPSSLAUTH option */
+#define CURLFTPAUTH_DEFAULT 0L /* let libcurl decide */
+#define CURLFTPAUTH_SSL     1L /* use "AUTH SSL" */
+#define CURLFTPAUTH_TLS     2L /* use "AUTH TLS" */
+
 typedef enum {
-  CURLFTPAUTH_DEFAULT, /* let libcurl decide */
-  CURLFTPAUTH_SSL,     /* use "AUTH SSL" */
-  CURLFTPAUTH_TLS,     /* use "AUTH TLS" */
-  CURLFTPAUTH_LAST /* not an option, never use */
+  CURLFTPAUTH_LAST = 3 /* not an option, never use */
 } curl_ftpauth;
 
 /* parameter for the CURLOPT_FTP_CREATE_MISSING_DIRS option */
+#define CURLFTP_CREATE_DIR_NONE  0L /* do NOT create missing dirs! */
+#define CURLFTP_CREATE_DIR       1L /* (FTP/SFTP) if CWD fails, try MKD and
+                                       then CWD again if MKD succeeded, for
+                                       SFTP this does similar magic */
+#define CURLFTP_CREATE_DIR_RETRY 2L /* (FTP only) if CWD fails, try MKD and
+                                       then CWD again even if MKD failed! */
+
 typedef enum {
-  CURLFTP_CREATE_DIR_NONE,  /* do NOT create missing dirs! */
-  CURLFTP_CREATE_DIR,       /* (FTP/SFTP) if CWD fails, try MKD and then CWD
-                               again if MKD succeeded, for SFTP this does
-                               similar magic */
-  CURLFTP_CREATE_DIR_RETRY, /* (FTP only) if CWD fails, try MKD and then CWD
-                               again even if MKD failed! */
-  CURLFTP_CREATE_DIR_LAST   /* not an option, never use */
+  CURLFTP_CREATE_DIR_LAST = 3 /* not an option, never use */
 } curl_ftpcreatedir;
 
 /* parameter for the CURLOPT_FTP_FILEMETHOD option */
+#define CURLFTPMETHOD_DEFAULT   0L /* let libcurl pick */
+#define CURLFTPMETHOD_MULTICWD  1L /* single CWD operation for each path
+                                      part */
+#define CURLFTPMETHOD_NOCWD     2L /* no CWD at all */
+#define CURLFTPMETHOD_SINGLECWD 3L /* one CWD to full dir, then work on file */
+
 typedef enum {
-  CURLFTPMETHOD_DEFAULT,   /* let libcurl pick */
-  CURLFTPMETHOD_MULTICWD,  /* single CWD operation for each path part */
-  CURLFTPMETHOD_NOCWD,     /* no CWD at all */
-  CURLFTPMETHOD_SINGLECWD, /* one CWD to full dir, then work on file */
-  CURLFTPMETHOD_LAST       /* not an option, never use */
+  CURLFTPMETHOD_LAST = 4 /* not an option, never use */
 } curl_ftpmethod;
 
 /* bitmask defines for CURLOPT_HEADEROPT */
-#define CURLHEADER_UNIFIED  0
-#define CURLHEADER_SEPARATE (1<<0)
+#define CURLHEADER_UNIFIED  0L
+#define CURLHEADER_SEPARATE (1L<<0)
 
 /* CURLALTSVC_* are bits for the CURLOPT_ALTSVC_CTRL option */
-#define CURLALTSVC_READONLYFILE (1<<2)
-#define CURLALTSVC_H1           (1<<3)
-#define CURLALTSVC_H2           (1<<4)
-#define CURLALTSVC_H3           (1<<5)
+#define CURLALTSVC_READONLYFILE (1L<<2)
+#define CURLALTSVC_H1           (1L<<3)
+#define CURLALTSVC_H2           (1L<<4)
+#define CURLALTSVC_H3           (1L<<5)
 
 /* bitmask values for CURLOPT_UPLOAD_FLAGS */
 #define CURLULFLAG_ANSWERED (1L<<0)
@@ -1058,42 +1067,42 @@ typedef CURLSTScode (*curl_hstswrite_callback)(CURL *easy,
                                                void *userp);
 
 /* CURLHSTS_* are bits for the CURLOPT_HSTS option */
-#define CURLHSTS_ENABLE       (long)(1<<0)
-#define CURLHSTS_READONLYFILE (long)(1<<1)
+#define CURLHSTS_ENABLE       (1L<<0)
+#define CURLHSTS_READONLYFILE (1L<<1)
 
 /* The CURLPROTO_ defines below are for the **deprecated** CURLOPT_*PROTOCOLS
    options. Do not use. */
-#define CURLPROTO_HTTP   (1<<0)
-#define CURLPROTO_HTTPS  (1<<1)
-#define CURLPROTO_FTP    (1<<2)
-#define CURLPROTO_FTPS   (1<<3)
-#define CURLPROTO_SCP    (1<<4)
-#define CURLPROTO_SFTP   (1<<5)
-#define CURLPROTO_TELNET (1<<6)
-#define CURLPROTO_LDAP   (1<<7)
-#define CURLPROTO_LDAPS  (1<<8)
-#define CURLPROTO_DICT   (1<<9)
-#define CURLPROTO_FILE   (1<<10)
-#define CURLPROTO_TFTP   (1<<11)
-#define CURLPROTO_IMAP   (1<<12)
-#define CURLPROTO_IMAPS  (1<<13)
-#define CURLPROTO_POP3   (1<<14)
-#define CURLPROTO_POP3S  (1<<15)
-#define CURLPROTO_SMTP   (1<<16)
-#define CURLPROTO_SMTPS  (1<<17)
-#define CURLPROTO_RTSP   (1<<18)
-#define CURLPROTO_RTMP   (1<<19)
-#define CURLPROTO_RTMPT  (1<<20)
-#define CURLPROTO_RTMPE  (1<<21)
-#define CURLPROTO_RTMPTE (1<<22)
-#define CURLPROTO_RTMPS  (1<<23)
-#define CURLPROTO_RTMPTS (1<<24)
-#define CURLPROTO_GOPHER (1<<25)
-#define CURLPROTO_SMB    (1<<26)
-#define CURLPROTO_SMBS   (1<<27)
-#define CURLPROTO_MQTT   (1<<28)
-#define CURLPROTO_GOPHERS (1<<29)
-#define CURLPROTO_ALL    (~0) /* enable everything */
+#define CURLPROTO_HTTP    (1L<<0)
+#define CURLPROTO_HTTPS   (1L<<1)
+#define CURLPROTO_FTP     (1L<<2)
+#define CURLPROTO_FTPS    (1L<<3)
+#define CURLPROTO_SCP     (1L<<4)
+#define CURLPROTO_SFTP    (1L<<5)
+#define CURLPROTO_TELNET  (1L<<6)
+#define CURLPROTO_LDAP    (1L<<7)
+#define CURLPROTO_LDAPS   (1L<<8)
+#define CURLPROTO_DICT    (1L<<9)
+#define CURLPROTO_FILE    (1L<<10)
+#define CURLPROTO_TFTP    (1L<<11)
+#define CURLPROTO_IMAP    (1L<<12)
+#define CURLPROTO_IMAPS   (1L<<13)
+#define CURLPROTO_POP3    (1L<<14)
+#define CURLPROTO_POP3S   (1L<<15)
+#define CURLPROTO_SMTP    (1L<<16)
+#define CURLPROTO_SMTPS   (1L<<17)
+#define CURLPROTO_RTSP    (1L<<18)
+#define CURLPROTO_RTMP    (1L<<19)
+#define CURLPROTO_RTMPT   (1L<<20)
+#define CURLPROTO_RTMPE   (1L<<21)
+#define CURLPROTO_RTMPTE  (1L<<22)
+#define CURLPROTO_RTMPS   (1L<<23)
+#define CURLPROTO_RTMPTS  (1L<<24)
+#define CURLPROTO_GOPHER  (1L<<25)
+#define CURLPROTO_SMB     (1L<<26)
+#define CURLPROTO_SMBS    (1L<<27)
+#define CURLPROTO_MQTT    (1L<<28)
+#define CURLPROTO_GOPHERS (1L<<29)
+#define CURLPROTO_ALL     (~0L) /* enable everything */
 
 /* long may be 32 or 64 bits, but we should never depend on anything else
    but 32 */
@@ -2354,18 +2363,18 @@ enum CURL_NETRC_OPTION {
   CURL_NETRC_LAST = 3
 };
 
-#define CURL_SSLVERSION_DEFAULT 0
-#define CURL_SSLVERSION_TLSv1   1 /* TLS 1.x */
-#define CURL_SSLVERSION_SSLv2   2
-#define CURL_SSLVERSION_SSLv3   3
-#define CURL_SSLVERSION_TLSv1_0 4
-#define CURL_SSLVERSION_TLSv1_1 5
-#define CURL_SSLVERSION_TLSv1_2 6
-#define CURL_SSLVERSION_TLSv1_3 7
+#define CURL_SSLVERSION_DEFAULT 0L
+#define CURL_SSLVERSION_TLSv1   1L /* TLS 1.x */
+#define CURL_SSLVERSION_SSLv2   2L
+#define CURL_SSLVERSION_SSLv3   3L
+#define CURL_SSLVERSION_TLSv1_0 4L
+#define CURL_SSLVERSION_TLSv1_1 5L
+#define CURL_SSLVERSION_TLSv1_2 6L
+#define CURL_SSLVERSION_TLSv1_3 7L
 
-#define CURL_SSLVERSION_LAST 8 /* never use, keep last */
+#define CURL_SSLVERSION_LAST    8L /* never use, keep last */
 
-#define CURL_SSLVERSION_MAX_NONE 0
+#define CURL_SSLVERSION_MAX_NONE 0L
 #define CURL_SSLVERSION_MAX_DEFAULT (CURL_SSLVERSION_TLSv1   << 16)
 #define CURL_SSLVERSION_MAX_TLSv1_0 (CURL_SSLVERSION_TLSv1_0 << 16)
 #define CURL_SSLVERSION_MAX_TLSv1_1 (CURL_SSLVERSION_TLSv1_1 << 16)
@@ -2389,10 +2398,10 @@ enum CURL_TLSAUTH {
    can be bitwise ORed so that CURL_REDIR_POST_301 | CURL_REDIR_POST_302
    | CURL_REDIR_POST_303 == CURL_REDIR_POST_ALL */
 
-#define CURL_REDIR_GET_ALL  0
-#define CURL_REDIR_POST_301 1
-#define CURL_REDIR_POST_302 2
-#define CURL_REDIR_POST_303 4
+#define CURL_REDIR_GET_ALL  0L
+#define CURL_REDIR_POST_301 1L
+#define CURL_REDIR_POST_302 2L
+#define CURL_REDIR_POST_303 4L
 #define CURL_REDIR_POST_ALL \
     (CURL_REDIR_POST_301|CURL_REDIR_POST_302|CURL_REDIR_POST_303)
 
@@ -2421,7 +2430,7 @@ typedef struct curl_mime      curl_mime;      /* Mime context. */
 typedef struct curl_mimepart  curl_mimepart;  /* Mime part context. */
 
 /* CURLMIMEOPT_ defines are for the CURLOPT_MIME_OPTIONS option. */
-#define CURLMIMEOPT_FORMESCAPE  (1<<0) /* Use backslash-escaping for forms. */
+#define CURLMIMEOPT_FORMESCAPE  (1L<<0) /* Use backslash-escaping for forms. */
 
 /*
  * NAME curl_mime_init()
@@ -2750,7 +2759,7 @@ CURL_EXTERN CURLcode curl_global_init(long flags);
  * for each application that uses libcurl. This function can be used to
  * initialize libcurl and set user defined memory management callback
  * functions. Users can implement memory management routines to check for
- * memory leaks, check for mis-use of the curl library etc. User registered
+ * memory leaks, check for misuse of the curl library etc. User registered
  * callback routines will be invoked by this library instead of the system
  * memory management routines like malloc, free etc.
  */
@@ -3302,7 +3311,7 @@ CURL_EXTERN CURLcode curl_easy_ssls_export(CURL *handle,
                                            void *userptr);
 
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 } /* end of extern "C" */
 #endif
 
@@ -3317,8 +3326,9 @@ CURL_EXTERN CURLcode curl_easy_ssls_export(CURL *handle,
 #include "mprintf.h"
 
 /* the typechecker does not work in C++ (yet) */
-#if defined(__GNUC__) && defined(__GNUC_MINOR__) && \
-    ((__GNUC__ > 4) || (__GNUC__ == 4 && __GNUC_MINOR__ >= 3)) && \
+#if ((defined(__GNUC__) && defined(__GNUC_MINOR__) && \
+      ((__GNUC__ > 4) || (__GNUC__ == 4 && __GNUC_MINOR__ >= 3))) || \
+    (defined(__clang__) && __clang_major__ >= 14)) && \
     !defined(__cplusplus) && !defined(CURL_DISABLE_TYPECHECK)
 #include "typecheck-gcc.h"
 #else
diff --git a/deps/curl/include/curl/curlver.h b/deps/curl/include/curl/curlver.h
index 31b01b99755..3c7a919415e 100644
--- a/deps/curl/include/curl/curlver.h
+++ b/deps/curl/include/curl/curlver.h
@@ -32,14 +32,13 @@
 
 /* This is the version number of the libcurl package from which this header
    file origins: */
-#define LIBCURL_VERSION "8.15.0"
+#define LIBCURL_VERSION "8.16.0"
 
 /* The numeric version number is also available "in parts" by using these
    defines: */
 #define LIBCURL_VERSION_MAJOR 8
-#define LIBCURL_VERSION_MINOR 15
+#define LIBCURL_VERSION_MINOR 16
 #define LIBCURL_VERSION_PATCH 0
-
 /* This is the numeric version of the libcurl version number, meant for easier
    parsing and comparisons by programs. The LIBCURL_VERSION_NUM define will
    always follow this syntax:
@@ -59,7 +58,7 @@
    CURL_VERSION_BITS() macro since curl's own configure script greps for it
    and needs it to contain the full number.
 */
-#define LIBCURL_VERSION_NUM 0x080f00
+#define LIBCURL_VERSION_NUM 0x081000
 
 /*
  * This is the date and time when the full source package was created. The
@@ -70,7 +69,7 @@
  *
  * "2007-11-23"
  */
-#define LIBCURL_TIMESTAMP "2025-07-16"
+#define LIBCURL_TIMESTAMP "2025-09-10"
 
 #define CURL_VERSION_BITS(x,y,z) ((x)<<16|(y)<<8|(z))
 #define CURL_AT_LEAST_VERSION(x,y,z) \
diff --git a/deps/curl/include/curl/easy.h b/deps/curl/include/curl/easy.h
index 56f8060e045..fa135649379 100644
--- a/deps/curl/include/curl/easy.h
+++ b/deps/curl/include/curl/easy.h
@@ -23,7 +23,7 @@
  * SPDX-License-Identifier: curl
  *
  ***************************************************************************/
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
@@ -118,7 +118,7 @@ CURL_EXTERN CURLcode curl_easy_send(CURL *curl, const void *buffer,
  */
 CURL_EXTERN CURLcode curl_easy_upkeep(CURL *curl);
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 } /* end of extern "C" */
 #endif
 
diff --git a/deps/curl/include/curl/header.h b/deps/curl/include/curl/header.h
index 8df11e1e424..7465274b9c4 100644
--- a/deps/curl/include/curl/header.h
+++ b/deps/curl/include/curl/header.h
@@ -24,7 +24,7 @@
  *
  ***************************************************************************/
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
diff --git a/deps/curl/include/curl/mprintf.h b/deps/curl/include/curl/mprintf.h
index 88059c851fb..9272e748919 100644
--- a/deps/curl/include/curl/mprintf.h
+++ b/deps/curl/include/curl/mprintf.h
@@ -28,7 +28,7 @@
 #include <stdio.h> /* needed for FILE */
 #include "curl.h"  /* for CURL_EXTERN */
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
@@ -38,7 +38,7 @@ extern "C" {
   defined(__STDC_VERSION__) && (__STDC_VERSION__ >= 199901L) &&         \
   !defined(CURL_NO_FMT_CHECKS)
 #if defined(__MINGW32__) && !defined(__clang__)
-#if defined(__MINGW_PRINTF_FORMAT)  /* mingw-w64 3.0.0+. Needs stdio.h. */
+#ifdef __MINGW_PRINTF_FORMAT  /* mingw-w64 3.0.0+. Needs stdio.h. */
 #define CURL_TEMP_PRINTF(fmt, arg) \
   __attribute__((format(__MINGW_PRINTF_FORMAT, fmt, arg)))
 #else
@@ -78,7 +78,7 @@ CURL_EXTERN char *curl_mvaprintf(const char *format, va_list args)
 
 #undef CURL_TEMP_PRINTF
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 } /* end of extern "C" */
 #endif
 
diff --git a/deps/curl/include/curl/multi.h b/deps/curl/include/curl/multi.h
index 42469bb5657..782541f1abb 100644
--- a/deps/curl/include/curl/multi.h
+++ b/deps/curl/include/curl/multi.h
@@ -50,7 +50,7 @@
  */
 #include "curl.h"
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
@@ -395,9 +395,23 @@ typedef enum {
   /* maximum number of concurrent streams to support on a connection */
   CURLOPT(CURLMOPT_MAX_CONCURRENT_STREAMS, CURLOPTTYPE_LONG, 16),
 
+  /* network has changed, adjust caches/connection reuse */
+  CURLOPT(CURLMOPT_NETWORK_CHANGED, CURLOPTTYPE_LONG, 17),
+
   CURLMOPT_LASTENTRY /* the last unused */
 } CURLMoption;
 
+/* Definition of bits for the CURLMOPT_NETWORK_CHANGED argument: */
+
+/* - CURLMNWC_CLEAR_CONNS tells libcurl to prevent further reuse of existing
+   connections. Connections that are idle will be closed. Ongoing transfers
+   will continue with the connection they have. */
+#define CURLMNWC_CLEAR_CONNS (1L<<0)
+
+/* - CURLMNWC_CLEAR_DNS tells libcurl to prevent further reuse of existing
+   connections. Connections that are idle will be closed. Ongoing transfers
+   will continue with the connection they have. */
+#define CURLMNWC_CLEAR_DNS (1L<<0)
 
 /*
  * Name:    curl_multi_setopt()
@@ -434,6 +448,36 @@ CURL_EXTERN CURLMcode curl_multi_assign(CURLM *multi_handle,
  */
 CURL_EXTERN CURL **curl_multi_get_handles(CURLM *multi_handle);
 
+
+typedef enum {
+  CURLMINFO_NONE, /* first, never use this */
+  /* The number of easy handles currently managed by the multi handle,
+   * e.g. have been added but not yet removed. */
+  CURLMINFO_XFERS_CURRENT = 1,
+  /* The number of easy handles running, e.g. not done and not queueing. */
+  CURLMINFO_XFERS_RUNNING = 2,
+  /* The number of easy handles waiting to start, e.g. for a connection
+   * to become available due to limits on parallelism, max connections
+   * or other factors. */
+  CURLMINFO_XFERS_PENDING = 3,
+  /* The number of easy handles finished, waiting for their results to
+   * be read via `curl_multi_info_read()`. */
+  CURLMINFO_XFERS_DONE = 4,
+  /* The total number of easy handles added to the multi handle, ever. */
+  CURLMINFO_XFERS_ADDED = 5
+} CURLMinfo_offt;
+
+/*
+ * Name:    curl_multi_get_offt()
+ *
+ * Desc:    Retrieves a numeric value for the `CURLMINFO_*` enums.
+ *
+ * Returns: CULRM_OK or error when value could not be obtained.
+ */
+CURL_EXTERN CURLMcode curl_multi_get_offt(CURLM *multi_handle,
+                                          CURLMinfo_offt info,
+                                          curl_off_t *pvalue);
+
 /*
  * Name: curl_push_callback
  *
diff --git a/deps/curl/include/curl/options.h b/deps/curl/include/curl/options.h
index 1ed76a95c68..77cab7768f2 100644
--- a/deps/curl/include/curl/options.h
+++ b/deps/curl/include/curl/options.h
@@ -24,7 +24,7 @@
  *
  ***************************************************************************/
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
diff --git a/deps/curl/include/curl/system.h b/deps/curl/include/curl/system.h
index ebcdc5e4fd0..62ed2b0f43a 100644
--- a/deps/curl/include/curl/system.h
+++ b/deps/curl/include/curl/system.h
@@ -66,7 +66,7 @@
 #  define CURL_TYPEOF_CURL_SOCKLEN_T int
 
 #elif defined(__POCC__)
-#  if defined(_MSC_VER)
+#  ifdef _MSC_VER
 #    define CURL_TYPEOF_CURL_OFF_T     __int64
 #    define CURL_FORMAT_CURL_OFF_T     "I64d"
 #    define CURL_FORMAT_CURL_OFF_TU    "I64u"
@@ -82,7 +82,7 @@
 #  define CURL_TYPEOF_CURL_SOCKLEN_T int
 
 #elif defined(__LCC__)
-#  if defined(__MCST__) /* MCST eLbrus Compiler Collection */
+#  ifdef __MCST__ /* MCST eLbrus Compiler Collection */
 #    define CURL_TYPEOF_CURL_OFF_T     long
 #    define CURL_FORMAT_CURL_OFF_T     "ld"
 #    define CURL_FORMAT_CURL_OFF_TU    "lu"
@@ -118,7 +118,7 @@
 #  define CURL_TYPEOF_CURL_SOCKLEN_T unsigned int
 
 #elif defined(__TANDEM)
-#  if !defined(__LP64)
+#  ifndef __LP64
 #    define CURL_TYPEOF_CURL_OFF_T     long long
 #    define CURL_FORMAT_CURL_OFF_T     "lld"
 #    define CURL_FORMAT_CURL_OFF_TU    "llu"
@@ -135,7 +135,7 @@
 #  endif
 
 #elif defined(UNDER_CE)
-#  if defined(__MINGW32CE__)
+#  ifdef __MINGW32CE__
 #    define CURL_TYPEOF_CURL_OFF_T     long long
 #    define CURL_FORMAT_CURL_OFF_T     "lld"
 #    define CURL_FORMAT_CURL_OFF_TU    "llu"
@@ -162,7 +162,7 @@
 #  define CURL_PULL_SYS_TYPES_H      1
 
 #elif defined(__VMS)
-#  if defined(__VAX)
+#  ifdef __VAX
 #    define CURL_TYPEOF_CURL_OFF_T     long
 #    define CURL_FORMAT_CURL_OFF_T     "ld"
 #    define CURL_FORMAT_CURL_OFF_TU    "lu"
@@ -188,7 +188,7 @@
 #  define CURL_PULL_SYS_SOCKET_H     1
 
 #elif defined(__MVS__)
-#  if defined(_LONG_LONG)
+#  ifdef _LONG_LONG
 #    define CURL_TYPEOF_CURL_OFF_T     long long
 #    define CURL_FORMAT_CURL_OFF_T     "lld"
 #    define CURL_FORMAT_CURL_OFF_TU    "llu"
@@ -207,7 +207,7 @@
 
 #elif defined(__370__)
 #  if defined(__IBMC__) || defined(__IBMCPP__)
-#    if defined(_LONG_LONG)
+#    ifdef _LONG_LONG
 #      define CURL_TYPEOF_CURL_OFF_T     long long
 #      define CURL_FORMAT_CURL_OFF_T     "lld"
 #      define CURL_FORMAT_CURL_OFF_TU    "llu"
@@ -266,7 +266,7 @@
 #  define CURL_PULL_SYS_SOCKET_H     1
 
 #elif defined(__xlc__) /* IBM xlc compiler */
-#  if !defined(_LP64)
+#  ifndef _LP64
 #    define CURL_TYPEOF_CURL_OFF_T     long long
 #    define CURL_FORMAT_CURL_OFF_T     "lld"
 #    define CURL_FORMAT_CURL_OFF_TU    "llu"
@@ -284,7 +284,7 @@
 #  define CURL_PULL_SYS_SOCKET_H     1
 
 #elif defined(__hpux) /* HP aCC compiler */
-#  if !defined(_LP64)
+#  ifndef _LP64
 #    define CURL_TYPEOF_CURL_OFF_T     long long
 #    define CURL_FORMAT_CURL_OFF_T     "lld"
 #    define CURL_FORMAT_CURL_OFF_TU    "llu"
@@ -336,8 +336,11 @@
 #    define CURL_FORMAT_CURL_OFF_TU    "llu"
 #    define CURL_SUFFIX_CURL_OFF_T     LL
 #    define CURL_SUFFIX_CURL_OFF_TU    ULL
-#    define CURL_POPCOUNT64(x)         __builtin_popcountll(x)
-#    define CURL_CTZ64(x)              __builtin_ctzll(x)
+#    if (__GNUC__ >= 4) || \
+       ((__GNUC__ == 3) && defined(__GNUC_MINOR__) && (__GNUC_MINOR__ >= 4))
+#      define CURL_POPCOUNT64(x)       __builtin_popcountll(x)
+#      define CURL_CTZ64(x)            __builtin_ctzll(x)
+#    endif
 #  elif defined(__LP64__) || \
         defined(__x86_64__) || defined(__ppc64__) || defined(__sparc64__) || \
         defined(__e2k__) || \
@@ -348,8 +351,11 @@
 #    define CURL_FORMAT_CURL_OFF_TU    "lu"
 #    define CURL_SUFFIX_CURL_OFF_T     L
 #    define CURL_SUFFIX_CURL_OFF_TU    UL
-#    define CURL_POPCOUNT64(x)         __builtin_popcountl(x)
-#    define CURL_CTZ64(x)              __builtin_ctzl(x)
+#    if (__GNUC__ >= 4) || \
+       ((__GNUC__ == 3) && defined(__GNUC_MINOR__) && (__GNUC_MINOR__ >= 4))
+#      define CURL_POPCOUNT64(x)       __builtin_popcountl(x)
+#      define CURL_CTZ64(x)            __builtin_ctzl(x)
+#    endif
 #  endif
 #  define CURL_TYPEOF_CURL_SOCKLEN_T socklen_t
 #  define CURL_PULL_SYS_TYPES_H      1
diff --git a/deps/curl/include/curl/typecheck-gcc.h b/deps/curl/include/curl/typecheck-gcc.h
index ca0c0ef9d69..a0b41aeb247 100644
--- a/deps/curl/include/curl/typecheck-gcc.h
+++ b/deps/curl/include/curl/typecheck-gcc.h
@@ -135,7 +135,7 @@
               _curl_easy_setopt_err_error_buffer();                     \
           if((option) == CURLOPT_CURLU)                                 \
             if(!curlcheck_ptr((value), CURLU))                          \
-              _curl_easy_setopt_err_curlu();                    \
+              _curl_easy_setopt_err_curlu();                            \
           if((option) == CURLOPT_STDERR)                                \
             if(!curlcheck_FILE(value))                                  \
               _curl_easy_setopt_err_FILE();                             \
@@ -178,7 +178,7 @@
               _curl_easy_getinfo_err_curl_slist();                      \
           if(curlcheck_tlssessioninfo_info(info))                       \
             if(!curlcheck_arr((arg), struct curl_tlssessioninfo *))     \
-              _curl_easy_getinfo_err_curl_tlssessioninfo();            \
+              _curl_easy_getinfo_err_curl_tlssessioninfo();             \
           if(curlcheck_certinfo_info(info))                             \
             if(!curlcheck_arr((arg), struct curl_certinfo *))           \
               _curl_easy_getinfo_err_curl_certinfo();                   \
@@ -193,11 +193,68 @@
       curl_easy_getinfo(handle, info, arg);                             \
     })
 
+#define curl_multi_setopt(handle, option, value)                        \
+  __extension__({                                                       \
+      if(__builtin_constant_p(option)) {                                \
+        if(curlcheck_long_option(option))                               \
+          if(!curlcheck_long(value))                                    \
+            _curl_multi_setopt_err_long();                              \
+        if(curlcheck_off_t_option(option))                              \
+          if(!curlcheck_off_t(value))                                   \
+            _curl_multi_setopt_err_curl_off_t();                        \
+        if(curlcheck_multicb_data_option(option))                       \
+          if(!curlcheck_cb_data(value))                                 \
+            _curl_multi_setopt_err_cb_data();                           \
+        if(curlcheck_charpp_option(option))                             \
+          if(!curlcheck_ptrptr(value, char))                            \
+            _curl_multi_setopt_err_charpp();                            \
+        if((option) == CURLMOPT_PUSHFUNCTION)                           \
+          if(!curlcheck_multipush_cb(value))                            \
+            _curl_multi_setopt_err_pushcb();                            \
+        if((option) == CURLMOPT_SOCKETFUNCTION)                         \
+          if(!curlcheck_multisocket_cb(value))                          \
+            _curl_multi_setopt_err_socketcb();                          \
+        if((option) == CURLMOPT_TIMERFUNCTION)                          \
+          if(!curlcheck_multitimer_cb(value))                           \
+            _curl_multi_setopt_err_timercb();                           \
+      }                                                                 \
+      curl_multi_setopt(handle, option, value);                         \
+    })
+
+/* evaluates to true if the option takes a data argument to pass to a
+   callback */
+#define curlcheck_multicb_data_option(option)                           \
+  ((option) == CURLMOPT_PUSHDATA ||                                     \
+   (option) == CURLMOPT_SOCKETDATA ||                                   \
+   (option) == CURLMOPT_TIMERDATA ||                                    \
+   0)
+
+/* evaluates to true if the option takes a char ** argument */
+#define curlcheck_charpp_option(option)                                 \
+  ((option) == CURLMOPT_PIPELINING_SERVER_BL ||                         \
+   (option) == CURLMOPT_PIPELINING_SITE_BL ||                           \
+   0)
+
+/* evaluates to true if expr is of type curl_multi_timer_callback */
+#define curlcheck_multitimer_cb(expr)                                   \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_multi_timer_callback))
+
+/* evaluates to true if expr is of type curl_socket_callback */
+#define curlcheck_multisocket_cb(expr)                                  \
+  (curlcheck_NULL(expr) ||                                              \
+   curlcheck_cb_compatible((expr), curl_socket_callback))
+
+/* evaluates to true if expr is of type curl_push_callback */
+#define curlcheck_multipush_cb(expr)                                  \
+  (curlcheck_NULL(expr) ||                                            \
+   curlcheck_cb_compatible((expr), curl_push_callback))
+
 /*
  * For now, just make sure that the functions are called with three arguments
  */
 #define curl_share_setopt(share,opt,param) curl_share_setopt(share,opt,param)
-#define curl_multi_setopt(handle,opt,param) curl_multi_setopt(handle,opt,param)
+
 
 /* the actual warnings, triggered by calling the _curl_easy_setopt_err*
  * functions */
@@ -208,6 +265,21 @@
   __attribute__((__unused__)) __attribute__((__noinline__))             \
   id(void) { __asm__(""); }
 
+CURLWARNING(_curl_multi_setopt_err_long,
+            "curl_multi_setopt expects a long argument")
+CURLWARNING(_curl_multi_setopt_err_curl_off_t,
+            "curl_multi_setopt expects a curl_off_t argument")
+CURLWARNING(_curl_multi_setopt_err_cb_data,
+            "curl_multi_setopt expects a 'void *' argument")
+CURLWARNING(_curl_multi_setopt_err_charpp,
+            "curl_multi_setopt expects a 'char **' argument")
+CURLWARNING(_curl_multi_setopt_err_pushcb,
+            "curl_multi_setopt expects a curl_push_callback argument")
+CURLWARNING(_curl_multi_setopt_err_socketcb,
+            "curl_multi_setopt expects a curl_socket_callback argument")
+CURLWARNING(_curl_multi_setopt_err_timercb,
+            "curl_multi_setopt expects a curl_multi_timer_callback argument")
+
 CURLWARNING(_curl_easy_setopt_err_long,
             "curl_easy_setopt expects a long argument")
 CURLWARNING(_curl_easy_setopt_err_curl_off_t,
@@ -534,6 +606,14 @@ CURLWARNING(_curl_easy_getinfo_err_curl_off_t,
    __builtin_types_compatible_p(__typeof__(expr), type *) ||            \
    __builtin_types_compatible_p(__typeof__(expr), const type *))
 
+/* evaluates to true if expr is type**, const type** or NULL */
+#define curlcheck_ptrptr(expr, type)                                    \
+  (curlcheck_NULL(expr) ||                                              \
+   __builtin_types_compatible_p(__typeof__(expr), type **) ||           \
+   __builtin_types_compatible_p(__typeof__(expr), type *[]) ||          \
+   __builtin_types_compatible_p(__typeof__(expr), const type *[]) ||    \
+   __builtin_types_compatible_p(__typeof__(expr), const type **))
+
 /* evaluates to true if expr is one of type[], type*, NULL or const type* */
 #define curlcheck_arr(expr, type)                                       \
   (curlcheck_ptr((expr), type) ||                                       \
@@ -546,7 +626,7 @@ CURLWARNING(_curl_easy_getinfo_err_curl_off_t,
    curlcheck_arr((expr), unsigned char))
 
 /* evaluates to true if expr is a CURL * */
-#define curlcheck_curl(expr)                                          \
+#define curlcheck_curl(expr)                                            \
   (curlcheck_NULL(expr) ||                                              \
    __builtin_types_compatible_p(__typeof__(expr), CURL *))
 
@@ -840,8 +920,8 @@ typedef long (*_curl_chunk_bgn_callback2)(void *, void *, int);
    curlcheck_cb_compatible((expr), curl_sshhostkeycallback))
 
 /* evaluates to true if expr is of type curl_sshkeycallback */
-#define curlcheck_ssh_key_cb(expr)                                  \
-  (curlcheck_NULL(expr) ||                                          \
+#define curlcheck_ssh_key_cb(expr)                                      \
+  (curlcheck_NULL(expr) ||                                              \
    curlcheck_cb_compatible((expr), curl_sshkeycallback))
 
 /* evaluates to true if expr is of type curl_interleave_callback */
@@ -855,13 +935,13 @@ typedef size_t (*_curl_interleave_callback2)(char *p, size_t s,
                                              size_t n, void *u);
 
 /* evaluates to true if expr is of type curl_prereq_callback */
-#define curlcheck_prereq_cb(expr)                                    \
-  (curlcheck_NULL(expr) ||                                           \
+#define curlcheck_prereq_cb(expr)                                       \
+  (curlcheck_NULL(expr) ||                                              \
    curlcheck_cb_compatible((expr), curl_prereq_callback))
 
 /* evaluates to true if expr is of type curl_trailer_callback */
-#define curlcheck_trailer_cb(expr)                                    \
-  (curlcheck_NULL(expr) ||                                            \
+#define curlcheck_trailer_cb(expr)                                      \
+  (curlcheck_NULL(expr) ||                                              \
    curlcheck_cb_compatible((expr), curl_trailer_callback))
 
 #endif /* CURLINC_TYPECHECK_GCC_H */
diff --git a/deps/curl/include/curl/urlapi.h b/deps/curl/include/curl/urlapi.h
index b4a6e5d5670..34c11a6bb7f 100644
--- a/deps/curl/include/curl/urlapi.h
+++ b/deps/curl/include/curl/urlapi.h
@@ -26,7 +26,7 @@
 
 #include "curl.h"
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
diff --git a/deps/curl/include/curl/websockets.h b/deps/curl/include/curl/websockets.h
index afb86b4ebcf..df8590f399d 100644
--- a/deps/curl/include/curl/websockets.h
+++ b/deps/curl/include/curl/websockets.h
@@ -24,7 +24,7 @@
  *
  ***************************************************************************/
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 extern "C" {
 #endif
 
@@ -72,13 +72,26 @@ CURL_EXTERN CURLcode curl_ws_send(CURL *curl, const void *buffer,
                                   curl_off_t fragsize,
                                   unsigned int flags);
 
+/*
+ * NAME curl_ws_start_frame()
+ *
+ * DESCRIPTION
+ *
+ * Buffers a websocket frame header with the given flags and length.
+ * Errors when a previous frame is not complete, e.g. not all its
+ * payload has been added.
+ */
+CURL_EXTERN CURLcode curl_ws_start_frame(CURL *curl,
+                                         unsigned int flags,
+                                         curl_off_t frame_len);
+
 /* bits for the CURLOPT_WS_OPTIONS bitmask: */
-#define CURLWS_RAW_MODE   (1<<0)
-#define CURLWS_NOAUTOPONG (1<<1)
+#define CURLWS_RAW_MODE   (1L<<0)
+#define CURLWS_NOAUTOPONG (1L<<1)
 
 CURL_EXTERN const struct curl_ws_frame *curl_ws_meta(CURL *curl);
 
-#ifdef  __cplusplus
+#ifdef __cplusplus
 }
 #endif
 
diff --git a/deps/curl/lib/CMakeLists.txt b/deps/curl/lib/CMakeLists.txt
index 9b0fda54092..3476d55b096 100644
--- a/deps/curl/lib/CMakeLists.txt
+++ b/deps/curl/lib/CMakeLists.txt
@@ -24,8 +24,7 @@
 
 set(LIBCURL_OUTPUT_NAME "${LIB_NAME}" CACHE STRING "Basename of the curl library")
 
-set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS "BUILDING_LIBCURL")
-set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS "${CURL_DEBUG_MACROS}")
+set_property(DIRECTORY APPEND PROPERTY COMPILE_DEFINITIONS ${CURL_DEBUG_MACROS} "BUILDING_LIBCURL")
 
 configure_file("curl_config.h.cmake" "${CMAKE_CURRENT_BINARY_DIR}/curl_config.h")
 
@@ -56,7 +55,7 @@ if(CURL_BUILD_TESTING)
       ${CSOURCES} > "${CMAKE_CURRENT_BINARY_DIR}/unitprotos.h"
     DEPENDS "${PROJECT_SOURCE_DIR}/scripts/extract-unit-protos" ${CSOURCES}
     VERBATIM)
-  add_custom_target(curlu-unitprotos ALL DEPENDS "${CMAKE_CURRENT_BINARY_DIR}/unitprotos.h")
+  add_custom_target(curlu-unitprotos DEPENDS "${CMAKE_CURRENT_BINARY_DIR}/unitprotos.h")
 endif()
 
 ## Library definition
@@ -156,11 +155,11 @@ if(BUILD_STATIC_LIBS)
   endif()
   if(CURL_HAS_LTO)
     if(CMAKE_CONFIGURATION_TYPES)
-      set_target_properties(${LIB_OBJECT} PROPERTIES
+      set_target_properties(${LIB_STATIC} PROPERTIES
         INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
         INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
     else()
-      set_target_properties(${LIB_OBJECT} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
+      set_target_properties(${LIB_STATIC} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
     endif()
   endif()
 
@@ -192,11 +191,11 @@ if(BUILD_SHARED_LIBS)
   endif()
   if(CURL_HAS_LTO)
     if(CMAKE_CONFIGURATION_TYPES)
-      set_target_properties(${LIB_OBJECT} PROPERTIES
+      set_target_properties(${LIB_SHARED} PROPERTIES
         INTERPROCEDURAL_OPTIMIZATION_RELEASE TRUE
         INTERPROCEDURAL_OPTIMIZATION_RELWITHDEBINFO TRUE)
     else()
-      set_target_properties(${LIB_OBJECT} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
+      set_target_properties(${LIB_SHARED} PROPERTIES INTERPROCEDURAL_OPTIMIZATION TRUE)
     endif()
   endif()
 
diff --git a/deps/curl/lib/Makefile.am b/deps/curl/lib/Makefile.am
index 75fbbdf4b93..973876f5010 100644
--- a/deps/curl/lib/Makefile.am
+++ b/deps/curl/lib/Makefile.am
@@ -66,7 +66,6 @@ AM_CPPFLAGS = -I$(top_srcdir)/include   \
 # Prevent LIBS from being used for all link targets
 LIBS = $(BLANK_AT_MAKETIME)
 
-AM_CPPFLAGS += -DBUILDING_LIBCURL
 AM_LDFLAGS =
 AM_CFLAGS =
 if DEBUGBUILD
@@ -75,6 +74,7 @@ endif
 if CURLDEBUG
 AM_CPPFLAGS += -DCURLDEBUG
 endif
+AM_CPPFLAGS += -DBUILDING_LIBCURL
 
 if DOING_NATIVE_WINDOWS
 CSOURCES += dllmain.c
@@ -162,7 +162,7 @@ CHECKSOURCES = checksrc
 endif
 endif
 
-all-local: $(CHECKSOURCES) $(UNITPROTOS)
+all-local: $(CHECKSOURCES)
 
 UNIT_V = $(UNITV_$(V))
 UNITV_0 = @echo "  UNITPR  " $@;
@@ -174,7 +174,7 @@ $(UNITPROTOS): $(CSOURCES)
 	$(UNIT_V)(cd $(srcdir) && @PERL@ ../scripts/extract-unit-protos $(CSOURCES) > $(top_builddir)/lib/$(UNITPROTOS))
 
 # disable the tests that are mostly causing false positives
-TIDYFLAGS := -checks=-clang-analyzer-security.insecureAPI.bzero,-clang-analyzer-security.insecureAPI.strcpy,-clang-analyzer-optin.performance.Padding,-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling -quiet
+TIDYFLAGS := -checks=-clang-analyzer-security.insecureAPI.bzero,-clang-analyzer-security.insecureAPI.strcpy,-clang-analyzer-optin.performance.Padding,-clang-analyzer-security.ArrayBound,-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling -quiet
 if CURL_WERROR
 TIDYFLAGS += --warnings-as-errors=*
 endif
diff --git a/deps/curl/lib/Makefile.in b/deps/curl/lib/Makefile.in
index 1ac27c85f10..a7f8065d96b 100644
--- a/deps/curl/lib/Makefile.in
+++ b/deps/curl/lib/Makefile.in
@@ -218,29 +218,29 @@ LTLIBRARIES = $(lib_LTLIBRARIES) $(noinst_LTLIBRARIES)
 libcurl_la_LIBADD =
 am__libcurl_la_SOURCES_DIST = altsvc.c amigaos.c asyn-ares.c \
 	asyn-base.c asyn-thrdd.c bufq.c bufref.c cf-h1-proxy.c \
-	cf-h2-proxy.c cf-haproxy.c cf-https-connect.c cf-socket.c \
-	cfilters.c conncache.c connect.c content_encoding.c cookie.c \
-	cshutdn.c curl_addrinfo.c curl_des.c curl_endian.c \
-	curl_fnmatch.c curl_get_line.c curl_gethostname.c \
-	curl_gssapi.c curl_memrchr.c curl_ntlm_core.c curl_range.c \
-	curl_rtmp.c curl_sasl.c curl_sha512_256.c curl_sspi.c \
-	curl_threads.c curl_trc.c cw-out.c cw-pause.c dict.c doh.c \
-	dynhds.c easy.c easygetopt.c easyoptions.c escape.c \
-	fake_addrinfo.c file.c fileinfo.c fopen.c formdata.c ftp.c \
-	ftplistparser.c getenv.c getinfo.c gopher.c hash.c headers.c \
-	hmac.c hostip.c hostip4.c hostip6.c hsts.c http.c http1.c \
-	http2.c http_aws_sigv4.c http_chunks.c http_digest.c \
-	http_negotiate.c http_ntlm.c http_proxy.c httpsrr.c idn.c \
-	if2ip.c imap.c krb5.c ldap.c llist.c macos.c md4.c md5.c \
-	memdebug.c mime.c mprintf.c mqtt.c multi.c multi_ev.c netrc.c \
-	noproxy.c openldap.c parsedate.c pingpong.c pop3.c progress.c \
-	psl.c rand.c rename.c request.c rtsp.c select.c sendf.c \
-	setopt.c sha256.c share.c slist.c smb.c smtp.c socketpair.c \
-	socks.c socks_gssapi.c socks_sspi.c speedcheck.c splay.c \
-	strcase.c strdup.c strequal.c strerror.c system_win32.c \
-	telnet.c tftp.c transfer.c uint-bset.c uint-hash.c \
-	uint-spbset.c uint-table.c url.c urlapi.c version.c ws.c \
-	vauth/cleartext.c vauth/cram.c vauth/digest.c \
+	cf-h2-proxy.c cf-haproxy.c cf-https-connect.c cf-ip-happy.c \
+	cf-socket.c cfilters.c conncache.c connect.c \
+	content_encoding.c cookie.c cshutdn.c curl_addrinfo.c \
+	curl_des.c curl_endian.c curl_fnmatch.c curl_get_line.c \
+	curl_gethostname.c curl_gssapi.c curl_memrchr.c \
+	curl_ntlm_core.c curl_range.c curl_rtmp.c curl_sasl.c \
+	curl_sha512_256.c curl_sspi.c curl_threads.c curl_trc.c \
+	cw-out.c cw-pause.c dict.c doh.c dynhds.c easy.c easygetopt.c \
+	easyoptions.c escape.c fake_addrinfo.c file.c fileinfo.c \
+	fopen.c formdata.c ftp.c ftplistparser.c getenv.c getinfo.c \
+	gopher.c hash.c headers.c hmac.c hostip.c hostip4.c hostip6.c \
+	hsts.c http.c http1.c http2.c http_aws_sigv4.c http_chunks.c \
+	http_digest.c http_negotiate.c http_ntlm.c http_proxy.c \
+	httpsrr.c idn.c if2ip.c imap.c krb5.c ldap.c llist.c macos.c \
+	md4.c md5.c memdebug.c mime.c mprintf.c mqtt.c multi.c \
+	multi_ev.c netrc.c noproxy.c openldap.c parsedate.c pingpong.c \
+	pop3.c progress.c psl.c rand.c rename.c request.c rtsp.c \
+	select.c sendf.c setopt.c sha256.c share.c slist.c smb.c \
+	smtp.c socketpair.c socks.c socks_gssapi.c socks_sspi.c \
+	speedcheck.c splay.c strcase.c strdup.c strequal.c strerror.c \
+	system_win32.c telnet.c tftp.c transfer.c uint-bset.c \
+	uint-hash.c uint-spbset.c uint-table.c url.c urlapi.c \
+	version.c ws.c vauth/cleartext.c vauth/cram.c vauth/digest.c \
 	vauth/digest_sspi.c vauth/gsasl.c vauth/krb5_gssapi.c \
 	vauth/krb5_sspi.c vauth/ntlm.c vauth/ntlm_sspi.c \
 	vauth/oauth2.c vauth/spnego_gssapi.c vauth/spnego_sspi.c \
@@ -249,27 +249,27 @@ am__libcurl_la_SOURCES_DIST = altsvc.c amigaos.c asyn-ares.c \
 	vtls/openssl.c vtls/rustls.c vtls/schannel.c \
 	vtls/schannel_verify.c vtls/vtls.c vtls/vtls_scache.c \
 	vtls/vtls_spack.c vtls/wolfssl.c vtls/x509asn1.c \
-	vquic/curl_msh3.c vquic/curl_ngtcp2.c vquic/curl_osslq.c \
-	vquic/curl_quiche.c vquic/vquic.c vquic/vquic-tls.c \
-	vssh/libssh.c vssh/libssh2.c vssh/curl_path.c vssh/wolfssh.c \
-	curlx/base64.c curlx/dynbuf.c curlx/inet_ntop.c \
-	curlx/inet_pton.c curlx/multibyte.c curlx/nonblock.c \
-	curlx/strparse.c curlx/timediff.c curlx/timeval.c \
-	curlx/version_win32.c curlx/wait.c curlx/warnless.c \
-	curlx/winapi.c dllmain.c altsvc.h amigaos.h arpa_telnet.h \
-	asyn.h bufq.h bufref.h cf-h1-proxy.h cf-h2-proxy.h \
-	cf-haproxy.h cf-https-connect.h cf-socket.h cfilters.h \
-	conncache.h cshutdn.h connect.h content_encoding.h cookie.h \
-	curl_addrinfo.h curl_ctype.h curl_des.h curl_endian.h \
-	curl_fnmatch.h curl_get_line.h curl_gethostname.h \
-	curl_gssapi.h curl_hmac.h curl_krb5.h curl_ldap.h curl_md4.h \
-	curl_md5.h curl_memory.h curl_memrchr.h curl_ntlm_core.h \
-	curl_printf.h curl_range.h curl_rtmp.h curl_sasl.h \
-	curl_setup.h curl_setup_once.h curl_sha256.h curl_sha512_256.h \
-	curl_sspi.h curl_threads.h curl_trc.h cw-out.h cw-pause.h \
-	dict.h doh.h dynhds.h easy_lock.h easyif.h easyoptions.h \
-	escape.h fake_addrinfo.h file.h fileinfo.h fopen.h formdata.h \
-	ftp.h ftplistparser.h functypes.h getinfo.h gopher.h hash.h \
+	vquic/curl_ngtcp2.c vquic/curl_osslq.c vquic/curl_quiche.c \
+	vquic/vquic.c vquic/vquic-tls.c vssh/libssh.c vssh/libssh2.c \
+	vssh/curl_path.c vssh/wolfssh.c curlx/base64.c curlx/dynbuf.c \
+	curlx/inet_ntop.c curlx/inet_pton.c curlx/multibyte.c \
+	curlx/nonblock.c curlx/strparse.c curlx/timediff.c \
+	curlx/timeval.c curlx/version_win32.c curlx/wait.c \
+	curlx/warnless.c curlx/winapi.c dllmain.c altsvc.h amigaos.h \
+	arpa_telnet.h asyn.h bufq.h bufref.h cf-h1-proxy.h \
+	cf-h2-proxy.h cf-haproxy.h cf-https-connect.h cf-ip-happy.h \
+	cf-socket.h cfilters.h conncache.h cshutdn.h connect.h \
+	content_encoding.h cookie.h curl_addrinfo.h curl_ctype.h \
+	curl_des.h curl_endian.h curl_fnmatch.h curl_get_line.h \
+	curl_gethostname.h curl_gssapi.h curl_hmac.h curl_krb5.h \
+	curl_ldap.h curl_md4.h curl_md5.h curl_mem_undef.h \
+	curl_memory.h curl_memrchr.h curl_ntlm_core.h curl_printf.h \
+	curl_range.h curl_rtmp.h curl_sasl.h curl_setup.h \
+	curl_setup_once.h curl_sha256.h curl_sha512_256.h curl_sspi.h \
+	curl_threads.h curl_trc.h cw-out.h cw-pause.h dict.h doh.h \
+	dynhds.h easy_lock.h easyif.h easyoptions.h escape.h \
+	fake_addrinfo.h file.h fileinfo.h fopen.h formdata.h ftp.h \
+	ftplistparser.h functypes.h getinfo.h gopher.h hash.h \
 	headers.h hostip.h hsts.h http.h http1.h http2.h \
 	http_aws_sigv4.h http_chunks.h http_digest.h http_negotiate.h \
 	http_ntlm.h http_proxy.h httpsrr.h idn.h if2ip.h imap.h \
@@ -286,34 +286,34 @@ am__libcurl_la_SOURCES_DIST = altsvc.c amigaos.c asyn-ares.c \
 	vtls/mbedtls.h vtls/mbedtls_threadlock.h vtls/openssl.h \
 	vtls/rustls.h vtls/schannel.h vtls/schannel_int.h vtls/vtls.h \
 	vtls/vtls_int.h vtls/vtls_scache.h vtls/vtls_spack.h \
-	vtls/wolfssl.h vtls/x509asn1.h vquic/curl_msh3.h \
-	vquic/curl_ngtcp2.h vquic/curl_osslq.h vquic/curl_quiche.h \
-	vquic/vquic.h vquic/vquic_int.h vquic/vquic-tls.h \
-	vssh/curl_path.h vssh/ssh.h curlx/binmode.h curlx/base64.h \
-	curlx/curlx.h curlx/dynbuf.h curlx/inet_ntop.h \
-	curlx/inet_pton.h curlx/multibyte.h curlx/nonblock.h \
-	curlx/strparse.h curlx/timediff.h curlx/timeval.h \
-	curlx/version_win32.h curlx/wait.h curlx/warnless.h \
-	curlx/winapi.h libcurl.rc
+	vtls/wolfssl.h vtls/x509asn1.h vquic/curl_ngtcp2.h \
+	vquic/curl_osslq.h vquic/curl_quiche.h vquic/vquic.h \
+	vquic/vquic_int.h vquic/vquic-tls.h vssh/curl_path.h \
+	vssh/ssh.h curlx/binmode.h curlx/base64.h curlx/curlx.h \
+	curlx/dynbuf.h curlx/inet_ntop.h curlx/inet_pton.h \
+	curlx/multibyte.h curlx/nonblock.h curlx/strparse.h \
+	curlx/timediff.h curlx/timeval.h curlx/version_win32.h \
+	curlx/wait.h curlx/warnless.h curlx/winapi.h libcurl.rc
 am__objects_1 = libcurl_la-altsvc.lo libcurl_la-amigaos.lo \
 	libcurl_la-asyn-ares.lo libcurl_la-asyn-base.lo \
 	libcurl_la-asyn-thrdd.lo libcurl_la-bufq.lo \
 	libcurl_la-bufref.lo libcurl_la-cf-h1-proxy.lo \
 	libcurl_la-cf-h2-proxy.lo libcurl_la-cf-haproxy.lo \
-	libcurl_la-cf-https-connect.lo libcurl_la-cf-socket.lo \
-	libcurl_la-cfilters.lo libcurl_la-conncache.lo \
-	libcurl_la-connect.lo libcurl_la-content_encoding.lo \
-	libcurl_la-cookie.lo libcurl_la-cshutdn.lo \
-	libcurl_la-curl_addrinfo.lo libcurl_la-curl_des.lo \
-	libcurl_la-curl_endian.lo libcurl_la-curl_fnmatch.lo \
-	libcurl_la-curl_get_line.lo libcurl_la-curl_gethostname.lo \
-	libcurl_la-curl_gssapi.lo libcurl_la-curl_memrchr.lo \
-	libcurl_la-curl_ntlm_core.lo libcurl_la-curl_range.lo \
-	libcurl_la-curl_rtmp.lo libcurl_la-curl_sasl.lo \
-	libcurl_la-curl_sha512_256.lo libcurl_la-curl_sspi.lo \
-	libcurl_la-curl_threads.lo libcurl_la-curl_trc.lo \
-	libcurl_la-cw-out.lo libcurl_la-cw-pause.lo libcurl_la-dict.lo \
-	libcurl_la-doh.lo libcurl_la-dynhds.lo libcurl_la-easy.lo \
+	libcurl_la-cf-https-connect.lo libcurl_la-cf-ip-happy.lo \
+	libcurl_la-cf-socket.lo libcurl_la-cfilters.lo \
+	libcurl_la-conncache.lo libcurl_la-connect.lo \
+	libcurl_la-content_encoding.lo libcurl_la-cookie.lo \
+	libcurl_la-cshutdn.lo libcurl_la-curl_addrinfo.lo \
+	libcurl_la-curl_des.lo libcurl_la-curl_endian.lo \
+	libcurl_la-curl_fnmatch.lo libcurl_la-curl_get_line.lo \
+	libcurl_la-curl_gethostname.lo libcurl_la-curl_gssapi.lo \
+	libcurl_la-curl_memrchr.lo libcurl_la-curl_ntlm_core.lo \
+	libcurl_la-curl_range.lo libcurl_la-curl_rtmp.lo \
+	libcurl_la-curl_sasl.lo libcurl_la-curl_sha512_256.lo \
+	libcurl_la-curl_sspi.lo libcurl_la-curl_threads.lo \
+	libcurl_la-curl_trc.lo libcurl_la-cw-out.lo \
+	libcurl_la-cw-pause.lo libcurl_la-dict.lo libcurl_la-doh.lo \
+	libcurl_la-dynhds.lo libcurl_la-easy.lo \
 	libcurl_la-easygetopt.lo libcurl_la-easyoptions.lo \
 	libcurl_la-escape.lo libcurl_la-fake_addrinfo.lo \
 	libcurl_la-file.lo libcurl_la-fileinfo.lo libcurl_la-fopen.lo \
@@ -367,10 +367,9 @@ am__objects_3 = vtls/libcurl_la-cipher_suite.lo \
 	vtls/libcurl_la-vtls.lo vtls/libcurl_la-vtls_scache.lo \
 	vtls/libcurl_la-vtls_spack.lo vtls/libcurl_la-wolfssl.lo \
 	vtls/libcurl_la-x509asn1.lo
-am__objects_4 = vquic/libcurl_la-curl_msh3.lo \
-	vquic/libcurl_la-curl_ngtcp2.lo vquic/libcurl_la-curl_osslq.lo \
-	vquic/libcurl_la-curl_quiche.lo vquic/libcurl_la-vquic.lo \
-	vquic/libcurl_la-vquic-tls.lo
+am__objects_4 = vquic/libcurl_la-curl_ngtcp2.lo \
+	vquic/libcurl_la-curl_osslq.lo vquic/libcurl_la-curl_quiche.lo \
+	vquic/libcurl_la-vquic.lo vquic/libcurl_la-vquic-tls.lo
 am__objects_5 = vssh/libcurl_la-libssh.lo vssh/libcurl_la-libssh2.lo \
 	vssh/libcurl_la-curl_path.lo vssh/libcurl_la-wolfssh.lo
 am__objects_6 = curlx/libcurl_la-base64.lo curlx/libcurl_la-dynbuf.lo \
@@ -406,29 +405,29 @@ libcurl_la_LINK = $(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) \
 libcurlu_la_LIBADD =
 am__libcurlu_la_SOURCES_DIST = altsvc.c amigaos.c asyn-ares.c \
 	asyn-base.c asyn-thrdd.c bufq.c bufref.c cf-h1-proxy.c \
-	cf-h2-proxy.c cf-haproxy.c cf-https-connect.c cf-socket.c \
-	cfilters.c conncache.c connect.c content_encoding.c cookie.c \
-	cshutdn.c curl_addrinfo.c curl_des.c curl_endian.c \
-	curl_fnmatch.c curl_get_line.c curl_gethostname.c \
-	curl_gssapi.c curl_memrchr.c curl_ntlm_core.c curl_range.c \
-	curl_rtmp.c curl_sasl.c curl_sha512_256.c curl_sspi.c \
-	curl_threads.c curl_trc.c cw-out.c cw-pause.c dict.c doh.c \
-	dynhds.c easy.c easygetopt.c easyoptions.c escape.c \
-	fake_addrinfo.c file.c fileinfo.c fopen.c formdata.c ftp.c \
-	ftplistparser.c getenv.c getinfo.c gopher.c hash.c headers.c \
-	hmac.c hostip.c hostip4.c hostip6.c hsts.c http.c http1.c \
-	http2.c http_aws_sigv4.c http_chunks.c http_digest.c \
-	http_negotiate.c http_ntlm.c http_proxy.c httpsrr.c idn.c \
-	if2ip.c imap.c krb5.c ldap.c llist.c macos.c md4.c md5.c \
-	memdebug.c mime.c mprintf.c mqtt.c multi.c multi_ev.c netrc.c \
-	noproxy.c openldap.c parsedate.c pingpong.c pop3.c progress.c \
-	psl.c rand.c rename.c request.c rtsp.c select.c sendf.c \
-	setopt.c sha256.c share.c slist.c smb.c smtp.c socketpair.c \
-	socks.c socks_gssapi.c socks_sspi.c speedcheck.c splay.c \
-	strcase.c strdup.c strequal.c strerror.c system_win32.c \
-	telnet.c tftp.c transfer.c uint-bset.c uint-hash.c \
-	uint-spbset.c uint-table.c url.c urlapi.c version.c ws.c \
-	vauth/cleartext.c vauth/cram.c vauth/digest.c \
+	cf-h2-proxy.c cf-haproxy.c cf-https-connect.c cf-ip-happy.c \
+	cf-socket.c cfilters.c conncache.c connect.c \
+	content_encoding.c cookie.c cshutdn.c curl_addrinfo.c \
+	curl_des.c curl_endian.c curl_fnmatch.c curl_get_line.c \
+	curl_gethostname.c curl_gssapi.c curl_memrchr.c \
+	curl_ntlm_core.c curl_range.c curl_rtmp.c curl_sasl.c \
+	curl_sha512_256.c curl_sspi.c curl_threads.c curl_trc.c \
+	cw-out.c cw-pause.c dict.c doh.c dynhds.c easy.c easygetopt.c \
+	easyoptions.c escape.c fake_addrinfo.c file.c fileinfo.c \
+	fopen.c formdata.c ftp.c ftplistparser.c getenv.c getinfo.c \
+	gopher.c hash.c headers.c hmac.c hostip.c hostip4.c hostip6.c \
+	hsts.c http.c http1.c http2.c http_aws_sigv4.c http_chunks.c \
+	http_digest.c http_negotiate.c http_ntlm.c http_proxy.c \
+	httpsrr.c idn.c if2ip.c imap.c krb5.c ldap.c llist.c macos.c \
+	md4.c md5.c memdebug.c mime.c mprintf.c mqtt.c multi.c \
+	multi_ev.c netrc.c noproxy.c openldap.c parsedate.c pingpong.c \
+	pop3.c progress.c psl.c rand.c rename.c request.c rtsp.c \
+	select.c sendf.c setopt.c sha256.c share.c slist.c smb.c \
+	smtp.c socketpair.c socks.c socks_gssapi.c socks_sspi.c \
+	speedcheck.c splay.c strcase.c strdup.c strequal.c strerror.c \
+	system_win32.c telnet.c tftp.c transfer.c uint-bset.c \
+	uint-hash.c uint-spbset.c uint-table.c url.c urlapi.c \
+	version.c ws.c vauth/cleartext.c vauth/cram.c vauth/digest.c \
 	vauth/digest_sspi.c vauth/gsasl.c vauth/krb5_gssapi.c \
 	vauth/krb5_sspi.c vauth/ntlm.c vauth/ntlm_sspi.c \
 	vauth/oauth2.c vauth/spnego_gssapi.c vauth/spnego_sspi.c \
@@ -437,27 +436,27 @@ am__libcurlu_la_SOURCES_DIST = altsvc.c amigaos.c asyn-ares.c \
 	vtls/openssl.c vtls/rustls.c vtls/schannel.c \
 	vtls/schannel_verify.c vtls/vtls.c vtls/vtls_scache.c \
 	vtls/vtls_spack.c vtls/wolfssl.c vtls/x509asn1.c \
-	vquic/curl_msh3.c vquic/curl_ngtcp2.c vquic/curl_osslq.c \
-	vquic/curl_quiche.c vquic/vquic.c vquic/vquic-tls.c \
-	vssh/libssh.c vssh/libssh2.c vssh/curl_path.c vssh/wolfssh.c \
-	curlx/base64.c curlx/dynbuf.c curlx/inet_ntop.c \
-	curlx/inet_pton.c curlx/multibyte.c curlx/nonblock.c \
-	curlx/strparse.c curlx/timediff.c curlx/timeval.c \
-	curlx/version_win32.c curlx/wait.c curlx/warnless.c \
-	curlx/winapi.c dllmain.c altsvc.h amigaos.h arpa_telnet.h \
-	asyn.h bufq.h bufref.h cf-h1-proxy.h cf-h2-proxy.h \
-	cf-haproxy.h cf-https-connect.h cf-socket.h cfilters.h \
-	conncache.h cshutdn.h connect.h content_encoding.h cookie.h \
-	curl_addrinfo.h curl_ctype.h curl_des.h curl_endian.h \
-	curl_fnmatch.h curl_get_line.h curl_gethostname.h \
-	curl_gssapi.h curl_hmac.h curl_krb5.h curl_ldap.h curl_md4.h \
-	curl_md5.h curl_memory.h curl_memrchr.h curl_ntlm_core.h \
-	curl_printf.h curl_range.h curl_rtmp.h curl_sasl.h \
-	curl_setup.h curl_setup_once.h curl_sha256.h curl_sha512_256.h \
-	curl_sspi.h curl_threads.h curl_trc.h cw-out.h cw-pause.h \
-	dict.h doh.h dynhds.h easy_lock.h easyif.h easyoptions.h \
-	escape.h fake_addrinfo.h file.h fileinfo.h fopen.h formdata.h \
-	ftp.h ftplistparser.h functypes.h getinfo.h gopher.h hash.h \
+	vquic/curl_ngtcp2.c vquic/curl_osslq.c vquic/curl_quiche.c \
+	vquic/vquic.c vquic/vquic-tls.c vssh/libssh.c vssh/libssh2.c \
+	vssh/curl_path.c vssh/wolfssh.c curlx/base64.c curlx/dynbuf.c \
+	curlx/inet_ntop.c curlx/inet_pton.c curlx/multibyte.c \
+	curlx/nonblock.c curlx/strparse.c curlx/timediff.c \
+	curlx/timeval.c curlx/version_win32.c curlx/wait.c \
+	curlx/warnless.c curlx/winapi.c dllmain.c altsvc.h amigaos.h \
+	arpa_telnet.h asyn.h bufq.h bufref.h cf-h1-proxy.h \
+	cf-h2-proxy.h cf-haproxy.h cf-https-connect.h cf-ip-happy.h \
+	cf-socket.h cfilters.h conncache.h cshutdn.h connect.h \
+	content_encoding.h cookie.h curl_addrinfo.h curl_ctype.h \
+	curl_des.h curl_endian.h curl_fnmatch.h curl_get_line.h \
+	curl_gethostname.h curl_gssapi.h curl_hmac.h curl_krb5.h \
+	curl_ldap.h curl_md4.h curl_md5.h curl_mem_undef.h \
+	curl_memory.h curl_memrchr.h curl_ntlm_core.h curl_printf.h \
+	curl_range.h curl_rtmp.h curl_sasl.h curl_setup.h \
+	curl_setup_once.h curl_sha256.h curl_sha512_256.h curl_sspi.h \
+	curl_threads.h curl_trc.h cw-out.h cw-pause.h dict.h doh.h \
+	dynhds.h easy_lock.h easyif.h easyoptions.h escape.h \
+	fake_addrinfo.h file.h fileinfo.h fopen.h formdata.h ftp.h \
+	ftplistparser.h functypes.h getinfo.h gopher.h hash.h \
 	headers.h hostip.h hsts.h http.h http1.h http2.h \
 	http_aws_sigv4.h http_chunks.h http_digest.h http_negotiate.h \
 	http_ntlm.h http_proxy.h httpsrr.h idn.h if2ip.h imap.h \
@@ -474,42 +473,42 @@ am__libcurlu_la_SOURCES_DIST = altsvc.c amigaos.c asyn-ares.c \
 	vtls/mbedtls.h vtls/mbedtls_threadlock.h vtls/openssl.h \
 	vtls/rustls.h vtls/schannel.h vtls/schannel_int.h vtls/vtls.h \
 	vtls/vtls_int.h vtls/vtls_scache.h vtls/vtls_spack.h \
-	vtls/wolfssl.h vtls/x509asn1.h vquic/curl_msh3.h \
-	vquic/curl_ngtcp2.h vquic/curl_osslq.h vquic/curl_quiche.h \
-	vquic/vquic.h vquic/vquic_int.h vquic/vquic-tls.h \
-	vssh/curl_path.h vssh/ssh.h curlx/binmode.h curlx/base64.h \
-	curlx/curlx.h curlx/dynbuf.h curlx/inet_ntop.h \
-	curlx/inet_pton.h curlx/multibyte.h curlx/nonblock.h \
-	curlx/strparse.h curlx/timediff.h curlx/timeval.h \
-	curlx/version_win32.h curlx/wait.h curlx/warnless.h \
-	curlx/winapi.h
+	vtls/wolfssl.h vtls/x509asn1.h vquic/curl_ngtcp2.h \
+	vquic/curl_osslq.h vquic/curl_quiche.h vquic/vquic.h \
+	vquic/vquic_int.h vquic/vquic-tls.h vssh/curl_path.h \
+	vssh/ssh.h curlx/binmode.h curlx/base64.h curlx/curlx.h \
+	curlx/dynbuf.h curlx/inet_ntop.h curlx/inet_pton.h \
+	curlx/multibyte.h curlx/nonblock.h curlx/strparse.h \
+	curlx/timediff.h curlx/timeval.h curlx/version_win32.h \
+	curlx/wait.h curlx/warnless.h curlx/winapi.h
 am__objects_13 = libcurlu_la-altsvc.lo libcurlu_la-amigaos.lo \
 	libcurlu_la-asyn-ares.lo libcurlu_la-asyn-base.lo \
 	libcurlu_la-asyn-thrdd.lo libcurlu_la-bufq.lo \
 	libcurlu_la-bufref.lo libcurlu_la-cf-h1-proxy.lo \
 	libcurlu_la-cf-h2-proxy.lo libcurlu_la-cf-haproxy.lo \
-	libcurlu_la-cf-https-connect.lo libcurlu_la-cf-socket.lo \
-	libcurlu_la-cfilters.lo libcurlu_la-conncache.lo \
-	libcurlu_la-connect.lo libcurlu_la-content_encoding.lo \
-	libcurlu_la-cookie.lo libcurlu_la-cshutdn.lo \
-	libcurlu_la-curl_addrinfo.lo libcurlu_la-curl_des.lo \
-	libcurlu_la-curl_endian.lo libcurlu_la-curl_fnmatch.lo \
-	libcurlu_la-curl_get_line.lo libcurlu_la-curl_gethostname.lo \
-	libcurlu_la-curl_gssapi.lo libcurlu_la-curl_memrchr.lo \
-	libcurlu_la-curl_ntlm_core.lo libcurlu_la-curl_range.lo \
-	libcurlu_la-curl_rtmp.lo libcurlu_la-curl_sasl.lo \
-	libcurlu_la-curl_sha512_256.lo libcurlu_la-curl_sspi.lo \
-	libcurlu_la-curl_threads.lo libcurlu_la-curl_trc.lo \
-	libcurlu_la-cw-out.lo libcurlu_la-cw-pause.lo \
-	libcurlu_la-dict.lo libcurlu_la-doh.lo libcurlu_la-dynhds.lo \
-	libcurlu_la-easy.lo libcurlu_la-easygetopt.lo \
-	libcurlu_la-easyoptions.lo libcurlu_la-escape.lo \
-	libcurlu_la-fake_addrinfo.lo libcurlu_la-file.lo \
-	libcurlu_la-fileinfo.lo libcurlu_la-fopen.lo \
-	libcurlu_la-formdata.lo libcurlu_la-ftp.lo \
-	libcurlu_la-ftplistparser.lo libcurlu_la-getenv.lo \
-	libcurlu_la-getinfo.lo libcurlu_la-gopher.lo \
-	libcurlu_la-hash.lo libcurlu_la-headers.lo libcurlu_la-hmac.lo \
+	libcurlu_la-cf-https-connect.lo libcurlu_la-cf-ip-happy.lo \
+	libcurlu_la-cf-socket.lo libcurlu_la-cfilters.lo \
+	libcurlu_la-conncache.lo libcurlu_la-connect.lo \
+	libcurlu_la-content_encoding.lo libcurlu_la-cookie.lo \
+	libcurlu_la-cshutdn.lo libcurlu_la-curl_addrinfo.lo \
+	libcurlu_la-curl_des.lo libcurlu_la-curl_endian.lo \
+	libcurlu_la-curl_fnmatch.lo libcurlu_la-curl_get_line.lo \
+	libcurlu_la-curl_gethostname.lo libcurlu_la-curl_gssapi.lo \
+	libcurlu_la-curl_memrchr.lo libcurlu_la-curl_ntlm_core.lo \
+	libcurlu_la-curl_range.lo libcurlu_la-curl_rtmp.lo \
+	libcurlu_la-curl_sasl.lo libcurlu_la-curl_sha512_256.lo \
+	libcurlu_la-curl_sspi.lo libcurlu_la-curl_threads.lo \
+	libcurlu_la-curl_trc.lo libcurlu_la-cw-out.lo \
+	libcurlu_la-cw-pause.lo libcurlu_la-dict.lo libcurlu_la-doh.lo \
+	libcurlu_la-dynhds.lo libcurlu_la-easy.lo \
+	libcurlu_la-easygetopt.lo libcurlu_la-easyoptions.lo \
+	libcurlu_la-escape.lo libcurlu_la-fake_addrinfo.lo \
+	libcurlu_la-file.lo libcurlu_la-fileinfo.lo \
+	libcurlu_la-fopen.lo libcurlu_la-formdata.lo \
+	libcurlu_la-ftp.lo libcurlu_la-ftplistparser.lo \
+	libcurlu_la-getenv.lo libcurlu_la-getinfo.lo \
+	libcurlu_la-gopher.lo libcurlu_la-hash.lo \
+	libcurlu_la-headers.lo libcurlu_la-hmac.lo \
 	libcurlu_la-hostip.lo libcurlu_la-hostip4.lo \
 	libcurlu_la-hostip6.lo libcurlu_la-hsts.lo libcurlu_la-http.lo \
 	libcurlu_la-http1.lo libcurlu_la-http2.lo \
@@ -558,8 +557,7 @@ am__objects_15 = vtls/libcurlu_la-cipher_suite.lo \
 	vtls/libcurlu_la-schannel_verify.lo vtls/libcurlu_la-vtls.lo \
 	vtls/libcurlu_la-vtls_scache.lo vtls/libcurlu_la-vtls_spack.lo \
 	vtls/libcurlu_la-wolfssl.lo vtls/libcurlu_la-x509asn1.lo
-am__objects_16 = vquic/libcurlu_la-curl_msh3.lo \
-	vquic/libcurlu_la-curl_ngtcp2.lo \
+am__objects_16 = vquic/libcurlu_la-curl_ngtcp2.lo \
 	vquic/libcurlu_la-curl_osslq.lo \
 	vquic/libcurlu_la-curl_quiche.lo vquic/libcurlu_la-vquic.lo \
 	vquic/libcurlu_la-vquic-tls.lo
@@ -613,6 +611,7 @@ am__depfiles_remade = ./$(DEPDIR)/libcurl_la-altsvc.Plo \
 	./$(DEPDIR)/libcurl_la-cf-h2-proxy.Plo \
 	./$(DEPDIR)/libcurl_la-cf-haproxy.Plo \
 	./$(DEPDIR)/libcurl_la-cf-https-connect.Plo \
+	./$(DEPDIR)/libcurl_la-cf-ip-happy.Plo \
 	./$(DEPDIR)/libcurl_la-cf-socket.Plo \
 	./$(DEPDIR)/libcurl_la-cfilters.Plo \
 	./$(DEPDIR)/libcurl_la-conncache.Plo \
@@ -739,6 +738,7 @@ am__depfiles_remade = ./$(DEPDIR)/libcurl_la-altsvc.Plo \
 	./$(DEPDIR)/libcurlu_la-cf-h2-proxy.Plo \
 	./$(DEPDIR)/libcurlu_la-cf-haproxy.Plo \
 	./$(DEPDIR)/libcurlu_la-cf-https-connect.Plo \
+	./$(DEPDIR)/libcurlu_la-cf-ip-happy.Plo \
 	./$(DEPDIR)/libcurlu_la-cf-socket.Plo \
 	./$(DEPDIR)/libcurlu_la-cfilters.Plo \
 	./$(DEPDIR)/libcurlu_la-conncache.Plo \
@@ -909,13 +909,11 @@ am__depfiles_remade = ./$(DEPDIR)/libcurl_la-altsvc.Plo \
 	vauth/$(DEPDIR)/libcurlu_la-spnego_gssapi.Plo \
 	vauth/$(DEPDIR)/libcurlu_la-spnego_sspi.Plo \
 	vauth/$(DEPDIR)/libcurlu_la-vauth.Plo \
-	vquic/$(DEPDIR)/libcurl_la-curl_msh3.Plo \
 	vquic/$(DEPDIR)/libcurl_la-curl_ngtcp2.Plo \
 	vquic/$(DEPDIR)/libcurl_la-curl_osslq.Plo \
 	vquic/$(DEPDIR)/libcurl_la-curl_quiche.Plo \
 	vquic/$(DEPDIR)/libcurl_la-vquic-tls.Plo \
 	vquic/$(DEPDIR)/libcurl_la-vquic.Plo \
-	vquic/$(DEPDIR)/libcurlu_la-curl_msh3.Plo \
 	vquic/$(DEPDIR)/libcurlu_la-curl_ngtcp2.Plo \
 	vquic/$(DEPDIR)/libcurlu_la-curl_osslq.Plo \
 	vquic/$(DEPDIR)/libcurlu_la-curl_quiche.Plo \
@@ -1042,6 +1040,7 @@ CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX = @CURL_LIBCURL_VERSIONED_SYMBOLS_PREFIX@
 CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME = @CURL_LIBCURL_VERSIONED_SYMBOLS_SONAME@
 CURL_NETWORK_AND_TIME_LIBS = @CURL_NETWORK_AND_TIME_LIBS@
 CYGPATH_W = @CYGPATH_W@
+DANTED = @DANTED@
 DEFS = @DEFS@
 DEPDIR = @DEPDIR@
 DLLTOOL = @DLLTOOL@
@@ -1288,7 +1287,6 @@ LIB_VTLS_HFILES = \
   vtls/x509asn1.h
 
 LIB_VQUIC_CFILES = \
-  vquic/curl_msh3.c   \
   vquic/curl_ngtcp2.c   \
   vquic/curl_osslq.c   \
   vquic/curl_quiche.c   \
@@ -1296,7 +1294,6 @@ LIB_VQUIC_CFILES = \
   vquic/vquic-tls.c
 
 LIB_VQUIC_HFILES = \
-  vquic/curl_msh3.h   \
   vquic/curl_ngtcp2.h   \
   vquic/curl_osslq.h   \
   vquic/curl_quiche.h   \
@@ -1326,6 +1323,7 @@ LIB_CFILES = \
   cf-h2-proxy.c      \
   cf-haproxy.c       \
   cf-https-connect.c \
+  cf-ip-happy.c      \
   cf-socket.c        \
   cfilters.c         \
   conncache.c        \
@@ -1454,6 +1452,7 @@ LIB_HFILES = \
   cf-h2-proxy.h      \
   cf-haproxy.h       \
   cf-https-connect.h \
+  cf-ip-happy.h      \
   cf-socket.h        \
   cfilters.h         \
   conncache.h        \
@@ -1474,6 +1473,7 @@ LIB_HFILES = \
   curl_ldap.h        \
   curl_md4.h         \
   curl_md5.h         \
+  curl_mem_undef.h   \
   curl_memory.h      \
   curl_memrchr.h     \
   curl_ntlm_core.h   \
@@ -1608,7 +1608,7 @@ lib_LTLIBRARIES = libcurl.la
 # $(top_builddir)/lib is for libcurl's generated lib/curl_config.h file
 # $(srcdir) for the generated unity source to find included sources
 AM_CPPFLAGS = -I$(top_srcdir)/include -I$(top_builddir)/lib \
-	-I$(srcdir) -DBUILDING_LIBCURL $(am__append_1) $(am__append_2)
+	-I$(srcdir) $(am__append_1) $(am__append_2) -DBUILDING_LIBCURL
 AM_LDFLAGS = 
 AM_CFLAGS = 
 @USE_UNITY_TRUE@nodist_libcurl_la_SOURCES = libcurl_unity.c
@@ -1651,7 +1651,7 @@ UNITV_1 =
 UNITV_ = $(UNITV_0)
 
 # disable the tests that are mostly causing false positives
-TIDYFLAGS := -checks=-clang-analyzer-security.insecureAPI.bzero,-clang-analyzer-security.insecureAPI.strcpy,-clang-analyzer-optin.performance.Padding,-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling \
+TIDYFLAGS := -checks=-clang-analyzer-security.insecureAPI.bzero,-clang-analyzer-security.insecureAPI.strcpy,-clang-analyzer-optin.performance.Padding,-clang-analyzer-security.ArrayBound,-clang-analyzer-security.insecureAPI.DeprecatedOrUnsafeBufferHandling \
 	-quiet $(am__append_13)
 TIDY := clang-tidy
 all: curl_config.h
@@ -1826,8 +1826,6 @@ vquic/$(am__dirstamp):
 vquic/$(DEPDIR)/$(am__dirstamp):
 	@$(MKDIR_P) vquic/$(DEPDIR)
 	@: > vquic/$(DEPDIR)/$(am__dirstamp)
-vquic/libcurl_la-curl_msh3.lo: vquic/$(am__dirstamp) \
-	vquic/$(DEPDIR)/$(am__dirstamp)
 vquic/libcurl_la-curl_ngtcp2.lo: vquic/$(am__dirstamp) \
 	vquic/$(DEPDIR)/$(am__dirstamp)
 vquic/libcurl_la-curl_osslq.lo: vquic/$(am__dirstamp) \
@@ -1943,8 +1941,6 @@ vtls/libcurlu_la-wolfssl.lo: vtls/$(am__dirstamp) \
 	vtls/$(DEPDIR)/$(am__dirstamp)
 vtls/libcurlu_la-x509asn1.lo: vtls/$(am__dirstamp) \
 	vtls/$(DEPDIR)/$(am__dirstamp)
-vquic/libcurlu_la-curl_msh3.lo: vquic/$(am__dirstamp) \
-	vquic/$(DEPDIR)/$(am__dirstamp)
 vquic/libcurlu_la-curl_ngtcp2.lo: vquic/$(am__dirstamp) \
 	vquic/$(DEPDIR)/$(am__dirstamp)
 vquic/libcurlu_la-curl_osslq.lo: vquic/$(am__dirstamp) \
@@ -2020,6 +2016,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurl_la-cf-h2-proxy.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurl_la-cf-haproxy.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurl_la-cf-https-connect.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurl_la-cf-ip-happy.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurl_la-cf-socket.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurl_la-cfilters.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurl_la-conncache.Plo@am__quote@ # am--include-marker
@@ -2149,6 +2146,7 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurlu_la-cf-h2-proxy.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurlu_la-cf-haproxy.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurlu_la-cf-https-connect.Plo@am__quote@ # am--include-marker
+@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurlu_la-cf-ip-happy.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurlu_la-cf-socket.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurlu_la-cfilters.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libcurlu_la-conncache.Plo@am__quote@ # am--include-marker
@@ -2319,13 +2317,11 @@ distclean-compile:
 @AMDEP_TRUE@@am__include@ @am__quote@vauth/$(DEPDIR)/libcurlu_la-spnego_gssapi.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@vauth/$(DEPDIR)/libcurlu_la-spnego_sspi.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@vauth/$(DEPDIR)/libcurlu_la-vauth.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@vquic/$(DEPDIR)/libcurl_la-curl_msh3.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@vquic/$(DEPDIR)/libcurl_la-curl_ngtcp2.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@vquic/$(DEPDIR)/libcurl_la-curl_osslq.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@vquic/$(DEPDIR)/libcurl_la-curl_quiche.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@vquic/$(DEPDIR)/libcurl_la-vquic-tls.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@vquic/$(DEPDIR)/libcurl_la-vquic.Plo@am__quote@ # am--include-marker
-@AMDEP_TRUE@@am__include@ @am__quote@vquic/$(DEPDIR)/libcurlu_la-curl_msh3.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@vquic/$(DEPDIR)/libcurlu_la-curl_ngtcp2.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@vquic/$(DEPDIR)/libcurlu_la-curl_osslq.Plo@am__quote@ # am--include-marker
 @AMDEP_TRUE@@am__include@ @am__quote@vquic/$(DEPDIR)/libcurlu_la-curl_quiche.Plo@am__quote@ # am--include-marker
@@ -2477,6 +2473,13 @@ libcurl_la-cf-https-connect.lo: cf-https-connect.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurl_la_CPPFLAGS) $(CPPFLAGS) $(libcurl_la_CFLAGS) $(CFLAGS) -c -o libcurl_la-cf-https-connect.lo `test -f 'cf-https-connect.c' || echo '$(srcdir)/'`cf-https-connect.c
 
+libcurl_la-cf-ip-happy.lo: cf-ip-happy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurl_la_CPPFLAGS) $(CPPFLAGS) $(libcurl_la_CFLAGS) $(CFLAGS) -MT libcurl_la-cf-ip-happy.lo -MD -MP -MF $(DEPDIR)/libcurl_la-cf-ip-happy.Tpo -c -o libcurl_la-cf-ip-happy.lo `test -f 'cf-ip-happy.c' || echo '$(srcdir)/'`cf-ip-happy.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libcurl_la-cf-ip-happy.Tpo $(DEPDIR)/libcurl_la-cf-ip-happy.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='cf-ip-happy.c' object='libcurl_la-cf-ip-happy.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurl_la_CPPFLAGS) $(CPPFLAGS) $(libcurl_la_CFLAGS) $(CFLAGS) -c -o libcurl_la-cf-ip-happy.lo `test -f 'cf-ip-happy.c' || echo '$(srcdir)/'`cf-ip-happy.c
+
 libcurl_la-cf-socket.lo: cf-socket.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurl_la_CPPFLAGS) $(CPPFLAGS) $(libcurl_la_CFLAGS) $(CFLAGS) -MT libcurl_la-cf-socket.lo -MD -MP -MF $(DEPDIR)/libcurl_la-cf-socket.Tpo -c -o libcurl_la-cf-socket.lo `test -f 'cf-socket.c' || echo '$(srcdir)/'`cf-socket.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libcurl_la-cf-socket.Tpo $(DEPDIR)/libcurl_la-cf-socket.Plo
@@ -3485,13 +3488,6 @@ vtls/libcurl_la-x509asn1.lo: vtls/x509asn1.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurl_la_CPPFLAGS) $(CPPFLAGS) $(libcurl_la_CFLAGS) $(CFLAGS) -c -o vtls/libcurl_la-x509asn1.lo `test -f 'vtls/x509asn1.c' || echo '$(srcdir)/'`vtls/x509asn1.c
 
-vquic/libcurl_la-curl_msh3.lo: vquic/curl_msh3.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurl_la_CPPFLAGS) $(CPPFLAGS) $(libcurl_la_CFLAGS) $(CFLAGS) -MT vquic/libcurl_la-curl_msh3.lo -MD -MP -MF vquic/$(DEPDIR)/libcurl_la-curl_msh3.Tpo -c -o vquic/libcurl_la-curl_msh3.lo `test -f 'vquic/curl_msh3.c' || echo '$(srcdir)/'`vquic/curl_msh3.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) vquic/$(DEPDIR)/libcurl_la-curl_msh3.Tpo vquic/$(DEPDIR)/libcurl_la-curl_msh3.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='vquic/curl_msh3.c' object='vquic/libcurl_la-curl_msh3.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurl_la_CPPFLAGS) $(CPPFLAGS) $(libcurl_la_CFLAGS) $(CFLAGS) -c -o vquic/libcurl_la-curl_msh3.lo `test -f 'vquic/curl_msh3.c' || echo '$(srcdir)/'`vquic/curl_msh3.c
-
 vquic/libcurl_la-curl_ngtcp2.lo: vquic/curl_ngtcp2.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurl_la_CPPFLAGS) $(CPPFLAGS) $(libcurl_la_CFLAGS) $(CFLAGS) -MT vquic/libcurl_la-curl_ngtcp2.lo -MD -MP -MF vquic/$(DEPDIR)/libcurl_la-curl_ngtcp2.Tpo -c -o vquic/libcurl_la-curl_ngtcp2.lo `test -f 'vquic/curl_ngtcp2.c' || echo '$(srcdir)/'`vquic/curl_ngtcp2.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) vquic/$(DEPDIR)/libcurl_la-curl_ngtcp2.Tpo vquic/$(DEPDIR)/libcurl_la-curl_ngtcp2.Plo
@@ -3737,6 +3733,13 @@ libcurlu_la-cf-https-connect.lo: cf-https-connect.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurlu_la_CPPFLAGS) $(CPPFLAGS) $(libcurlu_la_CFLAGS) $(CFLAGS) -c -o libcurlu_la-cf-https-connect.lo `test -f 'cf-https-connect.c' || echo '$(srcdir)/'`cf-https-connect.c
 
+libcurlu_la-cf-ip-happy.lo: cf-ip-happy.c
+@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurlu_la_CPPFLAGS) $(CPPFLAGS) $(libcurlu_la_CFLAGS) $(CFLAGS) -MT libcurlu_la-cf-ip-happy.lo -MD -MP -MF $(DEPDIR)/libcurlu_la-cf-ip-happy.Tpo -c -o libcurlu_la-cf-ip-happy.lo `test -f 'cf-ip-happy.c' || echo '$(srcdir)/'`cf-ip-happy.c
+@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libcurlu_la-cf-ip-happy.Tpo $(DEPDIR)/libcurlu_la-cf-ip-happy.Plo
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='cf-ip-happy.c' object='libcurlu_la-cf-ip-happy.lo' libtool=yes @AMDEPBACKSLASH@
+@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
+@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurlu_la_CPPFLAGS) $(CPPFLAGS) $(libcurlu_la_CFLAGS) $(CFLAGS) -c -o libcurlu_la-cf-ip-happy.lo `test -f 'cf-ip-happy.c' || echo '$(srcdir)/'`cf-ip-happy.c
+
 libcurlu_la-cf-socket.lo: cf-socket.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurlu_la_CPPFLAGS) $(CPPFLAGS) $(libcurlu_la_CFLAGS) $(CFLAGS) -MT libcurlu_la-cf-socket.lo -MD -MP -MF $(DEPDIR)/libcurlu_la-cf-socket.Tpo -c -o libcurlu_la-cf-socket.lo `test -f 'cf-socket.c' || echo '$(srcdir)/'`cf-socket.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) $(DEPDIR)/libcurlu_la-cf-socket.Tpo $(DEPDIR)/libcurlu_la-cf-socket.Plo
@@ -4745,13 +4748,6 @@ vtls/libcurlu_la-x509asn1.lo: vtls/x509asn1.c
 @AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
 @am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurlu_la_CPPFLAGS) $(CPPFLAGS) $(libcurlu_la_CFLAGS) $(CFLAGS) -c -o vtls/libcurlu_la-x509asn1.lo `test -f 'vtls/x509asn1.c' || echo '$(srcdir)/'`vtls/x509asn1.c
 
-vquic/libcurlu_la-curl_msh3.lo: vquic/curl_msh3.c
-@am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurlu_la_CPPFLAGS) $(CPPFLAGS) $(libcurlu_la_CFLAGS) $(CFLAGS) -MT vquic/libcurlu_la-curl_msh3.lo -MD -MP -MF vquic/$(DEPDIR)/libcurlu_la-curl_msh3.Tpo -c -o vquic/libcurlu_la-curl_msh3.lo `test -f 'vquic/curl_msh3.c' || echo '$(srcdir)/'`vquic/curl_msh3.c
-@am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) vquic/$(DEPDIR)/libcurlu_la-curl_msh3.Tpo vquic/$(DEPDIR)/libcurlu_la-curl_msh3.Plo
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	$(AM_V_CC)source='vquic/curl_msh3.c' object='vquic/libcurlu_la-curl_msh3.lo' libtool=yes @AMDEPBACKSLASH@
-@AMDEP_TRUE@@am__fastdepCC_FALSE@	DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
-@am__fastdepCC_FALSE@	$(AM_V_CC@am__nodep@)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurlu_la_CPPFLAGS) $(CPPFLAGS) $(libcurlu_la_CFLAGS) $(CFLAGS) -c -o vquic/libcurlu_la-curl_msh3.lo `test -f 'vquic/curl_msh3.c' || echo '$(srcdir)/'`vquic/curl_msh3.c
-
 vquic/libcurlu_la-curl_ngtcp2.lo: vquic/curl_ngtcp2.c
 @am__fastdepCC_TRUE@	$(AM_V_CC)$(LIBTOOL) $(AM_V_lt) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libcurlu_la_CPPFLAGS) $(CPPFLAGS) $(libcurlu_la_CFLAGS) $(CFLAGS) -MT vquic/libcurlu_la-curl_ngtcp2.lo -MD -MP -MF vquic/$(DEPDIR)/libcurlu_la-curl_ngtcp2.Tpo -c -o vquic/libcurlu_la-curl_ngtcp2.lo `test -f 'vquic/curl_ngtcp2.c' || echo '$(srcdir)/'`vquic/curl_ngtcp2.c
 @am__fastdepCC_TRUE@	$(AM_V_at)$(am__mv) vquic/$(DEPDIR)/libcurlu_la-curl_ngtcp2.Tpo vquic/$(DEPDIR)/libcurlu_la-curl_ngtcp2.Plo
@@ -5080,6 +5076,7 @@ distclean: distclean-am
 	-rm -f ./$(DEPDIR)/libcurl_la-cf-h2-proxy.Plo
 	-rm -f ./$(DEPDIR)/libcurl_la-cf-haproxy.Plo
 	-rm -f ./$(DEPDIR)/libcurl_la-cf-https-connect.Plo
+	-rm -f ./$(DEPDIR)/libcurl_la-cf-ip-happy.Plo
 	-rm -f ./$(DEPDIR)/libcurl_la-cf-socket.Plo
 	-rm -f ./$(DEPDIR)/libcurl_la-cfilters.Plo
 	-rm -f ./$(DEPDIR)/libcurl_la-conncache.Plo
@@ -5209,6 +5206,7 @@ distclean: distclean-am
 	-rm -f ./$(DEPDIR)/libcurlu_la-cf-h2-proxy.Plo
 	-rm -f ./$(DEPDIR)/libcurlu_la-cf-haproxy.Plo
 	-rm -f ./$(DEPDIR)/libcurlu_la-cf-https-connect.Plo
+	-rm -f ./$(DEPDIR)/libcurlu_la-cf-ip-happy.Plo
 	-rm -f ./$(DEPDIR)/libcurlu_la-cf-socket.Plo
 	-rm -f ./$(DEPDIR)/libcurlu_la-cfilters.Plo
 	-rm -f ./$(DEPDIR)/libcurlu_la-conncache.Plo
@@ -5379,13 +5377,11 @@ distclean: distclean-am
 	-rm -f vauth/$(DEPDIR)/libcurlu_la-spnego_gssapi.Plo
 	-rm -f vauth/$(DEPDIR)/libcurlu_la-spnego_sspi.Plo
 	-rm -f vauth/$(DEPDIR)/libcurlu_la-vauth.Plo
-	-rm -f vquic/$(DEPDIR)/libcurl_la-curl_msh3.Plo
 	-rm -f vquic/$(DEPDIR)/libcurl_la-curl_ngtcp2.Plo
 	-rm -f vquic/$(DEPDIR)/libcurl_la-curl_osslq.Plo
 	-rm -f vquic/$(DEPDIR)/libcurl_la-curl_quiche.Plo
 	-rm -f vquic/$(DEPDIR)/libcurl_la-vquic-tls.Plo
 	-rm -f vquic/$(DEPDIR)/libcurl_la-vquic.Plo
-	-rm -f vquic/$(DEPDIR)/libcurlu_la-curl_msh3.Plo
 	-rm -f vquic/$(DEPDIR)/libcurlu_la-curl_ngtcp2.Plo
 	-rm -f vquic/$(DEPDIR)/libcurlu_la-curl_osslq.Plo
 	-rm -f vquic/$(DEPDIR)/libcurlu_la-curl_quiche.Plo
@@ -5485,6 +5481,7 @@ maintainer-clean: maintainer-clean-am
 	-rm -f ./$(DEPDIR)/libcurl_la-cf-h2-proxy.Plo
 	-rm -f ./$(DEPDIR)/libcurl_la-cf-haproxy.Plo
 	-rm -f ./$(DEPDIR)/libcurl_la-cf-https-connect.Plo
+	-rm -f ./$(DEPDIR)/libcurl_la-cf-ip-happy.Plo
 	-rm -f ./$(DEPDIR)/libcurl_la-cf-socket.Plo
 	-rm -f ./$(DEPDIR)/libcurl_la-cfilters.Plo
 	-rm -f ./$(DEPDIR)/libcurl_la-conncache.Plo
@@ -5614,6 +5611,7 @@ maintainer-clean: maintainer-clean-am
 	-rm -f ./$(DEPDIR)/libcurlu_la-cf-h2-proxy.Plo
 	-rm -f ./$(DEPDIR)/libcurlu_la-cf-haproxy.Plo
 	-rm -f ./$(DEPDIR)/libcurlu_la-cf-https-connect.Plo
+	-rm -f ./$(DEPDIR)/libcurlu_la-cf-ip-happy.Plo
 	-rm -f ./$(DEPDIR)/libcurlu_la-cf-socket.Plo
 	-rm -f ./$(DEPDIR)/libcurlu_la-cfilters.Plo
 	-rm -f ./$(DEPDIR)/libcurlu_la-conncache.Plo
@@ -5784,13 +5782,11 @@ maintainer-clean: maintainer-clean-am
 	-rm -f vauth/$(DEPDIR)/libcurlu_la-spnego_gssapi.Plo
 	-rm -f vauth/$(DEPDIR)/libcurlu_la-spnego_sspi.Plo
 	-rm -f vauth/$(DEPDIR)/libcurlu_la-vauth.Plo
-	-rm -f vquic/$(DEPDIR)/libcurl_la-curl_msh3.Plo
 	-rm -f vquic/$(DEPDIR)/libcurl_la-curl_ngtcp2.Plo
 	-rm -f vquic/$(DEPDIR)/libcurl_la-curl_osslq.Plo
 	-rm -f vquic/$(DEPDIR)/libcurl_la-curl_quiche.Plo
 	-rm -f vquic/$(DEPDIR)/libcurl_la-vquic-tls.Plo
 	-rm -f vquic/$(DEPDIR)/libcurl_la-vquic.Plo
-	-rm -f vquic/$(DEPDIR)/libcurlu_la-curl_msh3.Plo
 	-rm -f vquic/$(DEPDIR)/libcurlu_la-curl_ngtcp2.Plo
 	-rm -f vquic/$(DEPDIR)/libcurlu_la-curl_osslq.Plo
 	-rm -f vquic/$(DEPDIR)/libcurlu_la-curl_quiche.Plo
@@ -5893,7 +5889,7 @@ checksrc:
 	$(CHECKSRC)(@PERL@ $(top_srcdir)/scripts/checksrc.pl -D$(srcdir) \
 	$(CSOURCES) $(HHEADERS))
 
-all-local: $(CHECKSOURCES) $(UNITPROTOS)
+all-local: $(CHECKSOURCES)
 
 # UNITPROTOS depends on every C file in the lib/ dir
 $(UNITPROTOS): $(CSOURCES)
diff --git a/deps/curl/lib/Makefile.inc b/deps/curl/lib/Makefile.inc
index 257e104de94..524fdcc53d5 100644
--- a/deps/curl/lib/Makefile.inc
+++ b/deps/curl/lib/Makefile.inc
@@ -110,7 +110,6 @@ LIB_VTLS_HFILES =           \
   vtls/x509asn1.h
 
 LIB_VQUIC_CFILES = \
-  vquic/curl_msh3.c   \
   vquic/curl_ngtcp2.c   \
   vquic/curl_osslq.c   \
   vquic/curl_quiche.c   \
@@ -118,7 +117,6 @@ LIB_VQUIC_CFILES = \
   vquic/vquic-tls.c
 
 LIB_VQUIC_HFILES = \
-  vquic/curl_msh3.h   \
   vquic/curl_ngtcp2.h   \
   vquic/curl_osslq.h   \
   vquic/curl_quiche.h   \
@@ -148,6 +146,7 @@ LIB_CFILES =         \
   cf-h2-proxy.c      \
   cf-haproxy.c       \
   cf-https-connect.c \
+  cf-ip-happy.c      \
   cf-socket.c        \
   cfilters.c         \
   conncache.c        \
@@ -276,6 +275,7 @@ LIB_HFILES =         \
   cf-h2-proxy.h      \
   cf-haproxy.h       \
   cf-https-connect.h \
+  cf-ip-happy.h      \
   cf-socket.h        \
   cfilters.h         \
   conncache.h        \
@@ -296,6 +296,7 @@ LIB_HFILES =         \
   curl_ldap.h        \
   curl_md4.h         \
   curl_md5.h         \
+  curl_mem_undef.h   \
   curl_memory.h      \
   curl_memrchr.h     \
   curl_ntlm_core.h   \
diff --git a/deps/curl/lib/altsvc.c b/deps/curl/lib/altsvc.c
index 59476d7325a..c7448692fb5 100644
--- a/deps/curl/lib/altsvc.c
+++ b/deps/curl/lib/altsvc.c
@@ -187,13 +187,13 @@ static CURLcode altsvc_add(struct altsvcinfo *asi, const char *line)
   else {
     struct altsvc *as;
     char dbuf[MAX_ALTSVC_DATELEN + 1];
-    time_t expires;
+    time_t expires = 0;
 
     /* The date parser works on a null-terminated string. The maximum length
        is upheld by curlx_str_quotedword(). */
     memcpy(dbuf, curlx_str(&date), curlx_strlen(&date));
     dbuf[curlx_strlen(&date)] = 0;
-    expires = Curl_getdate_capped(dbuf);
+    Curl_getdate_capped(dbuf, &expires);
     as = altsvc_create(&srchost, &dsthost, &srcalpn, &dstalpn,
                        (size_t)srcport, (size_t)dstport);
     if(as) {
@@ -260,11 +260,11 @@ static CURLcode altsvc_out(struct altsvc *as, FILE *fp)
 #ifdef USE_IPV6
   else {
     char ipv6_unused[16];
-    if(1 == curlx_inet_pton(AF_INET6, as->dst.host, ipv6_unused)) {
+    if(curlx_inet_pton(AF_INET6, as->dst.host, ipv6_unused) == 1) {
       dst6_pre = "[";
       dst6_post = "]";
     }
-    if(1 == curlx_inet_pton(AF_INET6, as->src.host, ipv6_unused)) {
+    if(curlx_inet_pton(AF_INET6, as->src.host, ipv6_unused) == 1) {
       src6_pre = "[";
       src6_post = "]";
     }
diff --git a/deps/curl/lib/asyn-ares.c b/deps/curl/lib/asyn-ares.c
index 007f1d7123c..e955990878a 100644
--- a/deps/curl/lib/asyn-ares.c
+++ b/deps/curl/lib/asyn-ares.c
@@ -237,26 +237,6 @@ CURLcode Curl_async_get_impl(struct Curl_easy *data, void **impl)
   return result;
 }
 
-static void async_ares_cleanup(struct Curl_easy *data);
-
-void Curl_async_ares_shutdown(struct Curl_easy *data)
-{
-  struct async_ares_ctx *ares = &data->state.async.ares;
-  if(ares->channel)
-    ares_cancel(ares->channel);
-  async_ares_cleanup(data);
-}
-
-void Curl_async_ares_destroy(struct Curl_easy *data)
-{
-  struct async_ares_ctx *ares = &data->state.async.ares;
-  Curl_async_ares_shutdown(data);
-  if(ares->channel) {
-    ares_destroy(ares->channel);
-    ares->channel = NULL;
-  }
-}
-
 /*
  * async_ares_cleanup() cleans up async resolver data.
  */
@@ -272,16 +252,37 @@ static void async_ares_cleanup(struct Curl_easy *data)
 #endif
 }
 
+void Curl_async_ares_shutdown(struct Curl_easy *data)
+{
+  /* c-ares has a method to "cancel" operations on a channel, but
+   * as reported in #18216, this does not totally reset the channel
+   * and ares may get stuck.
+   * We need to destroy the channel and on demand create a new
+   * one to avoid that. */
+  Curl_async_ares_destroy(data);
+}
+
+void Curl_async_ares_destroy(struct Curl_easy *data)
+{
+  struct async_ares_ctx *ares = &data->state.async.ares;
+  if(ares->channel) {
+    ares_destroy(ares->channel);
+    ares->channel = NULL;
+  }
+  async_ares_cleanup(data);
+}
+
 /*
- * Curl_async_getsock() is called when someone from the outside world
+ * Curl_async_pollset() is called when someone from the outside world
  * (using curl_multi_fdset()) wants to get our fd_set setup.
  */
 
-int Curl_async_getsock(struct Curl_easy *data, curl_socket_t *socks)
+CURLcode Curl_async_pollset(struct Curl_easy *data, struct easy_pollset *ps)
 {
   struct async_ares_ctx *ares = &data->state.async.ares;
-  DEBUGASSERT(ares->channel);
-  return Curl_ares_getsock(data, ares->channel, socks);
+  if(ares->channel)
+    return Curl_ares_pollset(data, ares->channel, ps);
+  return CURLE_OK;
 }
 
 /*
@@ -337,28 +338,33 @@ CURLcode Curl_async_is_resolved(struct Curl_easy *data,
     Curl_resolv_unlink(data, &data->state.async.dns);
     data->state.async.done = TRUE;
     result = ares->result;
-    if(ares->last_status == CURL_ASYNC_SUCCESS && !result) {
+    if(ares->ares_status == ARES_SUCCESS && !result) {
       data->state.async.dns =
         Curl_dnscache_mk_entry(data, ares->temp_ai,
                                data->state.async.hostname, 0,
                                data->state.async.port, FALSE);
       ares->temp_ai = NULL; /* temp_ai now owned by entry */
 #ifdef HTTPSRR_WORKS
-        if(data->state.async.dns) {
-          struct Curl_https_rrinfo *lhrr = Curl_httpsrr_dup_move(&ares->hinfo);
-          if(!lhrr)
-            result = CURLE_OUT_OF_MEMORY;
-          else
-            data->state.async.dns->hinfo = lhrr;
-        }
+      if(data->state.async.dns) {
+        struct Curl_https_rrinfo *lhrr = Curl_httpsrr_dup_move(&ares->hinfo);
+        if(!lhrr)
+          result = CURLE_OUT_OF_MEMORY;
+        else
+          data->state.async.dns->hinfo = lhrr;
+      }
 #endif
       if(!result && data->state.async.dns)
         result = Curl_dnscache_add(data, data->state.async.dns);
     }
     /* if we have not found anything, report the proper
      * CURLE_COULDNT_RESOLVE_* code */
-    if(!result && !data->state.async.dns)
-      result = Curl_resolver_error(data);
+    if(!result && !data->state.async.dns) {
+      const char *msg = NULL;
+      if(ares->ares_status != ARES_SUCCESS)
+        msg = ares_strerror(ares->ares_status);
+      result = Curl_resolver_error(data, msg);
+    }
+
     if(result)
       Curl_resolv_unlink(data, &data->state.async.dns);
     *dns = data->state.async.dns;
@@ -511,14 +517,14 @@ static void async_ares_hostbyname_cb(void *user_data,
        be valid so only defer it when we know the 'status' says its fine! */
     return;
 
-  if(CURL_ASYNC_SUCCESS == status) {
-    ares->last_status = status; /* one success overrules any error */
+  if(ARES_SUCCESS == status) {
+    ares->ares_status = status; /* one success overrules any error */
     async_addr_concat(&ares->temp_ai,
       Curl_he2ai(hostent, data->state.async.port));
   }
-  else if(ares->last_status != ARES_SUCCESS) {
-    /* no success so far, remember error */
-    ares->last_status = status;
+  else if(ares->ares_status != ARES_SUCCESS) {
+    /* no success so far, remember last error */
+    ares->ares_status = status;
   }
 
   ares->num_pending--;
@@ -666,21 +672,22 @@ async_ares_node2addr(struct ares_addrinfo_node *node)
 }
 
 static void async_ares_addrinfo_cb(void *user_data, int status, int timeouts,
-                                   struct ares_addrinfo *result)
+                                   struct ares_addrinfo *ares_ai)
 {
   struct Curl_easy *data = (struct Curl_easy *)user_data;
   struct async_ares_ctx *ares = &data->state.async.ares;
   (void)timeouts;
-  CURL_TRC_DNS(data, "asyn-ares: addrinfo callback, status=%d", status);
-  if(ARES_SUCCESS == status) {
-    ares->temp_ai = async_ares_node2addr(result->nodes);
-    ares->last_status = CURL_ASYNC_SUCCESS;
-    ares_freeaddrinfo(result);
+  if(ares->ares_status != ARES_SUCCESS) /* do not overwrite success */
+    ares->ares_status = status;
+  if(status == ARES_SUCCESS) {
+    ares->temp_ai = async_ares_node2addr(ares_ai->nodes);
+    ares_freeaddrinfo(ares_ai);
   }
   ares->num_pending--;
-  CURL_TRC_DNS(data, "ares: addrinfo done, status=%d, pending=%d, "
-               "addr=%sfound",
-               status, ares->num_pending, ares->temp_ai ? "" : "not ");
+  CURL_TRC_DNS(data, "ares: addrinfo done, query status=%d, "
+               "overall status=%d, pending=%d, addr=%sfound",
+               status, ares->ares_status, ares->num_pending,
+               ares->temp_ai ? "" : "not ");
 }
 
 #endif
@@ -736,7 +743,13 @@ struct Curl_addrinfo *Curl_async_getaddrinfo(struct Curl_easy *data,
     return NULL;
 
   /* initial status - failed */
-  ares->last_status = ARES_ENOTFOUND;
+  ares->ares_status = ARES_ENOTFOUND;
+  ares->result = CURLE_OK;
+
+#if ARES_VERSION >= 0x011800  /* >= v1.24.0 */
+  CURL_TRC_DNS(data, "asyn-ares: servers=%s",
+               ares_get_servers_csv(ares->channel));
+#endif
 
 #ifdef HAVE_CARES_GETADDRINFO
   {
diff --git a/deps/curl/lib/asyn-base.c b/deps/curl/lib/asyn-base.c
index ea89fba15c3..eb2240b816c 100644
--- a/deps/curl/lib/asyn-base.c
+++ b/deps/curl/lib/asyn-base.c
@@ -70,7 +70,7 @@
 #endif
 
 /*
- * Curl_ares_getsock() is called when the outside world (using
+ * Curl_ares_pollset() is called when the outside world (using
  * curl_multi_fdset()) wants to get our fd_set setup and we are talking with
  * ares. The caller must make sure that this function is only called when we
  * have a working ares channel.
@@ -78,18 +78,44 @@
  * Returns: sockets-in-use-bitmap
  */
 
-int Curl_ares_getsock(struct Curl_easy *data,
-                      ares_channel channel,
-                      curl_socket_t *socks)
+
+CURLcode Curl_ares_pollset(struct Curl_easy *data,
+                           ares_channel channel,
+                           struct easy_pollset *ps)
 {
   struct timeval maxtime = { CURL_TIMEOUT_RESOLVE, 0 };
   struct timeval timebuf;
-  int max = ares_getsock(channel,
-                         (ares_socket_t *)socks, MAX_SOCKSPEREASYHANDLE);
-  struct timeval *timeout = ares_timeout(channel, &maxtime, &timebuf);
-  timediff_t milli = curlx_tvtoms(timeout);
+  curl_socket_t sockets[16];  /* ARES documented limit */
+  unsigned int bitmap, i;
+  struct timeval *timeout;
+  timediff_t milli;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(channel);
+  if(!channel)
+    return CURLE_FAILED_INIT;
+
+  bitmap = ares_getsock(channel, (ares_socket_t *)sockets,
+                        CURL_ARRAYSIZE(sockets));
+  for(i = 0; i < CURL_ARRAYSIZE(sockets); ++i) {
+    int flags = 0;
+    if(ARES_GETSOCK_READABLE(bitmap, i))
+      flags |= CURL_POLL_IN;
+    if(ARES_GETSOCK_WRITABLE(bitmap, i))
+      flags |= CURL_POLL_OUT;
+    if(!flags)
+      break;
+    result = Curl_pollset_change(data, ps, sockets[i], flags, 0);
+    if(result)
+      return result;
+  }
+
+  timeout = ares_timeout(channel, &maxtime, &timebuf);
+  if(!timeout)
+    timeout = &maxtime;
+  milli = curlx_tvtoms(timeout);
   Curl_expire(data, milli, EXPIRE_ASYNC_NAME);
-  return max;
+  return result;
 }
 
 /*
diff --git a/deps/curl/lib/asyn-thrdd.c b/deps/curl/lib/asyn-thrdd.c
index 1ede8688206..ca6830a0bee 100644
--- a/deps/curl/lib/asyn-thrdd.c
+++ b/deps/curl/lib/asyn-thrdd.c
@@ -63,6 +63,7 @@
 #include "url.h"
 #include "multiif.h"
 #include "curl_threads.h"
+#include "select.h"
 #include "strdup.h"
 
 #ifdef USE_ARES
@@ -106,6 +107,7 @@ void Curl_async_global_cleanup(void)
 }
 
 static void async_thrdd_destroy(struct Curl_easy *);
+static void async_thrdd_shutdown(struct Curl_easy *);
 
 CURLcode Curl_async_get_impl(struct Curl_easy *data, void **impl)
 {
@@ -114,33 +116,46 @@ CURLcode Curl_async_get_impl(struct Curl_easy *data, void **impl)
   return CURLE_OK;
 }
 
-/* Destroy context of threaded resolver */
-static void addr_ctx_destroy(struct async_thrdd_addr_ctx *addr_ctx)
+/* Give up reference to add_ctx */
+static void addr_ctx_unlink(struct async_thrdd_addr_ctx **paddr_ctx,
+                            struct Curl_easy *data)
 {
-  if(addr_ctx) {
-    DEBUGASSERT(!addr_ctx->ref_count);
+  struct async_thrdd_addr_ctx *addr_ctx = *paddr_ctx;
+  bool destroy;
+
+  (void)data;
+  if(!addr_ctx)
+    return;
+
+  Curl_mutex_acquire(&addr_ctx->mutx);
+  if(!data)  /* called by resolving thread */
+    addr_ctx->thrd_done = TRUE;
+
+  DEBUGASSERT(addr_ctx->ref_count);
+  --addr_ctx->ref_count;
+  destroy = !addr_ctx->ref_count;
+  Curl_mutex_release(&addr_ctx->mutx);
+
+  if(destroy) {
     Curl_mutex_destroy(&addr_ctx->mutx);
     free(addr_ctx->hostname);
     if(addr_ctx->res)
       Curl_freeaddrinfo(addr_ctx->res);
 #ifndef CURL_DISABLE_SOCKETPAIR
-  /*
-   * close one end of the socket pair (may be done in resolver thread);
-   * the other end (for reading) is always closed in the parent thread.
-   */
 #ifndef USE_EVENTFD
-  if(addr_ctx->sock_pair[1] != CURL_SOCKET_BAD) {
     wakeup_close(addr_ctx->sock_pair[1]);
-  }
 #endif
+    wakeup_close(addr_ctx->sock_pair[0]);
 #endif
     free(addr_ctx);
   }
+  *paddr_ctx = NULL;
 }
 
 /* Initialize context for threaded resolver */
 static struct async_thrdd_addr_ctx *
-addr_ctx_create(const char *hostname, int port,
+addr_ctx_create(struct Curl_easy *data,
+                const char *hostname, int port,
                 const struct addrinfo *hints)
 {
   struct async_thrdd_addr_ctx *addr_ctx = calloc(1, sizeof(*addr_ctx));
@@ -149,17 +164,13 @@ addr_ctx_create(const char *hostname, int port,
 
   addr_ctx->thread_hnd = curl_thread_t_null;
   addr_ctx->port = port;
-#ifndef CURL_DISABLE_SOCKETPAIR
-  addr_ctx->sock_pair[0] = CURL_SOCKET_BAD;
-  addr_ctx->sock_pair[1] = CURL_SOCKET_BAD;
-#endif
-  addr_ctx->ref_count = 0;
+  addr_ctx->ref_count = 1;
 
 #ifdef HAVE_GETADDRINFO
   DEBUGASSERT(hints);
   addr_ctx->hints = *hints;
 #else
-  (void) hints;
+  (void)hints;
 #endif
 
   Curl_mutex_init(&addr_ctx->mutx);
@@ -172,7 +183,7 @@ addr_ctx_create(const char *hostname, int port,
     goto err_exit;
   }
 #endif
-  addr_ctx->sock_error = CURL_ASYNC_SUCCESS;
+  addr_ctx->sock_error = 0;
 
   /* Copying hostname string because original can be destroyed by parent
    * thread during gethostbyname execution.
@@ -181,20 +192,21 @@ addr_ctx_create(const char *hostname, int port,
   if(!addr_ctx->hostname)
     goto err_exit;
 
-  addr_ctx->ref_count = 1;
   return addr_ctx;
 
 err_exit:
-#ifndef CURL_DISABLE_SOCKETPAIR
-  if(addr_ctx->sock_pair[0] != CURL_SOCKET_BAD) {
-    wakeup_close(addr_ctx->sock_pair[0]);
-    addr_ctx->sock_pair[0] = CURL_SOCKET_BAD;
-  }
-#endif
-  addr_ctx_destroy(addr_ctx);
+  addr_ctx_unlink(&addr_ctx, data);
   return NULL;
 }
 
+static void async_thrd_cleanup(void *arg)
+{
+  struct async_thrdd_addr_ctx *addr_ctx = arg;
+
+  Curl_thread_disable_cancel();
+  addr_ctx_unlink(&addr_ctx, NULL);
+}
+
 #ifdef HAVE_GETADDRINFO
 
 /*
@@ -203,58 +215,71 @@ addr_ctx_create(const char *hostname, int port,
  * For builds without ARES, but with USE_IPV6, create a resolver thread
  * and wait on it.
  */
-static
-#if defined(CURL_WINDOWS_UWP) || defined(UNDER_CE)
-DWORD
-#else
-unsigned int
-#endif
-CURL_STDCALL getaddrinfo_thread(void *arg)
+static CURL_THREAD_RETURN_T CURL_STDCALL getaddrinfo_thread(void *arg)
 {
   struct async_thrdd_addr_ctx *addr_ctx = arg;
-  char service[12];
-  int rc;
-  bool all_gone;
+  bool do_abort;
 
-  msnprintf(service, sizeof(service), "%d", addr_ctx->port);
+/* clang complains about empty statements and the pthread_cleanup* macros
+ * are pretty ill defined. */
+#if defined(__clang__)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wextra-semi-stmt"
+#endif
 
-  rc = Curl_getaddrinfo_ex(addr_ctx->hostname, service,
-                           &addr_ctx->hints, &addr_ctx->res);
-
-  if(rc) {
-    addr_ctx->sock_error = SOCKERRNO ? SOCKERRNO : rc;
-    if(addr_ctx->sock_error == 0)
-      addr_ctx->sock_error = RESOLVER_ENOMEM;
-  }
-  else {
-    Curl_addrinfo_set_port(addr_ctx->res, addr_ctx->port);
-  }
+  Curl_thread_push_cleanup(async_thrd_cleanup, addr_ctx);
 
   Curl_mutex_acquire(&addr_ctx->mutx);
-  if(addr_ctx->ref_count > 1) {
-    /* Someone still waiting on our results. */
+  do_abort = addr_ctx->do_abort;
+  Curl_mutex_release(&addr_ctx->mutx);
+
+  if(!do_abort) {
+    char service[12];
+    int rc;
+
+#ifdef DEBUGBUILD
+    Curl_resolve_test_delay();
+#endif
+    msnprintf(service, sizeof(service), "%d", addr_ctx->port);
+
+    rc = Curl_getaddrinfo_ex(addr_ctx->hostname, service,
+                             &addr_ctx->hints, &addr_ctx->res);
+
+    if(rc) {
+      addr_ctx->sock_error = SOCKERRNO ? SOCKERRNO : rc;
+      if(addr_ctx->sock_error == 0)
+        addr_ctx->sock_error = RESOLVER_ENOMEM;
+    }
+    else {
+      Curl_addrinfo_set_port(addr_ctx->res, addr_ctx->port);
+    }
+
+    Curl_mutex_acquire(&addr_ctx->mutx);
+    do_abort = addr_ctx->do_abort;
+    Curl_mutex_release(&addr_ctx->mutx);
 #ifndef CURL_DISABLE_SOCKETPAIR
-    if(addr_ctx->sock_pair[1] != CURL_SOCKET_BAD) {
+    if(!do_abort) {
 #ifdef USE_EVENTFD
       const uint64_t buf[1] = { 1 };
 #else
       const char buf[1] = { 1 };
 #endif
-      /* DNS has been resolved, signal client task */
+      /* Thread is done, notify transfer */
       if(wakeup_write(addr_ctx->sock_pair[1], buf, sizeof(buf)) < 0) {
-        /* update sock_erro to errno */
+        /* update sock_error to errno */
         addr_ctx->sock_error = SOCKERRNO;
       }
     }
 #endif
+
   }
-  /* thread gives up its reference to the shared data now. */
-  --addr_ctx->ref_count;
-  all_gone = !addr_ctx->ref_count;
-  Curl_mutex_release(&addr_ctx->mutx);
-  if(all_gone)
-    addr_ctx_destroy(addr_ctx);
 
+  Curl_thread_pop_cleanup();
+#if defined(__clang__)
+#pragma clang diagnostic pop
+#endif
+
+  addr_ctx_unlink(&addr_ctx, NULL);
   return 0;
 }
 
@@ -263,33 +288,61 @@ CURL_STDCALL getaddrinfo_thread(void *arg)
 /*
  * gethostbyname_thread() resolves a name and then exits.
  */
-static
-#if defined(CURL_WINDOWS_UWP) || defined(UNDER_CE)
-DWORD
-#else
-unsigned int
-#endif
-CURL_STDCALL gethostbyname_thread(void *arg)
+static CURL_THREAD_RETURN_T CURL_STDCALL gethostbyname_thread(void *arg)
 {
   struct async_thrdd_addr_ctx *addr_ctx = arg;
-  bool all_gone;
+  bool do_abort;
 
-  addr_ctx->res = Curl_ipv4_resolve_r(addr_ctx->hostname, addr_ctx->port);
+/* clang complains about empty statements and the pthread_cleanup* macros
+ * are pretty ill defined. */
+#if defined(__clang__)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wextra-semi-stmt"
+#endif
 
-  if(!addr_ctx->res) {
-    addr_ctx->sock_error = SOCKERRNO;
-    if(addr_ctx->sock_error == 0)
-      addr_ctx->sock_error = RESOLVER_ENOMEM;
-  }
+  Curl_thread_push_cleanup(async_thrd_cleanup, addr_ctx);
 
   Curl_mutex_acquire(&addr_ctx->mutx);
-  /* thread gives up its reference to the shared data now. */
-  --addr_ctx->ref_count;
-  all_gone = !addr_ctx->ref_count;;
+  do_abort = addr_ctx->do_abort;
   Curl_mutex_release(&addr_ctx->mutx);
-  if(all_gone)
-    addr_ctx_destroy(addr_ctx);
 
+  if(!do_abort) {
+#ifdef DEBUGBUILD
+    Curl_resolve_test_delay();
+#endif
+
+    addr_ctx->res = Curl_ipv4_resolve_r(addr_ctx->hostname, addr_ctx->port);
+    if(!addr_ctx->res) {
+      addr_ctx->sock_error = SOCKERRNO;
+      if(addr_ctx->sock_error == 0)
+        addr_ctx->sock_error = RESOLVER_ENOMEM;
+    }
+
+    Curl_mutex_acquire(&addr_ctx->mutx);
+    do_abort = addr_ctx->do_abort;
+    Curl_mutex_release(&addr_ctx->mutx);
+#ifndef CURL_DISABLE_SOCKETPAIR
+    if(!do_abort) {
+#ifdef USE_EVENTFD
+      const uint64_t buf[1] = { 1 };
+#else
+      const char buf[1] = { 1 };
+#endif
+      /* Thread is done, notify transfer */
+      if(wakeup_write(addr_ctx->sock_pair[1], buf, sizeof(buf)) < 0) {
+        /* update sock_error to errno */
+        addr_ctx->sock_error = SOCKERRNO;
+      }
+    }
+#endif
+  }
+
+  Curl_thread_pop_cleanup();
+#if defined(__clang__)
+#pragma clang diagnostic pop
+#endif
+
+  async_thrd_cleanup(addr_ctx);
   return 0;
 }
 
@@ -302,6 +355,7 @@ static void async_thrdd_destroy(struct Curl_easy *data)
 {
   struct async_thrdd_ctx *thrdd = &data->state.async.thrdd;
   struct async_thrdd_addr_ctx *addr = thrdd->addr;
+
 #ifdef USE_HTTPSRR_ARES
   if(thrdd->rr.channel) {
     ares_destroy(thrdd->rr.channel);
@@ -310,46 +364,30 @@ static void async_thrdd_destroy(struct Curl_easy *data)
   Curl_httpsrr_cleanup(&thrdd->rr.hinfo);
 #endif
 
-  if(addr) {
-#ifndef CURL_DISABLE_SOCKETPAIR
-    curl_socket_t sock_rd = addr->sock_pair[0];
-#endif
+  if(thrdd->addr && (thrdd->addr->thread_hnd != curl_thread_t_null)) {
     bool done;
 
-    /* Release our reference to the data shared with the thread. */
     Curl_mutex_acquire(&addr->mutx);
-    --addr->ref_count;
-    CURL_TRC_DNS(data, "resolve, destroy async data, shared ref=%d",
-                 addr->ref_count);
-    done = !addr->ref_count;
-    /* we give up our reference to `addr`, so NULL our pointer.
-     * coverity analyses this as being a potential unsynched write,
-     * assuming two calls to this function could be invoked concurrently.
-     * Which they never are, as the transfer's side runs single-threaded. */
-    thrdd->addr = NULL;
-    if(!done) {
-      /* thread is still running. Detach the thread while mutexed, it will
-       * trigger the cleanup when it releases its reference. */
-      Curl_thread_destroy(&addr->thread_hnd);
-    }
+#ifndef CURL_DISABLE_SOCKETPAIR
+    if(!addr->do_abort)
+      Curl_multi_will_close(data, addr->sock_pair[0]);
+#endif
+    addr->do_abort = TRUE;
+    done = addr->thrd_done;
     Curl_mutex_release(&addr->mutx);
 
     if(done) {
-      /* thread has released its reference, join it and
-       * release the memory we shared with it. */
-      if(addr->thread_hnd != curl_thread_t_null)
-        Curl_thread_join(&addr->thread_hnd);
-      addr_ctx_destroy(addr);
+      Curl_thread_join(&addr->thread_hnd);
+      CURL_TRC_DNS(data, "async_thrdd_destroy, thread joined");
+    }
+    else {
+      /* thread is still running. Detach the thread while mutexed, it will
+       * trigger the cleanup when it releases its reference. */
+      Curl_thread_destroy(&addr->thread_hnd);
+      CURL_TRC_DNS(data, "async_thrdd_destroy, thread detached");
     }
-#ifndef CURL_DISABLE_SOCKETPAIR
-    /*
-     * ensure CURLMOPT_SOCKETFUNCTION fires CURL_POLL_REMOVE
-     * before the FD is invalidated to avoid EBADF on EPOLL_CTL_DEL
-     */
-    Curl_multi_will_close(data, sock_rd);
-    wakeup_close(sock_rd);
-#endif
   }
+  addr_ctx_unlink(&thrdd->addr, data);
 }
 
 #ifdef USE_HTTPSRR_ARES
@@ -379,6 +417,14 @@ static CURLcode async_rr_start(struct Curl_easy *data)
     thrdd->rr.channel = NULL;
     return CURLE_FAILED_INIT;
   }
+#ifdef CURLDEBUG
+  if(getenv("CURL_DNS_SERVER")) {
+    const char *servers = getenv("CURL_DNS_SERVER");
+    status = ares_set_servers_ports_csv(thrdd->rr.channel, servers);
+    if(status)
+      return CURLE_FAILED_INIT;
+  }
+#endif
 
   memset(&thrdd->rr.hinfo, 0, sizeof(thrdd->rr.hinfo));
   thrdd->rr.hinfo.port = -1;
@@ -386,6 +432,7 @@ static CURLcode async_rr_start(struct Curl_easy *data)
                     data->conn->host.name, ARES_CLASS_IN,
                     ARES_REC_TYPE_HTTPS,
                     async_thrdd_rr_done, data, NULL);
+  CURL_TRC_DNS(data, "Issued HTTPS-RR request for %s", data->conn->host.name);
   return CURLE_OK;
 }
 #endif
@@ -428,29 +475,28 @@ static bool async_thrdd_init(struct Curl_easy *data,
   if(!data->state.async.hostname)
     goto err_exit;
 
-  addr_ctx = addr_ctx_create(hostname, port, hints);
+  addr_ctx = addr_ctx_create(data, hostname, port, hints);
   if(!addr_ctx)
     goto err_exit;
   thrdd->addr = addr_ctx;
 
-  Curl_mutex_acquire(&addr_ctx->mutx);
-  DEBUGASSERT(addr_ctx->ref_count == 1);
   /* passing addr_ctx to the thread adds a reference */
+  addr_ctx->ref_count = 2;
   addr_ctx->start = curlx_now();
-  ++addr_ctx->ref_count;
+
 #ifdef HAVE_GETADDRINFO
   addr_ctx->thread_hnd = Curl_thread_create(getaddrinfo_thread, addr_ctx);
 #else
   addr_ctx->thread_hnd = Curl_thread_create(gethostbyname_thread, addr_ctx);
 #endif
+
   if(addr_ctx->thread_hnd == curl_thread_t_null) {
-    /* The thread never started, remove its reference that never happened. */
-    --addr_ctx->ref_count;
+    /* The thread never started */
+    addr_ctx->ref_count = 1;
+    addr_ctx->thrd_done = TRUE;
     err = errno;
-    Curl_mutex_release(&addr_ctx->mutx);
     goto err_exit;
   }
-  Curl_mutex_release(&addr_ctx->mutx);
 
 #ifdef USE_HTTPSRR_ARES
   if(async_rr_start(data))
@@ -466,6 +512,33 @@ static bool async_thrdd_init(struct Curl_easy *data,
   return FALSE;
 }
 
+static void async_thrdd_shutdown(struct Curl_easy *data)
+{
+  struct async_thrdd_ctx *thrdd = &data->state.async.thrdd;
+  struct async_thrdd_addr_ctx *addr_ctx = thrdd->addr;
+  bool done;
+
+  if(!addr_ctx)
+    return;
+  if(addr_ctx->thread_hnd == curl_thread_t_null)
+    return;
+
+  Curl_mutex_acquire(&addr_ctx->mutx);
+#ifndef CURL_DISABLE_SOCKETPAIR
+    if(!addr_ctx->do_abort)
+      Curl_multi_will_close(data, addr_ctx->sock_pair[0]);
+#endif
+  addr_ctx->do_abort = TRUE;
+  done = addr_ctx->thrd_done;
+  Curl_mutex_release(&addr_ctx->mutx);
+
+  DEBUGASSERT(addr_ctx->thread_hnd != curl_thread_t_null);
+  if(!done && (addr_ctx->thread_hnd != curl_thread_t_null)) {
+    CURL_TRC_DNS(data, "cancelling resolve thread");
+    (void)Curl_thread_cancel(&addr_ctx->thread_hnd);
+  }
+}
+
 /*
  * 'entry' may be NULL and then no data is returned
  */
@@ -475,47 +548,44 @@ static CURLcode asyn_thrdd_await(struct Curl_easy *data,
 {
   CURLcode result = CURLE_OK;
 
-  DEBUGASSERT(addr_ctx->thread_hnd != curl_thread_t_null);
+  if(addr_ctx->thread_hnd != curl_thread_t_null) {
+    /* not interested in result? cancel, if still running... */
+    if(!entry)
+      async_thrdd_shutdown(data);
+
+    CURL_TRC_DNS(data, "resolve, wait for thread to finish");
+    if(!Curl_thread_join(&addr_ctx->thread_hnd)) {
+      DEBUGASSERT(0);
+    }
 
-  CURL_TRC_DNS(data, "resolve, wait for thread to finish");
-  /* wait for the thread to resolve the name */
-  if(Curl_thread_join(&addr_ctx->thread_hnd)) {
     if(entry)
       result = Curl_async_is_resolved(data, entry);
   }
-  else
-    DEBUGASSERT(0);
 
   data->state.async.done = TRUE;
   if(entry)
     *entry = data->state.async.dns;
 
-  async_thrdd_destroy(data);
   return result;
 }
 
-
 /*
  * Until we gain a way to signal the resolver threads to stop early, we must
  * simply wait for them and ignore their results.
  */
 void Curl_async_thrdd_shutdown(struct Curl_easy *data)
 {
-  struct async_thrdd_ctx *thrdd = &data->state.async.thrdd;
-
-  /* If we are still resolving, we must wait for the threads to fully clean up,
-     unfortunately. Otherwise, we can simply cancel to clean up any resolver
-     data. */
-  if(thrdd->addr && (thrdd->addr->thread_hnd != curl_thread_t_null) &&
-     !data->set.quick_exit)
-    (void)asyn_thrdd_await(data, thrdd->addr, NULL);
-  else
-    async_thrdd_destroy(data);
+  async_thrdd_shutdown(data);
 }
 
 void Curl_async_thrdd_destroy(struct Curl_easy *data)
 {
-  Curl_async_thrdd_shutdown(data);
+  struct async_thrdd_ctx *thrdd = &data->state.async.thrdd;
+
+  if(thrdd->addr && !data->set.quick_exit) {
+    (void)asyn_thrdd_await(data, thrdd->addr, NULL);
+  }
+  async_thrdd_destroy(data);
 }
 
 /*
@@ -572,7 +642,7 @@ CURLcode Curl_async_is_resolved(struct Curl_easy *data,
     return CURLE_FAILED_INIT;
 
   Curl_mutex_acquire(&thrdd->addr->mutx);
-  done = (thrdd->addr->ref_count == 1);
+  done = thrdd->addr->thrd_done;
   Curl_mutex_release(&thrdd->addr->mutx);
 
   if(done) {
@@ -608,13 +678,13 @@ CURLcode Curl_async_is_resolved(struct Curl_easy *data,
     }
 
     if(!result && !data->state.async.dns)
-      result = Curl_resolver_error(data);
+      result = Curl_resolver_error(data, NULL);
     if(result)
       Curl_resolv_unlink(data, &data->state.async.dns);
     *dns = data->state.async.dns;
     CURL_TRC_DNS(data, "is_resolved() result=%d, dns=%sfound",
                  result, *dns ? "" : "not ");
-    async_thrdd_destroy(data);
+    async_thrdd_shutdown(data);
     return result;
   }
   else {
@@ -641,37 +711,35 @@ CURLcode Curl_async_is_resolved(struct Curl_easy *data,
   }
 }
 
-int Curl_async_getsock(struct Curl_easy *data, curl_socket_t *socks)
+CURLcode Curl_async_pollset(struct Curl_easy *data, struct easy_pollset *ps)
 {
   struct async_thrdd_ctx *thrdd = &data->state.async.thrdd;
-  int ret_val = 0;
-#if !defined(CURL_DISABLE_SOCKETPAIR) || defined(USE_HTTPSRR_ARES)
-  int socketi = 0;
-#else
-  (void)socks;
+  CURLcode result = CURLE_OK;
+  bool thrd_done;
+
+#if !defined(USE_HTTPSRR_ARES) && defined(CURL_DISABLE_SOCKETPAIR)
+  (void)ps;
 #endif
 
 #ifdef USE_HTTPSRR_ARES
   if(thrdd->rr.channel) {
-    ret_val = Curl_ares_getsock(data, thrdd->rr.channel, socks);
-    for(socketi = 0; socketi < (MAX_SOCKSPEREASYHANDLE - 1); socketi++)
-      if(!ARES_GETSOCK_READABLE(ret_val, socketi) &&
-         !ARES_GETSOCK_WRITABLE(ret_val, socketi))
-        break;
+    result = Curl_ares_pollset(data, thrdd->rr.channel, ps);
+    if(result)
+      return result;
   }
 #endif
   if(!thrdd->addr)
-    return ret_val;
+    return result;
 
+  Curl_mutex_acquire(&thrdd->addr->mutx);
+  thrd_done = thrdd->addr->thrd_done;
+  Curl_mutex_release(&thrdd->addr->mutx);
+
+  if(!thrd_done) {
 #ifndef CURL_DISABLE_SOCKETPAIR
-  if(thrdd->addr) {
-    /* return read fd to client for polling the DNS resolution status */
-    socks[socketi] = thrdd->addr->sock_pair[0];
-    ret_val |= GETSOCK_READSOCK(socketi);
-  }
-  else
-#endif
-  {
+  /* return read fd to client for polling the DNS resolution status */
+    result = Curl_pollset_add_in(data, ps, thrdd->addr->sock_pair[0]);
+#else
     timediff_t milli;
     timediff_t ms = curlx_timediff(curlx_now(), thrdd->addr->start);
     if(ms < 3)
@@ -683,9 +751,9 @@ int Curl_async_getsock(struct Curl_easy *data, curl_socket_t *socks)
     else
       milli = 200;
     Curl_expire(data, milli, EXPIRE_ASYNC_NAME);
+#endif
   }
-
-  return ret_val;
+  return result;
 }
 
 #ifndef HAVE_GETADDRINFO
diff --git a/deps/curl/lib/asyn.h b/deps/curl/lib/asyn.h
index 1cc7175bebc..7863042bbe3 100644
--- a/deps/curl/lib/asyn.h
+++ b/deps/curl/lib/asyn.h
@@ -37,6 +37,7 @@ struct Curl_dns_entry;
 struct addrinfo;
 struct hostent;
 struct connectdata;
+struct easy_pollset;
 
 #if defined(CURLRES_ARES) && defined(CURLRES_THREADED)
 #error cannot have both CURLRES_ARES and CURLRES_THREADED defined
@@ -70,15 +71,15 @@ void Curl_async_global_cleanup(void);
  */
 CURLcode Curl_async_get_impl(struct Curl_easy *easy, void **impl);
 
-/* Curl_async_getsock()
+/* Curl_async_pollset()
  *
- * This function is called from the Curl_multi_getsock() function.  'sock' is a
+ * This function is called from the Curl_multi_pollset() function.  'sock' is a
  * pointer to an array to hold the file descriptors, with 'numsock' being the
  * size of that array (in number of entries). This function is supposed to
  * return bitmask indicating what file descriptors (referring to array indexes
  * in the 'sock' array) to wait for, read/write.
  */
-int Curl_async_getsock(struct Curl_easy *data, curl_socket_t *sock);
+CURLcode Curl_async_pollset(struct Curl_easy *data, struct easy_pollset *ps);
 
 /*
  * Curl_async_is_resolved()
@@ -127,9 +128,10 @@ struct Curl_addrinfo *Curl_async_getaddrinfo(struct Curl_easy *data,
 /* common functions for c-ares and threaded resolver with HTTPSRR */
 #include <ares.h>
 
-int Curl_ares_getsock(struct Curl_easy *data,
-                      ares_channel channel,
-                      curl_socket_t *socks);
+CURLcode Curl_ares_pollset(struct Curl_easy *data,
+                           ares_channel channel,
+                           struct easy_pollset *ps);
+
 int Curl_ares_perform(ares_channel channel,
                       timediff_t timeout_ms);
 #endif
@@ -141,7 +143,7 @@ struct async_ares_ctx {
   int num_pending; /* number of outstanding c-ares requests */
   struct Curl_addrinfo *temp_ai; /* intermediary result while fetching c-ares
                                     parts */
-  int last_status;
+  int ares_status; /* ARES_SUCCESS, ARES_ENOTFOUND, etc. */
   CURLcode result; /* CURLE_OK or error handling response */
 #ifndef HAVE_CARES_GETADDRINFO
   struct curltime happy_eyeballs_dns_time; /* when this timer started, or 0 */
@@ -191,6 +193,8 @@ struct async_thrdd_addr_ctx {
   int port;
   int sock_error;
   int ref_count;
+  BIT(thrd_done);
+  BIT(do_abort);
 };
 
 /* Context for threaded resolver */
@@ -236,7 +240,7 @@ struct doh_probes;
 
 #ifdef USE_CURL_ASYNC
 struct Curl_async {
-#ifdef CURLRES_ARES /*  */
+#ifdef CURLRES_ARES
   struct async_ares_ctx ares;
 #elif defined(CURLRES_THREADED)
   struct async_thrdd_ctx thrdd;
diff --git a/deps/curl/lib/bufq.c b/deps/curl/lib/bufq.c
index 8783619eed0..5cfd7520f2e 100644
--- a/deps/curl/lib/bufq.c
+++ b/deps/curl/lib/bufq.c
@@ -149,7 +149,6 @@ static void chunk_list_free(struct buf_chunk **anchor)
 }
 
 
-
 void Curl_bufcp_init(struct bufc_pool *pool,
                      size_t chunk_size, size_t spare_max)
 {
@@ -174,6 +173,12 @@ static CURLcode bufcp_take(struct bufc_pool *pool,
     return CURLE_OK;
   }
 
+  /* Check for integer overflow before allocation */
+  if(pool->chunk_size > SIZE_MAX - sizeof(*chunk)) {
+    *pchunk = NULL;
+    return CURLE_OUT_OF_MEMORY;
+  }
+
   chunk = calloc(1, sizeof(*chunk) + pool->chunk_size);
   if(!chunk) {
     *pchunk = NULL;
@@ -302,6 +307,11 @@ static struct buf_chunk *get_spare(struct bufq *q)
     return chunk;
   }
   else {
+    /* Check for integer overflow before allocation */
+    if(q->chunk_size > SIZE_MAX - sizeof(*chunk)) {
+      return NULL;
+    }
+
     chunk = calloc(1, sizeof(*chunk) + q->chunk_size);
     if(!chunk)
       return NULL;
@@ -526,7 +536,8 @@ CURLcode Curl_bufq_write_pass(struct bufq *q,
       if(result != CURLE_AGAIN)
         /* real error, fail */
         return result;
-      if((result == CURLE_AGAIN) && *pwritten)
+      /* result == CURLE_AGAIN */
+      if(*pwritten)
         /* we did write successfully before */
         result = CURLE_OK;
       return result;
@@ -590,8 +601,7 @@ static CURLcode bufq_slurpn(struct bufq *q, size_t max_len,
       break;
     }
     else if(n == 0) {
-      /* eof */
-      result = CURLE_OK;
+      /* eof, result remains CURLE_OK */
       break;
     }
     *pnread += n;
diff --git a/deps/curl/lib/cf-h1-proxy.c b/deps/curl/lib/cf-h1-proxy.c
index 4aac877fc18..798d6e9f668 100644
--- a/deps/curl/lib/cf-h1-proxy.c
+++ b/deps/curl/lib/cf-h1-proxy.c
@@ -682,11 +682,12 @@ static CURLcode cf_h1_proxy_connect(struct Curl_cfilter *cf,
   return result;
 }
 
-static void cf_h1_proxy_adjust_pollset(struct Curl_cfilter *cf,
-                                       struct Curl_easy *data,
-                                       struct easy_pollset *ps)
+static CURLcode cf_h1_proxy_adjust_pollset(struct Curl_cfilter *cf,
+                                           struct Curl_easy *data,
+                                           struct easy_pollset *ps)
 {
   struct h1_tunnel_state *ts = cf->ctx;
+  CURLcode result = CURLE_OK;
 
   if(!cf->connected) {
     /* If we are not connected, but the filter "below" is
@@ -698,13 +699,14 @@ static void cf_h1_proxy_adjust_pollset(struct Curl_cfilter *cf,
          response headers or if we are still sending the request, wait
          for write. */
       if(tunnel_want_send(ts))
-        Curl_pollset_set_out_only(data, ps, sock);
+        result = Curl_pollset_set_out_only(data, ps, sock);
       else
-        Curl_pollset_set_in_only(data, ps, sock);
+        result = Curl_pollset_set_in_only(data, ps, sock);
     }
     else
-      Curl_pollset_set_out_only(data, ps, sock);
+      result = Curl_pollset_set_out_only(data, ps, sock);
   }
+  return result;
 }
 
 static void cf_h1_proxy_destroy(struct Curl_cfilter *cf,
diff --git a/deps/curl/lib/cf-h2-proxy.c b/deps/curl/lib/cf-h2-proxy.c
index 8a853f6b1d2..d67bbd55adf 100644
--- a/deps/curl/lib/cf-h2-proxy.c
+++ b/deps/curl/lib/cf-h2-proxy.c
@@ -24,7 +24,8 @@
 
 #include "curl_setup.h"
 
-#if defined(USE_NGHTTP2) && !defined(CURL_DISABLE_PROXY)
+#if !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_PROXY) && \
+  defined(USE_NGHTTP2)
 
 #include <nghttp2/nghttp2.h>
 #include "urldata.h"
@@ -40,6 +41,7 @@
 #include "http_proxy.h"
 #include "multiif.h"
 #include "sendf.h"
+#include "select.h"
 #include "cf-h2-proxy.h"
 
 /* The last 3 #include files should be in this order */
@@ -472,7 +474,7 @@ static CURLcode proxy_h2_progress_ingress(struct Curl_cfilter *cf,
                 Curl_bufq_len(&ctx->inbufq), result, nread);
     if(result) {
       if(result != CURLE_AGAIN) {
-        failf(data, "Failed receiving HTTP2 data");
+        failf(data, "Failed receiving HTTP2 proxy data");
         return result;
       }
       break;
@@ -539,7 +541,7 @@ static ssize_t on_session_send(nghttp2_session *h2,
   if(!nwritten)
     return NGHTTP2_ERR_WOULDBLOCK;
 
-  return (nwritten  > SSIZE_T_MAX) ?
+  return (nwritten  > SSIZE_MAX) ?
     NGHTTP2_ERR_CALLBACK_FAILURE : (ssize_t)nwritten;
 }
 
@@ -815,7 +817,7 @@ static ssize_t tunnel_send_callback(nghttp2_session *session,
 
   CURL_TRC_CF(data, cf, "[%d] tunnel_send_callback -> %zd",
               ts->stream_id, nread);
-  return (nread  > SSIZE_T_MAX) ?
+  return (nread  > SSIZE_MAX) ?
     NGHTTP2_ERR_CALLBACK_FAILURE : (ssize_t)nread;
 }
 
@@ -1201,14 +1203,15 @@ static bool cf_h2_proxy_data_pending(struct Curl_cfilter *cf,
   return cf->next ? cf->next->cft->has_data_pending(cf->next, data) : FALSE;
 }
 
-static void cf_h2_proxy_adjust_pollset(struct Curl_cfilter *cf,
-                                       struct Curl_easy *data,
-                                       struct easy_pollset *ps)
+static CURLcode cf_h2_proxy_adjust_pollset(struct Curl_cfilter *cf,
+                                           struct Curl_easy *data,
+                                           struct easy_pollset *ps)
 {
   struct cf_h2_proxy_ctx *ctx = cf->ctx;
   struct cf_call_data save;
   curl_socket_t sock = Curl_conn_cf_get_socket(cf, data);
   bool want_recv, want_send;
+  CURLcode result = CURLE_OK;
 
   if(!cf->connected && ctx->h2) {
     want_send = nghttp2_session_want_write(ctx->h2) ||
@@ -1233,9 +1236,9 @@ static void cf_h2_proxy_adjust_pollset(struct Curl_cfilter *cf,
                 !Curl_bufq_is_empty(&ctx->outbufq) ||
                 !Curl_bufq_is_empty(&ctx->tunnel.sendbuf);
 
-    Curl_pollset_set(data, ps, sock, want_recv, want_send);
-    CURL_TRC_CF(data, cf, "adjust_pollset, want_recv=%d want_send=%d",
-                want_recv, want_send);
+    result = Curl_pollset_set(data, ps, sock, want_recv, want_send);
+    CURL_TRC_CF(data, cf, "adjust_pollset, want_recv=%d want_send=%d -> %d",
+                want_recv, want_send, result);
     CF_DATA_RESTORE(cf, save);
   }
   else if(ctx->sent_goaway && !cf->shutdown) {
@@ -1245,11 +1248,12 @@ static void cf_h2_proxy_adjust_pollset(struct Curl_cfilter *cf,
                 !Curl_bufq_is_empty(&ctx->outbufq) ||
                 !Curl_bufq_is_empty(&ctx->tunnel.sendbuf);
     want_recv = nghttp2_session_want_read(ctx->h2);
-    Curl_pollset_set(data, ps, sock, want_recv, want_send);
-    CURL_TRC_CF(data, cf, "adjust_pollset, want_recv=%d want_send=%d",
-                want_recv, want_send);
+    result = Curl_pollset_set(data, ps, sock, want_recv, want_send);
+    CURL_TRC_CF(data, cf, "adjust_pollset, want_recv=%d want_send=%d -> %d",
+                want_recv, want_send, result);
     CF_DATA_RESTORE(cf, save);
   }
+  return result;
 }
 
 static CURLcode h2_handle_tunnel_close(struct Curl_cfilter *cf,
@@ -1533,6 +1537,12 @@ static CURLcode cf_h2_proxy_query(struct Curl_cfilter *cf,
     }
     break;
   }
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = NULL;
+    return CURLE_OK;
+  }
   default:
     break;
   }
@@ -1606,4 +1616,4 @@ CURLcode Curl_cf_h2_proxy_insert_after(struct Curl_cfilter *cf,
   return result;
 }
 
-#endif /* defined(USE_NGHTTP2) && !defined(CURL_DISABLE_PROXY) */
+#endif /* !CURL_DISABLE_HTTP && !CURL_DISABLE_PROXY && USE_NGHTTP2 */
diff --git a/deps/curl/lib/cf-h2-proxy.h b/deps/curl/lib/cf-h2-proxy.h
index c01bf62133b..1b3f85aaaff 100644
--- a/deps/curl/lib/cf-h2-proxy.h
+++ b/deps/curl/lib/cf-h2-proxy.h
@@ -33,7 +33,6 @@ CURLcode Curl_cf_h2_proxy_insert_after(struct Curl_cfilter *cf,
 
 extern struct Curl_cftype Curl_cft_h2_proxy;
 
-
-#endif /* defined(USE_NGHTTP2) && !defined(CURL_DISABLE_PROXY) */
+#endif /* USE_NGHTTP2 && !CURL_DISABLE_PROXY */
 
 #endif /* HEADER_CURL_H2_PROXY_H */
diff --git a/deps/curl/lib/cf-haproxy.c b/deps/curl/lib/cf-haproxy.c
index 6183ca2c13a..2d66efea904 100644
--- a/deps/curl/lib/cf-haproxy.c
+++ b/deps/curl/lib/cf-haproxy.c
@@ -24,7 +24,7 @@
 
 #include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_PROXY)
+#ifndef CURL_DISABLE_PROXY
 
 #include <curl/curl.h>
 #include "urldata.h"
@@ -32,6 +32,7 @@
 #include "cf-haproxy.h"
 #include "curl_trc.h"
 #include "multiif.h"
+#include "select.h"
 
 /* The last 3 #include files should be in this order */
 #include "curl_printf.h"
@@ -72,7 +73,7 @@ static CURLcode cf_haproxy_date_out_set(struct Curl_cfilter*cf,
   CURLcode result;
   const char *client_ip;
   struct ip_quadruple ipquad;
-  int is_ipv6;
+  bool is_ipv6;
 
   DEBUGASSERT(ctx);
   DEBUGASSERT(ctx->state == HAPROXY_INIT);
@@ -178,15 +179,17 @@ static void cf_haproxy_close(struct Curl_cfilter *cf,
     cf->next->cft->do_close(cf->next, data);
 }
 
-static void cf_haproxy_adjust_pollset(struct Curl_cfilter *cf,
-                                      struct Curl_easy *data,
-                                      struct easy_pollset *ps)
+static CURLcode cf_haproxy_adjust_pollset(struct Curl_cfilter *cf,
+                                          struct Curl_easy *data,
+                                          struct easy_pollset *ps)
 {
   if(cf->next->connected && !cf->connected) {
     /* If we are not connected, but the filter "below" is
      * and not waiting on something, we are sending. */
-    Curl_pollset_set_out_only(data, ps, Curl_conn_cf_get_socket(cf, data));
+    return Curl_pollset_set_out_only(
+      data, ps, Curl_conn_cf_get_socket(cf, data));
   }
+  return CURLE_OK;
 }
 
 struct Curl_cftype Curl_cft_haproxy = {
diff --git a/deps/curl/lib/cf-haproxy.h b/deps/curl/lib/cf-haproxy.h
index d02c323e7b7..9190dd5b578 100644
--- a/deps/curl/lib/cf-haproxy.h
+++ b/deps/curl/lib/cf-haproxy.h
@@ -27,7 +27,7 @@
 #include "curl_setup.h"
 #include "urldata.h"
 
-#if !defined(CURL_DISABLE_PROXY)
+#ifndef CURL_DISABLE_PROXY
 
 CURLcode Curl_cf_haproxy_insert_after(struct Curl_cfilter *cf_at,
                                       struct Curl_easy *data);
diff --git a/deps/curl/lib/cf-https-connect.c b/deps/curl/lib/cf-https-connect.c
index b89ed80e553..b4a46052950 100644
--- a/deps/curl/lib/cf-https-connect.c
+++ b/deps/curl/lib/cf-https-connect.c
@@ -24,7 +24,7 @@
 
 #include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_HTTP)
+#ifndef CURL_DISABLE_HTTP
 
 #include "urldata.h"
 #include <curl/curl.h>
@@ -35,6 +35,7 @@
 #include "multiif.h"
 #include "cf-https-connect.h"
 #include "http2.h"
+#include "select.h"
 #include "vquic/vquic.h"
 
 /* The last 3 #include files should be in this order */
@@ -226,24 +227,22 @@ static CURLcode baller_connected(struct Curl_cfilter *cf,
   cf->next = winner->cf;
   winner->cf = NULL;
 
-  switch(cf->conn->alpn) {
-  case CURL_HTTP_VERSION_3:
-    break;
-  case CURL_HTTP_VERSION_2:
 #ifdef USE_NGHTTP2
+  {
     /* Using nghttp2, we add the filter "below" us, so when the conn
      * closes, we tear it down for a fresh reconnect */
-    result = Curl_http2_switch_at(cf, data);
-    if(result) {
-      ctx->state = CF_HC_FAILURE;
-      ctx->result = result;
-      return result;
+    const char *alpn = Curl_conn_cf_get_alpn_negotiated(cf->next, data);
+    if(alpn && !strcmp("h2", alpn)) {
+      result = Curl_http2_switch_at(cf, data);
+      if(result) {
+        ctx->state = CF_HC_FAILURE;
+        ctx->result = result;
+        return result;
+      }
     }
-#endif
-    break;
-  default:
-    break;
   }
+#endif
+
   ctx->state = CF_HC_SUCCESS;
   cf->connected = TRUE;
   return result;
@@ -428,22 +427,24 @@ static CURLcode cf_hc_shutdown(struct Curl_cfilter *cf,
   return result;
 }
 
-static void cf_hc_adjust_pollset(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 struct easy_pollset *ps)
+static CURLcode cf_hc_adjust_pollset(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data,
+                                     struct easy_pollset *ps)
 {
+  CURLcode result = CURLE_OK;
   if(!cf->connected) {
     struct cf_hc_ctx *ctx = cf->ctx;
     size_t i;
 
-    for(i = 0; i < ctx->baller_count; i++) {
+    for(i = 0; (i < ctx->baller_count) && !result; i++) {
       struct cf_hc_baller *b = &ctx->ballers[i];
       if(!cf_hc_baller_is_active(b))
         continue;
-      Curl_conn_cf_adjust_pollset(b->cf, data, ps);
+      result = Curl_conn_cf_adjust_pollset(b->cf, data, ps);
     }
-    CURL_TRC_CF(data, cf, "adjust_pollset -> %d socks", ps->num);
+    CURL_TRC_CF(data, cf, "adjust_pollset -> %d, %d socks", result, ps->n);
   }
+  return result;
 }
 
 static bool cf_hc_data_pending(struct Curl_cfilter *cf,
@@ -749,4 +750,4 @@ CURLcode Curl_cf_https_setup(struct Curl_easy *data,
   return result;
 }
 
-#endif /* !defined(CURL_DISABLE_HTTP) */
+#endif /* !CURL_DISABLE_HTTP */
diff --git a/deps/curl/lib/cf-https-connect.h b/deps/curl/lib/cf-https-connect.h
index c36726f0a22..df51b62479d 100644
--- a/deps/curl/lib/cf-https-connect.h
+++ b/deps/curl/lib/cf-https-connect.h
@@ -25,7 +25,7 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_HTTP)
+#ifndef CURL_DISABLE_HTTP
 
 struct Curl_cfilter;
 struct Curl_easy;
@@ -40,16 +40,10 @@ CURLcode Curl_cf_http_connect_add(struct Curl_easy *data,
                                   int sockindex,
                                   bool try_h3, bool try_h21);
 
-CURLcode
-Curl_cf_http_connect_insert_after(struct Curl_cfilter *cf_at,
-                                  struct Curl_easy *data,
-                                  bool try_h3, bool try_h21);
-
-
 CURLcode Curl_cf_https_setup(struct Curl_easy *data,
                              struct connectdata *conn,
                              int sockindex);
 
 
-#endif /* !defined(CURL_DISABLE_HTTP) */
+#endif /* !CURL_DISABLE_HTTP */
 #endif /* HEADER_CURL_CF_HTTP_H */
diff --git a/deps/curl/lib/cf-ip-happy.c b/deps/curl/lib/cf-ip-happy.c
new file mode 100644
index 00000000000..5e4c20444e7
--- /dev/null
+++ b/deps/curl/lib/cf-ip-happy.c
@@ -0,0 +1,951 @@
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+
+#include "curl_setup.h"
+
+#ifdef HAVE_NETINET_IN_H
+#include <netinet/in.h> /* <netinet/tcp.h> may need it */
+#endif
+#ifdef HAVE_SYS_UN_H
+#include <sys/un.h> /* for sockaddr_un */
+#endif
+#ifdef HAVE_LINUX_TCP_H
+#include <linux/tcp.h>
+#elif defined(HAVE_NETINET_TCP_H)
+#include <netinet/tcp.h>
+#endif
+#ifdef HAVE_SYS_IOCTL_H
+#include <sys/ioctl.h>
+#endif
+#ifdef HAVE_NETDB_H
+#include <netdb.h>
+#endif
+#ifdef HAVE_FCNTL_H
+#include <fcntl.h>
+#endif
+#ifdef HAVE_ARPA_INET_H
+#include <arpa/inet.h>
+#endif
+
+#ifdef __VMS
+#include <in.h>
+#include <inet.h>
+#endif
+
+#include "urldata.h"
+#include "connect.h"
+#include "cfilters.h"
+#include "cf-ip-happy.h"
+#include "curl_trc.h"
+#include "multiif.h"
+#include "progress.h"
+#include "select.h"
+#include "vquic/vquic.h" /* for quic cfilters */
+
+/* The last 3 #include files should be in this order */
+#include "curl_printf.h"
+#include "curl_memory.h"
+#include "memdebug.h"
+
+
+struct transport_provider {
+  int transport;
+  cf_ip_connect_create *cf_create;
+};
+
+static
+#ifndef UNITTESTS
+const
+#endif
+struct transport_provider transport_providers[] = {
+  { TRNSPRT_TCP, Curl_cf_tcp_create },
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
+  { TRNSPRT_QUIC, Curl_cf_quic_create },
+#endif
+#ifndef CURL_DISABLE_TFTP
+  { TRNSPRT_UDP, Curl_cf_udp_create },
+#endif
+#ifdef USE_UNIX_SOCKETS
+  { TRNSPRT_UNIX, Curl_cf_unix_create },
+#endif
+};
+
+static cf_ip_connect_create *get_cf_create(int transport)
+{
+  size_t i;
+  for(i = 0; i < CURL_ARRAYSIZE(transport_providers); ++i) {
+    if(transport == transport_providers[i].transport)
+      return transport_providers[i].cf_create;
+  }
+  return NULL;
+}
+
+#ifdef UNITTESTS
+/* used by unit2600.c */
+void Curl_debug_set_transport_provider(int transport,
+                                       cf_ip_connect_create *cf_create)
+{
+  size_t i;
+  for(i = 0; i < CURL_ARRAYSIZE(transport_providers); ++i) {
+    if(transport == transport_providers[i].transport) {
+      transport_providers[i].cf_create = cf_create;
+      return;
+    }
+  }
+}
+#endif /* UNITTESTS */
+
+
+struct cf_ai_iter {
+  const struct Curl_addrinfo *head;
+  const struct Curl_addrinfo *last;
+  int ai_family;
+  int n;
+};
+
+static void cf_ai_iter_init(struct cf_ai_iter *iter,
+                            const struct Curl_addrinfo *list,
+                            int ai_family)
+{
+  iter->head = list;
+  iter->ai_family = ai_family;
+  iter->last = NULL;
+  iter->n = -1;
+}
+
+static const struct Curl_addrinfo *cf_ai_iter_next(struct cf_ai_iter *iter)
+{
+  const struct Curl_addrinfo *addr;
+  if(iter->n < 0) {
+    iter->n++;
+    for(addr = iter->head; addr; addr = addr->ai_next) {
+      if(addr->ai_family == iter->ai_family)
+        break;
+    }
+    iter->last = addr;
+  }
+  else if(iter->last) {
+    iter->n++;
+    for(addr = iter->last->ai_next; addr; addr = addr->ai_next) {
+      if(addr->ai_family == iter->ai_family)
+        break;
+    }
+    iter->last = addr;
+  }
+  return iter->last;
+}
+
+#ifdef USE_IPV6
+static bool cf_ai_iter_done(struct cf_ai_iter *iter)
+{
+  return (iter->n >= 0) && !iter->last;
+}
+#endif
+
+struct cf_ip_attempt {
+  struct cf_ip_attempt *next;
+  const struct Curl_addrinfo *addr;  /* List of addresses to try, not owned */
+  struct Curl_cfilter *cf;           /* current sub-cfilter connecting */
+  cf_ip_connect_create *cf_create;
+  struct curltime started;           /* start of current attempt */
+  CURLcode result;
+  int ai_family;
+  int transport;
+  int error;
+  BIT(connected);                    /* cf has connected */
+  BIT(shutdown);                     /* cf has shutdown */
+  BIT(inconclusive);                 /* connect was not a hard failure, we
+                                      * might talk to a restarting server */
+};
+
+static void cf_ip_attempt_free(struct cf_ip_attempt *a,
+                               struct Curl_easy *data)
+{
+  if(a) {
+    if(a->cf)
+      Curl_conn_cf_discard_chain(&a->cf, data);
+    free(a);
+  }
+}
+
+static CURLcode cf_ip_attempt_new(struct cf_ip_attempt **pa,
+                                  struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  const struct Curl_addrinfo *addr,
+                                  int ai_family,
+                                  int transport,
+                                  cf_ip_connect_create *cf_create)
+{
+  struct Curl_cfilter *wcf;
+  struct cf_ip_attempt *a;
+  CURLcode result = CURLE_OK;
+
+  *pa = NULL;
+  a = calloc(1, sizeof(*a));
+  if(!a)
+    return CURLE_OUT_OF_MEMORY;
+
+  a->addr = addr;
+  a->ai_family = ai_family;
+  a->transport = transport;
+  a->result = CURLE_OK;
+  a->cf_create = cf_create;
+  *pa = a;
+
+  result = a->cf_create(&a->cf, data, cf->conn, a->addr, transport);
+  if(result)
+    goto out;
+
+  /* the new filter might have sub-filters */
+  for(wcf = a->cf; wcf; wcf = wcf->next) {
+    wcf->conn = cf->conn;
+    wcf->sockindex = cf->sockindex;
+  }
+
+out:
+  if(result) {
+    cf_ip_attempt_free(a, data);
+    *pa = NULL;
+  }
+  return result;
+}
+
+static CURLcode cf_ip_attempt_connect(struct cf_ip_attempt *a,
+                                      struct Curl_easy *data,
+                                      bool *connected)
+{
+  *connected = a->connected;
+  if(!a->result &&  !*connected) {
+    /* evaluate again */
+    a->result = Curl_conn_cf_connect(a->cf, data, connected);
+
+    if(!a->result) {
+      if(*connected) {
+        a->connected = TRUE;
+      }
+    }
+    else if(a->result == CURLE_WEIRD_SERVER_REPLY)
+      a->inconclusive = TRUE;
+  }
+  return a->result;
+}
+
+struct cf_ip_ballers {
+  struct cf_ip_attempt *running;
+  struct cf_ip_attempt *winner;
+  struct cf_ai_iter addr_iter;
+#ifdef USE_IPV6
+  struct cf_ai_iter ipv6_iter;
+#endif
+  cf_ip_connect_create *cf_create;   /* for creating cf */
+  struct curltime started;
+  struct curltime last_attempt_started;
+  timediff_t attempt_delay_ms;
+  int last_attempt_ai_family;
+  int transport;
+};
+
+static CURLcode cf_ip_attempt_restart(struct cf_ip_attempt *a,
+                                      struct Curl_cfilter *cf,
+                                      struct Curl_easy *data)
+{
+  struct Curl_cfilter *cf_prev = a->cf;
+  struct Curl_cfilter *wcf;
+  CURLcode result;
+
+  /* When restarting, we tear down and existing filter *after* we
+   * started up the new one. This gives us a new socket number and
+   * probably a new local port. Which may prevent confusion. */
+  a->result = CURLE_OK;
+  a->connected = FALSE;
+  a->inconclusive = FALSE;
+  a->cf = NULL;
+
+  result = a->cf_create(&a->cf, data, cf->conn, a->addr, a->transport);
+  if(!result) {
+    bool dummy;
+    /* the new filter might have sub-filters */
+    for(wcf = a->cf; wcf; wcf = wcf->next) {
+      wcf->conn = cf->conn;
+      wcf->sockindex = cf->sockindex;
+    }
+    a->result = cf_ip_attempt_connect(a, data, &dummy);
+  }
+  if(cf_prev)
+    Curl_conn_cf_discard_chain(&cf_prev, data);
+  return result;
+}
+
+static void cf_ip_ballers_clear(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                struct cf_ip_ballers *bs)
+{
+  (void)cf;
+  while(bs->running) {
+    struct cf_ip_attempt *a = bs->running;
+    bs->running = a->next;
+    cf_ip_attempt_free(a, data);
+  }
+  cf_ip_attempt_free(bs->winner, data);
+  bs->winner = NULL;
+}
+
+static CURLcode cf_ip_ballers_init(struct cf_ip_ballers *bs, int ip_version,
+                                   const struct Curl_addrinfo *addr_list,
+                                   cf_ip_connect_create *cf_create,
+                                   int transport,
+                                   timediff_t attempt_delay_ms)
+{
+  memset(bs, 0, sizeof(*bs));
+  bs->cf_create = cf_create;
+  bs->transport = transport;
+  bs->attempt_delay_ms = attempt_delay_ms;
+  bs->last_attempt_ai_family = AF_INET; /* so AF_INET6 is next */
+
+  if(transport == TRNSPRT_UNIX) {
+#ifdef USE_UNIX_SOCKETS
+    cf_ai_iter_init(&bs->addr_iter, addr_list, AF_UNIX);
+#else
+    return CURLE_UNSUPPORTED_PROTOCOL;
+#endif
+  }
+  else { /* TCP/UDP/QUIC */
+#ifdef USE_IPV6
+    if(ip_version == CURL_IPRESOLVE_V6)
+      cf_ai_iter_init(&bs->addr_iter, NULL, AF_INET);
+    else
+      cf_ai_iter_init(&bs->addr_iter, addr_list, AF_INET);
+
+    if(ip_version == CURL_IPRESOLVE_V4)
+      cf_ai_iter_init(&bs->ipv6_iter, NULL, AF_INET6);
+    else
+      cf_ai_iter_init(&bs->ipv6_iter, addr_list, AF_INET6);
+#else
+    (void)ip_version;
+    cf_ai_iter_init(&bs->addr_iter, addr_list, AF_INET);
+#endif
+  }
+  return CURLE_OK;
+}
+
+static CURLcode cf_ip_ballers_run(struct cf_ip_ballers *bs,
+                                  struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  bool *connected)
+{
+  CURLcode result = CURLE_OK;
+  struct cf_ip_attempt *a = NULL, **panchor;
+  bool do_more, more_possible;
+  struct curltime now;
+  timediff_t next_expire_ms;
+  int i, inconclusive, ongoing;
+
+  if(bs->winner)
+    return CURLE_OK;
+
+evaluate:
+  now = curlx_now();
+  ongoing = inconclusive = 0;
+  more_possible = TRUE;
+
+  /* check if a running baller connects now */
+  i = -1;
+  for(panchor = &bs->running; *panchor; panchor = &((*panchor)->next)) {
+    ++i;
+    a = *panchor;
+    a->result = cf_ip_attempt_connect(a, data, connected);
+    if(!a->result) {
+      if(*connected) {
+        /* connected, declare the winner, remove from running,
+         * clear remaining running list. */
+        CURL_TRC_CF(data, cf, "connect attempt #%d successful", i);
+        bs->winner = a;
+        *panchor = a->next;
+        a->next = NULL;
+        while(bs->running) {
+          a = bs->running;
+          bs->running = a->next;
+          cf_ip_attempt_free(a, data);
+        }
+        return CURLE_OK;
+      }
+      /* still running */
+      ++ongoing;
+    }
+    else if(a->inconclusive) /* failed, but inconclusive */
+      ++inconclusive;
+  }
+  if(bs->running)
+    CURL_TRC_CF(data, cf, "checked connect attempts: "
+                "%d ongoing, %d inconclusive", ongoing, inconclusive);
+
+  /* no attempt connected yet, start another one? */
+  if(!ongoing) {
+    if(!bs->started.tv_sec && !bs->started.tv_usec)
+      bs->started = now;
+    do_more = TRUE;
+  }
+  else {
+    do_more = (curlx_timediff(now, bs->last_attempt_started) >=
+               bs->attempt_delay_ms);
+    if(do_more)
+      CURL_TRC_CF(data, cf, "happy eyeballs timeout expired, "
+                  "start next attempt");
+  }
+
+  if(do_more) {
+    /* start the next attempt if there is another ip address to try.
+     * Alternate between address families when possible. */
+    const struct Curl_addrinfo *addr = NULL;
+    int ai_family = 0;
+#ifdef USE_IPV6
+    if((bs->last_attempt_ai_family == AF_INET) ||
+        cf_ai_iter_done(&bs->addr_iter)) {
+       addr = cf_ai_iter_next(&bs->ipv6_iter);
+       ai_family = bs->ipv6_iter.ai_family;
+    }
+#endif
+    if(!addr) {
+      addr = cf_ai_iter_next(&bs->addr_iter);
+      ai_family = bs->addr_iter.ai_family;
+    }
+
+    if(addr) {  /* try another address */
+      result = cf_ip_attempt_new(&a, cf, data, addr, ai_family,
+                                bs->transport, bs->cf_create);
+      CURL_TRC_CF(data, cf, "starting %s attempt for ipv%s -> %d",
+                  bs->running ? "next" : "first",
+                  (ai_family == AF_INET) ? "4" : "6", result);
+      if(result)
+        goto out;
+      DEBUGASSERT(a);
+
+      /* append to running list */
+      panchor = &bs->running;
+      while(*panchor)
+        panchor = &((*panchor)->next);
+      *panchor = a;
+      bs->last_attempt_started = now;
+      bs->last_attempt_ai_family = ai_family;
+      /* and run everything again */
+      goto evaluate;
+    }
+    else if(inconclusive) {
+      /* tried all addresses, no success but some where inconclusive.
+       * Let's restart the inconclusive ones. */
+      if(curlx_timediff(now, bs->last_attempt_started) >=
+         bs->attempt_delay_ms) {
+        CURL_TRC_CF(data, cf, "tried all addresses with inconclusive results"
+                    ", restarting one");
+        i = -1;
+        for(a = bs->running; a; a = a->next) {
+          ++i;
+          if(!a->inconclusive)
+            continue;
+          result = cf_ip_attempt_restart(a, cf, data);
+          CURL_TRC_CF(data, cf, "restarted baller %d -> %d", i, result);
+          if(result) /* serious failure */
+            goto out;
+          bs->last_attempt_started = now;
+          goto evaluate;
+        }
+        DEBUGASSERT(0); /* should not come here */
+      }
+      /* attempt timeout for restart has not expired yet */
+      goto out;
+    }
+    else if(ongoing) {
+      /* no more addresses, no inconclusive attempts */
+      more_possible = FALSE;
+    }
+    else {
+      CURL_TRC_CF(data, cf, "no more attempts to try");
+      result = CURLE_COULDNT_CONNECT;
+      i = 0;
+      for(a = bs->running; a; a = a->next) {
+        CURL_TRC_CF(data, cf, "baller %d: result=%d", i, a->result);
+        if(a->result)
+          result = a->result;
+      }
+    }
+  }
+
+out:
+  if(!result) {
+    /* when do we need to be called again? */
+    next_expire_ms = Curl_timeleft(data, &now, TRUE);
+    if(more_possible) {
+      timediff_t expire_ms, elapsed_ms;
+      elapsed_ms = curlx_timediff(now, bs->last_attempt_started);
+      expire_ms = CURLMAX(bs->attempt_delay_ms - elapsed_ms, 0);
+      next_expire_ms = CURLMIN(next_expire_ms, expire_ms);
+    }
+
+    if(next_expire_ms <= 0) {
+      failf(data, "Connection timeout after %" FMT_OFF_T " ms",
+            curlx_timediff(now, data->progress.t_startsingle));
+      return CURLE_OPERATION_TIMEDOUT;
+    }
+    Curl_expire(data, next_expire_ms, EXPIRE_HAPPY_EYEBALLS);
+  }
+  return result;
+}
+
+static CURLcode cf_ip_ballers_shutdown(struct cf_ip_ballers *bs,
+                                       struct Curl_easy *data,
+                                       bool *done)
+{
+  struct cf_ip_attempt *a;
+
+  /* shutdown all ballers that have not done so already. If one fails,
+   * continue shutting down others until all are shutdown. */
+  *done = TRUE;
+  for(a = bs->running; a; a = a->next) {
+    bool bdone = FALSE;
+    if(a->shutdown)
+      continue;
+    a->result = a->cf->cft->do_shutdown(a->cf, data, &bdone);
+    if(a->result || bdone)
+      a->shutdown = TRUE; /* treat a failed shutdown as done */
+    else
+      *done = FALSE;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode cf_ip_ballers_pollset(struct cf_ip_ballers *bs,
+                                      struct Curl_easy *data,
+                                      struct easy_pollset *ps)
+{
+  struct cf_ip_attempt *a;
+  CURLcode result = CURLE_OK;
+  for(a = bs->running; a && !result; a = a->next) {
+    if(a->result)
+      continue;
+    result = Curl_conn_cf_adjust_pollset(a->cf, data, ps);
+  }
+  return result;
+}
+
+static bool cf_ip_ballers_pending(struct cf_ip_ballers *bs,
+                                  const struct Curl_easy *data)
+{
+  struct cf_ip_attempt *a;
+
+  for(a = bs->running; a; a = a->next) {
+    if(a->result)
+      continue;
+    if(a->cf->cft->has_data_pending(a->cf, data))
+      return TRUE;
+  }
+  return FALSE;
+}
+
+static struct curltime cf_ip_ballers_max_time(struct cf_ip_ballers *bs,
+                                              struct Curl_easy *data,
+                                              int query)
+{
+  struct curltime t, tmax;
+  struct cf_ip_attempt *a;
+
+  memset(&tmax, 0, sizeof(tmax));
+  for(a = bs->running; a; a = a->next) {
+    memset(&t, 0, sizeof(t));
+    if(!a->cf->cft->query(a->cf, data, query, NULL, &t)) {
+      if((t.tv_sec || t.tv_usec) && curlx_timediff_us(t, tmax) > 0)
+        tmax = t;
+    }
+  }
+  return tmax;
+}
+
+static int cf_ip_ballers_min_reply_ms(struct cf_ip_ballers *bs,
+                                      struct Curl_easy *data)
+{
+  int reply_ms = -1, breply_ms;
+  struct cf_ip_attempt *a;
+
+  for(a = bs->running; a; a = a->next) {
+    if(!a->cf->cft->query(a->cf, data, CF_QUERY_CONNECT_REPLY_MS,
+                          &breply_ms, NULL)) {
+      if(breply_ms >= 0 && (reply_ms < 0 || breply_ms < reply_ms))
+        reply_ms = breply_ms;
+    }
+  }
+  return reply_ms;
+}
+
+
+typedef enum {
+  SCFST_INIT,
+  SCFST_WAITING,
+  SCFST_DONE
+} cf_connect_state;
+
+struct cf_ip_happy_ctx {
+  int transport;
+  cf_ip_connect_create *cf_create;
+  cf_connect_state state;
+  struct cf_ip_ballers ballers;
+  struct curltime started;
+};
+
+
+static CURLcode is_connected(struct Curl_cfilter *cf,
+                             struct Curl_easy *data,
+                             bool *connected)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+  struct connectdata *conn = cf->conn;
+  CURLcode result;
+
+  result = cf_ip_ballers_run(&ctx->ballers, cf, data, connected);
+
+  if(!result)
+    return CURLE_OK;
+
+  {
+    const char *hostname, *proxy_name = NULL;
+    int port;
+#ifndef CURL_DISABLE_PROXY
+    if(conn->bits.socksproxy)
+      proxy_name = conn->socks_proxy.host.name;
+    else if(conn->bits.httpproxy)
+      proxy_name = conn->http_proxy.host.name;
+#endif
+    hostname = conn->bits.conn_to_host ?
+               conn->conn_to_host.name : conn->host.name;
+
+    if(cf->sockindex == SECONDARYSOCKET)
+      port = conn->secondary_port;
+    else if(cf->conn->bits.conn_to_port)
+      port = conn->conn_to_port;
+    else
+      port = conn->remote_port;
+
+    failf(data, "Failed to connect to %s port %u %s%s%safter "
+          "%" FMT_TIMEDIFF_T " ms: %s",
+          hostname, port,
+          proxy_name ? "via " : "",
+          proxy_name ? proxy_name : "",
+          proxy_name ? " " : "",
+          curlx_timediff(curlx_now(), data->progress.t_startsingle),
+          curl_easy_strerror(result));
+  }
+
+#ifdef SOCKETIMEDOUT
+  if(SOCKETIMEDOUT == data->state.os_errno)
+    result = CURLE_OPERATION_TIMEDOUT;
+#endif
+
+  return result;
+}
+
+/*
+ * Connect to the given host with timeout, proxy or remote does not matter.
+ * There might be more than one IP address to try out.
+ */
+static CURLcode start_connect(struct Curl_cfilter *cf,
+                              struct Curl_easy *data)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+  struct Curl_dns_entry *dns = data->state.dns[cf->sockindex];
+
+  if(!dns)
+    return CURLE_FAILED_INIT;
+
+  if(Curl_timeleft(data, NULL, TRUE) < 0) {
+    /* a precaution, no need to continue if time already is up */
+    failf(data, "Connection time-out");
+    return CURLE_OPERATION_TIMEDOUT;
+  }
+
+  CURL_TRC_CF(data, cf, "init ip ballers for transport %d", ctx->transport);
+  ctx->started = curlx_now();
+  return cf_ip_ballers_init(&ctx->ballers, cf->conn->ip_version,
+                            dns->addr, ctx->cf_create, ctx->transport,
+                            data->set.happy_eyeballs_timeout);
+}
+
+static void cf_ip_happy_ctx_clear(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+
+  DEBUGASSERT(ctx);
+  DEBUGASSERT(data);
+  cf_ip_ballers_clear(cf, data, &ctx->ballers);
+}
+
+static CURLcode cf_ip_happy_shutdown(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data,
+                                     bool *done)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(data);
+  if(cf->connected) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  result = cf_ip_ballers_shutdown(&ctx->ballers, data, done);
+  CURL_TRC_CF(data, cf, "shutdown -> %d, done=%d", result, *done);
+  return result;
+}
+
+static CURLcode cf_ip_happy_adjust_pollset(struct Curl_cfilter *cf,
+                                           struct Curl_easy *data,
+                                           struct easy_pollset *ps)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  if(!cf->connected) {
+    result = cf_ip_ballers_pollset(&ctx->ballers, data, ps);
+    CURL_TRC_CF(data, cf, "adjust_pollset -> %d, %d socks", result, ps->n);
+  }
+  return result;
+}
+
+static CURLcode cf_ip_happy_connect(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    bool *done)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
+
+  if(cf->connected) {
+    *done = TRUE;
+    return CURLE_OK;
+  }
+
+  DEBUGASSERT(ctx);
+  *done = FALSE;
+
+  switch(ctx->state) {
+    case SCFST_INIT:
+      DEBUGASSERT(CURL_SOCKET_BAD == Curl_conn_cf_get_socket(cf, data));
+      DEBUGASSERT(!cf->connected);
+      result = start_connect(cf, data);
+      if(result)
+        return result;
+      ctx->state = SCFST_WAITING;
+      FALLTHROUGH();
+    case SCFST_WAITING:
+      result = is_connected(cf, data, done);
+      if(!result && *done) {
+        DEBUGASSERT(ctx->ballers.winner);
+        DEBUGASSERT(ctx->ballers.winner->cf);
+        DEBUGASSERT(ctx->ballers.winner->cf->connected);
+        /* we have a winner. Install and activate it.
+         * close/free all others. */
+        ctx->state = SCFST_DONE;
+        cf->connected = TRUE;
+        cf->next = ctx->ballers.winner->cf;
+        ctx->ballers.winner->cf = NULL;
+        cf_ip_happy_ctx_clear(cf, data);
+        Curl_expire_done(data, EXPIRE_HAPPY_EYEBALLS);
+
+        if(cf->conn->handler->protocol & PROTO_FAMILY_SSH)
+          Curl_pgrsTime(data, TIMER_APPCONNECT); /* we are connected already */
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+        if(Curl_trc_cf_is_verbose(cf, data)) {
+          struct ip_quadruple ipquad;
+          bool is_ipv6;
+          if(!Curl_conn_cf_get_ip_info(cf->next, data, &is_ipv6, &ipquad)) {
+            const char *host;
+            int port;
+            Curl_conn_get_current_host(data, cf->sockindex, &host, &port);
+            CURL_TRC_CF(data, cf, "Connected to %s (%s) port %u",
+                        host, ipquad.remote_ip, ipquad.remote_port);
+          }
+        }
+#endif
+        data->info.numconnects++; /* to track the # of connections made */
+      }
+      break;
+    case SCFST_DONE:
+      *done = TRUE;
+      break;
+  }
+  return result;
+}
+
+static void cf_ip_happy_close(struct Curl_cfilter *cf,
+                              struct Curl_easy *data)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+
+  CURL_TRC_CF(data, cf, "close");
+  cf_ip_happy_ctx_clear(cf, data);
+  cf->connected = FALSE;
+  ctx->state = SCFST_INIT;
+
+  if(cf->next) {
+    cf->next->cft->do_close(cf->next, data);
+    Curl_conn_cf_discard_chain(&cf->next, data);
+  }
+}
+
+static bool cf_ip_happy_data_pending(struct Curl_cfilter *cf,
+                                     const struct Curl_easy *data)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+
+  if(!cf->connected) {
+    return cf_ip_ballers_pending(&ctx->ballers, data);
+  }
+  return cf->next->cft->has_data_pending(cf->next, data);
+}
+
+static CURLcode cf_ip_happy_query(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  int query, int *pres1, void *pres2)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+
+  if(!cf->connected) {
+    switch(query) {
+    case CF_QUERY_CONNECT_REPLY_MS: {
+      *pres1 = cf_ip_ballers_min_reply_ms(&ctx->ballers, data);
+      CURL_TRC_CF(data, cf, "query connect reply: %dms", *pres1);
+      return CURLE_OK;
+    }
+    case CF_QUERY_TIMER_CONNECT: {
+      struct curltime *when = pres2;
+      *when = cf_ip_ballers_max_time(&ctx->ballers, data,
+                                     CF_QUERY_TIMER_CONNECT);
+      return CURLE_OK;
+    }
+    case CF_QUERY_TIMER_APPCONNECT: {
+      struct curltime *when = pres2;
+      *when = cf_ip_ballers_max_time(&ctx->ballers, data,
+                                     CF_QUERY_TIMER_APPCONNECT);
+      return CURLE_OK;
+    }
+    default:
+      break;
+    }
+  }
+
+  return cf->next ?
+    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
+    CURLE_UNKNOWN_OPTION;
+}
+
+static void cf_ip_happy_destroy(struct Curl_cfilter *cf,
+                                struct Curl_easy *data)
+{
+  struct cf_ip_happy_ctx *ctx = cf->ctx;
+
+  CURL_TRC_CF(data, cf, "destroy");
+  if(ctx) {
+    cf_ip_happy_ctx_clear(cf, data);
+  }
+  /* release any resources held in state */
+  Curl_safefree(ctx);
+}
+
+struct Curl_cftype Curl_cft_ip_happy = {
+  "HAPPY-EYEBALLS",
+  0,
+  CURL_LOG_LVL_NONE,
+  cf_ip_happy_destroy,
+  cf_ip_happy_connect,
+  cf_ip_happy_close,
+  cf_ip_happy_shutdown,
+  cf_ip_happy_adjust_pollset,
+  cf_ip_happy_data_pending,
+  Curl_cf_def_send,
+  Curl_cf_def_recv,
+  Curl_cf_def_cntrl,
+  Curl_cf_def_conn_is_alive,
+  Curl_cf_def_conn_keep_alive,
+  cf_ip_happy_query,
+};
+
+/**
+ * Create an IP happy eyeball connection filter that uses the, once resolved,
+ * address information to connect on ip families based on connection
+ * configuration.
+ * @param pcf        output, the created cfilter
+ * @param data       easy handle used in creation
+ * @param conn       connection the filter is created for
+ * @param cf_create  method to create the sub-filters performing the
+ *                   actual connects.
+ */
+static CURLcode cf_ip_happy_create(struct Curl_cfilter **pcf,
+                                   struct Curl_easy *data,
+                                   struct connectdata *conn,
+                                   cf_ip_connect_create *cf_create,
+                                   int transport)
+{
+  struct cf_ip_happy_ctx *ctx = NULL;
+  CURLcode result;
+
+  (void)data;
+  (void)conn;
+  *pcf = NULL;
+  ctx = calloc(1, sizeof(*ctx));
+  if(!ctx) {
+    result = CURLE_OUT_OF_MEMORY;
+    goto out;
+  }
+  ctx->transport = transport;
+  ctx->cf_create = cf_create;
+
+  result = Curl_cf_create(pcf, &Curl_cft_ip_happy, ctx);
+
+out:
+  if(result) {
+    Curl_safefree(*pcf);
+    free(ctx);
+  }
+  return result;
+}
+
+CURLcode cf_ip_happy_insert_after(struct Curl_cfilter *cf_at,
+                                  struct Curl_easy *data,
+                                  int transport)
+{
+  cf_ip_connect_create *cf_create;
+  struct Curl_cfilter *cf;
+  CURLcode result;
+
+  /* Need to be first */
+  DEBUGASSERT(cf_at);
+  cf_create = get_cf_create(transport);
+  if(!cf_create) {
+    CURL_TRC_CF(data, cf_at, "unsupported transport type %d", transport);
+    return CURLE_UNSUPPORTED_PROTOCOL;
+  }
+  result = cf_ip_happy_create(&cf, data, cf_at->conn, cf_create, transport);
+  if(result)
+    return result;
+
+  Curl_conn_cf_insert_after(cf_at, cf);
+  return CURLE_OK;
+}
diff --git a/deps/curl/lib/cf-ip-happy.h b/deps/curl/lib/cf-ip-happy.h
new file mode 100644
index 00000000000..96e619ae430
--- /dev/null
+++ b/deps/curl/lib/cf-ip-happy.h
@@ -0,0 +1,59 @@
+#ifndef HEADER_CURL_IP_HAPPY_H
+#define HEADER_CURL_IP_HAPPY_H
+/***************************************************************************
+ *                                  _   _ ____  _
+ *  Project                     ___| | | |  _ \| |
+ *                             / __| | | | |_) | |
+ *                            | (__| |_| |  _ <| |___
+ *                             \___|\___/|_| \_\_____|
+ *
+ * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
+ *
+ * This software is licensed as described in the file COPYING, which
+ * you should have received as part of this distribution. The terms
+ * are also available at https://curl.se/docs/copyright.html.
+ *
+ * You may opt to use, copy, modify, merge, publish, distribute and/or sell
+ * copies of the Software, and permit persons to whom the Software is
+ * furnished to do so, under the terms of the COPYING file.
+ *
+ * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
+ * KIND, either express or implied.
+ *
+ * SPDX-License-Identifier: curl
+ *
+ ***************************************************************************/
+#include "curl_setup.h"
+
+#include "curlx/nonblock.h" /* for curlx_nonblock() */
+#include "sockaddr.h"
+
+/**
+ * Create a cfilter for making an "ip" connection to the
+ * given address, using parameters from `conn`. The "ip" connection
+ * can be a TCP socket, a UDP socket or even a QUIC connection.
+ *
+ * It MUST use only the supplied `ai` for its connection attempt.
+ *
+ * Such a filter may be used in "happy eyeball" scenarios, and its
+ * `connect` implementation needs to support non-blocking. Once connected,
+ * it MAY be installed in the connection filter chain to serve transfers.
+ */
+typedef CURLcode cf_ip_connect_create(struct Curl_cfilter **pcf,
+                                      struct Curl_easy *data,
+                                      struct connectdata *conn,
+                                      const struct Curl_addrinfo *ai,
+                                      int transport);
+
+CURLcode cf_ip_happy_insert_after(struct Curl_cfilter *cf_at,
+                                  struct Curl_easy *data,
+                                  int transport);
+
+extern struct Curl_cftype Curl_cft_ip_happy;
+
+#ifdef UNITTESTS
+void Curl_debug_set_transport_provider(int transport,
+                                       cf_ip_connect_create *cf_create);
+#endif
+
+#endif /* HEADER_CURL_IP_HAPPY_H */
diff --git a/deps/curl/lib/cf-socket.c b/deps/curl/lib/cf-socket.c
index 273258feaf2..f449ca36caf 100644
--- a/deps/curl/lib/cf-socket.c
+++ b/deps/curl/lib/cf-socket.c
@@ -109,7 +109,7 @@ static void set_ipv6_v6only(curl_socket_t sockfd, int on)
 
 static void tcpnodelay(struct Curl_easy *data, curl_socket_t sockfd)
 {
-#if defined(TCP_NODELAY)
+#if defined(TCP_NODELAY) && defined(CURL_TCP_NODELAY_SUPPORTED)
   curl_socklen_t onoff = (curl_socklen_t) 1;
   int level = IPPROTO_TCP;
   char buffer[STRERROR_LEN];
@@ -136,7 +136,7 @@ static void nosigpipe(struct Curl_easy *data,
   (void)data;
   if(setsockopt(sockfd, SOL_SOCKET, SO_NOSIGPIPE,
                 (void *)&onoff, sizeof(onoff)) < 0) {
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
     char buffer[STRERROR_LEN];
     infof(data, "Could not set SO_NOSIGPIPE: %s",
           Curl_strerror(SOCKERRNO, buffer, sizeof(buffer)));
@@ -164,6 +164,7 @@ static void nosigpipe(struct Curl_easy *data,
 #define KEEPALIVE_FACTOR(x)
 #endif
 
+/* Offered by mingw-w64 and MS SDK. Latter only when targeting Win7+. */
 #if defined(USE_WINSOCK) && !defined(SIO_KEEPALIVE_VALS)
 #define SIO_KEEPALIVE_VALS    _WSAIOW(IOC_VENDOR,4)
 
@@ -188,9 +189,9 @@ tcpkeepalive(struct Curl_easy *data,
           sockfd, SOCKERRNO);
   }
   else {
-#if defined(SIO_KEEPALIVE_VALS) /* Windows */
+#ifdef SIO_KEEPALIVE_VALS /* Windows */
 /* Windows 10, version 1709 (10.0.16299) and later versions */
-#if defined(CURL_WINSOCK_KEEP_SSO)
+#ifdef CURL_WINSOCK_KEEP_SSO
     optval = curlx_sltosi(data->set.tcp_keepidle);
     KEEPALIVE_FACTOR(optval);
     if(setsockopt(sockfd, IPPROTO_TCP, TCP_KEEPIDLE,
@@ -307,9 +308,9 @@ tcpkeepalive(struct Curl_easy *data,
  * Assign the address `ai` to the Curl_sockaddr_ex `dest` and
  * set the transport used.
  */
-CURLcode Curl_sock_assign_addr(struct Curl_sockaddr_ex *dest,
-                               const struct Curl_addrinfo *ai,
-                               int transport)
+static CURLcode sock_assign_addr(struct Curl_sockaddr_ex *dest,
+                                 const struct Curl_addrinfo *ai,
+                                 int transport)
 {
   /*
    * The Curl_sockaddr_ex structure is basically libcurl's external API
@@ -406,7 +407,7 @@ CURLcode Curl_socket_open(struct Curl_easy *data,
     /* if the caller does not want info back, use a local temp copy */
     addr = &dummy;
 
-  result = Curl_sock_assign_addr(addr, ai, transport);
+  result = sock_assign_addr(addr, ai, transport);
   if(result)
     return result;
 
@@ -844,7 +845,7 @@ static bool verifyconnect(curl_socket_t sockfd, int *error)
 
 #endif
 
-  if(0 != getsockopt(sockfd, SOL_SOCKET, SO_ERROR, (void *)&err, &errSize))
+  if(getsockopt(sockfd, SOL_SOCKET, SO_ERROR, (void *)&err, &errSize))
     err = SOCKERRNO;
 #ifdef UNDER_CE
   /* Old Windows CE versions do not support SO_ERROR */
@@ -860,7 +861,7 @@ static bool verifyconnect(curl_socket_t sockfd, int *error)
     err = 0;
   }
 #endif
-  if((0 == err) || (SOCKEISCONN == err))
+  if((err == 0) || (SOCKEISCONN == err))
     /* we are connected, awesome! */
     rc = TRUE;
   else
@@ -885,7 +886,7 @@ static CURLcode socket_connect_result(struct Curl_easy *data,
   switch(error) {
   case SOCKEINPROGRESS:
   case SOCKEWOULDBLOCK:
-#if defined(EAGAIN)
+#ifdef EAGAIN
 #if (EAGAIN) != (SOCKEWOULDBLOCK)
     /* On some platforms EAGAIN and EWOULDBLOCK are the
      * same value, and on others they are different, hence
@@ -949,7 +950,7 @@ static CURLcode cf_socket_ctx_init(struct cf_socket_ctx *ctx,
   ctx->sock = CURL_SOCKET_BAD;
   ctx->transport = transport;
 
-  result = Curl_sock_assign_addr(&ctx->addr, ai, transport);
+  result = sock_assign_addr(&ctx->addr, ai, transport);
   if(result)
     return result;
 
@@ -1237,8 +1238,8 @@ static int do_connect(struct Curl_cfilter *cf, struct Curl_easy *data,
 
   (void)data;
   if(is_tcp_fastopen) {
-#if defined(CONNECT_DATA_IDEMPOTENT) /* Darwin */
-#  if defined(HAVE_BUILTIN_AVAILABLE)
+#ifdef CONNECT_DATA_IDEMPOTENT /* Darwin */
+#  ifdef HAVE_BUILTIN_AVAILABLE
     /* while connectx function is available since macOS 10.11 / iOS 9,
        it did not have the interface declared correctly until
        Xcode 9 / macOS SDK 10.13 */
@@ -1375,11 +1376,12 @@ static CURLcode cf_tcp_connect(struct Curl_cfilter *cf,
   return result;
 }
 
-static void cf_socket_adjust_pollset(struct Curl_cfilter *cf,
-                                     struct Curl_easy *data,
-                                     struct easy_pollset *ps)
+static CURLcode cf_socket_adjust_pollset(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         struct easy_pollset *ps)
 {
   struct cf_socket_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
 
   if(ctx->sock != CURL_SOCKET_BAD) {
     /* A listening socket filter needs to be connected before the accept
@@ -1387,25 +1389,27 @@ static void cf_socket_adjust_pollset(struct Curl_cfilter *cf,
      * FTP no longer does the socket checks and accept calls and delegates
      * all that to the filter. */
     if(ctx->listening) {
-      Curl_pollset_set_in_only(data, ps, ctx->sock);
+      result = Curl_pollset_set_in_only(data, ps, ctx->sock);
       CURL_TRC_CF(data, cf, "adjust_pollset, listening, POLLIN fd=%"
                   FMT_SOCKET_T, ctx->sock);
     }
     else if(!cf->connected) {
-      Curl_pollset_set_out_only(data, ps, ctx->sock);
+      result = Curl_pollset_set_out_only(data, ps, ctx->sock);
       CURL_TRC_CF(data, cf, "adjust_pollset, !connected, POLLOUT fd=%"
                   FMT_SOCKET_T, ctx->sock);
     }
     else if(!ctx->active) {
-      Curl_pollset_add_in(data, ps, ctx->sock);
+      result = Curl_pollset_add_in(data, ps, ctx->sock);
       CURL_TRC_CF(data, cf, "adjust_pollset, !active, POLLIN fd=%"
                   FMT_SOCKET_T, ctx->sock);
     }
   }
+  return result;
 }
 
 #ifdef USE_WINSOCK
 
+/* Offered by mingw-w64 v13+. MS SDK 7.0A+. */
 #ifndef SIO_IDEAL_SEND_BACKLOG_QUERY
 #define SIO_IDEAL_SEND_BACKLOG_QUERY 0x4004747B
 #endif
@@ -1440,7 +1444,7 @@ static CURLcode cf_socket_send(struct Curl_cfilter *cf, struct Curl_easy *data,
   size_t orig_len = len;
   CURLcode result = CURLE_OK;
 
-  (void)eos; /* unused */
+  (void)eos;
   *pnwritten = 0;
   fdsave = cf->conn->sock[cf->sockindex];
   cf->conn->sock[cf->sockindex] = ctx->sock;
@@ -1505,7 +1509,7 @@ static CURLcode cf_socket_send(struct Curl_cfilter *cf, struct Curl_easy *data,
   else
     *pnwritten = (size_t)nwritten;
 
-#if defined(USE_WINSOCK)
+#ifdef USE_WINSOCK
   if(!result)
     win_update_sndbuf_size(ctx);
 #endif
@@ -1600,15 +1604,10 @@ static void cf_socket_active(struct Curl_cfilter *cf, struct Curl_easy *data)
   /* use this socket from now on */
   cf->conn->sock[cf->sockindex] = ctx->sock;
   set_local_ip(cf, data);
-  if(cf->sockindex == FIRSTSOCKET) {
-    cf->conn->primary = ctx->ip;
-  #ifdef USE_IPV6
+#ifdef USE_IPV6
+  if(cf->sockindex == FIRSTSOCKET)
     cf->conn->bits.ipv6 = (ctx->addr.family == AF_INET6);
-  #endif
-  }
-  else {
-    cf->conn->secondary = ctx->ip;
-  }
+#endif
   ctx->active = TRUE;
 }
 
@@ -2111,13 +2110,13 @@ static CURLcode cf_tcp_accept_connect(struct Curl_cfilter *cf,
     return CURLE_OK;
   }
 
-  if(0 == getsockname(ctx->sock, (struct sockaddr *) &add, &size)) {
+  if(!getsockname(ctx->sock, (struct sockaddr *) &add, &size)) {
     size = sizeof(add);
 #ifdef HAVE_ACCEPT4
     s_accepted = accept4(ctx->sock, (struct sockaddr *) &add, &size,
                          SOCK_NONBLOCK | SOCK_CLOEXEC);
 #else
-    s_accepted = accept(ctx->sock, (struct sockaddr *) &add, &size);
+    s_accepted = CURL_ACCEPT(ctx->sock, (struct sockaddr *) &add, &size);
 #endif
   }
 
diff --git a/deps/curl/lib/cf-socket.h b/deps/curl/lib/cf-socket.h
index 90daf079a01..88c08fe7c0c 100644
--- a/deps/curl/lib/cf-socket.h
+++ b/deps/curl/lib/cf-socket.h
@@ -91,14 +91,6 @@ void Curl_sndbuf_init(curl_socket_t sockfd);
 #define Curl_sndbuf_init(y) Curl_nop_stmt
 #endif
 
-/**
- * Assign the address `ai` to the Curl_sockaddr_ex `dest` and
- * set the transport used.
- */
-CURLcode Curl_sock_assign_addr(struct Curl_sockaddr_ex *dest,
-                               const struct Curl_addrinfo *ai,
-                               int transport);
-
 /**
  * Creates a cfilter that opens a TCP socket to the given address
  * when calling its `connect` implementation.
diff --git a/deps/curl/lib/cfilters.c b/deps/curl/lib/cfilters.c
index 01f1e282183..efd2ac6f63d 100644
--- a/deps/curl/lib/cfilters.c
+++ b/deps/curl/lib/cfilters.c
@@ -67,14 +67,15 @@ CURLcode Curl_cf_def_shutdown(struct Curl_cfilter *cf,
 static void conn_report_connect_stats(struct Curl_easy *data,
                                       struct connectdata *conn);
 
-void Curl_cf_def_adjust_pollset(struct Curl_cfilter *cf,
-                                struct Curl_easy *data,
-                                struct easy_pollset *ps)
+CURLcode Curl_cf_def_adjust_pollset(struct Curl_cfilter *cf,
+                                    struct Curl_easy *data,
+                                    struct easy_pollset *ps)
 {
   /* NOP */
   (void)cf;
   (void)data;
   (void)ps;
+  return CURLE_OK;
 }
 
 bool Curl_cf_def_data_pending(struct Curl_cfilter *cf,
@@ -176,6 +177,10 @@ CURLcode Curl_conn_shutdown(struct Curl_easy *data, int sockindex, bool *done)
   struct curltime now;
 
   DEBUGASSERT(data->conn);
+
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
   /* Get the first connected filter that is not shut down already. */
   cf = data->conn->cfilter[sockindex];
   while(cf && (!cf->connected || cf->shutdown))
@@ -439,6 +444,29 @@ CURLcode Curl_conn_cf_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
   return CURLE_RECV_ERROR;
 }
 
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+static CURLcode cf_verboseconnect(struct Curl_easy *data,
+                                  struct Curl_cfilter *cf)
+{
+  if(Curl_trc_is_verbose(data)) {
+    struct ip_quadruple ipquad;
+    bool is_ipv6;
+    CURLcode result;
+
+    result = Curl_conn_cf_get_ip_info(cf, data, &is_ipv6, &ipquad);
+    if(result)
+      return result;
+
+    infof(data, "Established %sconnection to %s (%s port %u) from %s port %u ",
+          (cf->sockindex == SECONDARYSOCKET) ? "2nd " : "",
+          CURL_CONN_HOST_DISPNAME(data->conn),
+          ipquad.remote_ip, ipquad.remote_port,
+          ipquad.local_ip, ipquad.local_port);
+  }
+  return CURLE_OK;
+}
+#endif
+
 CURLcode Curl_conn_connect(struct Curl_easy *data,
                            int sockindex,
                            bool blocking,
@@ -446,12 +474,15 @@ CURLcode Curl_conn_connect(struct Curl_easy *data,
 {
 #define CF_CONN_NUM_POLLS_ON_STACK 5
   struct pollfd a_few_on_stack[CF_CONN_NUM_POLLS_ON_STACK];
+  struct easy_pollset ps;
   struct curl_pollfds cpfds;
   struct Curl_cfilter *cf;
   CURLcode result = CURLE_OK;
 
   DEBUGASSERT(data);
   DEBUGASSERT(data->conn);
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
 
   cf = data->conn->cfilter[sockindex];
   if(!cf) {
@@ -463,6 +494,7 @@ CURLcode Curl_conn_connect(struct Curl_easy *data,
   if(*done)
     return CURLE_OK;
 
+  Curl_pollset_init(&ps);
   Curl_pollfds_init(&cpfds, a_few_on_stack, CF_CONN_NUM_POLLS_ON_STACK);
   while(!*done) {
     if(Curl_conn_needs_flush(data, sockindex)) {
@@ -482,7 +514,9 @@ CURLcode Curl_conn_connect(struct Curl_easy *data,
       cf_cntrl_update_info(data, data->conn);
       conn_report_connect_stats(data, data->conn);
       data->conn->keepalive = curlx_now();
-      Curl_verboseconnect(data, data->conn, sockindex);
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+      result = cf_verboseconnect(data, cf);
+#endif
       goto out;
     }
     else if(result) {
@@ -498,7 +532,6 @@ CURLcode Curl_conn_connect(struct Curl_easy *data,
       /* check allowed time left */
       const timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
       curl_socket_t sockfd = Curl_conn_cf_get_socket(cf, data);
-      struct easy_pollset ps;
       int rc;
 
       if(timeout_ms < 0) {
@@ -509,12 +542,14 @@ CURLcode Curl_conn_connect(struct Curl_easy *data,
       }
 
       CURL_TRC_CF(data, cf, "Curl_conn_connect(block=1), do poll");
+      Curl_pollset_reset(&ps);
       Curl_pollfds_reset(&cpfds);
-      memset(&ps, 0, sizeof(ps));
       /* In general, we want to send after connect, wait on that. */
       if(sockfd != CURL_SOCKET_BAD)
         Curl_pollset_set_out_only(data, &ps, sockfd);
-      Curl_conn_adjust_pollset(data, data->conn, &ps);
+      result = Curl_conn_adjust_pollset(data, data->conn, &ps);
+      if(result)
+        goto out;
       result = Curl_pollfds_add_ps(&cpfds, &ps);
       if(result)
         goto out;
@@ -532,12 +567,15 @@ CURLcode Curl_conn_connect(struct Curl_easy *data,
   }
 
 out:
+  Curl_pollset_cleanup(&ps);
   Curl_pollfds_cleanup(&cpfds);
   return result;
 }
 
 bool Curl_conn_is_setup(struct connectdata *conn, int sockindex)
 {
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
   return (conn->cfilter[sockindex] != NULL);
 }
 
@@ -545,6 +583,8 @@ bool Curl_conn_is_connected(struct connectdata *conn, int sockindex)
 {
   struct Curl_cfilter *cf;
 
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
   cf = conn->cfilter[sockindex];
   return cf && cf->connected;
 }
@@ -553,6 +593,8 @@ bool Curl_conn_is_ip_connected(struct Curl_easy *data, int sockindex)
 {
   struct Curl_cfilter *cf;
 
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
   cf = data->conn->cfilter[sockindex];
   while(cf) {
     if(cf->connected)
@@ -564,7 +606,7 @@ bool Curl_conn_is_ip_connected(struct Curl_easy *data, int sockindex)
   return FALSE;
 }
 
-bool Curl_conn_cf_is_ssl(struct Curl_cfilter *cf)
+static bool cf_is_ssl(struct Curl_cfilter *cf)
 {
   for(; cf; cf = cf->next) {
     if(cf->cft->flags & CF_TYPE_SSL)
@@ -577,13 +619,17 @@ bool Curl_conn_cf_is_ssl(struct Curl_cfilter *cf)
 
 bool Curl_conn_is_ssl(struct connectdata *conn, int sockindex)
 {
-  return conn ? Curl_conn_cf_is_ssl(conn->cfilter[sockindex]) : FALSE;
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
+  return conn ? cf_is_ssl(conn->cfilter[sockindex]) : FALSE;
 }
 
 bool Curl_conn_get_ssl_info(struct Curl_easy *data,
                             struct connectdata *conn, int sockindex,
                             struct curl_tlssessioninfo *info)
 {
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
   if(Curl_conn_is_ssl(conn, sockindex)) {
     struct Curl_cfilter *cf = conn->cfilter[sockindex];
     CURLcode result = cf ? cf->cft->query(cf, data, CF_QUERY_SSL_INFO,
@@ -593,9 +639,24 @@ bool Curl_conn_get_ssl_info(struct Curl_easy *data,
   return FALSE;
 }
 
+CURLcode Curl_conn_get_ip_info(struct Curl_easy *data,
+                               struct connectdata *conn, int sockindex,
+                               bool *is_ipv6, struct ip_quadruple *ipquad)
+{
+  struct Curl_cfilter *cf;
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  cf = conn ? conn->cfilter[sockindex] : NULL;
+  return Curl_conn_cf_get_ip_info(cf, data, is_ipv6, ipquad);
+}
+
 bool Curl_conn_is_multiplex(struct connectdata *conn, int sockindex)
 {
-  struct Curl_cfilter *cf = conn ? conn->cfilter[sockindex] : NULL;
+  struct Curl_cfilter *cf;
+
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
+  cf = conn ? conn->cfilter[sockindex] : NULL;
 
   for(; cf; cf = cf->next) {
     if(cf->cft->flags & CF_TYPE_MULTIPLEX)
@@ -613,6 +674,13 @@ unsigned char Curl_conn_get_transport(struct Curl_easy *data,
   return Curl_conn_cf_get_transport(cf, data);
 }
 
+const char *Curl_conn_get_alpn_negotiated(struct Curl_easy *data,
+                                          struct connectdata *conn)
+{
+  struct Curl_cfilter *cf = conn->cfilter[FIRSTSOCKET];
+  return Curl_conn_cf_get_alpn_negotiated(cf, data);
+}
+
 unsigned char Curl_conn_http_version(struct Curl_easy *data,
                                      struct connectdata *conn)
 {
@@ -644,6 +712,8 @@ bool Curl_conn_data_pending(struct Curl_easy *data, int sockindex)
   (void)data;
   DEBUGASSERT(data);
   DEBUGASSERT(data->conn);
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
 
   cf = data->conn->cfilter[sockindex];
   while(cf && !cf->connected) {
@@ -667,13 +737,16 @@ bool Curl_conn_cf_needs_flush(struct Curl_cfilter *cf,
 
 bool Curl_conn_needs_flush(struct Curl_easy *data, int sockindex)
 {
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return FALSE;
   return Curl_conn_cf_needs_flush(data->conn->cfilter[sockindex], data);
 }
 
-void Curl_conn_cf_adjust_pollset(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 struct easy_pollset *ps)
+CURLcode Curl_conn_cf_adjust_pollset(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data,
+                                     struct easy_pollset *ps)
 {
+  CURLcode result = CURLE_OK;
   /* Get the lowest not-connected filter, if there are any */
   while(cf && !cf->connected && cf->next && !cf->next->connected)
     cf = cf->next;
@@ -682,23 +755,26 @@ void Curl_conn_cf_adjust_pollset(struct Curl_cfilter *cf,
     cf = cf->next;
   /* From there on, give all filters a chance to adjust the pollset.
    * Lower filters are called later, so they may override */
-  while(cf) {
-    cf->cft->adjust_pollset(cf, data, ps);
+  while(cf && !result) {
+    result = cf->cft->adjust_pollset(cf, data, ps);
     cf = cf->next;
   }
+  return result;
 }
 
-void Curl_conn_adjust_pollset(struct Curl_easy *data,
-                              struct connectdata *conn,
-                              struct easy_pollset *ps)
+CURLcode Curl_conn_adjust_pollset(struct Curl_easy *data,
+                                  struct connectdata *conn,
+                                  struct easy_pollset *ps)
 {
+  CURLcode result = CURLE_OK;
   int i;
 
   DEBUGASSERT(data);
   DEBUGASSERT(conn);
-  for(i = 0; i < 2; ++i) {
-    Curl_conn_cf_adjust_pollset(conn->cfilter[i], data, ps);
+  for(i = 0; (i < 2) && !result; ++i) {
+    result = Curl_conn_cf_adjust_pollset(conn->cfilter[i], data, ps);
   }
+  return result;
 }
 
 int Curl_conn_cf_poll(struct Curl_cfilter *cf,
@@ -706,35 +782,18 @@ int Curl_conn_cf_poll(struct Curl_cfilter *cf,
                       timediff_t timeout_ms)
 {
   struct easy_pollset ps;
-  struct pollfd pfds[MAX_SOCKSPEREASYHANDLE];
-  unsigned int i, npfds = 0;
+  int result;
 
   DEBUGASSERT(cf);
   DEBUGASSERT(data);
   DEBUGASSERT(data->conn);
-  memset(&ps, 0, sizeof(ps));
-  memset(pfds, 0, sizeof(pfds));
-
-  Curl_conn_cf_adjust_pollset(cf, data, &ps);
-  DEBUGASSERT(ps.num <= MAX_SOCKSPEREASYHANDLE);
-  for(i = 0; i < ps.num; ++i) {
-    short events = 0;
-    if(ps.actions[i] & CURL_POLL_IN) {
-      events |= POLLIN;
-    }
-    if(ps.actions[i] & CURL_POLL_OUT) {
-      events |= POLLOUT;
-    }
-    if(events) {
-      pfds[npfds].fd = ps.sockets[i];
-      pfds[npfds].events = events;
-      ++npfds;
-    }
-  }
+  Curl_pollset_init(&ps);
 
-  if(!npfds)
-    DEBUGF(infof(data, "no sockets to poll!"));
-  return Curl_poll(pfds, npfds, timeout_ms);
+  result = Curl_conn_cf_adjust_pollset(cf, data, &ps);
+  if(!result)
+    result = Curl_pollset_poll(data, &ps, timeout_ms);
+  Curl_pollset_cleanup(&ps);
+  return result;
 }
 
 void Curl_conn_get_current_host(struct Curl_easy *data, int sockindex,
@@ -742,8 +801,14 @@ void Curl_conn_get_current_host(struct Curl_easy *data, int sockindex,
 {
   struct Curl_cfilter *cf, *cf_proxy = NULL;
 
-  DEBUGASSERT(data->conn);
-  cf = data->conn->cfilter[sockindex];
+  if(!data->conn) {
+    DEBUGASSERT(0);
+    *phost = "";
+    *pport = -1;
+    return;
+  }
+
+  cf = CONN_SOCK_IDX_VALID(sockindex) ? data->conn->cfilter[sockindex] : NULL;
   /* Find the "lowest" tunneling proxy filter that has not connected yet. */
   while(cf && !cf->connected) {
     if((cf->cft->flags & (CF_TYPE_IP_CONNECT|CF_TYPE_PROXY)) ==
@@ -810,6 +875,17 @@ unsigned char Curl_conn_cf_get_transport(struct Curl_cfilter *cf,
   return (unsigned char)(data->conn ? data->conn->transport_wanted : 0);
 }
 
+const char *Curl_conn_cf_get_alpn_negotiated(struct Curl_cfilter *cf,
+                                             struct Curl_easy *data)
+{
+  const char *alpn = NULL;
+  CURL_TRC_CF(data, cf, "query ALPN");
+  if(cf && !cf->cft->query(cf, data, CF_QUERY_ALPN_NEGOTIATED, NULL,
+                           CURL_UNCONST(&alpn)))
+    return alpn;
+  return NULL;
+}
+
 static const struct Curl_sockaddr_ex *
 cf_get_remote_addr(struct Curl_cfilter *cf, struct Curl_easy *data)
 {
@@ -823,36 +899,44 @@ cf_get_remote_addr(struct Curl_cfilter *cf, struct Curl_easy *data)
 
 CURLcode Curl_conn_cf_get_ip_info(struct Curl_cfilter *cf,
                                   struct Curl_easy *data,
-                                  int *is_ipv6, struct ip_quadruple *ipquad)
+                                  bool *is_ipv6, struct ip_quadruple *ipquad)
 {
-  if(cf)
-    return cf->cft->query(cf, data, CF_QUERY_IP_INFO, is_ipv6, ipquad);
-  return CURLE_UNKNOWN_OPTION;
+  CURLcode result = CURLE_UNKNOWN_OPTION;
+  if(cf) {
+    int ipv6 = 0;
+    result = cf->cft->query(cf, data, CF_QUERY_IP_INFO, &ipv6, ipquad);
+    *is_ipv6 = !!ipv6;
+  }
+  return result;
 }
 
-curl_socket_t Curl_conn_get_socket(struct Curl_easy *data, int sockindex)
+curl_socket_t Curl_conn_get_first_socket(struct Curl_easy *data)
 {
   struct Curl_cfilter *cf;
 
-  cf = data->conn ? data->conn->cfilter[sockindex] : NULL;
+  if(!data->conn)
+    return CURL_SOCKET_BAD;
+
+  cf = data->conn->cfilter[FIRSTSOCKET];
   /* if the top filter has not connected, ask it (and its sub-filters)
-   * for the socket. Otherwise conn->sock[sockindex] should have it.
-   */
+   * for the socket. Otherwise conn->sock[sockindex] should have it. */
   if(cf && !cf->connected)
     return Curl_conn_cf_get_socket(cf, data);
-  return data->conn ? data->conn->sock[sockindex] : CURL_SOCKET_BAD;
+  return data->conn->sock[FIRSTSOCKET];
 }
 
 const struct Curl_sockaddr_ex *
 Curl_conn_get_remote_addr(struct Curl_easy *data, int sockindex)
 {
-  struct Curl_cfilter *cf = data->conn ? data->conn->cfilter[sockindex] : NULL;
+  struct Curl_cfilter *cf =
+    (data->conn && CONN_SOCK_IDX_VALID(sockindex)) ?
+    data->conn->cfilter[sockindex] : NULL;
   return cf ? cf_get_remote_addr(cf, data) : NULL;
 }
 
 void Curl_conn_forget_socket(struct Curl_easy *data, int sockindex)
 {
-  if(data->conn) {
+  if(data->conn && CONN_SOCK_IDX_VALID(sockindex)) {
     struct Curl_cfilter *cf = data->conn->cfilter[sockindex];
     if(cf)
       (void)Curl_conn_cf_cntrl(cf, data, TRUE,
@@ -894,6 +978,8 @@ CURLcode Curl_conn_ev_data_idle(struct Curl_easy *data)
 
 CURLcode Curl_conn_flush(struct Curl_easy *data, int sockindex)
 {
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
   return Curl_conn_cf_cntrl(data->conn->cfilter[sockindex], data, FALSE,
                             CF_CTRL_FLUSH, 0, NULL);
 }
@@ -963,7 +1049,11 @@ CURLcode Curl_conn_keep_alive(struct Curl_easy *data,
                               struct connectdata *conn,
                               int sockindex)
 {
-  struct Curl_cfilter *cf = conn->cfilter[sockindex];
+  struct Curl_cfilter *cf;
+
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  cf = conn->cfilter[sockindex];
   return cf ? cf->cft->keep_alive(cf, data) : CURLE_OK;
 }
 
@@ -971,23 +1061,34 @@ size_t Curl_conn_get_max_concurrent(struct Curl_easy *data,
                                     struct connectdata *conn,
                                     int sockindex)
 {
+  struct Curl_cfilter *cf;
   CURLcode result;
-  int n = 0;
+  int n = -1;
 
-  struct Curl_cfilter *cf = conn->cfilter[sockindex];
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return 0;
+
+  cf = conn->cfilter[sockindex];
   result = cf ? cf->cft->query(cf, data, CF_QUERY_MAX_CONCURRENT,
                                &n, NULL) : CURLE_UNKNOWN_OPTION;
-  return (result || n <= 0) ? 1 : (size_t)n;
+  /* If no filter answered the query, the default is a non-multiplexed
+   * connection with limit 1. Otherwise, the the query may return 0
+   * for connections that are in shutdown, e.g. server HTTP/2 GOAWAY. */
+  return (result || n < 0) ? 1 : (size_t)n;
 }
 
 int Curl_conn_get_stream_error(struct Curl_easy *data,
                                struct connectdata *conn,
                                int sockindex)
 {
+  struct Curl_cfilter *cf;
   CURLcode result;
   int n = 0;
 
-  struct Curl_cfilter *cf = conn->cfilter[sockindex];
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return 0;
+
+  cf = conn->cfilter[sockindex];
   result = cf ? cf->cft->query(cf, data, CF_QUERY_STREAM_ERROR,
                                &n, NULL) : CURLE_UNKNOWN_OPTION;
   return (result || n < 0) ? 0 : n;
@@ -1006,6 +1107,8 @@ CURLcode Curl_conn_recv(struct Curl_easy *data, int sockindex,
 {
   DEBUGASSERT(data);
   DEBUGASSERT(data->conn);
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
   if(data && data->conn && data->conn->recv[sockindex])
     return data->conn->recv[sockindex](data, sockindex, buf, blen, pnread);
   *pnread = 0;
@@ -1020,7 +1123,9 @@ CURLcode Curl_conn_send(struct Curl_easy *data, int sockindex,
 
   DEBUGASSERT(data);
   DEBUGASSERT(data->conn);
-  DEBUGASSERT(sockindex >= 0 && sockindex < 2);
+  DEBUGASSERT(CONN_SOCK_IDX_VALID(sockindex));
+  if(!CONN_SOCK_IDX_VALID(sockindex))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
 #ifdef DEBUGBUILD
   if(write_len) {
     /* Allow debug builds to override this logic to force short sends
@@ -1041,142 +1146,3 @@ CURLcode Curl_conn_send(struct Curl_easy *data, int sockindex,
   *pnwritten = 0;
   return CURLE_FAILED_INIT;
 }
-
-void Curl_pollset_reset(struct Curl_easy *data,
-                        struct easy_pollset *ps)
-{
-  size_t i;
-  (void)data;
-  memset(ps, 0, sizeof(*ps));
-  for(i = 0; i < MAX_SOCKSPEREASYHANDLE; i++)
-    ps->sockets[i] = CURL_SOCKET_BAD;
-}
-
-/**
- *
- */
-void Curl_pollset_change(struct Curl_easy *data,
-                         struct easy_pollset *ps, curl_socket_t sock,
-                         int add_flags, int remove_flags)
-{
-  unsigned int i;
-
-  (void)data;
-  DEBUGASSERT(VALID_SOCK(sock));
-  if(!VALID_SOCK(sock))
-    return;
-
-  DEBUGASSERT(add_flags <= (CURL_POLL_IN|CURL_POLL_OUT));
-  DEBUGASSERT(remove_flags <= (CURL_POLL_IN|CURL_POLL_OUT));
-  DEBUGASSERT((add_flags&remove_flags) == 0); /* no overlap */
-  for(i = 0; i < ps->num; ++i) {
-    if(ps->sockets[i] == sock) {
-      ps->actions[i] &= (unsigned char)(~remove_flags);
-      ps->actions[i] |= (unsigned char)add_flags;
-      /* all gone? remove socket */
-      if(!ps->actions[i]) {
-        if((i + 1) < ps->num) {
-          memmove(&ps->sockets[i], &ps->sockets[i + 1],
-                  (ps->num - (i + 1)) * sizeof(ps->sockets[0]));
-          memmove(&ps->actions[i], &ps->actions[i + 1],
-                  (ps->num - (i + 1)) * sizeof(ps->actions[0]));
-        }
-        --ps->num;
-      }
-      return;
-    }
-  }
-  /* not present */
-  if(add_flags) {
-    /* Having more SOCKETS per easy handle than what is defined
-     * is a programming error. This indicates that we need
-     * to raise this limit, making easy_pollset larger.
-     * Since we use this in tight loops, we do not want to make
-     * the pollset dynamic unnecessarily.
-     * The current maximum in practise is HTTP/3 eyeballing where
-     * we have up to 4 sockets involved in connection setup.
-     */
-    DEBUGASSERT(i < MAX_SOCKSPEREASYHANDLE);
-    if(i < MAX_SOCKSPEREASYHANDLE) {
-      ps->sockets[i] = sock;
-      ps->actions[i] = (unsigned char)add_flags;
-      ps->num = i + 1;
-    }
-  }
-}
-
-void Curl_pollset_set(struct Curl_easy *data,
-                      struct easy_pollset *ps, curl_socket_t sock,
-                      bool do_in, bool do_out)
-{
-  Curl_pollset_change(data, ps, sock,
-                      (do_in ? CURL_POLL_IN : 0)|
-                      (do_out ? CURL_POLL_OUT : 0),
-                      (!do_in ? CURL_POLL_IN : 0)|
-                      (!do_out ? CURL_POLL_OUT : 0));
-}
-
-static void ps_add(struct Curl_easy *data, struct easy_pollset *ps,
-                   int bitmap, curl_socket_t *socks)
-{
-  if(bitmap) {
-    int i;
-    for(i = 0; i < MAX_SOCKSPEREASYHANDLE; ++i) {
-      if(!(bitmap & GETSOCK_MASK_RW(i)) || !VALID_SOCK((socks[i]))) {
-        break;
-      }
-      if(bitmap & GETSOCK_READSOCK(i)) {
-        if(bitmap & GETSOCK_WRITESOCK(i))
-          Curl_pollset_add_inout(data, ps, socks[i]);
-        else
-          /* is READ, since we checked MASK_RW above */
-          Curl_pollset_add_in(data, ps, socks[i]);
-      }
-      else
-        Curl_pollset_add_out(data, ps, socks[i]);
-    }
-  }
-}
-
-void Curl_pollset_add_socks(struct Curl_easy *data,
-                            struct easy_pollset *ps,
-                            int (*get_socks_cb)(struct Curl_easy *data,
-                                                curl_socket_t *socks))
-{
-  curl_socket_t socks[MAX_SOCKSPEREASYHANDLE];
-  int bitmap;
-
-  bitmap = get_socks_cb(data, socks);
-  ps_add(data, ps, bitmap, socks);
-}
-
-void Curl_pollset_check(struct Curl_easy *data,
-                        struct easy_pollset *ps, curl_socket_t sock,
-                        bool *pwant_read, bool *pwant_write)
-{
-  unsigned int i;
-
-  (void)data;
-  DEBUGASSERT(VALID_SOCK(sock));
-  for(i = 0; i < ps->num; ++i) {
-    if(ps->sockets[i] == sock) {
-      *pwant_read = !!(ps->actions[i] & CURL_POLL_IN);
-      *pwant_write = !!(ps->actions[i] & CURL_POLL_OUT);
-      return;
-    }
-  }
-  *pwant_read = *pwant_write = FALSE;
-}
-
-bool Curl_pollset_want_read(struct Curl_easy *data,
-                            struct easy_pollset *ps,
-                            curl_socket_t sock)
-{
-  unsigned int i;
-  (void)data;
-  for(i = 0; i < ps->num; ++i) {
-    if((ps->sockets[i] == sock) && (ps->actions[i] & CURL_POLL_IN))
-      return TRUE;
-  }
-  return FALSE;
-}
diff --git a/deps/curl/lib/cfilters.h b/deps/curl/lib/cfilters.h
index 39d906d673b..815b72a6e80 100644
--- a/deps/curl/lib/cfilters.h
+++ b/deps/curl/lib/cfilters.h
@@ -80,7 +80,7 @@ struct easy_pollset;
  * @param data   the easy handle the pollset is about
  * @param ps     the pollset (inout) for the easy handle
  */
-typedef void     Curl_cft_adjust_pollset(struct Curl_cfilter *cf,
+typedef CURLcode Curl_cft_adjust_pollset(struct Curl_cfilter *cf,
                                          struct Curl_easy *data,
                                          struct easy_pollset *ps);
 
@@ -158,6 +158,10 @@ typedef CURLcode Curl_cft_cntrl(struct Curl_cfilter *cf,
  * - CF_QUERY_SSL_CTX_INFO: same as CF_QUERY_SSL_INFO, but give the SSL_CTX
  *                      when available, or the same internal pointer
  *                      when the TLS stack does not differentiate.
+ * - CF_QUERY_ALPN_NEGOTIATED: The ALPN selected by the server as
+                        null-terminated string or NULL if none
+                        selected/handshake not done. Implemented by filter
+                        types CF_TYPE_SSL or CF_TYPE_IP_CONNECT.
  */
 /*      query                             res1       res2     */
 #define CF_QUERY_MAX_CONCURRENT     1  /* number     -        */
@@ -176,6 +180,7 @@ typedef CURLcode Curl_cft_cntrl(struct Curl_cfilter *cf,
 #define CF_QUERY_SSL_INFO          12  /* -    struct curl_tlssessioninfo * */
 #define CF_QUERY_SSL_CTX_INFO      13  /* -    struct curl_tlssessioninfo * */
 #define CF_QUERY_TRANSPORT         14  /* TRNSPRT_*  - * */
+#define CF_QUERY_ALPN_NEGOTIATED   15  /* -          const char * */
 
 /**
  * Query the cfilter for properties. Filters ignorant of a query will
@@ -239,7 +244,7 @@ void Curl_cf_def_destroy_this(struct Curl_cfilter *cf,
 
 /* Default implementations for the type functions, implementing pass-through
  * the filter chain. */
-void     Curl_cf_def_adjust_pollset(struct Curl_cfilter *cf,
+CURLcode Curl_cf_def_adjust_pollset(struct Curl_cfilter *cf,
                                     struct Curl_easy *data,
                                     struct easy_pollset *ps);
 bool     Curl_cf_def_data_pending(struct Curl_cfilter *cf,
@@ -331,12 +336,6 @@ CURLcode Curl_conn_cf_cntrl(struct Curl_cfilter *cf,
                             bool ignore_result,
                             int event, int arg1, void *arg2);
 
-/**
- * Determine if the connection filter chain is using SSL to the remote host
- * (or will be once connected).
- */
-bool Curl_conn_cf_is_ssl(struct Curl_cfilter *cf);
-
 /**
  * Get the socket used by the filter chain starting at `cf`.
  * Returns CURL_SOCKET_BAD if not available.
@@ -346,7 +345,7 @@ curl_socket_t Curl_conn_cf_get_socket(struct Curl_cfilter *cf,
 
 CURLcode Curl_conn_cf_get_ip_info(struct Curl_cfilter *cf,
                                   struct Curl_easy *data,
-                                  int *is_ipv6, struct ip_quadruple *ipquad);
+                                  bool *is_ipv6, struct ip_quadruple *ipquad);
 
 bool Curl_conn_cf_needs_flush(struct Curl_cfilter *cf,
                               struct Curl_easy *data);
@@ -354,6 +353,9 @@ bool Curl_conn_cf_needs_flush(struct Curl_cfilter *cf,
 unsigned char Curl_conn_cf_get_transport(struct Curl_cfilter *cf,
                                          struct Curl_easy *data);
 
+const char *Curl_conn_cf_get_alpn_negotiated(struct Curl_cfilter *cf,
+                                             struct Curl_easy *data);
+
 #define CURL_CF_SSL_DEFAULT  -1
 #define CURL_CF_SSL_DISABLE  0
 #define CURL_CF_SSL_ENABLE   1
@@ -402,6 +404,10 @@ bool Curl_conn_get_ssl_info(struct Curl_easy *data,
                             struct connectdata *conn, int sockindex,
                             struct curl_tlssessioninfo *info);
 
+CURLcode Curl_conn_get_ip_info(struct Curl_easy *data,
+                               struct connectdata *conn, int sockindex,
+                               bool *is_ipv6, struct ip_quadruple *ipquad);
+
 /**
  * Connection provides multiplexing of easy handles at `socketindex`.
  */
@@ -418,6 +424,10 @@ unsigned char Curl_conn_http_version(struct Curl_easy *data,
 unsigned char Curl_conn_get_transport(struct Curl_easy *data,
                                       struct connectdata *conn);
 
+/* Get the negotiated ALPN protocol or NULL if none in play */
+const char *Curl_conn_get_alpn_negotiated(struct Curl_easy *data,
+                                          struct connectdata *conn);
+
 /**
  * Close the filter chain at `sockindex` for connection `data->conn`.
   * Filters remain in place and may be connected again afterwards.
@@ -450,10 +460,11 @@ bool Curl_conn_needs_flush(struct Curl_easy *data, int sockindex);
 CURLcode Curl_conn_flush(struct Curl_easy *data, int sockindex);
 
 /**
- * Return the socket used on data's connection for the index.
+ * Return the socket used on data's connection for FIRSTSOCKET,
+ * querying filters if the whole chain has not connected yet.
  * Returns CURL_SOCKET_BAD if not available.
  */
-curl_socket_t Curl_conn_get_socket(struct Curl_easy *data, int sockindex);
+curl_socket_t Curl_conn_get_first_socket(struct Curl_easy *data);
 
 /* Return a pointer to the connected socket address or NULL. */
 const struct Curl_sockaddr_ex *
@@ -467,16 +478,16 @@ void Curl_conn_forget_socket(struct Curl_easy *data, int sockindex);
 /**
  * Adjust the pollset for the filter chain starting at `cf`.
  */
-void Curl_conn_cf_adjust_pollset(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 struct easy_pollset *ps);
+CURLcode Curl_conn_cf_adjust_pollset(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data,
+                                     struct easy_pollset *ps);
 
 /**
  * Adjust pollset from filters installed at transfer's connection.
  */
-void Curl_conn_adjust_pollset(struct Curl_easy *data,
-                              struct connectdata *conn,
-                              struct easy_pollset *ps);
+CURLcode Curl_conn_adjust_pollset(struct Curl_easy *data,
+                                  struct connectdata *conn,
+                                  struct easy_pollset *ps);
 
 /**
  * Curl_poll() the filter chain at `cf` with timeout `timeout_ms`.
@@ -622,56 +633,6 @@ CURLcode Curl_conn_send(struct Curl_easy *data, int sockindex,
                         size_t *pnwritten);
 
 
-void Curl_pollset_reset(struct Curl_easy *data,
-                        struct easy_pollset *ps);
-
-/* Change the poll flags (CURL_POLL_IN/CURL_POLL_OUT) to the poll set for
- * socket `sock`. If the socket is not already part of the poll set, it
- * will be added.
- * If the socket is present and all poll flags are cleared, it will be removed.
- */
-void Curl_pollset_change(struct Curl_easy *data,
-                         struct easy_pollset *ps, curl_socket_t sock,
-                         int add_flags, int remove_flags);
-
-void Curl_pollset_set(struct Curl_easy *data,
-                      struct easy_pollset *ps, curl_socket_t sock,
-                      bool do_in, bool do_out);
-
-#define Curl_pollset_add_in(data, ps, sock) \
-          Curl_pollset_change((data), (ps), (sock), CURL_POLL_IN, 0)
-#define Curl_pollset_add_out(data, ps, sock) \
-          Curl_pollset_change((data), (ps), (sock), CURL_POLL_OUT, 0)
-#define Curl_pollset_add_inout(data, ps, sock) \
-          Curl_pollset_change((data), (ps), (sock), \
-                               CURL_POLL_IN|CURL_POLL_OUT, 0)
-#define Curl_pollset_set_in_only(data, ps, sock) \
-          Curl_pollset_change((data), (ps), (sock), \
-                               CURL_POLL_IN, CURL_POLL_OUT)
-#define Curl_pollset_set_out_only(data, ps, sock) \
-          Curl_pollset_change((data), (ps), (sock), \
-                               CURL_POLL_OUT, CURL_POLL_IN)
-
-void Curl_pollset_add_socks(struct Curl_easy *data,
-                            struct easy_pollset *ps,
-                            int (*get_socks_cb)(struct Curl_easy *data,
-                                                curl_socket_t *socks));
-
-/**
- * Check if the pollset, as is, wants to read and/or write regarding
- * the given socket.
- */
-void Curl_pollset_check(struct Curl_easy *data,
-                        struct easy_pollset *ps, curl_socket_t sock,
-                        bool *pwant_read, bool *pwant_write);
-
-/**
- * Return TRUE if the pollset contains socket with CURL_POLL_IN.
- */
-bool Curl_pollset_want_read(struct Curl_easy *data,
-                            struct easy_pollset *ps,
-                            curl_socket_t sock);
-
 /**
  * Types and macros used to keep the current easy handle in filter calls,
  * allowing for nested invocations. See #10336.
diff --git a/deps/curl/lib/config-os400.h b/deps/curl/lib/config-os400.h
index 064338ed2ab..bccdb4a8974 100644
--- a/deps/curl/lib/config-os400.h
+++ b/deps/curl/lib/config-os400.h
@@ -203,10 +203,6 @@
 /* Define if you have the ANSI C header files. */
 #define STDC_HEADERS
 
-/* Define to enable HTTP3 support (experimental, requires NGTCP2, quiche or
-   MSH3) */
-#undef USE_HTTP3
-
 /* Version number of package */
 #undef VERSION
 
diff --git a/deps/curl/lib/config-win32.h b/deps/curl/lib/config-win32.h
index 68377025db3..b7f83927a43 100644
--- a/deps/curl/lib/config-win32.h
+++ b/deps/curl/lib/config-win32.h
@@ -264,13 +264,11 @@
 #define HAVE_SNPRINTF 1
 #endif
 
-/* Vista */
-#if (defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x600) && !defined(UNDER_CE)
+/* Must always use local implementations on Windows. */
 /* Define to 1 if you have an IPv6 capable working inet_ntop function. */
-#define HAVE_INET_NTOP 1
+/* #undef HAVE_INET_NTOP */
 /* Define to 1 if you have an IPv6 capable working inet_pton function. */
-#define HAVE_INET_PTON 1
-#endif
+/* #undef HAVE_INET_PTON */
 
 /* Define to 1 if you have the `basename' function. */
 #ifdef __MINGW32__
diff --git a/deps/curl/lib/conncache.c b/deps/curl/lib/conncache.c
index fd6776e34c6..1393bb565be 100644
--- a/deps/curl/lib/conncache.c
+++ b/deps/curl/lib/conncache.c
@@ -515,7 +515,7 @@ static bool cpool_foreach(struct Curl_easy *data,
       struct connectdata *conn = Curl_node_elem(curr);
       curr = Curl_node_next(curr);
 
-      if(1 == func(data, conn, param)) {
+      if(func(data, conn, param) == 1) {
         return TRUE;
       }
     }
@@ -709,7 +709,8 @@ static int cpool_reap_dead_cb(struct Curl_easy *data,
                               struct connectdata *conn, void *param)
 {
   struct cpool_reaper_ctx *rctx = param;
-  if(Curl_conn_seems_dead(conn, data, &rctx->now)) {
+  if((!CONN_INUSE(conn) && conn->bits.no_reuse) ||
+     Curl_conn_seems_dead(conn, data, &rctx->now)) {
     /* stop the iteration here, pass back the connection that was pruned */
     Curl_conn_terminate(data, conn, FALSE);
     return 1;
@@ -849,6 +850,40 @@ void Curl_cpool_do_locked(struct Curl_easy *data,
     cb(conn, data, cbdata);
 }
 
+static int cpool_mark_stale(struct Curl_easy *data,
+                            struct connectdata *conn, void *param)
+{
+  (void)data;
+  (void)param;
+  conn->bits.no_reuse = TRUE;
+  return 0;
+}
+
+static int cpool_reap_no_reuse(struct Curl_easy *data,
+                               struct connectdata *conn, void *param)
+{
+  (void)data;
+  (void)param;
+  if(!CONN_INUSE(conn) && conn->bits.no_reuse) {
+    Curl_conn_terminate(data, conn, FALSE);
+    return 1;
+  }
+  return 0; /* continue iteration */
+}
+
+void Curl_cpool_nw_changed(struct Curl_easy *data)
+{
+  struct cpool *cpool = cpool_get_instance(data);
+
+  if(cpool) {
+    CPOOL_LOCK(cpool, data);
+    cpool_foreach(data, cpool, NULL, cpool_mark_stale);
+    while(cpool_foreach(data, cpool, NULL, cpool_reap_no_reuse))
+      ;
+    CPOOL_UNLOCK(cpool, data);
+  }
+}
+
 #if 0
 /* Useful for debugging the connection pool */
 void Curl_cpool_print(struct cpool *cpool)
diff --git a/deps/curl/lib/conncache.h b/deps/curl/lib/conncache.h
index ac07111a7d7..a5f133344fd 100644
--- a/deps/curl/lib/conncache.h
+++ b/deps/curl/lib/conncache.h
@@ -163,4 +163,8 @@ void Curl_cpool_do_locked(struct Curl_easy *data,
                           struct connectdata *conn,
                           Curl_cpool_conn_do_cb *cb, void *cbdata);
 
+/* Close all unused connections, prevent reuse of existing ones. */
+void Curl_cpool_nw_changed(struct Curl_easy *data);
+
+
 #endif /* HEADER_CURL_CONNCACHE_H */
diff --git a/deps/curl/lib/connect.c b/deps/curl/lib/connect.c
index ac16c3399b3..f0628d6206e 100644
--- a/deps/curl/lib/connect.c
+++ b/deps/curl/lib/connect.c
@@ -61,6 +61,7 @@
 #include "connect.h"
 #include "cf-haproxy.h"
 #include "cf-https-connect.h"
+#include "cf-ip-happy.h"
 #include "cf-socket.h"
 #include "select.h"
 #include "url.h" /* for Curl_safefree() */
@@ -74,8 +75,6 @@
 #include "conncache.h"
 #include "multihandle.h"
 #include "share.h"
-#include "curlx/version_win32.h"
-#include "vquic/vquic.h" /* for quic cfilters */
 #include "http_proxy.h"
 #include "socks.h"
 
@@ -232,28 +231,6 @@ bool Curl_shutdown_started(struct Curl_easy *data, int sockindex)
   return (pt->tv_sec > 0) || (pt->tv_usec > 0);
 }
 
-static const struct Curl_addrinfo *
-addr_first_match(const struct Curl_addrinfo *addr, int family)
-{
-  while(addr) {
-    if(addr->ai_family == family)
-      return addr;
-    addr = addr->ai_next;
-  }
-  return NULL;
-}
-
-static const struct Curl_addrinfo *
-addr_next_match(const struct Curl_addrinfo *addr, int family)
-{
-  while(addr && addr->ai_next) {
-    addr = addr->ai_next;
-    if(addr->ai_family == family)
-      return addr;
-  }
-  return NULL;
-}
-
 /* retrieves ip address and port from a sockaddr structure. note it calls
    curlx_inet_ntop which sets errno on fail, not SOCKERRNO. */
 bool Curl_addr2string(struct sockaddr *sa, curl_socklen_t salen,
@@ -372,874 +349,6 @@ void Curl_conncontrol(struct connectdata *conn,
   }
 }
 
-/**
- * job walking the matching addr infos, creating a sub-cfilter with the
- * provided method `cf_create` and running setup/connect on it.
- */
-struct eyeballer {
-  const char *name;
-  const struct Curl_addrinfo *first; /* complete address list, not owned */
-  const struct Curl_addrinfo *addr;  /* List of addresses to try, not owned */
-  int ai_family;                     /* matching address family only */
-  cf_ip_connect_create *cf_create;   /* for creating cf */
-  struct Curl_cfilter *cf;           /* current sub-cfilter connecting */
-  struct eyeballer *primary;         /* eyeballer this one is backup for */
-  timediff_t delay_ms;               /* delay until start */
-  struct curltime started;           /* start of current attempt */
-  timediff_t timeoutms;              /* timeout for current attempt */
-  expire_id timeout_id;              /* ID for Curl_expire() */
-  CURLcode result;
-  int error;
-  BIT(has_started);                  /* attempts have started */
-  BIT(is_done);                      /* out of addresses/time */
-  BIT(connected);                    /* cf has connected */
-  BIT(shutdown);                     /* cf has shutdown */
-  BIT(inconclusive);                 /* connect was not a hard failure, we
-                                      * might talk to a restarting server */
-};
-
-
-typedef enum {
-  SCFST_INIT,
-  SCFST_WAITING,
-  SCFST_DONE
-} cf_connect_state;
-
-struct cf_he_ctx {
-  int transport;
-  cf_ip_connect_create *cf_create;
-  cf_connect_state state;
-  struct eyeballer *baller[2];
-  struct eyeballer *winner;
-  struct curltime started;
-};
-
-/* when there are more than one IP address left to use, this macro returns how
-   much of the given timeout to spend on *this* attempt */
-#define TIMEOUT_LARGE 600
-#define USETIME(ms) ((ms > TIMEOUT_LARGE) ? (ms / 2) : ms)
-
-static CURLcode eyeballer_new(struct eyeballer **pballer,
-                              cf_ip_connect_create *cf_create,
-                              const struct Curl_addrinfo *addr,
-                              int ai_family,
-                              struct eyeballer *primary,
-                              timediff_t delay_ms,
-                              timediff_t timeout_ms,
-                              expire_id timeout_id)
-{
-  struct eyeballer *baller;
-
-  *pballer = NULL;
-  baller = calloc(1, sizeof(*baller));
-  if(!baller)
-    return CURLE_OUT_OF_MEMORY;
-
-  baller->name = ((ai_family == AF_INET) ? "ipv4" : (
-#ifdef USE_IPV6
-                  (ai_family == AF_INET6) ? "ipv6" :
-#endif
-                  "ip"));
-  baller->cf_create = cf_create;
-  baller->first = baller->addr = addr;
-  baller->ai_family = ai_family;
-  baller->primary = primary;
-  baller->delay_ms = delay_ms;
-  baller->timeoutms = addr_next_match(baller->addr, baller->ai_family) ?
-    USETIME(timeout_ms) : timeout_ms;
-  baller->timeout_id = timeout_id;
-  baller->result = CURLE_COULDNT_CONNECT;
-
-  *pballer = baller;
-  return CURLE_OK;
-}
-
-static void baller_close(struct eyeballer *baller,
-                         struct Curl_easy *data)
-{
-  if(baller && baller->cf) {
-    Curl_conn_cf_discard_chain(&baller->cf, data);
-  }
-}
-
-static void baller_free(struct eyeballer *baller,
-                        struct Curl_easy *data)
-{
-  if(baller) {
-    baller_close(baller, data);
-    free(baller);
-  }
-}
-
-static void baller_rewind(struct eyeballer *baller)
-{
-  baller->addr = baller->first;
-  baller->inconclusive = FALSE;
-}
-
-static void baller_next_addr(struct eyeballer *baller)
-{
-  baller->addr = addr_next_match(baller->addr, baller->ai_family);
-}
-
-/*
- * Initiate a connect attempt walk.
- *
- * Note that even on connect fail it returns CURLE_OK, but with 'sock' set to
- * CURL_SOCKET_BAD. Other errors will however return proper errors.
- */
-static void baller_initiate(struct Curl_cfilter *cf,
-                            struct Curl_easy *data,
-                            struct eyeballer *baller)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  struct Curl_cfilter *cf_prev = baller->cf;
-  struct Curl_cfilter *wcf;
-  CURLcode result;
-
-
-  /* Do not close a previous cfilter yet to ensure that the next IP's
-     socket gets a different file descriptor, which can prevent bugs when
-     the curl_multi_socket_action interface is used with certain select()
-     replacements such as kqueue. */
-  result = baller->cf_create(&baller->cf, data, cf->conn, baller->addr,
-                             ctx->transport);
-  if(result)
-    goto out;
-
-  /* the new filter might have sub-filters */
-  for(wcf = baller->cf; wcf; wcf = wcf->next) {
-    wcf->conn = cf->conn;
-    wcf->sockindex = cf->sockindex;
-  }
-
-  if(addr_next_match(baller->addr, baller->ai_family)) {
-    Curl_expire(data, baller->timeoutms, baller->timeout_id);
-  }
-
-out:
-  if(result) {
-    CURL_TRC_CF(data, cf, "%s failed", baller->name);
-    baller_close(baller, data);
-  }
-  if(cf_prev)
-    Curl_conn_cf_discard_chain(&cf_prev, data);
-  baller->result = result;
-}
-
-/**
- * Start a connection attempt on the current baller address.
- * Will return CURLE_OK on the first address where a socket
- * could be created and the non-blocking connect started.
- * Returns error when all remaining addresses have been tried.
- */
-static CURLcode baller_start(struct Curl_cfilter *cf,
-                             struct Curl_easy *data,
-                             struct eyeballer *baller,
-                             timediff_t timeoutms)
-{
-  baller->error = 0;
-  baller->connected = FALSE;
-  baller->has_started = TRUE;
-
-  while(baller->addr) {
-    baller->started = curlx_now();
-    baller->timeoutms = addr_next_match(baller->addr, baller->ai_family) ?
-      USETIME(timeoutms) : timeoutms;
-    baller_initiate(cf, data, baller);
-    if(!baller->result)
-      break;
-    baller_next_addr(baller);
-  }
-  if(!baller->addr) {
-    baller->is_done = TRUE;
-  }
-  return baller->result;
-}
-
-
-/* Used within the multi interface. Try next IP address, returns error if no
-   more address exists or error */
-static CURLcode baller_start_next(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  struct eyeballer *baller,
-                                  timediff_t timeoutms)
-{
-  if(cf->sockindex == FIRSTSOCKET) {
-    baller_next_addr(baller);
-    /* If we get inconclusive answers from the server(s), we start
-     * again until this whole thing times out. This allows us to
-     * connect to servers that are gracefully restarting and the
-     * packet routing to the new instance has not happened yet (e.g. QUIC). */
-    if(!baller->addr && baller->inconclusive)
-      baller_rewind(baller);
-    baller_start(cf, data, baller, timeoutms);
-  }
-  else {
-    baller->error = 0;
-    baller->connected = FALSE;
-    baller->has_started = TRUE;
-    baller->is_done = TRUE;
-    baller->result = CURLE_COULDNT_CONNECT;
-  }
-  return baller->result;
-}
-
-static CURLcode baller_connect(struct Curl_cfilter *cf,
-                               struct Curl_easy *data,
-                               struct eyeballer *baller,
-                               struct curltime *now,
-                               bool *connected)
-{
-  (void)cf;
-  *connected = baller->connected;
-  if(!baller->result &&  !*connected) {
-    /* evaluate again */
-    baller->result = Curl_conn_cf_connect(baller->cf, data, connected);
-
-    if(!baller->result) {
-      if(*connected) {
-        baller->connected = TRUE;
-        baller->is_done = TRUE;
-      }
-      else if(curlx_timediff(*now, baller->started) >= baller->timeoutms) {
-        infof(data, "%s connect timeout after %" FMT_TIMEDIFF_T
-              "ms, move on!", baller->name, baller->timeoutms);
-#ifdef SOCKETIMEDOUT
-        baller->error = SOCKETIMEDOUT;
-#endif
-        baller->result = CURLE_OPERATION_TIMEDOUT;
-      }
-    }
-    else if(baller->result == CURLE_WEIRD_SERVER_REPLY)
-      baller->inconclusive = TRUE;
-  }
-  return baller->result;
-}
-
-/*
- * is_connected() checks if the socket has connected.
- */
-static CURLcode is_connected(struct Curl_cfilter *cf,
-                             struct Curl_easy *data,
-                             bool *connected)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  struct connectdata *conn = cf->conn;
-  CURLcode result;
-  struct curltime now;
-  size_t i;
-  int ongoing, not_started;
-  const char *hostname;
-
-  /* Check if any of the conn->tempsock we use for establishing connections
-   * succeeded and, if so, close any ongoing other ones.
-   * Transfer the successful conn->tempsock to conn->sock[sockindex]
-   * and set conn->tempsock to CURL_SOCKET_BAD.
-   * If transport is QUIC, we need to shutdown the ongoing 'other'
-   * cot ballers in a QUIC appropriate way. */
-evaluate:
-  *connected = FALSE; /* a negative world view is best */
-  now = curlx_now();
-  ongoing = not_started = 0;
-  for(i = 0; i < CURL_ARRAYSIZE(ctx->baller); i++) {
-    struct eyeballer *baller = ctx->baller[i];
-
-    if(!baller || baller->is_done)
-      continue;
-
-    if(!baller->has_started) {
-      ++not_started;
-      continue;
-    }
-    baller->result = baller_connect(cf, data, baller, &now, connected);
-    CURL_TRC_CF(data, cf, "%s connect -> %d, connected=%d",
-                baller->name, baller->result, *connected);
-
-    if(!baller->result) {
-      if(*connected) {
-        /* connected, declare the winner */
-        ctx->winner = baller;
-        ctx->baller[i] = NULL;
-        break;
-      }
-      else { /* still waiting */
-        ++ongoing;
-      }
-    }
-    else if(!baller->is_done) {
-      /* The baller failed to connect, start its next attempt */
-      if(baller->error) {
-        data->state.os_errno = baller->error;
-        SET_SOCKERRNO(baller->error);
-      }
-      baller_start_next(cf, data, baller, Curl_timeleft(data, &now, TRUE));
-      if(baller->is_done) {
-        CURL_TRC_CF(data, cf, "%s done", baller->name);
-      }
-      else {
-        /* next attempt was started */
-        CURL_TRC_CF(data, cf, "%s trying next", baller->name);
-        ++ongoing;
-        Curl_multi_mark_dirty(data);
-      }
-    }
-  }
-
-  if(ctx->winner) {
-    *connected = TRUE;
-    return CURLE_OK;
-  }
-
-  /* Nothing connected, check the time before we might
-   * start new ballers or return ok. */
-  if((ongoing || not_started) && Curl_timeleft(data, &now, TRUE) < 0) {
-    failf(data, "Connection timeout after %" FMT_OFF_T " ms",
-          curlx_timediff(now, data->progress.t_startsingle));
-    return CURLE_OPERATION_TIMEDOUT;
-  }
-
-  /* Check if we have any waiting ballers to start now. */
-  if(not_started > 0) {
-    int added = 0;
-
-    for(i = 0; i < CURL_ARRAYSIZE(ctx->baller); i++) {
-      struct eyeballer *baller = ctx->baller[i];
-
-      if(!baller || baller->has_started)
-        continue;
-      /* We start its primary baller has failed to connect or if
-       * its start delay_ms have expired */
-      if((baller->primary && baller->primary->is_done) ||
-          curlx_timediff(now, ctx->started) >= baller->delay_ms) {
-        baller_start(cf, data, baller, Curl_timeleft(data, &now, TRUE));
-        if(baller->is_done) {
-          CURL_TRC_CF(data, cf, "%s done", baller->name);
-        }
-        else {
-          CURL_TRC_CF(data, cf, "%s starting (timeout=%" FMT_TIMEDIFF_T "ms)",
-                      baller->name, baller->timeoutms);
-          ++ongoing;
-          ++added;
-        }
-      }
-    }
-    if(added > 0)
-      goto evaluate;
-  }
-
-  if(ongoing > 0) {
-    /* We are still trying, return for more waiting */
-    *connected = FALSE;
-    return CURLE_OK;
-  }
-
-  /* all ballers have failed to connect. */
-  CURL_TRC_CF(data, cf, "all eyeballers failed");
-  result = CURLE_COULDNT_CONNECT;
-  for(i = 0; i < CURL_ARRAYSIZE(ctx->baller); i++) {
-    struct eyeballer *baller = ctx->baller[i];
-    if(!baller)
-      continue;
-    CURL_TRC_CF(data, cf, "%s assess started=%d, result=%d",
-                baller->name, baller->has_started, baller->result);
-    if(baller->has_started && baller->result) {
-      result = baller->result;
-      break;
-    }
-  }
-
-#ifndef CURL_DISABLE_PROXY
-  if(conn->bits.socksproxy)
-    hostname = conn->socks_proxy.host.name;
-  else if(conn->bits.httpproxy)
-    hostname = conn->http_proxy.host.name;
-  else
-#endif
-    if(conn->bits.conn_to_host)
-      hostname = conn->conn_to_host.name;
-  else
-    hostname = conn->host.name;
-
-  failf(data, "Failed to connect to %s port %u after "
-        "%" FMT_TIMEDIFF_T " ms: %s",
-        hostname, conn->primary.remote_port,
-        curlx_timediff(now, data->progress.t_startsingle),
-        curl_easy_strerror(result));
-
-#ifdef SOCKETIMEDOUT
-  if(SOCKETIMEDOUT == data->state.os_errno)
-    result = CURLE_OPERATION_TIMEDOUT;
-#endif
-
-  return result;
-}
-
-/*
- * Connect to the given host with timeout, proxy or remote does not matter.
- * There might be more than one IP address to try out.
- */
-static CURLcode start_connect(struct Curl_cfilter *cf,
-                              struct Curl_easy *data)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  struct connectdata *conn = cf->conn;
-  CURLcode result = CURLE_COULDNT_CONNECT;
-  int ai_family0 = 0, ai_family1 = 0;
-  timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
-  const struct Curl_addrinfo *addr0 = NULL, *addr1 = NULL;
-  struct Curl_dns_entry *dns = data->state.dns[cf->sockindex];
-
-  if(!dns)
-    return CURLE_FAILED_INIT;
-
-  if(timeout_ms < 0) {
-    /* a precaution, no need to continue if time already is up */
-    failf(data, "Connection time-out");
-    return CURLE_OPERATION_TIMEDOUT;
-  }
-
-  ctx->started = curlx_now();
-
-  /* dns->addr is the list of addresses from the resolver, each
-   * with an address family. The list has at least one entry, possibly
-   * many more.
-   * We try at most 2 at a time, until we either get a connection or
-   * run out of addresses to try. Since likelihood of success is tied
-   * to the address family (e.g. IPV6 might not work at all ), we want
-   * the 2 connect attempt ballers to try different families, if possible.
-   *
-   */
-  if(conn->ip_version == CURL_IPRESOLVE_V6) {
-#ifdef USE_IPV6
-    ai_family0 = AF_INET6;
-    addr0 = addr_first_match(dns->addr, ai_family0);
-#endif
-  }
-  else if(conn->ip_version == CURL_IPRESOLVE_V4) {
-    ai_family0 = AF_INET;
-    addr0 = addr_first_match(dns->addr, ai_family0);
-  }
-  else {
-    /* no user preference, we try ipv6 always first when available */
-#ifdef USE_IPV6
-    ai_family0 = AF_INET6;
-    addr0 = addr_first_match(dns->addr, ai_family0);
-#endif
-    /* next candidate is ipv4 */
-    ai_family1 = AF_INET;
-    addr1 = addr_first_match(dns->addr, ai_family1);
-    /* no ip address families, probably AF_UNIX or something, use the
-     * address family given to us */
-    if(!addr1 && !addr0 && dns->addr) {
-      ai_family0 = dns->addr->ai_family;
-      addr0 = addr_first_match(dns->addr, ai_family0);
-    }
-  }
-
-  if(!addr0 && addr1) {
-    /* switch around, so a single baller always uses addr0 */
-    addr0 = addr1;
-    ai_family0 = ai_family1;
-    addr1 = NULL;
-  }
-
-  /* We found no address that matches our criteria, we cannot connect */
-  if(!addr0) {
-    return CURLE_COULDNT_CONNECT;
-  }
-
-  memset(ctx->baller, 0, sizeof(ctx->baller));
-  result = eyeballer_new(&ctx->baller[0], ctx->cf_create, addr0, ai_family0,
-                          NULL, 0, /* no primary/delay, start now */
-                          timeout_ms,  EXPIRE_DNS_PER_NAME);
-  if(result)
-    return result;
-  CURL_TRC_CF(data, cf, "created %s (timeout %" FMT_TIMEDIFF_T "ms)",
-              ctx->baller[0]->name, ctx->baller[0]->timeoutms);
-  if(addr1) {
-    /* second one gets a delayed start */
-    result = eyeballer_new(&ctx->baller[1], ctx->cf_create, addr1, ai_family1,
-                            ctx->baller[0], /* wait on that to fail */
-                            /* or start this delayed */
-                            data->set.happy_eyeballs_timeout,
-                            timeout_ms,  EXPIRE_DNS_PER_NAME2);
-    if(result)
-      return result;
-    CURL_TRC_CF(data, cf, "created %s (timeout %" FMT_TIMEDIFF_T "ms)",
-                ctx->baller[1]->name, ctx->baller[1]->timeoutms);
-    Curl_expire(data, data->set.happy_eyeballs_timeout,
-                EXPIRE_HAPPY_EYEBALLS);
-  }
-
-  return CURLE_OK;
-}
-
-static void cf_he_ctx_clear(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  size_t i;
-
-  DEBUGASSERT(ctx);
-  DEBUGASSERT(data);
-  for(i = 0; i < CURL_ARRAYSIZE(ctx->baller); i++) {
-    baller_free(ctx->baller[i], data);
-    ctx->baller[i] = NULL;
-  }
-  baller_free(ctx->winner, data);
-  ctx->winner = NULL;
-}
-
-static CURLcode cf_he_shutdown(struct Curl_cfilter *cf,
-                               struct Curl_easy *data, bool *done)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  size_t i;
-  CURLcode result = CURLE_OK;
-
-  DEBUGASSERT(data);
-  if(cf->connected) {
-    *done = TRUE;
-    return CURLE_OK;
-  }
-
-  /* shutdown all ballers that have not done so already. If one fails,
-   * continue shutting down others until all are shutdown. */
-  for(i = 0; i < CURL_ARRAYSIZE(ctx->baller); i++) {
-    struct eyeballer *baller = ctx->baller[i];
-    bool bdone = FALSE;
-    if(!baller || !baller->cf || baller->shutdown)
-      continue;
-    baller->result = baller->cf->cft->do_shutdown(baller->cf, data, &bdone);
-    if(baller->result || bdone)
-      baller->shutdown = TRUE; /* treat a failed shutdown as done */
-  }
-
-  *done = TRUE;
-  for(i = 0; i < CURL_ARRAYSIZE(ctx->baller); i++) {
-    if(ctx->baller[i] && !ctx->baller[i]->shutdown)
-      *done = FALSE;
-  }
-  if(*done) {
-    for(i = 0; i < CURL_ARRAYSIZE(ctx->baller); i++) {
-      if(ctx->baller[i] && ctx->baller[i]->result)
-        result = ctx->baller[i]->result;
-    }
-  }
-  CURL_TRC_CF(data, cf, "shutdown -> %d, done=%d", result, *done);
-  return result;
-}
-
-static void cf_he_adjust_pollset(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 struct easy_pollset *ps)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  size_t i;
-
-  if(!cf->connected) {
-    for(i = 0; i < CURL_ARRAYSIZE(ctx->baller); i++) {
-      struct eyeballer *baller = ctx->baller[i];
-      if(!baller || !baller->cf)
-        continue;
-      Curl_conn_cf_adjust_pollset(baller->cf, data, ps);
-    }
-    CURL_TRC_CF(data, cf, "adjust_pollset -> %d socks", ps->num);
-  }
-}
-
-static CURLcode cf_he_connect(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              bool *done)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  CURLcode result = CURLE_OK;
-
-  if(cf->connected) {
-    *done = TRUE;
-    return CURLE_OK;
-  }
-
-  DEBUGASSERT(ctx);
-  *done = FALSE;
-
-  switch(ctx->state) {
-    case SCFST_INIT:
-      DEBUGASSERT(CURL_SOCKET_BAD == Curl_conn_cf_get_socket(cf, data));
-      DEBUGASSERT(!cf->connected);
-      result = start_connect(cf, data);
-      if(result)
-        return result;
-      ctx->state = SCFST_WAITING;
-      FALLTHROUGH();
-    case SCFST_WAITING:
-      result = is_connected(cf, data, done);
-      if(!result && *done) {
-        DEBUGASSERT(ctx->winner);
-        DEBUGASSERT(ctx->winner->cf);
-        DEBUGASSERT(ctx->winner->cf->connected);
-        /* we have a winner. Install and activate it.
-         * close/free all others. */
-        ctx->state = SCFST_DONE;
-        cf->connected = TRUE;
-        cf->next = ctx->winner->cf;
-        ctx->winner->cf = NULL;
-        cf_he_ctx_clear(cf, data);
-
-        if(cf->conn->handler->protocol & PROTO_FAMILY_SSH)
-          Curl_pgrsTime(data, TIMER_APPCONNECT); /* we are connected already */
-        if(Curl_trc_cf_is_verbose(cf, data)) {
-          struct ip_quadruple ipquad;
-          int is_ipv6;
-          if(!Curl_conn_cf_get_ip_info(cf->next, data, &is_ipv6, &ipquad)) {
-            const char *host;
-            int port;
-            Curl_conn_get_current_host(data, cf->sockindex, &host, &port);
-            CURL_TRC_CF(data, cf, "Connected to %s (%s) port %u",
-                        host, ipquad.remote_ip, ipquad.remote_port);
-          }
-        }
-        data->info.numconnects++; /* to track the # of connections made */
-      }
-      break;
-    case SCFST_DONE:
-      *done = TRUE;
-      break;
-  }
-  return result;
-}
-
-static void cf_he_close(struct Curl_cfilter *cf,
-                        struct Curl_easy *data)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-
-  CURL_TRC_CF(data, cf, "close");
-  cf_he_ctx_clear(cf, data);
-  cf->connected = FALSE;
-  ctx->state = SCFST_INIT;
-
-  if(cf->next) {
-    cf->next->cft->do_close(cf->next, data);
-    Curl_conn_cf_discard_chain(&cf->next, data);
-  }
-}
-
-static bool cf_he_data_pending(struct Curl_cfilter *cf,
-                               const struct Curl_easy *data)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  size_t i;
-
-  if(cf->connected)
-    return cf->next->cft->has_data_pending(cf->next, data);
-
-  for(i = 0; i < CURL_ARRAYSIZE(ctx->baller); i++) {
-    struct eyeballer *baller = ctx->baller[i];
-    if(!baller || !baller->cf)
-      continue;
-    if(baller->cf->cft->has_data_pending(baller->cf, data))
-      return TRUE;
-  }
-  return FALSE;
-}
-
-static struct curltime get_max_baller_time(struct Curl_cfilter *cf,
-                                           struct Curl_easy *data,
-                                           int query)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-  struct curltime t, tmax;
-  size_t i;
-
-  memset(&tmax, 0, sizeof(tmax));
-  for(i = 0; i < CURL_ARRAYSIZE(ctx->baller); i++) {
-    struct eyeballer *baller = ctx->baller[i];
-
-    memset(&t, 0, sizeof(t));
-    if(baller && baller->cf &&
-       !baller->cf->cft->query(baller->cf, data, query, NULL, &t)) {
-      if((t.tv_sec || t.tv_usec) && curlx_timediff_us(t, tmax) > 0)
-        tmax = t;
-    }
-  }
-  return tmax;
-}
-
-static CURLcode cf_he_query(struct Curl_cfilter *cf,
-                            struct Curl_easy *data,
-                            int query, int *pres1, void *pres2)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-
-  if(!cf->connected) {
-    switch(query) {
-    case CF_QUERY_CONNECT_REPLY_MS: {
-      int reply_ms = -1;
-      size_t i;
-
-      for(i = 0; i < CURL_ARRAYSIZE(ctx->baller); i++) {
-        struct eyeballer *baller = ctx->baller[i];
-        int breply_ms;
-
-        if(baller && baller->cf &&
-           !baller->cf->cft->query(baller->cf, data, query,
-                                   &breply_ms, NULL)) {
-          if(breply_ms >= 0 && (reply_ms < 0 || breply_ms < reply_ms))
-            reply_ms = breply_ms;
-        }
-      }
-      *pres1 = reply_ms;
-      CURL_TRC_CF(data, cf, "query connect reply: %dms", *pres1);
-      return CURLE_OK;
-    }
-    case CF_QUERY_TIMER_CONNECT: {
-      struct curltime *when = pres2;
-      *when = get_max_baller_time(cf, data, CF_QUERY_TIMER_CONNECT);
-      return CURLE_OK;
-    }
-    case CF_QUERY_TIMER_APPCONNECT: {
-      struct curltime *when = pres2;
-      *when = get_max_baller_time(cf, data, CF_QUERY_TIMER_APPCONNECT);
-      return CURLE_OK;
-    }
-    default:
-      break;
-    }
-  }
-
-  return cf->next ?
-    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
-    CURLE_UNKNOWN_OPTION;
-}
-
-static void cf_he_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_he_ctx *ctx = cf->ctx;
-
-  CURL_TRC_CF(data, cf, "destroy");
-  if(ctx) {
-    cf_he_ctx_clear(cf, data);
-  }
-  /* release any resources held in state */
-  Curl_safefree(ctx);
-}
-
-struct Curl_cftype Curl_cft_happy_eyeballs = {
-  "HAPPY-EYEBALLS",
-  0,
-  CURL_LOG_LVL_NONE,
-  cf_he_destroy,
-  cf_he_connect,
-  cf_he_close,
-  cf_he_shutdown,
-  cf_he_adjust_pollset,
-  cf_he_data_pending,
-  Curl_cf_def_send,
-  Curl_cf_def_recv,
-  Curl_cf_def_cntrl,
-  Curl_cf_def_conn_is_alive,
-  Curl_cf_def_conn_keep_alive,
-  cf_he_query,
-};
-
-/**
- * Create a happy eyeball connection filter that uses the, once resolved,
- * address information to connect on ip families based on connection
- * configuration.
- * @param pcf        output, the created cfilter
- * @param data       easy handle used in creation
- * @param conn       connection the filter is created for
- * @param cf_create  method to create the sub-filters performing the
- *                   actual connects.
- */
-static CURLcode
-cf_happy_eyeballs_create(struct Curl_cfilter **pcf,
-                         struct Curl_easy *data,
-                         struct connectdata *conn,
-                         cf_ip_connect_create *cf_create,
-                         int transport)
-{
-  struct cf_he_ctx *ctx = NULL;
-  CURLcode result;
-
-  (void)data;
-  (void)conn;
-  *pcf = NULL;
-  ctx = calloc(1, sizeof(*ctx));
-  if(!ctx) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto out;
-  }
-  ctx->transport = transport;
-  ctx->cf_create = cf_create;
-
-  result = Curl_cf_create(pcf, &Curl_cft_happy_eyeballs, ctx);
-
-out:
-  if(result) {
-    Curl_safefree(*pcf);
-    free(ctx);
-  }
-  return result;
-}
-
-struct transport_provider {
-  int transport;
-  cf_ip_connect_create *cf_create;
-};
-
-static
-#ifndef UNITTESTS
-const
-#endif
-struct transport_provider transport_providers[] = {
-  { TRNSPRT_TCP, Curl_cf_tcp_create },
-#ifdef USE_HTTP3
-  { TRNSPRT_QUIC, Curl_cf_quic_create },
-#endif
-#ifndef CURL_DISABLE_TFTP
-  { TRNSPRT_UDP, Curl_cf_udp_create },
-#endif
-#ifdef USE_UNIX_SOCKETS
-  { TRNSPRT_UNIX, Curl_cf_unix_create },
-#endif
-};
-
-static cf_ip_connect_create *get_cf_create(int transport)
-{
-  size_t i;
-  for(i = 0; i < CURL_ARRAYSIZE(transport_providers); ++i) {
-    if(transport == transport_providers[i].transport)
-      return transport_providers[i].cf_create;
-  }
-  return NULL;
-}
-
-static CURLcode cf_he_insert_after(struct Curl_cfilter *cf_at,
-                                   struct Curl_easy *data,
-                                   int transport)
-{
-  cf_ip_connect_create *cf_create;
-  struct Curl_cfilter *cf;
-  CURLcode result;
-
-  /* Need to be first */
-  DEBUGASSERT(cf_at);
-  cf_create = get_cf_create(transport);
-  if(!cf_create) {
-    CURL_TRC_CF(data, cf_at, "unsupported transport type %d", transport);
-    return CURLE_UNSUPPORTED_PROTOCOL;
-  }
-  result = cf_happy_eyeballs_create(&cf, data, cf_at->conn,
-                                    cf_create, transport);
-  if(result)
-    return result;
-
-  Curl_conn_cf_insert_after(cf_at, cf);
-  return CURLE_OK;
-}
-
 typedef enum {
   CF_SETUP_INIT,
   CF_SETUP_CNNCT_EYEBALLS,
@@ -1281,7 +390,7 @@ static CURLcode cf_setup_connect(struct Curl_cfilter *cf,
   }
 
   if(ctx->state < CF_SETUP_CNNCT_EYEBALLS) {
-    result = cf_he_insert_after(cf, data, ctx->transport);
+    result = cf_ip_happy_insert_after(cf, data, ctx->transport);
     if(result)
       return result;
     ctx->state = CF_SETUP_CNNCT_EYEBALLS;
@@ -1310,7 +419,7 @@ static CURLcode cf_setup_connect(struct Curl_cfilter *cf,
     }
 #endif /* USE_SSL */
 
-#if !defined(CURL_DISABLE_HTTP)
+#ifndef CURL_DISABLE_HTTP
     if(cf->conn->bits.tunnel_proxy) {
       result = Curl_cf_http_proxy_insert_after(cf, data);
       if(result)
@@ -1324,7 +433,7 @@ static CURLcode cf_setup_connect(struct Curl_cfilter *cf,
 #endif /* !CURL_DISABLE_PROXY */
 
   if(ctx->state < CF_SETUP_CNNCT_HAPROXY) {
-#if !defined(CURL_DISABLE_PROXY)
+#ifndef CURL_DISABLE_PROXY
     if(data->set.haproxyprotocol) {
       if(Curl_conn_is_ssl(cf->conn, cf->sockindex)) {
         failf(data, "haproxy protocol not support with SSL "
@@ -1456,21 +565,6 @@ static CURLcode cf_setup_add(struct Curl_easy *data,
   return result;
 }
 
-#ifdef UNITTESTS
-/* used by unit2600.c */
-void Curl_debug_set_transport_provider(int transport,
-                                       cf_ip_connect_create *cf_create)
-{
-  size_t i;
-  for(i = 0; i < CURL_ARRAYSIZE(transport_providers); ++i) {
-    if(transport == transport_providers[i].transport) {
-      transport_providers[i].cf_create = cf_create;
-      return;
-    }
-  }
-}
-#endif /* UNITTESTS */
-
 CURLcode Curl_cf_setup_insert_after(struct Curl_cfilter *cf_at,
                                     struct Curl_easy *data,
                                     int transport,
@@ -1503,7 +597,7 @@ CURLcode Curl_conn_setup(struct Curl_easy *data,
   Curl_resolv_unlink(data, &data->state.dns[sockindex]);
   data->state.dns[sockindex] = dns;
 
-#if !defined(CURL_DISABLE_HTTP)
+#ifndef CURL_DISABLE_HTTP
   if(!conn->cfilter[sockindex] &&
      conn->handler->protocol == CURLPROTO_HTTPS) {
     DEBUGASSERT(ssl_mode != CURL_CF_SSL_DISABLE);
@@ -1511,7 +605,7 @@ CURLcode Curl_conn_setup(struct Curl_easy *data,
     if(result)
       goto out;
   }
-#endif /* !defined(CURL_DISABLE_HTTP) */
+#endif /* !CURL_DISABLE_HTTP */
 
   /* Still no cfilter set, apply default. */
   if(!conn->cfilter[sockindex]) {
diff --git a/deps/curl/lib/connect.h b/deps/curl/lib/connect.h
index 120338eb99f..6a2487ff538 100644
--- a/deps/curl/lib/connect.h
+++ b/deps/curl/lib/connect.h
@@ -107,23 +107,6 @@ void Curl_conncontrol(struct connectdata *conn,
 #define connkeep(x,y) Curl_conncontrol(x, CONNCTRL_KEEP)
 #endif
 
-/**
- * Create a cfilter for making an "ip" connection to the
- * given address, using parameters from `conn`. The "ip" connection
- * can be a TCP socket, a UDP socket or even a QUIC connection.
- *
- * It MUST use only the supplied `ai` for its connection attempt.
- *
- * Such a filter may be used in "happy eyeball" scenarios, and its
- * `connect` implementation needs to support non-blocking. Once connected,
- * it MAY be installed in the connection filter chain to serve transfers.
- */
-typedef CURLcode cf_ip_connect_create(struct Curl_cfilter **pcf,
-                                      struct Curl_easy *data,
-                                      struct connectdata *conn,
-                                      const struct Curl_addrinfo *ai,
-                                      int transport);
-
 CURLcode Curl_cf_setup_insert_after(struct Curl_cfilter *cf_at,
                                     struct Curl_easy *data,
                                     int transport,
@@ -140,12 +123,6 @@ CURLcode Curl_conn_setup(struct Curl_easy *data,
                          struct Curl_dns_entry *dns,
                          int ssl_mode);
 
-extern struct Curl_cftype Curl_cft_happy_eyeballs;
 extern struct Curl_cftype Curl_cft_setup;
 
-#ifdef UNITTESTS
-void Curl_debug_set_transport_provider(int transport,
-                                       cf_ip_connect_create *cf_create);
-#endif
-
 #endif /* HEADER_CURL_CONNECT_H */
diff --git a/deps/curl/lib/content_encoding.c b/deps/curl/lib/content_encoding.c
index 9ea4a047c88..3a0549c4b1a 100644
--- a/deps/curl/lib/content_encoding.c
+++ b/deps/curl/lib/content_encoding.c
@@ -96,7 +96,7 @@ struct zlib_writer {
 static voidpf
 zalloc_cb(voidpf opaque, unsigned int items, unsigned int size)
 {
-  (void) opaque;
+  (void)opaque;
   /* not a typo, keep it calloc() */
   return (voidpf) calloc(items, size);
 }
@@ -104,7 +104,7 @@ zalloc_cb(voidpf opaque, unsigned int items, unsigned int size)
 static void
 zfree_cb(voidpf opaque, voidpf ptr)
 {
-  (void) opaque;
+  (void)opaque;
   free(ptr);
 }
 
@@ -411,7 +411,7 @@ static CURLcode brotli_do_init(struct Curl_easy *data,
                                struct Curl_cwriter *writer)
 {
   struct brotli_writer *bp = (struct brotli_writer *) writer;
-  (void) data;
+  (void)data;
 
   bp->br = BrotliDecoderCreateInstance(NULL, NULL, NULL);
   return bp->br ? CURLE_OK : CURLE_OUT_OF_MEMORY;
@@ -466,7 +466,7 @@ static void brotli_do_close(struct Curl_easy *data,
                             struct Curl_cwriter *writer)
 {
   struct brotli_writer *bp = (struct brotli_writer *) writer;
-  (void) data;
+  (void)data;
 
   if(bp->br) {
     BrotliDecoderDestroyInstance(bp->br);
@@ -671,9 +671,9 @@ static CURLcode error_do_write(struct Curl_easy *data,
                                struct Curl_cwriter *writer, int type,
                                const char *buf, size_t nbytes)
 {
-  (void) writer;
-  (void) buf;
-  (void) nbytes;
+  (void)writer;
+  (void)buf;
+  (void)nbytes;
 
   if(!(type & CLIENTWRITE_BODY) || !nbytes)
     return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
@@ -689,8 +689,8 @@ static CURLcode error_do_write(struct Curl_easy *data,
 static void error_do_close(struct Curl_easy *data,
                            struct Curl_cwriter *writer)
 {
-  (void) data;
-  (void) writer;
+  (void)data;
+  (void)writer;
 }
 
 static const struct Curl_cwtype error_writer = {
@@ -843,9 +843,9 @@ CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
 CURLcode Curl_build_unencoding_stack(struct Curl_easy *data,
                                      const char *enclist, int is_transfer)
 {
-  (void) data;
-  (void) enclist;
-  (void) is_transfer;
+  (void)data;
+  (void)enclist;
+  (void)is_transfer;
   return CURLE_NOT_BUILT_IN;
 }
 
diff --git a/deps/curl/lib/cookie.c b/deps/curl/lib/cookie.c
index 9221871e4b4..35d33268f96 100644
--- a/deps/curl/lib/cookie.c
+++ b/deps/curl/lib/cookie.c
@@ -107,7 +107,7 @@ static void strstore(char **str, const char *newstr, size_t len);
 */
 static void cap_expires(time_t now, struct Cookie *co)
 {
-  if((TIME_T_MAX - COOKIES_MAXAGE - 30) > now) {
+  if(co->expires && (TIME_T_MAX - COOKIES_MAXAGE - 30) > now) {
     timediff_t cap = now + COOKIES_MAXAGE;
     if(co->expires > cap) {
       cap += 30;
@@ -167,13 +167,13 @@ static bool pathmatch(const char *cookie_path, const char *uri_path)
 
   /* cookie_path must not have last '/' separator. ex: /sample */
   cookie_path_len = strlen(cookie_path);
-  if(1 == cookie_path_len) {
+  if(cookie_path_len == 1) {
     /* cookie_path must be '/' */
     return TRUE;
   }
 
   /* #-fragments are already cut off! */
-  if(0 == strlen(uri_path) || uri_path[0] != '/')
+  if(strlen(uri_path) == 0 || uri_path[0] != '/')
     uri_path = "/";
 
   /*
@@ -296,9 +296,9 @@ static char *sanitize_cookie_path(const char *cookie_path)
     /* Let cookie-path be the default-path. */
     return strdup("/");
 
-  /* remove trailing slash */
+  /* remove trailing slash when path is non-empty */
   /* convert /hoge/ to /hoge */
-  if(len && cookie_path[len - 1] == '/')
+  if(len > 1 && cookie_path[len - 1] == '/')
     len--;
 
   return Curl_memdup0(cookie_path, len);
@@ -388,17 +388,17 @@ static void remove_expired(struct CookieInfo *ci)
     for(n = Curl_llist_head(&ci->cookielist[i]); n; n = e) {
       co = Curl_node_elem(n);
       e = Curl_node_next(n);
-      if(co->expires && co->expires < now) {
-        Curl_node_remove(n);
-        freecookie(co);
-        ci->numcookies--;
-      }
-      else {
-        /*
-         * If this cookie has an expiration timestamp earlier than what we
-         * have seen so far then record it for the next round of expirations.
-         */
-        if(co->expires && co->expires < ci->next_expiration)
+      if(co->expires) {
+        if(co->expires < now) {
+          Curl_node_remove(n);
+          freecookie(co);
+          ci->numcookies--;
+        }
+        else if(co->expires < ci->next_expiration)
+          /*
+           * If this cookie has an expiration timestamp earlier than what we
+           * have seen so far then record it for the next round of expirations.
+           */
           ci->next_expiration = co->expires;
       }
     }
@@ -666,7 +666,6 @@ parse_cookie_header(struct Curl_easy *data,
         if(*maxage == '\"')
           maxage++;
         rc = curlx_str_number(&maxage, &co->expires, CURL_OFF_T_MAX);
-
         switch(rc) {
         case STRE_OVERFLOW:
           /* overflow, used max value */
@@ -678,8 +677,7 @@ parse_cookie_header(struct Curl_easy *data,
           break;
         case STRE_OK:
           if(!co->expires)
-            /* already expired */
-            co->expires = 1;
+            co->expires = 1; /* expire now */
           else if(CURL_OFF_T_MAX - now < co->expires)
             /* would overflow */
             co->expires = CURL_OFF_T_MAX;
@@ -698,18 +696,15 @@ parse_cookie_header(struct Curl_easy *data,
            * will be treated as a session cookie
            */
           char dbuf[MAX_DATE_LENGTH + 1];
+          time_t date = 0;
           memcpy(dbuf, curlx_str(&val), curlx_strlen(&val));
           dbuf[curlx_strlen(&val)] = 0;
-          co->expires = Curl_getdate_capped(dbuf);
-
-          /*
-           * Session cookies have expires set to 0 so if we get that back
-           * from the date parser let's add a second to make it a
-           * non-session cookie
-           */
-          if(co->expires == 0)
-            co->expires = 1;
-          else if(co->expires < 0)
+          if(!Curl_getdate_capped(dbuf, &date)) {
+            if(!date)
+              date++;
+            co->expires = (curl_off_t)date;
+          }
+          else
             co->expires = 0;
           cap_expires(now, co);
         }
@@ -872,7 +867,7 @@ parse_netscape(struct Cookie *co,
       break;
     }
   }
-  if(6 == fields) {
+  if(fields == 6) {
     /* we got a cookie with blank contents, fix it */
     co->value = strdup("");
     if(!co->value)
@@ -881,7 +876,7 @@ parse_netscape(struct Cookie *co,
       fields++;
   }
 
-  if(7 != fields)
+  if(fields != 7)
     /* we did not find the sufficient number of fields */
     return CERR_FIELDS;
 
@@ -965,7 +960,7 @@ replace_existing(struct Curl_easy *data,
          clist->spath && co->spath && /* both have paths */
          clist->secure && !co->secure && !secure) {
         size_t cllen;
-        const char *sep;
+        const char *sep = NULL;
 
         /*
          * A non-secure cookie may not overlay an existing secure cookie.
@@ -974,8 +969,9 @@ replace_existing(struct Curl_easy *data,
          * "/loginhelper" is ok.
          */
 
-        sep = strchr(clist->spath + 1, '/');
-
+        DEBUGASSERT(clist->spath[0]);
+        if(clist->spath[0])
+          sep = strchr(clist->spath + 1, '/');
         if(sep)
           cllen = sep - clist->spath;
         else
@@ -1102,7 +1098,7 @@ Curl_cookie_add(struct Curl_easy *data,
 
   if(!ci->running &&    /* read from a file */
      ci->newsession &&  /* clean session cookies */
-     !co->expires)      /* this is a session cookie since it does not expire */
+     !co->expires)      /* this is a session cookie */
     goto fail;
 
   co->livecookie = ci->running;
@@ -1293,6 +1289,14 @@ static int cookie_sort_ct(const void *p1, const void *p2)
   return (c2->creationtime > c1->creationtime) ? 1 : -1;
 }
 
+bool Curl_secure_context(struct connectdata *conn, const char *host)
+{
+  return conn->handler->protocol&(CURLPROTO_HTTPS|CURLPROTO_WSS) ||
+    curl_strequal("localhost", host) ||
+    !strcmp(host, "127.0.0.1") ||
+    !strcmp(host, "::1");
+}
+
 /*
  * Curl_cookie_getlist
  *
@@ -1305,15 +1309,17 @@ static int cookie_sort_ct(const void *p1, const void *p2)
  * Returns 0 when there is a list returned. Otherwise non-zero.
  */
 int Curl_cookie_getlist(struct Curl_easy *data,
-                        struct CookieInfo *ci,
-                        const char *host, const char *path,
-                        bool secure,
+                        struct connectdata *conn,
+                        const char *host,
                         struct Curl_llist *list)
 {
   size_t matches = 0;
-  bool is_ip;
+  const bool is_ip = Curl_host_is_ipnum(host);
   const size_t myhash = cookiehash(host);
   struct Curl_llist_node *n;
+  const bool secure = Curl_secure_context(conn, host);
+  struct CookieInfo *ci = data->cookies;
+  const char *path = data->state.up.path;
 
   Curl_llist_init(list, NULL);
 
@@ -1323,9 +1329,6 @@ int Curl_cookie_getlist(struct Curl_easy *data,
   /* at first, remove expired cookies */
   remove_expired(ci);
 
-  /* check if host is an IP(v4|v6) address */
-  is_ip = Curl_host_is_ipnum(host);
-
   for(n = Curl_llist_head(&ci->cookielist[myhash]);
       n; n = Curl_node_next(n)) {
     struct Cookie *co = Curl_node_elem(n);
@@ -1614,6 +1617,9 @@ static struct curl_slist *cookie_list(struct Curl_easy *data)
   if(!data->cookies || (data->cookies->numcookies == 0))
     return NULL;
 
+  /* at first, remove expired cookies */
+  remove_expired(data->cookies);
+
   for(i = 0; i < COOKIE_HASH_SIZE; i++) {
     for(n = Curl_llist_head(&data->cookies->cookielist[i]); n;
         n = Curl_node_next(n)) {
diff --git a/deps/curl/lib/cookie.h b/deps/curl/lib/cookie.h
index 7af65073cd9..99aa20af7c4 100644
--- a/deps/curl/lib/cookie.h
+++ b/deps/curl/lib/cookie.h
@@ -105,21 +105,21 @@ struct CookieInfo {
 #define MAX_COOKIE_SEND_AMOUNT 150
 
 struct Curl_easy;
+struct connectdata;
+
 /*
  * Add a cookie to the internal list of cookies. The domain and path arguments
  * are only used if the header boolean is TRUE.
  */
 
+bool Curl_secure_context(struct connectdata *conn, const char *host);
 struct Cookie *Curl_cookie_add(struct Curl_easy *data,
                                struct CookieInfo *c, bool header,
                                bool noexpiry, const char *lineptr,
                                const char *domain, const char *path,
                                bool secure);
-
-int Curl_cookie_getlist(struct Curl_easy *data,
-                        struct CookieInfo *c, const char *host,
-                        const char *path, bool secure,
-                        struct Curl_llist *list);
+int Curl_cookie_getlist(struct Curl_easy *data, struct connectdata *conn,
+                        const char *host, struct Curl_llist *list);
 void Curl_cookie_clearall(struct CookieInfo *cookies);
 void Curl_cookie_clearsess(struct CookieInfo *cookies);
 
diff --git a/deps/curl/lib/cshutdn.c b/deps/curl/lib/cshutdn.c
index c8b40dc3218..1c144c6025f 100644
--- a/deps/curl/lib/cshutdn.c
+++ b/deps/curl/lib/cshutdn.c
@@ -486,19 +486,25 @@ void Curl_cshutdn_setfds(struct cshutdn *cshutdn,
 {
   if(Curl_llist_head(&cshutdn->list)) {
     struct Curl_llist_node *e;
+    struct easy_pollset ps;
 
+    Curl_pollset_init(&ps);
     for(e = Curl_llist_head(&cshutdn->list); e;
         e = Curl_node_next(e)) {
-      struct easy_pollset ps;
       unsigned int i;
       struct connectdata *conn = Curl_node_elem(e);
-      memset(&ps, 0, sizeof(ps));
+      CURLcode result;
+
+      Curl_pollset_reset(&ps);
       Curl_attach_connection(data, conn);
-      Curl_conn_adjust_pollset(data, conn, &ps);
+      result = Curl_conn_adjust_pollset(data, conn, &ps);
       Curl_detach_connection(data);
 
-      for(i = 0; i < ps.num; i++) {
-#if defined(__DJGPP__)
+      if(result)
+        continue;
+
+      for(i = 0; i < ps.n; i++) {
+#ifdef __DJGPP__
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Warith-conversion"
 #endif
@@ -506,7 +512,7 @@ void Curl_cshutdn_setfds(struct cshutdn *cshutdn,
           FD_SET(ps.sockets[i], read_fd_set);
         if(ps.actions[i] & CURL_POLL_OUT)
           FD_SET(ps.sockets[i], write_fd_set);
-#if defined(__DJGPP__)
+#ifdef __DJGPP__
 #pragma GCC diagnostic pop
 #endif
         if((ps.actions[i] & (CURL_POLL_OUT | CURL_POLL_IN)) &&
@@ -514,6 +520,7 @@ void Curl_cshutdn_setfds(struct cshutdn *cshutdn,
           *maxfd = (int)ps.sockets[i];
       }
     }
+    Curl_pollset_cleanup(&ps);
   }
 }
 
@@ -528,17 +535,21 @@ unsigned int Curl_cshutdn_add_waitfds(struct cshutdn *cshutdn,
     struct Curl_llist_node *e;
     struct easy_pollset ps;
     struct connectdata *conn;
+    CURLcode result;
 
+    Curl_pollset_init(&ps);
     for(e = Curl_llist_head(&cshutdn->list); e;
         e = Curl_node_next(e)) {
       conn = Curl_node_elem(e);
-      memset(&ps, 0, sizeof(ps));
+      Curl_pollset_reset(&ps);
       Curl_attach_connection(data, conn);
-      Curl_conn_adjust_pollset(data, conn, &ps);
+      result = Curl_conn_adjust_pollset(data, conn, &ps);
       Curl_detach_connection(data);
 
-      need += Curl_waitfds_add_ps(cwfds, &ps);
+      if(!result)
+        need += Curl_waitfds_add_ps(cwfds, &ps);
     }
+    Curl_pollset_cleanup(&ps);
   }
   return need;
 }
@@ -554,20 +565,24 @@ CURLcode Curl_cshutdn_add_pollfds(struct cshutdn *cshutdn,
     struct easy_pollset ps;
     struct connectdata *conn;
 
+    Curl_pollset_init(&ps);
     for(e = Curl_llist_head(&cshutdn->list); e;
         e = Curl_node_next(e)) {
       conn = Curl_node_elem(e);
-      memset(&ps, 0, sizeof(ps));
+      Curl_pollset_reset(&ps);
       Curl_attach_connection(data, conn);
-      Curl_conn_adjust_pollset(data, conn, &ps);
+      result = Curl_conn_adjust_pollset(data, conn, &ps);
       Curl_detach_connection(data);
 
-      result = Curl_pollfds_add_ps(cpfds, &ps);
+      if(!result)
+        result = Curl_pollfds_add_ps(cpfds, &ps);
       if(result) {
+        Curl_pollset_cleanup(&ps);
         Curl_pollfds_cleanup(cpfds);
         goto out;
       }
     }
+    Curl_pollset_cleanup(&ps);
   }
 out:
   return result;
diff --git a/deps/curl/lib/curl_addrinfo.c b/deps/curl/lib/curl_addrinfo.c
index b131c747b10..22212ac86f8 100644
--- a/deps/curl/lib/curl_addrinfo.c
+++ b/deps/curl/lib/curl_addrinfo.c
@@ -68,7 +68,7 @@
  */
 
 #if defined(__INTEL_COMPILER) && (__INTEL_COMPILER == 910) && \
-    defined(__OPTIMIZE__) && defined(__unix__) &&  defined(__i386__)
+  defined(__OPTIMIZE__) && defined(__unix__) &&  defined(__i386__)
   /* workaround icc 9.1 optimizer issue */
 # define vqualifier volatile
 #else
@@ -398,11 +398,7 @@ Curl_ip2addr(int af, const void *inaddr, const char *hostname, int port)
     addr = (void *)ai->ai_addr; /* storage area for this info */
 
     memcpy(&addr->sin_addr, inaddr, sizeof(struct in_addr));
-#ifdef __MINGW32__
-    addr->sin_family = (short)af;
-#else
     addr->sin_family = (CURL_SA_FAMILY_T)af;
-#endif
     addr->sin_port = htons((unsigned short)port);
     break;
 
@@ -411,11 +407,7 @@ Curl_ip2addr(int af, const void *inaddr, const char *hostname, int port)
     addr6 = (void *)ai->ai_addr; /* storage area for this info */
 
     memcpy(&addr6->sin6_addr, inaddr, sizeof(struct in6_addr));
-#ifdef __MINGW32__
-    addr6->sin6_family = (short)af;
-#else
     addr6->sin6_family = (CURL_SA_FAMILY_T)af;
-#endif
     addr6->sin6_port = htons((unsigned short)port);
     break;
 #endif
@@ -521,7 +513,7 @@ curl_dbg_freeaddrinfo(struct addrinfo *freethis,
   freeaddrinfo(freethis);
 #endif
 }
-#endif /* defined(CURLDEBUG) && defined(HAVE_FREEADDRINFO) */
+#endif /* CURLDEBUG && HAVE_FREEADDRINFO */
 
 
 #if defined(CURLDEBUG) && defined(HAVE_GETADDRINFO)
@@ -552,7 +544,7 @@ curl_dbg_getaddrinfo(const char *hostname,
 #else
   int res = getaddrinfo(hostname, service, hints, result);
 #endif
-  if(0 == res)
+  if(res == 0)
     /* success */
     curl_dbg_log("ADDR %s:%d getaddrinfo() = %p\n",
                  source, line, (void *)*result);
@@ -561,7 +553,7 @@ curl_dbg_getaddrinfo(const char *hostname,
                  source, line);
   return res;
 }
-#endif /* defined(CURLDEBUG) && defined(HAVE_GETADDRINFO) */
+#endif /* CURLDEBUG && HAVE_GETADDRINFO */
 
 #if defined(HAVE_GETADDRINFO) && defined(USE_RESOLVE_ON_IPS)
 /*
diff --git a/deps/curl/lib/curl_config.h.cmake b/deps/curl/lib/curl_config.h.cmake
index 0838ddccfba..ca516710e42 100644
--- a/deps/curl/lib/curl_config.h.cmake
+++ b/deps/curl/lib/curl_config.h.cmake
@@ -336,9 +336,6 @@
 /* Define to 1 if symbol `sa_family_t' exists */
 #cmakedefine HAVE_SA_FAMILY_T 1
 
-/* Define to 1 if symbol `ADDRESS_FAMILY' exists */
-#cmakedefine HAVE_ADDRESS_FAMILY 1
-
 /* Define to 1 if you have the ioctlsocket function. */
 #cmakedefine HAVE_IOCTLSOCKET 1
 
@@ -761,9 +758,6 @@ ${SIZEOF_TIME_T_CODE}
 /* Define to 1 if you have the quiche_conn_set_qlog_fd function. */
 #cmakedefine HAVE_QUICHE_CONN_SET_QLOG_FD 1
 
-/* to enable msh3 */
-#cmakedefine USE_MSH3 1
-
 /* if Unix domain sockets are enabled  */
 #cmakedefine USE_UNIX_SOCKETS 1
 
diff --git a/deps/curl/lib/curl_config.h.in b/deps/curl/lib/curl_config.h.in
index a525e96b231..397384733fb 100644
--- a/deps/curl/lib/curl_config.h.in
+++ b/deps/curl/lib/curl_config.h.in
@@ -5,7 +5,7 @@
 /* Location of default ca bundle */
 #undef CURL_CA_BUNDLE
 
-/* define "1" to use built-in CA store of SSL library */
+/* define "1" to use OpenSSL's built-in CA store */
 #undef CURL_CA_FALLBACK
 
 /* Location of default ca path */
@@ -167,9 +167,6 @@
 /* Define to 1 if you have the `accept4' function. */
 #undef HAVE_ACCEPT4
 
-/* Define to 1 if symbol `ADDRESS_FAMILY' exists */
-#undef HAVE_ADDRESS_FAMILY
-
 /* Define to 1 if you have the alarm function. */
 #undef HAVE_ALARM
 
@@ -436,9 +433,6 @@
 /* Define to 1 if you have the MSG_NOSIGNAL flag. */
 #undef HAVE_MSG_NOSIGNAL
 
-/* Define to 1 if you have the <msh3.h> header file. */
-#undef HAVE_MSH3_H
-
 /* Define to 1 if you have the <netdb.h> header file. */
 #undef HAVE_NETDB_H
 
@@ -856,9 +850,6 @@
 /* if mbedTLS is enabled */
 #undef USE_MBEDTLS
 
-/* if msh3 is in use */
-#undef USE_MSH3
-
 /* if nghttp2 is in use */
 #undef USE_NGHTTP2
 
diff --git a/deps/curl/lib/curl_fnmatch.c b/deps/curl/lib/curl_fnmatch.c
index 21eca4ceda5..66b9739f3c0 100644
--- a/deps/curl/lib/curl_fnmatch.c
+++ b/deps/curl/lib/curl_fnmatch.c
@@ -74,14 +74,13 @@ typedef enum {
 static int parsekeyword(const unsigned char **pattern, unsigned char *charset)
 {
   parsekey_state state = CURLFNM_PKW_INIT;
-#define KEYLEN 10
-  char keyword[KEYLEN] = { 0 };
-  int i;
+  char keyword[10] = { 0 };
+  size_t i;
   const unsigned char *p = *pattern;
   bool found = FALSE;
   for(i = 0; !found; i++) {
     char c = (char)*p++;
-    if(i >= KEYLEN)
+    if(i >= sizeof(keyword))
       return SETCHARSET_FAIL;
     switch(state) {
     case CURLFNM_PKW_INIT:
diff --git a/deps/curl/lib/curl_gethostname.c b/deps/curl/lib/curl_gethostname.c
index fb418b400d8..c3fa864effc 100644
--- a/deps/curl/lib/curl_gethostname.c
+++ b/deps/curl/lib/curl_gethostname.c
@@ -46,8 +46,8 @@ int Curl_gethostname(char * const name, GETHOSTNAME_TYPE_ARG2 namelen)
 #ifndef HAVE_GETHOSTNAME
 
   /* Allow compilation and return failure when unavailable */
-  (void) name;
-  (void) namelen;
+  (void)name;
+  (void)namelen;
   return -1;
 
 #else
diff --git a/deps/curl/lib/curl_gssapi.c b/deps/curl/lib/curl_gssapi.c
index 4690218050c..92b867f7753 100644
--- a/deps/curl/lib/curl_gssapi.c
+++ b/deps/curl/lib/curl_gssapi.c
@@ -34,7 +34,7 @@
 #include "curl_memory.h"
 #include "memdebug.h"
 
-#if defined(__GNUC__)
+#ifdef __GNUC__
 #define CURL_ALIGN8  __attribute__((aligned(8)))
 #else
 #define CURL_ALIGN8
diff --git a/deps/curl/lib/curl_hmac.h b/deps/curl/lib/curl_hmac.h
index f54edeb49ed..9675c6c5425 100644
--- a/deps/curl/lib/curl_hmac.h
+++ b/deps/curl/lib/curl_hmac.h
@@ -26,7 +26,7 @@
 
 #if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) ||      \
   !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) ||   \
-  defined(USE_SSL)
+  defined(USE_LIBSSH2) || defined(USE_SSL)
 
 #include <curl/curl.h>
 
diff --git a/deps/curl/lib/curl_md4.h b/deps/curl/lib/curl_md4.h
index 4706e49578b..f103d38b41b 100644
--- a/deps/curl/lib/curl_md4.h
+++ b/deps/curl/lib/curl_md4.h
@@ -27,13 +27,13 @@
 #include "curl_setup.h"
 #include <curl/curl.h>
 
-#if defined(USE_CURL_NTLM_CORE)
+#ifdef USE_CURL_NTLM_CORE
 
 #define MD4_DIGEST_LENGTH 16
 
 CURLcode Curl_md4it(unsigned char *output, const unsigned char *input,
                     const size_t len);
 
-#endif /* defined(USE_CURL_NTLM_CORE) */
+#endif /* USE_CURL_NTLM_CORE */
 
 #endif /* HEADER_CURL_MD4_H */
diff --git a/deps/curl/lib/curl_md5.h b/deps/curl/lib/curl_md5.h
index ec27503b144..16272c75910 100644
--- a/deps/curl/lib/curl_md5.h
+++ b/deps/curl/lib/curl_md5.h
@@ -24,8 +24,8 @@
  *
  ***************************************************************************/
 
-#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) \
-    || !defined(CURL_DISABLE_DIGEST_AUTH)
+#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) || \
+  !defined(CURL_DISABLE_DIGEST_AUTH)
 
 #include "curl_hmac.h"
 
diff --git a/deps/curl/lib/vquic/curl_msh3.h b/deps/curl/lib/curl_mem_undef.h
similarity index 62%
rename from deps/curl/lib/vquic/curl_msh3.h
rename to deps/curl/lib/curl_mem_undef.h
index d2862c2d896..b72e529ddeb 100644
--- a/deps/curl/lib/vquic/curl_msh3.h
+++ b/deps/curl/lib/curl_mem_undef.h
@@ -1,5 +1,3 @@
-#ifndef HEADER_CURL_VQUIC_CURL_MSH3_H
-#define HEADER_CURL_VQUIC_CURL_MSH3_H
 /***************************************************************************
  *                                  _   _ ____  _
  *  Project                     ___| | | |  _ \| |
@@ -24,23 +22,34 @@
  *
  ***************************************************************************/
 
-#include "../curl_setup.h"
-
-#ifdef USE_MSH3
-
-#include <msh3.h>
-
-void Curl_msh3_ver(char *p, size_t len);
-
-CURLcode Curl_cf_msh3_create(struct Curl_cfilter **pcf,
-                             struct Curl_easy *data,
-                             struct connectdata *conn,
-                             const struct Curl_addrinfo *ai);
-
-bool Curl_conn_is_msh3(const struct Curl_easy *data,
-                       const struct connectdata *conn,
-                       int sockindex);
-
-#endif /* USE_MSQUIC */
-
-#endif /* HEADER_CURL_VQUIC_CURL_MSH3_H */
+/* Unset redefined system symbols. */
+
+#undef strdup
+#undef malloc
+#undef calloc
+#undef realloc
+#undef free
+#undef send
+#undef recv
+
+#ifdef _WIN32
+#undef _tcsdup
+#endif
+
+#undef socket
+#ifdef HAVE_ACCEPT4
+#undef accept4
+#endif
+#ifdef HAVE_SOCKETPAIR
+#undef socketpair
+#endif
+
+#undef fopen
+#ifdef CURL_FOPEN
+#define fopen(fname, mode) CURL_FOPEN(fname, mode)
+#endif
+#undef fdopen
+#undef fclose
+
+#undef HEADER_CURL_MEMORY_H
+#undef HEADER_CURL_MEMDEBUG_H
diff --git a/deps/curl/lib/curl_memory.h b/deps/curl/lib/curl_memory.h
index b4536c1b3f8..07ef111ce78 100644
--- a/deps/curl/lib/curl_memory.h
+++ b/deps/curl/lib/curl_memory.h
@@ -54,74 +54,6 @@
  *
  */
 
-#ifdef HEADER_CURL_MEMDEBUG_H
-/* cleanup after memdebug.h */
-
-#ifdef CURLDEBUG
-
-#undef strdup
-#undef malloc
-#undef calloc
-#undef realloc
-#undef free
-#undef send
-#undef recv
-
-#ifdef _WIN32
-#undef _tcsdup
-#endif
-
-#undef socket
-#undef accept
-#ifdef HAVE_ACCEPT4
-#undef accept4
-#endif
-#ifdef HAVE_SOCKETPAIR
-#undef socketpair
-#endif
-
-/* sclose is probably already defined, redefine it! */
-#undef sclose
-#define sclose(x)  CURL_SCLOSE(x)
-#undef fopen
-#ifdef CURL_FOPEN
-#define fopen(fname, mode)  CURL_FOPEN(fname, mode)
-#endif
-#undef fdopen
-#undef fclose
-
-#endif /* CURLDEBUG */
-
-#undef HEADER_CURL_MEMDEBUG_H
-#endif /* HEADER_CURL_MEMDEBUG_H */
-
-/*
-** Following section applies even when CURLDEBUG is not defined.
-*/
-
-#undef fake_sclose
-
-#ifndef CURL_DID_MEMORY_FUNC_TYPEDEFS /* only if not already done */
-/*
- * The following memory function replacement typedef's are COPIED from
- * curl/curl.h and MUST match the originals. We copy them to avoid having to
- * include curl/curl.h here. We avoid that include since it includes stdio.h
- * and other headers that may get messed up with defines done here.
- */
-typedef void *(*curl_malloc_callback)(size_t size);
-typedef void (*curl_free_callback)(void *ptr);
-typedef void *(*curl_realloc_callback)(void *ptr, size_t size);
-typedef char *(*curl_strdup_callback)(const char *str);
-typedef void *(*curl_calloc_callback)(size_t nmemb, size_t size);
-#define CURL_DID_MEMORY_FUNC_TYPEDEFS
-#endif
-
-extern curl_malloc_callback Curl_cmalloc;
-extern curl_free_callback Curl_cfree;
-extern curl_realloc_callback Curl_crealloc;
-extern curl_strdup_callback Curl_cstrdup;
-extern curl_calloc_callback Curl_ccalloc;
-
 #ifndef CURLDEBUG
 
 /*
diff --git a/deps/curl/lib/curl_ntlm_core.c b/deps/curl/lib/curl_ntlm_core.c
index c35953177c9..e040db2ab65 100644
--- a/deps/curl/lib/curl_ntlm_core.c
+++ b/deps/curl/lib/curl_ntlm_core.c
@@ -24,7 +24,7 @@
 
 #include "curl_setup.h"
 
-#if defined(USE_CURL_NTLM_CORE)
+#ifdef USE_CURL_NTLM_CORE
 
 /*
  * NTLM details:
@@ -51,39 +51,35 @@
      in NTLM type-3 messages.
  */
 
-#if defined(USE_OPENSSL)
+#ifdef USE_OPENSSL
   #include <openssl/opensslconf.h>
   #if !defined(OPENSSL_NO_DES) && !defined(OPENSSL_NO_DEPRECATED_3_0)
     #define USE_OPENSSL_DES
   #endif
 #elif defined(USE_WOLFSSL)
   #include <wolfssl/options.h>
-  #if !defined(NO_DES3)
+  #ifndef NO_DES3
     #define USE_OPENSSL_DES
   #endif
 #endif
 
-#if defined(USE_OPENSSL_DES)
+#ifdef USE_OPENSSL_DES
 
-#if defined(USE_OPENSSL)
+#ifdef USE_OPENSSL
 #  include <openssl/des.h>
 #  include <openssl/md5.h>
 #  include <openssl/ssl.h>
 #  include <openssl/rand.h>
-#  if defined(OPENSSL_IS_AWSLC)
+#  ifdef OPENSSL_IS_AWSLC  /* for versions 1.2.0 to 1.30.1 */
 #    define DES_set_key_unchecked (void)DES_set_key
-#    define DESKEYARG(x) *x
-#    define DESKEY(x) &x
-#  else
-#    define DESKEYARG(x) *x
-#    define DESKEY(x) &x
 #  endif
+#  define DESKEY(x) &x
 #else
 #  include <wolfssl/openssl/des.h>
 #  include <wolfssl/openssl/md5.h>
 #  include <wolfssl/openssl/ssl.h>
 #  include <wolfssl/openssl/rand.h>
-#  if defined(OPENSSL_COEXIST)
+#  ifdef OPENSSL_COEXIST
 #    define DES_key_schedule WOLFSSL_DES_key_schedule
 #    define DES_cblock WOLFSSL_DES_cblock
 #    define DES_set_odd_parity wolfSSL_DES_set_odd_parity
@@ -91,12 +87,11 @@
 #    define DES_set_key_unchecked wolfSSL_DES_set_key_unchecked
 #    define DES_ecb_encrypt wolfSSL_DES_ecb_encrypt
 #    define DESKEY(x) ((WOLFSSL_DES_key_schedule *)(x))
-#    define DESKEYARG(x) *x
 #  else
-#    define DESKEYARG(x) *x
 #    define DESKEY(x) &x
 #  endif
 #endif
+#define DESKEYARG(x) *x
 
 #elif defined(USE_GNUTLS)
 
@@ -129,7 +124,7 @@
 #include "curl_memory.h"
 #include "memdebug.h"
 
-#if !defined(CURL_NTLM_NOT_SUPPORTED)
+#ifndef CURL_NTLM_NOT_SUPPORTED
 /*
 * Turns a 56-bit key into being 64-bit wide.
 */
@@ -146,7 +141,7 @@ static void extend_key_56_to_64(const unsigned char *key_56, char *key)
 }
 #endif
 
-#if defined(USE_OPENSSL_DES)
+#ifdef USE_OPENSSL_DES
 /*
  * Turns a 56-bit key into a 64-bit, odd parity key and sets the key. The
  * key schedule ks is also set.
@@ -277,7 +272,7 @@ static bool encrypt_des(const unsigned char *in, unsigned char *out,
   return TRUE;
 }
 
-#endif /* defined(USE_WIN32_CRYPTO) */
+#endif /* USE_WIN32_CRYPTO */
 
  /*
   * takes a 21 byte array and treats it as 3 56-bit DES keys. The
@@ -288,7 +283,7 @@ void Curl_ntlm_core_lm_resp(const unsigned char *keys,
                             const unsigned char *plaintext,
                             unsigned char *results)
 {
-#if defined(USE_OPENSSL_DES)
+#ifdef USE_OPENSSL_DES
   DES_key_schedule ks;
 
   setup_des_key(keys, DESKEY(ks));
@@ -329,7 +324,7 @@ CURLcode Curl_ntlm_core_mk_lm_hash(const char *password,
                                    unsigned char *lmbuffer /* 21 bytes */)
 {
   unsigned char pw[14];
-#if !defined(CURL_NTLM_NOT_SUPPORTED)
+#ifndef CURL_NTLM_NOT_SUPPORTED
   static const unsigned char magic[] = {
     0x4B, 0x47, 0x53, 0x21, 0x40, 0x23, 0x24, 0x25 /* i.e. KGS!@#$% */
   };
@@ -342,7 +337,7 @@ CURLcode Curl_ntlm_core_mk_lm_hash(const char *password,
   {
     /* Create LanManager hashed password. */
 
-#if defined(USE_OPENSSL_DES)
+#ifdef USE_OPENSSL_DES
     DES_key_schedule ks;
 
     setup_des_key(pw, DESKEY(ks));
@@ -380,7 +375,7 @@ static void ascii_to_unicode_le(unsigned char *dest, const char *src,
   }
 }
 
-#if !defined(USE_WINDOWS_SSPI)
+#ifndef USE_WINDOWS_SSPI
 
 static void ascii_uppercase_to_unicode_le(unsigned char *dest,
                                           const char *src, size_t srclen)
@@ -404,7 +399,7 @@ CURLcode Curl_ntlm_core_mk_nt_hash(const char *password,
   size_t len = strlen(password);
   unsigned char *pw;
   CURLcode result;
-  if(len > SIZE_T_MAX/2) /* avoid integer overflow */
+  if(len > SIZE_MAX/2) /* avoid integer overflow */
     return CURLE_OUT_OF_MEMORY;
   pw = len ? malloc(len * 2) : (unsigned char *)strdup("");
   if(!pw)
@@ -422,7 +417,7 @@ CURLcode Curl_ntlm_core_mk_nt_hash(const char *password,
   return result;
 }
 
-#if !defined(USE_WINDOWS_SSPI)
+#ifndef USE_WINDOWS_SSPI
 
 #define NTLMv2_BLOB_SIGNATURE "\x01\x01\x00\x00"
 #define NTLMv2_BLOB_LEN       (44 -16 + ntlm->target_info_len + 4)
diff --git a/deps/curl/lib/curl_ntlm_core.h b/deps/curl/lib/curl_ntlm_core.h
index 7571ad5432f..584f4a17d50 100644
--- a/deps/curl/lib/curl_ntlm_core.h
+++ b/deps/curl/lib/curl_ntlm_core.h
@@ -26,7 +26,7 @@
 
 #include "curl_setup.h"
 
-#if defined(USE_CURL_NTLM_CORE)
+#ifdef USE_CURL_NTLM_CORE
 
 #include "vauth/vauth.h"
 
@@ -47,7 +47,7 @@ CURLcode Curl_ntlm_core_mk_lm_hash(const char *password,
 CURLcode Curl_ntlm_core_mk_nt_hash(const char *password,
                                    unsigned char *ntbuffer /* 21 bytes */);
 
-#if !defined(USE_WINDOWS_SSPI)
+#ifndef USE_WINDOWS_SSPI
 
 CURLcode Curl_hmac_md5(const unsigned char *key, unsigned int keylen,
                        const unsigned char *data, unsigned int datalen,
diff --git a/deps/curl/lib/curl_rtmp.c b/deps/curl/lib/curl_rtmp.c
index 0be1f7c7681..baee79fbeec 100644
--- a/deps/curl/lib/curl_rtmp.c
+++ b/deps/curl/lib/curl_rtmp.c
@@ -81,10 +81,10 @@ const struct Curl_handler Curl_handler_rtmp = {
   rtmp_connect,                         /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   rtmp_disconnect,                      /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -106,10 +106,10 @@ const struct Curl_handler Curl_handler_rtmpt = {
   rtmp_connect,                         /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   rtmp_disconnect,                      /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -131,10 +131,10 @@ const struct Curl_handler Curl_handler_rtmpe = {
   rtmp_connect,                         /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   rtmp_disconnect,                      /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -156,10 +156,10 @@ const struct Curl_handler Curl_handler_rtmpte = {
   rtmp_connect,                         /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   rtmp_disconnect,                      /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -181,10 +181,10 @@ const struct Curl_handler Curl_handler_rtmps = {
   rtmp_connect,                         /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   rtmp_disconnect,                      /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -206,10 +206,10 @@ const struct Curl_handler Curl_handler_rtmpts = {
   rtmp_connect,                         /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   rtmp_disconnect,                      /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -296,10 +296,10 @@ static CURLcode rtmp_do(struct Curl_easy *data, bool *done)
 
   if(data->state.upload) {
     Curl_pgrsSetUploadSize(data, data->state.infilesize);
-    Curl_xfer_setup1(data, CURL_XFER_SEND, -1, FALSE);
+    Curl_xfer_setup_send(data, FIRSTSOCKET);
   }
   else
-    Curl_xfer_setup1(data, CURL_XFER_RECV, -1, FALSE);
+    Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
   *done = TRUE;
   return CURLE_OK;
 }
@@ -307,9 +307,9 @@ static CURLcode rtmp_do(struct Curl_easy *data, bool *done)
 static CURLcode rtmp_done(struct Curl_easy *data, CURLcode status,
                           bool premature)
 {
-  (void)data; /* unused */
-  (void)status; /* unused */
-  (void)premature; /* unused */
+  (void)data;
+  (void)status;
+  (void)premature;
 
   return CURLE_OK;
 }
@@ -334,7 +334,7 @@ static CURLcode rtmp_recv(struct Curl_easy *data, int sockindex, char *buf,
   CURLcode result = CURLE_OK;
   ssize_t nread;
 
-  (void)sockindex; /* unused */
+  (void)sockindex;
   *pnread = 0;
   if(!r)
     return CURLE_FAILED_INIT;
@@ -362,8 +362,8 @@ static CURLcode rtmp_send(struct Curl_easy *data, int sockindex,
   RTMP *r = Curl_conn_meta_get(conn, CURL_META_RTMP_CONN);
   ssize_t nwritten;
 
-  (void)sockindex; /* unused */
-  (void)eos; /* unused */
+  (void)sockindex;
+  (void)eos;
   *pnwritten = 0;
   if(!r)
     return CURLE_FAILED_INIT;
diff --git a/deps/curl/lib/curl_sasl.c b/deps/curl/lib/curl_sasl.c
index 766de44b85c..8eb63fb9495 100644
--- a/deps/curl/lib/curl_sasl.c
+++ b/deps/curl/lib/curl_sasl.c
@@ -222,7 +222,7 @@ static void sasl_state(struct SASL *sasl, struct Curl_easy *data,
     infof(data, "SASL %p state change from %s to %s",
           (void *)sasl, names[sasl->state], names[newstate]);
 #else
-  (void) data;
+  (void)data;
 #endif
 
   sasl->state = newstate;
@@ -557,7 +557,7 @@ CURLcode Curl_sasl_start(struct SASL *sasl, struct Curl_easy *data,
   /* Calculate the supported authentication mechanism, by decreasing order of
      security, as well as the initial response where appropriate */
   if(sasl_choose_external(data, &sctx) ||
-#if defined(USE_KERBEROS5)
+#ifdef USE_KERBEROS5
      sasl_choose_krb5(data, &sctx) ||
 #endif
 #ifdef USE_GSASL
@@ -615,8 +615,8 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
   struct bufref resp;
   const char *hostname;
   int port;
-#if defined(USE_KERBEROS5) || defined(USE_NTLM) \
-    || !defined(CURL_DISABLE_DIGEST_AUTH)
+#if defined(USE_KERBEROS5) || defined(USE_NTLM) || \
+  !defined(CURL_DISABLE_DIGEST_AUTH)
   const char *service = data->set.str[STRING_SERVICE_NAME] ?
     data->set.str[STRING_SERVICE_NAME] :
     sasl->params->service;
@@ -722,7 +722,7 @@ CURLcode Curl_sasl_continue(struct SASL *sasl, struct Curl_easy *data,
   }
 #endif
 
-#if defined(USE_KERBEROS5)
+#ifdef USE_KERBEROS5
   case SASL_GSSAPI: {
     struct kerberos5data *krb5 = Curl_auth_krb5_get(conn);
     result = !krb5 ? CURLE_OUT_OF_MEMORY :
diff --git a/deps/curl/lib/curl_setup.h b/deps/curl/lib/curl_setup.h
index 4dc46f7a73a..72c118affcc 100644
--- a/deps/curl/lib/curl_setup.h
+++ b/deps/curl/lib/curl_setup.h
@@ -75,6 +75,11 @@
 #endif
 #endif
 
+#if defined(__MINGW32__) && !defined(__MINGW32CE__) && \
+  (!defined(__MINGW64_VERSION_MAJOR) || (__MINGW64_VERSION_MAJOR < 3))
+#error "Building curl requires mingw-w64 3.0 or later"
+#endif
+
 /* Visual Studio 2008 is the minimum Visual Studio version we support.
    Workarounds for older versions of Visual Studio have been removed. */
 #if defined(_MSC_VER) && (_MSC_VER < 1500)
@@ -331,10 +336,10 @@
 #define CURL_CONC_MACROS(A,B) CURL_CONC_MACROS_(A,B)
 
 /* curl uses its own printf() function internally. It understands the GNU
- * format. Use this format, so that is matches the GNU format attribute we
+ * format. Use this format, so that it matches the GNU format attribute we
  * use with the MinGW compiler, allowing it to verify them at compile-time.
  */
-#ifdef  __MINGW32__
+#ifdef __MINGW32__
 #  undef CURL_FORMAT_CURL_OFF_T
 #  undef CURL_FORMAT_CURL_OFF_TU
 #  define CURL_FORMAT_CURL_OFF_T   "lld"
@@ -380,7 +385,7 @@
  * performing this task will result in a synthesized IPv6 address.
  */
 #if defined(__APPLE__) && !defined(USE_ARES)
-#define USE_RESOLVE_ON_IPS 1
+#  define USE_RESOLVE_ON_IPS 1
 #  if TARGET_OS_MAC && !(defined(TARGET_OS_IPHONE) && TARGET_OS_IPHONE) && \
      defined(USE_IPV6)
 #    define CURL_MACOS_CALL_COPYPROXIES 1
@@ -470,6 +475,12 @@
 #include <curl/stdcheaders.h>
 #endif
 
+#if defined(HAVE_STDINT_H) || defined(USE_WOLFSSL)
+#include <stdint.h>
+#endif
+
+#include <limits.h>
+
 #ifdef _WIN32
 #  ifdef HAVE_IO_H
 #  include <io.h>
@@ -549,11 +560,11 @@
 
 #ifndef SIZEOF_OFF_T
 #  if defined(__VMS) && !defined(__VAX)
-#    if defined(_LARGEFILE)
+#    ifdef _LARGEFILE
 #      define SIZEOF_OFF_T 8
 #    endif
 #  elif defined(__OS400__) && defined(__ILEC400__)
-#    if defined(_LARGE_FILES)
+#    ifdef _LARGE_FILES
 #      define SIZEOF_OFF_T 8
 #    endif
 #  elif defined(__MVS__) && defined(__IBMC__)
@@ -613,21 +624,21 @@
 #  endif
 #endif
 
-#ifndef SIZE_T_MAX
+#ifndef SIZE_MAX
 /* some limits.h headers have this defined, some do not */
 #if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)
-#define SIZE_T_MAX 18446744073709551615U
+#define SIZE_MAX 18446744073709551615U
 #else
-#define SIZE_T_MAX 4294967295U
+#define SIZE_MAX 4294967295U
 #endif
 #endif
 
-#ifndef SSIZE_T_MAX
+#ifndef SSIZE_MAX
 /* some limits.h headers have this defined, some do not */
 #if defined(SIZEOF_SIZE_T) && (SIZEOF_SIZE_T > 4)
-#define SSIZE_T_MAX 9223372036854775807
+#define SSIZE_MAX 9223372036854775807
 #else
-#define SSIZE_T_MAX 2147483647
+#define SSIZE_MAX 2147483647
 #endif
 #endif
 
@@ -774,20 +785,12 @@
  * Parameters should of course normally not be unused, but for example when
  * we have multiple implementations of the same interface it may happen.
  */
-
 #if defined(__GNUC__) && ((__GNUC__ >= 3) || \
   ((__GNUC__ == 2) && defined(__GNUC_MINOR__) && (__GNUC_MINOR__ >= 7)))
-#  define UNUSED_PARAM __attribute__((__unused__))
 #  define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
-#elif defined(__IAR_SYSTEMS_ICC__)
-#  define UNUSED_PARAM __attribute__((__unused__))
-#  if (__VER__ >= 9040001)
-#    define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
-#  else
-#    define WARN_UNUSED_RESULT
-#  endif
+#elif defined(__IAR_SYSTEMS_ICC__) && (__VER__ >= 9040001)
+#  define WARN_UNUSED_RESULT __attribute__((warn_unused_result))
 #else
-#  define UNUSED_PARAM /* NOTHING */
 #  define WARN_UNUSED_RESULT
 #endif
 
@@ -932,10 +935,10 @@ endings either CRLF or LF so 't' is appropriate.
 
 /* for systems that do not detect this in configure */
 #ifndef CURL_SA_FAMILY_T
-#  if defined(HAVE_SA_FAMILY_T)
-#    define CURL_SA_FAMILY_T sa_family_t
-#  elif defined(HAVE_ADDRESS_FAMILY)
+#  if defined(_WIN32) && !defined(UNDER_CE)
 #    define CURL_SA_FAMILY_T ADDRESS_FAMILY
+#  elif defined(HAVE_SA_FAMILY_T)
+#    define CURL_SA_FAMILY_T sa_family_t
 #  elif defined(__AMIGA__)
 #    define CURL_SA_FAMILY_T unsigned char
 #  else
@@ -956,15 +959,145 @@ endings either CRLF or LF so 't' is appropriate.
 
 #define CURL_ARRAYSIZE(A) (sizeof(A)/sizeof((A)[0]))
 
+#ifndef CURL_DID_MEMORY_FUNC_TYPEDEFS /* only if not already done */
+/*
+ * The following memory function replacement typedef's are COPIED from
+ * curl/curl.h and MUST match the originals. We copy them to avoid having to
+ * include curl/curl.h here. We avoid that include since it includes stdio.h
+ * and other headers that may get messed up with defines done here.
+ */
+typedef void *(*curl_malloc_callback)(size_t size);
+typedef void (*curl_free_callback)(void *ptr);
+typedef void *(*curl_realloc_callback)(void *ptr, size_t size);
+typedef char *(*curl_strdup_callback)(const char *str);
+typedef void *(*curl_calloc_callback)(size_t nmemb, size_t size);
+#define CURL_DID_MEMORY_FUNC_TYPEDEFS
+#endif
+
+extern curl_malloc_callback Curl_cmalloc;
+extern curl_free_callback Curl_cfree;
+extern curl_realloc_callback Curl_crealloc;
+extern curl_strdup_callback Curl_cstrdup;
+extern curl_calloc_callback Curl_ccalloc;
+
+/*
+ * Curl_safefree defined as a macro to allow MemoryTracking feature
+ * to log free() calls at same location where Curl_safefree is used.
+ * This macro also assigns NULL to given pointer when free'd.
+ */
+#define Curl_safefree(ptr) \
+  do { free((ptr)); (ptr) = NULL;} while(0)
+
 #ifdef CURLDEBUG
+#ifdef __clang__
+#  define ALLOC_FUNC         __attribute__((__malloc__))
+#  if __clang_major__ >= 4
+#  define ALLOC_SIZE(s)      __attribute__((__alloc_size__(s)))
+#  define ALLOC_SIZE2(n, s)  __attribute__((__alloc_size__(n, s)))
+#  else
+#  define ALLOC_SIZE(s)
+#  define ALLOC_SIZE2(n, s)
+#  endif
+#elif defined(__GNUC__) && __GNUC__ >= 3
+#  define ALLOC_FUNC         __attribute__((__malloc__))
+#  define ALLOC_SIZE(s)      __attribute__((__alloc_size__(s)))
+#  define ALLOC_SIZE2(n, s)  __attribute__((__alloc_size__(n, s)))
+#elif defined(_MSC_VER)
+#  define ALLOC_FUNC         __declspec(restrict)
+#  define ALLOC_SIZE(s)
+#  define ALLOC_SIZE2(n, s)
+#else
+#  define ALLOC_FUNC
+#  define ALLOC_SIZE(s)
+#  define ALLOC_SIZE2(n, s)
+#endif
+
+#include <curl/curl.h> /* for CURL_EXTERN */
+
+extern FILE *curl_dbg_logfile;
+
+/* memory functions */
+CURL_EXTERN void curl_dbg_free(void *ptr, int line, const char *source);
+CURL_EXTERN ALLOC_FUNC ALLOC_SIZE(1)
+  void *curl_dbg_malloc(size_t size, int line, const char *source);
+CURL_EXTERN ALLOC_FUNC ALLOC_SIZE2(1, 2)
+  void *curl_dbg_calloc(size_t n, size_t size, int line, const char *source);
+CURL_EXTERN ALLOC_SIZE(2)
+  void *curl_dbg_realloc(void *ptr, size_t size, int line, const char *source);
+CURL_EXTERN ALLOC_FUNC
+  char *curl_dbg_strdup(const char *str, int line, const char *src);
+#if defined(_WIN32) && defined(UNICODE)
+CURL_EXTERN ALLOC_FUNC
+  wchar_t *curl_dbg_wcsdup(const wchar_t *str, int line, const char *source);
+#endif
+
+CURL_EXTERN void curl_dbg_memdebug(const char *logname);
+CURL_EXTERN void curl_dbg_memlimit(long limit);
+CURL_EXTERN void curl_dbg_log(const char *format, ...) CURL_PRINTF(1, 2);
+
+/* file descriptor manipulators */
+CURL_EXTERN curl_socket_t curl_dbg_socket(int domain, int type, int protocol,
+                                          int line, const char *source);
+CURL_EXTERN void curl_dbg_mark_sclose(curl_socket_t sockfd,
+                                      int line, const char *source);
+CURL_EXTERN int curl_dbg_sclose(curl_socket_t sockfd,
+                                int line, const char *source);
+CURL_EXTERN curl_socket_t curl_dbg_accept(curl_socket_t s, void *a, void *alen,
+                                          int line, const char *source);
+#ifdef HAVE_ACCEPT4
+CURL_EXTERN curl_socket_t curl_dbg_accept4(curl_socket_t s, void *saddr,
+                                           void *saddrlen, int flags,
+                                           int line, const char *source);
+#endif
+#ifdef HAVE_SOCKETPAIR
+CURL_EXTERN int curl_dbg_socketpair(int domain, int type, int protocol,
+                                    curl_socket_t socket_vector[2],
+                                    int line, const char *source);
+#endif
+
+/* send/receive sockets */
+CURL_EXTERN SEND_TYPE_RETV curl_dbg_send(SEND_TYPE_ARG1 sockfd,
+                                         SEND_QUAL_ARG2 SEND_TYPE_ARG2 buf,
+                                         SEND_TYPE_ARG3 len,
+                                         SEND_TYPE_ARG4 flags, int line,
+                                         const char *source);
+CURL_EXTERN RECV_TYPE_RETV curl_dbg_recv(RECV_TYPE_ARG1 sockfd,
+                                         RECV_TYPE_ARG2 buf,
+                                         RECV_TYPE_ARG3 len,
+                                         RECV_TYPE_ARG4 flags, int line,
+                                         const char *source);
+
+/* FILE functions */
+CURL_EXTERN int curl_dbg_fclose(FILE *file, int line, const char *source);
+CURL_EXTERN ALLOC_FUNC
+  FILE *curl_dbg_fopen(const char *file, const char *mode,
+                       int line, const char *source);
+CURL_EXTERN ALLOC_FUNC
+  FILE *curl_dbg_fdopen(int filedes, const char *mode,
+                        int line, const char *source);
+
+#define sclose(sockfd) curl_dbg_sclose(sockfd,__LINE__,__FILE__)
+#define fake_sclose(sockfd) curl_dbg_mark_sclose(sockfd,__LINE__,__FILE__)
+
 #define CURL_GETADDRINFO(host,serv,hint,res) \
   curl_dbg_getaddrinfo(host, serv, hint, res, __LINE__, __FILE__)
 #define CURL_FREEADDRINFO(data) \
   curl_dbg_freeaddrinfo(data, __LINE__, __FILE__)
-#else
+
+#define CURL_ACCEPT(sock,addr,len) \
+  curl_dbg_accept(sock, addr, len, __LINE__, __FILE__)
+
+#else /* !CURLDEBUG */
+
+#define sclose(x) CURL_SCLOSE(x)
+#define fake_sclose(x) Curl_nop_stmt
+
 #define CURL_GETADDRINFO getaddrinfo
 #define CURL_FREEADDRINFO freeaddrinfo
-#endif
+
+#define CURL_ACCEPT accept
+
+#endif /* CURLDEBUG */
 
 /* Some versions of the Android NDK is missing the declaration */
 #if defined(HAVE_GETPWUID_R) && \
@@ -986,7 +1119,7 @@ int getpwuid_r(uid_t uid, struct passwd *pwd, char *buf,
 
 #if (defined(USE_NGTCP2) && defined(USE_NGHTTP3)) || \
     (defined(USE_OPENSSL_QUIC) && defined(USE_NGHTTP3)) || \
-    defined(USE_QUICHE) || defined(USE_MSH3)
+    defined(USE_QUICHE)
 
 #ifdef CURL_WITH_MULTI_SSL
 #error "MultiSSL combined with QUIC is not supported"
@@ -995,6 +1128,11 @@ int getpwuid_r(uid_t uid, struct passwd *pwd, char *buf,
 #define USE_HTTP3
 #endif
 
+/* WebAssembly builds have TCP_NODELAY, but runtime support is missing. */
+#ifndef __EMSCRIPTEN__
+#define CURL_TCP_NODELAY_SUPPORTED
+#endif
+
 /* Certain Windows implementations are not aligned with what curl expects,
    so always use the local one on this platform. E.g. the mingw-w64
    implementation can return wrong results for non-ASCII inputs. */
@@ -1003,7 +1141,7 @@ int getpwuid_r(uid_t uid, struct passwd *pwd, char *buf,
 #endif
 
 #if defined(USE_UNIX_SOCKETS) && defined(_WIN32)
-#  if !defined(UNIX_PATH_MAX)
+#  ifndef UNIX_PATH_MAX
      /* Replicating logic present in afunix.h
         (distributed with newer Windows 10 SDK versions only) */
 #    define UNIX_PATH_MAX 108
@@ -1051,3 +1189,5 @@ int getpwuid_r(uid_t uid, struct passwd *pwd, char *buf,
 #endif
 
 #endif /* HEADER_CURL_SETUP_H */
+
+#include "curl_mem_undef.h"
diff --git a/deps/curl/lib/curl_setup_once.h b/deps/curl/lib/curl_setup_once.h
index bec45de8888..7a54760e161 100644
--- a/deps/curl/lib/curl_setup_once.h
+++ b/deps/curl/lib/curl_setup_once.h
@@ -63,10 +63,6 @@
 #include <unistd.h>
 #endif
 
-#if defined(HAVE_STDINT_H) || defined(USE_WOLFSSL)
-#include <stdint.h>
-#endif
-
 /* Macro to strip 'const' without triggering a compiler warning.
    Use it for APIs that do not or cannot support the const qualifier. */
 #ifdef HAVE_STDINT_H
@@ -206,8 +202,6 @@ struct timeval {
 #  define CURL_SCLOSE(x)  close((x))
 #endif
 
-#define sclose(x)  CURL_SCLOSE(x)
-
 /*
  * Stack-independent version of fcntl() on sockets:
  */
diff --git a/deps/curl/lib/curl_sha256.h b/deps/curl/lib/curl_sha256.h
index f532939d056..caa5080b3f0 100644
--- a/deps/curl/lib/curl_sha256.h
+++ b/deps/curl/lib/curl_sha256.h
@@ -25,8 +25,8 @@
  *
  ***************************************************************************/
 
-#if !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) \
-    || defined(USE_LIBSSH2) || defined(USE_SSL)
+#if !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) || \
+  defined(USE_LIBSSH2) || defined(USE_SSL)
 
 #include <curl/curl.h>
 #include "curl_hmac.h"
diff --git a/deps/curl/lib/curl_sha512_256.c b/deps/curl/lib/curl_sha512_256.c
index 81bfddc711a..7e9b223387e 100644
--- a/deps/curl/lib/curl_sha512_256.c
+++ b/deps/curl/lib/curl_sha512_256.c
@@ -38,13 +38,12 @@
  * * Rustls
  * Skip the backend if it does not support the required algorithm */
 
-#if defined(USE_OPENSSL)
+#ifdef USE_OPENSSL
 #  include <openssl/opensslv.h>
 #  if (!defined(LIBRESSL_VERSION_NUMBER) && \
-        defined(OPENSSL_VERSION_NUMBER) && \
-        (OPENSSL_VERSION_NUMBER >= 0x10101000L)) || \
+       OPENSSL_VERSION_NUMBER >= 0x10101000L) || \
       (defined(LIBRESSL_VERSION_NUMBER) && \
-        (LIBRESSL_VERSION_NUMBER >= 0x3080000fL))
+       LIBRESSL_VERSION_NUMBER >= 0x3080000fL)
 #    include <openssl/opensslconf.h>
 #    if !defined(OPENSSL_NO_SHA) && !defined(OPENSSL_NO_SHA512)
 #      include <openssl/evp.h>
@@ -78,12 +77,12 @@
 
 #if !defined(HAS_SHA512_256_IMPLEMENTATION) && defined(USE_GNUTLS)
 #  include <nettle/sha.h>
-#  if defined(SHA512_256_DIGEST_SIZE)
+#  ifdef SHA512_256_DIGEST_SIZE
 #    define USE_GNUTLS_SHA512_256           1
 #  endif
 #endif /* ! HAS_SHA512_256_IMPLEMENTATION && USE_GNUTLS */
 
-#if defined(USE_OPENSSL_SHA512_256)
+#ifdef USE_OPENSSL_SHA512_256
 
 /* OpenSSL does not provide macros for SHA-512/256 sizes */
 
@@ -110,8 +109,7 @@ typedef EVP_MD_CTX *Curl_sha512_256_ctx;
  * @return CURLE_OK if succeed,
  *         error code otherwise
  */
-static CURLcode
-Curl_sha512_256_init(void *context)
+static CURLcode Curl_sha512_256_init(void *context)
 {
   Curl_sha512_256_ctx *const ctx = (Curl_sha512_256_ctx *)context;
 
@@ -142,10 +140,9 @@ Curl_sha512_256_init(void *context)
  * @return CURLE_OK if succeed,
  *         error code otherwise
  */
-static CURLcode
-Curl_sha512_256_update(void *context,
-                       const unsigned char *data,
-                       size_t length)
+static CURLcode Curl_sha512_256_update(void *context,
+                                       const unsigned char *data,
+                                       size_t length)
 {
   Curl_sha512_256_ctx *const ctx = (Curl_sha512_256_ctx *)context;
 
@@ -165,9 +162,7 @@ Curl_sha512_256_update(void *context,
  * @return CURLE_OK if succeed,
  *         error code otherwise
  */
-static CURLcode
-Curl_sha512_256_finish(unsigned char *digest,
-                       void *context)
+static CURLcode Curl_sha512_256_finish(unsigned char *digest, void *context)
 {
   CURLcode ret;
   Curl_sha512_256_ctx *const ctx = (Curl_sha512_256_ctx *)context;
@@ -207,8 +202,7 @@ typedef struct sha512_256_ctx Curl_sha512_256_ctx;
  * @param context the calculation context
  * @return always CURLE_OK
  */
-static CURLcode
-Curl_sha512_256_init(void *context)
+static CURLcode Curl_sha512_256_init(void *context)
 {
   Curl_sha512_256_ctx *const ctx = (Curl_sha512_256_ctx *)context;
 
@@ -229,10 +223,9 @@ Curl_sha512_256_init(void *context)
  * @param length number of bytes in @a data
  * @return always CURLE_OK
  */
-static CURLcode
-Curl_sha512_256_update(void *context,
-                       const unsigned char *data,
-                       size_t length)
+static CURLcode Curl_sha512_256_update(void *context,
+                                       const unsigned char *data,
+                                       size_t length)
 {
   Curl_sha512_256_ctx *const ctx = (Curl_sha512_256_ctx *)context;
 
@@ -252,9 +245,8 @@ Curl_sha512_256_update(void *context,
  #             bytes
  * @return always CURLE_OK
  */
-static CURLcode
-Curl_sha512_256_finish(unsigned char *digest,
-                       void *context)
+static CURLcode Curl_sha512_256_finish(unsigned char *digest,
+                                       void *context)
 {
   Curl_sha512_256_ctx *const ctx = (Curl_sha512_256_ctx *)context;
 
@@ -284,13 +276,13 @@ Curl_sha512_256_finish(unsigned char *digest,
 
 #if !defined(CURL_FORCEINLINE) && \
   defined(_MSC_VER) && !defined(__GNUC__) && !defined(__clang__)
-#  define CURL_FORCEINLINE __forceinline
+#define CURL_FORCEINLINE __forceinline
 #endif
 
-#if !defined(CURL_FORCEINLINE)
-   /* Assume that 'CURL_INLINE' keyword works or the
-    * macro was already defined correctly. */
-#  define CURL_FORCEINLINE CURL_INLINE
+/* Assume that 'CURL_INLINE' keyword works or the
+ * macro was already defined correctly. */
+#ifndef CURL_FORCEINLINE
+#define CURL_FORCEINLINE CURL_INLINE
 #endif
 
 /* Bits manipulation macros and functions.
@@ -320,11 +312,11 @@ Curl_sha512_256_finish(unsigned char *digest,
 /* Defined as a function. The macro version may duplicate the binary code
  * size as each argument is used twice, so if any calculation is used
  * as an argument, the calculation could be done twice. */
-static CURL_FORCEINLINE curl_uint64_t
-Curl_rotr64(curl_uint64_t value, unsigned int bits)
+static CURL_FORCEINLINE curl_uint64_t Curl_rotr64(curl_uint64_t value,
+                                                  unsigned int bits)
 {
   bits %= 64;
-  if(0 == bits)
+  if(bits == 0)
     return value;
   /* Defined in a form which modern compiler could optimize. */
   return (value >> bits) | (value << (64 - bits));
@@ -380,8 +372,7 @@ Curl_rotr64(curl_uint64_t value, unsigned int bits)
 /**
  * SHA-512/256 calculation context
  */
-struct Curl_sha512_256ctx
-{
+struct Curl_sha512_256ctx {
   /**
    * Intermediate hash value. The variable is properly aligned. Smart
    * compilers may automatically use fast load/store instruction for big
@@ -417,8 +408,7 @@ typedef struct Curl_sha512_256ctx Curl_sha512_256_ctx;
  * @param context the calculation context
  * @return always CURLE_OK
  */
-static CURLcode
-Curl_sha512_256_init(void *context)
+static CURLcode Curl_sha512_256_init(void *context)
 {
   struct Curl_sha512_256ctx *const ctx = (struct Curl_sha512_256ctx *)context;
 
@@ -453,9 +443,9 @@ Curl_sha512_256_init(void *context)
  * @param H     hash values
  * @param data  the data buffer with #CURL_SHA512_256_BLOCK_SIZE bytes block
  */
-static void
-Curl_sha512_256_transform(curl_uint64_t H[SHA512_256_HASH_SIZE_WORDS],
-                          const void *data)
+static
+void Curl_sha512_256_transform(curl_uint64_t H[SHA512_256_HASH_SIZE_WORDS],
+                               const void *data)
 {
   /* Working variables,
      see FIPS PUB 180-4 section 6.7, 6.4. */
@@ -619,10 +609,9 @@ Curl_sha512_256_transform(curl_uint64_t H[SHA512_256_HASH_SIZE_WORDS],
  * @param length number of bytes in @a data
  * @return always CURLE_OK
  */
-static CURLcode
-Curl_sha512_256_update(void *context,
-                       const unsigned char *data,
-                       size_t length)
+static CURLcode Curl_sha512_256_update(void *context,
+                                       const unsigned char *data,
+                                       size_t length)
 {
   unsigned int bytes_have; /**< Number of bytes in the context buffer */
   struct Curl_sha512_256ctx *const ctx = (struct Curl_sha512_256ctx *)context;
@@ -631,7 +620,7 @@ Curl_sha512_256_update(void *context,
 
   DEBUGASSERT((data != NULL) || (length == 0));
 
-  if(0 == length)
+  if(length == 0)
     return CURLE_OK; /* Shortcut, do nothing */
 
   /* Note: (count & (CURL_SHA512_256_BLOCK_SIZE-1))
@@ -643,7 +632,7 @@ Curl_sha512_256_update(void *context,
   ctx->count_bits_hi += ctx->count >> 61;
   ctx->count &= CURL_UINT64_C(0x1FFFFFFFFFFFFFFF);
 
-  if(0 != bytes_have) {
+  if(bytes_have) {
     unsigned int bytes_left = CURL_SHA512_256_BLOCK_SIZE - bytes_have;
     if(length >= bytes_left) {
       /* Combine new data with data in the buffer and process the full
@@ -666,7 +655,7 @@ Curl_sha512_256_update(void *context,
     length -= CURL_SHA512_256_BLOCK_SIZE;
   }
 
-  if(0 != length) {
+  if(length) {
     /* Copy incomplete block of new data (if any)
        to the buffer. */
     memcpy(((unsigned char *) ctx_buf) + bytes_have, data, length);
@@ -676,7 +665,6 @@ Curl_sha512_256_update(void *context,
 }
 
 
-
 /**
  * Size of "length" insertion in bits.
  * See FIPS PUB 180-4 section 5.1.2.
@@ -696,9 +684,7 @@ Curl_sha512_256_update(void *context,
  #             bytes
  * @return always CURLE_OK
  */
-static CURLcode
-Curl_sha512_256_finish(unsigned char *digest,
-                       void *context)
+static CURLcode Curl_sha512_256_finish(unsigned char *digest, void *context)
 {
   struct Curl_sha512_256ctx *const ctx = (struct Curl_sha512_256ctx *)context;
   curl_uint64_t num_bits;   /**< Number of processed bits */
@@ -746,14 +732,14 @@ Curl_sha512_256_finish(unsigned char *digest,
      part of number of bits as big-endian values.
      See FIPS PUB 180-4 section 5.1.2. */
   /* Note: the target location is predefined and buffer is always aligned */
-  CURL_PUT_64BIT_BE(((unsigned char *) ctx_buf)  \
+  CURL_PUT_64BIT_BE(((unsigned char *) ctx_buf)       \
                       + CURL_SHA512_256_BLOCK_SIZE    \
                       - SHA512_256_SIZE_OF_LEN_ADD,   \
                       ctx->count_bits_hi);
-  CURL_PUT_64BIT_BE(((unsigned char *) ctx_buf)      \
-                      + CURL_SHA512_256_BLOCK_SIZE        \
-                      - SHA512_256_SIZE_OF_LEN_ADD        \
-                      + SHA512_256_BYTES_IN_WORD,         \
+  CURL_PUT_64BIT_BE(((unsigned char *) ctx_buf)       \
+                      + CURL_SHA512_256_BLOCK_SIZE    \
+                      - SHA512_256_SIZE_OF_LEN_ADD    \
+                      + SHA512_256_BYTES_IN_WORD,     \
                       num_bits);
   /* Process the full final block. */
   Curl_sha512_256_transform(ctx->H, ctx->buffer);
@@ -782,9 +768,8 @@ Curl_sha512_256_finish(unsigned char *digest,
  * @param input_size the size of the data pointed by @a input
  * @return always #CURLE_OK
  */
-CURLcode
-Curl_sha512_256it(unsigned char *output, const unsigned char *input,
-                  size_t input_size)
+CURLcode Curl_sha512_256it(unsigned char *output, const unsigned char *input,
+                           size_t input_size)
 {
   Curl_sha512_256_ctx ctx;
   CURLcode res;
@@ -796,7 +781,7 @@ Curl_sha512_256it(unsigned char *output, const unsigned char *input,
   res = Curl_sha512_256_update(&ctx, (const void *) input, input_size);
 
   if(res != CURLE_OK) {
-    (void) Curl_sha512_256_finish(output, &ctx);
+    (void)Curl_sha512_256_finish(output, &ctx);
     return res;
   }
 
@@ -804,22 +789,19 @@ Curl_sha512_256it(unsigned char *output, const unsigned char *input,
 }
 
 /* Wrapper function, takes 'unsigned int' as length type, returns void */
-static void
-Curl_sha512_256_update_i(void *context,
-                         const unsigned char *data,
-                         unsigned int length)
+static void Curl_sha512_256_update_i(void *context,
+                                     const unsigned char *data,
+                                     unsigned int length)
 {
   /* Hypothetically the function may fail, but assume it does not */
-  (void) Curl_sha512_256_update(context, data, length);
+  (void)Curl_sha512_256_update(context, data, length);
 }
 
 /* Wrapper function, returns void */
-static void
-Curl_sha512_256_finish_v(unsigned char *result,
-                         void *context)
+static void Curl_sha512_256_finish_v(unsigned char *result, void *context)
 {
   /* Hypothetically the function may fail, but assume it does not */
-  (void) Curl_sha512_256_finish(result, context);
+  (void)Curl_sha512_256_finish(result, context);
 }
 
 /* Wrapper function, takes 'unsigned int' as length type, returns void */
diff --git a/deps/curl/lib/curl_sspi.c b/deps/curl/lib/curl_sspi.c
index 5f19e960b9b..635f560b68a 100644
--- a/deps/curl/lib/curl_sspi.c
+++ b/deps/curl/lib/curl_sspi.c
@@ -31,7 +31,6 @@
 #include "strdup.h"
 #include "curlx/multibyte.h"
 #include "system_win32.h"
-#include "curlx/version_win32.h"
 #include "curlx/warnless.h"
 
 /* The last #include files should be: */
@@ -178,7 +177,12 @@ CURLcode Curl_create_sspi_identity(const char *userp, const char *passwdp,
   curlx_unicodefree(passwd.tchar_ptr);
 
   /* Setup the identity's flags */
-  identity->Flags = SECFLAG_WINNT_AUTH_IDENTITY;
+  identity->Flags = (unsigned long)
+#ifdef UNICODE
+    SEC_WINNT_AUTH_IDENTITY_UNICODE;
+#else
+    SEC_WINNT_AUTH_IDENTITY_ANSI;
+#endif
 
   return CURLE_OK;
 }
diff --git a/deps/curl/lib/curl_sspi.h b/deps/curl/lib/curl_sspi.h
index 540cdfd19cc..8ecd81fdea1 100644
--- a/deps/curl/lib/curl_sspi.h
+++ b/deps/curl/lib/curl_sspi.h
@@ -65,6 +65,7 @@ extern PSecurityFunctionTable Curl_pSecFn;
 #define SP_NAME_NEGOTIATE           "Negotiate"
 #define SP_NAME_KERBEROS            "Kerberos"
 
+/* Offered by mingw-w64 v9+. MS SDK 7.0A+. */
 #ifndef ISC_REQ_USE_HTTP_STYLE
 #define ISC_REQ_USE_HTTP_STYLE                0x01000000
 #endif
@@ -288,14 +289,17 @@ extern PSecurityFunctionTable Curl_pSecFn;
 #define SEC_E_KDC_CERT_REVOKED                ((HRESULT)0x8009035BL)
 #endif
 #endif /* __MINGW32CE__ */
+/* Offered by mingw-w64 v8+. MS SDK 6.0A+. */
 #ifndef SEC_E_INVALID_PARAMETER
-# define SEC_E_INVALID_PARAMETER              ((HRESULT)0x8009035DL)
+#define SEC_E_INVALID_PARAMETER               ((HRESULT)0x8009035DL)
 #endif
+/* Offered by mingw-w64 v8+. MS SDK 6.0A+. */
 #ifndef SEC_E_DELEGATION_POLICY
-# define SEC_E_DELEGATION_POLICY              ((HRESULT)0x8009035EL)
+#define SEC_E_DELEGATION_POLICY               ((HRESULT)0x8009035EL)
 #endif
+/* Offered by mingw-w64 v8+. MS SDK 6.0A+. */
 #ifndef SEC_E_POLICY_NLTM_ONLY
-# define SEC_E_POLICY_NLTM_ONLY               ((HRESULT)0x8009035FL)
+#define SEC_E_POLICY_NLTM_ONLY                ((HRESULT)0x8009035FL)
 #endif
 
 #ifdef __MINGW32CE__
@@ -324,37 +328,17 @@ extern PSecurityFunctionTable Curl_pSecFn;
 #define SEC_I_NO_LSA_CONTEXT                  ((HRESULT)0x00090323L)
 #endif
 #endif /* __MINGW32CE__ */
+
+/* Offered by mingw-w64 v8+. MS SDK 6.0A+. */
 #ifndef SEC_I_SIGNATURE_NEEDED
 #define SEC_I_SIGNATURE_NEEDED                ((HRESULT)0x0009035CL)
 #endif
 
-#ifndef CRYPT_E_REVOKED
-#define CRYPT_E_REVOKED                       ((HRESULT)0x80092010L)
-#endif
-
-#ifndef CRYPT_E_NO_REVOCATION_DLL
-#define CRYPT_E_NO_REVOCATION_DLL             ((HRESULT)0x80092011L)
-#endif
-
-#ifndef CRYPT_E_NO_REVOCATION_CHECK
-#define CRYPT_E_NO_REVOCATION_CHECK           ((HRESULT)0x80092012L)
-#endif
-
-#ifndef CRYPT_E_REVOCATION_OFFLINE
-#define CRYPT_E_REVOCATION_OFFLINE            ((HRESULT)0x80092013L)
-#endif
-
+#ifdef __MINGW32CE__
 #ifndef CRYPT_E_NOT_IN_REVOCATION_DATABASE
 #define CRYPT_E_NOT_IN_REVOCATION_DATABASE    ((HRESULT)0x80092014L)
 #endif
-
-#ifdef UNICODE
-#  define SECFLAG_WINNT_AUTH_IDENTITY \
-     (unsigned long)SEC_WINNT_AUTH_IDENTITY_UNICODE
-#else
-#  define SECFLAG_WINNT_AUTH_IDENTITY \
-     (unsigned long)SEC_WINNT_AUTH_IDENTITY_ANSI
-#endif
+#endif /* __MINGW32CE__ */
 
 /*
  * Definitions required from ntsecapi.h are directly provided below this point
diff --git a/deps/curl/lib/curl_threads.c b/deps/curl/lib/curl_threads.c
index eae75440161..2750f5ad9f7 100644
--- a/deps/curl/lib/curl_threads.c
+++ b/deps/curl/lib/curl_threads.c
@@ -26,7 +26,7 @@
 
 #include <curl/curl.h>
 
-#if defined(USE_THREADS_POSIX)
+#ifdef USE_THREADS_POSIX
 #  ifdef HAVE_PTHREAD_H
 #    include <pthread.h>
 #  endif
@@ -36,10 +36,10 @@
 
 #include "curl_threads.h"
 #include "curl_memory.h"
-/* The last #include file should be: */
+/* The last #include FILE should be: */
 #include "memdebug.h"
 
-#if defined(USE_THREADS_POSIX)
+#ifdef USE_THREADS_POSIX
 
 struct Curl_actual_call {
   unsigned int (*func)(void *);
@@ -59,7 +59,8 @@ static void *curl_thread_create_thunk(void *arg)
   return 0;
 }
 
-curl_thread_t Curl_thread_create(unsigned int (*func) (void *), void *arg)
+curl_thread_t Curl_thread_create(CURL_THREAD_RETURN_T
+                                 (CURL_STDCALL *func) (void *), void *arg)
 {
   curl_thread_t t = malloc(sizeof(pthread_t));
   struct Curl_actual_call *ac = malloc(sizeof(struct Curl_actual_call));
@@ -99,16 +100,38 @@ int Curl_thread_join(curl_thread_t *hnd)
   return ret;
 }
 
-#elif defined(USE_THREADS_WIN32)
+/* do not use pthread_cancel if:
+ * - pthread_cancel seems to be absent
+ * - on FreeBSD, as we see hangers in CI testing
+ * - this is a -fsanitize=thread build
+ *   (clang sanitizer reports false positive when functions to not return)
+ */
+#if defined(PTHREAD_CANCEL_ENABLE) && !defined(__FreeBSD__)
+#if defined(__has_feature)
+#  if !__has_feature(thread_sanitizer)
+#define USE_PTHREAD_CANCEL
+#  endif
+#else /* __has_feature */
+#define USE_PTHREAD_CANCEL
+#endif /* !__has_feature */
+#endif /* PTHREAD_CANCEL_ENABLE && !__FreeBSD__ */
 
-curl_thread_t Curl_thread_create(
-#if defined(CURL_WINDOWS_UWP) || defined(UNDER_CE)
-                                 DWORD
+int Curl_thread_cancel(curl_thread_t *hnd)
+{
+  (void)hnd;
+  if(*hnd != curl_thread_t_null)
+#ifdef USE_PTHREAD_CANCEL
+    return pthread_cancel(**hnd);
 #else
-                                 unsigned int
+    return 1; /* not supported */
 #endif
-                                 (CURL_STDCALL *func) (void *),
-                                 void *arg)
+  return 0;
+}
+
+#elif defined(USE_THREADS_WIN32)
+
+curl_thread_t Curl_thread_create(CURL_THREAD_RETURN_T
+                                 (CURL_STDCALL *func) (void *), void *arg)
 {
 #if defined(CURL_WINDOWS_UWP) || defined(UNDER_CE)
   typedef HANDLE curl_win_thread_handle_t;
@@ -147,8 +170,7 @@ void Curl_thread_destroy(curl_thread_t *hnd)
 
 int Curl_thread_join(curl_thread_t *hnd)
 {
-#if !defined(_WIN32_WINNT) || !defined(_WIN32_WINNT_VISTA) || \
-    (_WIN32_WINNT < _WIN32_WINNT_VISTA)
+#if !defined(_WIN32_WINNT) || (_WIN32_WINNT < _WIN32_WINNT_VISTA)
   int ret = (WaitForSingleObject(*hnd, INFINITE) == WAIT_OBJECT_0);
 #else
   int ret = (WaitForSingleObjectEx(*hnd, INFINITE, FALSE) == WAIT_OBJECT_0);
@@ -156,7 +178,16 @@ int Curl_thread_join(curl_thread_t *hnd)
 
   Curl_thread_destroy(hnd);
 
+
   return ret;
 }
 
+int Curl_thread_cancel(curl_thread_t *hnd)
+{
+  if(*hnd != curl_thread_t_null) {
+    return 1; /* not supported */
+  }
+  return 0;
+}
+
 #endif /* USE_THREADS_* */
diff --git a/deps/curl/lib/curl_threads.h b/deps/curl/lib/curl_threads.h
index b060d4acd3e..115277c00ea 100644
--- a/deps/curl/lib/curl_threads.h
+++ b/deps/curl/lib/curl_threads.h
@@ -25,7 +25,7 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#if defined(USE_THREADS_POSIX)
+#ifdef USE_THREADS_POSIX
 #  define CURL_STDCALL
 #  define curl_mutex_t           pthread_mutex_t
 #  define curl_thread_t          pthread_t *
@@ -39,8 +39,7 @@
 #  define curl_mutex_t           CRITICAL_SECTION
 #  define curl_thread_t          HANDLE
 #  define curl_thread_t_null     (HANDLE)0
-#  if !defined(_WIN32_WINNT) || !defined(_WIN32_WINNT_VISTA) || \
-      (_WIN32_WINNT < _WIN32_WINNT_VISTA)
+#  if !defined(_WIN32_WINNT) || (_WIN32_WINNT < _WIN32_WINNT_VISTA)
 #    define Curl_mutex_init(m)   InitializeCriticalSection(m)
 #  else
 #    define Curl_mutex_init(m)   InitializeCriticalSectionEx(m, 0, 1)
@@ -48,23 +47,41 @@
 #  define Curl_mutex_acquire(m)  EnterCriticalSection(m)
 #  define Curl_mutex_release(m)  LeaveCriticalSection(m)
 #  define Curl_mutex_destroy(m)  DeleteCriticalSection(m)
+#else
+#  define CURL_STDCALL
 #endif
 
-#if defined(USE_THREADS_POSIX) || defined(USE_THREADS_WIN32)
-
-curl_thread_t Curl_thread_create(
 #if defined(CURL_WINDOWS_UWP) || defined(UNDER_CE)
-                                 DWORD
+#define CURL_THREAD_RETURN_T DWORD
 #else
-                                 unsigned int
+#define CURL_THREAD_RETURN_T unsigned int
 #endif
-                                 (CURL_STDCALL *func) (void *),
-                                 void *arg);
+
+#if defined(USE_THREADS_POSIX) || defined(USE_THREADS_WIN32)
+
+curl_thread_t Curl_thread_create(CURL_THREAD_RETURN_T
+                                 (CURL_STDCALL *func) (void *), void *arg);
 
 void Curl_thread_destroy(curl_thread_t *hnd);
 
 int Curl_thread_join(curl_thread_t *hnd);
 
+int Curl_thread_cancel(curl_thread_t *hnd);
+
+#if defined(USE_THREADS_POSIX) && defined(PTHREAD_CANCEL_ENABLE)
+#define Curl_thread_push_cleanup(a,b)   pthread_cleanup_push(a,b)
+#define Curl_thread_pop_cleanup()       pthread_cleanup_pop(0)
+#define Curl_thread_enable_cancel()     \
+    pthread_setcancelstate(PTHREAD_CANCEL_ENABLE, NULL)
+#define Curl_thread_disable_cancel()     \
+    pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL)
+#else
+#define Curl_thread_push_cleanup(a,b)   ((void)a,(void)b)
+#define Curl_thread_pop_cleanup()       Curl_nop_stmt
+#define Curl_thread_enable_cancel()     Curl_nop_stmt
+#define Curl_thread_disable_cancel()    Curl_nop_stmt
+#endif
+
 #endif /* USE_THREADS_POSIX || USE_THREADS_WIN32 */
 
 #endif /* HEADER_CURL_THREADS_H */
diff --git a/deps/curl/lib/curl_trc.c b/deps/curl/lib/curl_trc.c
index 334b6e2a1db..52671f4eaeb 100644
--- a/deps/curl/lib/curl_trc.c
+++ b/deps/curl/lib/curl_trc.c
@@ -41,6 +41,7 @@
 #include "cf-h2-proxy.h"
 #include "cf-haproxy.h"
 #include "cf-https-connect.h"
+#include "cf-ip-happy.h"
 #include "socks.h"
 #include "curlx/strparse.h"
 #include "vtls/vtls.h"
@@ -161,10 +162,12 @@ void Curl_debug(struct Curl_easy *data, curl_infotype type,
       case CURLINFO_TEXT:
       case CURLINFO_HEADER_OUT:
       case CURLINFO_HEADER_IN:
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
         if(CURL_TRC_IDS(data)) {
           len = trc_print_ids(data, buf, TRC_LINE_MAX);
           fwrite(buf, len, 1, data->set.err);
         }
+#endif
         fwrite(s_infotype[type], 2, 1, data->set.err);
         fwrite(ptr, size, 1, data->set.err);
         break;
@@ -199,8 +202,7 @@ void Curl_failf(struct Curl_easy *data, const char *fmt, ...)
   }
 }
 
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
-
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
 
 static void trc_infof(struct Curl_easy *data,
                       struct curl_trc_feat *feat,
@@ -271,6 +273,45 @@ struct curl_trc_feat Curl_trc_feat_dns = {
   CURL_LOG_LVL_NONE,
 };
 
+static const char * const Curl_trc_timer_names[]={
+  "100_TIMEOUT",
+  "ASYNC_NAME",
+  "CONNECTTIMEOUT",
+  "DNS_PER_NAME",
+  "DNS_PER_NAME2",
+  "HAPPY_EYEBALLS_DNS",
+  "HAPPY_EYEBALLS",
+  "MULTI_PENDING",
+  "SPEEDCHECK",
+  "TIMEOUT",
+  "TOOFAST",
+  "QUIC",
+  "FTP_ACCEPT",
+  "ALPN_EYEBALLS",
+  "SHUTDOWN",
+};
+
+const char *Curl_trc_timer_name(int tid)
+{
+  if((tid >= 0) && ((size_t)tid < CURL_ARRAYSIZE(Curl_trc_timer_names)))
+    return Curl_trc_timer_names[(size_t)tid];
+  return "UNKNOWN?";
+}
+
+void Curl_trc_multi_timeouts(struct Curl_easy *data)
+{
+  struct Curl_llist_node *e = Curl_llist_head(&data->state.timeoutlist);
+  if(e) {
+    struct curltime now = curlx_now();
+    while(e) {
+      struct time_node *n = Curl_node_elem(e);
+      e = Curl_node_next(e);
+      CURL_TRC_M(data, "[TIMEOUT] %s expires in %" FMT_TIMEDIFF_T "ns",
+                 CURL_TIMER_NAME(n->eid),
+                 curlx_timediff_us(n->time, now));
+    }
+  }
+}
 
 static const char * const Curl_trc_mstate_names[]={
   "INIT",
@@ -461,9 +502,9 @@ static struct trc_cft_def trc_cfts[] = {
   { &Curl_cft_udp,            TRC_CT_NETWORK },
   { &Curl_cft_unix,           TRC_CT_NETWORK },
   { &Curl_cft_tcp_accept,     TRC_CT_NETWORK },
-  { &Curl_cft_happy_eyeballs, TRC_CT_NETWORK },
+  { &Curl_cft_ip_happy,       TRC_CT_NETWORK },
   { &Curl_cft_setup,          TRC_CT_PROTOCOL },
-#ifdef USE_NGHTTP2
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGHTTP2)
   { &Curl_cft_nghttp2,        TRC_CT_PROTOCOL },
 #endif
 #ifdef USE_SSL
@@ -472,8 +513,8 @@ static struct trc_cft_def trc_cfts[] = {
   { &Curl_cft_ssl_proxy,      TRC_CT_PROXY },
 #endif
 #endif
-#if !defined(CURL_DISABLE_PROXY)
-#if !defined(CURL_DISABLE_HTTP)
+#ifndef CURL_DISABLE_PROXY
+#ifndef CURL_DISABLE_HTTP
   { &Curl_cft_h1_proxy,       TRC_CT_PROXY },
 #ifdef USE_NGHTTP2
   { &Curl_cft_h2_proxy,       TRC_CT_PROXY },
@@ -483,10 +524,10 @@ static struct trc_cft_def trc_cfts[] = {
   { &Curl_cft_haproxy,        TRC_CT_PROXY },
   { &Curl_cft_socks_proxy,    TRC_CT_PROXY },
 #endif /* !CURL_DISABLE_PROXY */
-#ifdef USE_HTTP3
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
   { &Curl_cft_http3,          TRC_CT_PROTOCOL },
 #endif
-#if !defined(CURL_DISABLE_HTTP)
+#ifndef CURL_DISABLE_HTTP
   { &Curl_cft_http_connect,   TRC_CT_PROTOCOL },
 #endif
 };
@@ -581,7 +622,7 @@ CURLcode Curl_trc_init(void)
 #endif
 }
 
-#else /* defined(CURL_DISABLE_VERBOSE_STRINGS) */
+#else /* CURL_DISABLE_VERBOSE_STRINGS */
 
 CURLcode Curl_trc_init(void)
 {
@@ -633,17 +674,18 @@ void Curl_trc_smtp(struct Curl_easy *data, const char *fmt, ...)
   (void)data; (void)fmt;
 }
 #endif
-#if !defined(CURL_DISABLE_WEBSOCKETS) || !defined(CURL_DISABLE_HTTP)
+#if !defined(CURL_DISABLE_WEBSOCKETS) && !defined(CURL_DISABLE_HTTP)
 void Curl_trc_ws(struct Curl_easy *data, const char *fmt, ...)
 {
   (void)data; (void)fmt;
 }
 #endif
-
+#ifdef USE_SSL
 void Curl_trc_ssls(struct Curl_easy *data, const char *fmt, ...)
 {
   (void)data;
   (void)fmt;
 }
+#endif
 
-#endif /* !defined(CURL_DISABLE_VERBOSE_STRINGS) */
+#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
diff --git a/deps/curl/lib/curl_trc.h b/deps/curl/lib/curl_trc.h
index ed7e5d89f00..fa0999250fb 100644
--- a/deps/curl/lib/curl_trc.h
+++ b/deps/curl/lib/curl_trc.h
@@ -85,6 +85,9 @@ void Curl_trc_cf_infof(struct Curl_easy *data, const struct Curl_cfilter *cf,
 void Curl_trc_multi(struct Curl_easy *data,
                     const char *fmt, ...) CURL_PRINTF(2, 3);
 const char *Curl_trc_mstate_name(int state);
+const char *Curl_trc_timer_name(int tid);
+void Curl_trc_multi_timeouts(struct Curl_easy *data);
+
 void Curl_trc_write(struct Curl_easy *data,
                     const char *fmt, ...) CURL_PRINTF(2, 3);
 void Curl_trc_read(struct Curl_easy *data,
@@ -113,12 +116,15 @@ void Curl_trc_ws(struct Curl_easy *data,
                  const char *fmt, ...) CURL_PRINTF(2, 3);
 #endif
 
+#define CURL_TRC_M_is_verbose(data) \
+  Curl_trc_ft_is_verbose(data, &Curl_trc_feat_multi)
+
 #if defined(CURL_HAVE_C99) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
 #define infof(data, ...) \
   do { if(Curl_trc_is_verbose(data)) \
          Curl_infof(data, __VA_ARGS__); } while(0)
 #define CURL_TRC_M(data, ...) \
-  do { if(Curl_trc_ft_is_verbose(data, &Curl_trc_feat_multi)) \
+  do { if(CURL_TRC_M_is_verbose(data)) \
          Curl_trc_multi(data, __VA_ARGS__); } while(0)
 #define CURL_TRC_CF(data, cf, ...) \
   do { if(Curl_trc_cf_is_verbose(cf, data)) \
@@ -202,15 +208,21 @@ extern struct curl_trc_feat Curl_trc_feat_dns;
             (Curl_trc_is_verbose(data) && \
              (ft)->log_level >= CURL_LOG_LVL_INFO)
 #define CURL_MSTATE_NAME(s)  Curl_trc_mstate_name((int)(s))
+#define CURL_TIMER_NAME(t)   Curl_trc_timer_name((int)(t))
+#define CURL_TRC_M_TIMEOUTS(data) \
+  do { if(CURL_TRC_M_is_verbose(data)) \
+         Curl_trc_multi_timeouts(data); } while(0)
 
-#else /* defined(CURL_DISABLE_VERBOSE_STRINGS) */
+#else /* CURL_DISABLE_VERBOSE_STRINGS */
 /* All informational messages are not compiled in for size savings */
 
 #define Curl_trc_is_verbose(d)        (FALSE)
 #define Curl_trc_cf_is_verbose(x,y)   (FALSE)
 #define Curl_trc_ft_is_verbose(x,y)   (FALSE)
 #define CURL_MSTATE_NAME(x)           ((void)(x), "-")
+#define CURL_TIMER_NAME(x)            ((void)(x), "-")
+#define CURL_TRC_M_TIMEOUTS(x)        Curl_nop_stmt
 
-#endif /* !defined(CURL_DISABLE_VERBOSE_STRINGS) */
+#endif /* !CURL_DISABLE_VERBOSE_STRINGS */
 
 #endif /* HEADER_CURL_TRC_H */
diff --git a/deps/curl/lib/curlx/base64.c b/deps/curl/lib/curlx/base64.c
index 92ebc57e1e6..dc6e9c001ce 100644
--- a/deps/curl/lib/curlx/base64.c
+++ b/deps/curl/lib/curlx/base64.c
@@ -26,13 +26,6 @@
 
 #include "../curl_setup.h"
 
-#if !defined(CURL_DISABLE_HTTP_AUTH) || defined(USE_SSH) || \
-  !defined(CURL_DISABLE_LDAP) || \
-  !defined(CURL_DISABLE_SMTP) || \
-  !defined(CURL_DISABLE_POP3) || \
-  !defined(CURL_DISABLE_IMAP) || \
-  !defined(CURL_DISABLE_DIGEST_AUTH) || \
-  !defined(CURL_DISABLE_DOH) || defined(USE_SSL) || !defined(BUILDING_LIBCURL)
 #include <curl/curl.h>
 #include "warnless.h"
 #include "base64.h"
@@ -281,5 +274,3 @@ CURLcode curlx_base64url_encode(const char *inputbuff, size_t insize,
 {
   return base64_encode(base64url, 0, inputbuff, insize, outptr, outlen);
 }
-
-#endif /* no users so disabled */
diff --git a/deps/curl/lib/curlx/dynbuf.c b/deps/curl/lib/curlx/dynbuf.c
index 0b8dfe8e34f..447203e42a8 100644
--- a/deps/curl/lib/curlx/dynbuf.c
+++ b/deps/curl/lib/curlx/dynbuf.c
@@ -71,14 +71,14 @@ void curlx_dyn_free(struct dynbuf *s)
 static CURLcode dyn_nappend(struct dynbuf *s,
                             const unsigned char *mem, size_t len)
 {
-  size_t indx = s->leng;
+  size_t idx = s->leng;
   size_t a = s->allc;
-  size_t fit = len + indx + 1; /* new string + old string + zero byte */
+  size_t fit = len + idx + 1; /* new string + old string + zero byte */
 
   /* try to detect if there is rubbish in the struct */
   DEBUGASSERT(s->init == DYNINIT);
   DEBUGASSERT(s->toobig);
-  DEBUGASSERT(indx < s->toobig);
+  DEBUGASSERT(idx < s->toobig);
   DEBUGASSERT(!s->leng || s->bufr);
   DEBUGASSERT(a <= s->toobig);
   DEBUGASSERT(!len || mem);
@@ -88,7 +88,7 @@ static CURLcode dyn_nappend(struct dynbuf *s,
     return CURLE_TOO_LARGE;
   }
   else if(!a) {
-    DEBUGASSERT(!indx);
+    DEBUGASSERT(!idx);
     /* first invoke */
     if(MIN_FIRST_ALLOC > s->toobig)
       a = s->toobig;
@@ -118,8 +118,8 @@ static CURLcode dyn_nappend(struct dynbuf *s,
   }
 
   if(len)
-    memcpy(&s->bufr[indx], mem, len);
-  s->leng = indx + len;
+    memcpy(&s->bufr[idx], mem, len);
+  s->leng = idx + len;
   s->bufr[s->leng] = 0;
   return CURLE_OK;
 }
@@ -231,6 +231,7 @@ CURLcode curlx_dyn_addf(struct dynbuf *s, const char *fmt, ...)
   DEBUGASSERT(s);
   DEBUGASSERT(s->init == DYNINIT);
   DEBUGASSERT(!s->leng || s->bufr);
+  DEBUGASSERT(strcmp(fmt, "%s")); /* use curlx_dyn_add instead */
   va_start(ap, fmt);
   result = curlx_dyn_vaddf(s, fmt, ap);
   va_end(ap);
diff --git a/deps/curl/lib/curlx/dynbuf.h b/deps/curl/lib/curlx/dynbuf.h
index 27335a6fbf4..00ca0478936 100644
--- a/deps/curl/lib/curlx/dynbuf.h
+++ b/deps/curl/lib/curlx/dynbuf.h
@@ -62,7 +62,7 @@ int curlx_dyn_vprintf(struct dynbuf *dyn, const char *format, va_list ap_save);
 char *curlx_dyn_take(struct dynbuf *s, size_t *plen);
 
 /* Dynamic buffer max sizes */
-#define MAX_DYNBUF_SIZE (SIZE_T_MAX/2)
+#define MAX_DYNBUF_SIZE (SIZE_MAX/2)
 
 #define DYN_DOH_RESPONSE    3000
 #define DYN_DOH_CNAME       256
diff --git a/deps/curl/lib/curlx/inet_ntop.c b/deps/curl/lib/curlx/inet_ntop.c
index e5ff45cb1be..3f8bcbf3668 100644
--- a/deps/curl/lib/curlx/inet_ntop.c
+++ b/deps/curl/lib/curlx/inet_ntop.c
@@ -54,7 +54,7 @@
  *
  * Returns `dst' (as a const)
  * Note:
- *  - uses no statics
+ *  - uses no static variables
  *  - takes an unsigned char* not an in_addr as input
  */
 static char *inet_ntop4(const unsigned char *src, char *dst, size_t size)
diff --git a/deps/curl/lib/curlx/inet_ntop.h b/deps/curl/lib/curlx/inet_ntop.h
index 68f8c8d132d..490f49e8a19 100644
--- a/deps/curl/lib/curlx/inet_ntop.h
+++ b/deps/curl/lib/curlx/inet_ntop.h
@@ -26,8 +26,6 @@
 
 #include "../curl_setup.h"
 
-char *curlx_inet_ntop(int af, const void *addr, char *buf, size_t size);
-
 #ifdef HAVE_INET_NTOP
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
@@ -46,6 +44,8 @@ char *curlx_inet_ntop(int af, const void *addr, char *buf, size_t size);
 #define curlx_inet_ntop(af,addr,buf,size)                \
   inet_ntop(af, addr, buf, (curl_socklen_t)(size))
 #endif
-#endif
+#else
+char *curlx_inet_ntop(int af, const void *addr, char *buf, size_t size);
+#endif /* HAVE_INET_NTOP */
 
 #endif /* HEADER_CURL_INET_NTOP_H */
diff --git a/deps/curl/lib/curlx/inet_pton.h b/deps/curl/lib/curlx/inet_pton.h
index 610b329f51d..a9ad24c9447 100644
--- a/deps/curl/lib/curlx/inet_pton.h
+++ b/deps/curl/lib/curlx/inet_pton.h
@@ -26,8 +26,6 @@
 
 #include "../curl_setup.h"
 
-int curlx_inet_pton(int, const char *, void *);
-
 #ifdef HAVE_INET_PTON
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
@@ -43,6 +41,8 @@ int curlx_inet_pton(int, const char *, void *);
 #else
 #define curlx_inet_pton(x,y,z) inet_pton(x,y,z)
 #endif
-#endif
+#else
+int curlx_inet_pton(int, const char *, void *);
+#endif /* HAVE_INET_PTON */
 
 #endif /* HEADER_CURL_INET_PTON_H */
diff --git a/deps/curl/lib/curlx/multibyte.h b/deps/curl/lib/curlx/multibyte.h
index 7835fdc3b5e..c60ce258c9b 100644
--- a/deps/curl/lib/curlx/multibyte.h
+++ b/deps/curl/lib/curlx/multibyte.h
@@ -26,14 +26,10 @@
 #include "../curl_setup.h"
 
 #ifdef _WIN32
-
- /*
-  * MultiByte conversions using Windows kernel32 library.
-  */
-
+/* MultiByte conversions using Windows kernel32 library. */
 wchar_t *curlx_convert_UTF8_to_wchar(const char *str_utf8);
 char *curlx_convert_wchar_to_UTF8(const wchar_t *str_w);
-#endif /* _WIN32 */
+#endif
 
 /*
  * Macros curlx_convert_UTF8_to_tchar(), curlx_convert_tchar_to_UTF8()
diff --git a/deps/curl/lib/curlx/nonblock.c b/deps/curl/lib/curlx/nonblock.c
index 409b187f1fd..b944f9546bb 100644
--- a/deps/curl/lib/curlx/nonblock.c
+++ b/deps/curl/lib/curlx/nonblock.c
@@ -46,7 +46,7 @@
 int curlx_nonblock(curl_socket_t sockfd,    /* operate on this */
                    int nonblock   /* TRUE or FALSE */)
 {
-#if defined(HAVE_FCNTL_O_NONBLOCK)
+#ifdef HAVE_FCNTL_O_NONBLOCK
   /* most recent Unix versions */
   int flags;
   flags = sfcntl(sockfd, F_GETFL, 0);
diff --git a/deps/curl/lib/curlx/strparse.c b/deps/curl/lib/curlx/strparse.c
index ecdf5b96153..a29d8be2fdb 100644
--- a/deps/curl/lib/curlx/strparse.c
+++ b/deps/curl/lib/curlx/strparse.c
@@ -165,7 +165,7 @@ static int str_num_base(const char **linep, curl_off_t *nump, curl_off_t max,
     (base == 16) ? 'f' : '7';
   DEBUGASSERT(linep && *linep && nump);
   DEBUGASSERT((base == 8) || (base == 10) || (base == 16));
-  DEBUGASSERT(max >= 0); /* mostly to catch SIZE_T_MAX, which is too large */
+  DEBUGASSERT(max >= 0); /* mostly to catch SIZE_MAX, which is too large */
   *nump = 0;
   p = *linep;
   if(!valid_digit(*p, m))
diff --git a/deps/curl/lib/curlx/timeval.c b/deps/curl/lib/curlx/timeval.c
index 501bf9c3fd9..bd8b9bcee27 100644
--- a/deps/curl/lib/curlx/timeval.c
+++ b/deps/curl/lib/curlx/timeval.c
@@ -115,7 +115,7 @@ struct curltime curlx_now(void)
         (HAVE_BUILTIN_AVAILABLE == 1)
     have_clock_gettime &&
 #endif
-    (0 == clock_gettime(CLOCK_MONOTONIC_RAW, &tsnow))) {
+    (clock_gettime(CLOCK_MONOTONIC_RAW, &tsnow) == 0)) {
     cnow.tv_sec = tsnow.tv_sec;
     cnow.tv_usec = (int)(tsnow.tv_nsec / 1000);
   }
@@ -127,7 +127,7 @@ struct curltime curlx_now(void)
         (HAVE_BUILTIN_AVAILABLE == 1)
     have_clock_gettime &&
 #endif
-    (0 == clock_gettime(CLOCK_MONOTONIC, &tsnow))) {
+    (clock_gettime(CLOCK_MONOTONIC, &tsnow) == 0)) {
     cnow.tv_sec = tsnow.tv_sec;
     cnow.tv_usec = (int)(tsnow.tv_nsec / 1000);
   }
@@ -168,11 +168,11 @@ struct curltime curlx_now(void)
   struct curltime cnow;
   uint64_t usecs;
 
-  if(0 == timebase.denom)
-    (void) mach_timebase_info(&timebase);
+  if(timebase.denom == 0)
+    (void)mach_timebase_info(&timebase);
 
   usecs = mach_absolute_time();
-  usecs *= timebase.numer;
+  usecs *= timebase.numer; /* spellchecker:disable-line */
   usecs /= timebase.denom;
   usecs /= 1000;
 
diff --git a/deps/curl/lib/curlx/wait.c b/deps/curl/lib/curlx/wait.c
index f568fb6948f..4e10a8297a9 100644
--- a/deps/curl/lib/curlx/wait.c
+++ b/deps/curl/lib/curlx/wait.c
@@ -68,7 +68,7 @@ int curlx_wait_ms(timediff_t timeout_ms)
     SET_SOCKERRNO(SOCKEINVAL);
     return -1;
   }
-#if defined(MSDOS)
+#ifdef MSDOS
   delay((unsigned int)timeout_ms);
 #elif defined(_WIN32)
   /* prevent overflow, timeout_ms is typecast to ULONG/DWORD. */
diff --git a/deps/curl/lib/curlx/warnless.c b/deps/curl/lib/curlx/warnless.c
index c6cb7c6e5e3..bb636a93270 100644
--- a/deps/curl/lib/curlx/warnless.c
+++ b/deps/curl/lib/curlx/warnless.c
@@ -98,7 +98,7 @@ unsigned long curlx_uztoul(size_t uznum)
 #  pragma warning(disable:810) /* conversion may lose significant bits */
 #endif
 
-#if ULONG_MAX < SIZE_T_MAX
+#if ULONG_MAX < SIZE_MAX
   DEBUGASSERT(uznum <= (size_t) CURL_MASK_ULONG);
 #endif
   return (unsigned long)(uznum & (size_t) CURL_MASK_ULONG);
@@ -119,7 +119,7 @@ unsigned int curlx_uztoui(size_t uznum)
 #  pragma warning(disable:810) /* conversion may lose significant bits */
 #endif
 
-#if UINT_MAX < SIZE_T_MAX
+#if UINT_MAX < SIZE_MAX
   DEBUGASSERT(uznum <= (size_t) CURL_MASK_UINT);
 #endif
   return (unsigned int)(uznum & (size_t) CURL_MASK_UINT);
@@ -243,7 +243,7 @@ int curlx_sztosi(ssize_t sznum)
 #endif
 
   DEBUGASSERT(sznum >= 0);
-#if INT_MAX < SSIZE_T_MAX
+#if INT_MAX < SSIZE_MAX
   DEBUGASSERT((size_t) sznum <= (size_t) CURL_MASK_SINT);
 #endif
   return (int)(sznum & (ssize_t) CURL_MASK_SINT);
diff --git a/deps/curl/lib/cw-out.c b/deps/curl/lib/cw-out.c
index ee7dc65dffc..6d988a00bf8 100644
--- a/deps/curl/lib/cw-out.c
+++ b/deps/curl/lib/cw-out.c
@@ -74,6 +74,7 @@
 typedef enum {
   CW_OUT_NONE,
   CW_OUT_BODY,
+  CW_OUT_BODY_0LEN,
   CW_OUT_HDS
 } cw_out_type;
 
@@ -170,6 +171,7 @@ static void cw_get_writefunc(struct Curl_easy *data, cw_out_type otype,
 {
   switch(otype) {
   case CW_OUT_BODY:
+  case CW_OUT_BODY_0LEN:
     *pwcb = data->set.fwrite_func;
     *pwcb_data = data->set.out;
     *pmax_write = CURL_MAX_WRITE_SIZE;
@@ -193,6 +195,51 @@ static void cw_get_writefunc(struct Curl_easy *data, cw_out_type otype,
   }
 }
 
+static CURLcode cw_out_cb_write(struct cw_out_ctx *ctx,
+                                struct Curl_easy *data,
+                                curl_write_callback wcb,
+                                void *wcb_data,
+                                cw_out_type otype,
+                                const char *buf, size_t blen,
+                                size_t *pnwritten)
+{
+  size_t nwritten;
+  CURLcode result;
+
+  DEBUGASSERT(data->conn);
+  *pnwritten = 0;
+  Curl_set_in_callback(data, TRUE);
+  nwritten = wcb((char *)CURL_UNCONST(buf), 1, blen, wcb_data);
+  Curl_set_in_callback(data, FALSE);
+  CURL_TRC_WRITE(data, "[OUT] wrote %zu %s bytes -> %zu",
+                 blen, (otype == CW_OUT_HDS) ? "header" : "body",
+                 nwritten);
+  if(CURL_WRITEFUNC_PAUSE == nwritten) {
+    if(data->conn->handler->flags & PROTOPT_NONETWORK) {
+      /* Protocols that work without network cannot be paused. This is
+         actually only FILE:// just now, and it cannot pause since the
+         transfer is not done using the "normal" procedure. */
+      failf(data, "Write callback asked for PAUSE when not supported");
+      return CURLE_WRITE_ERROR;
+    }
+    ctx->paused = TRUE;
+    CURL_TRC_WRITE(data, "[OUT] PAUSE requested by client");
+    result = Curl_xfer_pause_recv(data, TRUE);
+    return result ? result : CURLE_AGAIN;
+  }
+  else if(CURL_WRITEFUNC_ERROR == nwritten) {
+    failf(data, "client returned ERROR on write of %zu bytes", blen);
+    return CURLE_WRITE_ERROR;
+  }
+  else if(nwritten != blen) {
+    failf(data, "Failure writing output to destination, "
+          "passed %zu returned %zd", blen, nwritten);
+    return CURLE_WRITE_ERROR;
+  }
+  *pnwritten = nwritten;
+  return CURLE_OK;
+}
+
 static CURLcode cw_out_ptr_flush(struct cw_out_ctx *ctx,
                                  struct Curl_easy *data,
                                  cw_out_type otype,
@@ -204,6 +251,7 @@ static CURLcode cw_out_ptr_flush(struct cw_out_ctx *ctx,
   void *wcb_data;
   size_t max_write, min_write;
   size_t wlen, nwritten;
+  CURLcode result;
 
   /* If we errored once, we do not invoke the client callback  again */
   if(ctx->errored)
@@ -217,40 +265,24 @@ static CURLcode cw_out_ptr_flush(struct cw_out_ctx *ctx,
   }
 
   *pconsumed = 0;
-  while(blen && !ctx->paused) {
-    if(!flush_all && blen < min_write)
-      break;
-    wlen = max_write ? CURLMIN(blen, max_write) : blen;
-    Curl_set_in_callback(data, TRUE);
-    nwritten = wcb((char *)CURL_UNCONST(buf), 1, wlen, wcb_data);
-    Curl_set_in_callback(data, FALSE);
-    CURL_TRC_WRITE(data, "[OUT] wrote %zu %s bytes -> %zu",
-                   wlen, (otype == CW_OUT_BODY) ? "body" : "header",
-                   nwritten);
-    if(CURL_WRITEFUNC_PAUSE == nwritten) {
-      if(data->conn && data->conn->handler->flags & PROTOPT_NONETWORK) {
-        /* Protocols that work without network cannot be paused. This is
-           actually only FILE:// just now, and it cannot pause since the
-           transfer is not done using the "normal" procedure. */
-        failf(data, "Write callback asked for PAUSE when not supported");
-        return CURLE_WRITE_ERROR;
-      }
-      ctx->paused = TRUE;
-      CURL_TRC_WRITE(data, "[OUT] PAUSE requested by client");
-      return Curl_xfer_pause_recv(data, TRUE);
-    }
-    else if(CURL_WRITEFUNC_ERROR == nwritten) {
-      failf(data, "client returned ERROR on write of %zu bytes", wlen);
-      return CURLE_WRITE_ERROR;
-    }
-    else if(nwritten != wlen) {
-      failf(data, "Failure writing output to destination, "
-            "passed %zu returned %zd", wlen, nwritten);
-      return CURLE_WRITE_ERROR;
+  if(otype == CW_OUT_BODY_0LEN) {
+    DEBUGASSERT(!blen);
+    return cw_out_cb_write(ctx, data, wcb, wcb_data, otype,
+                           buf, blen, &nwritten);
+  }
+  else {
+    while(blen && !ctx->paused) {
+      if(!flush_all && blen < min_write)
+        break;
+      wlen = max_write ? CURLMIN(blen, max_write) : blen;
+      result = cw_out_cb_write(ctx, data, wcb, wcb_data, otype,
+                               buf, wlen, &nwritten);
+      if(result)
+        return result;
+      *pconsumed += nwritten;
+      blen -= nwritten;
+      buf += nwritten;
     }
-    *pconsumed += nwritten;
-    blen -= nwritten;
-    buf += nwritten;
   }
   return CURLE_OK;
 }
@@ -262,14 +294,14 @@ static CURLcode cw_out_buf_flush(struct cw_out_ctx *ctx,
 {
   CURLcode result = CURLE_OK;
 
-  if(curlx_dyn_len(&cwbuf->b)) {
+  if(curlx_dyn_len(&cwbuf->b) || (cwbuf->type == CW_OUT_BODY_0LEN)) {
     size_t consumed;
 
     result = cw_out_ptr_flush(ctx, data, cwbuf->type, flush_all,
                               curlx_dyn_ptr(&cwbuf->b),
                               curlx_dyn_len(&cwbuf->b),
                               &consumed);
-    if(result)
+    if(result && (result != CURLE_AGAIN))
       return result;
 
     if(consumed) {
@@ -382,8 +414,9 @@ static CURLcode cw_out_do_write(struct cw_out_ctx *ctx,
     size_t consumed;
     result = cw_out_ptr_flush(ctx, data, otype, flush_all,
                               buf, blen, &consumed);
-    if(result)
+    if(result && (result != CURLE_AGAIN))
       return result;
+    result = CURLE_OK;
     if(consumed < blen) {
       /* did not write all, append the rest */
       result = cw_out_append(ctx, data, otype,
@@ -413,7 +446,9 @@ static CURLcode cw_out_write(struct Curl_easy *data,
 
   if((type & CLIENTWRITE_BODY) ||
      ((type & CLIENTWRITE_HEADER) && data->set.include_header)) {
-    result = cw_out_do_write(ctx, data, CW_OUT_BODY, flush_all, buf, blen);
+    cw_out_type otype = (!blen && (type & CLIENTWRITE_0LEN)) ?
+                        CW_OUT_BODY_0LEN : CW_OUT_BODY;
+    result = cw_out_do_write(ctx, data, otype, flush_all, buf, blen);
     if(result)
       return result;
   }
diff --git a/deps/curl/lib/dict.c b/deps/curl/lib/dict.c
index 7f13e6f7ea9..819584f284a 100644
--- a/deps/curl/lib/dict.c
+++ b/deps/curl/lib/dict.c
@@ -92,10 +92,10 @@ const struct Curl_handler Curl_handler_dict = {
   ZERO_NULL,                            /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -242,7 +242,7 @@ static CURLcode dict_do(struct Curl_easy *data, bool *done)
       failf(data, "Failed sending DICT request");
       goto error;
     }
-    Curl_xfer_setup1(data, CURL_XFER_RECV, -1, FALSE); /* no upload */
+    Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
   }
   else if(curl_strnequal(path, DICT_DEFINE, sizeof(DICT_DEFINE)-1) ||
           curl_strnequal(path, DICT_DEFINE2, sizeof(DICT_DEFINE2)-1) ||
@@ -283,7 +283,7 @@ static CURLcode dict_do(struct Curl_easy *data, bool *done)
       failf(data, "Failed sending DICT request");
       goto error;
     }
-    Curl_xfer_setup1(data, CURL_XFER_RECV, -1, FALSE);
+    Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
   }
   else {
 
@@ -305,7 +305,7 @@ static CURLcode dict_do(struct Curl_easy *data, bool *done)
         goto error;
       }
 
-      Curl_xfer_setup1(data, CURL_XFER_RECV, -1, FALSE);
+      Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
     }
   }
 
diff --git a/deps/curl/lib/dllmain.c b/deps/curl/lib/dllmain.c
index 33076e05714..7ac457ae055 100644
--- a/deps/curl/lib/dllmain.c
+++ b/deps/curl/lib/dllmain.c
@@ -37,10 +37,8 @@
 #if defined(_WIN32) && !defined(CURL_STATICLIB)
 
 #if defined(USE_OPENSSL) && \
-    !defined(OPENSSL_IS_AWSLC) && \
-    !defined(OPENSSL_IS_BORINGSSL) && \
-    !defined(LIBRESSL_VERSION_NUMBER) && \
-    (OPENSSL_VERSION_NUMBER >= 0x10100000L)
+  !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) && \
+  !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10100000L
 #define PREVENT_OPENSSL_MEMLEAK
 #endif
 
diff --git a/deps/curl/lib/doh.c b/deps/curl/lib/doh.c
index f96ae0824a4..030b026fe29 100644
--- a/deps/curl/lib/doh.c
+++ b/deps/curl/lib/doh.c
@@ -348,10 +348,10 @@ static CURLcode doh_probe_run(struct Curl_easy *data,
 #endif
 #ifndef DEBUGBUILD
   /* enforce HTTPS if not debug */
-  ERROR_CHECK_SETOPT(CURLOPT_PROTOCOLS, (long)CURLPROTO_HTTPS);
+  ERROR_CHECK_SETOPT(CURLOPT_PROTOCOLS, CURLPROTO_HTTPS);
 #else
   /* in debug mode, also allow http */
-  ERROR_CHECK_SETOPT(CURLOPT_PROTOCOLS, (long)CURLPROTO_HTTP|CURLPROTO_HTTPS);
+  ERROR_CHECK_SETOPT(CURLOPT_PROTOCOLS, CURLPROTO_HTTP|CURLPROTO_HTTPS);
 #endif
   ERROR_CHECK_SETOPT(CURLOPT_TIMEOUT_MS, (long)timeout_ms);
   ERROR_CHECK_SETOPT(CURLOPT_SHARE, (CURLSH *)data->share);
@@ -484,7 +484,7 @@ struct Curl_addrinfo *Curl_doh(struct Curl_easy *data,
   data->sub_xfer_done = doh_probe_done;
 
   /* create IPv4 DoH request */
-  result = doh_probe_run(data, DNS_TYPE_A,
+  result = doh_probe_run(data, CURL_DNS_TYPE_A,
                          hostname, data->set.str[STRING_DOH],
                          data->multi,
                          &dohp->probe_resp[DOH_SLOT_IPV4].probe_mid);
@@ -495,7 +495,7 @@ struct Curl_addrinfo *Curl_doh(struct Curl_easy *data,
 #ifdef USE_IPV6
   if((ip_version != CURL_IPRESOLVE_V4) && Curl_ipv6works(data)) {
     /* create IPv6 DoH request */
-    result = doh_probe_run(data, DNS_TYPE_AAAA,
+    result = doh_probe_run(data, CURL_DNS_TYPE_AAAA,
                            hostname, data->set.str[STRING_DOH],
                            data->multi,
                            &dohp->probe_resp[DOH_SLOT_IPV6].probe_mid);
@@ -514,7 +514,7 @@ struct Curl_addrinfo *Curl_doh(struct Curl_easy *data,
       if(!qname)
         goto error;
     }
-    result = doh_probe_run(data, DNS_TYPE_HTTPS,
+    result = doh_probe_run(data, CURL_DNS_TYPE_HTTPS,
                            qname ? qname : hostname, data->set.str[STRING_DOH],
                            data->multi,
                            &dohp->probe_resp[DOH_SLOT_HTTPS_RR].probe_mid);
@@ -581,7 +581,7 @@ static void doh_store_a(const unsigned char *doh, int index,
   /* silently ignore addresses over the limit */
   if(d->numaddr < DOH_MAX_ADDR) {
     struct dohaddr *a = &d->addr[d->numaddr];
-    a->type = DNS_TYPE_A;
+    a->type = CURL_DNS_TYPE_A;
     memcpy(&a->ip.v4, &doh[index], 4);
     d->numaddr++;
   }
@@ -593,7 +593,7 @@ static void doh_store_aaaa(const unsigned char *doh, int index,
   /* silently ignore addresses over the limit */
   if(d->numaddr < DOH_MAX_ADDR) {
     struct dohaddr *a = &d->addr[d->numaddr];
-    a->type = DNS_TYPE_AAAA;
+    a->type = CURL_DNS_TYPE_AAAA;
     memcpy(&a->ip.v6, &doh[index], 16);
     d->numaddr++;
   }
@@ -681,29 +681,29 @@ static DOHcode doh_rdata(const unsigned char *doh,
   DOHcode rc;
 
   switch(type) {
-  case DNS_TYPE_A:
+  case CURL_DNS_TYPE_A:
     if(rdlength != 4)
       return DOH_DNS_RDATA_LEN;
     doh_store_a(doh, index, d);
     break;
-  case DNS_TYPE_AAAA:
+  case CURL_DNS_TYPE_AAAA:
     if(rdlength != 16)
       return DOH_DNS_RDATA_LEN;
     doh_store_aaaa(doh, index, d);
     break;
 #ifdef USE_HTTPSRR
-  case DNS_TYPE_HTTPS:
+  case CURL_DNS_TYPE_HTTPS:
     rc = doh_store_https(doh, index, d, rdlength);
     if(rc)
       return rc;
     break;
 #endif
-  case DNS_TYPE_CNAME:
+  case CURL_DNS_TYPE_CNAME:
     rc = doh_store_cname(doh, dohlen, (unsigned int)index, d);
     if(rc)
       return rc;
     break;
-  case DNS_TYPE_DNAME:
+  case CURL_DNS_TYPE_DNAME:
     /* explicit for clarity; just skip; rely on synthesized CNAME  */
     break;
   default:
@@ -770,8 +770,8 @@ UNITTEST DOHcode doh_resp_decode(const unsigned char *doh,
       return DOH_DNS_OUT_OF_RANGE;
 
     type = doh_get16bit(doh, index);
-    if((type != DNS_TYPE_CNAME)    /* may be synthesized from DNAME */
-       && (type != DNS_TYPE_DNAME) /* if present, accept and ignore */
+    if((type != CURL_DNS_TYPE_CNAME)    /* may be synthesized from DNAME */
+       && (type != CURL_DNS_TYPE_DNAME) /* if present, accept and ignore */
        && (type != dnstype))
       /* Not the same type as was asked for nor CNAME nor DNAME */
       return DOH_DNS_UNEXPECTED_TYPE;
@@ -855,9 +855,10 @@ UNITTEST DOHcode doh_resp_decode(const unsigned char *doh,
     return DOH_DNS_MALFORMAT; /* something is wrong */
 
 #ifdef USE_HTTTPS
-  if((type != DNS_TYPE_NS) && !d->numcname && !d->numaddr && !d->numhttps_rrs)
+  if((type != CURL_DNS_TYPE_NS) && !d->numcname && !d->numaddr &&
+      !d->numhttps_rrs)
 #else
-  if((type != DNS_TYPE_NS) && !d->numcname && !d->numaddr)
+  if((type != CURL_DNS_TYPE_NS) && !d->numcname && !d->numaddr)
 #endif
     /* nothing stored! */
     return DOH_NO_CONTENT;
@@ -873,12 +874,12 @@ static void doh_show(struct Curl_easy *data,
   infof(data, "[DoH] TTL: %u seconds", d->ttl);
   for(i = 0; i < d->numaddr; i++) {
     const struct dohaddr *a = &d->addr[i];
-    if(a->type == DNS_TYPE_A) {
+    if(a->type == CURL_DNS_TYPE_A) {
       infof(data, "[DoH] A: %u.%u.%u.%u",
             a->ip.v4[0], a->ip.v4[1],
             a->ip.v4[2], a->ip.v4[3]);
     }
-    else if(a->type == DNS_TYPE_AAAA) {
+    else if(a->type == CURL_DNS_TYPE_AAAA) {
       int j;
       char buffer[128] = "[DoH] AAAA: ";
       size_t len = strlen(buffer);
@@ -948,7 +949,7 @@ static CURLcode doh2ai(const struct dohentry *de, const char *hostname,
   for(i = 0; i < de->numaddr; i++) {
     size_t ss_size;
     CURL_SA_FAMILY_T addrtype;
-    if(de->addr[i].type == DNS_TYPE_AAAA) {
+    if(de->addr[i].type == CURL_DNS_TYPE_AAAA) {
 #ifndef USE_IPV6
       /* we cannot handle IPv6 addresses */
       continue;
@@ -1025,12 +1026,12 @@ static CURLcode doh2ai(const struct dohentry *de, const char *hostname,
 static const char *doh_type2name(DNStype dnstype)
 {
   switch(dnstype) {
-    case DNS_TYPE_A:
+    case CURL_DNS_TYPE_A:
       return "A";
-    case DNS_TYPE_AAAA:
+    case CURL_DNS_TYPE_AAAA:
       return "AAAA";
 #ifdef USE_HTTPSRR
-    case DNS_TYPE_HTTPS:
+    case CURL_DNS_TYPE_HTTPS:
       return "HTTPS";
 #endif
     default:
@@ -1248,8 +1249,8 @@ CURLcode Curl_doh_is_resolved(struct Curl_easy *data,
                                  p->dnstype, &de);
 #ifndef CURL_DISABLE_VERBOSE_STRINGS
       if(rc[slot]) {
-        infof(data, "DoH: %s type %s for %s", doh_strerror(rc[slot]),
-              doh_type2name(p->dnstype), dohp->host);
+        CURL_TRC_DNS(data, "DoH: %s type %s for %s", doh_strerror(rc[slot]),
+                     doh_type2name(p->dnstype), dohp->host);
       }
 #endif
     } /* next slot */
diff --git a/deps/curl/lib/doh.h b/deps/curl/lib/doh.h
index 9146f53580f..3fd7de2c1c5 100644
--- a/deps/curl/lib/doh.h
+++ b/deps/curl/lib/doh.h
@@ -51,12 +51,12 @@ typedef enum {
 } DOHcode;
 
 typedef enum {
-  DNS_TYPE_A = 1,
-  DNS_TYPE_NS = 2,
-  DNS_TYPE_CNAME = 5,
-  DNS_TYPE_AAAA = 28,
-  DNS_TYPE_DNAME = 39,           /* RFC6672 */
-  DNS_TYPE_HTTPS = 65
+  CURL_DNS_TYPE_A = 1,
+  CURL_DNS_TYPE_NS = 2,
+  CURL_DNS_TYPE_CNAME = 5,
+  CURL_DNS_TYPE_AAAA = 28,
+  CURL_DNS_TYPE_DNAME = 39,           /* RFC6672 */
+  CURL_DNS_TYPE_HTTPS = 65
 } DNStype;
 
 enum doh_slot_num {
diff --git a/deps/curl/lib/easy.c b/deps/curl/lib/easy.c
index 9c1f1c6969b..b9b8d527548 100644
--- a/deps/curl/lib/easy.c
+++ b/deps/curl/lib/easy.c
@@ -107,7 +107,7 @@ static curl_simple_lock s_lock = CURL_SIMPLE_LOCK_INIT;
  * ways, but at this point it must be defined as the system-supplied strdup
  * so the callback pointer is initialized correctly.
  */
-#if defined(UNDER_CE)
+#ifdef UNDER_CE
 #define system_strdup _strdup
 #elif !defined(HAVE_STRDUP)
 #define system_strdup Curl_strdup
@@ -465,8 +465,8 @@ static int events_socket(CURL *easy,      /* easy handle */
   bool found = FALSE;
   struct Curl_easy *data = easy;
 
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) easy;
+#ifdef CURL_DISABLE_VERBOSE_STRINGS
+  (void)easy;
 #endif
   (void)socketp;
 
@@ -567,6 +567,39 @@ static unsigned int populate_fds(struct pollfd *fds, struct events *ev)
   return numfds;
 }
 
+/* poll_fds()
+ *
+ * poll the fds[] array
+ */
+static CURLcode poll_fds(struct events *ev,
+                         struct pollfd *fds,
+                         const unsigned int numfds,
+                         int *pollrc)
+{
+  if(numfds) {
+    /* wait for activity or timeout */
+#if DEBUG_EV_POLL
+    fprintf(stderr, "poll(numfds=%u, timeout=%ldms)\n", numfds, ev->ms);
+#endif
+    *pollrc = Curl_poll(fds, numfds, ev->ms);
+#if DEBUG_EV_POLL
+    fprintf(stderr, "poll(numfds=%u, timeout=%ldms) -> %d\n",
+            numfds, ev->ms, *pollrc);
+#endif
+    if(*pollrc < 0)
+      return CURLE_UNRECOVERABLE_POLL;
+  }
+  else {
+#if DEBUG_EV_POLL
+    fprintf(stderr, "poll, but no fds, wait timeout=%ldms\n", ev->ms);
+#endif
+    *pollrc = 0;
+    if(ev->ms > 0)
+      curlx_wait_ms(ev->ms);
+  }
+  return CURLE_OK;
+}
+
 /* wait_or_timeout()
  *
  * waits for activity on any of the given sockets, or the timeout to trigger.
@@ -587,27 +620,9 @@ static CURLcode wait_or_timeout(struct Curl_multi *multi, struct events *ev)
     /* get the time stamp to use to figure out how long poll takes */
     before = curlx_now();
 
-    if(numfds) {
-      /* wait for activity or timeout */
-#if DEBUG_EV_POLL
-      fprintf(stderr, "poll(numfds=%u, timeout=%ldms)\n", numfds, ev->ms);
-#endif
-      pollrc = Curl_poll(fds, numfds, ev->ms);
-#if DEBUG_EV_POLL
-      fprintf(stderr, "poll(numfds=%u, timeout=%ldms) -> %d\n",
-              numfds, ev->ms, pollrc);
-#endif
-      if(pollrc < 0)
-        return CURLE_UNRECOVERABLE_POLL;
-    }
-    else {
-#if DEBUG_EV_POLL
-      fprintf(stderr, "poll, but no fds, wait timeout=%ldms\n", ev->ms);
-#endif
-      pollrc = 0;
-      if(ev->ms > 0)
-        curlx_wait_ms(ev->ms);
-    }
+    result = poll_fds(ev, fds, numfds, &pollrc);
+    if(result)
+      return result;
 
     ev->msbump = FALSE; /* reset here */
 
@@ -822,7 +837,6 @@ static CURLcode easy_perform(struct Curl_easy *data, bool events)
   return result;
 }
 
-
 /*
  * curl_easy_perform() is the external interface that performs a blocking
  * transfer as previously setup.
@@ -841,7 +855,6 @@ CURLcode curl_easy_perform_ev(struct Curl_easy *data)
 {
   return easy_perform(data, TRUE);
 }
-
 #endif
 
 /*
@@ -950,7 +963,11 @@ static void dupeasy_meta_freeentry(void *p)
 CURL *curl_easy_duphandle(CURL *d)
 {
   struct Curl_easy *data = d;
-  struct Curl_easy *outcurl = calloc(1, sizeof(struct Curl_easy));
+  struct Curl_easy *outcurl = NULL;
+
+  if(!GOOD_EASY_HANDLE(data))
+    goto fail;
+  outcurl = calloc(1, sizeof(struct Curl_easy));
   if(!outcurl)
     goto fail;
 
@@ -1074,6 +1091,9 @@ CURL *curl_easy_duphandle(CURL *d)
 void curl_easy_reset(CURL *d)
 {
   struct Curl_easy *data = d;
+  if(!GOOD_EASY_HANDLE(data))
+    return;
+
   Curl_req_hard_reset(&data->req, data);
   Curl_hash_clean(&data->meta_hash);
 
@@ -1097,6 +1117,7 @@ void curl_easy_reset(CURL *d)
   data->progress.hide = TRUE;
   data->state.current_speed = -1; /* init to negative == impossible */
   data->state.retrycount = 0;     /* reset the retry counter */
+  data->state.recent_conn_id = -1; /* clear remembered connection id */
 
   /* zero out authentication data: */
   memset(&data->state.authhost, 0, sizeof(struct auth));
@@ -1154,13 +1175,15 @@ CURLcode curl_easy_pause(CURL *d, int action)
 
   /* If not completely pausing both directions now, run again in any case. */
   if(!Curl_xfer_is_blocked(data)) {
-    Curl_expire(data, 0, EXPIRE_RUN_NOW);
     /* reset the too-slow time keeper */
     data->state.keeps_speed.tv_sec = 0;
-    /* On changes, tell application to update its timers. */
-    if(changed && data->multi) {
-      if(Curl_update_timer(data->multi) && !result)
-        result = CURLE_ABORTED_BY_CALLBACK;
+    if(data->multi) {
+      Curl_multi_mark_dirty(data); /* make it run */
+      /* On changes, tell application to update its timers. */
+      if(changed) {
+        if(Curl_update_timer(data->multi) && !result)
+          result = CURLE_ABORTED_BY_CALLBACK;
+      }
     }
   }
 
@@ -1213,6 +1236,8 @@ CURLcode curl_easy_recv(CURL *d, void *buffer, size_t buflen, size_t *n)
   struct connectdata *c;
   struct Curl_easy *data = d;
 
+  if(!GOOD_EASY_HANDLE(data))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
   if(Curl_is_in_callback(data))
     return CURLE_RECURSIVE_API_CALL;
 
@@ -1288,6 +1313,8 @@ CURLcode curl_easy_send(CURL *d, const void *buffer, size_t buflen, size_t *n)
   size_t written = 0;
   CURLcode result;
   struct Curl_easy *data = d;
+  if(!GOOD_EASY_HANDLE(data))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
   if(Curl_is_in_callback(data))
     return CURLE_RECURSIVE_API_CALL;
 
@@ -1317,7 +1344,7 @@ CURLcode curl_easy_ssls_import(CURL *d, const char *session_key,
                                const unsigned char *shmac, size_t shmac_len,
                                const unsigned char *sdata, size_t sdata_len)
 {
-#ifdef USE_SSLS_EXPORT
+#if defined(USE_SSL) && defined(USE_SSLS_EXPORT)
   struct Curl_easy *data = d;
   if(!GOOD_EASY_HANDLE(data))
     return CURLE_BAD_FUNCTION_ARGUMENT;
@@ -1338,7 +1365,7 @@ CURLcode curl_easy_ssls_export(CURL *d,
                                curl_ssls_export_cb *export_fn,
                                void *userptr)
 {
-#ifdef USE_SSLS_EXPORT
+#if defined(USE_SSL) && defined(USE_SSLS_EXPORT)
   struct Curl_easy *data = d;
   if(!GOOD_EASY_HANDLE(data))
     return CURLE_BAD_FUNCTION_ARGUMENT;
diff --git a/deps/curl/lib/easy_lock.h b/deps/curl/lib/easy_lock.h
index ec324cfc81a..909753f43aa 100644
--- a/deps/curl/lib/easy_lock.h
+++ b/deps/curl/lib/easy_lock.h
@@ -30,12 +30,6 @@
 
 #if defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x600
 
-#ifdef __MINGW32__
-#ifndef SRWLOCK_INIT
-#define SRWLOCK_INIT NULL
-#endif
-#endif /* __MINGW32__ */
-
 #define curl_simple_lock SRWLOCK
 #define CURL_SIMPLE_LOCK_INIT SRWLOCK_INIT
 
@@ -44,7 +38,7 @@
 
 #elif defined(HAVE_ATOMIC) && defined(HAVE_STDATOMIC_H)
 #include <stdatomic.h>
-#if defined(HAVE_SCHED_YIELD)
+#ifdef HAVE_SCHED_YIELD
 #include <sched.h>
 #endif
 
diff --git a/deps/curl/lib/easygetopt.c b/deps/curl/lib/easygetopt.c
index 01131216320..7ac39bc634e 100644
--- a/deps/curl/lib/easygetopt.c
+++ b/deps/curl/lib/easygetopt.c
@@ -82,7 +82,7 @@ const struct curl_easyoption *curl_easy_option_by_name(const char *name)
   return NULL;
 }
 
-const struct curl_easyoption *curl_easy_option_by_id (CURLoption id)
+const struct curl_easyoption *curl_easy_option_by_id(CURLoption id)
 {
   (void)id;
   return NULL;
diff --git a/deps/curl/lib/file.c b/deps/curl/lib/file.c
index b88f6123056..749759653d5 100644
--- a/deps/curl/lib/file.c
+++ b/deps/curl/lib/file.c
@@ -120,10 +120,10 @@ const struct Curl_handler Curl_handler_file = {
   file_connect,                         /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   file_disconnect,                      /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -292,8 +292,8 @@ static CURLcode file_done(struct Curl_easy *data,
                           CURLcode status, bool premature)
 {
   struct FILEPROTO *file = Curl_meta_get(data, CURL_META_FILE_EASY);
-  (void)status; /* not used */
-  (void)premature; /* not used */
+  (void)status;
+  (void)premature;
 
   if(file)
     file_cleanup(file);
@@ -305,7 +305,7 @@ static CURLcode file_disconnect(struct Curl_easy *data,
                                 struct connectdata *conn,
                                 bool dead_connection)
 {
-  (void)dead_connection; /* not used */
+  (void)dead_connection;
   (void)conn;
   return file_done(data, CURLE_OK, FALSE);
 }
@@ -348,7 +348,7 @@ static CURLcode file_upload(struct Curl_easy *data,
     mode |= O_TRUNC;
 
 #if (defined(ANDROID) || defined(__ANDROID__)) && \
-    (defined(__i386__) || defined(__arm__))
+  (defined(__i386__) || defined(__arm__))
   fd = open(file->path, mode, (mode_t)data->set.new_file_perms);
 #else
   fd = open(file->path, mode, data->set.new_file_perms);
@@ -358,7 +358,7 @@ static CURLcode file_upload(struct Curl_easy *data,
     return CURLE_WRITE_ERROR;
   }
 
-  if(-1 != data->state.infilesize)
+  if(data->state.infilesize != -1)
     /* known size of data to "upload" */
     Curl_pgrsSetUploadSize(data, data->state.infilesize);
 
@@ -470,7 +470,7 @@ static CURLcode file_do(struct Curl_easy *data, bool *done)
   fd = file->fd;
 
   /* VMS: This only works reliable for STREAMLF files */
-  if(-1 != fstat(fd, &statbuf)) {
+  if(fstat(fd, &statbuf) != -1) {
     if(!S_ISDIR(statbuf.st_mode))
       expected_size = statbuf.st_size;
     /* and store the modification time */
diff --git a/deps/curl/lib/fileinfo.c b/deps/curl/lib/fileinfo.c
index c3439af341e..47cdb102e37 100644
--- a/deps/curl/lib/fileinfo.c
+++ b/deps/curl/lib/fileinfo.c
@@ -23,7 +23,9 @@
  ***************************************************************************/
 
 #include "curl_setup.h"
+
 #ifndef CURL_DISABLE_FTP
+
 #include "strdup.h"
 #include "fileinfo.h"
 #include "curl_memory.h"
@@ -43,4 +45,5 @@ void Curl_fileinfo_cleanup(struct fileinfo *finfo)
   curlx_dyn_free(&finfo->buf);
   free(finfo);
 }
+
 #endif
diff --git a/deps/curl/lib/fopen.c b/deps/curl/lib/fopen.c
index 38b87f326e3..b28977317a8 100644
--- a/deps/curl/lib/fopen.c
+++ b/deps/curl/lib/fopen.c
@@ -136,7 +136,7 @@ CURLcode Curl_fopen(struct Curl_easy *data, const char *filename,
 
   result = CURLE_WRITE_ERROR;
 #if (defined(ANDROID) || defined(__ANDROID__)) && \
-    (defined(__i386__) || defined(__arm__))
+  (defined(__i386__) || defined(__arm__))
   fd = open(tempstore, O_WRONLY | O_CREAT | O_EXCL, (mode_t)(0600|sb.st_mode));
 #else
   fd = open(tempstore, O_WRONLY | O_CREAT | O_EXCL, 0600|sb.st_mode);
diff --git a/deps/curl/lib/formdata.c b/deps/curl/lib/formdata.c
index 5a4b52ea57a..d8553e32569 100644
--- a/deps/curl/lib/formdata.c
+++ b/deps/curl/lib/formdata.c
@@ -186,22 +186,24 @@ static void free_formlist(struct FormInfo *ptr)
  * Examples:
  *
  * Simple name/value pair with copied contents:
- * curl_formadd (&post, &last, CURLFORM_COPYNAME, "name",
- * CURLFORM_COPYCONTENTS, "value", CURLFORM_END);
+ * curl_formadd(&post, &last, CURLFORM_COPYNAME, "name",
+ *              CURLFORM_COPYCONTENTS, "value", CURLFORM_END);
  *
  * name/value pair where only the content pointer is remembered:
- * curl_formadd (&post, &last, CURLFORM_COPYNAME, "name",
- * CURLFORM_PTRCONTENTS, ptr, CURLFORM_CONTENTSLENGTH, 10, CURLFORM_END);
+ * curl_formadd(&post, &last, CURLFORM_COPYNAME, "name",
+ *              CURLFORM_PTRCONTENTS, ptr, CURLFORM_CONTENTSLENGTH, 10,
+ *              CURLFORM_END);
  * (if CURLFORM_CONTENTSLENGTH is missing strlen () is used)
  *
  * storing a filename (CONTENTTYPE is optional!):
- * curl_formadd (&post, &last, CURLFORM_COPYNAME, "name",
- * CURLFORM_FILE, "filename1", CURLFORM_CONTENTTYPE, "plain/text",
- * CURLFORM_END);
+ * curl_formadd(&post, &last, CURLFORM_COPYNAME, "name",
+ *              CURLFORM_FILE, "filename1", CURLFORM_CONTENTTYPE, "plain/text",
+ *              CURLFORM_END);
  *
  * storing multiple filenames:
- * curl_formadd (&post, &last, CURLFORM_COPYNAME, "name",
- * CURLFORM_FILE, "filename1", CURLFORM_FILE, "filename2", CURLFORM_END);
+ * curl_formadd(&post, &last, CURLFORM_COPYNAME, "name",
+ *              CURLFORM_FILE, "filename1", CURLFORM_FILE, "filename2",
+ *              CURLFORM_END);
  *
  * Returns:
  * CURL_FORMADD_OK             on success
@@ -926,9 +928,9 @@ CURLFORMcode curl_formadd(struct curl_httppost **httppost,
 int curl_formget(struct curl_httppost *form, void *arg,
                  curl_formget_callback append)
 {
-  (void) form;
-  (void) arg;
-  (void) append;
+  (void)form;
+  (void)arg;
+  (void)append;
   return CURL_FORMADD_DISABLED;
 }
 
diff --git a/deps/curl/lib/ftp.c b/deps/curl/lib/ftp.c
index 06c486bc917..29c2f789a3e 100644
--- a/deps/curl/lib/ftp.c
+++ b/deps/curl/lib/ftp.c
@@ -150,7 +150,8 @@ static void _ftp_state(struct Curl_easy *data,
 #endif
   )
 {
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifdef CURL_DISABLE_VERBOSE_STRINGS
+  (void)data;
 #ifdef DEBUGBUILD
   (void)lineno;
 #endif
@@ -213,10 +214,10 @@ static CURLcode ftp_disconnect(struct Curl_easy *data,
                                struct connectdata *conn, bool dead_connection);
 static CURLcode ftp_do_more(struct Curl_easy *data, int *completed);
 static CURLcode ftp_multi_statemach(struct Curl_easy *data, bool *done);
-static int ftp_getsock(struct Curl_easy *data, struct connectdata *conn,
-                       curl_socket_t *socks);
-static int ftp_domore_getsock(struct Curl_easy *data,
-                              struct connectdata *conn, curl_socket_t *socks);
+static CURLcode ftp_pollset(struct Curl_easy *data,
+                            struct easy_pollset *ps);
+static CURLcode ftp_domore_pollset(struct Curl_easy *data,
+                                   struct easy_pollset *ps);
 static CURLcode ftp_doing(struct Curl_easy *data,
                           bool *dophase_done);
 static CURLcode ftp_setup_connection(struct Curl_easy *data,
@@ -256,10 +257,10 @@ const struct Curl_handler Curl_handler_ftp = {
   ftp_connect,                     /* connect_it */
   ftp_multi_statemach,             /* connecting */
   ftp_doing,                       /* doing */
-  ftp_getsock,                     /* proto_getsock */
-  ftp_getsock,                     /* doing_getsock */
-  ftp_domore_getsock,              /* domore_getsock */
-  ZERO_NULL,                       /* perform_getsock */
+  ftp_pollset,                     /* proto_pollset */
+  ftp_pollset,                     /* doing_pollset */
+  ftp_domore_pollset,              /* domore_pollset */
+  ZERO_NULL,                       /* perform_pollset */
   ftp_disconnect,                  /* disconnect */
   ZERO_NULL,                       /* write_resp */
   ZERO_NULL,                       /* write_resp_hd */
@@ -289,10 +290,10 @@ const struct Curl_handler Curl_handler_ftps = {
   ftp_connect,                     /* connect_it */
   ftp_multi_statemach,             /* connecting */
   ftp_doing,                       /* doing */
-  ftp_getsock,                     /* proto_getsock */
-  ftp_getsock,                     /* doing_getsock */
-  ftp_domore_getsock,              /* domore_getsock */
-  ZERO_NULL,                       /* perform_getsock */
+  ftp_pollset,                     /* proto_pollset */
+  ftp_pollset,                     /* doing_pollset */
+  ftp_domore_pollset,              /* domore_pollset */
+  ZERO_NULL,                       /* perform_pollset */
   ftp_disconnect,                  /* disconnect */
   ZERO_NULL,                       /* write_resp */
   ZERO_NULL,                       /* write_resp_hd */
@@ -330,19 +331,10 @@ static void close_secondarysocket(struct Curl_easy *data,
 
 static void freedirs(struct ftp_conn *ftpc)
 {
-  if(ftpc->dirs) {
-    int i;
-    for(i = 0; i < ftpc->dirdepth; i++) {
-      free(ftpc->dirs[i]);
-      ftpc->dirs[i] = NULL;
-    }
-    free(ftpc->dirs);
-    ftpc->dirs = NULL;
-    ftpc->dirdepth = 0;
-  }
-  Curl_safefree(ftpc->file);
-
-  /* no longer of any use */
+  Curl_safefree(ftpc->dirs);
+  ftpc->dirdepth = 0;
+  Curl_safefree(ftpc->rawpath);
+  ftpc->file = NULL;
   Curl_safefree(ftpc->newhost);
 }
 
@@ -545,12 +537,13 @@ static CURLcode ftp_initiate_transfer(struct Curl_easy *data,
 
     /* FTP upload, shutdown DATA, ignore shutdown errors, as we rely
      * on the server response on the CONTROL connection. */
-    Curl_xfer_setup2(data, CURL_XFER_SEND, -1, TRUE, TRUE);
+    Curl_xfer_setup_send(data, SECONDARYSOCKET);
+    Curl_xfer_set_shutdown(data, TRUE, TRUE);
   }
   else {
     /* FTP download, shutdown, do not ignore errors */
-    Curl_xfer_setup2(data, CURL_XFER_RECV,
-                     ftpc->retr_size_saved, TRUE, FALSE);
+    Curl_xfer_setup_recv(data, SECONDARYSOCKET, ftpc->retr_size_saved);
+    Curl_xfer_set_shutdown(data, TRUE, FALSE);
   }
 
   ftpc->pp.pending_resp = TRUE; /* expect server response */
@@ -578,12 +571,12 @@ static CURLcode ftp_readresp(struct Curl_easy *data,
                              struct ftp_conn *ftpc,
                              int sockindex,
                              struct pingpong *pp,
-                             int *ftpcode, /* return the ftp-code if done */
+                             int *ftpcodep, /* return the ftp-code if done */
                              size_t *size) /* size of the response */
 {
   int code;
   CURLcode result = Curl_pp_readresp(data, sockindex, pp, &code, size);
-
+  DEBUGASSERT(ftpcodep);
 #ifdef HAVE_GSSAPI
   {
     struct connectdata *conn = data->conn;
@@ -611,10 +604,9 @@ static CURLcode ftp_readresp(struct Curl_easy *data,
   if(!ftpc->shutdown)
     data->info.httpcode = code;
 
-  if(ftpcode)
-    *ftpcode = code;
+  *ftpcodep = code;
 
-  if(421 == code) {
+  if(code == 421) {
     /* 421 means "Service not available, closing control connection." and FTP
      * servers use it to signal that idle session timeout has been exceeded.
      * If we ignored the response, it could end up hanging in some cases.
@@ -640,7 +632,7 @@ static CURLcode ftp_readresp(struct Curl_easy *data,
 
 CURLcode Curl_GetFTPResponse(struct Curl_easy *data,
                              ssize_t *nreadp, /* return number of bytes read */
-                             int *ftpcode) /* return the ftp-code */
+                             int *ftpcodep) /* return the ftp-code */
 {
   /*
    * We cannot read just one byte per read() and then go back to select() as
@@ -656,20 +648,16 @@ CURLcode Curl_GetFTPResponse(struct Curl_easy *data,
   struct pingpong *pp = &ftpc->pp;
   size_t nread;
   int cache_skip = 0;
-  int value_to_be_ignored = 0;
+  DEBUGASSERT(ftpcodep);
 
   CURL_TRC_FTP(data, "getFTPResponse start");
   *nreadp = 0;
-  if(ftpcode)
-    *ftpcode = 0; /* 0 for errors */
-  else
-    /* make the pointer point to something for the rest of this function */
-    ftpcode = &value_to_be_ignored;
+  *ftpcodep = 0; /* 0 for errors */
 
   if(!ftpc)
     return CURLE_FAILED_INIT;
 
-  while(!*ftpcode && !result) {
+  while(!*ftpcodep && !result) {
     /* check and reset timeout value every lap */
     timediff_t timeout = Curl_pp_state_timeout(data, pp, FALSE);
     timediff_t interval_ms;
@@ -727,7 +715,7 @@ CURLcode Curl_GetFTPResponse(struct Curl_easy *data,
         break;
     }
 
-    result = ftp_readresp(data, ftpc, FIRSTSOCKET, pp, ftpcode, &nread);
+    result = ftp_readresp(data, ftpc, FIRSTSOCKET, pp, ftpcodep, &nread);
     if(result)
       break;
 
@@ -746,7 +734,7 @@ CURLcode Curl_GetFTPResponse(struct Curl_easy *data,
 
   pp->pending_resp = FALSE;
   CURL_TRC_FTP(data, "getFTPResponse -> result=%d, nread=%zd, ftpcode=%d",
-               result, *nreadp, *ftpcode);
+               result, *nreadp, *ftpcodep);
 
   return result;
 }
@@ -780,42 +768,53 @@ static CURLcode ftp_state_pwd(struct Curl_easy *data,
 }
 
 /* For the FTP "protocol connect" and "doing" phases only */
-static int ftp_getsock(struct Curl_easy *data,
-                       struct connectdata *conn,
-                       curl_socket_t *socks)
+static CURLcode ftp_pollset(struct Curl_easy *data,
+                            struct easy_pollset *ps)
 {
-  struct ftp_conn *ftpc = Curl_conn_meta_get(conn, CURL_META_FTP_CONN);
-  return ftpc ? Curl_pp_getsock(data, &ftpc->pp, socks) : GETSOCK_BLANK;
+  struct ftp_conn *ftpc = Curl_conn_meta_get(data->conn, CURL_META_FTP_CONN);
+  return ftpc ? Curl_pp_pollset(data, &ftpc->pp, ps) : CURLE_OK;
 }
 
 /* For the FTP "DO_MORE" phase only */
-static int ftp_domore_getsock(struct Curl_easy *data,
-                              struct connectdata *conn, curl_socket_t *socks)
+static CURLcode ftp_domore_pollset(struct Curl_easy *data,
+                                   struct easy_pollset *ps)
 {
-  struct ftp_conn *ftpc = Curl_conn_meta_get(conn, CURL_META_FTP_CONN);
-  (void)data;
+  struct ftp_conn *ftpc = Curl_conn_meta_get(data->conn, CURL_META_FTP_CONN);
 
   if(!ftpc)
-    return GETSOCK_BLANK;
+    return CURLE_OK;
 
   /* When in DO_MORE state, we could be either waiting for us to connect to a
    * remote site, or we could wait for that site to connect to us. Or just
    * handle ordinary commands.
    */
-  CURL_TRC_FTP(data, "[%s] ftp_domore_getsock()", FTP_CSTATE(ftpc));
+  CURL_TRC_FTP(data, "[%s] ftp_domore_pollset()", FTP_CSTATE(ftpc));
 
   if(FTP_STOP == ftpc->state) {
     /* if stopped and still in this state, then we are also waiting for a
        connect on the secondary connection */
-    DEBUGASSERT(conn->sock[SECONDARYSOCKET] != CURL_SOCKET_BAD ||
-               (conn->cfilter[SECONDARYSOCKET] &&
-                !Curl_conn_is_connected(conn, SECONDARYSOCKET)));
-    socks[0] = conn->sock[FIRSTSOCKET];
+    DEBUGASSERT(data->conn->sock[SECONDARYSOCKET] != CURL_SOCKET_BAD ||
+               (data->conn->cfilter[SECONDARYSOCKET] &&
+                !Curl_conn_is_connected(data->conn, SECONDARYSOCKET)));
     /* An unconnected SECONDARY will add its socket by itself
      * via its adjust_pollset() */
-    return GETSOCK_READSOCK(0);
+    return Curl_pollset_add_in(data, ps, data->conn->sock[FIRSTSOCKET]);
   }
-  return Curl_pp_getsock(data, &ftpc->pp, socks);
+  return Curl_pp_pollset(data, &ftpc->pp, ps);
+}
+
+static int pathlen(struct ftp_conn *ftpc, int num)
+{
+  DEBUGASSERT(ftpc->dirs);
+  DEBUGASSERT(ftpc->dirdepth > num);
+  return ftpc->dirs[num].len;
+}
+
+static const char *pathpiece(struct ftp_conn *ftpc, int num)
+{
+  DEBUGASSERT(ftpc->dirs);
+  DEBUGASSERT(ftpc->dirdepth > num);
+  return &ftpc->rawpath[ ftpc->dirs[num].start ];
 }
 
 /* This is called after the FTP_QUOTE state is passed.
@@ -836,13 +835,13 @@ static CURLcode ftp_state_cwd(struct Curl_easy *data,
   else {
     /* FTPFILE_NOCWD with full path: expect ftpc->cwddone! */
     DEBUGASSERT((data->set.ftp_filemethod != FTPFILE_NOCWD) ||
-                !(ftpc->dirdepth && ftpc->dirs[0][0] == '/'));
+                !(ftpc->dirdepth && ftpc->rawpath[0] == '/'));
 
     ftpc->count2 = 0; /* count2 counts failed CWDs */
 
     if(data->conn->bits.reuse && ftpc->entrypath &&
        /* no need to go to entrypath when we have an absolute path */
-       !(ftpc->dirdepth && ftpc->dirs[0][0] == '/')) {
+       !(ftpc->dirdepth && ftpc->rawpath[0] == '/')) {
       /* This is a reused connection. Since we change directory to where the
          transfer is taking place, we must first get back to the original dir
          where we ended up after login: */
@@ -857,8 +856,8 @@ static CURLcode ftp_state_cwd(struct Curl_easy *data,
         ftpc->cwdcount = 1;
         /* issue the first CWD, the rest is sent when the CWD responses are
            received... */
-        result = Curl_pp_sendf(data, &ftpc->pp, "CWD %s",
-                               ftpc->dirs[ftpc->cwdcount -1]);
+        result = Curl_pp_sendf(data, &ftpc->pp, "CWD %.*s",
+                               pathlen(ftpc, 0), pathpiece(ftpc, 0));
         if(!result)
           ftp_state(data, ftpc, FTP_CWD);
       }
@@ -1257,7 +1256,7 @@ static CURLcode ftp_state_use_port(struct Curl_easy *data,
        !Curl_conn_is_ssl(conn, SECONDARYSOCKET)) {
       result = Curl_ssl_cfilter_add(data, conn, SECONDARYSOCKET);
     }
-    data->conn->bits.do_more = FALSE;
+    conn->bits.do_more = FALSE;
     Curl_pgrsTime(data, TIMER_STARTACCEPT);
     Curl_expire(data, (data->set.accepttimeout > 0) ?
                 data->set.accepttimeout: DEFAULT_ACCEPT_TIMEOUT,
@@ -1416,18 +1415,14 @@ static CURLcode ftp_state_list(struct Curl_easy *data,
      The other ftp_filemethods will CWD into dir/dir/ first and
      then just do LIST (in that case: nothing to do here)
   */
-  char *lstArg = NULL;
+  const char *lstArg = NULL;
+  int lstArglen = 0;
   char *cmd;
 
   if((data->set.ftp_filemethod == FTPFILE_NOCWD) && ftp->path) {
     /* url-decode before evaluation: e.g. paths starting/ending with %2f */
-    const char *slashPos = NULL;
-    char *rawPath = NULL;
-    result = Curl_urldecode(ftp->path, 0, &rawPath, NULL, REJECT_CTRL);
-    if(result)
-      return result;
-
-    slashPos = strrchr(rawPath, '/');
+    const char *rawPath = ftpc->rawpath;
+    const char *slashPos = strrchr(rawPath, '/');
     if(slashPos) {
       /* chop off the file part if format is dir/file otherwise remove
          the trailing slash for dir/dir/ except for absolute path / */
@@ -1436,19 +1431,16 @@ static CURLcode ftp_state_list(struct Curl_easy *data,
         ++n;
 
       lstArg = rawPath;
-      lstArg[n] = '\0';
+      lstArglen = (int)n;
     }
-    else
-      free(rawPath);
   }
 
-  cmd = aprintf("%s%s%s",
+  cmd = aprintf("%s%s%.*s",
                 data->set.str[STRING_CUSTOMREQUEST] ?
                 data->set.str[STRING_CUSTOMREQUEST] :
                 (data->state.list_only ? "NLST" : "LIST"),
                 lstArg ? " " : "",
-                lstArg ? lstArg : "");
-  free(lstArg);
+                lstArglen, lstArg ? lstArg : "");
 
   if(!cmd)
     return CURLE_OUT_OF_MEMORY;
@@ -1792,17 +1784,23 @@ static CURLcode ftp_epsv_disable(struct Curl_easy *data,
 }
 
 
-static char *control_address(struct connectdata *conn)
+static char *control_address_dup(struct Curl_easy *data,
+                                 struct connectdata *conn)
 {
+    struct ip_quadruple ipquad;
+    bool is_ipv6;
+
   /* Returns the control connection IP address.
      If a proxy tunnel is used, returns the original hostname instead, because
      the effective control connection address is the proxy address,
      not the ftp host. */
 #ifndef CURL_DISABLE_PROXY
   if(conn->bits.tunnel_proxy || conn->bits.socksproxy)
-    return conn->host.name;
+    return strdup(conn->host.name);
 #endif
-  return conn->primary.remote_ip;
+  if(!Curl_conn_get_ip_info(data, conn, FIRSTSOCKET, &is_ipv6, &ipquad))
+    return strdup(ipquad.remote_ip);
+  return NULL;
 }
 
 static bool match_pasv_6nums(const char *p,
@@ -1855,7 +1853,7 @@ static CURLcode ftp_state_pasv_resp(struct Curl_easy *data,
           return CURLE_FTP_WEIRD_PASV_REPLY;
         }
         ftpc->newport = (unsigned short)num;
-        ftpc->newhost = strdup(control_address(conn));
+        ftpc->newhost = control_address_dup(data, conn);
         if(!ftpc->newhost)
           return CURLE_OUT_OF_MEMORY;
       }
@@ -1899,7 +1897,7 @@ static CURLcode ftp_state_pasv_resp(struct Curl_easy *data,
       infof(data, "Skip %u.%u.%u.%u for data connection, reuse %s instead",
             ip[0], ip[1], ip[2], ip[3],
             conn->host.name);
-      ftpc->newhost = strdup(control_address(conn));
+      ftpc->newhost = control_address_dup(data, conn);
     }
     else
       ftpc->newhost = aprintf("%u.%u.%u.%u", ip[0], ip[1], ip[2], ip[3]);
@@ -1920,17 +1918,24 @@ static CURLcode ftp_state_pasv_resp(struct Curl_easy *data,
 
 #ifndef CURL_DISABLE_PROXY
   if(conn->bits.proxy) {
-    /*
-     * This connection uses a proxy and we need to connect to the proxy again
+    /* This connection uses a proxy and we need to connect to the proxy again
      * here. We do not want to rely on a former host lookup that might've
-     * expired now, instead we remake the lookup here and now!
-     */
+     * expired now, instead we remake the lookup here and now! */
+    struct ip_quadruple ipquad;
+    bool is_ipv6;
     const char * const host_name = conn->bits.socksproxy ?
       conn->socks_proxy.host.name : conn->http_proxy.host.name;
-    (void)Curl_resolv_blocking(data, host_name, conn->primary.remote_port,
-                               conn->ip_version, &dns);
+
+    result = Curl_conn_get_ip_info(data, data->conn, FIRSTSOCKET,
+                                   &is_ipv6, &ipquad);
+    if(result)
+      return result;
+
+    (void)Curl_resolv_blocking(data, host_name, ipquad.remote_port,
+                               is_ipv6 ? CURL_IPRESOLVE_V6 : CURL_IPRESOLVE_V4,
+                               &dns);
     /* we connect to the proxy's port */
-    connectport = (unsigned short)conn->primary.remote_port;
+    connectport = (unsigned short)ipquad.remote_port;
 
     if(!dns) {
       failf(data, "cannot resolve proxy host %s:%hu", host_name, connectport);
@@ -1946,7 +1951,7 @@ static CURLcode ftp_state_pasv_resp(struct Curl_easy *data,
     /* postponed address resolution in case of tcp fastopen */
     if(conn->bits.tcp_fastopen && !conn->bits.reuse && !ftpc->newhost[0]) {
       free(ftpc->newhost);
-      ftpc->newhost = strdup(control_address(conn));
+      ftpc->newhost = control_address_dup(data, conn);
       if(!ftpc->newhost)
         return CURLE_OUT_OF_MEMORY;
     }
@@ -2067,7 +2072,7 @@ static CURLcode client_write_header(struct Curl_easy *data,
    * the body write callback when data->set.include_header is set
    * via CURLOPT_HEADER.
    * For historic reasons, FTP never played this game and expects
-   * all its HEADERs to do that always. Set that flag during the
+   * all its headers to do that always. Set that flag during the
    * call to Curl_client_write() so it does the right thing.
    *
    * Notice that we cannot enable this flag for FTP in general,
@@ -2097,6 +2102,7 @@ static CURLcode ftp_state_mdtm_resp(struct Curl_easy *data,
       int year, month, day, hour, minute, second;
       struct pingpong *pp = &ftpc->pp;
       char *resp = curlx_dyn_ptr(&pp->recvbuf) + 4;
+      bool showtime = FALSE;
       if(ftp_213_date(resp, &year, &month, &day, &hour, &minute, &second)) {
         /* we have a time, reformat it */
         char timebuf[24];
@@ -2104,7 +2110,8 @@ static CURLcode ftp_state_mdtm_resp(struct Curl_easy *data,
                   "%04d%02d%02d %02d:%02d:%02d GMT",
                   year, month, day, hour, minute, second);
         /* now, convert this into a time() value: */
-        data->info.filetime = Curl_getdate_capped(timebuf);
+        if(!Curl_getdate_capped(timebuf, &data->info.filetime))
+          showtime = TRUE;
       }
 
 #ifdef CURL_FTP_HTTPSTYLE_HEAD
@@ -2117,10 +2124,8 @@ static CURLcode ftp_state_mdtm_resp(struct Curl_easy *data,
    warning: comparison of unsigned expression in '>= 0' is always true */
 #pragma GCC diagnostic ignored "-Wtype-limits"
 #endif
-      if(data->req.no_body &&
-         ftpc->file &&
-         data->set.get_filetime &&
-         (data->info.filetime >= 0) ) {
+      if(data->req.no_body && ftpc->file &&
+         data->set.get_filetime && showtime) {
 #if defined(__GNUC__) && (defined(__DJGPP__) || defined(__AMIGA__))
 #pragma GCC diagnostic pop
 #endif
@@ -2355,7 +2360,7 @@ static CURLcode ftp_state_size_resp(struct Curl_easy *data,
 
   if(instate == FTP_SIZE) {
 #ifdef CURL_FTP_HTTPSTYLE_HEAD
-    if(-1 != filesize) {
+    if(filesize != -1) {
       char clbuf[128];
       int clbuflen = msnprintf(clbuf, sizeof(clbuf),
                 "Content-Length: %" FMT_OFF_T "\r\n", filesize);
@@ -2686,6 +2691,175 @@ static CURLcode ftp_state_acct_resp(struct Curl_easy *data,
   return result;
 }
 
+static CURLcode ftp_pwd_resp(struct Curl_easy *data,
+                             struct ftp_conn *ftpc,
+                             int ftpcode)
+{
+  struct pingpong *pp = &ftpc->pp;
+  CURLcode result;
+
+  if(ftpcode == 257) {
+    char *ptr = curlx_dyn_ptr(&pp->recvbuf) + 4; /* start on the first
+                                                    letter */
+    bool entry_extracted = FALSE;
+    struct dynbuf out;
+    curlx_dyn_init(&out, 1000);
+
+    /* Reply format is like
+       257<space>[rubbish]"<directory-name>"<space><commentary> and the
+       RFC959 says
+
+       The directory name can contain any character; embedded
+       double-quotes should be escaped by double-quotes (the
+       "quote-doubling" convention).
+    */
+
+    /* scan for the first double-quote for non-standard responses */
+    while(*ptr != '\n' && *ptr != '\0' && *ptr != '"')
+      ptr++;
+
+    if('\"' == *ptr) {
+      /* it started good */
+      for(ptr++; *ptr; ptr++) {
+        if('\"' == *ptr) {
+          if('\"' == ptr[1]) {
+            /* "quote-doubling" */
+            result = curlx_dyn_addn(&out, &ptr[1], 1);
+            ptr++;
+          }
+          else {
+            /* end of path */
+            if(curlx_dyn_len(&out))
+              entry_extracted = TRUE;
+            break; /* get out of this loop */
+          }
+        }
+        else
+          result = curlx_dyn_addn(&out, ptr, 1);
+        if(result)
+          return result;
+      }
+    }
+    if(entry_extracted) {
+      /* If the path name does not look like an absolute path (i.e.: it
+         does not start with a '/'), we probably need some server-dependent
+         adjustments. For example, this is the case when connecting to
+         an OS400 FTP server: this server supports two name syntaxes,
+         the default one being incompatible with standard paths. In
+         addition, this server switches automatically to the regular path
+         syntax when one is encountered in a command: this results in
+         having an entrypath in the wrong syntax when later used in CWD.
+         The method used here is to check the server OS: we do it only
+         if the path name looks strange to minimize overhead on other
+         systems. */
+      char *dir = curlx_dyn_ptr(&out);
+
+      if(!ftpc->server_os && dir[0] != '/') {
+        result = Curl_pp_sendf(data, &ftpc->pp, "%s", "SYST");
+        if(result) {
+          free(dir);
+          return result;
+        }
+        free(ftpc->entrypath);
+        ftpc->entrypath = dir; /* remember this */
+        infof(data, "Entry path is '%s'", ftpc->entrypath);
+        /* also save it where getinfo can access it: */
+        free(data->state.most_recent_ftp_entrypath);
+        data->state.most_recent_ftp_entrypath = strdup(ftpc->entrypath);
+        if(!data->state.most_recent_ftp_entrypath)
+          return CURLE_OUT_OF_MEMORY;
+        ftp_state(data, ftpc, FTP_SYST);
+        return result;
+      }
+
+      free(ftpc->entrypath);
+      ftpc->entrypath = dir; /* remember this */
+      infof(data, "Entry path is '%s'", ftpc->entrypath);
+      /* also save it where getinfo can access it: */
+      free(data->state.most_recent_ftp_entrypath);
+      data->state.most_recent_ftp_entrypath = strdup(ftpc->entrypath);
+      if(!data->state.most_recent_ftp_entrypath)
+        return CURLE_OUT_OF_MEMORY;
+    }
+    else {
+      /* could not get the path */
+      curlx_dyn_free(&out);
+      infof(data, "Failed to figure out path");
+    }
+  }
+  ftp_state(data, ftpc, FTP_STOP); /* we are done with CONNECT phase! */
+  CURL_TRC_FTP(data, "[%s] protocol connect phase DONE", FTP_CSTATE(ftpc));
+  return CURLE_OK;
+}
+
+static const char * const ftpauth[] = { "SSL", "TLS" };
+
+static CURLcode ftp_wait_resp(struct Curl_easy *data,
+                              struct connectdata *conn,
+                              struct ftp_conn *ftpc,
+                              int ftpcode)
+{
+  CURLcode result = CURLE_OK;
+  if(ftpcode == 230) {
+    /* 230 User logged in - already! Take as 220 if TLS required. */
+    if(data->set.use_ssl <= CURLUSESSL_TRY ||
+       conn->bits.ftp_use_control_ssl)
+      return ftp_state_user_resp(data, ftpc, ftpcode);
+  }
+  else if(ftpcode != 220) {
+    failf(data, "Got a %03d ftp-server response when 220 was expected",
+          ftpcode);
+    return CURLE_WEIRD_SERVER_REPLY;
+  }
+
+  /* We have received a 220 response fine, now we proceed. */
+#ifdef HAVE_GSSAPI
+  if(data->set.krb) {
+    /* If not anonymous login, try a secure login. Note that this
+       procedure is still BLOCKING. */
+
+    Curl_sec_request_prot(conn, "private");
+    /* We set private first as default, in case the line below fails to
+       set a valid level */
+    Curl_sec_request_prot(conn, data->set.str[STRING_KRB_LEVEL]);
+
+    if(Curl_sec_login(data, conn)) {
+      failf(data, "secure login failed");
+      return CURLE_WEIRD_SERVER_REPLY;
+    }
+    infof(data, "Authentication successful");
+  }
+#endif
+
+  if(data->set.use_ssl && !conn->bits.ftp_use_control_ssl) {
+    /* We do not have an SSL/TLS control connection yet, but FTPS is
+       requested. Try an FTPS connection now */
+
+    ftpc->count3 = 0;
+    switch((long)data->set.ftpsslauth) {
+    case CURLFTPAUTH_DEFAULT:
+    case CURLFTPAUTH_SSL:
+      ftpc->count2 = 1; /* add one to get next */
+      ftpc->count1 = 0;
+      break;
+    case CURLFTPAUTH_TLS:
+      ftpc->count2 = -1; /* subtract one to get next */
+      ftpc->count1 = 1;
+      break;
+    default:
+      failf(data, "unsupported parameter to CURLOPT_FTPSSLAUTH: %d",
+            (int)data->set.ftpsslauth);
+      return CURLE_UNKNOWN_OPTION; /* we do not know what to do */
+    }
+    result = Curl_pp_sendf(data, &ftpc->pp, "AUTH %s",
+                           ftpauth[ftpc->count1]);
+    if(!result)
+      ftp_state(data, ftpc, FTP_AUTH);
+  }
+  else
+    result = ftp_state_user(data, ftpc, conn);
+  return result;
+}
 
 static CURLcode ftp_pp_statemachine(struct Curl_easy *data,
                                     struct connectdata *conn)
@@ -2695,7 +2869,6 @@ static CURLcode ftp_pp_statemachine(struct Curl_easy *data,
   struct ftp_conn *ftpc = Curl_conn_meta_get(conn, CURL_META_FTP_CONN);
   struct FTP *ftp = Curl_meta_get(data, CURL_META_FTP_EASY);
   struct pingpong *pp;
-  static const char * const ftpauth[] = { "SSL", "TLS" };
   size_t nread = 0;
 
   if(!ftpc || !ftp)
@@ -2705,450 +2878,306 @@ static CURLcode ftp_pp_statemachine(struct Curl_easy *data,
     return Curl_pp_flushsend(data, pp);
 
   result = ftp_readresp(data, ftpc, FIRSTSOCKET, pp, &ftpcode, &nread);
-  if(result)
+  if(result || !ftpcode)
     return result;
 
-  if(ftpcode) {
-    /* we have now received a full FTP server response */
-    switch(ftpc->state) {
-    case FTP_WAIT220:
-      if(ftpcode == 230) {
-        /* 230 User logged in - already! Take as 220 if TLS required. */
-        if(data->set.use_ssl <= CURLUSESSL_TRY ||
-           conn->bits.ftp_use_control_ssl)
-          return ftp_state_user_resp(data, ftpc, ftpcode);
-      }
-      else if(ftpcode != 220) {
-        failf(data, "Got a %03d ftp-server response when 220 was expected",
-              ftpcode);
-        return CURLE_WEIRD_SERVER_REPLY;
-      }
-
-      /* We have received a 220 response fine, now we proceed. */
-#ifdef HAVE_GSSAPI
-      if(data->set.krb) {
-        /* If not anonymous login, try a secure login. Note that this
-           procedure is still BLOCKING. */
-
-        Curl_sec_request_prot(conn, "private");
-        /* We set private first as default, in case the line below fails to
-           set a valid level */
-        Curl_sec_request_prot(conn, data->set.str[STRING_KRB_LEVEL]);
-
-        if(Curl_sec_login(data, conn)) {
-          failf(data, "secure login failed");
-          return CURLE_WEIRD_SERVER_REPLY;
-        }
-        infof(data, "Authentication successful");
-      }
-#endif
-
-      if(data->set.use_ssl && !conn->bits.ftp_use_control_ssl) {
-        /* We do not have an SSL/TLS control connection yet, but FTPS is
-           requested. Try an FTPS connection now */
-
-        ftpc->count3 = 0;
-        switch(data->set.ftpsslauth) {
-        case CURLFTPAUTH_DEFAULT:
-        case CURLFTPAUTH_SSL:
-          ftpc->count2 = 1; /* add one to get next */
-          ftpc->count1 = 0;
-          break;
-        case CURLFTPAUTH_TLS:
-          ftpc->count2 = -1; /* subtract one to get next */
-          ftpc->count1 = 1;
-          break;
-        default:
-          failf(data, "unsupported parameter to CURLOPT_FTPSSLAUTH: %d",
-                (int)data->set.ftpsslauth);
-          return CURLE_UNKNOWN_OPTION; /* we do not know what to do */
-        }
-        result = Curl_pp_sendf(data, &ftpc->pp, "AUTH %s",
-                               ftpauth[ftpc->count1]);
-        if(!result)
-          ftp_state(data, ftpc, FTP_AUTH);
-      }
-      else
-        result = ftp_state_user(data, ftpc, conn);
-      break;
+  /* we have now received a full FTP server response */
+  switch(ftpc->state) {
+  case FTP_WAIT220:
+    result = ftp_wait_resp(data, conn, ftpc, ftpcode);
+    break;
 
-    case FTP_AUTH:
-      /* we have gotten the response to a previous AUTH command */
+  case FTP_AUTH:
+    /* we have gotten the response to a previous AUTH command */
 
-      if(pp->overflow)
-        return CURLE_WEIRD_SERVER_REPLY; /* Forbid pipelining in response. */
+    if(pp->overflow)
+      return CURLE_WEIRD_SERVER_REPLY; /* Forbid pipelining in response. */
 
-      /* RFC2228 (page 5) says:
-       *
-       * If the server is willing to accept the named security mechanism,
-       * and does not require any security data, it must respond with
-       * reply code 234/334.
-       */
+    /* RFC2228 (page 5) says:
+     *
+     * If the server is willing to accept the named security mechanism,
+     * and does not require any security data, it must respond with
+     * reply code 234/334.
+     */
 
-      if((ftpcode == 234) || (ftpcode == 334)) {
-        /* this was BLOCKING, keep it so for now */
-        bool done;
-        if(!Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
-          result = Curl_ssl_cfilter_add(data, conn, FIRSTSOCKET);
-          if(result) {
-            /* we failed and bail out */
-            return CURLE_USE_SSL_FAILED;
-          }
-        }
-        result = Curl_conn_connect(data, FIRSTSOCKET, TRUE, &done);
-        if(!result) {
-          conn->bits.ftp_use_data_ssl = FALSE; /* clear-text data */
-          conn->bits.ftp_use_control_ssl = TRUE; /* SSL on control */
-          result = ftp_state_user(data, ftpc, conn);
+    if((ftpcode == 234) || (ftpcode == 334)) {
+      /* this was BLOCKING, keep it so for now */
+      bool done;
+      if(!Curl_conn_is_ssl(conn, FIRSTSOCKET)) {
+        result = Curl_ssl_cfilter_add(data, conn, FIRSTSOCKET);
+        if(result) {
+          /* we failed and bail out */
+          return CURLE_USE_SSL_FAILED;
         }
       }
-      else if(ftpc->count3 < 1) {
-        ftpc->count3++;
-        ftpc->count1 += ftpc->count2; /* get next attempt */
-        result = Curl_pp_sendf(data, &ftpc->pp, "AUTH %s",
-                               ftpauth[ftpc->count1]);
-        /* remain in this same state */
-      }
-      else {
-        if(data->set.use_ssl > CURLUSESSL_TRY)
-          /* we failed and CURLUSESSL_CONTROL or CURLUSESSL_ALL is set */
-          result = CURLE_USE_SSL_FAILED;
-        else
-          /* ignore the failure and continue */
-          result = ftp_state_user(data, ftpc, conn);
-      }
-      break;
-
-    case FTP_USER:
-    case FTP_PASS:
-      result = ftp_state_user_resp(data, ftpc, ftpcode);
-      break;
-
-    case FTP_ACCT:
-      result = ftp_state_acct_resp(data, ftpc, ftpcode);
-      break;
-
-    case FTP_PBSZ:
-      result =
-        Curl_pp_sendf(data, &ftpc->pp, "PROT %c",
-                      data->set.use_ssl == CURLUSESSL_CONTROL ? 'C' : 'P');
-      if(!result)
-        ftp_state(data, ftpc, FTP_PROT);
-      break;
-
-    case FTP_PROT:
-      if(ftpcode/100 == 2)
-        /* We have enabled SSL for the data connection! */
-        conn->bits.ftp_use_data_ssl =
-          (data->set.use_ssl != CURLUSESSL_CONTROL);
-      /* FTP servers typically responds with 500 if they decide to reject
-         our 'P' request */
-      else if(data->set.use_ssl > CURLUSESSL_CONTROL)
-        /* we failed and bails out */
-        return CURLE_USE_SSL_FAILED;
-
-      if(data->set.ftp_ccc) {
-        /* CCC - Clear Command Channel
-         */
-        result = Curl_pp_sendf(data, &ftpc->pp, "%s", "CCC");
-        if(!result)
-          ftp_state(data, ftpc, FTP_CCC);
+      result = Curl_conn_connect(data, FIRSTSOCKET, TRUE, &done);
+      if(!result) {
+        conn->bits.ftp_use_data_ssl = FALSE; /* clear-text data */
+        conn->bits.ftp_use_control_ssl = TRUE; /* SSL on control */
+        result = ftp_state_user(data, ftpc, conn);
       }
+    }
+    else if(ftpc->count3 < 1) {
+      ftpc->count3++;
+      ftpc->count1 += ftpc->count2; /* get next attempt */
+      result = Curl_pp_sendf(data, &ftpc->pp, "AUTH %s",
+                             ftpauth[ftpc->count1]);
+      /* remain in this same state */
+    }
+    else {
+      if(data->set.use_ssl > CURLUSESSL_TRY)
+        /* we failed and CURLUSESSL_CONTROL or CURLUSESSL_ALL is set */
+        result = CURLE_USE_SSL_FAILED;
       else
-        result = ftp_state_pwd(data, ftpc);
-      break;
-
-    case FTP_CCC:
-      if(ftpcode < 500) {
-        /* First shut down the SSL layer (note: this call will block) */
-        /* This has only been tested on the proftpd server, and the mod_tls
-         * code sends a close notify alert without waiting for a close notify
-         * alert in response. Thus we wait for a close notify alert from the
-         * server, but we do not send one. Let's hope other servers do
-         * the same... */
-        result = Curl_ssl_cfilter_remove(data, FIRSTSOCKET,
-          (data->set.ftp_ccc == CURLFTPSSL_CCC_ACTIVE));
+        /* ignore the failure and continue */
+        result = ftp_state_user(data, ftpc, conn);
+    }
+    break;
 
-        if(result)
-          failf(data, "Failed to clear the command channel (CCC)");
-      }
-      if(!result)
-        /* Then continue as normal */
-        result = ftp_state_pwd(data, ftpc);
-      break;
+  case FTP_USER:
+  case FTP_PASS:
+    result = ftp_state_user_resp(data, ftpc, ftpcode);
+    break;
 
-    case FTP_PWD:
-      if(ftpcode == 257) {
-        char *ptr = curlx_dyn_ptr(&pp->recvbuf) + 4; /* start on the first
-                                                        letter */
-        bool entry_extracted = FALSE;
-        struct dynbuf out;
-        curlx_dyn_init(&out, 1000);
+  case FTP_ACCT:
+    result = ftp_state_acct_resp(data, ftpc, ftpcode);
+    break;
 
-        /* Reply format is like
-           257<space>[rubbish]"<directory-name>"<space><commentary> and the
-           RFC959 says
+  case FTP_PBSZ:
+    result =
+      Curl_pp_sendf(data, &ftpc->pp, "PROT %c",
+                    data->set.use_ssl == CURLUSESSL_CONTROL ? 'C' : 'P');
+    if(!result)
+      ftp_state(data, ftpc, FTP_PROT);
+    break;
 
-           The directory name can contain any character; embedded
-           double-quotes should be escaped by double-quotes (the
-           "quote-doubling" convention).
-        */
+  case FTP_PROT:
+    if(ftpcode/100 == 2)
+      /* We have enabled SSL for the data connection! */
+      conn->bits.ftp_use_data_ssl =
+        (data->set.use_ssl != CURLUSESSL_CONTROL);
+    /* FTP servers typically responds with 500 if they decide to reject
+       our 'P' request */
+    else if(data->set.use_ssl > CURLUSESSL_CONTROL)
+      /* we failed and bails out */
+      return CURLE_USE_SSL_FAILED;
+
+    if(data->set.ftp_ccc) {
+      /* CCC - Clear Command Channel
+       */
+      result = Curl_pp_sendf(data, &ftpc->pp, "%s", "CCC");
+      if(!result)
+        ftp_state(data, ftpc, FTP_CCC);
+    }
+    else
+      result = ftp_state_pwd(data, ftpc);
+    break;
 
-        /* scan for the first double-quote for non-standard responses */
-        while(*ptr != '\n' && *ptr != '\0' && *ptr != '"')
-          ptr++;
+  case FTP_CCC:
+    if(ftpcode < 500) {
+      /* First shut down the SSL layer (note: this call will block) */
+      /* This has only been tested on the proftpd server, and the mod_tls
+       * code sends a close notify alert without waiting for a close notify
+       * alert in response. Thus we wait for a close notify alert from the
+       * server, but we do not send one. Let's hope other servers do
+       * the same... */
+      result = Curl_ssl_cfilter_remove(data, FIRSTSOCKET,
+                                       (data->set.ftp_ccc ==
+                                        (unsigned char)CURLFTPSSL_CCC_ACTIVE));
+      if(result)
+        failf(data, "Failed to clear the command channel (CCC)");
+    }
+    if(!result)
+      /* Then continue as normal */
+      result = ftp_state_pwd(data, ftpc);
+    break;
 
-        if('\"' == *ptr) {
-          /* it started good */
-          for(ptr++; *ptr; ptr++) {
-            if('\"' == *ptr) {
-              if('\"' == ptr[1]) {
-                /* "quote-doubling" */
-                result = curlx_dyn_addn(&out, &ptr[1], 1);
-                ptr++;
-              }
-              else {
-                /* end of path */
-                if(curlx_dyn_len(&out))
-                  entry_extracted = TRUE;
-                break; /* get out of this loop */
-              }
-            }
-            else
-              result = curlx_dyn_addn(&out, ptr, 1);
-            if(result)
-              return result;
-          }
-        }
-        if(entry_extracted) {
-          /* If the path name does not look like an absolute path (i.e.: it
-             does not start with a '/'), we probably need some server-dependent
-             adjustments. For example, this is the case when connecting to
-             an OS400 FTP server: this server supports two name syntaxes,
-             the default one being incompatible with standard paths. In
-             addition, this server switches automatically to the regular path
-             syntax when one is encountered in a command: this results in
-             having an entrypath in the wrong syntax when later used in CWD.
-               The method used here is to check the server OS: we do it only
-             if the path name looks strange to minimize overhead on other
-             systems. */
-          char *dir = curlx_dyn_ptr(&out);
-
-          if(!ftpc->server_os && dir[0] != '/') {
-            result = Curl_pp_sendf(data, &ftpc->pp, "%s", "SYST");
-            if(result) {
-              free(dir);
-              return result;
-            }
-            free(ftpc->entrypath);
-            ftpc->entrypath = dir; /* remember this */
-            infof(data, "Entry path is '%s'", ftpc->entrypath);
-            /* also save it where getinfo can access it: */
-            free(data->state.most_recent_ftp_entrypath);
-            data->state.most_recent_ftp_entrypath = strdup(ftpc->entrypath);
-            if(!data->state.most_recent_ftp_entrypath)
-              return CURLE_OUT_OF_MEMORY;
-            ftp_state(data, ftpc, FTP_SYST);
-            break;
-          }
+  case FTP_PWD:
+    result = ftp_pwd_resp(data, ftpc, ftpcode);
+    break;
 
-          free(ftpc->entrypath);
-          ftpc->entrypath = dir; /* remember this */
-          infof(data, "Entry path is '%s'", ftpc->entrypath);
-          /* also save it where getinfo can access it: */
-          free(data->state.most_recent_ftp_entrypath);
-          data->state.most_recent_ftp_entrypath = strdup(ftpc->entrypath);
-          if(!data->state.most_recent_ftp_entrypath)
-            return CURLE_OUT_OF_MEMORY;
-        }
-        else {
-          /* could not get the path */
-          curlx_dyn_free(&out);
-          infof(data, "Failed to figure out path");
-        }
-      }
-      ftp_state(data, ftpc, FTP_STOP); /* we are done with CONNECT phase! */
-      CURL_TRC_FTP(data, "[%s] protocol connect phase DONE", FTP_CSTATE(ftpc));
-      break;
+  case FTP_SYST:
+    if(ftpcode == 215) {
+      char *ptr = curlx_dyn_ptr(&pp->recvbuf) + 4; /* start on the first
+                                                      letter */
+      char *os;
+      char *start;
 
-    case FTP_SYST:
-      if(ftpcode == 215) {
-        char *ptr = curlx_dyn_ptr(&pp->recvbuf) + 4; /* start on the first
-                                                       letter */
-        char *os;
-        char *start;
-
-        /* Reply format is like
-           215<space><OS-name><space><commentary>
-        */
-        while(*ptr == ' ')
-          ptr++;
-        for(start = ptr; *ptr && *ptr != ' '; ptr++)
-          ;
-        os = Curl_memdup0(start, ptr - start);
-        if(!os)
-          return CURLE_OUT_OF_MEMORY;
+      /* Reply format is like
+         215<space><OS-name><space><commentary>
+      */
+      while(*ptr == ' ')
+        ptr++;
+      for(start = ptr; *ptr && *ptr != ' '; ptr++)
+        ;
+      os = Curl_memdup0(start, ptr - start);
+      if(!os)
+        return CURLE_OUT_OF_MEMORY;
 
-        /* Check for special servers here. */
-        if(curl_strequal(os, "OS/400")) {
-          /* Force OS400 name format 1. */
-          result = Curl_pp_sendf(data, &ftpc->pp, "%s", "SITE NAMEFMT 1");
-          if(result) {
-            free(os);
-            return result;
-          }
-          /* remember target server OS */
-          free(ftpc->server_os);
-          ftpc->server_os = os;
-          ftp_state(data, ftpc, FTP_NAMEFMT);
-          break;
+      /* Check for special servers here. */
+      if(curl_strequal(os, "OS/400")) {
+        /* Force OS400 name format 1. */
+        result = Curl_pp_sendf(data, &ftpc->pp, "%s", "SITE NAMEFMT 1");
+        if(result) {
+          free(os);
+          return result;
         }
-        /* Nothing special for the target server. */
         /* remember target server OS */
         free(ftpc->server_os);
         ftpc->server_os = os;
-      }
-      else {
-        /* Cannot identify server OS. Continue anyway and cross fingers. */
-      }
-
-      ftp_state(data, ftpc, FTP_STOP); /* we are done with CONNECT phase! */
-      CURL_TRC_FTP(data, "[%s] protocol connect phase DONE", FTP_CSTATE(ftpc));
-      break;
-
-    case FTP_NAMEFMT:
-      if(ftpcode == 250) {
-        /* Name format change successful: reload initial path. */
-        ftp_state_pwd(data, ftpc);
+        ftp_state(data, ftpc, FTP_NAMEFMT);
         break;
       }
+      /* Nothing special for the target server. */
+      /* remember target server OS */
+      free(ftpc->server_os);
+      ftpc->server_os = os;
+    }
+    else {
+      /* Cannot identify server OS. Continue anyway and cross fingers. */
+    }
 
-      ftp_state(data, ftpc, FTP_STOP); /* we are done with CONNECT phase! */
-      CURL_TRC_FTP(data, "[%s] protocol connect phase DONE", FTP_CSTATE(ftpc));
-      break;
+    ftp_state(data, ftpc, FTP_STOP); /* we are done with CONNECT phase! */
+    CURL_TRC_FTP(data, "[%s] protocol connect phase DONE", FTP_CSTATE(ftpc));
+    break;
 
-    case FTP_QUOTE:
-    case FTP_POSTQUOTE:
-    case FTP_RETR_PREQUOTE:
-    case FTP_STOR_PREQUOTE:
-    case FTP_LIST_PREQUOTE:
-      if((ftpcode >= 400) && !ftpc->count2) {
-        /* failure response code, and not allowed to fail */
-        failf(data, "QUOT command failed with %03d", ftpcode);
-        result = CURLE_QUOTE_ERROR;
-      }
-      else
-        result = ftp_state_quote(data, ftpc, ftp, FALSE, ftpc->state);
+  case FTP_NAMEFMT:
+    if(ftpcode == 250) {
+      /* Name format change successful: reload initial path. */
+      ftp_state_pwd(data, ftpc);
       break;
+    }
 
-    case FTP_CWD:
-      if(ftpcode/100 != 2) {
-        /* failure to CWD there */
-        if(data->set.ftp_create_missing_dirs &&
-           ftpc->cwdcount && !ftpc->count2) {
-          /* try making it */
-          ftpc->count2++; /* counter to prevent CWD-MKD loops */
-
-          /* count3 is set to allow MKD to fail once per dir. In the case when
-          CWD fails and then MKD fails (due to another session raced it to
-          create the dir) this then allows for a second try to CWD to it. */
-          ftpc->count3 = (data->set.ftp_create_missing_dirs == 2) ? 1 : 0;
-
-          result = Curl_pp_sendf(data, &ftpc->pp, "MKD %s",
-                                 ftpc->dirs[ftpc->cwdcount - 1]);
-          if(!result)
-            ftp_state(data, ftpc, FTP_MKD);
-        }
-        else {
-          /* return failure */
-          failf(data, "Server denied you to change to the given directory");
-          ftpc->cwdfail = TRUE; /* do not remember this path as we failed
-                                   to enter it */
-          result = CURLE_REMOTE_ACCESS_DENIED;
-        }
+    ftp_state(data, ftpc, FTP_STOP); /* we are done with CONNECT phase! */
+    CURL_TRC_FTP(data, "[%s] protocol connect phase DONE", FTP_CSTATE(ftpc));
+    break;
+
+  case FTP_QUOTE:
+  case FTP_POSTQUOTE:
+  case FTP_RETR_PREQUOTE:
+  case FTP_STOR_PREQUOTE:
+  case FTP_LIST_PREQUOTE:
+    if((ftpcode >= 400) && !ftpc->count2) {
+      /* failure response code, and not allowed to fail */
+      failf(data, "QUOT command failed with %03d", ftpcode);
+      result = CURLE_QUOTE_ERROR;
+    }
+    else
+      result = ftp_state_quote(data, ftpc, ftp, FALSE, ftpc->state);
+    break;
+
+  case FTP_CWD:
+    if(ftpcode/100 != 2) {
+      /* failure to CWD there */
+      if(data->set.ftp_create_missing_dirs &&
+         ftpc->cwdcount && !ftpc->count2) {
+        /* try making it */
+        ftpc->count2++; /* counter to prevent CWD-MKD loops */
+
+        /* count3 is set to allow MKD to fail once per dir. In the case when
+           CWD fails and then MKD fails (due to another session raced it to
+           create the dir) this then allows for a second try to CWD to it. */
+        ftpc->count3 = (data->set.ftp_create_missing_dirs == 2) ? 1 : 0;
+
+        result = Curl_pp_sendf(data, &ftpc->pp, "MKD %.*s",
+                               pathlen(ftpc, ftpc->cwdcount - 1),
+                               pathpiece(ftpc, ftpc->cwdcount - 1));
+        if(!result)
+          ftp_state(data, ftpc, FTP_MKD);
       }
       else {
-        /* success */
-        ftpc->count2 = 0;
-        if(++ftpc->cwdcount <= ftpc->dirdepth)
-          /* send next CWD */
-          result = Curl_pp_sendf(data, &ftpc->pp, "CWD %s",
-                                 ftpc->dirs[ftpc->cwdcount - 1]);
-        else
-          result = ftp_state_mdtm(data, ftpc, ftp);
-      }
-      break;
-
-    case FTP_MKD:
-      if((ftpcode/100 != 2) && !ftpc->count3--) {
-        /* failure to MKD the dir */
-        failf(data, "Failed to MKD dir: %03d", ftpcode);
+        /* return failure */
+        failf(data, "Server denied you to change to the given directory");
+        ftpc->cwdfail = TRUE; /* do not remember this path as we failed
+                                 to enter it */
         result = CURLE_REMOTE_ACCESS_DENIED;
       }
+    }
+    else {
+      /* success */
+      ftpc->count2 = 0;
+      if(ftpc->cwdcount >= ftpc->dirdepth)
+        result = ftp_state_mdtm(data, ftpc, ftp);
       else {
-        ftp_state(data, ftpc, FTP_CWD);
-        /* send CWD */
-        result = Curl_pp_sendf(data, &ftpc->pp, "CWD %s",
-                               ftpc->dirs[ftpc->cwdcount - 1]);
+        ftpc->cwdcount++;
+        /* send next CWD */
+        result = Curl_pp_sendf(data, &ftpc->pp, "CWD %.*s",
+                               pathlen(ftpc, ftpc->cwdcount - 1),
+                               pathpiece(ftpc, ftpc->cwdcount - 1));
       }
-      break;
+    }
+    break;
 
-    case FTP_MDTM:
-      result = ftp_state_mdtm_resp(data, ftpc, ftp, ftpcode);
-      break;
+  case FTP_MKD:
+    if((ftpcode/100 != 2) && !ftpc->count3--) {
+      /* failure to MKD the dir */
+      failf(data, "Failed to MKD dir: %03d", ftpcode);
+      result = CURLE_REMOTE_ACCESS_DENIED;
+    }
+    else {
+      ftp_state(data, ftpc, FTP_CWD);
+      /* send CWD */
+      result = Curl_pp_sendf(data, &ftpc->pp, "CWD %.*s",
+                             pathlen(ftpc, ftpc->cwdcount - 1),
+                             pathpiece(ftpc, ftpc->cwdcount - 1));
+    }
+    break;
 
-    case FTP_TYPE:
-    case FTP_LIST_TYPE:
-    case FTP_RETR_TYPE:
-    case FTP_STOR_TYPE:
-    case FTP_RETR_LIST_TYPE:
-      result = ftp_state_type_resp(data, ftpc, ftp, ftpcode, ftpc->state);
-      break;
+  case FTP_MDTM:
+    result = ftp_state_mdtm_resp(data, ftpc, ftp, ftpcode);
+    break;
 
-    case FTP_SIZE:
-    case FTP_RETR_SIZE:
-    case FTP_STOR_SIZE:
-      result = ftp_state_size_resp(data, ftpc, ftp, ftpcode, ftpc->state);
-      break;
+  case FTP_TYPE:
+  case FTP_LIST_TYPE:
+  case FTP_RETR_TYPE:
+  case FTP_STOR_TYPE:
+  case FTP_RETR_LIST_TYPE:
+    result = ftp_state_type_resp(data, ftpc, ftp, ftpcode, ftpc->state);
+    break;
 
-    case FTP_REST:
-    case FTP_RETR_REST:
-      result = ftp_state_rest_resp(data, ftpc, ftp, ftpcode, ftpc->state);
-      break;
+  case FTP_SIZE:
+  case FTP_RETR_SIZE:
+  case FTP_STOR_SIZE:
+    result = ftp_state_size_resp(data, ftpc, ftp, ftpcode, ftpc->state);
+    break;
 
-    case FTP_PRET:
-      if(ftpcode != 200) {
-        /* there only is this one standard OK return code. */
-        failf(data, "PRET command not accepted: %03d", ftpcode);
-        return CURLE_FTP_PRET_FAILED;
-      }
-      result = ftp_state_use_pasv(data, ftpc, conn);
-      break;
+  case FTP_REST:
+  case FTP_RETR_REST:
+    result = ftp_state_rest_resp(data, ftpc, ftp, ftpcode, ftpc->state);
+    break;
 
-    case FTP_PASV:
-      result = ftp_state_pasv_resp(data, ftpc, ftpcode);
-      break;
+  case FTP_PRET:
+    if(ftpcode != 200) {
+      /* there only is this one standard OK return code. */
+      failf(data, "PRET command not accepted: %03d", ftpcode);
+      return CURLE_FTP_PRET_FAILED;
+    }
+    result = ftp_state_use_pasv(data, ftpc, conn);
+    break;
 
-    case FTP_PORT:
-      result = ftp_state_port_resp(data, ftpc, ftp, ftpcode);
-      break;
+  case FTP_PASV:
+    result = ftp_state_pasv_resp(data, ftpc, ftpcode);
+    break;
 
-    case FTP_LIST:
-    case FTP_RETR:
-      result = ftp_state_get_resp(data, ftpc, ftp, ftpcode, ftpc->state);
-      break;
+  case FTP_PORT:
+    result = ftp_state_port_resp(data, ftpc, ftp, ftpcode);
+    break;
 
-    case FTP_STOR:
-      result = ftp_state_stor_resp(data, ftpc, ftpcode, ftpc->state);
-      break;
+  case FTP_LIST:
+  case FTP_RETR:
+    result = ftp_state_get_resp(data, ftpc, ftp, ftpcode, ftpc->state);
+    break;
 
-    case FTP_QUIT:
-    default:
-      /* internal error */
-      ftp_state(data, ftpc, FTP_STOP);
-      break;
-    }
-  } /* if(ftpcode) */
+  case FTP_STOR:
+    result = ftp_state_stor_resp(data, ftpc, ftpcode, ftpc->state);
+    break;
+
+  case FTP_QUIT:
+  default:
+    /* internal error */
+    ftp_state(data, ftpc, FTP_STOP);
+    break;
+  }
 
   return result;
 }
@@ -3257,8 +3286,6 @@ static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
   ssize_t nread;
   int ftpcode;
   CURLcode result = CURLE_OK;
-  char *rawPath = NULL;
-  size_t pathLen = 0;
 
   if(!ftp || !ftpc)
     return CURLE_OK;
@@ -3301,14 +3328,11 @@ static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
       Curl_set_in_callback(data, TRUE);
       data->set.chunk_end(data->set.wildcardptr);
       Curl_set_in_callback(data, FALSE);
+      freedirs(ftpc);
     }
     ftpc->known_filesize = -1;
   }
 
-  if(!result)
-    /* get the url-decoded "raw" path */
-    result = Curl_urldecode(ftp->path, 0, &rawPath, &pathLen,
-                            REJECT_CTRL);
   if(result) {
     /* We can limp along anyway (and should try to since we may already be in
      * the error path) */
@@ -3318,34 +3342,31 @@ static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
     ftpc->prevpath = NULL; /* no path remembering */
   }
   else { /* remember working directory for connection reuse */
-    if((data->set.ftp_filemethod == FTPFILE_NOCWD) && (rawPath[0] == '/'))
-      free(rawPath); /* full path => no CWDs happened => keep ftpc->prevpath */
-    else {
-      free(ftpc->prevpath);
+    const char *rawPath = ftpc->rawpath;
+    if(rawPath) {
+      if((data->set.ftp_filemethod == FTPFILE_NOCWD) && (rawPath[0] == '/'))
+        ; /* full path => no CWDs happened => keep ftpc->prevpath */
+      else {
+        size_t pathLen = strlen(ftpc->rawpath);
 
-      if(!ftpc->cwdfail) {
-        if(data->set.ftp_filemethod == FTPFILE_NOCWD)
-          pathLen = 0; /* relative path => working directory is FTP home */
-        else
-          /* file is url-decoded */
-          pathLen -= ftpc->file ? strlen(ftpc->file) : 0;
+        free(ftpc->prevpath);
 
-        rawPath[pathLen] = '\0';
-        ftpc->prevpath = rawPath;
-      }
-      else {
-        free(rawPath);
-        ftpc->prevpath = NULL; /* no path */
+        if(!ftpc->cwdfail) {
+          if(data->set.ftp_filemethod == FTPFILE_NOCWD)
+            pathLen = 0; /* relative path => working directory is FTP home */
+          else
+            /* file is url-decoded */
+            pathLen -= ftpc->file ? strlen(ftpc->file) : 0;
+          ftpc->prevpath = Curl_memdup0(rawPath, pathLen);
+        }
+        else
+          ftpc->prevpath = NULL; /* no path */
       }
     }
-
     if(ftpc->prevpath)
       infof(data, "Remembering we are in dir \"%s\"", ftpc->prevpath);
   }
 
-  /* free the dir tree and file parts */
-  freedirs(ftpc);
-
   /* shut down the socket to inform the server we are done */
 
 #ifdef UNDER_CE
@@ -3438,7 +3459,7 @@ static CURLcode ftp_done(struct Curl_easy *data, CURLcode status,
     }
   }
   else {
-    if((-1 != data->req.size) &&
+    if((data->req.size != -1) &&
        (data->req.size != data->req.bytecount) &&
        (data->req.maxdownload != data->req.bytecount)) {
       failf(data, "Received only partial file: %" FMT_OFF_T " bytes",
@@ -3753,7 +3774,6 @@ static CURLcode ftp_do_more(struct Curl_easy *data, int *completep)
 }
 
 
-
 /***********************************************************************
  *
  * ftp_perform()
@@ -4163,6 +4183,20 @@ static CURLcode ftp_disconnect(struct Curl_easy *data,
   return CURLE_OK;
 }
 
+static size_t numof_slashes(const char *str)
+{
+  const char *slashPos;
+  size_t num = 0;
+  do {
+    slashPos = strchr(str, '/');
+    if(slashPos) {
+      ++num;
+      str = slashPos + 1;
+    }
+  } while(slashPos);
+  return num;
+}
+
 /***********************************************************************
  *
  * ftp_parse_url_path()
@@ -4178,18 +4212,21 @@ CURLcode ftp_parse_url_path(struct Curl_easy *data,
   const char *slashPos = NULL;
   const char *fileName = NULL;
   CURLcode result = CURLE_OK;
-  char *rawPath = NULL; /* url-decoded "raw" path */
+  const char *rawPath = NULL; /* url-decoded "raw" path */
   size_t pathLen = 0;
 
   ftpc->ctl_valid = FALSE;
   ftpc->cwdfail = FALSE;
 
+  if(ftpc->rawpath)
+    freedirs(ftpc);
   /* url-decode ftp path before further evaluation */
-  result = Curl_urldecode(ftp->path, 0, &rawPath, &pathLen, REJECT_CTRL);
+  result = Curl_urldecode(ftp->path, 0, &ftpc->rawpath, &pathLen, REJECT_CTRL);
   if(result) {
     failf(data, "path contains control characters");
     return result;
   }
+  rawPath = ftpc->rawpath;
 
   switch(data->set.ftp_filemethod) {
     case FTPFILE_NOCWD: /* fastest, but less standard-compliant */
@@ -4213,17 +4250,11 @@ CURLcode ftp_parse_url_path(struct Curl_easy *data,
           dirlen = 1;
 
         ftpc->dirs = calloc(1, sizeof(ftpc->dirs[0]));
-        if(!ftpc->dirs) {
-          free(rawPath);
-          return CURLE_OUT_OF_MEMORY;
-        }
-
-        ftpc->dirs[0] = Curl_memdup0(rawPath, dirlen);
-        if(!ftpc->dirs[0]) {
-          free(rawPath);
+        if(!ftpc->dirs)
           return CURLE_OUT_OF_MEMORY;
-        }
 
+        ftpc->dirs[0].start = 0;
+        ftpc->dirs[0].len = (int)dirlen;
         ftpc->dirdepth = 1; /* we consider it to be a single dir */
         fileName = slashPos + 1; /* rest is filename */
       }
@@ -4236,51 +4267,45 @@ CURLcode ftp_parse_url_path(struct Curl_easy *data,
       /* current position: begin of next path component */
       const char *curPos = rawPath;
 
-      /* number of entries allocated for the 'dirs' array */
-      size_t dirAlloc = 0;
-      const char *str = rawPath;
-      for(; *str != 0; ++str)
-        if(*str == '/')
-          ++dirAlloc;
+      /* number of entries to allocate for the 'dirs' array */
+      size_t dirAlloc = numof_slashes(rawPath);
+
+      if(dirAlloc >= 1000)
+        /* suspiciously deep dir hierarchy */
+        return CURLE_URL_MALFORMAT;
 
       if(dirAlloc) {
         ftpc->dirs = calloc(dirAlloc, sizeof(ftpc->dirs[0]));
-        if(!ftpc->dirs) {
-          free(rawPath);
+        if(!ftpc->dirs)
           return CURLE_OUT_OF_MEMORY;
-        }
 
         /* parse the URL path into separate path components */
-        /* !checksrc! disable EQUALSNULL 1 */
-        while((slashPos = strchr(curPos, '/')) != NULL) {
-          size_t compLen = slashPos - curPos;
+        while(dirAlloc--) {
+          const char *spos = strchr(curPos, '/');
+          size_t clen = spos - curPos;
 
           /* path starts with a slash: add that as a directory */
-          if((compLen == 0) && (ftpc->dirdepth == 0))
-            ++compLen;
+          if(!clen && (ftpc->dirdepth == 0))
+            ++clen;
 
           /* we skip empty path components, like "x//y" since the FTP command
              CWD requires a parameter and a non-existent parameter a) does not
              work on many servers and b) has no effect on the others. */
-          if(compLen > 0) {
-            char *comp = Curl_memdup0(curPos, compLen);
-            if(!comp) {
-              free(rawPath);
-              return CURLE_OUT_OF_MEMORY;
-            }
-            ftpc->dirs[ftpc->dirdepth++] = comp;
+          if(clen) {
+            ftpc->dirs[ftpc->dirdepth].start = (int)(curPos - rawPath);
+            ftpc->dirs[ftpc->dirdepth].len = (int)clen;
+            ftpc->dirdepth++;
           }
-          curPos = slashPos + 1;
+          curPos = spos + 1;
         }
       }
-      DEBUGASSERT((size_t)ftpc->dirdepth <= dirAlloc);
       fileName = curPos; /* the rest is the filename (or empty) */
     }
     break;
   } /* switch */
 
   if(fileName && *fileName)
-    ftpc->file = strdup(fileName);
+    ftpc->file = fileName;
   else
     ftpc->file = NULL; /* instead of point to a zero byte,
                             we make it a NULL pointer */
@@ -4288,7 +4313,6 @@ CURLcode ftp_parse_url_path(struct Curl_easy *data,
   if(data->state.upload && !ftpc->file && (ftp->transfer == PPTRANSFER_BODY)) {
     /* We need a filename when uploading. Return error! */
     failf(data, "Uploading to a URL without a filename");
-    free(rawPath);
     return CURLE_URL_MALFORMAT;
   }
 
@@ -4312,7 +4336,6 @@ CURLcode ftp_parse_url_path(struct Curl_easy *data,
     }
   }
 
-  free(rawPath);
   return CURLE_OK;
 }
 
diff --git a/deps/curl/lib/ftp.h b/deps/curl/lib/ftp.h
index 52661981ef3..aba1db7f2d3 100644
--- a/deps/curl/lib/ftp.h
+++ b/deps/curl/lib/ftp.h
@@ -120,6 +120,11 @@ struct FTP {
   curl_off_t downloadsize;
 };
 
+/* one struct entry for each path component (of 'rawpath') */
+struct pathcomp {
+  int start; /* start column */
+  int len;   /* length in bytes */
+};
 
 /* ftp_conn is used for struct connection-oriented data in the connectdata
    struct */
@@ -128,8 +133,9 @@ struct ftp_conn {
   char *account;
   char *alternative_to_user;
   char *entrypath; /* the PWD reply when we logged on */
-  char *file;    /* url-decoded filename (or path) */
-  char **dirs;   /* realloc()ed array for path components */
+  const char *file; /* url-decoded filename (or path), points into rawpath */
+  char *rawpath; /* URL decoded, allocated, version of the path */
+  struct pathcomp *dirs; /* allocated array for path components */
   char *newhost; /* the (allocated) IP addr or hostname to connect the data
                     connection to */
   char *prevpath;   /* url-decoded conn->path from the previous transfer */
diff --git a/deps/curl/lib/gopher.c b/deps/curl/lib/gopher.c
index 68ccb59e408..93db85e9d02 100644
--- a/deps/curl/lib/gopher.c
+++ b/deps/curl/lib/gopher.c
@@ -70,10 +70,10 @@ const struct Curl_handler Curl_handler_gopher = {
   ZERO_NULL,                            /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -96,10 +96,10 @@ const struct Curl_handler Curl_handler_gophers = {
   gopher_connect,                       /* connect_it */
   gopher_connecting,                    /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -240,7 +240,7 @@ static CURLcode gopher_do(struct Curl_easy *data, bool *done)
   if(result)
     return result;
 
-  Curl_xfer_setup1(data, CURL_XFER_RECV, -1, FALSE);
+  Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
   return CURLE_OK;
 }
 #endif /* CURL_DISABLE_GOPHER */
diff --git a/deps/curl/lib/hmac.c b/deps/curl/lib/hmac.c
index 3af1f292dac..5e7dd0df0c2 100644
--- a/deps/curl/lib/hmac.c
+++ b/deps/curl/lib/hmac.c
@@ -73,7 +73,8 @@ Curl_HMAC_init(const struct HMAC_params *hashparams,
 
   /* If the key is too long, replace it by its hash digest. */
   if(keylen > hashparams->maxkeylen) {
-    hashparams->hinit(ctxt->hashctxt1);
+    if(hashparams->hinit(ctxt->hashctxt1))
+      return NULL;
     hashparams->hupdate(ctxt->hashctxt1, key, keylen);
     hkey = (unsigned char *) ctxt->hashctxt2 + hashparams->ctxtsize;
     hashparams->hfinal(hkey, ctxt->hashctxt1);
@@ -82,8 +83,9 @@ Curl_HMAC_init(const struct HMAC_params *hashparams,
   }
 
   /* Prime the two hash contexts with the modified key. */
-  hashparams->hinit(ctxt->hashctxt1);
-  hashparams->hinit(ctxt->hashctxt2);
+  if(hashparams->hinit(ctxt->hashctxt1) ||
+     hashparams->hinit(ctxt->hashctxt2))
+    return NULL;
 
   for(i = 0; i < keylen; i++) {
     b = (unsigned char)(*key ^ hmac_ipad);
diff --git a/deps/curl/lib/hostip.c b/deps/curl/lib/hostip.c
index 191aaeb8de9..2d122fb9996 100644
--- a/deps/curl/lib/hostip.c
+++ b/deps/curl/lib/hostip.c
@@ -180,9 +180,9 @@ create_dnscache_id(const char *name,
 }
 
 struct dnscache_prune_data {
-  time_t now;
-  time_t oldest; /* oldest time in cache not pruned. */
-  int max_age_sec;
+  struct curltime now;
+  timediff_t oldest_ms; /* oldest time in cache not pruned. */
+  timediff_t max_age_ms;
 };
 
 /*
@@ -199,36 +199,38 @@ dnscache_entry_is_stale(void *datap, void *hc)
     (struct dnscache_prune_data *) datap;
   struct Curl_dns_entry *dns = (struct Curl_dns_entry *) hc;
 
-  if(dns->timestamp) {
-    /* age in seconds */
-    time_t age = prune->now - dns->timestamp;
-    if(age >= (time_t)prune->max_age_sec)
+  if(dns->timestamp.tv_sec || dns->timestamp.tv_usec) {
+    /* get age in milliseconds */
+    timediff_t age = curlx_timediff(prune->now, dns->timestamp);
+    if(!dns->addr)
+      age *= 2; /* negative entries age twice as fast */
+    if(age >= prune->max_age_ms)
       return TRUE;
-    if(age > prune->oldest)
-      prune->oldest = age;
+    if(age > prune->oldest_ms)
+      prune->oldest_ms = age;
   }
   return FALSE;
 }
 
 /*
  * Prune the DNS cache. This assumes that a lock has already been taken.
- * Returns the 'age' of the oldest still kept entry.
+ * Returns the 'age' of the oldest still kept entry - in milliseconds.
  */
-static time_t
-dnscache_prune(struct Curl_hash *hostcache, int cache_timeout,
-               time_t now)
+static timediff_t
+dnscache_prune(struct Curl_hash *hostcache, timediff_t cache_timeout_ms,
+               struct curltime now)
 {
   struct dnscache_prune_data user;
 
-  user.max_age_sec = cache_timeout;
+  user.max_age_ms = cache_timeout_ms;
   user.now = now;
-  user.oldest = 0;
+  user.oldest_ms = 0;
 
   Curl_hash_clean_with_criterium(hostcache,
                                  (void *) &user,
                                  dnscache_entry_is_stale);
 
-  return user.oldest;
+  return user.oldest_ms;
 }
 
 static struct Curl_dnscache *dnscache_get(struct Curl_easy *data)
@@ -261,35 +263,49 @@ static void dnscache_unlock(struct Curl_easy *data,
 void Curl_dnscache_prune(struct Curl_easy *data)
 {
   struct Curl_dnscache *dnscache = dnscache_get(data);
-  time_t now;
+  struct curltime now;
   /* the timeout may be set -1 (forever) */
-  int timeout = data->set.dns_cache_timeout;
+  timediff_t timeout_ms = data->set.dns_cache_timeout_ms;
 
-  if(!dnscache)
+  if(!dnscache || (timeout_ms == -1))
     /* NULL hostcache means we cannot do it */
     return;
 
   dnscache_lock(data, dnscache);
 
-  now = time(NULL);
+  now = curlx_now();
 
   do {
     /* Remove outdated and unused entries from the hostcache */
-    time_t oldest = dnscache_prune(&dnscache->entries, timeout, now);
+    timediff_t oldest_ms = dnscache_prune(&dnscache->entries, timeout_ms, now);
 
-    if(oldest < INT_MAX)
-      timeout = (int)oldest; /* we know it fits */
+    if(Curl_hash_count(&dnscache->entries) > MAX_DNS_CACHE_SIZE) {
+      if(oldest_ms < INT_MAX)
+        /* prune the ones over half this age */
+        timeout_ms = (int)oldest_ms / 2;
+      else
+        timeout_ms = INT_MAX/2;
+    }
     else
-      timeout = INT_MAX - 1;
+      break;
 
-    /* if the cache size is still too big, use the oldest age as new
-       prune limit */
-  } while(timeout &&
-          (Curl_hash_count(&dnscache->entries) > MAX_DNS_CACHE_SIZE));
+    /* if the cache size is still too big, use the oldest age as new prune
+       limit */
+  } while(timeout_ms);
 
   dnscache_unlock(data, dnscache);
 }
 
+void Curl_dnscache_clear(struct Curl_easy *data)
+{
+  struct Curl_dnscache *dnscache = dnscache_get(data);
+  if(dnscache) {
+    dnscache_lock(data, dnscache);
+    Curl_hash_clean(&dnscache->entries);
+    dnscache_unlock(data, dnscache);
+  }
+}
+
 #ifdef USE_ALARM_TIMEOUT
 /* Beware this is a global and unique instance. This is used to store the
    return address that we can jump back to from inside a signal handler. This
@@ -327,13 +343,13 @@ static struct Curl_dns_entry *fetch_addr(struct Curl_easy *data,
     dns = Curl_hash_pick(&dnscache->entries, entry_id, entry_len + 1);
   }
 
-  if(dns && (data->set.dns_cache_timeout != -1)) {
+  if(dns && (data->set.dns_cache_timeout_ms != -1)) {
     /* See whether the returned entry is stale. Done before we release lock */
     struct dnscache_prune_data user;
 
-    user.now = time(NULL);
-    user.max_age_sec = data->set.dns_cache_timeout;
-    user.oldest = 0;
+    user.now = curlx_now();
+    user.max_age_ms = data->set.dns_cache_timeout_ms;
+    user.oldest_ms = 0;
 
     if(dnscache_entry_is_stale(&user, dns)) {
       infof(data, "Hostname in DNS cache was stale, zapped");
@@ -520,12 +536,12 @@ Curl_dnscache_mk_entry(struct Curl_easy *data,
 
   dns->refcount = 1; /* the cache has the first reference */
   dns->addr = addr; /* this is the address(es) */
-  if(permanent)
-    dns->timestamp = 0; /* an entry that never goes stale */
+  if(permanent) {
+    dns->timestamp.tv_sec = 0; /* an entry that never goes stale */
+    dns->timestamp.tv_usec = 0; /* an entry that never goes stale */
+  }
   else {
-    dns->timestamp = time(NULL);
-    if(dns->timestamp == 0)
-      dns->timestamp = 1;
+    dns->timestamp = curlx_now();
   }
   dns->hostport = port;
   if(hostlen)
@@ -784,6 +800,28 @@ static bool can_resolve_ip_version(struct Curl_easy *data, int ip_version)
   return TRUE;
 }
 
+static CURLcode store_negative_resolve(struct Curl_easy *data,
+                                       const char *host,
+                                       int port)
+{
+  struct Curl_dnscache *dnscache = dnscache_get(data);
+  struct Curl_dns_entry *dns;
+  DEBUGASSERT(dnscache);
+  if(!dnscache)
+    return CURLE_FAILED_INIT;
+
+  /* put this new host in the cache */
+  dns = dnscache_add_addr(data, dnscache, NULL, host, 0, port, FALSE);
+  if(dns) {
+    /* release the returned reference; the cache itself will keep the
+     * entry alive: */
+    dns->refcount--;
+    infof(data, "Store negative name resolve for %s:%d", host, port);
+    return CURLE_OK;
+  }
+  return CURLE_OUT_OF_MEMORY;
+}
+
 /*
  * Curl_resolv() is the main name resolve function within libcurl. It resolves
  * a name and returns a pointer to the entry in the 'entry' argument (if one
@@ -903,6 +941,11 @@ CURLcode Curl_resolv(struct Curl_easy *data,
    * or `respwait` is set for an async operation.
    * Everything else is a failure to resolve. */
   if(dns) {
+    if(!dns->addr) {
+      infof(data, "Negative DNS entry");
+      dns->refcount--;
+      return CURLE_COULDNT_RESOLVE_HOST;
+    }
     *entry = dns;
     return CURLE_OK;
   }
@@ -928,6 +971,7 @@ CURLcode Curl_resolv(struct Curl_easy *data,
     Curl_resolv_unlink(data, &dns);
   *entry = NULL;
   Curl_async_shutdown(data);
+  store_negative_resolve(data, hostname, port);
   return CURLE_COULDNT_RESOLVE_HOST;
 }
 
@@ -1088,14 +1132,18 @@ CURLcode Curl_resolv_timeout(struct Curl_easy *data,
     prev_alarm = alarm(curlx_sltoui(timeout/1000L));
   }
 
-#else /* USE_ALARM_TIMEOUT */
+#ifdef DEBUGBUILD
+  Curl_resolve_test_delay();
+#endif
+
+#else /* !USE_ALARM_TIMEOUT */
 #ifndef CURLRES_ASYNCH
   if(timeoutms)
     infof(data, "timeout on name lookup is not supported");
 #else
-  (void)timeoutms; /* timeoutms not used with an async resolver */
+  (void)timeoutms;
 #endif
-#endif /* else USE_ALARM_TIMEOUT */
+#endif /* USE_ALARM_TIMEOUT */
 
   /* Perform the actual name resolution. This might be interrupted by an
    * alarm if it takes too long.
@@ -1258,7 +1306,7 @@ CURLcode Curl_loadhostpairs(struct Curl_easy *data)
       struct Curl_addrinfo *head = NULL, *tail = NULL;
       size_t entry_len;
       char address[64];
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
       const char *addresses = NULL;
 #endif
       curl_off_t port = 0;
@@ -1283,7 +1331,7 @@ CURLcode Curl_loadhostpairs(struct Curl_easy *data)
          curlx_str_single(&host, ':'))
         goto err;
 
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
       addresses = host;
 #endif
 
@@ -1503,31 +1551,36 @@ CURLcode Curl_resolv_check(struct Curl_easy *data,
 #ifndef CURL_DISABLE_DOH
   if(data->conn->bits.doh) {
     result = Curl_doh_is_resolved(data, dns);
+    if(result)
+      Curl_resolver_error(data, NULL);
   }
   else
 #endif
   result = Curl_async_is_resolved(data, dns);
   if(*dns)
     show_resolve_info(data, *dns);
+  if(result)
+    store_negative_resolve(data, data->state.async.hostname,
+                           data->state.async.port);
   return result;
 }
 #endif
 
-int Curl_resolv_getsock(struct Curl_easy *data,
-                        curl_socket_t *socks)
+CURLcode Curl_resolv_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
 {
 #ifdef CURLRES_ASYNCH
 #ifndef CURL_DISABLE_DOH
   if(data->conn->bits.doh)
     /* nothing to wait for during DoH resolve, those handles have their own
        sockets */
-    return GETSOCK_BLANK;
+    return CURLE_OK;
 #endif
-  return Curl_async_getsock(data, socks);
+  return Curl_async_pollset(data, ps);
 #else
   (void)data;
-  (void)socks;
-  return GETSOCK_BLANK;
+  (void)ps;
+  return CURLE_OK;
 #endif
 }
 
@@ -1565,7 +1618,7 @@ CURLcode Curl_once_resolved(struct Curl_easy *data,
  */
 
 #ifdef USE_CURL_ASYNC
-CURLcode Curl_resolver_error(struct Curl_easy *data)
+CURLcode Curl_resolver_error(struct Curl_easy *data, const char *detail)
 {
   struct connectdata *conn = data->conn;
   const char *host_or_proxy = "host";
@@ -1581,7 +1634,23 @@ CURLcode Curl_resolver_error(struct Curl_easy *data)
   }
 #endif
 
-  failf(data, "Could not resolve %s: %s", host_or_proxy, name);
+  failf(data, "Could not resolve %s: %s%s%s%s", host_or_proxy, name,
+        detail ? " (" : "", detail ? detail : "", detail ? ")" : "");
   return result;
 }
 #endif /* USE_CURL_ASYNC */
+
+#ifdef DEBUGBUILD
+#include "curlx/wait.h"
+
+void Curl_resolve_test_delay(void)
+{
+  const char *p = getenv("CURL_DNS_DELAY_MS");
+  if(p) {
+    curl_off_t l;
+    if(!curlx_str_number(&p, &l, TIME_T_MAX) && l) {
+      curlx_wait_ms((timediff_t)l);
+    }
+  }
+}
+#endif
diff --git a/deps/curl/lib/hostip.h b/deps/curl/lib/hostip.h
index cd3d957e1e7..2f78be82c2e 100644
--- a/deps/curl/lib/hostip.h
+++ b/deps/curl/lib/hostip.h
@@ -47,12 +47,11 @@
 #define CURL_TIMEOUT_RESOLVE 300 /* when using asynch methods, we allow this
                                     many seconds for a name resolve */
 
-#define CURL_ASYNC_SUCCESS CURLE_OK
-
 struct addrinfo;
 struct hostent;
 struct Curl_easy;
 struct connectdata;
+struct easy_pollset;
 
 enum alpnid {
   ALPN_none = 0,
@@ -67,7 +66,7 @@ struct Curl_dns_entry {
   struct Curl_https_rrinfo *hinfo;
 #endif
   /* timestamp == 0 -- permanent CURLOPT_RESOLVE entry (does not time out) */
-  time_t timestamp;
+  struct curltime timestamp;
   /* reference counter, entry is freed on reaching 0 */
   size_t refcount;
   /* hostname port number that resolved to addr. */
@@ -130,6 +129,9 @@ void Curl_dnscache_destroy(struct Curl_dnscache *dns);
 /* prune old entries from the DNS cache */
 void Curl_dnscache_prune(struct Curl_easy *data);
 
+/* clear the DNS cache */
+void Curl_dnscache_clear(struct Curl_easy *data);
+
 /* IPv4 threadsafe resolve function used for synch and asynch builds */
 struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname, int port);
 
@@ -196,10 +198,10 @@ CURLcode Curl_resolv_check(struct Curl_easy *data,
 #else
 #define Curl_resolv_check(x,y) CURLE_NOT_BUILT_IN
 #endif
-int Curl_resolv_getsock(struct Curl_easy *data,
-                        curl_socket_t *socks);
+CURLcode Curl_resolv_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps);
 
-CURLcode Curl_resolver_error(struct Curl_easy *data);
+CURLcode Curl_resolver_error(struct Curl_easy *data, const char *detail);
 
 #ifdef CURLRES_SYNCH
 /*
@@ -214,4 +216,8 @@ struct Curl_addrinfo *Curl_sync_getaddrinfo(struct Curl_easy *data,
 
 #endif
 
+#ifdef DEBUGBUILD
+void Curl_resolve_test_delay(void);
+#endif
+
 #endif /* HEADER_CURL_HOSTIP_H */
diff --git a/deps/curl/lib/hostip4.c b/deps/curl/lib/hostip4.c
index 14e4d98a866..2c356f3464e 100644
--- a/deps/curl/lib/hostip4.c
+++ b/deps/curl/lib/hostip4.c
@@ -94,8 +94,7 @@ struct Curl_addrinfo *Curl_sync_getaddrinfo(struct Curl_easy *data,
 #endif /* CURLRES_SYNCH */
 #endif /* CURLRES_IPV4 */
 
-#if defined(CURLRES_IPV4) && \
-   !defined(CURLRES_ARES) && !defined(CURLRES_AMIGA)
+#if defined(CURLRES_IPV4) && !defined(CURLRES_ARES) && !defined(CURLRES_AMIGA)
 
 /*
  * Curl_ipv4_resolve_r() - ipv4 threadsafe resolver function.
@@ -108,7 +107,7 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
                                           int port)
 {
 #if !(defined(HAVE_GETADDRINFO) && defined(HAVE_GETADDRINFO_THREADSAFE)) && \
-   defined(HAVE_GETHOSTBYNAME_R_3)
+  defined(HAVE_GETHOSTBYNAME_R_3)
   int res;
 #endif
   struct Curl_addrinfo *ai = NULL;
@@ -145,11 +144,11 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
     return NULL; /* major failure */
   /*
    * The clearing of the buffer is a workaround for a gethostbyname_r bug in
-   * qnx nto and it is also _required_ for some of these functions on some
+   * QNX Neutrino and it is also _required_ for some of these functions on some
    * platforms.
    */
 
-#if defined(HAVE_GETHOSTBYNAME_R_5)
+#ifdef HAVE_GETHOSTBYNAME_R_5
   /* Solaris, IRIX and more */
   h = gethostbyname_r(hostname,
                       (struct hostent *)buf,
@@ -287,5 +286,4 @@ struct Curl_addrinfo *Curl_ipv4_resolve_r(const char *hostname,
 
   return ai;
 }
-#endif /* defined(CURLRES_IPV4) && !defined(CURLRES_ARES) &&
-                                   !defined(CURLRES_AMIGA) */
+#endif /* CURLRES_IPV4 && !CURLRES_ARES && !CURLRES_AMIGA */
diff --git a/deps/curl/lib/hostip6.c b/deps/curl/lib/hostip6.c
index ce7f5050ea8..4c05f0247e1 100644
--- a/deps/curl/lib/hostip6.c
+++ b/deps/curl/lib/hostip6.c
@@ -57,7 +57,7 @@
 #include "curl_memory.h"
 #include "memdebug.h"
 
-#if defined(CURLRES_SYNCH)
+#ifdef CURLRES_SYNCH
 
 #ifdef DEBUG_ADDRINFO
 static void dump_addrinfo(const struct Curl_addrinfo *ai)
@@ -114,8 +114,8 @@ struct Curl_addrinfo *Curl_sync_getaddrinfo(struct Curl_easy *data,
    * The AI_NUMERICHOST must not be set to get synthesized IPv6 address from
    * an IPv4 address on iOS and macOS.
    */
-  if((1 == curlx_inet_pton(AF_INET, hostname, addrbuf)) ||
-     (1 == curlx_inet_pton(AF_INET6, hostname, addrbuf))) {
+  if((curlx_inet_pton(AF_INET, hostname, addrbuf) == 1) ||
+     (curlx_inet_pton(AF_INET6, hostname, addrbuf) == 1)) {
     /* the given address is numerical only, prevent a reverse lookup */
     hints.ai_flags = AI_NUMERICHOST;
   }
diff --git a/deps/curl/lib/hsts.c b/deps/curl/lib/hsts.c
index 91f32276f95..9525158bcc7 100644
--- a/deps/curl/lib/hsts.c
+++ b/deps/curl/lib/hsts.c
@@ -426,7 +426,7 @@ static CURLcode hsts_add(struct hsts *h, const char *line)
     bool subdomain = FALSE;
     struct stsentry *e;
     char dbuf[MAX_HSTS_DATELEN + 1];
-    time_t expires;
+    time_t expires = 0;
     const char *hp = curlx_str(&host);
 
     /* The date parser works on a null-terminated string. The maximum length
@@ -434,8 +434,10 @@ static CURLcode hsts_add(struct hsts *h, const char *line)
     memcpy(dbuf, curlx_str(&date), curlx_strlen(&date));
     dbuf[curlx_strlen(&date)] = 0;
 
-    expires = strcmp(dbuf, UNLIMITED) ? Curl_getdate_capped(dbuf) :
-      TIME_T_MAX;
+    if(!strcmp(dbuf, UNLIMITED))
+      expires = TIME_T_MAX;
+    else
+      Curl_getdate_capped(dbuf, &expires);
 
     if(hp[0] == '.') {
       curlx_str_nudge(&host, 1);
@@ -478,14 +480,14 @@ static CURLcode hsts_pull(struct Curl_easy *data, struct hsts *h)
       e.name[0] = 0; /* just to make it clean */
       sc = data->set.hsts_read(data, &e, data->set.hsts_read_userp);
       if(sc == CURLSTS_OK) {
-        time_t expires;
+        time_t expires = 0;
         CURLcode result;
         DEBUGASSERT(e.name[0]);
         if(!e.name[0])
           /* bail out if no name was stored */
           return CURLE_BAD_FUNCTION_ARGUMENT;
         if(e.expire[0])
-          expires = Curl_getdate_capped(e.expire);
+          Curl_getdate_capped(e.expire, &expires);
         else
           expires = TIME_T_MAX; /* the end of time */
         result = hsts_create(h, e.name, strlen(e.name),
diff --git a/deps/curl/lib/http.c b/deps/curl/lib/http.c
index e5a0696274f..e01de6f4772 100644
--- a/deps/curl/lib/http.c
+++ b/deps/curl/lib/http.c
@@ -105,24 +105,16 @@ static void http_exp100_got100(struct Curl_easy *data);
 static CURLcode http_firstwrite(struct Curl_easy *data);
 static CURLcode http_header(struct Curl_easy *data,
                             const char *hd, size_t hdlen);
-static CURLcode http_host(struct Curl_easy *data, struct connectdata *conn);
 static CURLcode http_range(struct Curl_easy *data,
                            Curl_HttpReq httpreq);
-static CURLcode http_req_complete(struct Curl_easy *data,
-                                  struct dynbuf *r, int httpversion,
-                                  Curl_HttpReq httpreq);
-static CURLcode http_req_set_reader(struct Curl_easy *data,
-                                    Curl_HttpReq httpreq, int httpversion,
-                                    const char **tep);
+static CURLcode http_req_set_TE(struct Curl_easy *data,
+                                struct dynbuf *req,
+                                int httpversion);
 static CURLcode http_size(struct Curl_easy *data);
 static CURLcode http_statusline(struct Curl_easy *data,
                                 struct connectdata *conn);
-static CURLcode http_target(struct Curl_easy *data, struct connectdata *conn,
-                            struct dynbuf *req);
+static CURLcode http_target(struct Curl_easy *data, struct dynbuf *req);
 static CURLcode http_useragent(struct Curl_easy *data);
-#ifdef HAVE_LIBZ
-static CURLcode http_transferencode(struct Curl_easy *data);
-#endif
 
 
 /*
@@ -137,10 +129,10 @@ const struct Curl_handler Curl_handler_http = {
   Curl_http_connect,                    /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  Curl_http_getsock_do,                 /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  Curl_http_do_pollset,                 /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   Curl_http_write_resp,                 /* write_resp */
   Curl_http_write_resp_hd,              /* write_resp_hd */
@@ -167,10 +159,10 @@ const struct Curl_handler Curl_handler_https = {
   Curl_http_connect,                    /* connect_it */
   NULL,                                 /* connecting */
   ZERO_NULL,                            /* doing */
-  NULL,                                 /* proto_getsock */
-  Curl_http_getsock_do,                 /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  NULL,                                 /* proto_pollset */
+  Curl_http_do_pollset,                 /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   Curl_http_write_resp,                 /* write_resp */
   Curl_http_write_resp_hd,              /* write_resp_hd */
@@ -474,7 +466,7 @@ static CURLcode http_perhapsrewind(struct Curl_easy *data,
 
   if(abort_upload) {
     /* We'd like to abort the upload - but should we? */
-#if defined(USE_NTLM)
+#ifdef USE_NTLM
     if((data->state.authproxy.picked == CURLAUTH_NTLM) ||
        (data->state.authhost.picked == CURLAUTH_NTLM)) {
       ongoing_auth = "NTLM";
@@ -486,7 +478,7 @@ static CURLcode http_perhapsrewind(struct Curl_easy *data,
       }
     }
 #endif
-#if defined(USE_SPNEGO)
+#ifdef USE_SPNEGO
     /* There is still data left to send */
     if((data->state.authproxy.picked == CURLAUTH_NEGOTIATE) ||
        (data->state.authhost.picked == CURLAUTH_NEGOTIATE)) {
@@ -1077,7 +1069,9 @@ CURLcode Curl_http_input_auth(struct Curl_easy *data, bool proxy,
   }
   return result;
 #else
-  (void) proxy;
+  (void)data;
+  (void)proxy;
+  (void)auth;
   /* nothing to do when disabled */
   return CURLE_OK;
 #endif
@@ -1321,7 +1315,7 @@ CURLcode Curl_http_follow(struct Curl_easy *data, const char *newurl,
     data->info.wouldredirect = follow_url;
 
     if(reachedmax) {
-      failf(data, "Maximum (%ld) redirects followed", data->set.maxredirs);
+      failf(data, "Maximum (%d) redirects followed", data->set.maxredirs);
       return CURLE_TOO_MANY_REDIRECTS;
     }
     return CURLE_OK;
@@ -1522,14 +1516,11 @@ CURLcode Curl_http_connect(struct Curl_easy *data, bool *done)
 /* this returns the socket to wait for in the DO and DOING state for the multi
    interface and then we are always _sending_ a request and thus we wait for
    the single socket to become writable only */
-int Curl_http_getsock_do(struct Curl_easy *data,
-                         struct connectdata *conn,
-                         curl_socket_t *socks)
+CURLcode Curl_http_do_pollset(struct Curl_easy *data,
+                              struct easy_pollset *ps)
 {
   /* write mode */
-  (void)conn;
-  socks[0] = Curl_conn_get_socket(data, FIRSTSOCKET);
-  return GETSOCK_WRITESOCK(0);
+  return Curl_pollset_add_out(data, ps, data->conn->sock[FIRSTSOCKET]);
 }
 
 /*
@@ -1710,10 +1701,8 @@ CURLcode Curl_add_custom_headers(struct Curl_easy *data,
                  we will force length zero then */
               curlx_str_casecompare(&name, "Content-Length"))
         ;
-      else if(data->state.aptr.te &&
-              /* when asking for Transfer-Encoding, do not pass on a custom
-                 Connection: */
-              curlx_str_casecompare(&name, "Connection"))
+      else if(curlx_str_casecompare(&name, "Connection"))
+        /* Normal Connection: header generation takes care of this */
         ;
       else if((httpversion >= 20) &&
               curlx_str_casecompare(&name, "Transfer-Encoding"))
@@ -1818,12 +1807,14 @@ CURLcode Curl_add_timecondition(struct Curl_easy *data,
 }
 #endif
 
-void Curl_http_method(struct Curl_easy *data, struct connectdata *conn,
+void Curl_http_method(struct Curl_easy *data,
                       const char **method, Curl_HttpReq *reqp)
 {
   Curl_HttpReq httpreq = (Curl_HttpReq)data->state.httpreq;
   const char *request;
-  if((conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) &&
+  if(data->conn->handler->protocol&(CURLPROTO_WS|CURLPROTO_WSS))
+    httpreq = HTTPREQ_GET;
+  else if((data->conn->handler->protocol&(PROTO_FAMILY_HTTP|CURLPROTO_FTP)) &&
      data->state.upload)
     httpreq = HTTPREQ_PUT;
 
@@ -1874,10 +1865,12 @@ static CURLcode http_useragent(struct Curl_easy *data)
 }
 
 
-static CURLcode http_host(struct Curl_easy *data, struct connectdata *conn)
+static CURLcode http_set_aptr_host(struct Curl_easy *data)
 {
-  const char *ptr;
+  struct connectdata *conn = data->conn;
   struct dynamically_allocated_data *aptr = &data->state.aptr;
+  const char *ptr;
+
   if(!data->state.this_is_a_follow) {
     /* Free to avoid leaking memory on multiple requests */
     free(data->state.first_host);
@@ -1894,7 +1887,7 @@ static CURLcode http_host(struct Curl_easy *data, struct connectdata *conn)
   ptr = Curl_checkheaders(data, STRCONST("Host"));
   if(ptr && (!data->state.this_is_a_follow ||
              curl_strequal(data->state.first_host, conn->host.name))) {
-#if !defined(CURL_DISABLE_COOKIES)
+#ifndef CURL_DISABLE_COOKIES
     /* If we have a given custom Host: header, we extract the hostname in
        order to possibly use it for cookie reasons later on. We only allow the
        custom Host: header if this is NOT a redirect, as setting Host: in the
@@ -1965,7 +1958,6 @@ static CURLcode http_host(struct Curl_easy *data, struct connectdata *conn)
  * Append the request-target to the HTTP request
  */
 static CURLcode http_target(struct Curl_easy *data,
-                            struct connectdata *conn,
                             struct dynbuf *r)
 {
   CURLcode result = CURLE_OK;
@@ -1978,7 +1970,7 @@ static CURLcode http_target(struct Curl_easy *data,
   }
 
 #ifndef CURL_DISABLE_PROXY
-  if(conn->bits.httpproxy && !conn->bits.tunnel_proxy) {
+  if(data->conn->bits.httpproxy && !data->conn->bits.tunnel_proxy) {
     /* Using a proxy but does not tunnel through it */
 
     /* The path sent to the proxy is in fact the entire URL. But if the remote
@@ -1992,8 +1984,8 @@ static CURLcode http_target(struct Curl_easy *data,
     if(!h)
       return CURLE_OUT_OF_MEMORY;
 
-    if(conn->host.dispname != conn->host.name) {
-      uc = curl_url_set(h, CURLUPART_HOST, conn->host.name, 0);
+    if(data->conn->host.dispname != data->conn->host.name) {
+      uc = curl_url_set(h, CURLUPART_HOST, data->conn->host.name, 0);
       if(uc) {
         curl_url_cleanup(h);
         return CURLE_OUT_OF_MEMORY;
@@ -2059,8 +2051,6 @@ static CURLcode http_target(struct Curl_easy *data,
   }
 
   else
-#else
-    (void)conn; /* not used in disabled-proxy builds */
 #endif
   {
     result = curlx_dyn_add(r, path);
@@ -2246,21 +2236,13 @@ static CURLcode http_resume(struct Curl_easy *data, Curl_HttpReq httpreq)
   return CURLE_OK;
 }
 
-static CURLcode http_req_set_reader(struct Curl_easy *data,
-                                    Curl_HttpReq httpreq, int httpversion,
-                                    const char **tep)
+static CURLcode http_req_set_TE(struct Curl_easy *data,
+                                struct dynbuf *req,
+                                int httpversion)
 {
   CURLcode result = CURLE_OK;
   const char *ptr;
 
-  result = set_reader(data, httpreq);
-  if(result)
-    return result;
-
-  result = http_resume(data, httpreq);
-  if(result)
-    return result;
-
   ptr = Curl_checkheaders(data, STRCONST("Transfer-Encoding"));
   if(ptr) {
     /* Some kind of TE is requested, check if 'chunked' is chosen */
@@ -2294,7 +2276,7 @@ static CURLcode http_req_set_reader(struct Curl_easy *data,
     }
 
     if(data->req.upload_chunky)
-      *tep = "Transfer-Encoding: chunked\r\n";
+      result = curlx_dyn_add(req, "Transfer-Encoding: chunked\r\n");
   }
   return result;
 }
@@ -2334,9 +2316,10 @@ static CURLcode addexpect(struct Curl_easy *data, struct dynbuf *r,
   return CURLE_OK;
 }
 
-static CURLcode http_req_complete(struct Curl_easy *data,
-                                  struct dynbuf *r, int httpversion,
-                                  Curl_HttpReq httpreq)
+static CURLcode http_add_content_hds(struct Curl_easy *data,
+                                     struct dynbuf *r,
+                                     int httpversion,
+                                     Curl_HttpReq httpreq)
 {
   CURLcode result = CURLE_OK;
   curl_off_t req_clen;
@@ -2404,26 +2387,17 @@ static CURLcode http_req_complete(struct Curl_easy *data,
     break;
   }
 
-  /* end of headers */
-  result = curlx_dyn_addn(r, STRCONST("\r\n"));
-  if(!result) {
-    Curl_pgrsSetUploadSize(data, req_clen);
-    if(announced_exp100)
-      result = http_exp100_add_reader(data);
-  }
+  Curl_pgrsSetUploadSize(data, req_clen);
+  if(announced_exp100)
+    result = http_exp100_add_reader(data);
 
 out:
-  if(!result) {
-    /* setup variables for the upcoming transfer */
-    Curl_xfer_setup1(data, CURL_XFER_SENDRECV, -1, TRUE);
-  }
   return result;
 }
 
-#if !defined(CURL_DISABLE_COOKIES)
+#ifndef CURL_DISABLE_COOKIES
 
 static CURLcode http_cookies(struct Curl_easy *data,
-                             struct connectdata *conn,
                              struct dynbuf *r)
 {
   CURLcode result = CURLE_OK;
@@ -2436,51 +2410,43 @@ static CURLcode http_cookies(struct Curl_easy *data,
   if(data->cookies || addcookies) {
     struct Curl_llist list;
     int count = 0;
-    int rc = 1;
 
     if(data->cookies && data->state.cookie_engine) {
       const char *host = data->state.aptr.cookiehost ?
-        data->state.aptr.cookiehost : conn->host.name;
-      const bool secure_context =
-        conn->handler->protocol&(CURLPROTO_HTTPS|CURLPROTO_WSS) ||
-        curl_strequal("localhost", host) ||
-        !strcmp(host, "127.0.0.1") ||
-        !strcmp(host, "::1");
+        data->state.aptr.cookiehost : data->conn->host.name;
       Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
-      rc = Curl_cookie_getlist(data, data->cookies, host, data->state.up.path,
-                               secure_context, &list);
-      Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
-    }
-    if(!rc) {
-      struct Curl_llist_node *n;
-      size_t clen = 8; /* hold the size of the generated Cookie: header */
-
-      /* loop through all cookies that matched */
-      for(n = Curl_llist_head(&list); n; n = Curl_node_next(n)) {
-        struct Cookie *co = Curl_node_elem(n);
-        if(co->value) {
-          size_t add;
-          if(!count) {
-            result = curlx_dyn_addn(r, STRCONST("Cookie: "));
+      if(!Curl_cookie_getlist(data, data->conn, host, &list)) {
+        struct Curl_llist_node *n;
+        size_t clen = 8; /* hold the size of the generated Cookie: header */
+
+        /* loop through all cookies that matched */
+        for(n = Curl_llist_head(&list); n; n = Curl_node_next(n)) {
+          struct Cookie *co = Curl_node_elem(n);
+          if(co->value) {
+            size_t add;
+            if(!count) {
+              result = curlx_dyn_addn(r, STRCONST("Cookie: "));
+              if(result)
+                break;
+            }
+            add = strlen(co->name) + strlen(co->value) + 1;
+            if(clen + add >= MAX_COOKIE_HEADER_LEN) {
+              infof(data, "Restricted outgoing cookies due to header size, "
+                    "'%s' not sent", co->name);
+              linecap = TRUE;
+              break;
+            }
+            result = curlx_dyn_addf(r, "%s%s=%s", count ? "; " : "",
+                                    co->name, co->value);
             if(result)
               break;
+            clen += add + (count ? 2 : 0);
+            count++;
           }
-          add = strlen(co->name) + strlen(co->value) + 1;
-          if(clen + add >= MAX_COOKIE_HEADER_LEN) {
-            infof(data, "Restricted outgoing cookies due to header size, "
-                  "'%s' not sent", co->name);
-            linecap = TRUE;
-            break;
-          }
-          result = curlx_dyn_addf(r, "%s%s=%s", count ? "; " : "",
-                                  co->name, co->value);
-          if(result)
-            break;
-          clen += add + (count ? 2 : 0);
-          count++;
         }
+        Curl_llist_destroy(&list, NULL);
       }
-      Curl_llist_destroy(&list, NULL);
+      Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
     }
     if(addcookies && !result && !linecap) {
       if(!count)
@@ -2499,7 +2465,7 @@ static CURLcode http_cookies(struct Curl_easy *data,
   return result;
 }
 #else
-#define http_cookies(a,b,c) CURLE_OK
+#define http_cookies(a,b) CURLE_OK
 #endif
 
 static CURLcode http_range(struct Curl_easy *data,
@@ -2621,39 +2587,257 @@ static CURLcode http_firstwrite(struct Curl_easy *data)
   return CURLE_OK;
 }
 
-#ifdef HAVE_LIBZ
-static CURLcode http_transferencode(struct Curl_easy *data)
+static CURLcode http_check_new_conn(struct Curl_easy *data)
 {
-  if(!Curl_checkheaders(data, STRCONST("TE")) &&
-     data->set.http_transfer_encoding) {
-    /* When we are to insert a TE: header in the request, we must also insert
-       TE in a Connection: header, so we need to merge the custom provided
-       Connection: header and prevent the original to get sent. Note that if
-       the user has inserted his/her own TE: header we do not do this magic
-       but then assume that the user will handle it all! */
-    char *cptr = Curl_checkheaders(data, STRCONST("Connection"));
-#define TE_HEADER "TE: gzip\r\n"
-
-    Curl_safefree(data->state.aptr.te);
-
-    if(cptr) {
-      cptr = Curl_copy_header_value(cptr);
-      if(!cptr)
-        return CURLE_OUT_OF_MEMORY;
+  struct connectdata *conn = data->conn;
+  const char *info_version = NULL;
+  const char *alpn;
+  CURLcode result;
+
+  alpn = Curl_conn_get_alpn_negotiated(data, conn);
+  if(alpn && !strcmp("h3", alpn)) {
+    DEBUGASSERT(Curl_conn_http_version(data, conn) == 30);
+    info_version = "HTTP/3";
+  }
+  else if(alpn && !strcmp("h2", alpn)) {
+#ifndef CURL_DISABLE_PROXY
+    if((Curl_conn_http_version(data, conn) != 20) &&
+       conn->bits.proxy && !conn->bits.tunnel_proxy) {
+      result = Curl_http2_switch(data);
+      if(result)
+        return result;
+    }
+    else
+#endif
+    DEBUGASSERT(Curl_conn_http_version(data, conn) == 20);
+    info_version = "HTTP/2";
+  }
+  else {
+    /* Check if user wants to use HTTP/2 with clear TCP */
+    if(Curl_http2_may_switch(data)) {
+      DEBUGF(infof(data, "HTTP/2 over clean TCP"));
+      result = Curl_http2_switch(data);
+      if(result)
+        return result;
+      info_version = "HTTP/2";
+      /* There is no ALPN here, but the connection is now definitely h2 */
+      conn->httpversion_seen = 20;
     }
+    else
+      info_version = "HTTP/1.x";
+  }
 
-    /* Create the (updated) Connection: header */
-    data->state.aptr.te = aprintf("Connection: %s%sTE\r\n" TE_HEADER,
-                                cptr ? cptr : "", (cptr && *cptr) ? ", ":"");
+  if(info_version)
+    infof(data, "using %s", info_version);
+  return CURLE_OK;
+}
 
-    free(cptr);
-    if(!data->state.aptr.te)
-      return CURLE_OUT_OF_MEMORY;
+static CURLcode http_add_connection_hd(struct Curl_easy *data,
+                                       struct dynbuf *req)
+{
+  char *custom = Curl_checkheaders(data, STRCONST("Connection"));
+  char *custom_val = custom ? Curl_copy_header_value(custom) : NULL;
+  const char *sep = (custom_val && *custom_val) ? ", " : "Connection: ";
+  CURLcode result = CURLE_OK;
+  size_t rlen = curlx_dyn_len(req);
+
+  if(custom && !custom_val)
+    return CURLE_OUT_OF_MEMORY;
+
+  if(custom_val && *custom_val)
+    result = curlx_dyn_addf(req, "Connection: %s", custom_val);
+  if(!result && data->state.http_hd_te) {
+    result = curlx_dyn_addf(req, "%s%s", sep, "TE");
+    sep = ", ";
   }
-  return CURLE_OK;
+  if(!result && data->state.http_hd_upgrade) {
+    result = curlx_dyn_addf(req, "%s%s", sep, "Upgrade");
+    sep = ", ";
+  }
+  if(!result && data->state.http_hd_h2_settings) {
+    result = curlx_dyn_addf(req, "%s%s", sep, "HTTP2-Settings");
+  }
+  if(!result && (rlen < curlx_dyn_len(req)))
+    result = curlx_dyn_addn(req, STRCONST("\r\n"));
+
+  free(custom_val);
+  return result;
 }
+
+/* Header identifier in order we send them by default */
+typedef enum {
+  H1_HD_REQUEST,
+  H1_HD_HOST,
+#ifndef CURL_DISABLE_PROXY
+  H1_HD_PROXY_AUTH,
+#endif
+  H1_HD_USER_AUTH,
+  H1_HD_RANGE,
+  H1_HD_USER_AGENT,
+  H1_HD_ACCEPT,
+  H1_HD_TE,
+  H1_HD_ACCEPT_ENCODING,
+  H1_HD_REFERER,
+#ifndef CURL_DISABLE_PROXY
+  H1_HD_PROXY_CONNECTION,
+#endif
+  H1_HD_TRANSFER_ENCODING,
+#ifndef CURL_DISABLE_ALTSVC
+  H1_HD_ALT_USED,
+#endif
+  H1_HD_UPGRADE,
+  H1_HD_COOKIES,
+  H1_HD_CONDITIONALS,
+  H1_HD_CUSTOM,
+  H1_HD_CONTENT,
+  H1_HD_CONNECTION,
+  H1_HD_LAST  /* the last, empty header line */
+} http_hd_t;
+
+static CURLcode http_add_hd(struct Curl_easy *data,
+                            struct dynbuf *req,
+                            http_hd_t id,
+                            unsigned char httpversion,
+                            const char *method,
+                            Curl_HttpReq httpreq)
+{
+  CURLcode result = CURLE_OK;
+  switch(id) {
+  case H1_HD_REQUEST:
+    /* add the main request stuff */
+    /* GET/HEAD/POST/PUT */
+    result = curlx_dyn_addf(req, "%s ", method);
+    if(!result)
+      result = http_target(data, req);
+    if(!result)
+      result = curlx_dyn_addf(req, " HTTP/%s\r\n",
+                              get_http_string(httpversion));
+    break;
+
+  case H1_HD_HOST:
+    if(data->state.aptr.host)
+      result = curlx_dyn_add(req, data->state.aptr.host);
+    break;
+
+#ifndef CURL_DISABLE_PROXY
+  case H1_HD_PROXY_AUTH:
+    if(data->state.aptr.proxyuserpwd)
+      result = curlx_dyn_add(req, data->state.aptr.proxyuserpwd);
+    break;
 #endif
 
+  case H1_HD_USER_AUTH:
+    if(data->state.aptr.userpwd)
+      result = curlx_dyn_add(req, data->state.aptr.userpwd);
+    break;
+
+  case H1_HD_RANGE:
+    if(data->state.use_range && data->state.aptr.rangeline)
+      result = curlx_dyn_add(req, data->state.aptr.rangeline);
+    break;
+
+  case H1_HD_USER_AGENT:
+    if(data->set.str[STRING_USERAGENT] && /* User-Agent: */
+       *data->set.str[STRING_USERAGENT] &&
+       data->state.aptr.uagent)
+      result = curlx_dyn_add(req, data->state.aptr.uagent);
+    break;
+
+  case H1_HD_ACCEPT:
+    if(!Curl_checkheaders(data, STRCONST("Accept")))
+      result = curlx_dyn_add(req, "Accept: */*\r\n");
+    break;
+
+  case H1_HD_TE:
+#ifdef HAVE_LIBZ
+    if(!Curl_checkheaders(data, STRCONST("TE")) &&
+       data->set.http_transfer_encoding) {
+      data->state.http_hd_te = TRUE;
+      result = curlx_dyn_add(req, "TE: gzip\r\n");
+    }
+#endif
+    break;
+
+  case H1_HD_ACCEPT_ENCODING:
+    Curl_safefree(data->state.aptr.accept_encoding);
+    if(!Curl_checkheaders(data, STRCONST("Accept-Encoding")) &&
+       data->set.str[STRING_ENCODING])
+      result = curlx_dyn_addf(req, "Accept-Encoding: %s\r\n",
+                              data->set.str[STRING_ENCODING]);
+    break;
+
+  case H1_HD_REFERER:
+    Curl_safefree(data->state.aptr.ref);
+    if(data->state.referer && !Curl_checkheaders(data, STRCONST("Referer")))
+      result = curlx_dyn_addf(req, "Referer: %s\r\n", data->state.referer);
+    break;
+
+#ifndef CURL_DISABLE_PROXY
+  case H1_HD_PROXY_CONNECTION:
+    if(data->conn->bits.httpproxy &&
+       !data->conn->bits.tunnel_proxy &&
+       !Curl_checkheaders(data, STRCONST("Proxy-Connection")) &&
+       !Curl_checkProxyheaders(data, data->conn, STRCONST("Proxy-Connection")))
+      result = curlx_dyn_add(req, "Proxy-Connection: Keep-Alive\r\n");
+    break;
+#endif
+
+  case H1_HD_TRANSFER_ENCODING:
+    result = http_req_set_TE(data, req, httpversion);
+    break;
+
+#ifndef CURL_DISABLE_ALTSVC
+  case H1_HD_ALT_USED:
+    if(data->conn->bits.altused &&
+       !Curl_checkheaders(data, STRCONST("Alt-Used")))
+      result = curlx_dyn_addf(req, "Alt-Used: %s:%d\r\n",
+                              data->conn->conn_to_host.name,
+                              data->conn->conn_to_port);
+    break;
+#endif
+
+  case H1_HD_UPGRADE:
+    if(!Curl_conn_is_ssl(data->conn, FIRSTSOCKET) && (httpversion < 20) &&
+       (data->state.http_neg.wanted & CURL_HTTP_V2x) &&
+       data->state.http_neg.h2_upgrade) {
+      /* append HTTP2 upgrade magic stuff to the HTTP request if it is not done
+         over SSL */
+      result = Curl_http2_request_upgrade(req, data);
+    }
+#ifndef CURL_DISABLE_WEBSOCKETS
+    if(!result && data->conn->handler->protocol&(CURLPROTO_WS|CURLPROTO_WSS))
+      result = Curl_ws_request(data, req);
+#endif
+    break;
+
+  case H1_HD_COOKIES:
+    result = http_cookies(data, req);
+    break;
+
+  case H1_HD_CONDITIONALS:
+    result = Curl_add_timecondition(data, req);
+    break;
+
+  case H1_HD_CUSTOM:
+    result = Curl_add_custom_headers(data, FALSE, httpversion, req);
+    break;
+
+  case H1_HD_CONTENT:
+    result = http_add_content_hds(data, req, httpversion, httpreq);
+    break;
+
+  case H1_HD_CONNECTION: {
+    result = http_add_connection_hd(data, req);
+    break;
+  }
+
+  case H1_HD_LAST:
+    result = curlx_dyn_addn(req, STRCONST("\r\n"));
+    break;
+  }
+  return result;
+}
+
 /*
  * Curl_http() gets called from the generic multi_do() function when an HTTP
  * request is to be performed. This creates and sends a properly constructed
@@ -2661,51 +2845,27 @@ static CURLcode http_transferencode(struct Curl_easy *data)
  */
 CURLcode Curl_http(struct Curl_easy *data, bool *done)
 {
-  struct connectdata *conn = data->conn;
   CURLcode result = CURLE_OK;
   Curl_HttpReq httpreq;
-  const char *te = ""; /* transfer-encoding */
-  const char *request;
-  const char *httpstring;
+  const char *method;
   struct dynbuf req;
-  char *altused = NULL;
-  const char *p_accept;      /* Accept: string */
   unsigned char httpversion;
+  size_t hd_id;
 
   /* Always consider the DO phase done after this function call, even if there
      may be parts of the request that are not yet sent, since we can deal with
      the rest of the request in the PERFORM phase. */
   *done = TRUE;
+  /* initialize a dynamic send-buffer */
+  curlx_dyn_init(&req, DYN_HTTP_REQUEST);
+  /* make sure the header buffer is reset - if there are leftovers from a
+     previous transfer */
+  curlx_dyn_reset(&data->state.headerb);
 
-  switch(conn->alpn) {
-  case CURL_HTTP_VERSION_3:
-    DEBUGASSERT(Curl_conn_http_version(data, conn) == 30);
-    break;
-  case CURL_HTTP_VERSION_2:
-#ifndef CURL_DISABLE_PROXY
-    if((Curl_conn_http_version(data, conn) != 20) &&
-       conn->bits.proxy && !conn->bits.tunnel_proxy
-      ) {
-      result = Curl_http2_switch(data);
-      if(result)
-        goto fail;
-    }
-    else
-#endif
-      DEBUGASSERT(Curl_conn_http_version(data, conn) == 20);
-    break;
-  case CURL_HTTP_VERSION_1_1:
-    /* continue with HTTP/1.x when explicitly requested */
-    break;
-  default:
-    /* Check if user wants to use HTTP/2 with clear TCP */
-    if(Curl_http2_may_switch(data)) {
-      DEBUGF(infof(data, "HTTP/2 over clean TCP"));
-      result = Curl_http2_switch(data);
-      if(result)
-        goto fail;
-    }
-    break;
+  if(!data->conn->bits.reuse) {
+    result = http_check_new_conn(data);
+    if(result)
+      goto out;
   }
 
   /* Add collecting of headers written to client. For a new connection,
@@ -2713,151 +2873,67 @@ CURLcode Curl_http(struct Curl_easy *data, bool *done)
    * or multiplex needs it here as well. */
   result = Curl_headers_init(data);
   if(result)
-    goto fail;
-
-  result = http_host(data, conn);
-  if(result)
-    goto fail;
+    goto out;
 
-  result = http_useragent(data);
-  if(result)
-    goto fail;
+  data->state.http_hd_te = FALSE;
+  data->state.http_hd_upgrade = FALSE;
+  data->state.http_hd_h2_settings = FALSE;
 
-  Curl_http_method(data, conn, &request, &httpreq);
+  /* what kind of request do we need to send? */
+  Curl_http_method(data, &method, &httpreq);
 
-  /* setup the authentication headers */
-  {
+  /* select host to send */
+  result = http_set_aptr_host(data);
+  if(!result) {
+    /* setup the authentication headers, how that method and host are known */
     char *pq = NULL;
     if(data->state.up.query) {
       pq = aprintf("%s?%s", data->state.up.path, data->state.up.query);
       if(!pq)
         return CURLE_OUT_OF_MEMORY;
     }
-    result = Curl_http_output_auth(data, conn, request, httpreq,
+    result = Curl_http_output_auth(data, data->conn, method, httpreq,
                                    (pq ? pq : data->state.up.path), FALSE);
     free(pq);
-    if(result)
-      goto fail;
-  }
-
-  Curl_safefree(data->state.aptr.ref);
-  if(data->state.referer && !Curl_checkheaders(data, STRCONST("Referer"))) {
-    data->state.aptr.ref = aprintf("Referer: %s\r\n", data->state.referer);
-    if(!data->state.aptr.ref)
-      return CURLE_OUT_OF_MEMORY;
   }
-
-  if(!Curl_checkheaders(data, STRCONST("Accept-Encoding")) &&
-     data->set.str[STRING_ENCODING]) {
-    free(data->state.aptr.accept_encoding);
-    data->state.aptr.accept_encoding =
-      aprintf("Accept-Encoding: %s\r\n", data->set.str[STRING_ENCODING]);
-    if(!data->state.aptr.accept_encoding)
-      return CURLE_OUT_OF_MEMORY;
-  }
-  else
-    Curl_safefree(data->state.aptr.accept_encoding);
-
-#ifdef HAVE_LIBZ
-  /* we only consider transfer-encoding magic if libz support is built-in */
-  result = http_transferencode(data);
   if(result)
-    goto fail;
-#endif
-
-  httpversion = http_request_version(data);
-  httpstring = get_http_string(httpversion);
+    goto out;
 
-  result = http_req_set_reader(data, httpreq, httpversion, &te);
+  result = http_useragent(data);
   if(result)
-    goto fail;
-
-  p_accept = Curl_checkheaders(data,
-                               STRCONST("Accept")) ? NULL : "Accept: */*\r\n";
+    goto out;
 
-  result = http_range(data, httpreq);
+  /* Setup input reader, resume information and ranges */
+  result = set_reader(data, httpreq);
+  if(!result)
+    result = http_resume(data, httpreq);
+  if(!result)
+    result = http_range(data, httpreq);
   if(result)
-    goto fail;
+    goto out;
 
-  /* initialize a dynamic send-buffer */
-  curlx_dyn_init(&req, DYN_HTTP_REQUEST);
+  httpversion = http_request_version(data);
+  /* Add request line and all headers to `req` */
+  for(hd_id = 0; hd_id <= H1_HD_LAST; ++hd_id) {
+    result = http_add_hd(data, &req, (http_hd_t)hd_id,
+                         httpversion, method, httpreq);
+    if(result)
+      goto out;
+  }
 
-  /* make sure the header buffer is reset - if there are leftovers from a
-     previous transfer */
-  curlx_dyn_reset(&data->state.headerb);
+  /* setup variables for the upcoming transfer and send */
+  Curl_xfer_setup_sendrecv(data, FIRSTSOCKET, -1);
+  result = Curl_req_send(data, &req, httpversion);
 
-  /* add the main request stuff */
-  /* GET/HEAD/POST/PUT */
-  result = curlx_dyn_addf(&req, "%s ", request);
-  if(!result)
-    result = http_target(data, conn, &req);
-  if(result) {
-    curlx_dyn_free(&req);
-    goto fail;
-  }
+  if((httpversion >= 20) && data->req.upload_chunky)
+    /* upload_chunky was set above to set up the request in a chunky fashion,
+       but is disabled here again to avoid that the chunked encoded version is
+       actually used when sending the request body over h2 */
+    data->req.upload_chunky = FALSE;
 
-#ifndef CURL_DISABLE_ALTSVC
-  if(conn->bits.altused && !Curl_checkheaders(data, STRCONST("Alt-Used"))) {
-    altused = aprintf("Alt-Used: %s:%d\r\n",
-                      conn->conn_to_host.name, conn->conn_to_port);
-    if(!altused) {
-      curlx_dyn_free(&req);
-      return CURLE_OUT_OF_MEMORY;
-    }
-  }
-#endif
-  result =
-    curlx_dyn_addf(&req,
-                   " HTTP/%s\r\n" /* HTTP version */
-                   "%s" /* host */
-                   "%s" /* proxyuserpwd */
-                   "%s" /* userpwd */
-                   "%s" /* range */
-                   "%s" /* user agent */
-                   "%s" /* accept */
-                   "%s" /* TE: */
-                   "%s" /* accept-encoding */
-                   "%s" /* referer */
-                   "%s" /* Proxy-Connection */
-                   "%s" /* transfer-encoding */
-                   "%s",/* Alt-Used */
-
-                   httpstring,
-                   (data->state.aptr.host ? data->state.aptr.host : ""),
-#ifndef CURL_DISABLE_PROXY
-                   data->state.aptr.proxyuserpwd ?
-                   data->state.aptr.proxyuserpwd : "",
-#else
-                   "",
-#endif
-                   data->state.aptr.userpwd ? data->state.aptr.userpwd : "",
-                   (data->state.use_range && data->state.aptr.rangeline) ?
-                   data->state.aptr.rangeline : "",
-                   (data->set.str[STRING_USERAGENT] &&
-                    *data->set.str[STRING_USERAGENT] &&
-                    data->state.aptr.uagent) ?
-                   data->state.aptr.uagent : "",
-                   p_accept ? p_accept : "",
-                   data->state.aptr.te ? data->state.aptr.te : "",
-                   (data->set.str[STRING_ENCODING] &&
-                    *data->set.str[STRING_ENCODING] &&
-                    data->state.aptr.accept_encoding) ?
-                   data->state.aptr.accept_encoding : "",
-                   (data->state.referer && data->state.aptr.ref) ?
-                   data->state.aptr.ref : "" /* Referer: <data> */,
-#ifndef CURL_DISABLE_PROXY
-                   (conn->bits.httpproxy &&
-                    !conn->bits.tunnel_proxy &&
-                    !Curl_checkheaders(data, STRCONST("Proxy-Connection")) &&
-                    !Curl_checkProxyheaders(data, conn,
-                                            STRCONST("Proxy-Connection"))) ?
-                   "Proxy-Connection: Keep-Alive\r\n":"",
-#else
-                   "",
-#endif
-                   te,
-                   altused ? altused : ""
-      );
+out:
+  if(CURLE_TOO_LARGE == result)
+    failf(data, "HTTP request too large");
 
   /* clear userpwd and proxyuserpwd to avoid reusing old credentials
    * from reused connections */
@@ -2865,53 +2941,7 @@ CURLcode Curl_http(struct Curl_easy *data, bool *done)
 #ifndef CURL_DISABLE_PROXY
   Curl_safefree(data->state.aptr.proxyuserpwd);
 #endif
-  free(altused);
-
-  if(result) {
-    curlx_dyn_free(&req);
-    goto fail;
-  }
-
-  if(!Curl_conn_is_ssl(conn, FIRSTSOCKET) && (httpversion < 20) &&
-     (data->state.http_neg.wanted & CURL_HTTP_V2x) &&
-     data->state.http_neg.h2_upgrade) {
-    /* append HTTP2 upgrade magic stuff to the HTTP request if it is not done
-       over SSL */
-    result = Curl_http2_request_upgrade(&req, data);
-    if(result) {
-      curlx_dyn_free(&req);
-      return result;
-    }
-  }
-
-  result = http_cookies(data, conn, &req);
-#ifndef CURL_DISABLE_WEBSOCKETS
-  if(!result && conn->handler->protocol&(CURLPROTO_WS|CURLPROTO_WSS))
-    result = Curl_ws_request(data, &req);
-#endif
-  if(!result)
-    result = Curl_add_timecondition(data, &req);
-  if(!result)
-    result = Curl_add_custom_headers(data, FALSE, httpversion, &req);
-
-  if(!result) {
-    /* req_send takes ownership of the 'req' memory on success */
-    result = http_req_complete(data, &req, httpversion, httpreq);
-    if(!result)
-      result = Curl_req_send(data, &req, httpversion);
-  }
   curlx_dyn_free(&req);
-  if(result)
-    goto fail;
-
-  if((httpversion >= 20) && data->req.upload_chunky)
-    /* upload_chunky was set above to set up the request in a chunky fashion,
-       but is disabled here again to avoid that the chunked encoded version is
-       actually used when sending the request body over h2 */
-    data->req.upload_chunky = FALSE;
-fail:
-  if(CURLE_TOO_LARGE == result)
-    failf(data, "HTTP request too large");
   return result;
 }
 
@@ -2963,7 +2993,7 @@ checkrtspprefix(struct Curl_easy *data,
 {
   statusline result = STATUS_BAD;
   statusline onmatch = len >= 5 ? STATUS_DONE : STATUS_UNKNOWN;
-  (void)data; /* unused */
+  (void)data;
   if(checkprefixmax("RTSP/", s, len))
     result = onmatch;
 
@@ -3164,7 +3194,8 @@ static CURLcode http_header_l(struct Curl_easy *data,
                    (data->set.timecondition || data->set.get_filetime)) ?
     HD_VAL(hd, hdlen, "Last-Modified:") : NULL;
   if(v) {
-    k->timeofdoc = Curl_getdate_capped(v);
+    if(Curl_getdate_capped(v, &k->timeofdoc))
+      k->timeofdoc = 0;
     if(data->set.get_filetime)
       data->info.filetime = k->timeofdoc;
     return CURLE_OK;
@@ -3279,14 +3310,12 @@ static CURLcode http_header_r(struct Curl_easy *data,
   if(v) {
     /* Retry-After = HTTP-date / delay-seconds */
     curl_off_t retry_after = 0; /* zero for unknown or "now" */
-    time_t date;
+    time_t date = 0;
     curlx_str_passblanks(&v);
 
     /* try it as a date first, because a date can otherwise start with and
        get treated as a number */
-    date = Curl_getdate_capped(v);
-
-    if((time_t)-1 != date) {
+    if(!Curl_getdate_capped(v, &date)) {
       time_t current = time(NULL);
       if(date >= current)
         /* convert date to number of seconds into the future */
@@ -3319,7 +3348,7 @@ static CURLcode http_header_s(struct Curl_easy *data,
   (void)hdlen;
 #endif
 
-#if !defined(CURL_DISABLE_COOKIES)
+#ifndef CURL_DISABLE_COOKIES
   v = (data->cookies && data->state.cookie_engine) ?
     HD_VAL(hd, hdlen, "Set-Cookie:") : NULL;
   if(v) {
@@ -3327,14 +3356,8 @@ static CURLcode http_header_s(struct Curl_easy *data,
      * real peer hostname. */
     const char *host = data->state.aptr.cookiehost ?
       data->state.aptr.cookiehost : conn->host.name;
-    const bool secure_context =
-      conn->handler->protocol&(CURLPROTO_HTTPS|CURLPROTO_WSS) ||
-      curl_strequal("localhost", host) ||
-      !strcmp(host, "127.0.0.1") ||
-      !strcmp(host, "::1");
-
-    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE,
-                    CURL_LOCK_ACCESS_SINGLE);
+    const bool secure_context = Curl_secure_context(conn, host);
+    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
     Curl_cookie_add(data, data->cookies, TRUE, FALSE, v, host,
                     data->state.up.path, secure_context);
     Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
@@ -3766,9 +3789,6 @@ static CURLcode http_on_response(struct Curl_easy *data,
         if(result)
           goto out;
         *pconsumed += blen; /* ws accept handled the data */
-        k->header = FALSE; /* we will not get more responses */
-        if(data->set.connect_only)
-          k->keepon &= ~KEEP_RECV; /* read no more content */
       }
 #endif
       else {
@@ -3813,7 +3833,7 @@ static CURLcode http_on_response(struct Curl_easy *data,
 
   /* At this point we have some idea about the fate of the connection.
      If we are closing the connection it may result auth failure. */
-#if defined(USE_NTLM)
+#ifdef USE_NTLM
   if(conn->bits.close &&
      (((data->req.httpcode == 401) &&
        (conn->http_ntlm_state == NTLMSTATE_TYPE2)) ||
@@ -3823,7 +3843,7 @@ static CURLcode http_on_response(struct Curl_easy *data,
     data->state.authproblem = TRUE;
   }
 #endif
-#if defined(USE_SPNEGO)
+#ifdef USE_SPNEGO
   if(conn->bits.close &&
     (((data->req.httpcode == 401) &&
       (conn->http_negotiate_state == GSS_AUTHRECV)) ||
@@ -3947,7 +3967,7 @@ static CURLcode http_on_response(struct Curl_easy *data,
      like to call http2_handle_stream_close to properly close a
      stream. In order to do this, we keep reading until we
      close the stream. */
-  if((0 == k->maxdownload) && (k->httpversion_sent < 20))
+  if((k->maxdownload == 0) && (k->httpversion_sent < 20))
     k->download_done = TRUE;
 
   /* final response without error, prepare to receive the body */
@@ -4368,7 +4388,17 @@ CURLcode Curl_http_req_make(struct httpreq **preq,
   req = calloc(1, sizeof(*req) + m_len);
   if(!req)
     goto out;
+#if defined(__GNUC__) && __GNUC__ >= 13
+#pragma GCC diagnostic push
+/* error: 'memcpy' offset [137, 142] from the object at 'req' is out of
+   the bounds of referenced subobject 'method' with type 'char[1]' at
+   offset 136 */
+#pragma GCC diagnostic ignored "-Warray-bounds"
+#endif
   memcpy(req->method, method, m_len);
+#if defined(__GNUC__) && __GNUC__ >= 13
+#pragma GCC diagnostic pop
+#endif
   if(scheme) {
     req->scheme = Curl_memdup0(scheme, s_len);
     if(!req->scheme)
@@ -4569,7 +4599,7 @@ struct name_const {
 };
 
 /* keep them sorted by length! */
-static struct name_const H2_NON_FIELD[] = {
+static const struct name_const H2_NON_FIELD[] = {
   { STRCONST("Host") },
   { STRCONST("Upgrade") },
   { STRCONST("Connection") },
@@ -4771,7 +4801,7 @@ static CURLcode cr_exp100_read(struct Curl_easy *data,
     /* We are now waiting for a reply from the server or
      * a timeout on our side IFF the request has been fully sent. */
     DEBUGF(infof(data, "cr_exp100_read, start AWAITING_CONTINUE, "
-           "timeout %ldms", data->set.expect_100_timeout));
+           "timeout %dms", data->set.expect_100_timeout));
     ctx->state = EXP100_AWAITING_CONTINUE;
     ctx->start = curlx_now();
     Curl_expire(data, data->set.expect_100_timeout, EXPIRE_100_TIMEOUT);
@@ -4822,8 +4852,7 @@ static const struct Curl_crtype cr_exp100 = {
   Curl_creader_def_needs_rewind,
   Curl_creader_def_total_length,
   Curl_creader_def_resume_from,
-  Curl_creader_def_rewind,
-  Curl_creader_def_unpause,
+  Curl_creader_def_cntrl,
   Curl_creader_def_is_paused,
   cr_exp100_done,
   sizeof(struct cr_exp100_ctx)
diff --git a/deps/curl/lib/http.h b/deps/curl/lib/http.h
index 8876f380447..67ef17f5b95 100644
--- a/deps/curl/lib/http.h
+++ b/deps/curl/lib/http.h
@@ -25,10 +25,6 @@
  ***************************************************************************/
 #include "curl_setup.h"
 
-#if defined(USE_MSH3) && !defined(_WIN32)
-#include <pthread.h>
-#endif
-
 #include "bufq.h"
 #include "dynhds.h"
 #include "ws.h"
@@ -62,7 +58,7 @@ typedef unsigned char http_majors;
 
 #ifndef CURL_DISABLE_HTTP
 
-#if defined(USE_HTTP3)
+#ifdef USE_HTTP3
 #include <stdint.h>
 #endif
 
@@ -110,7 +106,7 @@ CURLcode Curl_add_custom_headers(struct Curl_easy *data, bool is_connect,
 CURLcode Curl_dynhds_add_custom(struct Curl_easy *data, bool is_connect,
                                 struct dynhds *hds);
 
-void Curl_http_method(struct Curl_easy *data, struct connectdata *conn,
+void Curl_http_method(struct Curl_easy *data,
                       const char **method, Curl_HttpReq *);
 
 /* protocol-specific functions set up to be called by the main engine */
@@ -119,8 +115,8 @@ CURLcode Curl_http_setup_conn(struct Curl_easy *data,
 CURLcode Curl_http(struct Curl_easy *data, bool *done);
 CURLcode Curl_http_done(struct Curl_easy *data, CURLcode, bool premature);
 CURLcode Curl_http_connect(struct Curl_easy *data, bool *done);
-int Curl_http_getsock_do(struct Curl_easy *data, struct connectdata *conn,
-                         curl_socket_t *socks);
+CURLcode Curl_http_do_pollset(struct Curl_easy *data,
+                              struct easy_pollset *ps);
 CURLcode Curl_http_write_resp(struct Curl_easy *data,
                               const char *buf, size_t blen,
                               bool is_eos);
diff --git a/deps/curl/lib/http2.c b/deps/curl/lib/http2.c
index 36dca426de8..e2cdc9181f5 100644
--- a/deps/curl/lib/http2.c
+++ b/deps/curl/lib/http2.c
@@ -24,7 +24,7 @@
 
 #include "curl_setup.h"
 
-#ifdef USE_NGHTTP2
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGHTTP2)
 #include <stdint.h>
 #include <nghttp2/nghttp2.h>
 #include "urldata.h"
@@ -488,7 +488,7 @@ static int on_header(nghttp2_session *session, const nghttp2_frame *frame,
                      const uint8_t *value, size_t valuelen,
                      uint8_t flags,
                      void *userp);
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
 static int error_callback(nghttp2_session *session, const char *msg,
                           size_t len, void *userp);
 #endif
@@ -523,7 +523,7 @@ static CURLcode cf_h2_ctx_open(struct Curl_cfilter *cf,
   nghttp2_session_callbacks_set_on_begin_headers_callback(
     cbs, on_begin_headers);
   nghttp2_session_callbacks_set_on_header_callback(cbs, on_header);
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
   nghttp2_session_callbacks_set_error_callback(cbs, error_callback);
 #endif
 
@@ -799,7 +799,7 @@ static ssize_t send_callback(nghttp2_session *h2,
     ctx->nw_out_blocked = 1;
     return NGHTTP2_ERR_WOULDBLOCK;
   }
-  return (nwritten  > SSIZE_T_MAX) ?
+  return (nwritten  > SSIZE_MAX) ?
     NGHTTP2_ERR_CALLBACK_FAILURE : (ssize_t)nwritten;
 }
 
@@ -1779,7 +1779,7 @@ static ssize_t req_body_read_callback(nghttp2_session *session,
   return (nread == 0) ? NGHTTP2_ERR_DEFERRED : nread;
 }
 
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
 static int error_callback(nghttp2_session *session,
                           const char *msg,
                           size_t len,
@@ -1820,8 +1820,9 @@ CURLcode Curl_http2_request_upgrade(struct dynbuf *req,
     return result;
   }
 
+  data->state.http_hd_upgrade = TRUE;
+  data->state.http_hd_h2_settings = TRUE;
   result = curlx_dyn_addf(req,
-                          "Connection: Upgrade, HTTP2-Settings\r\n"
                           "Upgrade: %s\r\n"
                           "HTTP2-Settings: %s\r\n",
                           NGHTTP2_CLEARTEXT_PROTO_VERSION_ID, base64);
@@ -2220,7 +2221,7 @@ static CURLcode h2_submit(struct h2_stream_ctx **pstream,
   struct dynhds h2_headers;
   nghttp2_nv *nva = NULL;
   const void *body = NULL;
-  size_t nheader, bodylen, i;
+  size_t nheader, bodylen;
   nghttp2_data_provider data_prd;
   int32_t stream_id;
   nghttp2_priority_spec pri_spec;
@@ -2282,9 +2283,10 @@ static CURLcode h2_submit(struct h2_stream_ctx **pstream,
     goto out;
   }
 
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
 #define MAX_ACC 60000  /* <64KB to account for some overhead */
   if(Curl_trc_is_verbose(data)) {
-    size_t acc = 0;
+    size_t acc = 0, i;
 
     infof(data, "[HTTP/2] [%d] OPENED stream for %s",
           stream_id, data->state.url);
@@ -2302,6 +2304,7 @@ static CURLcode h2_submit(struct h2_stream_ctx **pstream,
             "stream to be rejected.", MAX_ACC);
     }
   }
+#endif
 
   stream->id = stream_id;
 
@@ -2348,7 +2351,7 @@ static CURLcode cf_h2_send(struct Curl_cfilter *cf, struct Curl_easy *data,
     DEBUGASSERT(stream);
   }
   else if(stream->body_eos) {
-    /* We already wrote this, but CURLE_AGAINed the call due to not
+    /* We already wrote this, but CURLE_AGAIN-ed the call due to not
      * being able to flush stream->sendbuf. Make a 0-length write
      * to trigger flushing again.
      * If this works, we report to have written `len` bytes. */
@@ -2463,17 +2466,18 @@ static CURLcode cf_h2_flush(struct Curl_cfilter *cf,
   return result;
 }
 
-static void cf_h2_adjust_pollset(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data,
-                                 struct easy_pollset *ps)
+static CURLcode cf_h2_adjust_pollset(struct Curl_cfilter *cf,
+                                     struct Curl_easy *data,
+                                     struct easy_pollset *ps)
 {
   struct cf_h2_ctx *ctx = cf->ctx;
   struct cf_call_data save;
   curl_socket_t sock;
   bool want_recv, want_send;
+  CURLcode result = CURLE_OK;
 
   if(!ctx->h2)
-    return;
+    return CURLE_OK;
 
   sock = Curl_conn_cf_get_socket(cf, data);
   Curl_pollset_check(data, ps, sock, &want_recv, &want_send);
@@ -2491,7 +2495,7 @@ static void cf_h2_adjust_pollset(struct Curl_cfilter *cf,
                 (!c_exhaust && nghttp2_session_want_write(ctx->h2)) ||
                 !Curl_bufq_is_empty(&ctx->outbufq);
 
-    Curl_pollset_set(data, ps, sock, want_recv, want_send);
+    result = Curl_pollset_set(data, ps, sock, want_recv, want_send);
     CF_DATA_RESTORE(cf, save);
   }
   else if(ctx->sent_goaway && !cf->shutdown) {
@@ -2500,9 +2504,10 @@ static void cf_h2_adjust_pollset(struct Curl_cfilter *cf,
     want_send = nghttp2_session_want_write(ctx->h2) ||
                 !Curl_bufq_is_empty(&ctx->outbufq);
     want_recv = nghttp2_session_want_read(ctx->h2);
-    Curl_pollset_set(data, ps, sock, want_recv, want_send);
+    result = Curl_pollset_set(data, ps, sock, want_recv, want_send);
     CF_DATA_RESTORE(cf, save);
   }
+  return result;
 }
 
 static CURLcode cf_h2_connect(struct Curl_cfilter *cf,
@@ -3008,23 +3013,23 @@ void *Curl_nghttp2_realloc(void *ptr, size_t size, void *user_data)
   return Curl_crealloc(ptr, size);
 }
 
-#else /* !USE_NGHTTP2 */
+#else /* CURL_DISABLE_HTTP || !USE_NGHTTP2 */
 
 /* Satisfy external references even if http2 is not compiled in. */
 #include <curl/curl.h>
 
 char *curl_pushheader_bynum(struct curl_pushheaders *h, size_t num)
 {
-  (void) h;
-  (void) num;
+  (void)h;
+  (void)num;
   return NULL;
 }
 
 char *curl_pushheader_byname(struct curl_pushheaders *h, const char *header)
 {
-  (void) h;
-  (void) header;
+  (void)h;
+  (void)header;
   return NULL;
 }
 
-#endif /* USE_NGHTTP2 */
+#endif /* !CURL_DISABLE_HTTP && USE_NGHTTP2 */
diff --git a/deps/curl/lib/http_aws_sigv4.c b/deps/curl/lib/http_aws_sigv4.c
index 92c0c1ff4cf..c62db499ca1 100644
--- a/deps/curl/lib/http_aws_sigv4.c
+++ b/deps/curl/lib/http_aws_sigv4.c
@@ -775,7 +775,7 @@ CURLcode Curl_output_aws_sigv4(struct Curl_easy *data)
     }
   }
 
-  Curl_http_method(data, conn, &method, &httpreq);
+  Curl_http_method(data, &method, &httpreq);
 
   payload_hash =
     parse_content_sha_hdr(data, curlx_str(&provider1),
@@ -1149,4 +1149,4 @@ static bool should_urlencode(struct Curl_str *service_name)
   return true;
 }
 
-#endif /* !defined(CURL_DISABLE_HTTP) && !defined(CURL_DISABLE_AWS) */
+#endif /* !CURL_DISABLE_HTTP && !CURL_DISABLE_AWS */
diff --git a/deps/curl/lib/http_chunks.c b/deps/curl/lib/http_chunks.c
index 63e477c48a6..f735a820c7b 100644
--- a/deps/curl/lib/http_chunks.c
+++ b/deps/curl/lib/http_chunks.c
@@ -159,7 +159,7 @@ static CURLcode httpchunk_readwrite(struct Curl_easy *data,
       }
       else {
         const char *p;
-        if(0 == ch->hexindex) {
+        if(ch->hexindex == 0) {
           /* This is illegal data, we received junk where we expected
              a hexadecimal digit. */
           failf(data, "chunk hex-length char not a hex digit: 0x%x", *buf);
@@ -184,7 +184,7 @@ static CURLcode httpchunk_readwrite(struct Curl_easy *data,
       /* waiting for the LF after a chunk size */
       if(*buf == 0x0a) {
         /* we are now expecting data to come, unless size was zero! */
-        if(0 == ch->datasize) {
+        if(ch->datasize == 0) {
           ch->state = CHUNK_TRAILER; /* now check for trailers */
         }
         else {
@@ -229,7 +229,7 @@ static CURLcode httpchunk_readwrite(struct Curl_easy *data,
                      FMT_OFF_T " bytes in chunk remain",
                      piece, ch->datasize);
 
-      if(0 == ch->datasize)
+      if(ch->datasize == 0)
         /* end of data this round, we now expect a trailing CRLF */
         ch->state = CHUNK_POSTLF;
       break;
@@ -656,8 +656,7 @@ const struct Curl_crtype Curl_httpchunk_encoder = {
   Curl_creader_def_needs_rewind,
   cr_chunked_total_length,
   Curl_creader_def_resume_from,
-  Curl_creader_def_rewind,
-  Curl_creader_def_unpause,
+  Curl_creader_def_cntrl,
   Curl_creader_def_is_paused,
   Curl_creader_def_done,
   sizeof(struct chunked_reader)
diff --git a/deps/curl/lib/http_digest.c b/deps/curl/lib/http_digest.c
index 651bb834037..f4e920706c6 100644
--- a/deps/curl/lib/http_digest.c
+++ b/deps/curl/lib/http_digest.c
@@ -120,7 +120,7 @@ CURLcode Curl_output_digest(struct Curl_easy *data,
   if(!passwdp)
     passwdp = "";
 
-#if defined(USE_WINDOWS_SSPI)
+#ifdef USE_WINDOWS_SSPI
   have_chlg = !!digest->input_token;
 #else
   have_chlg = !!digest->nonce;
@@ -141,7 +141,7 @@ CURLcode Curl_output_digest(struct Curl_easy *data,
      https://httpd.apache.org/docs/2.2/mod/mod_auth_digest.html#msie
 
      Further details on Digest implementation differences:
-     http://www.fngtps.com/2006/09/http-authentication
+     https://web.archive.org/web/2009/fngtps.com/2006/09/http-authentication
   */
 
   if(authp->iestyle) {
diff --git a/deps/curl/lib/http_ntlm.c b/deps/curl/lib/http_ntlm.c
index 0dff8f3a007..a172eb848dd 100644
--- a/deps/curl/lib/http_ntlm.c
+++ b/deps/curl/lib/http_ntlm.c
@@ -45,7 +45,7 @@
 
 /* SSL backend-specific #if branches in this file must be kept in the order
    documented in curl_ntlm_core. */
-#if defined(USE_WINDOWS_SSPI)
+#ifdef USE_WINDOWS_SSPI
 #include "curl_sspi.h"
 #endif
 
diff --git a/deps/curl/lib/http_proxy.c b/deps/curl/lib/http_proxy.c
index 6f435a86745..2d742856ce8 100644
--- a/deps/curl/lib/http_proxy.c
+++ b/deps/curl/lib/http_proxy.c
@@ -162,11 +162,6 @@ static CURLcode dynhds_add_custom(struct Curl_easy *data,
                  we will force length zero then */
               hd_name_eq(name, namelen, STRCONST("Content-Length:")))
         ;
-      else if(data->state.aptr.te &&
-              /* when asking for Transfer-Encoding, do not pass on a custom
-                 Connection: */
-              hd_name_eq(name, namelen, STRCONST("Connection:")))
-        ;
       else if((httpversion >= 20) &&
               hd_name_eq(name, namelen, STRCONST("Transfer-Encoding:")))
         /* HTTP/2 and HTTP/3 do not support chunked requests */
@@ -325,36 +320,42 @@ static CURLcode http_proxy_cf_connect(struct Curl_cfilter *cf,
   if(!ctx->cf_protocol) {
     struct Curl_cfilter *cf_protocol = NULL;
     int httpversion = 0;
-    int alpn = Curl_conn_cf_is_ssl(cf->next) ?
-      cf->conn->proxy_alpn : CURL_HTTP_VERSION_1_1;
-
-    /* First time call after the subchain connected */
-    switch(alpn) {
-    case CURL_HTTP_VERSION_NONE:
-    case CURL_HTTP_VERSION_1_0:
-    case CURL_HTTP_VERSION_1_1:
+    const char *alpn = Curl_conn_cf_get_alpn_negotiated(cf->next, data);
+
+    if(alpn)
+      infof(data, "CONNECT: '%s' negotiated", alpn);
+    else
+      infof(data, "CONNECT: no ALPN negotiated");
+
+    if(alpn && !strcmp(alpn, "http/1.0")) {
+      CURL_TRC_CF(data, cf, "installing subfilter for HTTP/1.0");
+      result = Curl_cf_h1_proxy_insert_after(cf, data);
+      if(result)
+        goto out;
+      cf_protocol = cf->next;
+      httpversion = 10;
+    }
+    else if(!alpn || !strcmp(alpn, "http/1.1")) {
       CURL_TRC_CF(data, cf, "installing subfilter for HTTP/1.1");
-      infof(data, "CONNECT tunnel: HTTP/1.%d negotiated",
-            (alpn == CURL_HTTP_VERSION_1_0) ? 0 : 1);
       result = Curl_cf_h1_proxy_insert_after(cf, data);
       if(result)
         goto out;
       cf_protocol = cf->next;
-      httpversion = (alpn == CURL_HTTP_VERSION_1_0) ? 10 : 11;
-      break;
+      /* Assume that without an ALPN, we are talking to an ancient one */
+      httpversion = 11;
+    }
 #ifdef USE_NGHTTP2
-    case CURL_HTTP_VERSION_2:
+    else if(!strcmp(alpn, "h2")) {
       CURL_TRC_CF(data, cf, "installing subfilter for HTTP/2");
-      infof(data, "CONNECT tunnel: HTTP/2 negotiated");
       result = Curl_cf_h2_proxy_insert_after(cf, data);
       if(result)
         goto out;
       cf_protocol = cf->next;
       httpversion = 20;
-      break;
+    }
 #endif
-    default:
-      infof(data, "CONNECT tunnel: unsupported ALPN(%d) negotiated", alpn);
+    else {
+      failf(data, "CONNECT: negotiated ALPN '%s' not supported", alpn);
       result = CURLE_COULDNT_CONNECT;
       goto out;
     }
@@ -391,6 +392,12 @@ CURLcode Curl_cf_http_proxy_query(struct Curl_cfilter *cf,
     *pres1 = (int)cf->conn->http_proxy.port;
     *((const char **)pres2) = cf->conn->http_proxy.host.name;
     return CURLE_OK;
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = NULL;
+    return CURLE_OK;
+  }
   default:
     break;
   }
diff --git a/deps/curl/lib/httpsrr.h b/deps/curl/lib/httpsrr.h
index 83119dc6bde..563d1c8e515 100644
--- a/deps/curl/lib/httpsrr.h
+++ b/deps/curl/lib/httpsrr.h
@@ -76,7 +76,7 @@ void Curl_httpsrr_cleanup(struct Curl_https_rrinfo *rrinfo);
 #define HTTPS_RR_CODE_ECH             0x05
 #define HTTPS_RR_CODE_IPV6            0x06
 
-#if defined(USE_ARES)
+#ifdef USE_ARES
 CURLcode Curl_httpsrr_from_ares(struct Curl_easy *data,
                                 const ares_dns_record_t *dnsrec,
                                 struct Curl_https_rrinfo *hinfo);
diff --git a/deps/curl/lib/idn.c b/deps/curl/lib/idn.c
index 798c9aaef1a..bb6fd2cffc2 100644
--- a/deps/curl/lib/idn.c
+++ b/deps/curl/lib/idn.c
@@ -51,7 +51,7 @@
 #include "memdebug.h"
 
 /* for macOS and iOS targets */
-#if defined(USE_APPLE_IDN)
+#ifdef USE_APPLE_IDN
 #include <unicode/uidna.h>
 #include <iconv.h>
 #include <langinfo.h>
@@ -152,7 +152,7 @@ static CURLcode mac_ascii_to_idn(const char *in, char **out)
 #ifdef USE_WIN32_IDN
 /* using Windows kernel32 and normaliz libraries. */
 
-#if (!defined(_WIN32_WINNT) || _WIN32_WINNT < 0x600) && \
+#if (!defined(_WIN32_WINNT) || _WIN32_WINNT < _WIN32_WINNT_VISTA) && \
   (!defined(WINVER) || WINVER < 0x600)
 WINBASEAPI int WINAPI IdnToAscii(DWORD dwFlags,
                                  const WCHAR *lpUnicodeCharStr,
@@ -323,8 +323,14 @@ CURLcode Curl_idn_decode(const char *input, char **output)
       result = CURLE_OUT_OF_MEMORY;
   }
 #endif
-  if(!result)
-    *output = d;
+  if(!result) {
+    if(!d[0]) { /* ended up zero length, not acceptable */
+      result = CURLE_URL_MALFORMAT;
+      free(d);
+    }
+    else
+      *output = d;
+  }
   return result;
 }
 
diff --git a/deps/curl/lib/if2ip.c b/deps/curl/lib/if2ip.c
index d685290889e..91ee59c02a7 100644
--- a/deps/curl/lib/if2ip.c
+++ b/deps/curl/lib/if2ip.c
@@ -94,7 +94,7 @@ unsigned int Curl_ipv6_scope(const struct sockaddr *sa)
 
 #if !defined(CURL_DISABLE_BINDLOCAL) || !defined(CURL_DISABLE_FTP)
 
-#if defined(HAVE_GETIFADDRS)
+#ifdef HAVE_GETIFADDRS
 
 if2ip_result_t Curl_if2ip(int af,
 #ifdef USE_IPV6
@@ -109,7 +109,7 @@ if2ip_result_t Curl_if2ip(int af,
 
 #if defined(USE_IPV6) && \
     !defined(HAVE_SOCKADDR_IN6_SIN6_SCOPE_ID)
-  (void) local_scope_id;
+  (void)local_scope_id;
 #endif
 
   if(getifaddrs(&head) >= 0) {
@@ -252,14 +252,14 @@ if2ip_result_t Curl_if2ip(int af,
                           const char *interf,
                           char *buf, size_t buf_size)
 {
-    (void) af;
+    (void)af;
 #ifdef USE_IPV6
-    (void) remote_scope;
-    (void) local_scope_id;
+    (void)remote_scope;
+    (void)local_scope_id;
 #endif
-    (void) interf;
-    (void) buf;
-    (void) buf_size;
+    (void)interf;
+    (void)buf;
+    (void)buf_size;
     return IF2IP_NOT_FOUND;
 }
 
diff --git a/deps/curl/lib/imap.c b/deps/curl/lib/imap.c
index f25176bb9e2..41aec8ffab7 100644
--- a/deps/curl/lib/imap.c
+++ b/deps/curl/lib/imap.c
@@ -157,8 +157,8 @@ static CURLcode imap_connect(struct Curl_easy *data, bool *done);
 static CURLcode imap_disconnect(struct Curl_easy *data,
                                 struct connectdata *conn, bool dead);
 static CURLcode imap_multi_statemach(struct Curl_easy *data, bool *done);
-static int imap_getsock(struct Curl_easy *data, struct connectdata *conn,
-                        curl_socket_t *socks);
+static CURLcode imap_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps);
 static CURLcode imap_doing(struct Curl_easy *data, bool *dophase_done);
 static CURLcode imap_setup_connection(struct Curl_easy *data,
                                       struct connectdata *conn);
@@ -196,10 +196,10 @@ const struct Curl_handler Curl_handler_imap = {
   imap_connect,                     /* connect_it */
   imap_multi_statemach,             /* connecting */
   imap_doing,                       /* doing */
-  imap_getsock,                     /* proto_getsock */
-  imap_getsock,                     /* doing_getsock */
-  ZERO_NULL,                        /* domore_getsock */
-  ZERO_NULL,                        /* perform_getsock */
+  imap_pollset,                     /* proto_pollset */
+  imap_pollset,                     /* doing_pollset */
+  ZERO_NULL,                        /* domore_pollset */
+  ZERO_NULL,                        /* perform_pollset */
   imap_disconnect,                  /* disconnect */
   ZERO_NULL,                        /* write_resp */
   ZERO_NULL,                        /* write_resp_hd */
@@ -227,10 +227,10 @@ const struct Curl_handler Curl_handler_imaps = {
   imap_connect,                     /* connect_it */
   imap_multi_statemach,             /* connecting */
   imap_doing,                       /* doing */
-  imap_getsock,                     /* proto_getsock */
-  imap_getsock,                     /* doing_getsock */
-  ZERO_NULL,                        /* domore_getsock */
-  ZERO_NULL,                        /* perform_getsock */
+  imap_pollset,                     /* proto_pollset */
+  imap_pollset,                     /* doing_pollset */
+  ZERO_NULL,                        /* domore_pollset */
+  ZERO_NULL,                        /* perform_pollset */
   imap_disconnect,                  /* disconnect */
   ZERO_NULL,                        /* write_resp */
   ZERO_NULL,                        /* write_resp_hd */
@@ -1005,7 +1005,7 @@ static CURLcode imap_state_servergreet_resp(struct Curl_easy *data,
                                             int imapcode,
                                             imapstate instate)
 {
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(imapcode == IMAP_RESP_PREAUTH) {
     /* PREAUTH */
@@ -1030,7 +1030,7 @@ static CURLcode imap_state_capability_resp(struct Curl_easy *data,
   struct connectdata *conn = data->conn;
   const char *line = curlx_dyn_ptr(&imapc->pp.recvbuf);
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   /* Do we have an untagged response? */
   if(imapcode == '*') {
@@ -1111,7 +1111,7 @@ static CURLcode imap_state_starttls_resp(struct Curl_easy *data,
 {
   CURLcode result = CURLE_OK;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   /* Pipelining in response is forbidden. */
   if(imapc->pp.overflow)
@@ -1140,7 +1140,7 @@ static CURLcode imap_state_auth_resp(struct Curl_easy *data,
   CURLcode result = CURLE_OK;
   saslprogress progress;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   result = Curl_sasl_continue(&imapc->sasl, data, imapcode, &progress);
   if(!result)
@@ -1171,7 +1171,7 @@ static CURLcode imap_state_login_resp(struct Curl_easy *data,
                                       imapstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(imapcode != IMAP_RESP_OK) {
     failf(data, "Access denied. %c", imapcode);
@@ -1194,7 +1194,7 @@ static CURLcode imap_state_listsearch_resp(struct Curl_easy *data,
   char *line = curlx_dyn_ptr(&imapc->pp.recvbuf);
   size_t len = imapc->pp.nfinal;
 
-  (void)instate; /* No use for this yet */
+  (void)instate;
 
   if(imapcode == '*')
     result = Curl_client_write(data, CLIENTWRITE_BODY, line, len);
@@ -1217,7 +1217,7 @@ static CURLcode imap_state_select_resp(struct Curl_easy *data,
   CURLcode result = CURLE_OK;
   const char *line = curlx_dyn_ptr(&imapc->pp.recvbuf);
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(imapcode == '*') {
     /* See if this is an UIDVALIDITY response */
@@ -1279,7 +1279,7 @@ static CURLcode imap_state_fetch_resp(struct Curl_easy *data,
   bool parsed = FALSE;
   curl_off_t size = 0;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(imapcode != '*') {
     Curl_pgrsSetDownloadSize(data, -1);
@@ -1347,7 +1347,7 @@ static CURLcode imap_state_fetch_resp(struct Curl_easy *data,
     else {
       /* IMAP download */
       data->req.maxdownload = size;
-      Curl_xfer_setup1(data, CURL_XFER_RECV, size, FALSE);
+      Curl_xfer_setup_recv(data, FIRSTSOCKET, size);
     }
   }
   else {
@@ -1370,7 +1370,7 @@ static CURLcode imap_state_fetch_final_resp(struct Curl_easy *data,
 {
   CURLcode result = CURLE_OK;
 
-  (void)instate; /* No use for this yet */
+  (void)instate;
 
   if(imapcode != IMAP_RESP_OK)
     result = CURLE_WEIRD_SERVER_REPLY;
@@ -1388,7 +1388,7 @@ static CURLcode imap_state_append_resp(struct Curl_easy *data,
                                        imapstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* No use for this yet */
+  (void)instate;
 
   if(imapcode != '+') {
     result = CURLE_UPLOAD_FAILED;
@@ -1398,7 +1398,7 @@ static CURLcode imap_state_append_resp(struct Curl_easy *data,
     Curl_pgrsSetUploadSize(data, data->state.infilesize);
 
     /* IMAP upload */
-    Curl_xfer_setup1(data, CURL_XFER_SEND, -1, FALSE);
+    Curl_xfer_setup_send(data, FIRSTSOCKET);
 
     /* End of DO phase */
     imap_state(data, imapc, IMAP_STOP);
@@ -1415,7 +1415,7 @@ static CURLcode imap_state_append_final_resp(struct Curl_easy *data,
 {
   CURLcode result = CURLE_OK;
 
-  (void)instate; /* No use for this yet */
+  (void)instate;
 
   if(imapcode != IMAP_RESP_OK)
     result = CURLE_UPLOAD_FAILED;
@@ -1560,13 +1560,12 @@ static CURLcode imap_block_statemach(struct Curl_easy *data,
 }
 
 /* For the IMAP "protocol connect" and "doing" phases only */
-static int imap_getsock(struct Curl_easy *data,
-                        struct connectdata *conn,
-                        curl_socket_t *socks)
+static CURLcode imap_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
 {
-  struct imap_conn *imapc = Curl_conn_meta_get(conn, CURL_META_IMAP_CONN);
-  return imapc ?
-         Curl_pp_getsock(data, &imapc->pp, socks) : GETSOCK_BLANK;
+  struct imap_conn *imapc =
+    Curl_conn_meta_get(data->conn, CURL_META_IMAP_CONN);
+  return imapc ? Curl_pp_pollset(data, &imapc->pp, ps) : CURLE_OK;
 }
 
 /***********************************************************************
diff --git a/deps/curl/lib/krb5.c b/deps/curl/lib/krb5.c
index b5effa2a1b7..563d724bbbc 100644
--- a/deps/curl/lib/krb5.c
+++ b/deps/curl/lib/krb5.c
@@ -130,7 +130,7 @@ krb5_init(void *app_data)
 static int
 krb5_check_prot(void *app_data, int level)
 {
-  (void)app_data; /* unused */
+  (void)app_data;
   if(level == PROT_CONFIDENTIAL)
     return -1;
   return 0;
@@ -138,8 +138,7 @@ krb5_check_prot(void *app_data, int level)
 
 static int
 krb5_decode(void *app_data, void *buf, int len,
-            int level UNUSED_PARAM,
-            struct connectdata *conn UNUSED_PARAM)
+            int level, struct connectdata *conn)
 {
   gss_ctx_id_t *context = app_data;
   OM_uint32 maj, min;
@@ -470,7 +469,7 @@ static int ftp_send_command(struct Curl_easy *data, const char *message, ...)
       ftp_code = -1;
   }
 
-  (void)nread; /* Unused */
+  (void)nread;
   return ftp_code;
 }
 
@@ -703,7 +702,7 @@ static CURLcode sec_send(struct Curl_easy *data, int sockindex,
                          const void *buffer, size_t len, bool eos,
                          size_t *pnwritten)
 {
-  (void)eos; /* unused */
+  (void)eos;
   return sec_write(data, sockindex, buffer, len, pnwritten);
 }
 
@@ -718,7 +717,7 @@ int Curl_sec_read_msg(struct Curl_easy *data, struct connectdata *conn,
   size_t decoded_sz = 0;
   CURLcode error;
 
-  (void) data;
+  (void)data;
 
   if(!conn->mech)
     /* not initialized, return error */
diff --git a/deps/curl/lib/ldap.c b/deps/curl/lib/ldap.c
index 40e72af0d77..c66a56d7bb2 100644
--- a/deps/curl/lib/ldap.c
+++ b/deps/curl/lib/ldap.c
@@ -43,7 +43,7 @@
  */
 
 /* Wincrypt must be included before anything that could include OpenSSL. */
-#if defined(USE_WIN32_CRYPTO)
+#ifdef USE_WIN32_CRYPTO
 #include <wincrypt.h>
 /* Undefine wincrypt conflicting symbols for BoringSSL. */
 #undef X509_NAME
@@ -105,7 +105,7 @@
 struct ldap_urldesc {
   char   *lud_host;
   int     lud_port;
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
   TCHAR  *lud_dn;
   TCHAR **lud_attrs;
 #else
@@ -113,7 +113,7 @@ struct ldap_urldesc {
   char  **lud_attrs;
 #endif
   int     lud_scope;
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
   TCHAR  *lud_filter;
 #else
   char   *lud_filter;
@@ -177,10 +177,10 @@ const struct Curl_handler Curl_handler_ldap = {
   ZERO_NULL,                            /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -207,10 +207,10 @@ const struct Curl_handler Curl_handler_ldaps = {
   ZERO_NULL,                            /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -224,9 +224,9 @@ const struct Curl_handler Curl_handler_ldaps = {
 };
 #endif
 
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
 
-#if defined(USE_WINDOWS_SSPI)
+#ifdef USE_WINDOWS_SSPI
 static int ldap_win_bind_auth(LDAP *server, const char *user,
                               const char *passwd, unsigned long authflags)
 {
@@ -236,19 +236,19 @@ static int ldap_win_bind_auth(LDAP *server, const char *user,
 
   memset(&cred, 0, sizeof(cred));
 
-#if defined(USE_SPNEGO)
+#ifdef USE_SPNEGO
   if(authflags & CURLAUTH_NEGOTIATE) {
     method = LDAP_AUTH_NEGOTIATE;
   }
   else
 #endif
-#if defined(USE_NTLM)
+#ifdef USE_NTLM
   if(authflags & CURLAUTH_NTLM) {
     method = LDAP_AUTH_NTLM;
   }
   else
 #endif
-#if !defined(CURL_DISABLE_DIGEST_AUTH)
+#ifndef CURL_DISABLE_DIGEST_AUTH
   if(authflags & CURLAUTH_DIGEST) {
     method = LDAP_AUTH_DIGEST;
   }
@@ -273,7 +273,7 @@ static int ldap_win_bind_auth(LDAP *server, const char *user,
   }
   return rc;
 }
-#endif /* #if defined(USE_WINDOWS_SSPI) */
+#endif /* USE_WINDOWS_SSPI */
 
 static int ldap_win_bind(struct Curl_easy *data, LDAP *server,
                          const char *user, const char *passwd)
@@ -292,7 +292,7 @@ static int ldap_win_bind(struct Curl_easy *data, LDAP *server,
     curlx_unicodefree(inuser);
     curlx_unicodefree(inpass);
   }
-#if defined(USE_WINDOWS_SSPI)
+#ifdef USE_WINDOWS_SSPI
   else {
     rc = (int)ldap_win_bind_auth(server, user, passwd, data->set.httpauth);
   }
@@ -300,9 +300,9 @@ static int ldap_win_bind(struct Curl_easy *data, LDAP *server,
 
   return rc;
 }
-#endif /* #if defined(USE_WIN32_LDAP) */
+#endif /* USE_WIN32_LDAP */
 
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
 #define FREE_ON_WINLDAP(x) curlx_unicodefree(x)
 #define curl_ldap_num_t ULONG
 #else
@@ -328,13 +328,15 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
 #ifdef LDAP_OPT_NETWORK_TIMEOUT
   struct timeval ldap_timeout = {10, 0}; /* 10 sec connection/search timeout */
 #endif
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
   TCHAR *host = NULL;
 #else
   char *host = NULL;
 #endif
   char *user = NULL;
   char *passwd = NULL;
+  struct ip_quadruple ipquad;
+  bool is_ipv6;
 
   *done = TRUE; /* unconditionally */
   infof(data, "LDAP local: LDAP Vendor = %s ; LDAP Version = %d",
@@ -352,13 +354,17 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
     goto quit;
   }
 
+  result = Curl_conn_get_ip_info(data, conn, FIRSTSOCKET, &is_ipv6, &ipquad);
+  if(result)
+    goto quit;
+
   /* Get the URL scheme (either ldap or ldaps) */
   if(Curl_conn_is_ssl(conn, FIRSTSOCKET))
     ldap_ssl = 1;
   infof(data, "LDAP local: trying to establish %s connection",
         ldap_ssl ? "encrypted" : "cleartext");
 
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
   host = curlx_convert_UTF8_to_tchar(conn->host.name);
   if(!host) {
     result = CURLE_OUT_OF_MEMORY;
@@ -383,7 +389,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
 #ifdef HAVE_LDAP_SSL
 #ifdef USE_WIN32_LDAP
     /* Win32 LDAP SDK does not support insecure mode without CA! */
-    server = ldap_sslinit(host, (curl_ldap_num_t)conn->primary.remote_port, 1);
+    server = ldap_sslinit(host, (curl_ldap_num_t)ipquad.remote_port, 1);
     ldap_set_option(server, LDAP_OPT_SSL, LDAP_OPT_ON);
 #else
     int ldap_option;
@@ -422,10 +428,10 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
       result = CURLE_SSL_CERTPROBLEM;
       goto quit;
     }
-    server = ldap_init(host, conn->primary.remote_port);
+    server = ldap_init(host, ipquad.remote_port);
     if(!server) {
       failf(data, "LDAP local: Cannot connect to %s:%u",
-            conn->host.dispname, conn->primary.remote_port);
+            conn->host.dispname, ipquad.remote_port);
       result = CURLE_COULDNT_CONNECT;
       goto quit;
     }
@@ -465,10 +471,10 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
     goto quit;
   }
   else {
-    server = ldap_init(host, (curl_ldap_num_t)conn->primary.remote_port);
+    server = ldap_init(host, (curl_ldap_num_t)ipquad.remote_port);
     if(!server) {
       failf(data, "LDAP local: Cannot connect to %s:%u",
-            conn->host.dispname, conn->primary.remote_port);
+            conn->host.dispname, ipquad.remote_port);
       result = CURLE_COULDNT_CONNECT;
       goto quit;
     }
@@ -516,7 +522,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
       entryIterator;
       entryIterator = ldap_next_entry(server, entryIterator), num++) {
     BerElement *ber = NULL;
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
     TCHAR *attribute;
 #else
     char *attribute;
@@ -527,7 +533,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
     {
       char *name;
       size_t name_len;
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
       TCHAR *dn = ldap_get_dn(server, entryIterator);
       name = curlx_convert_tchar_to_UTF8(dn);
       if(!name) {
@@ -574,7 +580,7 @@ static CURLcode ldap_do(struct Curl_easy *data, bool *done)
         attribute = ldap_next_attribute(server, entryIterator, ber)) {
       BerValue **vals;
       size_t attr_len;
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
       char *attr = curlx_convert_tchar_to_UTF8(attribute);
       if(!attr) {
         if(ber)
@@ -837,7 +843,7 @@ static int _ldap_url_parse2(struct Curl_easy *data,
       goto quit;
     }
 
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
     /* Convert the unescaped string to a tchar */
     ludp->lud_dn = curlx_convert_UTF8_to_tchar(unescaped);
 
@@ -868,7 +874,7 @@ static int _ldap_url_parse2(struct Curl_easy *data,
     const char *atp = p;
 
     /* Allocate our array (+1 for the NULL entry) */
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
     ludp->lud_attrs = calloc(count + 1, sizeof(TCHAR *));
 #else
     ludp->lud_attrs = calloc(count + 1, sizeof(char *));
@@ -896,7 +902,7 @@ static int _ldap_url_parse2(struct Curl_easy *data,
         goto quit;
       }
 
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
       /* Convert the unescaped string to a tchar */
       ludp->lud_attrs[i] = curlx_convert_UTF8_to_tchar(unescaped);
 
@@ -960,7 +966,7 @@ static int _ldap_url_parse2(struct Curl_easy *data,
       goto quit;
     }
 
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
     /* Convert the unescaped string to a tchar */
     ludp->lud_filter = curlx_convert_UTF8_to_tchar(unescaped);
 
@@ -1016,7 +1022,7 @@ static void _ldap_free_urldesc(LDAPURLDesc *ludp)
   if(!ludp)
     return;
 
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
   curlx_unicodefree(ludp->lud_dn);
   curlx_unicodefree(ludp->lud_filter);
 #else
@@ -1027,7 +1033,7 @@ static void _ldap_free_urldesc(LDAPURLDesc *ludp)
   if(ludp->lud_attrs) {
     size_t i;
     for(i = 0; i < ludp->lud_attrs_dups; i++) {
-#if defined(USE_WIN32_LDAP)
+#ifdef USE_WIN32_LDAP
       curlx_unicodefree(ludp->lud_attrs[i]);
 #else
       free(ludp->lud_attrs[i]);
diff --git a/deps/curl/lib/libcurl.def b/deps/curl/lib/libcurl.def
index 43e26f655c6..d2f5d8318f2 100644
--- a/deps/curl/lib/libcurl.def
+++ b/deps/curl/lib/libcurl.def
@@ -54,6 +54,7 @@ curl_multi_assign
 curl_multi_cleanup
 curl_multi_fdset
 curl_multi_get_handles
+curl_multi_get_offt
 curl_multi_info_read
 curl_multi_init
 curl_multi_perform
@@ -95,3 +96,4 @@ curl_version_info
 curl_ws_meta
 curl_ws_recv
 curl_ws_send
+curl_ws_start_frame
diff --git a/deps/curl/lib/md4.c b/deps/curl/lib/md4.c
index a77085a6b28..b9c98d6c4ae 100644
--- a/deps/curl/lib/md4.c
+++ b/deps/curl/lib/md4.c
@@ -24,7 +24,7 @@
 
 #include "curl_setup.h"
 
-#if defined(USE_CURL_NTLM_CORE)
+#ifdef USE_CURL_NTLM_CORE
 
 #include <string.h>
 
@@ -34,7 +34,7 @@
 
 #ifdef USE_OPENSSL
 #include <openssl/opensslv.h>
-#if (OPENSSL_VERSION_NUMBER >= 0x30000000L) && !defined(USE_AMISSL)
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && !defined(USE_AMISSL)
 /* OpenSSL 3.0.0 marks the MD4 functions as deprecated */
 #define OPENSSL_NO_MD4
 #else
@@ -53,21 +53,14 @@
 
 #ifdef USE_MBEDTLS
 #include <mbedtls/version.h>
-#if MBEDTLS_VERSION_NUMBER >= 0x03000000
-#include <mbedtls/mbedtls_config.h>
-#else
-#include <mbedtls/config.h>
-#endif
-#if(MBEDTLS_VERSION_NUMBER >= 0x02070000) && \
-   (MBEDTLS_VERSION_NUMBER < 0x03000000)
-  #define HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS
+#if MBEDTLS_VERSION_NUMBER < 0x03020000
+  #error "mbedTLS 3.2.0 or later required"
 #endif
+#include <mbedtls/mbedtls_config.h>
 #endif /* USE_MBEDTLS */
 
-#if defined(USE_GNUTLS)
-#include <nettle/md4.h>
 /* When OpenSSL or wolfSSL is available, we use their MD4 functions. */
-#elif defined(USE_WOLFSSL) && !defined(WOLFSSL_NO_MD4)
+#if defined(USE_WOLFSSL) && !defined(WOLFSSL_NO_MD4)
 #include <wolfssl/openssl/md4.h>
 #elif defined(USE_OPENSSL) && !defined(OPENSSL_NO_MD4)
 #include <openssl/md4.h>
@@ -83,6 +76,8 @@
 #include <CommonCrypto/CommonDigest.h>
 #elif defined(USE_WIN32_CRYPTO)
 #include <wincrypt.h>
+#elif defined(USE_GNUTLS)
+#include <nettle/md4.h>
 #elif(defined(USE_MBEDTLS) && defined(MBEDTLS_MD4_C))
 #include <mbedtls/md4.h>
 #endif
@@ -93,27 +88,7 @@
 #include "memdebug.h"
 
 
-#if defined(USE_GNUTLS)
-
-typedef struct md4_ctx MD4_CTX;
-
-static int MD4_Init(MD4_CTX *ctx)
-{
-  md4_init(ctx);
-  return 1;
-}
-
-static void MD4_Update(MD4_CTX *ctx, const void *data, unsigned long size)
-{
-  md4_update(ctx, size, data);
-}
-
-static void MD4_Final(unsigned char *result, MD4_CTX *ctx)
-{
-  md4_digest(ctx, MD4_DIGEST_SIZE, result);
-}
-
-#elif defined(USE_WOLFSSL) && !defined(WOLFSSL_NO_MD4)
+#if defined(USE_WOLFSSL) && !defined(WOLFSSL_NO_MD4)
 
 #ifdef OPENSSL_COEXIST
   #define MD4_CTX WOLFSSL_MD4_CTX
@@ -193,6 +168,26 @@ static void MD4_Final(unsigned char *result, MD4_CTX *ctx)
     CryptReleaseContext(ctx->hCryptProv, 0);
 }
 
+#elif defined(USE_GNUTLS)
+
+typedef struct md4_ctx MD4_CTX;
+
+static int MD4_Init(MD4_CTX *ctx)
+{
+  md4_init(ctx);
+  return 1;
+}
+
+static void MD4_Update(MD4_CTX *ctx, const void *data, unsigned long size)
+{
+  md4_update(ctx, size, data);
+}
+
+static void MD4_Final(unsigned char *result, MD4_CTX *ctx)
+{
+  md4_digest(ctx, MD4_DIGEST_SIZE, result);
+}
+
 #elif(defined(USE_MBEDTLS) && defined(MBEDTLS_MD4_C))
 
 struct md4_ctx {
@@ -220,12 +215,7 @@ static void MD4_Update(MD4_CTX *ctx, const void *data, unsigned long size)
 static void MD4_Final(unsigned char *result, MD4_CTX *ctx)
 {
   if(ctx->data) {
-#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
     mbedtls_md4(ctx->data, ctx->size, result);
-#else
-    (void) mbedtls_md4_ret(ctx->data, ctx->size, result);
-#endif
-
     Curl_safefree(ctx->data);
     ctx->size = 0;
   }
diff --git a/deps/curl/lib/md5.c b/deps/curl/lib/md5.c
index 6a273c56c0e..625670965a1 100644
--- a/deps/curl/lib/md5.c
+++ b/deps/curl/lib/md5.c
@@ -24,8 +24,8 @@
 
 #include "curl_setup.h"
 
-#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) \
-    || !defined(CURL_DISABLE_DIGEST_AUTH)
+#if (defined(USE_CURL_NTLM_CORE) && !defined(USE_WINDOWS_SSPI)) || \
+  !defined(CURL_DISABLE_DIGEST_AUTH)
 
 #include <string.h>
 #include <curl/curl.h>
@@ -36,10 +36,8 @@
 
 #ifdef USE_MBEDTLS
 #include <mbedtls/version.h>
-
-#if(MBEDTLS_VERSION_NUMBER >= 0x02070000) && \
-   (MBEDTLS_VERSION_NUMBER < 0x03000000)
-  #define HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS
+#if MBEDTLS_VERSION_NUMBER < 0x03020000
+  #error "mbedTLS 3.2.0 or later required"
 #endif
 #endif /* USE_MBEDTLS */
 
@@ -57,7 +55,7 @@
   #endif
 #endif
 
-#if defined(USE_GNUTLS)
+#ifdef USE_GNUTLS
 #include <nettle/md5.h>
 #elif defined(USE_OPENSSL_MD5)
 #include <openssl/md5.h>
@@ -84,7 +82,7 @@
 #include "curl_memory.h"
 #include "memdebug.h"
 
-#if defined(USE_GNUTLS)
+#ifdef USE_GNUTLS
 
 typedef struct md5_ctx my_md5_ctx;
 
@@ -161,15 +159,8 @@ typedef mbedtls_md5_context my_md5_ctx;
 
 static CURLcode my_md5_init(void *ctx)
 {
-#if (MBEDTLS_VERSION_NUMBER >= 0x03000000)
   if(mbedtls_md5_starts(ctx))
     return CURLE_OUT_OF_MEMORY;
-#elif defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
-  if(mbedtls_md5_starts_ret(ctx))
-    return CURLE_OUT_OF_MEMORY;
-#else
-  (void)mbedtls_md5_starts(ctx);
-#endif
   return CURLE_OK;
 }
 
@@ -177,20 +168,12 @@ static void my_md5_update(void *ctx,
                           const unsigned char *data,
                           unsigned int length)
 {
-#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
-  (void) mbedtls_md5_update(ctx, data, length);
-#else
-  (void) mbedtls_md5_update_ret(ctx, data, length);
-#endif
+  (void)mbedtls_md5_update(ctx, data, length);
 }
 
 static void my_md5_final(unsigned char *digest, void *ctx)
 {
-#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
-  (void) mbedtls_md5_finish(ctx, digest);
-#else
-  (void) mbedtls_md5_finish_ret(ctx, digest);
-#endif
+  (void)mbedtls_md5_finish(ctx, digest);
 }
 
 #elif defined(AN_APPLE_OS)
diff --git a/deps/curl/lib/memdebug.c b/deps/curl/lib/memdebug.c
index bdcdcbb9074..c1121713ea3 100644
--- a/deps/curl/lib/memdebug.c
+++ b/deps/curl/lib/memdebug.c
@@ -356,7 +356,7 @@ int curl_dbg_socketpair(int domain, int type, int protocol,
 {
   int res = (socketpair)(domain, type, protocol, socket_vector);
 
-  if(source && (0 == res))
+  if(source && (res == 0))
     curl_dbg_log("FD %s:%d socketpair() = "
                  "%" FMT_SOCKET_T " %" FMT_SOCKET_T "\n",
                  source, line, socket_vector[0], socket_vector[1]);
@@ -371,7 +371,7 @@ curl_socket_t curl_dbg_accept(curl_socket_t s, void *saddr, void *saddrlen,
   struct sockaddr *addr = (struct sockaddr *)saddr;
   curl_socklen_t *addrlen = (curl_socklen_t *)saddrlen;
 
-  curl_socket_t sockfd = (accept)(s, addr, addrlen);
+  curl_socket_t sockfd = accept(s, addr, addrlen);
 
   if(source && (sockfd != CURL_SOCKET_BAD))
     curl_dbg_log("FD %s:%d accept() = %" FMT_SOCKET_T "\n",
diff --git a/deps/curl/lib/memdebug.h b/deps/curl/lib/memdebug.h
index 03b04b12dc2..30469b99a50 100644
--- a/deps/curl/lib/memdebug.h
+++ b/deps/curl/lib/memdebug.h
@@ -1,6 +1,5 @@
 #ifndef HEADER_CURL_MEMDEBUG_H
 #define HEADER_CURL_MEMDEBUG_H
-#ifdef CURLDEBUG
 /***************************************************************************
  *                                  _   _ ____  _
  *  Project                     ___| | | |  _ \| |
@@ -30,99 +29,7 @@
  * as well as the library. Do not mix with library internals!
  */
 
-#include <curl/curl.h>
-#include "functypes.h"
-
-#ifdef __clang__
-#  define ALLOC_FUNC         __attribute__((__malloc__))
-#  if __clang_major__ >= 4
-#  define ALLOC_SIZE(s)      __attribute__((__alloc_size__(s)))
-#  define ALLOC_SIZE2(n, s)  __attribute__((__alloc_size__(n, s)))
-#  else
-#  define ALLOC_SIZE(s)
-#  define ALLOC_SIZE2(n, s)
-#  endif
-#elif defined(__GNUC__) && __GNUC__ >= 3
-#  define ALLOC_FUNC         __attribute__((__malloc__))
-#  define ALLOC_SIZE(s)      __attribute__((__alloc_size__(s)))
-#  define ALLOC_SIZE2(n, s)  __attribute__((__alloc_size__(n, s)))
-#elif defined(_MSC_VER)
-#  define ALLOC_FUNC         __declspec(restrict)
-#  define ALLOC_SIZE(s)
-#  define ALLOC_SIZE2(n, s)
-#else
-#  define ALLOC_FUNC
-#  define ALLOC_SIZE(s)
-#  define ALLOC_SIZE2(n, s)
-#endif
-
-/* Avoid redundant redeclaration warnings with modern compilers, when including
-   this header multiple times. */
-#ifndef HEADER_CURL_MEMDEBUG_H_EXTERNS
-#define HEADER_CURL_MEMDEBUG_H_EXTERNS
-extern FILE *curl_dbg_logfile;
-
-/* memory functions */
-CURL_EXTERN void curl_dbg_free(void *ptr, int line, const char *source);
-CURL_EXTERN ALLOC_FUNC ALLOC_SIZE(1)
-  void *curl_dbg_malloc(size_t size, int line, const char *source);
-CURL_EXTERN ALLOC_FUNC ALLOC_SIZE2(1, 2)
-  void *curl_dbg_calloc(size_t n, size_t size, int line, const char *source);
-CURL_EXTERN ALLOC_SIZE(2)
-  void *curl_dbg_realloc(void *ptr, size_t size, int line, const char *source);
-CURL_EXTERN ALLOC_FUNC
-  char *curl_dbg_strdup(const char *str, int line, const char *src);
-#if defined(_WIN32) && defined(UNICODE)
-CURL_EXTERN ALLOC_FUNC
-  wchar_t *curl_dbg_wcsdup(const wchar_t *str, int line, const char *source);
-#endif
-
-CURL_EXTERN void curl_dbg_memdebug(const char *logname);
-CURL_EXTERN void curl_dbg_memlimit(long limit);
-CURL_EXTERN void curl_dbg_log(const char *format, ...) CURL_PRINTF(1, 2);
-
-/* file descriptor manipulators */
-CURL_EXTERN curl_socket_t curl_dbg_socket(int domain, int type, int protocol,
-                                          int line, const char *source);
-CURL_EXTERN void curl_dbg_mark_sclose(curl_socket_t sockfd,
-                                      int line, const char *source);
-CURL_EXTERN int curl_dbg_sclose(curl_socket_t sockfd,
-                                int line, const char *source);
-CURL_EXTERN curl_socket_t curl_dbg_accept(curl_socket_t s, void *a, void *alen,
-                                          int line, const char *source);
-#ifdef HAVE_ACCEPT4
-CURL_EXTERN curl_socket_t curl_dbg_accept4(curl_socket_t s, void *saddr,
-                                           void *saddrlen, int flags,
-                                           int line, const char *source);
-#endif
-#ifdef HAVE_SOCKETPAIR
-CURL_EXTERN int curl_dbg_socketpair(int domain, int type, int protocol,
-                                    curl_socket_t socket_vector[2],
-                                    int line, const char *source);
-#endif
-
-/* send/receive sockets */
-CURL_EXTERN SEND_TYPE_RETV curl_dbg_send(SEND_TYPE_ARG1 sockfd,
-                                         SEND_QUAL_ARG2 SEND_TYPE_ARG2 buf,
-                                         SEND_TYPE_ARG3 len,
-                                         SEND_TYPE_ARG4 flags, int line,
-                                         const char *source);
-CURL_EXTERN RECV_TYPE_RETV curl_dbg_recv(RECV_TYPE_ARG1 sockfd,
-                                         RECV_TYPE_ARG2 buf,
-                                         RECV_TYPE_ARG3 len,
-                                         RECV_TYPE_ARG4 flags, int line,
-                                         const char *source);
-
-/* FILE functions */
-CURL_EXTERN int curl_dbg_fclose(FILE *file, int line, const char *source);
-CURL_EXTERN ALLOC_FUNC
-  FILE *curl_dbg_fopen(const char *file, const char *mode,
-                       int line, const char *source);
-CURL_EXTERN ALLOC_FUNC
-  FILE *curl_dbg_fdopen(int filedes, const char *mode,
-                        int line, const char *source);
-
-#endif /* HEADER_CURL_MEMDEBUG_H_EXTERNS */
+#ifdef CURLDEBUG
 
 /* Set this symbol on the command-line, recompile all lib-sources */
 #undef strdup
@@ -152,9 +59,6 @@ CURL_EXTERN ALLOC_FUNC
 #undef socket
 #define socket(domain,type,protocol) \
   curl_dbg_socket((int)domain, type, protocol, __LINE__, __FILE__)
-#undef accept /* for those with accept as a macro */
-#define accept(sock,addr,len) \
-  curl_dbg_accept(sock, addr, len, __LINE__, __FILE__)
 #ifdef HAVE_ACCEPT4
 #undef accept4 /* for those with accept4 as a macro */
 #define accept4(sock,addr,len,flags) \
@@ -166,12 +70,6 @@ CURL_EXTERN ALLOC_FUNC
                       __LINE__, __FILE__)
 #endif
 
-/* sclose is probably already defined, redefine it! */
-#undef sclose
-#define sclose(sockfd) curl_dbg_sclose(sockfd,__LINE__,__FILE__)
-
-#define fake_sclose(sockfd) curl_dbg_mark_sclose(sockfd,__LINE__,__FILE__)
-
 #undef fopen
 #define fopen(file,mode) curl_dbg_fopen(file,mode,__LINE__,__FILE__)
 #undef fdopen
@@ -180,22 +78,4 @@ CURL_EXTERN ALLOC_FUNC
 #define fclose(file) curl_dbg_fclose(file,__LINE__,__FILE__)
 
 #endif /* CURLDEBUG */
-
-/*
-** Following section applies even when CURLDEBUG is not defined.
-*/
-
-#ifndef fake_sclose
-#define fake_sclose(x)  Curl_nop_stmt
-#endif
-
-/*
- * Curl_safefree defined as a macro to allow MemoryTracking feature
- * to log free() calls at same location where Curl_safefree is used.
- * This macro also assigns NULL to given pointer when free'd.
- */
-
-#define Curl_safefree(ptr) \
-  do { free((ptr)); (ptr) = NULL;} while(0)
-
 #endif /* HEADER_CURL_MEMDEBUG_H */
diff --git a/deps/curl/lib/mime.c b/deps/curl/lib/mime.c
index 06cd221abfc..894413be17f 100644
--- a/deps/curl/lib/mime.c
+++ b/deps/curl/lib/mime.c
@@ -36,9 +36,10 @@ struct Curl_easy;
 #include "strdup.h"
 #include "curlx/base64.h"
 
-#if !defined(CURL_DISABLE_MIME) && (!defined(CURL_DISABLE_HTTP) ||      \
-                                    !defined(CURL_DISABLE_SMTP) ||      \
-                                    !defined(CURL_DISABLE_IMAP))
+#if !defined(CURL_DISABLE_MIME) && \
+  (!defined(CURL_DISABLE_HTTP) || \
+   !defined(CURL_DISABLE_SMTP) || \
+   !defined(CURL_DISABLE_IMAP))
 
 #if defined(HAVE_LIBGEN_H) && defined(HAVE_BASENAME)
 #include <libgen.h>
@@ -53,14 +54,13 @@ struct Curl_easy;
 #include "memdebug.h"
 
 #ifdef _WIN32
-# ifndef R_OK
+#  ifndef R_OK
 #  define R_OK 4
-# endif
+#  endif
 #endif
 
-
-#define READ_ERROR                      ((size_t) -1)
-#define STOP_FILLING                    ((size_t) -2)
+#define READ_ERROR    ((size_t) -1)
+#define STOP_FILLING  ((size_t) -2)
 
 static size_t mime_subparts_read(char *buffer, size_t size, size_t nitems,
                                  void *instream, bool *hasread);
@@ -97,30 +97,30 @@ static const struct mime_encoder encoders[] = {
 #define QP_CR           3       /* Carriage return. */
 #define QP_LF           4       /* Line-feed. */
 static const unsigned char qp_class[] = {
- 0,     0,     0,     0,     0,     0,     0,     0,            /* 00 - 07 */
- 0,     QP_SP, QP_LF, 0,     0,     QP_CR, 0,     0,            /* 08 - 0F */
- 0,     0,     0,     0,     0,     0,     0,     0,            /* 10 - 17 */
- 0,     0,     0,     0,     0,     0,     0,     0,            /* 18 - 1F */
- QP_SP, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 20 - 27 */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 28 - 2F */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 30 - 37 */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, 0    , QP_OK, QP_OK,        /* 38 - 3F */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 40 - 47 */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 48 - 4F */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 50 - 57 */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 58 - 5F */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 60 - 67 */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 68 - 6F */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 70 - 77 */
- QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, 0,            /* 78 - 7F */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* 80 - 8F */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* 90 - 9F */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* A0 - AF */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* B0 - BF */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* C0 - CF */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* D0 - DF */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* E0 - EF */
- 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0                 /* F0 - FF */
+  0,     0,     0,     0,     0,     0,     0,     0,            /* 00 - 07 */
+  0,     QP_SP, QP_LF, 0,     0,     QP_CR, 0,     0,            /* 08 - 0F */
+  0,     0,     0,     0,     0,     0,     0,     0,            /* 10 - 17 */
+  0,     0,     0,     0,     0,     0,     0,     0,            /* 18 - 1F */
+  QP_SP, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 20 - 27 */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 28 - 2F */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 30 - 37 */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, 0    , QP_OK, QP_OK,        /* 38 - 3F */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 40 - 47 */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 48 - 4F */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 50 - 57 */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 58 - 5F */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 60 - 67 */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 68 - 6F */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK,        /* 70 - 77 */
+  QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, QP_OK, 0,            /* 78 - 7F */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* 80 - 8F */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* 90 - 9F */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* A0 - AF */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* B0 - BF */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* C0 - CF */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* D0 - DF */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0,                /* E0 - EF */
+  0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0                 /* F0 - FF */
 };
 
 
@@ -129,7 +129,6 @@ static const char aschex[] =
   "\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x41\x42\x43\x44\x45\x46";
 
 
-
 #ifndef __VMS
 #define filesize(name, stat_data) (stat_data.st_size)
 #define fopen_read fopen
@@ -384,7 +383,7 @@ static size_t encoder_nop_read(char *buffer, size_t size, bool ateof,
   struct mime_encoder_state *st = &part->encstate;
   size_t insize = st->bufend - st->bufbeg;
 
-  (void) ateof;
+  (void)ateof;
 
   if(!size)
     return STOP_FILLING;
@@ -412,7 +411,7 @@ static size_t encoder_7bit_read(char *buffer, size_t size, bool ateof,
   struct mime_encoder_state *st = &part->encstate;
   size_t cursize = st->bufend - st->bufbeg;
 
-  (void) ateof;
+  (void)ateof;
 
   if(!size)
     return STOP_FILLING;
@@ -661,7 +660,7 @@ static size_t mime_mem_read(char *buffer, size_t size, size_t nitems,
 {
   curl_mimepart *part = (curl_mimepart *) instream;
   size_t sz = curlx_sotouz(part->datasize - part->state.offset);
-  (void) size;   /* Always 1.*/
+  (void)size;  /* Always 1 */
 
   if(!nitems)
     return STOP_FILLING;
@@ -1000,7 +999,7 @@ static size_t mime_subparts_read(char *buffer, size_t size, size_t nitems,
 {
   curl_mime *mime = (curl_mime *) instream;
   size_t cursize = 0;
-  (void) size;   /* Always 1. */
+  (void)size;  /* Always 1 */
 
   while(nitems) {
     size_t sz = 0;
@@ -1593,7 +1592,7 @@ size_t Curl_mime_read(char *buffer, size_t size, size_t nitems, void *instream)
   size_t ret;
   bool hasread;
 
-  (void) size;   /* Always 1. */
+  (void)size;  /* Always 1 */
 
   /* If `nitems` is <= 4, some encoders will return STOP_FILLING without
    * adding any data and this loops infinitely. */
@@ -2150,22 +2149,27 @@ static CURLcode cr_mime_resume_from(struct Curl_easy *data,
   return CURLE_OK;
 }
 
-static CURLcode cr_mime_rewind(struct Curl_easy *data,
-                               struct Curl_creader *reader)
+static CURLcode cr_mime_cntrl(struct Curl_easy *data,
+                              struct Curl_creader *reader,
+                              Curl_creader_cntrl opcode)
 {
   struct cr_mime_ctx *ctx = reader->ctx;
-  CURLcode result = mime_rewind(ctx->part);
-  if(result)
-    failf(data, "Cannot rewind mime/post data");
-  return result;
-}
-
-static CURLcode cr_mime_unpause(struct Curl_easy *data,
-                                struct Curl_creader *reader)
-{
-  struct cr_mime_ctx *ctx = reader->ctx;
-  (void)data;
-  mime_unpause(ctx->part);
+  switch(opcode) {
+  case CURL_CRCNTRL_REWIND: {
+    CURLcode result = mime_rewind(ctx->part);
+    if(result)
+      failf(data, "Cannot rewind mime/post data");
+    return result;
+  }
+  case CURL_CRCNTRL_UNPAUSE:
+    mime_unpause(ctx->part);
+    break;
+  case CURL_CRCNTRL_CLEAR_EOS:
+    ctx->seen_eos = FALSE;
+    break;
+  default:
+    break;
+  }
   return CURLE_OK;
 }
 
@@ -2185,8 +2189,7 @@ static const struct Curl_crtype cr_mime = {
   cr_mime_needs_rewind,
   cr_mime_total_length,
   cr_mime_resume_from,
-  cr_mime_rewind,
-  cr_mime_unpause,
+  cr_mime_cntrl,
   cr_mime_is_paused,
   Curl_creader_def_done,
   sizeof(struct cr_mime_ctx)
@@ -2220,62 +2223,62 @@ CURLcode Curl_creader_set_mime(struct Curl_easy *data, curl_mimepart *part)
 /* Mime not compiled in: define stubs for externally-referenced functions. */
 curl_mime *curl_mime_init(CURL *easy)
 {
-  (void) easy;
+  (void)easy;
   return NULL;
 }
 
 void curl_mime_free(curl_mime *mime)
 {
-  (void) mime;
+  (void)mime;
 }
 
 curl_mimepart *curl_mime_addpart(curl_mime *mime)
 {
-  (void) mime;
+  (void)mime;
   return NULL;
 }
 
 CURLcode curl_mime_name(curl_mimepart *part, const char *name)
 {
-  (void) part;
-  (void) name;
+  (void)part;
+  (void)name;
   return CURLE_NOT_BUILT_IN;
 }
 
 CURLcode curl_mime_filename(curl_mimepart *part, const char *filename)
 {
-  (void) part;
-  (void) filename;
+  (void)part;
+  (void)filename;
   return CURLE_NOT_BUILT_IN;
 }
 
 CURLcode curl_mime_type(curl_mimepart *part, const char *mimetype)
 {
-  (void) part;
-  (void) mimetype;
+  (void)part;
+  (void)mimetype;
   return CURLE_NOT_BUILT_IN;
 }
 
 CURLcode curl_mime_encoder(curl_mimepart *part, const char *encoding)
 {
-  (void) part;
-  (void) encoding;
+  (void)part;
+  (void)encoding;
   return CURLE_NOT_BUILT_IN;
 }
 
 CURLcode curl_mime_data(curl_mimepart *part,
                         const char *data, size_t datasize)
 {
-  (void) part;
-  (void) data;
-  (void) datasize;
+  (void)part;
+  (void)data;
+  (void)datasize;
   return CURLE_NOT_BUILT_IN;
 }
 
 CURLcode curl_mime_filedata(curl_mimepart *part, const char *filename)
 {
-  (void) part;
-  (void) filename;
+  (void)part;
+  (void)filename;
   return CURLE_NOT_BUILT_IN;
 }
 
@@ -2286,28 +2289,28 @@ CURLcode curl_mime_data_cb(curl_mimepart *part,
                            curl_free_callback freefunc,
                            void *arg)
 {
-  (void) part;
-  (void) datasize;
-  (void) readfunc;
-  (void) seekfunc;
-  (void) freefunc;
-  (void) arg;
+  (void)part;
+  (void)datasize;
+  (void)readfunc;
+  (void)seekfunc;
+  (void)freefunc;
+  (void)arg;
   return CURLE_NOT_BUILT_IN;
 }
 
 CURLcode curl_mime_subparts(curl_mimepart *part, curl_mime *subparts)
 {
-  (void) part;
-  (void) subparts;
+  (void)part;
+  (void)subparts;
   return CURLE_NOT_BUILT_IN;
 }
 
 CURLcode curl_mime_headers(curl_mimepart *part,
                            struct curl_slist *headers, int take_ownership)
 {
-  (void) part;
-  (void) headers;
-  (void) take_ownership;
+  (void)part;
+  (void)headers;
+  (void)take_ownership;
   return CURLE_NOT_BUILT_IN;
 }
 
diff --git a/deps/curl/lib/mqtt.c b/deps/curl/lib/mqtt.c
index 90f857dca56..35afe012075 100644
--- a/deps/curl/lib/mqtt.c
+++ b/deps/curl/lib/mqtt.c
@@ -107,8 +107,8 @@ static CURLcode mqtt_do(struct Curl_easy *data, bool *done);
 static CURLcode mqtt_done(struct Curl_easy *data,
                           CURLcode status, bool premature);
 static CURLcode mqtt_doing(struct Curl_easy *data, bool *done);
-static int mqtt_getsock(struct Curl_easy *data, struct connectdata *conn,
-                        curl_socket_t *sock);
+static CURLcode mqtt_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps);
 static CURLcode mqtt_setup_conn(struct Curl_easy *data,
                                 struct connectdata *conn);
 
@@ -125,10 +125,10 @@ const struct Curl_handler Curl_handler_mqtt = {
   ZERO_NULL,                          /* connect_it */
   ZERO_NULL,                          /* connecting */
   mqtt_doing,                         /* doing */
-  ZERO_NULL,                          /* proto_getsock */
-  mqtt_getsock,                       /* doing_getsock */
-  ZERO_NULL,                          /* domore_getsock */
-  ZERO_NULL,                          /* perform_getsock */
+  ZERO_NULL,                          /* proto_pollset */
+  mqtt_pollset,                       /* doing_pollset */
+  ZERO_NULL,                          /* domore_pollset */
+  ZERO_NULL,                          /* perform_pollset */
   ZERO_NULL,                          /* disconnect */
   ZERO_NULL,                          /* write_resp */
   ZERO_NULL,                          /* write_resp_hd */
@@ -213,13 +213,10 @@ static CURLcode mqtt_send(struct Curl_easy *data,
 /* Generic function called by the multi interface to figure out what socket(s)
    to wait for and for what actions during the DOING and PROTOCONNECT
    states */
-static int mqtt_getsock(struct Curl_easy *data,
-                        struct connectdata *conn,
-                        curl_socket_t *sock)
+static CURLcode mqtt_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
 {
-  (void)data;
-  sock[0] = conn->sock[FIRSTSOCKET];
-  return GETSOCK_READSOCK(FIRSTSOCKET);
+  return Curl_pollset_add_in(data, ps, data->conn->sock[FIRSTSOCKET]);
 }
 
 static int mqtt_encode_len(char *buf, size_t len)
diff --git a/deps/curl/lib/multi.c b/deps/curl/lib/multi.c
index b3a7938e33f..918928d03cc 100644
--- a/deps/curl/lib/multi.c
+++ b/deps/curl/lib/multi.c
@@ -465,22 +465,6 @@ CURLMcode curl_multi_add_handle(CURLM *m, CURL *d)
      is called. */
   data->multi = multi;
 
-  /* Set the timeout for this handle to expire really soon so that it will
-     be taken care of even when this handle is added in the midst of operation
-     when only the curl_multi_socket() API is used. During that flow, only
-     sockets that time-out or have actions will be dealt with. Since this
-     handle has no action yet, we make sure it times out to get things to
-     happen. */
-  Curl_expire(data, 0, EXPIRE_RUN_NOW);
-
-  rc = Curl_update_timer(multi);
-  if(rc) {
-    data->multi = NULL; /* not anymore */
-    Curl_uint_tbl_remove(&multi->xfers, data->mid);
-    data->mid = UINT_MAX;
-    return rc;
-  }
-
   /* set the easy handle */
   multistate(data, MSTATE_INIT);
 
@@ -495,10 +479,23 @@ CURLMcode curl_multi_add_handle(CURLM *m, CURL *d)
   /* add the easy handle to the process set */
   Curl_uint_bset_add(&multi->process, data->mid);
   ++multi->xfers_alive;
+  ++multi->xfers_total_ever;
 
   Curl_cpool_xfer_init(data);
   multi_warn_debug(multi, data);
 
+  /* Make sure the new handle will run */
+  Curl_multi_mark_dirty(data);
+  /* Necessary in event based processing, where dirty handles trigger
+   * a timeout callback invocation. */
+  rc = Curl_update_timer(multi);
+  if(rc) {
+    data->multi = NULL; /* not anymore */
+    Curl_uint_tbl_remove(&multi->xfers, data->mid);
+    data->mid = UINT_MAX;
+    return rc;
+  }
+
   /* The admin handle only ever has default timeouts set. To improve the
      state somewhat we clone the timeouts from each added handle so that the
      admin handle always has the same timeouts as the most recently added
@@ -539,6 +536,22 @@ static void multi_done_locked(struct connectdata *conn,
                               void *userdata)
 {
   struct multi_done_ctx *mdctx = userdata;
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+  const char *host =
+#ifndef CURL_DISABLE_PROXY
+        conn->bits.socksproxy ?
+        conn->socks_proxy.host.dispname :
+        conn->bits.httpproxy ? conn->http_proxy.host.dispname :
+#endif
+        conn->bits.conn_to_host ? conn->conn_to_host.dispname :
+        conn->host.dispname;
+  int port =
+#ifndef CURL_DISABLE_PROXY
+        conn->bits.httpproxy ? conn->http_proxy.port :
+#endif
+        conn->bits.conn_to_port ? conn->conn_to_port :
+        conn->remote_port;
+#endif
 
   Curl_detach_connection(data);
 
@@ -574,40 +587,43 @@ static void multi_done_locked(struct connectdata *conn,
   */
 
   if((data->set.reuse_forbid
-#if defined(USE_NTLM)
+#ifdef USE_NTLM
       && !(conn->http_ntlm_state == NTLMSTATE_TYPE2 ||
            conn->proxy_ntlm_state == NTLMSTATE_TYPE2)
 #endif
-#if defined(USE_SPNEGO)
+#ifdef USE_SPNEGO
       && !(conn->http_negotiate_state == GSS_AUTHRECV ||
            conn->proxy_negotiate_state == GSS_AUTHRECV)
 #endif
      ) || conn->bits.close
        || (mdctx->premature && !Curl_conn_is_multiplex(conn, FIRSTSOCKET))) {
-    CURL_TRC_M(data, "multi_done, not reusing connection=%"
-                     FMT_OFF_T ", forbid=%d"
-                     ", close=%d, premature=%d, conn_multiplex=%d",
-                     conn->connection_id, data->set.reuse_forbid,
-                     conn->bits.close, mdctx->premature,
-                     Curl_conn_is_multiplex(conn, FIRSTSOCKET));
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+    CURL_TRC_M(data, "multi_done, terminating conn #%" FMT_OFF_T " to %s:%d, "
+               "forbid=%d, close=%d, premature=%d, conn_multiplex=%d",
+               conn->connection_id, host, port, data->set.reuse_forbid,
+               conn->bits.close, mdctx->premature,
+               Curl_conn_is_multiplex(conn, FIRSTSOCKET));
+#endif
     connclose(conn, "disconnecting");
     Curl_conn_terminate(data, conn, mdctx->premature);
   }
+  else if(!Curl_conn_get_max_concurrent(data, conn, FIRSTSOCKET)) {
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+    CURL_TRC_M(data, "multi_done, conn #%" FMT_OFF_T " to %s:%d was shutdown"
+               " by server, not reusing", conn->connection_id, host, port);
+#endif
+    connclose(conn, "server shutdown");
+    Curl_conn_terminate(data, conn, mdctx->premature);
+  }
   else {
     /* the connection is no longer in use by any transfer */
     if(Curl_cpool_conn_now_idle(data, conn)) {
       /* connection kept in the cpool */
-      const char *host =
-#ifndef CURL_DISABLE_PROXY
-        conn->bits.socksproxy ?
-        conn->socks_proxy.host.dispname :
-        conn->bits.httpproxy ? conn->http_proxy.host.dispname :
-#endif
-        conn->bits.conn_to_host ? conn->conn_to_host.dispname :
-        conn->host.dispname;
       data->state.lastconnect_id = conn->connection_id;
-      infof(data, "Connection #%" FMT_OFF_T " to host %s left intact",
-            conn->connection_id, host);
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+      infof(data, "Connection #%" FMT_OFF_T " to host %s:%d left intact",
+            conn->connection_id, host, port);
+#endif
     }
     else {
       /* connection was removed from the cpool and destroyed. */
@@ -892,118 +908,105 @@ void Curl_attach_connection(struct Curl_easy *data,
     conn->handler->attach(data, conn);
 }
 
-static int connecting_getsock(struct Curl_easy *data, curl_socket_t *socks)
+static CURLcode mstate_connecting_pollset(struct Curl_easy *data,
+                                          struct easy_pollset *ps)
 {
-  struct connectdata *conn = data->conn;
-  curl_socket_t sockfd;
-
-  if(!conn)
-    return GETSOCK_BLANK;
-  sockfd = Curl_conn_get_socket(data, FIRSTSOCKET);
-  if(sockfd != CURL_SOCKET_BAD) {
-    /* Default is to wait to something from the server */
-    socks[0] = sockfd;
-    return GETSOCK_READSOCK(0);
+  if(data->conn) {
+    curl_socket_t sockfd = Curl_conn_get_first_socket(data);
+    if(sockfd != CURL_SOCKET_BAD) {
+      /* Default is to wait to something from the server */
+      return Curl_pollset_change(data, ps, sockfd, CURL_POLL_IN, 0);
+    }
   }
-  return GETSOCK_BLANK;
+  return CURLE_OK;
 }
 
-static int protocol_getsock(struct Curl_easy *data, curl_socket_t *socks)
+static CURLcode mstate_protocol_pollset(struct Curl_easy *data,
+                                        struct easy_pollset *ps)
 {
-  struct connectdata *conn = data->conn;
-  curl_socket_t sockfd;
-
-  if(!conn)
-    return GETSOCK_BLANK;
-  if(conn->handler->proto_getsock)
-    return conn->handler->proto_getsock(data, conn, socks);
-  sockfd = Curl_conn_get_socket(data, FIRSTSOCKET);
-  if(sockfd != CURL_SOCKET_BAD) {
-    /* Default is to wait to something from the server */
-    socks[0] = sockfd;
-    return GETSOCK_READSOCK(0);
+  if(data->conn) {
+    curl_socket_t sockfd;
+    if(data->conn->handler->proto_pollset)
+      return data->conn->handler->proto_pollset(data, ps);
+    sockfd = data->conn->sock[FIRSTSOCKET];
+    if(sockfd != CURL_SOCKET_BAD) {
+      /* Default is to wait to something from the server */
+      return Curl_pollset_change(data, ps, sockfd, CURL_POLL_IN, 0);
+    }
   }
-  return GETSOCK_BLANK;
+  return CURLE_OK;
 }
 
-static int domore_getsock(struct Curl_easy *data, curl_socket_t *socks)
+static CURLcode mstate_do_pollset(struct Curl_easy *data,
+                                  struct easy_pollset *ps)
 {
-  struct connectdata *conn = data->conn;
-  if(!conn)
-    return GETSOCK_BLANK;
-  if(conn->handler->domore_getsock)
-    return conn->handler->domore_getsock(data, conn, socks);
-  else if(conn->sockfd != CURL_SOCKET_BAD) {
-    /* Default is that we want to send something to the server */
-    socks[0] = conn->sockfd;
-    return GETSOCK_WRITESOCK(0);
+  if(data->conn) {
+    if(data->conn->handler->doing_pollset)
+      return data->conn->handler->doing_pollset(data, ps);
+    else if(CONN_SOCK_IDX_VALID(data->conn->send_idx)) {
+      /* Default is that we want to send something to the server */
+      return Curl_pollset_add_out(
+        data, ps, data->conn->sock[data->conn->send_idx]);
+    }
   }
-  return GETSOCK_BLANK;
+  return CURLE_OK;
 }
 
-static int doing_getsock(struct Curl_easy *data, curl_socket_t *socks)
+static CURLcode mstate_domore_pollset(struct Curl_easy *data,
+                                      struct easy_pollset *ps)
 {
-  struct connectdata *conn = data->conn;
-  if(!conn)
-    return GETSOCK_BLANK;
-  if(conn->handler->doing_getsock)
-    return conn->handler->doing_getsock(data, conn, socks);
-  else if(conn->sockfd != CURL_SOCKET_BAD) {
-    /* Default is that we want to send something to the server */
-    socks[0] = conn->sockfd;
-    return GETSOCK_WRITESOCK(0);
+  if(data->conn) {
+    if(data->conn->handler->domore_pollset)
+      return data->conn->handler->domore_pollset(data, ps);
+    else if(CONN_SOCK_IDX_VALID(data->conn->send_idx)) {
+      /* Default is that we want to send something to the server */
+      return Curl_pollset_add_out(
+        data, ps, data->conn->sock[data->conn->send_idx]);
+    }
   }
-  return GETSOCK_BLANK;
+  return CURLE_OK;
 }
 
-static int perform_getsock(struct Curl_easy *data, curl_socket_t *sock)
+static CURLcode mstate_perform_pollset(struct Curl_easy *data,
+                                       struct easy_pollset *ps)
 {
-  struct connectdata *conn = data->conn;
-  if(!conn)
-    return GETSOCK_BLANK;
-  else if(conn->handler->perform_getsock)
-    return conn->handler->perform_getsock(data, conn, sock);
+  if(!data->conn)
+    return CURLE_OK;
+  else if(data->conn->handler->perform_pollset)
+    return data->conn->handler->perform_pollset(data, ps);
   else {
     /* Default is to obey the data->req.keepon flags for send/recv */
-    int bitmap = GETSOCK_BLANK;
-    unsigned sockindex = 0;
-    if(CURL_WANT_RECV(data)) {
-      DEBUGASSERT(conn->sockfd != CURL_SOCKET_BAD);
-      bitmap |= GETSOCK_READSOCK(sockindex);
-      sock[sockindex] = conn->sockfd;
-    }
-
-    if(Curl_req_want_send(data)) {
-      if((conn->sockfd != conn->writesockfd) ||
-         bitmap == GETSOCK_BLANK) {
-        /* only if they are not the same socket and we have a readable
-           one, we increase index */
-        if(bitmap != GETSOCK_BLANK)
-          sockindex++; /* increase index if we need two entries */
-
-        DEBUGASSERT(conn->writesockfd != CURL_SOCKET_BAD);
-        sock[sockindex] = conn->writesockfd;
-      }
-      bitmap |= GETSOCK_WRITESOCK(sockindex);
+    CURLcode result = CURLE_OK;
+    if(CURL_WANT_RECV(data) && CONN_SOCK_IDX_VALID(data->conn->recv_idx)) {
+      result = Curl_pollset_add_in(
+        data, ps, data->conn->sock[data->conn->recv_idx]);
+    }
+
+    if(!result && Curl_req_want_send(data) &&
+       CONN_SOCK_IDX_VALID(data->conn->send_idx)) {
+      result = Curl_pollset_add_out(
+        data, ps, data->conn->sock[data->conn->send_idx]);
     }
-    return bitmap;
+    return result;
   }
 }
 
 /* Initializes `poll_set` with the current socket poll actions needed
  * for transfer `data`. */
-void Curl_multi_getsock(struct Curl_easy *data,
-                        struct easy_pollset *ps,
-                        const char *caller)
+CURLMcode Curl_multi_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps,
+                             const char *caller)
 {
+  CURLMcode mresult = CURLM_OK;
+  CURLcode result = CURLE_OK;
   bool expect_sockets = TRUE;
 
   /* If the transfer has no connection, this is fine. Happens when
      called via curl_multi_remove_handle() => Curl_multi_ev_assess() =>
-     Curl_multi_getsock(). */
-  Curl_pollset_reset(data, ps);
+     Curl_multi_pollset(). */
+  Curl_pollset_reset(ps);
   if(!data->conn)
-    return;
+    return CURLM_OK;
 
   switch(data->mstate) {
   case MSTATE_INIT:
@@ -1015,7 +1018,7 @@ void Curl_multi_getsock(struct Curl_easy *data,
     break;
 
   case MSTATE_RESOLVING:
-    Curl_pollset_add_socks(data, ps, Curl_resolv_getsock);
+    result = Curl_resolv_pollset(data, ps);
     /* connection filters are not involved in this phase. It's ok if we get no
      * sockets to wait for. Resolving can wake up from other sources. */
     expect_sockets = FALSE;
@@ -1023,31 +1026,40 @@ void Curl_multi_getsock(struct Curl_easy *data,
 
   case MSTATE_CONNECTING:
   case MSTATE_TUNNELING:
-    Curl_pollset_add_socks(data, ps, connecting_getsock);
-    Curl_conn_adjust_pollset(data, data->conn, ps);
+    if(!Curl_xfer_recv_is_paused(data)) {
+      result = mstate_connecting_pollset(data, ps);
+      if(!result)
+        result = Curl_conn_adjust_pollset(data, data->conn, ps);
+    }
+    else
+      expect_sockets = FALSE;
     break;
 
   case MSTATE_PROTOCONNECT:
   case MSTATE_PROTOCONNECTING:
-    Curl_pollset_add_socks(data, ps, protocol_getsock);
-    Curl_conn_adjust_pollset(data, data->conn, ps);
+    result = mstate_protocol_pollset(data, ps);
+    if(!result)
+      result = Curl_conn_adjust_pollset(data, data->conn, ps);
     break;
 
   case MSTATE_DO:
   case MSTATE_DOING:
-    Curl_pollset_add_socks(data, ps, doing_getsock);
-    Curl_conn_adjust_pollset(data, data->conn, ps);
+    result = mstate_do_pollset(data, ps);
+    if(!result)
+      result = Curl_conn_adjust_pollset(data, data->conn, ps);
     break;
 
   case MSTATE_DOING_MORE:
-    Curl_pollset_add_socks(data, ps, domore_getsock);
-    Curl_conn_adjust_pollset(data, data->conn, ps);
+    result = mstate_domore_pollset(data, ps);
+    if(!result)
+      result = Curl_conn_adjust_pollset(data, data->conn, ps);
     break;
 
   case MSTATE_DID: /* same as PERFORMING in regard to polling */
   case MSTATE_PERFORMING:
-    Curl_pollset_add_socks(data, ps, perform_getsock);
-    Curl_conn_adjust_pollset(data, data->conn, ps);
+    result = mstate_perform_pollset(data, ps);
+    if(!result)
+      result = Curl_conn_adjust_pollset(data, data->conn, ps);
     break;
 
   case MSTATE_RATELIMITING:
@@ -1069,10 +1081,19 @@ void Curl_multi_getsock(struct Curl_easy *data,
     break;
   }
 
+  if(result) {
+    if(result == CURLE_OUT_OF_MEMORY)
+      mresult = CURLM_OUT_OF_MEMORY;
+    else {
+      failf(data, "error determining pollset: %d", result);
+      mresult = CURLM_INTERNAL_ERROR;
+    }
+    goto out;
+  }
 
   /* Unblocked and waiting to receive with buffered input.
    * Make transfer run again at next opportunity. */
-  if(!Curl_xfer_is_blocked(data) &&
+  if(!Curl_xfer_is_blocked(data) && !Curl_xfer_is_too_fast(data) &&
      ((Curl_pollset_want_read(data, ps, data->conn->sock[FIRSTSOCKET]) &&
        Curl_conn_data_pending(data, FIRSTSOCKET)) ||
       (Curl_pollset_want_read(data, ps, data->conn->sock[SECONDARYSOCKET]) &&
@@ -1082,47 +1103,56 @@ void Curl_multi_getsock(struct Curl_easy *data,
     Curl_multi_mark_dirty(data);
   }
 
-  switch(ps->num) {
-    case 0:
-      CURL_TRC_M(data, "%s pollset[], timeouts=%zu, paused %d/%d (r/w)",
-                 caller, Curl_llist_count(&data->state.timeoutlist),
-                 Curl_xfer_send_is_paused(data),
-                 Curl_xfer_recv_is_paused(data));
-      break;
-    case 1:
-      CURL_TRC_M(data, "%s pollset[fd=%" FMT_SOCKET_T " %s%s], timeouts=%zu",
-                 caller, ps->sockets[0],
-                 (ps->actions[0] & CURL_POLL_IN) ? "IN" : "",
-                 (ps->actions[0] & CURL_POLL_OUT) ? "OUT" : "",
-                 Curl_llist_count(&data->state.timeoutlist));
-      break;
-    case 2:
-      CURL_TRC_M(data, "%s pollset[fd=%" FMT_SOCKET_T " %s%s, "
-                 "fd=%" FMT_SOCKET_T " %s%s], timeouts=%zu",
-                 caller, ps->sockets[0],
-                 (ps->actions[0] & CURL_POLL_IN) ? "IN" : "",
-                 (ps->actions[0] & CURL_POLL_OUT) ? "OUT" : "",
-                 ps->sockets[1],
-                 (ps->actions[1] & CURL_POLL_IN) ? "IN" : "",
-                 (ps->actions[1] & CURL_POLL_OUT) ? "OUT" : "",
-                 Curl_llist_count(&data->state.timeoutlist));
-      break;
-    default:
-      CURL_TRC_M(data, "%s pollset[fds=%u], timeouts=%zu",
-                 caller, ps->num, Curl_llist_count(&data->state.timeoutlist));
-      break;
+  if(CURL_TRC_M_is_verbose(data)) {
+    size_t timeout_count = Curl_llist_count(&data->state.timeoutlist);
+    switch(ps->n) {
+      case 0:
+        CURL_TRC_M(data, "%s pollset[], timeouts=%zu, paused %d/%d (r/w)",
+                   caller, timeout_count,
+                   Curl_xfer_send_is_paused(data),
+                   Curl_xfer_recv_is_paused(data));
+        break;
+      case 1:
+        CURL_TRC_M(data, "%s pollset[fd=%" FMT_SOCKET_T " %s%s], timeouts=%zu",
+                   caller, ps->sockets[0],
+                   (ps->actions[0] & CURL_POLL_IN) ? "IN" : "",
+                   (ps->actions[0] & CURL_POLL_OUT) ? "OUT" : "",
+                   timeout_count);
+        break;
+      case 2:
+        CURL_TRC_M(data, "%s pollset[fd=%" FMT_SOCKET_T " %s%s, "
+                   "fd=%" FMT_SOCKET_T " %s%s], timeouts=%zu",
+                   caller, ps->sockets[0],
+                   (ps->actions[0] & CURL_POLL_IN) ? "IN" : "",
+                   (ps->actions[0] & CURL_POLL_OUT) ? "OUT" : "",
+                   ps->sockets[1],
+                   (ps->actions[1] & CURL_POLL_IN) ? "IN" : "",
+                   (ps->actions[1] & CURL_POLL_OUT) ? "OUT" : "",
+                   timeout_count);
+        break;
+      default:
+        CURL_TRC_M(data, "%s pollset[fds=%u], timeouts=%zu",
+                   caller, ps->n, timeout_count);
+        break;
+    }
+    CURL_TRC_M_TIMEOUTS(data);
   }
-  if(expect_sockets && !ps->num &&
+
+  if(expect_sockets && !ps->n && data->multi &&
+     !Curl_uint_bset_contains(&data->multi->dirty, data->mid) &&
      !Curl_llist_count(&data->state.timeoutlist) &&
      !Curl_cwriter_is_paused(data) && !Curl_creader_is_paused(data) &&
      Curl_conn_is_ip_connected(data, FIRSTSOCKET)) {
     /* We expected sockets for POLL monitoring, but none are set.
+     * We are not dirty (and run anyway).
      * We are not waiting on any timer.
      * None of the READ/WRITE directions are paused.
      * We are connected to the server on IP level, at least. */
     infof(data, "WARNING: no socket in pollset or timer, transfer may stall!");
     DEBUGASSERT(0);
   }
+out:
+  return mresult;
 }
 
 CURLMcode curl_multi_fdset(CURLM *m,
@@ -1134,8 +1164,9 @@ CURLMcode curl_multi_fdset(CURLM *m,
      and then we must make sure that is done. */
   int this_max_fd = -1;
   struct Curl_multi *multi = m;
+  struct easy_pollset ps;
   unsigned int i, mid;
-  (void)exc_fd_set; /* not used */
+  (void)exc_fd_set;
 
   if(!GOOD_MULTI_HANDLE(multi))
     return CURLM_BAD_HANDLE;
@@ -1143,22 +1174,22 @@ CURLMcode curl_multi_fdset(CURLM *m,
   if(multi->in_callback)
     return CURLM_RECURSIVE_API_CALL;
 
+  Curl_pollset_init(&ps);
   if(Curl_uint_bset_first(&multi->process, &mid)) {
     do {
       struct Curl_easy *data = Curl_multi_get_easy(multi, mid);
-      struct easy_pollset ps;
 
       if(!data) {
         DEBUGASSERT(0);
         continue;
       }
 
-      Curl_multi_getsock(data, &ps, "curl_multi_fdset");
-      for(i = 0; i < ps.num; i++) {
+      Curl_multi_pollset(data, &ps, "curl_multi_fdset");
+      for(i = 0; i < ps.n; i++) {
         if(!FDSET_SOCK(ps.sockets[i]))
           /* pretend it does not exist */
           continue;
-#if defined(__DJGPP__)
+#ifdef __DJGPP__
 #pragma GCC diagnostic push
 #pragma GCC diagnostic ignored "-Warith-conversion"
 #endif
@@ -1166,7 +1197,7 @@ CURLMcode curl_multi_fdset(CURLM *m,
           FD_SET(ps.sockets[i], read_fd_set);
         if(ps.actions[i] & CURL_POLL_OUT)
           FD_SET(ps.sockets[i], write_fd_set);
-#if defined(__DJGPP__)
+#ifdef __DJGPP__
 #pragma GCC diagnostic pop
 #endif
         if((int)ps.sockets[i] > this_max_fd)
@@ -1180,6 +1211,7 @@ CURLMcode curl_multi_fdset(CURLM *m,
                       read_fd_set, write_fd_set, &this_max_fd);
 
   *max_fd = this_max_fd;
+  Curl_pollset_cleanup(&ps);
 
   return CURLM_OK;
 }
@@ -1192,6 +1224,7 @@ CURLMcode curl_multi_waitfds(CURLM *m,
   struct Curl_waitfds cwfds;
   CURLMcode result = CURLM_OK;
   struct Curl_multi *multi = m;
+  struct easy_pollset ps;
   unsigned int need = 0, mid;
 
   if(!ufds && (size || !fd_count))
@@ -1203,18 +1236,18 @@ CURLMcode curl_multi_waitfds(CURLM *m,
   if(multi->in_callback)
     return CURLM_RECURSIVE_API_CALL;
 
+  Curl_pollset_init(&ps);
   Curl_waitfds_init(&cwfds, ufds, size);
   if(Curl_uint_bset_first(&multi->process, &mid)) {
     do {
       struct Curl_easy *data = Curl_multi_get_easy(multi, mid);
-      struct easy_pollset ps;
       if(!data) {
         DEBUGASSERT(0);
         Curl_uint_bset_remove(&multi->process, mid);
         Curl_uint_bset_remove(&multi->dirty, mid);
         continue;
       }
-      Curl_multi_getsock(data, &ps, "curl_multi_waitfds");
+      Curl_multi_pollset(data, &ps, "curl_multi_waitfds");
       need += Curl_waitfds_add_ps(&cwfds, &ps);
     }
     while(Curl_uint_bset_next(&multi->process, mid, &mid));
@@ -1228,6 +1261,7 @@ CURLMcode curl_multi_waitfds(CURLM *m,
 
   if(fd_count)
     *fd_count = need;
+  Curl_pollset_cleanup(&ps);
   return result;
 }
 
@@ -1261,6 +1295,7 @@ static CURLMcode multi_wait(struct Curl_multi *multi,
   struct curltime expire_time;
   long timeout_internal;
   int retcode = 0;
+  struct easy_pollset ps;
   struct pollfd a_few_on_stack[NUM_POLLS_ON_STACK];
   struct curl_pollfds cpfds;
   unsigned int curl_nfds = 0; /* how many pfds are for curl transfers */
@@ -1285,12 +1320,12 @@ static CURLMcode multi_wait(struct Curl_multi *multi,
   if(timeout_ms < 0)
     return CURLM_BAD_FUNCTION_ARGUMENT;
 
+  Curl_pollset_init(&ps);
   Curl_pollfds_init(&cpfds, a_few_on_stack, NUM_POLLS_ON_STACK);
 
   /* Add the curl handles to our pollfds first */
   if(Curl_uint_bset_first(&multi->process, &mid)) {
     do {
-      struct easy_pollset ps;
       data = Curl_multi_get_easy(multi, mid);
       if(!data) {
         DEBUGASSERT(0);
@@ -1298,7 +1333,7 @@ static CURLMcode multi_wait(struct Curl_multi *multi,
         Curl_uint_bset_remove(&multi->dirty, mid);
         continue;
       }
-      Curl_multi_getsock(data, &ps, "multi_wait");
+      Curl_multi_pollset(data, &ps, "multi_wait");
       if(Curl_pollfds_add_ps(&cpfds, &ps)) {
         result = CURLM_OUT_OF_MEMORY;
         goto out;
@@ -1497,6 +1532,7 @@ static CURLMcode multi_wait(struct Curl_multi *multi,
   }
 
 out:
+  Curl_pollset_cleanup(&ps);
   Curl_pollfds_cleanup(&cpfds);
   return result;
 }
@@ -1829,7 +1865,7 @@ static void multi_posttransfer(struct Curl_easy *data)
   if(!data->set.no_signal)
     signal(SIGPIPE, data->state.prev_signal);
 #else
-  (void)data; /* unused parameter */
+  (void)data;
 #endif
 }
 
@@ -1849,6 +1885,40 @@ static CURLcode multi_follow(struct Curl_easy *data,
   return CURLE_TOO_MANY_REDIRECTS;
 }
 
+static CURLcode mspeed_check(struct Curl_easy *data,
+                             struct curltime *nowp)
+{
+  timediff_t recv_wait_ms = 0;
+  timediff_t send_wait_ms = 0;
+
+  /* check if over send speed */
+  if(data->set.max_send_speed)
+    send_wait_ms = Curl_pgrsLimitWaitTime(&data->progress.ul,
+                                          data->set.max_send_speed,
+                                          *nowp);
+
+  /* check if over recv speed */
+  if(data->set.max_recv_speed)
+    recv_wait_ms = Curl_pgrsLimitWaitTime(&data->progress.dl,
+                                          data->set.max_recv_speed,
+                                          *nowp);
+
+  if(send_wait_ms || recv_wait_ms) {
+    if(data->mstate != MSTATE_RATELIMITING) {
+      Curl_ratelimit(data, *nowp);
+      multistate(data, MSTATE_RATELIMITING);
+    }
+    Curl_expire(data, CURLMAX(send_wait_ms, recv_wait_ms), EXPIRE_TOOFAST);
+    Curl_multi_clear_dirty(data);
+    return CURLE_AGAIN;
+  }
+  else if(data->mstate != MSTATE_PERFORMING) {
+    multistate(data, MSTATE_PERFORMING);
+    Curl_ratelimit(data, *nowp);
+  }
+  return CURLE_OK;
+}
+
 static CURLMcode state_performing(struct Curl_easy *data,
                                   struct curltime *nowp,
                                   bool *stream_errorp,
@@ -1856,33 +1926,12 @@ static CURLMcode state_performing(struct Curl_easy *data,
 {
   char *newurl = NULL;
   bool retry = FALSE;
-  timediff_t recv_timeout_ms = 0;
-  timediff_t send_timeout_ms = 0;
   CURLMcode rc = CURLM_OK;
   CURLcode result = *resultp = CURLE_OK;
   *stream_errorp = FALSE;
 
-  /* check if over send speed */
-  if(data->set.max_send_speed)
-    send_timeout_ms = Curl_pgrsLimitWaitTime(&data->progress.ul,
-                                             data->set.max_send_speed,
-                                             *nowp);
-
-  /* check if over recv speed */
-  if(data->set.max_recv_speed)
-    recv_timeout_ms = Curl_pgrsLimitWaitTime(&data->progress.dl,
-                                             data->set.max_recv_speed,
-                                             *nowp);
-
-  if(send_timeout_ms || recv_timeout_ms) {
-    Curl_ratelimit(data, *nowp);
-    multistate(data, MSTATE_RATELIMITING);
-    if(send_timeout_ms >= recv_timeout_ms)
-      Curl_expire(data, send_timeout_ms, EXPIRE_TOOFAST);
-    else
-      Curl_expire(data, recv_timeout_ms, EXPIRE_TOOFAST);
+  if(mspeed_check(data, nowp) == CURLE_AGAIN)
     return CURLM_OK;
-  }
 
   /* read/write data if it is ready to do so */
   result = Curl_sendrecv(data, nowp);
@@ -1997,6 +2046,9 @@ static CURLMcode state_performing(struct Curl_easy *data,
       }
     }
   }
+  else { /* not errored, not done */
+    mspeed_check(data, nowp);
+  }
   free(newurl);
   *resultp = result;
   return rc;
@@ -2164,30 +2216,8 @@ static CURLMcode state_ratelimiting(struct Curl_easy *data,
     multi_done(data, result, TRUE);
   }
   else {
-    timediff_t recv_timeout_ms = 0;
-    timediff_t send_timeout_ms = 0;
-    if(data->set.max_send_speed)
-      send_timeout_ms =
-        Curl_pgrsLimitWaitTime(&data->progress.ul,
-                               data->set.max_send_speed,
-                               *nowp);
-
-    if(data->set.max_recv_speed)
-      recv_timeout_ms =
-        Curl_pgrsLimitWaitTime(&data->progress.dl,
-                               data->set.max_recv_speed,
-                               *nowp);
-
-    if(!send_timeout_ms && !recv_timeout_ms) {
-      multistate(data, MSTATE_PERFORMING);
-      Curl_ratelimit(data, *nowp);
-      /* start performing again right away */
+    if(!mspeed_check(data, nowp))
       rc = CURLM_CALL_MULTI_PERFORM;
-    }
-    else if(send_timeout_ms >= recv_timeout_ms)
-      Curl_expire(data, send_timeout_ms, EXPIRE_TOOFAST);
-    else
-      Curl_expire(data, recv_timeout_ms, EXPIRE_TOOFAST);
   }
   *resultp = result;
   return rc;
@@ -2407,22 +2437,24 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
     case MSTATE_CONNECTING:
       /* awaiting a completion of an asynch TCP connect */
       DEBUGASSERT(data->conn);
-      result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &connected);
-      if(connected && !result) {
-        if(!data->conn->bits.reuse &&
-           Curl_conn_is_multiplex(data->conn, FIRSTSOCKET)) {
-          /* new connection, can multiplex, wake pending handles */
-          process_pending_handles(data->multi);
+      if(!Curl_xfer_recv_is_paused(data)) {
+        result = Curl_conn_connect(data, FIRSTSOCKET, FALSE, &connected);
+        if(connected && !result) {
+          if(!data->conn->bits.reuse &&
+             Curl_conn_is_multiplex(data->conn, FIRSTSOCKET)) {
+            /* new connection, can multiplex, wake pending handles */
+            process_pending_handles(data->multi);
+          }
+          rc = CURLM_CALL_MULTI_PERFORM;
+          multistate(data, MSTATE_PROTOCONNECT);
+        }
+        else if(result) {
+          /* failure detected */
+          multi_posttransfer(data);
+          multi_done(data, result, TRUE);
+          stream_error = TRUE;
+          break;
         }
-        rc = CURLM_CALL_MULTI_PERFORM;
-        multistate(data, MSTATE_PROTOCONNECT);
-      }
-      else if(result) {
-        /* failure detected */
-        multi_posttransfer(data);
-        multi_done(data, result, TRUE);
-        stream_error = TRUE;
-        break;
       }
       break;
 
@@ -2530,8 +2562,8 @@ static CURLMcode multi_runsingle(struct Curl_multi *multi,
 
       /* Only perform the transfer if there is a good socket to work with.
          Having both BAD is a signal to skip immediately to DONE */
-      if((data->conn->sockfd != CURL_SOCKET_BAD) ||
-         (data->conn->writesockfd != CURL_SOCKET_BAD))
+      if(CONN_SOCK_IDX_VALID(data->conn->recv_idx) ||
+         CONN_SOCK_IDX_VALID(data->conn->send_idx))
         multistate(data, MSTATE_PERFORMING);
       else {
 #ifndef CURL_DISABLE_FTP
@@ -2766,6 +2798,7 @@ CURLMcode curl_multi_perform(CURLM *m, int *running_handles)
     if(t) {
       /* the removed may have another timeout in queue */
       struct Curl_easy *data = Curl_splayget(t);
+      (void)add_next_timeout(now, multi, data);
       if(data->mstate == MSTATE_PENDING) {
         bool stream_unused;
         CURLcode result_unused;
@@ -2774,7 +2807,6 @@ CURLMcode curl_multi_perform(CURLM *m, int *running_handles)
           move_pending_to_connect(multi, data);
         }
       }
-      (void)add_next_timeout(now, multi, Curl_splayget(t));
     }
   } while(t);
 
@@ -3217,6 +3249,16 @@ CURLMcode curl_multi_setopt(CURLM *m,
       multi->max_concurrent_streams = (unsigned int)streams;
     }
     break;
+  case CURLMOPT_NETWORK_CHANGED: {
+    long val = va_arg(param, long);
+    if(val & CURLMNWC_CLEAR_DNS) {
+      Curl_dnscache_clear(multi->admin);
+    }
+    if(val & CURLMNWC_CLEAR_CONNS) {
+      Curl_cpool_nw_changed(multi->admin);
+    }
+    break;
+  }
   default:
     res = CURLM_UNKNOWN_OPTION;
     break;
@@ -3541,8 +3583,8 @@ void Curl_expire_ex(struct Curl_easy *data,
   multi->timetree = Curl_splayinsert(*curr_expire, multi->timetree,
                                      &data->state.timenode);
   if(data->id >= 0)
-    CURL_TRC_M(data, "set expire[%d] in %" FMT_TIMEDIFF_T "ns",
-               id, curlx_timediff_us(set, *nowp));
+    CURL_TRC_M(data, "[TIMEOUT] set %s to expire in %" FMT_TIMEDIFF_T "ns",
+               CURL_TIMER_NAME(id), curlx_timediff_us(set, *nowp));
 }
 
 /*
@@ -3572,6 +3614,8 @@ void Curl_expire_done(struct Curl_easy *data, expire_id id)
 {
   /* remove the timer, if there */
   multi_deltimeout(data, id);
+  if(data->id >= 0)
+    CURL_TRC_M(data, "[TIMEOUT] cleared %s", CURL_TIMER_NAME(id));
 }
 
 /*
@@ -3603,7 +3647,8 @@ bool Curl_expire_clear(struct Curl_easy *data)
     /* clear the timeout list too */
     Curl_llist_destroy(list, NULL);
 
-    CURL_TRC_M(data, "Expire cleared");
+    if(data->id >= 0)
+      CURL_TRC_M(data, "[TIMEOUT] all cleared");
     nowp->tv_sec = 0;
     nowp->tv_usec = 0;
     return TRUE;
@@ -3631,9 +3676,7 @@ static void move_pending_to_connect(struct Curl_multi *multi,
   Curl_uint_bset_add(&multi->process, data->mid);
 
   multistate(data, MSTATE_CONNECT);
-
-  /* Make sure that the handle will be processed soonish. */
-  Curl_expire(data, 0, EXPIRE_RUN_NOW);
+  Curl_multi_mark_dirty(data); /* make it run */
 }
 
 /* process_pending_handles() moves a handle from PENDING back into the process
@@ -3656,9 +3699,13 @@ static void process_pending_handles(struct Curl_multi *multi)
   if(Curl_uint_bset_first(&multi->pending, &mid)) {
     do {
       struct Curl_easy *data = Curl_multi_get_easy(multi, mid);
-      DEBUGASSERT(data);
-      if(data)
+      if(data) {
         move_pending_to_connect(multi, data);
+        break;
+      }
+      /* transfer no longer known, should not happen */
+      Curl_uint_bset_remove(&multi->pending, mid);
+      DEBUGASSERT(0);
     }
     while(Curl_uint_bset_next(&multi->pending, mid, &mid));
   }
@@ -3704,6 +3751,43 @@ CURL **curl_multi_get_handles(CURLM *m)
   return a;
 }
 
+CURLMcode curl_multi_get_offt(CURLM *m,
+                              CURLMinfo_offt info,
+                              curl_off_t *pvalue)
+{
+  struct Curl_multi *multi = m;
+
+  if(!GOOD_MULTI_HANDLE(multi))
+    return CURLM_BAD_HANDLE;
+  if(!pvalue)
+    return CURLM_BAD_FUNCTION_ARGUMENT;
+
+  switch(info) {
+  case CURLMINFO_XFERS_CURRENT: {
+    unsigned int n = Curl_uint_tbl_count(&multi->xfers);
+    if(n && multi->admin)
+      --n;
+    *pvalue = (curl_off_t)n;
+    return CURLM_OK;
+  }
+  case CURLMINFO_XFERS_RUNNING:
+    *pvalue = (curl_off_t)Curl_uint_bset_count(&multi->process);
+    return CURLM_OK;
+  case CURLMINFO_XFERS_PENDING:
+    *pvalue = (curl_off_t)Curl_uint_bset_count(&multi->pending);
+    return CURLM_OK;
+  case CURLMINFO_XFERS_DONE:
+    *pvalue = (curl_off_t)Curl_uint_bset_count(&multi->msgsent);
+    return CURLM_OK;
+  case CURLMINFO_XFERS_ADDED:
+    *pvalue = multi->xfers_total_ever;
+    return CURLM_OK;
+  default:
+    *pvalue = -1;
+    return CURLM_UNKNOWN_OPTION;
+  }
+}
+
 CURLcode Curl_multi_xfer_buf_borrow(struct Curl_easy *data,
                                     char **pbuf, size_t *pbuflen)
 {
@@ -3892,6 +3976,12 @@ void Curl_multi_mark_dirty(struct Curl_easy *data)
     Curl_uint_bset_add(&data->multi->dirty, data->mid);
 }
 
+void Curl_multi_clear_dirty(struct Curl_easy *data)
+{
+  if(data->multi && data->mid != UINT_MAX)
+    Curl_uint_bset_remove(&data->multi->dirty, data->mid);
+}
+
 #ifdef DEBUGBUILD
 static void multi_xfer_dump(struct Curl_multi *multi, unsigned int mid,
                             void *entry)
diff --git a/deps/curl/lib/multi_ev.c b/deps/curl/lib/multi_ev.c
index 0b4c472849d..61c639d9e48 100644
--- a/deps/curl/lib/multi_ev.c
+++ b/deps/curl/lib/multi_ev.c
@@ -64,19 +64,21 @@ struct mev_sh_entry {
                          * libcurl application to watch out for */
   unsigned int readers; /* this many transfers want to read */
   unsigned int writers; /* this many transfers want to write */
+  BIT(announced);       /* this socket has been passed to the socket
+                           callback at least once */
 };
 
 static size_t mev_sh_entry_hash(void *key, size_t key_length, size_t slots_num)
 {
   curl_socket_t fd = *((curl_socket_t *) key);
-  (void) key_length;
+  (void)key_length;
   return (fd % (curl_socket_t)slots_num);
 }
 
 static size_t mev_sh_entry_compare(void *k1, size_t k1_len,
                                    void *k2, size_t k2_len)
 {
-  (void) k1_len; (void) k2_len;
+  (void)k1_len; (void)k2_len;
   return (*((curl_socket_t *) k1)) == (*((curl_socket_t *) k2));
 }
 
@@ -205,13 +207,14 @@ static CURLMcode mev_forget_socket(struct Curl_multi *multi,
     return CURLM_OK;
 
   /* We managed this socket before, tell the socket callback to forget it. */
-  if(multi->socket_cb) {
+  if(entry->announced && multi->socket_cb) {
     CURL_TRC_M(data, "ev %s, call(fd=%" FMT_SOCKET_T ", ev=REMOVE)",
                cause, s);
     mev_in_callback(multi, TRUE);
     rc = multi->socket_cb(data, s, CURL_POLL_REMOVE,
                           multi->socket_userp, entry->user_data);
     mev_in_callback(multi, FALSE);
+    entry->announced = FALSE;
   }
 
   mev_sh_entry_kill(multi, s);
@@ -281,8 +284,8 @@ static CURLMcode mev_sh_entry_update(struct Curl_multi *multi,
   mev_in_callback(multi, TRUE);
   rc = multi->socket_cb(data, s, comboaction, multi->socket_userp,
                         entry->user_data);
-
   mev_in_callback(multi, FALSE);
+  entry->announced = TRUE;
   if(rc == -1) {
     multi->dead = TRUE;
     return CURLM_ABORTED_BY_CALLBACK;
@@ -314,7 +317,7 @@ static CURLMcode mev_pollset_diff(struct Curl_multi *multi,
   DEBUGASSERT(prev_ps);
 
   /* Handle changes to sockets the transfer is interested in. */
-  for(i = 0; i < ps->num; i++) {
+  for(i = 0; i < ps->n; i++) {
     unsigned char last_action;
     bool first_time = FALSE; /* data/conn appears first time on socket */
 
@@ -359,7 +362,7 @@ static CURLMcode mev_pollset_diff(struct Curl_multi *multi,
                  entry->conn ? 1 : 0);
     }
     else {
-      for(j = 0; j < prev_ps->num; j++) {
+      for(j = 0; j < prev_ps->n; j++) {
         if(s == prev_ps->sockets[j]) {
           last_action = prev_ps->actions[j];
           break;
@@ -374,11 +377,11 @@ static CURLMcode mev_pollset_diff(struct Curl_multi *multi,
   }
 
   /* Handle changes to sockets the transfer is NO LONGER interested in. */
-  for(i = 0; i < prev_ps->num; i++) {
+  for(i = 0; i < prev_ps->n; i++) {
     bool stillused = FALSE;
 
     s = prev_ps->sockets[i];
-    for(j = 0; j < ps->num; j++) {
+    for(j = 0; j < ps->n; j++) {
       if(s == ps->sockets[j]) {
         /* socket is still supervised */
         stillused = TRUE;
@@ -434,15 +437,19 @@ static CURLMcode mev_pollset_diff(struct Curl_multi *multi,
   } /* for loop over num */
 
   /* Remember for next time */
-  memcpy(prev_ps, ps, sizeof(*prev_ps));
+  Curl_pollset_move(prev_ps, ps);
   return CURLM_OK;
 }
 
 static void mev_pollset_dtor(void *key, size_t klen, void *entry)
 {
+  struct easy_pollset *ps = entry;
   (void)key;
   (void)klen;
-  free(entry);
+  if(ps) {
+    Curl_pollset_cleanup(ps);
+    free(ps);
+  }
 }
 
 static struct easy_pollset*
@@ -450,7 +457,7 @@ mev_add_new_conn_pollset(struct connectdata *conn)
 {
   struct easy_pollset *ps;
 
-  ps = calloc(1, sizeof(*ps));
+  ps = Curl_pollset_create();
   if(!ps)
     return NULL;
   if(Curl_conn_meta_set(conn, CURL_META_MEV_POLLSET, ps, mev_pollset_dtor))
@@ -463,7 +470,7 @@ mev_add_new_xfer_pollset(struct Curl_easy *data)
 {
   struct easy_pollset *ps;
 
-  ps = calloc(1, sizeof(*ps));
+  ps = Curl_pollset_create();
   if(!ps)
     return NULL;
   if(Curl_meta_set(data, CURL_META_MEV_POLLSET, ps, mev_pollset_dtor))
@@ -483,42 +490,47 @@ mev_get_last_pollset(struct Curl_easy *data,
   return NULL;
 }
 
-static void mev_init_cur_pollset(struct easy_pollset *ps,
-                                 struct Curl_easy *data,
-                                 struct connectdata *conn)
-{
-  memset(ps, 0, sizeof(*ps));
-  if(conn)
-    Curl_conn_adjust_pollset(data, conn, ps);
-  else if(data)
-    Curl_multi_getsock(data, ps, "ev assess");
-}
-
 static CURLMcode mev_assess(struct Curl_multi *multi,
                             struct Curl_easy *data,
                             struct connectdata *conn)
 {
-  if(multi && multi->socket_cb) {
-    struct easy_pollset ps, *last_ps;
+  struct easy_pollset ps, *last_ps;
+  CURLMcode res = CURLM_OK;
 
-    mev_init_cur_pollset(&ps, data, conn);
-    last_ps = mev_get_last_pollset(data, conn);
+  if(!multi || !multi->socket_cb)
+    return CURLM_OK;
 
-    if(!last_ps && ps.num) {
-      if(conn)
-        last_ps = mev_add_new_conn_pollset(conn);
-      else
-        last_ps = mev_add_new_xfer_pollset(data);
-      if(!last_ps)
-        return CURLM_OUT_OF_MEMORY;
+  Curl_pollset_init(&ps);
+  if(conn) {
+    CURLcode r = Curl_conn_adjust_pollset(data, conn, &ps);
+    if(r) {
+      res = (r == CURLE_OUT_OF_MEMORY) ?
+            CURLM_OUT_OF_MEMORY : CURLM_INTERNAL_ERROR;
+      goto out;
     }
+  }
+  else if(data)
+    Curl_multi_pollset(data, &ps, "ev assess");
+  last_ps = mev_get_last_pollset(data, conn);
 
-    if(last_ps)
-      return mev_pollset_diff(multi, data, conn, &ps, last_ps);
+  if(!last_ps && ps.n) {
+    if(conn)
+      last_ps = mev_add_new_conn_pollset(conn);
     else
-      DEBUGASSERT(!ps.num);
+      last_ps = mev_add_new_xfer_pollset(data);
+    if(!last_ps) {
+      res = CURLM_OUT_OF_MEMORY;
+      goto out;
+    }
   }
-  return CURLM_OK;
+
+  if(last_ps)
+    res = mev_pollset_diff(multi, data, conn, &ps, last_ps);
+  else
+    DEBUGASSERT(!ps.n);
+out:
+  Curl_pollset_cleanup(&ps);
+  return res;
 }
 
 CURLMcode Curl_multi_ev_assess_xfer(struct Curl_multi *multi,
diff --git a/deps/curl/lib/multihandle.h b/deps/curl/lib/multihandle.h
index 4bf2dd811c2..ae41044adc2 100644
--- a/deps/curl/lib/multihandle.h
+++ b/deps/curl/lib/multihandle.h
@@ -72,15 +72,9 @@ typedef enum {
   MSTATE_LAST          /* 18 - not a true state, never use this */
 } CURLMstate;
 
-/* we support N sockets per easy handle. Set the corresponding bit to what
-   action we should wait for */
-#define MAX_SOCKSPEREASYHANDLE 5
-#define GETSOCK_READABLE (0x00ff)
-#define GETSOCK_WRITABLE (0xff00)
-
 #define CURLPIPE_ANY (CURLPIPE_MULTIPLEX)
 
-#if !defined(CURL_DISABLE_SOCKETPAIR)
+#ifndef CURL_DISABLE_SOCKETPAIR
 #define ENABLE_WAKEUP
 #endif
 
@@ -95,6 +89,7 @@ struct Curl_multi {
 
   unsigned int xfers_alive; /* amount of added transfers that have
                                not yet reached COMPLETE state */
+  curl_off_t xfers_total_ever; /* total of added transfers, ever. */
   struct uint_tbl xfers; /* transfers added to this multi */
   /* Each transfer's mid may be present in at most one of these */
   struct uint_bset process; /* transfer being processed */
diff --git a/deps/curl/lib/multiif.h b/deps/curl/lib/multiif.h
index 1ba0d0f8387..1423d5a03d0 100644
--- a/deps/curl/lib/multiif.h
+++ b/deps/curl/lib/multiif.h
@@ -53,20 +53,6 @@ struct Curl_multi *Curl_multi_handle(unsigned int xfer_table_size,
                                      size_t dnssize,
                                      size_t sesssize);
 
-/* the write bits start at bit 16 for the *getsock() bitmap */
-#define GETSOCK_WRITEBITSTART 16
-
-#define GETSOCK_BLANK 0 /* no bits set */
-
-/* set the bit for the given sock number to make the bitmap for writable */
-#define GETSOCK_WRITESOCK(x) (1 << (GETSOCK_WRITEBITSTART + (x)))
-
-/* set the bit for the given sock number to make the bitmap for readable */
-#define GETSOCK_READSOCK(x) (1 << (x))
-
-/* mask for checking if read and/or write is set for index x */
-#define GETSOCK_MASK_RW(x) (GETSOCK_READSOCK(x)|GETSOCK_WRITESOCK(x))
-
 /**
  * Let the multi handle know that the socket is about to be closed.
  * The multi will then remove anything it knows about the socket, so
@@ -86,9 +72,9 @@ CURLMcode Curl_multi_add_perform(struct Curl_multi *multi,
 /* Return the value of the CURLMOPT_MAX_CONCURRENT_STREAMS option */
 unsigned int Curl_multi_max_concurrent_streams(struct Curl_multi *multi);
 
-void Curl_multi_getsock(struct Curl_easy *data,
-                        struct easy_pollset *ps,
-                        const char *caller);
+CURLMcode Curl_multi_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps,
+                             const char *caller);
 
 /**
  * Borrow the transfer buffer from the multi, suitable
@@ -176,5 +162,7 @@ unsigned int Curl_multi_xfers_running(struct Curl_multi *multi);
 /* Mark a transfer as dirty, e.g. to be rerun at earliest convenience.
  * A cheap operation, can be done many times repeatedly. */
 void Curl_multi_mark_dirty(struct Curl_easy *data);
+/* Clear transfer from the dirty set. */
+void Curl_multi_clear_dirty(struct Curl_easy *data);
 
 #endif /* HEADER_CURL_MULTIIF_H */
diff --git a/deps/curl/lib/netrc.c b/deps/curl/lib/netrc.c
index bf53fc01e18..447ee095852 100644
--- a/deps/curl/lib/netrc.c
+++ b/deps/curl/lib/netrc.c
@@ -390,53 +390,57 @@ const char *Curl_netrc_strerror(NETRCcode ret)
  */
 NETRCcode Curl_parsenetrc(struct store_netrc *store, const char *host,
                           char **loginp, char **passwordp,
-                          char *netrcfile)
+                          const char *netrcfile)
 {
   NETRCcode retcode = NETRC_OK;
   char *filealloc = NULL;
 
   if(!netrcfile) {
+    char *home = NULL;
+    char *homea = NULL;
 #if defined(HAVE_GETPWUID_R) && defined(HAVE_GETEUID)
     char pwbuf[1024];
 #endif
-    char *home = NULL;
-    char *homea = curl_getenv("HOME"); /* portable environment reader */
-    if(homea) {
-      home = homea;
+    filealloc = curl_getenv("NETRC");
+    if(!filealloc) {
+      homea = curl_getenv("HOME"); /* portable environment reader */
+      if(homea) {
+        home = homea;
 #if defined(HAVE_GETPWUID_R) && defined(HAVE_GETEUID)
-    }
-    else {
-      struct passwd pw, *pw_res;
-      if(!getpwuid_r(geteuid(), &pw, pwbuf, sizeof(pwbuf), &pw_res)
-         && pw_res) {
-        home = pw.pw_dir;
       }
+      else {
+        struct passwd pw, *pw_res;
+        if(!getpwuid_r(geteuid(), &pw, pwbuf, sizeof(pwbuf), &pw_res)
+           && pw_res) {
+          home = pw.pw_dir;
+        }
 #elif defined(HAVE_GETPWUID) && defined(HAVE_GETEUID)
-    }
-    else {
-      struct passwd *pw;
-      pw = getpwuid(geteuid());
-      if(pw) {
-        home = pw->pw_dir;
       }
+      else {
+        struct passwd *pw;
+        pw = getpwuid(geteuid());
+        if(pw) {
+          home = pw->pw_dir;
+        }
 #elif defined(_WIN32)
-    }
-    else {
-      homea = curl_getenv("USERPROFILE");
-      if(homea) {
-        home = homea;
       }
+      else {
+        homea = curl_getenv("USERPROFILE");
+        if(homea) {
+          home = homea;
+        }
 #endif
-    }
+      }
 
-    if(!home)
-      return NETRC_FILE_MISSING; /* no home directory found (or possibly out
-                                    of memory) */
+      if(!home)
+        return NETRC_FILE_MISSING; /* no home directory found (or possibly out
+                                      of memory) */
 
-    filealloc = aprintf("%s%s.netrc", home, DIR_CHAR);
-    if(!filealloc) {
-      free(homea);
-      return NETRC_OUT_OF_MEMORY;
+      filealloc = aprintf("%s%s.netrc", home, DIR_CHAR);
+      if(!filealloc) {
+        free(homea);
+        return NETRC_OUT_OF_MEMORY;
+      }
     }
     retcode = parsenetrc(store, host, loginp, passwordp, filealloc);
     free(filealloc);
diff --git a/deps/curl/lib/netrc.h b/deps/curl/lib/netrc.h
index ef3bde5212a..0d6d081bfbb 100644
--- a/deps/curl/lib/netrc.h
+++ b/deps/curl/lib/netrc.h
@@ -48,7 +48,8 @@ void Curl_netrc_init(struct store_netrc *s);
 void Curl_netrc_cleanup(struct store_netrc *s);
 
 NETRCcode Curl_parsenetrc(struct store_netrc *s, const char *host,
-                          char **loginp, char **passwordp, char *filename);
+                          char **loginp, char **passwordp,
+                          const char *filename);
   /* Assume: (*passwordp)[0]=0, host[0] != 0.
    * If (*loginp)[0] = 0, search for login and password within a machine
    * section in the netrc.
diff --git a/deps/curl/lib/noproxy.c b/deps/curl/lib/noproxy.c
index 306cd6d1f98..22b067ad1b0 100644
--- a/deps/curl/lib/noproxy.c
+++ b/deps/curl/lib/noproxy.c
@@ -54,9 +54,9 @@ UNITTEST bool Curl_cidr4_match(const char *ipv4,    /* 1.2.3.4 address */
     /* strange input */
     return FALSE;
 
-  if(1 != curlx_inet_pton(AF_INET, ipv4, &address))
+  if(curlx_inet_pton(AF_INET, ipv4, &address) != 1)
     return FALSE;
-  if(1 != curlx_inet_pton(AF_INET, network, &check))
+  if(curlx_inet_pton(AF_INET, network, &check) != 1)
     return FALSE;
 
   if(bits && (bits != 32)) {
@@ -92,9 +92,9 @@ UNITTEST bool Curl_cidr6_match(const char *ipv6,
   rest = bits & 0x07;
   if((bytes > 16) || ((bytes == 16) && rest))
     return FALSE;
-  if(1 != curlx_inet_pton(AF_INET6, ipv6, address))
+  if(curlx_inet_pton(AF_INET6, ipv6, address) != 1)
     return FALSE;
-  if(1 != curlx_inet_pton(AF_INET6, network, check))
+  if(curlx_inet_pton(AF_INET6, network, check) != 1)
     return FALSE;
   if(bytes && memcmp(address, check, bytes))
     return FALSE;
@@ -163,7 +163,7 @@ bool Curl_check_noproxy(const char *name, const char *no_proxy)
     else {
       unsigned int address;
       namelen = strlen(name);
-      if(1 == curlx_inet_pton(AF_INET, name, &address))
+      if(curlx_inet_pton(AF_INET, name, &address) == 1)
         type = TYPE_IPV4;
       else {
         /* ignore trailing dots in the hostname */
diff --git a/deps/curl/lib/openldap.c b/deps/curl/lib/openldap.c
index e4714b55801..da26d4a78d0 100644
--- a/deps/curl/lib/openldap.c
+++ b/deps/curl/lib/openldap.c
@@ -126,10 +126,10 @@ const struct Curl_handler Curl_handler_ldap = {
   oldap_connect,                        /* connect_it */
   oldap_connecting,                     /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   oldap_disconnect,                     /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -156,10 +156,10 @@ const struct Curl_handler Curl_handler_ldaps = {
   oldap_connect,                        /* connect_it */
   oldap_connecting,                     /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   oldap_disconnect,                     /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -496,7 +496,24 @@ static CURLcode oldap_perform_sasl(struct Curl_easy *data)
 }
 
 #ifdef USE_SSL
-static Sockbuf_IO ldapsb_tls;
+static int ldapsb_tls_setup(Sockbuf_IO_Desc *sbiod, void *arg);
+static int ldapsb_tls_remove(Sockbuf_IO_Desc *sbiod);
+static int ldapsb_tls_ctrl(Sockbuf_IO_Desc *sbiod, int opt, void *arg);
+static ber_slen_t ldapsb_tls_read(Sockbuf_IO_Desc *sbiod, void *buf,
+                                  ber_len_t len);
+static ber_slen_t ldapsb_tls_write(Sockbuf_IO_Desc *sbiod, void *buf,
+                                   ber_len_t len);
+static int ldapsb_tls_close(Sockbuf_IO_Desc *sbiod);
+
+static Sockbuf_IO ldapsb_tls =
+{
+  ldapsb_tls_setup,
+  ldapsb_tls_remove,
+  ldapsb_tls_ctrl,
+  ldapsb_tls_read,
+  ldapsb_tls_write,
+  ldapsb_tls_close
+};
 
 static bool ssl_installed(struct connectdata *conn)
 {
@@ -924,7 +941,7 @@ static CURLcode oldap_disconnect(struct Curl_easy *data,
                                  bool dead_connection)
 {
   struct ldapconninfo *li = Curl_conn_meta_get(conn, CURL_META_LDAP_CONN);
-  (void) dead_connection;
+  (void)dead_connection;
 #ifndef USE_SSL
   (void)data;
 #endif
@@ -993,7 +1010,7 @@ static CURLcode oldap_do(struct Curl_easy *data, bool *done)
   }
 
   lr->msgid = msgid;
-  Curl_xfer_setup1(data, CURL_XFER_RECV, -1, FALSE);
+  Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
   *done = TRUE;
 
 out:
@@ -1293,16 +1310,6 @@ ldapsb_tls_write(Sockbuf_IO_Desc *sbiod, void *buf, ber_len_t len)
   }
   return ret;
 }
-
-static Sockbuf_IO ldapsb_tls =
-{
-  ldapsb_tls_setup,
-  ldapsb_tls_remove,
-  ldapsb_tls_ctrl,
-  ldapsb_tls_read,
-  ldapsb_tls_write,
-  ldapsb_tls_close
-};
 #endif /* USE_SSL */
 
 #endif /* !CURL_DISABLE_LDAP && USE_OPENLDAP */
diff --git a/deps/curl/lib/optiontable.pl b/deps/curl/lib/optiontable.pl
index cc38a922cc9..43fbd39d3bf 100755
--- a/deps/curl/lib/optiontable.pl
+++ b/deps/curl/lib/optiontable.pl
@@ -1,5 +1,8 @@
 #!/usr/bin/env perl
 
+use strict;
+use warnings;
+
 print <<HEAD
 /***************************************************************************
  *                                  _   _ ____  _
@@ -37,31 +40,36 @@
 
 my $lastnum=0;
 
+my %opt;
+my %type;
+my @names;
+my %alias;
+
 sub add {
-    my($opt, $type, $num)=@_;
+    my($optstr, $typestr, $num)=@_;
     my $name;
     # remove all spaces from the type
-    $type =~ s/ //g;
-    my $ext = $type;
+    $typestr =~ s/ //g;
+    my $ext = $typestr;
 
-    if($opt =~ /OBSOLETE/) {
+    if($optstr =~ /OBSOLETE/) {
         # skip obsolete options
         next;
     }
 
-    if($opt =~ /^CURLOPT_(.*)/) {
+    if($optstr =~ /^CURLOPT_(.*)/) {
         $name=$1;
     }
     $ext =~ s/CURLOPTTYPE_//;
     $ext =~ s/CBPOINT/CBPTR/;
     $ext =~ s/POINT\z//;
-    $type = "CURLOT_$ext";
+    $typestr = "CURLOT_$ext";
 
-    $opt{$name} = $opt;
-    $type{$name} = $type;
+    $opt{$name} = $optstr;
+    $type{$name} = $typestr;
     push @names, $name;
     if($num < $lastnum) {
-        print STDERR "ERROR: $opt has bad number: $num < $lastnum\n";
+        print STDERR "ERROR: $optstr has bad number: $num < $lastnum\n";
         exit 2;
     }
     else {
@@ -123,8 +131,8 @@ sub add {
         $name = $alias{$name};
         $flag = "CURLOT_FLAG_ALIAS";
     }
-    $o = sprintf("  {\"%s\", %s, %s, %s},\n",
-                 $oname, $opt{$name}, $type{$name}, $flag);
+    my $o = sprintf("  {\"%s\", %s, %s, %s},\n",
+                    $oname, $opt{$name}, $type{$name}, $flag);
     if(length($o) < 80) {
         print $o;
     }
diff --git a/deps/curl/lib/parsedate.c b/deps/curl/lib/parsedate.c
index 65730d6c997..b9429db7f67 100644
--- a/deps/curl/lib/parsedate.c
+++ b/deps/curl/lib/parsedate.c
@@ -150,7 +150,7 @@ static const struct tzinfo tz[]= {
   {"HDT", 600 tDAYZONE},   /* Hawaii Daylight */
   {"CAT", 600},            /* Central Alaska */
   {"AHST", 600},           /* Alaska-Hawaii Standard */
-  {"NT",  660},            /* Nome */
+  {"NT",  660},            /* Nome */ /* spellchecker:disable-line */
   {"IDLW", 720},           /* International Date Line West */
   {"CET", -60},            /* Central European */
   {"MET", -60},            /* Middle European */
@@ -161,7 +161,8 @@ static const struct tzinfo tz[]= {
   {"FWT", -60},            /* French Winter */
   {"FST", -60 tDAYZONE},   /* French Summer */
   {"EET", -120},           /* Eastern Europe, USSR Zone 1 */
-  {"WAST", -420},          /* West Australian Standard */
+  {"WAST", -420}, /* spellchecker:disable-line */
+                           /* West Australian Standard */
   {"WADT", -420 tDAYZONE}, /* West Australian Daylight */
   {"CCT", -480},           /* China Coast, USSR Zone 7 */
   {"JST", -540},           /* Japan Standard, USSR Zone 8 */
@@ -588,26 +589,12 @@ time_t curl_getdate(const char *p, const time_t *now)
 
 /* Curl_getdate_capped() differs from curl_getdate() in that this will return
    TIME_T_MAX in case the parsed time value was too big, instead of an
-   error. */
+   error. Returns non-zero on error. */
 
-time_t Curl_getdate_capped(const char *p)
+int Curl_getdate_capped(const char *p, time_t *tp)
 {
-  time_t parsed = -1;
-  int rc = parsedate(p, &parsed);
-
-  switch(rc) {
-  case PARSEDATE_OK:
-    if(parsed == (time_t)-1)
-      /* avoid returning -1 for a working scenario */
-      parsed++;
-    return parsed;
-  case PARSEDATE_LATER:
-    /* this returns the maximum time value */
-    return parsed;
-  default:
-    return -1; /* everything else is fail */
-  }
-  /* UNREACHABLE */
+  int rc = parsedate(p, tp);
+  return (rc == PARSEDATE_FAIL);
 }
 
 /*
diff --git a/deps/curl/lib/parsedate.h b/deps/curl/lib/parsedate.h
index 84c37f1675c..e5efb53f617 100644
--- a/deps/curl/lib/parsedate.h
+++ b/deps/curl/lib/parsedate.h
@@ -29,10 +29,10 @@ extern const char * const Curl_month[12];
 
 CURLcode Curl_gmtime(time_t intime, struct tm *store);
 
-/* Curl_getdate_capped() differs from curl_getdate() in that this will return
+/* Curl_getdate_capped() differs from curl_getdate() in that this returns
    TIME_T_MAX in case the parsed time value was too big, instead of an
    error. */
 
-time_t Curl_getdate_capped(const char *p);
+int Curl_getdate_capped(const char *p, time_t *store);
 
 #endif /* HEADER_CURL_PARSEDATE_H */
diff --git a/deps/curl/lib/pingpong.c b/deps/curl/lib/pingpong.c
index a661a0285b5..003ad58441c 100644
--- a/deps/curl/lib/pingpong.c
+++ b/deps/curl/lib/pingpong.c
@@ -397,19 +397,13 @@ CURLcode Curl_pp_readresp(struct Curl_easy *data,
   return result;
 }
 
-int Curl_pp_getsock(struct Curl_easy *data,
-                    struct pingpong *pp, curl_socket_t *socks)
+CURLcode Curl_pp_pollset(struct Curl_easy *data,
+                         struct pingpong *pp,
+                         struct easy_pollset *ps)
 {
-  struct connectdata *conn = data->conn;
-  socks[0] = conn->sock[FIRSTSOCKET];
-
-  if(pp->sendleft) {
-    /* write mode */
-    return GETSOCK_WRITESOCK(0);
-  }
-
-  /* read mode */
-  return GETSOCK_READSOCK(0);
+  int flags = pp->sendleft ? CURL_POLL_OUT : CURL_POLL_IN;
+  return Curl_pollset_change(data, ps, data->conn->sock[FIRSTSOCKET],
+                             flags, 0);
 }
 
 bool Curl_pp_needs_flush(struct Curl_easy *data,
diff --git a/deps/curl/lib/pingpong.h b/deps/curl/lib/pingpong.h
index c6d0a56f0d2..5db96c4345f 100644
--- a/deps/curl/lib/pingpong.h
+++ b/deps/curl/lib/pingpong.h
@@ -147,8 +147,9 @@ CURLcode Curl_pp_flushsend(struct Curl_easy *data,
 /* call this when a pingpong connection is disconnected */
 CURLcode Curl_pp_disconnect(struct pingpong *pp);
 
-int Curl_pp_getsock(struct Curl_easy *data, struct pingpong *pp,
-                    curl_socket_t *socks);
+CURLcode Curl_pp_pollset(struct Curl_easy *data,
+                         struct pingpong *pp,
+                         struct easy_pollset *ps);
 
 
 /***********************************************************************
diff --git a/deps/curl/lib/pop3.c b/deps/curl/lib/pop3.c
index 514c4b8fa53..f5ecfd178ba 100644
--- a/deps/curl/lib/pop3.c
+++ b/deps/curl/lib/pop3.c
@@ -153,8 +153,8 @@ static CURLcode pop3_connect(struct Curl_easy *data, bool *done);
 static CURLcode pop3_disconnect(struct Curl_easy *data,
                                 struct connectdata *conn, bool dead);
 static CURLcode pop3_multi_statemach(struct Curl_easy *data, bool *done);
-static int pop3_getsock(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks);
+static CURLcode pop3_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps);
 static CURLcode pop3_doing(struct Curl_easy *data, bool *dophase_done);
 static CURLcode pop3_setup_connection(struct Curl_easy *data,
                                       struct connectdata *conn);
@@ -186,10 +186,10 @@ const struct Curl_handler Curl_handler_pop3 = {
   pop3_connect,                     /* connect_it */
   pop3_multi_statemach,             /* connecting */
   pop3_doing,                       /* doing */
-  pop3_getsock,                     /* proto_getsock */
-  pop3_getsock,                     /* doing_getsock */
-  ZERO_NULL,                        /* domore_getsock */
-  ZERO_NULL,                        /* perform_getsock */
+  pop3_pollset,                     /* proto_pollset */
+  pop3_pollset,                     /* doing_pollset */
+  ZERO_NULL,                        /* domore_pollset */
+  ZERO_NULL,                        /* perform_pollset */
   pop3_disconnect,                  /* disconnect */
   pop3_write,                       /* write_resp */
   ZERO_NULL,                        /* write_resp_hd */
@@ -217,10 +217,10 @@ const struct Curl_handler Curl_handler_pop3s = {
   pop3_connect,                     /* connect_it */
   pop3_multi_statemach,             /* connecting */
   pop3_doing,                       /* doing */
-  pop3_getsock,                     /* proto_getsock */
-  pop3_getsock,                     /* doing_getsock */
-  ZERO_NULL,                        /* domore_getsock */
-  ZERO_NULL,                        /* perform_getsock */
+  pop3_pollset,                     /* proto_pollset */
+  pop3_pollset,                     /* doing_pollset */
+  ZERO_NULL,                        /* domore_pollset */
+  ZERO_NULL,                        /* perform_pollset */
   pop3_disconnect,                  /* disconnect */
   pop3_write,                       /* write_resp */
   ZERO_NULL,                        /* write_resp_hd */
@@ -811,7 +811,7 @@ static CURLcode pop3_state_servergreet_resp(struct Curl_easy *data,
   const char *line;
   size_t len;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
   if(!pop3c)
     return CURLE_FAILED_INIT;
 
@@ -866,7 +866,7 @@ static CURLcode pop3_state_capa_resp(struct Curl_easy *data, int pop3code,
   const char *line;
   size_t len;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
   if(!pop3c)
     return CURLE_FAILED_INIT;
 
@@ -954,7 +954,7 @@ static CURLcode pop3_state_starttls_resp(struct Curl_easy *data,
 {
   struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(!pop3c)
     return CURLE_FAILED_INIT;
@@ -987,7 +987,7 @@ static CURLcode pop3_state_auth_resp(struct Curl_easy *data,
   struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   saslprogress progress;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
   if(!pop3c)
     return CURLE_FAILED_INIT;
 
@@ -1025,7 +1025,7 @@ static CURLcode pop3_state_apop_resp(struct Curl_easy *data, int pop3code,
                                      pop3state instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(pop3code != '+') {
     failf(data, "Authentication failed: %d", pop3code);
@@ -1046,7 +1046,7 @@ static CURLcode pop3_state_user_resp(struct Curl_easy *data, int pop3code,
   CURLcode result = CURLE_OK;
   struct connectdata *conn = data->conn;
   struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(!pop3c)
     return CURLE_FAILED_INIT;
@@ -1070,7 +1070,7 @@ static CURLcode pop3_state_pass_resp(struct Curl_easy *data, int pop3code,
                                      pop3state instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(pop3code != '+') {
     failf(data, "Access denied. %c", pop3code);
@@ -1094,7 +1094,7 @@ static CURLcode pop3_state_command_resp(struct Curl_easy *data,
   struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
   struct pingpong *pp;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
   if(!pop3 || !pop3c)
     return CURLE_FAILED_INIT;
 
@@ -1116,7 +1116,7 @@ static CURLcode pop3_state_command_resp(struct Curl_easy *data,
 
   if(pop3->transfer == PPTRANSFER_BODY) {
     /* POP3 download */
-    Curl_xfer_setup1(data, CURL_XFER_RECV, -1, FALSE);
+    Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
 
     if(pp->overflow) {
       /* The recv buffer contains data that is actually body content so send
@@ -1269,13 +1269,12 @@ static CURLcode pop3_block_statemach(struct Curl_easy *data,
 }
 
 /* For the POP3 "protocol connect" and "doing" phases only */
-static int pop3_getsock(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks)
+static CURLcode pop3_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
 {
-  struct pop3_conn *pop3c = Curl_conn_meta_get(conn, CURL_META_POP3_CONN);
-  if(pop3c)
-    return Curl_pp_getsock(data, &pop3c->pp, socks);
-  return GETSOCK_BLANK;
+  struct pop3_conn *pop3c =
+    Curl_conn_meta_get(data->conn, CURL_META_POP3_CONN);
+  return pop3c ? Curl_pp_pollset(data, &pop3c->pp, ps) : CURLE_OK;
 }
 
 /***********************************************************************
diff --git a/deps/curl/lib/progress.c b/deps/curl/lib/progress.c
index 746805f20fa..fdae3194c55 100644
--- a/deps/curl/lib/progress.c
+++ b/deps/curl/lib/progress.c
@@ -281,41 +281,40 @@ void Curl_pgrsStartNow(struct Curl_easy *data)
  * to wait to get back under the speed limit.
  */
 timediff_t Curl_pgrsLimitWaitTime(struct pgrs_dir *d,
-                                  curl_off_t speed_limit,
+                                  curl_off_t bytes_per_sec,
                                   struct curltime now)
 {
-  curl_off_t size = d->cur_size - d->limit.start_size;
-  timediff_t minimum;
-  timediff_t actual;
+  curl_off_t bytes = d->cur_size - d->limit.start_size;
+  timediff_t should_ms;
+  timediff_t took_ms;
 
-  if(!speed_limit || !size)
+  /* no limit or we did not get to any bytes yet */
+  if(!bytes_per_sec || !bytes)
     return 0;
 
-  /*
-   * 'minimum' is the number of milliseconds 'size' should take to download to
-   * stay below 'limit'.
-   */
-  if(size < CURL_OFF_T_MAX/1000)
-    minimum = (timediff_t) (1000 * size / speed_limit);
+  /* The time it took us to have `bytes` */
+  took_ms = curlx_timediff_ceil(now, d->limit.start);
+
+  /* The time it *should* have taken us to have `bytes`
+   * when obeying the bytes_per_sec speed_limit. */
+  if(bytes < CURL_OFF_T_MAX/1000) {
+    /* (1000 * bytes / (bytes / sec)) = 1000 * sec = ms */
+    should_ms = (timediff_t) (1000 * bytes / bytes_per_sec);
+  }
   else {
-    minimum = (timediff_t) (size / speed_limit);
-    if(minimum < TIMEDIFF_T_MAX/1000)
-      minimum *= 1000;
+    /* very large `bytes`, first calc the seconds it should have taken.
+     * if that is small enough, convert to milliseconds. */
+    should_ms = (timediff_t) (bytes / bytes_per_sec);
+    if(should_ms < TIMEDIFF_T_MAX/1000)
+      should_ms *= 1000;
     else
-      minimum = TIMEDIFF_T_MAX;
+      should_ms = TIMEDIFF_T_MAX;
   }
 
-  /*
-   * 'actual' is the time in milliseconds it took to actually download the
-   * last 'size' bytes.
-   */
-  actual = curlx_timediff_ceil(now, d->limit.start);
-  if(actual < minimum) {
-    /* if it downloaded the data faster than the limit, make it wait the
-       difference */
-    return minimum - actual;
+  if(took_ms < should_ms) {
+    /* when gotten to `bytes` too fast, wait the difference */
+    return should_ms - took_ms;
   }
-
   return 0;
 }
 
@@ -449,7 +448,7 @@ static bool progress_calc(struct Curl_easy *data, struct curltime now)
 
       /* Figure out the exact time for the time span */
       span_ms = curlx_timediff(now, p->speeder_time[checkindex]);
-      if(0 == span_ms)
+      if(span_ms == 0)
         span_ms = 1; /* at least one millisecond MUST have passed */
 
       /* Calculate the average speed the last 'span_ms' milliseconds */
diff --git a/deps/curl/lib/rand.c b/deps/curl/lib/rand.c
index 72545e08677..a1a5e42c2bb 100644
--- a/deps/curl/lib/rand.c
+++ b/deps/curl/lib/rand.c
@@ -48,13 +48,14 @@
 
 #ifdef _WIN32
 
-#if defined(_WIN32_WINNT) && _WIN32_WINNT >= 0x600 && \
+#if defined(_WIN32_WINNT) && _WIN32_WINNT >= _WIN32_WINNT_VISTA && \
   !defined(CURL_WINDOWS_UWP)
 #  define HAVE_WIN_BCRYPTGENRANDOM
 #  include <bcrypt.h>
 #  ifdef _MSC_VER
 #    pragma comment(lib, "bcrypt.lib")
 #  endif
+   /* Offered by mingw-w64 v3+. MS SDK v7.0A+. */
 #  ifndef BCRYPT_USE_SYSTEM_PREFERRED_RNG
 #  define BCRYPT_USE_SYSTEM_PREFERRED_RNG 0x00000002
 #  endif
@@ -72,7 +73,7 @@ CURLcode Curl_win32_random(unsigned char *entropy, size_t length)
 {
   memset(entropy, 0, length);
 
-#if defined(HAVE_WIN_BCRYPTGENRANDOM)
+#ifdef HAVE_WIN_BCRYPTGENRANDOM
   if(BCryptGenRandom(NULL, entropy, (ULONG)length,
                      BCRYPT_USE_SYSTEM_PREFERRED_RNG) != STATUS_SUCCESS)
     return CURLE_FAILED_INIT;
@@ -100,7 +101,7 @@ CURLcode Curl_win32_random(unsigned char *entropy, size_t length)
 }
 #endif
 
-#if !defined(USE_SSL)
+#ifndef USE_SSL
 /* ---- possibly non-cryptographic version following ---- */
 static CURLcode weak_random(struct Curl_easy *data,
                             unsigned char *entropy,
@@ -119,7 +120,7 @@ static CURLcode weak_random(struct Curl_easy *data,
   }
 #endif
 
-#if defined(HAVE_ARC4RANDOM)
+#ifdef HAVE_ARC4RANDOM
   (void)data;
   r = (unsigned int)arc4random();
   memcpy(entropy, &r, length);
diff --git a/deps/curl/lib/request.c b/deps/curl/lib/request.c
index 0d9b23ef0c4..8751ada5598 100644
--- a/deps/curl/lib/request.c
+++ b/deps/curl/lib/request.c
@@ -62,7 +62,7 @@ CURLcode Curl_req_soft_reset(struct SingleRequest *req,
   req->shutdown = FALSE;
   req->bytecount = 0;
   req->writebytecount = 0;
-  req->header = TRUE; /* assume header */
+  req->header = FALSE;
   req->headerline = 0;
   req->headerbytecount = 0;
   req->allheadercount =  0;
@@ -153,6 +153,7 @@ void Curl_req_hard_reset(struct SingleRequest *req, struct Curl_easy *data)
   req->eos_written = FALSE;
   req->eos_read = FALSE;
   req->eos_sent = FALSE;
+  req->rewind_read = FALSE;
   req->upload_done = FALSE;
   req->upload_aborted = FALSE;
   req->ignorebody = FALSE;
@@ -160,7 +161,6 @@ void Curl_req_hard_reset(struct SingleRequest *req, struct Curl_easy *data)
   req->chunk = FALSE;
   req->ignore_cl = FALSE;
   req->upload_chunky = FALSE;
-  req->getheader = FALSE;
   req->no_body = data->set.opt_no_body;
   req->authneg = FALSE;
   req->shutdown = FALSE;
@@ -308,7 +308,7 @@ static CURLcode req_flush(struct Curl_easy *data)
   }
 
   if(data->req.eos_read && !data->req.eos_sent) {
-    char tmp;
+    char tmp = 0;
     size_t nwritten;
     result = xfer_send(data, &tmp, 0, 0, &nwritten);
     if(result)
@@ -380,8 +380,14 @@ CURLcode Curl_req_send(struct Curl_easy *data, struct dynbuf *req,
   data->req.httpversion_sent = httpversion;
   buf = curlx_dyn_ptr(req);
   blen = curlx_dyn_len(req);
-  if(!Curl_creader_total_length(data)) {
-    /* Request without body. Try to send directly from the buf given. */
+  /* if the sendbuf is empty and the request without body and
+   * the length to send fits info a sendbuf chunk, we send it directly.
+   * If `blen` is larger then `chunk_size`, we can not. Because we
+   * might have to retry a blocked send later from sendbuf and that
+   * would result in retry sends with a shrunken length. That is trouble. */
+  if(Curl_bufq_is_empty(&data->req.sendbuf) &&
+     !Curl_creader_total_length(data) &&
+     (blen <= data->req.sendbuf.chunk_size)) {
     data->req.eos_read = TRUE;
     result = xfer_send(data, buf, blen, blen, &nwritten);
     if(result)
diff --git a/deps/curl/lib/request.h b/deps/curl/lib/request.h
index 74d9f534396..bce34de8ba9 100644
--- a/deps/curl/lib/request.h
+++ b/deps/curl/lib/request.h
@@ -123,7 +123,6 @@ struct SingleRequest {
   BIT(ignore_cl);     /* ignore content-length */
   BIT(upload_chunky); /* set TRUE if we are doing chunked transfer-encoding
                          on upload */
-  BIT(getheader);    /* TRUE if header parsing is wanted */
   BIT(no_body);      /* the response has no body */
   BIT(authneg);      /* TRUE when the auth phase has started, which means
                         that we are creating a request with an auth header,
diff --git a/deps/curl/lib/rtsp.c b/deps/curl/lib/rtsp.c
index ac44bec4222..1d5f44f91b2 100644
--- a/deps/curl/lib/rtsp.c
+++ b/deps/curl/lib/rtsp.c
@@ -24,7 +24,7 @@
 
 #include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_RTSP)
+#ifndef CURL_DISABLE_RTSP
 
 #include "urldata.h"
 #include <curl/curl.h>
@@ -83,8 +83,8 @@ struct RTSP {
 static CURLcode rtsp_do(struct Curl_easy *data, bool *done);
 static CURLcode rtsp_done(struct Curl_easy *data, CURLcode, bool premature);
 static CURLcode rtsp_connect(struct Curl_easy *data, bool *done);
-static int rtsp_getsock_do(struct Curl_easy *data,
-                           struct connectdata *conn, curl_socket_t *socks);
+static CURLcode rtsp_do_pollset(struct Curl_easy *data,
+                                struct easy_pollset *ps);
 
 /*
  * Parse and write out an RTSP response.
@@ -100,6 +100,10 @@ static CURLcode rtsp_rtp_write_resp(struct Curl_easy *data,
                                     const char *buf,
                                     size_t blen,
                                     bool is_eos);
+static CURLcode rtsp_rtp_write_resp_hd(struct Curl_easy *data,
+                                       const char *buf,
+                                       size_t blen,
+                                       bool is_eos);
 
 static CURLcode rtsp_setup_connection(struct Curl_easy *data,
                                       struct connectdata *conn);
@@ -110,13 +114,11 @@ static unsigned int rtsp_conncheck(struct Curl_easy *data,
 /* this returns the socket to wait for in the DO and DOING state for the multi
    interface and then we are always _sending_ a request and thus we wait for
    the single socket to become writable only */
-static int rtsp_getsock_do(struct Curl_easy *data, struct connectdata *conn,
-                           curl_socket_t *socks)
+static CURLcode rtsp_do_pollset(struct Curl_easy *data,
+                                struct easy_pollset *ps)
 {
   /* write mode */
-  (void)data;
-  socks[0] = conn->sock[FIRSTSOCKET];
-  return GETSOCK_WRITESOCK(0);
+  return Curl_pollset_add_out(data, ps, data->conn->sock[FIRSTSOCKET]);
 }
 
 static
@@ -137,13 +139,13 @@ const struct Curl_handler Curl_handler_rtsp = {
   rtsp_connect,                         /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  rtsp_getsock_do,                      /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  rtsp_do_pollset,                      /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   rtsp_rtp_write_resp,                  /* write_resp */
-  ZERO_NULL,                            /* write_resp_hd */
+  rtsp_rtp_write_resp_hd,               /* write_resp_hd */
   rtsp_conncheck,                       /* connection_check */
   ZERO_NULL,                            /* attach connection */
   Curl_http_follow,                     /* follow */
@@ -276,6 +278,84 @@ static CURLcode rtsp_done(struct Curl_easy *data,
   return httpStatus;
 }
 
+
+static CURLcode rtsp_setup_body(struct Curl_easy *data,
+                                Curl_RtspReq rtspreq,
+                                struct dynbuf *reqp)
+{
+  CURLcode result;
+  if(rtspreq == RTSPREQ_ANNOUNCE ||
+     rtspreq == RTSPREQ_SET_PARAMETER ||
+     rtspreq == RTSPREQ_GET_PARAMETER) {
+    curl_off_t req_clen; /* request content length */
+
+    if(data->state.upload) {
+      req_clen = data->state.infilesize;
+      data->state.httpreq = HTTPREQ_PUT;
+      result = Curl_creader_set_fread(data, req_clen);
+      if(result)
+        return result;
+    }
+    else {
+      if(data->set.postfields) {
+        size_t plen = strlen(data->set.postfields);
+        req_clen = (curl_off_t)plen;
+        result = Curl_creader_set_buf(data, data->set.postfields, plen);
+      }
+      else if(data->state.infilesize >= 0) {
+        req_clen = data->state.infilesize;
+        result = Curl_creader_set_fread(data, req_clen);
+      }
+      else {
+        req_clen = 0;
+        result = Curl_creader_set_null(data);
+      }
+      if(result)
+        return result;
+    }
+
+    if(req_clen > 0) {
+      /* As stated in the http comments, it is probably not wise to
+       * actually set a custom Content-Length in the headers */
+      if(!Curl_checkheaders(data, STRCONST("Content-Length"))) {
+        result = curlx_dyn_addf(reqp, "Content-Length: %" FMT_OFF_T"\r\n",
+                                req_clen);
+        if(result)
+          return result;
+      }
+
+      if(rtspreq == RTSPREQ_SET_PARAMETER ||
+         rtspreq == RTSPREQ_GET_PARAMETER) {
+        if(!Curl_checkheaders(data, STRCONST("Content-Type"))) {
+          result = curlx_dyn_addn(reqp,
+                                  STRCONST("Content-Type: "
+                                           "text/parameters\r\n"));
+          if(result)
+            return result;
+        }
+      }
+
+      if(rtspreq == RTSPREQ_ANNOUNCE) {
+        if(!Curl_checkheaders(data, STRCONST("Content-Type"))) {
+          result = curlx_dyn_addn(reqp,
+                                  STRCONST("Content-Type: "
+                                           "application/sdp\r\n"));
+          if(result)
+            return result;
+        }
+      }
+    }
+    else if(rtspreq == RTSPREQ_GET_PARAMETER) {
+      /* Check for an empty GET_PARAMETER (heartbeat) request */
+      data->state.httpreq = HTTPREQ_HEAD;
+      data->req.no_body = TRUE;
+    }
+  }
+  else
+    result = Curl_creader_set_null(data);
+  return result;
+}
+
 static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
 {
   struct connectdata *conn = data->conn;
@@ -372,7 +452,7 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
   }
 
   if(rtspreq == RTSPREQ_RECEIVE) {
-    Curl_xfer_setup1(data, CURL_XFER_RECV, -1, TRUE);
+    Curl_xfer_setup_recv(data, FIRSTSOCKET, -1);
     goto out;
   }
 
@@ -559,86 +639,16 @@ static CURLcode rtsp_do(struct Curl_easy *data, bool *done)
   if(result)
     goto out;
 
-  if(rtspreq == RTSPREQ_ANNOUNCE ||
-     rtspreq == RTSPREQ_SET_PARAMETER ||
-     rtspreq == RTSPREQ_GET_PARAMETER) {
-    curl_off_t req_clen; /* request content length */
-
-    if(data->state.upload) {
-      req_clen = data->state.infilesize;
-      data->state.httpreq = HTTPREQ_PUT;
-      result = Curl_creader_set_fread(data, req_clen);
-      if(result)
-        goto out;
-    }
-    else {
-      if(data->set.postfields) {
-        size_t plen = strlen(data->set.postfields);
-        req_clen = (curl_off_t)plen;
-        result = Curl_creader_set_buf(data, data->set.postfields, plen);
-      }
-      else if(data->state.infilesize >= 0) {
-        req_clen = data->state.infilesize;
-        result = Curl_creader_set_fread(data, req_clen);
-      }
-      else {
-        req_clen = 0;
-        result = Curl_creader_set_null(data);
-      }
-      if(result)
-        goto out;
-    }
-
-    if(req_clen > 0) {
-      /* As stated in the http comments, it is probably not wise to
-       * actually set a custom Content-Length in the headers */
-      if(!Curl_checkheaders(data, STRCONST("Content-Length"))) {
-        result =
-          curlx_dyn_addf(&req_buffer, "Content-Length: %" FMT_OFF_T"\r\n",
-                         req_clen);
-        if(result)
-          goto out;
-      }
-
-      if(rtspreq == RTSPREQ_SET_PARAMETER ||
-         rtspreq == RTSPREQ_GET_PARAMETER) {
-        if(!Curl_checkheaders(data, STRCONST("Content-Type"))) {
-          result = curlx_dyn_addn(&req_buffer,
-                                  STRCONST("Content-Type: "
-                                           "text/parameters\r\n"));
-          if(result)
-            goto out;
-        }
-      }
-
-      if(rtspreq == RTSPREQ_ANNOUNCE) {
-        if(!Curl_checkheaders(data, STRCONST("Content-Type"))) {
-          result = curlx_dyn_addn(&req_buffer,
-                                  STRCONST("Content-Type: "
-                                           "application/sdp\r\n"));
-          if(result)
-            goto out;
-        }
-      }
-    }
-    else if(rtspreq == RTSPREQ_GET_PARAMETER) {
-      /* Check for an empty GET_PARAMETER (heartbeat) request */
-      data->state.httpreq = HTTPREQ_HEAD;
-      data->req.no_body = TRUE;
-    }
-  }
-  else {
-    result = Curl_creader_set_null(data);
-    if(result)
-      goto out;
-  }
+  result = rtsp_setup_body(data, rtspreq, &req_buffer);
+  if(result)
+    goto out;
 
   /* Finish the request buffer */
   result = curlx_dyn_addn(&req_buffer, STRCONST("\r\n"));
   if(result)
     goto out;
 
-  Curl_xfer_setup1(data, CURL_XFER_SENDRECV, -1, TRUE);
+  Curl_xfer_setup_sendrecv(data, FIRSTSOCKET, -1);
 
   /* issue the request */
   result = Curl_req_send(data, &req_buffer, httpversion);
@@ -937,6 +947,14 @@ static CURLcode rtsp_rtp_write_resp(struct Curl_easy *data,
   return result;
 }
 
+static CURLcode rtsp_rtp_write_resp_hd(struct Curl_easy *data,
+                                       const char *buf,
+                                       size_t blen,
+                                       bool is_eos)
+{
+  return rtsp_rtp_write_resp(data, buf, blen, is_eos);
+}
+
 static
 CURLcode rtp_client_write(struct Curl_easy *data, const char *ptr, size_t len)
 {
diff --git a/deps/curl/lib/select.c b/deps/curl/lib/select.c
index 2353c474df3..af78cb836b0 100644
--- a/deps/curl/lib/select.c
+++ b/deps/curl/lib/select.c
@@ -41,6 +41,7 @@
 #include "urldata.h"
 #include "connect.h"
 #include "select.h"
+#include "curl_trc.h"
 #include "curlx/timediff.h"
 #include "curlx/wait.h"
 #include "curlx/warnless.h"
@@ -423,7 +424,7 @@ CURLcode Curl_pollfds_add_ps(struct curl_pollfds *cpfds,
 
   DEBUGASSERT(cpfds);
   DEBUGASSERT(ps);
-  for(i = 0; i < ps->num; i++) {
+  for(i = 0; i < ps->n; i++) {
     short events = 0;
     if(ps->actions[i] & CURL_POLL_IN)
       events |= POLLIN;
@@ -481,7 +482,7 @@ unsigned int Curl_waitfds_add_ps(struct Curl_waitfds *cwfds,
 
   DEBUGASSERT(cwfds);
   DEBUGASSERT(ps);
-  for(i = 0; i < ps->num; i++) {
+  for(i = 0; i < ps->n; i++) {
     short events = 0;
     if(ps->actions[i] & CURL_POLL_IN)
       events |= CURL_WAIT_POLLIN;
@@ -492,3 +493,233 @@ unsigned int Curl_waitfds_add_ps(struct Curl_waitfds *cwfds,
   }
   return need;
 }
+
+void Curl_pollset_reset(struct easy_pollset *ps)
+{
+  unsigned int i;
+  ps->n = 0;
+#ifdef DEBUGBUILD
+  DEBUGASSERT(ps->init == CURL_EASY_POLLSET_MAGIC);
+#endif
+  DEBUGASSERT(ps->count);
+  for(i = 0; i < ps->count; i++)
+    ps->sockets[i] = CURL_SOCKET_BAD;
+  memset(ps->actions, 0, ps->count * sizeof(ps->actions[0]));
+}
+
+void Curl_pollset_init(struct easy_pollset *ps)
+{
+#ifdef DEBUGBUILD
+  ps->init = CURL_EASY_POLLSET_MAGIC;
+#endif
+  ps->sockets = ps->def_sockets;
+  ps->actions = ps->def_actions;
+  ps->count = CURL_ARRAYSIZE(ps->def_sockets);
+  ps->n = 0;
+  Curl_pollset_reset(ps);
+}
+
+struct easy_pollset *Curl_pollset_create(void)
+{
+  struct easy_pollset *ps = calloc(1, sizeof(*ps));
+  if(ps)
+    Curl_pollset_init(ps);
+  return ps;
+}
+
+void Curl_pollset_cleanup(struct easy_pollset *ps)
+{
+#ifdef DEBUGBUILD
+  DEBUGASSERT(ps->init == CURL_EASY_POLLSET_MAGIC);
+#endif
+  if(ps->sockets != ps->def_sockets) {
+    free(ps->sockets);
+    ps->sockets = ps->def_sockets;
+  }
+  if(ps->actions != ps->def_actions) {
+    free(ps->actions);
+    ps->actions = ps->def_actions;
+  }
+  ps->count = CURL_ARRAYSIZE(ps->def_sockets);
+  Curl_pollset_reset(ps);
+}
+
+void Curl_pollset_move(struct easy_pollset *to, struct easy_pollset *from)
+{
+  Curl_pollset_cleanup(to); /* deallocate anything in to */
+  if(from->sockets != from->def_sockets) {
+    DEBUGASSERT(from->actions != from->def_actions);
+    to->sockets = from->sockets;
+    to->actions = from->actions;
+    to->count = from->count;
+    to->n = from->n;
+    Curl_pollset_init(from);
+  }
+  else {
+    DEBUGASSERT(to->sockets == to->def_sockets);
+    DEBUGASSERT(to->actions == to->def_actions);
+    memcpy(to->sockets, from->sockets, to->count * sizeof(to->sockets[0]));
+    memcpy(to->actions, from->actions, to->count * sizeof(to->actions[0]));
+    to->n = from->n;
+    Curl_pollset_init(from);
+  }
+}
+
+/**
+ *
+ */
+CURLcode Curl_pollset_change(struct Curl_easy *data,
+                             struct easy_pollset *ps, curl_socket_t sock,
+                             int add_flags, int remove_flags)
+{
+  unsigned int i;
+
+#ifdef DEBUGBUILD
+  DEBUGASSERT(ps->init == CURL_EASY_POLLSET_MAGIC);
+#endif
+
+  (void)data;
+  DEBUGASSERT(VALID_SOCK(sock));
+  if(!VALID_SOCK(sock))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  DEBUGASSERT(add_flags <= (CURL_POLL_IN|CURL_POLL_OUT));
+  DEBUGASSERT(remove_flags <= (CURL_POLL_IN|CURL_POLL_OUT));
+  DEBUGASSERT((add_flags&remove_flags) == 0); /* no overlap */
+  for(i = 0; i < ps->n; ++i) {
+    if(ps->sockets[i] == sock) {
+      ps->actions[i] &= (unsigned char)(~remove_flags);
+      ps->actions[i] |= (unsigned char)add_flags;
+      /* all gone? remove socket */
+      if(!ps->actions[i]) {
+        if((i + 1) < ps->n) {
+          memmove(&ps->sockets[i], &ps->sockets[i + 1],
+                  (ps->n - (i + 1)) * sizeof(ps->sockets[0]));
+          memmove(&ps->actions[i], &ps->actions[i + 1],
+                  (ps->n - (i + 1)) * sizeof(ps->actions[0]));
+        }
+        --ps->n;
+      }
+      return CURLE_OK;
+    }
+  }
+  /* not present */
+  if(add_flags) {
+    if(i >= ps->count) { /* need to grow */
+      unsigned int new_count = CURLMAX(ps->count * 2, 8);
+      curl_socket_t *nsockets;
+      unsigned char *nactions;
+
+      CURL_TRC_M(data, "growing pollset capacity from %u to %u",
+                 ps->count, new_count);
+      if(new_count <= ps->count)
+        return CURLE_OUT_OF_MEMORY;
+      nsockets = calloc(new_count, sizeof(nsockets[0]));
+      if(!nsockets)
+        return CURLE_OUT_OF_MEMORY;
+      nactions = calloc(new_count, sizeof(nactions[0]));
+      if(!nactions) {
+        free(nsockets);
+        return CURLE_OUT_OF_MEMORY;
+      }
+      memcpy(nsockets, ps->sockets, ps->count * sizeof(ps->sockets[0]));
+      memcpy(nactions, ps->actions, ps->count * sizeof(ps->actions[0]));
+      if(ps->sockets != ps->def_sockets)
+        free(ps->sockets);
+      ps->sockets = nsockets;
+      if(ps->actions != ps->def_actions)
+        free(ps->actions);
+      ps->actions = nactions;
+      ps->count = new_count;
+    }
+    DEBUGASSERT(i < ps->count);
+    if(i < ps->count) {
+      ps->sockets[i] = sock;
+      ps->actions[i] = (unsigned char)add_flags;
+      ps->n = i + 1;
+    }
+  }
+  return CURLE_OK;
+}
+
+CURLcode Curl_pollset_set(struct Curl_easy *data,
+                          struct easy_pollset *ps, curl_socket_t sock,
+                          bool do_in, bool do_out)
+{
+  return Curl_pollset_change(data, ps, sock,
+                             (do_in ? CURL_POLL_IN : 0)|
+                             (do_out ? CURL_POLL_OUT : 0),
+                             (!do_in ? CURL_POLL_IN : 0)|
+                             (!do_out ? CURL_POLL_OUT : 0));
+}
+
+int Curl_pollset_poll(struct Curl_easy *data,
+                      struct easy_pollset *ps,
+                      timediff_t timeout_ms)
+{
+  struct pollfd *pfds;
+  unsigned int i, npfds;
+  int result;
+
+  (void)data;
+  DEBUGASSERT(data);
+  DEBUGASSERT(data->conn);
+
+  if(!ps->n)
+    return curlx_wait_ms(timeout_ms);
+
+  pfds = calloc(ps->n, sizeof(*pfds));
+  if(!pfds)
+    return -1;
+
+  npfds = 0;
+  for(i = 0; i < ps->n; ++i) {
+    short events = 0;
+    if(ps->actions[i] & CURL_POLL_IN) {
+      events |= POLLIN;
+    }
+    if(ps->actions[i] & CURL_POLL_OUT) {
+      events |= POLLOUT;
+    }
+    if(events) {
+      pfds[npfds].fd = ps->sockets[i];
+      pfds[npfds].events = events;
+      ++npfds;
+    }
+  }
+
+  result = Curl_poll(pfds, npfds, timeout_ms);
+  free(pfds);
+  return result;
+}
+
+void Curl_pollset_check(struct Curl_easy *data,
+                        struct easy_pollset *ps, curl_socket_t sock,
+                        bool *pwant_read, bool *pwant_write)
+{
+  unsigned int i;
+
+  (void)data;
+  DEBUGASSERT(VALID_SOCK(sock));
+  for(i = 0; i < ps->n; ++i) {
+    if(ps->sockets[i] == sock) {
+      *pwant_read = !!(ps->actions[i] & CURL_POLL_IN);
+      *pwant_write = !!(ps->actions[i] & CURL_POLL_OUT);
+      return;
+    }
+  }
+  *pwant_read = *pwant_write = FALSE;
+}
+
+bool Curl_pollset_want_read(struct Curl_easy *data,
+                            struct easy_pollset *ps,
+                            curl_socket_t sock)
+{
+  unsigned int i;
+  (void)data;
+  for(i = 0; i < ps->n; ++i) {
+    if((ps->sockets[i] == sock) && (ps->actions[i] & CURL_POLL_IN))
+      return TRUE;
+  }
+  return FALSE;
+}
diff --git a/deps/curl/lib/select.h b/deps/curl/lib/select.h
index e9cec600f3b..47cdd31267f 100644
--- a/deps/curl/lib/select.h
+++ b/deps/curl/lib/select.h
@@ -110,6 +110,90 @@ int Curl_poll(struct pollfd ufds[], unsigned int nfds, timediff_t timeout_ms);
   } while(0)
 #endif
 
+
+/* Keep the sockets to poll for an easy handle.
+ * `actions` are bitmaps of CURL_POLL_IN and CURL_POLL_OUT.
+ * Starts with small capacity, grows on demand.
+ */
+#define EZ_POLLSET_DEF_COUNT    2
+
+struct easy_pollset {
+  curl_socket_t *sockets;
+  unsigned char *actions;
+  unsigned int n;
+  unsigned int count;
+#ifdef DEBUGBUILD
+  int init;
+#endif
+  curl_socket_t def_sockets[EZ_POLLSET_DEF_COUNT];
+  unsigned char def_actions[EZ_POLLSET_DEF_COUNT];
+};
+
+#ifdef DEBUGBUILD
+#define CURL_EASY_POLLSET_MAGIC  0x7a657370
+#endif
+
+
+/* allocate and initialise */
+struct easy_pollset *Curl_pollset_create(void);
+
+/* Initialize before first use */
+void Curl_pollset_init(struct easy_pollset *ps);
+/* Free any allocated resources */
+void Curl_pollset_cleanup(struct easy_pollset *ps);
+/* Reset to an empty pollset */
+void Curl_pollset_reset(struct easy_pollset *ps);
+/* Move pollset from to pollset to, replacing all in to,
+ * leaving from empty. */
+void Curl_pollset_move(struct easy_pollset *to, struct easy_pollset *from);
+
+/* Change the poll flags (CURL_POLL_IN/CURL_POLL_OUT) to the poll set for
+ * socket `sock`. If the socket is not already part of the poll set, it
+ * will be added.
+ * If the socket is present and all poll flags are cleared, it will be removed.
+ */
+CURLcode Curl_pollset_change(struct Curl_easy *data,
+                             struct easy_pollset *ps, curl_socket_t sock,
+                             int add_flags, int remove_flags);
+
+CURLcode Curl_pollset_set(struct Curl_easy *data,
+                          struct easy_pollset *ps, curl_socket_t sock,
+                          bool do_in, bool do_out);
+
+#define Curl_pollset_add_in(data, ps, sock) \
+          Curl_pollset_change((data), (ps), (sock), CURL_POLL_IN, 0)
+#define Curl_pollset_add_out(data, ps, sock) \
+          Curl_pollset_change((data), (ps), (sock), CURL_POLL_OUT, 0)
+#define Curl_pollset_add_inout(data, ps, sock) \
+          Curl_pollset_change((data), (ps), (sock), \
+                               CURL_POLL_IN|CURL_POLL_OUT, 0)
+#define Curl_pollset_set_in_only(data, ps, sock) \
+          Curl_pollset_change((data), (ps), (sock), \
+                               CURL_POLL_IN, CURL_POLL_OUT)
+#define Curl_pollset_set_out_only(data, ps, sock) \
+          Curl_pollset_change((data), (ps), (sock), \
+                               CURL_POLL_OUT, CURL_POLL_IN)
+
+/* return < = on error, 0 on timeout or how many sockets are ready */
+int Curl_pollset_poll(struct Curl_easy *data,
+                      struct easy_pollset *ps,
+                      timediff_t timeout_ms);
+
+/**
+ * Check if the pollset, as is, wants to read and/or write regarding
+ * the given socket.
+ */
+void Curl_pollset_check(struct Curl_easy *data,
+                        struct easy_pollset *ps, curl_socket_t sock,
+                        bool *pwant_read, bool *pwant_write);
+
+/**
+ * Return TRUE if the pollset contains socket with CURL_POLL_IN.
+ */
+bool Curl_pollset_want_read(struct Curl_easy *data,
+                            struct easy_pollset *ps,
+                            curl_socket_t sock);
+
 struct curl_pollfds {
   struct pollfd *pfds;
   unsigned int n;
diff --git a/deps/curl/lib/sendf.c b/deps/curl/lib/sendf.c
index 339a8773b47..551bb5ca81a 100644
--- a/deps/curl/lib/sendf.c
+++ b/deps/curl/lib/sendf.c
@@ -151,7 +151,7 @@ CURLcode Curl_client_start(struct Curl_easy *data)
 
     CURL_TRC_READ(data, "client start, rewind readers");
     while(r) {
-      result = r->crt->rewind(data, r);
+      result = r->crt->cntrl(data, r, CURL_CRCNTRL_REWIND);
       if(result) {
         failf(data, "rewind of client reader '%s' failed: %d",
               r->crt->name, result);
@@ -203,8 +203,8 @@ CURLcode Curl_cwriter_def_write(struct Curl_easy *data,
 void Curl_cwriter_def_close(struct Curl_easy *data,
                             struct Curl_cwriter *writer)
 {
-  (void) data;
-  (void) writer;
+  (void)data;
+  (void)writer;
 }
 
 static size_t get_max_body_write_len(struct Curl_easy *data, curl_off_t limit)
@@ -218,15 +218,15 @@ static size_t get_max_body_write_len(struct Curl_easy *data, curl_off_t limit)
       return 0;
     }
 #if SIZEOF_CURL_OFF_T > SIZEOF_SIZE_T
-    else if(remain_diff > SSIZE_T_MAX) {
-      return SIZE_T_MAX;
+    else if(remain_diff > SSIZE_MAX) {
+      return SIZE_MAX;
     }
 #endif
     else {
       return (size_t)remain_diff;
     }
   }
-  return SIZE_T_MAX;
+  return SIZE_MAX;
 }
 
 struct cw_download_ctx {
@@ -281,7 +281,7 @@ static CURLcode cw_download_write(struct Curl_easy *data,
    * This gives deterministic BODY writes on varying buffer receive
    * lengths. */
   nwrite = nbytes;
-  if(-1 != data->req.maxdownload) {
+  if(data->req.maxdownload != -1) {
     size_t wmax = get_max_body_write_len(data, data->req.maxdownload);
     if(nwrite > wmax) {
       excess_len = nbytes - wmax;
@@ -293,9 +293,9 @@ static CURLcode cw_download_write(struct Curl_easy *data,
     }
 
     if((type & CLIENTWRITE_EOS) && !data->req.no_body &&
-       (data->req.maxdownload > data->req.bytecount)) {
+       (data->req.size > data->req.bytecount)) {
       failf(data, "end of response with %" FMT_OFF_T " bytes missing",
-            data->req.maxdownload - data->req.bytecount);
+            data->req.size - data->req.bytecount);
       return CURLE_PARTIAL_FILE;
     }
   }
@@ -543,6 +543,15 @@ CURLcode Curl_creader_read(struct Curl_easy *data,
   return reader->crt->do_read(data, reader, buf, blen, nread, eos);
 }
 
+void Curl_creader_clear_eos(struct Curl_easy *data,
+                            struct Curl_creader *reader)
+{
+  while(reader) {
+    (void)reader->crt->cntrl(data, reader, CURL_CRCNTRL_CLEAR_EOS);
+    reader = reader->next;
+  }
+}
+
 CURLcode Curl_creader_def_init(struct Curl_easy *data,
                                struct Curl_creader *reader)
 {
@@ -598,19 +607,13 @@ CURLcode Curl_creader_def_resume_from(struct Curl_easy *data,
   return CURLE_READ_ERROR;
 }
 
-CURLcode Curl_creader_def_rewind(struct Curl_easy *data,
-                                 struct Curl_creader *reader)
-{
-  (void)data;
-  (void)reader;
-  return CURLE_OK;
-}
-
-CURLcode Curl_creader_def_unpause(struct Curl_easy *data,
-                                  struct Curl_creader *reader)
+CURLcode Curl_creader_def_cntrl(struct Curl_easy *data,
+                                struct Curl_creader *reader,
+                                Curl_creader_cntrl opcode)
 {
   (void)data;
   (void)reader;
+  (void)opcode;
   return CURLE_OK;
 }
 
@@ -879,7 +882,7 @@ static CURLcode cr_in_rewind(struct Curl_easy *data,
       int err = fseek(data->state.in, 0, SEEK_SET);
       CURL_TRC_READ(data, "cr_in, rewind via fseek -> %d(%d)",
                     (int)err, (int)errno);
-      if(-1 != err)
+      if(err != -1)
         /* successful rewind */
         return CURLE_OK;
     }
@@ -891,12 +894,24 @@ static CURLcode cr_in_rewind(struct Curl_easy *data,
   return CURLE_OK;
 }
 
-static CURLcode cr_in_unpause(struct Curl_easy *data,
-                              struct Curl_creader *reader)
+static CURLcode cr_in_cntrl(struct Curl_easy *data,
+                            struct Curl_creader *reader,
+                            Curl_creader_cntrl opcode)
 {
   struct cr_in_ctx *ctx = reader->ctx;
-  (void)data;
-  ctx->is_paused = FALSE;
+
+  switch(opcode) {
+  case CURL_CRCNTRL_REWIND:
+    return cr_in_rewind(data, reader);
+  case CURL_CRCNTRL_UNPAUSE:
+    ctx->is_paused = FALSE;
+    break;
+  case CURL_CRCNTRL_CLEAR_EOS:
+    ctx->seen_eos = FALSE;
+    break;
+  default:
+    break;
+  }
   return CURLE_OK;
 }
 
@@ -916,8 +931,7 @@ static const struct Curl_crtype cr_in = {
   cr_in_needs_rewind,
   cr_in_total_length,
   cr_in_resume_from,
-  cr_in_rewind,
-  cr_in_unpause,
+  cr_in_cntrl,
   cr_in_is_paused,
   Curl_creader_def_done,
   sizeof(struct cr_in_ctx)
@@ -1077,8 +1091,7 @@ static const struct Curl_crtype cr_lc = {
   Curl_creader_def_needs_rewind,
   cr_lc_total_length,
   Curl_creader_def_resume_from,
-  Curl_creader_def_rewind,
-  Curl_creader_def_unpause,
+  Curl_creader_def_cntrl,
   Curl_creader_def_is_paused,
   Curl_creader_def_done,
   sizeof(struct cr_lc_ctx)
@@ -1251,8 +1264,7 @@ static const struct Curl_crtype cr_null = {
   Curl_creader_def_needs_rewind,
   cr_null_total_length,
   Curl_creader_def_resume_from,
-  Curl_creader_def_rewind,
-  Curl_creader_def_unpause,
+  Curl_creader_def_cntrl,
   Curl_creader_def_is_paused,
   Curl_creader_def_done,
   sizeof(struct Curl_creader)
@@ -1312,12 +1324,19 @@ static bool cr_buf_needs_rewind(struct Curl_easy *data,
   return ctx->index > 0;
 }
 
-static CURLcode cr_buf_rewind(struct Curl_easy *data,
-                              struct Curl_creader *reader)
+static CURLcode cr_buf_cntrl(struct Curl_easy *data,
+                             struct Curl_creader *reader,
+                             Curl_creader_cntrl opcode)
 {
   struct cr_buf_ctx *ctx = reader->ctx;
   (void)data;
-  ctx->index = 0;
+  switch(opcode) {
+  case CURL_CRCNTRL_REWIND:
+    ctx->index = 0;
+    break;
+  default:
+    break;
+  }
   return CURLE_OK;
 }
 
@@ -1360,8 +1379,7 @@ static const struct Curl_crtype cr_buf = {
   cr_buf_needs_rewind,
   cr_buf_total_length,
   cr_buf_resume_from,
-  cr_buf_rewind,
-  Curl_creader_def_unpause,
+  cr_buf_cntrl,
   Curl_creader_def_is_paused,
   Curl_creader_def_done,
   sizeof(struct cr_buf_ctx)
@@ -1417,7 +1435,7 @@ CURLcode Curl_creader_unpause(struct Curl_easy *data)
   CURLcode result = CURLE_OK;
 
   while(reader) {
-    result = reader->crt->unpause(data, reader);
+    result = reader->crt->cntrl(data, reader, CURL_CRCNTRL_UNPAUSE);
     if(result)
       break;
     reader = reader->next;
diff --git a/deps/curl/lib/sendf.h b/deps/curl/lib/sendf.h
index e5cc600bfe5..68674439010 100644
--- a/deps/curl/lib/sendf.h
+++ b/deps/curl/lib/sendf.h
@@ -50,6 +50,7 @@
 #define CLIENTWRITE_1XX     (1<<5) /* a 1xx response related HEADER */
 #define CLIENTWRITE_TRAILER (1<<6) /* a trailer HEADER */
 #define CLIENTWRITE_EOS     (1<<7) /* End Of transfer download Stream */
+#define CLIENTWRITE_0LEN    (1<<8) /* write even 0-length buffers */
 
 /**
  * Write `len` bytes at `prt` to the client. `type` indicates what
@@ -202,6 +203,11 @@ void Curl_cwriter_def_close(struct Curl_easy *data,
                             struct Curl_cwriter *writer);
 
 
+typedef enum {
+  CURL_CRCNTRL_REWIND,
+  CURL_CRCNTRL_UNPAUSE,
+  CURL_CRCNTRL_CLEAR_EOS
+} Curl_creader_cntrl;
 
 /* Client Reader Type, provides the implementation */
 struct Curl_crtype {
@@ -215,8 +221,8 @@ struct Curl_crtype {
                              struct Curl_creader *reader);
   CURLcode (*resume_from)(struct Curl_easy *data,
                           struct Curl_creader *reader, curl_off_t offset);
-  CURLcode (*rewind)(struct Curl_easy *data, struct Curl_creader *reader);
-  CURLcode (*unpause)(struct Curl_easy *data, struct Curl_creader *reader);
+  CURLcode (*cntrl)(struct Curl_easy *data, struct Curl_creader *reader,
+                    Curl_creader_cntrl opcode);
   bool (*is_paused)(struct Curl_easy *data, struct Curl_creader *reader);
   void (*done)(struct Curl_easy *data,
                struct Curl_creader *reader, int premature);
@@ -264,10 +270,9 @@ curl_off_t Curl_creader_def_total_length(struct Curl_easy *data,
 CURLcode Curl_creader_def_resume_from(struct Curl_easy *data,
                                       struct Curl_creader *reader,
                                       curl_off_t offset);
-CURLcode Curl_creader_def_rewind(struct Curl_easy *data,
-                                 struct Curl_creader *reader);
-CURLcode Curl_creader_def_unpause(struct Curl_easy *data,
-                                  struct Curl_creader *reader);
+CURLcode Curl_creader_def_cntrl(struct Curl_easy *data,
+                                struct Curl_creader *reader,
+                                Curl_creader_cntrl opcode);
 bool Curl_creader_def_is_paused(struct Curl_easy *data,
                                 struct Curl_creader *reader);
 void Curl_creader_def_done(struct Curl_easy *data,
@@ -281,6 +286,10 @@ CURLcode Curl_creader_read(struct Curl_easy *data,
                            struct Curl_creader *reader,
                            char *buf, size_t blen, size_t *nread, bool *eos);
 
+/* Tell the reader and all below that any EOS state is to be cleared */
+void Curl_creader_clear_eos(struct Curl_easy *data,
+                            struct Curl_creader *reader);
+
 /**
  * Create a new creader instance with given type and phase. Is not
  * inserted into the writer chain by this call.
diff --git a/deps/curl/lib/setopt.c b/deps/curl/lib/setopt.c
index 1380c33db6f..5adfe4dbebb 100644
--- a/deps/curl/lib/setopt.c
+++ b/deps/curl/lib/setopt.c
@@ -60,7 +60,6 @@
 #include "curl_memory.h"
 #include "memdebug.h"
 
-
 static CURLcode setopt_set_timeout_sec(timediff_t *ptimeout_ms, long secs)
 {
   if(secs < 0)
@@ -327,8 +326,8 @@ static CURLcode setopt_HTTP_VERSION(struct Curl_easy *data, long arg)
 #endif /* ! CURL_DISABLE_HTTP */
 
 #ifdef USE_SSL
-static CURLcode setopt_SSLVERSION(struct Curl_easy *data, CURLoption option,
-                                  long arg)
+CURLcode Curl_setopt_SSLVERSION(struct Curl_easy *data, CURLoption option,
+                                long arg)
 {
   /*
    * Set explicit SSL version to try to connect with, as some SSL
@@ -353,6 +352,8 @@ static CURLcode setopt_SSLVERSION(struct Curl_easy *data, CURLoption option,
        version_max < CURL_SSLVERSION_MAX_NONE ||
        version_max >= CURL_SSLVERSION_MAX_LAST)
       return CURLE_BAD_FUNCTION_ARGUMENT;
+    if(version == CURL_SSLVERSION_DEFAULT)
+      version = CURL_SSLVERSION_TLSv1_2;
 
     primary->version = (unsigned char)version;
     primary->version_max = (unsigned int)version_max;
@@ -438,67 +439,38 @@ static void set_ssl_options(struct ssl_config_data *ssl,
 }
 #endif
 
-static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
-                            long arg)
+static CURLcode setopt_bool(struct Curl_easy *data, CURLoption option,
+                            long arg, bool *set)
 {
-  bool enabled = (0 != arg);
-  unsigned long uarg = (unsigned long)arg;
+  bool enabled = !!arg;
+  struct UserDefined *s = &data->set;
   switch(option) {
-  case CURLOPT_DNS_CACHE_TIMEOUT:
-    if(arg < -1)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    else if(arg > INT_MAX)
-      arg = INT_MAX;
-
-    data->set.dns_cache_timeout = (int)arg;
-    break;
-  case CURLOPT_CA_CACHE_TIMEOUT:
-    if(Curl_ssl_supports(data, SSLSUPP_CA_CACHE)) {
-      if(arg < -1)
-        return CURLE_BAD_FUNCTION_ARGUMENT;
-      else if(arg > INT_MAX)
-        arg = INT_MAX;
-
-      data->set.general_ssl.ca_cache_timeout = (int)arg;
-    }
-    else
-      return CURLE_NOT_BUILT_IN;
-    break;
-  case CURLOPT_MAXCONNECTS:
-    /*
-     * Set the absolute number of maximum simultaneous alive connection that
-     * libcurl is allowed to have.
-     */
-    if(uarg > UINT_MAX)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.maxconnects = (unsigned int)uarg;
-    break;
   case CURLOPT_FORBID_REUSE:
     /*
      * When this transfer is done, it must not be left to be reused by a
      * subsequent transfer but shall be closed immediately.
      */
-    data->set.reuse_forbid = enabled;
+    s->reuse_forbid = enabled;
     break;
   case CURLOPT_FRESH_CONNECT:
     /*
      * This transfer shall not use a previously cached connection but
      * should be made with a fresh new connect!
      */
-    data->set.reuse_fresh = enabled;
+    s->reuse_fresh = enabled;
     break;
   case CURLOPT_VERBOSE:
     /*
      * Verbose means infof() calls that give a lot of information about
      * the connection and transfer procedures as well as internal choices.
      */
-    data->set.verbose = enabled;
+    s->verbose = enabled;
     break;
   case CURLOPT_HEADER:
     /*
      * Set to include the header in the general data output stream.
      */
-    data->set.include_header = enabled;
+    s->include_header = enabled;
     break;
   case CURLOPT_NOPROGRESS:
     /*
@@ -510,13 +482,13 @@ static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
     /*
      * Do not include the body part in the output data stream.
      */
-    data->set.opt_no_body = enabled;
+    s->opt_no_body = enabled;
 #ifndef CURL_DISABLE_HTTP
-    if(data->set.opt_no_body)
+    if(s->opt_no_body)
       /* in HTTP lingo, no body means using the HEAD request... */
-      data->set.method = HTTPREQ_HEAD;
-    else if(data->set.method == HTTPREQ_HEAD)
-      data->set.method = HTTPREQ_GET;
+      s->method = HTTPREQ_HEAD;
+    else if(s->method == HTTPREQ_HEAD)
+      s->method = HTTPREQ_GET;
 #endif
     break;
   case CURLOPT_FAILONERROR:
@@ -524,10 +496,10 @@ static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
      * Do not output the >=400 error code HTML-page, but instead only
      * return error.
      */
-    data->set.http_fail_on_error = enabled;
+    s->http_fail_on_error = enabled;
     break;
   case CURLOPT_KEEP_SENDING_ON_ERROR:
-    data->set.http_keep_sending_on_error = enabled;
+    s->http_keep_sending_on_error = enabled;
     break;
   case CURLOPT_UPLOAD:
   case CURLOPT_PUT:
@@ -535,119 +507,27 @@ static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
      * We want to sent data to the remote host. If this is HTTP, that equals
      * using the PUT request.
      */
-    if(arg) {
+    if(enabled) {
       /* If this is HTTP, PUT is what's needed to "upload" */
-      data->set.method = HTTPREQ_PUT;
-      data->set.opt_no_body = FALSE; /* this is implied */
+      s->method = HTTPREQ_PUT;
+      s->opt_no_body = FALSE; /* this is implied */
     }
     else
       /* In HTTP, the opposite of upload is GET (unless NOBODY is true as
          then this can be changed to HEAD later on) */
-      data->set.method = HTTPREQ_GET;
+      s->method = HTTPREQ_GET;
     break;
   case CURLOPT_FILETIME:
     /*
      * Try to get the file time of the remote document. The time will
      * later (possibly) become available using curl_easy_getinfo().
      */
-    data->set.get_filetime = enabled;
-    break;
-  case CURLOPT_SERVER_RESPONSE_TIMEOUT:
-    /*
-     * Option that specifies how quickly a server response must be obtained
-     * before it is considered failure. For pingpong protocols.
-     */
-    return setopt_set_timeout_sec(&data->set.server_response_timeout, arg);
-
-  case CURLOPT_SERVER_RESPONSE_TIMEOUT_MS:
-    /*
-     * Option that specifies how quickly a server response must be obtained
-     * before it is considered failure. For pingpong protocols.
-     */
-    return setopt_set_timeout_ms(&data->set.server_response_timeout, arg);
-
-#ifndef CURL_DISABLE_TFTP
-  case CURLOPT_TFTP_NO_OPTIONS:
-    /*
-     * Option that prevents libcurl from sending TFTP option requests to the
-     * server.
-     */
-    data->set.tftp_no_options = enabled;
-    break;
-  case CURLOPT_TFTP_BLKSIZE:
-    /*
-     * TFTP option that specifies the block size to use for data transmission.
-     */
-    if(arg < TFTP_BLKSIZE_MIN)
-      arg = 512;
-    else if(arg > TFTP_BLKSIZE_MAX)
-      arg = TFTP_BLKSIZE_MAX;
-    data->set.tftp_blksize = arg;
-    break;
-#endif
-#ifndef CURL_DISABLE_NETRC
-  case CURLOPT_NETRC:
-    /*
-     * Parse the $HOME/.netrc file
-     */
-    if((arg < CURL_NETRC_IGNORED) || (arg >= CURL_NETRC_LAST))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.use_netrc = (unsigned char)arg;
-    break;
-#endif
-  case CURLOPT_TRANSFERTEXT:
-    /*
-     * This option was previously named 'FTPASCII'. Renamed to work with
-     * more protocols than merely FTP.
-     *
-     * Transfer using ASCII (instead of BINARY).
-     */
-    data->set.prefer_ascii = enabled;
-    break;
-  case CURLOPT_TIMECONDITION:
-    /*
-     * Set HTTP time condition. This must be one of the defines in the
-     * curl/curl.h header file.
-     */
-    if((arg < CURL_TIMECOND_NONE) || (arg >= CURL_TIMECOND_LAST))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.timecondition = (unsigned char)arg;
-    break;
-  case CURLOPT_TIMEVALUE:
-    /*
-     * This is the value to compare with the remote document with the
-     * method set with CURLOPT_TIMECONDITION
-     */
-    data->set.timevalue = (time_t)arg;
-    break;
-  case CURLOPT_SSLVERSION:
-#ifndef CURL_DISABLE_PROXY
-  case CURLOPT_PROXY_SSLVERSION:
-#endif
-#ifdef USE_SSL
-    return setopt_SSLVERSION(data, option, arg);
-#else
-    return CURLE_NOT_BUILT_IN;
-#endif
-
-  case CURLOPT_POSTFIELDSIZE:
-    /*
-     * The size of the POSTFIELD data to prevent libcurl to do strlen() to
-     * figure it out. Enables binary posts.
-     */
-    if(arg < -1)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-
-    if(data->set.postfieldsize < arg &&
-       data->set.postfields == data->set.str[STRING_COPYPOSTFIELDS]) {
-      /* Previous CURLOPT_COPYPOSTFIELDS is no longer valid. */
-      Curl_safefree(data->set.str[STRING_COPYPOSTFIELDS]);
-      data->set.postfields = NULL;
-    }
-
-    data->set.postfieldsize = arg;
+    s->get_filetime = enabled;
     break;
 #ifndef CURL_DISABLE_HTTP
+  case CURLOPT_HTTP09_ALLOWED:
+    s->http09_allowed = enabled;
+    break;
 #if !defined(CURL_DISABLE_COOKIES)
   case CURLOPT_COOKIESESSION:
     /*
@@ -656,171 +536,80 @@ static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
      * cookies that are marked as being session cookies, as they belong to a
      * previous session.
      */
-    data->set.cookiesession = enabled;
+    s->cookiesession = enabled;
     break;
 #endif
   case CURLOPT_AUTOREFERER:
     /*
      * Switch on automatic referer that gets set if curl follows locations.
      */
-    data->set.http_auto_referer = enabled;
+    s->http_auto_referer = enabled;
     break;
 
   case CURLOPT_TRANSFER_ENCODING:
-    data->set.http_transfer_encoding = enabled;
-    break;
-
-  case CURLOPT_FOLLOWLOCATION:
-    /*
-     * Follow Location: header hints on an HTTP-server.
-     */
-    if(uarg > 3)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.http_follow_mode = (unsigned char)uarg;
+    s->http_transfer_encoding = enabled;
     break;
-
   case CURLOPT_UNRESTRICTED_AUTH:
     /*
      * Send authentication (user+password) when following locations, even when
      * hostname changed.
      */
-    data->set.allow_auth_to_other_hosts = enabled;
-    break;
-
-  case CURLOPT_MAXREDIRS:
-    /*
-     * The maximum amount of hops you allow curl to follow Location:
-     * headers. This should mostly be used to detect never-ending loops.
-     */
-    if(arg < -1)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.maxredirs = arg;
+    s->allow_auth_to_other_hosts = enabled;
     break;
 
-  case CURLOPT_POSTREDIR:
+  case CURLOPT_HTTP_TRANSFER_DECODING:
     /*
-     * Set the behavior of POST when redirecting
-     * CURL_REDIR_GET_ALL - POST is changed to GET after 301 and 302
-     * CURL_REDIR_POST_301 - POST is kept as POST after 301
-     * CURL_REDIR_POST_302 - POST is kept as POST after 302
-     * CURL_REDIR_POST_303 - POST is kept as POST after 303
-     * CURL_REDIR_POST_ALL - POST is kept as POST after 301, 302 and 303
-     * other - POST is kept as POST after 301 and 302
+     * disable libcurl transfer encoding is used
      */
-    if(arg < CURL_REDIR_GET_ALL)
-      /* no return error on too high numbers since the bitmask could be
-         extended in a future */
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.keep_post = arg & CURL_REDIR_POST_ALL;
+    s->http_te_skip = !enabled; /* reversed */
     break;
 
-  case CURLOPT_POST:
-    /* Does this option serve a purpose anymore? Yes it does, when
-       CURLOPT_POSTFIELDS is not used and the POST data is read off the
-       callback! */
-    if(arg) {
-      data->set.method = HTTPREQ_POST;
-      data->set.opt_no_body = FALSE; /* this is implied */
-    }
-    else
-      data->set.method = HTTPREQ_GET;
-    break;
-  case CURLOPT_HEADEROPT:
+  case CURLOPT_HTTP_CONTENT_DECODING:
     /*
-     * Set header option.
+     * raw data passed to the application when content encoding is used
      */
-    data->set.sep_headers = !!(arg & CURLHEADER_SEPARATE);
+    s->http_ce_skip = !enabled; /* reversed */
     break;
-  case CURLOPT_HTTPAUTH:
-    return httpauth(data, FALSE, uarg);
 
   case CURLOPT_HTTPGET:
     /*
      * Set to force us do HTTP GET
      */
     if(enabled) {
-      data->set.method = HTTPREQ_GET;
-      data->set.opt_no_body = FALSE; /* this is implied */
+      s->method = HTTPREQ_GET;
+      s->opt_no_body = FALSE; /* this is implied */
     }
     break;
-
-  case CURLOPT_HTTP_VERSION:
-    return setopt_HTTP_VERSION(data, arg);
-
-  case CURLOPT_EXPECT_100_TIMEOUT_MS:
-    /*
-     * Time to wait for a response to an HTTP request containing an
-     * Expect: 100-continue header before sending the data anyway.
-     */
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.expect_100_timeout = arg;
-    break;
-
-  case CURLOPT_HTTP09_ALLOWED:
-    data->set.http09_allowed = enabled;
+  case CURLOPT_POST:
+    /* Does this option serve a purpose anymore? Yes it does, when
+       CURLOPT_POSTFIELDS is not used and the POST data is read off the
+       callback! */
+    if(enabled) {
+      s->method = HTTPREQ_POST;
+      s->opt_no_body = FALSE; /* this is implied */
+    }
+    else
+      s->method = HTTPREQ_GET;
     break;
 #endif /* ! CURL_DISABLE_HTTP */
-
-#ifndef CURL_DISABLE_MIME
-  case CURLOPT_MIME_OPTIONS:
-    data->set.mime_formescape = !!(arg & CURLMIMEOPT_FORMESCAPE);
-    break;
-#endif
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_HTTPPROXYTUNNEL:
     /*
      * Tunnel operations through the proxy instead of normal proxy use
      */
-    data->set.tunnel_thru_httpproxy = enabled;
-    break;
-
-  case CURLOPT_PROXYPORT:
-    /*
-     * Explicitly set HTTP proxy port number.
-     */
-    if((arg < 0) || (arg > 65535))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.proxyport = (unsigned short)arg;
-    break;
-
-  case CURLOPT_PROXYAUTH:
-    return httpauth(data, TRUE, uarg);
-
-  case CURLOPT_PROXYTYPE:
-    /*
-     * Set proxy type.
-     */
-    if((arg < CURLPROXY_HTTP) || (arg > CURLPROXY_SOCKS5_HOSTNAME))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.proxytype = (unsigned char)(curl_proxytype)arg;
-    break;
-
-  case CURLOPT_PROXY_TRANSFER_MODE:
-    /*
-     * set transfer mode (;type=<a|i>) when doing FTP via an HTTP proxy
-     */
-    if(uarg > 1)
-      /* reserve other values for future use */
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.proxy_transfer_mode = (bool)uarg;
-    break;
-  case CURLOPT_SOCKS5_AUTH:
-    if(uarg & ~(CURLAUTH_BASIC | CURLAUTH_GSSAPI))
-      return CURLE_NOT_BUILT_IN;
-    data->set.socks5auth = (unsigned char)uarg;
+    s->tunnel_thru_httpproxy = enabled;
     break;
   case CURLOPT_HAPROXYPROTOCOL:
     /*
      * Set to send the HAProxy Proxy Protocol header
      */
-    data->set.haproxyprotocol = enabled;
+    s->haproxyprotocol = enabled;
     break;
   case CURLOPT_PROXY_SSL_VERIFYPEER:
     /*
      * Enable peer SSL verifying for proxy.
      */
-    data->set.proxy_ssl.primary.verifypeer = enabled;
+    s->proxy_ssl.primary.verifypeer = enabled;
 
     /* Update the current connection proxy_ssl_config. */
     Curl_ssl_conn_config_update(data, TRUE);
@@ -829,19 +618,24 @@ static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
     /*
      * Enable verification of the hostname in the peer certificate for proxy
      */
-    data->set.proxy_ssl.primary.verifyhost = enabled;
+    s->proxy_ssl.primary.verifyhost = enabled;
 
     /* Update the current connection proxy_ssl_config. */
     Curl_ssl_conn_config_update(data, TRUE);
     break;
+  case CURLOPT_PROXY_TRANSFER_MODE:
+    /*
+     * set transfer mode (;type=<a|i>) when doing FTP via an HTTP proxy
+     */
+    s->proxy_transfer_mode = enabled;
+    break;
 #endif /* ! CURL_DISABLE_PROXY */
-
 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
   case CURLOPT_SOCKS5_GSSAPI_NEC:
     /*
      * Set flag for NEC SOCK5 support
      */
-    data->set.socks5_gssapi_nec = enabled;
+    s->socks5_gssapi_nec = enabled;
     break;
 #endif
 #ifdef CURL_LIST_ONLY_PROTOCOL
@@ -850,7 +644,7 @@ static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
      * An option that changes the command to one that asks for a list only, no
      * file info details. Used for FTP, POP3 and SFTP.
      */
-    data->set.list_only = enabled;
+    s->list_only = enabled;
     break;
 #endif
   case CURLOPT_APPEND:
@@ -858,202 +652,86 @@ static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
      * We want to upload and append to an existing file. Used for FTP and
      * SFTP.
      */
-    data->set.remote_append = enabled;
+    s->remote_append = enabled;
     break;
-
 #ifndef CURL_DISABLE_FTP
-  case CURLOPT_FTP_FILEMETHOD:
-    /*
-     * How do access files over FTP.
-     */
-    if((arg < CURLFTPMETHOD_DEFAULT) || (arg >= CURLFTPMETHOD_LAST))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.ftp_filemethod = (unsigned char)arg;
-    break;
   case CURLOPT_FTP_USE_EPRT:
-    data->set.ftp_use_eprt = enabled;
+    s->ftp_use_eprt = enabled;
     break;
 
   case CURLOPT_FTP_USE_EPSV:
-    data->set.ftp_use_epsv = enabled;
+    s->ftp_use_epsv = enabled;
     break;
 
   case CURLOPT_FTP_USE_PRET:
-    data->set.ftp_use_pret = enabled;
-    break;
-
-  case CURLOPT_FTP_SSL_CCC:
-    if((arg < CURLFTPSSL_CCC_NONE) || (arg >= CURLFTPSSL_CCC_LAST))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.ftp_ccc = (unsigned char)arg;
+    s->ftp_use_pret = enabled;
     break;
-
   case CURLOPT_FTP_SKIP_PASV_IP:
     /*
      * Enable or disable FTP_SKIP_PASV_IP, which will disable/enable the
      * bypass of the IP address in PASV responses.
      */
-    data->set.ftp_skip_ip = enabled;
+    s->ftp_skip_ip = enabled;
     break;
-
-  case CURLOPT_FTPSSLAUTH:
-    /*
-     * Set a specific auth for FTP-SSL transfers.
-     */
-    if((arg < CURLFTPAUTH_DEFAULT) || (arg >= CURLFTPAUTH_LAST))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.ftpsslauth = (unsigned char)(curl_ftpauth)arg;
+  case CURLOPT_WILDCARDMATCH:
+    s->wildcard_enabled = enabled;
     break;
-  case CURLOPT_ACCEPTTIMEOUT_MS:
+#endif
+  case CURLOPT_CRLF:
     /*
-     * The maximum time for curl to wait for FTP server connect
+     * Kludgy option to enable CRLF conversions. Subject for removal.
      */
-    return setopt_set_timeout_ms(&data->set.accepttimeout, arg);
-
-  case CURLOPT_WILDCARDMATCH:
-    data->set.wildcard_enabled = enabled;
+    s->crlf = enabled;
     break;
-#endif /* ! CURL_DISABLE_FTP */
-#if !defined(CURL_DISABLE_FTP) || defined(USE_SSH)
-  case CURLOPT_FTP_CREATE_MISSING_DIRS:
+
+#ifndef CURL_DISABLE_TFTP
+  case CURLOPT_TFTP_NO_OPTIONS:
     /*
-     * An FTP/SFTP option that modifies an upload to create missing
-     * directories on the server.
+     * Option that prevents libcurl from sending TFTP option requests to the
+     * server.
      */
-    /* reserve other values for future use */
-    if((arg < CURLFTP_CREATE_DIR_NONE) || (arg > CURLFTP_CREATE_DIR_RETRY))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.ftp_create_missing_dirs = (unsigned char)arg;
+    s->tftp_no_options = enabled;
     break;
-#endif /* ! CURL_DISABLE_FTP || USE_SSH */
-  case CURLOPT_INFILESIZE:
+#endif /* ! CURL_DISABLE_TFTP */
+  case CURLOPT_TRANSFERTEXT:
     /*
-     * If known, this should inform curl about the file size of the
-     * to-be-uploaded file.
+     * This option was previously named 'FTPASCII'. Renamed to work with
+     * more protocols than merely FTP.
+     *
+     * Transfer using ASCII (instead of BINARY).
      */
-    if(arg < -1)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.filesize = arg;
+    s->prefer_ascii = enabled;
     break;
-  case CURLOPT_LOW_SPEED_LIMIT:
+  case CURLOPT_SSL_VERIFYPEER:
     /*
-     * The low speed limit that if transfers are below this for
-     * CURLOPT_LOW_SPEED_TIME, the transfer is aborted.
+     * Enable peer SSL verifying.
      */
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.low_speed_limit = arg;
+    s->ssl.primary.verifypeer = enabled;
+
+    /* Update the current connection ssl_config. */
+    Curl_ssl_conn_config_update(data, FALSE);
     break;
-  case CURLOPT_LOW_SPEED_TIME:
+#ifndef CURL_DISABLE_DOH
+  case CURLOPT_DOH_SSL_VERIFYPEER:
     /*
-     * The low speed time that if transfers are below the set
-     * CURLOPT_LOW_SPEED_LIMIT during this time, the transfer is aborted.
+     * Enable peer SSL verifying for DoH.
      */
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.low_speed_time = arg;
+    s->doh_verifypeer = enabled;
     break;
-  case CURLOPT_PORT:
+  case CURLOPT_DOH_SSL_VERIFYHOST:
     /*
-     * The port number to use when getting the URL. 0 disables it.
+     * Enable verification of the hostname in the peer certificate for DoH
      */
-    if((arg < 0) || (arg > 65535))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.use_port = (unsigned short)arg;
+    s->doh_verifyhost = enabled;
     break;
-  case CURLOPT_TIMEOUT:
-    /*
-     * The maximum time you allow curl to use for a single transfer
-     * operation.
-     */
-    return setopt_set_timeout_sec(&data->set.timeout, arg);
-
-  case CURLOPT_TIMEOUT_MS:
-    return setopt_set_timeout_ms(&data->set.timeout, arg);
-
-  case CURLOPT_CONNECTTIMEOUT:
-    /*
-     * The maximum time you allow curl to use to connect.
-     */
-    return setopt_set_timeout_sec(&data->set.connecttimeout, arg);
-
-  case CURLOPT_CONNECTTIMEOUT_MS:
-    return setopt_set_timeout_ms(&data->set.connecttimeout, arg);
-
-  case CURLOPT_RESUME_FROM:
-    /*
-     * Resume transfer at the given file position
-     */
-    if(arg < -1)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.set_resume_from = arg;
-    break;
-
-  case CURLOPT_CRLF:
-    /*
-     * Kludgy option to enable CRLF conversions. Subject for removal.
-     */
-    data->set.crlf = enabled;
-    break;
-
-#ifndef CURL_DISABLE_BINDLOCAL
-  case CURLOPT_LOCALPORT:
-    /*
-     * Set what local port to bind the socket to when performing an operation.
-     */
-    if((arg < 0) || (arg > 65535))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.localport = curlx_sltous(arg);
-    break;
-  case CURLOPT_LOCALPORTRANGE:
-    /*
-     * Set number of local ports to try, starting with CURLOPT_LOCALPORT.
-     */
-    if((arg < 0) || (arg > 65535))
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.localportrange = curlx_sltous(arg);
-    break;
-#endif
-
-#ifdef HAVE_GSSAPI
-  case CURLOPT_GSSAPI_DELEGATION:
-    /*
-     * GSS-API credential delegation bitmask
-     */
-    data->set.gssapi_delegation = (unsigned char)uarg&
-      (CURLGSSAPI_DELEGATION_POLICY_FLAG|CURLGSSAPI_DELEGATION_FLAG);
-    break;
-#endif
-  case CURLOPT_SSL_VERIFYPEER:
-    /*
-     * Enable peer SSL verifying.
-     */
-    data->set.ssl.primary.verifypeer = enabled;
-
-    /* Update the current connection ssl_config. */
-    Curl_ssl_conn_config_update(data, FALSE);
-    break;
-#ifndef CURL_DISABLE_DOH
-  case CURLOPT_DOH_SSL_VERIFYPEER:
-    /*
-     * Enable peer SSL verifying for DoH.
-     */
-    data->set.doh_verifypeer = enabled;
-    break;
-  case CURLOPT_DOH_SSL_VERIFYHOST:
-    /*
-     * Enable verification of the hostname in the peer certificate for DoH
-     */
-    data->set.doh_verifyhost = enabled;
-    break;
-  case CURLOPT_DOH_SSL_VERIFYSTATUS:
+  case CURLOPT_DOH_SSL_VERIFYSTATUS:
     /*
      * Enable certificate status verifying for DoH.
      */
     if(!Curl_ssl_cert_status_request())
       return CURLE_NOT_BUILT_IN;
 
-    data->set.doh_verifystatus = enabled;
+    s->doh_verifystatus = enabled;
     break;
 #endif /* ! CURL_DISABLE_DOH */
   case CURLOPT_SSL_VERIFYHOST:
@@ -1064,7 +742,7 @@ static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
     /* Obviously people are not reading documentation and too many thought
        this argument took a boolean when it was not and misused it.
        Treat 1 and 2 the same */
-    data->set.ssl.primary.verifyhost = enabled;
+    s->ssl.primary.verifyhost = enabled;
 
     /* Update the current connection ssl_config. */
     Curl_ssl_conn_config_update(data, FALSE);
@@ -1076,84 +754,383 @@ static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
     if(!Curl_ssl_cert_status_request())
       return CURLE_NOT_BUILT_IN;
 
-    data->set.ssl.primary.verifystatus = enabled;
+    s->ssl.primary.verifystatus = enabled;
 
     /* Update the current connection ssl_config. */
     Curl_ssl_conn_config_update(data, FALSE);
     break;
-  case CURLOPT_SSL_FALSESTART:
-    /*
-     * No TLS backends support false start anymore.
-     */
-    return CURLE_NOT_BUILT_IN;
   case CURLOPT_CERTINFO:
 #ifdef USE_SSL
     if(Curl_ssl_supports(data, SSLSUPP_CERTINFO))
-      data->set.ssl.certinfo = enabled;
+      s->ssl.certinfo = enabled;
     else
 #endif
       return CURLE_NOT_BUILT_IN;
     break;
-  case CURLOPT_BUFFERSIZE:
+  case CURLOPT_NOSIGNAL:
     /*
-     * The application kindly asks for a differently sized receive buffer.
-     * If it seems reasonable, we will use it.
+     * The application asks not to set any signal() or alarm() handlers,
+     * even when using a timeout.
      */
-    if(arg > READBUFFER_MAX)
-      arg = READBUFFER_MAX;
-    else if(arg < 1)
-      arg = READBUFFER_SIZE;
-    else if(arg < READBUFFER_MIN)
-      arg = READBUFFER_MIN;
-
-    data->set.buffer_size = (unsigned int)arg;
+    s->no_signal = enabled;
     break;
-
-  case CURLOPT_UPLOAD_BUFFERSIZE:
+  case CURLOPT_TCP_NODELAY:
     /*
-     * The application kindly asks for a differently sized upload buffer.
-     * Cap it to sensible.
+     * Enable or disable TCP_NODELAY, which will disable/enable the Nagle
+     * algorithm
      */
-    if(arg > UPLOADBUFFER_MAX)
-      arg = UPLOADBUFFER_MAX;
-    else if(arg < UPLOADBUFFER_MIN)
-      arg = UPLOADBUFFER_MIN;
+    s->tcp_nodelay = enabled;
+    break;
+
+  case CURLOPT_IGNORE_CONTENT_LENGTH:
+    s->ignorecl = enabled;
+    break;
+  case CURLOPT_SSL_SESSIONID_CACHE:
+    s->ssl.primary.cache_session = enabled;
+#ifndef CURL_DISABLE_PROXY
+    s->proxy_ssl.primary.cache_session =
+      s->ssl.primary.cache_session;
+#endif
+    break;
+#ifdef USE_SSH
+  case CURLOPT_SSH_COMPRESSION:
+    s->ssh_compression = enabled;
+    break;
+#endif /* ! USE_SSH */
+#ifndef CURL_DISABLE_SMTP
+  case CURLOPT_MAIL_RCPT_ALLOWFAILS:
+    /* allow RCPT TO command to fail for some recipients */
+    s->mail_rcpt_allowfails = enabled;
+    break;
+#endif /* !CURL_DISABLE_SMTP */
+  case CURLOPT_SASL_IR:
+    /* Enable/disable SASL initial response */
+    s->sasl_ir = enabled;
+    break;
+  case CURLOPT_TCP_KEEPALIVE:
+    s->tcp_keepalive = enabled;
+    break;
+  case CURLOPT_TCP_FASTOPEN:
+#if defined(CONNECT_DATA_IDEMPOTENT) || defined(MSG_FASTOPEN) ||        \
+  defined(TCP_FASTOPEN_CONNECT)
+    s->tcp_fastopen = enabled;
+#else
+    return CURLE_NOT_BUILT_IN;
+#endif
+    break;
+  case CURLOPT_SSL_ENABLE_ALPN:
+    s->ssl_enable_alpn = enabled;
+    break;
+  case CURLOPT_PATH_AS_IS:
+    s->path_as_is = enabled;
+    break;
+  case CURLOPT_PIPEWAIT:
+    s->pipewait = enabled;
+    break;
+  case CURLOPT_SUPPRESS_CONNECT_HEADERS:
+    s->suppress_connect_headers = enabled;
+    break;
+#ifndef CURL_DISABLE_SHUFFLE_DNS
+  case CURLOPT_DNS_SHUFFLE_ADDRESSES:
+    s->dns_shuffle_addresses = enabled;
+    break;
+#endif
+  case CURLOPT_DISALLOW_USERNAME_IN_URL:
+    s->disallow_username_in_url = enabled;
+    break;
+  case CURLOPT_QUICK_EXIT:
+    s->quick_exit = enabled;
+    break;
+  default:
+    return CURLE_OK;
+  }
+  if((arg > 1) || (arg < 0))
+    /* reserve other values for future use */
+    infof(data, "boolean setopt(%d) got unsupported argument %ld,"
+          " treated as %d", option, arg, enabled);
+
+  *set = TRUE;
+  return CURLE_OK;
+}
+
+static CURLcode value_range(long *value, long below_error, long min, long max)
+{
+  if(*value < below_error)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  else if(*value < min)
+    *value = min;
+  else if(*value > max)
+    *value = max;
+  return CURLE_OK;
+}
 
-    data->set.upload_buffer_size = (unsigned int)arg;
+static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
+                            long arg)
+{
+  unsigned long uarg = (unsigned long)arg;
+  bool set = FALSE;
+  CURLcode result = setopt_bool(data, option, arg, &set);
+  struct UserDefined *s = &data->set;
+  if(set || result)
+    return result;
+
+  switch(option) {
+  case CURLOPT_DNS_CACHE_TIMEOUT:
+    return setopt_set_timeout_sec(&s->dns_cache_timeout_ms, arg);
+
+  case CURLOPT_CA_CACHE_TIMEOUT:
+    if(Curl_ssl_supports(data, SSLSUPP_CA_CACHE)) {
+      result = value_range(&arg, -1, -1, INT_MAX);
+      if(result)
+        return result;
+
+      s->general_ssl.ca_cache_timeout = (int)arg;
+    }
+    else
+      return CURLE_NOT_BUILT_IN;
     break;
+  case CURLOPT_MAXCONNECTS:
+    result = value_range(&arg, 1, 1, UINT_MAX);
+    if(result)
+      return result;
+    s->maxconnects = (unsigned int)arg;
+    break;
+  case CURLOPT_SERVER_RESPONSE_TIMEOUT:
+    return setopt_set_timeout_sec(&s->server_response_timeout, arg);
 
-  case CURLOPT_NOSIGNAL:
-    /*
-     * The application asks not to set any signal() or alarm() handlers,
-     * even when using a timeout.
-     */
-    data->set.no_signal = enabled;
+  case CURLOPT_SERVER_RESPONSE_TIMEOUT_MS:
+    return setopt_set_timeout_ms(&s->server_response_timeout, arg);
+
+#ifndef CURL_DISABLE_TFTP
+  case CURLOPT_TFTP_BLKSIZE:
+    result = value_range(&arg, 0, TFTP_BLKSIZE_MIN, TFTP_BLKSIZE_MAX);
+    if(result)
+      return result;
+    s->tftp_blksize = (unsigned short)arg;
+    break;
+#endif
+#ifndef CURL_DISABLE_NETRC
+  case CURLOPT_NETRC:
+    if((arg < CURL_NETRC_IGNORED) || (arg >= CURL_NETRC_LAST))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->use_netrc = (unsigned char)arg;
+    break;
+#endif
+  case CURLOPT_TIMECONDITION:
+    if((arg < CURL_TIMECOND_NONE) || (arg >= CURL_TIMECOND_LAST))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->timecondition = (unsigned char)arg;
+    break;
+  case CURLOPT_TIMEVALUE:
+    s->timevalue = (time_t)arg;
+    break;
+  case CURLOPT_SSLVERSION:
+#ifndef CURL_DISABLE_PROXY
+  case CURLOPT_PROXY_SSLVERSION:
+#endif
+    return Curl_setopt_SSLVERSION(data, option, arg);
+
+  case CURLOPT_POSTFIELDSIZE:
+    if(arg < -1)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+
+    if(s->postfieldsize < arg &&
+       s->postfields == s->str[STRING_COPYPOSTFIELDS]) {
+      /* Previous CURLOPT_COPYPOSTFIELDS is no longer valid. */
+      Curl_safefree(s->str[STRING_COPYPOSTFIELDS]);
+      s->postfields = NULL;
+    }
+
+    s->postfieldsize = arg;
     break;
+#ifndef CURL_DISABLE_HTTP
+  case CURLOPT_FOLLOWLOCATION:
+    if(uarg > 3)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->http_follow_mode = (unsigned char)uarg;
+    break;
+
+  case CURLOPT_MAXREDIRS:
+    result = value_range(&arg, -1, 0, 0x7fff);
+    if(result)
+      return result;
+    s->maxredirs = (short)arg;
+    break;
+
+  case CURLOPT_POSTREDIR:
+    if(arg < CURL_REDIR_GET_ALL)
+      /* no return error on too high numbers since the bitmask could be
+         extended in a future */
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->keep_post = arg & CURL_REDIR_POST_ALL;
+    break;
+
+  case CURLOPT_HEADEROPT:
+    s->sep_headers = !!(arg & CURLHEADER_SEPARATE);
+    break;
+  case CURLOPT_HTTPAUTH:
+    return httpauth(data, FALSE, uarg);
+
+  case CURLOPT_HTTP_VERSION:
+    return setopt_HTTP_VERSION(data, arg);
+
+  case CURLOPT_EXPECT_100_TIMEOUT_MS:
+    result = value_range(&arg, 0, 0, 0xffff);
+    if(result)
+      return result;
+    s->expect_100_timeout = (unsigned short)arg;
+    break;
+
+#endif /* ! CURL_DISABLE_HTTP */
+
+#ifndef CURL_DISABLE_MIME
+  case CURLOPT_MIME_OPTIONS:
+    s->mime_formescape = !!(arg & CURLMIMEOPT_FORMESCAPE);
+    break;
+#endif
+#ifndef CURL_DISABLE_PROXY
+  case CURLOPT_PROXYPORT:
+    if((arg < 0) || (arg > 65535))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->proxyport = (unsigned short)arg;
+    break;
+
+  case CURLOPT_PROXYAUTH:
+    return httpauth(data, TRUE, uarg);
+
+  case CURLOPT_PROXYTYPE:
+    if((arg < CURLPROXY_HTTP) || (arg > CURLPROXY_SOCKS5_HOSTNAME))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->proxytype = (unsigned char)arg;
+    break;
+
+  case CURLOPT_SOCKS5_AUTH:
+    if(uarg & ~(CURLAUTH_BASIC | CURLAUTH_GSSAPI))
+      return CURLE_NOT_BUILT_IN;
+    s->socks5auth = (unsigned char)uarg;
+    break;
+#endif /* ! CURL_DISABLE_PROXY */
+
+#ifndef CURL_DISABLE_FTP
+  case CURLOPT_FTP_FILEMETHOD:
+    if((arg < CURLFTPMETHOD_DEFAULT) || (arg >= CURLFTPMETHOD_LAST))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->ftp_filemethod = (unsigned char)arg;
+    break;
+  case CURLOPT_FTP_SSL_CCC:
+    if((arg < CURLFTPSSL_CCC_NONE) || (arg >= CURLFTPSSL_CCC_LAST))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->ftp_ccc = (unsigned char)arg;
+    break;
+
+  case CURLOPT_FTPSSLAUTH:
+    if((arg < CURLFTPAUTH_DEFAULT) || (arg >= CURLFTPAUTH_LAST))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->ftpsslauth = (unsigned char)arg;
+    break;
+  case CURLOPT_ACCEPTTIMEOUT_MS:
+    return setopt_set_timeout_ms(&s->accepttimeout, arg);
+#endif /* ! CURL_DISABLE_FTP */
+#if !defined(CURL_DISABLE_FTP) || defined(USE_SSH)
+  case CURLOPT_FTP_CREATE_MISSING_DIRS:
+    if((arg < CURLFTP_CREATE_DIR_NONE) || (arg > CURLFTP_CREATE_DIR_RETRY))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->ftp_create_missing_dirs = (unsigned char)arg;
+    break;
+#endif /* ! CURL_DISABLE_FTP || USE_SSH */
+  case CURLOPT_INFILESIZE:
+    if(arg < -1)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->filesize = arg;
+    break;
+  case CURLOPT_LOW_SPEED_LIMIT:
+    if(arg < 0)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->low_speed_limit = arg;
+    break;
+  case CURLOPT_LOW_SPEED_TIME:
+    if(arg < 0)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->low_speed_time = arg;
+    break;
+  case CURLOPT_PORT:
+    if((arg < 0) || (arg > 65535))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->use_port = (unsigned short)arg;
+    break;
+  case CURLOPT_TIMEOUT:
+    return setopt_set_timeout_sec(&s->timeout, arg);
+
+  case CURLOPT_TIMEOUT_MS:
+    return setopt_set_timeout_ms(&s->timeout, arg);
+
+  case CURLOPT_CONNECTTIMEOUT:
+    return setopt_set_timeout_sec(&s->connecttimeout, arg);
+
+  case CURLOPT_CONNECTTIMEOUT_MS:
+    return setopt_set_timeout_ms(&s->connecttimeout, arg);
+
+  case CURLOPT_RESUME_FROM:
+    if(arg < -1)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->set_resume_from = arg;
+    break;
+
+#ifndef CURL_DISABLE_BINDLOCAL
+  case CURLOPT_LOCALPORT:
+    if((arg < 0) || (arg > 65535))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->localport = curlx_sltous(arg);
+    break;
+  case CURLOPT_LOCALPORTRANGE:
+    if((arg < 0) || (arg > 65535))
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    s->localportrange = curlx_sltous(arg);
+    break;
+#endif
+
+#ifdef HAVE_GSSAPI
+  case CURLOPT_GSSAPI_DELEGATION:
+    s->gssapi_delegation = (unsigned char)uarg&
+      (CURLGSSAPI_DELEGATION_POLICY_FLAG|CURLGSSAPI_DELEGATION_FLAG);
+    break;
+#endif
+
+  case CURLOPT_SSL_FALSESTART:
+    return CURLE_NOT_BUILT_IN;
+  case CURLOPT_BUFFERSIZE:
+    result = value_range(&arg, 0, READBUFFER_MIN, READBUFFER_MAX);
+    if(result)
+      return result;
+    s->buffer_size = (unsigned int)arg;
+    break;
+
+  case CURLOPT_UPLOAD_BUFFERSIZE:
+    result = value_range(&arg, 0, UPLOADBUFFER_MIN, UPLOADBUFFER_MAX);
+    if(result)
+      return result;
+    s->upload_buffer_size = (unsigned int)arg;
+    break;
+
   case CURLOPT_MAXFILESIZE:
-    /*
-     * Set the maximum size of a file to download.
-     */
     if(arg < 0)
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.max_filesize = arg;
+    s->max_filesize = arg;
     break;
 
 #ifdef USE_SSL
   case CURLOPT_USE_SSL:
-    /*
-     * Make transfers attempt to use SSL/TLS.
-     */
     if((arg < CURLUSESSL_NONE) || (arg >= CURLUSESSL_LAST))
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.use_ssl = (unsigned char)arg;
+    s->use_ssl = (unsigned char)arg;
     break;
   case CURLOPT_SSL_OPTIONS:
-    set_ssl_options(&data->set.ssl, &data->set.ssl.primary, arg);
+    set_ssl_options(&s->ssl, &s->ssl.primary, arg);
     break;
 
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_SSL_OPTIONS:
-    set_ssl_options(&data->set.proxy_ssl, &data->set.proxy_ssl.primary, arg);
+    set_ssl_options(&s->proxy_ssl, &s->proxy_ssl.primary, arg);
     break;
 #endif
 
@@ -1161,218 +1138,108 @@ static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
   case CURLOPT_IPRESOLVE:
     if((arg < CURL_IPRESOLVE_WHATEVER) || (arg > CURL_IPRESOLVE_V6))
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.ipver = (unsigned char) arg;
-    break;
-  case CURLOPT_TCP_NODELAY:
-    /*
-     * Enable or disable TCP_NODELAY, which will disable/enable the Nagle
-     * algorithm
-     */
-    data->set.tcp_nodelay = enabled;
-    break;
-
-  case CURLOPT_IGNORE_CONTENT_LENGTH:
-    data->set.ignorecl = enabled;
+    s->ipver = (unsigned char) arg;
     break;
 
   case CURLOPT_CONNECT_ONLY:
-    /*
-     * No data transfer.
-     * (1) - only do connection
-     * (2) - do first get request but get no content
-     */
-    if(arg > 2)
+    if(arg < 0 || arg > 2)
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.connect_only = !!arg;
-    data->set.connect_only_ws = (arg == 2);
+    s->connect_only = !!arg;
+    s->connect_only_ws = (arg == 2);
     break;
 
-  case CURLOPT_SSL_SESSIONID_CACHE:
-    data->set.ssl.primary.cache_session = enabled;
-#ifndef CURL_DISABLE_PROXY
-    data->set.proxy_ssl.primary.cache_session =
-      data->set.ssl.primary.cache_session;
-#endif
-    break;
 
 #ifdef USE_SSH
-    /* we only include SSH options if explicitly built to support SSH */
   case CURLOPT_SSH_AUTH_TYPES:
-    data->set.ssh_auth_types = (int)arg;
-    break;
-  case CURLOPT_SSH_COMPRESSION:
-    data->set.ssh_compression = enabled;
+    s->ssh_auth_types = (int)arg;
     break;
 #endif
 
-  case CURLOPT_HTTP_TRANSFER_DECODING:
-    /*
-     * disable libcurl transfer encoding is used
-     */
-    data->set.http_te_skip = !enabled; /* reversed */
-    break;
-
-  case CURLOPT_HTTP_CONTENT_DECODING:
-    /*
-     * raw data passed to the application when content encoding is used
-     */
-    data->set.http_ce_skip = !enabled; /* reversed */
-    break;
-
 #if !defined(CURL_DISABLE_FTP) || defined(USE_SSH)
   case CURLOPT_NEW_FILE_PERMS:
-    /*
-     * Uses these permissions instead of 0644
-     */
     if((arg < 0) || (arg > 0777))
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.new_file_perms = (unsigned int)arg;
+    s->new_file_perms = (unsigned int)arg;
     break;
 #endif
 #ifdef USE_SSH
   case CURLOPT_NEW_DIRECTORY_PERMS:
-    /*
-     * Uses these permissions instead of 0755
-     */
     if((arg < 0) || (arg > 0777))
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.new_directory_perms = (unsigned int)arg;
+    s->new_directory_perms = (unsigned int)arg;
     break;
 #endif
 #ifdef USE_IPV6
   case CURLOPT_ADDRESS_SCOPE:
-    /*
-     * Use this scope id when using IPv6
-     * We always get longs when passed plain numericals so we should check
-     * that the value fits into an unsigned 32-bit integer.
-     */
 #if SIZEOF_LONG > 4
     if(uarg > UINT_MAX)
       return CURLE_BAD_FUNCTION_ARGUMENT;
 #endif
-    data->set.scope_id = (unsigned int)uarg;
+    s->scope_id = (unsigned int)uarg;
     break;
 #endif
   case CURLOPT_PROTOCOLS:
-    /* set the bitmask for the protocols that are allowed to be used for the
-       transfer, which thus helps the app which takes URLs from users or other
-       external inputs and want to restrict what protocol(s) to deal with.
-       Defaults to CURLPROTO_ALL. */
-    data->set.allowed_protocols = (curl_prot_t)arg;
+    s->allowed_protocols = (curl_prot_t)arg;
     break;
 
   case CURLOPT_REDIR_PROTOCOLS:
-    /* set the bitmask for the protocols that libcurl is allowed to follow to,
-       as a subset of the CURLOPT_PROTOCOLS ones. That means the protocol
-       needs to be set in both bitmasks to be allowed to get redirected to. */
-    data->set.redir_protocols = (curl_prot_t)arg;
+    s->redir_protocols = (curl_prot_t)arg;
     break;
 
-#ifndef CURL_DISABLE_SMTP
-  case CURLOPT_MAIL_RCPT_ALLOWFAILS:
-    /* allow RCPT TO command to fail for some recipients */
-    data->set.mail_rcpt_allowfails = enabled;
-    break;
-#endif /* !CURL_DISABLE_SMTP */
-  case CURLOPT_SASL_IR:
-    /* Enable/disable SASL initial response */
-    data->set.sasl_ir = enabled;
-    break;
 #ifndef CURL_DISABLE_RTSP
   case CURLOPT_RTSP_REQUEST:
     return setopt_RTSP_REQUEST(data, arg);
   case CURLOPT_RTSP_CLIENT_CSEQ:
-    /*
-     * Set the CSEQ number to issue for the next RTSP request. Useful if the
-     * application is resuming a previously broken connection. The CSEQ
-     * will increment from this new number henceforth.
-     */
     data->state.rtsp_next_client_CSeq = arg;
     break;
 
   case CURLOPT_RTSP_SERVER_CSEQ:
-    /* Same as the above, but for server-initiated requests */
     data->state.rtsp_next_server_CSeq = arg;
     break;
 
 #endif /* ! CURL_DISABLE_RTSP */
 
-  case CURLOPT_TCP_KEEPALIVE:
-    data->set.tcp_keepalive = enabled;
-    break;
   case CURLOPT_TCP_KEEPIDLE:
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    else if(arg > INT_MAX)
-      arg = INT_MAX;
-    data->set.tcp_keepidle = (int)arg;
+    result = value_range(&arg, 0, 0, INT_MAX);
+    if(result)
+      return result;
+    s->tcp_keepidle = (int)arg;
     break;
   case CURLOPT_TCP_KEEPINTVL:
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    else if(arg > INT_MAX)
-      arg = INT_MAX;
-    data->set.tcp_keepintvl = (int)arg;
+    result = value_range(&arg, 0, 0, INT_MAX);
+    if(result)
+      return result;
+    s->tcp_keepintvl = (int)arg;
     break;
   case CURLOPT_TCP_KEEPCNT:
-    if(arg < 0)
-      return CURLE_BAD_FUNCTION_ARGUMENT;
-    else if(arg > INT_MAX)
-      arg = INT_MAX;
-    data->set.tcp_keepcnt = (int)arg;
-    break;
-  case CURLOPT_TCP_FASTOPEN:
-#if defined(CONNECT_DATA_IDEMPOTENT) || defined(MSG_FASTOPEN) ||        \
-  defined(TCP_FASTOPEN_CONNECT)
-    data->set.tcp_fastopen = enabled;
-#else
-    return CURLE_NOT_BUILT_IN;
-#endif
+    result = value_range(&arg, 0, 0, INT_MAX);
+    if(result)
+      return result;
+    s->tcp_keepcnt = (int)arg;
     break;
   case CURLOPT_SSL_ENABLE_NPN:
     break;
-  case CURLOPT_SSL_ENABLE_ALPN:
-    data->set.ssl_enable_alpn = enabled;
-    break;
-  case CURLOPT_PATH_AS_IS:
-    data->set.path_as_is = enabled;
-    break;
-  case CURLOPT_PIPEWAIT:
-    data->set.pipewait = enabled;
-    break;
   case CURLOPT_STREAM_WEIGHT:
 #if defined(USE_HTTP2) || defined(USE_HTTP3)
     if((arg >= 1) && (arg <= 256))
-      data->set.priority.weight = (int)arg;
+      s->priority.weight = (int)arg;
     break;
 #else
     return CURLE_NOT_BUILT_IN;
 #endif
-  case CURLOPT_SUPPRESS_CONNECT_HEADERS:
-    data->set.suppress_connect_headers = enabled;
-    break;
   case CURLOPT_HAPPY_EYEBALLS_TIMEOUT_MS:
-    return setopt_set_timeout_ms(&data->set.happy_eyeballs_timeout, arg);
-
-#ifndef CURL_DISABLE_SHUFFLE_DNS
-  case CURLOPT_DNS_SHUFFLE_ADDRESSES:
-    data->set.dns_shuffle_addresses = enabled;
-    break;
-#endif
-  case CURLOPT_DISALLOW_USERNAME_IN_URL:
-    data->set.disallow_username_in_url = enabled;
-    break;
+    return setopt_set_timeout_ms(&s->happy_eyeballs_timeout, arg);
 
   case CURLOPT_UPKEEP_INTERVAL_MS:
     if(arg < 0)
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.upkeep_interval_ms = arg;
+    s->upkeep_interval_ms = arg;
     break;
   case CURLOPT_MAXAGE_CONN:
-    return setopt_set_timeout_sec(&data->set.conn_max_idle_ms, arg);
+    return setopt_set_timeout_sec(&s->conn_max_idle_ms, arg);
 
   case CURLOPT_MAXLIFETIME_CONN:
-    return setopt_set_timeout_sec(&data->set.conn_max_age_ms, arg);
+    return setopt_set_timeout_sec(&s->conn_max_age_ms, arg);
 
 #ifndef CURL_DISABLE_HSTS
   case CURLOPT_HSTS_CTRL:
@@ -1402,27 +1269,20 @@ static CURLcode setopt_long(struct Curl_easy *data, CURLoption option,
 #endif /* ! CURL_DISABLE_ALTSVC */
 #ifndef CURL_DISABLE_WEBSOCKETS
   case CURLOPT_WS_OPTIONS:
-    data->set.ws_raw_mode = (bool)(arg & CURLWS_RAW_MODE);
-    data->set.ws_no_auto_pong = (bool)(arg & CURLWS_NOAUTOPONG);
+    s->ws_raw_mode = (bool)(arg & CURLWS_RAW_MODE);
+    s->ws_no_auto_pong = (bool)(arg & CURLWS_NOAUTOPONG);
     break;
 #endif
-  case CURLOPT_QUICK_EXIT:
-    data->set.quick_exit = enabled;
-    break;
   case CURLOPT_DNS_USE_GLOBAL_CACHE:
     /* deprecated */
     break;
   case CURLOPT_SSLENGINE_DEFAULT:
-    /*
-     * flag to set engine as default.
-     */
-    Curl_safefree(data->set.str[STRING_SSL_ENGINE]);
+    Curl_safefree(s->str[STRING_SSL_ENGINE]);
     return Curl_ssl_set_engine_default(data);
   case CURLOPT_UPLOAD_FLAGS:
-    data->set.upload_flags = (unsigned char)arg;
+    s->upload_flags = (unsigned char)arg;
     break;
   default:
-    /* unknown option */
     return CURLE_UNKNOWN_OPTION;
   }
   return CURLE_OK;
@@ -1432,6 +1292,7 @@ static CURLcode setopt_slist(struct Curl_easy *data, CURLoption option,
                              struct curl_slist *slist)
 {
   CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
   switch(option) {
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXYHEADER:
@@ -1445,7 +1306,7 @@ static CURLcode setopt_slist(struct Curl_easy *data, CURLoption option,
      *
      * Set this option to NULL to restore the previous behavior.
      */
-    data->set.proxyheaders = slist;
+    s->proxyheaders = slist;
     break;
 #endif
 #ifndef CURL_DISABLE_HTTP
@@ -1453,7 +1314,7 @@ static CURLcode setopt_slist(struct Curl_easy *data, CURLoption option,
     /*
      * Set a list of aliases for HTTP 200 in response header
      */
-    data->set.http200aliases = slist;
+    s->http200aliases = slist;
     break;
 #endif
 #if !defined(CURL_DISABLE_FTP) || defined(USE_SSH)
@@ -1461,19 +1322,19 @@ static CURLcode setopt_slist(struct Curl_easy *data, CURLoption option,
     /*
      * List of RAW FTP commands to use after a transfer
      */
-    data->set.postquote = slist;
+    s->postquote = slist;
     break;
   case CURLOPT_PREQUOTE:
     /*
      * List of RAW FTP commands to use prior to RETR (Wesley Laxton)
      */
-    data->set.prequote = slist;
+    s->prequote = slist;
     break;
   case CURLOPT_QUOTE:
     /*
      * List of RAW FTP commands to use before a transfer
      */
-    data->set.quote = slist;
+    s->quote = slist;
     break;
 #endif
   case CURLOPT_RESOLVE:
@@ -1490,15 +1351,15 @@ static CURLcode setopt_slist(struct Curl_easy *data, CURLoption option,
      * This API can remove any entry from the DNS cache, but only entries
      * that are not actually in use right now will be pruned immediately.
      */
-    data->set.resolve = slist;
-    data->state.resolve = data->set.resolve;
+    s->resolve = slist;
+    data->state.resolve = s->resolve;
     break;
 #if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_MIME)
   case CURLOPT_HTTPHEADER:
     /*
      * Set a list with HTTP headers to use (or replace internals with)
      */
-    data->set.headers = slist;
+    s->headers = slist;
     break;
 #endif
 #ifndef CURL_DISABLE_TELNET
@@ -1506,17 +1367,17 @@ static CURLcode setopt_slist(struct Curl_easy *data, CURLoption option,
     /*
      * Set a linked list of telnet options
      */
-    data->set.telnet_options = slist;
+    s->telnet_options = slist;
     break;
 #endif
 #ifndef CURL_DISABLE_SMTP
   case CURLOPT_MAIL_RCPT:
     /* Set the list of mail recipients */
-    data->set.mail_rcpt = slist;
+    s->mail_rcpt = slist;
     break;
 #endif
   case CURLOPT_CONNECT_TO:
-    data->set.connect_to = slist;
+    s->connect_to = slist;
     break;
   default:
     return CURLE_UNKNOWN_OPTION;
@@ -1529,6 +1390,7 @@ static CURLcode setopt_pointers(struct Curl_easy *data, CURLoption option,
                                 va_list param)
 {
   CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
   switch(option) {
 #ifndef CURL_DISABLE_HTTP
 #ifndef CURL_DISABLE_FORM_API
@@ -1536,9 +1398,9 @@ static CURLcode setopt_pointers(struct Curl_easy *data, CURLoption option,
     /*
      * Set to make us do HTTP POST. Legacy API-style.
      */
-    data->set.httppost = va_arg(param, struct curl_httppost *);
-    data->set.method = HTTPREQ_POST_FORM;
-    data->set.opt_no_body = FALSE; /* this is implied */
+    s->httppost = va_arg(param, struct curl_httppost *);
+    s->method = HTTPREQ_POST_FORM;
+    s->opt_no_body = FALSE; /* this is implied */
     Curl_mime_cleanpart(data->state.formp);
     Curl_safefree(data->state.formp);
     data->state.mimepost = NULL;
@@ -1552,12 +1414,12 @@ static CURLcode setopt_pointers(struct Curl_easy *data, CURLoption option,
     /*
      * Set to make us do MIME POST
      */
-    result = Curl_mime_set_subparts(&data->set.mimepost,
+    result = Curl_mime_set_subparts(&s->mimepost,
                                     va_arg(param, curl_mime *),
                                     FALSE);
     if(!result) {
-      data->set.method = HTTPREQ_POST_MIME;
-      data->set.opt_no_body = FALSE; /* this is implied */
+      s->method = HTTPREQ_POST_MIME;
+      s->opt_no_body = FALSE; /* this is implied */
 #ifndef CURL_DISABLE_FORM_API
       Curl_mime_cleanpart(data->state.formp);
       Curl_safefree(data->state.formp);
@@ -1572,9 +1434,9 @@ static CURLcode setopt_pointers(struct Curl_easy *data, CURLoption option,
      * Set to a FILE * that should receive all error writes. This
      * defaults to stderr for normal operations.
      */
-    data->set.err = va_arg(param, FILE *);
-    if(!data->set.err)
-      data->set.err = stderr;
+    s->err = va_arg(param, FILE *);
+    if(!s->err)
+      s->err = stderr;
     break;
   case CURLOPT_SHARE:
   {
@@ -1661,22 +1523,115 @@ static CURLcode setopt_pointers(struct Curl_easy *data, CURLoption option,
   return result;
 }
 
+#ifndef CURL_DISABLE_COOKIES
+static CURLcode cookielist(struct Curl_easy *data,
+                           const char *ptr)
+{
+  if(!ptr)
+    return CURLE_OK;
+
+  if(curl_strequal(ptr, "ALL")) {
+    /* clear all cookies */
+    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
+    Curl_cookie_clearall(data->cookies);
+    Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
+  }
+  else if(curl_strequal(ptr, "SESS")) {
+    /* clear session cookies */
+    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
+    Curl_cookie_clearsess(data->cookies);
+    Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
+  }
+  else if(curl_strequal(ptr, "FLUSH")) {
+    /* flush cookies to file, takes care of the locking */
+    Curl_flush_cookies(data, FALSE);
+  }
+  else if(curl_strequal(ptr, "RELOAD")) {
+    /* reload cookies from file */
+    Curl_cookie_loadfiles(data);
+  }
+  else {
+    if(!data->cookies) {
+      /* if cookie engine was not running, activate it */
+      data->cookies = Curl_cookie_init(data, NULL, NULL, TRUE);
+      if(!data->cookies)
+        return CURLE_OUT_OF_MEMORY;
+    }
+
+    /* general protection against mistakes and abuse */
+    if(strlen(ptr) > CURL_MAX_INPUT_LENGTH)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+
+    Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
+    if(checkprefix("Set-Cookie:", ptr))
+      /* HTTP Header format line */
+      Curl_cookie_add(data, data->cookies, TRUE, FALSE, ptr + 11, NULL,
+                      NULL, TRUE);
+    else
+      /* Netscape format line */
+      Curl_cookie_add(data, data->cookies, FALSE, FALSE, ptr, NULL,
+                      NULL, TRUE);
+    Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
+  }
+  return CURLE_OK;
+}
+
+static CURLcode cookiefile(struct Curl_easy *data,
+                           const char *ptr)
+{
+  /*
+   * Set cookie file to read and parse. Can be used multiple times.
+   */
+  if(ptr) {
+    struct curl_slist *cl;
+    /* general protection against mistakes and abuse */
+    if(strlen(ptr) > CURL_MAX_INPUT_LENGTH)
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    /* append the cookie filename to the list of filenames, and deal with
+       them later */
+    cl = curl_slist_append(data->state.cookielist, ptr);
+    if(!cl) {
+      curl_slist_free_all(data->state.cookielist);
+      data->state.cookielist = NULL;
+      return CURLE_OUT_OF_MEMORY;
+    }
+    data->state.cookielist = cl; /* store the list for later use */
+  }
+  else {
+    /* clear the list of cookie files */
+    curl_slist_free_all(data->state.cookielist);
+    data->state.cookielist = NULL;
+
+    if(!data->share || !data->share->cookies) {
+      /* throw away all existing cookies if this is not a shared cookie
+         container */
+      Curl_cookie_clearall(data->cookies);
+      Curl_cookie_cleanup(data->cookies);
+    }
+    /* disable the cookie engine */
+    data->cookies = NULL;
+  }
+  return CURLE_OK;
+}
+#endif
+
 static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
                             char *ptr)
 {
   CURLcode result = CURLE_OK;
+  struct UserDefined *s = &data->set;
   switch(option) {
   case CURLOPT_SSL_CIPHER_LIST:
     if(Curl_ssl_supports(data, SSLSUPP_CIPHER_LIST))
       /* set a list of cipher we want to use in the SSL connection */
-      return Curl_setstropt(&data->set.str[STRING_SSL_CIPHER_LIST], ptr);
+      return Curl_setstropt(&s->str[STRING_SSL_CIPHER_LIST], ptr);
     else
       return CURLE_NOT_BUILT_IN;
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_SSL_CIPHER_LIST:
     if(Curl_ssl_supports(data, SSLSUPP_CIPHER_LIST)) {
       /* set a list of cipher we want to use in the SSL connection for proxy */
-      return Curl_setstropt(&data->set.str[STRING_SSL_CIPHER_LIST_PROXY],
+      return Curl_setstropt(&s->str[STRING_SSL_CIPHER_LIST_PROXY],
                             ptr);
     }
     else
@@ -1685,7 +1640,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
   case CURLOPT_TLS13_CIPHERS:
     if(Curl_ssl_supports(data, SSLSUPP_TLS13_CIPHERSUITES)) {
       /* set preferred list of TLS 1.3 cipher suites */
-      return Curl_setstropt(&data->set.str[STRING_SSL_CIPHER13_LIST], ptr);
+      return Curl_setstropt(&s->str[STRING_SSL_CIPHER13_LIST], ptr);
     }
     else
       return CURLE_NOT_BUILT_IN;
@@ -1693,7 +1648,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
   case CURLOPT_PROXY_TLS13_CIPHERS:
     if(Curl_ssl_supports(data, SSLSUPP_TLS13_CIPHERSUITES))
       /* set preferred list of TLS 1.3 cipher suites for proxy */
-      return Curl_setstropt(&data->set.str[STRING_SSL_CIPHER13_LIST_PROXY],
+      return Curl_setstropt(&s->str[STRING_SSL_CIPHER13_LIST_PROXY],
                             ptr);
     else
       return CURLE_NOT_BUILT_IN;
@@ -1703,13 +1658,13 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
   case CURLOPT_EGDSOCKET:
     break;
   case CURLOPT_REQUEST_TARGET:
-    return Curl_setstropt(&data->set.str[STRING_TARGET], ptr);
+    return Curl_setstropt(&s->str[STRING_TARGET], ptr);
 #ifndef CURL_DISABLE_NETRC
   case CURLOPT_NETRC_FILE:
     /*
      * Use this file instead of the $HOME/.netrc file
      */
-    return Curl_setstropt(&data->set.str[STRING_NETRC_FILE], ptr);
+    return Curl_setstropt(&s->str[STRING_NETRC_FILE], ptr);
 #endif
 
 #if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_MQTT)
@@ -1719,16 +1674,16 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * If needed, CURLOPT_POSTFIELDSIZE must have been set prior to
      *  CURLOPT_COPYPOSTFIELDS and not altered later.
      */
-    if(!ptr || data->set.postfieldsize == -1)
-      result = Curl_setstropt(&data->set.str[STRING_COPYPOSTFIELDS], ptr);
+    if(!ptr || s->postfieldsize == -1)
+      result = Curl_setstropt(&s->str[STRING_COPYPOSTFIELDS], ptr);
     else {
-      if(data->set.postfieldsize < 0)
+      if(s->postfieldsize < 0)
         return CURLE_BAD_FUNCTION_ARGUMENT;
 #if SIZEOF_CURL_OFF_T > SIZEOF_SIZE_T
       /*
        *  Check that requested length does not overflow the size_t type.
        */
-      else if(data->set.postfieldsize > SIZE_T_MAX)
+      else if(s->postfieldsize > SIZE_MAX)
         return CURLE_OUT_OF_MEMORY;
 #endif
       else {
@@ -1737,28 +1692,28 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
            mark that postfields is used rather than read function or form
            data.
         */
-        char *p = Curl_memdup0(ptr, (size_t)data->set.postfieldsize);
+        char *p = Curl_memdup0(ptr, (size_t)s->postfieldsize);
         if(!p)
           return CURLE_OUT_OF_MEMORY;
         else {
-          free(data->set.str[STRING_COPYPOSTFIELDS]);
-          data->set.str[STRING_COPYPOSTFIELDS] = p;
+          free(s->str[STRING_COPYPOSTFIELDS]);
+          s->str[STRING_COPYPOSTFIELDS] = p;
         }
       }
     }
 
-    data->set.postfields = data->set.str[STRING_COPYPOSTFIELDS];
-    data->set.method = HTTPREQ_POST;
+    s->postfields = s->str[STRING_COPYPOSTFIELDS];
+    s->method = HTTPREQ_POST;
     break;
 
   case CURLOPT_POSTFIELDS:
     /*
      * Like above, but use static data instead of copying it.
      */
-    data->set.postfields = ptr;
+    s->postfields = ptr;
     /* Release old copied data. */
-    Curl_safefree(data->set.str[STRING_COPYPOSTFIELDS]);
-    data->set.method = HTTPREQ_POST;
+    Curl_safefree(s->str[STRING_COPYPOSTFIELDS]);
+    s->method = HTTPREQ_POST;
     break;
 #endif /* ! CURL_DISABLE_HTTP || ! CURL_DISABLE_MQTT */
 
@@ -1776,22 +1731,22 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
     if(ptr && !*ptr) {
       char all[256];
       Curl_all_content_encodings(all, sizeof(all));
-      return Curl_setstropt(&data->set.str[STRING_ENCODING], all);
+      return Curl_setstropt(&s->str[STRING_ENCODING], all);
     }
-    return Curl_setstropt(&data->set.str[STRING_ENCODING], ptr);
+    return Curl_setstropt(&s->str[STRING_ENCODING], ptr);
 
-#if !defined(CURL_DISABLE_AWS)
+#ifndef CURL_DISABLE_AWS
   case CURLOPT_AWS_SIGV4:
     /*
      * String that is merged to some authentication
      * parameters are used by the algorithm.
      */
-    result = Curl_setstropt(&data->set.str[STRING_AWS_SIGV4], ptr);
+    result = Curl_setstropt(&s->str[STRING_AWS_SIGV4], ptr);
     /*
      * Basic been set by default it need to be unset here
      */
-    if(data->set.str[STRING_AWS_SIGV4])
-      data->set.httpauth = CURLAUTH_AWS_SIGV4;
+    if(s->str[STRING_AWS_SIGV4])
+      s->httpauth = CURLAUTH_AWS_SIGV4;
     break;
 #endif
   case CURLOPT_REFERER:
@@ -1802,70 +1757,38 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
       Curl_safefree(data->state.referer);
       data->state.referer_alloc = FALSE;
     }
-    result = Curl_setstropt(&data->set.str[STRING_SET_REFERER], ptr);
-    data->state.referer = data->set.str[STRING_SET_REFERER];
+    result = Curl_setstropt(&s->str[STRING_SET_REFERER], ptr);
+    data->state.referer = s->str[STRING_SET_REFERER];
     break;
 
   case CURLOPT_USERAGENT:
     /*
      * String to use in the HTTP User-Agent field
      */
-    return Curl_setstropt(&data->set.str[STRING_USERAGENT], ptr);
+    return Curl_setstropt(&s->str[STRING_USERAGENT], ptr);
 
-#if !defined(CURL_DISABLE_COOKIES)
+#ifndef CURL_DISABLE_COOKIES
   case CURLOPT_COOKIE:
     /*
      * Cookie string to send to the remote server in the request.
      */
-    return Curl_setstropt(&data->set.str[STRING_COOKIE], ptr);
+    return Curl_setstropt(&s->str[STRING_COOKIE], ptr);
 
   case CURLOPT_COOKIEFILE:
-    /*
-     * Set cookie file to read and parse. Can be used multiple times.
-     */
-    if(ptr) {
-      struct curl_slist *cl;
-      /* general protection against mistakes and abuse */
-      if(strlen(ptr) > CURL_MAX_INPUT_LENGTH)
-        return CURLE_BAD_FUNCTION_ARGUMENT;
-      /* append the cookie filename to the list of filenames, and deal with
-         them later */
-      cl = curl_slist_append(data->state.cookielist, ptr);
-      if(!cl) {
-        curl_slist_free_all(data->state.cookielist);
-        data->state.cookielist = NULL;
-        return CURLE_OUT_OF_MEMORY;
-      }
-      data->state.cookielist = cl; /* store the list for later use */
-    }
-    else {
-      /* clear the list of cookie files */
-      curl_slist_free_all(data->state.cookielist);
-      data->state.cookielist = NULL;
-
-      if(!data->share || !data->share->cookies) {
-        /* throw away all existing cookies if this is not a shared cookie
-           container */
-        Curl_cookie_clearall(data->cookies);
-        Curl_cookie_cleanup(data->cookies);
-      }
-      /* disable the cookie engine */
-      data->cookies = NULL;
-    }
-    break;
+    return cookiefile(data, ptr);
 
   case CURLOPT_COOKIEJAR:
     /*
      * Set cookie filename to dump all cookies to when we are done.
      */
-    result = Curl_setstropt(&data->set.str[STRING_COOKIEJAR], ptr);
+    result = Curl_setstropt(&s->str[STRING_COOKIEJAR], ptr);
     if(!result) {
       /*
        * Activate the cookie parser. This may or may not already
        * have been made.
        */
       struct CookieInfo *newcookies =
-        Curl_cookie_init(data, NULL, data->cookies, data->set.cookiesession);
+        Curl_cookie_init(data, NULL, data->cookies, s->cookiesession);
       if(!newcookies)
         result = CURLE_OUT_OF_MEMORY;
       data->cookies = newcookies;
@@ -1873,54 +1796,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
     break;
 
   case CURLOPT_COOKIELIST:
-    if(!ptr)
-      break;
-
-    if(curl_strequal(ptr, "ALL")) {
-      /* clear all cookies */
-      Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
-      Curl_cookie_clearall(data->cookies);
-      Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
-    }
-    else if(curl_strequal(ptr, "SESS")) {
-      /* clear session cookies */
-      Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
-      Curl_cookie_clearsess(data->cookies);
-      Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
-    }
-    else if(curl_strequal(ptr, "FLUSH")) {
-      /* flush cookies to file, takes care of the locking */
-      Curl_flush_cookies(data, FALSE);
-    }
-    else if(curl_strequal(ptr, "RELOAD")) {
-      /* reload cookies from file */
-      Curl_cookie_loadfiles(data);
-      break;
-    }
-    else {
-      if(!data->cookies) {
-        /* if cookie engine was not running, activate it */
-        data->cookies = Curl_cookie_init(data, NULL, NULL, TRUE);
-        if(!data->cookies)
-          return CURLE_OUT_OF_MEMORY;
-      }
-
-      /* general protection against mistakes and abuse */
-      if(strlen(ptr) > CURL_MAX_INPUT_LENGTH)
-        return CURLE_BAD_FUNCTION_ARGUMENT;
-
-      Curl_share_lock(data, CURL_LOCK_DATA_COOKIE, CURL_LOCK_ACCESS_SINGLE);
-      if(checkprefix("Set-Cookie:", ptr))
-        /* HTTP Header format line */
-        Curl_cookie_add(data, data->cookies, TRUE, FALSE, ptr + 11, NULL,
-                        NULL, TRUE);
-      else
-        /* Netscape format line */
-        Curl_cookie_add(data, data->cookies, FALSE, FALSE, ptr, NULL,
-                        NULL, TRUE);
-      Curl_share_unlock(data, CURL_LOCK_DATA_COOKIE);
-    }
-    break;
+    return cookielist(data, ptr);
 #endif /* !CURL_DISABLE_COOKIES */
 
 #endif /* ! CURL_DISABLE_HTTP */
@@ -1929,10 +1805,10 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
     /*
      * Set a custom string to use as request
      */
-    return Curl_setstropt(&data->set.str[STRING_CUSTOMREQUEST], ptr);
+    return Curl_setstropt(&s->str[STRING_CUSTOMREQUEST], ptr);
 
     /* we do not set
-       data->set.method = HTTPREQ_CUSTOM;
+       s->method = HTTPREQ_CUSTOM;
        here, we continue as if we were using the already set type
        and this just changes the actual request keyword */
 
@@ -1948,7 +1824,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * Setting it to NULL, means no proxy but allows the environment variables
      * to decide for us (if CURLOPT_SOCKS_PROXY setting it to NULL).
      */
-    return Curl_setstropt(&data->set.str[STRING_PROXY], ptr);
+    return Curl_setstropt(&s->str[STRING_PROXY], ptr);
 
   case CURLOPT_PRE_PROXY:
     /*
@@ -1957,7 +1833,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * If the proxy is set to "" or NULL we explicitly say that we do not want
      * to use the socks proxy.
      */
-    return Curl_setstropt(&data->set.str[STRING_PRE_PROXY], ptr);
+    return Curl_setstropt(&s->str[STRING_PRE_PROXY], ptr);
 #endif   /* CURL_DISABLE_PROXY */
 
 #ifndef CURL_DISABLE_PROXY
@@ -1966,58 +1842,58 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
     /*
      * Set proxy authentication service name for Kerberos 5 and SPNEGO
      */
-    return Curl_setstropt(&data->set.str[STRING_PROXY_SERVICE_NAME], ptr);
+    return Curl_setstropt(&s->str[STRING_PROXY_SERVICE_NAME], ptr);
 #endif
   case CURLOPT_SERVICE_NAME:
     /*
      * Set authentication service name for DIGEST-MD5, Kerberos 5 and SPNEGO
      */
-    return Curl_setstropt(&data->set.str[STRING_SERVICE_NAME], ptr);
+    return Curl_setstropt(&s->str[STRING_SERVICE_NAME], ptr);
 
   case CURLOPT_HEADERDATA:
     /*
      * Custom pointer to pass the header write callback function
      */
-    data->set.writeheader = ptr;
+    s->writeheader = ptr;
     break;
   case CURLOPT_READDATA:
     /*
      * FILE pointer to read the file to be uploaded from. Or possibly used as
      * argument to the read callback.
      */
-    data->set.in_set = ptr;
+    s->in_set = ptr;
     break;
   case CURLOPT_WRITEDATA:
     /*
      * FILE pointer to write to. Or possibly used as argument to the write
      * callback.
      */
-    data->set.out = ptr;
+    s->out = ptr;
     break;
   case CURLOPT_DEBUGDATA:
     /*
      * Set to a void * that should receive all error writes. This
      * defaults to CURLOPT_STDERR for normal operations.
      */
-    data->set.debugdata = ptr;
+    s->debugdata = ptr;
     break;
   case CURLOPT_PROGRESSDATA:
     /*
      * Custom client data to pass to the progress callback
      */
-    data->set.progress_client = ptr;
+    s->progress_client = ptr;
     break;
   case CURLOPT_SEEKDATA:
     /*
      * Seek control callback. Might be NULL.
      */
-    data->set.seek_client = ptr;
+    s->seek_client = ptr;
     break;
   case CURLOPT_IOCTLDATA:
     /*
      * I/O control data pointer. Might be NULL.
      */
-    data->set.ioctl_client = ptr;
+    s->ioctl_client = ptr;
     break;
   case CURLOPT_SSL_CTX_DATA:
     /*
@@ -2025,7 +1901,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      */
 #ifdef USE_SSL
     if(Curl_ssl_supports(data, SSLSUPP_SSL_CTX)) {
-      data->set.ssl.fsslctxp = ptr;
+      s->ssl.fsslctxp = ptr;
       break;
     }
     else
@@ -2035,33 +1911,33 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
     /*
      * socket callback data pointer. Might be NULL.
      */
-    data->set.sockopt_client = ptr;
+    s->sockopt_client = ptr;
     break;
   case CURLOPT_OPENSOCKETDATA:
     /*
      * socket callback data pointer. Might be NULL.
      */
-    data->set.opensocket_client = ptr;
+    s->opensocket_client = ptr;
     break;
   case CURLOPT_RESOLVER_START_DATA:
     /*
      * resolver start callback data pointer. Might be NULL.
      */
-    data->set.resolver_start_client = ptr;
+    s->resolver_start_client = ptr;
     break;
   case CURLOPT_CLOSESOCKETDATA:
     /*
      * socket callback data pointer. Might be NULL.
      */
-    data->set.closesocket_client = ptr;
+    s->closesocket_client = ptr;
     break;
   case CURLOPT_TRAILERDATA:
 #ifndef CURL_DISABLE_HTTP
-    data->set.trailer_data = ptr;
+    s->trailer_data = ptr;
 #endif
     break;
   case CURLOPT_PREREQDATA:
-    data->set.prereq_userp = ptr;
+    s->prereq_userp = ptr;
     break;
 
   case CURLOPT_ERRORBUFFER:
@@ -2069,7 +1945,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * Error buffer provided by the caller to get the human readable error
      * string in.
      */
-    data->set.errorbuffer = ptr;
+    s->errorbuffer = ptr;
     break;
 
 #ifndef CURL_DISABLE_FTP
@@ -2077,23 +1953,23 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
     /*
      * Use FTP PORT, this also specifies which IP address to use
      */
-    result = Curl_setstropt(&data->set.str[STRING_FTPPORT], ptr);
-    data->set.ftp_use_port = !!(data->set.str[STRING_FTPPORT]);
+    result = Curl_setstropt(&s->str[STRING_FTPPORT], ptr);
+    s->ftp_use_port = !!(s->str[STRING_FTPPORT]);
     break;
 
   case CURLOPT_FTP_ACCOUNT:
-    return Curl_setstropt(&data->set.str[STRING_FTP_ACCOUNT], ptr);
+    return Curl_setstropt(&s->str[STRING_FTP_ACCOUNT], ptr);
 
   case CURLOPT_FTP_ALTERNATIVE_TO_USER:
-    return Curl_setstropt(&data->set.str[STRING_FTP_ALTERNATIVE_TO_USER], ptr);
+    return Curl_setstropt(&s->str[STRING_FTP_ALTERNATIVE_TO_USER], ptr);
 
 #ifdef HAVE_GSSAPI
   case CURLOPT_KRBLEVEL:
     /*
      * A string that defines the kerberos security level.
      */
-    result = Curl_setstropt(&data->set.str[STRING_KRB_LEVEL], ptr);
-    data->set.krb = !!(data->set.str[STRING_KRB_LEVEL]);
+    result = Curl_setstropt(&s->str[STRING_KRB_LEVEL], ptr);
+    s->krb = !!(s->str[STRING_KRB_LEVEL]);
     break;
 #endif
 #endif
@@ -2105,40 +1981,40 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
       Curl_safefree(data->state.url);
       data->state.url_alloc = FALSE;
     }
-    result = Curl_setstropt(&data->set.str[STRING_SET_URL], ptr);
-    data->state.url = data->set.str[STRING_SET_URL];
+    result = Curl_setstropt(&s->str[STRING_SET_URL], ptr);
+    data->state.url = s->str[STRING_SET_URL];
     break;
 
   case CURLOPT_USERPWD:
     /*
      * user:password to use in the operation
      */
-    return setstropt_userpwd(ptr, &data->set.str[STRING_USERNAME],
-                             &data->set.str[STRING_PASSWORD]);
+    return setstropt_userpwd(ptr, &s->str[STRING_USERNAME],
+                             &s->str[STRING_PASSWORD]);
 
   case CURLOPT_USERNAME:
     /*
      * authentication username to use in the operation
      */
-    return Curl_setstropt(&data->set.str[STRING_USERNAME], ptr);
+    return Curl_setstropt(&s->str[STRING_USERNAME], ptr);
 
   case CURLOPT_PASSWORD:
     /*
      * authentication password to use in the operation
      */
-    return Curl_setstropt(&data->set.str[STRING_PASSWORD], ptr);
+    return Curl_setstropt(&s->str[STRING_PASSWORD], ptr);
 
   case CURLOPT_LOGIN_OPTIONS:
     /*
      * authentication options to use in the operation
      */
-    return Curl_setstropt(&data->set.str[STRING_OPTIONS], ptr);
+    return Curl_setstropt(&s->str[STRING_OPTIONS], ptr);
 
   case CURLOPT_XOAUTH2_BEARER:
     /*
      * OAuth 2.0 bearer token to use in the operation
      */
-    return Curl_setstropt(&data->set.str[STRING_BEARER], ptr);
+    return Curl_setstropt(&s->str[STRING_BEARER], ptr);
 
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXYUSERPWD: {
@@ -2151,13 +2027,13 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
 
     /* URL decode the components */
     if(!result && u) {
-      Curl_safefree(data->set.str[STRING_PROXYUSERNAME]);
-      result = Curl_urldecode(u, 0, &data->set.str[STRING_PROXYUSERNAME], NULL,
+      Curl_safefree(s->str[STRING_PROXYUSERNAME]);
+      result = Curl_urldecode(u, 0, &s->str[STRING_PROXYUSERNAME], NULL,
                               REJECT_ZERO);
     }
     if(!result && p) {
-      Curl_safefree(data->set.str[STRING_PROXYPASSWORD]);
-      result = Curl_urldecode(p, 0, &data->set.str[STRING_PROXYPASSWORD], NULL,
+      Curl_safefree(s->str[STRING_PROXYPASSWORD]);
+      result = Curl_urldecode(p, 0, &s->str[STRING_PROXYPASSWORD], NULL,
                               REJECT_ZERO);
     }
     free(u);
@@ -2168,26 +2044,26 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
     /*
      * authentication username to use in the operation
      */
-    return Curl_setstropt(&data->set.str[STRING_PROXYUSERNAME], ptr);
+    return Curl_setstropt(&s->str[STRING_PROXYUSERNAME], ptr);
 
   case CURLOPT_PROXYPASSWORD:
     /*
      * authentication password to use in the operation
      */
-    return Curl_setstropt(&data->set.str[STRING_PROXYPASSWORD], ptr);
+    return Curl_setstropt(&s->str[STRING_PROXYPASSWORD], ptr);
 
   case CURLOPT_NOPROXY:
     /*
      * proxy exception list
      */
-    return Curl_setstropt(&data->set.str[STRING_NOPROXY], ptr);
+    return Curl_setstropt(&s->str[STRING_NOPROXY], ptr);
 #endif /* ! CURL_DISABLE_PROXY */
 
   case CURLOPT_RANGE:
     /*
      * What range of the file you want to transfer
      */
-    return Curl_setstropt(&data->set.str[STRING_SET_RANGE], ptr);
+    return Curl_setstropt(&s->str[STRING_SET_RANGE], ptr);
 
   case CURLOPT_CURLU:
     /*
@@ -2199,77 +2075,77 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
     }
     else
       data->state.url = NULL;
-    Curl_safefree(data->set.str[STRING_SET_URL]);
-    data->set.uh = (CURLU *)ptr;
+    Curl_safefree(s->str[STRING_SET_URL]);
+    s->uh = (CURLU *)ptr;
     break;
   case CURLOPT_SSLCERT:
     /*
      * String that holds filename of the SSL certificate to use
      */
-    return Curl_setstropt(&data->set.str[STRING_CERT], ptr);
+    return Curl_setstropt(&s->str[STRING_CERT], ptr);
 
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_SSLCERT:
     /*
      * String that holds filename of the SSL certificate to use for proxy
      */
-    return Curl_setstropt(&data->set.str[STRING_CERT_PROXY], ptr);
+    return Curl_setstropt(&s->str[STRING_CERT_PROXY], ptr);
 
 #endif
   case CURLOPT_SSLCERTTYPE:
     /*
      * String that holds file type of the SSL certificate to use
      */
-    return Curl_setstropt(&data->set.str[STRING_CERT_TYPE], ptr);
+    return Curl_setstropt(&s->str[STRING_CERT_TYPE], ptr);
 
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_SSLCERTTYPE:
     /*
      * String that holds file type of the SSL certificate to use for proxy
      */
-    return Curl_setstropt(&data->set.str[STRING_CERT_TYPE_PROXY], ptr);
+    return Curl_setstropt(&s->str[STRING_CERT_TYPE_PROXY], ptr);
 
 #endif
   case CURLOPT_SSLKEY:
     /*
      * String that holds filename of the SSL key to use
      */
-    return Curl_setstropt(&data->set.str[STRING_KEY], ptr);
+    return Curl_setstropt(&s->str[STRING_KEY], ptr);
 
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_SSLKEY:
     /*
      * String that holds filename of the SSL key to use for proxy
      */
-    return Curl_setstropt(&data->set.str[STRING_KEY_PROXY], ptr);
+    return Curl_setstropt(&s->str[STRING_KEY_PROXY], ptr);
 
 #endif
   case CURLOPT_SSLKEYTYPE:
     /*
      * String that holds file type of the SSL key to use
      */
-    return Curl_setstropt(&data->set.str[STRING_KEY_TYPE], ptr);
+    return Curl_setstropt(&s->str[STRING_KEY_TYPE], ptr);
 
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_SSLKEYTYPE:
     /*
      * String that holds file type of the SSL key to use for proxy
      */
-    return Curl_setstropt(&data->set.str[STRING_KEY_TYPE_PROXY], ptr);
+    return Curl_setstropt(&s->str[STRING_KEY_TYPE_PROXY], ptr);
 
 #endif
   case CURLOPT_KEYPASSWD:
     /*
      * String that holds the SSL or SSH private key password.
      */
-    return Curl_setstropt(&data->set.str[STRING_KEY_PASSWD], ptr);
+    return Curl_setstropt(&s->str[STRING_KEY_PASSWD], ptr);
 
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_KEYPASSWD:
     /*
      * String that holds the SSL private key password for proxy.
      */
-    return Curl_setstropt(&data->set.str[STRING_KEY_PASSWD_PROXY], ptr);
+    return Curl_setstropt(&s->str[STRING_KEY_PASSWD_PROXY], ptr);
 
 #endif
   case CURLOPT_SSLENGINE:
@@ -2277,7 +2153,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * String that holds the SSL crypto engine.
      */
     if(ptr && ptr[0]) {
-      result = Curl_setstropt(&data->set.str[STRING_SSL_ENGINE], ptr);
+      result = Curl_setstropt(&s->str[STRING_SSL_ENGINE], ptr);
       if(!result) {
         result = Curl_ssl_set_engine(data, ptr);
       }
@@ -2289,9 +2165,9 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
     /*
      * Set the client IP to send through HAProxy PROXY protocol
      */
-    result = Curl_setstropt(&data->set.str[STRING_HAPROXY_CLIENT_IP], ptr);
+    result = Curl_setstropt(&s->str[STRING_HAPROXY_CLIENT_IP], ptr);
     /* enable the HAProxy protocol */
-    data->set.haproxyprotocol = TRUE;
+    s->haproxyprotocol = TRUE;
     break;
 
 #endif
@@ -2301,9 +2177,9 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * performing an operation and thus what from-IP your connection will use.
      */
     return setstropt_interface(ptr,
-                               &data->set.str[STRING_DEVICE],
-                               &data->set.str[STRING_INTERFACE],
-                               &data->set.str[STRING_BINDHOST]);
+                               &s->str[STRING_DEVICE],
+                               &s->str[STRING_INTERFACE],
+                               &s->str[STRING_BINDHOST]);
 
   case CURLOPT_PINNEDPUBLICKEY:
     /*
@@ -2312,7 +2188,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      */
 #ifdef USE_SSL
     if(Curl_ssl_supports(data, SSLSUPP_PINNEDPUBKEY))
-      return Curl_setstropt(&data->set.str[STRING_SSL_PINNEDPUBLICKEY], ptr);
+      return Curl_setstropt(&s->str[STRING_SSL_PINNEDPUBLICKEY], ptr);
 #endif
     return CURLE_NOT_BUILT_IN;
 
@@ -2324,7 +2200,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      */
 #ifdef USE_SSL
     if(Curl_ssl_supports(data, SSLSUPP_PINNEDPUBKEY))
-      return Curl_setstropt(&data->set.str[STRING_SSL_PINNEDPUBLICKEY_PROXY],
+      return Curl_setstropt(&s->str[STRING_SSL_PINNEDPUBLICKEY_PROXY],
                             ptr);
 #endif
     return CURLE_NOT_BUILT_IN;
@@ -2333,7 +2209,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
     /*
      * Set CA info for SSL connection. Specify filename of the CA certificate
      */
-    return Curl_setstropt(&data->set.str[STRING_SSL_CAFILE], ptr);
+    return Curl_setstropt(&s->str[STRING_SSL_CAFILE], ptr);
 
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_CAINFO:
@@ -2341,7 +2217,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * Set CA info SSL connection for proxy. Specify filename of the
      * CA certificate
      */
-    return Curl_setstropt(&data->set.str[STRING_SSL_CAFILE_PROXY], ptr);
+    return Curl_setstropt(&s->str[STRING_SSL_CAFILE_PROXY], ptr);
 
 #endif
   case CURLOPT_CAPATH:
@@ -2352,7 +2228,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
 #ifdef USE_SSL
     if(Curl_ssl_supports(data, SSLSUPP_CA_PATH))
       /* This does not work on Windows. */
-      return Curl_setstropt(&data->set.str[STRING_SSL_CAPATH], ptr);
+      return Curl_setstropt(&s->str[STRING_SSL_CAPATH], ptr);
 #endif
     return CURLE_NOT_BUILT_IN;
 #ifndef CURL_DISABLE_PROXY
@@ -2364,7 +2240,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
 #ifdef USE_SSL
     if(Curl_ssl_supports(data, SSLSUPP_CA_PATH))
       /* This does not work on Windows. */
-      return Curl_setstropt(&data->set.str[STRING_SSL_CAPATH_PROXY], ptr);
+      return Curl_setstropt(&s->str[STRING_SSL_CAPATH_PROXY], ptr);
 #endif
     return CURLE_NOT_BUILT_IN;
 #endif
@@ -2373,7 +2249,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * Set CRL file info for SSL connection. Specify filename of the CRL
      * to check certificates revocation
      */
-    return Curl_setstropt(&data->set.str[STRING_SSL_CRLFILE], ptr);
+    return Curl_setstropt(&s->str[STRING_SSL_CRLFILE], ptr);
 
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_CRLFILE:
@@ -2381,7 +2257,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * Set CRL file info for SSL connection for proxy. Specify filename of the
      * CRL to check certificates revocation
      */
-    return Curl_setstropt(&data->set.str[STRING_SSL_CRLFILE_PROXY], ptr);
+    return Curl_setstropt(&s->str[STRING_SSL_CRLFILE_PROXY], ptr);
 
 #endif
   case CURLOPT_ISSUERCERT:
@@ -2389,7 +2265,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * Set Issuer certificate file
      * to check certificates issuer
      */
-    return Curl_setstropt(&data->set.str[STRING_SSL_ISSUERCERT], ptr);
+    return Curl_setstropt(&s->str[STRING_SSL_ISSUERCERT], ptr);
 
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_ISSUERCERT:
@@ -2397,14 +2273,14 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * Set Issuer certificate file
      * to check certificates issuer
      */
-    return Curl_setstropt(&data->set.str[STRING_SSL_ISSUERCERT_PROXY], ptr);
+    return Curl_setstropt(&s->str[STRING_SSL_ISSUERCERT_PROXY], ptr);
 
 #endif
   case CURLOPT_PRIVATE:
     /*
      * Set private data pointer.
      */
-    data->set.private_data = ptr;
+    s->private_data = ptr;
     break;
 
 #ifdef USE_SSL
@@ -2413,7 +2289,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * Set accepted curves in SSL connection setup.
      * Specify colon-delimited list of curve algorithm names.
      */
-    return Curl_setstropt(&data->set.str[STRING_SSL_EC_CURVES], ptr);
+    return Curl_setstropt(&s->str[STRING_SSL_EC_CURVES], ptr);
 
   case CURLOPT_SSL_SIGNATURE_ALGORITHMS:
     /*
@@ -2421,7 +2297,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * Specify colon-delimited list of signature scheme names.
      */
     if(Curl_ssl_supports(data, SSLSUPP_SIGNATURE_ALGORITHMS))
-      return Curl_setstropt(&data->set.str[STRING_SSL_SIGNATURE_ALGORITHMS],
+      return Curl_setstropt(&s->str[STRING_SSL_SIGNATURE_ALGORITHMS],
                             ptr);
     return CURLE_NOT_BUILT_IN;
 #endif
@@ -2430,13 +2306,13 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
     /*
      * Use this file instead of the $HOME/.ssh/id_dsa.pub file
      */
-    return Curl_setstropt(&data->set.str[STRING_SSH_PUBLIC_KEY], ptr);
+    return Curl_setstropt(&s->str[STRING_SSH_PUBLIC_KEY], ptr);
 
   case CURLOPT_SSH_PRIVATE_KEYFILE:
     /*
      * Use this file instead of the $HOME/.ssh/id_dsa file
      */
-    return Curl_setstropt(&data->set.str[STRING_SSH_PRIVATE_KEY], ptr);
+    return Curl_setstropt(&s->str[STRING_SSH_PRIVATE_KEY], ptr);
 
 #if defined(USE_LIBSSH2) || defined(USE_LIBSSH)
   case CURLOPT_SSH_HOST_PUBLIC_KEY_MD5:
@@ -2444,19 +2320,19 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * Option to allow for the MD5 of the host public key to be checked
      * for validation purposes.
      */
-    return Curl_setstropt(&data->set.str[STRING_SSH_HOST_PUBLIC_KEY_MD5], ptr);
+    return Curl_setstropt(&s->str[STRING_SSH_HOST_PUBLIC_KEY_MD5], ptr);
 
   case CURLOPT_SSH_KNOWNHOSTS:
     /*
      * Store the filename to read known hosts from.
      */
-    return Curl_setstropt(&data->set.str[STRING_SSH_KNOWNHOSTS], ptr);
+    return Curl_setstropt(&s->str[STRING_SSH_KNOWNHOSTS], ptr);
 #endif
   case CURLOPT_SSH_KEYDATA:
     /*
      * Custom client data to pass to the SSH keyfunc callback
      */
-    data->set.ssh_keyfunc_userp = ptr;
+    s->ssh_keyfunc_userp = ptr;
     break;
 #ifdef USE_LIBSSH2
   case CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256:
@@ -2464,47 +2340,47 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * Option to allow for the SHA256 of the host public key to be checked
      * for validation purposes.
      */
-    return Curl_setstropt(&data->set.str[STRING_SSH_HOST_PUBLIC_KEY_SHA256],
+    return Curl_setstropt(&s->str[STRING_SSH_HOST_PUBLIC_KEY_SHA256],
                           ptr);
 
   case CURLOPT_SSH_HOSTKEYDATA:
     /*
      * Custom client data to pass to the SSH keyfunc callback
      */
-    data->set.ssh_hostkeyfunc_userp = ptr;
+    s->ssh_hostkeyfunc_userp = ptr;
     break;
 #endif /* USE_LIBSSH2 */
 #endif /* USE_SSH */
   case CURLOPT_PROTOCOLS_STR:
     if(ptr)
-      return protocol2num(ptr, &data->set.allowed_protocols);
+      return protocol2num(ptr, &s->allowed_protocols);
     /* make a NULL argument reset to default */
-    data->set.allowed_protocols = (curl_prot_t) CURLPROTO_ALL;
+    s->allowed_protocols = (curl_prot_t) CURLPROTO_ALL;
     break;
 
   case CURLOPT_REDIR_PROTOCOLS_STR:
     if(ptr)
-      return protocol2num(ptr, &data->set.redir_protocols);
+      return protocol2num(ptr, &s->redir_protocols);
     /* make a NULL argument reset to default */
-    data->set.redir_protocols = (curl_prot_t) CURLPROTO_REDIR;
+    s->redir_protocols = (curl_prot_t) CURLPROTO_REDIR;
     break;
 
   case CURLOPT_DEFAULT_PROTOCOL:
     /* Set the protocol to use when the URL does not include any protocol */
-    return Curl_setstropt(&data->set.str[STRING_DEFAULT_PROTOCOL], ptr);
+    return Curl_setstropt(&s->str[STRING_DEFAULT_PROTOCOL], ptr);
 
 #ifndef CURL_DISABLE_SMTP
   case CURLOPT_MAIL_FROM:
     /* Set the SMTP mail originator */
-    return Curl_setstropt(&data->set.str[STRING_MAIL_FROM], ptr);
+    return Curl_setstropt(&s->str[STRING_MAIL_FROM], ptr);
 
   case CURLOPT_MAIL_AUTH:
     /* Set the SMTP auth originator */
-    return Curl_setstropt(&data->set.str[STRING_MAIL_AUTH], ptr);
+    return Curl_setstropt(&s->str[STRING_MAIL_AUTH], ptr);
 #endif
   case CURLOPT_SASL_AUTHZID:
     /* Authorization identity (identity to act as) */
-    return Curl_setstropt(&data->set.str[STRING_SASL_AUTHZID], ptr);
+    return Curl_setstropt(&s->str[STRING_SASL_AUTHZID], ptr);
 
 #ifndef CURL_DISABLE_RTSP
   case CURLOPT_RTSP_SESSION_ID:
@@ -2512,48 +2388,48 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
      * Set the RTSP Session ID manually. Useful if the application is
      * resuming a previously established RTSP session
      */
-    return Curl_setstropt(&data->set.str[STRING_RTSP_SESSION_ID], ptr);
+    return Curl_setstropt(&s->str[STRING_RTSP_SESSION_ID], ptr);
 
   case CURLOPT_RTSP_STREAM_URI:
     /*
      * Set the Stream URI for the RTSP request. Unless the request is
      * for generic server options, the application will need to set this.
      */
-    return Curl_setstropt(&data->set.str[STRING_RTSP_STREAM_URI], ptr);
+    return Curl_setstropt(&s->str[STRING_RTSP_STREAM_URI], ptr);
 
   case CURLOPT_RTSP_TRANSPORT:
     /*
      * The content of the Transport: header for the RTSP request
      */
-    return Curl_setstropt(&data->set.str[STRING_RTSP_TRANSPORT], ptr);
+    return Curl_setstropt(&s->str[STRING_RTSP_TRANSPORT], ptr);
 
   case CURLOPT_INTERLEAVEDATA:
-    data->set.rtp_out = ptr;
+    s->rtp_out = ptr;
     break;
 #endif /* ! CURL_DISABLE_RTSP */
 #ifndef CURL_DISABLE_FTP
   case CURLOPT_CHUNK_DATA:
-    data->set.wildcardptr = ptr;
+    s->wildcardptr = ptr;
     break;
   case CURLOPT_FNMATCH_DATA:
-    data->set.fnmatch_data = ptr;
+    s->fnmatch_data = ptr;
     break;
 #endif
 #ifdef USE_TLS_SRP
   case CURLOPT_TLSAUTH_USERNAME:
-    return Curl_setstropt(&data->set.str[STRING_TLSAUTH_USERNAME], ptr);
+    return Curl_setstropt(&s->str[STRING_TLSAUTH_USERNAME], ptr);
 
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_TLSAUTH_USERNAME:
-    return Curl_setstropt(&data->set.str[STRING_TLSAUTH_USERNAME_PROXY], ptr);
+    return Curl_setstropt(&s->str[STRING_TLSAUTH_USERNAME_PROXY], ptr);
 
 #endif
   case CURLOPT_TLSAUTH_PASSWORD:
-    return Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD], ptr);
+    return Curl_setstropt(&s->str[STRING_TLSAUTH_PASSWORD], ptr);
 
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_TLSAUTH_PASSWORD:
-    return Curl_setstropt(&data->set.str[STRING_TLSAUTH_PASSWORD_PROXY], ptr);
+    return Curl_setstropt(&s->str[STRING_TLSAUTH_PASSWORD_PROXY], ptr);
 #endif
   case CURLOPT_TLSAUTH_TYPE:
     if(ptr && !curl_strequal(ptr, "SRP"))
@@ -2568,25 +2444,25 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
 #endif
 #ifdef CURLRES_ARES
   case CURLOPT_DNS_SERVERS:
-    result = Curl_setstropt(&data->set.str[STRING_DNS_SERVERS], ptr);
+    result = Curl_setstropt(&s->str[STRING_DNS_SERVERS], ptr);
     if(result)
       return result;
     return Curl_async_ares_set_dns_servers(data);
 
   case CURLOPT_DNS_INTERFACE:
-    result = Curl_setstropt(&data->set.str[STRING_DNS_INTERFACE], ptr);
+    result = Curl_setstropt(&s->str[STRING_DNS_INTERFACE], ptr);
     if(result)
       return result;
     return Curl_async_ares_set_dns_interface(data);
 
   case CURLOPT_DNS_LOCAL_IP4:
-    result = Curl_setstropt(&data->set.str[STRING_DNS_LOCAL_IP4], ptr);
+    result = Curl_setstropt(&s->str[STRING_DNS_LOCAL_IP4], ptr);
     if(result)
       return result;
     return Curl_async_ares_set_dns_local_ip4(data);
 
   case CURLOPT_DNS_LOCAL_IP6:
-    result = Curl_setstropt(&data->set.str[STRING_DNS_LOCAL_IP6], ptr);
+    result = Curl_setstropt(&s->str[STRING_DNS_LOCAL_IP6], ptr);
     if(result)
       return result;
     return Curl_async_ares_set_dns_local_ip6(data);
@@ -2594,27 +2470,27 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
 #endif
 #ifdef USE_UNIX_SOCKETS
   case CURLOPT_UNIX_SOCKET_PATH:
-    data->set.abstract_unix_socket = FALSE;
-    return Curl_setstropt(&data->set.str[STRING_UNIX_SOCKET_PATH], ptr);
+    s->abstract_unix_socket = FALSE;
+    return Curl_setstropt(&s->str[STRING_UNIX_SOCKET_PATH], ptr);
 
   case CURLOPT_ABSTRACT_UNIX_SOCKET:
-    data->set.abstract_unix_socket = TRUE;
-    return Curl_setstropt(&data->set.str[STRING_UNIX_SOCKET_PATH], ptr);
+    s->abstract_unix_socket = TRUE;
+    return Curl_setstropt(&s->str[STRING_UNIX_SOCKET_PATH], ptr);
 
 #endif
 
 #ifndef CURL_DISABLE_DOH
   case CURLOPT_DOH_URL:
-    result = Curl_setstropt(&data->set.str[STRING_DOH], ptr);
-    data->set.doh = !!(data->set.str[STRING_DOH]);
+    result = Curl_setstropt(&s->str[STRING_DOH], ptr);
+    s->doh = !!(s->str[STRING_DOH]);
     break;
 #endif
 #ifndef CURL_DISABLE_HSTS
   case CURLOPT_HSTSREADDATA:
-    data->set.hsts_read_userp = ptr;
+    s->hsts_read_userp = ptr;
     break;
   case CURLOPT_HSTSWRITEDATA:
-    data->set.hsts_write_userp = ptr;
+    s->hsts_write_userp = ptr;
     break;
   case CURLOPT_HSTS: {
     struct curl_slist *h;
@@ -2624,7 +2500,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
         return CURLE_OUT_OF_MEMORY;
     }
     if(ptr) {
-      result = Curl_setstropt(&data->set.str[STRING_HSTS], ptr);
+      result = Curl_setstropt(&s->str[STRING_HSTS], ptr);
       if(result)
         return result;
       /* this needs to build a list of filenames to read from, so that it can
@@ -2656,7 +2532,7 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
       if(!data->asi)
         return CURLE_OUT_OF_MEMORY;
     }
-    result = Curl_setstropt(&data->set.str[STRING_ALTSVC], ptr);
+    result = Curl_setstropt(&s->str[STRING_ALTSVC], ptr);
     if(result)
       return result;
     if(ptr)
@@ -2668,35 +2544,35 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
     size_t plen = 0;
 
     if(!ptr) {
-      data->set.tls_ech = CURLECH_DISABLE;
+      s->tls_ech = CURLECH_DISABLE;
       return CURLE_OK;
     }
     plen = strlen(ptr);
     if(plen > CURL_MAX_INPUT_LENGTH) {
-      data->set.tls_ech = CURLECH_DISABLE;
+      s->tls_ech = CURLECH_DISABLE;
       return CURLE_BAD_FUNCTION_ARGUMENT;
     }
     /* set tls_ech flag value, preserving CLA_CFG bit */
     if(!strcmp(ptr, "false"))
-      data->set.tls_ech = CURLECH_DISABLE |
-        (data->set.tls_ech & CURLECH_CLA_CFG);
+      s->tls_ech = CURLECH_DISABLE |
+        (s->tls_ech & CURLECH_CLA_CFG);
     else if(!strcmp(ptr, "grease"))
-      data->set.tls_ech = CURLECH_GREASE |
-        (data->set.tls_ech & CURLECH_CLA_CFG);
+      s->tls_ech = CURLECH_GREASE |
+        (s->tls_ech & CURLECH_CLA_CFG);
     else if(!strcmp(ptr, "true"))
-      data->set.tls_ech = CURLECH_ENABLE |
-        (data->set.tls_ech & CURLECH_CLA_CFG);
+      s->tls_ech = CURLECH_ENABLE |
+        (s->tls_ech & CURLECH_CLA_CFG);
     else if(!strcmp(ptr, "hard"))
-      data->set.tls_ech = CURLECH_HARD |
-        (data->set.tls_ech & CURLECH_CLA_CFG);
+      s->tls_ech = CURLECH_HARD |
+        (s->tls_ech & CURLECH_CLA_CFG);
     else if(plen > 5 && !strncmp(ptr, "ecl:", 4)) {
-      result = Curl_setstropt(&data->set.str[STRING_ECH_CONFIG], ptr + 4);
+      result = Curl_setstropt(&s->str[STRING_ECH_CONFIG], ptr + 4);
       if(result)
         return result;
-      data->set.tls_ech |= CURLECH_CLA_CFG;
+      s->tls_ech |= CURLECH_CLA_CFG;
     }
     else if(plen > 4 && !strncmp(ptr, "pn:", 3)) {
-      result = Curl_setstropt(&data->set.str[STRING_ECH_PUBLIC], ptr + 3);
+      result = Curl_setstropt(&s->str[STRING_ECH_PUBLIC], ptr + 3);
       if(result)
         return result;
     }
@@ -2712,13 +2588,14 @@ static CURLcode setopt_cptr(struct Curl_easy *data, CURLoption option,
 static CURLcode setopt_func(struct Curl_easy *data, CURLoption option,
                             va_list param)
 {
+  struct UserDefined *s = &data->set;
   switch(option) {
   case CURLOPT_PROGRESSFUNCTION:
     /*
      * Progress callback function
      */
-    data->set.fprogress = va_arg(param, curl_progress_callback);
-    if(data->set.fprogress)
+    s->fprogress = va_arg(param, curl_progress_callback);
+    if(s->fprogress)
       data->progress.callback = TRUE; /* no longer internal */
     else
       data->progress.callback = FALSE; /* NULL enforces internal */
@@ -2728,8 +2605,8 @@ static CURLcode setopt_func(struct Curl_easy *data, CURLoption option,
     /*
      * Transfer info callback function
      */
-    data->set.fxferinfo = va_arg(param, curl_xferinfo_callback);
-    if(data->set.fxferinfo)
+    s->fxferinfo = va_arg(param, curl_xferinfo_callback);
+    if(s->fxferinfo)
       data->progress.callback = TRUE; /* no longer internal */
     else
       data->progress.callback = FALSE; /* NULL enforces internal */
@@ -2739,7 +2616,7 @@ static CURLcode setopt_func(struct Curl_easy *data, CURLoption option,
     /*
      * stderr write callback.
      */
-    data->set.fdebug = va_arg(param, curl_debug_callback);
+    s->fdebug = va_arg(param, curl_debug_callback);
     /*
      * if the callback provided is NULL, it will use the default callback
      */
@@ -2748,41 +2625,41 @@ static CURLcode setopt_func(struct Curl_easy *data, CURLoption option,
     /*
      * Set header write callback
      */
-    data->set.fwrite_header = va_arg(param, curl_write_callback);
+    s->fwrite_header = va_arg(param, curl_write_callback);
     break;
   case CURLOPT_WRITEFUNCTION:
     /*
      * Set data write callback
      */
-    data->set.fwrite_func = va_arg(param, curl_write_callback);
-    if(!data->set.fwrite_func)
+    s->fwrite_func = va_arg(param, curl_write_callback);
+    if(!s->fwrite_func)
       /* When set to NULL, reset to our internal default function */
-      data->set.fwrite_func = (curl_write_callback)fwrite;
+      s->fwrite_func = (curl_write_callback)fwrite;
     break;
   case CURLOPT_READFUNCTION:
     /*
      * Read data callback
      */
-    data->set.fread_func_set = va_arg(param, curl_read_callback);
-    if(!data->set.fread_func_set) {
-      data->set.is_fread_set = 0;
+    s->fread_func_set = va_arg(param, curl_read_callback);
+    if(!s->fread_func_set) {
+      s->is_fread_set = 0;
       /* When set to NULL, reset to our internal default function */
-      data->set.fread_func_set = (curl_read_callback)fread;
+      s->fread_func_set = (curl_read_callback)fread;
     }
     else
-      data->set.is_fread_set = 1;
+      s->is_fread_set = 1;
     break;
   case CURLOPT_SEEKFUNCTION:
     /*
      * Seek callback. Might be NULL.
      */
-    data->set.seek_func = va_arg(param, curl_seek_callback);
+    s->seek_func = va_arg(param, curl_seek_callback);
     break;
   case CURLOPT_IOCTLFUNCTION:
     /*
      * I/O control callback. Might be NULL.
      */
-    data->set.ioctl_func = va_arg(param, curl_ioctl_callback);
+    s->ioctl_func = va_arg(param, curl_ioctl_callback);
     break;
   case CURLOPT_SSL_CTX_FUNCTION:
     /*
@@ -2790,7 +2667,7 @@ static CURLcode setopt_func(struct Curl_easy *data, CURLoption option,
      */
 #ifdef USE_SSL
     if(Curl_ssl_supports(data, SSLSUPP_SSL_CTX)) {
-      data->set.ssl.fsslctx = va_arg(param, curl_ssl_ctx_callback);
+      s->ssl.fsslctx = va_arg(param, curl_ssl_ctx_callback);
       break;
     }
     else
@@ -2801,7 +2678,7 @@ static CURLcode setopt_func(struct Curl_easy *data, CURLoption option,
     /*
      * socket callback function: called after socket() but before connect()
      */
-    data->set.fsockopt = va_arg(param, curl_sockopt_callback);
+    s->fsockopt = va_arg(param, curl_sockopt_callback);
     break;
 
   case CURLOPT_OPENSOCKETFUNCTION:
@@ -2809,7 +2686,7 @@ static CURLcode setopt_func(struct Curl_easy *data, CURLoption option,
      * open/create socket callback function: called instead of socket(),
      * before connect()
      */
-    data->set.fopensocket = va_arg(param, curl_opensocket_callback);
+    s->fopensocket = va_arg(param, curl_opensocket_callback);
     break;
 
   case CURLOPT_CLOSESOCKETFUNCTION:
@@ -2817,7 +2694,7 @@ static CURLcode setopt_func(struct Curl_easy *data, CURLoption option,
      * close socket callback function: called instead of close()
      * when shutting down a connection
      */
-    data->set.fclosesocket = va_arg(param, curl_closesocket_callback);
+    s->fclosesocket = va_arg(param, curl_closesocket_callback);
     break;
 
   case CURLOPT_RESOLVER_START_FUNCTION:
@@ -2825,21 +2702,21 @@ static CURLcode setopt_func(struct Curl_easy *data, CURLoption option,
      * resolver start callback function: called before a new resolver request
      * is started
      */
-    data->set.resolver_start = va_arg(param, curl_resolver_start_callback);
+    s->resolver_start = va_arg(param, curl_resolver_start_callback);
     break;
 
 #ifdef USE_SSH
 #ifdef USE_LIBSSH2
   case CURLOPT_SSH_HOSTKEYFUNCTION:
     /* the callback to check the hostkey without the knownhost file */
-    data->set.ssh_hostkeyfunc = va_arg(param, curl_sshhostkeycallback);
+    s->ssh_hostkeyfunc = va_arg(param, curl_sshhostkeycallback);
     break;
 #endif
 
   case CURLOPT_SSH_KEYFUNCTION:
     /* setting to NULL is fine since the ssh.c functions themselves will
        then revert to use the internal default */
-    data->set.ssh_keyfunc = va_arg(param, curl_sshkeycallback);
+    s->ssh_keyfunc = va_arg(param, curl_sshkeycallback);
     break;
 
 #endif /* USE_SSH */
@@ -2847,35 +2724,35 @@ static CURLcode setopt_func(struct Curl_easy *data, CURLoption option,
 #ifndef CURL_DISABLE_RTSP
   case CURLOPT_INTERLEAVEFUNCTION:
     /* Set the user defined RTP write function */
-    data->set.fwrite_rtp = va_arg(param, curl_write_callback);
+    s->fwrite_rtp = va_arg(param, curl_write_callback);
     break;
 #endif
 #ifndef CURL_DISABLE_FTP
   case CURLOPT_CHUNK_BGN_FUNCTION:
-    data->set.chunk_bgn = va_arg(param, curl_chunk_bgn_callback);
+    s->chunk_bgn = va_arg(param, curl_chunk_bgn_callback);
     break;
   case CURLOPT_CHUNK_END_FUNCTION:
-    data->set.chunk_end = va_arg(param, curl_chunk_end_callback);
+    s->chunk_end = va_arg(param, curl_chunk_end_callback);
     break;
   case CURLOPT_FNMATCH_FUNCTION:
-    data->set.fnmatch = va_arg(param, curl_fnmatch_callback);
+    s->fnmatch = va_arg(param, curl_fnmatch_callback);
     break;
 #endif
 #ifndef CURL_DISABLE_HTTP
   case CURLOPT_TRAILERFUNCTION:
-    data->set.trailer_callback = va_arg(param, curl_trailer_callback);
+    s->trailer_callback = va_arg(param, curl_trailer_callback);
     break;
 #endif
 #ifndef CURL_DISABLE_HSTS
   case CURLOPT_HSTSREADFUNCTION:
-    data->set.hsts_read = va_arg(param, curl_hstsread_callback);
+    s->hsts_read = va_arg(param, curl_hstsread_callback);
     break;
   case CURLOPT_HSTSWRITEFUNCTION:
-    data->set.hsts_write = va_arg(param, curl_hstswrite_callback);
+    s->hsts_write = va_arg(param, curl_hstswrite_callback);
     break;
 #endif
   case CURLOPT_PREREQFUNCTION:
-    data->set.fprereq = va_arg(param, curl_prereq_callback);
+    s->fprereq = va_arg(param, curl_prereq_callback);
     break;
   default:
     return CURLE_UNKNOWN_OPTION;
@@ -2886,13 +2763,14 @@ static CURLcode setopt_func(struct Curl_easy *data, CURLoption option,
 static CURLcode setopt_offt(struct Curl_easy *data, CURLoption option,
                             curl_off_t offt)
 {
+  struct UserDefined *s = &data->set;
   switch(option) {
   case CURLOPT_TIMEVALUE_LARGE:
     /*
      * This is the value to compare with the remote document with the
      * method set with CURLOPT_TIMECONDITION
      */
-    data->set.timevalue = (time_t)offt;
+    s->timevalue = (time_t)offt;
     break;
 
     /* MQTT "borrows" some of the HTTP options */
@@ -2904,13 +2782,13 @@ static CURLcode setopt_offt(struct Curl_easy *data, CURLoption option,
     if(offt < -1)
       return CURLE_BAD_FUNCTION_ARGUMENT;
 
-    if(data->set.postfieldsize < offt &&
-       data->set.postfields == data->set.str[STRING_COPYPOSTFIELDS]) {
+    if(s->postfieldsize < offt &&
+       s->postfields == s->str[STRING_COPYPOSTFIELDS]) {
       /* Previous CURLOPT_COPYPOSTFIELDS is no longer valid. */
-      Curl_safefree(data->set.str[STRING_COPYPOSTFIELDS]);
-      data->set.postfields = NULL;
+      Curl_safefree(s->str[STRING_COPYPOSTFIELDS]);
+      s->postfields = NULL;
     }
-    data->set.postfieldsize = offt;
+    s->postfieldsize = offt;
     break;
   case CURLOPT_INFILESIZE_LARGE:
     /*
@@ -2919,7 +2797,7 @@ static CURLcode setopt_offt(struct Curl_easy *data, CURLoption option,
      */
     if(offt < -1)
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.filesize = offt;
+    s->filesize = offt;
     break;
   case CURLOPT_MAX_SEND_SPEED_LARGE:
     /*
@@ -2928,7 +2806,7 @@ static CURLcode setopt_offt(struct Curl_easy *data, CURLoption option,
      */
     if(offt < 0)
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.max_send_speed = offt;
+    s->max_send_speed = offt;
     break;
   case CURLOPT_MAX_RECV_SPEED_LARGE:
     /*
@@ -2937,7 +2815,7 @@ static CURLcode setopt_offt(struct Curl_easy *data, CURLoption option,
      */
     if(offt < 0)
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.max_recv_speed = offt;
+    s->max_recv_speed = offt;
     break;
   case CURLOPT_RESUME_FROM_LARGE:
     /*
@@ -2945,7 +2823,7 @@ static CURLcode setopt_offt(struct Curl_easy *data, CURLoption option,
      */
     if(offt < -1)
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.set_resume_from = offt;
+    s->set_resume_from = offt;
     break;
   case CURLOPT_MAXFILESIZE_LARGE:
     /*
@@ -2953,7 +2831,7 @@ static CURLcode setopt_offt(struct Curl_easy *data, CURLoption option,
      */
     if(offt < 0)
       return CURLE_BAD_FUNCTION_ARGUMENT;
-    data->set.max_filesize = offt;
+    s->max_filesize = offt;
     break;
 
   default:
@@ -2965,23 +2843,24 @@ static CURLcode setopt_offt(struct Curl_easy *data, CURLoption option,
 static CURLcode setopt_blob(struct Curl_easy *data, CURLoption option,
                             struct curl_blob *blob)
 {
+  struct UserDefined *s = &data->set;
   switch(option) {
   case CURLOPT_SSLCERT_BLOB:
     /*
      * Blob that holds file content of the SSL certificate to use
      */
-    return Curl_setblobopt(&data->set.blobs[BLOB_CERT], blob);
+    return Curl_setblobopt(&s->blobs[BLOB_CERT], blob);
 #ifndef CURL_DISABLE_PROXY
   case CURLOPT_PROXY_SSLCERT_BLOB:
     /*
      * Blob that holds file content of the SSL certificate to use for proxy
      */
-    return Curl_setblobopt(&data->set.blobs[BLOB_CERT_PROXY], blob);
+    return Curl_setblobopt(&s->blobs[BLOB_CERT_PROXY], blob);
   case CURLOPT_PROXY_SSLKEY_BLOB:
     /*
      * Blob that holds file content of the SSL key to use for proxy
      */
-    return Curl_setblobopt(&data->set.blobs[BLOB_KEY_PROXY], blob);
+    return Curl_setblobopt(&s->blobs[BLOB_KEY_PROXY], blob);
   case CURLOPT_PROXY_CAINFO_BLOB:
     /*
      * Blob that holds CA info for SSL connection proxy.
@@ -2989,21 +2868,21 @@ static CURLcode setopt_blob(struct Curl_easy *data, CURLoption option,
      */
 #ifdef USE_SSL
     if(Curl_ssl_supports(data, SSLSUPP_CAINFO_BLOB))
-      return Curl_setblobopt(&data->set.blobs[BLOB_CAINFO_PROXY], blob);
+      return Curl_setblobopt(&s->blobs[BLOB_CAINFO_PROXY], blob);
 #endif
     return CURLE_NOT_BUILT_IN;
   case CURLOPT_PROXY_ISSUERCERT_BLOB:
     /*
      * Blob that holds Issuer certificate to check certificates issuer
      */
-    return Curl_setblobopt(&data->set.blobs[BLOB_SSL_ISSUERCERT_PROXY],
+    return Curl_setblobopt(&s->blobs[BLOB_SSL_ISSUERCERT_PROXY],
                            blob);
 #endif
   case CURLOPT_SSLKEY_BLOB:
     /*
      * Blob that holds file content of the SSL key to use
      */
-    return Curl_setblobopt(&data->set.blobs[BLOB_KEY], blob);
+    return Curl_setblobopt(&s->blobs[BLOB_KEY], blob);
   case CURLOPT_CAINFO_BLOB:
     /*
      * Blob that holds CA info for SSL connection.
@@ -3011,14 +2890,14 @@ static CURLcode setopt_blob(struct Curl_easy *data, CURLoption option,
      */
 #ifdef USE_SSL
     if(Curl_ssl_supports(data, SSLSUPP_CAINFO_BLOB))
-      return Curl_setblobopt(&data->set.blobs[BLOB_CAINFO], blob);
+      return Curl_setblobopt(&s->blobs[BLOB_CAINFO], blob);
 #endif
     return CURLE_NOT_BUILT_IN;
   case CURLOPT_ISSUERCERT_BLOB:
     /*
      * Blob that holds Issuer certificate to check certificates issuer
      */
-    return Curl_setblobopt(&data->set.blobs[BLOB_SSL_ISSUERCERT], blob);
+    return Curl_setblobopt(&s->blobs[BLOB_SSL_ISSUERCERT], blob);
 
   default:
     return CURLE_UNKNOWN_OPTION;
diff --git a/deps/curl/lib/setopt.h b/deps/curl/lib/setopt.h
index b0237467bd6..c323dd74a37 100644
--- a/deps/curl/lib/setopt.h
+++ b/deps/curl/lib/setopt.h
@@ -24,6 +24,13 @@
  *
  ***************************************************************************/
 
+#ifdef USE_SSL
+CURLcode Curl_setopt_SSLVERSION(struct Curl_easy *data, CURLoption option,
+                                long arg);
+#else
+#define Curl_setopt_SSLVERSION(a,b,c) CURLE_NOT_BUILT_IN
+#endif
+
 CURLcode Curl_setstropt(char **charp, const char *s) WARN_UNUSED_RESULT;
 CURLcode Curl_setblobopt(struct curl_blob **blobp,
                          const struct curl_blob *blob) WARN_UNUSED_RESULT;
diff --git a/deps/curl/lib/sha256.c b/deps/curl/lib/sha256.c
index d73e0ef0937..6f519add58a 100644
--- a/deps/curl/lib/sha256.c
+++ b/deps/curl/lib/sha256.c
@@ -25,8 +25,8 @@
 
 #include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) \
-  || defined(USE_LIBSSH2) || defined(USE_SSL)
+#if !defined(CURL_DISABLE_AWS) || !defined(CURL_DISABLE_DIGEST_AUTH) || \
+  defined(USE_LIBSSH2) || defined(USE_SSL)
 
 #include "curlx/warnless.h"
 #include "curl_sha256.h"
@@ -38,9 +38,8 @@
 #include <nettle/sha.h>
 #elif defined(USE_MBEDTLS)
 #include <mbedtls/version.h>
-#if(MBEDTLS_VERSION_NUMBER >= 0x02070000) && \
-   (MBEDTLS_VERSION_NUMBER < 0x03000000)
-  #define HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS
+#if MBEDTLS_VERSION_NUMBER < 0x03020000
+  #error "mbedTLS 3.2.0 or later required"
 #endif
 #include <mbedtls/sha256.h>
 #elif (defined(__MAC_OS_X_VERSION_MAX_ALLOWED) && \
@@ -134,11 +133,7 @@ typedef mbedtls_sha256_context my_sha256_ctx;
 
 static CURLcode my_sha256_init(void *ctx)
 {
-#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
-  (void) mbedtls_sha256_starts(ctx, 0);
-#else
-  (void) mbedtls_sha256_starts_ret(ctx, 0);
-#endif
+  (void)mbedtls_sha256_starts(ctx, 0);
   return CURLE_OK;
 }
 
@@ -146,20 +141,12 @@ static void my_sha256_update(void *ctx,
                              const unsigned char *data,
                              unsigned int length)
 {
-#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
-  (void) mbedtls_sha256_update(ctx, data, length);
-#else
-  (void) mbedtls_sha256_update_ret(ctx, data, length);
-#endif
+  (void)mbedtls_sha256_update(ctx, data, length);
 }
 
 static void my_sha256_final(unsigned char *digest, void *ctx)
 {
-#if !defined(HAS_MBEDTLS_RESULT_CODE_BASED_FUNCTIONS)
-  (void) mbedtls_sha256_finish(ctx, digest);
-#else
-  (void) mbedtls_sha256_finish_ret(ctx, digest);
-#endif
+  (void)mbedtls_sha256_finish(ctx, digest);
 }
 
 #elif defined(AN_APPLE_OS)
@@ -167,7 +154,7 @@ typedef CC_SHA256_CTX my_sha256_ctx;
 
 static CURLcode my_sha256_init(void *ctx)
 {
-  (void) CC_SHA256_Init(ctx);
+  (void)CC_SHA256_Init(ctx);
   return CURLE_OK;
 }
 
@@ -175,12 +162,12 @@ static void my_sha256_update(void *ctx,
                              const unsigned char *data,
                              unsigned int length)
 {
-  (void) CC_SHA256_Update(ctx, data, length);
+  (void)CC_SHA256_Update(ctx, data, length);
 }
 
 static void my_sha256_final(unsigned char *digest, void *ctx)
 {
-  (void) CC_SHA256_Final(digest, ctx);
+  (void)CC_SHA256_Final(digest, ctx);
 }
 
 #elif defined(USE_WIN32_CRYPTO)
@@ -191,7 +178,8 @@ struct sha256_ctx {
 };
 typedef struct sha256_ctx my_sha256_ctx;
 
-#if !defined(CALG_SHA_256)
+/* Offered when targeting Vista (XP SP2+) */
+#ifndef CALG_SHA_256
 #define CALG_SHA_256 0x0000800c
 #endif
 
diff --git a/deps/curl/lib/smb.c b/deps/curl/lib/smb.c
index 3eee16468de..81cf6e7cc1f 100644
--- a/deps/curl/lib/smb.c
+++ b/deps/curl/lib/smb.c
@@ -36,6 +36,7 @@
 #include "connect.h"
 #include "progress.h"
 #include "transfer.h"
+#include "select.h"
 #include "vtls/vtls.h"
 #include "curl_ntlm_core.h"
 #include "escape.h"
@@ -298,8 +299,8 @@ static CURLcode smb_connect(struct Curl_easy *data, bool *done);
 static CURLcode smb_connection_state(struct Curl_easy *data, bool *done);
 static CURLcode smb_do(struct Curl_easy *data, bool *done);
 static CURLcode smb_request_state(struct Curl_easy *data, bool *done);
-static int smb_getsock(struct Curl_easy *data, struct connectdata *conn,
-                       curl_socket_t *socks);
+static CURLcode smb_pollset(struct Curl_easy *data,
+                            struct easy_pollset *ps);
 static CURLcode smb_parse_url_path(struct Curl_easy *data,
                                    struct smb_conn *smbc,
                                    struct smb_request *req);
@@ -316,10 +317,10 @@ const struct Curl_handler Curl_handler_smb = {
   smb_connect,                          /* connect_it */
   smb_connection_state,                 /* connecting */
   smb_request_state,                    /* doing */
-  smb_getsock,                          /* proto_getsock */
-  smb_getsock,                          /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  smb_pollset,                          /* proto_pollset */
+  smb_pollset,                          /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -345,10 +346,10 @@ const struct Curl_handler Curl_handler_smbs = {
   smb_connect,                          /* connect_it */
   smb_connection_state,                 /* connecting */
   smb_request_state,                    /* doing */
-  smb_getsock,                          /* proto_getsock */
-  smb_getsock,                          /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  smb_pollset,                          /* proto_pollset */
+  smb_pollset,                          /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -496,7 +497,7 @@ static CURLcode smb_connect(struct Curl_easy *data, bool *done)
   struct smb_conn *smbc = Curl_conn_meta_get(conn, CURL_META_SMB_CONN);
   char *slash;
 
-  (void) done;
+  (void)done;
   if(!smbc)
     return CURLE_FAILED_INIT;
 
@@ -1204,12 +1205,10 @@ static CURLcode smb_request_state(struct Curl_easy *data, bool *done)
   return CURLE_OK;
 }
 
-static int smb_getsock(struct Curl_easy *data,
-                       struct connectdata *conn, curl_socket_t *socks)
+static CURLcode smb_pollset(struct Curl_easy *data,
+                            struct easy_pollset *ps)
 {
-  (void)data;
-  socks[0] = conn->sock[FIRSTSOCKET];
-  return GETSOCK_READSOCK(0) | GETSOCK_WRITESOCK(0);
+  return Curl_pollset_add_inout(data, ps, data->conn->sock[FIRSTSOCKET]);
 }
 
 static CURLcode smb_do(struct Curl_easy *data, bool *done)
@@ -1267,5 +1266,4 @@ static CURLcode smb_parse_url_path(struct Curl_easy *data,
   return CURLE_OK;
 }
 
-#endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE &&
-          SIZEOF_CURL_OFF_T > 4 */
+#endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE && SIZEOF_CURL_OFF_T > 4 */
diff --git a/deps/curl/lib/smb.h b/deps/curl/lib/smb.h
index eb4df6550a3..aa0be881c13 100644
--- a/deps/curl/lib/smb.h
+++ b/deps/curl/lib/smb.h
@@ -26,12 +26,11 @@
  ***************************************************************************/
 
 #if !defined(CURL_DISABLE_SMB) && defined(USE_CURL_NTLM_CORE) && \
-    (SIZEOF_CURL_OFF_T > 4)
+  (SIZEOF_CURL_OFF_T > 4)
 
 extern const struct Curl_handler Curl_handler_smb;
 extern const struct Curl_handler Curl_handler_smbs;
 
-#endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE &&
-          SIZEOF_CURL_OFF_T > 4 */
+#endif /* CURL_DISABLE_SMB && USE_CURL_NTLM_CORE && SIZEOF_CURL_OFF_T > 4 */
 
 #endif /* HEADER_CURL_SMB_H */
diff --git a/deps/curl/lib/smtp.c b/deps/curl/lib/smtp.c
index d2adf43a7c2..5dba1f9ea8c 100644
--- a/deps/curl/lib/smtp.c
+++ b/deps/curl/lib/smtp.c
@@ -157,8 +157,8 @@ static CURLcode smtp_connect(struct Curl_easy *data, bool *done);
 static CURLcode smtp_disconnect(struct Curl_easy *data,
                                 struct connectdata *conn, bool dead);
 static CURLcode smtp_multi_statemach(struct Curl_easy *data, bool *done);
-static int smtp_getsock(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks);
+static CURLcode smtp_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps);
 static CURLcode smtp_doing(struct Curl_easy *data, bool *dophase_done);
 static CURLcode smtp_setup_connection(struct Curl_easy *data,
                                       struct connectdata *conn);
@@ -169,7 +169,8 @@ static CURLcode smtp_parse_url_path(struct Curl_easy *data,
 static CURLcode smtp_parse_custom_request(struct Curl_easy *data,
                                           struct SMTP *smtp);
 static CURLcode smtp_parse_address(const char *fqma,
-                                   char **address, struct hostname *host);
+                                   char **address, struct hostname *host,
+                                   const char **suffix);
 static CURLcode smtp_perform_auth(struct Curl_easy *data, const char *mech,
                                   const struct bufref *initresp);
 static CURLcode smtp_continue_auth(struct Curl_easy *data, const char *mech,
@@ -191,10 +192,10 @@ const struct Curl_handler Curl_handler_smtp = {
   smtp_connect,                     /* connect_it */
   smtp_multi_statemach,             /* connecting */
   smtp_doing,                       /* doing */
-  smtp_getsock,                     /* proto_getsock */
-  smtp_getsock,                     /* doing_getsock */
-  ZERO_NULL,                        /* domore_getsock */
-  ZERO_NULL,                        /* perform_getsock */
+  smtp_pollset,                     /* proto_pollset */
+  smtp_pollset,                     /* doing_pollset */
+  ZERO_NULL,                        /* domore_pollset */
+  ZERO_NULL,                        /* perform_pollset */
   smtp_disconnect,                  /* disconnect */
   ZERO_NULL,                        /* write_resp */
   ZERO_NULL,                        /* write_resp_hd */
@@ -222,10 +223,10 @@ const struct Curl_handler Curl_handler_smtps = {
   smtp_connect,                     /* connect_it */
   smtp_multi_statemach,             /* connecting */
   smtp_doing,                       /* doing */
-  smtp_getsock,                     /* proto_getsock */
-  smtp_getsock,                     /* doing_getsock */
-  ZERO_NULL,                        /* domore_getsock */
-  ZERO_NULL,                        /* perform_getsock */
+  smtp_pollset,                     /* proto_pollset */
+  smtp_pollset,                     /* doing_pollset */
+  ZERO_NULL,                        /* domore_pollset */
+  ZERO_NULL,                        /* perform_pollset */
   smtp_disconnect,                  /* disconnect */
   ZERO_NULL,                        /* write_resp */
   ZERO_NULL,                        /* write_resp_hd */
@@ -357,7 +358,7 @@ static void smtp_state(struct Curl_easy *data,
                        struct smtp_conn *smtpc,
                        smtpstate newstate)
 {
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
   /* for debug purposes */
   static const char * const names[] = {
     "STOP",
@@ -379,6 +380,8 @@ static void smtp_state(struct Curl_easy *data,
   if(smtpc->state != newstate)
     CURL_TRC_SMTP(data, "state change from %s to %s",
                   names[smtpc->state], names[newstate]);
+#else
+  (void)data;
 #endif
 
   smtpc->state = newstate;
@@ -618,11 +621,12 @@ static CURLcode smtp_perform_command(struct Curl_easy *data,
     if((!smtp->custom) || (!smtp->custom[0])) {
       char *address = NULL;
       struct hostname host = { NULL, NULL, NULL, NULL };
+      const char *suffix = "";
 
       /* Parse the mailbox to verify into the local address and hostname
          parts, converting the hostname to an IDN A-label if necessary */
       result = smtp_parse_address(smtp->rcpt->data,
-                                  &address, &host);
+                                  &address, &host, &suffix);
       if(result)
         return result;
 
@@ -692,11 +696,12 @@ static CURLcode smtp_perform_mail(struct Curl_easy *data,
   if(data->set.str[STRING_MAIL_FROM]) {
     char *address = NULL;
     struct hostname host = { NULL, NULL, NULL, NULL };
+    const char *suffix = "";
 
     /* Parse the FROM mailbox into the local address and hostname parts,
        converting the hostname to an IDN A-label if necessary */
     result = smtp_parse_address(data->set.str[STRING_MAIL_FROM],
-                                &address, &host);
+                                &address, &host, &suffix);
     if(result)
       goto out;
 
@@ -707,14 +712,14 @@ static CURLcode smtp_perform_mail(struct Curl_easy *data,
             (!Curl_is_ASCII_name(host.name)));
 
     if(host.name) {
-      from = aprintf("<%s@%s>", address, host.name);
+      from = aprintf("<%s@%s>%s", address, host.name, suffix);
 
       Curl_free_idnconverted_hostname(&host);
     }
     else
       /* An invalid mailbox was provided but we will simply let the server
          worry about that and reply with a 501 error */
-      from = aprintf("<%s>", address);
+      from = aprintf("<%s>%s", address, suffix);
 
     free(address);
   }
@@ -732,11 +737,12 @@ static CURLcode smtp_perform_mail(struct Curl_easy *data,
     if(data->set.str[STRING_MAIL_AUTH][0] != '\0') {
       char *address = NULL;
       struct hostname host = { NULL, NULL, NULL, NULL };
+      const char *suffix = "";
 
       /* Parse the AUTH mailbox into the local address and hostname parts,
          converting the hostname to an IDN A-label if necessary */
       result = smtp_parse_address(data->set.str[STRING_MAIL_AUTH],
-                                  &address, &host);
+                                  &address, &host, &suffix);
       if(result)
         goto out;
 
@@ -748,14 +754,14 @@ static CURLcode smtp_perform_mail(struct Curl_easy *data,
         utf8 = TRUE;
 
       if(host.name) {
-        auth = aprintf("<%s@%s>", address, host.name);
+        auth = aprintf("<%s@%s>%s", address, host.name, suffix);
 
         Curl_free_idnconverted_hostname(&host);
       }
       else
         /* An invalid mailbox was provided but we will simply let the server
            worry about it */
-        auth = aprintf("<%s>", address);
+        auth = aprintf("<%s>%s", address, suffix);
       free(address);
     }
     else
@@ -865,22 +871,24 @@ static CURLcode smtp_perform_rcpt_to(struct Curl_easy *data,
   CURLcode result = CURLE_OK;
   char *address = NULL;
   struct hostname host = { NULL, NULL, NULL, NULL };
+  const char *suffix = "";
 
   /* Parse the recipient mailbox into the local address and hostname parts,
      converting the hostname to an IDN A-label if necessary */
   result = smtp_parse_address(smtp->rcpt->data,
-                              &address, &host);
+                              &address, &host, &suffix);
   if(result)
     return result;
 
   /* Send the RCPT TO command */
   if(host.name)
-    result = Curl_pp_sendf(data, &smtpc->pp, "RCPT TO:<%s@%s>",
-                           address, host.name);
+    result = Curl_pp_sendf(data, &smtpc->pp, "RCPT TO:<%s@%s>%s",
+                           address, host.name, suffix);
   else
     /* An invalid mailbox was provided but we will simply let the server worry
        about that and reply with a 501 error */
-    result = Curl_pp_sendf(data, &smtpc->pp, "RCPT TO:<%s>", address);
+    result = Curl_pp_sendf(data, &smtpc->pp, "RCPT TO:<%s>%s",
+                           address, suffix);
 
   Curl_free_idnconverted_hostname(&host);
   free(address);
@@ -916,7 +924,7 @@ static CURLcode smtp_state_servergreet_resp(struct Curl_easy *data,
                                             smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(smtpcode/100 != 2) {
     failf(data, "Got unexpected smtp-server response: %d", smtpcode);
@@ -935,7 +943,7 @@ static CURLcode smtp_state_starttls_resp(struct Curl_easy *data,
                                          smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   /* Pipelining in response is forbidden. */
   if(smtpc->pp.overflow)
@@ -965,7 +973,7 @@ static CURLcode smtp_state_ehlo_resp(struct Curl_easy *data,
   const char *line = curlx_dyn_ptr(&smtpc->pp.recvbuf);
   size_t len = smtpc->pp.nfinal;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(smtpcode/100 != 2 && smtpcode != 1) {
     if(data->set.use_ssl <= CURLUSESSL_TRY
@@ -1066,7 +1074,7 @@ static CURLcode smtp_state_helo_resp(struct Curl_easy *data,
                                      smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(smtpcode/100 != 2) {
     failf(data, "Remote access denied: %d", smtpcode);
@@ -1088,7 +1096,7 @@ static CURLcode smtp_state_auth_resp(struct Curl_easy *data,
   CURLcode result = CURLE_OK;
   saslprogress progress;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   result = Curl_sasl_continue(&smtpc->sasl, data, smtpcode, &progress);
   if(!result)
@@ -1118,7 +1126,7 @@ static CURLcode smtp_state_command_resp(struct Curl_easy *data,
   char *line = curlx_dyn_ptr(&smtpc->pp.recvbuf);
   size_t len = smtpc->pp.nfinal;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if((smtp->rcpt && smtpcode/100 != 2 && smtpcode != 553 && smtpcode != 1) ||
      (!smtp->rcpt && smtpcode/100 != 2 && smtpcode != 1)) {
@@ -1158,7 +1166,7 @@ static CURLcode smtp_state_mail_resp(struct Curl_easy *data,
                                      smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(smtpcode/100 != 2) {
     failf(data, "MAIL failed: %d", smtpcode);
@@ -1182,7 +1190,7 @@ static CURLcode smtp_state_rcpt_resp(struct Curl_easy *data,
   bool is_smtp_err = FALSE;
   bool is_smtp_blocking_err = FALSE;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   is_smtp_err = (smtpcode/100 != 2);
 
@@ -1238,7 +1246,7 @@ static CURLcode smtp_state_data_resp(struct Curl_easy *data,
                                      smtpstate instate)
 {
   CURLcode result = CURLE_OK;
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(smtpcode != 354) {
     failf(data, "DATA failed: %d", smtpcode);
@@ -1249,7 +1257,7 @@ static CURLcode smtp_state_data_resp(struct Curl_easy *data,
     Curl_pgrsSetUploadSize(data, data->state.infilesize);
 
     /* SMTP upload */
-    Curl_xfer_setup1(data, CURL_XFER_SEND, -1, FALSE);
+    Curl_xfer_setup_send(data, FIRSTSOCKET);
 
     /* End of DO phase */
     smtp_state(data, smtpc, SMTP_STOP);
@@ -1267,7 +1275,7 @@ static CURLcode smtp_state_postdata_resp(struct Curl_easy *data,
 {
   CURLcode result = CURLE_OK;
 
-  (void)instate; /* no use for this yet */
+  (void)instate;
 
   if(smtpcode != 250)
     result = CURLE_WEIRD_SERVER_REPLY;
@@ -1405,12 +1413,12 @@ static CURLcode smtp_block_statemach(struct Curl_easy *data,
 }
 
 /* For the SMTP "protocol connect" and "doing" phases only */
-static int smtp_getsock(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks)
+static CURLcode smtp_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
 {
-  struct smtp_conn *smtpc = Curl_conn_meta_get(conn, CURL_META_SMTP_CONN);
-  return smtpc ?
-         Curl_pp_getsock(data, &smtpc->pp, socks) : GETSOCK_BLANK;
+  struct smtp_conn *smtpc =
+    Curl_conn_meta_get(data->conn, CURL_META_SMTP_CONN);
+  return smtpc ? Curl_pp_pollset(data, &smtpc->pp, ps) : CURLE_OK;
 }
 
 /***********************************************************************
@@ -1866,10 +1874,11 @@ static CURLcode smtp_parse_custom_request(struct Curl_easy *data,
  * the address part with the hostname being NULL.
  */
 static CURLcode smtp_parse_address(const char *fqma, char **address,
-                                   struct hostname *host)
+                                   struct hostname *host, const char **suffix)
 {
   CURLcode result = CURLE_OK;
   size_t length;
+  char *addressend;
 
   /* Duplicate the fully qualified email address so we can manipulate it,
      ensuring it does not contain the delimiters if specified */
@@ -1877,10 +1886,19 @@ static CURLcode smtp_parse_address(const char *fqma, char **address,
   if(!dup)
     return CURLE_OUT_OF_MEMORY;
 
-  length = strlen(dup);
-  if(length) {
-    if(dup[length - 1] == '>')
-      dup[length - 1] = '\0';
+  if(fqma[0] != '<') {
+    length = strlen(dup);
+    if(length) {
+      if(dup[length - 1] == '>')
+        dup[length - 1] = '\0';
+    }
+  }
+  else {
+    addressend = strrchr(dup, '>');
+    if(addressend) {
+      *addressend = '\0';
+      *suffix = addressend + 1;
+    }
   }
 
   /* Extract the hostname from the address (if we can) */
@@ -1890,7 +1908,7 @@ static CURLcode smtp_parse_address(const char *fqma, char **address,
     host->name = host->name + 1;
 
     /* Attempt to convert the hostname to IDN ACE */
-    (void) Curl_idnconvert_hostname(host);
+    (void)Curl_idnconvert_hostname(host);
 
     /* If Curl_idnconvert_hostname() fails then we shall attempt to continue
        and send the hostname using UTF-8 rather than as 7-bit ACE (which is
@@ -2051,8 +2069,7 @@ static const struct Curl_crtype cr_eob = {
   Curl_creader_def_needs_rewind,
   cr_eob_total_length,
   Curl_creader_def_resume_from,
-  Curl_creader_def_rewind,
-  Curl_creader_def_unpause,
+  Curl_creader_def_cntrl,
   Curl_creader_def_is_paused,
   Curl_creader_def_done,
   sizeof(struct cr_eob_ctx)
diff --git a/deps/curl/lib/socketpair.c b/deps/curl/lib/socketpair.c
index 1d1d5a66f30..4151a9bb979 100644
--- a/deps/curl/lib/socketpair.c
+++ b/deps/curl/lib/socketpair.c
@@ -84,6 +84,7 @@ int Curl_pipe(curl_socket_t socks[2], bool nonblocking)
 
 #ifndef CURL_DISABLE_SOCKETPAIR
 #ifdef HAVE_SOCKETPAIR
+#ifdef USE_SOCKETPAIR
 int Curl_socketpair(int domain, int type, int protocol,
                     curl_socket_t socks[2], bool nonblocking)
 {
@@ -104,6 +105,7 @@ int Curl_socketpair(int domain, int type, int protocol,
 #endif
   return 0;
 }
+#endif /* USE_SOCKETPAIR */
 #else /* !HAVE_SOCKETPAIR */
 #ifdef _WIN32
 /*
@@ -199,7 +201,7 @@ int Curl_socketpair(int domain, int type, int protocol,
   pfd[0].events = POLLIN;
   pfd[0].revents = 0;
   (void)Curl_poll(pfd, 1, 1000); /* one second */
-  socks[1] = accept(listener, NULL, NULL);
+  socks[1] = CURL_ACCEPT(listener, NULL, NULL);
   if(socks[1] == CURL_SOCKET_BAD)
     goto error;
   else {
diff --git a/deps/curl/lib/socketpair.h b/deps/curl/lib/socketpair.h
index 5541899445b..e601f5f71be 100644
--- a/deps/curl/lib/socketpair.h
+++ b/deps/curl/lib/socketpair.h
@@ -66,8 +66,9 @@ int Curl_pipe(curl_socket_t socks[2], bool nonblocking);
 #define SOCKETPAIR_TYPE SOCK_STREAM
 #endif
 
-#define wakeup_create(p,nb)\
-Curl_socketpair(SOCKETPAIR_FAMILY, SOCKETPAIR_TYPE, 0, p, nb)
+#define USE_SOCKETPAIR
+#define wakeup_create(p,nb)                                     \
+  Curl_socketpair(SOCKETPAIR_FAMILY, SOCKETPAIR_TYPE, 0, p, nb)
 
 #endif /* USE_EVENTFD */
 
diff --git a/deps/curl/lib/socks.c b/deps/curl/lib/socks.c
index 7d25ef52087..fc6c9730f87 100644
--- a/deps/curl/lib/socks.c
+++ b/deps/curl/lib/socks.c
@@ -24,7 +24,7 @@
 
 #include "curl_setup.h"
 
-#if !defined(CURL_DISABLE_PROXY)
+#ifndef CURL_DISABLE_PROXY
 
 #ifdef HAVE_NETINET_IN_H
 #include <netinet/in.h>
@@ -141,13 +141,15 @@ int Curl_blockread_all(struct Curl_cfilter *cf,
 
 #if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
 #define DEBUG_AND_VERBOSE
-#define sxstate(x,d,y) socksstate(x,d,y, __LINE__)
+#define sxstate(x,c,d,y) socksstate(x,c,d,y, __LINE__)
 #else
-#define sxstate(x,d,y) socksstate(x,d,y)
+#define sxstate(x,c,d,y) socksstate(x,c,d,y)
 #endif
 
 /* always use this function to change state, to make debugging easier */
-static void socksstate(struct socks_state *sx, struct Curl_easy *data,
+static void socksstate(struct socks_state *sx,
+                       struct Curl_cfilter *cf,
+                       struct Curl_easy *data,
                        enum connect_t state
 #ifdef DEBUG_AND_VERBOSE
                        , int lineno
@@ -179,6 +181,7 @@ static void socksstate(struct socks_state *sx, struct Curl_easy *data,
   };
 #endif
 
+  (void)cf;
   (void)data;
   if(oldstate == state)
     /* do not bother when the new state is the same as the old state */
@@ -187,10 +190,8 @@ static void socksstate(struct socks_state *sx, struct Curl_easy *data,
   sx->state = state;
 
 #ifdef DEBUG_AND_VERBOSE
-  infof(data,
-        "SXSTATE: %s => %s; line %d",
-        socks_statename[oldstate], socks_statename[sx->state],
-        lineno);
+  CURL_TRC_CF(data, cf, "[%s] -> [%s] (line %d)",
+              socks_statename[oldstate], socks_statename[sx->state], lineno);
 #endif
 }
 
@@ -284,12 +285,10 @@ static CURLproxycode do_SOCKS4(struct Curl_cfilter *cf,
   case CONNECT_SOCKS_INIT:
     /* SOCKS4 can only do IPv4, insist! */
     conn->ip_version = CURL_IPRESOLVE_V4;
-    if(conn->bits.httpproxy)
-      infof(data, "SOCKS4%s: connecting to HTTP proxy %s port %d",
-            protocol4a ? "a" : "", sx->hostname, sx->remote_port);
-
-    infof(data, "SOCKS4 communication to %s:%d",
-          sx->hostname, sx->remote_port);
+    CURL_TRC_CF(data, cf, "SOCKS4%s communication to%s %s:%d",
+                protocol4a ? "a" : "",
+                conn->bits.httpproxy ? " HTTP proxy" : "",
+                sx->hostname, sx->remote_port);
 
     /*
      * Compose socks4 request
@@ -313,18 +312,19 @@ static CURLproxycode do_SOCKS4(struct Curl_cfilter *cf,
                            cf->conn->ip_version, TRUE, &dns);
 
       if(result == CURLE_AGAIN) {
-        sxstate(sx, data, CONNECT_RESOLVING);
-        infof(data, "SOCKS4 non-blocking resolve of %s", sx->hostname);
+        sxstate(sx, cf, data, CONNECT_RESOLVING);
+        CURL_TRC_CF(data, cf, "SOCKS4 non-blocking resolve of %s",
+                    sx->hostname);
         return CURLPX_OK;
       }
       else if(result)
         return CURLPX_RESOLVE_HOST;
-      sxstate(sx, data, CONNECT_RESOLVED);
+      sxstate(sx, cf, data, CONNECT_RESOLVED);
       goto CONNECT_RESOLVED;
     }
 
     /* socks4a does not resolve anything locally */
-    sxstate(sx, data, CONNECT_REQ_INIT);
+    sxstate(sx, cf, data, CONNECT_REQ_INIT);
     goto CONNECT_REQ_INIT;
 
   case CONNECT_RESOLVING:
@@ -362,8 +362,8 @@ static CURLproxycode do_SOCKS4(struct Curl_cfilter *cf,
         socksreq[6] = ((unsigned char *)&saddr_in->sin_addr.s_addr)[2];
         socksreq[7] = ((unsigned char *)&saddr_in->sin_addr.s_addr)[3];
 
-        infof(data, "SOCKS4 connect to IPv4 %s (locally resolved)", buf);
-
+        CURL_TRC_CF(data, cf, "SOCKS4 connect to IPv4 %s (locally resolved)",
+                    buf);
         Curl_resolv_unlink(data, &dns); /* not used anymore from now on */
       }
       else
@@ -424,7 +424,7 @@ static CURLproxycode do_SOCKS4(struct Curl_cfilter *cf,
       sx->outp = socksreq;
       DEBUGASSERT(packetsize <= sizeof(sx->buffer));
       sx->outstanding = packetsize;
-      sxstate(sx, data, CONNECT_REQ_SENDING);
+      sxstate(sx, cf, data, CONNECT_REQ_SENDING);
     }
     FALLTHROUGH();
   case CONNECT_REQ_SENDING:
@@ -440,7 +440,7 @@ static CURLproxycode do_SOCKS4(struct Curl_cfilter *cf,
     /* done sending! */
     sx->outstanding = 8; /* receive data size */
     sx->outp = socksreq;
-    sxstate(sx, data, CONNECT_SOCKS_READ);
+    sxstate(sx, cf, data, CONNECT_SOCKS_READ);
 
     FALLTHROUGH();
   case CONNECT_SOCKS_READ:
@@ -453,7 +453,7 @@ static CURLproxycode do_SOCKS4(struct Curl_cfilter *cf,
       /* remain in reading state */
       return CURLPX_OK;
     }
-    sxstate(sx, data, CONNECT_DONE);
+    sxstate(sx, cf, data, CONNECT_DONE);
     break;
   default: /* lots of unused states in SOCKS4 */
     break;
@@ -488,11 +488,11 @@ static CURLproxycode do_SOCKS4(struct Curl_cfilter *cf,
   /* Result */
   switch(socksreq[1]) {
   case 90:
-    infof(data, "SOCKS4%s request granted.", protocol4a ? "a" : "");
+    CURL_TRC_CF(data, cf, "SOCKS4%s request granted.", protocol4a ? "a" : "");
     break;
   case 91:
     failf(data,
-          "cannot complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d)"
+          "[SOCKS] cannot complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d)"
           ", request rejected or failed.",
           socksreq[4], socksreq[5], socksreq[6], socksreq[7],
           (((unsigned char)socksreq[2] << 8) | (unsigned char)socksreq[3]),
@@ -500,7 +500,7 @@ static CURLproxycode do_SOCKS4(struct Curl_cfilter *cf,
     return CURLPX_REQUEST_FAILED;
   case 92:
     failf(data,
-          "cannot complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d)"
+          "[SOCKS] cannot complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d)"
           ", request rejected because SOCKS server cannot connect to "
           "identd on the client.",
           socksreq[4], socksreq[5], socksreq[6], socksreq[7],
@@ -509,7 +509,7 @@ static CURLproxycode do_SOCKS4(struct Curl_cfilter *cf,
     return CURLPX_IDENTD;
   case 93:
     failf(data,
-          "cannot complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d)"
+          "[SOCKS] cannot complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d)"
           ", request rejected because the client program and identd "
           "report different user-ids.",
           socksreq[4], socksreq[5], socksreq[6], socksreq[7],
@@ -518,7 +518,7 @@ static CURLproxycode do_SOCKS4(struct Curl_cfilter *cf,
     return CURLPX_IDENTD_DIFFER;
   default:
     failf(data,
-          "cannot complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d)"
+          "[SOCKS] cannot complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d)"
           ", Unknown.",
           socksreq[4], socksreq[5], socksreq[6], socksreq[7],
           (((unsigned char)socksreq[2] << 8) | (unsigned char)socksreq[3]),
@@ -529,6 +529,110 @@ static CURLproxycode do_SOCKS4(struct Curl_cfilter *cf,
   return CURLPX_OK; /* Proxy was successful! */
 }
 
+static CURLproxycode socks5_init(struct Curl_cfilter *cf,
+                                 struct socks_state *sx,
+                                 struct Curl_easy *data,
+                                 const bool socks5_resolve_local,
+                                 const size_t hostname_len)
+{
+  struct connectdata *conn = cf->conn;
+  const unsigned char auth = data->set.socks5auth;
+  unsigned char *socksreq = sx->buffer;
+
+  if(conn->bits.httpproxy)
+    CURL_TRC_CF(data, cf, "SOCKS5: connecting to HTTP proxy %s port %d",
+                sx->hostname, sx->remote_port);
+
+  /* RFC1928 chapter 5 specifies max 255 chars for domain name in packet */
+  if(!socks5_resolve_local && hostname_len > 255) {
+    failf(data, "SOCKS5: the destination hostname is too long to be "
+          "resolved remotely by the proxy.");
+    return CURLPX_LONG_HOSTNAME;
+  }
+
+  if(auth & ~(CURLAUTH_BASIC | CURLAUTH_GSSAPI))
+    infof(data, "warning: unsupported value passed to "
+          "CURLOPT_SOCKS5_AUTH: %u", auth);
+  if(!(auth & CURLAUTH_BASIC))
+    /* disable username/password auth */
+    sx->proxy_user = NULL;
+
+  if(!sx->outstanding) {
+    size_t idx = 0;
+    socksreq[idx++] = 5;   /* version */
+    idx++;                 /* number of authentication methods */
+    socksreq[idx++] = 0;   /* no authentication */
+#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
+    if(auth & CURLAUTH_GSSAPI)
+      socksreq[idx++] = 1; /* GSS-API */
+#endif
+    if(sx->proxy_user)
+      socksreq[idx++] = 2; /* username/password */
+    /* write the number of authentication methods */
+    socksreq[1] = (unsigned char) (idx - 2);
+
+    sx->outp = socksreq;
+    DEBUGASSERT(idx <= sizeof(sx->buffer));
+    sx->outstanding = idx;
+  }
+
+  return socks_state_send(cf, sx, data, CURLPX_SEND_CONNECT,
+                          "initial SOCKS5 request");
+}
+
+static CURLproxycode socks5_auth_init(struct Curl_cfilter *cf,
+                                      struct socks_state *sx,
+                                      struct Curl_easy *data)
+{
+  /* Needs username and password */
+  size_t proxy_user_len, proxy_password_len;
+  size_t len = 0;
+  unsigned char *socksreq = sx->buffer;
+
+  if(sx->proxy_user && sx->proxy_password) {
+    proxy_user_len = strlen(sx->proxy_user);
+    proxy_password_len = strlen(sx->proxy_password);
+  }
+  else {
+    proxy_user_len = 0;
+    proxy_password_len = 0;
+  }
+
+  /*   username/password request looks like
+   * +----+------+----------+------+----------+
+   * |VER | ULEN |  UNAME   | PLEN |  PASSWD  |
+   * +----+------+----------+------+----------+
+   * | 1  |  1   | 1 to 255 |  1   | 1 to 255 |
+   * +----+------+----------+------+----------+
+   */
+  socksreq[len++] = 1;    /* username/pw subnegotiation version */
+  socksreq[len++] = (unsigned char) proxy_user_len;
+  if(sx->proxy_user && proxy_user_len) {
+    /* the length must fit in a single byte */
+    if(proxy_user_len > 255) {
+      failf(data, "Excessive username length for proxy auth");
+      return CURLPX_LONG_USER;
+    }
+    memcpy(socksreq + len, sx->proxy_user, proxy_user_len);
+  }
+  len += proxy_user_len;
+  socksreq[len++] = (unsigned char) proxy_password_len;
+  if(sx->proxy_password && proxy_password_len) {
+    /* the length must fit in a single byte */
+    if(proxy_password_len > 255) {
+      failf(data, "Excessive password length for proxy auth");
+      return CURLPX_LONG_PASSWD;
+    }
+    memcpy(socksreq + len, sx->proxy_password, proxy_password_len);
+  }
+  len += proxy_password_len;
+  sxstate(sx, cf, data, CONNECT_AUTH_SEND);
+  DEBUGASSERT(len <= sizeof(sx->buffer));
+  sx->outstanding = len;
+  sx->outp = socksreq;
+  return CURLPX_OK;
+}
+
 /*
  * This function logs in to a SOCKS5 proxy and sends the specifics to the final
  * destination server.
@@ -555,65 +659,21 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
   */
   struct connectdata *conn = cf->conn;
   unsigned char *socksreq = sx->buffer;
-  size_t idx;
   CURLcode result;
   CURLproxycode presult;
   bool socks5_resolve_local =
     (conn->socks_proxy.proxytype == CURLPROXY_SOCKS5);
   const size_t hostname_len = strlen(sx->hostname);
   size_t len = 0;
-  const unsigned char auth = data->set.socks5auth;
   bool allow_gssapi = FALSE;
   struct Curl_dns_entry *dns = NULL;
 
   switch(sx->state) {
   case CONNECT_SOCKS_INIT:
-    if(conn->bits.httpproxy)
-      infof(data, "SOCKS5: connecting to HTTP proxy %s port %d",
-            sx->hostname, sx->remote_port);
-
-    /* RFC1928 chapter 5 specifies max 255 chars for domain name in packet */
-    if(!socks5_resolve_local && hostname_len > 255) {
-      failf(data, "SOCKS5: the destination hostname is too long to be "
-            "resolved remotely by the proxy.");
-      return CURLPX_LONG_HOSTNAME;
-    }
-
-    if(auth & ~(CURLAUTH_BASIC | CURLAUTH_GSSAPI))
-      infof(data,
-            "warning: unsupported value passed to CURLOPT_SOCKS5_AUTH: %u",
-            auth);
-    if(!(auth & CURLAUTH_BASIC))
-      /* disable username/password auth */
-      sx->proxy_user = NULL;
-#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
-    if(auth & CURLAUTH_GSSAPI)
-      allow_gssapi = TRUE;
-#endif
-
-    idx = 0;
-    socksreq[idx++] = 5;   /* version */
-    idx++;                 /* number of authentication methods */
-    socksreq[idx++] = 0;   /* no authentication */
-    if(allow_gssapi)
-      socksreq[idx++] = 1; /* GSS-API */
-    if(sx->proxy_user)
-      socksreq[idx++] = 2; /* username/password */
-    /* write the number of authentication methods */
-    socksreq[1] = (unsigned char) (idx - 2);
-
-    sx->outp = socksreq;
-    DEBUGASSERT(idx <= sizeof(sx->buffer));
-    sx->outstanding = idx;
-    presult = socks_state_send(cf, sx, data, CURLPX_SEND_CONNECT,
-                               "initial SOCKS5 request");
-    if(CURLPX_OK != presult)
+    presult = socks5_init(cf, sx, data, socks5_resolve_local, hostname_len);
+    if(presult || sx->outstanding)
       return presult;
-    else if(sx->outstanding) {
-      /* remain in sending state */
-      return CURLPX_OK;
-    }
-    sxstate(sx, data, CONNECT_SOCKS_READ);
+    sxstate(sx, cf, data, CONNECT_SOCKS_READ);
     goto CONNECT_SOCKS_READ_INIT;
   case CONNECT_SOCKS_SEND:
     presult = socks_state_send(cf, sx, data, CURLPX_SEND_CONNECT,
@@ -633,6 +693,10 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
   case CONNECT_SOCKS_READ:
     presult = socks_state_recv(cf, sx, data, CURLPX_RECV_CONNECT,
                                "initial SOCKS5 response");
+#if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
+    if(data->set.socks5auth & CURLAUTH_GSSAPI)
+      allow_gssapi = TRUE;
+#endif
     if(CURLPX_OK != presult)
       return presult;
     else if(sx->outstanding) {
@@ -645,17 +709,17 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
     }
     else if(socksreq[1] == 0) {
       /* DONE! No authentication needed. Send request. */
-      sxstate(sx, data, CONNECT_REQ_INIT);
+      sxstate(sx, cf, data, CONNECT_REQ_INIT);
       goto CONNECT_REQ_INIT;
     }
     else if(socksreq[1] == 2) {
       /* regular name + password authentication */
-      sxstate(sx, data, CONNECT_AUTH_INIT);
+      sxstate(sx, cf, data, CONNECT_AUTH_INIT);
       goto CONNECT_AUTH_INIT;
     }
 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
     else if(allow_gssapi && (socksreq[1] == 1)) {
-      sxstate(sx, data, CONNECT_GSSAPI_INIT);
+      sxstate(sx, cf, data, CONNECT_GSSAPI_INIT);
       result = Curl_SOCKS5_gssapi_negotiate(cf, data);
       if(result) {
         failf(data, "Unable to negotiate SOCKS5 GSS-API context.");
@@ -688,52 +752,10 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
     break;
 
 CONNECT_AUTH_INIT:
-  case CONNECT_AUTH_INIT: {
-    /* Needs username and password */
-    size_t proxy_user_len, proxy_password_len;
-    if(sx->proxy_user && sx->proxy_password) {
-      proxy_user_len = strlen(sx->proxy_user);
-      proxy_password_len = strlen(sx->proxy_password);
-    }
-    else {
-      proxy_user_len = 0;
-      proxy_password_len = 0;
-    }
-
-    /*   username/password request looks like
-     * +----+------+----------+------+----------+
-     * |VER | ULEN |  UNAME   | PLEN |  PASSWD  |
-     * +----+------+----------+------+----------+
-     * | 1  |  1   | 1 to 255 |  1   | 1 to 255 |
-     * +----+------+----------+------+----------+
-     */
-    len = 0;
-    socksreq[len++] = 1;    /* username/pw subnegotiation version */
-    socksreq[len++] = (unsigned char) proxy_user_len;
-    if(sx->proxy_user && proxy_user_len) {
-      /* the length must fit in a single byte */
-      if(proxy_user_len > 255) {
-        failf(data, "Excessive username length for proxy auth");
-        return CURLPX_LONG_USER;
-      }
-      memcpy(socksreq + len, sx->proxy_user, proxy_user_len);
-    }
-    len += proxy_user_len;
-    socksreq[len++] = (unsigned char) proxy_password_len;
-    if(sx->proxy_password && proxy_password_len) {
-      /* the length must fit in a single byte */
-      if(proxy_password_len > 255) {
-        failf(data, "Excessive password length for proxy auth");
-        return CURLPX_LONG_PASSWD;
-      }
-      memcpy(socksreq + len, sx->proxy_password, proxy_password_len);
-    }
-    len += proxy_password_len;
-    sxstate(sx, data, CONNECT_AUTH_SEND);
-    DEBUGASSERT(len <= sizeof(sx->buffer));
-    sx->outstanding = len;
-    sx->outp = socksreq;
-  }
+  case CONNECT_AUTH_INIT:
+    presult = socks5_auth_init(cf, sx, data);
+    if(presult)
+      return presult;
     FALLTHROUGH();
   case CONNECT_AUTH_SEND:
     presult = socks_state_send(cf, sx, data, CURLPX_SEND_AUTH,
@@ -746,7 +768,7 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
     }
     sx->outp = socksreq;
     sx->outstanding = 2;
-    sxstate(sx, data, CONNECT_AUTH_READ);
+    sxstate(sx, cf, data, CONNECT_AUTH_READ);
     FALLTHROUGH();
   case CONNECT_AUTH_READ:
     presult = socks_state_recv(cf, sx, data, CURLPX_RECV_AUTH,
@@ -765,7 +787,7 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
     }
 
     /* Everything is good so far, user was authenticated! */
-    sxstate(sx, data, CONNECT_REQ_INIT);
+    sxstate(sx, cf, data, CONNECT_REQ_INIT);
     FALLTHROUGH();
   case CONNECT_REQ_INIT:
 CONNECT_REQ_INIT:
@@ -774,12 +796,12 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
                            cf->conn->ip_version, TRUE, &dns);
 
       if(result == CURLE_AGAIN) {
-        sxstate(sx, data, CONNECT_RESOLVING);
+        sxstate(sx, cf, data, CONNECT_RESOLVING);
         return CURLPX_OK;
       }
       else if(result)
         return CURLPX_RESOLVE_HOST;
-      sxstate(sx, data, CONNECT_RESOLVED);
+      sxstate(sx, cf, data, CONNECT_RESOLVED);
       goto CONNECT_RESOLVED;
     }
     goto CONNECT_RESOLVE_REMOTE;
@@ -831,8 +853,8 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
         socksreq[len++] = ((unsigned char *)&saddr_in->sin_addr.s_addr)[i];
       }
 
-      infof(data, "SOCKS5 connect to %s:%d (locally resolved)", dest,
-            sx->remote_port);
+      CURL_TRC_CF(data, cf, "SOCKS5 connect to %s:%d (locally resolved)",
+                  dest, sx->remote_port);
     }
 #ifdef USE_IPV6
     else if(hp->ai_family == AF_INET6) {
@@ -846,8 +868,8 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
           ((unsigned char *)&saddr_in6->sin6_addr.s6_addr)[i];
       }
 
-      infof(data, "SOCKS5 connect to [%s]:%d (locally resolved)", dest,
-            sx->remote_port);
+      CURL_TRC_CF(data, cf, "SOCKS5 connect to [%s]:%d (locally resolved)",
+                  dest, sx->remote_port);
     }
 #endif
     else {
@@ -874,7 +896,7 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
 #ifdef USE_IPV6
       if(conn->bits.ipv6_ip) {
         char ip6[16];
-        if(1 != curlx_inet_pton(AF_INET6, sx->hostname, ip6))
+        if(curlx_inet_pton(AF_INET6, sx->hostname, ip6) != 1)
           return CURLPX_BAD_ADDRESS_TYPE;
         socksreq[len++] = 4;
         memcpy(&socksreq[len], ip6, sizeof(ip6));
@@ -882,7 +904,7 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
       }
       else
 #endif
-      if(1 == curlx_inet_pton(AF_INET, sx->hostname, ip4)) {
+      if(curlx_inet_pton(AF_INET, sx->hostname, ip4) == 1) {
         socksreq[len++] = 1;
         memcpy(&socksreq[len], ip4, sizeof(ip4));
         len += sizeof(ip4);
@@ -893,8 +915,8 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
         memcpy(&socksreq[len], sx->hostname, hostname_len); /* w/o NULL */
         len += hostname_len;
       }
-      infof(data, "SOCKS5 connect to %s:%d (remotely resolved)",
-            sx->hostname, sx->remote_port);
+      CURL_TRC_CF(data, cf, "SOCKS5 connect to %s:%d (remotely resolved)",
+                  sx->hostname, sx->remote_port);
     }
     FALLTHROUGH();
 
@@ -914,7 +936,7 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
     sx->outp = socksreq;
     DEBUGASSERT(len <= sizeof(sx->buffer));
     sx->outstanding = len;
-    sxstate(sx, data, CONNECT_REQ_SENDING);
+    sxstate(sx, cf, data, CONNECT_REQ_SENDING);
     FALLTHROUGH();
   case CONNECT_REQ_SENDING:
     presult = socks_state_send(cf, sx, data, CURLPX_SEND_REQUEST,
@@ -933,7 +955,7 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
 #endif
     sx->outstanding = 10; /* minimum packet size is 10 */
     sx->outp = socksreq;
-    sxstate(sx, data, CONNECT_REQ_READ);
+    sxstate(sx, cf, data, CONNECT_REQ_READ);
     FALLTHROUGH();
   case CONNECT_REQ_READ:
     presult = socks_state_recv(cf, sx, data, CURLPX_RECV_REQACK,
@@ -984,7 +1006,7 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
 
        ATYP:
        o  IP v4 address: X'01', BND.ADDR = 4 byte
-       o  domain name:  X'03', BND.ADDR = [ 1 byte length, string ]
+       o  domain name:   X'03', BND.ADDR = [ 1 byte length, string ]
        o  IP v6 address: X'04', BND.ADDR = 16 byte
     */
 
@@ -1015,10 +1037,10 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
         DEBUGASSERT(len <= sizeof(sx->buffer));
         sx->outstanding = len - 10; /* get the rest */
         sx->outp = &socksreq[10];
-        sxstate(sx, data, CONNECT_REQ_READ_MORE);
+        sxstate(sx, cf, data, CONNECT_REQ_READ_MORE);
       }
       else {
-        sxstate(sx, data, CONNECT_DONE);
+        sxstate(sx, cf, data, CONNECT_DONE);
         break;
       }
 #if defined(HAVE_GSSAPI) || defined(USE_WINDOWS_SSPI)
@@ -1034,9 +1056,9 @@ static CURLproxycode do_SOCKS5(struct Curl_cfilter *cf,
       /* remain in reading state */
       return CURLPX_OK;
     }
-    sxstate(sx, data, CONNECT_DONE);
+    sxstate(sx, cf, data, CONNECT_DONE);
   }
-  infof(data, "SOCKS5 request granted.");
+  CURL_TRC_CF(data, cf, "SOCKS5 request granted.");
 
   return CURLPX_OK; /* Proxy was successful! */
 }
@@ -1117,7 +1139,7 @@ static CURLcode socks_proxy_cf_connect(struct Curl_cfilter *cf,
     /* for the secondary socket (FTP), use the "connect to host"
      * but ignore the "connect to port" (use the secondary port)
      */
-    sxstate(sx, data, CONNECT_SOCKS_INIT);
+    sxstate(sx, cf, data, CONNECT_SOCKS_INIT);
     sx->hostname =
       conn->bits.httpproxy ?
       conn->http_proxy.host.name :
@@ -1137,7 +1159,21 @@ static CURLcode socks_proxy_cf_connect(struct Curl_cfilter *cf,
   result = connect_SOCKS(cf, sx, data);
   if(!result && sx->state == CONNECT_DONE) {
     cf->connected = TRUE;
-    Curl_verboseconnect(data, conn, cf->sockindex);
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+    if(Curl_trc_is_verbose(data)) {
+      struct ip_quadruple ipquad;
+      bool is_ipv6;
+      result = Curl_conn_cf_get_ip_info(cf->next, data, &is_ipv6, &ipquad);
+      if(result)
+        return result;
+      infof(data, "Opened %sSOCKS connection from %s port %u to %s port %u "
+            "(via %s port %u)",
+            (sockindex == SECONDARYSOCKET) ? "2nd " : "",
+            ipquad.local_ip, ipquad.local_port,
+            sx->hostname, sx->remote_port,
+            ipquad.remote_ip, ipquad.remote_port);
+    }
+#endif
     socks_proxy_cf_free(cf);
   }
 
@@ -1145,11 +1181,12 @@ static CURLcode socks_proxy_cf_connect(struct Curl_cfilter *cf,
   return result;
 }
 
-static void socks_cf_adjust_pollset(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data,
-                                    struct easy_pollset *ps)
+static CURLcode socks_cf_adjust_pollset(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        struct easy_pollset *ps)
 {
   struct socks_state *sx = cf->ctx;
+  CURLcode result = CURLE_OK;
 
   if(!cf->connected && sx) {
     /* If we are not connected, the filter below is and has nothing
@@ -1161,13 +1198,14 @@ static void socks_cf_adjust_pollset(struct Curl_cfilter *cf,
     case CONNECT_AUTH_READ:
     case CONNECT_REQ_READ:
     case CONNECT_REQ_READ_MORE:
-      Curl_pollset_set_in_only(data, ps, sock);
+      result = Curl_pollset_set_in_only(data, ps, sock);
       break;
     default:
-      Curl_pollset_set_out_only(data, ps, sock);
+      result = Curl_pollset_set_out_only(data, ps, sock);
       break;
     }
   }
+  return result;
 }
 
 static void socks_proxy_cf_close(struct Curl_cfilter *cf,
@@ -1193,15 +1231,22 @@ static CURLcode socks_cf_query(struct Curl_cfilter *cf,
 {
   struct socks_state *sx = cf->ctx;
 
-  if(sx) {
-    switch(query) {
-    case CF_QUERY_HOST_PORT:
+  switch(query) {
+  case CF_QUERY_HOST_PORT:
+    if(sx) {
       *pres1 = sx->remote_port;
       *((const char **)pres2) = sx->hostname;
       return CURLE_OK;
-    default:
-      break;
     }
+    break;
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = NULL;
+    return CURLE_OK;
+  }
+  default:
+    break;
   }
   return cf->next ?
     cf->next->cft->query(cf->next, data, query, pres1, pres2) :
@@ -1209,7 +1254,7 @@ static CURLcode socks_cf_query(struct Curl_cfilter *cf,
 }
 
 struct Curl_cftype Curl_cft_socks_proxy = {
-  "SOCKS-PROXYY",
+  "SOCKS",
   CF_TYPE_IP_CONNECT|CF_TYPE_PROXY,
   0,
   socks_proxy_cf_destroy,
diff --git a/deps/curl/lib/socks_gssapi.c b/deps/curl/lib/socks_gssapi.c
index f23a1ae6edf..0a7ddd5ff1d 100644
--- a/deps/curl/lib/socks_gssapi.c
+++ b/deps/curl/lib/socks_gssapi.c
@@ -212,7 +212,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
 
       code = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 4,
                                FALSE, &nwritten);
-      if(code || (4 != nwritten)) {
+      if(code || (nwritten != 4)) {
         failf(data, "Failed to send GSS-API authentication request.");
         gss_release_name(&gss_status, &server);
         gss_release_buffer(&gss_status, &gss_recv_token);
@@ -420,7 +420,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
 
   code = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 4, FALSE,
                            &nwritten);
-  if(code || (4 != nwritten)) {
+  if(code || (nwritten != 4)) {
     failf(data, "Failed to send GSS-API encryption request.");
     gss_release_buffer(&gss_status, &gss_w_token);
     Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
@@ -431,7 +431,7 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     memcpy(socksreq, &gss_enc, 1);
     code = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 1, FALSE,
                              &nwritten);
-    if(code || (1 != nwritten)) {
+    if(code || (nwritten != 1)) {
       failf(data, "Failed to send GSS-API encryption type.");
       Curl_gss_delete_sec_context(&gss_status, &gss_context, NULL);
       return CURLE_COULDNT_CONNECT;
diff --git a/deps/curl/lib/socks_sspi.c b/deps/curl/lib/socks_sspi.c
index 82147562b76..49210585b0f 100644
--- a/deps/curl/lib/socks_sspi.c
+++ b/deps/curl/lib/socks_sspi.c
@@ -90,7 +90,6 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
   unsigned char socksreq[4]; /* room for GSS-API exchange header only */
   const char *service = data->set.str[STRING_PROXY_SERVICE_NAME] ?
     data->set.str[STRING_PROXY_SERVICE_NAME]  : "rcmd";
-  const size_t service_length = strlen(service);
 
   /*   GSS-API request looks like
    * +----+------+-----+----------------+
@@ -101,20 +100,12 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
    */
 
   /* prepare service name */
-  if(strchr(service, '/')) {
+  if(strchr(service, '/'))
     service_name = strdup(service);
-    if(!service_name)
-      return CURLE_OUT_OF_MEMORY;
-  }
-  else {
-    service_name = malloc(service_length +
-                          strlen(conn->socks_proxy.host.name) + 2);
-    if(!service_name)
-      return CURLE_OUT_OF_MEMORY;
-    msnprintf(service_name, service_length +
-              strlen(conn->socks_proxy.host.name) + 2, "%s/%s",
-              service, conn->socks_proxy.host.name);
-  }
+  else
+    service_name = aprintf("%s/%s", service, conn->socks_proxy.host.name);
+  if(!service_name)
+    return CURLE_OUT_OF_MEMORY;
 
   input_desc.cBuffers = 1;
   input_desc.pBuffers = &sspi_recv_token;
@@ -132,6 +123,10 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
   sspi_send_token.cbBuffer = 0;
   sspi_send_token.pvBuffer = NULL;
 
+  sspi_w_token[0].pvBuffer =
+    sspi_w_token[1].pvBuffer =
+    sspi_w_token[2].pvBuffer = NULL;
+
   wrap_desc.cBuffers = 3;
   wrap_desc.pBuffers = sspi_w_token;
   wrap_desc.ulVersion = SECBUFFER_VERSION;
@@ -139,21 +134,19 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
   cred_handle.dwLower = 0;
   cred_handle.dwUpper = 0;
 
-  status = Curl_pSecFn->AcquireCredentialsHandle(NULL,
+  names.sUserName = NULL;
+
+  status =
+    Curl_pSecFn->AcquireCredentialsHandle(NULL,
                                        (TCHAR *)CURL_UNCONST(TEXT("Kerberos")),
-                                       SECPKG_CRED_OUTBOUND,
-                                       NULL,
-                                       NULL,
-                                       NULL,
-                                       NULL,
-                                       &cred_handle,
-                                       &expiry);
+                                          SECPKG_CRED_OUTBOUND,
+                                          NULL, NULL, NULL, NULL,
+                                          &cred_handle, &expiry);
 
   if(check_sspi_err(data, status, "AcquireCredentialsHandle")) {
     failf(data, "Failed to acquire credentials.");
-    free(service_name);
-    Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
-    return CURLE_COULDNT_CONNECT;
+    result = CURLE_COULDNT_CONNECT;
+    goto error;
   }
 
   (void)curlx_nonblock(sock, FALSE);
@@ -164,24 +157,24 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     TCHAR *sname;
 
     sname = curlx_convert_UTF8_to_tchar(service_name);
-    if(!sname)
-      return CURLE_OUT_OF_MEMORY;
-
-    status = Curl_pSecFn->InitializeSecurityContext(&cred_handle,
-                                                 context_handle,
-                                                 sname,
-                                                 ISC_REQ_MUTUAL_AUTH |
-                                                 ISC_REQ_ALLOCATE_MEMORY |
-                                                 ISC_REQ_CONFIDENTIALITY |
-                                                 ISC_REQ_REPLAY_DETECT,
-                                                 0,
-                                                 SECURITY_NATIVE_DREP,
-                                                 &input_desc,
-                                                 0,
-                                                 &sspi_context,
-                                                 &output_desc,
-                                                 &sspi_ret_flags,
-                                                 &expiry);
+    if(!sname) {
+      result = CURLE_OUT_OF_MEMORY;
+      goto error;
+    }
+
+    status =
+      Curl_pSecFn->InitializeSecurityContext(&cred_handle, context_handle,
+                                             sname,
+                                             ISC_REQ_MUTUAL_AUTH |
+                                             ISC_REQ_ALLOCATE_MEMORY |
+                                             ISC_REQ_CONFIDENTIALITY |
+                                             ISC_REQ_REPLAY_DETECT,
+                                             0, SECURITY_NATIVE_DREP,
+                                             &input_desc, 0,
+                                             &sspi_context,
+                                             &output_desc,
+                                             &sspi_ret_flags,
+                                             &expiry);
 
     curlx_unicodefree(sname);
 
@@ -192,13 +185,9 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     }
 
     if(check_sspi_err(data, status, "InitializeSecurityContext")) {
-      free(service_name);
-      Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      if(sspi_recv_token.pvBuffer)
-        Curl_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
       failf(data, "Failed to initialise security context.");
-      return CURLE_COULDNT_CONNECT;
+      result = CURLE_COULDNT_CONNECT;
+      goto error;
     }
 
     if(sspi_send_token.cbBuffer) {
@@ -209,16 +198,10 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
 
       code = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 4, FALSE,
                                &written);
-      if(code || (4 != written)) {
+      if(code || (written != 4)) {
         failf(data, "Failed to send SSPI authentication request.");
-        free(service_name);
-        if(sspi_send_token.pvBuffer)
-          Curl_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
-        if(sspi_recv_token.pvBuffer)
-          Curl_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
-        Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
-        Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-        return CURLE_COULDNT_CONNECT;
+        result = CURLE_COULDNT_CONNECT;
+        goto error;
       }
 
       code = Curl_conn_cf_send(cf->next, data,
@@ -226,16 +209,9 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
                                sspi_send_token.cbBuffer, FALSE, &written);
       if(code || (sspi_send_token.cbBuffer != written)) {
         failf(data, "Failed to send SSPI authentication token.");
-        free(service_name);
-        if(sspi_send_token.pvBuffer)
-          Curl_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
-        if(sspi_recv_token.pvBuffer)
-          Curl_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
-        Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
-        Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-        return CURLE_COULDNT_CONNECT;
+        result = CURLE_COULDNT_CONNECT;
+        goto error;
       }
-
     }
 
     if(sspi_send_token.pvBuffer) {
@@ -266,29 +242,23 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
     if(result || (actualread != 4)) {
       failf(data, "Failed to receive SSPI authentication response.");
-      free(service_name);
-      Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_COULDNT_CONNECT;
+      result = CURLE_COULDNT_CONNECT;
+      goto error;
     }
 
     /* ignore the first (VER) byte */
     if(socksreq[1] == 255) { /* status / message type */
       failf(data, "User was rejected by the SOCKS5 server (%u %u).",
             (unsigned int)socksreq[0], (unsigned int)socksreq[1]);
-      free(service_name);
-      Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_COULDNT_CONNECT;
+      result = CURLE_COULDNT_CONNECT;
+      goto error;
     }
 
     if(socksreq[1] != 1) { /* status / message type */
       failf(data, "Invalid SSPI authentication response type (%u %u).",
             (unsigned int)socksreq[0], (unsigned int)socksreq[1]);
-      free(service_name);
-      Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_COULDNT_CONNECT;
+      result = CURLE_COULDNT_CONNECT;
+      goto error;
     }
 
     memcpy(&us_length, socksreq + 2, sizeof(short));
@@ -298,39 +268,32 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     sspi_recv_token.pvBuffer = malloc(us_length);
 
     if(!sspi_recv_token.pvBuffer) {
-      free(service_name);
-      Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_OUT_OF_MEMORY;
+      result = CURLE_OUT_OF_MEMORY;
+      goto error;
     }
     result = Curl_blockread_all(cf, data, (char *)sspi_recv_token.pvBuffer,
                                 sspi_recv_token.cbBuffer, &actualread);
 
     if(result || (actualread != us_length)) {
       failf(data, "Failed to receive SSPI authentication token.");
-      free(service_name);
-      if(sspi_recv_token.pvBuffer)
-        Curl_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
-      Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_COULDNT_CONNECT;
+      result = CURLE_COULDNT_CONNECT;
+      goto error;
     }
 
     context_handle = &sspi_context;
   }
 
-  free(service_name);
+  Curl_safefree(service_name);
 
   /* Everything is good so far, user was authenticated! */
   status = Curl_pSecFn->QueryCredentialsAttributes(&cred_handle,
-                                                SECPKG_CRED_ATTR_NAMES,
-                                                &names);
+                                                   SECPKG_CRED_ATTR_NAMES,
+                                                   &names);
   Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
   if(check_sspi_err(data, status, "QueryCredentialAttributes")) {
-    Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-    Curl_pSecFn->FreeContextBuffer(names.sUserName);
     failf(data, "Failed to determine username.");
-    return CURLE_COULDNT_CONNECT;
+    result = CURLE_COULDNT_CONNECT;
+    goto error;
   }
   else {
 #ifndef CURL_DISABLE_VERBOSE_STRINGS
@@ -396,12 +359,12 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
   }
   else {
     status = Curl_pSecFn->QueryContextAttributes(&sspi_context,
-                                              SECPKG_ATTR_SIZES,
-                                              &sspi_sizes);
+                                                 SECPKG_ATTR_SIZES,
+                                                 &sspi_sizes);
     if(check_sspi_err(data, status, "QueryContextAttributes")) {
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
       failf(data, "Failed to query security context attributes.");
-      return CURLE_COULDNT_CONNECT;
+      result = CURLE_COULDNT_CONNECT;
+      goto error;
     }
 
     sspi_w_token[0].cbBuffer = sspi_sizes.cbSecurityTrailer;
@@ -409,16 +372,15 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     sspi_w_token[0].pvBuffer = malloc(sspi_sizes.cbSecurityTrailer);
 
     if(!sspi_w_token[0].pvBuffer) {
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_OUT_OF_MEMORY;
+      result = CURLE_OUT_OF_MEMORY;
+      goto error;
     }
 
     sspi_w_token[1].cbBuffer = 1;
     sspi_w_token[1].pvBuffer = malloc(1);
     if(!sspi_w_token[1].pvBuffer) {
-      Curl_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_OUT_OF_MEMORY;
+      result = CURLE_OUT_OF_MEMORY;
+      goto error;
     }
 
     memcpy(sspi_w_token[1].pvBuffer, &gss_enc, 1);
@@ -426,42 +388,33 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     sspi_w_token[2].cbBuffer = sspi_sizes.cbBlockSize;
     sspi_w_token[2].pvBuffer = malloc(sspi_sizes.cbBlockSize);
     if(!sspi_w_token[2].pvBuffer) {
-      Curl_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      Curl_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_OUT_OF_MEMORY;
+      result = CURLE_OUT_OF_MEMORY;
+      goto error;
     }
     status = Curl_pSecFn->EncryptMessage(&sspi_context,
-                                      KERB_WRAP_NO_ENCRYPT,
-                                      &wrap_desc,
-                                      0);
+                                         KERB_WRAP_NO_ENCRYPT,
+                                         &wrap_desc, 0);
     if(check_sspi_err(data, status, "EncryptMessage")) {
-      Curl_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      Curl_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
-      Curl_pSecFn->FreeContextBuffer(sspi_w_token[2].pvBuffer);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
       failf(data, "Failed to query security context attributes.");
-      return CURLE_COULDNT_CONNECT;
+      result = CURLE_COULDNT_CONNECT;
+      goto error;
     }
-    sspi_send_token.cbBuffer = sspi_w_token[0].cbBuffer
-      + sspi_w_token[1].cbBuffer
-      + sspi_w_token[2].cbBuffer;
+    sspi_send_token.cbBuffer = sspi_w_token[0].cbBuffer +
+      sspi_w_token[1].cbBuffer +
+      sspi_w_token[2].cbBuffer;
     sspi_send_token.pvBuffer = malloc(sspi_send_token.cbBuffer);
     if(!sspi_send_token.pvBuffer) {
-      Curl_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      Curl_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
-      Curl_pSecFn->FreeContextBuffer(sspi_w_token[2].pvBuffer);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_OUT_OF_MEMORY;
+      result = CURLE_OUT_OF_MEMORY;
+      goto error;
     }
 
     memcpy(sspi_send_token.pvBuffer, sspi_w_token[0].pvBuffer,
            sspi_w_token[0].cbBuffer);
     memcpy((PUCHAR) sspi_send_token.pvBuffer +(int)sspi_w_token[0].cbBuffer,
            sspi_w_token[1].pvBuffer, sspi_w_token[1].cbBuffer);
-    memcpy((PUCHAR) sspi_send_token.pvBuffer
-           + sspi_w_token[0].cbBuffer
-           + sspi_w_token[1].cbBuffer,
+    memcpy((PUCHAR) sspi_send_token.pvBuffer +
+           sspi_w_token[0].cbBuffer +
+           sspi_w_token[1].cbBuffer,
            sspi_w_token[2].pvBuffer, sspi_w_token[2].cbBuffer);
 
     Curl_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
@@ -480,22 +433,20 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
 
   code = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 4, FALSE,
                            &written);
-  if(code || (4 != written)) {
+  if(code || (written != 4)) {
     failf(data, "Failed to send SSPI encryption request.");
-    if(sspi_send_token.pvBuffer)
-      Curl_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
-    Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-    return CURLE_COULDNT_CONNECT;
+    result = CURLE_COULDNT_CONNECT;
+    goto error;
   }
 
   if(data->set.socks5_gssapi_nec) {
     memcpy(socksreq, &gss_enc, 1);
     code = Curl_conn_cf_send(cf->next, data, (char *)socksreq, 1, FALSE,
                              &written);
-    if(code || (1 != written)) {
+    if(code || (written != 1)) {
       failf(data, "Failed to send SSPI encryption type.");
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_COULDNT_CONNECT;
+      result = CURLE_COULDNT_CONNECT;
+      goto error;
     }
   }
   else {
@@ -504,10 +455,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
                              sspi_send_token.cbBuffer, FALSE, &written);
     if(code || (sspi_send_token.cbBuffer != (size_t)written)) {
       failf(data, "Failed to send SSPI encryption type.");
-      if(sspi_send_token.pvBuffer)
-        Curl_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_COULDNT_CONNECT;
+      result = CURLE_COULDNT_CONNECT;
+      goto error;
     }
     if(sspi_send_token.pvBuffer)
       Curl_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
@@ -516,23 +465,23 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
   result = Curl_blockread_all(cf, data, (char *)socksreq, 4, &actualread);
   if(result || (actualread != 4)) {
     failf(data, "Failed to receive SSPI encryption response.");
-    Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-    return CURLE_COULDNT_CONNECT;
+    result = CURLE_COULDNT_CONNECT;
+    goto error;
   }
 
   /* ignore the first (VER) byte */
   if(socksreq[1] == 255) { /* status / message type */
     failf(data, "User was rejected by the SOCKS5 server (%u %u).",
           (unsigned int)socksreq[0], (unsigned int)socksreq[1]);
-    Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-    return CURLE_COULDNT_CONNECT;
+    result = CURLE_COULDNT_CONNECT;
+    goto error;
   }
 
   if(socksreq[1] != 2) { /* status / message type */
     failf(data, "Invalid SSPI encryption response type (%u %u).",
           (unsigned int)socksreq[0], (unsigned int)socksreq[1]);
-    Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-    return CURLE_COULDNT_CONNECT;
+    result = CURLE_COULDNT_CONNECT;
+    goto error;
   }
 
   memcpy(&us_length, socksreq + 2, sizeof(short));
@@ -541,8 +490,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
   sspi_w_token[0].cbBuffer = us_length;
   sspi_w_token[0].pvBuffer = malloc(us_length);
   if(!sspi_w_token[0].pvBuffer) {
-    Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-    return CURLE_OUT_OF_MEMORY;
+    result = CURLE_OUT_OF_MEMORY;
+    goto error;
   }
 
   result = Curl_blockread_all(cf, data, (char *)sspi_w_token[0].pvBuffer,
@@ -550,9 +499,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
 
   if(result || (actualread != us_length)) {
     failf(data, "Failed to receive SSPI encryption type.");
-    Curl_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-    Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-    return CURLE_COULDNT_CONNECT;
+    result = CURLE_COULDNT_CONNECT;
+    goto error;
   }
 
 
@@ -563,30 +511,20 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     sspi_w_token[1].cbBuffer = 0;
     sspi_w_token[1].pvBuffer = NULL;
 
-    status = Curl_pSecFn->DecryptMessage(&sspi_context,
-                                      &wrap_desc,
-                                      0,
-                                      &qop);
+    status = Curl_pSecFn->DecryptMessage(&sspi_context, &wrap_desc,
+                                         0, &qop);
 
     if(check_sspi_err(data, status, "DecryptMessage")) {
-      if(sspi_w_token[0].pvBuffer)
-        Curl_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      if(sspi_w_token[1].pvBuffer)
-        Curl_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
       failf(data, "Failed to query security context attributes.");
-      return CURLE_COULDNT_CONNECT;
+      result = CURLE_COULDNT_CONNECT;
+      goto error;
     }
 
     if(sspi_w_token[1].cbBuffer != 1) {
       failf(data, "Invalid SSPI encryption response length (%lu).",
             (unsigned long)sspi_w_token[1].cbBuffer);
-      if(sspi_w_token[0].pvBuffer)
-        Curl_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      if(sspi_w_token[1].pvBuffer)
-        Curl_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_COULDNT_CONNECT;
+      result = CURLE_COULDNT_CONNECT;
+      goto error;
     }
 
     memcpy(socksreq, sspi_w_token[1].pvBuffer, sspi_w_token[1].cbBuffer);
@@ -597,9 +535,8 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
     if(sspi_w_token[0].cbBuffer != 1) {
       failf(data, "Invalid SSPI encryption response length (%lu).",
             (unsigned long)sspi_w_token[0].cbBuffer);
-      Curl_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
-      Curl_pSecFn->DeleteSecurityContext(&sspi_context);
-      return CURLE_COULDNT_CONNECT;
+      result = CURLE_COULDNT_CONNECT;
+      goto error;
     }
     memcpy(socksreq, sspi_w_token[0].pvBuffer, sspi_w_token[0].cbBuffer);
     Curl_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
@@ -621,5 +558,22 @@ CURLcode Curl_SOCKS5_gssapi_negotiate(struct Curl_cfilter *cf,
      }
   */
   return CURLE_OK;
+error:
+  free(service_name);
+  Curl_pSecFn->FreeCredentialsHandle(&cred_handle);
+  Curl_pSecFn->DeleteSecurityContext(&sspi_context);
+  if(sspi_recv_token.pvBuffer)
+    Curl_pSecFn->FreeContextBuffer(sspi_recv_token.pvBuffer);
+  if(sspi_send_token.pvBuffer)
+    Curl_pSecFn->FreeContextBuffer(sspi_send_token.pvBuffer);
+  if(names.sUserName)
+    Curl_pSecFn->FreeContextBuffer(names.sUserName);
+  if(sspi_w_token[0].pvBuffer)
+    Curl_pSecFn->FreeContextBuffer(sspi_w_token[0].pvBuffer);
+  if(sspi_w_token[1].pvBuffer)
+    Curl_pSecFn->FreeContextBuffer(sspi_w_token[1].pvBuffer);
+  if(sspi_w_token[2].pvBuffer)
+    Curl_pSecFn->FreeContextBuffer(sspi_w_token[2].pvBuffer);
+  return result;
 }
 #endif
diff --git a/deps/curl/lib/splay.c b/deps/curl/lib/splay.c
index 7a0e419ce68..3ca8678b2b2 100644
--- a/deps/curl/lib/splay.c
+++ b/deps/curl/lib/splay.c
@@ -94,6 +94,10 @@ struct Curl_tree *Curl_splay(struct curltime i,
   return t;
 }
 
+static const struct curltime SPLAY_SUBNODE = {
+  ~0, -1
+};
+
 /* Insert key i into the tree t. Return a pointer to the resulting tree or
  * NULL if something went wrong.
  *
@@ -103,10 +107,6 @@ struct Curl_tree *Curl_splayinsert(struct curltime i,
                                    struct Curl_tree *t,
                                    struct Curl_tree *node)
 {
-  static const struct curltime KEY_NOTUSED = {
-    ~0, -1
-  }; /* will *NEVER* appear */
-
   DEBUGASSERT(node);
 
   if(t) {
@@ -117,8 +117,7 @@ struct Curl_tree *Curl_splayinsert(struct curltime i,
          doubly-linked circular list of nodes. We add the new 'node' struct to
          the end of this list. */
 
-      node->key = KEY_NOTUSED; /* we set the key in the sub node to NOTUSED
-                                  to quickly identify this node as a subnode */
+      node->key = SPLAY_SUBNODE; /* identify this node as a subnode */
       node->samen = t;
       node->samep = t->samep;
       t->samep->samen = node;
@@ -214,9 +213,6 @@ int Curl_splayremove(struct Curl_tree *t,
                      struct Curl_tree *removenode,
                      struct Curl_tree **newroot)
 {
-  static const struct curltime KEY_NOTUSED = {
-    ~0, -1
-  }; /* will *NEVER* appear */
   struct Curl_tree *x;
 
   if(!t)
@@ -224,11 +220,12 @@ int Curl_splayremove(struct Curl_tree *t,
 
   DEBUGASSERT(removenode);
 
-  if(compare(KEY_NOTUSED, removenode->key) == 0) {
-    /* Key set to NOTUSED means it is a subnode within a 'same' linked list
-       and thus we can unlink it easily. */
+  if(compare(SPLAY_SUBNODE, removenode->key) == 0) {
+    /* It is a subnode within a 'same' linked list and thus we can unlink it
+       easily. */
+    DEBUGASSERT(removenode->samen != removenode);
     if(removenode->samen == removenode)
-      /* A non-subnode should never be set to KEY_NOTUSED */
+      /* A non-subnode should never be set to SPLAY_SUBNODE */
       return 3;
 
     removenode->samep->samen = removenode->samen;
@@ -249,8 +246,9 @@ int Curl_splayremove(struct Curl_tree *t,
      is not actually in the tree.
 
      We cannot just compare the keys here as a double remove in quick
-     succession of a node with key != KEY_NOTUSED && same != NULL
+     succession of a node with key != SPLAY_SUBNODE && same != NULL
      could return the same key but a different node. */
+  DEBUGASSERT(t == removenode);
   if(t != removenode)
     return 2;
 
diff --git a/deps/curl/lib/strdup.c b/deps/curl/lib/strdup.c
index 69c41a5e252..66fd7c60eb5 100644
--- a/deps/curl/lib/strdup.c
+++ b/deps/curl/lib/strdup.c
@@ -71,7 +71,7 @@ wchar_t *Curl_wcsdup(const wchar_t *src)
 {
   size_t length = wcslen(src);
 
-  if(length > (SIZE_T_MAX / sizeof(wchar_t)) - 1)
+  if(length > (SIZE_MAX / sizeof(wchar_t)) - 1)
     return (wchar_t *)NULL; /* integer overflow */
 
   return (wchar_t *)Curl_memdup(src, (length + 1) * sizeof(wchar_t));
diff --git a/deps/curl/lib/strequal.c b/deps/curl/lib/strequal.c
index fb6be51dd5d..17dd34b7f3a 100644
--- a/deps/curl/lib/strequal.c
+++ b/deps/curl/lib/strequal.c
@@ -59,7 +59,7 @@ static int ncasecompare(const char *first, const char *second, size_t max)
     first++;
     second++;
   }
-  if(0 == max)
+  if(max == 0)
     return 1; /* they are equal this far */
 
   return Curl_raw_toupper(*first) == Curl_raw_toupper(*second);
diff --git a/deps/curl/lib/strerror.c b/deps/curl/lib/strerror.c
index 90694882c3c..f0f36ed1b71 100644
--- a/deps/curl/lib/strerror.c
+++ b/deps/curl/lib/strerror.c
@@ -809,7 +809,7 @@ const char *Curl_strerror(int err, char *buf, size_t buflen)
   * storage is supplied via 'strerrbuf' and 'buflen' to hold the generated
   * message string, or EINVAL if 'errnum' is not a valid error number.
   */
-  if(0 != strerror_r(err, buf, buflen)) {
+  if(strerror_r(err, buf, buflen)) {
     if('\0' == buf[0])
       curl_msnprintf(buf, buflen, "Unknown error %d", err);
   }
diff --git a/deps/curl/lib/telnet.c b/deps/curl/lib/telnet.c
index bd599dece26..cc827c1b3e8 100644
--- a/deps/curl/lib/telnet.c
+++ b/deps/curl/lib/telnet.c
@@ -188,10 +188,10 @@ const struct Curl_handler Curl_handler_telnet = {
   ZERO_NULL,                            /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  ZERO_NULL,                            /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  ZERO_NULL,                            /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -1287,8 +1287,8 @@ static CURLcode send_telnet_data(struct Curl_easy *data,
 static CURLcode telnet_done(struct Curl_easy *data,
                             CURLcode status, bool premature)
 {
-  (void)status; /* unused */
-  (void)premature; /* not used */
+  (void)status;
+  (void)premature;
   Curl_meta_remove(data, CURL_META_TELNET_EASY);
   return CURLE_OK;
 }
diff --git a/deps/curl/lib/tftp.c b/deps/curl/lib/tftp.c
index 5ea986dbb4b..4c2fadc2caf 100644
--- a/deps/curl/lib/tftp.c
+++ b/deps/curl/lib/tftp.c
@@ -160,8 +160,8 @@ static CURLcode tftp_setup_connection(struct Curl_easy *data,
                                       struct connectdata *conn);
 static CURLcode tftp_multi_statemach(struct Curl_easy *data, bool *done);
 static CURLcode tftp_doing(struct Curl_easy *data, bool *dophase_done);
-static int tftp_getsock(struct Curl_easy *data, struct connectdata *conn,
-                        curl_socket_t *socks);
+static CURLcode tftp_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps);
 static CURLcode tftp_translate_code(tftp_error_t error);
 
 
@@ -178,10 +178,10 @@ const struct Curl_handler Curl_handler_tftp = {
   tftp_connect,                         /* connect_it */
   tftp_multi_statemach,                 /* connecting */
   tftp_doing,                           /* doing */
-  tftp_getsock,                         /* proto_getsock */
-  tftp_getsock,                         /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  tftp_pollset,                         /* proto_pollset */
+  tftp_pollset,                         /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -1061,8 +1061,8 @@ static CURLcode tftp_done(struct Curl_easy *data, CURLcode status,
   struct connectdata *conn = data->conn;
   struct tftp_conn *state = Curl_conn_meta_get(conn, CURL_META_TFTP_CONN);
 
-  (void)status; /* unused */
-  (void)premature; /* not used */
+  (void)status;
+  (void)premature;
 
   if(Curl_pgrsDone(data))
     return CURLE_ABORTED_BY_CALLBACK;
@@ -1074,19 +1074,10 @@ static CURLcode tftp_done(struct Curl_easy *data, CURLcode status,
   return result;
 }
 
-/**********************************************************
- *
- * tftp_getsock
- *
- * The getsock callback
- *
- **********************************************************/
-static int tftp_getsock(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks)
+static CURLcode tftp_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
 {
-  (void)data;
-  socks[0] = conn->sock[FIRSTSOCKET];
-  return GETSOCK_READSOCK(0);
+  return Curl_pollset_add_in(data, ps, data->conn->sock[FIRSTSOCKET]);
 }
 
 /**********************************************************
diff --git a/deps/curl/lib/transfer.c b/deps/curl/lib/transfer.c
index 15a61f69978..1297a3e82d2 100644
--- a/deps/curl/lib/transfer.c
+++ b/deps/curl/lib/transfer.c
@@ -162,38 +162,23 @@ bool Curl_meets_timecondition(struct Curl_easy *data, time_t timeofdoc)
 
 static CURLcode xfer_recv_shutdown(struct Curl_easy *data, bool *done)
 {
-  int sockindex;
-
   if(!data || !data->conn)
     return CURLE_FAILED_INIT;
-  if(data->conn->sockfd == CURL_SOCKET_BAD)
-    return CURLE_FAILED_INIT;
-  sockindex = (data->conn->sockfd == data->conn->sock[SECONDARYSOCKET]);
-  return Curl_conn_shutdown(data, sockindex, done);
+  return Curl_conn_shutdown(data, data->conn->recv_idx, done);
 }
 
 static bool xfer_recv_shutdown_started(struct Curl_easy *data)
 {
-  int sockindex;
-
   if(!data || !data->conn)
     return FALSE;
-  if(data->conn->sockfd == CURL_SOCKET_BAD)
-    return FALSE;
-  sockindex = (data->conn->sockfd == data->conn->sock[SECONDARYSOCKET]);
-  return Curl_shutdown_started(data, sockindex);
+  return Curl_shutdown_started(data, data->conn->recv_idx);
 }
 
 CURLcode Curl_xfer_send_shutdown(struct Curl_easy *data, bool *done)
 {
-  int sockindex;
-
   if(!data || !data->conn)
     return CURLE_FAILED_INIT;
-  if(data->conn->writesockfd == CURL_SOCKET_BAD)
-    return CURLE_FAILED_INIT;
-  sockindex = (data->conn->writesockfd == data->conn->sock[SECONDARYSOCKET]);
-  return Curl_conn_shutdown(data, sockindex, done);
+  return Curl_conn_shutdown(data, data->conn->send_idx, done);
 }
 
 /**
@@ -295,9 +280,10 @@ static CURLcode sendrecv_dl(struct Curl_easy *data,
 
     if(bytestoread && data->set.max_recv_speed > 0) {
       /* In case of speed limit on receiving: if this loop already got
-       * data, break out. If not, limit the amount of bytes to receive.
-       * The overall, timed, speed limiting is done in multi.c */
-      if(total_received)
+       * a quarter of the quota, break out. We want to stutter a bit
+       * to keep in the limit, but too small receives will just cost
+       * cpu unnecessarily. */
+      if(total_received >= (data->set.max_recv_speed / 4))
         break;
       if(data->set.max_recv_speed < (curl_off_t)bytestoread)
         bytestoread = (size_t)data->set.max_recv_speed;
@@ -481,7 +467,7 @@ CURLcode Curl_sendrecv(struct Curl_easy *data, struct curltime *nowp)
   }
 
   /* If there is nothing more to send/recv, the request is done */
-  if(0 == (k->keepon&(KEEP_RECVBITS|KEEP_SENDBITS)))
+  if((k->keepon & (KEEP_RECVBITS|KEEP_SENDBITS)) == 0)
     data->req.done = TRUE;
 
 out:
@@ -732,101 +718,88 @@ CURLcode Curl_retry_request(struct Curl_easy *data, char **url)
   return CURLE_OK;
 }
 
-/*
- * xfer_setup() is called to setup basic properties for the transfer.
- */
 static void xfer_setup(
   struct Curl_easy *data,   /* transfer */
-  int sockindex,            /* socket index to read from or -1 */
-  curl_off_t size,          /* -1 if unknown at this point */
-  bool getheader,           /* TRUE if header parsing is wanted */
-  int writesockindex,       /* socket index to write to, it may be the same we
-                               read from. -1 disables */
-  bool shutdown,            /* shutdown connection at transfer end. Only
-                             * supported when sending OR receiving. */
-  bool shutdown_err_ignore  /* errors during shutdown do not fail the
-                             * transfer */
+  int send_idx,             /* sockindex to send on or -1 */
+  int recv_idx,             /* sockindex to receive on or -1 */
+  curl_off_t recv_size      /* how much to receive, -1 if unknown */
   )
 {
   struct SingleRequest *k = &data->req;
   struct connectdata *conn = data->conn;
-  bool want_send = Curl_req_want_send(data);
 
   DEBUGASSERT(conn != NULL);
-  DEBUGASSERT((sockindex <= 1) && (sockindex >= -1));
-  DEBUGASSERT((writesockindex <= 1) && (writesockindex >= -1));
-  DEBUGASSERT(!shutdown || (sockindex == -1) || (writesockindex == -1));
-
-  if(Curl_conn_is_multiplex(conn, FIRSTSOCKET) || want_send) {
-    /* when multiplexing, the read/write sockets need to be the same! */
-    conn->sockfd = sockindex == -1 ?
-      ((writesockindex == -1 ? CURL_SOCKET_BAD : conn->sock[writesockindex])) :
-      conn->sock[sockindex];
-    conn->writesockfd = conn->sockfd;
-    if(want_send)
-      /* special and HTTP-specific */
-      writesockindex = FIRSTSOCKET;
-  }
-  else {
-    conn->sockfd = sockindex == -1 ?
-      CURL_SOCKET_BAD : conn->sock[sockindex];
-    conn->writesockfd = writesockindex == -1 ?
-      CURL_SOCKET_BAD : conn->sock[writesockindex];
-  }
-
-  k->getheader = getheader;
-  k->size = size;
-  k->shutdown = shutdown;
-  k->shutdown_err_ignore = shutdown_err_ignore;
+  /* indexes are in range */
+  DEBUGASSERT((send_idx <= 1) && (send_idx >= -1));
+  DEBUGASSERT((recv_idx <= 1) && (recv_idx >= -1));
+  /* if request wants to send, switching off the send direction is wrong */
+  DEBUGASSERT((send_idx >= 0) || !Curl_req_want_send(data));
+
+  conn->send_idx = send_idx;
+  conn->recv_idx = recv_idx;
+
+  /* without receiving, there should be not recv_size */
+  DEBUGASSERT((conn->recv_idx >= 0) || (recv_size == -1));
+  k->size = recv_size;
+  k->header = !!conn->handler->write_resp_hd;
+  /* by default, we do not shutdown at the end of the transfer */
+  k->shutdown = FALSE;
+  k->shutdown_err_ignore = FALSE;
 
   /* The code sequence below is placed in this function just because all
      necessary input is not always known in do_complete() as this function may
      be called after that */
+  if(!k->header && (recv_size > 0))
+    Curl_pgrsSetDownloadSize(data, recv_size);
 
-  if(!k->getheader) {
-    k->header = FALSE;
-    if(size > 0)
-      Curl_pgrsSetDownloadSize(data, size);
-  }
   /* we want header and/or body, if neither then do not do this! */
-  if(k->getheader || !data->req.no_body) {
+  if(conn->handler->write_resp_hd || !data->req.no_body) {
 
-    if(sockindex != -1)
+    if(conn->recv_idx != -1)
       k->keepon |= KEEP_RECV;
 
-    if(writesockindex != -1)
+    if(conn->send_idx != -1)
       k->keepon |= KEEP_SEND;
-  } /* if(k->getheader || !data->req.no_body) */
+  }
 
+  CURL_TRC_M(data, "xfer_setup: recv_idx=%d, send_idx=%d",
+             conn->recv_idx, conn->send_idx);
 }
 
 void Curl_xfer_setup_nop(struct Curl_easy *data)
 {
-  xfer_setup(data, -1, -1, FALSE, -1, FALSE, FALSE);
+  xfer_setup(data, -1, -1, -1);
+}
+
+void Curl_xfer_setup_sendrecv(struct Curl_easy *data,
+                              int sockindex,
+                              curl_off_t recv_size)
+{
+  xfer_setup(data, sockindex, sockindex, recv_size);
+}
+
+void Curl_xfer_setup_send(struct Curl_easy *data,
+                          int sockindex)
+{
+  xfer_setup(data, sockindex, -1, -1);
 }
 
-void Curl_xfer_setup1(struct Curl_easy *data,
-                      int send_recv,
-                      curl_off_t recv_size,
-                      bool getheader)
+void Curl_xfer_setup_recv(struct Curl_easy *data,
+                          int sockindex,
+                          curl_off_t recv_size)
 {
-  int recv_index = (send_recv & CURL_XFER_RECV) ? FIRSTSOCKET : -1;
-  int send_index = (send_recv & CURL_XFER_SEND) ? FIRSTSOCKET : -1;
-  DEBUGASSERT((recv_index >= 0) || (recv_size == -1));
-  xfer_setup(data, recv_index, recv_size, getheader, send_index, FALSE, FALSE);
+  xfer_setup(data, -1, sockindex, recv_size);
 }
 
-void Curl_xfer_setup2(struct Curl_easy *data,
-                      int send_recv,
-                      curl_off_t recv_size,
-                      bool shutdown,
-                      bool shutdown_err_ignore)
+void Curl_xfer_set_shutdown(struct Curl_easy *data,
+                            bool shutdown,
+                            bool ignore_errors)
 {
-  int recv_index = (send_recv & CURL_XFER_RECV) ? SECONDARYSOCKET : -1;
-  int send_index = (send_recv & CURL_XFER_SEND) ? SECONDARYSOCKET : -1;
-  DEBUGASSERT((recv_index >= 0) || (recv_size == -1));
-  xfer_setup(data, recv_index, recv_size, FALSE, send_index,
-             shutdown, shutdown_err_ignore);
+  /* Shutdown should only be set when the transfer only sends or receives. */
+  DEBUGASSERT(!shutdown ||
+              (data->conn->send_idx < 0) || (data->conn->recv_idx < 0));
+  data->req.shutdown = shutdown;
+  data->req.shutdown_err_ignore = ignore_errors;
 }
 
 CURLcode Curl_xfer_write_resp(struct Curl_easy *data,
@@ -886,18 +859,12 @@ CURLcode Curl_xfer_write_done(struct Curl_easy *data, bool premature)
 
 bool Curl_xfer_needs_flush(struct Curl_easy *data)
 {
-  int sockindex;
-  sockindex = ((data->conn->writesockfd != CURL_SOCKET_BAD) &&
-               (data->conn->writesockfd == data->conn->sock[SECONDARYSOCKET]));
-  return Curl_conn_needs_flush(data, sockindex);
+  return Curl_conn_needs_flush(data, data->conn->send_idx);
 }
 
 CURLcode Curl_xfer_flush(struct Curl_easy *data)
 {
-  int sockindex;
-  sockindex = ((data->conn->writesockfd != CURL_SOCKET_BAD) &&
-               (data->conn->writesockfd == data->conn->sock[SECONDARYSOCKET]));
-  return Curl_conn_flush(data, sockindex);
+  return Curl_conn_flush(data, data->conn->send_idx);
 }
 
 CURLcode Curl_xfer_send(struct Curl_easy *data,
@@ -905,14 +872,12 @@ CURLcode Curl_xfer_send(struct Curl_easy *data,
                         size_t *pnwritten)
 {
   CURLcode result;
-  int sockindex;
 
   DEBUGASSERT(data);
   DEBUGASSERT(data->conn);
 
-  sockindex = ((data->conn->writesockfd != CURL_SOCKET_BAD) &&
-               (data->conn->writesockfd == data->conn->sock[SECONDARYSOCKET]));
-  result = Curl_conn_send(data, sockindex, buf, blen, eos, pnwritten);
+  result = Curl_conn_send(data, data->conn->send_idx,
+                          buf, blen, eos, pnwritten);
   if(result == CURLE_AGAIN) {
     result = CURLE_OK;
     *pnwritten = 0;
@@ -929,17 +894,13 @@ CURLcode Curl_xfer_recv(struct Curl_easy *data,
                         char *buf, size_t blen,
                         size_t *pnrcvd)
 {
-  int sockindex;
-
   DEBUGASSERT(data);
   DEBUGASSERT(data->conn);
   DEBUGASSERT(data->set.buffer_size > 0);
 
-  sockindex = ((data->conn->sockfd != CURL_SOCKET_BAD) &&
-               (data->conn->sockfd == data->conn->sock[SECONDARYSOCKET]));
   if((size_t)data->set.buffer_size < blen)
     blen = (size_t)data->set.buffer_size;
-  return Curl_conn_recv(data, sockindex, buf, blen, pnrcvd);
+  return Curl_conn_recv(data, data->conn->recv_idx, buf, blen, pnrcvd);
 }
 
 CURLcode Curl_xfer_send_close(struct Curl_easy *data)
@@ -998,3 +959,15 @@ CURLcode Curl_xfer_pause_recv(struct Curl_easy *data, bool enable)
   Curl_conn_ev_data_pause(data, enable);
   return result;
 }
+
+bool Curl_xfer_is_too_fast(struct Curl_easy *data)
+{
+  struct Curl_llist_node *e = Curl_llist_head(&data->state.timeoutlist);
+  while(e) {
+    struct time_node *n = Curl_node_elem(e);
+    e = Curl_node_next(e);
+    if(n->eid == EXPIRE_TOOFAST)
+      return TRUE;
+  }
+  return FALSE;
+}
diff --git a/deps/curl/lib/transfer.h b/deps/curl/lib/transfer.h
index 92278226be2..6145efb4a5f 100644
--- a/deps/curl/lib/transfer.h
+++ b/deps/curl/lib/transfer.h
@@ -34,8 +34,6 @@ void Curl_init_CONNECT(struct Curl_easy *data);
 CURLcode Curl_pretransfer(struct Curl_easy *data);
 
 CURLcode Curl_sendrecv(struct Curl_easy *data, struct curltime *nowp);
-int Curl_single_getsock(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks);
 CURLcode Curl_retry_request(struct Curl_easy *data, char **url);
 bool Curl_meets_timecondition(struct Curl_easy *data, time_t timeofdoc);
 
@@ -66,38 +64,33 @@ bool Curl_xfer_write_is_paused(struct Curl_easy *data);
 CURLcode Curl_xfer_write_resp_hd(struct Curl_easy *data,
                                  const char *hd0, size_t hdlen, bool is_eos);
 
-#define CURL_XFER_NOP     (0)
-#define CURL_XFER_RECV    (1<<(0))
-#define CURL_XFER_SEND    (1<<(1))
-#define CURL_XFER_SENDRECV (CURL_XFER_RECV|CURL_XFER_SEND)
-
-/**
- * The transfer is neither receiving nor sending now.
- */
+/* The transfer is neither receiving nor sending. */
 void Curl_xfer_setup_nop(struct Curl_easy *data);
 
-/**
- * The transfer will use socket 1 to send/recv. `recv_size` is
- * the amount to receive or -1 if unknown. `getheader` indicates
- * response header processing is expected.
- */
-void Curl_xfer_setup1(struct Curl_easy *data,
-                      int send_recv,
-                      curl_off_t recv_size,
-                      bool getheader);
+/* The transfer sends data on the given socket index */
+void Curl_xfer_setup_send(struct Curl_easy *data,
+                          int sockindex);
+
+/* The transfer receives data on the given socket index, the
+ * amount to receive (or -1 if unknown). */
+void Curl_xfer_setup_recv(struct Curl_easy *data,
+                          int sockindex,
+                          curl_off_t recv_size);
+
+/* *After* Curl_xfer_setup_xxx(), tell the transfer to shutdown the
+ * connection at the end. Let the transfer either fail or ignore any
+ * errors during shutdown. */
+void Curl_xfer_set_shutdown(struct Curl_easy *data,
+                            bool shutdown,
+                            bool ignore_errors);
 
 /**
- * The transfer will use socket 2 to send/recv. `recv_size` is
- * the amount to receive or -1 if unknown. With `shutdown` being
- * set, the transfer is only allowed to either send OR receive
- * and the socket 2 connection will be shutdown at the end of
- * the transfer. An unclean shutdown will fail the transfer
- * unless `shutdown_err_ignore` is TRUE.
+ * The transfer will use socket 1 to send/recv. `recv_size` is
+ * the amount to receive or -1 if unknown.
  */
-void Curl_xfer_setup2(struct Curl_easy *data,
-                      int send_recv,
-                      curl_off_t recv_size,
-                      bool shutdown, bool shutdown_err_ignore);
+void Curl_xfer_setup_sendrecv(struct Curl_easy *data,
+                              int sockindex,
+                              curl_off_t recv_size);
 
 /**
  * Multi has set transfer to DONE. Last chance to trigger
@@ -150,5 +143,7 @@ bool Curl_xfer_recv_is_paused(struct Curl_easy *data);
 CURLcode Curl_xfer_pause_send(struct Curl_easy *data, bool enable);
 CURLcode Curl_xfer_pause_recv(struct Curl_easy *data, bool enable);
 
+/* Query if transfer has expire timeout TOOFAST set. */
+bool Curl_xfer_is_too_fast(struct Curl_easy *data);
 
 #endif /* HEADER_CURL_TRANSFER_H */
diff --git a/deps/curl/lib/uint-bset.c b/deps/curl/lib/uint-bset.c
index e612c390a6b..1c60f22adff 100644
--- a/deps/curl/lib/uint-bset.c
+++ b/deps/curl/lib/uint-bset.c
@@ -79,8 +79,9 @@ UNITTEST unsigned int Curl_uint_bset_capacity(struct uint_bset *bset)
 {
   return bset->nslots * 64;
 }
+#endif
 
-UNITTEST unsigned int Curl_uint_bset_count(struct uint_bset *bset)
+unsigned int Curl_uint_bset_count(struct uint_bset *bset)
 {
   unsigned int i;
   unsigned int n = 0;
@@ -90,7 +91,6 @@ UNITTEST unsigned int Curl_uint_bset_count(struct uint_bset *bset)
   }
   return n;
 }
-#endif
 
 bool Curl_uint_bset_empty(struct uint_bset *bset)
 {
diff --git a/deps/curl/lib/url.c b/deps/curl/lib/url.c
index e4f250f54ae..b52267cb673 100644
--- a/deps/curl/lib/url.c
+++ b/deps/curl/lib/url.c
@@ -60,6 +60,9 @@
 #endif
 
 #if defined(HAVE_IF_NAMETOINDEX) && defined(_WIN32)
+#if defined(__MINGW32__) && (__MINGW64_VERSION_MAJOR <= 5)
+#include <wincrypt.h>  /* workaround for old mingw-w64 missing to include it */
+#endif
 #include <iphlpapi.h>
 #endif
 
@@ -317,7 +320,6 @@ CURLcode Curl_close(struct Curl_easy **datap)
   Curl_safefree(data->state.aptr.uagent);
   Curl_safefree(data->state.aptr.userpwd);
   Curl_safefree(data->state.aptr.accept_encoding);
-  Curl_safefree(data->state.aptr.te);
   Curl_safefree(data->state.aptr.rangeline);
   Curl_safefree(data->state.aptr.ref);
   Curl_safefree(data->state.aptr.host);
@@ -385,7 +387,7 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
   set->ftp_filemethod = FTPFILE_MULTICWD;
   set->ftp_skip_ip = TRUE;    /* skip PASV IP by default */
 #endif
-  set->dns_cache_timeout = 60; /* Timeout every 60 seconds by default */
+  set->dns_cache_timeout_ms = 60000; /* Timeout every 60 seconds by default */
 
   /* Timeout every 24 hours by default */
   set->general_ssl.ca_cache_timeout = 24 * 60 * 60;
@@ -455,6 +457,14 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
 #endif
   }
 
+  /* set default minimum TLS version */
+#ifdef USE_SSL
+  Curl_setopt_SSLVERSION(data, CURLOPT_SSLVERSION, CURL_SSLVERSION_DEFAULT);
+#ifndef CURL_DISABLE_PROXY
+  Curl_setopt_SSLVERSION(data, CURLOPT_PROXY_SSLVERSION,
+                         CURL_SSLVERSION_DEFAULT);
+#endif
+#endif
 #ifndef CURL_DISABLE_FTP
   set->wildcard_enabled = FALSE;
   set->chunk_bgn      = ZERO_NULL;
@@ -832,7 +842,7 @@ static bool url_match_connect_config(struct connectdata *conn,
                                      struct url_conn_match *m)
 {
   /* connect-only or to-be-closed connections will not be reused */
-  if(conn->connect_only || conn->bits.close)
+  if(conn->connect_only || conn->bits.close || conn->bits.no_reuse)
     return FALSE;
 
   /* ip_version must match */
@@ -1373,38 +1383,6 @@ ConnectionExists(struct Curl_easy *data,
   return result;
 }
 
-/*
- * verboseconnect() displays verbose information after a connect
- */
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-void Curl_verboseconnect(struct Curl_easy *data,
-                         struct connectdata *conn, int sockindex)
-{
-  if(data->set.verbose && sockindex == SECONDARYSOCKET)
-    infof(data, "Connected 2nd connection to %s port %u",
-          conn->secondary.remote_ip, conn->secondary.remote_port);
-  else
-    infof(data, "Connected to %s (%s) port %u",
-          CURL_CONN_HOST_DISPNAME(conn), conn->primary.remote_ip,
-          conn->primary.remote_port);
-#ifndef CURL_DISABLE_HTTP
-    if(conn->handler->protocol & PROTO_FAMILY_HTTP) {
-      switch(conn->alpn) {
-      case CURL_HTTP_VERSION_3:
-        infof(data, "using HTTP/3");
-        break;
-      case CURL_HTTP_VERSION_2:
-        infof(data, "using HTTP/2");
-        break;
-      default:
-        infof(data, "using HTTP/1.x");
-        break;
-      }
-    }
-#endif
-}
-#endif
-
 /*
  * Allocate and initialize a new connectdata object.
  */
@@ -1418,10 +1396,9 @@ static struct connectdata *allocate_conn(struct Curl_easy *data)
 
   conn->sock[FIRSTSOCKET] = CURL_SOCKET_BAD;     /* no file descriptor */
   conn->sock[SECONDARYSOCKET] = CURL_SOCKET_BAD; /* no file descriptor */
-  conn->sockfd = CURL_SOCKET_BAD;
-  conn->writesockfd = CURL_SOCKET_BAD;
+  conn->recv_idx = 0; /* default for receiving transfer data */
+  conn->send_idx = 0; /* default for sending transfer data */
   conn->connection_id = -1;    /* no ID */
-  conn->primary.remote_port = -1; /* unknown at this point */
   conn->remote_port = -1; /* unknown at this point */
 
   /* Default protocol-independent behavior does not support persistent
@@ -2033,7 +2010,7 @@ static CURLcode parseurlandfillconn(struct Curl_easy *data,
         valid = FALSE;
     }
     if(valid)
-      conn->primary.remote_port = conn->remote_port = (unsigned short)port;
+      conn->remote_port = (unsigned short)port;
   }
 
   (void)curl_url_get(uh, CURLUPART_QUERY, &data->state.up.query, 0);
@@ -2092,33 +2069,21 @@ static CURLcode setup_range(struct Curl_easy *data)
 static CURLcode setup_connection_internals(struct Curl_easy *data,
                                            struct connectdata *conn)
 {
-  const struct Curl_handler *p;
   const char *hostname;
   int port;
   CURLcode result;
 
-  /* Perform setup complement if some. */
-  p = conn->handler;
-
-  if(p->setup_connection) {
-    result = (*p->setup_connection)(data, conn);
-
+  if(conn->handler->setup_connection) {
+    result = conn->handler->setup_connection(data, conn);
     if(result)
       return result;
-
-    p = conn->handler;              /* May have changed. */
   }
 
-  if(conn->primary.remote_port < 0)
-    /* we check for -1 here since if proxy was detected already, this was
-       likely already set to the proxy port */
-    conn->primary.remote_port = p->defport;
-
   /* Now create the destination name */
 #ifndef CURL_DISABLE_PROXY
   if(conn->bits.httpproxy && !conn->bits.tunnel_proxy) {
     hostname = conn->http_proxy.host.name;
-    port = conn->primary.remote_port;
+    port = conn->http_proxy.port;
   }
   else
 #endif
@@ -2241,7 +2206,7 @@ static char *detect_proxy(struct Curl_easy *data,
  */
 static CURLcode parse_proxy(struct Curl_easy *data,
                             struct connectdata *conn, char *proxy,
-                            curl_proxytype proxytype)
+                            long proxytype)
 {
   char *portptr = NULL;
   int port = -1;
@@ -2379,12 +2344,8 @@ static CURLcode parse_proxy(struct Curl_easy *data,
         port = CURL_DEFAULT_PROXY_PORT;
     }
   }
-  if(port >= 0) {
+  if(port >= 0)
     proxyinfo->port = port;
-    if(conn->primary.remote_port < 0 || sockstype ||
-       !conn->socks_proxy.host.rawalloc)
-      conn->primary.remote_port = port;
-  }
 
   /* now, clone the proxy hostname */
   uc = curl_url_get(uhp, CURLUPART_HOST, &host, CURLU_URLDECODE);
@@ -2559,7 +2520,7 @@ static CURLcode create_conn_helper_init_proxy(struct Curl_easy *data,
    * connection that may exist registered to the same proxy host.
    ***********************************************************************/
   if(proxy || socksproxy) {
-    curl_proxytype ptype = (curl_proxytype)conn->http_proxy.proxytype;
+    long ptype = conn->http_proxy.proxytype;
     if(proxy) {
       result = parse_proxy(data, conn, proxy, ptype);
       Curl_safefree(proxy); /* parse_proxy copies the proxy string */
@@ -2952,7 +2913,7 @@ static CURLcode parse_connect_to_host_port(struct Curl_easy *data,
   CURLcode result = CURLE_OK;
 
 #ifdef CURL_DISABLE_VERBOSE_STRINGS
-  (void) data;
+  (void)data;
 #endif
 
   *hostname_result = NULL;
@@ -3191,8 +3152,8 @@ static CURLcode parse_connect_to_slist(struct Curl_easy *data,
                                &as /* to */,
                                allowed_alpns);
     }
- #endif
- #ifdef USE_HTTP2
+#endif
+#ifdef USE_HTTP2
     if(!hit && (neg->wanted & CURL_HTTP_V2x) &&
        !neg->h2_prior_knowledge) {
       srcalpnid = ALPN_h2;
@@ -3201,7 +3162,7 @@ static CURLcode parse_connect_to_slist(struct Curl_easy *data,
                                &as /* to */,
                                allowed_alpns);
     }
- #endif
+#endif
     if(!hit && (neg->wanted & CURL_HTTP_V1x) &&
        !neg->only_10) {
       srcalpnid = ALPN_h1;
@@ -3263,7 +3224,7 @@ static CURLcode resolve_unix(struct Curl_easy *data,
 
   /* Unix domain sockets are local. The host gets ignored, just use the
    * specified domain socket address. Do not cache "DNS entries". There is
-   * no DNS involved and we already have the filesystem path available. */
+   * no DNS involved and we already have the file system path available. */
   hostaddr = calloc(1, sizeof(struct Curl_dns_entry));
   if(!hostaddr)
     return CURLE_OUT_OF_MEMORY;
@@ -3293,6 +3254,7 @@ static CURLcode resolve_server(struct Curl_easy *data,
                                struct Curl_dns_entry **pdns)
 {
   struct hostname *ehost;
+  int eport;
   timediff_t timeout_ms = Curl_timeleft(data, NULL, TRUE);
   const char *peertype = "host";
   CURLcode result;
@@ -3322,6 +3284,8 @@ static CURLcode resolve_server(struct Curl_easy *data,
   if(CONN_IS_PROXIED(conn)) {
     ehost = conn->bits.socksproxy ? &conn->socks_proxy.host :
       &conn->http_proxy.host;
+    eport = conn->bits.socksproxy ? conn->socks_proxy.port :
+      conn->http_proxy.port;
     peertype = "proxy";
   }
   else
@@ -3330,8 +3294,7 @@ static CURLcode resolve_server(struct Curl_easy *data,
     ehost = conn->bits.conn_to_host ? &conn->conn_to_host : &conn->host;
     /* If not connecting via a proxy, extract the port from the URL, if it is
      * there, thus overriding any defaults that might have been set above. */
-    conn->primary.remote_port = conn->bits.conn_to_port ? conn->conn_to_port :
-      conn->remote_port;
+    eport = conn->bits.conn_to_port ? conn->conn_to_port : conn->remote_port;
   }
 
   /* Resolve target host right on */
@@ -3340,7 +3303,7 @@ static CURLcode resolve_server(struct Curl_easy *data,
     return CURLE_OUT_OF_MEMORY;
 
   result = Curl_resolv_timeout(data, conn->hostname_resolve,
-                               conn->primary.remote_port, conn->ip_version,
+                               eport, conn->ip_version,
                                pdns, timeout_ms);
   DEBUGASSERT(!result || !*pdns);
   if(result == CURLE_AGAIN) {
@@ -3717,7 +3680,7 @@ static CURLcode create_conn(struct Curl_easy *data,
     *in_connect = conn;
 
 #ifndef CURL_DISABLE_PROXY
-    infof(data, "Re-using existing %s: connection%s with %s %s",
+    infof(data, "Reusing existing %s: connection%s with %s %s",
           conn->given->scheme,
           tls_upgraded ? " (upgraded to SSL)" : "",
           conn->bits.proxy ? "proxy" : "host",
@@ -3725,7 +3688,7 @@ static CURLcode create_conn(struct Curl_easy *data,
           conn->http_proxy.host.name ? conn->http_proxy.host.dispname :
           conn->host.dispname);
 #else
-    infof(data, "Re-using existing %s: connection%s with host %s",
+    infof(data, "Reusing existing %s: connection%s with host %s",
           conn->given->scheme,
           tls_upgraded ? " (upgraded to SSL)" : "",
           conn->host.dispname);
@@ -4078,7 +4041,7 @@ void Curl_data_priority_clear_state(struct Curl_easy *data)
   memset(&data->state.priority, 0, sizeof(data->state.priority));
 }
 
-#endif /* defined(USE_HTTP2) || defined(USE_HTTP3) */
+#endif /* USE_HTTP2 || USE_HTTP3 */
 
 
 CURLcode Curl_conn_meta_set(struct connectdata *conn, const char *key,
diff --git a/deps/curl/lib/url.h b/deps/curl/lib/url.h
index bd4060c8846..11a69d41578 100644
--- a/deps/curl/lib/url.h
+++ b/deps/curl/lib/url.h
@@ -79,13 +79,6 @@ const struct Curl_handler *Curl_getn_scheme_handler(const char *scheme,
 #define CURL_DEFAULT_HTTPS_PROXY_PORT 443 /* default https proxy port unless
                                              specified */
 
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-#define Curl_verboseconnect(x,y,z)  Curl_nop_stmt
-#else
-void Curl_verboseconnect(struct Curl_easy *data, struct connectdata *conn,
-                         int sockindex);
-#endif
-
 /**
  * Return TRUE iff the given connection is considered dead.
  * @param nowp      NULL or pointer to time being checked against.
@@ -118,7 +111,7 @@ CURLcode Curl_1st_fatal(CURLcode r1, CURLcode r2);
 void Curl_data_priority_clear_state(struct Curl_easy *data);
 #else
 #define Curl_data_priority_clear_state(x)
-#endif /* !(defined(USE_HTTP2) || defined(USE_HTTP3)) */
+#endif /* USE_HTTP2 || USE_HTTP3 */
 
 #ifdef USE_NGHTTP2
 CURLcode Curl_data_priority_add_child(struct Curl_easy *parent,
diff --git a/deps/curl/lib/urlapi.c b/deps/curl/lib/urlapi.c
index c266fd3ebc2..c89852794e0 100644
--- a/deps/curl/lib/urlapi.c
+++ b/deps/curl/lib/urlapi.c
@@ -511,7 +511,7 @@ static CURLUcode ipv6_parse(struct Curl_URL *u, char *hostname,
   {
     char dest[16]; /* fits a binary IPv6 address */
     hostname[hlen] = 0; /* end the address there */
-    if(1 != curlx_inet_pton(AF_INET6, hostname, dest))
+    if(curlx_inet_pton(AF_INET6, hostname, dest) != 1)
       return CURLUE_BAD_IPV6;
     if(curlx_inet_ntop(AF_INET6, dest, hostname, hlen)) {
       hlen = strlen(hostname); /* might be shorter now */
@@ -1757,13 +1757,26 @@ static CURLUcode urlset_clear(CURLU *u, CURLUPart what)
   return CURLUE_OK;
 }
 
+static bool allowed_in_path(unsigned char x)
+{
+  switch(x) {
+  case '!': case '$': case '&': case '\'':
+  case '(': case ')': case '{': case '}':
+  case '[': case ']': case '*': case '+':
+  case ',': case ';': case '=': case ':':
+  case '@': case '/':
+    return TRUE;
+  }
+  return FALSE;
+}
+
 CURLUcode curl_url_set(CURLU *u, CURLUPart what,
                        const char *part, unsigned int flags)
 {
   char **storep = NULL;
   bool urlencode = (flags & CURLU_URLENCODE) ? 1 : 0;
   bool plusencode = FALSE;
-  bool urlskipslash = FALSE;
+  bool pathmode = FALSE;
   bool leadingslash = FALSE;
   bool appendquery = FALSE;
   bool equalsencode = FALSE;
@@ -1808,7 +1821,7 @@ CURLUcode curl_url_set(CURLU *u, CURLUPart what,
   case CURLUPART_PORT:
     return set_url_port(u, part);
   case CURLUPART_PATH:
-    urlskipslash = TRUE;
+    pathmode = TRUE;
     leadingslash = TRUE; /* enforce */
     storep = &u->path;
     break;
@@ -1850,7 +1863,7 @@ CURLUcode curl_url_set(CURLU *u, CURLUPart what,
             return CURLUE_OUT_OF_MEMORY;
         }
         else if(ISUNRESERVED(*i) ||
-                ((*i == '/') && urlskipslash) ||
+                (pathmode && allowed_in_path(*i)) ||
                 ((*i == '=') && equalsencode)) {
           if((*i == '=') && equalsencode)
             /* only skip the first equals sign */
diff --git a/deps/curl/lib/urldata.h b/deps/curl/lib/urldata.h
index e54721dd983..cf181af641f 100644
--- a/deps/curl/lib/urldata.h
+++ b/deps/curl/lib/urldata.h
@@ -70,11 +70,11 @@ struct curl_trc_featt;
  * platforms that have a >= 64-bit type and then we use such a type for the
  * protocol fields in the protocol handler.
  */
-#define CURLPROTO_WS     (1<<30)
+#define CURLPROTO_WS     (1L<<30)
 #define CURLPROTO_WSS    ((curl_prot_t)1<<31)
 #else
-#define CURLPROTO_WS 0
-#define CURLPROTO_WSS 0
+#define CURLPROTO_WS     0L
+#define CURLPROTO_WSS    0L
 #endif
 
 /* the default protocols accepting a redirect to */
@@ -317,7 +317,7 @@ struct ssl_general_config {
 #ifndef CURL_DISABLE_DIGEST_AUTH
 /* Struct used for Digest challenge-response authentication */
 struct digestdata {
-#if defined(USE_WINDOWS_SSPI)
+#ifdef USE_WINDOWS_SSPI
   BYTE *input_token;
   size_t input_token_len;
   CtxtHandle *http_context;
@@ -423,6 +423,7 @@ struct ConnectBits {
   BIT(parallel_connect); /* set TRUE when a parallel connect attempt has
                             started (happy eyeballs) */
   BIT(aborted); /* connection was aborted, e.g. in unclean state */
+  BIT(no_reuse); /* connection should not be reused */
   BIT(shutdown_handler); /* connection shutdown: handler shut down */
   BIT(shutdown_filters); /* connection shutdown: filters shut down */
   BIT(in_cpool);     /* connection is kept in a connection pool */
@@ -470,15 +471,6 @@ struct hostname {
 #define FIRSTSOCKET     0
 #define SECONDARYSOCKET 1
 
-/* Polling requested by an easy handle.
- * `action` is CURL_POLL_IN, CURL_POLL_OUT or CURL_POLL_INOUT.
- */
-struct easy_pollset {
-  curl_socket_t sockets[MAX_SOCKSPEREASYHANDLE];
-  unsigned int num;
-  unsigned char actions[MAX_SOCKSPEREASYHANDLE];
-};
-
 /*
  * Specific protocol handler.
  */
@@ -515,24 +507,24 @@ struct Curl_handler {
 
   /* Called from the multi interface during the PROTOCONNECT phase, and it
      should then return a proper fd set */
-  int (*proto_getsock)(struct Curl_easy *data,
-                       struct connectdata *conn, curl_socket_t *socks);
+  CURLcode (*proto_pollset)(struct Curl_easy *data,
+                            struct easy_pollset *ps);
 
   /* Called from the multi interface during the DOING phase, and it should
      then return a proper fd set */
-  int (*doing_getsock)(struct Curl_easy *data,
-                       struct connectdata *conn, curl_socket_t *socks);
+  CURLcode (*doing_pollset)(struct Curl_easy *data,
+                            struct easy_pollset *ps);
 
   /* Called from the multi interface during the DO_MORE phase, and it should
      then return a proper fd set */
-  int (*domore_getsock)(struct Curl_easy *data,
-                        struct connectdata *conn, curl_socket_t *socks);
+  CURLcode (*domore_pollset)(struct Curl_easy *data,
+                            struct easy_pollset *ps);
 
   /* Called from the multi interface during the DO_DONE, PERFORM and
      WAITPERFORM phases, and it should then return a proper fd set. Not setting
      this will make libcurl use the generic default one. */
-  int (*perform_getsock)(struct Curl_easy *data,
-                         struct connectdata *conn, curl_socket_t *socks);
+  CURLcode (*perform_pollset)(struct Curl_easy *data,
+                              struct easy_pollset *ps);
 
   /* This function *MAY* be set to a protocol-dependent function that is run
    * by the curl_disconnect(), as a step in the disconnection. If the handler
@@ -625,8 +617,7 @@ struct ip_quadruple {
 struct proxy_info {
   struct hostname host;
   int port;
-  unsigned char proxytype; /* curl_proxytype: what kind of proxy that is in
-                              use */
+  unsigned char proxytype; /* what kind of proxy that is in use */
   char *user;    /* proxy username string, allocated */
   char *passwd;  /* proxy password string, allocated */
 };
@@ -674,14 +665,6 @@ struct connectdata {
   struct proxy_info socks_proxy;
   struct proxy_info http_proxy;
 #endif
-  /* 'primary' and 'secondary' get filled with IP quadruple
-     (local/remote numerical ip address and port) whenever a connect is
-     *attempted*.
-     When more than one address is tried for a connection these will hold data
-     for the last attempt. When the connection is actually established
-     these are updated with data which comes directly from the socket. */
-  struct ip_quadruple primary;
-  struct ip_quadruple secondary;
   char *user;    /* username string, allocated */
   char *passwd;  /* password string, allocated */
   char *options; /* options string, allocated */
@@ -689,11 +672,18 @@ struct connectdata {
   char *oauth_bearer; /* OAUTH2 bearer, allocated */
   struct curltime created; /* creation time */
   struct curltime lastused; /* when returned to the connection poolas idle */
-  curl_socket_t sock[2]; /* two sockets, the second is used for the data
-                            transfer when doing FTP */
+
+  /* A connection can have one or two sockets and connection filters.
+   * The protocol using the 2nd one is FTP for CONTROL+DATA sockets */
+  curl_socket_t sock[2];
+  struct Curl_cfilter *cfilter[2]; /* connection filters */
   Curl_recv *recv[2];
   Curl_send *send[2];
-  struct Curl_cfilter *cfilter[2]; /* connection filters */
+  int recv_idx;  /* on which socket index to receive, default 0 */
+  int send_idx;  /* on which socket index to send, default 0 */
+
+#define CONN_SOCK_IDX_VALID(i)    (((i) >= 0) && ((i) < 2))
+
   struct {
     struct curltime start[2]; /* when filter shutdown started */
     timediff_t timeout_ms; /* 0 means no timeout */
@@ -715,10 +705,6 @@ struct connectdata {
 
   /**** curl_get() phase fields */
 
-  curl_socket_t sockfd;   /* socket to read from or CURL_SOCKET_BAD */
-  curl_socket_t writesockfd; /* socket to write to, it may be the same we read
-                                from. CURL_SOCKET_BAD disables */
-
 #ifdef HAVE_GSSAPI
   BIT(sec_complete); /* if Kerberos is enabled for this connection */
   unsigned char command_prot; /* enum protection_level */
@@ -742,10 +728,10 @@ struct connectdata {
 
   /*************** Request - specific items ************/
 #if defined(USE_WINDOWS_SSPI) && defined(SECPKG_ATTR_ENDPOINT_BINDINGS)
-  CtxtHandle *sslContext;
+  CtxtHandle *sslContext;  /* mingw-w64 v9+. MS SDK 7.0A+. */
 #endif
 
-#if defined(USE_NTLM)
+#ifdef USE_NTLM
   curlntlm http_ntlm_state;
   curlntlm proxy_ntlm_state;
 #endif
@@ -780,17 +766,12 @@ struct connectdata {
   unsigned short localport;
   unsigned short secondary_port; /* secondary socket remote port to connect to
                                     (ftp) */
-  unsigned char alpn; /* APLN TLS negotiated protocol, a CURL_HTTP_VERSION*
-                         value */
-#ifndef CURL_DISABLE_PROXY
-  unsigned char proxy_alpn; /* APLN of proxy tunnel, CURL_HTTP_VERSION* */
-#endif
   unsigned char transport_wanted; /* one of the TRNSPRT_* defines. Not
    necessarily the transport the connection ends using due to Alt-Svc
    and happy eyeballing. Use `Curl_conn_get_transport() for actual value
    once the connection is set up. */
   unsigned char ip_version; /* copied from the Curl_easy at creation time */
-  /* HTTP version last responded with by the server.
+  /* HTTP version last responded with by the server or negotiated via ALPN.
    * 0 at start, then one of 09, 10, 11, etc. */
   unsigned char httpversion_seen;
   unsigned char connect_only;
@@ -966,7 +947,6 @@ typedef enum {
   EXPIRE_HAPPY_EYEBALLS_DNS, /* See asyn-ares.c */
   EXPIRE_HAPPY_EYEBALLS,
   EXPIRE_MULTI_PENDING,
-  EXPIRE_RUN_NOW,
   EXPIRE_SPEEDCHECK,
   EXPIRE_TIMEOUT,
   EXPIRE_TOOFAST,
@@ -1053,7 +1033,7 @@ struct UrlState {
   struct Curl_async async;  /* asynchronous name resolver data */
 #endif
 
-#if defined(USE_OPENSSL)
+#ifdef USE_OPENSSL
   /* void instead of ENGINE to avoid bleeding OpenSSL into this header */
   void *engine;
   /* void instead of OSSL_PROVIDER */
@@ -1142,7 +1122,6 @@ struct UrlState {
 #ifndef CURL_DISABLE_RTSP
     char *rtsp_transport;
 #endif
-    char *te; /* TE: request header */
 
     /* transfer credentials */
     char *user;
@@ -1198,6 +1177,11 @@ struct UrlState {
                     internal use and the user does not have ownership of the
                     handle. */
   BIT(http_ignorecustom); /* ignore custom method from now */
+#ifndef CURL_DISABLE_HTTP
+  BIT(http_hd_te); /* Added HTTP header TE: */
+  BIT(http_hd_upgrade); /* Added HTTP header Upgrade: */
+  BIT(http_hd_h2_settings); /* Added HTTP header H2Settings: */
+#endif
 };
 
 /*
@@ -1255,7 +1239,7 @@ enum dupstring {
   STRING_FTP_ALTERNATIVE_TO_USER, /* command to send if USER/PASS fails */
   STRING_FTPPORT,         /* port to send with the FTP PORT command */
 #endif
-#if defined(HAVE_GSSAPI)
+#ifdef HAVE_GSSAPI
   STRING_KRB_LEVEL,       /* krb security level */
 #endif
 #ifndef CURL_DISABLE_NETRC
@@ -1371,8 +1355,6 @@ struct UserDefined {
   void *writeheader; /* write the header to this if non-NULL */
   unsigned long httpauth;  /* kind of HTTP authentication to use (bitmask) */
   unsigned long proxyauth; /* kind of proxy authentication to use (bitmask) */
-  long maxredirs;    /* maximum no. of http(s) redirects to follow, set to -1
-                        for infinity */
   void *postfields;  /* if POST, set the fields' values here */
   curl_seek_callback seek_func;      /* function that seeks the input */
   curl_off_t postfieldsize; /* if POST, this might have a size to use instead
@@ -1411,9 +1393,6 @@ struct UserDefined {
                            is to be reused */
   timediff_t conn_max_age_ms; /* max time since creation to allow a
                             connection that is to be reused */
-#ifndef CURL_DISABLE_TFTP
-  long tftp_blksize;    /* in bytes, 0 means use default */
-#endif
   curl_off_t filesize;  /* size of file to upload, -1 means unknown */
   long low_speed_limit; /* bytes/second */
   long low_speed_time;  /* number of seconds */
@@ -1441,11 +1420,11 @@ struct UserDefined {
   unsigned short proxyport; /* If non-zero, use this port number by
                                default. If the proxy string features a
                                ":[port]" that one will override this. */
-  unsigned char proxytype; /* what kind of proxy: curl_proxytype */
+  unsigned char proxytype; /* what kind of proxy */
   unsigned char socks5auth;/* kind of SOCKS5 authentication to use (bitmask) */
 #endif
   struct ssl_general_config general_ssl; /* general user defined SSL stuff */
-  int dns_cache_timeout; /* DNS cache timeout (seconds) */
+  timediff_t dns_cache_timeout_ms; /* DNS cache timeout (milliseconds) */
   unsigned int buffer_size;      /* size of receive buffer to use */
   unsigned int upload_buffer_size; /* size of upload buffer to use,
                                       keep it >= CURL_MAX_WRITE_SIZE */
@@ -1508,7 +1487,6 @@ struct UserDefined {
   int tcp_keepintvl;    /* seconds between TCP keepalive probes */
   int tcp_keepcnt;      /* maximum number of keepalive probes */
 
-  long expect_100_timeout; /* in milliseconds */
 #if defined(USE_HTTP2) || defined(USE_HTTP3)
   struct Curl_data_priority priority;
 #endif
@@ -1528,6 +1506,9 @@ struct UserDefined {
 #ifdef USE_ECH
   int tls_ech;      /* TLS ECH configuration  */
 #endif
+  short maxredirs;    /* maximum no. of http(s) redirects to follow,
+                         set to -1 for infinity */
+  unsigned short expect_100_timeout; /* in milliseconds */
   unsigned short use_port; /* which port to use (when not using default) */
 #ifndef CURL_DISABLE_BINDLOCAL
   unsigned short localport; /* local port number to bind to */
@@ -1535,6 +1516,9 @@ struct UserDefined {
                                     in case the 'localport' one cannot be
                                     bind()ed */
 #endif
+#ifndef CURL_DISABLE_TFTP
+  unsigned short tftp_blksize;    /* in bytes, 0 means use default */
+#endif
 #ifndef CURL_DISABLE_NETRC
   unsigned char use_netrc;        /* enum CURL_NETRC_OPTION values  */
 #endif
@@ -1620,7 +1604,7 @@ struct UserDefined {
                              location: */
   BIT(opt_no_body);    /* as set with CURLOPT_NOBODY */
   BIT(verbose);        /* output verbosity */
-#if defined(HAVE_GSSAPI)
+#ifdef HAVE_GSSAPI
   BIT(krb);            /* Kerberos connection requested */
 #endif
   BIT(reuse_forbid);   /* forbidden to be reused, close after use */
diff --git a/deps/curl/lib/vauth/cleartext.c b/deps/curl/lib/vauth/cleartext.c
index 8fc5d41b9a3..ebf026fcf5f 100644
--- a/deps/curl/lib/vauth/cleartext.c
+++ b/deps/curl/lib/vauth/cleartext.c
@@ -74,8 +74,8 @@ CURLcode Curl_auth_create_plain_message(const char *authzid,
   plen = strlen(passwd);
 
   /* Compute binary message length. Check for overflows. */
-  if((zlen > SIZE_T_MAX/4) || (clen > SIZE_T_MAX/4) ||
-     (plen > (SIZE_T_MAX/2 - 2)))
+  if((zlen > SIZE_MAX/4) || (clen > SIZE_MAX/4) ||
+     (plen > (SIZE_MAX/2 - 2)))
     return CURLE_OUT_OF_MEMORY;
   plainlen = zlen + clen + plen + 2;
 
diff --git a/deps/curl/lib/vauth/digest_sspi.c b/deps/curl/lib/vauth/digest_sspi.c
index 28d0b3599c2..c74b8f86539 100644
--- a/deps/curl/lib/vauth/digest_sspi.c
+++ b/deps/curl/lib/vauth/digest_sspi.c
@@ -203,7 +203,7 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
      status == SEC_I_COMPLETE_AND_CONTINUE)
     Curl_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
   else if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) {
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
     char buffer[STRERROR_LEN];
 #endif
 
@@ -215,7 +215,7 @@ CURLcode Curl_auth_create_digest_md5_message(struct Curl_easy *data,
     if(status == SEC_E_INSUFFICIENT_MEMORY)
       return CURLE_OUT_OF_MEMORY;
 
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
     infof(data, "schannel: InitializeSecurityContext failed: %s",
           Curl_sspi_strerror(status, buffer, sizeof(buffer)));
 #endif
@@ -411,7 +411,7 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
   SecBufferDesc chlg_desc;
   SECURITY_STATUS status;
 
-  (void) data;
+  (void)data;
 
   /* Query the security package for DigestSSP */
   status =
@@ -602,7 +602,7 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
        status == SEC_I_COMPLETE_AND_CONTINUE)
       Curl_pSecFn->CompleteAuthToken(&credentials, &resp_desc);
     else if(status != SEC_E_OK && status != SEC_I_CONTINUE_NEEDED) {
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
       char buffer[STRERROR_LEN];
 #endif
 
@@ -616,7 +616,7 @@ CURLcode Curl_auth_create_digest_http_message(struct Curl_easy *data,
       if(status == SEC_E_INSUFFICIENT_MEMORY)
         return CURLE_OUT_OF_MEMORY;
 
-#if !defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
       infof(data, "schannel: InitializeSecurityContext failed: %s",
             Curl_sspi_strerror(status, buffer, sizeof(buffer)));
 #endif
diff --git a/deps/curl/lib/vauth/krb5_gssapi.c b/deps/curl/lib/vauth/krb5_gssapi.c
index 78f4be3dc94..fd46619d846 100644
--- a/deps/curl/lib/vauth/krb5_gssapi.c
+++ b/deps/curl/lib/vauth/krb5_gssapi.c
@@ -99,8 +99,8 @@ CURLcode Curl_auth_create_gssapi_user_message(struct Curl_easy *data,
   gss_buffer_desc input_token = GSS_C_EMPTY_BUFFER;
   gss_buffer_desc output_token = GSS_C_EMPTY_BUFFER;
 
-  (void) userp;
-  (void) passwdp;
+  (void)userp;
+  (void)passwdp;
 
   if(!krb5->spn) {
     gss_buffer_desc spn_token = GSS_C_EMPTY_BUFFER;
diff --git a/deps/curl/lib/vauth/krb5_sspi.c b/deps/curl/lib/vauth/krb5_sspi.c
index a29358569d9..ea26f82750a 100644
--- a/deps/curl/lib/vauth/krb5_sspi.c
+++ b/deps/curl/lib/vauth/krb5_sspi.c
@@ -270,8 +270,8 @@ CURLcode Curl_auth_create_gssapi_security_message(struct Curl_easy *data,
   SecPkgContext_Sizes sizes;
   SECURITY_STATUS status;
 
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) data;
+#ifdef CURL_DISABLE_VERBOSE_STRINGS
+  (void)data;
 #endif
 
   /* Ensure we have a valid challenge message */
diff --git a/deps/curl/lib/vauth/ntlm.c b/deps/curl/lib/vauth/ntlm.c
index 5cda790dda3..6164cd388be 100644
--- a/deps/curl/lib/vauth/ntlm.c
+++ b/deps/curl/lib/vauth/ntlm.c
@@ -235,7 +235,7 @@ static void ntlm_print_hex(FILE *handle, const char *buf, size_t len)
 {
   const char *p = buf;
 
-  (void) handle;
+  (void)handle;
 
   fprintf(stderr, "0x");
   while(len-- > 0)
@@ -268,8 +268,8 @@ static CURLcode ntlm_decode_type2_target(struct Curl_easy *data,
   const unsigned char *type2 = Curl_bufref_ptr(type2ref);
   size_t type2len = Curl_bufref_len(type2ref);
 
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) data;
+#ifdef CURL_DISABLE_VERBOSE_STRINGS
+  (void)data;
 #endif
 
   if(type2len >= 48) {
@@ -368,7 +368,7 @@ CURLcode Curl_auth_decode_ntlm_type2_message(struct Curl_easy *data,
   const unsigned char *type2 = Curl_bufref_ptr(type2ref);
   size_t type2len = Curl_bufref_len(type2ref);
 
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
+#ifdef CURL_DISABLE_VERBOSE_STRINGS
   (void)data;
 #endif
 
diff --git a/deps/curl/lib/vauth/ntlm_sspi.c b/deps/curl/lib/vauth/ntlm_sspi.c
index 86b4bccfdf4..d45e2db38e1 100644
--- a/deps/curl/lib/vauth/ntlm_sspi.c
+++ b/deps/curl/lib/vauth/ntlm_sspi.c
@@ -205,8 +205,8 @@ CURLcode Curl_auth_decode_ntlm_type2_message(struct Curl_easy *data,
                                              const struct bufref *type2,
                                              struct ntlmdata *ntlm)
 {
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) data;
+#ifdef CURL_DISABLE_VERBOSE_STRINGS
+  (void)data;
 #endif
 
   /* Ensure we have a valid type-2 message */
@@ -257,11 +257,11 @@ CURLcode Curl_auth_create_ntlm_type3_message(struct Curl_easy *data,
   unsigned long attrs;
   TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
 
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) data;
+#ifdef CURL_DISABLE_VERBOSE_STRINGS
+  (void)data;
 #endif
-  (void) passwdp;
-  (void) userp;
+  (void)passwdp;
+  (void)userp;
 
   /* Setup the type-2 "input" security buffer */
   type_2_desc.ulVersion     = SECBUFFER_VERSION;
diff --git a/deps/curl/lib/vauth/spnego_gssapi.c b/deps/curl/lib/vauth/spnego_gssapi.c
index 1e576c71348..4ed02a398ca 100644
--- a/deps/curl/lib/vauth/spnego_gssapi.c
+++ b/deps/curl/lib/vauth/spnego_gssapi.c
@@ -98,8 +98,8 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
   gss_channel_bindings_t chan_bindings = GSS_C_NO_CHANNEL_BINDINGS;
   struct gss_channel_bindings_struct chan;
 
-  (void) user;
-  (void) password;
+  (void)user;
+  (void)password;
 
   if(nego->context && nego->status == GSS_S_COMPLETE) {
     /* We finished successfully our part of authentication, but server
diff --git a/deps/curl/lib/vauth/spnego_sspi.c b/deps/curl/lib/vauth/spnego_sspi.c
index c19a1ff4236..9c481252612 100644
--- a/deps/curl/lib/vauth/spnego_sspi.c
+++ b/deps/curl/lib/vauth/spnego_sspi.c
@@ -107,8 +107,8 @@ CURLcode Curl_auth_decode_spnego_message(struct Curl_easy *data,
   unsigned long attrs;
   TimeStamp expiry; /* For Windows 9x compatibility of SSPI calls */
 
-#if defined(CURL_DISABLE_VERBOSE_STRINGS)
-  (void) data;
+#ifdef CURL_DISABLE_VERBOSE_STRINGS
+  (void)data;
 #endif
 
   if(nego->context && nego->status == SEC_E_OK) {
diff --git a/deps/curl/lib/vauth/vauth.c b/deps/curl/lib/vauth/vauth.c
index 7a85b7041f6..1b44aa6de1a 100644
--- a/deps/curl/lib/vauth/vauth.c
+++ b/deps/curl/lib/vauth/vauth.c
@@ -54,7 +54,7 @@
  *
  * Returns a pointer to the newly allocated SPN.
  */
-#if !defined(USE_WINDOWS_SSPI)
+#ifndef USE_WINDOWS_SSPI
 char *Curl_auth_build_spn(const char *service, const char *host,
                           const char *realm)
 {
@@ -79,7 +79,7 @@ TCHAR *Curl_auth_build_spn(const char *service, const char *host,
   TCHAR *tchar_spn = NULL;
   TCHAR *dupe_tchar_spn = NULL;
 
-  (void) realm;
+  (void)realm;
 
   /* Note: We could use DsMakeSPN() or DsClientMakeSpnForTargetServer() rather
      than doing this ourselves but the first is only available in Windows XP
diff --git a/deps/curl/lib/vauth/vauth.h b/deps/curl/lib/vauth/vauth.h
index 7d085e33fdb..d9e73a0ed12 100644
--- a/deps/curl/lib/vauth/vauth.h
+++ b/deps/curl/lib/vauth/vauth.h
@@ -32,11 +32,11 @@
 struct Curl_easy;
 struct connectdata;
 
-#if !defined(CURL_DISABLE_DIGEST_AUTH)
+#ifndef CURL_DISABLE_DIGEST_AUTH
 struct digestdata;
 #endif
 
-#if defined(USE_NTLM)
+#ifdef USE_NTLM
 struct ntlmdata;
 #endif
 
@@ -44,7 +44,7 @@ struct ntlmdata;
 struct negotiatedata;
 #endif
 
-#if defined(USE_GSASL)
+#ifdef USE_GSASL
 struct gsasldata;
 #endif
 
@@ -60,7 +60,7 @@ struct gsasldata;
 bool Curl_auth_allowed_to_host(struct Curl_easy *data);
 
 /* This is used to build an SPN string */
-#if !defined(USE_WINDOWS_SSPI)
+#ifndef USE_WINDOWS_SSPI
 char *Curl_auth_build_spn(const char *service, const char *host,
                           const char *realm);
 #else
@@ -153,7 +153,7 @@ CURLcode Curl_auth_gsasl_token(struct Curl_easy *data,
 void Curl_auth_gsasl_cleanup(struct gsasldata *digest);
 #endif
 
-#if defined(USE_NTLM)
+#ifdef USE_NTLM
 
 /* meta key for storing NTML meta at connection */
 #define CURL_META_NTLM_CONN   "meta:auth:ntml:conn"
@@ -231,7 +231,7 @@ CURLcode Curl_auth_create_xoauth_bearer_message(const char *user,
                                                 const char *bearer,
                                                 struct bufref *out);
 
-#if defined(USE_KERBEROS5)
+#ifdef USE_KERBEROS5
 
 #ifdef HAVE_GSSAPI
 # ifdef HAVE_GSSGNU
@@ -250,7 +250,7 @@ CURLcode Curl_auth_create_xoauth_bearer_message(const char *user,
 #define CURL_META_KRB5_CONN   "meta:auth:krb5:conn"
 
 struct kerberos5data {
-#if defined(USE_WINDOWS_SSPI)
+#ifdef USE_WINDOWS_SSPI
   CredHandle *credentials;
   CtxtHandle *context;
   TCHAR *spn;
diff --git a/deps/curl/lib/version.c b/deps/curl/lib/version.c
index bf4c76d016c..a2d48672009 100644
--- a/deps/curl/lib/version.c
+++ b/deps/curl/lib/version.c
@@ -197,10 +197,10 @@ char *curl_version(void)
 #ifdef USE_SSH
   char ssh_version[30];
 #endif
-#ifdef USE_NGHTTP2
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGHTTP2)
   char h2_version[30];
 #endif
-#ifdef USE_HTTP3
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
   char h3_version[30];
 #endif
 #ifdef USE_LIBRTMP
@@ -258,11 +258,11 @@ char *curl_version(void)
   Curl_ssh_version(ssh_version, sizeof(ssh_version));
   src[i++] = ssh_version;
 #endif
-#ifdef USE_NGHTTP2
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGHTTP2)
   Curl_http2_ver(h2_version, sizeof(h2_version));
   src[i++] = h2_version;
 #endif
-#ifdef USE_HTTP3
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
   Curl_quic_ver(h3_version, sizeof(h3_version));
   src[i++] = h3_version;
 #endif
@@ -428,7 +428,7 @@ static int idn_present(curl_version_info_data *info)
   !defined(CURL_DISABLE_HTTP)
 static int https_proxy_present(curl_version_info_data *info)
 {
-  (void) info;
+  (void)info;
   return Curl_ssl_supports(NULL, SSLSUPP_HTTPS_PROXY);
 }
 #endif
@@ -436,7 +436,7 @@ static int https_proxy_present(curl_version_info_data *info)
 #if defined(USE_SSL) && defined(USE_ECH)
 static int ech_present(curl_version_info_data *info)
 {
-  (void) info;
+  (void)info;
   return Curl_ssl_supports(NULL, SSLSUPP_ECH);
 }
 #endif
@@ -488,17 +488,17 @@ static const struct feat features_table[] = {
 #ifndef CURL_DISABLE_HSTS
   FEATURE("HSTS",        NULL,                CURL_VERSION_HSTS),
 #endif
-#if defined(USE_NGHTTP2)
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGHTTP2)
   FEATURE("HTTP2",       NULL,                CURL_VERSION_HTTP2),
 #endif
-#if defined(USE_HTTP3)
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
   FEATURE("HTTP3",       NULL,                CURL_VERSION_HTTP3),
 #endif
 #if defined(USE_SSL) && !defined(CURL_DISABLE_PROXY) && \
   !defined(CURL_DISABLE_HTTP)
   FEATURE("HTTPS-proxy", https_proxy_present, CURL_VERSION_HTTPS_PROXY),
 #endif
-#if defined(USE_HTTPSRR)
+#ifdef USE_HTTPSRR
   FEATURE("HTTPSRR",     NULL,                0),
 #endif
 #if defined(USE_LIBIDN2) || defined(USE_WIN32_IDN) || defined(USE_APPLE_IDN)
@@ -523,7 +523,7 @@ static const struct feat features_table[] = {
 #ifdef USE_NTLM
   FEATURE("NTLM",        NULL,                CURL_VERSION_NTLM),
 #endif
-#if defined(USE_LIBPSL)
+#ifdef USE_LIBPSL
   FEATURE("PSL",         NULL,                CURL_VERSION_PSL),
 #endif
 #ifdef USE_SPNEGO
@@ -532,7 +532,7 @@ static const struct feat features_table[] = {
 #ifdef USE_SSL
   FEATURE("SSL",         NULL,                CURL_VERSION_SSL),
 #endif
-#if defined(USE_SSLS_EXPORT)
+#ifdef USE_SSLS_EXPORT
   FEATURE("SSLS-EXPORT", NULL,                0),
 #endif
 #ifdef USE_WINDOWS_SSPI
@@ -607,7 +607,7 @@ curl_version_info_data *curl_version_info(CURLversion stamp)
   const struct feat *p;
   int features = 0;
 
-#if defined(USE_SSH)
+#ifdef USE_SSH
   static char ssh_buf[80];  /* 'ssh_buffer' clashes with libssh/libssh.h */
 #endif
 #ifdef USE_SSL
@@ -624,7 +624,7 @@ curl_version_info_data *curl_version_info(CURLversion stamp)
   static char zstd_buffer[80];
 #endif
 
-  (void)stamp; /* avoid compiler warnings, we do not use this */
+  (void)stamp;
 
 #ifdef USE_SSL
   Curl_ssl_version(ssl_buffer, sizeof(ssl_buffer));
@@ -648,7 +648,7 @@ curl_version_info_data *curl_version_info(CURLversion stamp)
   version_info.libidn = idn2_check_version(IDN2_VERSION);
 #endif
 
-#if defined(USE_SSH)
+#ifdef USE_SSH
   Curl_ssh_version(ssh_buf, sizeof(ssh_buf));
   version_info.libssh_version = ssh_buf;
 #endif
@@ -673,7 +673,7 @@ curl_version_info_data *curl_version_info(CURLversion stamp)
   }
 #endif
 
-#ifdef USE_HTTP3
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
   {
     static char quicbuffer[80];
     Curl_quic_ver(quicbuffer, sizeof(quicbuffer));
diff --git a/deps/curl/lib/vquic/curl_msh3.c b/deps/curl/lib/vquic/curl_msh3.c
deleted file mode 100644
index 6566447ba10..00000000000
--- a/deps/curl/lib/vquic/curl_msh3.c
+++ /dev/null
@@ -1,1095 +0,0 @@
-/***************************************************************************
- *                                  _   _ ____  _
- *  Project                     ___| | | |  _ \| |
- *                             / __| | | | |_) | |
- *                            | (__| |_| |  _ <| |___
- *                             \___|\___/|_| \_\_____|
- *
- * Copyright (C) Daniel Stenberg, <daniel@haxx.se>, et al.
- *
- * This software is licensed as described in the file COPYING, which
- * you should have received as part of this distribution. The terms
- * are also available at https://curl.se/docs/copyright.html.
- *
- * You may opt to use, copy, modify, merge, publish, distribute and/or sell
- * copies of the Software, and permit persons to whom the Software is
- * furnished to do so, under the terms of the COPYING file.
- *
- * This software is distributed on an "AS IS" basis, WITHOUT WARRANTY OF ANY
- * KIND, either express or implied.
- *
- * SPDX-License-Identifier: curl
- *
- ***************************************************************************/
-
-#include "../curl_setup.h"
-
-#ifdef USE_MSH3
-
-#include "../urldata.h"
-#include "../hash.h"
-#include "../uint-hash.h"
-#include "../curlx/timeval.h"
-#include "../multiif.h"
-#include "../sendf.h"
-#include "../curl_trc.h"
-#include "../cfilters.h"
-#include "../cf-socket.h"
-#include "../connect.h"
-#include "../progress.h"
-#include "../http1.h"
-#include "curl_msh3.h"
-#include "../socketpair.h"
-#include "../vtls/vtls.h"
-#include "vquic.h"
-#include "vquic_int.h"
-
-/* The last 3 #include files should be in this order */
-#include "../curl_printf.h"
-#include "../curl_memory.h"
-#include "../memdebug.h"
-
-#ifdef CURL_DISABLE_SOCKETPAIR
-#error "MSH3 cannot be build with CURL_DISABLE_SOCKETPAIR set"
-#endif
-
-#define H3_STREAM_WINDOW_SIZE (128 * 1024)
-#define H3_STREAM_CHUNK_SIZE   (16 * 1024)
-#define H3_STREAM_RECV_CHUNKS \
-          (H3_STREAM_WINDOW_SIZE / H3_STREAM_CHUNK_SIZE)
-
-#ifdef _WIN32
-#define msh3_lock CRITICAL_SECTION
-#define msh3_lock_initialize(lock) InitializeCriticalSection(lock)
-#define msh3_lock_uninitialize(lock) DeleteCriticalSection(lock)
-#define msh3_lock_acquire(lock) EnterCriticalSection(lock)
-#define msh3_lock_release(lock) LeaveCriticalSection(lock)
-#else /* !_WIN32 */
-#include <pthread.h>
-#define msh3_lock pthread_mutex_t
-#define msh3_lock_initialize(lock) do { \
-  pthread_mutexattr_t attr; \
-  pthread_mutexattr_init(&attr); \
-  pthread_mutexattr_settype(&attr, PTHREAD_MUTEX_RECURSIVE); \
-  pthread_mutex_init(lock, &attr); \
-  pthread_mutexattr_destroy(&attr); \
-} while(0)
-#define msh3_lock_uninitialize(lock) pthread_mutex_destroy(lock)
-#define msh3_lock_acquire(lock) pthread_mutex_lock(lock)
-#define msh3_lock_release(lock) pthread_mutex_unlock(lock)
-#endif /* _WIN32 */
-
-
-static void MSH3_CALL msh3_conn_connected(MSH3_CONNECTION *Connection,
-                                          void *IfContext);
-static void MSH3_CALL msh3_conn_shutdown_complete(MSH3_CONNECTION *Connection,
-                                                  void *IfContext);
-static void MSH3_CALL msh3_conn_new_request(MSH3_CONNECTION *Connection,
-                                            void *IfContext,
-                                            MSH3_REQUEST *Request);
-static void MSH3_CALL msh3_header_received(MSH3_REQUEST *Request,
-                                           void *IfContext,
-                                           const MSH3_HEADER *Header);
-static bool MSH3_CALL msh3_data_received(MSH3_REQUEST *Request,
-                                         void *IfContext, uint32_t *Length,
-                                         const uint8_t *Data);
-static void MSH3_CALL msh3_complete(MSH3_REQUEST *Request, void *IfContext,
-                                    bool Aborted, uint64_t AbortError);
-static void MSH3_CALL msh3_shutdown_complete(MSH3_REQUEST *Request,
-                                             void *IfContext);
-static void MSH3_CALL msh3_data_sent(MSH3_REQUEST *Request,
-                                     void *IfContext, void *SendContext);
-
-
-void Curl_msh3_ver(char *p, size_t len)
-{
-  uint32_t v[4];
-  MsH3Version(v);
-  (void)msnprintf(p, len, "msh3/%d.%d.%d.%d", v[0], v[1], v[2], v[3]);
-}
-
-#define SP_LOCAL   0
-#define SP_REMOTE  1
-
-struct cf_msh3_ctx {
-  MSH3_API *api;
-  MSH3_CONNECTION *qconn;
-  struct Curl_sockaddr_ex addr;
-  curl_socket_t sock[2]; /* fake socket pair until we get support in msh3 */
-  char l_ip[MAX_IPADR_LEN];          /* local IP as string */
-  int l_port;                        /* local port number */
-  struct cf_call_data call_data;
-  struct curltime connect_started;   /* time the current attempt started */
-  struct curltime handshake_at;      /* time connect handshake finished */
-  struct uint_hash streams;          /* hash `data->mid` to `stream_ctx` */
-  /* Flags written by msh3/msquic thread */
-  BIT(handshake_complete);
-  BIT(handshake_succeeded);
-  BIT(connected);
-  BIT(initialized);
-  /* Flags written by curl thread */
-  BIT(verbose);
-  BIT(active);
-};
-
-static void h3_stream_hash_free(unsigned int id, void *stream);
-
-static CURLcode cf_msh3_ctx_init(struct cf_msh3_ctx *ctx,
-                                 const struct Curl_addrinfo *ai)
-{
-  CURLcode result;
-
-  DEBUGASSERT(!ctx->initialized);
-  Curl_uint_hash_init(&ctx->streams, 63, h3_stream_hash_free);
-
-  result = Curl_sock_assign_addr(&ctx->addr, ai, TRNSPRT_QUIC);
-  if(result)
-    return result;
-
-  ctx->sock[SP_LOCAL] = CURL_SOCKET_BAD;
-  ctx->sock[SP_REMOTE] = CURL_SOCKET_BAD;
-  ctx->initialized = TRUE;
-
-  return result;
-}
-
-static void cf_msh3_ctx_free(struct cf_msh3_ctx *ctx)
-{
-  if(ctx && ctx->initialized) {
-    Curl_uint_hash_destroy(&ctx->streams);
-  }
-  free(ctx);
-}
-
-static struct cf_msh3_ctx *h3_get_msh3_ctx(struct Curl_easy *data);
-
-/* How to access `call_data` from a cf_msh3 filter */
-#undef CF_CTX_CALL_DATA
-#define CF_CTX_CALL_DATA(cf)  \
-  ((struct cf_msh3_ctx *)(cf)->ctx)->call_data
-
-/**
- * All about the H3 internals of a stream
- */
-struct h3_stream_ctx {
-  struct MSH3_REQUEST *req;
-  struct bufq recvbuf;   /* h3 response */
-#ifdef _WIN32
-  CRITICAL_SECTION recv_lock;
-#else /* !_WIN32 */
-  pthread_mutex_t recv_lock;
-#endif /* _WIN32 */
-  uint64_t error3; /* HTTP/3 stream error code */
-  int status_code; /* HTTP status code */
-  CURLcode recv_error;
-  BIT(closed);
-  BIT(reset);
-  BIT(upload_done);
-  BIT(firstheader);  /* FALSE until headers arrive */
-  BIT(recv_header_complete);
-};
-
-static void h3_stream_ctx_free(struct h3_stream_ctx *stream)
-{
-  Curl_bufq_free(&stream->recvbuf);
-  free(stream);
-}
-
-static void h3_stream_hash_free(unsigned int id, void *stream)
-{
-  (void)id;
-  DEBUGASSERT(stream);
-  h3_stream_ctx_free((struct h3_stream_ctx *)stream);
-}
-
-static CURLcode h3_data_setup(struct Curl_cfilter *cf,
-                              struct Curl_easy *data)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-
-  if(stream)
-    return CURLE_OK;
-
-  stream = calloc(1, sizeof(*stream));
-  if(!stream)
-    return CURLE_OUT_OF_MEMORY;
-
-  stream->req = ZERO_NULL;
-  msh3_lock_initialize(&stream->recv_lock);
-  Curl_bufq_init2(&stream->recvbuf, H3_STREAM_CHUNK_SIZE,
-                  H3_STREAM_RECV_CHUNKS, BUFQ_OPT_SOFT_LIMIT);
-  CURL_TRC_CF(data, cf, "data setup");
-
-  if(!Curl_uint_hash_set(&ctx->streams, data->mid, stream)) {
-    h3_stream_ctx_free(stream);
-    return CURLE_OUT_OF_MEMORY;
-  }
-
-  return CURLE_OK;
-}
-
-static void h3_data_done(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-
-  (void)cf;
-  if(stream) {
-    CURL_TRC_CF(data, cf, "easy handle is done");
-    Curl_uint_hash_remove(&ctx->streams, data->mid);
-  }
-}
-
-static void drain_stream_from_other_thread(struct Curl_easy *data,
-                                           struct h3_stream_ctx *stream)
-{
-  (void)data;
-  (void)stream;
-  /* cannot expire from other thread.
-     here is the disconnect between msh3 and curl */
-}
-
-static void h3_drain_stream(struct Curl_cfilter *cf,
-                            struct Curl_easy *data)
-{
-  (void)cf;
-  Curl_multi_mark_dirty(data);
-}
-
-static const MSH3_CONNECTION_IF msh3_conn_if = {
-  msh3_conn_connected,
-  msh3_conn_shutdown_complete,
-  msh3_conn_new_request
-};
-
-static void MSH3_CALL msh3_conn_connected(MSH3_CONNECTION *Connection,
-                                          void *IfContext)
-{
-  struct Curl_cfilter *cf = IfContext;
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct Curl_easy *data = CF_DATA_CURRENT(cf);
-  (void)Connection;
-
-  CURL_TRC_CF(data, cf, "[MSH3] connected");
-  ctx->handshake_succeeded = TRUE;
-  ctx->connected = TRUE;
-  ctx->handshake_complete = TRUE;
-}
-
-static void MSH3_CALL msh3_conn_shutdown_complete(MSH3_CONNECTION *Connection,
-                                                  void *IfContext)
-{
-  struct Curl_cfilter *cf = IfContext;
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct Curl_easy *data = CF_DATA_CURRENT(cf);
-
-  (void)Connection;
-  CURL_TRC_CF(data, cf, "[MSH3] shutdown complete");
-  ctx->connected = FALSE;
-  ctx->handshake_complete = TRUE;
-}
-
-static void MSH3_CALL msh3_conn_new_request(MSH3_CONNECTION *Connection,
-                                            void *IfContext,
-                                            MSH3_REQUEST *Request)
-{
-  (void)Connection;
-  (void)IfContext;
-  (void)Request;
-}
-
-static const MSH3_REQUEST_IF msh3_request_if = {
-  msh3_header_received,
-  msh3_data_received,
-  msh3_complete,
-  msh3_shutdown_complete,
-  msh3_data_sent
-};
-
-/* Decode HTTP status code. Returns -1 if no valid status code was
-   decoded. (duplicate from http2.c) */
-static int decode_status_code(const char *value, size_t len)
-{
-  int i;
-  int res;
-
-  if(len != 3) {
-    return -1;
-  }
-
-  res = 0;
-
-  for(i = 0; i < 3; ++i) {
-    char c = value[i];
-
-    if(c < '0' || c > '9') {
-      return -1;
-    }
-
-    res *= 10;
-    res += c - '0';
-  }
-
-  return res;
-}
-
-/*
- * write_resp_raw() copies response data in raw format to the `data`'s
-  * receive buffer. If not enough space is available, it appends to the
- * `data`'s overflow buffer.
- */
-static CURLcode write_resp_raw(struct Curl_easy *data,
-                               const void *mem, size_t memlen)
-{
-  struct cf_msh3_ctx *ctx = h3_get_msh3_ctx(data);
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-  CURLcode result = CURLE_OK;
-  size_t nwritten;
-
-  if(!stream)
-    return CURLE_RECV_ERROR;
-
-  result = Curl_bufq_write(&stream->recvbuf, mem, memlen, &nwritten);
-  if(result)
-    return result;
-
-  if(nwritten < memlen) {
-    /* This MUST not happen. Our recbuf is dimensioned to hold the
-     * full max_stream_window and then some for this very reason. */
-    DEBUGASSERT(0);
-    return CURLE_RECV_ERROR;
-  }
-  return result;
-}
-
-static void MSH3_CALL msh3_header_received(MSH3_REQUEST *Request,
-                                           void *userp,
-                                           const MSH3_HEADER *hd)
-{
-  struct Curl_easy *data = userp;
-  struct cf_msh3_ctx *ctx = h3_get_msh3_ctx(data);
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-  CURLcode result;
-  (void)Request;
-
-  DEBUGF(infof(data, "[MSH3] header received, stream=%d", !!stream));
-  if(!stream || stream->recv_header_complete) {
-    return;
-  }
-
-  msh3_lock_acquire(&stream->recv_lock);
-
-  if((hd->NameLength == 7) &&
-     !strncmp(HTTP_PSEUDO_STATUS, (const char *)hd->Name, 7)) {
-    char line[14]; /* status line is always 13 characters long */
-    size_t ncopy;
-
-    DEBUGASSERT(!stream->firstheader);
-    stream->status_code = decode_status_code(hd->Value, hd->ValueLength);
-    DEBUGASSERT(stream->status_code != -1);
-    ncopy = msnprintf(line, sizeof(line), "HTTP/3 %03d \r\n",
-                      stream->status_code);
-    result = write_resp_raw(data, line, ncopy);
-    if(result)
-      stream->recv_error = result;
-    stream->firstheader = TRUE;
-  }
-  else {
-    /* store as an HTTP1-style header */
-    DEBUGASSERT(stream->firstheader);
-    result = write_resp_raw(data, hd->Name, hd->NameLength);
-    if(!result)
-      result = write_resp_raw(data, ": ", 2);
-    if(!result)
-      result = write_resp_raw(data, hd->Value, hd->ValueLength);
-    if(!result)
-      result = write_resp_raw(data, "\r\n", 2);
-    if(result) {
-      stream->recv_error = result;
-    }
-  }
-
-  drain_stream_from_other_thread(data, stream);
-  msh3_lock_release(&stream->recv_lock);
-}
-
-static bool MSH3_CALL msh3_data_received(MSH3_REQUEST *Request,
-                                         void *IfContext, uint32_t *buflen,
-                                         const uint8_t *buf)
-{
-  struct Curl_easy *data = IfContext;
-  struct cf_msh3_ctx *ctx = h3_get_msh3_ctx(data);
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-  CURLcode result;
-  bool rv = FALSE;
-
-  /* We would like to limit the amount of data we are buffer here. There seems
-   * to be no mechanism in msh3 to adjust flow control and it is undocumented
-   * what happens if we return FALSE here or less length (buflen is an inout
-   * parameter).
-   */
-  (void)Request;
-  if(!stream)
-    return FALSE;
-
-  msh3_lock_acquire(&stream->recv_lock);
-
-  if(!stream->recv_header_complete) {
-    result = write_resp_raw(data, "\r\n", 2);
-    if(result) {
-      stream->recv_error = result;
-      goto out;
-    }
-    stream->recv_header_complete = TRUE;
-  }
-
-  result = write_resp_raw(data, buf, *buflen);
-  if(result) {
-    stream->recv_error = result;
-  }
-  rv = TRUE;
-
-out:
-  msh3_lock_release(&stream->recv_lock);
-  return rv;
-}
-
-static void MSH3_CALL msh3_complete(MSH3_REQUEST *Request, void *IfContext,
-                                    bool aborted, uint64_t error)
-{
-  struct Curl_easy *data = IfContext;
-  struct cf_msh3_ctx *ctx = h3_get_msh3_ctx(data);
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-
-  (void)Request;
-  if(!stream)
-    return;
-  msh3_lock_acquire(&stream->recv_lock);
-  stream->closed = TRUE;
-  stream->recv_header_complete = TRUE;
-  if(error)
-    stream->error3 = error;
-  if(aborted)
-    stream->reset = TRUE;
-  msh3_lock_release(&stream->recv_lock);
-}
-
-static void MSH3_CALL msh3_shutdown_complete(MSH3_REQUEST *Request,
-                                             void *IfContext)
-{
-  struct Curl_easy *data = IfContext;
-  struct cf_msh3_ctx *ctx = h3_get_msh3_ctx(data);
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-
-  if(!stream)
-    return;
-  (void)Request;
-  (void)stream;
-}
-
-static void MSH3_CALL msh3_data_sent(MSH3_REQUEST *Request,
-                                     void *IfContext, void *SendContext)
-{
-  struct Curl_easy *data = IfContext;
-  struct cf_msh3_ctx *ctx = h3_get_msh3_ctx(data);
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-  if(!stream)
-    return;
-  (void)Request;
-  (void)stream;
-  (void)SendContext;
-}
-
-static CURLcode recv_closed_stream(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data,
-                                   size_t *pnread)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-
-  (void)cf;
-  *pnread = 0;
-  if(!stream)
-    return CURLE_RECV_ERROR;
-
-  if(stream->reset) {
-    failf(data, "HTTP/3 stream reset by server");
-    CURL_TRC_CF(data, cf, "cf_recv, was reset");
-    return CURLE_PARTIAL_FILE;
-  }
-  else if(stream->error3) {
-    failf(data, "HTTP/3 stream was not closed cleanly: (error %zd)",
-          (ssize_t)stream->error3);
-    CURL_TRC_CF(data, cf, "cf_recv, closed uncleanly");
-    return CURLE_HTTP3;
-  }
-  else {
-    CURL_TRC_CF(data, cf, "cf_recv, closed ok");
-  }
-  return CURLE_OK;
-}
-
-static void set_quic_expire(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-
-  /* we have no indication from msh3 when it would be a good time
-   * to juggle the connection again. So, we compromise by calling
-   * us again every some milliseconds. */
-  (void)cf;
-  if(stream && stream->req && !stream->closed) {
-    Curl_expire(data, 10, EXPIRE_QUIC);
-  }
-  else {
-    Curl_expire(data, 50, EXPIRE_QUIC);
-  }
-}
-
-static CURLcode cf_msh3_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
-                             char *buf, size_t len, size_t *pnread)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-  struct cf_call_data save;
-  CURLcode result = CURLE_OK;
-
-  *pnread = 0;
-  CURL_TRC_CF(data, cf, "cf_recv(len=%zu), stream=%d", len, !!stream);
-  if(!stream)
-    return CURLE_RECV_ERROR;
-  CF_DATA_SAVE(save, cf, data);
-
-  msh3_lock_acquire(&stream->recv_lock);
-
-  if(stream->recv_error) {
-    failf(data, "request aborted");
-    result = stream->recv_error;
-    goto out;
-  }
-
-  if(!Curl_bufq_is_empty(&stream->recvbuf)) {
-    result = Curl_bufq_cread(&stream->recvbuf, buf, len, pnread);
-    CURL_TRC_CF(data, cf, "read recvbuf(len=%zu) -> %d, %zu",
-                len, result, *pnread);
-    if(result)
-      goto out;
-    if(stream->closed)
-      h3_drain_stream(cf, data);
-  }
-  else if(stream->closed) {
-    result = recv_closed_stream(cf, data, pnread);
-    goto out;
-  }
-  else {
-    CURL_TRC_CF(data, cf, "req: nothing here, call again");
-    result = CURLE_AGAIN;
-  }
-
-out:
-  msh3_lock_release(&stream->recv_lock);
-  set_quic_expire(cf, data);
-  CF_DATA_RESTORE(cf, save);
-  return result;
-}
-
-static CURLcode cf_msh3_send(struct Curl_cfilter *cf, struct Curl_easy *data,
-                             const void *buf, size_t len, bool eos,
-                             size_t *pnwritten)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-  struct h1_req_parser h1;
-  struct dynhds h2_headers;
-  MSH3_HEADER *nva = NULL;
-  size_t nheader, i;
-  ssize_t nwritten = -1;
-  struct cf_call_data save;
-  CURLcode result = CURLE_OK;
-
-  *pnwritten = 0;
-  CF_DATA_SAVE(save, cf, data);
-
-  Curl_h1_req_parse_init(&h1, H1_PARSE_DEFAULT_MAX_LINE_LEN);
-  Curl_dynhds_init(&h2_headers, 0, DYN_HTTP_REQUEST);
-
-  /* Sizes must match for cast below to work" */
-  DEBUGASSERT(stream);
-  CURL_TRC_CF(data, cf, "req: send %zu bytes", len);
-
-  if(!stream->req) {
-    /* The first send on the request contains the headers and possibly some
-       data. Parse out the headers and create the request, then if there is
-       any data left over go ahead and send it too. */
-    nwritten = Curl_h1_req_parse_read(&h1, buf, len, NULL, 0, &result);
-    if(nwritten < 0)
-      goto out;
-    DEBUGASSERT(h1.done);
-    DEBUGASSERT(h1.req);
-    *pnwritten = (size_t)nwritten;
-
-    result = Curl_http_req_to_h2(&h2_headers, h1.req, data);
-    if(result)
-      goto out;
-
-    nheader = Curl_dynhds_count(&h2_headers);
-    nva = malloc(sizeof(MSH3_HEADER) * nheader);
-    if(!nva) {
-      result = CURLE_OUT_OF_MEMORY;
-      goto out;
-    }
-
-    for(i = 0; i < nheader; ++i) {
-      struct dynhds_entry *e = Curl_dynhds_getn(&h2_headers, i);
-      nva[i].Name = e->name;
-      nva[i].NameLength = e->namelen;
-      nva[i].Value = e->value;
-      nva[i].ValueLength = e->valuelen;
-    }
-
-    CURL_TRC_CF(data, cf, "req: send %zu headers", nheader);
-    stream->req = MsH3RequestOpen(ctx->qconn, &msh3_request_if, data,
-                                  nva, nheader,
-                                  eos ? MSH3_REQUEST_FLAG_FIN :
-                                  MSH3_REQUEST_FLAG_NONE);
-    if(!stream->req) {
-      failf(data, "request open failed");
-      result = CURLE_SEND_ERROR;
-    }
-    result = CURLE_OK;
-    *pnwritten = len;
-    goto out;
-  }
-  else {
-    /* request is open */
-    CURL_TRC_CF(data, cf, "req: send %zu body bytes", len);
-    if(len > 0xFFFFFFFF) {
-      len = 0xFFFFFFFF;
-    }
-
-    if(!MsH3RequestSend(stream->req, MSH3_REQUEST_FLAG_NONE, buf,
-                        (uint32_t)len, stream)) {
-      result = CURLE_SEND_ERROR;
-      goto out;
-    }
-
-    /* msh3/msquic will hold onto this memory until the send complete event.
-       How do we make sure curl does not free it until then? */
-    result = CURLE_OK;
-    *pnwritten = len;
-  }
-
-out:
-  set_quic_expire(cf, data);
-  free(nva);
-  Curl_h1_req_parse_free(&h1);
-  Curl_dynhds_free(&h2_headers);
-  CF_DATA_RESTORE(cf, save);
-  return result;
-}
-
-static void cf_msh3_adjust_pollset(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data,
-                                   struct easy_pollset *ps)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-  struct cf_call_data save;
-
-  CF_DATA_SAVE(save, cf, data);
-  if(stream && ctx->sock[SP_LOCAL] != CURL_SOCKET_BAD) {
-    if(stream->recv_error) {
-      Curl_pollset_add_in(data, ps, ctx->sock[SP_LOCAL]);
-      h3_drain_stream(cf, data);
-    }
-    else if(stream->req) {
-      Curl_pollset_add_out(data, ps, ctx->sock[SP_LOCAL]);
-      h3_drain_stream(cf, data);
-    }
-  }
-}
-
-static bool cf_msh3_data_pending(struct Curl_cfilter *cf,
-                                 const struct Curl_easy *data)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-  struct cf_call_data save;
-  bool pending = FALSE;
-
-  CF_DATA_SAVE(save, cf, data);
-
-  (void)cf;
-  if(stream && stream->req) {
-    msh3_lock_acquire(&stream->recv_lock);
-    CURL_TRC_CF((struct Curl_easy *)CURL_UNCONST(data), cf,
-                "data pending = %zu",
-                Curl_bufq_len(&stream->recvbuf));
-    pending = !Curl_bufq_is_empty(&stream->recvbuf);
-    msh3_lock_release(&stream->recv_lock);
-    if(pending)
-      h3_drain_stream(cf, (struct Curl_easy *)CURL_UNCONST(data));
-  }
-
-  CF_DATA_RESTORE(cf, save);
-  return pending;
-}
-
-static CURLcode h3_data_pause(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              bool pause)
-{
-  if(!pause) {
-    h3_drain_stream(cf, data);
-    Curl_expire(data, 0, EXPIRE_RUN_NOW);
-  }
-  return CURLE_OK;
-}
-
-static CURLcode cf_msh3_data_event(struct Curl_cfilter *cf,
-                                   struct Curl_easy *data,
-                                   int event, int arg1, void *arg2)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct h3_stream_ctx *stream = H3_STREAM_CTX(ctx, data);
-  struct cf_call_data save;
-  CURLcode result = CURLE_OK;
-
-  CF_DATA_SAVE(save, cf, data);
-
-  (void)arg1;
-  (void)arg2;
-  switch(event) {
-  case CF_CTRL_DATA_SETUP:
-    result = h3_data_setup(cf, data);
-    break;
-  case CF_CTRL_DATA_PAUSE:
-    result = h3_data_pause(cf, data, (arg1 != 0));
-    break;
-  case CF_CTRL_DATA_DONE:
-    h3_data_done(cf, data);
-    break;
-  case CF_CTRL_DATA_DONE_SEND:
-    CURL_TRC_CF(data, cf, "req: send done");
-    if(stream) {
-      stream->upload_done = TRUE;
-      if(stream->req) {
-        char buf[1];
-        if(!MsH3RequestSend(stream->req, MSH3_REQUEST_FLAG_FIN,
-                            buf, 0, data)) {
-          result = CURLE_SEND_ERROR;
-        }
-      }
-    }
-    break;
-  default:
-    break;
-  }
-
-  CF_DATA_RESTORE(cf, save);
-  return result;
-}
-
-static CURLcode cf_connect_start(struct Curl_cfilter *cf,
-                                 struct Curl_easy *data)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct ssl_primary_config *conn_config;
-  MSH3_ADDR addr = {0};
-  CURLcode result;
-  bool verify;
-
-  DEBUGASSERT(ctx->initialized);
-  conn_config = Curl_ssl_cf_get_primary_config(cf);
-  if(!conn_config)
-    return CURLE_FAILED_INIT;
-  verify = !!conn_config->verifypeer;
-
-  memcpy(&addr, &ctx->addr.curl_sa_addr, ctx->addr.addrlen);
-  MSH3_SET_PORT(&addr, (uint16_t)cf->conn->remote_port);
-
-  if(verify && (conn_config->CAfile || conn_config->CApath)) {
-    /* Note there's currently no way to provide trust anchors to MSH3 and
-       that causes tests to fail. */
-    CURL_TRC_CF(data, cf, "non-standard CA not supported, "
-                "attempting with built-in verification");
-  }
-
-  CURL_TRC_CF(data, cf, "connecting to %s:%d (verify=%d)",
-              cf->conn->host.name, (int)cf->conn->remote_port, verify);
-
-  ctx->api = MsH3ApiOpen();
-  if(!ctx->api) {
-    failf(data, "cannot create msh3 api");
-    return CURLE_FAILED_INIT;
-  }
-
-  ctx->qconn = MsH3ConnectionOpen(ctx->api,
-                                  &msh3_conn_if,
-                                  cf,
-                                  cf->conn->host.name,
-                                  &addr,
-                                  !verify);
-  if(!ctx->qconn) {
-    failf(data, "cannot create msh3 connection");
-    if(ctx->api) {
-      MsH3ApiClose(ctx->api);
-      ctx->api = NULL;
-    }
-    return CURLE_FAILED_INIT;
-  }
-
-  result = h3_data_setup(cf, data);
-  if(result)
-    return result;
-
-  return CURLE_OK;
-}
-
-static CURLcode cf_msh3_connect(struct Curl_cfilter *cf,
-                                struct Curl_easy *data,
-                                bool *done)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct cf_call_data save;
-  CURLcode result = CURLE_OK;
-
-  if(cf->connected) {
-    *done = TRUE;
-    return CURLE_OK;
-  }
-
-  CF_DATA_SAVE(save, cf, data);
-
-  if(ctx->sock[SP_LOCAL] == CURL_SOCKET_BAD) {
-    if(Curl_socketpair(AF_UNIX, SOCK_STREAM, 0, &ctx->sock[0], FALSE) < 0) {
-      ctx->sock[SP_LOCAL] = CURL_SOCKET_BAD;
-      ctx->sock[SP_REMOTE] = CURL_SOCKET_BAD;
-      return CURLE_COULDNT_CONNECT;
-    }
-  }
-
-  *done = FALSE;
-  if(!ctx->qconn) {
-    ctx->connect_started = curlx_now();
-    result = cf_connect_start(cf, data);
-    if(result)
-      goto out;
-  }
-
-  if(ctx->handshake_complete) {
-    ctx->handshake_at = curlx_now();
-    if(ctx->handshake_succeeded) {
-      CURL_TRC_CF(data, cf, "handshake succeeded");
-      cf->conn->bits.multiplex = TRUE; /* at least potentially multiplexed */
-      cf->connected = TRUE;
-      cf->conn->alpn = CURL_HTTP_VERSION_3;
-      *done = TRUE;
-      connkeep(cf->conn, "HTTP/3 default");
-      Curl_pgrsTime(data, TIMER_APPCONNECT);
-    }
-    else {
-      failf(data, "failed to connect, handshake failed");
-      result = CURLE_COULDNT_CONNECT;
-    }
-  }
-
-out:
-  CF_DATA_RESTORE(cf, save);
-  return result;
-}
-
-static void cf_msh3_close(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-  struct cf_call_data save;
-
-  (void)data;
-  CF_DATA_SAVE(save, cf, data);
-
-  if(ctx) {
-    CURL_TRC_CF(data, cf, "destroying");
-    if(ctx->qconn) {
-      MsH3ConnectionClose(ctx->qconn);
-      ctx->qconn = NULL;
-    }
-    if(ctx->api) {
-      MsH3ApiClose(ctx->api);
-      ctx->api = NULL;
-    }
-
-    if(ctx->active) {
-      /* We share our socket at cf->conn->sock[cf->sockindex] when active.
-       * If it is no longer there, someone has stolen (and hopefully
-       * closed it) and we just forget about it.
-       */
-      ctx->active = FALSE;
-      if(ctx->sock[SP_LOCAL] == cf->conn->sock[cf->sockindex]) {
-        CURL_TRC_CF(data, cf, "cf_msh3_close(%d) active",
-                    (int)ctx->sock[SP_LOCAL]);
-        cf->conn->sock[cf->sockindex] = CURL_SOCKET_BAD;
-      }
-      else {
-        CURL_TRC_CF(data, cf, "cf_socket_close(%d) no longer at "
-                    "conn->sock[], discarding", (int)ctx->sock[SP_LOCAL]);
-        ctx->sock[SP_LOCAL] = CURL_SOCKET_BAD;
-      }
-    }
-    if(ctx->sock[SP_LOCAL] != CURL_SOCKET_BAD) {
-      sclose(ctx->sock[SP_LOCAL]);
-    }
-    if(ctx->sock[SP_REMOTE] != CURL_SOCKET_BAD) {
-      sclose(ctx->sock[SP_REMOTE]);
-    }
-    ctx->sock[SP_LOCAL] = CURL_SOCKET_BAD;
-    ctx->sock[SP_REMOTE] = CURL_SOCKET_BAD;
-  }
-  CF_DATA_RESTORE(cf, save);
-}
-
-static void cf_msh3_destroy(struct Curl_cfilter *cf, struct Curl_easy *data)
-{
-  struct cf_call_data save;
-
-  CF_DATA_SAVE(save, cf, data);
-  cf_msh3_close(cf, data);
-  if(cf->ctx) {
-    cf_msh3_ctx_free(cf->ctx);
-    cf->ctx = NULL;
-  }
-  /* no CF_DATA_RESTORE(cf, save); its gone */
-}
-
-static CURLcode cf_msh3_query(struct Curl_cfilter *cf,
-                              struct Curl_easy *data,
-                              int query, int *pres1, void *pres2)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-
-  switch(query) {
-  case CF_QUERY_MAX_CONCURRENT: {
-    /* We do not have access to this so far, fake it */
-    (void)ctx;
-    *pres1 = 100;
-    return CURLE_OK;
-  }
-  case CF_QUERY_TIMER_CONNECT: {
-    struct curltime *when = pres2;
-    /* we do not know when the first byte arrived */
-    if(cf->connected)
-      *when = ctx->handshake_at;
-    return CURLE_OK;
-  }
-  case CF_QUERY_TIMER_APPCONNECT: {
-    struct curltime *when = pres2;
-    if(cf->connected)
-      *when = ctx->handshake_at;
-    return CURLE_OK;
-  }
-  case CF_QUERY_HTTP_VERSION:
-    *pres1 = 30;
-    return CURLE_OK;
-  default:
-    break;
-  }
-  return cf->next ?
-    cf->next->cft->query(cf->next, data, query, pres1, pres2) :
-    CURLE_UNKNOWN_OPTION;
-}
-
-static bool cf_msh3_conn_is_alive(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  bool *input_pending)
-{
-  struct cf_msh3_ctx *ctx = cf->ctx;
-
-  (void)data;
-  *input_pending = FALSE;
-  return ctx && ctx->sock[SP_LOCAL] != CURL_SOCKET_BAD && ctx->qconn &&
-         ctx->connected;
-}
-
-struct Curl_cftype Curl_cft_http3 = {
-  "HTTP/3",
-  CF_TYPE_IP_CONNECT | CF_TYPE_SSL | CF_TYPE_MULTIPLEX | CF_TYPE_HTTP,
-  0,
-  cf_msh3_destroy,
-  cf_msh3_connect,
-  cf_msh3_close,
-  Curl_cf_def_shutdown,
-  cf_msh3_adjust_pollset,
-  cf_msh3_data_pending,
-  cf_msh3_send,
-  cf_msh3_recv,
-  cf_msh3_data_event,
-  cf_msh3_conn_is_alive,
-  Curl_cf_def_conn_keep_alive,
-  cf_msh3_query,
-};
-
-static struct cf_msh3_ctx *h3_get_msh3_ctx(struct Curl_easy *data)
-{
-  if(data && data->conn) {
-    struct Curl_cfilter *cf = data->conn->cfilter[FIRSTSOCKET];
-    while(cf) {
-      if(cf->cft == &Curl_cft_http3)
-        return cf->ctx;
-      cf = cf->next;
-    }
-  }
-  DEBUGF(infof(data, "no filter context found"));
-  return NULL;
-}
-
-CURLcode Curl_cf_msh3_create(struct Curl_cfilter **pcf,
-                             struct Curl_easy *data,
-                             struct connectdata *conn,
-                             const struct Curl_addrinfo *ai)
-{
-  struct cf_msh3_ctx *ctx = NULL;
-  struct Curl_cfilter *cf = NULL;
-  CURLcode result;
-
-  (void)data;
-  (void)conn;
-  (void)ai; /* msh3 resolves itself? */
-  ctx = calloc(1, sizeof(*ctx));
-  if(!ctx) {
-    result = CURLE_OUT_OF_MEMORY;
-    goto out;
-  }
-
-  result = cf_msh3_ctx_init(ctx, ai);
-  if(result)
-    goto out;
-
-  result = Curl_cf_create(&cf, &Curl_cft_http3, ctx);
-
-out:
-  *pcf = (!result) ? cf : NULL;
-  if(result) {
-    Curl_safefree(cf);
-    cf_msh3_ctx_free(ctx);
-  }
-
-  return result;
-}
-
-bool Curl_conn_is_msh3(const struct Curl_easy *data,
-                       const struct connectdata *conn,
-                       int sockindex)
-{
-  struct Curl_cfilter *cf = conn ? conn->cfilter[sockindex] : NULL;
-
-  (void)data;
-  for(; cf; cf = cf->next) {
-    if(cf->cft == &Curl_cft_http3)
-      return TRUE;
-    if(cf->cft->flags & CF_TYPE_IP_CONNECT)
-      return FALSE;
-  }
-  return FALSE;
-}
-
-#endif /* USE_MSH3 */
diff --git a/deps/curl/lib/vquic/curl_ngtcp2.c b/deps/curl/lib/vquic/curl_ngtcp2.c
index 69d54ecce28..6470f1506d1 100644
--- a/deps/curl/lib/vquic/curl_ngtcp2.c
+++ b/deps/curl/lib/vquic/curl_ngtcp2.c
@@ -24,7 +24,7 @@
 
 #include "../curl_setup.h"
 
-#if defined(USE_NGTCP2) && defined(USE_NGHTTP3)
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGTCP2) && defined(USE_NGHTTP3)
 #include <ngtcp2/ngtcp2.h>
 #include <nghttp3/nghttp3.h>
 
@@ -155,7 +155,7 @@ struct cf_ngtcp2_ctx {
   BIT(initialized);
   BIT(tls_handshake_complete);       /* TLS handshake is done */
   BIT(use_earlydata);                /* Using 0RTT data */
-  BIT(earlydata_accepted);           /* 0RTT was acceptd by server */
+  BIT(earlydata_accepted);           /* 0RTT was accepted by server */
   BIT(shutdown_started);             /* queued shutdown packets */
 };
 
@@ -431,9 +431,9 @@ static void quic_settings(struct cf_ngtcp2_ctx *ctx,
   s->log_printf = NULL;
 #endif
 
-  (void)data;
   s->initial_ts = pktx->ts;
-  s->handshake_timeout = QUIC_HANDSHAKE_TIMEOUT;
+  s->handshake_timeout = (data->set.connecttimeout > 0) ?
+    data->set.connecttimeout * NGTCP2_MILLISECONDS : QUIC_HANDSHAKE_TIMEOUT;
   s->max_window = 100 * ctx->max_stream_window;
   s->max_stream_window = 10 * ctx->max_stream_window;
 
@@ -833,6 +833,9 @@ static ngtcp2_callbacks ng_callbacks = {
   cb_recv_rx_key,
   NULL, /* recv_tx_key */
   NULL, /* early_data_rejected */
+#ifdef NGTCP2_CALLBACKS_V2
+  NULL, /* begin_path_validation */
+#endif
 };
 
 #if defined(_MSC_VER) && defined(_DLL)
@@ -895,15 +898,16 @@ static CURLcode check_and_set_expiry(struct Curl_cfilter *cf,
   return CURLE_OK;
 }
 
-static void cf_ngtcp2_adjust_pollset(struct Curl_cfilter *cf,
-                                     struct Curl_easy *data,
-                                     struct easy_pollset *ps)
+static CURLcode cf_ngtcp2_adjust_pollset(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         struct easy_pollset *ps)
 {
   struct cf_ngtcp2_ctx *ctx = cf->ctx;
   bool want_recv, want_send;
+  CURLcode result = CURLE_OK;
 
   if(!ctx->qconn)
-    return;
+    return CURLE_OK;
 
   Curl_pollset_check(data, ps, ctx->q.sockfd, &want_recv, &want_send);
   if(!want_send && !Curl_bufq_is_empty(&ctx->q.sendbuf))
@@ -923,9 +927,10 @@ static void cf_ngtcp2_adjust_pollset(struct Curl_cfilter *cf,
     want_send = (!s_exhaust && want_send) ||
                  !Curl_bufq_is_empty(&ctx->q.sendbuf);
 
-    Curl_pollset_set(data, ps, ctx->q.sockfd, want_recv, want_send);
+    result = Curl_pollset_set(data, ps, ctx->q.sockfd, want_recv, want_send);
     CF_DATA_RESTORE(cf, save);
   }
+  return result;
 }
 
 static int cb_h3_stream_close(nghttp3_conn *conn, int64_t sid,
@@ -1182,7 +1187,12 @@ static nghttp3_callbacks ngh3_callbacks = {
   NULL, /* end_stream */
   cb_h3_reset_stream,
   NULL, /* shutdown */
-  NULL /* recv_settings */
+  NULL, /* recv_settings */
+#ifdef NGHTTP3_CALLBACKS_V2
+  NULL, /* recv_origin */
+  NULL, /* end_origin */
+  NULL, /* rand */
+#endif
 };
 
 static CURLcode init_ngh3_conn(struct Curl_cfilter *cf,
@@ -1202,7 +1212,7 @@ static CURLcode init_ngh3_conn(struct Curl_cfilter *cf,
   rc = nghttp3_conn_client_new(&ctx->h3conn,
                                &ngh3_callbacks,
                                &ctx->h3settings,
-                               nghttp3_mem_default(),
+                               Curl_nghttp3_mem(),
                                cf);
   if(rc) {
     failf(data, "error creating nghttp3 connection instance");
@@ -1331,7 +1341,6 @@ static CURLcode cf_ngtcp2_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
   result = Curl_1st_err(result, check_and_set_expiry(cf, data, &pktx));
 
   CURL_TRC_CF(data, cf, "[%" FMT_PRId64 "] cf_recv(blen=%zu) -> %dm, %zu",
-
               stream ? stream->id : -1, blen, result, *pnread);
   CF_DATA_RESTORE(cf, save);
   return result;
@@ -1946,9 +1955,9 @@ static CURLcode h3_data_pause(struct Curl_cfilter *cf,
   return CURLE_OK;
 }
 
-static CURLcode cf_ngtcp2_data_event(struct Curl_cfilter *cf,
-                                     struct Curl_easy *data,
-                                     int event, int arg1, void *arg2)
+static CURLcode cf_ngtcp2_cntrl(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                int event, int arg1, void *arg2)
 {
   struct cf_ngtcp2_ctx *ctx = cf->ctx;
   CURLcode result = CURLE_OK;
@@ -1986,6 +1995,10 @@ static CURLcode cf_ngtcp2_data_event(struct Curl_cfilter *cf,
     }
     break;
   }
+  case CF_CTRL_CONN_INFO_UPDATE:
+    if(!cf->sockindex && cf->connected)
+      cf->conn->httpversion_seen = 30;
+    break;
   default:
     break;
   }
@@ -2462,7 +2475,7 @@ static const struct alpn_spec ALPN_SPEC_H3 = {
                               &ctx->connected_path,
                               NGTCP2_PROTO_VER_V1, &ng_callbacks,
                               &ctx->settings, &ctx->transport_params,
-                              NULL, cf);
+                              Curl_ngtcp2_mem(), cf);
   if(rc)
     return CURLE_QUIC_CONNECT_ERROR;
 
@@ -2536,7 +2549,6 @@ static CURLcode cf_ngtcp2_connect(struct Curl_cfilter *cf,
     if(result)
       goto out;
     if(cf->connected) {
-      cf->conn->alpn = CURL_HTTP_VERSION_3;
       *done = TRUE;
       goto out;
     }
@@ -2558,7 +2570,6 @@ static CURLcode cf_ngtcp2_connect(struct Curl_cfilter *cf,
     if(!result) {
       CURL_TRC_CF(data, cf, "peer verified");
       cf->connected = TRUE;
-      cf->conn->alpn = CURL_HTTP_VERSION_3;
       *done = TRUE;
       connkeep(cf->conn, "HTTP/3 default");
     }
@@ -2653,10 +2664,16 @@ static CURLcode cf_ngtcp2_query(struct Curl_cfilter *cf,
   case CF_QUERY_SSL_CTX_INFO: {
     struct curl_tlssessioninfo *info = pres2;
     if(Curl_vquic_tls_get_ssl_info(&ctx->tls,
-                                   (query == CF_QUERY_SSL_INFO), info))
+                                   (query == CF_QUERY_SSL_CTX_INFO), info))
       return CURLE_OK;
     break;
   }
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = cf->connected ? "h3" : NULL;
+    return CURLE_OK;
+  }
   default:
     break;
   }
@@ -2720,7 +2737,7 @@ struct Curl_cftype Curl_cft_http3 = {
   Curl_cf_def_data_pending,
   cf_ngtcp2_send,
   cf_ngtcp2_recv,
-  cf_ngtcp2_data_event,
+  cf_ngtcp2_cntrl,
   cf_ngtcp2_conn_is_alive,
   Curl_cf_def_conn_keep_alive,
   cf_ngtcp2_query,
diff --git a/deps/curl/lib/vquic/curl_ngtcp2.h b/deps/curl/lib/vquic/curl_ngtcp2.h
index a4ccef49fec..86753a3a6ba 100644
--- a/deps/curl/lib/vquic/curl_ngtcp2.h
+++ b/deps/curl/lib/vquic/curl_ngtcp2.h
@@ -26,7 +26,7 @@
 
 #include "../curl_setup.h"
 
-#if defined(USE_NGTCP2) && defined(USE_NGHTTP3)
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_NGTCP2) && defined(USE_NGHTTP3)
 
 #ifdef HAVE_NETINET_UDP_H
 #include <netinet/udp.h>
diff --git a/deps/curl/lib/vquic/curl_osslq.c b/deps/curl/lib/vquic/curl_osslq.c
index 90fed6c44f0..3586ad0d556 100644
--- a/deps/curl/lib/vquic/curl_osslq.c
+++ b/deps/curl/lib/vquic/curl_osslq.c
@@ -24,7 +24,8 @@
 
 #include "../curl_setup.h"
 
-#if defined(USE_OPENSSL_QUIC) && defined(USE_NGHTTP3)
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_OPENSSL_QUIC) && \
+  defined(USE_NGHTTP3)
 
 #include <openssl/ssl.h>
 #include <openssl/bio.h>
@@ -118,17 +119,17 @@ static const char *osslq_SSL_ERROR_to_str(int err)
     return "SSL_ERROR_WANT_CONNECT";
   case SSL_ERROR_WANT_ACCEPT:
     return "SSL_ERROR_WANT_ACCEPT";
-#if defined(SSL_ERROR_WANT_ASYNC)
+#ifdef SSL_ERROR_WANT_ASYNC  /* OpenSSL 1.1.0+, LibreSSL 3.6.0+ */
   case SSL_ERROR_WANT_ASYNC:
     return "SSL_ERROR_WANT_ASYNC";
 #endif
-#if defined(SSL_ERROR_WANT_ASYNC_JOB)
+#ifdef SSL_ERROR_WANT_ASYNC_JOB  /* OpenSSL 1.1.0+, LibreSSL 3.6.0+ */
   case SSL_ERROR_WANT_ASYNC_JOB:
     return "SSL_ERROR_WANT_ASYNC_JOB";
 #endif
-#if defined(SSL_ERROR_WANT_EARLY)
-  case SSL_ERROR_WANT_EARLY:
-    return "SSL_ERROR_WANT_EARLY";
+#ifdef SSL_ERROR_WANT_CLIENT_HELLO_CB  /* OpenSSL 1.1.1, LibreSSL 3.6.0+ */
+  case SSL_ERROR_WANT_CLIENT_HELLO_CB:
+    return "SSL_ERROR_WANT_CLIENT_HELLO_CB";
 #endif
   default:
     return "SSL_ERROR unknown";
@@ -159,11 +160,11 @@ static char *osslq_strerror(unsigned long error, char *buf, size_t size)
 static CURLcode make_bio_addr(BIO_ADDR **pbio_addr,
                               const struct Curl_sockaddr_ex *addr)
 {
-  BIO_ADDR *ba;
+  BIO_ADDR *bio_addr;
   CURLcode result = CURLE_FAILED_INIT;
 
-  ba = BIO_ADDR_new();
-  if(!ba) {
+  bio_addr = BIO_ADDR_new();
+  if(!bio_addr) {
     result = CURLE_OUT_OF_MEMORY;
     goto out;
   }
@@ -172,7 +173,7 @@ static CURLcode make_bio_addr(BIO_ADDR **pbio_addr,
   case AF_INET: {
     struct sockaddr_in * const sin =
       (struct sockaddr_in * const)CURL_UNCONST(&addr->curl_sa_addr);
-    if(!BIO_ADDR_rawmake(ba, AF_INET, &sin->sin_addr,
+    if(!BIO_ADDR_rawmake(bio_addr, AF_INET, &sin->sin_addr,
                          sizeof(sin->sin_addr), sin->sin_port)) {
       goto out;
     }
@@ -183,7 +184,7 @@ static CURLcode make_bio_addr(BIO_ADDR **pbio_addr,
   case AF_INET6: {
     struct sockaddr_in6 * const sin =
       (struct sockaddr_in6 * const)CURL_UNCONST(&addr->curl_sa_addr);
-    if(!BIO_ADDR_rawmake(ba, AF_INET6, &sin->sin6_addr,
+    if(!BIO_ADDR_rawmake(bio_addr, AF_INET6, &sin->sin6_addr,
                          sizeof(sin->sin6_addr), sin->sin6_port)) {
     }
     result = CURLE_OK;
@@ -197,11 +198,11 @@ static CURLcode make_bio_addr(BIO_ADDR **pbio_addr,
   }
 
 out:
-  if(result && ba) {
-    BIO_ADDR_free(ba);
-    ba = NULL;
+  if(result && bio_addr) {
+    BIO_ADDR_free(bio_addr);
+    bio_addr = NULL;
   }
-  *pbio_addr = ba;
+  *pbio_addr = bio_addr;
   return result;
 }
 
@@ -513,7 +514,7 @@ static CURLcode cf_osslq_ssl_err(struct Curl_cfilter *cf,
     else
       err_descr = "SSL certificate verification failed";
   }
-#if defined(SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED)
+#ifdef SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED
   /* SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED is only available on
      OpenSSL version above v1.1.1, not LibreSSL, BoringSSL, or AWS-LC */
   else if((lib == ERR_LIB_SSL) &&
@@ -1086,7 +1087,12 @@ static nghttp3_callbacks ngh3_callbacks = {
   NULL, /* end_stream */
   cb_h3_reset_stream,
   NULL, /* shutdown */
-  NULL /* recv_settings */
+  NULL, /* recv_settings */
+#ifdef NGHTTP3_CALLBACKS_V2
+  NULL, /* recv_origin */
+  NULL, /* end_origin */
+  NULL, /* rand */
+#endif
 };
 
 static CURLcode cf_osslq_h3conn_init(struct cf_osslq_ctx *ctx, SSL *conn,
@@ -1100,7 +1106,7 @@ static CURLcode cf_osslq_h3conn_init(struct cf_osslq_ctx *ctx, SSL *conn,
   rc = nghttp3_conn_client_new(&h3->conn,
                                &ngh3_callbacks,
                                &h3->settings,
-                               nghttp3_mem_default(),
+                               Curl_nghttp3_mem(),
                                user_data);
   if(rc) {
     result = CURLE_OUT_OF_MEMORY;
@@ -1796,7 +1802,6 @@ static CURLcode cf_osslq_connect(struct Curl_cfilter *cf,
     if(!result) {
       CURL_TRC_CF(data, cf, "peer verified");
       cf->connected = TRUE;
-      cf->conn->alpn = CURL_HTTP_VERSION_3;
       *done = TRUE;
       connkeep(cf->conn, "HTTP/3 default");
     }
@@ -2163,9 +2168,9 @@ static bool cf_osslq_data_pending(struct Curl_cfilter *cf,
   return stream && !Curl_bufq_is_empty(&stream->recvbuf);
 }
 
-static CURLcode cf_osslq_data_event(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data,
-                                    int event, int arg1, void *arg2)
+static CURLcode cf_osslq_cntrl(struct Curl_cfilter *cf,
+                               struct Curl_easy *data,
+                               int event, int arg1, void *arg2)
 {
   struct cf_osslq_ctx *ctx = cf->ctx;
   CURLcode result = CURLE_OK;
@@ -2201,6 +2206,10 @@ static CURLcode cf_osslq_data_event(struct Curl_cfilter *cf,
     }
     break;
   }
+  case CF_CTRL_CONN_INFO_UPDATE:
+    if(!cf->sockindex && cf->connected)
+      cf->conn->httpversion_seen = 30;
+    break;
   default:
     break;
   }
@@ -2261,11 +2270,12 @@ static bool cf_osslq_conn_is_alive(struct Curl_cfilter *cf,
   return alive;
 }
 
-static void cf_osslq_adjust_pollset(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data,
-                                    struct easy_pollset *ps)
+static CURLcode cf_osslq_adjust_pollset(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        struct easy_pollset *ps)
 {
   struct cf_osslq_ctx *ctx = cf->ctx;
+  CURLcode result = CURLE_OK;
 
   if(!ctx->tls.ossl.ssl) {
     /* NOP */
@@ -2273,9 +2283,9 @@ static void cf_osslq_adjust_pollset(struct Curl_cfilter *cf,
   else if(!cf->connected) {
     /* during handshake, transfer has not started yet. we always
      * add our socket for polling if SSL wants to send/recv */
-    Curl_pollset_set(data, ps, ctx->q.sockfd,
-                     SSL_net_read_desired(ctx->tls.ossl.ssl),
-                     SSL_net_write_desired(ctx->tls.ossl.ssl));
+    result = Curl_pollset_set(data, ps, ctx->q.sockfd,
+                              SSL_net_read_desired(ctx->tls.ossl.ssl),
+                              SSL_net_write_desired(ctx->tls.ossl.ssl));
   }
   else {
     /* once connected, we only modify the socket if it is present.
@@ -2283,15 +2293,16 @@ static void cf_osslq_adjust_pollset(struct Curl_cfilter *cf,
     bool want_recv, want_send;
     Curl_pollset_check(data, ps, ctx->q.sockfd, &want_recv, &want_send);
     if(want_recv || want_send) {
-      Curl_pollset_set(data, ps, ctx->q.sockfd,
-                       SSL_net_read_desired(ctx->tls.ossl.ssl),
-                       SSL_net_write_desired(ctx->tls.ossl.ssl));
+      result = Curl_pollset_set(data, ps, ctx->q.sockfd,
+                                SSL_net_read_desired(ctx->tls.ossl.ssl),
+                                SSL_net_write_desired(ctx->tls.ossl.ssl));
     }
     else if(ctx->need_recv || ctx->need_send) {
-      Curl_pollset_set(data, ps, ctx->q.sockfd,
-                       ctx->need_recv, ctx->need_send);
+      result = Curl_pollset_set(data, ps, ctx->q.sockfd,
+                                ctx->need_recv, ctx->need_send);
     }
   }
+  return result;
 }
 
 static CURLcode cf_osslq_query(struct Curl_cfilter *cf,
@@ -2347,10 +2358,16 @@ static CURLcode cf_osslq_query(struct Curl_cfilter *cf,
   case CF_QUERY_SSL_CTX_INFO: {
     struct curl_tlssessioninfo *info = pres2;
     if(Curl_vquic_tls_get_ssl_info(&ctx->tls,
-                                   (query == CF_QUERY_SSL_INFO), info))
+                                   (query == CF_QUERY_SSL_CTX_INFO), info))
       return CURLE_OK;
     break;
   }
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = cf->connected ? "h3" : NULL;
+    return CURLE_OK;
+  }
   default:
     break;
   }
@@ -2371,7 +2388,7 @@ struct Curl_cftype Curl_cft_http3 = {
   cf_osslq_data_pending,
   cf_osslq_send,
   cf_osslq_recv,
-  cf_osslq_data_event,
+  cf_osslq_cntrl,
   cf_osslq_conn_is_alive,
   Curl_cf_def_conn_keep_alive,
   cf_osslq_query,
@@ -2443,4 +2460,4 @@ void Curl_osslq_ver(char *p, size_t len)
   (void)msnprintf(p, len, "nghttp3/%s", ht3->version_str);
 }
 
-#endif /* USE_OPENSSL_QUIC && USE_NGHTTP3 */
+#endif /* !CURL_DISABLE_HTTP && USE_OPENSSL_QUIC && USE_NGHTTP3 */
diff --git a/deps/curl/lib/vquic/curl_osslq.h b/deps/curl/lib/vquic/curl_osslq.h
index a2809c92bcc..9f5025f8aeb 100644
--- a/deps/curl/lib/vquic/curl_osslq.h
+++ b/deps/curl/lib/vquic/curl_osslq.h
@@ -26,7 +26,8 @@
 
 #include "../curl_setup.h"
 
-#if defined(USE_OPENSSL_QUIC) && defined(USE_NGHTTP3)
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_OPENSSL_QUIC) && \
+  defined(USE_NGHTTP3)
 
 #ifdef HAVE_NETINET_UDP_H
 #include <netinet/udp.h>
diff --git a/deps/curl/lib/vquic/curl_quiche.c b/deps/curl/lib/vquic/curl_quiche.c
index 920913d288a..179ccf8aa1a 100644
--- a/deps/curl/lib/vquic/curl_quiche.c
+++ b/deps/curl/lib/vquic/curl_quiche.c
@@ -24,7 +24,7 @@
 
 #include "../curl_setup.h"
 
-#ifdef USE_QUICHE
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_QUICHE)
 #include <quiche.h>
 #include <openssl/err.h>
 #include <openssl/ssl.h>
@@ -40,6 +40,7 @@
 #include "../connect.h"
 #include "../progress.h"
 #include "../strerror.h"
+#include "../select.h"
 #include "../http1.h"
 #include "vquic.h"
 #include "vquic_int.h"
@@ -1024,6 +1025,7 @@ static CURLcode h3_open_stream(struct Curl_cfilter *cf,
 
   stream3_id = quiche_h3_send_request(ctx->h3c, ctx->qconn, nva, nheader,
                                       stream->send_closed);
+  CURL_TRC_CF(data, cf, "quiche_send_request() -> %" FMT_PRIu64, stream3_id);
   if(stream3_id < 0) {
     if(QUICHE_H3_ERR_STREAM_BLOCKED == stream3_id) {
       /* quiche seems to report this error if the connection window is
@@ -1141,15 +1143,16 @@ static bool stream_is_writeable(struct Curl_cfilter *cf,
     ctx->qconn, (curl_uint64_t)stream->id, 1) > 0);
 }
 
-static void cf_quiche_adjust_pollset(struct Curl_cfilter *cf,
-                                     struct Curl_easy *data,
-                                     struct easy_pollset *ps)
+static CURLcode cf_quiche_adjust_pollset(struct Curl_cfilter *cf,
+                                         struct Curl_easy *data,
+                                         struct easy_pollset *ps)
 {
   struct cf_quiche_ctx *ctx = cf->ctx;
   bool want_recv, want_send;
+  CURLcode result = CURLE_OK;
 
   if(!ctx->qconn)
-    return;
+    return CURLE_OK;
 
   Curl_pollset_check(data, ps, ctx->q.sockfd, &want_recv, &want_send);
   if(want_recv || want_send) {
@@ -1164,8 +1167,9 @@ static void cf_quiche_adjust_pollset(struct Curl_cfilter *cf,
     want_send = (!s_exhaust && want_send) ||
                  !Curl_bufq_is_empty(&ctx->q.sendbuf);
 
-    Curl_pollset_set(data, ps, ctx->q.sockfd, want_recv, want_send);
+    result = Curl_pollset_set(data, ps, ctx->q.sockfd, want_recv, want_send);
   }
+  return result;
 }
 
 /*
@@ -1194,9 +1198,9 @@ static CURLcode h3_data_pause(struct Curl_cfilter *cf,
   return CURLE_OK;
 }
 
-static CURLcode cf_quiche_data_event(struct Curl_cfilter *cf,
-                                     struct Curl_easy *data,
-                                     int event, int arg1, void *arg2)
+static CURLcode cf_quiche_cntrl(struct Curl_cfilter *cf,
+                                struct Curl_easy *data,
+                                int event, int arg1, void *arg2)
 {
   struct cf_quiche_ctx *ctx = cf->ctx;
   CURLcode result = CURLE_OK;
@@ -1235,6 +1239,10 @@ static CURLcode cf_quiche_data_event(struct Curl_cfilter *cf,
     }
     break;
   }
+  case CF_CTRL_CONN_INFO_UPDATE:
+    if(!cf->sockindex && cf->connected)
+      cf->conn->httpversion_seen = 30;
+    break;
   default:
     break;
   }
@@ -1416,7 +1424,6 @@ static CURLcode cf_quiche_connect(struct Curl_cfilter *cf,
         goto out;
       }
       cf->connected = TRUE;
-      cf->conn->alpn = CURL_HTTP_VERSION_3;
       *done = TRUE;
       connkeep(cf->conn, "HTTP/3 default");
     }
@@ -1552,10 +1559,16 @@ static CURLcode cf_quiche_query(struct Curl_cfilter *cf,
   case CF_QUERY_SSL_CTX_INFO: {
     struct curl_tlssessioninfo *info = pres2;
     if(Curl_vquic_tls_get_ssl_info(&ctx->tls,
-                                   (query == CF_QUERY_SSL_INFO), info))
+                                   (query == CF_QUERY_SSL_CTX_INFO), info))
       return CURLE_OK;
     break;
   }
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = cf->connected ? "h3" : NULL;
+    return CURLE_OK;
+  }
   default:
     break;
   }
@@ -1613,7 +1626,7 @@ struct Curl_cftype Curl_cft_http3 = {
   cf_quiche_data_pending,
   cf_quiche_send,
   cf_quiche_recv,
-  cf_quiche_data_event,
+  cf_quiche_cntrl,
   cf_quiche_conn_is_alive,
   Curl_cf_def_conn_keep_alive,
   cf_quiche_query,
diff --git a/deps/curl/lib/vquic/curl_quiche.h b/deps/curl/lib/vquic/curl_quiche.h
index b2c767216fb..bee966eeb7a 100644
--- a/deps/curl/lib/vquic/curl_quiche.h
+++ b/deps/curl/lib/vquic/curl_quiche.h
@@ -26,7 +26,7 @@
 
 #include "../curl_setup.h"
 
-#ifdef USE_QUICHE
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_QUICHE)
 
 #include <quiche.h>
 #include <openssl/ssl.h>
diff --git a/deps/curl/lib/vquic/vquic-tls.c b/deps/curl/lib/vquic/vquic-tls.c
index 8a53c83b33b..4bdd23c981c 100644
--- a/deps/curl/lib/vquic/vquic-tls.c
+++ b/deps/curl/lib/vquic/vquic-tls.c
@@ -167,7 +167,7 @@ CURLcode Curl_vquic_tls_verify_peer(struct curl_tls_ctx *ctx,
 
 #ifdef USE_OPENSSL
   (void)conn_config;
-  result = Curl_oss_check_peer_cert(cf, data, &ctx->ossl, peer);
+  result = Curl_ossl_check_peer_cert(cf, data, &ctx->ossl, peer);
 #elif defined(USE_GNUTLS)
   if(conn_config->verifyhost) {
     result = Curl_gtls_verifyserver(data, ctx->gtls.session,
@@ -208,7 +208,7 @@ bool Curl_vquic_tls_get_ssl_info(struct curl_tls_ctx *ctx,
   return TRUE;
 #elif defined(USE_GNUTLS)
   (void)give_ssl_ctx; /* gnutls always returns its session */
-  info->backend = CURLSSLBACKEND_OPENSSL;
+  info->backend = CURLSSLBACKEND_GNUTLS;
   info->internals = ctx->gtls.session;
   return TRUE;
 #elif defined(USE_WOLFSSL)
diff --git a/deps/curl/lib/vquic/vquic.c b/deps/curl/lib/vquic/vquic.c
index 691c0d3fa73..647450a29ba 100644
--- a/deps/curl/lib/vquic/vquic.c
+++ b/deps/curl/lib/vquic/vquic.c
@@ -30,12 +30,14 @@
 #ifdef HAVE_FCNTL_H
 #include <fcntl.h>
 #endif
+#ifdef USE_NGHTTP3
+#include <nghttp3/nghttp3.h>
+#endif
 #include "../urldata.h"
 #include "../bufq.h"
 #include "../curlx/dynbuf.h"
 #include "../cfilters.h"
 #include "../curl_trc.h"
-#include "curl_msh3.h"
 #include "curl_ngtcp2.h"
 #include "curl_osslq.h"
 #include "curl_quiche.h"
@@ -52,7 +54,7 @@
 #include "../memdebug.h"
 
 
-#ifdef USE_HTTP3
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
 
 #define NW_CHUNK_SIZE     (64 * 1024)
 #define NW_SEND_CHUNKS    2
@@ -76,8 +78,6 @@ void Curl_quic_ver(char *p, size_t len)
   Curl_osslq_ver(p, len);
 #elif defined(USE_QUICHE)
   Curl_quiche_ver(p, len);
-#elif defined(USE_MSH3)
-  Curl_msh3_ver(p, len);
 #endif
 }
 
@@ -186,8 +186,9 @@ static CURLcode do_sendmsg(struct Curl_cfilter *cf,
       return CURLE_SEND_ERROR;
     }
   }
-  else {
-    assert(pktlen == (size_t)sent);
+  else if(pktlen != (size_t)sent) {
+    failf(data, "sendmsg() sent only %zd/%zu bytes", sent, pktlen);
+    return CURLE_SEND_ERROR;
   }
 #else
   ssize_t sent;
@@ -615,7 +616,7 @@ CURLcode vquic_recv_packets(struct Curl_cfilter *cf,
                             vquic_recv_pkt_cb *recv_cb, void *userp)
 {
   CURLcode result;
-#if defined(HAVE_SENDMMSG)
+#ifdef HAVE_SENDMMSG
   result = recvmmsg_packets(cf, data, qctx, max_pkts, recv_cb, userp);
 #elif defined(HAVE_SENDMSG)
   result = recvmsg_packets(cf, data, qctx, max_pkts, recv_cb, userp);
@@ -645,7 +646,7 @@ CURLcode Curl_qlogdir(struct Curl_easy *data,
                       size_t scidlen,
                       int *qlogfdp)
 {
-  const char *qlog_dir = getenv("QLOGDIR");
+  char *qlog_dir = curl_getenv("QLOGDIR");
   *qlogfdp = -1;
   if(qlog_dir) {
     struct dynbuf fname;
@@ -670,6 +671,7 @@ CURLcode Curl_qlogdir(struct Curl_easy *data,
         *qlogfdp = qlogfd;
     }
     curlx_dyn_free(&fname);
+    free(qlog_dir);
     if(result)
       return result;
   }
@@ -691,8 +693,6 @@ CURLcode Curl_cf_quic_create(struct Curl_cfilter **pcf,
   return Curl_cf_osslq_create(pcf, data, conn, ai);
 #elif defined(USE_QUICHE)
   return Curl_cf_quiche_create(pcf, data, conn, ai);
-#elif defined(USE_MSH3)
-  return Curl_cf_msh3_create(pcf, data, conn, ai);
 #else
   *pcf = NULL;
   (void)data;
@@ -728,7 +728,63 @@ CURLcode Curl_conn_may_http3(struct Curl_easy *data,
   return CURLE_OK;
 }
 
-#else /* USE_HTTP3 */
+#if defined(USE_NGTCP2) || defined(USE_NGHTTP3)
+
+static void *vquic_ngtcp2_malloc(size_t size, void *user_data)
+{
+  (void)user_data;
+  return Curl_cmalloc(size);
+}
+
+static void vquic_ngtcp2_free(void *ptr, void *user_data)
+{
+  (void)user_data;
+  Curl_cfree(ptr);
+}
+
+static void *vquic_ngtcp2_calloc(size_t nmemb, size_t size, void *user_data)
+{
+  (void)user_data;
+  return Curl_ccalloc(nmemb, size);
+}
+
+static void *vquic_ngtcp2_realloc(void *ptr, size_t size, void *user_data)
+{
+  (void)user_data;
+  return Curl_crealloc(ptr, size);
+}
+
+#ifdef USE_NGTCP2
+static struct ngtcp2_mem vquic_ngtcp2_mem = {
+  NULL,
+  vquic_ngtcp2_malloc,
+  vquic_ngtcp2_free,
+  vquic_ngtcp2_calloc,
+  vquic_ngtcp2_realloc
+};
+struct ngtcp2_mem *Curl_ngtcp2_mem(void)
+{
+  return &vquic_ngtcp2_mem;
+}
+#endif
+
+#ifdef USE_NGHTTP3
+static struct nghttp3_mem vquic_nghttp3_mem = {
+  NULL,
+  vquic_ngtcp2_malloc,
+  vquic_ngtcp2_free,
+  vquic_ngtcp2_calloc,
+  vquic_ngtcp2_realloc
+};
+struct nghttp3_mem *Curl_nghttp3_mem(void)
+{
+  return &vquic_nghttp3_mem;
+}
+#endif
+
+#endif /* USE_NGTCP2 || USE_NGHTTP3 */
+
+#else /* CURL_DISABLE_HTTP || !USE_HTTP3 */
 
 CURLcode Curl_conn_may_http3(struct Curl_easy *data,
                              const struct connectdata *conn,
@@ -741,4 +797,4 @@ CURLcode Curl_conn_may_http3(struct Curl_easy *data,
   return CURLE_NOT_BUILT_IN;
 }
 
-#endif /* !USE_HTTP3 */
+#endif /* !CURL_DISABLE_HTTP && USE_HTTP3 */
diff --git a/deps/curl/lib/vquic/vquic.h b/deps/curl/lib/vquic/vquic.h
index 3577a857e33..0f81334f293 100644
--- a/deps/curl/lib/vquic/vquic.h
+++ b/deps/curl/lib/vquic/vquic.h
@@ -26,7 +26,7 @@
 
 #include "../curl_setup.h"
 
-#ifdef USE_HTTP3
+#if !defined(CURL_DISABLE_HTTP) && defined(USE_HTTP3)
 struct Curl_cfilter;
 struct Curl_easy;
 struct connectdata;
@@ -51,7 +51,7 @@ extern struct Curl_cftype Curl_cft_http3;
 
 #else
 #define Curl_vquic_init() 1
-#endif /* !USE_HTTP3 */
+#endif /* !CURL_DISABLE_HTTP && USE_HTTP3 */
 
 CURLcode Curl_conn_may_http3(struct Curl_easy *data,
                              const struct connectdata *conn,
diff --git a/deps/curl/lib/vquic/vquic_int.h b/deps/curl/lib/vquic/vquic_int.h
index d271368d290..38189beb703 100644
--- a/deps/curl/lib/vquic/vquic_int.h
+++ b/deps/curl/lib/vquic/vquic_int.h
@@ -91,4 +91,13 @@ CURLcode vquic_recv_packets(struct Curl_cfilter *cf,
 
 #endif /* !USE_HTTP3 */
 
+#ifdef USE_NGTCP2
+struct ngtcp2_mem;
+struct ngtcp2_mem *Curl_ngtcp2_mem(void);
+#endif
+#ifdef USE_NGHTTP3
+struct nghttp3_mem;
+struct nghttp3_mem *Curl_nghttp3_mem(void);
+#endif
+
 #endif /* HEADER_CURL_VQUIC_QUIC_INT_H */
diff --git a/deps/curl/lib/vssh/curl_path.c b/deps/curl/lib/vssh/curl_path.c
index 474a5ecb8e2..021e85faf8e 100644
--- a/deps/curl/lib/vssh/curl_path.c
+++ b/deps/curl/lib/vssh/curl_path.c
@@ -24,7 +24,7 @@
 
 #include "../curl_setup.h"
 
-#if defined(USE_SSH)
+#ifdef USE_SSH
 
 #include "curl_path.h"
 #include <curl/curl.h>
diff --git a/deps/curl/lib/vssh/libssh.c b/deps/curl/lib/vssh/libssh.c
index 3bae943c7ce..695532ff851 100644
--- a/deps/curl/lib/vssh/libssh.c
+++ b/deps/curl/lib/vssh/libssh.c
@@ -125,8 +125,8 @@ CURLcode sftp_perform(struct Curl_easy *data,
                       bool *connected,
                       bool *dophase_done);
 
-static int myssh_getsock(struct Curl_easy *data,
-                         struct connectdata *conn, curl_socket_t *sock);
+static CURLcode myssh_pollset(struct Curl_easy *data,
+                              struct easy_pollset *ps);
 static void myssh_block2waitfor(struct connectdata *conn,
                                 struct ssh_conn *sshc,
                                 bool block);
@@ -148,10 +148,10 @@ const struct Curl_handler Curl_handler_scp = {
   myssh_connect,                /* connect_it */
   myssh_multi_statemach,        /* connecting */
   scp_doing,                    /* doing */
-  myssh_getsock,                /* proto_getsock */
-  myssh_getsock,                /* doing_getsock */
-  ZERO_NULL,                    /* domore_getsock */
-  myssh_getsock,                /* perform_getsock */
+  myssh_pollset,                /* proto_pollset */
+  myssh_pollset,                /* doing_pollset */
+  ZERO_NULL,                    /* domore_pollset */
+  myssh_pollset,                /* perform_pollset */
   scp_disconnect,               /* disconnect */
   ZERO_NULL,                    /* write_resp */
   ZERO_NULL,                    /* write_resp_hd */
@@ -177,10 +177,10 @@ const struct Curl_handler Curl_handler_sftp = {
   myssh_connect,                        /* connect_it */
   myssh_multi_statemach,                /* connecting */
   sftp_doing,                           /* doing */
-  myssh_getsock,                        /* proto_getsock */
-  myssh_getsock,                        /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  myssh_getsock,                        /* perform_getsock */
+  myssh_pollset,                        /* proto_pollset */
+  myssh_pollset,                        /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  myssh_pollset,                        /* perform_pollset */
   sftp_disconnect,                      /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -218,10 +218,10 @@ static CURLcode sftp_error_to_CURLE(int err)
   return CURLE_SSH;
 }
 
-#ifndef DEBUGBUILD
-#define myssh_to(x,y,z) myssh_set_state(x,y,z)
-#else
+#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
 #define myssh_to(x,y,z) myssh_set_state(x,y,z, __LINE__)
+#else
+#define myssh_to(x,y,z) myssh_set_state(x,y,z)
 #endif
 
 /*
@@ -231,7 +231,7 @@ static CURLcode sftp_error_to_CURLE(int err)
 static void myssh_set_state(struct Curl_easy *data,
                             struct ssh_conn *sshc,
                             sshstate nowstate
-#ifdef DEBUGBUILD
+#if defined(DEBUGBUILD) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
                           , int lineno
 #endif
   )
@@ -1115,8 +1115,8 @@ static int myssh_in_AUTH_DONE(struct Curl_easy *data,
   /* At this point we have an authenticated ssh session. */
   infof(data, "Authentication complete");
   Curl_pgrsTime(data, TIMER_APPCONNECT);      /* SSH is connected */
-  data->conn->sockfd = data->conn->sock[FIRSTSOCKET];
-  data->conn->writesockfd = CURL_SOCKET_BAD;
+  data->conn->recv_idx = FIRSTSOCKET;
+  data->conn->send_idx = -1;
 
   if(data->conn->handler->protocol == CURLPROTO_SFTP) {
     myssh_to(data, sshc, SSH_SFTP_INIT);
@@ -1251,10 +1251,10 @@ static int myssh_in_UPLOAD_INIT(struct Curl_easy *data,
     Curl_pgrsSetUploadSize(data, data->state.infilesize);
   }
   /* upload data */
-  Curl_xfer_setup1(data, CURL_XFER_SEND, -1, FALSE);
+  Curl_xfer_setup_send(data, FIRSTSOCKET);
 
   /* not set by Curl_xfer_setup to preserve keepon bits */
-  data->conn->sockfd = data->conn->writesockfd;
+  data->conn->recv_idx = FIRSTSOCKET;
 
   /* store this original bitmask setup to use later on if we cannot
      figure out a "real" bitmask */
@@ -1423,10 +1423,10 @@ static int myssh_in_SFTP_DOWNLOAD_STAT(struct Curl_easy *data,
     myssh_to(data, sshc, SSH_STOP);
     return rc;
   }
-  Curl_xfer_setup1(data, CURL_XFER_RECV, data->req.size, FALSE);
+  Curl_xfer_setup_recv(data, FIRSTSOCKET, data->req.size);
 
   /* not set by Curl_xfer_setup to preserve keepon bits */
-  data->conn->writesockfd = data->conn->sockfd;
+  data->conn->send_idx = 0;
 
   sshc->sftp_recv_state = 0;
   myssh_to(data, sshc, SSH_STOP);
@@ -1468,10 +1468,8 @@ static int myssh_in_SFTP_SHUTDOWN(struct Curl_easy *data,
      before we proceed */
   ssh_set_blocking(sshc->ssh_session, 0);
 #if LIBSSH_VERSION_INT > SSH_VERSION_INT(0, 11, 0)
-  if(sshc->sftp_aio) {
-    sftp_aio_free(sshc->sftp_aio);
-    sshc->sftp_aio = NULL;
-  }
+  SFTP_AIO_FREE(sshc->sftp_send_aio);
+  SFTP_AIO_FREE(sshc->sftp_recv_aio);
 #endif
 
   if(sshc->sftp_file) {
@@ -1857,9 +1855,9 @@ static int myssh_in_SFTP_QUOTE_STAT(struct Curl_easy *data,
   }
   else if(!strncmp(cmd, "atime", 5) ||
           !strncmp(cmd, "mtime", 5)) {
-    time_t date = Curl_getdate_capped(sshc->quote_path1);
+    time_t date;
     bool fail = FALSE;
-    if(date == -1) {
+    if(Curl_getdate_capped(sshc->quote_path1, &date)) {
       failf(data, "incorrect date format for %.*s", 5, cmd);
       fail = TRUE;
     }
@@ -2242,10 +2240,10 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data,
       }
 
       /* upload data */
-      Curl_xfer_setup1(data, CURL_XFER_SEND, -1, FALSE);
+      Curl_xfer_setup_send(data, FIRSTSOCKET);
 
       /* not set by Curl_xfer_setup to preserve keepon bits */
-      conn->sockfd = conn->writesockfd;
+      data->conn->recv_idx = FIRSTSOCKET;
 
       /* store this original bitmask setup to use later on if we cannot
          figure out a "real" bitmask */
@@ -2281,10 +2279,10 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data,
         /* download data */
         bytecount = ssh_scp_request_get_size(sshc->scp_session);
         data->req.maxdownload = (curl_off_t) bytecount;
-        Curl_xfer_setup1(data, CURL_XFER_RECV, bytecount, FALSE);
+        Curl_xfer_setup_recv(data, FIRSTSOCKET, bytecount);
 
         /* not set by Curl_xfer_setup to preserve keepon bits */
-        conn->writesockfd = conn->sockfd;
+        conn->send_idx = 0;
 
         myssh_to(data, sshc, SSH_STOP);
         break;
@@ -2392,25 +2390,19 @@ static CURLcode myssh_statemach_act(struct Curl_easy *data,
 
 /* called by the multi interface to figure out what socket(s) to wait for and
    for what actions in the DO_DONE, PERFORM and WAITPERFORM states */
-static int myssh_getsock(struct Curl_easy *data,
-                         struct connectdata *conn,
-                         curl_socket_t *sock)
+static CURLcode myssh_pollset(struct Curl_easy *data,
+                              struct easy_pollset *ps)
 {
-  int bitmap = GETSOCK_BLANK;
-  (void)data;
-  sock[0] = conn->sock[FIRSTSOCKET];
-
-  if(conn->waitfor & KEEP_RECV)
-    bitmap |= GETSOCK_READSOCK(FIRSTSOCKET);
-
-  if(conn->waitfor & KEEP_SEND)
-    bitmap |= GETSOCK_WRITESOCK(FIRSTSOCKET);
-
-  if(!conn->waitfor)
-    bitmap |= GETSOCK_WRITESOCK(FIRSTSOCKET);
-
-  DEBUGF(infof(data, "ssh_getsock -> %x", bitmap));
-  return bitmap;
+  int flags = 0;
+  if(data->conn->waitfor & KEEP_RECV)
+    flags |= CURL_POLL_IN;
+  if(data->conn->waitfor & KEEP_SEND)
+    flags |= CURL_POLL_OUT;
+  if(!data->conn->waitfor)
+    flags |= CURL_POLL_OUT;
+  return flags ?
+    Curl_pollset_change(data, ps, data->conn->sock[FIRSTSOCKET], flags, 0) :
+    CURLE_OK;
 }
 
 static void myssh_block2waitfor(struct connectdata *conn,
@@ -2439,7 +2431,7 @@ static CURLcode myssh_multi_statemach(struct Curl_easy *data,
   struct connectdata *conn = data->conn;
   struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
   struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
-  bool block;    /* we store the status and use that to provide a ssh_getsock()
+  bool block;    /* we store the status and use that to provide a ssh_pollset()
                     implementation */
   CURLcode result;
 
@@ -2487,8 +2479,8 @@ static CURLcode myssh_block_statemach(struct Curl_easy *data,
     if(block) {
       curl_socket_t fd_read = conn->sock[FIRSTSOCKET];
       /* wait for the socket to become ready */
-      (void) Curl_socket_check(fd_read, CURL_SOCKET_BAD,
-                               CURL_SOCKET_BAD, left > 1000 ? 1000 : left);
+      (void)Curl_socket_check(fd_read, CURL_SOCKET_BAD,
+                              CURL_SOCKET_BAD, left > 1000 ? 1000 : left);
     }
 
   }
@@ -2807,7 +2799,7 @@ static CURLcode scp_disconnect(struct Curl_easy *data,
   CURLcode result = CURLE_OK;
   struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
   struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
-  (void) dead_connection;
+  (void)dead_connection;
 
   if(sshc && sshc->ssh_session && sshp) {
     /* only if there is a session still around to use! */
@@ -2848,7 +2840,7 @@ static CURLcode scp_done(struct Curl_easy *data, CURLcode status,
                          bool premature)
 {
   struct ssh_conn *sshc = Curl_conn_meta_get(data->conn, CURL_META_SSH_CONN);
-  (void) premature;             /* not used */
+  (void)premature;
 
   if(!sshc)
     return CURLE_FAILED_INIT;
@@ -2866,7 +2858,7 @@ static CURLcode scp_send(struct Curl_easy *data, int sockindex,
   struct connectdata *conn = data->conn;
   struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
 
-  (void) sockindex; /* we only support SCP on the fixed known primary socket */
+  (void)sockindex; /* we only support SCP on the fixed known primary socket */
   (void)eos;
   *pnwritten = 0;
 
@@ -2899,7 +2891,7 @@ static CURLcode scp_recv(struct Curl_easy *data, int sockindex,
   struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
   ssize_t nread;
 
-  (void) sockindex; /* we only support SCP on the fixed known primary socket */
+  (void)sockindex; /* we only support SCP on the fixed known primary socket */
   *pnread = 0;
 
   if(!sshc)
@@ -2984,7 +2976,7 @@ static CURLcode sftp_disconnect(struct Curl_easy *data,
   struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
   struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
   CURLcode result = CURLE_OK;
-  (void) dead_connection;
+  (void)dead_connection;
 
   DEBUGF(infof(data, "SSH DISCONNECT starts now"));
 
@@ -3033,32 +3025,30 @@ static CURLcode sftp_send(struct Curl_easy *data, int sockindex,
   if(!sshc)
     return CURLE_FAILED_INIT;
 
-  /* limit the writes to the maximum specified in Section 3 of
-   * https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-02
-   */
-  if(len > 32768)
-    len = 32768;
 #if LIBSSH_VERSION_INT > SSH_VERSION_INT(0, 11, 0)
   switch(sshc->sftp_send_state) {
     case 0:
       sftp_file_set_nonblocking(sshc->sftp_file);
       if(sftp_aio_begin_write(sshc->sftp_file, mem, len,
-                              &sshc->sftp_aio) == SSH_ERROR) {
+                              &sshc->sftp_send_aio) == SSH_ERROR) {
         return CURLE_SEND_ERROR;
       }
       sshc->sftp_send_state = 1;
       FALLTHROUGH();
     case 1:
-      nwrite = sftp_aio_wait_write(&sshc->sftp_aio);
+      nwrite = sftp_aio_wait_write(&sshc->sftp_send_aio);
       myssh_block2waitfor(conn, sshc, (nwrite == SSH_AGAIN) ? TRUE : FALSE);
       if(nwrite == SSH_AGAIN)
         return CURLE_AGAIN;
       else if(nwrite < 0)
         return CURLE_SEND_ERROR;
-      if(sshc->sftp_aio) {
-        sftp_aio_free(sshc->sftp_aio);
-        sshc->sftp_aio = NULL;
-      }
+
+      /*
+       * sftp_aio_wait_write() would free sftp_send_aio and
+       * assign it NULL in all cases except when it returns
+       * SSH_AGAIN.
+       */
+
       sshc->sftp_send_state = 0;
       *pnwritten = (size_t)nwrite;
       return CURLE_OK;
@@ -3067,6 +3057,17 @@ static CURLcode sftp_send(struct Curl_easy *data, int sockindex,
       return CURLE_SEND_ERROR;
   }
 #else
+  /*
+   * limit the writes to the maximum specified in Section 3 of
+   * https://datatracker.ietf.org/doc/html/draft-ietf-secsh-filexfer-02
+   *
+   * libssh started applying appropriate read/write length limits
+   * internally since version 0.11.0, hence such an operation is
+   * not needed for versions after (and including) 0.11.0.
+   */
+  if(len > 32768)
+    len = 32768;
+
   nwrite = sftp_write(sshc->sftp_file, mem, len);
 
   myssh_block2waitfor(conn, sshc, FALSE);
@@ -3106,16 +3107,28 @@ static CURLcode sftp_recv(struct Curl_easy *data, int sockindex,
 
   switch(sshc->sftp_recv_state) {
     case 0:
+#if LIBSSH_VERSION_INT > SSH_VERSION_INT(0, 11, 0)
+      if(sftp_aio_begin_read(sshc->sftp_file, len,
+                             &sshc->sftp_recv_aio) == SSH_ERROR) {
+        return CURLE_RECV_ERROR;
+      }
+#else
       sshc->sftp_file_index =
         sftp_async_read_begin(sshc->sftp_file, (uint32_t)len);
       if(sshc->sftp_file_index < 0)
         return CURLE_RECV_ERROR;
+#endif
 
       FALLTHROUGH();
     case 1:
       sshc->sftp_recv_state = 1;
+
+#if LIBSSH_VERSION_INT > SSH_VERSION_INT(0, 11, 0)
+      nread = sftp_aio_wait_read(&sshc->sftp_recv_aio, mem, len);
+#else
       nread = sftp_async_read(sshc->sftp_file, mem, (uint32_t)len,
                               (uint32_t)sshc->sftp_file_index);
+#endif
 
       myssh_block2waitfor(conn, sshc, (nread == SSH_AGAIN));
 
@@ -3124,6 +3137,12 @@ static CURLcode sftp_recv(struct Curl_easy *data, int sockindex,
       else if(nread < 0)
         return CURLE_RECV_ERROR;
 
+      /*
+       * sftp_aio_wait_read() would free sftp_recv_aio and
+       * assign it NULL in all cases except when it returns
+       * SSH_AGAIN.
+       */
+
       sshc->sftp_recv_state = 0;
       *pnread = (size_t)nread;
       return CURLE_OK;
diff --git a/deps/curl/lib/vssh/libssh2.c b/deps/curl/lib/vssh/libssh2.c
index d599d3cc509..5dfc377ec14 100644
--- a/deps/curl/lib/vssh/libssh2.c
+++ b/deps/curl/lib/vssh/libssh2.c
@@ -99,8 +99,8 @@ static CURLcode sftp_disconnect(struct Curl_easy *data,
                                 struct connectdata *conn, bool dead);
 static CURLcode sftp_perform(struct Curl_easy *data, bool *connected,
                              bool *dophase_done);
-static int ssh_getsock(struct Curl_easy *data, struct connectdata *conn,
-                       curl_socket_t *sock);
+static CURLcode ssh_pollset(struct Curl_easy *data,
+                            struct easy_pollset *ps);
 static CURLcode ssh_setup_connection(struct Curl_easy *data,
                                      struct connectdata *conn);
 static void ssh_attach(struct Curl_easy *data, struct connectdata *conn);
@@ -119,10 +119,10 @@ const struct Curl_handler Curl_handler_scp = {
   ssh_connect,                          /* connect_it */
   ssh_multi_statemach,                  /* connecting */
   scp_doing,                            /* doing */
-  ssh_getsock,                          /* proto_getsock */
-  ssh_getsock,                          /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ssh_getsock,                          /* perform_getsock */
+  ssh_pollset,                          /* proto_pollset */
+  ssh_pollset,                          /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ssh_pollset,                          /* perform_pollset */
   scp_disconnect,                       /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -150,10 +150,10 @@ const struct Curl_handler Curl_handler_sftp = {
   ssh_connect,                          /* connect_it */
   ssh_multi_statemach,                  /* connecting */
   sftp_doing,                           /* doing */
-  ssh_getsock,                          /* proto_getsock */
-  ssh_getsock,                          /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ssh_getsock,                          /* perform_getsock */
+  ssh_pollset,                          /* proto_pollset */
+  ssh_pollset,                          /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ssh_pollset,                          /* perform_pollset */
   sftp_disconnect,                      /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -276,19 +276,19 @@ static CURLcode libssh2_session_error_to_CURLE(int err)
 
 static LIBSSH2_ALLOC_FUNC(my_libssh2_malloc)
 {
-  (void)abstract; /* arg not used */
+  (void)abstract;
   return Curl_cmalloc(count);
 }
 
 static LIBSSH2_REALLOC_FUNC(my_libssh2_realloc)
 {
-  (void)abstract; /* arg not used */
+  (void)abstract;
   return Curl_crealloc(ptr, count);
 }
 
 static LIBSSH2_FREE_FUNC(my_libssh2_free)
 {
-  (void)abstract; /* arg not used */
+  (void)abstract;
   if(ptr) /* ssh2 agent sometimes call free with null ptr */
     Curl_cfree(ptr);
 }
@@ -1199,10 +1199,10 @@ sftp_upload_init(struct Curl_easy *data,
     Curl_pgrsSetUploadSize(data, data->state.infilesize);
   }
   /* upload data */
-  Curl_xfer_setup1(data, CURL_XFER_SEND, -1, FALSE);
+  Curl_xfer_setup_send(data, FIRSTSOCKET);
 
   /* not set by Curl_xfer_setup to preserve keepon bits */
-  data->conn->sockfd = data->conn->writesockfd;
+  data->conn->recv_idx = FIRSTSOCKET;
 
   /* store this original bitmask setup to use later on if we cannot
      figure out a "real" bitmask */
@@ -1390,16 +1390,16 @@ sftp_quote_stat(struct Curl_easy *data,
   }
   else if(!strncmp(cmd, "atime", 5) ||
           !strncmp(cmd, "mtime", 5)) {
-    time_t date = Curl_getdate_capped(sshc->quote_path1);
+    time_t date;
     bool fail = FALSE;
 
-    if(date == -1) {
+    if(Curl_getdate_capped(sshc->quote_path1, &date)) {
       failf(data, "incorrect date format for %.*s", 5, cmd);
       fail = TRUE;
     }
 #if SIZEOF_TIME_T > SIZEOF_LONG
     if(date > 0xffffffff) {
-      /* if 'long' cannot old >32-bit, this date cannot be sent */
+      /* if 'long' cannot hold >32-bit, this date cannot be sent */
       failf(data, "date overflow");
       fail = TRUE;
     }
@@ -1540,10 +1540,10 @@ sftp_download_stat(struct Curl_easy *data,
     myssh_state(data, sshc, SSH_STOP);
     return CURLE_OK;
   }
-  Curl_xfer_setup1(data, CURL_XFER_RECV, data->req.size, FALSE);
+  Curl_xfer_setup_recv(data, FIRSTSOCKET, data->req.size);
 
   /* not set by Curl_xfer_setup to preserve keepon bits */
-  data->conn->writesockfd = data->conn->sockfd;
+  data->conn->send_idx = 0;
 
   myssh_state(data, sshc, SSH_STOP);
 
@@ -1945,8 +1945,8 @@ static CURLcode ssh_state_auth_done(struct Curl_easy *data,
 
   Curl_pgrsTime(data, TIMER_APPCONNECT); /* SSH is connected */
 
-  conn->sockfd = conn->sock[FIRSTSOCKET];
-  conn->writesockfd = CURL_SOCKET_BAD;
+  data->conn->recv_idx = FIRSTSOCKET;
+  conn->send_idx = -1;
 
   if(conn->handler->protocol == CURLPROTO_SFTP) {
     myssh_state(data, sshc, SSH_SFTP_INIT);
@@ -2460,10 +2460,10 @@ static CURLcode ssh_state_scp_download_init(struct Curl_easy *data,
   /* download data */
   bytecount = (curl_off_t)sb.st_size;
   data->req.maxdownload = (curl_off_t)sb.st_size;
-  Curl_xfer_setup1(data, CURL_XFER_RECV, bytecount, FALSE);
+  Curl_xfer_setup_recv(data, FIRSTSOCKET, bytecount);
 
   /* not set by Curl_xfer_setup to preserve keepon bits */
-  data->conn->writesockfd = data->conn->sockfd;
+  data->conn->send_idx = 0;
 
   myssh_state(data, sshc, SSH_STOP);
   return CURLE_OK;
@@ -2609,10 +2609,10 @@ static CURLcode ssh_state_scp_upload_init(struct Curl_easy *data,
   /* upload data */
   data->req.size = data->state.infilesize;
   Curl_pgrsSetUploadSize(data, data->state.infilesize);
-  Curl_xfer_setup1(data, CURL_XFER_SEND, -1, FALSE);
+  Curl_xfer_setup_send(data, FIRSTSOCKET);
 
   /* not set by Curl_xfer_setup to preserve keepon bits */
-  data->conn->sockfd = data->conn->writesockfd;
+  data->conn->recv_idx = FIRSTSOCKET;
 
   /* store this original bitmask setup to use later on if we cannot
      figure out a "real" bitmask */
@@ -3073,7 +3073,7 @@ static CURLcode ssh_statemachine(struct Curl_easy *data,
       break;
     }
 
-  } while(!result && (sshc->state != SSH_STOP));
+  } while(!result && (sshc->state != SSH_STOP) && !*block);
 
   if(result == CURLE_AGAIN) {
     /* we would block, we need to wait for the socket to be ready (in the
@@ -3087,22 +3087,17 @@ static CURLcode ssh_statemachine(struct Curl_easy *data,
 
 /* called by the multi interface to figure out what socket(s) to wait for and
    for what actions in the DO_DONE, PERFORM and WAITPERFORM states */
-static int ssh_getsock(struct Curl_easy *data,
-                       struct connectdata *conn,
-                       curl_socket_t *sock)
+static CURLcode ssh_pollset(struct Curl_easy *data,
+                            struct easy_pollset *ps)
 {
-  int bitmap = GETSOCK_BLANK;
-  (void)data;
-
-  sock[0] = conn->sock[FIRSTSOCKET];
-
-  if(conn->waitfor & KEEP_RECV)
-    bitmap |= GETSOCK_READSOCK(FIRSTSOCKET);
-
-  if(conn->waitfor & KEEP_SEND)
-    bitmap |= GETSOCK_WRITESOCK(FIRSTSOCKET);
-
-  return bitmap;
+  int flags = 0;
+  if(data->conn->waitfor & KEEP_RECV)
+    flags |= CURL_POLL_IN;
+  if(data->conn->waitfor & KEEP_SEND)
+    flags |= CURL_POLL_OUT;
+  return flags ?
+    Curl_pollset_change(data, ps, data->conn->sock[FIRSTSOCKET], flags, 0) :
+    CURLE_OK;
 }
 
 /*
@@ -3139,7 +3134,7 @@ static CURLcode ssh_multi_statemach(struct Curl_easy *data, bool *done)
   struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
   struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
   CURLcode result = CURLE_OK;
-  bool block; /* we store the status and use that to provide a ssh_getsock()
+  bool block; /* we store the status and use that to provide a ssh_pollset()
                  implementation */
   if(!sshc || !sshp)
     return CURLE_FAILED_INIT;
@@ -3695,7 +3690,7 @@ static CURLcode scp_disconnect(struct Curl_easy *data,
   CURLcode result = CURLE_OK;
   struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
   struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
-  (void) dead_connection;
+  (void)dead_connection;
 
   if(sshc && sshc->ssh_session && sshp) {
     /* only if there is a session still around to use! */
@@ -3737,7 +3732,7 @@ static CURLcode scp_done(struct Curl_easy *data, CURLcode status,
                          bool premature)
 {
   struct ssh_conn *sshc = Curl_conn_meta_get(data->conn, CURL_META_SSH_CONN);
-  (void)premature; /* not used */
+  (void)premature;
 
   if(sshc && !status)
     myssh_state(data, sshc, SSH_SCP_DONE);
@@ -3867,7 +3862,7 @@ static CURLcode sftp_disconnect(struct Curl_easy *data,
   CURLcode result = CURLE_OK;
   struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
   struct SSHPROTO *sshp = Curl_meta_get(data, CURL_META_SSH_EASY);
-  (void) dead_connection;
+  (void)dead_connection;
 
   DEBUGF(infof(data, "SSH DISCONNECT starts now"));
 
diff --git a/deps/curl/lib/vssh/ssh.h b/deps/curl/lib/vssh/ssh.h
index 4056c39b200..75b31bd931f 100644
--- a/deps/curl/lib/vssh/ssh.h
+++ b/deps/curl/lib/vssh/ssh.h
@@ -26,7 +26,7 @@
 
 #include "../curl_setup.h"
 
-#if defined(USE_LIBSSH2)
+#ifdef USE_LIBSSH2
 #include <libssh2.h>
 #include <libssh2_sftp.h>
 #elif defined(USE_LIBSSH)
@@ -162,7 +162,7 @@ struct ssh_conn {
   int orig_waitfor;             /* default READ/WRITE bits wait for */
   char *slash_pos;              /* used by the SFTP_CREATE_DIRS state */
 
-#if defined(USE_LIBSSH)
+#ifdef USE_LIBSSH
   CURLcode actualcode;        /* the actual error code */
   char *readdir_linkPath;
   size_t readdir_len;
@@ -180,10 +180,13 @@ struct ssh_conn {
 
   unsigned sftp_recv_state; /* 0 or 1 */
 #if LIBSSH_VERSION_INT > SSH_VERSION_INT(0, 11, 0)
-  sftp_aio sftp_aio;
+  sftp_aio sftp_recv_aio;
+
+  sftp_aio sftp_send_aio;
   unsigned sftp_send_state; /* 0 or 1 */
-#endif
+#else
   int sftp_file_index; /* for async read */
+#endif
   sftp_attributes readdir_attrs; /* used by the SFTP readdir actions */
   sftp_attributes readdir_link_attrs; /* used by the SFTP readdir actions */
   sftp_attributes quote_attrs; /* used by the SFTP_QUOTE state */
@@ -228,7 +231,7 @@ struct ssh_conn {
 #endif
 #endif
 
-#if defined(USE_LIBSSH2)
+#ifdef USE_LIBSSH2
 
 /* Feature detection based on version numbers to better work with
    non-configure platforms */
diff --git a/deps/curl/lib/vssh/wolfssh.c b/deps/curl/lib/vssh/wolfssh.c
index eed73fd9192..7cd0402a99d 100644
--- a/deps/curl/lib/vssh/wolfssh.c
+++ b/deps/curl/lib/vssh/wolfssh.c
@@ -66,9 +66,8 @@ static CURLcode wsftp_doing(struct Curl_easy *data,
 static CURLcode wsftp_disconnect(struct Curl_easy *data,
                                  struct connectdata *conn,
                                  bool dead);
-static int wssh_getsock(struct Curl_easy *data,
-                        struct connectdata *conn,
-                        curl_socket_t *sock);
+static CURLcode wssh_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps);
 static CURLcode wssh_setup_connection(struct Curl_easy *data,
                                       struct connectdata *conn);
 static void wssh_sshc_cleanup(struct ssh_conn *sshc);
@@ -87,10 +86,10 @@ const struct Curl_handler Curl_handler_scp = {
   wssh_connect,                         /* connect_it */
   wssh_multi_statemach,                 /* connecting */
   wscp_doing,                           /* doing */
-  wssh_getsock,                         /* proto_getsock */
-  wssh_getsock,                         /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  wssh_getsock,                         /* perform_getsock */
+  wssh_pollset,                         /* proto_pollset */
+  wssh_pollset,                         /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  wssh_pollset,                         /* perform_pollset */
   wscp_disconnect,                      /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -118,10 +117,10 @@ const struct Curl_handler Curl_handler_sftp = {
   wssh_connect,                         /* connect_it */
   wssh_multi_statemach,                 /* connecting */
   wsftp_doing,                          /* doing */
-  wssh_getsock,                         /* proto_getsock */
-  wssh_getsock,                         /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  wssh_getsock,                         /* perform_getsock */
+  wssh_pollset,                         /* proto_pollset */
+  wssh_pollset,                         /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  wssh_pollset,                         /* perform_pollset */
   wsftp_disconnect,                     /* disconnect */
   ZERO_NULL,                            /* write_resp */
   ZERO_NULL,                            /* write_resp_hd */
@@ -464,6 +463,150 @@ static CURLcode wssh_connect(struct Curl_easy *data, bool *done)
   return CURLE_FAILED_INIT;
 }
 
+static CURLcode wssh_sftp_upload_init(struct Curl_easy *data,
+                                      struct ssh_conn *sshc,
+                                      struct SSHPROTO *sftp_scp,
+                                      bool *block)
+{
+  word32 flags;
+  WS_SFTP_FILEATRB createattrs;
+  struct connectdata *conn = data->conn;
+  int rc;
+  if(data->state.resume_from) {
+    WS_SFTP_FILEATRB attrs;
+    if(data->state.resume_from < 0) {
+      rc = wolfSSH_SFTP_STAT(sshc->ssh_session, sftp_scp->path,
+                             &attrs);
+      if(rc != WS_SUCCESS)
+        return CURLE_SSH;
+
+      if(rc) {
+        data->state.resume_from = 0;
+      }
+      else {
+        curl_off_t size = ((curl_off_t)attrs.sz[1] << 32) | attrs.sz[0];
+        if(size < 0) {
+          failf(data, "Bad file size (%" FMT_OFF_T ")", size);
+          return CURLE_BAD_DOWNLOAD_RESUME;
+        }
+        data->state.resume_from = size;
+      }
+    }
+  }
+
+  if(data->set.remote_append)
+    /* Try to open for append, but create if nonexisting */
+    flags = WOLFSSH_FXF_WRITE|WOLFSSH_FXF_CREAT|WOLFSSH_FXF_APPEND;
+  else if(data->state.resume_from > 0)
+    /* If we have restart position then open for append */
+    flags = WOLFSSH_FXF_WRITE|WOLFSSH_FXF_APPEND;
+  else
+    /* Clear file before writing (normal behavior) */
+    flags = WOLFSSH_FXF_WRITE|WOLFSSH_FXF_CREAT|WOLFSSH_FXF_TRUNC;
+
+  memset(&createattrs, 0, sizeof(createattrs));
+  createattrs.per = (word32)data->set.new_file_perms;
+  sshc->handleSz = sizeof(sshc->handle);
+  rc = wolfSSH_SFTP_Open(sshc->ssh_session, sftp_scp->path,
+                         flags, &createattrs,
+                         sshc->handle, &sshc->handleSz);
+  if(rc == WS_FATAL_ERROR)
+    rc = wolfSSH_get_error(sshc->ssh_session);
+  if(rc == WS_WANT_READ) {
+    *block = TRUE;
+    conn->waitfor = KEEP_RECV;
+    return CURLE_OK;
+  }
+  else if(rc == WS_WANT_WRITE) {
+    *block = TRUE;
+    conn->waitfor = KEEP_SEND;
+    return CURLE_OK;
+  }
+  else if(rc == WS_SUCCESS) {
+    infof(data, "wolfssh SFTP open succeeded");
+  }
+  else {
+    failf(data, "wolfssh SFTP upload open failed: %d", rc);
+    return CURLE_SSH;
+  }
+  wssh_state(data, sshc, SSH_SFTP_DOWNLOAD_STAT);
+
+  /* If we have a restart point then we need to seek to the correct
+     position. */
+  if(data->state.resume_from > 0) {
+    /* Let's read off the proper amount of bytes from the input. */
+    int seekerr = CURL_SEEKFUNC_OK;
+    if(data->set.seek_func) {
+      Curl_set_in_callback(data, TRUE);
+      seekerr = data->set.seek_func(data->set.seek_client,
+                                    data->state.resume_from, SEEK_SET);
+      Curl_set_in_callback(data, FALSE);
+    }
+
+    if(seekerr != CURL_SEEKFUNC_OK) {
+      curl_off_t passed = 0;
+
+      if(seekerr != CURL_SEEKFUNC_CANTSEEK) {
+        failf(data, "Could not seek stream");
+        return CURLE_FTP_COULDNT_USE_REST;
+      }
+      /* seekerr == CURL_SEEKFUNC_CANTSEEK (cannot seek to offset) */
+      do {
+        char scratch[4*1024];
+        size_t readthisamountnow =
+          (data->state.resume_from - passed >
+           (curl_off_t)sizeof(scratch)) ?
+          sizeof(scratch) : curlx_sotouz(data->state.resume_from - passed);
+
+        size_t actuallyread;
+        Curl_set_in_callback(data, TRUE);
+        actuallyread = data->state.fread_func(scratch, 1,
+                                              readthisamountnow,
+                                              data->state.in);
+        Curl_set_in_callback(data, FALSE);
+
+        passed += actuallyread;
+        if((actuallyread == 0) || (actuallyread > readthisamountnow)) {
+          /* this checks for greater-than only to make sure that the
+             CURL_READFUNC_ABORT return code still aborts */
+          failf(data, "Failed to read data");
+          return CURLE_FTP_COULDNT_USE_REST;
+        }
+      } while(passed < data->state.resume_from);
+    }
+
+    /* now, decrease the size of the read */
+    if(data->state.infilesize > 0) {
+      data->state.infilesize -= data->state.resume_from;
+      data->req.size = data->state.infilesize;
+      Curl_pgrsSetUploadSize(data, data->state.infilesize);
+    }
+
+    sshc->offset += data->state.resume_from;
+  }
+  if(data->state.infilesize > 0) {
+    data->req.size = data->state.infilesize;
+    Curl_pgrsSetUploadSize(data, data->state.infilesize);
+  }
+  /* upload data */
+  Curl_xfer_setup_send(data, FIRSTSOCKET);
+
+  /* not set by Curl_xfer_setup to preserve keepon bits */
+  data->conn->recv_idx = FIRSTSOCKET;
+
+  /* store this original bitmask setup to use later on if we cannot
+     figure out a "real" bitmask */
+  sshc->orig_waitfor = data->req.keepon;
+
+  /* since we do not really wait for anything at this point, we want the state
+     machine to move on as soon as possible */
+  Curl_multi_mark_dirty(data);
+
+  wssh_state(data, sshc, SSH_STOP);
+
+  return CURLE_OK;
+}
+
 /*
  * wssh_statemach_act() runs the SSH state machine as far as it can without
  * blocking and without reaching the end. The data the pointer 'block' points
@@ -598,148 +741,10 @@ static CURLcode wssh_statemach_act(struct Curl_easy *data,
           wssh_state(data, sshc, SSH_SFTP_DOWNLOAD_INIT);
       }
       break;
-    case SSH_SFTP_UPLOAD_INIT: {
-      word32 flags;
-      WS_SFTP_FILEATRB createattrs;
-      if(data->state.resume_from) {
-        WS_SFTP_FILEATRB attrs;
-        if(data->state.resume_from < 0) {
-          rc = wolfSSH_SFTP_STAT(sshc->ssh_session, sftp_scp->path,
-                                 &attrs);
-          if(rc != WS_SUCCESS)
-            break;
-
-          if(rc) {
-            data->state.resume_from = 0;
-          }
-          else {
-            curl_off_t size = ((curl_off_t)attrs.sz[1] << 32) | attrs.sz[0];
-            if(size < 0) {
-              failf(data, "Bad file size (%" FMT_OFF_T ")", size);
-              return CURLE_BAD_DOWNLOAD_RESUME;
-            }
-            data->state.resume_from = size;
-          }
-        }
-      }
-
-      if(data->set.remote_append)
-        /* Try to open for append, but create if nonexisting */
-        flags = WOLFSSH_FXF_WRITE|WOLFSSH_FXF_CREAT|WOLFSSH_FXF_APPEND;
-      else if(data->state.resume_from > 0)
-        /* If we have restart position then open for append */
-        flags = WOLFSSH_FXF_WRITE|WOLFSSH_FXF_APPEND;
-      else
-        /* Clear file before writing (normal behavior) */
-        flags = WOLFSSH_FXF_WRITE|WOLFSSH_FXF_CREAT|WOLFSSH_FXF_TRUNC;
-
-      memset(&createattrs, 0, sizeof(createattrs));
-      createattrs.per = (word32)data->set.new_file_perms;
-      sshc->handleSz = sizeof(sshc->handle);
-      rc = wolfSSH_SFTP_Open(sshc->ssh_session, sftp_scp->path,
-                             flags, &createattrs,
-                             sshc->handle, &sshc->handleSz);
-      if(rc == WS_FATAL_ERROR)
-        rc = wolfSSH_get_error(sshc->ssh_session);
-      if(rc == WS_WANT_READ) {
-        *block = TRUE;
-        conn->waitfor = KEEP_RECV;
-        return CURLE_OK;
-      }
-      else if(rc == WS_WANT_WRITE) {
-        *block = TRUE;
-        conn->waitfor = KEEP_SEND;
-        return CURLE_OK;
-      }
-      else if(rc == WS_SUCCESS) {
-        infof(data, "wolfssh SFTP open succeeded");
-      }
-      else {
-        failf(data, "wolfssh SFTP upload open failed: %d", rc);
-        return CURLE_SSH;
-      }
-      wssh_state(data, sshc, SSH_SFTP_DOWNLOAD_STAT);
-
-      /* If we have a restart point then we need to seek to the correct
-         position. */
-      if(data->state.resume_from > 0) {
-        /* Let's read off the proper amount of bytes from the input. */
-        int seekerr = CURL_SEEKFUNC_OK;
-        if(data->set.seek_func) {
-          Curl_set_in_callback(data, TRUE);
-          seekerr = data->set.seek_func(data->set.seek_client,
-                                        data->state.resume_from, SEEK_SET);
-          Curl_set_in_callback(data, FALSE);
-        }
-
-        if(seekerr != CURL_SEEKFUNC_OK) {
-          curl_off_t passed = 0;
-
-          if(seekerr != CURL_SEEKFUNC_CANTSEEK) {
-            failf(data, "Could not seek stream");
-            return CURLE_FTP_COULDNT_USE_REST;
-          }
-          /* seekerr == CURL_SEEKFUNC_CANTSEEK (cannot seek to offset) */
-          do {
-            char scratch[4*1024];
-            size_t readthisamountnow =
-              (data->state.resume_from - passed >
-                (curl_off_t)sizeof(scratch)) ?
-              sizeof(scratch) : curlx_sotouz(data->state.resume_from - passed);
-
-            size_t actuallyread;
-            Curl_set_in_callback(data, TRUE);
-            actuallyread = data->state.fread_func(scratch, 1,
-                                                  readthisamountnow,
-                                                  data->state.in);
-            Curl_set_in_callback(data, FALSE);
-
-            passed += actuallyread;
-            if((actuallyread == 0) || (actuallyread > readthisamountnow)) {
-              /* this checks for greater-than only to make sure that the
-                 CURL_READFUNC_ABORT return code still aborts */
-              failf(data, "Failed to read data");
-              return CURLE_FTP_COULDNT_USE_REST;
-            }
-          } while(passed < data->state.resume_from);
-        }
-
-        /* now, decrease the size of the read */
-        if(data->state.infilesize > 0) {
-          data->state.infilesize -= data->state.resume_from;
-          data->req.size = data->state.infilesize;
-          Curl_pgrsSetUploadSize(data, data->state.infilesize);
-        }
-
-        sshc->offset += data->state.resume_from;
-      }
-      if(data->state.infilesize > 0) {
-        data->req.size = data->state.infilesize;
-        Curl_pgrsSetUploadSize(data, data->state.infilesize);
-      }
-      /* upload data */
-      Curl_xfer_setup1(data, CURL_XFER_SEND, -1, FALSE);
-
-      /* not set by Curl_xfer_setup to preserve keepon bits */
-      conn->sockfd = conn->writesockfd;
-
-      if(result) {
-        wssh_state(data, sshc, SSH_SFTP_CLOSE);
-        sshc->actualcode = result;
-      }
-      else {
-        /* store this original bitmask setup to use later on if we cannot
-           figure out a "real" bitmask */
-        sshc->orig_waitfor = data->req.keepon;
-
-        /* since we do not really wait for anything at this point, we want the
-           state machine to move on as soon as possible */
-        Curl_multi_mark_dirty(data);
-
-        wssh_state(data, sshc, SSH_STOP);
-      }
+    case SSH_SFTP_UPLOAD_INIT:
+      result = wssh_sftp_upload_init(data, sshc, sftp_scp, block);
       break;
-    }
+
     case SSH_SFTP_DOWNLOAD_INIT:
       sshc->handleSz = sizeof(sshc->handle);
       rc = wolfSSH_SFTP_Open(sshc->ssh_session, sftp_scp->path,
@@ -817,10 +822,10 @@ static CURLcode wssh_statemach_act(struct Curl_easy *data,
         wssh_state(data, sshc, SSH_STOP);
         break;
       }
-      Curl_xfer_setup1(data, CURL_XFER_RECV, data->req.size, FALSE);
+      Curl_xfer_setup_recv(data, FIRSTSOCKET, data->req.size);
 
       /* not set by Curl_xfer_setup to preserve keepon bits */
-      conn->writesockfd = conn->sockfd;
+      conn->send_idx = 0;
 
       if(result) {
         /* this should never occur; the close state should be entered
@@ -932,7 +937,7 @@ static CURLcode wssh_multi_statemach(struct Curl_easy *data, bool *done)
   struct connectdata *conn = data->conn;
   struct ssh_conn *sshc = Curl_conn_meta_get(conn, CURL_META_SSH_CONN);
   CURLcode result = CURLE_OK;
-  bool block; /* we store the status and use that to provide a ssh_getsock()
+  bool block; /* we store the status and use that to provide a ssh_pollset()
                  implementation */
   if(!sshc)
     return CURLE_FAILED_INIT;
@@ -1185,21 +1190,17 @@ static CURLcode wsftp_disconnect(struct Curl_easy *data,
   return result;
 }
 
-static int wssh_getsock(struct Curl_easy *data,
-                        struct connectdata *conn,
-                        curl_socket_t *sock)
+static CURLcode wssh_pollset(struct Curl_easy *data,
+                             struct easy_pollset *ps)
 {
-  int bitmap = GETSOCK_BLANK;
-  int dir = conn->waitfor;
-  (void)data;
-  sock[0] = conn->sock[FIRSTSOCKET];
-
-  if(dir == KEEP_RECV)
-    bitmap |= GETSOCK_READSOCK(FIRSTSOCKET);
-  else if(dir == KEEP_SEND)
-    bitmap |= GETSOCK_WRITESOCK(FIRSTSOCKET);
-
-  return bitmap;
+  int flags = 0;
+  if(data->conn->waitfor & KEEP_RECV)
+    flags |= CURL_POLL_IN;
+  if(data->conn->waitfor & KEEP_SEND)
+    flags |= CURL_POLL_OUT;
+  return flags ?
+    Curl_pollset_change(data, ps, data->conn->sock[FIRSTSOCKET], flags, 0) :
+    CURLE_OK;
 }
 
 void Curl_ssh_version(char *buffer, size_t buflen)
diff --git a/deps/curl/lib/vtls/cipher_suite.c b/deps/curl/lib/vtls/cipher_suite.c
index cefc92c580b..4bf60c1a4ab 100644
--- a/deps/curl/lib/vtls/cipher_suite.c
+++ b/deps/curl/lib/vtls/cipher_suite.c
@@ -70,7 +70,7 @@ static const char *cs_txt =
   "ECDH" "\0"
   "ECDHE" "\0"
   "ECDSA" "\0"
-  "EDE" "\0"
+  "EDE" "\0" /* spellchecker:disable-line */
   "GCM" "\0"
   "MD5" "\0"
   "NULL" "\0"
@@ -80,7 +80,7 @@ static const char *cs_txt =
   "SHA" "\0"
   "SHA256" "\0"
   "SHA384" "\0"
-#if defined(USE_MBEDTLS)
+#ifdef USE_MBEDTLS
   "ARIA" "\0"
   "ARIA128" "\0"
   "ARIA256" "\0"
@@ -111,7 +111,7 @@ enum {
   CS_TXT_IDX_ECDH,
   CS_TXT_IDX_ECDHE,
   CS_TXT_IDX_ECDSA,
-  CS_TXT_IDX_EDE,
+  CS_TXT_IDX_EDE, /* spellchecker:disable-line */
   CS_TXT_IDX_GCM,
   CS_TXT_IDX_MD5,
   CS_TXT_IDX_NULL,
@@ -121,7 +121,7 @@ enum {
   CS_TXT_IDX_SHA,
   CS_TXT_IDX_SHA256,
   CS_TXT_IDX_SHA384,
-#if defined(USE_MBEDTLS)
+#ifdef USE_MBEDTLS
   CS_TXT_IDX_ARIA,
   CS_TXT_IDX_ARIA128,
   CS_TXT_IDX_ARIA256,
@@ -180,7 +180,7 @@ static const struct cs_entry cs_list [] = {
   CS_ENTRY(0xCCA8, ECDHE,RSA,CHACHA20,POLY1305,,,,),
   CS_ENTRY(0xCCA9, TLS,ECDHE,ECDSA,WITH,CHACHA20,POLY1305,SHA256,),
   CS_ENTRY(0xCCA9, ECDHE,ECDSA,CHACHA20,POLY1305,,,,),
-#if defined(USE_MBEDTLS)
+#ifdef USE_MBEDTLS
   CS_ENTRY(0x002F, TLS,RSA,WITH,AES,128,CBC,SHA,),
   CS_ENTRY(0x002F, AES128,SHA,,,,,,),
   CS_ENTRY(0x0035, TLS,RSA,WITH,AES,256,CBC,SHA,),
@@ -234,7 +234,7 @@ static const struct cs_entry cs_list [] = {
   CS_ENTRY(0xC032, TLS,ECDH,RSA,WITH,AES,256,GCM,SHA384),
   CS_ENTRY(0xC032, ECDH,RSA,AES256,GCM,SHA384,,,),
 #endif
-#if defined(USE_MBEDTLS)
+#ifdef USE_MBEDTLS
   CS_ENTRY(0x0001, TLS,RSA,WITH,NULL,MD5,,,),
   CS_ENTRY(0x0001, NULL,MD5,,,,,,),
   CS_ENTRY(0x0002, TLS,RSA,WITH,NULL,SHA,,,),
@@ -322,7 +322,7 @@ static const struct cs_entry cs_list [] = {
   CS_ENTRY(0xCCAB, TLS,PSK,WITH,CHACHA20,POLY1305,SHA256,,),
   CS_ENTRY(0xCCAB, PSK,CHACHA20,POLY1305,,,,,),
 #endif
-#if defined(USE_MBEDTLS)
+#ifdef USE_MBEDTLS
   CS_ENTRY(0xC09C, TLS,RSA,WITH,AES,128,CCM,,),
   CS_ENTRY(0xC09C, AES128,CCM,,,,,,),
   CS_ENTRY(0xC09D, TLS,RSA,WITH,AES,256,CCM,,),
@@ -340,7 +340,7 @@ static const struct cs_entry cs_list [] = {
   CS_ENTRY(0xC0AF, TLS,ECDHE,ECDSA,WITH,AES,256,CCM,8),
   CS_ENTRY(0xC0AF, ECDHE,ECDSA,AES256,CCM8,,,,),
 #endif
-#if defined(USE_MBEDTLS)
+#ifdef USE_MBEDTLS
   /* entries marked ns are "non-standard", they are not in OpenSSL */
   CS_ENTRY(0x0041, TLS,RSA,WITH,CAMELLIA,128,CBC,SHA,),
   CS_ENTRY(0x0041, CAMELLIA128,SHA,,,,,,),
diff --git a/deps/curl/lib/vtls/gtls.c b/deps/curl/lib/vtls/gtls.c
index f5e02975a04..f38c90e66c3 100644
--- a/deps/curl/lib/vtls/gtls.c
+++ b/deps/curl/lib/vtls/gtls.c
@@ -77,7 +77,12 @@ static bool gtls_inited = FALSE;
 #error "too old GnuTLS version"
 #endif
 
-# include <gnutls/ocsp.h>
+#undef CURL_GNUTLS_EARLY_DATA
+#if GNUTLS_VERSION_NUMBER >= 0x03060d
+#define CURL_GNUTLS_EARLY_DATA
+#endif
+
+#include <gnutls/ocsp.h>
 
 struct gtls_ssl_backend_data {
   struct gtls_ctx gtls;
@@ -334,12 +339,13 @@ gnutls_set_ssl_version_min_max(struct Curl_easy *data,
   if((ssl_version == CURL_SSLVERSION_DEFAULT) ||
      (ssl_version == CURL_SSLVERSION_TLSv1))
     ssl_version = CURL_SSLVERSION_TLSv1_0;
-  if(ssl_version_max == CURL_SSLVERSION_MAX_NONE)
-    ssl_version_max = CURL_SSLVERSION_MAX_DEFAULT;
+  if((ssl_version_max == CURL_SSLVERSION_MAX_NONE) ||
+     (ssl_version_max == CURL_SSLVERSION_MAX_DEFAULT))
+    ssl_version_max = tls13support ?
+      CURL_SSLVERSION_MAX_TLSv1_3 : CURL_SSLVERSION_MAX_TLSv1_2;
 
   if(peer->transport == TRNSPRT_QUIC) {
-    if((ssl_version_max != CURL_SSLVERSION_MAX_DEFAULT) &&
-       (ssl_version_max < CURL_SSLVERSION_MAX_TLSv1_3)) {
+    if(ssl_version_max < CURL_SSLVERSION_MAX_TLSv1_3) {
       failf(data, "QUIC needs at least TLS version 1.3");
       return CURLE_SSL_CONNECT_ERROR;
      }
@@ -347,19 +353,6 @@ gnutls_set_ssl_version_min_max(struct Curl_easy *data,
     return CURLE_OK;
   }
 
-  if(!tls13support) {
-    /* If the running GnuTLS does not support TLS 1.3, we must not specify a
-       prioritylist involving that since it will make GnuTLS return an en
-       error back at us */
-    if((ssl_version_max == CURL_SSLVERSION_MAX_TLSv1_3) ||
-       (ssl_version_max == CURL_SSLVERSION_MAX_DEFAULT)) {
-      ssl_version_max = CURL_SSLVERSION_MAX_TLSv1_2;
-    }
-  }
-  else if(ssl_version_max == CURL_SSLVERSION_MAX_DEFAULT) {
-    ssl_version_max = CURL_SSLVERSION_MAX_TLSv1_3;
-  }
-
   switch(ssl_version | ssl_version_max) {
   case CURL_SSLVERSION_TLSv1_0 | CURL_SSLVERSION_MAX_TLSv1_0:
     *prioritylist = GNUTLS_CIPHERS ":-VERS-SSL3.0:-VERS-TLS-ALL:"
@@ -433,7 +426,7 @@ CURLcode Curl_gtls_shared_creds_create(struct Curl_easy *data,
 CURLcode Curl_gtls_shared_creds_up_ref(struct gtls_shared_creds *creds)
 {
   DEBUGASSERT(creds);
-  if(creds->refcount < SIZE_T_MAX) {
+  if(creds->refcount < SIZE_MAX) {
     ++creds->refcount;
     return CURLE_OK;
   }
@@ -667,6 +660,7 @@ CURLcode Curl_gtls_client_trust_setup(struct Curl_cfilter *cf,
   return CURLE_OK;
 }
 
+#ifdef CURL_GNUTLS_EARLY_DATA
 CURLcode Curl_gtls_cache_session(struct Curl_cfilter *cf,
                                  struct Curl_easy *data,
                                  const char *ssl_peer_key,
@@ -727,6 +721,7 @@ CURLcode Curl_gtls_cache_session(struct Curl_cfilter *cf,
   }
   return result;
 }
+#endif
 
 int Curl_glts_get_ietf_proto(gnutls_session_t session)
 {
@@ -739,13 +734,16 @@ int Curl_glts_get_ietf_proto(gnutls_session_t session)
     return CURL_IETF_PROTO_TLS1_1;
   case GNUTLS_TLS1_2:
     return CURL_IETF_PROTO_TLS1_2;
+#if GNUTLS_VERSION_NUMBER >= 0x030603
   case GNUTLS_TLS1_3:
     return CURL_IETF_PROTO_TLS1_3;
+#endif
   default:
     return CURL_IETF_PROTO_UNKNOWN;
   }
 }
 
+#ifdef CURL_GNUTLS_EARLY_DATA
 static CURLcode cf_gtls_update_session_id(struct Curl_cfilter *cf,
                                           struct Curl_easy *data,
                                           gnutls_session_t session)
@@ -781,6 +779,7 @@ static int gtls_handshake_cb(gnutls_session_t session, unsigned int htype,
   }
   return 0;
 }
+#endif
 
 static CURLcode gtls_set_priority(struct Curl_cfilter *cf,
                                   struct Curl_easy *data,
@@ -895,6 +894,7 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf,
 
   /* Initialize TLS session as a client */
   init_flags = GNUTLS_CLIENT;
+#ifdef CURL_GNUTLS_EARLY_DATA
   if(peer->transport == TRNSPRT_QUIC && earlydata_max > 0)
     init_flags |= GNUTLS_ENABLE_EARLY_DATA | GNUTLS_NO_END_OF_EARLY_DATA;
   else if(earlydata_max > 0 && earlydata_max != 0xFFFFFFFFUL)
@@ -903,21 +903,17 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf,
      * and one announcing 0xFFFFFFFFUL. On TCP+TLS, this is unlikely, but
      * on QUIC this is common. */
     init_flags |= GNUTLS_ENABLE_EARLY_DATA;
+#endif
 
-#if defined(GNUTLS_FORCE_CLIENT_CERT)
+#ifdef GNUTLS_FORCE_CLIENT_CERT
   init_flags |= GNUTLS_FORCE_CLIENT_CERT;
 #endif
 
-#if defined(GNUTLS_NO_TICKETS_TLS12)
-    init_flags |= GNUTLS_NO_TICKETS_TLS12;
-#elif defined(GNUTLS_NO_TICKETS)
-  /* Disable TLS session tickets for non 1.3 connections */
-  if((config->version != CURL_SSLVERSION_TLSv1_3) &&
-     (config->version != CURL_SSLVERSION_DEFAULT))
-    init_flags |= GNUTLS_NO_TICKETS;
+#ifdef GNUTLS_NO_TICKETS_TLS12
+  init_flags |= GNUTLS_NO_TICKETS_TLS12;
 #endif
 
-#if defined(GNUTLS_NO_STATUS_REQUEST)
+#ifdef GNUTLS_NO_STATUS_REQUEST
   if(!config->verifystatus)
     /* Disable the "status_request" TLS extension, enabled by default since
        GnuTLS 3.8.0. */
@@ -1049,6 +1045,7 @@ static CURLcode gtls_client_init(struct Curl_cfilter *cf,
   return CURLE_OK;
 }
 
+#ifdef CURL_GNUTLS_EARLY_DATA
 static int keylog_callback(gnutls_session_t session, const char *label,
                            const gnutls_datum_t *secret)
 {
@@ -1097,6 +1094,7 @@ static CURLcode gtls_on_session_reuse(struct Curl_cfilter *cf,
   }
   return result;
 }
+#endif
 
 CURLcode Curl_gtls_ctx_init(struct gtls_ctx *gctx,
                             struct Curl_cfilter *cf,
@@ -1144,9 +1142,7 @@ CURLcode Curl_gtls_ctx_init(struct gtls_ctx *gctx,
       else {
         infof(data, "SSL reusing session with ALPN '%s'",
               scs->alpn ? scs->alpn : "-");
-        if(ssl_config->earlydata && scs->alpn &&
-           !cf->conn->connect_only &&
-           (gnutls_protocol_get_version(gctx->session) == GNUTLS_TLS1_3)) {
+        if(ssl_config->earlydata && scs->alpn && !cf->conn->connect_only) {
           bool do_early_data = FALSE;
           if(sess_reuse_cb) {
             result = sess_reuse_cb(cf, data, &alpns, scs, &do_early_data);
@@ -1177,11 +1173,13 @@ CURLcode Curl_gtls_ctx_init(struct gtls_ctx *gctx,
       goto out;
   }
 
+#ifdef CURL_GNUTLS_EARLY_DATA
   /* Open the file if a TLS or QUIC backend has not done this before. */
   Curl_tls_keylog_open();
   if(Curl_tls_keylog_enabled()) {
     gnutls_session_set_keylog_function(gctx->session, keylog_callback);
   }
+#endif
 
   /* convert the ALPN string from our arguments to a list of strings that
    * gnutls wants and will convert internally back to this string for sending
@@ -1226,7 +1224,13 @@ gtls_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
 
   result = Curl_gtls_ctx_init(&backend->gtls, cf, data, &connssl->peer,
                               connssl->alpn, NULL, NULL, cf,
-                              gtls_on_session_reuse);
+#ifdef CURL_GNUTLS_EARLY_DATA
+                              gtls_on_session_reuse
+#else
+                              NULL
+#endif
+                              );
+
   if(result)
     return result;
 
@@ -1237,9 +1241,11 @@ gtls_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
     infof(data, VTLS_INFOF_ALPN_OFFER_1STR, proto.data);
   }
 
+#ifdef CURL_GNUTLS_EARLY_DATA
   gnutls_handshake_set_hook_function(backend->gtls.session,
                                      GNUTLS_HANDSHAKE_ANY, GNUTLS_HOOK_POST,
                                      gtls_handshake_cb);
+#endif
 
   /* register callback functions and handle to send and receive data. */
   gnutls_transport_set_ptr(backend->gtls.session, cf);
@@ -1329,6 +1335,190 @@ void Curl_gtls_report_handshake(struct Curl_easy *data,
 #endif
 }
 
+static void gtls_msg_verify_result(struct Curl_easy *data,
+                                   struct ssl_peer *peer,
+                                   gnutls_x509_crt_t x509_cert,
+                                   bool was_verified,
+                                   bool needs_verified)
+{
+  char certname[65] = ""; /* limited to 64 chars by ASN.1 */
+  size_t size = sizeof(certname);
+  int rc;
+
+  rc = gnutls_x509_crt_get_dn_by_oid(x509_cert, GNUTLS_OID_X520_COMMON_NAME,
+                                     0, /* the first and only one */
+                                     FALSE, certname, &size);
+  if(rc) {
+    infof(data, "error fetching CN from cert:%s", gnutls_strerror(rc));
+    certname[0] = 0;
+  }
+
+  if(!was_verified) {
+    if(needs_verified) {
+      failf(data, "SSL: certificate subject name (%s) does not match "
+            "target hostname '%s'", certname, peer->dispname);
+    }
+    else
+      infof(data, "  common name: %s (does not match '%s')",
+            certname, peer->dispname);
+  }
+  else
+    infof(data, "  common name: %s (matched)", certname);
+}
+
+static void gtls_infof_cert(struct Curl_easy *data,
+                            gnutls_x509_crt_t x509_cert)
+{
+#ifndef CURL_DISABLE_VERBOSE_STRINGS
+  if(Curl_trc_is_verbose(data)) {
+    gnutls_datum_t certfields;
+    int rc, algo;
+    time_t tstamp;
+    unsigned int bits;
+
+    /* public key algorithm's parameters */
+    algo = gnutls_x509_crt_get_pk_algorithm(x509_cert, &bits);
+    infof(data, "  certificate public key: %s",
+          gnutls_pk_algorithm_get_name((gnutls_pk_algorithm_t)algo));
+
+    /* version of the X.509 certificate. */
+    infof(data, "  certificate version: #%d",
+          gnutls_x509_crt_get_version(x509_cert));
+
+    rc = gnutls_x509_crt_get_dn2(x509_cert, &certfields);
+    if(rc)
+      infof(data, "Failed to get certificate name");
+    else {
+      infof(data, "  subject: %s", certfields.data);
+
+      tstamp = gnutls_x509_crt_get_activation_time(x509_cert);
+      showtime(data, "start date", tstamp);
+
+      tstamp = gnutls_x509_crt_get_expiration_time(x509_cert);
+      showtime(data, "expire date", tstamp);
+
+      gnutls_free(certfields.data);
+    }
+
+    rc = gnutls_x509_crt_get_issuer_dn2(x509_cert, &certfields);
+    if(rc)
+      infof(data, "Failed to get certificate issuer");
+    else {
+      infof(data, "  issuer: %s", certfields.data);
+
+      gnutls_free(certfields.data);
+    }
+  }
+#else
+  (void)data;
+  (void)x509_cert;
+#endif
+}
+
+static CURLcode gtls_verify_ocsp_status(struct Curl_easy *data,
+                                        gnutls_session_t session)
+{
+  gnutls_ocsp_resp_t ocsp_resp = NULL;
+  gnutls_datum_t status_request;
+  gnutls_ocsp_cert_status_t status;
+  gnutls_x509_crl_reason_t reason;
+  CURLcode result = CURLE_OK;
+  int rc;
+
+  rc = gnutls_ocsp_status_request_get(session, &status_request);
+
+  if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
+    failf(data, "No OCSP response received");
+    result = CURLE_SSL_INVALIDCERTSTATUS;
+    goto out;
+  }
+  else if(rc < 0) {
+    failf(data, "Invalid OCSP response received");
+    result = CURLE_SSL_INVALIDCERTSTATUS;
+    goto out;
+  }
+
+  gnutls_ocsp_resp_init(&ocsp_resp);
+
+  rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request);
+  if(rc < 0) {
+    failf(data, "Invalid OCSP response received");
+    result = CURLE_SSL_INVALIDCERTSTATUS;
+    goto out;
+  }
+
+  (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL,
+                                    &status, NULL, NULL, NULL, &reason);
+
+  switch(status) {
+  case GNUTLS_OCSP_CERT_GOOD:
+    break;
+
+  case GNUTLS_OCSP_CERT_REVOKED: {
+    const char *crl_reason;
+
+    switch(reason) {
+    default:
+    case GNUTLS_X509_CRLREASON_UNSPECIFIED:
+      crl_reason = "unspecified reason";
+      break;
+
+    case GNUTLS_X509_CRLREASON_KEYCOMPROMISE:
+      crl_reason = "private key compromised";
+      break;
+
+    case GNUTLS_X509_CRLREASON_CACOMPROMISE:
+      crl_reason = "CA compromised";
+      break;
+
+    case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED:
+      crl_reason = "affiliation has changed";
+      break;
+
+    case GNUTLS_X509_CRLREASON_SUPERSEDED:
+      crl_reason = "certificate superseded";
+      break;
+
+    case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION:
+      crl_reason = "operation has ceased";
+      break;
+
+    case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD:
+      crl_reason = "certificate is on hold";
+      break;
+
+    case GNUTLS_X509_CRLREASON_REMOVEFROMCRL:
+      crl_reason = "will be removed from delta CRL";
+      break;
+
+    case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN:
+      crl_reason = "privilege withdrawn";
+      break;
+
+    case GNUTLS_X509_CRLREASON_AACOMPROMISE:
+      crl_reason = "AA compromised";
+      break;
+    }
+
+    failf(data, "Server certificate was revoked: %s", crl_reason);
+    break;
+  }
+
+  default:
+  case GNUTLS_OCSP_CERT_UNKNOWN:
+    failf(data, "Server certificate status is unknown");
+    break;
+  }
+
+  result = (status != GNUTLS_OCSP_CERT_GOOD) ?
+           CURLE_SSL_INVALIDCERTSTATUS : CURLE_OK;
+
+out:
+  if(ocsp_resp)
+    gnutls_ocsp_resp_deinit(ocsp_resp);
+  return result;
+}
+
 CURLcode
 Curl_gtls_verifyserver(struct Curl_easy *data,
                        gnutls_session_t session,
@@ -1340,18 +1530,10 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
   unsigned int cert_list_size;
   const gnutls_datum_t *chainp;
   unsigned int verify_status = 0;
-  gnutls_x509_crt_t x509_cert, x509_issuer;
-  gnutls_datum_t issuerp;
-  gnutls_datum_t certfields;
-  char certname[65] = ""; /* limited to 64 chars by ASN.1 */
-  size_t size;
+  gnutls_x509_crt_t x509_cert = NULL, x509_issuer = NULL;
   time_t certclock;
   int rc;
   CURLcode result = CURLE_OK;
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  int algo;
-  unsigned int bits;
-#endif
   long * const certverifyresult = &ssl_config->certverifyresult;
 
   /* This function will return the peer's raw certificate (chain) as sent by
@@ -1375,7 +1557,8 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
 #endif
         failf(data, "failed to get server cert");
         *certverifyresult = GNUTLS_E_NO_CERTIFICATE_FOUND;
-        return CURLE_PEER_FAILED_VERIFICATION;
+        result = CURLE_PEER_FAILED_VERIFICATION;
+        goto out;
 #ifdef USE_GNUTLS_SRP
       }
 #endif
@@ -1388,7 +1571,7 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
 
     result = Curl_ssl_init_certinfo(data, (int)cert_list_size);
     if(result)
-      return result;
+      goto out;
 
     for(i = 0; i < cert_list_size; i++) {
       const char *beg = (const char *) chainp[i].data;
@@ -1396,7 +1579,7 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
 
       result = Curl_extract_certinfo(data, (int)i, beg, end);
       if(result)
-        return result;
+        goto out;
     }
   }
 
@@ -1412,7 +1595,8 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
     if(rc < 0) {
       failf(data, "server cert verify failed: %d", rc);
       *certverifyresult = rc;
-      return CURLE_SSL_CONNECT_ERROR;
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto out;
     }
 
     *certverifyresult = verify_status;
@@ -1434,7 +1618,8 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
               config->CAfile ? config->CAfile : "none",
               ssl_config->primary.CRLfile ?
               ssl_config->primary.CRLfile : "none");
-        return CURLE_PEER_FAILED_VERIFICATION;
+        result = CURLE_PEER_FAILED_VERIFICATION;
+        goto out;
       }
       else
         infof(data, "  server certificate verification FAILED");
@@ -1446,97 +1631,9 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
     infof(data, "  server certificate verification SKIPPED");
 
   if(config->verifystatus) {
-    gnutls_datum_t status_request;
-    gnutls_ocsp_resp_t ocsp_resp;
-    gnutls_ocsp_cert_status_t status;
-    gnutls_x509_crl_reason_t reason;
-
-    rc = gnutls_ocsp_status_request_get(session, &status_request);
-
-    if(rc == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
-      failf(data, "No OCSP response received");
-      return CURLE_SSL_INVALIDCERTSTATUS;
-    }
-
-    if(rc < 0) {
-      failf(data, "Invalid OCSP response received");
-      return CURLE_SSL_INVALIDCERTSTATUS;
-    }
-
-    gnutls_ocsp_resp_init(&ocsp_resp);
-
-    rc = gnutls_ocsp_resp_import(ocsp_resp, &status_request);
-    if(rc < 0) {
-      failf(data, "Invalid OCSP response received");
-      return CURLE_SSL_INVALIDCERTSTATUS;
-    }
-
-    (void)gnutls_ocsp_resp_get_single(ocsp_resp, 0, NULL, NULL, NULL, NULL,
-                                      &status, NULL, NULL, NULL, &reason);
-
-    switch(status) {
-    case GNUTLS_OCSP_CERT_GOOD:
-      break;
-
-    case GNUTLS_OCSP_CERT_REVOKED: {
-      const char *crl_reason;
-
-      switch(reason) {
-      default:
-      case GNUTLS_X509_CRLREASON_UNSPECIFIED:
-        crl_reason = "unspecified reason";
-        break;
-
-      case GNUTLS_X509_CRLREASON_KEYCOMPROMISE:
-        crl_reason = "private key compromised";
-        break;
-
-      case GNUTLS_X509_CRLREASON_CACOMPROMISE:
-        crl_reason = "CA compromised";
-        break;
-
-      case GNUTLS_X509_CRLREASON_AFFILIATIONCHANGED:
-        crl_reason = "affiliation has changed";
-        break;
-
-      case GNUTLS_X509_CRLREASON_SUPERSEDED:
-        crl_reason = "certificate superseded";
-        break;
-
-      case GNUTLS_X509_CRLREASON_CESSATIONOFOPERATION:
-        crl_reason = "operation has ceased";
-        break;
-
-      case GNUTLS_X509_CRLREASON_CERTIFICATEHOLD:
-        crl_reason = "certificate is on hold";
-        break;
-
-      case GNUTLS_X509_CRLREASON_REMOVEFROMCRL:
-        crl_reason = "will be removed from delta CRL";
-        break;
-
-      case GNUTLS_X509_CRLREASON_PRIVILEGEWITHDRAWN:
-        crl_reason = "privilege withdrawn";
-        break;
-
-      case GNUTLS_X509_CRLREASON_AACOMPROMISE:
-        crl_reason = "AA compromised";
-        break;
-      }
-
-      failf(data, "Server certificate was revoked: %s", crl_reason);
-      break;
-    }
-
-    default:
-    case GNUTLS_OCSP_CERT_UNKNOWN:
-      failf(data, "Server certificate status is unknown");
-      break;
-    }
-
-    gnutls_ocsp_resp_deinit(ocsp_resp);
-    if(status != GNUTLS_OCSP_CERT_GOOD)
-      return CURLE_SSL_INVALIDCERTSTATUS;
+    result = gtls_verify_ocsp_status(data, session);
+    if(result)
+      goto out;
   }
   else
     infof(data, "  server certificate status verification SKIPPED");
@@ -1550,33 +1647,22 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
     gnutls_x509_crt_import(x509_cert, chainp, GNUTLS_X509_FMT_DER);
 
   if(config->issuercert) {
+    gnutls_datum_t issuerp;
     gnutls_x509_crt_init(&x509_issuer);
     issuerp = load_file(config->issuercert);
     gnutls_x509_crt_import(x509_issuer, &issuerp, GNUTLS_X509_FMT_PEM);
     rc = (int)gnutls_x509_crt_check_issuer(x509_cert, x509_issuer);
-    gnutls_x509_crt_deinit(x509_issuer);
     unload_file(issuerp);
     if(rc <= 0) {
       failf(data, "server certificate issuer check failed (IssuerCert: %s)",
             config->issuercert ? config->issuercert : "none");
-      gnutls_x509_crt_deinit(x509_cert);
-      return CURLE_SSL_ISSUER_ERROR;
+      result = CURLE_SSL_ISSUER_ERROR;
+      goto out;
     }
     infof(data, "  server certificate issuer check OK (Issuer Cert: %s)",
           config->issuercert ? config->issuercert : "none");
   }
 
-  size = sizeof(certname);
-  rc = gnutls_x509_crt_get_dn_by_oid(x509_cert, GNUTLS_OID_X520_COMMON_NAME,
-                                     0, /* the first and only one */
-                                     FALSE,
-                                     certname,
-                                     &size);
-  if(rc) {
-    infof(data, "error fetching CN from cert:%s",
-          gnutls_strerror(rc));
-  }
-
   /* This function will check if the given certificate's subject matches the
      given hostname. This is a basic implementation of the matching described
      in RFC2818 (HTTPS), which takes into account wildcards, and the subject
@@ -1631,19 +1717,12 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
     }
   }
 #endif
-  if(!rc) {
-    if(config->verifyhost) {
-      failf(data, "SSL: certificate subject name (%s) does not match "
-            "target hostname '%s'", certname, peer->dispname);
-      gnutls_x509_crt_deinit(x509_cert);
-      return CURLE_PEER_FAILED_VERIFICATION;
-    }
-    else
-      infof(data, "  common name: %s (does not match '%s')",
-            certname, peer->dispname);
-  }
-  else
-    infof(data, "  common name: %s (matched)", certname);
+
+  result = (!rc && config->verifyhost) ?
+           CURLE_PEER_FAILED_VERIFICATION : CURLE_OK;
+  gtls_msg_verify_result(data, peer, x509_cert, rc, config->verifyhost);
+  if(result)
+    goto out;
 
   /* Check for time-based validity */
   certclock = gnutls_x509_crt_get_expiration_time(x509_cert);
@@ -1652,8 +1731,8 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
     if(config->verifypeer) {
       failf(data, "server cert expiration date verify failed");
       *certverifyresult = GNUTLS_CERT_EXPIRED;
-      gnutls_x509_crt_deinit(x509_cert);
-      return CURLE_SSL_CONNECT_ERROR;
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto out;
     }
     else
       infof(data, "  server certificate expiration date verify FAILED");
@@ -1663,8 +1742,8 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
       if(config->verifypeer) {
         failf(data, "server certificate expiration date has passed.");
         *certverifyresult = GNUTLS_CERT_EXPIRED;
-        gnutls_x509_crt_deinit(x509_cert);
-        return CURLE_PEER_FAILED_VERIFICATION;
+        result = CURLE_PEER_FAILED_VERIFICATION;
+        goto out;
       }
       else
         infof(data, "  server certificate expiration date FAILED");
@@ -1679,8 +1758,8 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
     if(config->verifypeer) {
       failf(data, "server cert activation date verify failed");
       *certverifyresult = GNUTLS_CERT_NOT_ACTIVATED;
-      gnutls_x509_crt_deinit(x509_cert);
-      return CURLE_SSL_CONNECT_ERROR;
+      result = CURLE_SSL_CONNECT_ERROR;
+      goto out;
     }
     else
       infof(data, "  server certificate activation date verify FAILED");
@@ -1690,8 +1769,8 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
       if(config->verifypeer) {
         failf(data, "server certificate not activated yet.");
         *certverifyresult = GNUTLS_CERT_NOT_ACTIVATED;
-        gnutls_x509_crt_deinit(x509_cert);
-        return CURLE_PEER_FAILED_VERIFICATION;
+        result = CURLE_PEER_FAILED_VERIFICATION;
+        goto out;
       }
       else
         infof(data, "  server certificate activation date FAILED");
@@ -1704,59 +1783,17 @@ Curl_gtls_verifyserver(struct Curl_easy *data,
     result = pkp_pin_peer_pubkey(data, x509_cert, pinned_key);
     if(result != CURLE_OK) {
       failf(data, "SSL: public key does not match pinned public key");
-      gnutls_x509_crt_deinit(x509_cert);
-      return result;
+      goto out;
     }
   }
 
-  /* Show:
-
-  - subject
-  - start date
-  - expire date
-  - common name
-  - issuer
-
-  */
-
-#ifndef CURL_DISABLE_VERBOSE_STRINGS
-  /* public key algorithm's parameters */
-  algo = gnutls_x509_crt_get_pk_algorithm(x509_cert, &bits);
-  infof(data, "  certificate public key: %s",
-        gnutls_pk_algorithm_get_name((gnutls_pk_algorithm_t)algo));
-
-  /* version of the X.509 certificate. */
-  infof(data, "  certificate version: #%d",
-        gnutls_x509_crt_get_version(x509_cert));
-
-
-  rc = gnutls_x509_crt_get_dn2(x509_cert, &certfields);
-  if(rc)
-    infof(data, "Failed to get certificate name");
-  else {
-    infof(data, "  subject: %s", certfields.data);
-
-    certclock = gnutls_x509_crt_get_activation_time(x509_cert);
-    showtime(data, "start date", certclock);
-
-    certclock = gnutls_x509_crt_get_expiration_time(x509_cert);
-    showtime(data, "expire date", certclock);
-
-    gnutls_free(certfields.data);
-  }
-
-  rc = gnutls_x509_crt_get_issuer_dn2(x509_cert, &certfields);
-  if(rc)
-    infof(data, "Failed to get certificate issuer");
-  else {
-    infof(data, "  issuer: %s", certfields.data);
-
-    gnutls_free(certfields.data);
-  }
-#endif
-
-  gnutls_x509_crt_deinit(x509_cert);
+  gtls_infof_cert(data, x509_cert);
 
+out:
+  if(x509_issuer)
+    gnutls_x509_crt_deinit(x509_issuer);
+  if(x509_cert)
+    gnutls_x509_crt_deinit(x509_cert);
   return result;
 }
 
@@ -1781,15 +1818,18 @@ static CURLcode gtls_verifyserver(struct Curl_cfilter *cf,
   if(result)
     goto out;
 
+#ifdef CURL_GNUTLS_EARLY_DATA
   /* Only on TLSv1.2 or lower do we have the session id now. For
    * TLSv1.3 we get it via a SESSION_TICKET message that arrives later. */
   if(gnutls_protocol_get_version(session) < GNUTLS_TLS1_3)
     result = cf_gtls_update_session_id(cf, data, session);
+#endif
 
 out:
   return result;
 }
 
+#ifdef CURL_GNUTLS_EARLY_DATA
 static CURLcode gtls_send_earlydata(struct Curl_cfilter *cf,
                                     struct Curl_easy *data)
 {
@@ -1828,6 +1868,7 @@ static CURLcode gtls_send_earlydata(struct Curl_cfilter *cf,
 out:
   return result;
 }
+#endif
 
 /*
  * This function is called after the TCP connect has completed. Setup the TLS
@@ -1864,6 +1905,7 @@ static CURLcode gtls_connect_common(struct Curl_cfilter *cf,
   }
 
   if(connssl->connecting_state == ssl_connect_2) {
+#ifdef CURL_GNUTLS_EARLY_DATA
     if(connssl->earlydata_state == ssl_earlydata_await) {
       goto out;
     }
@@ -1875,7 +1917,7 @@ static CURLcode gtls_connect_common(struct Curl_cfilter *cf,
     }
     DEBUGASSERT((connssl->earlydata_state == ssl_earlydata_none) ||
                 (connssl->earlydata_state == ssl_earlydata_sent));
-
+#endif
     result = handshake(cf, data);
     if(result)
       goto out;
@@ -1906,6 +1948,7 @@ static CURLcode gtls_connect_common(struct Curl_cfilter *cf,
     if(result)
       goto out;
 
+#ifdef CURL_GNUTLS_EARLY_DATA
     if(connssl->earlydata_state > ssl_earlydata_none) {
       /* We should be in this state by now */
       DEBUGASSERT(connssl->earlydata_state == ssl_earlydata_sent);
@@ -1914,6 +1957,7 @@ static CURLcode gtls_connect_common(struct Curl_cfilter *cf,
          GNUTLS_SFLAGS_EARLY_DATA) ?
         ssl_earlydata_accepted : ssl_earlydata_rejected;
     }
+#endif
     connssl->connecting_state = ssl_connect_done;
   }
 
@@ -1935,6 +1979,7 @@ static CURLcode gtls_connect(struct Curl_cfilter *cf,
                              struct Curl_easy *data,
                              bool *done)
 {
+#ifdef CURL_GNUTLS_EARLY_DATA
   struct ssl_connect_data *connssl = cf->ctx;
   if((connssl->state == ssl_connection_deferred) &&
      (connssl->earlydata_state == ssl_earlydata_await)) {
@@ -1942,6 +1987,7 @@ static CURLcode gtls_connect(struct Curl_cfilter *cf,
     *done = TRUE;
     return CURLE_OK;
   }
+#endif
   return gtls_connect_common(cf, data, done);
 }
 
@@ -1955,7 +2001,7 @@ static bool gtls_data_pending(struct Curl_cfilter *cf,
   DEBUGASSERT(ctx && ctx->backend);
   backend = (struct gtls_ssl_backend_data *)ctx->backend;
   if(backend->gtls.session &&
-     0 != gnutls_record_check_pending(backend->gtls.session))
+     gnutls_record_check_pending(backend->gtls.session) != 0)
     return TRUE;
   return FALSE;
 }
@@ -2090,7 +2136,7 @@ static void gtls_close(struct Curl_cfilter *cf,
   struct gtls_ssl_backend_data *backend =
     (struct gtls_ssl_backend_data *)connssl->backend;
 
-  (void) data;
+  (void)data;
   DEBUGASSERT(backend);
   CURL_TRC_CF(data, cf, "close");
   if(backend->gtls.session) {
@@ -2186,7 +2232,7 @@ static bool gtls_cert_status_request(void)
 }
 
 static void *gtls_get_internals(struct ssl_connect_data *connssl,
-                                CURLINFO info UNUSED_PARAM)
+                                CURLINFO info)
 {
   struct gtls_ssl_backend_data *backend =
     (struct gtls_ssl_backend_data *)connssl->backend;
diff --git a/deps/curl/lib/vtls/hostcheck.c b/deps/curl/lib/vtls/hostcheck.c
index 68af9be57d0..23ba33951f1 100644
--- a/deps/curl/lib/vtls/hostcheck.c
+++ b/deps/curl/lib/vtls/hostcheck.c
@@ -24,8 +24,7 @@
 
 #include "../curl_setup.h"
 
-#if defined(USE_OPENSSL)                        \
-  || defined(USE_SCHANNEL)
+#if defined(USE_OPENSSL) || defined(USE_SCHANNEL)
 /* these backends use functions from this file */
 
 #ifdef HAVE_NETINET_IN_H
diff --git a/deps/curl/lib/vtls/hostcheck.h b/deps/curl/lib/vtls/hostcheck.h
index 6b4e3796443..b843d09c65e 100644
--- a/deps/curl/lib/vtls/hostcheck.h
+++ b/deps/curl/lib/vtls/hostcheck.h
@@ -26,8 +26,12 @@
 
 #include <curl/curl.h>
 
+#if defined(USE_OPENSSL) || defined(USE_SCHANNEL)
+
 /* returns TRUE if there is a match */
 bool Curl_cert_hostcheck(const char *match_pattern, size_t matchlen,
                          const char *hostname, size_t hostlen);
 
+#endif
+
 #endif /* HEADER_CURL_HOSTCHECK_H */
diff --git a/deps/curl/lib/vtls/mbedtls.c b/deps/curl/lib/vtls/mbedtls.c
index 75190d30f3e..7b1a31e42f5 100644
--- a/deps/curl/lib/vtls/mbedtls.c
+++ b/deps/curl/lib/vtls/mbedtls.c
@@ -37,11 +37,10 @@
 /* #define MBEDTLS_DEBUG */
 
 #include <mbedtls/version.h>
-#if MBEDTLS_VERSION_NUMBER >= 0x02040000
-#include <mbedtls/net_sockets.h>
-#else
-#include <mbedtls/net.h>
+#if MBEDTLS_VERSION_NUMBER < 0x03020000
+  #error "mbedTLS 3.2.0 or later required"
 #endif
+#include <mbedtls/net_sockets.h>
 #include <mbedtls/ssl.h>
 #include <mbedtls/x509.h>
 
@@ -49,13 +48,9 @@
 #include <mbedtls/entropy.h>
 #include <mbedtls/ctr_drbg.h>
 #include <mbedtls/sha256.h>
-
-#if MBEDTLS_VERSION_MAJOR >= 2
-#  ifdef MBEDTLS_DEBUG
-#    include <mbedtls/debug.h>
-#  endif
-#endif /* MBEDTLS_VERSION_MAJOR >= 2 */
-
+#ifdef MBEDTLS_DEBUG
+#include <mbedtls/debug.h>
+#endif
 #include "cipher_suite.h"
 #include "../urldata.h"
 #include "../sendf.h"
@@ -104,8 +99,7 @@ struct mbed_ssl_backend_data {
 };
 
 /* apply threading? */
-#if (defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)) ||  \
-  defined(_WIN32)
+#if (defined(USE_THREADS_POSIX) && defined(HAVE_PTHREAD_H)) || defined(_WIN32)
 #define HAS_THREADING_SUPPORT
 #endif
 
@@ -113,19 +107,6 @@ struct mbed_ssl_backend_data {
 #define mbedtls_strerror(a,b,c) b[0] = 0
 #endif
 
-/* PSA can be used independently of TLS 1.3 */
-#if defined(MBEDTLS_USE_PSA_CRYPTO) && MBEDTLS_VERSION_NUMBER >= 0x03060000
-#define HAS_PSA_SUPPORT
-#endif
-
-#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && MBEDTLS_VERSION_NUMBER >= 0x03060000
-#define HAS_TLS13_SUPPORT
-#endif
-
-#if defined(HAS_TLS13_SUPPORT) && defined(MBEDTLS_SSL_SESSION_TICKETS)
-#define HAS_SESSION_TICKETS
-#endif
-
 #ifdef HAS_THREADING_SUPPORT
 static mbedtls_entropy_context ts_entropy;
 
@@ -171,9 +152,9 @@ static void mbed_debug(void *context, int level, const char *f_name,
                        int line_nb, const char *line)
 {
   struct Curl_easy *data = (struct Curl_easy *)context;
-  (void) level;
-  (void) line_nb;
-  (void) f_name;
+  (void)level;
+  (void)line_nb;
+  (void)f_name;
 
   if(data) {
     size_t len = strlen(line);
@@ -264,45 +245,25 @@ mbed_set_ssl_version_min_max(struct Curl_easy *data,
    * function basically always sets TLS 1.2 as min/max, unless given
    * unsupported option values. */
 
-#if MBEDTLS_VERSION_NUMBER < 0x03020000
-  int ver_min = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
-  int ver_max = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
-#else
-  /* mbedTLS 3.2.0 (2022) introduced new methods for setting TLS version */
   mbedtls_ssl_protocol_version ver_min = MBEDTLS_SSL_VERSION_TLS1_2;
   mbedtls_ssl_protocol_version ver_max =
-#ifdef HAS_TLS13_SUPPORT
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
     MBEDTLS_SSL_VERSION_TLS1_3
 #else
     MBEDTLS_SSL_VERSION_TLS1_2
 #endif
     ;
-#endif
 
   switch(conn_config->version) {
   case CURL_SSLVERSION_DEFAULT:
-#if MBEDTLS_VERSION_NUMBER < 0x03000000
-  case CURL_SSLVERSION_TLSv1:
-  case CURL_SSLVERSION_TLSv1_0:
-    ver_min = MBEDTLS_SSL_MINOR_VERSION_1;
-    break;
-  case CURL_SSLVERSION_TLSv1_1:
-    ver_min = MBEDTLS_SSL_MINOR_VERSION_2;
-    break;
-#else
   case CURL_SSLVERSION_TLSv1:
   case CURL_SSLVERSION_TLSv1_0:
   case CURL_SSLVERSION_TLSv1_1:
-#endif
   case CURL_SSLVERSION_TLSv1_2:
-#if MBEDTLS_VERSION_NUMBER < 0x03020000
-    ver_min = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
-#else
     ver_min = MBEDTLS_SSL_VERSION_TLS1_2;
-#endif
     break;
   case CURL_SSLVERSION_TLSv1_3:
-#ifdef HAS_TLS13_SUPPORT
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
     ver_min = MBEDTLS_SSL_VERSION_TLS1_3;
     break;
 #endif
@@ -316,42 +277,22 @@ mbed_set_ssl_version_min_max(struct Curl_easy *data,
   case CURL_SSLVERSION_MAX_DEFAULT:
   case CURL_SSLVERSION_MAX_NONE:
   case CURL_SSLVERSION_MAX_TLSv1_3:
-#ifdef HAS_TLS13_SUPPORT
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
     ver_max = MBEDTLS_SSL_VERSION_TLS1_3;
     break;
 #endif
   case CURL_SSLVERSION_MAX_TLSv1_2:
-#if MBEDTLS_VERSION_NUMBER < 0x03020000
-    ver_max = MBEDTLS_SSL_MINOR_VERSION_3; /* TLS 1.2 */
-#else
     ver_max = MBEDTLS_SSL_VERSION_TLS1_2;
-#endif
-    break;
-#if MBEDTLS_VERSION_NUMBER < 0x03000000
-  case CURL_SSLVERSION_MAX_TLSv1_1:
-    ver_max = MBEDTLS_SSL_MINOR_VERSION_2;
     break;
-  case CURL_SSLVERSION_MAX_TLSv1_0:
-    ver_max = MBEDTLS_SSL_MINOR_VERSION_1;
-    break;
-#else
   case CURL_SSLVERSION_MAX_TLSv1_1:
   case CURL_SSLVERSION_MAX_TLSv1_0:
-#endif
   default:
     failf(data, "mbedTLS: unsupported maximum TLS version value");
     return CURLE_SSL_CONNECT_ERROR;
   }
 
-#if MBEDTLS_VERSION_NUMBER < 0x03020000
-  mbedtls_ssl_conf_min_version(&backend->config, MBEDTLS_SSL_MAJOR_VERSION_3,
-                               ver_min);
-  mbedtls_ssl_conf_max_version(&backend->config, MBEDTLS_SSL_MAJOR_VERSION_3,
-                               ver_max);
-#else
   mbedtls_ssl_conf_min_tls_version(&backend->config, ver_min);
   mbedtls_ssl_conf_max_tls_version(&backend->config, ver_max);
-#endif
 
   return CURLE_OK;
 }
@@ -361,7 +302,6 @@ mbed_set_ssl_version_min_max(struct Curl_easy *data,
    cipher suite present in other SSL implementations. Provide
    provisional support for specifying the cipher suite here. */
 #ifdef MBEDTLS_TLS_ECJPAKE_WITH_AES_128_CCM_8
-#if MBEDTLS_VERSION_NUMBER >= 0x03020000
 static int
 mbed_cipher_suite_get_str(uint16_t id, char *buf, size_t buf_size,
                           bool prefer_rfc)
@@ -372,7 +312,6 @@ mbed_cipher_suite_get_str(uint16_t id, char *buf, size_t buf_size,
     return Curl_cipher_suite_get_str(id, buf, buf_size, prefer_rfc);
   return 0;
 }
-#endif
 
 static uint16_t
 mbed_cipher_suite_walk_str(const char **str, const char **end)
@@ -411,8 +350,8 @@ mbed_set_selected_ciphers(struct Curl_easy *data,
   if(!selected)
     return CURLE_OUT_OF_MEMORY;
 
-#ifndef HAS_TLS13_SUPPORT
-  (void) ciphers13, (void) j;
+#ifndef MBEDTLS_SSL_PROTO_TLS1_3
+  (void)ciphers13, (void)j;
 #else
   if(!ciphers13) {
     /* Add default TLSv1.3 ciphers to selection */
@@ -459,7 +398,7 @@ mbed_set_selected_ciphers(struct Curl_easy *data,
     selected[count++] = id;
   }
 
-#ifdef HAS_TLS13_SUPPORT
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
   if(ciphers == ciphers13 && ciphers12) {
     ciphers = ciphers12;
     goto add_ciphers;
@@ -500,9 +439,8 @@ mbed_set_selected_ciphers(struct Curl_easy *data,
 static void
 mbed_dump_cert_info(struct Curl_easy *data, const mbedtls_x509_crt *crt)
 {
-#if defined(CURL_DISABLE_VERBOSE_STRINGS) || \
-    (MBEDTLS_VERSION_NUMBER >= 0x03000000 && defined(MBEDTLS_X509_REMOVE_INFO))
-  (void) data, (void) crt;
+#if defined(CURL_DISABLE_VERBOSE_STRINGS) || defined(MBEDTLS_X509_REMOVE_INFO)
+  (void)data, (void)crt;
 #else
   const size_t bufsize = 16384;
   char *p, *buffer = malloc(bufsize);
@@ -559,7 +497,7 @@ static int mbed_verify_cb(void *ptr, mbedtls_x509_crt *crt,
     *flags &= ~MBEDTLS_X509_BADCERT_CN_MISMATCH;
 
   if(*flags) {
-#if MBEDTLS_VERSION_NUMBER < 0x03000000 || !defined(MBEDTLS_X509_REMOVE_INFO)
+#ifndef MBEDTLS_X509_REMOVE_INFO
     char buf[128];
     mbedtls_x509_crt_verify_info(buf, sizeof(buf), "", *flags);
     failf(data, "mbedTLS: %s", buf);
@@ -659,7 +597,7 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
       return CURLE_SSL_CACERT_BADFILE;
     }
 #else
-    failf(data, "mbedtls: functions that use the filesystem not built in");
+    failf(data, "mbedtls: functions that use the file system not built in");
     return CURLE_NOT_BUILT_IN;
 #endif
   }
@@ -677,7 +615,7 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
         return CURLE_SSL_CACERT_BADFILE;
     }
 #else
-    failf(data, "mbedtls: functions that use the filesystem not built in");
+    failf(data, "mbedtls: functions that use the file system not built in");
     return CURLE_NOT_BUILT_IN;
 #endif
   }
@@ -697,7 +635,7 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
       return CURLE_SSL_CERTPROBLEM;
     }
 #else
-    failf(data, "mbedtls: functions that use the filesystem not built in");
+    failf(data, "mbedtls: functions that use the file system not built in");
     return CURLE_NOT_BUILT_IN;
 #endif
   }
@@ -728,15 +666,10 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
   if(ssl_config->key || ssl_config->key_blob) {
     if(ssl_config->key) {
 #ifdef MBEDTLS_FS_IO
-#if MBEDTLS_VERSION_NUMBER >= 0x03000000
       ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
                                      ssl_config->key_passwd,
                                      mbedtls_ctr_drbg_random,
                                      &backend->ctr_drbg);
-#else
-      ret = mbedtls_pk_parse_keyfile(&backend->pk, ssl_config->key,
-                                     ssl_config->key_passwd);
-#endif
       if(ret == 0 && !(mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_RSA) ||
                        mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_ECKEY)))
         ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
@@ -748,7 +681,7 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
         return CURLE_SSL_CERTPROBLEM;
       }
 #else
-      failf(data, "mbedtls: functions that use the filesystem not built in");
+      failf(data, "mbedtls: functions that use the file system not built in");
       return CURLE_NOT_BUILT_IN;
 #endif
     }
@@ -757,17 +690,11 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
       const unsigned char *key_data =
         (const unsigned char *)ssl_key_blob->data;
       const char *passwd = ssl_config->key_passwd;
-#if MBEDTLS_VERSION_NUMBER >= 0x03000000
       ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
                                  (const unsigned char *)passwd,
                                  passwd ? strlen(passwd) : 0,
                                  mbedtls_ctr_drbg_random,
                                  &backend->ctr_drbg);
-#else
-      ret = mbedtls_pk_parse_key(&backend->pk, key_data, ssl_key_blob->len,
-                                 (const unsigned char *)passwd,
-                                 passwd ? strlen(passwd) : 0);
-#endif
       if(ret == 0 && !(mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_RSA) ||
                        mbedtls_pk_can_do(&backend->pk, MBEDTLS_PK_ECKEY)))
         ret = MBEDTLS_ERR_PK_TYPE_MISMATCH;
@@ -797,7 +724,7 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
       return CURLE_SSL_CRL_BADFILE;
     }
 #else
-    failf(data, "mbedtls: functions that use the filesystem not built in");
+    failf(data, "mbedtls: functions that use the file system not built in");
     return CURLE_NOT_BUILT_IN;
 #endif
   }
@@ -820,7 +747,7 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
     return CURLE_SSL_CONNECT_ERROR;
   }
 
-#if defined(HAS_SESSION_TICKETS) && MBEDTLS_VERSION_NUMBER >= 0x03060100
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
   /* New in mbedTLS 3.6.1, need to enable, default is now disabled */
   mbedtls_ssl_conf_tls13_enable_signal_new_session_tickets(&backend->config,
     MBEDTLS_SSL_TLS1_3_SIGNAL_NEW_SESSION_TICKETS_ENABLED);
@@ -859,7 +786,7 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
                       mbedtls_bio_cf_read,
                       NULL /*  rev_timeout() */);
 
-#ifndef HAS_TLS13_SUPPORT
+#ifndef MBEDTLS_SSL_PROTO_TLS1_3
   if(conn_config->cipher_list) {
     CURLcode result = mbed_set_selected_ciphers(data, backend,
                                                 conn_config->cipher_list,
@@ -881,12 +808,12 @@ mbed_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
   }
 
 
-#if defined(MBEDTLS_SSL_RENEGOTIATION)
+#ifdef MBEDTLS_SSL_RENEGOTIATION
   mbedtls_ssl_conf_renegotiation(&backend->config,
                                  MBEDTLS_SSL_RENEGOTIATION_ENABLED);
 #endif
 
-#if defined(MBEDTLS_SSL_SESSION_TICKETS)
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
   mbedtls_ssl_conf_session_tickets(&backend->config,
                                    MBEDTLS_SSL_SESSION_TICKETS_DISABLED);
 #endif
@@ -1021,17 +948,14 @@ mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
   }
   else if(ret) {
     char errorbuf[128];
-#if MBEDTLS_VERSION_NUMBER >= 0x03020000
     CURL_TRC_CF(data, cf, "TLS version %04X",
                 mbedtls_ssl_get_version_number(&backend->ssl));
-#endif
     mbedtls_strerror(ret, errorbuf, sizeof(errorbuf));
     failf(data, "ssl_handshake returned: (-0x%04X) %s",
           -ret, errorbuf);
     return CURLE_SSL_CONNECT_ERROR;
   }
 
-#if MBEDTLS_VERSION_NUMBER >= 0x03020000
   {
     char cipher_str[64];
     uint16_t cipher_id;
@@ -1041,10 +965,6 @@ mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
     infof(data, "mbedTLS: %s Handshake complete, cipher is %s",
           mbedtls_ssl_get_version(&backend->ssl), cipher_str);
   }
-#else
-  infof(data, "mbedTLS: %s Handshake complete",
-        mbedtls_ssl_get_version(&backend->ssl));
-#endif
 
   if(pinnedpubkey) {
     int size;
@@ -1054,12 +974,7 @@ mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
     unsigned char *pubkey = NULL;
 
     peercert = mbedtls_ssl_get_peer_cert(&backend->ssl);
-#if MBEDTLS_VERSION_NUMBER == 0x03000000
-    if(!peercert || !peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p) ||
-       !peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len)) {
-#else
     if(!peercert || !peercert->raw.p || !peercert->raw.len) {
-#endif
       failf(data, "Failed due to missing peer certificate");
       return CURLE_SSL_PINNEDPUBKEYNOTMATCH;
     }
@@ -1081,24 +996,13 @@ mbed_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
     /* Make a copy of our const peercert because mbedtls_pk_write_pubkey_der
        needs a non-const key, for now.
        https://github.com/Mbed-TLS/mbedtls/issues/396 */
-#if MBEDTLS_VERSION_NUMBER == 0x03000000
-    if(mbedtls_x509_crt_parse_der(p,
-                        peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(p),
-                        peercert->MBEDTLS_PRIVATE(raw).MBEDTLS_PRIVATE(len))) {
-#else
     if(mbedtls_x509_crt_parse_der(p, peercert->raw.p, peercert->raw.len)) {
-#endif
       failf(data, "Failed copying peer certificate");
       result = CURLE_SSL_PINNEDPUBKEYNOTMATCH;
       goto pinnedpubkey_error;
     }
 
-#if MBEDTLS_VERSION_NUMBER == 0x03000000
-    size = mbedtls_pk_write_pubkey_der(&p->MBEDTLS_PRIVATE(pk), pubkey,
-                                       PUB_DER_MAX_BYTES);
-#else
     size = mbedtls_pk_write_pubkey_der(&p->pk, pubkey, PUB_DER_MAX_BYTES);
-#endif
 
     if(size <= 0) {
       failf(data, "Failed copying public key from peer certificate");
@@ -1181,11 +1085,7 @@ mbed_new_session(struct Curl_cfilter *cf, struct Curl_easy *data)
     goto out;
   }
 
-#if MBEDTLS_VERSION_NUMBER >= 0x03020000
   ietf_tls_id = mbedtls_ssl_get_version_number(&backend->ssl);
-#else
-  ietf_tls_id = CURL_IETF_PROTO_UNKNOWN;
-#endif
   result = Curl_ssl_session_create(sdata, slen,
                                    ietf_tls_id,
                                    connssl->negotiated.alpn, 0, 0,
@@ -1236,7 +1136,7 @@ static CURLcode mbed_send(struct Curl_cfilter *cf, struct Curl_easy *data,
     CURL_TRC_CF(data, cf, "mbedtls_ssl_write(len=%zu) -> -0x%04X",
                 len, -nwritten);
     result = ((nwritten == MBEDTLS_ERR_SSL_WANT_WRITE)
-#ifdef HAS_TLS13_SUPPORT
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
       || (nwritten == MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET)
 #endif
       ) ? CURLE_AGAIN : CURLE_SEND_ERROR;
@@ -1306,7 +1206,7 @@ static CURLcode mbedtls_shutdown(struct Curl_cfilter *cf,
      * WANT_READ, but has not encountered an EAGAIN. */
     if(ret == MBEDTLS_ERR_SSL_WANT_READ)
       ret = mbedtls_ssl_read(&backend->ssl, buf, sizeof(buf));
-#ifdef HAS_TLS13_SUPPORT
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3
     if(ret == MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET)
       continue;
 #endif
@@ -1388,7 +1288,7 @@ static CURLcode mbed_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
     CURL_TRC_CF(data, cf, "mbedtls_ssl_read(len=%zu) -> -0x%04X",
                 buffersize, -nread);
     switch(nread) {
-#ifdef HAS_SESSION_TICKETS
+#ifdef MBEDTLS_SSL_SESSION_TICKETS
     case MBEDTLS_ERR_SSL_RECEIVED_NEW_SESSION_TICKET:
       mbed_new_session(cf, data);
       FALLTHROUGH();
@@ -1427,7 +1327,7 @@ static size_t mbedtls_version(char *buffer, size_t size)
 static CURLcode mbedtls_random(struct Curl_easy *data,
                                unsigned char *entropy, size_t length)
 {
-#if defined(MBEDTLS_CTR_DRBG_C)
+#ifdef MBEDTLS_CTR_DRBG_C
   int ret;
   mbedtls_entropy_context ctr_entropy;
   mbedtls_ctr_drbg_context ctr_drbg;
@@ -1486,16 +1386,12 @@ static CURLcode mbedtls_connect(struct Curl_cfilter *cf,
 
   if(ssl_connect_3 == connssl->connecting_state) {
     /* For tls1.3 we get notified about new sessions */
-#if MBEDTLS_VERSION_NUMBER >= 0x03020000
     struct ssl_connect_data *ctx = cf->ctx;
     struct mbed_ssl_backend_data *backend =
       (struct mbed_ssl_backend_data *)ctx->backend;
 
     if(mbedtls_ssl_get_version_number(&backend->ssl) <=
        MBEDTLS_SSL_VERSION_TLS1_2) {
-#else
-    {  /* no TLSv1.3 supported here */
-#endif
       retcode = mbed_new_session(cf, data);
       if(retcode)
         return retcode;
@@ -1522,7 +1418,7 @@ static int mbedtls_init(void)
 #ifdef HAS_THREADING_SUPPORT
   entropy_init_mutex(&ts_entropy);
 #endif
-#ifdef HAS_PSA_SUPPORT
+#ifdef MBEDTLS_USE_PSA_CRYPTO  /* requires mbedTLS 3.6.0+ */
   {
     int ret;
 #ifdef HAS_THREADING_SUPPORT
@@ -1535,7 +1431,7 @@ static int mbedtls_init(void)
     if(ret != PSA_SUCCESS)
       return 0;
   }
-#endif /* HAS_PSA_SUPPORT */
+#endif /* MBEDTLS_USE_PSA_CRYPTO */
   return 1;
 }
 
@@ -1562,25 +1458,17 @@ static bool mbedtls_data_pending(struct Curl_cfilter *cf,
 static CURLcode mbedtls_sha256sum(const unsigned char *input,
                                   size_t inputlen,
                                   unsigned char *sha256sum,
-                                  size_t sha256len UNUSED_PARAM)
+                                  size_t sha256len)
 {
   (void)sha256len;
-#if MBEDTLS_VERSION_NUMBER < 0x02070000
-  mbedtls_sha256(input, inputlen, sha256sum, 0);
-#else
   /* returns 0 on success, otherwise failure */
-#if MBEDTLS_VERSION_NUMBER >= 0x03000000
   if(mbedtls_sha256(input, inputlen, sha256sum, 0) != 0)
-#else
-  if(mbedtls_sha256_ret(input, inputlen, sha256sum, 0) != 0)
-#endif
     return CURLE_BAD_FUNCTION_ARGUMENT;
-#endif
   return CURLE_OK;
 }
 
 static void *mbedtls_get_internals(struct ssl_connect_data *connssl,
-                                   CURLINFO info UNUSED_PARAM)
+                                   CURLINFO info)
 {
   struct mbed_ssl_backend_data *backend =
     (struct mbed_ssl_backend_data *)connssl->backend;
@@ -1597,7 +1485,7 @@ const struct Curl_ssl Curl_ssl_mbedtls = {
   SSLSUPP_CERTINFO |
   SSLSUPP_PINNEDPUBKEY |
   SSLSUPP_SSL_CTX |
-#ifdef HAS_TLS13_SUPPORT
+#ifdef MBEDTLS_SSL_PROTO_TLS1_3  /* requires mbedTLS 3.6.0+ */
   SSLSUPP_TLS13_CIPHERSUITES |
 #endif
   SSLSUPP_HTTPS_PROXY |
diff --git a/deps/curl/lib/vtls/openssl.c b/deps/curl/lib/vtls/openssl.c
index b0f91cf400f..a49203ab07d 100644
--- a/deps/curl/lib/vtls/openssl.c
+++ b/deps/curl/lib/vtls/openssl.c
@@ -61,6 +61,7 @@
 #include "../vauth/vauth.h"
 #include "keylog.h"
 #include "hostcheck.h"
+#include "../transfer.h"
 #include "../multiif.h"
 #include "../curlx/strparse.h"
 #include "../strdup.h"
@@ -89,11 +90,9 @@
 #define USE_ECH_OPENSSL
 #endif
 
-#ifdef USE_ECH_OPENSSL
-# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
-#  include <openssl/ech.h>
-# endif
-#endif /* USE_ECH_OPENSSL */
+#if defined(USE_ECH_OPENSSL) && !defined(HAVE_BORINGSSL_LIKE)
+#include <openssl/ech.h>
+#endif
 
 #ifndef OPENSSL_NO_OCSP
 #include <openssl/ocsp.h>
@@ -105,15 +104,15 @@
 #endif
 
 #ifdef LIBRESSL_VERSION_NUMBER
-# /* As of LibreSSL 2.0.0-4.0.0: OPENSSL_VERSION_NUMBER == 0x20000000L */
-# if LIBRESSL_VERSION_NUMBER < 0x2090100fL /* 2019-04-13 */
-#  error "LibreSSL 2.9.1 or later required"
-# endif
+/* As of LibreSSL 2.0.0-4.0.0: OPENSSL_VERSION_NUMBER == 0x20000000L */
+#  if LIBRESSL_VERSION_NUMBER < 0x2090100fL /* 2019-04-13 */
+#    error "LibreSSL 2.9.1 or later required"
+#  endif
 #elif OPENSSL_VERSION_NUMBER < 0x1000201fL /* 2015-03-19 */
-# error "OpenSSL 1.0.2a or later required"
+#  error "OpenSSL 1.0.2a or later required"
 #endif
 
-#if OPENSSL_VERSION_NUMBER >= 0x3000000fL && !defined(OPENSSL_NO_UI_CONSOLE)
+#if defined(HAVE_OPENSSL3) && !defined(OPENSSL_NO_UI_CONSOLE)
 #include <openssl/provider.h>
 #include <openssl/store.h>
 /* this is used in the following conditions to make them easier to read */
@@ -122,10 +121,15 @@
 static void ossl_provider_cleanup(struct Curl_easy *data);
 #endif
 
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L && \
-     !defined(LIBRESSL_VERSION_NUMBER) && \
-     !defined(OPENSSL_IS_BORINGSSL))
-  #define HAVE_SSL_CTX_SET_DEFAULT_READ_BUFFER_LEN 1
+/*
+ * AWS-LC has `SSL_CTX_set_default_read_buffer_len()?` but runs into
+ * decryption failures with large buffers. Sporadic failures in
+ * test_10_08 with h2 proxy uploads, increased frequency
+ * with CURL_DBG_SOCK_RBLOCK=50. Looks like a bug on their part.
+ */
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
+  !defined(LIBRESSL_VERSION_NUMBER) && !defined(HAVE_BORINGSSL_LIKE)
+#define HAVE_SSL_CTX_SET_DEFAULT_READ_BUFFER_LEN 1
 #endif
 
 #include "../curlx/warnless.h"
@@ -134,17 +138,6 @@ static void ossl_provider_cleanup(struct Curl_easy *data);
 #include "../curl_memory.h"
 #include "../memdebug.h"
 
-/* Uncomment the ALLOW_RENEG line to a real #define if you want to allow TLS
-   renegotiations when built with BoringSSL. Renegotiating is non-compliant
-   with HTTP/2 and "an extremely dangerous protocol feature". Beware.
-
-#define ALLOW_RENEG 1
- */
-
-#ifndef OPENSSL_VERSION_NUMBER
-#error "OPENSSL_VERSION_NUMBER not defined"
-#endif
-
 #if defined(USE_OPENSSL_ENGINE) || defined(OPENSSL_HAS_PROVIDERS)
 #include <openssl/ui.h>
 #endif
@@ -174,7 +167,7 @@ static void ossl_provider_cleanup(struct Curl_easy *data);
 #define HAVE_SSL_COMP_FREE_COMPRESSION_METHODS 1
 #endif
 
-#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
+#ifdef HAVE_OPENSSL3
 #define HAVE_EVP_PKEY_GET_PARAMS 1
 #endif
 
@@ -197,10 +190,10 @@ static void ossl_provider_cleanup(struct Curl_easy *data);
      (defined(LIBRESSL_VERSION_NUMBER) && \
       LIBRESSL_VERSION_NUMBER >= 0x3040100fL)) && \
     !defined(OPENSSL_IS_BORINGSSL)
-  #define HAVE_SSL_CTX_SET_CIPHERSUITES
-  #ifndef OPENSSL_IS_AWSLC
-    #define HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH
-  #endif
+#  define HAVE_SSL_CTX_SET_CIPHERSUITES
+#  ifndef OPENSSL_IS_AWSLC
+#    define HAVE_SSL_CTX_SET_POST_HANDSHAKE_AUTH
+#  endif
 #endif
 
 /* Whether SSL_CTX_set1_sigalgs_list is available
@@ -208,9 +201,8 @@ static void ossl_provider_cleanup(struct Curl_easy *data);
  * BoringSSL: supported since 0.20240913.0 (commit 826ce15)
  * LibreSSL: no
  */
-#if (OPENSSL_VERSION_NUMBER >= 0x10002000L && \
-      !defined(LIBRESSL_VERSION_NUMBER))
-  #define HAVE_SSL_CTX_SET1_SIGALGS
+#if OPENSSL_VERSION_NUMBER >= 0x10002000L && !defined(LIBRESSL_VERSION_NUMBER)
+#define HAVE_SSL_CTX_SET1_SIGALGS
 #endif
 
 #ifdef LIBRESSL_VERSION_NUMBER
@@ -219,21 +211,23 @@ static void ossl_provider_cleanup(struct Curl_easy *data);
 #define OSSL_PACKAGE "BoringSSL"
 #elif defined(OPENSSL_IS_AWSLC)
 #define OSSL_PACKAGE "AWS-LC"
-#elif (defined(USE_NGTCP2) && defined(USE_NGHTTP3) && \
-       !defined(OPENSSL_QUIC_API2)) || defined(USE_MSH3)
+#elif defined(USE_NGTCP2) && defined(USE_NGHTTP3) &&   \
+  !defined(OPENSSL_QUIC_API2)
 #define OSSL_PACKAGE "quictls"
 #else
 #define OSSL_PACKAGE "OpenSSL"
 #endif
 
-#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+#ifdef HAVE_BORINGSSL_LIKE
 typedef size_t numcert_t;
+typedef uint32_t sslerr_t;
 #else
 typedef int numcert_t;
+typedef unsigned long sslerr_t;
 #endif
 #define ossl_valsize_t numcert_t
 
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
 /* up2date versions of OpenSSL maintain reasonably secure defaults without
  * breaking compatibility, so it is better not to override the defaults in curl
  */
@@ -244,36 +238,16 @@ typedef int numcert_t;
   "ALL:!EXPORT:!EXPORT40:!EXPORT56:!aNULL:!LOW:!RC4:@STRENGTH"
 #endif
 
-#ifdef HAVE_OPENSSL_SRP
-/* the function exists */
-#ifdef USE_TLS_SRP
-/* the functionality is not disabled */
-#define USE_OPENSSL_SRP
-#endif
-#endif
-
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
 #define HAVE_RANDOM_INIT_BY_DEFAULT 1
 #endif
 
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) && \
-    !defined(OPENSSL_IS_BORINGSSL) && \
-    !defined(OPENSSL_IS_AWSLC)
-#define HAVE_OPENSSL_VERSION
-#endif
-
-#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
-typedef uint32_t sslerr_t;
-#else
-typedef unsigned long sslerr_t;
-#endif
-
 /*
  * Whether the OpenSSL version has the API needed to support sharing an
  * X509_STORE between connections. The API is:
  * * `X509_STORE_up_ref`       -- Introduced: OpenSSL 1.1.0.
  */
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) /* OpenSSL >= 1.1.0 */
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L /* OpenSSL >= 1.1.0 */
 #define HAVE_SSL_X509_STORE_SHARE
 #endif
 
@@ -344,8 +318,7 @@ static CURLcode X509V3_ext(struct Curl_easy *data,
 {
   int i;
   CURLcode result = CURLE_OK;
-#if OPENSSL_VERSION_NUMBER >= 0x10100000L && \
-  !defined(LIBRESSL_VERSION_NUMBER)
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(LIBRESSL_VERSION_NUMBER)
   const STACK_OF(X509_EXTENSION) *exts = extsarg;
 #else
   STACK_OF(X509_EXTENSION) *exts = CURL_UNCONST(extsarg);
@@ -703,13 +676,11 @@ static long ossl_bio_cf_ctrl(BIO *bio, int cmd, long num, void *ptr)
   case BIO_CTRL_DUP:
     ret = 1;
     break;
-#ifdef BIO_CTRL_EOF
   case BIO_CTRL_EOF: {
     /* EOF has been reached on input? */
     struct ssl_connect_data *connssl = cf->ctx;
     return connssl->peer_closed;
   }
-#endif
   default:
     ret = 0;
     break;
@@ -850,13 +821,19 @@ static void ossl_keylog_callback(const SSL *ssl, const char *line)
 static void
 ossl_log_tls12_secret(const SSL *ssl, bool *keylog_done)
 {
-  const SSL_SESSION *session = SSL_get_session(ssl);
+  const SSL_SESSION *session;
   unsigned char client_random[SSL3_RANDOM_SIZE];
   unsigned char master_key[SSL_MAX_MASTER_KEY_LENGTH];
   int master_key_length = 0;
 
-  if(!session || *keylog_done)
+  ERR_set_mark();
+
+  session = SSL_get_session(ssl);
+
+  if(!session || *keylog_done) {
+    ERR_pop_to_mark();
     return;
+  }
 
 #if OPENSSL_VERSION_NUMBER >= 0x10100000L
   /* ssl->s3 is not checked in OpenSSL 1.1.0-pre6, but let's assume that
@@ -872,6 +849,8 @@ ossl_log_tls12_secret(const SSL *ssl, bool *keylog_done)
   }
 #endif
 
+  ERR_pop_to_mark();
+
   /* The handshake has not progressed sufficiently yet, or this is a TLS 1.3
    * session (when curl was built with older OpenSSL headers and running with
    * newer OpenSSL runtime libraries). */
@@ -905,17 +884,17 @@ static const char *SSL_ERROR_to_str(int err)
     return "SSL_ERROR_WANT_CONNECT";
   case SSL_ERROR_WANT_ACCEPT:
     return "SSL_ERROR_WANT_ACCEPT";
-#ifdef SSL_ERROR_WANT_ASYNC
+#ifdef SSL_ERROR_WANT_ASYNC  /* OpenSSL 1.1.0+, LibreSSL 3.6.0+ */
   case SSL_ERROR_WANT_ASYNC:
     return "SSL_ERROR_WANT_ASYNC";
 #endif
-#ifdef SSL_ERROR_WANT_ASYNC_JOB
+#ifdef SSL_ERROR_WANT_ASYNC_JOB  /* OpenSSL 1.1.0+, LibreSSL 3.6.0+ */
   case SSL_ERROR_WANT_ASYNC_JOB:
     return "SSL_ERROR_WANT_ASYNC_JOB";
 #endif
-#ifdef SSL_ERROR_WANT_EARLY
-  case SSL_ERROR_WANT_EARLY:
-    return "SSL_ERROR_WANT_EARLY";
+#ifdef SSL_ERROR_WANT_CLIENT_HELLO_CB  /* OpenSSL 1.1.1, LibreSSL 3.6.0+ */
+  case SSL_ERROR_WANT_CLIENT_HELLO_CB:
+    return "SSL_ERROR_WANT_CLIENT_HELLO_CB";
 #endif
   default:
     return "SSL_ERROR unknown";
@@ -940,7 +919,7 @@ static char *ossl_strerror(unsigned long error, char *buf, size_t size)
     *buf = '\0';
   }
 
-#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+#ifdef HAVE_BORINGSSL_LIKE
   ERR_error_string_n((uint32_t)error, buf, size);
 #else
   ERR_error_string_n(error, buf, size);
@@ -958,7 +937,7 @@ static char *ossl_strerror(unsigned long error, char *buf, size_t size)
 static int passwd_callback(char *buf, int num, int encrypting,
                            void *password)
 {
-  DEBUGASSERT(0 == encrypting);
+  DEBUGASSERT(encrypting == 0);
 
   if(!encrypting && num >= 0 && password) {
     int klen = curlx_uztosi(strlen((char *)password));
@@ -975,7 +954,7 @@ static int passwd_callback(char *buf, int num, int encrypting,
  */
 static bool rand_enough(void)
 {
-  return 0 != RAND_status();
+  return RAND_status() != 0;
 }
 
 static CURLcode ossl_seed(struct Curl_easy *data)
@@ -1124,7 +1103,7 @@ static bool is_pkcs11_uri(const char *string)
 #endif
 
 static CURLcode ossl_set_engine(struct Curl_easy *data, const char *engine);
-#if defined(OPENSSL_HAS_PROVIDERS)
+#ifdef OPENSSL_HAS_PROVIDERS
 static CURLcode ossl_set_provider(struct Curl_easy *data,
                                   const char *provider);
 #endif
@@ -1249,27 +1228,438 @@ use_certificate_chain_blob(SSL_CTX *ctx, const struct curl_blob *blob,
   return ret;
 }
 
-static
-int cert_stuff(struct Curl_easy *data,
-               SSL_CTX* ctx,
-               char *cert_file,
-               const struct curl_blob *cert_blob,
-               const char *cert_type,
-               char *key_file,
-               const struct curl_blob *key_blob,
-               const char *key_type,
-               char *key_passwd)
+static int enginecheck(struct Curl_easy *data,
+                       SSL_CTX* ctx,
+                       const char *key_file,
+                       const char *key_passwd)
+#ifdef USE_OPENSSL_ENGINE
+{
+  EVP_PKEY *priv_key = NULL;
+
+  /* Implicitly use pkcs11 engine if none was provided and the
+   * key_file is a PKCS#11 URI */
+  if(!data->state.engine) {
+    if(is_pkcs11_uri(key_file)) {
+      if(ossl_set_engine(data, "pkcs11") != CURLE_OK) {
+        return 0;
+      }
+    }
+  }
+
+  if(data->state.engine) {
+    UI_METHOD *ui_method =
+      UI_create_method(OSSL_UI_METHOD_CAST("curl user interface"));
+    if(!ui_method) {
+      failf(data, "unable do create " OSSL_PACKAGE " user-interface method");
+      return 0;
+    }
+    UI_method_set_opener(ui_method, UI_method_get_opener(UI_OpenSSL()));
+    UI_method_set_closer(ui_method, UI_method_get_closer(UI_OpenSSL()));
+    UI_method_set_reader(ui_method, ssl_ui_reader);
+    UI_method_set_writer(ui_method, ssl_ui_writer);
+    priv_key = ENGINE_load_private_key(data->state.engine, key_file,
+                                       ui_method,
+                                       CURL_UNCONST(key_passwd));
+    UI_destroy_method(ui_method);
+    if(!priv_key) {
+      failf(data, "failed to load private key from crypto engine");
+      return 0;
+    }
+    if(SSL_CTX_use_PrivateKey(ctx, priv_key) != 1) {
+      failf(data, "unable to set private key");
+      EVP_PKEY_free(priv_key);
+      return 0;
+    }
+    EVP_PKEY_free(priv_key);  /* we do not need the handle any more... */
+  }
+  else {
+    failf(data, "crypto engine not set, cannot load private key");
+    return 0;
+  }
+  return 1;
+}
+#else
+{
+  (void)ctx;
+  (void)key_file;
+  (void)key_passwd;
+  failf(data, "SSL_FILETYPE_ENGINE not supported for private key");
+  return 0;
+}
+#endif
+
+static int providercheck(struct Curl_easy *data,
+                         SSL_CTX* ctx,
+                         const char *key_file)
+#ifdef OPENSSL_HAS_PROVIDERS
 {
   char error_buffer[256];
-  bool check_privkey = TRUE;
+  /* Implicitly use pkcs11 provider if none was provided and the
+   * key_file is a PKCS#11 URI */
+  if(!data->state.provider_loaded) {
+    if(is_pkcs11_uri(key_file)) {
+      if(ossl_set_provider(data, "pkcs11") != CURLE_OK) {
+        return 0;
+      }
+    }
+  }
 
+  if(data->state.provider_loaded) {
+    /* Load the private key from the provider */
+    EVP_PKEY *priv_key = NULL;
+    OSSL_STORE_CTX *store = NULL;
+    OSSL_STORE_INFO *info = NULL;
+    UI_METHOD *ui_method =
+      UI_create_method(OSSL_UI_METHOD_CAST("curl user interface"));
+    if(!ui_method) {
+      failf(data, "unable do create " OSSL_PACKAGE " user-interface method");
+      return 0;
+    }
+    UI_method_set_opener(ui_method, UI_method_get_opener(UI_OpenSSL()));
+    UI_method_set_closer(ui_method, UI_method_get_closer(UI_OpenSSL()));
+    UI_method_set_reader(ui_method, ssl_ui_reader);
+    UI_method_set_writer(ui_method, ssl_ui_writer);
+
+    store = OSSL_STORE_open_ex(key_file, data->state.libctx,
+                               data->state.propq, ui_method, NULL, NULL,
+                               NULL, NULL);
+    if(!store) {
+      failf(data, "Failed to open OpenSSL store: %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+    if(OSSL_STORE_expect(store, OSSL_STORE_INFO_PKEY) != 1) {
+      failf(data, "Failed to set store preference. Ignoring the error: %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+    }
+
+    info = OSSL_STORE_load(store);
+    if(info) {
+      int ossl_type = OSSL_STORE_INFO_get_type(info);
+
+      if(ossl_type == OSSL_STORE_INFO_PKEY)
+        priv_key = OSSL_STORE_INFO_get1_PKEY(info);
+      OSSL_STORE_INFO_free(info);
+    }
+    OSSL_STORE_close(store);
+    UI_destroy_method(ui_method);
+    if(!priv_key) {
+      failf(data, "No private key found in the openssl store: %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+
+    if(SSL_CTX_use_PrivateKey(ctx, priv_key) != 1) {
+      failf(data, "unable to set private key [%s]",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      EVP_PKEY_free(priv_key);
+      return 0;
+    }
+    EVP_PKEY_free(priv_key); /* we do not need the handle any more... */
+  }
+  else {
+    failf(data, "crypto provider not set, cannot load private key");
+    return 0;
+  }
+  return 1;
+}
+#else
+{
+  (void)ctx;
+  (void)key_file;
+  failf(data, "SSL_FILETYPE_PROVIDER not supported for private key");
+  return 0;
+}
+#endif
+
+static int engineload(struct Curl_easy *data,
+                      SSL_CTX* ctx,
+                      const char *cert_file)
+/* ENGINE_CTRL_GET_CMD_FROM_NAME supported by OpenSSL, LibreSSL <=3.8.3 */
+#if defined(USE_OPENSSL_ENGINE) && defined(ENGINE_CTRL_GET_CMD_FROM_NAME)
+{
+  char error_buffer[256];
+  /* Implicitly use pkcs11 engine if none was provided and the
+   * cert_file is a PKCS#11 URI */
+  if(!data->state.engine) {
+    if(is_pkcs11_uri(cert_file)) {
+      if(ossl_set_engine(data, "pkcs11") != CURLE_OK) {
+        return 0;
+      }
+    }
+  }
+
+  if(data->state.engine) {
+    const char *cmd_name = "LOAD_CERT_CTRL";
+    struct {
+      const char *cert_id;
+      X509 *cert;
+    } params;
+
+    params.cert_id = cert_file;
+    params.cert = NULL;
+
+    /* Does the engine supports LOAD_CERT_CTRL ? */
+    if(!ENGINE_ctrl(data->state.engine, ENGINE_CTRL_GET_CMD_FROM_NAME,
+                    0, CURL_UNCONST(cmd_name), NULL)) {
+      failf(data, "ssl engine does not support loading certificates");
+      return 0;
+    }
+
+    /* Load the certificate from the engine */
+    if(!ENGINE_ctrl_cmd(data->state.engine, cmd_name,
+                        0, &params, NULL, 1)) {
+      failf(data, "ssl engine cannot load client cert with id"
+            " '%s' [%s]", cert_file,
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+
+    if(!params.cert) {
+      failf(data, "ssl engine did not initialized the certificate "
+            "properly.");
+      return 0;
+    }
+
+    if(SSL_CTX_use_certificate(ctx, params.cert) != 1) {
+      failf(data, "unable to set client certificate [%s]",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+    X509_free(params.cert); /* we do not need the handle any more... */
+  }
+  else {
+    failf(data, "crypto engine not set, cannot load certificate");
+    return 0;
+  }
+  return 1;
+}
+#else
+{
+  (void)ctx;
+  (void)cert_file;
+  failf(data, "SSL_FILETYPE_ENGINE not supported for certificate");
+  return 0;
+}
+#endif
+
+static int providerload(struct Curl_easy *data,
+                        SSL_CTX* ctx,
+                        const char *cert_file)
+#ifdef OPENSSL_HAS_PROVIDERS
+{
+  char error_buffer[256];
+  /* Implicitly use pkcs11 provider if none was provided and the
+   * cert_file is a PKCS#11 URI */
+  if(!data->state.provider_loaded) {
+    if(is_pkcs11_uri(cert_file)) {
+      if(ossl_set_provider(data, "pkcs11") != CURLE_OK) {
+        return 0;
+      }
+    }
+  }
+
+  if(data->state.provider_loaded) {
+    /* Load the certificate from the provider */
+    OSSL_STORE_INFO *info = NULL;
+    X509 *cert = NULL;
+    OSSL_STORE_CTX *store =
+      OSSL_STORE_open_ex(cert_file, data->state.libctx,
+                         NULL, NULL, NULL, NULL, NULL, NULL);
+    if(!store) {
+      failf(data, "Failed to open OpenSSL store: %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+    if(OSSL_STORE_expect(store, OSSL_STORE_INFO_CERT) != 1) {
+      failf(data, "Failed to set store preference. Ignoring the error: %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+    }
+
+    info = OSSL_STORE_load(store);
+    if(info) {
+      int ossl_type = OSSL_STORE_INFO_get_type(info);
+
+      if(ossl_type == OSSL_STORE_INFO_CERT)
+        cert = OSSL_STORE_INFO_get1_CERT(info);
+      OSSL_STORE_INFO_free(info);
+    }
+    OSSL_STORE_close(store);
+    if(!cert) {
+      failf(data, "No cert found in the openssl store: %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+
+    if(SSL_CTX_use_certificate(ctx, cert) != 1) {
+      failf(data, "unable to set client certificate [%s]",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)));
+      return 0;
+    }
+    X509_free(cert); /* we do not need the handle any more... */
+  }
+  else {
+    failf(data, "crypto provider not set, cannot load certificate");
+    return 0;
+  }
+  return 1;
+}
+#else
+{
+  (void)ctx;
+  (void)cert_file;
+  failf(data, "SSL_FILETYPE_PROVIDER not supported for certificate");
+  return 0;
+}
+#endif
+
+static int pkcs12load(struct Curl_easy *data,
+                      SSL_CTX* ctx,
+                      const struct curl_blob *cert_blob,
+                      const char *cert_file,
+                      const char *key_passwd)
+{
+  char error_buffer[256];
+  BIO *cert_bio = NULL;
+  PKCS12 *p12 = NULL;
+  EVP_PKEY *pri;
+  X509 *x509;
+  int cert_done = 0;
+  STACK_OF(X509) *ca = NULL;
+  if(cert_blob) {
+    cert_bio = BIO_new_mem_buf(cert_blob->data, (int)(cert_blob->len));
+    if(!cert_bio) {
+      failf(data,
+            "BIO_new_mem_buf NULL, " OSSL_PACKAGE " error %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)) );
+      return 0;
+    }
+  }
+  else {
+    cert_bio = BIO_new(BIO_s_file());
+    if(!cert_bio) {
+      failf(data,
+            "BIO_new return NULL, " OSSL_PACKAGE " error %s",
+            ossl_strerror(ERR_get_error(), error_buffer,
+                          sizeof(error_buffer)) );
+      return 0;
+    }
+
+    if(BIO_read_filename(cert_bio, CURL_UNCONST(cert_file)) <= 0) {
+      failf(data, "could not open PKCS12 file '%s'", cert_file);
+      BIO_free(cert_bio);
+      return 0;
+    }
+  }
+
+  p12 = d2i_PKCS12_bio(cert_bio, NULL);
+  BIO_free(cert_bio);
+
+  if(!p12) {
+    failf(data, "error reading PKCS12 file '%s'",
+          cert_blob ? "(memory blob)" : cert_file);
+    return 0;
+  }
+
+  PKCS12_PBE_add();
+
+  if(!PKCS12_parse(p12, key_passwd, &pri, &x509, &ca)) {
+    failf(data,
+          "could not parse PKCS12 file, check password, " OSSL_PACKAGE
+          " error %s",
+          ossl_strerror(ERR_get_error(), error_buffer,
+                        sizeof(error_buffer)) );
+    PKCS12_free(p12);
+    return 0;
+  }
+
+  PKCS12_free(p12);
+
+  if(SSL_CTX_use_certificate(ctx, x509) != 1) {
+    failf(data,
+          "could not load PKCS12 client certificate, " OSSL_PACKAGE
+          " error %s",
+          ossl_strerror(ERR_get_error(), error_buffer,
+                        sizeof(error_buffer)) );
+    goto fail;
+  }
+
+  if(SSL_CTX_use_PrivateKey(ctx, pri) != 1) {
+    failf(data, "unable to use private key from PKCS12 file '%s'",
+          cert_file);
+    goto fail;
+  }
+
+  if(!SSL_CTX_check_private_key(ctx)) {
+    failf(data, "private key from PKCS12 file '%s' "
+          "does not match certificate in same file", cert_file);
+    goto fail;
+  }
+  /* Set Certificate Verification chain */
+  if(ca) {
+    while(sk_X509_num(ca)) {
+      /*
+       * Note that sk_X509_pop() is used below to make sure the cert is
+       * removed from the stack properly before getting passed to
+       * SSL_CTX_add_extra_chain_cert(), which takes ownership. Previously
+       * we used sk_X509_value() instead, but then we would clean it in the
+       * subsequent sk_X509_pop_free() call.
+       */
+      X509 *x = sk_X509_pop(ca);
+      if(!SSL_CTX_add_client_CA(ctx, x)) {
+        X509_free(x);
+        failf(data, "cannot add certificate to client CA list");
+        goto fail;
+      }
+      if(!SSL_CTX_add_extra_chain_cert(ctx, x)) {
+        X509_free(x);
+        failf(data, "cannot add certificate to certificate chain");
+        goto fail;
+      }
+    }
+  }
+
+  cert_done = 1;
+fail:
+  EVP_PKEY_free(pri);
+  X509_free(x509);
+  sk_X509_pop_free(ca, X509_free);
+  if(!cert_done)
+    return 0; /* failure! */
+  return 1;
+}
+
+
+static CURLcode client_cert(struct Curl_easy *data,
+                            SSL_CTX* ctx,
+                            char *cert_file,
+                            const struct curl_blob *cert_blob,
+                            const char *cert_type,
+                            char *key_file,
+                            const struct curl_blob *key_blob,
+                            const char *key_type,
+                            char *key_passwd)
+{
+  char error_buffer[256];
+  bool check_privkey = TRUE;
   int file_type = ossl_do_file_type(cert_type);
 
   if(cert_file || cert_blob || (file_type == SSL_FILETYPE_ENGINE) ||
      (file_type == SSL_FILETYPE_PROVIDER)) {
     SSL *ssl;
     X509 *x509;
-    int cert_done = 0;
+    bool pcks12_done = FALSE;
     int cert_use_result;
 
     if(key_passwd) {
@@ -1279,7 +1669,6 @@ int cert_stuff(struct Curl_easy *data,
       SSL_CTX_set_default_passwd_cb(ctx, passwd_callback);
     }
 
-
     switch(file_type) {
     case SSL_FILETYPE_PEM:
       /* SSL_CTX_use_certificate_chain_file() only works on PEM files */
@@ -1294,7 +1683,7 @@ int cert_stuff(struct Curl_easy *data,
               (cert_blob ? "CURLOPT_SSLCERT_BLOB" : cert_file),
               ossl_strerror(ERR_get_error(), error_buffer,
                             sizeof(error_buffer)) );
-        return 0;
+        return CURLE_SSL_CERTPROBLEM;
       }
       break;
 
@@ -1314,249 +1703,29 @@ int cert_stuff(struct Curl_easy *data,
               (cert_blob ? "CURLOPT_SSLCERT_BLOB" : cert_file),
               ossl_strerror(ERR_get_error(), error_buffer,
                             sizeof(error_buffer)) );
-        return 0;
+        return CURLE_SSL_CERTPROBLEM;
       }
       break;
-    case SSL_FILETYPE_ENGINE:
-#if defined(USE_OPENSSL_ENGINE) && defined(ENGINE_CTRL_GET_CMD_FROM_NAME)
-    {
-      /* Implicitly use pkcs11 engine if none was provided and the
-       * cert_file is a PKCS#11 URI */
-      if(!data->state.engine) {
-        if(is_pkcs11_uri(cert_file)) {
-          if(ossl_set_engine(data, "pkcs11") != CURLE_OK) {
-            return 0;
-          }
-        }
-      }
-
-      if(data->state.engine) {
-        const char *cmd_name = "LOAD_CERT_CTRL";
-        struct {
-          const char *cert_id;
-          X509 *cert;
-        } params;
-
-        params.cert_id = cert_file;
-        params.cert = NULL;
-
-        /* Does the engine supports LOAD_CERT_CTRL ? */
-        if(!ENGINE_ctrl(data->state.engine, ENGINE_CTRL_GET_CMD_FROM_NAME,
-                        0, CURL_UNCONST(cmd_name), NULL)) {
-          failf(data, "ssl engine does not support loading certificates");
-          return 0;
-        }
-
-        /* Load the certificate from the engine */
-        if(!ENGINE_ctrl_cmd(data->state.engine, cmd_name,
-                            0, &params, NULL, 1)) {
-          failf(data, "ssl engine cannot load client cert with id"
-                " '%s' [%s]", cert_file,
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)));
-          return 0;
-        }
 
-        if(!params.cert) {
-          failf(data, "ssl engine did not initialized the certificate "
-                "properly.");
-          return 0;
-        }
+    case SSL_FILETYPE_ENGINE:
+      if(!engineload(data, ctx, cert_file))
+        return CURLE_SSL_CERTPROBLEM;
+      break;
 
-        if(SSL_CTX_use_certificate(ctx, params.cert) != 1) {
-          failf(data, "unable to set client certificate [%s]",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)));
-          return 0;
-        }
-        X509_free(params.cert); /* we do not need the handle any more... */
-      }
-      else {
-        failf(data, "crypto engine not set, cannot load certificate");
-        return 0;
-      }
-    }
-    break;
-#endif
-#if defined(OPENSSL_HAS_PROVIDERS)
-      /* fall through to compatible provider */
     case SSL_FILETYPE_PROVIDER:
-    {
-      /* Implicitly use pkcs11 provider if none was provided and the
-       * cert_file is a PKCS#11 URI */
-      if(!data->state.provider_loaded) {
-        if(is_pkcs11_uri(cert_file)) {
-          if(ossl_set_provider(data, "pkcs11") != CURLE_OK) {
-            return 0;
-          }
-        }
-      }
-
-      if(data->state.provider_loaded) {
-        /* Load the certificate from the provider */
-        OSSL_STORE_INFO *info = NULL;
-        X509 *cert = NULL;
-        OSSL_STORE_CTX *store =
-          OSSL_STORE_open_ex(cert_file, data->state.libctx,
-                             NULL, NULL, NULL, NULL, NULL, NULL);
-        if(!store) {
-          failf(data, "Failed to open OpenSSL store: %s",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)));
-          return 0;
-        }
-        if(OSSL_STORE_expect(store, OSSL_STORE_INFO_CERT) != 1) {
-          failf(data, "Failed to set store preference. Ignoring the error: %s",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)));
-        }
-
-        info = OSSL_STORE_load(store);
-        if(info) {
-          int ossl_type = OSSL_STORE_INFO_get_type(info);
-
-          if(ossl_type == OSSL_STORE_INFO_CERT)
-            cert = OSSL_STORE_INFO_get1_CERT(info);
-          OSSL_STORE_INFO_free(info);
-        }
-        OSSL_STORE_close(store);
-        if(!cert) {
-          failf(data, "No cert found in the openssl store: %s",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)));
-          return 0;
-        }
-
-        if(SSL_CTX_use_certificate(ctx, cert) != 1) {
-          failf(data, "unable to set client certificate [%s]",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)));
-          return 0;
-        }
-        X509_free(cert); /* we do not need the handle any more... */
-      }
-      else {
-        failf(data, "crypto provider not set, cannot load certificate");
-        return 0;
-      }
-    }
-    break;
-#endif
+      if(!providerload(data, ctx, cert_file))
+        return CURLE_SSL_CERTPROBLEM;
+      break;
 
     case SSL_FILETYPE_PKCS12:
-    {
-      BIO *cert_bio = NULL;
-      PKCS12 *p12 = NULL;
-      EVP_PKEY *pri;
-      STACK_OF(X509) *ca = NULL;
-      if(cert_blob) {
-        cert_bio = BIO_new_mem_buf(cert_blob->data, (int)(cert_blob->len));
-        if(!cert_bio) {
-          failf(data,
-                "BIO_new_mem_buf NULL, " OSSL_PACKAGE
-                " error %s",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)) );
-          return 0;
-        }
-      }
-      else {
-        cert_bio = BIO_new(BIO_s_file());
-        if(!cert_bio) {
-          failf(data,
-                "BIO_new return NULL, " OSSL_PACKAGE
-                " error %s",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)) );
-          return 0;
-        }
-
-        if(BIO_read_filename(cert_bio, cert_file) <= 0) {
-          failf(data, "could not open PKCS12 file '%s'", cert_file);
-          BIO_free(cert_bio);
-          return 0;
-        }
-      }
-
-      p12 = d2i_PKCS12_bio(cert_bio, NULL);
-      BIO_free(cert_bio);
-
-      if(!p12) {
-        failf(data, "error reading PKCS12 file '%s'",
-              cert_blob ? "(memory blob)" : cert_file);
-        return 0;
-      }
-
-      PKCS12_PBE_add();
-
-      if(!PKCS12_parse(p12, key_passwd, &pri, &x509, &ca)) {
-        failf(data,
-              "could not parse PKCS12 file, check password, " OSSL_PACKAGE
-              " error %s",
-              ossl_strerror(ERR_get_error(), error_buffer,
-                            sizeof(error_buffer)) );
-        PKCS12_free(p12);
-        return 0;
-      }
-
-      PKCS12_free(p12);
-
-      if(SSL_CTX_use_certificate(ctx, x509) != 1) {
-        failf(data,
-              "could not load PKCS12 client certificate, " OSSL_PACKAGE
-              " error %s",
-              ossl_strerror(ERR_get_error(), error_buffer,
-                            sizeof(error_buffer)) );
-        goto fail;
-      }
-
-      if(SSL_CTX_use_PrivateKey(ctx, pri) != 1) {
-        failf(data, "unable to use private key from PKCS12 file '%s'",
-              cert_file);
-        goto fail;
-      }
-
-      if(!SSL_CTX_check_private_key (ctx)) {
-        failf(data, "private key from PKCS12 file '%s' "
-              "does not match certificate in same file", cert_file);
-        goto fail;
-      }
-      /* Set Certificate Verification chain */
-      if(ca) {
-        while(sk_X509_num(ca)) {
-          /*
-           * Note that sk_X509_pop() is used below to make sure the cert is
-           * removed from the stack properly before getting passed to
-           * SSL_CTX_add_extra_chain_cert(), which takes ownership. Previously
-           * we used sk_X509_value() instead, but then we would clean it in the
-           * subsequent sk_X509_pop_free() call.
-           */
-          X509 *x = sk_X509_pop(ca);
-          if(!SSL_CTX_add_client_CA(ctx, x)) {
-            X509_free(x);
-            failf(data, "cannot add certificate to client CA list");
-            goto fail;
-          }
-          if(!SSL_CTX_add_extra_chain_cert(ctx, x)) {
-            X509_free(x);
-            failf(data, "cannot add certificate to certificate chain");
-            goto fail;
-          }
-        }
-      }
-
-      cert_done = 1;
-fail:
-      EVP_PKEY_free(pri);
-      X509_free(x509);
-      sk_X509_pop_free(ca, X509_free);
-      if(!cert_done)
-        return 0; /* failure! */
+      if(!pkcs12load(data, ctx, cert_blob, cert_file, key_passwd))
+        return CURLE_SSL_CERTPROBLEM;
+      pcks12_done = TRUE;
       break;
-    }
+
     default:
       failf(data, "not supported file type '%s' for certificate", cert_type);
-      return 0;
+      return CURLE_BAD_FUNCTION_ARGUMENT;
     }
 
     if((!key_file) && (!key_blob)) {
@@ -1568,9 +1737,6 @@ int cert_stuff(struct Curl_easy *data,
 
     switch(file_type) {
     case SSL_FILETYPE_PEM:
-      if(cert_done)
-        break;
-      FALLTHROUGH();
     case SSL_FILETYPE_ASN1:
       cert_use_result = key_blob ?
         use_privatekey_blob(ctx, key_blob, file_type, key_passwd) :
@@ -1579,153 +1745,34 @@ int cert_stuff(struct Curl_easy *data,
         failf(data, "unable to set private key file: '%s' type %s",
               key_file ? key_file : "(memory blob)",
               key_type ? key_type : "PEM");
-        return 0;
+        return CURLE_BAD_FUNCTION_ARGUMENT;
       }
       break;
     case SSL_FILETYPE_ENGINE:
-#ifdef USE_OPENSSL_ENGINE
-    {
-      EVP_PKEY *priv_key = NULL;
-
-      /* Implicitly use pkcs11 engine if none was provided and the
-       * key_file is a PKCS#11 URI */
-      if(!data->state.engine) {
-        if(is_pkcs11_uri(key_file)) {
-          if(ossl_set_engine(data, "pkcs11") != CURLE_OK) {
-            return 0;
-          }
-        }
-      }
+      if(!enginecheck(data, ctx, key_file, key_passwd))
+        return CURLE_SSL_CERTPROBLEM;
+      break;
 
-      if(data->state.engine) {
-        UI_METHOD *ui_method =
-          UI_create_method(OSSL_UI_METHOD_CAST("curl user interface"));
-        if(!ui_method) {
-          failf(data, "unable do create " OSSL_PACKAGE
-                " user-interface method");
-          return 0;
-        }
-        UI_method_set_opener(ui_method, UI_method_get_opener(UI_OpenSSL()));
-        UI_method_set_closer(ui_method, UI_method_get_closer(UI_OpenSSL()));
-        UI_method_set_reader(ui_method, ssl_ui_reader);
-        UI_method_set_writer(ui_method, ssl_ui_writer);
-        priv_key = ENGINE_load_private_key(data->state.engine, key_file,
-                                           ui_method,
-                                           key_passwd);
-        UI_destroy_method(ui_method);
-        if(!priv_key) {
-          failf(data, "failed to load private key from crypto engine");
-          return 0;
-        }
-        if(SSL_CTX_use_PrivateKey(ctx, priv_key) != 1) {
-          failf(data, "unable to set private key");
-          EVP_PKEY_free(priv_key);
-          return 0;
-        }
-        EVP_PKEY_free(priv_key);  /* we do not need the handle any more... */
-      }
-      else {
-        failf(data, "crypto engine not set, cannot load private key");
-        return 0;
-      }
-    }
-    break;
-#endif
-#if defined(OPENSSL_HAS_PROVIDERS)
-      /* fall through to compatible provider */
     case SSL_FILETYPE_PROVIDER:
-    {
-      /* Implicitly use pkcs11 provider if none was provided and the
-       * key_file is a PKCS#11 URI */
-      if(!data->state.provider_loaded) {
-        if(is_pkcs11_uri(key_file)) {
-          if(ossl_set_provider(data, "pkcs11") != CURLE_OK) {
-            return 0;
-          }
-        }
-      }
-
-      if(data->state.provider_loaded) {
-        /* Load the private key from the provider */
-        EVP_PKEY *priv_key = NULL;
-        OSSL_STORE_CTX *store = NULL;
-        OSSL_STORE_INFO *info = NULL;
-        UI_METHOD *ui_method =
-          UI_create_method(OSSL_UI_METHOD_CAST("curl user interface"));
-        if(!ui_method) {
-          failf(data, "unable do create " OSSL_PACKAGE
-                " user-interface method");
-          return 0;
-        }
-        UI_method_set_opener(ui_method, UI_method_get_opener(UI_OpenSSL()));
-        UI_method_set_closer(ui_method, UI_method_get_closer(UI_OpenSSL()));
-        UI_method_set_reader(ui_method, ssl_ui_reader);
-        UI_method_set_writer(ui_method, ssl_ui_writer);
-
-        store = OSSL_STORE_open_ex(key_file, data->state.libctx,
-                                   data->state.propq, ui_method, NULL, NULL,
-                                   NULL, NULL);
-        if(!store) {
-          failf(data, "Failed to open OpenSSL store: %s",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)));
-          return 0;
-        }
-        if(OSSL_STORE_expect(store, OSSL_STORE_INFO_PKEY) != 1) {
-          failf(data, "Failed to set store preference. Ignoring the error: %s",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)));
-        }
-
-        info = OSSL_STORE_load(store);
-        if(info) {
-          int ossl_type = OSSL_STORE_INFO_get_type(info);
-
-          if(ossl_type == OSSL_STORE_INFO_PKEY)
-            priv_key = OSSL_STORE_INFO_get1_PKEY(info);
-          OSSL_STORE_INFO_free(info);
-        }
-        OSSL_STORE_close(store);
-        UI_destroy_method(ui_method);
-        if(!priv_key) {
-          failf(data, "No private key found in the openssl store: %s",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)));
-          return 0;
-        }
-
-        if(SSL_CTX_use_PrivateKey(ctx, priv_key) != 1) {
-          failf(data, "unable to set private key [%s]",
-                ossl_strerror(ERR_get_error(), error_buffer,
-                              sizeof(error_buffer)));
-          EVP_PKEY_free(priv_key);
-          return 0;
-        }
-        EVP_PKEY_free(priv_key); /* we do not need the handle any more... */
-      }
-      else {
-        failf(data, "crypto provider not set, cannot load private key");
-        return 0;
-      }
-    }
-    break;
-#endif
+      if(!providercheck(data, ctx, key_file))
+        return CURLE_SSL_CERTPROBLEM;
+      break;
 
     case SSL_FILETYPE_PKCS12:
-      if(!cert_done) {
+      if(!pcks12_done) {
         failf(data, "file type P12 for private key not supported");
-        return 0;
+        return CURLE_SSL_CERTPROBLEM;
       }
       break;
     default:
       failf(data, "not supported file type for private key");
-      return 0;
+      return CURLE_BAD_FUNCTION_ARGUMENT;
     }
 
     ssl = SSL_new(ctx);
     if(!ssl) {
       failf(data, "unable to create an SSL structure");
-      return 0;
+      return CURLE_OUT_OF_MEMORY;
     }
 
     x509 = SSL_get_certificate(ssl);
@@ -1738,8 +1785,7 @@ int cert_stuff(struct Curl_easy *data,
       EVP_PKEY_free(pktmp);
     }
 
-#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_IS_BORINGSSL) &&       \
-  !defined(OPENSSL_NO_DEPRECATED_3_0)
+#if !defined(OPENSSL_NO_RSA) && !defined(OPENSSL_NO_DEPRECATED_3_0)
     {
       /* If RSA is used, do not check the private key if its flags indicate
        * it does not support it. */
@@ -1769,11 +1815,11 @@ int cert_stuff(struct Curl_easy *data,
        * the SSL context */
       if(!SSL_CTX_check_private_key(ctx)) {
         failf(data, "Private key does not match the certificate public key");
-        return 0;
+        return CURLE_SSL_CERTPROBLEM;
       }
     }
   }
-  return 1;
+  return CURLE_OK;
 }
 
 /* returns non-zero on failure */
@@ -1785,8 +1831,10 @@ static CURLcode x509_name_oneline(X509_NAME *a, struct dynbuf *d)
   CURLcode result = CURLE_OUT_OF_MEMORY;
 
   if(bio_out) {
+    unsigned long flags = XN_FLAG_SEP_SPLUS_SPC |
+      (XN_FLAG_ONELINE & ~ASN1_STRFLGS_ESC_MSB & ~XN_FLAG_SPC_EQ);
     curlx_dyn_reset(d);
-    rc = X509_NAME_print_ex(bio_out, a, 0, XN_FLAG_SEP_SPLUS_SPC);
+    rc = X509_NAME_print_ex(bio_out, a, 0, flags);
     if(rc != -1) {
       BIO_get_mem_ptr(bio_out, &biomem);
       result = curlx_dyn_addn(d, biomem->data, biomem->length);
@@ -1824,12 +1872,6 @@ static int ossl_init(void)
   ENGINE_load_builtin_engines();
 #endif
 
-/* CONF_MFLAGS_DEFAULT_SECTION was introduced some time between 0.9.8b and
-   0.9.8e */
-#ifndef CONF_MFLAGS_DEFAULT_SECTION
-#define CONF_MFLAGS_DEFAULT_SECTION 0x0
-#endif
-
 #ifndef CURL_DISABLE_OPENSSL_AUTO_LOAD_CONFIG
   CONF_modules_load_file(NULL, NULL,
                          CONF_MFLAGS_DEFAULT_SECTION|
@@ -1940,7 +1982,7 @@ static CURLcode ossl_set_engine_default(struct Curl_easy *data)
     }
   }
 #else
-  (void) data;
+  (void)data;
 #endif
   return CURLE_OK;
 }
@@ -1963,11 +2005,11 @@ static struct curl_slist *ossl_engines_list(struct Curl_easy *data)
     list = beg;
   }
 #endif
-  (void) data;
+  (void)data;
   return list;
 }
 
-#if defined(OPENSSL_HAS_PROVIDERS)
+#ifdef OPENSSL_HAS_PROVIDERS
 
 static void ossl_provider_cleanup(struct Curl_easy *data)
 {
@@ -2242,28 +2284,6 @@ static void ossl_close_all(struct Curl_easy *data)
 
 /* ====================================================== */
 
-/*
- * Match subjectAltName against the hostname.
- */
-static bool subj_alt_hostcheck(struct Curl_easy *data,
-                               const char *match_pattern,
-                               size_t matchlen,
-                               const char *hostname,
-                               size_t hostlen,
-                               const char *dispname)
-{
-#ifdef CURL_DISABLE_VERBOSE_STRINGS
-  (void)dispname;
-  (void)data;
-#endif
-  if(Curl_cert_hostcheck(match_pattern, matchlen, hostname, hostlen)) {
-    infof(data, " subjectAltName: host \"%s\" matched cert's \"%s\"",
-          dispname, match_pattern);
-    return TRUE;
-  }
-  return FALSE;
-}
-
 /* Quote from RFC2818 section 3.1 "Server Identity"
 
    If a subjectAltName extension of type dNSName is present, that MUST
@@ -2288,7 +2308,8 @@ static bool subj_alt_hostcheck(struct Curl_easy *data,
 */
 static CURLcode ossl_verifyhost(struct Curl_easy *data,
                                 struct connectdata *conn,
-                                struct ssl_peer *peer, X509 *server_cert)
+                                struct ssl_peer *peer,
+                                X509 *server_cert)
 {
   bool matched = FALSE;
   int target; /* target type, GEN_DNS or GEN_IPADD */
@@ -2302,10 +2323,9 @@ static CURLcode ossl_verifyhost(struct Curl_easy *data,
   CURLcode result = CURLE_OK;
   bool dNSName = FALSE; /* if a dNSName field exists in the cert */
   bool iPAddress = FALSE; /* if an iPAddress field exists in the cert */
-  size_t hostlen;
+  size_t hostlen = strlen(peer->hostname);
 
   (void)conn;
-  hostlen = strlen(peer->hostname);
   switch(peer->type) {
   case CURL_SSL_PEER_IPV4:
     if(!curlx_inet_pton(AF_INET, peer->hostname, &addr))
@@ -2334,22 +2354,20 @@ static CURLcode ossl_verifyhost(struct Curl_easy *data,
   altnames = X509_get_ext_d2i(server_cert, NID_subject_alt_name, NULL, NULL);
 
   if(altnames) {
-#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+#ifdef HAVE_BORINGSSL_LIKE
     size_t numalts;
     size_t i;
 #else
     int numalts;
     int i;
 #endif
-    bool dnsmatched = FALSE;
-    bool ipmatched = FALSE;
 
     /* get amount of alternatives, RFC2459 claims there MUST be at least
        one, but we do not depend on it... */
     numalts = sk_GENERAL_NAME_num(altnames);
 
     /* loop through all alternatives - until a dnsmatch */
-    for(i = 0; (i < numalts) && !dnsmatched; i++) {
+    for(i = 0; (i < numalts) && !matched; i++) {
       /* get a handle to alternative name number i */
       const GENERAL_NAME *check = sk_GENERAL_NAME_value(altnames, i);
 
@@ -2378,10 +2396,10 @@ static CURLcode ossl_verifyhost(struct Curl_easy *data,
           if((altlen == strlen(altptr)) &&
              /* if this is not true, there was an embedded zero in the name
                 string and we cannot match it. */
-             subj_alt_hostcheck(data, altptr, altlen,
-                                peer->hostname, hostlen,
-                                peer->dispname)) {
-            dnsmatched = TRUE;
+             Curl_cert_hostcheck(altptr, altlen, peer->hostname, hostlen)) {
+            matched = TRUE;
+            infof(data, " subjectAltName: host \"%s\" matched cert's \"%.*s\"",
+                  peer->dispname, (int)altlen, altptr);
           }
           break;
 
@@ -2389,7 +2407,7 @@ static CURLcode ossl_verifyhost(struct Curl_easy *data,
           /* compare alternative IP address if the data chunk is the same size
              our server IP address is */
           if((altlen == addrlen) && !memcmp(altptr, &addr, altlen)) {
-            ipmatched = TRUE;
+            matched = TRUE;
             infof(data,
                   " subjectAltName: host \"%s\" matched cert's IP address!",
                   peer->dispname);
@@ -2399,9 +2417,6 @@ static CURLcode ossl_verifyhost(struct Curl_easy *data,
       }
     }
     GENERAL_NAMES_free(altnames);
-
-    if(dnsmatched || ipmatched)
-      matched = TRUE;
   }
 
   if(matched)
@@ -2495,7 +2510,7 @@ static CURLcode verifystatus(struct Curl_cfilter *cf,
                              struct ossl_ctx *octx)
 {
   int i, ocsp_status;
-#ifdef OPENSSL_IS_AWSLC
+#ifdef HAVE_BORINGSSL_LIKE
   const uint8_t *status;
 #else
   unsigned char *status;
@@ -2628,15 +2643,9 @@ static CURLcode verifystatus(struct Curl_cfilter *cf,
 }
 #endif
 
-#endif /* USE_OPENSSL */
-
-/* The SSL_CTRL_SET_MSG_CALLBACK does not exist in ancient OpenSSL versions
-   and thus this cannot be done there. */
-#ifdef SSL_CTRL_SET_MSG_CALLBACK
-
 static const char *ssl_msg_type(int ssl_ver, int msg)
 {
-#ifdef SSL2_VERSION_MAJOR
+#ifdef SSL2_VERSION_MAJOR  /* OpenSSL 1.0.2, LibreSSL <=3.9.2 */
   if(ssl_ver == SSL2_VERSION_MAJOR) {
     switch(msg) {
     case SSL2_MT_ERROR:
@@ -2782,7 +2791,7 @@ static void ossl_trace(int direction, int ssl_ver, int content_type,
     verstr = "TLSv1.2";
     break;
 #endif
-#ifdef TLS1_3_VERSION
+#ifdef TLS1_3_VERSION  /* OpenSSL 1.1.1+, all forks */
   case TLS1_3_VERSION:
     verstr = "TLSv1.3";
     break;
@@ -2846,19 +2855,15 @@ static void ossl_trace(int direction, int ssl_ver, int content_type,
 
   Curl_debug(data, (direction == 1) ? CURLINFO_SSL_DATA_OUT :
              CURLINFO_SSL_DATA_IN, (const char *)buf, len);
-  (void) ssl;
+  (void)ssl;
 }
-#endif
-
-#ifdef USE_OPENSSL
-/* ====================================================== */
 
 /* Check for ALPN support. */
 #ifndef OPENSSL_NO_TLSEXT
 #  define HAS_ALPN_OPENSSL
 #endif
 
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) /* 1.1.0 */
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 */
 static CURLcode
 ossl_set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx)
 {
@@ -2868,9 +2873,7 @@ ossl_set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx)
   long curl_ssl_version_max;
 
   /* convert curl min SSL version option to OpenSSL constant */
-#if (defined(OPENSSL_IS_BORINGSSL) || \
-     defined(OPENSSL_IS_AWSLC) || \
-     defined(LIBRESSL_VERSION_NUMBER))
+#if defined(HAVE_BORINGSSL_LIKE) || defined(LIBRESSL_VERSION_NUMBER)
   uint16_t ossl_ssl_version_min = 0;
   uint16_t ossl_ssl_version_max = 0;
 #else
@@ -2947,9 +2950,9 @@ ossl_set_ssl_version_min_max(struct Curl_cfilter *cf, SSL_CTX *ctx)
 }
 #endif
 
-#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+#ifdef HAVE_BORINGSSL_LIKE
 typedef uint32_t ctx_option_t;
-#elif OPENSSL_VERSION_NUMBER >= 0x30000000L
+#elif defined(HAVE_OPENSSL3)
 typedef uint64_t ctx_option_t;
 #elif OPENSSL_VERSION_NUMBER >= 0x10100000L && \
   !defined(LIBRESSL_VERSION_NUMBER)
@@ -2958,7 +2961,7 @@ typedef unsigned long ctx_option_t;
 typedef long ctx_option_t;
 #endif
 
-#if (OPENSSL_VERSION_NUMBER < 0x10100000L) /* 1.1.0 */
+#if OPENSSL_VERSION_NUMBER < 0x10100000L /* 1.1.0 */
 static CURLcode
 ossl_set_ssl_version_min_max_legacy(ctx_option_t *ctx_options,
                                     struct Curl_cfilter *cf,
@@ -2968,7 +2971,7 @@ ossl_set_ssl_version_min_max_legacy(ctx_option_t *ctx_options,
   long ssl_version = conn_config->version;
   long ssl_version_max = conn_config->version_max;
 
-  (void) data; /* In case it is unused. */
+  (void)data; /* In case it is unused. */
 
   switch(ssl_version) {
   case CURL_SSLVERSION_TLSv1_3:
@@ -3373,7 +3376,7 @@ static CURLcode ossl_populate_x509_store(struct Curl_cfilter *cf,
     }
 
     if(ssl_cafile || ssl_capath) {
-#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
+#ifdef HAVE_OPENSSL3
       /* OpenSSL 3.0.0 has deprecated SSL_CTX_load_verify_locations */
       if(ssl_cafile && !X509_STORE_load_file(store, ssl_cafile)) {
         if(!imported_native_ca && !imported_ca_info_blob) {
@@ -3450,10 +3453,7 @@ static CURLcode ossl_populate_x509_store(struct Curl_cfilter *cf,
        https://web.archive.org/web/20190422050538/
        rt.openssl.org/Ticket/Display.html?id=3621
     */
-#ifdef X509_V_FLAG_TRUSTED_FIRST
     X509_STORE_set_flags(store, X509_V_FLAG_TRUSTED_FIRST);
-#endif
-#ifdef X509_V_FLAG_PARTIAL_CHAIN
     if(!ssl_config->no_partialchain && !ssl_crlfile) {
       /* Have intermediate certificates in the trust store be treated as
          trust-anchors, in the same way as self-signed root CA certificates
@@ -3465,7 +3465,6 @@ static CURLcode ossl_populate_x509_store(struct Curl_cfilter *cf,
       */
       X509_STORE_set_flags(store, X509_V_FLAG_PARTIAL_CHAIN);
     }
-#endif
   }
 
   return result;
@@ -3613,6 +3612,8 @@ CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf,
     !ssl_config->primary.CRLfile &&
     !ssl_config->native_ca_store;
 
+  ERR_set_mark();
+
   cached_store = ossl_get_cached_x509_store(cf, data);
   if(cached_store && cache_criteria_met && X509_STORE_up_ref(cached_store)) {
     SSL_CTX_set_cert_store(ssl_ctx, cached_store);
@@ -3626,6 +3627,8 @@ CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf,
     }
   }
 
+  ERR_pop_to_mark();
+
   return result;
 }
 #else /* HAVE_SSL_X509_STORE_SHARE */
@@ -3633,9 +3636,17 @@ CURLcode Curl_ssl_setup_x509_store(struct Curl_cfilter *cf,
                                    struct Curl_easy *data,
                                    SSL_CTX *ssl_ctx)
 {
-  X509_STORE *store = SSL_CTX_get_cert_store(ssl_ctx);
+  CURLcode result;
+  X509_STORE *store;
+
+  ERR_set_mark();
 
-  return ossl_populate_x509_store(cf, data, store);
+  store = SSL_CTX_get_cert_store(ssl_ctx);
+  result = ossl_populate_x509_store(cf, data, store);
+
+  ERR_pop_to_mark();
+
+  return result;
 }
 #endif /* HAVE_SSL_X509_STORE_SHARE */
 
@@ -3746,14 +3757,14 @@ static CURLcode ossl_init_ech(struct ossl_ctx *octx,
 
   if(data->set.tls_ech & CURLECH_GREASE) {
     infof(data, "ECH: will GREASE ClientHello");
-# if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+# ifdef HAVE_BORINGSSL_LIKE
     SSL_set_enable_ech_grease(octx->ssl, 1);
 # else
     SSL_set_options(octx->ssl, SSL_OP_ECH_GREASE);
 # endif
   }
   else if(data->set.tls_ech & CURLECH_CLA_CFG) {
-# if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+# ifdef HAVE_BORINGSSL_LIKE
     /* have to do base64 decode here for BoringSSL */
     const char *b64 = data->set.str[STRING_ECH_CONFIG];
 
@@ -3834,7 +3845,7 @@ static CURLcode ossl_init_ech(struct ossl_ctx *octx,
       Curl_resolv_unlink(data, &dns);
     }
   }
-# if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+# ifdef HAVE_BORINGSSL_LIKE
   if(trying_ech_now && outername) {
     infof(data, "ECH: setting public_name not supported with BoringSSL");
     return CURLE_SSL_CONNECT_ERROR;
@@ -3851,7 +3862,7 @@ static CURLcode ossl_init_ech(struct ossl_ctx *octx,
       return CURLE_SSL_CONNECT_ERROR;
     }
   }
-# endif  /* OPENSSL_IS_BORINGSSL || OPENSSL_IS_AWSLC */
+# endif /* HAVE_BORINGSSL_LIKE */
   if(trying_ech_now
      && SSL_set_min_proto_version(octx->ssl, TLS1_3_VERSION) != 1) {
     infof(data, "ECH: cannot force TLSv1.3 [ERROR]");
@@ -3887,15 +3898,9 @@ static CURLcode ossl_init_ssl(struct ossl_ctx *octx,
     SSL_set_tlsext_status_type(octx->ssl, TLSEXT_STATUSTYPE_ocsp);
 #endif
 
-#if (defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)) && \
-    defined(ALLOW_RENEG)
-  SSL_set_renegotiate_mode(octx->ssl, ssl_renegotiate_freely);
-#endif
-
   SSL_set_connect_state(octx->ssl);
 
   octx->server_cert = NULL;
-#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
   if(peer->sni) {
     if(!SSL_set_tlsext_host_name(octx->ssl, peer->sni)) {
       failf(data, "Failed set SNI");
@@ -3909,9 +3914,7 @@ static CURLcode ossl_init_ssl(struct ossl_ctx *octx,
     if(result)
       return result;
   }
-#endif  /* USE_ECH_OPENSSL */
-
-#endif
+#endif /* USE_ECH_OPENSSL */
 
   return ossl_init_session_and_alpns(octx, cf, data, peer,
                                      alpns_requested, sess_reuse_cb);
@@ -3939,11 +3942,11 @@ static CURLcode ossl_init_method(struct Curl_cfilter *cf,
     case CURL_SSLVERSION_TLSv1_2:
     case CURL_SSLVERSION_TLSv1_3:
       /* it will be handled later with the context options */
-  #if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
       *pmethod = TLS_client_method();
-  #else
+#else
       *pmethod = SSLv23_client_method();
-  #endif
+#endif
       break;
     case CURL_SSLVERSION_SSLv2:
       failf(data, "No SSLv2 support");
@@ -4037,13 +4040,11 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
       return result;
   }
 
-#ifdef SSL_CTRL_SET_MSG_CALLBACK
   if(data->set.fdebug && data->set.verbose) {
     /* the SSL trace callback is only used for verbose logging */
     SSL_CTX_set_msg_callback(octx->ssl_ctx, ossl_trace);
     SSL_CTX_set_msg_callback_arg(octx->ssl_ctx, cf);
   }
-#endif
 
   /* OpenSSL contains code to work around lots of bugs and flaws in various
      SSL-implementations. SSL_CTX_set_options() is used to enabled those
@@ -4081,27 +4082,15 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
      SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS bit must not be set.
   */
 
-  ctx_options = SSL_OP_ALL;
-
-#ifdef SSL_OP_NO_TICKET
-  ctx_options |= SSL_OP_NO_TICKET;
-#endif
-
-#ifdef SSL_OP_NO_COMPRESSION
-  ctx_options |= SSL_OP_NO_COMPRESSION;
-#endif
+  ctx_options = SSL_OP_ALL | SSL_OP_NO_TICKET | SSL_OP_NO_COMPRESSION;
 
-#ifdef SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG
   /* mitigate CVE-2010-4180 */
   ctx_options &= ~(ctx_option_t)SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG;
-#endif
 
-#ifdef SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS
   /* unless the user explicitly asks to allow the protocol vulnerability we
      use the work-around */
   if(!ssl_config->enable_beast)
     ctx_options &= ~(ctx_option_t)SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS;
-#endif
 
   switch(ssl_version_min) {
   case CURL_SSLVERSION_SSLv2:
@@ -4120,12 +4109,12 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
     ctx_options |= SSL_OP_NO_SSLv2;
     ctx_options |= SSL_OP_NO_SSLv3;
 
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) /* 1.1.0 */
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 */
     result = ossl_set_ssl_version_min_max(cf, octx->ssl_ctx);
 #else
     result = ossl_set_ssl_version_min_max_legacy(&ctx_options, cf, data);
 #endif
-    if(result != CURLE_OK)
+    if(result)
       return result;
     break;
 
@@ -4146,15 +4135,12 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
      However using a large buffer (8 packets) actually decreases performance.
      4 packets is better.
    */
-
 #ifdef HAVE_SSL_CTX_SET_DEFAULT_READ_BUFFER_LEN
   SSL_CTX_set_default_read_buffer_len(octx->ssl_ctx, 0x401e * 4);
 #endif
 
-#ifdef SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER
   /* We do retry writes sometimes from another buffer address */
   SSL_CTX_set_mode(octx->ssl_ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
-#endif
 
   ciphers = conn_config->cipher_list;
   if(!ciphers && (peer->transport != TRNSPRT_QUIC))
@@ -4183,14 +4169,12 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
 #endif
 
   if(ssl_cert || ssl_cert_blob || ssl_cert_type) {
-    if(!result &&
-       !cert_stuff(data, octx->ssl_ctx,
-                   ssl_cert, ssl_cert_blob, ssl_cert_type,
-                   ssl_config->key, ssl_config->key_blob,
-                   ssl_config->key_type, ssl_config->key_passwd))
-      result = CURLE_SSL_CERTPROBLEM;
+    result = client_cert(data, octx->ssl_ctx,
+                         ssl_cert, ssl_cert_blob, ssl_cert_type,
+                         ssl_config->key, ssl_config->key_blob,
+                         ssl_config->key_type, ssl_config->key_passwd);
     if(result)
-      /* failf() is already done in cert_stuff() */
+      /* failf() is already done in client_cert() */
       return result;
   }
 
@@ -4202,7 +4186,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
   {
     const char *curves = conn_config->curves;
     if(curves) {
-#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+#ifdef HAVE_BORINGSSL_LIKE
 #define OSSL_CURVE_CAST(x) (x)
 #else
 #define OSSL_CURVE_CAST(x) (char *)CURL_UNCONST(x)
@@ -4229,7 +4213,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
   }
 #endif
 
-#ifdef USE_OPENSSL_SRP
+#if defined(HAVE_OPENSSL_SRP) && defined(USE_TLS_SRP)
   if(ssl_config->primary.username && Curl_auth_allowed_to_host(data)) {
     char * const ssl_username = ssl_config->primary.username;
     char * const ssl_password = ssl_config->primary.password;
@@ -4252,7 +4236,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
       }
     }
   }
-#endif
+#endif /* HAVE_OPENSSL_SRP && USE_TLS_SRP */
 
   /* OpenSSL always tries to verify the peer, this only says whether it should
    * fail to connect if the verification fails, or if it should continue
@@ -4342,9 +4326,9 @@ void Curl_ossl_report_handshake(struct Curl_easy *data,
     int psigtype_nid = NID_undef;
     const char *negotiated_group_name = NULL;
 
-#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
+#ifdef HAVE_OPENSSL3
     SSL_get_peer_signature_type_nid(octx->ssl, &psigtype_nid);
-#if (OPENSSL_VERSION_NUMBER >= 0x30200000L)
+#if OPENSSL_VERSION_NUMBER >= 0x30200000L
     negotiated_group_name = SSL_get0_group_name(octx->ssl);
 #else
     negotiated_group_name =
@@ -4425,7 +4409,7 @@ static void ossl_trace_ech_retry_configs(struct Curl_easy *data, SSL* ssl,
   CURLcode result = CURLE_OK;
   size_t rcl = 0;
   int rv = 1;
-# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
+# ifndef HAVE_BORINGSSL_LIKE
   char *inner = NULL;
   unsigned char *rcs = NULL;
   char *outer = NULL;
@@ -4440,7 +4424,7 @@ static void ossl_trace_ech_retry_configs(struct Curl_easy *data, SSL* ssl,
   /* nothing to trace if not doing ECH */
   if(!ECH_ENABLED(data))
     return;
-# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
+# ifndef HAVE_BORINGSSL_LIKE
   rv = SSL_ech_get1_retry_config(ssl, &rcs, &rcl);
 # else
   SSL_get0_ech_retry_configs(ssl, &rcs, &rcl);
@@ -4455,7 +4439,7 @@ static void ossl_trace_ech_retry_configs(struct Curl_easy *data, SSL* ssl,
     if(!result && b64str) {
       infof(data, "ECH: retry_configs %s", b64str);
       free(b64str);
-#if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
+#ifndef HAVE_BORINGSSL_LIKE
       rv = SSL_ech_get1_status(ssl, &inner, &outer);
       infof(data, "ECH: retry_configs for %s from %s, %d %d",
             inner ? inner : "NULL", outer ? outer : "NULL", reason, rv);
@@ -4471,7 +4455,7 @@ static void ossl_trace_ech_retry_configs(struct Curl_easy *data, SSL* ssl,
   }
   else
     infof(data, "ECH: no retry_configs (rv = %d)", rv);
-# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
+# ifndef HAVE_BORINGSSL_LIKE
   OPENSSL_free((void *)rcs);
 # endif
   return;
@@ -4514,7 +4498,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
   /* 1  is fine
      0  is "not successful but was shut down controlled"
      <0 is "handshake was not successful, because a fatal error occurred" */
-  if(1 != err) {
+  if(err != 1) {
     int detail = SSL_get_error(octx->ssl, err);
     CURL_TRC_CF(data, cf, "SSL_connect() -> err=%d, detail=%d", err, detail);
 
@@ -4538,7 +4522,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
 #ifdef SSL_ERROR_WANT_RETRY_VERIFY
     if(SSL_ERROR_WANT_RETRY_VERIFY == detail) {
       CURL_TRC_CF(data, cf, "SSL_connect() -> want retry_verify");
-      connssl->io_need = CURL_SSL_IO_NEED_RECV;
+      Curl_xfer_pause_recv(data, TRUE);
       return CURLE_AGAIN;
     }
 #endif
@@ -4590,7 +4574,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
 #endif
 #ifdef USE_ECH_OPENSSL
       else if((lib == ERR_LIB_SSL) &&
-# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
+# ifndef HAVE_BORINGSSL_LIKE
               (reason == SSL_R_ECH_REQUIRED)) {
 # else
               (reason == SSL_R_ECH_REJECTED)) {
@@ -4635,8 +4619,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
     connssl->connecting_state = ssl_connect_3;
     Curl_ossl_report_handshake(data, octx);
 
-#ifdef USE_ECH_OPENSSL
-# if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
+#if defined(USE_ECH_OPENSSL) && !defined(HAVE_BORINGSSL_LIKE)
     if(ECH_ENABLED(data)) {
       char *inner = NULL, *outer = NULL;
       const char *status = NULL;
@@ -4694,8 +4677,7 @@ static CURLcode ossl_connect_step2(struct Curl_cfilter *cf,
     else {
       infof(data, "ECH: result: status is not attempted");
     }
-# endif  /* !OPENSSL_IS_BORINGSSL && !OPENSSL_IS_AWSLC */
-#endif  /* USE_ECH_OPENSSL */
+#endif /* USE_ECH_OPENSSL && !HAVE_BORINGSSL_LIKE */
 
 #ifdef HAS_ALPN_OPENSSL
     /* Sets data and len to negotiated protocol, len is 0 if no protocol was
@@ -4772,12 +4754,10 @@ static CURLcode ossl_pkp_pin_peer_pubkey(struct Curl_easy *data, X509* cert,
   return result;
 }
 
-#if (OPENSSL_VERSION_NUMBER >= 0x10100000L) &&  \
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L &&  \
   !(defined(LIBRESSL_VERSION_NUMBER) && \
     LIBRESSL_VERSION_NUMBER < 0x3060000fL) && \
-  !defined(OPENSSL_IS_BORINGSSL) && \
-  !defined(OPENSSL_IS_AWSLC) && \
-  !defined(CURL_DISABLE_VERBOSE_STRINGS)
+  !defined(HAVE_BORINGSSL_LIKE) && !defined(CURL_DISABLE_VERBOSE_STRINGS)
 static void infof_certstack(struct Curl_easy *data, const SSL *ssl)
 {
   STACK_OF(X509) *certstack;
@@ -4812,11 +4792,11 @@ static void infof_certstack(struct Curl_easy *data, const SSL *ssl)
 
     current_pkey = X509_get0_pubkey(current_cert);
     key_bits = EVP_PKEY_bits(current_pkey);
-#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
+#ifndef HAVE_OPENSSL3
 #define EVP_PKEY_get_security_bits EVP_PKEY_security_bits
 #endif
     key_sec_bits = EVP_PKEY_get_security_bits(current_pkey);
-#if (OPENSSL_VERSION_NUMBER >= 0x30000000L)
+#ifdef HAVE_OPENSSL3
     {
       char group_name[80] = "";
       get_group_name = EVP_PKEY_get_group_name(current_pkey, group_name,
@@ -4843,10 +4823,10 @@ static void infof_certstack(struct Curl_easy *data, const SSL *ssl)
 
 #define MAX_CERT_NAME_LENGTH 2048
 
-CURLcode Curl_oss_check_peer_cert(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  struct ossl_ctx *octx,
-                                  struct ssl_peer *peer)
+CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   struct ossl_ctx *octx,
+                                   struct ssl_peer *peer)
 {
   struct connectdata *conn = cf->conn;
   struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
@@ -4867,8 +4847,7 @@ CURLcode Curl_oss_check_peer_cert(struct Curl_cfilter *cf,
 
   if(!mem) {
     failf(data,
-          "BIO_new return NULL, " OSSL_PACKAGE
-          " error %s",
+          "BIO_new return NULL, " OSSL_PACKAGE " error %s",
           ossl_strerror(ERR_get_error(), error_buffer,
                         sizeof(error_buffer)) );
     return CURLE_OUT_OF_MEMORY;
@@ -4944,8 +4923,7 @@ CURLcode Curl_oss_check_peer_cert(struct Curl_cfilter *cf,
                              (int)conn_config->issuercert_blob->len);
         if(!fp) {
           failf(data,
-                "BIO_new_mem_buf NULL, " OSSL_PACKAGE
-                " error %s",
+                "BIO_new_mem_buf NULL, " OSSL_PACKAGE " error %s",
                 ossl_strerror(ERR_get_error(), error_buffer,
                               sizeof(error_buffer)) );
           X509_free(octx->server_cert);
@@ -4957,8 +4935,7 @@ CURLcode Curl_oss_check_peer_cert(struct Curl_cfilter *cf,
         fp = BIO_new(BIO_s_file());
         if(!fp) {
           failf(data,
-                "BIO_new return NULL, " OSSL_PACKAGE
-                " error %s",
+                "BIO_new return NULL, " OSSL_PACKAGE " error %s",
                 ossl_strerror(ERR_get_error(), error_buffer,
                               sizeof(error_buffer)) );
           X509_free(octx->server_cert);
@@ -5078,7 +5055,7 @@ static CURLcode ossl_connect_step3(struct Curl_cfilter *cf,
    * operations.
    */
 
-  result = Curl_oss_check_peer_cert(cf, data, octx, &connssl->peer);
+  result = Curl_ossl_check_peer_cert(cf, data, octx, &connssl->peer);
   if(result)
     /* on error, remove sessions we might have in the pool */
     Curl_ssl_scache_remove_all(cf, data, connssl->peer.scache_key);
@@ -5274,6 +5251,17 @@ static CURLcode ossl_send(struct Curl_cfilter *cf,
 
   connssl->io_need = CURL_SSL_IO_NEED_NONE;
   memlen = (len > (size_t)INT_MAX) ? INT_MAX : (int)len;
+  if(octx->blocked_ssl_write_len && (octx->blocked_ssl_write_len != memlen)) {
+    /* The previous SSL_write() call was blocked, using that length.
+     * We need to use that again or OpenSSL will freak out. A shorter
+     * length should not happen and is a bug in libcurl. */
+    if(octx->blocked_ssl_write_len > memlen) {
+      DEBUGASSERT(0);
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+    memlen = octx->blocked_ssl_write_len;
+  }
+  octx->blocked_ssl_write_len = 0;
   nwritten = SSL_write(octx->ssl, mem, memlen);
 
   if(nwritten > 0)
@@ -5284,16 +5272,19 @@ static CURLcode ossl_send(struct Curl_cfilter *cf,
     switch(err) {
     case SSL_ERROR_WANT_READ:
       connssl->io_need = CURL_SSL_IO_NEED_RECV;
+      octx->blocked_ssl_write_len = memlen;
       result = CURLE_AGAIN;
       goto out;
     case SSL_ERROR_WANT_WRITE:
       result = CURLE_AGAIN;
+      octx->blocked_ssl_write_len = memlen;
       goto out;
     case SSL_ERROR_SYSCALL:
     {
       int sockerr = SOCKERRNO;
 
       if(octx->io_result == CURLE_AGAIN) {
+        octx->blocked_ssl_write_len = memlen;
         result = CURLE_AGAIN;
         goto out;
       }
@@ -5526,9 +5517,9 @@ static CURLcode ossl_get_channel_binding(struct Curl_easy *data, int sockindex,
   return CURLE_OK;
 #else
   /* No X509_get_signature_nid support */
-  (void)data; /* unused */
-  (void)sockindex; /* unused */
-  (void)binding; /* unused */
+  (void)data;
+  (void)sockindex;
+  (void)binding;
   return CURLE_OK;
 #endif
 }
@@ -5552,16 +5543,14 @@ size_t Curl_ossl_version(char *buffer, size_t size)
 #elif defined(OPENSSL_IS_BORINGSSL)
 #ifdef CURL_BORINGSSL_VERSION
   return msnprintf(buffer, size, "%s/%s",
-                   OSSL_PACKAGE,
-                   CURL_BORINGSSL_VERSION);
+                   OSSL_PACKAGE, CURL_BORINGSSL_VERSION);
 #else
   return msnprintf(buffer, size, OSSL_PACKAGE);
 #endif
 #elif defined(OPENSSL_IS_AWSLC)
   return msnprintf(buffer, size, "%s/%s",
-                   OSSL_PACKAGE,
-                   AWSLC_VERSION_NUMBER_STRING);
-#elif defined(HAVE_OPENSSL_VERSION) && defined(OPENSSL_VERSION_STRING)
+                   OSSL_PACKAGE, AWSLC_VERSION_NUMBER_STRING);
+#elif defined(OPENSSL_VERSION_STRING)  /* OpenSSL 3+ */
   return msnprintf(buffer, size, "%s/%s",
                    OSSL_PACKAGE, OpenSSL_version(OPENSSL_VERSION_STRING));
 #else
@@ -5596,7 +5585,7 @@ size_t Curl_ossl_version(char *buffer, size_t size)
                    (ssleay_value >> 20) & 0xff,
                    (ssleay_value >> 12) & 0xff,
                    sub);
-#endif /* OPENSSL_IS_BORINGSSL */
+#endif
 }
 
 /* can be called with data == NULL */
@@ -5625,7 +5614,7 @@ static CURLcode ossl_sha256sum(const unsigned char *tmp, /* input */
 {
   EVP_MD_CTX *mdctx;
   unsigned int len = 0;
-  (void) unused;
+  (void)unused;
 
   mdctx = EVP_MD_CTX_create();
   if(!mdctx)
diff --git a/deps/curl/lib/vtls/openssl.h b/deps/curl/lib/vtls/openssl.h
index 1338eafb585..e263ee2eb26 100644
--- a/deps/curl/lib/vtls/openssl.h
+++ b/deps/curl/lib/vtls/openssl.h
@@ -37,6 +37,14 @@
 
 #include "../urldata.h"
 
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#define HAVE_OPENSSL3  /* non-fork OpenSSL 3.x or later */
+#endif
+
+#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
+#define HAVE_BORINGSSL_LIKE
+#endif
+
 /*
  * Whether SSL_CTX_set_keylog_callback is available.
  * OpenSSL: supported since 1.1.1 https://github.com/openssl/openssl/pull/2287
@@ -44,15 +52,13 @@
  * LibreSSL: not supported. 3.5.0+ has a stub function that does nothing.
  */
 #if (OPENSSL_VERSION_NUMBER >= 0x10101000L && \
-     !defined(LIBRESSL_VERSION_NUMBER)) || \
-    defined(OPENSSL_IS_BORINGSSL)
+  !defined(LIBRESSL_VERSION_NUMBER)) || defined(HAVE_BORINGSSL_LIKE)
 #define HAVE_KEYLOG_CALLBACK
 #endif
 
 /* Check for OpenSSL 1.1.1 which has early data support. */
 #undef HAVE_OPENSSL_EARLYDATA
-#if OPENSSL_VERSION_NUMBER >= 0x10100010L && defined(TLS1_3_VERSION) && \
-    !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC)
+#if defined(TLS1_3_VERSION) && !defined(HAVE_BORINGSSL_LIKE)
 #define HAVE_OPENSSL_EARLYDATA
 #endif
 
@@ -68,6 +74,8 @@ struct ossl_ctx {
   X509*    server_cert;
   BIO_METHOD *bio_method;
   CURLcode io_result;       /* result of last BIO cfilter operation */
+  /* blocked writes need to retry with same length, remember it */
+  int      blocked_ssl_write_len;
 #ifndef HAVE_KEYLOG_CALLBACK
   /* Set to true once a valid keylog entry has been created to avoid dupes.
      This is a bool and not a bitfield because it is passed by address. */
@@ -101,7 +109,7 @@ CURLcode Curl_ossl_ctx_init(struct ossl_ctx *octx,
                             void *ssl_user_data,
                             Curl_ossl_init_session_reuse_cb *sess_reuse_cb);
 
-#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
+#ifndef HAVE_OPENSSL3
 #define SSL_get1_peer_certificate SSL_get_peer_certificate
 #endif
 
@@ -137,10 +145,10 @@ CURLcode Curl_ossl_add_session(struct Curl_cfilter *cf,
  * ssl config verifypeer or -host is set. Otherwise all this is for
  * informational purposes only!
  */
-CURLcode Curl_oss_check_peer_cert(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  struct ossl_ctx *octx,
-                                  struct ssl_peer *peer);
+CURLcode Curl_ossl_check_peer_cert(struct Curl_cfilter *cf,
+                                   struct Curl_easy *data,
+                                   struct ossl_ctx *octx,
+                                   struct ssl_peer *peer);
 
 /* Report properties of a successful handshake */
 void Curl_ossl_report_handshake(struct Curl_easy *data,
diff --git a/deps/curl/lib/vtls/rustls.c b/deps/curl/lib/vtls/rustls.c
index 4e1b78a759d..221a7a6215a 100644
--- a/deps/curl/lib/vtls/rustls.c
+++ b/deps/curl/lib/vtls/rustls.c
@@ -393,9 +393,11 @@ cr_send(struct Curl_cfilter *cf, struct Curl_easy *data,
 /* A server certificate verify callback for Rustls that always returns
    RUSTLS_RESULT_OK, or in other words disable certificate verification. */
 static uint32_t
-cr_verify_none(void *userdata UNUSED_PARAM,
-               const rustls_verify_server_cert_params *params UNUSED_PARAM)
+cr_verify_none(void *userdata,
+               const rustls_verify_server_cert_params *params)
 {
+  (void)userdata;
+  (void)params;
   return RUSTLS_RESULT_OK;
 }
 
@@ -583,7 +585,7 @@ init_config_builder(struct Curl_easy *data,
     goto cleanup;
   }
 
-#if defined(USE_ECH)
+#ifdef USE_ECH
   if(ECH_ENABLED(data)) {
     tls_versions[0] = RUSTLS_TLS_VERSION_TLSV1_3;
     tls_versions_len = 1;
@@ -918,7 +920,7 @@ init_config_builder_client_auth(struct Curl_easy *data,
   return result;
 }
 
-#if defined(USE_ECH)
+#ifdef USE_ECH
 static CURLcode
 init_config_builder_ech(struct Curl_easy *data,
                         const struct ssl_connect_data *connssl,
@@ -1077,7 +1079,7 @@ cr_init_backend(struct Curl_cfilter *cf, struct Curl_easy *data,
     }
   }
 
-#if defined(USE_ECH)
+#ifdef USE_ECH
   if(ECH_ENABLED(data)) {
     result = init_config_builder_ech(data, connssl, config_builder);
     if(result != CURLE_OK && data->set.tls_ech & CURLECH_HARD) {
@@ -1295,12 +1297,13 @@ cr_connect(struct Curl_cfilter *cf,
 
 static void *
 cr_get_internals(struct ssl_connect_data *connssl,
-                 CURLINFO info UNUSED_PARAM)
+                 CURLINFO info)
 {
   struct rustls_ssl_backend_data *backend =
     (struct rustls_ssl_backend_data *)connssl->backend;
+  (void)info;
   DEBUGASSERT(backend);
-  return &backend->conn;
+  return backend->conn;
 }
 
 static CURLcode
diff --git a/deps/curl/lib/vtls/schannel.c b/deps/curl/lib/vtls/schannel.c
index 2ac61ba7946..1afc6790cc5 100644
--- a/deps/curl/lib/vtls/schannel.c
+++ b/deps/curl/lib/vtls/schannel.c
@@ -57,6 +57,7 @@
 #include "../curlx/version_win32.h"
 #include "../rand.h"
 #include "../curlx/strparse.h"
+#include "../progress.h"
 
 /* The last #include file should be: */
 #include "../curl_memory.h"
@@ -65,62 +66,37 @@
 /* Some verbose debug messages are wrapped by SCH_DEV() instead of DEBUGF()
  * and only shown if CURL_SCHANNEL_DEV_DEBUG was defined at build time. These
  * messages are extra verbose and intended for curl developers debugging
- * Schannel recv decryption.
+ * Schannel recv decryption and renegotiation.
  */
 #ifdef CURL_SCHANNEL_DEV_DEBUG
 #define SCH_DEV(x) x
+#define SCH_DEV_SHOWBOOL(x) \
+  infof(data, "schannel: " #x " %s", (x) ? "TRUE" : "FALSE");
 #else
 #define SCH_DEV(x) do { } while(0)
+#define SCH_DEV_SHOWBOOL(x) do { } while(0)
 #endif
 
-#ifndef BCRYPT_CHAIN_MODE_CCM
-#define BCRYPT_CHAIN_MODE_CCM L"ChainingModeCCM"
-#endif
-
-#ifndef BCRYPT_CHAIN_MODE_GCM
-#define BCRYPT_CHAIN_MODE_GCM L"ChainingModeGCM"
-#endif
-
-#ifndef BCRYPT_AES_ALGORITHM
-#define BCRYPT_AES_ALGORITHM L"AES"
-#endif
-
-#ifndef BCRYPT_SHA256_ALGORITHM
-#define BCRYPT_SHA256_ALGORITHM L"SHA256"
-#endif
-
-#ifndef BCRYPT_SHA384_ALGORITHM
-#define BCRYPT_SHA384_ALGORITHM L"SHA384"
-#endif
-
-#ifdef HAS_CLIENT_CERT_PATH
-#ifdef UNICODE
-#define CURL_CERT_STORE_PROV_SYSTEM CERT_STORE_PROV_SYSTEM_W
-#else
-#define CURL_CERT_STORE_PROV_SYSTEM CERT_STORE_PROV_SYSTEM_A
-#endif
-#endif
-
+/* Offered by mingw-w64 v8+. MS SDK 7.0A+. */
 #ifndef SP_PROT_TLS1_0_CLIENT
 #define SP_PROT_TLS1_0_CLIENT           SP_PROT_TLS1_CLIENT
 #endif
-
 #ifndef SP_PROT_TLS1_1_CLIENT
 #define SP_PROT_TLS1_1_CLIENT           0x00000200
 #endif
-
 #ifndef SP_PROT_TLS1_2_CLIENT
 #define SP_PROT_TLS1_2_CLIENT           0x00000800
 #endif
 
+/* Offered by mingw-w64 v8+. MS SDK ~10+/~VS2017+. */
 #ifndef SP_PROT_TLS1_3_CLIENT
 #define SP_PROT_TLS1_3_CLIENT           0x00002000
 #endif
-
 #ifndef SCH_USE_STRONG_CRYPTO
 #define SCH_USE_STRONG_CRYPTO           0x00400000
 #endif
 
+/* Offered by mingw-w64 v10+. MS SDK 7.0A+. */
 #ifndef SECBUFFER_ALERT
 #define SECBUFFER_ALERT                 17
 #endif
@@ -137,6 +113,7 @@
  * #define failf(x, y, ...) printf(y, __VA_ARGS__)
  */
 
+/* Offered when targeting Vista (XP SP2+) */
 #ifndef CALG_SHA_256
 #define CALG_SHA_256 0x0000800c
 #endif
@@ -147,14 +124,19 @@
 #define ALG_CLASS_DHASH ALG_CLASS_HASH
 #endif
 
+/* Offered by mingw-w64 v4+. MS SDK 6.0A+. */
 #ifndef PKCS12_NO_PERSIST_KEY
 #define PKCS12_NO_PERSIST_KEY 0x00008000
 #endif
 
+/* Offered by mingw-w64 v4+. MS SDK ~10+/~VS2017+. */
 #ifndef CERT_FIND_HAS_PRIVATE_KEY
 #define CERT_FIND_HAS_PRIVATE_KEY (21 << CERT_COMPARE_SHIFT)
 #endif
 
+/* key to use at `multi->proto_hash` */
+#define MPROTO_SCHANNEL_CERT_SHARE_KEY   "tls:schannel:cert:share"
+
 /* ALPN requires version 8.1 of the Windows SDK, which was
    shipped with Visual Studio 2013, aka _MSC_VER 1800:
      https://technet.microsoft.com/en-us/library/hh831771%28v=ws.11%29.aspx
@@ -286,7 +268,7 @@ static const struct algo algs[]= {
 #ifdef CALG_TEK
   CIPHEROPTION(CALG_TEK),
 #endif
-  CIPHEROPTION(CALG_CYLINK_MEK),
+  CIPHEROPTION(CALG_CYLINK_MEK), /* spellchecker:disable-line */
   CIPHEROPTION(CALG_SSL3_SHAMD5),
 #ifdef CALG_SSL3_MASTER
   CIPHEROPTION(CALG_SSL3_MASTER),
@@ -379,7 +361,7 @@ set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
 {
   const char *startCur = ciphers;
   int algCount = 0;
-  while(startCur && (0 != *startCur) && (algCount < NUM_CIPHERS)) {
+  while(startCur && *startCur && (algCount < NUM_CIPHERS)) {
     curl_off_t alg;
     if(curlx_str_number(&startCur, &alg, INT_MAX) || !alg)
       alg = get_alg_id_by_name(startCur);
@@ -402,8 +384,7 @@ set_ssl_ciphers(SCHANNEL_CRED *schannel_cred, char *ciphers,
   return CURLE_OK;
 }
 
-#ifdef HAS_CLIENT_CERT_PATH
-
+#ifndef UNDER_CE
 /* Function allocates memory for store_path only if CURLE_OK is returned */
 static CURLcode
 get_cert_location(TCHAR *path, DWORD *store_name, TCHAR **store_path,
@@ -469,10 +450,8 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
   struct ssl_primary_config *conn_config = Curl_ssl_cf_get_primary_config(cf);
   struct ssl_config_data *ssl_config = Curl_ssl_cf_get_config(cf, data);
 
-#ifdef HAS_CLIENT_CERT_PATH
   PCCERT_CONTEXT client_certs[1] = { NULL };
   HCERTSTORE client_cert_store = NULL;
-#endif
   SECURITY_STATUS sspi_status = SEC_E_OK;
   CURLcode result;
 
@@ -486,11 +465,9 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
   DEBUGASSERT(backend);
 
   if(conn_config->verifypeer) {
-#ifdef HAS_MANUAL_VERIFY_API
     if(backend->use_manual_cred_validation)
       flags = SCH_CRED_MANUAL_CRED_VALIDATION;
     else
-#endif
       flags = SCH_CRED_AUTO_CRED_VALIDATION;
 
     if(ssl_config->no_revoke) {
@@ -545,7 +522,7 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
   case CURL_SSLVERSION_TLSv1_3:
   {
     result = schannel_set_ssl_version_min_max(&enabled_protocols, cf, data);
-    if(result != CURLE_OK)
+    if(result)
       return result;
     break;
   }
@@ -558,7 +535,7 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
     return CURLE_SSL_CONNECT_ERROR;
   }
 
-#ifdef HAS_CLIENT_CERT_PATH
+#ifndef UNDER_CE
   /* client certificate */
   if(data->set.ssl.primary.clientcert || data->set.ssl.primary.cert_blob) {
     DWORD cert_store_name = 0;
@@ -709,7 +686,13 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
     }
     else {
       cert_store =
-        CertOpenStore(CURL_CERT_STORE_PROV_SYSTEM, 0,
+        CertOpenStore(
+#ifdef UNICODE
+                      CERT_STORE_PROV_SYSTEM_W,
+#else
+                      CERT_STORE_PROV_SYSTEM_A,
+#endif
+                      0,
                       (HCRYPTPROV)NULL,
                       CERT_STORE_OPEN_EXISTING_FLAG | cert_store_name,
                       cert_store_path);
@@ -751,16 +734,12 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
       if(!client_certs[0]) {
         /* CRYPT_E_NOT_FOUND / E_INVALIDARG */
         CertCloseStore(cert_store, 0);
+        failf(data, "schannel: client cert not found in cert store");
         return CURLE_SSL_CERTPROBLEM;
       }
     }
     client_cert_store = cert_store;
   }
-#else
-  if(data->set.ssl.primary.clientcert || data->set.ssl.primary.cert_blob) {
-    failf(data, "schannel: client cert support not built in");
-    return CURLE_NOT_BUILT_IN;
-  }
 #endif
 
   /* allocate memory for the reusable credential handle */
@@ -769,23 +748,19 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
   if(!backend->cred) {
     failf(data, "schannel: unable to allocate memory");
 
-#ifdef HAS_CLIENT_CERT_PATH
     if(client_certs[0])
       CertFreeCertificateContext(client_certs[0]);
     if(client_cert_store)
       CertCloseStore(client_cert_store, 0);
-#endif
 
     return CURLE_OUT_OF_MEMORY;
   }
   backend->cred->refcount = 1;
 
-#ifdef HAS_CLIENT_CERT_PATH
   /* Since we did not persist the key, we need to extend the store's
    * lifetime until the end of the connection
    */
   backend->cred->client_cert_store = client_cert_store;
-#endif
 
   /* We support TLS 1.3 starting in Windows 10 version 1809 (OS build 17763) as
      long as the user did not set a legacy algorithm list
@@ -811,12 +786,10 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
     credentials.pTlsParameters->grbitDisabledProtocols =
       (DWORD)~enabled_protocols;
 
-#ifdef HAS_CLIENT_CERT_PATH
     if(client_certs[0]) {
       credentials.cCreds = 1;
       credentials.paCred = client_certs;
     }
-#endif
 
     sspi_status =
       Curl_pSecFn->AcquireCredentialsHandle(NULL,
@@ -843,7 +816,7 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
               "user set an algorithm cipher list.");
       }
       result = set_ssl_ciphers(&schannel_cred, ciphers, algIds);
-      if(CURLE_OK != result) {
+      if(result) {
         failf(data, "schannel: Failed setting algorithm cipher list");
         return result;
       }
@@ -852,12 +825,10 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
       schannel_cred.dwFlags = flags | SCH_USE_STRONG_CRYPTO;
     }
 
-#ifdef HAS_CLIENT_CERT_PATH
     if(client_certs[0]) {
       schannel_cred.cCreds = 1;
       schannel_cred.paCred = client_certs;
     }
-#endif
 
     sspi_status =
       Curl_pSecFn->AcquireCredentialsHandle(NULL,
@@ -868,10 +839,8 @@ schannel_acquire_credential_handle(struct Curl_cfilter *cf,
                                             &backend->cred->time_stamp);
   }
 
-#ifdef HAS_CLIENT_CERT_PATH
   if(client_certs[0])
     CertFreeCertificateContext(client_certs[0]);
-#endif
 
   if(sspi_status != SEC_E_OK) {
     char buffer[STRERROR_LEN];
@@ -935,15 +904,10 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
 #endif
 
 #ifdef UNDER_CE
-#ifdef HAS_MANUAL_VERIFY_API
   /* certificate validation on Windows CE does not seem to work right; we will
    * do it following a more manual process. */
   backend->use_manual_cred_validation = TRUE;
 #else
-#error "compiler too old to support Windows CE requisite manual cert verify"
-#endif
-#else
-#ifdef HAS_MANUAL_VERIFY_API
   if(conn_config->CAfile || conn_config->ca_info_blob) {
     if(curlx_verify_windows_version(6, 1, 0, PLATFORM_WINNT,
                                     VERSION_GREATER_THAN_EQUAL)) {
@@ -957,12 +921,6 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
   }
   else
     backend->use_manual_cred_validation = FALSE;
-#else
-  if(conn_config->CAfile || conn_config->ca_info_blob) {
-    failf(data, "schannel: CA cert support not built in");
-    return CURLE_NOT_BUILT_IN;
-  }
-#endif
 #endif
 
   backend->cred = NULL;
@@ -1106,17 +1064,17 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
       failf(data, "schannel: SNI or certificate check failed: %s",
             Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
       return CURLE_PEER_FAILED_VERIFICATION;
-      /*
-        case SEC_E_INVALID_HANDLE:
-        case SEC_E_INVALID_TOKEN:
-        case SEC_E_LOGON_DENIED:
-        case SEC_E_TARGET_UNKNOWN:
-        case SEC_E_NO_AUTHENTICATING_AUTHORITY:
-        case SEC_E_INTERNAL_ERROR:
-        case SEC_E_NO_CREDENTIALS:
-        case SEC_E_UNSUPPORTED_FUNCTION:
-        case SEC_E_APPLICATION_PROTOCOL_MISMATCH:
-      */
+#if 0
+    case SEC_E_INVALID_HANDLE:
+    case SEC_E_INVALID_TOKEN:
+    case SEC_E_LOGON_DENIED:
+    case SEC_E_TARGET_UNKNOWN:
+    case SEC_E_NO_AUTHENTICATING_AUTHORITY:
+    case SEC_E_INTERNAL_ERROR:
+    case SEC_E_NO_CREDENTIALS:
+    case SEC_E_UNSUPPORTED_FUNCTION:
+    case SEC_E_APPLICATION_PROTOCOL_MISMATCH:
+#endif
     default:
       failf(data, "schannel: initial InitializeSecurityContext failed: %s",
             Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
@@ -1132,7 +1090,7 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
                              outbuf.pvBuffer, outbuf.cbBuffer, FALSE,
                              &written);
   Curl_pSecFn->FreeContextBuffer(outbuf.pvBuffer);
-  if((result != CURLE_OK) || (outbuf.cbBuffer != written)) {
+  if(result || (outbuf.cbBuffer != written)) {
     failf(data, "schannel: failed to send initial handshake data: "
           "sent %zu of %lu bytes", written, outbuf.cbBuffer);
     return CURLE_SSL_CONNECT_ERROR;
@@ -1145,6 +1103,7 @@ schannel_connect_step1(struct Curl_cfilter *cf, struct Curl_easy *data)
   backend->recv_sspi_close_notify = FALSE;
   backend->recv_connection_closed = FALSE;
   backend->recv_renegotiating = FALSE;
+  backend->renegotiate_state.started = FALSE;
   backend->encdata_is_incomplete = FALSE;
 
   /* continue to second handshake step */
@@ -1230,27 +1189,34 @@ schannel_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
     if(doread) {
       /* read encrypted handshake data from socket */
       result = Curl_conn_cf_recv(cf->next, data,
-                                 (char *) (backend->encdata_buffer +
-                                           backend->encdata_offset),
+                                 (char *)(backend->encdata_buffer +
+                                          backend->encdata_offset),
                                  backend->encdata_length -
                                  backend->encdata_offset,
                                  &nread);
       if(result == CURLE_AGAIN) {
-        connssl->io_need = CURL_SSL_IO_NEED_RECV;
-        DEBUGF(infof(data, "schannel: failed to receive handshake, "
-                     "need more data"));
-        return CURLE_OK;
+        if(!backend->encdata_offset || backend->encdata_is_incomplete) {
+          connssl->io_need = CURL_SSL_IO_NEED_RECV;
+          DEBUGF(infof(data, "schannel: failed to receive handshake, "
+                       "need more data"));
+          return CURLE_OK;
+        }
+        else {
+          DEBUGF(infof(data, "schannel: no new handshake data received, "
+                       "continuing to process existing handshake data"));
+        }
       }
-      else if((result != CURLE_OK) || (nread == 0)) {
+      else if(result || (nread == 0)) {
         failf(data, "schannel: failed to receive handshake, "
               "SSL/TLS connection failed");
         return CURLE_SSL_CONNECT_ERROR;
       }
-
-      /* increase encrypted data buffer offset */
-      backend->encdata_offset += nread;
-      backend->encdata_is_incomplete = FALSE;
-      SCH_DEV(infof(data, "schannel: encrypted data got %zu", nread));
+      else {
+        /* increase encrypted data buffer offset */
+        backend->encdata_offset += nread;
+        backend->encdata_is_incomplete = FALSE;
+        SCH_DEV(infof(data, "schannel: encrypted data got %zu", nread));
+      }
     }
 
     SCH_DEV(infof(data,
@@ -1278,6 +1244,17 @@ schannel_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
     memcpy(inbuf[0].pvBuffer, backend->encdata_buffer,
            backend->encdata_offset);
 
+    /* The socket must be writeable (or a poll error occurred) before we call
+       InitializeSecurityContext to continue processing the received TLS
+       records. This is because that function is not idempotent and we don't
+       support partial save/resume sending replies of handshake tokens. */
+    if(!SOCKET_WRITABLE(Curl_conn_cf_get_socket(cf, data), 0)) {
+      SCH_DEV(infof(data, "schannel: handshake waiting for writeable socket"));
+      connssl->io_need = CURL_SSL_IO_NEED_SEND;
+      free(inbuf[0].pvBuffer);
+      return CURLE_OK;
+    }
+
     sspi_status = Curl_pSecFn->InitializeSecurityContext(
       &backend->cred->cred_handle, &backend->ctxt->ctxt_handle,
       backend->cred->sni_hostname, backend->req_flags,
@@ -1320,8 +1297,7 @@ schannel_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
           result = Curl_conn_cf_send(cf->next, data,
                                      outbuf[i].pvBuffer, outbuf[i].cbBuffer,
                                      FALSE, &written);
-          if((result != CURLE_OK) ||
-             (outbuf[i].cbBuffer != written)) {
+          if(result || (outbuf[i].cbBuffer != written)) {
             failf(data, "schannel: failed to send next handshake data: "
                   "sent %zu of %lu bytes", written, outbuf[i].cbBuffer);
             return CURLE_SSL_CONNECT_ERROR;
@@ -1349,17 +1325,17 @@ schannel_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
         failf(data, "schannel: %s",
               Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
         return CURLE_PEER_FAILED_VERIFICATION;
-        /*
-          case SEC_E_INVALID_HANDLE:
-          case SEC_E_INVALID_TOKEN:
-          case SEC_E_LOGON_DENIED:
-          case SEC_E_TARGET_UNKNOWN:
-          case SEC_E_NO_AUTHENTICATING_AUTHORITY:
-          case SEC_E_INTERNAL_ERROR:
-          case SEC_E_NO_CREDENTIALS:
-          case SEC_E_UNSUPPORTED_FUNCTION:
-          case SEC_E_APPLICATION_PROTOCOL_MISMATCH:
-        */
+#if 0
+      case SEC_E_INVALID_HANDLE:
+      case SEC_E_INVALID_TOKEN:
+      case SEC_E_LOGON_DENIED:
+      case SEC_E_TARGET_UNKNOWN:
+      case SEC_E_NO_AUTHENTICATING_AUTHORITY:
+      case SEC_E_INTERNAL_ERROR:
+      case SEC_E_NO_CREDENTIALS:
+      case SEC_E_UNSUPPORTED_FUNCTION:
+      case SEC_E_APPLICATION_PROTOCOL_MISMATCH:
+#endif
       default:
         failf(data, "schannel: next InitializeSecurityContext failed: %s",
               Curl_sspi_strerror(sspi_status, buffer, sizeof(buffer)));
@@ -1427,12 +1403,10 @@ schannel_connect_step2(struct Curl_cfilter *cf, struct Curl_easy *data)
     }
   }
 
-#ifdef HAS_MANUAL_VERIFY_API
   if(conn_config->verifypeer && backend->use_manual_cred_validation) {
     /* Certificate verification also verifies the hostname if verifyhost */
     return Curl_verify_certificate(cf, data);
   }
-#endif
 
   /* Verify the hostname manually when certificate verification is disabled,
      because in that case Schannel will not verify it. */
@@ -1485,7 +1459,7 @@ static bool
 cert_counter_callback(const CERT_CONTEXT *ccert_context, bool reverse_order,
                       void *certs_count)
 {
-  (void)reverse_order; /* unused */
+  (void)reverse_order;
   if(valid_cert_encoding(ccert_context))
     (*(int *)certs_count)++;
   return TRUE;
@@ -1527,12 +1501,10 @@ static void schannel_session_free(void *sessionid)
     if(cred->refcount == 0) {
       Curl_pSecFn->FreeCredentialsHandle(&cred->cred_handle);
       curlx_unicodefree(cred->sni_hostname);
-#ifdef HAS_CLIENT_CERT_PATH
       if(cred->client_cert_store) {
         CertCloseStore(cred->client_cert_store, 0);
         cred->client_cert_store = NULL;
       }
-#endif
       Curl_safefree(cred);
     }
   }
@@ -1591,19 +1563,18 @@ schannel_connect_step3(struct Curl_cfilter *cf, struct Curl_easy *data)
 
     if(alpn_result.ProtoNegoStatus ==
        SecApplicationProtocolNegotiationStatus_Success) {
-      unsigned char prev_alpn = cf->conn->alpn;
-
+      if(backend->recv_renegotiating &&
+         connssl->negotiated.alpn &&
+         strncmp(connssl->negotiated.alpn,
+                 (const char *)alpn_result.ProtocolId,
+                 alpn_result.ProtocolIdSize)) {
+        /* Renegotiation selected a different protocol now, we cannot
+         * deal with this */
+        failf(data, "schannel: server selected an ALPN protocol too late");
+        return CURLE_SSL_CONNECT_ERROR;
+      }
       Curl_alpn_set_negotiated(cf, data, connssl, alpn_result.ProtocolId,
                                alpn_result.ProtocolIdSize);
-      if(backend->recv_renegotiating) {
-        if(prev_alpn != cf->conn->alpn &&
-           prev_alpn != CURL_HTTP_VERSION_NONE) {
-          /* Renegotiation selected a different protocol now, we cannot
-           * deal with this */
-          failf(data, "schannel: server selected an ALPN protocol too late");
-          return CURLE_SSL_CONNECT_ERROR;
-        }
-      }
     }
     else {
       if(!backend->recv_renegotiating)
@@ -1694,7 +1665,7 @@ static CURLcode schannel_connect(struct Curl_cfilter *cf,
   if(ssl_connect_done == connssl->connecting_state) {
     connssl->state = ssl_connection_complete;
 
-#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS
+#ifdef SECPKG_ATTR_ENDPOINT_BINDINGS  /* mingw-w64 v9+. MS SDK 7.0A+. */
     /* When SSPI is used in combination with Schannel
      * we need the Schannel context to create the Schannel
      * binding to pass the IIS extended protection checks.
@@ -1714,6 +1685,205 @@ static CURLcode schannel_connect(struct Curl_cfilter *cf,
   return CURLE_OK;
 }
 
+enum schannel_renegotiate_caller_t {
+  SCH_RENEG_CALLER_IS_RECV,
+  SCH_RENEG_CALLER_IS_SEND
+};
+
+/* This function renegotiates the connection due to a server request received
+   by schannel_recv. This function returns CURLE_AGAIN if the renegotiation is
+   incomplete. In that case, we remain in the renegotiation (connecting) stage
+   and future calls to schannel_recv and schannel_send must call this function
+   first to complete the renegotiation. */
+static CURLcode
+schannel_recv_renegotiate(struct Curl_cfilter *cf, struct Curl_easy *data,
+                          enum schannel_renegotiate_caller_t caller)
+{
+  CURLcode result;
+  curl_socket_t sockfd;
+  const timediff_t max_renegotiate_ms = 5 * 60 * 1000; /* 5 minutes */
+  struct ssl_connect_data *connssl = cf->ctx;
+  struct schannel_ssl_backend_data *backend =
+    (struct schannel_ssl_backend_data *)connssl->backend;
+  struct schannel_renegotiate_state *rs = &backend->renegotiate_state;
+
+  if(!backend || !backend->recv_renegotiating) {
+    failf(data, "schannel: unexpected call to schannel_recv_renegotiate");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  if(caller == SCH_RENEG_CALLER_IS_RECV)
+    SCH_DEV(infof(data, "schannel: renegotiation caller is schannel_recv"));
+  else if(caller == SCH_RENEG_CALLER_IS_SEND)
+    SCH_DEV(infof(data, "schannel: renegotiation caller is schannel_send"));
+  else {
+    failf(data, "schannel: unknown caller for schannel_recv_renegotiate");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  sockfd = Curl_conn_cf_get_socket(cf, data);
+
+  if(sockfd == CURL_SOCKET_BAD) {
+    failf(data, "schannel: renegotiation missing socket");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  if(!rs->started) { /* new renegotiation */
+    infof(data, "schannel: renegotiating SSL/TLS connection");
+    DEBUGASSERT(connssl->state == ssl_connection_complete);
+    DEBUGASSERT(connssl->connecting_state == ssl_connect_done);
+    connssl->state = ssl_connection_negotiating;
+    connssl->connecting_state = ssl_connect_2;
+    memset(rs, 0, sizeof(*rs));
+    rs->io_need = CURL_SSL_IO_NEED_SEND;
+    rs->start_time = curlx_now();
+    rs->started = TRUE;
+  }
+
+  for(;;) {
+    bool block_read, block_write, blocking, done;
+    curl_socket_t readfd, writefd;
+    timediff_t elapsed;
+
+    elapsed = curlx_timediff(curlx_now(), rs->start_time);
+    if(elapsed >= max_renegotiate_ms) {
+      failf(data, "schannel: renegotiation timeout");
+      result = CURLE_SSL_CONNECT_ERROR;
+      break;
+    }
+
+    /* the current io_need state may have been overwritten since the last time
+       this function was called. restore the io_need state needed to continue
+       the renegotiation. */
+
+    connssl->io_need = rs->io_need;
+
+    result = schannel_connect(cf, data, &done);
+
+    rs->io_need = connssl->io_need;
+
+    if(!result && !done)
+      result = CURLE_AGAIN;
+
+    if(result != CURLE_AGAIN)
+      break;
+
+    readfd = (rs->io_need & CURL_SSL_IO_NEED_RECV) ? sockfd : CURL_SOCKET_BAD;
+    writefd = (rs->io_need & CURL_SSL_IO_NEED_SEND) ? sockfd : CURL_SOCKET_BAD;
+
+    if(readfd == CURL_SOCKET_BAD && writefd == CURL_SOCKET_BAD)
+      continue;
+
+    /* connect should not have requested io read and write together */
+    DEBUGASSERT(readfd == CURL_SOCKET_BAD || writefd == CURL_SOCKET_BAD);
+
+    /* This function is partially blocking to avoid a stoppage that would
+     * occur if the user is waiting on the socket only in one direction.
+     *
+     * For example, if the user has called recv then they may not be waiting
+     * for a writeable socket and vice versa, so we block to avoid that.
+     *
+     * In practice a wait is unlikely to occur. For caller recv if handshake
+     * data needs to be sent then we block for a writeable socket that should
+     * be writeable immediately except for OS resource constraints. For caller
+     * send if handshake data needs to be received then we block for a readable
+     * socket, which could take some time, but it's more likely the user has
+     * called recv since they had called it prior (only recv can start
+     * renegotiation and probably the user is going to call it again to get
+     * more of their data before calling send).
+     */
+
+    block_read = (caller == SCH_RENEG_CALLER_IS_SEND) ? TRUE : FALSE;
+    block_write = (caller == SCH_RENEG_CALLER_IS_RECV) ? TRUE : FALSE;
+
+    blocking = (block_read && (readfd != CURL_SOCKET_BAD)) ||
+               (block_write && (writefd != CURL_SOCKET_BAD));
+
+    SCH_DEV_SHOWBOOL(block_read);
+    SCH_DEV_SHOWBOOL(block_write);
+    SCH_DEV_SHOWBOOL(blocking);
+
+    for(;;) {
+      int what;
+      timediff_t timeout, remaining;
+
+      if(Curl_pgrsUpdate(data)) {
+        result = CURLE_ABORTED_BY_CALLBACK;
+        break;
+      }
+
+      elapsed = curlx_timediff(curlx_now(), rs->start_time);
+      if(elapsed >= max_renegotiate_ms) {
+        failf(data, "schannel: renegotiation timeout");
+        result = CURLE_SSL_CONNECT_ERROR;
+        break;
+      }
+      remaining = max_renegotiate_ms - elapsed;
+
+      if(blocking) {
+        timeout = Curl_timeleft(data, NULL, FALSE);
+
+        if(timeout < 0) {
+          result = CURLE_OPERATION_TIMEDOUT;
+          break;
+        }
+
+        /* the blocking is in intervals so that the progress function can be
+           called every second */
+        if(!timeout || timeout > 1000)
+          timeout = 1000;
+
+        if(timeout > remaining)
+          timeout = remaining;
+      }
+      else
+        timeout = 0;
+
+      SCH_DEV(infof(data, "schannel: renegotiation wait until socket is"
+                    "%s%s for up to %" FMT_TIMEDIFF_T " ms",
+                    ((readfd != CURL_SOCKET_BAD) ? " readable" : ""),
+                    ((writefd != CURL_SOCKET_BAD) ? " writeable" : ""),
+                    timeout));
+
+      what = Curl_socket_check(readfd, CURL_SOCKET_BAD, writefd, timeout);
+
+      if(what > 0 && (what & (CURL_CSELECT_IN | CURL_CSELECT_OUT))) {
+        SCH_DEV(infof(data, "schannel: renegotiation socket %s%s",
+                      ((what & CURL_CSELECT_IN) ? "CURL_CSELECT_IN " : ""),
+                      ((what & CURL_CSELECT_OUT) ? "CURL_CSELECT_OUT " : "")));
+        result = CURLE_AGAIN;
+        break;
+      }
+      else if(!what) {
+        SCH_DEV(infof(data, "schannel: renegotiation socket timeout"));
+        if(blocking)
+          continue;
+        else
+          return CURLE_AGAIN;
+      }
+
+      failf(data, "schannel: socket error during renegotiation");
+      result = CURLE_SSL_CONNECT_ERROR;
+      break;
+    }
+    if(result != CURLE_AGAIN)
+      break;
+  }
+
+  DEBUGASSERT(result != CURLE_AGAIN);
+
+  rs->started = FALSE;
+  backend->recv_renegotiating = FALSE;
+  connssl->io_need = CURL_SSL_IO_NEED_NONE;
+
+  if(result)
+    failf(data, "schannel: renegotiation failed");
+  else
+    infof(data, "schannel: SSL/TLS connection renegotiated");
+
+  return result;
+}
+
 static CURLcode
 schannel_send(struct Curl_cfilter *cf, struct Curl_easy *data,
               const void *buf, size_t len, size_t *pnwritten)
@@ -1731,6 +1901,12 @@ schannel_send(struct Curl_cfilter *cf, struct Curl_easy *data,
   DEBUGASSERT(backend);
   *pnwritten = 0;
 
+  if(backend->recv_renegotiating) {
+    result = schannel_recv_renegotiate(cf, data, SCH_RENEG_CALLER_IS_SEND);
+    if(result)
+      return result;
+  }
+
   /* check if the maximum stream sizes were queried */
   if(backend->stream_sizes.cbMaximumMessage == 0) {
     sspi_status = Curl_pSecFn->QueryContextAttributes(
@@ -1750,7 +1926,7 @@ schannel_send(struct Curl_cfilter *cf, struct Curl_easy *data,
   /* calculate the complete message length and allocate a buffer for it */
   data_len = backend->stream_sizes.cbHeader + len +
     backend->stream_sizes.cbTrailer;
-  ptr = (unsigned char *) malloc(data_len);
+  ptr = (unsigned char *)malloc(data_len);
   if(!ptr) {
     return CURLE_OUT_OF_MEMORY;
   }
@@ -1771,7 +1947,7 @@ schannel_send(struct Curl_cfilter *cf, struct Curl_easy *data,
 
   /* https://msdn.microsoft.com/en-us/library/windows/desktop/aa375390.aspx */
   sspi_status = Curl_pSecFn->EncryptMessage(&backend->ctxt->ctxt_handle, 0,
-                                         &outbuf_desc, 0);
+                                            &outbuf_desc, 0);
 
   /* check if the message was encrypted */
   if(sspi_status == SEC_E_OK) {
@@ -1816,7 +1992,7 @@ schannel_send(struct Curl_cfilter *cf, struct Curl_easy *data,
         result = CURLE_SEND_ERROR;
         break;
       }
-      else if(0 == what) {
+      else if(what == 0) {
         failf(data, "schannel: timed out sending data "
               "(bytes sent: %zu)", *pnwritten);
         result = CURLE_OPERATION_TIMEDOUT;
@@ -1829,7 +2005,7 @@ schannel_send(struct Curl_cfilter *cf, struct Curl_easy *data,
                                   FALSE, &this_write);
       if(result == CURLE_AGAIN)
         continue;
-      else if(result != CURLE_OK) {
+      else if(result) {
         break;
       }
 
@@ -1862,7 +2038,6 @@ schannel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
   struct ssl_connect_data *connssl = cf->ctx;
   unsigned char *reallocated_buffer;
   size_t reallocated_length;
-  bool done = FALSE;
   SecBuffer inbuf[4];
   SecBufferDesc inbuf_desc;
   SECURITY_STATUS sspi_status = SEC_E_OK;
@@ -1876,6 +2051,12 @@ schannel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
   DEBUGASSERT(backend);
   *pnread = 0;
 
+  if(backend->recv_renegotiating) {
+    result = schannel_recv_renegotiate(cf, data, SCH_RENEG_CALLER_IS_RECV);
+    if(result)
+      return result;
+  }
+
   /****************************************************************************
    * Do not return or set backend->recv_unrecoverable_err unless in the
    * cleanup. The pattern for return error is set *err, optional infof, goto
@@ -2068,21 +2249,13 @@ schannel_recv(struct Curl_cfilter *cf, struct Curl_easy *data,
           goto cleanup;
         }
 
-        /* begin renegotiation */
-        infof(data, "schannel: renegotiating SSL/TLS connection");
-        connssl->state = ssl_connection_negotiating;
-        connssl->connecting_state = ssl_connect_2;
-        connssl->io_need = CURL_SSL_IO_NEED_SEND;
         backend->recv_renegotiating = TRUE;
-        result = schannel_connect(cf, data, &done);
-        backend->recv_renegotiating = FALSE;
-        if(result) {
-          infof(data, "schannel: renegotiation failed");
+        result = schannel_recv_renegotiate(cf, data, SCH_RENEG_CALLER_IS_RECV);
+        if(result)
           goto cleanup;
-        }
+
         /* now retry receiving data */
         sspi_status = SEC_E_OK;
-        infof(data, "schannel: SSL/TLS connection renegotiated");
         continue;
       }
       /* check if the server closed the connection */
@@ -2380,26 +2553,16 @@ static void schannel_close(struct Curl_cfilter *cf, struct Curl_easy *data)
 static int schannel_init(void)
 {
 #if defined(HAS_ALPN_SCHANNEL) && !defined(UNDER_CE)
-  bool wine = FALSE;
-  bool wine_has_alpn = FALSE;
-
-#ifndef CURL_WINDOWS_UWP
   typedef const char *(APIENTRY *WINE_GET_VERSION_FN)(void);
-  /* GetModuleHandle() not available for UWP.
-     Assume no WINE because WINE has no UWP support. */
   WINE_GET_VERSION_FN p_wine_get_version =
     CURLX_FUNCTION_CAST(WINE_GET_VERSION_FN,
                         (GetProcAddress(GetModuleHandleA("ntdll"),
                                         "wine_get_version")));
-  wine = !!p_wine_get_version;
-  if(wine) {
+  if(p_wine_get_version) {  /* WINE detected */
     const char *wine_version = p_wine_get_version();  /* e.g. "6.0.2" */
     /* Assume ALPN support with WINE 6.0 or upper */
-    wine_has_alpn = wine_version && atoi(wine_version) >= 6;
+    s_win_has_alpn = wine_version && atoi(wine_version) >= 6;
   }
-#endif
-  if(wine)
-    s_win_has_alpn = wine_has_alpn;
   else {
     /* ALPN is supported on Windows 8.1 / Server 2012 R2 and above. */
     s_win_has_alpn = curlx_verify_windows_version(6, 3, 0, PLATFORM_WINNT,
@@ -2420,7 +2583,7 @@ static size_t schannel_version(char *buffer, size_t size)
   return msnprintf(buffer, size, "Schannel");
 }
 
-static CURLcode schannel_random(struct Curl_easy *data UNUSED_PARAM,
+static CURLcode schannel_random(struct Curl_easy *data,
                                 unsigned char *entropy, size_t length)
 {
   (void)data;
@@ -2504,13 +2667,6 @@ static void schannel_checksum(const unsigned char *input,
                               DWORD provType,
                               const unsigned int algId)
 {
-#ifdef CURL_WINDOWS_UWP
-  (void)input;
-  (void)inputlen;
-  (void)provType;
-  (void)algId;
-  memset(checksum, 0, checksumlen);
-#else
   HCRYPTPROV hProv = 0;
   HCRYPTHASH hHash = 0;
   DWORD cbHashSize = 0;
@@ -2556,7 +2712,6 @@ static void schannel_checksum(const unsigned char *input,
 
   if(hProv)
     CryptReleaseContext(hProv, 0);
-#endif
 }
 
 static CURLcode schannel_sha256sum(const unsigned char *input,
@@ -2570,7 +2725,7 @@ static CURLcode schannel_sha256sum(const unsigned char *input,
 }
 
 static void *schannel_get_internals(struct ssl_connect_data *connssl,
-                                    CURLINFO info UNUSED_PARAM)
+                                    CURLINFO info)
 {
   struct schannel_ssl_backend_data *backend =
     (struct schannel_ssl_backend_data *)connssl->backend;
@@ -2726,12 +2881,8 @@ const struct Curl_ssl Curl_ssl_schannel = {
   { CURLSSLBACKEND_SCHANNEL, "schannel" }, /* info */
 
   SSLSUPP_CERTINFO |
-#ifdef HAS_MANUAL_VERIFY_API
   SSLSUPP_CAINFO_BLOB |
-#endif
-#ifndef CURL_WINDOWS_UWP
   SSLSUPP_PINNEDPUBKEY |
-#endif
   SSLSUPP_CA_CACHE |
   SSLSUPP_HTTPS_PROXY |
   SSLSUPP_CIPHER_LIST,
diff --git a/deps/curl/lib/vtls/schannel.h b/deps/curl/lib/vtls/schannel.h
index c3512dd1323..9d0bea221a9 100644
--- a/deps/curl/lib/vtls/schannel.h
+++ b/deps/curl/lib/vtls/schannel.h
@@ -37,7 +37,7 @@
 #pragma warning(pop)
 #endif
 /* Wincrypt must be included before anything that could include OpenSSL. */
-#if defined(USE_WIN32_CRYPTO)
+#ifdef USE_WIN32_CRYPTO
 #include <wincrypt.h>
 /* Undefine wincrypt conflicting symbols for BoringSSL. */
 #undef X509_NAME
@@ -68,7 +68,7 @@
  * BoringSSL's <openssl/x509.h>: So just undefine those defines here
  * (and only here).
  */
-#if defined(OPENSSL_IS_BORINGSSL)
+#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
 # undef X509_NAME
 # undef X509_CERT_PAIR
 # undef X509_EXTENSIONS
diff --git a/deps/curl/lib/vtls/schannel_int.h b/deps/curl/lib/vtls/schannel_int.h
index 511a852c7a2..5483d12b5bb 100644
--- a/deps/curl/lib/vtls/schannel_int.h
+++ b/deps/curl/lib/vtls/schannel_int.h
@@ -30,32 +30,6 @@
 
 #include "vtls.h"
 
-#if (defined(__MINGW32__) || defined(CERT_CHAIN_REVOCATION_CHECK_CHAIN)) \
-  && !defined(CURL_WINDOWS_UWP)
-#define HAS_MANUAL_VERIFY_API
-#endif
-
-#if defined(CryptStringToBinary) && defined(CRYPT_STRING_HEX)   \
-  && !defined(DISABLE_SCHANNEL_CLIENT_CERT)
-#define HAS_CLIENT_CERT_PATH
-#endif
-
-#ifndef CRYPT_DECODE_NOCOPY_FLAG
-#define CRYPT_DECODE_NOCOPY_FLAG 0x1
-#endif
-
-#ifndef CRYPT_DECODE_ALLOC_FLAG
-#define CRYPT_DECODE_ALLOC_FLAG 0x8000
-#endif
-
-#ifndef CERT_ALT_NAME_DNS_NAME
-#define CERT_ALT_NAME_DNS_NAME 3
-#endif
-
-#ifndef CERT_ALT_NAME_IP_ADDRESS
-#define CERT_ALT_NAME_IP_ADDRESS 8
-#endif
-
 #if defined(_MSC_VER) && (_MSC_VER <= 1600)
 /* Workaround for warning:
    'type cast' : conversion from 'int' to 'LPCSTR' of greater size */
@@ -67,6 +41,7 @@
 #define CERT_STORE_PROV_SYSTEM_W  ((LPCSTR)(size_t)10)
 #endif
 
+/* Offered by mingw-w64 v8+, MS SDK ~10+/~VS2022+ */
 #ifndef SCH_CREDENTIALS_VERSION
 #define SCH_CREDENTIALS_VERSION  0x00000005
 
@@ -83,7 +58,7 @@ typedef struct _CRYPTO_SETTINGS {
   eTlsAlgorithmUsage  eAlgorithmUsage;
   UNICODE_STRING      strCngAlgId;
   DWORD               cChainingModes;
-  PUNICODE_STRING     rgstrChainingModes;
+  PUNICODE_STRING     rgstrChainingModes; /* spellchecker:disable-line */
   DWORD               dwMinBitLength;
   DWORD               dwMaxBitLength;
 } CRYPTO_SETTINGS, * PCRYPTO_SETTINGS;
@@ -91,7 +66,7 @@ typedef struct _CRYPTO_SETTINGS {
 /* !checksrc! disable TYPEDEFSTRUCT 1 */
 typedef struct _TLS_PARAMETERS {
   DWORD               cAlpnIds;
-  PUNICODE_STRING     rgstrAlpnIds;
+  PUNICODE_STRING     rgstrAlpnIds; /* spellchecker:disable-line */
   DWORD               grbitDisabledProtocols;
   DWORD               cDisabledCrypto;
   PCRYPTO_SETTINGS    pDisabledCrypto;
@@ -126,9 +101,7 @@ struct Curl_schannel_cred {
   CredHandle cred_handle;
   TimeStamp time_stamp;
   TCHAR *sni_hostname;
-#ifdef HAS_CLIENT_CERT_PATH
   HCERTSTORE client_cert_store;
-#endif
   int refcount;
 };
 
@@ -150,20 +123,20 @@ struct schannel_ssl_backend_data {
      more bytes into encdata then set this back to false. */
   unsigned long req_flags, ret_flags;
   CURLcode recv_unrecoverable_err; /* schannel_recv had an unrecoverable err */
+  struct schannel_renegotiate_state {
+    bool started;
+    struct curltime start_time;
+    int io_need;
+  } renegotiate_state;
   BIT(recv_sspi_close_notify); /* true if connection closed by close_notify */
   BIT(recv_connection_closed); /* true if connection closed, regardless how */
   BIT(recv_renegotiating);     /* true if recv is doing renegotiation */
   BIT(use_alpn); /* true if ALPN is used for this connection */
-#ifdef HAS_MANUAL_VERIFY_API
   BIT(use_manual_cred_validation); /* true if manual cred validation is used */
-#endif
   BIT(sent_shutdown);
   BIT(encdata_is_incomplete);
 };
 
-/* key to use at `multi->proto_hash` */
-#define MPROTO_SCHANNEL_CERT_SHARE_KEY   "tls:schannel:cert:share"
-
 struct schannel_cert_share {
   unsigned char CAinfo_blob_digest[CURL_SHA256_DIGEST_LENGTH];
   size_t CAinfo_blob_size;           /* CA info blob size */
diff --git a/deps/curl/lib/vtls/schannel_verify.c b/deps/curl/lib/vtls/schannel_verify.c
index 7db13f2a251..17e42707631 100644
--- a/deps/curl/lib/vtls/schannel_verify.c
+++ b/deps/curl/lib/vtls/schannel_verify.c
@@ -56,8 +56,6 @@
 
 #define BACKEND ((struct schannel_ssl_backend_data *)connssl->backend)
 
-#ifdef HAS_MANUAL_VERIFY_API
-
 #ifdef __MINGW32CE__
 #define CERT_QUERY_OBJECT_BLOB 0x00000002
 #define CERT_QUERY_CONTENT_CERT 1
@@ -94,7 +92,7 @@ struct cert_chain_engine_config_win8 {
   DWORD dwExclusiveFlags;
 };
 
-/* Not defined before mingw-w64 4.0.0 */
+/* Offered by mingw-w64 v4+. MS SDK ~10+/~VS2017+. */
 #ifndef CERT_CHAIN_EXCLUSIVE_ENABLE_CA_FLAG
 #define CERT_CHAIN_EXCLUSIVE_ENABLE_CA_FLAG 0x00000001
 #endif
@@ -370,11 +368,7 @@ static CURLcode add_certs_file_to_store(HCERTSTORE trust_store,
 
   return result;
 }
-#endif
-
-#endif /* HAS_MANUAL_VERIFY_API */
 
-#ifndef UNDER_CE
 /*
  * Returns the number of characters necessary to populate all the host_names.
  * If host_names is not NULL, populate it with all the hostnames. Each string
@@ -390,18 +384,11 @@ static DWORD cert_get_name_string(struct Curl_easy *data,
                                   BOOL Win8_compat)
 {
   DWORD actual_length = 0;
-#if defined(CURL_WINDOWS_UWP)
-  (void)data;
-  (void)cert_context;
-  (void)host_names;
-  (void)length;
-  (void)alt_name_info;
-  (void)Win8_compat;
-#else
   BOOL compute_content = FALSE;
   LPTSTR current_pos = NULL;
   DWORD i;
 
+/* Offered by mingw-w64 v4+. MS SDK ~10+/~VS2017+. */
 #ifdef CERT_NAME_SEARCH_ALL_NAMES_FLAG
   /* CERT_NAME_SEARCH_ALL_NAMES_FLAG is available from Windows 8 onwards. */
   if(Win8_compat) {
@@ -471,7 +458,6 @@ static DWORD cert_get_name_string(struct Curl_easy *data,
     /* Last string has double null-terminator. */
     *current_pos = '\0';
   }
-#endif
   return actual_length;
 }
 
@@ -510,12 +496,6 @@ static bool get_alt_name_info(struct Curl_easy *data,
                               LPDWORD alt_name_info_size)
 {
   bool result = FALSE;
-#if defined(CURL_WINDOWS_UWP)
-  (void)data;
-  (void)ctx;
-  (void)alt_name_info;
-  (void)alt_name_info_size;
-#else
   PCERT_INFO cert_info = NULL;
   PCERT_EXTENSION extension = NULL;
   CRYPT_DECODE_PARA decode_para = { sizeof(CRYPT_DECODE_PARA), NULL, NULL };
@@ -553,7 +533,6 @@ static bool get_alt_name_info(struct Curl_easy *data,
     return result;
   }
   result = TRUE;
-#endif
   return result;
 }
 #endif /* !UNDER_CE */
@@ -767,7 +746,6 @@ CURLcode Curl_verify_host(struct Curl_cfilter *cf,
   return result;
 }
 
-#ifdef HAS_MANUAL_VERIFY_API
 /* Verify the server's certificate and hostname */
 CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
                                  struct Curl_easy *data)
@@ -801,8 +779,8 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
 
 #ifndef UNDER_CE
   if(result == CURLE_OK &&
-      (conn_config->CAfile || conn_config->ca_info_blob) &&
-      BACKEND->use_manual_cred_validation) {
+     (conn_config->CAfile || conn_config->ca_info_blob) &&
+     BACKEND->use_manual_cred_validation) {
     /*
      * Create a chain engine that uses the certificates in the CA file as
      * trusted certificates. This is only supported on Windows 7+.
@@ -979,5 +957,4 @@ CURLcode Curl_verify_certificate(struct Curl_cfilter *cf,
   return result;
 }
 
-#endif /* HAS_MANUAL_VERIFY_API */
 #endif /* USE_SCHANNEL */
diff --git a/deps/curl/lib/vtls/vtls.c b/deps/curl/lib/vtls/vtls.c
index db4e57342e3..f17f9142bed 100644
--- a/deps/curl/lib/vtls/vtls.c
+++ b/deps/curl/lib/vtls/vtls.c
@@ -137,9 +137,11 @@ static bool blobcmp(struct curl_blob *first, struct curl_blob *second)
 }
 
 #ifdef USE_SSL
+#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_PROXY)
 static const struct alpn_spec ALPN_SPEC_H11 = {
   { ALPN_HTTP_1_1 }, 1
 };
+#endif /* !CURL_DISABLE_HTTP || !CURL_DISABLE_PROXY */
 #ifdef USE_HTTP2
 static const struct alpn_spec ALPN_SPEC_H2 = {
   { ALPN_H2 }, 1
@@ -149,6 +151,7 @@ static const struct alpn_spec ALPN_SPEC_H2_H11 = {
 };
 #endif
 
+#if !defined(CURL_DISABLE_HTTP) || !defined(CURL_DISABLE_PROXY)
 static const struct alpn_spec *
 alpn_get_spec(http_majors allowed, bool use_alpn)
 {
@@ -167,6 +170,7 @@ alpn_get_spec(http_majors allowed, bool use_alpn)
      Avoid "http/1.0" because some servers do not support it. */
   return &ALPN_SPEC_H11;
 }
+#endif /* !CURL_DISABLE_HTTP || !CURL_DISABLE_PROXY */
 #endif /* USE_SSL */
 
 
@@ -499,26 +503,30 @@ void Curl_ssl_close_all(struct Curl_easy *data)
     Curl_ssl->close_all(data);
 }
 
-void Curl_ssl_adjust_pollset(struct Curl_cfilter *cf, struct Curl_easy *data,
-                             struct easy_pollset *ps)
+CURLcode  Curl_ssl_adjust_pollset(struct Curl_cfilter *cf,
+                                  struct Curl_easy *data,
+                                  struct easy_pollset *ps)
 {
   struct ssl_connect_data *connssl = cf->ctx;
 
   if(connssl->io_need) {
     curl_socket_t sock = Curl_conn_cf_get_socket(cf->next, data);
+    CURLcode result = CURLE_OK;
     if(sock != CURL_SOCKET_BAD) {
       if(connssl->io_need & CURL_SSL_IO_NEED_SEND) {
-        Curl_pollset_set_out_only(data, ps, sock);
+        result = Curl_pollset_set_out_only(data, ps, sock);
         CURL_TRC_CF(data, cf, "adjust_pollset, POLLOUT fd=%" FMT_SOCKET_T,
                     sock);
       }
       else {
-        Curl_pollset_set_in_only(data, ps, sock);
+        result = Curl_pollset_set_in_only(data, ps, sock);
         CURL_TRC_CF(data, cf, "adjust_pollset, POLLIN fd=%" FMT_SOCKET_T,
                     sock);
       }
     }
+    return result;
   }
+  return CURLE_OK;
 }
 
 /* Selects an SSL crypto engine
@@ -666,7 +674,7 @@ static CURLcode pubkey_pem_to_der(const char *pem,
 
   pem_count = begin_pos - pem;
   /* Invalid if not at beginning AND not directly following \n */
-  if(0 != pem_count && '\n' != pem[pem_count - 1])
+  if(pem_count && '\n' != pem[pem_count - 1])
     return CURLE_BAD_CONTENT_ENCODING;
 
   /* 26 is length of "-----BEGIN PUBLIC KEY-----" */
@@ -882,6 +890,14 @@ static int multissl_init(void)
   return 1;
 }
 
+static CURLcode multissl_random(struct Curl_easy *data,
+                                unsigned char *entropy, size_t length)
+{
+  if(multissl_setup(NULL))
+    return CURLE_FAILED_INIT;
+  return Curl_ssl->random(data, entropy, length);
+}
+
 static CURLcode multissl_connect(struct Curl_cfilter *cf,
                                  struct Curl_easy *data, bool *done)
 {
@@ -890,13 +906,13 @@ static CURLcode multissl_connect(struct Curl_cfilter *cf,
   return Curl_ssl->do_connect(cf, data, done);
 }
 
-static void multissl_adjust_pollset(struct Curl_cfilter *cf,
-                                    struct Curl_easy *data,
-                                    struct easy_pollset *ps)
+static CURLcode multissl_adjust_pollset(struct Curl_cfilter *cf,
+                                        struct Curl_easy *data,
+                                        struct easy_pollset *ps)
 {
   if(multissl_setup(NULL))
-    return;
-  Curl_ssl->adjust_pollset(cf, data, ps);
+    return CURLE_OK;
+  return Curl_ssl->adjust_pollset(cf, data, ps);
 }
 
 static void *multissl_get_internals(struct ssl_connect_data *connssl,
@@ -943,7 +959,7 @@ static const struct Curl_ssl Curl_ssl_multi = {
   multissl_version,                  /* version */
   NULL,                              /* shutdown */
   NULL,                              /* data_pending */
-  NULL,                              /* random */
+  multissl_random,                   /* random */
   NULL,                              /* cert_status_request */
   multissl_connect,                  /* connect */
   multissl_adjust_pollset,           /* adjust_pollset */
@@ -960,7 +976,7 @@ static const struct Curl_ssl Curl_ssl_multi = {
 };
 
 const struct Curl_ssl *Curl_ssl =
-#if defined(CURL_WITH_MULTI_SSL)
+#ifdef CURL_WITH_MULTI_SSL
   &Curl_ssl_multi;
 #elif defined(USE_WOLFSSL)
   &Curl_ssl_wolfssl;
@@ -979,22 +995,22 @@ const struct Curl_ssl *Curl_ssl =
 #endif
 
 static const struct Curl_ssl *available_backends[] = {
-#if defined(USE_WOLFSSL)
+#ifdef USE_WOLFSSL
   &Curl_ssl_wolfssl,
 #endif
-#if defined(USE_GNUTLS)
+#ifdef USE_GNUTLS
   &Curl_ssl_gnutls,
 #endif
-#if defined(USE_MBEDTLS)
+#ifdef USE_MBEDTLS
   &Curl_ssl_mbedtls,
 #endif
-#if defined(USE_OPENSSL)
+#ifdef USE_OPENSSL
   &Curl_ssl_openssl,
 #endif
-#if defined(USE_SCHANNEL)
+#ifdef USE_SCHANNEL
   &Curl_ssl_schannel,
 #endif
-#if defined(USE_RUSTLS)
+#ifdef USE_RUSTLS
   &Curl_ssl_rustls,
 #endif
   NULL
@@ -1007,7 +1023,7 @@ void Curl_ssl_cleanup(void)
     /* only cleanup if we did a previous init */
     if(Curl_ssl->cleanup)
       Curl_ssl->cleanup();
-#if defined(CURL_WITH_MULTI_SSL)
+#ifdef CURL_WITH_MULTI_SSL
     Curl_ssl = &Curl_ssl_multi;
 #endif
     init_ssl = FALSE;
@@ -1112,7 +1128,7 @@ CURLsslset Curl_init_sslset_nolock(curl_sslbackend id, const char *name,
     return id == Curl_ssl->info.id ||
            (name && curl_strequal(name, Curl_ssl->info.name)) ?
            CURLSSLSET_OK :
-#if defined(CURL_WITH_MULTI_SSL)
+#ifdef CURL_WITH_MULTI_SSL
            CURLSSLSET_TOO_LATE;
 #else
            CURLSSLSET_UNKNOWN_BACKEND;
@@ -1533,16 +1549,18 @@ static CURLcode ssl_cf_shutdown(struct Curl_cfilter *cf,
   return result;
 }
 
-static void ssl_cf_adjust_pollset(struct Curl_cfilter *cf,
-                                  struct Curl_easy *data,
-                                  struct easy_pollset *ps)
+static CURLcode ssl_cf_adjust_pollset(struct Curl_cfilter *cf,
+                                      struct Curl_easy *data,
+                                      struct easy_pollset *ps)
 {
   struct ssl_connect_data *connssl = cf->ctx;
   struct cf_call_data save;
+  CURLcode result;
 
   CF_DATA_SAVE(save, cf, data);
-  connssl->ssl_impl->adjust_pollset(cf, data, ps);
+  result = connssl->ssl_impl->adjust_pollset(cf, data, ps);
   CF_DATA_RESTORE(cf, save);
+  return result;
 }
 
 static CURLcode ssl_cf_query(struct Curl_cfilter *cf,
@@ -1559,15 +1577,24 @@ static CURLcode ssl_cf_query(struct Curl_cfilter *cf,
     return CURLE_OK;
   }
   case CF_QUERY_SSL_INFO:
-  case CF_QUERY_SSL_CTX_INFO: {
-    struct curl_tlssessioninfo *info = pres2;
-    struct cf_call_data save;
-    CF_DATA_SAVE(save, cf, data);
-    info->backend = Curl_ssl_backend();
-    info->internals = connssl->ssl_impl->get_internals(
-      cf->ctx, (query == CF_QUERY_SSL_INFO) ?
-      CURLINFO_TLS_SSL_PTR : CURLINFO_TLS_SESSION);
-    CF_DATA_RESTORE(cf, save);
+  case CF_QUERY_SSL_CTX_INFO:
+    if(!Curl_ssl_cf_is_proxy(cf)) {
+      struct curl_tlssessioninfo *info = pres2;
+      struct cf_call_data save;
+      CF_DATA_SAVE(save, cf, data);
+      info->backend = Curl_ssl_backend();
+      info->internals = connssl->ssl_impl->get_internals(
+        cf->ctx, (query == CF_QUERY_SSL_INFO) ?
+        CURLINFO_TLS_SSL_PTR : CURLINFO_TLS_SESSION);
+      CF_DATA_RESTORE(cf, save);
+      return CURLE_OK;
+    }
+    break;
+  case CF_QUERY_ALPN_NEGOTIATED: {
+    const char **palpn = pres2;
+    DEBUGASSERT(palpn);
+    *palpn = connssl->negotiated.alpn;
+    CURL_TRC_CF(data, cf, "query ALPN: returning '%s'", *palpn);
     return CURLE_OK;
   }
   default:
@@ -1578,6 +1605,30 @@ static CURLcode ssl_cf_query(struct Curl_cfilter *cf,
     CURLE_UNKNOWN_OPTION;
 }
 
+static CURLcode ssl_cf_cntrl(struct Curl_cfilter *cf,
+                             struct Curl_easy *data,
+                             int event, int arg1, void *arg2)
+{
+  struct ssl_connect_data *connssl = cf->ctx;
+
+  (void)arg1;
+  (void)arg2;
+  (void)data;
+  switch(event) {
+  case CF_CTRL_CONN_INFO_UPDATE:
+    if(connssl->negotiated.alpn && !cf->sockindex) {
+      if(!strcmp("http/1.1", connssl->negotiated.alpn))
+        cf->conn->httpversion_seen = 11;
+      else if(!strcmp("h2", connssl->negotiated.alpn))
+        cf->conn->httpversion_seen = 20;
+      else if(!strcmp("h3", connssl->negotiated.alpn))
+        cf->conn->httpversion_seen = 30;
+    }
+    break;
+  }
+  return CURLE_OK;
+}
+
 static bool cf_ssl_is_alive(struct Curl_cfilter *cf, struct Curl_easy *data,
                             bool *input_pending)
 {
@@ -1601,7 +1652,7 @@ struct Curl_cftype Curl_cft_ssl = {
   ssl_cf_data_pending,
   ssl_cf_send,
   ssl_cf_recv,
-  Curl_cf_def_cntrl,
+  ssl_cf_cntrl,
   cf_ssl_is_alive,
   Curl_cf_def_conn_keep_alive,
   ssl_cf_query,
@@ -1624,7 +1675,7 @@ struct Curl_cftype Curl_cft_ssl_proxy = {
   Curl_cf_def_cntrl,
   cf_ssl_is_alive,
   Curl_cf_def_conn_keep_alive,
-  Curl_cf_def_query,
+  ssl_cf_query,
 };
 
 #endif /* !CURL_DISABLE_PROXY */
@@ -1640,6 +1691,7 @@ static CURLcode cf_ssl_create(struct Curl_cfilter **pcf,
   DEBUGASSERT(data->conn);
 
 #ifdef CURL_DISABLE_HTTP
+  (void)conn;
   /* We only support ALPN for HTTP so far. */
   DEBUGASSERT(!conn->bits.tls_enable_alpn);
   ctx = cf_ctx_new(data, NULL);
@@ -1695,9 +1747,11 @@ static CURLcode cf_ssl_proxy_create(struct Curl_cfilter **pcf,
   struct Curl_cfilter *cf = NULL;
   struct ssl_connect_data *ctx;
   CURLcode result;
-  bool use_alpn = conn->bits.tls_enable_alpn;
+  /* ALPN is default, but if user explicitly disables it, obey */
+  bool use_alpn = data->set.ssl_enable_alpn;
   http_majors allowed = CURL_HTTP_V1x;
 
+  (void)conn;
 #ifdef USE_HTTP2
   if(conn->http_proxy.proxytype == CURLPROXY_HTTPS2) {
     use_alpn = TRUE;
@@ -1777,7 +1831,7 @@ static CURLcode vtls_shutdown_blocking(struct Curl_cfilter *cf,
         result = CURLE_RECV_ERROR;
         goto out;
       }
-      else if(0 == what) {
+      else if(what == 0) {
         /* timeout */
         failf(data, "SSL shutdown timeout");
         result = CURLE_OPERATION_TIMEDOUT;
@@ -1926,14 +1980,7 @@ CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
                                   size_t proto_len)
 {
   CURLcode result = CURLE_OK;
-  unsigned char *palpn =
-#ifndef CURL_DISABLE_PROXY
-    (cf->conn->bits.tunnel_proxy && Curl_ssl_cf_is_proxy(cf)) ?
-    &cf->conn->proxy_alpn : &cf->conn->alpn
-#else
-    &cf->conn->alpn
-#endif
-    ;
+  (void)cf;
 
   if(connssl->negotiated.alpn) {
     /* When we ask for a specific ALPN protocol, we need the confirmation
@@ -1975,38 +2022,12 @@ CURLcode Curl_alpn_set_negotiated(struct Curl_cfilter *cf,
   }
 
   if(proto && proto_len) {
-    if(proto_len == ALPN_HTTP_1_1_LENGTH &&
-       !memcmp(ALPN_HTTP_1_1, proto, ALPN_HTTP_1_1_LENGTH)) {
-      *palpn = CURL_HTTP_VERSION_1_1;
-    }
-#ifdef USE_HTTP2
-    else if(proto_len == ALPN_H2_LENGTH &&
-            !memcmp(ALPN_H2, proto, ALPN_H2_LENGTH)) {
-      *palpn = CURL_HTTP_VERSION_2;
-    }
-#endif
-#ifdef USE_HTTP3
-    else if(proto_len == ALPN_H3_LENGTH &&
-            !memcmp(ALPN_H3, proto, ALPN_H3_LENGTH)) {
-      *palpn = CURL_HTTP_VERSION_3;
-    }
-#endif
-    else {
-      *palpn = CURL_HTTP_VERSION_NONE;
-      failf(data, "unsupported ALPN protocol: '%.*s'", (int)proto_len, proto);
-      /* Previous code just ignored it and some vtls backends even ignore the
-       * return code of this function. */
-      /* return CURLE_NOT_BUILT_IN; */
-      goto out;
-    }
-
     if(connssl->state == ssl_connection_deferred)
       infof(data, VTLS_INFOF_ALPN_DEFERRED, (int)proto_len, proto);
     else
       infof(data, VTLS_INFOF_ALPN_ACCEPTED, (int)proto_len, proto);
   }
   else {
-    *palpn = CURL_HTTP_VERSION_NONE;
     if(connssl->state == ssl_connection_deferred)
       infof(data, VTLS_INFOF_NO_ALPN_DEFERRED);
     else
diff --git a/deps/curl/lib/vtls/vtls_int.h b/deps/curl/lib/vtls/vtls_int.h
index 11987c382a3..de0b735e22b 100644
--- a/deps/curl/lib/vtls/vtls_int.h
+++ b/deps/curl/lib/vtls/vtls_int.h
@@ -166,8 +166,8 @@ struct Curl_ssl {
 
   /* During handshake/shutdown, adjust the pollset to include the socket
    * for POLLOUT or POLLIN as needed. Mandatory. */
-  void (*adjust_pollset)(struct Curl_cfilter *cf, struct Curl_easy *data,
-                          struct easy_pollset *ps);
+  CURLcode (*adjust_pollset)(struct Curl_cfilter *cf, struct Curl_easy *data,
+                             struct easy_pollset *ps);
   void *(*get_internals)(struct ssl_connect_data *connssl, CURLINFO info);
   void (*close)(struct Curl_cfilter *cf, struct Curl_easy *data);
   void (*close_all)(struct Curl_easy *data);
@@ -190,8 +190,9 @@ struct Curl_ssl {
 
 extern const struct Curl_ssl *Curl_ssl;
 
-void Curl_ssl_adjust_pollset(struct Curl_cfilter *cf, struct Curl_easy *data,
-                             struct easy_pollset *ps);
+CURLcode Curl_ssl_adjust_pollset(struct Curl_cfilter *cf,
+                                 struct Curl_easy *data,
+                                 struct easy_pollset *ps);
 
 /**
  * Get the SSL filter below the given one or NULL if there is none.
diff --git a/deps/curl/lib/vtls/vtls_spack.c b/deps/curl/lib/vtls/vtls_spack.c
index 152fad7eb30..10d16f213d4 100644
--- a/deps/curl/lib/vtls/vtls_spack.c
+++ b/deps/curl/lib/vtls/vtls_spack.c
@@ -24,7 +24,7 @@
 
 #include "../curl_setup.h"
 
-#ifdef USE_SSLS_EXPORT
+#if defined(USE_SSL) && defined(USE_SSLS_EXPORT)
 
 #include "../urldata.h"
 #include "../curl_trc.h"
@@ -343,4 +343,4 @@ CURLcode Curl_ssl_session_unpack(struct Curl_easy *data,
   return r;
 }
 
-#endif /* USE_SSLS_EXPORT */
+#endif /* USE_SSL && USE_SSLS_EXPORT */
diff --git a/deps/curl/lib/vtls/vtls_spack.h b/deps/curl/lib/vtls/vtls_spack.h
index 4cdabae30e6..86796ee62ed 100644
--- a/deps/curl/lib/vtls/vtls_spack.h
+++ b/deps/curl/lib/vtls/vtls_spack.h
@@ -25,7 +25,7 @@
  ***************************************************************************/
 #include "../curl_setup.h"
 
-#ifdef USE_SSLS_EXPORT
+#if defined(USE_SSL) && defined(USE_SSLS_EXPORT)
 
 struct dynbuf;
 struct Curl_ssl_session;
@@ -38,6 +38,6 @@ CURLcode Curl_ssl_session_unpack(struct Curl_easy *data,
                                  const void *bufv, size_t buflen,
                                  struct Curl_ssl_session **ps);
 
-#endif /* USE_SSLS_EXPORT */
+#endif /* USE_SSL && USE_SSLS_EXPORT */
 
 #endif /* HEADER_CURL_VTLS_SPACK_H */
diff --git a/deps/curl/lib/vtls/wolfssl.c b/deps/curl/lib/vtls/wolfssl.c
index c3560e8b8d1..afbb9b82182 100644
--- a/deps/curl/lib/vtls/wolfssl.c
+++ b/deps/curl/lib/vtls/wolfssl.c
@@ -178,7 +178,7 @@ wssl_tls13_secret_callback(SSL *ssl, int id, const unsigned char *secret,
   Curl_tls_keylog_write(label, client_random, secret, secretSz);
   return 0;
 }
-#endif /* defined(HAVE_SECRET_CALLBACK) && defined(WOLFSSL_TLS13) */
+#endif /* HAVE_SECRET_CALLBACK && WOLFSSL_TLS13 */
 
 static void wssl_log_tls12_secret(WOLFSSL *ssl)
 {
@@ -243,12 +243,12 @@ static const struct group_name_map gnm[] = {
   { WOLFSSL_ML_KEM_512, "ML_KEM_512" },
   { WOLFSSL_ML_KEM_768, "ML_KEM_768" },
   { WOLFSSL_ML_KEM_1024, "ML_KEM_1024" },
-  { WOLFSSL_P256_ML_KEM_512, "P256_ML_KEM_512" },
-  { WOLFSSL_P384_ML_KEM_768, "P384_ML_KEM_768" },
-  { WOLFSSL_P521_ML_KEM_1024, "P521_ML_KEM_1024" },
-  { WOLFSSL_P256_ML_KEM_768, "P256_ML_KEM_768" },
-  { WOLFSSL_P384_ML_KEM_1024, "P384_ML_KEM_1024" },
-  { WOLFSSL_X25519_ML_KEM_768, "X25519_ML_KEM_768" },
+  { WOLFSSL_SECP256R1MLKEM512, "SecP256r1MLKEM512" },
+  { WOLFSSL_SECP384R1MLKEM768, "SecP384r1MLKEM768" },
+  { WOLFSSL_SECP521R1MLKEM1024, "SecP521r1MLKEM1024" },
+  { WOLFSSL_SECP256R1MLKEM768, "SecP256r1MLKEM768" },
+  { WOLFSSL_SECP384R1MLKEM1024, "SecP384r1MLKEM1024" },
+  { WOLFSSL_X25519MLKEM768, "X25519MLKEM768" },
   { 0, NULL }
 };
 #endif
@@ -931,13 +931,170 @@ wssl_legacy_CTX_set_min_proto_version(WOLFSSL_CTX* ctx, int version)
 static int
 wssl_legacy_CTX_set_max_proto_version(WOLFSSL_CTX* ctx, int version)
 {
-  (void) ctx, (void) version;
+  (void)ctx, (void)version;
   return WOLFSSL_NOT_IMPLEMENTED;
 }
 #define wolfSSL_CTX_set_min_proto_version wssl_legacy_CTX_set_min_proto_version
 #define wolfSSL_CTX_set_max_proto_version wssl_legacy_CTX_set_max_proto_version
 #endif
 
+static CURLcode client_certificate(struct Curl_easy *data,
+                                   struct ssl_config_data *ssl_config,
+                                   struct wssl_ctx *wctx)
+{
+  /* Load the client certificate, and private key */
+#ifndef NO_FILESYSTEM
+  if(ssl_config->primary.cert_blob || ssl_config->primary.clientcert) {
+    const char *cert_file = ssl_config->primary.clientcert;
+    const char *key_file = ssl_config->key;
+    const struct curl_blob *cert_blob = ssl_config->primary.cert_blob;
+    const struct curl_blob *key_blob = ssl_config->key_blob;
+    int file_type = wssl_do_file_type(ssl_config->cert_type);
+    int rc;
+
+    switch(file_type) {
+    case WOLFSSL_FILETYPE_PEM:
+      rc = cert_blob ?
+        wolfSSL_CTX_use_certificate_chain_buffer(wctx->ssl_ctx,
+                                                 cert_blob->data,
+                                                 (long)cert_blob->len) :
+        wolfSSL_CTX_use_certificate_chain_file(wctx->ssl_ctx, cert_file);
+      break;
+    case WOLFSSL_FILETYPE_ASN1:
+      rc = cert_blob ?
+        wolfSSL_CTX_use_certificate_buffer(wctx->ssl_ctx, cert_blob->data,
+                                           (long)cert_blob->len, file_type) :
+        wolfSSL_CTX_use_certificate_file(wctx->ssl_ctx, cert_file, file_type);
+      break;
+    default:
+      failf(data, "unknown cert type");
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+    if(rc != 1) {
+      failf(data, "unable to use client certificate");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+
+    if(!key_blob && !key_file) {
+      key_blob = cert_blob;
+      key_file = cert_file;
+    }
+    else
+      file_type = wssl_do_file_type(ssl_config->key_type);
+
+    rc = key_blob ?
+      wolfSSL_CTX_use_PrivateKey_buffer(wctx->ssl_ctx, key_blob->data,
+                                        (long)key_blob->len, file_type) :
+      wolfSSL_CTX_use_PrivateKey_file(wctx->ssl_ctx, key_file, file_type);
+    if(rc != 1) {
+      failf(data, "unable to set private key");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+#else /* NO_FILESYSTEM */
+  if(ssl_config->primary.cert_blob) {
+    const struct curl_blob *cert_blob = ssl_config->primary.cert_blob;
+    const struct curl_blob *key_blob = ssl_config->key_blob;
+    int file_type = wssl_do_file_type(ssl_config->cert_type);
+    int rc;
+
+    switch(file_type) {
+    case WOLFSSL_FILETYPE_PEM:
+      rc = wolfSSL_CTX_use_certificate_chain_buffer(wctx->ssl_ctx,
+                                                    cert_blob->data,
+                                                    (long)cert_blob->len);
+      break;
+    case WOLFSSL_FILETYPE_ASN1:
+      rc = wolfSSL_CTX_use_certificate_buffer(wctx->ssl_ctx, cert_blob->data,
+                                              (long)cert_blob->len, file_type);
+      break;
+    default:
+      failf(data, "unknown cert type");
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+    if(rc != 1) {
+      failf(data, "unable to use client certificate");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+
+    if(!key_blob)
+      key_blob = cert_blob;
+    else
+      file_type = wssl_do_file_type(ssl_config->key_type);
+
+    if(wolfSSL_CTX_use_PrivateKey_buffer(wctx->ssl_ctx, key_blob->data,
+                                         (long)key_blob->len,
+                                         file_type) != 1) {
+      failf(data, "unable to set private key");
+      return CURLE_SSL_CONNECT_ERROR;
+    }
+  }
+#endif /* !NO_FILESYSTEM */
+  return CURLE_OK;
+}
+
+static CURLcode ssl_version(struct Curl_easy *data,
+                            struct ssl_primary_config *conn_config,
+                            struct wssl_ctx *wctx)
+{
+  int res;
+  switch(conn_config->version) {
+  case CURL_SSLVERSION_DEFAULT:
+  case CURL_SSLVERSION_TLSv1:
+  case CURL_SSLVERSION_TLSv1_0:
+    res = wolfSSL_CTX_set_min_proto_version(wctx->ssl_ctx, TLS1_VERSION);
+    break;
+  case CURL_SSLVERSION_TLSv1_1:
+    res = wolfSSL_CTX_set_min_proto_version(wctx->ssl_ctx, TLS1_1_VERSION);
+    break;
+  case CURL_SSLVERSION_TLSv1_2:
+    res = wolfSSL_CTX_set_min_proto_version(wctx->ssl_ctx, TLS1_2_VERSION);
+    break;
+#ifdef WOLFSSL_TLS13
+  case CURL_SSLVERSION_TLSv1_3:
+    res = wolfSSL_CTX_set_min_proto_version(wctx->ssl_ctx, TLS1_3_VERSION);
+    break;
+#endif
+  default:
+    failf(data, "wolfSSL: unsupported minimum TLS version value");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+  if(res != WOLFSSL_SUCCESS) {
+    failf(data, "wolfSSL: failed set the minimum TLS version");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+
+  switch(conn_config->version_max) {
+#ifdef WOLFSSL_TLS13
+  case CURL_SSLVERSION_MAX_TLSv1_3:
+    res = wolfSSL_CTX_set_max_proto_version(wctx->ssl_ctx, TLS1_3_VERSION);
+    break;
+#endif
+  case CURL_SSLVERSION_MAX_TLSv1_2:
+    res = wolfSSL_CTX_set_max_proto_version(wctx->ssl_ctx, TLS1_2_VERSION);
+    break;
+  case CURL_SSLVERSION_MAX_TLSv1_1:
+    res = wolfSSL_CTX_set_max_proto_version(wctx->ssl_ctx, TLS1_1_VERSION);
+    break;
+  case CURL_SSLVERSION_MAX_TLSv1_0:
+    res = wolfSSL_CTX_set_max_proto_version(wctx->ssl_ctx, TLS1_VERSION);
+    break;
+  case CURL_SSLVERSION_MAX_DEFAULT:
+  case CURL_SSLVERSION_MAX_NONE:
+    res = WOLFSSL_SUCCESS;
+    break;
+  default:
+    failf(data, "wolfSSL: unsupported maximum TLS version value");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+  if(res != WOLFSSL_SUCCESS) {
+    failf(data, "wolfSSL: failed set the maximum TLS version");
+    return CURLE_SSL_CONNECT_ERROR;
+  }
+  return CURLE_OK;
+}
+
+
 #define QUIC_CIPHERS                                                          \
   "TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:TLS_CHACHA20_"               \
   "POLY1305_SHA256:TLS_AES_128_CCM_SHA256"
@@ -957,7 +1114,6 @@ CURLcode Curl_wssl_ctx_init(struct wssl_ctx *wctx,
   struct ssl_primary_config *conn_config;
   WOLFSSL_METHOD* req_method = NULL;
   struct alpn_spec alpns;
-  int res;
   char *curves;
 #ifdef WOLFSSL_HAVE_KYBER
   word16 pqkem = 0;
@@ -998,63 +1154,9 @@ CURLcode Curl_wssl_ctx_init(struct wssl_ctx *wctx,
     goto out;
   }
 
-  switch(conn_config->version) {
-  case CURL_SSLVERSION_DEFAULT:
-  case CURL_SSLVERSION_TLSv1:
-  case CURL_SSLVERSION_TLSv1_0:
-    res = wolfSSL_CTX_set_min_proto_version(wctx->ssl_ctx, TLS1_VERSION);
-    break;
-  case CURL_SSLVERSION_TLSv1_1:
-    res = wolfSSL_CTX_set_min_proto_version(wctx->ssl_ctx, TLS1_1_VERSION);
-    break;
-  case CURL_SSLVERSION_TLSv1_2:
-    res = wolfSSL_CTX_set_min_proto_version(wctx->ssl_ctx, TLS1_2_VERSION);
-    break;
-#ifdef WOLFSSL_TLS13
-  case CURL_SSLVERSION_TLSv1_3:
-    res = wolfSSL_CTX_set_min_proto_version(wctx->ssl_ctx, TLS1_3_VERSION);
-    break;
-#endif
-  default:
-    failf(data, "wolfSSL: unsupported minimum TLS version value");
-    result = CURLE_SSL_CONNECT_ERROR;
-    goto out;
-  }
-  if(res != WOLFSSL_SUCCESS) {
-    failf(data, "wolfSSL: failed set the minimum TLS version");
-    result = CURLE_SSL_CONNECT_ERROR;
-    goto out;
-  }
-
-  switch(conn_config->version_max) {
-#ifdef WOLFSSL_TLS13
-  case CURL_SSLVERSION_MAX_TLSv1_3:
-    res = wolfSSL_CTX_set_max_proto_version(wctx->ssl_ctx, TLS1_3_VERSION);
-    break;
-#endif
-  case CURL_SSLVERSION_MAX_TLSv1_2:
-    res = wolfSSL_CTX_set_max_proto_version(wctx->ssl_ctx, TLS1_2_VERSION);
-    break;
-  case CURL_SSLVERSION_MAX_TLSv1_1:
-    res = wolfSSL_CTX_set_max_proto_version(wctx->ssl_ctx, TLS1_1_VERSION);
-    break;
-  case CURL_SSLVERSION_MAX_TLSv1_0:
-    res = wolfSSL_CTX_set_max_proto_version(wctx->ssl_ctx, TLS1_VERSION);
-    break;
-  case CURL_SSLVERSION_MAX_DEFAULT:
-  case CURL_SSLVERSION_MAX_NONE:
-    res = WOLFSSL_SUCCESS;
-    break;
-  default:
-    failf(data, "wolfSSL: unsupported maximum TLS version value");
-    result = CURLE_SSL_CONNECT_ERROR;
-    goto out;
-  }
-  if(res != WOLFSSL_SUCCESS) {
-    failf(data, "wolfSSL: failed set the maximum TLS version");
-    result = CURLE_SSL_CONNECT_ERROR;
+  result = ssl_version(data, conn_config, wctx);
+  if(result)
     goto out;
-  }
 
 #ifndef WOLFSSL_TLS13
   {
@@ -1129,100 +1231,9 @@ CURLcode Curl_wssl_ctx_init(struct wssl_ctx *wctx,
     }
   }
 
-  /* Load the client certificate, and private key */
-#ifndef NO_FILESYSTEM
-  if(ssl_config->primary.cert_blob || ssl_config->primary.clientcert) {
-    const char *cert_file = ssl_config->primary.clientcert;
-    const char *key_file = ssl_config->key;
-    const struct curl_blob *cert_blob = ssl_config->primary.cert_blob;
-    const struct curl_blob *key_blob = ssl_config->key_blob;
-    int file_type = wssl_do_file_type(ssl_config->cert_type);
-    int rc;
-
-    switch(file_type) {
-    case WOLFSSL_FILETYPE_PEM:
-      rc = cert_blob ?
-        wolfSSL_CTX_use_certificate_chain_buffer(wctx->ssl_ctx,
-                                                 cert_blob->data,
-                                                 (long)cert_blob->len) :
-        wolfSSL_CTX_use_certificate_chain_file(wctx->ssl_ctx, cert_file);
-      break;
-    case WOLFSSL_FILETYPE_ASN1:
-      rc = cert_blob ?
-        wolfSSL_CTX_use_certificate_buffer(wctx->ssl_ctx, cert_blob->data,
-                                           (long)cert_blob->len, file_type) :
-        wolfSSL_CTX_use_certificate_file(wctx->ssl_ctx, cert_file, file_type);
-      break;
-    default:
-      failf(data, "unknown cert type");
-      result = CURLE_BAD_FUNCTION_ARGUMENT;
-      goto out;
-    }
-    if(rc != 1) {
-      failf(data, "unable to use client certificate");
-      result = CURLE_SSL_CONNECT_ERROR;
-      goto out;
-    }
-
-    if(!key_blob && !key_file) {
-      key_blob = cert_blob;
-      key_file = cert_file;
-    }
-    else
-      file_type = wssl_do_file_type(ssl_config->key_type);
-
-    rc = key_blob ?
-      wolfSSL_CTX_use_PrivateKey_buffer(wctx->ssl_ctx, key_blob->data,
-                                        (long)key_blob->len, file_type) :
-      wolfSSL_CTX_use_PrivateKey_file(wctx->ssl_ctx, key_file, file_type);
-    if(rc != 1) {
-      failf(data, "unable to set private key");
-      result = CURLE_SSL_CONNECT_ERROR;
-      goto out;
-    }
-  }
-#else /* NO_FILESYSTEM */
-  if(ssl_config->primary.cert_blob) {
-    const struct curl_blob *cert_blob = ssl_config->primary.cert_blob;
-    const struct curl_blob *key_blob = ssl_config->key_blob;
-    int file_type = wssl_do_file_type(ssl_config->cert_type);
-    int rc;
-
-    switch(file_type) {
-    case WOLFSSL_FILETYPE_PEM:
-      rc = wolfSSL_CTX_use_certificate_chain_buffer(wctx->ssl_ctx,
-                                                    cert_blob->data,
-                                                    (long)cert_blob->len);
-      break;
-    case WOLFSSL_FILETYPE_ASN1:
-      rc = wolfSSL_CTX_use_certificate_buffer(wctx->ssl_ctx, cert_blob->data,
-                                              (long)cert_blob->len, file_type);
-      break;
-    default:
-      failf(data, "unknown cert type");
-      result = CURLE_BAD_FUNCTION_ARGUMENT;
-      goto out;
-    }
-    if(rc != 1) {
-      failf(data, "unable to use client certificate");
-      result = CURLE_SSL_CONNECT_ERROR;
-      goto out;
-    }
-
-    if(!key_blob)
-      key_blob = cert_blob;
-    else
-      file_type = wssl_do_file_type(ssl_config->key_type);
-
-    if(wolfSSL_CTX_use_PrivateKey_buffer(wctx->ssl_ctx, key_blob->data,
-                                         (long)key_blob->len,
-                                         file_type) != 1) {
-      failf(data, "unable to set private key");
-      result = CURLE_SSL_CONNECT_ERROR;
-      goto out;
-    }
-  }
-#endif /* !NO_FILESYSTEM */
+  result = client_certificate(data, ssl_config, wctx);
+  if(result)
+    goto out;
 
   /* SSL always tries to verify the peer, this only says whether it should
    * fail to connect if the verification fails, or if it should continue
@@ -1275,7 +1286,7 @@ CURLcode Curl_wssl_ctx_init(struct wssl_ctx *wctx,
 #ifdef NO_FILESYSTEM
   else if(conn_config->verifypeer) {
     failf(data, "SSL: Certificates cannot be loaded because wolfSSL was built"
-          " with \"no filesystem\". Either disable peer verification"
+          " with \"no file system\". Either disable peer verification"
           " (insecure) or if you are building an application with libcurl you"
           " can load certificates via CURLOPT_SSL_CTX_FUNCTION.");
     result = CURLE_SSL_CONNECT_ERROR;
@@ -1542,6 +1553,7 @@ CURLcode Curl_wssl_verify_pinned(struct Curl_cfilter *cf,
     data->set.str[STRING_SSL_PINNEDPUBLICKEY];
 #else
   const char * const pinnedpubkey = data->set.str[STRING_SSL_PINNEDPUBLICKEY];
+  (void)cf;
 #endif
 
   if(pinnedpubkey) {
@@ -1758,7 +1770,7 @@ static CURLcode wssl_handshake(struct Curl_cfilter *cf,
       }
     }
 #ifdef USE_ECH_WOLFSSL
-    else if(-1 == detail) {
+    else if(detail == -1) {
       /* try access a retry_config ECHConfigList for tracing */
       byte echConfigs[1000];
       word32 echConfigsLen = 1000;
@@ -1966,7 +1978,7 @@ static void wssl_close(struct Curl_cfilter *cf, struct Curl_easy *data)
   struct ssl_connect_data *connssl = cf->ctx;
   struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
 
-  (void) data;
+  (void)data;
 
   DEBUGASSERT(wssl);
 
@@ -2239,12 +2251,12 @@ static CURLcode wssl_sha256sum(const unsigned char *tmp, /* input */
 }
 
 static void *wssl_get_internals(struct ssl_connect_data *connssl,
-                                CURLINFO info UNUSED_PARAM)
+                                CURLINFO info)
 {
   struct wssl_ctx *wssl = (struct wssl_ctx *)connssl->backend;
-  (void)info;
   DEBUGASSERT(wssl);
-  return wssl->ssl;
+  return info == CURLINFO_TLS_SESSION ?
+    (void *)wssl->ssl_ctx : (void *)wssl->ssl;
 }
 
 const struct Curl_ssl Curl_ssl_wolfssl = {
diff --git a/deps/curl/lib/vtls/wolfssl.h b/deps/curl/lib/vtls/wolfssl.h
index 19ca609c849..7ff4cfb8817 100644
--- a/deps/curl/lib/vtls/wolfssl.h
+++ b/deps/curl/lib/vtls/wolfssl.h
@@ -44,7 +44,7 @@ struct wssl_ctx {
   struct WOLFSSL     *ssl;
   CURLcode    io_result;   /* result of last BIO cfilter operation */
   CURLcode    hs_result;   /* result of handshake */
-  int io_send_blocked_len; /* length of last BIO write that EAGAINed */
+  int io_send_blocked_len; /* length of last BIO write that EAGAIN-ed */
   BIT(x509_store_setup);   /* x509 store has been set up */
   BIT(shutting_down);      /* TLS is being shut down */
 };
diff --git a/deps/curl/lib/ws.c b/deps/curl/lib/ws.c
index 7f8a688ca17..3b654281604 100644
--- a/deps/curl/lib/ws.c
+++ b/deps/curl/lib/ws.c
@@ -108,6 +108,15 @@ struct ws_encoder {
   BIT(contfragment); /* set TRUE if the previous fragment sent was not final */
 };
 
+/* Control frames are allowed up to 125 characters, rfc6455, ch. 5.5 */
+#define WS_MAX_CNTRL_LEN    125
+
+struct ws_cntrl_frame {
+  unsigned int type;
+  size_t payload_len;
+  unsigned char payload[WS_MAX_CNTRL_LEN];
+};
+
 /* A websocket connection with en- and decoder that treat frames
  * and keep track of boundaries. */
 struct websocket {
@@ -116,7 +125,8 @@ struct websocket {
   struct ws_encoder enc;  /* decode of we frames */
   struct bufq recvbuf;    /* raw data from the server */
   struct bufq sendbuf;    /* raw data to be sent to the server */
-  struct curl_ws_frame frame;  /* the current WS FRAME received */
+  struct curl_ws_frame recvframe;  /* the current WS FRAME received */
+  struct ws_cntrl_frame pending; /* a control frame pending to be sent */
   size_t sendbuf_payload; /* number of payload bytes in sendbuf */
 };
 
@@ -220,62 +230,66 @@ static int ws_frame_firstbyte2flags(struct Curl_easy *data,
   }
 }
 
-static unsigned char ws_frame_flags2firstbyte(struct Curl_easy *data,
-                                              unsigned int flags,
-                                              bool contfragment,
-                                              CURLcode *err)
+static CURLcode ws_frame_flags2firstbyte(struct Curl_easy *data,
+                                         unsigned int flags,
+                                         bool contfragment,
+                                         unsigned char *pfirstbyte)
 {
+  *pfirstbyte = 0;
   switch(flags & ~CURLWS_OFFSET) {
     case 0:
       if(contfragment) {
-        infof(data, "[WS] no flags given; interpreting as continuation "
+        CURL_TRC_WS(data, "no flags given; interpreting as continuation "
                     "fragment for compatibility");
-        return (WSBIT_OPCODE_CONT | WSBIT_FIN);
+        *pfirstbyte = (WSBIT_OPCODE_CONT | WSBIT_FIN);
+        return CURLE_OK;
       }
       failf(data, "[WS] no flags given");
-      *err = CURLE_BAD_FUNCTION_ARGUMENT;
-      return 0xff;
+      return CURLE_BAD_FUNCTION_ARGUMENT;
     case CURLWS_CONT:
       if(contfragment) {
         infof(data, "[WS] setting CURLWS_CONT flag without message type is "
                     "supported for compatibility but highly discouraged");
-        return WSBIT_OPCODE_CONT;
+        *pfirstbyte = WSBIT_OPCODE_CONT;
+        return CURLE_OK;
       }
       failf(data, "[WS] No ongoing fragmented message to continue");
-      *err = CURLE_BAD_FUNCTION_ARGUMENT;
-      return 0xff;
+      return CURLE_BAD_FUNCTION_ARGUMENT;
     case CURLWS_TEXT:
-      return contfragment ? (WSBIT_OPCODE_CONT | WSBIT_FIN)
-                          : (WSBIT_OPCODE_TEXT | WSBIT_FIN);
+      *pfirstbyte = contfragment ? (WSBIT_OPCODE_CONT | WSBIT_FIN)
+                                 : (WSBIT_OPCODE_TEXT | WSBIT_FIN);
+      return CURLE_OK;
     case (CURLWS_TEXT | CURLWS_CONT):
-      return contfragment ? WSBIT_OPCODE_CONT : WSBIT_OPCODE_TEXT;
+      *pfirstbyte = contfragment ? WSBIT_OPCODE_CONT : WSBIT_OPCODE_TEXT;
+      return CURLE_OK;
     case CURLWS_BINARY:
-      return contfragment ? (WSBIT_OPCODE_CONT | WSBIT_FIN)
-                          : (WSBIT_OPCODE_BIN | WSBIT_FIN);
+      *pfirstbyte = contfragment ? (WSBIT_OPCODE_CONT | WSBIT_FIN)
+                                 : (WSBIT_OPCODE_BIN | WSBIT_FIN);
+      return CURLE_OK;
     case (CURLWS_BINARY | CURLWS_CONT):
-      return contfragment ? WSBIT_OPCODE_CONT : WSBIT_OPCODE_BIN;
+      *pfirstbyte = contfragment ? WSBIT_OPCODE_CONT : WSBIT_OPCODE_BIN;
+      return CURLE_OK;
     case CURLWS_CLOSE:
-      return WSBIT_OPCODE_CLOSE | WSBIT_FIN;
+      *pfirstbyte = WSBIT_OPCODE_CLOSE | WSBIT_FIN;
+      return CURLE_OK;
     case (CURLWS_CLOSE | CURLWS_CONT):
       failf(data, "[WS] CLOSE frame must not be fragmented");
-      *err = CURLE_BAD_FUNCTION_ARGUMENT;
-      return 0xff;
+      return CURLE_BAD_FUNCTION_ARGUMENT;
     case CURLWS_PING:
-      return WSBIT_OPCODE_PING | WSBIT_FIN;
+      *pfirstbyte = WSBIT_OPCODE_PING | WSBIT_FIN;
+      return CURLE_OK;
     case (CURLWS_PING | CURLWS_CONT):
       failf(data, "[WS] PING frame must not be fragmented");
-      *err = CURLE_BAD_FUNCTION_ARGUMENT;
-      return 0xff;
+      return CURLE_BAD_FUNCTION_ARGUMENT;
     case CURLWS_PONG:
-      return WSBIT_OPCODE_PONG | WSBIT_FIN;
+      *pfirstbyte = WSBIT_OPCODE_PONG | WSBIT_FIN;
+      return CURLE_OK;
     case (CURLWS_PONG | CURLWS_CONT):
       failf(data, "[WS] PONG frame must not be fragmented");
-      *err = CURLE_BAD_FUNCTION_ARGUMENT;
-      return 0xff;
+      return CURLE_BAD_FUNCTION_ARGUMENT;
     default:
       failf(data, "[WS] unknown flags: %x", flags);
-      *err = CURLE_BAD_FUNCTION_ARGUMENT;
-      return 0xff;
+      return CURLE_BAD_FUNCTION_ARGUMENT;
   }
 }
 
@@ -308,15 +322,16 @@ static void ws_dec_info(struct ws_decoder *dec, struct Curl_easy *data,
   }
 }
 
-static CURLcode ws_send_raw_blocking(CURL *data, struct websocket *ws,
+static CURLcode ws_send_raw_blocking(struct Curl_easy *data,
+                                     struct websocket *ws,
                                      const char *buffer, size_t buflen);
 
-typedef ssize_t ws_write_payload(const unsigned char *buf, size_t buflen,
-                                 int frame_age, int frame_flags,
-                                 curl_off_t payload_offset,
-                                 curl_off_t payload_len,
-                                 void *userp,
-                                 CURLcode *err);
+typedef CURLcode ws_write_payload(const unsigned char *buf, size_t buflen,
+                                  int frame_age, int frame_flags,
+                                  curl_off_t payload_offset,
+                                  curl_off_t payload_len,
+                                  void *userp,
+                                  size_t *pnwritten);
 
 static void ws_dec_next_frame(struct ws_decoder *dec)
 {
@@ -385,21 +400,20 @@ static CURLcode ws_dec_read_head(struct ws_decoder *dec,
         ws_dec_reset(dec);
         return CURLE_RECV_ERROR;
       }
-      if(dec->frame_flags & CURLWS_PING && dec->head[1] > 125) {
+      if(dec->frame_flags & CURLWS_PING && dec->head[1] > WS_MAX_CNTRL_LEN) {
         /* The maximum valid size of PING frames is 125 bytes.
            Accepting overlong pings would mean sending equivalent pongs! */
         failf(data, "[WS] received PING frame is too big");
         ws_dec_reset(dec);
         return CURLE_RECV_ERROR;
       }
-      if(dec->frame_flags & CURLWS_PONG && dec->head[1] > 125) {
+      if(dec->frame_flags & CURLWS_PONG && dec->head[1] > WS_MAX_CNTRL_LEN) {
         /* The maximum valid size of PONG frames is 125 bytes. */
         failf(data, "[WS] received PONG frame is too big");
         ws_dec_reset(dec);
         return CURLE_RECV_ERROR;
       }
-      if(dec->frame_flags & CURLWS_CLOSE && dec->head[1] > 125) {
-        /* The maximum valid size of CLOSE frames is 125 bytes. */
+      if(dec->frame_flags & CURLWS_CLOSE && dec->head[1] > WS_MAX_CNTRL_LEN) {
         failf(data, "[WS] received CLOSE frame is too big");
         ws_dec_reset(dec);
         return CURLE_RECV_ERROR;
@@ -469,12 +483,12 @@ static CURLcode ws_dec_read_head(struct ws_decoder *dec,
 static CURLcode ws_dec_pass_payload(struct ws_decoder *dec,
                                     struct Curl_easy *data,
                                     struct bufq *inraw,
-                                    ws_write_payload *write_payload,
+                                    ws_write_payload *write_cb,
                                     void *write_ctx)
 {
   const unsigned char *inbuf;
   size_t inlen;
-  ssize_t nwritten;
+  size_t nwritten;
   CURLcode result;
   curl_off_t remain = dec->payload_len - dec->payload_offset;
 
@@ -482,15 +496,15 @@ static CURLcode ws_dec_pass_payload(struct ws_decoder *dec,
   while(remain && Curl_bufq_peek(inraw, &inbuf, &inlen)) {
     if((curl_off_t)inlen > remain)
       inlen = (size_t)remain;
-    nwritten = write_payload(inbuf, inlen, dec->frame_age, dec->frame_flags,
-                             dec->payload_offset, dec->payload_len,
-                             write_ctx, &result);
-    if(nwritten < 0)
+    result = write_cb(inbuf, inlen, dec->frame_age, dec->frame_flags,
+                      dec->payload_offset, dec->payload_len,
+                      write_ctx, &nwritten);
+    if(result)
       return result;
-    Curl_bufq_skip(inraw, (size_t)nwritten);
-    dec->payload_offset += (curl_off_t)nwritten;
+    Curl_bufq_skip(inraw, nwritten);
+    dec->payload_offset += nwritten;
     remain = dec->payload_len - dec->payload_offset;
-    CURL_TRC_WS(data, "passed %zd bytes payload, %"
+    CURL_TRC_WS(data, "passed %zu bytes payload, %"
                 FMT_OFF_T " remain", nwritten, remain);
   }
 
@@ -500,7 +514,7 @@ static CURLcode ws_dec_pass_payload(struct ws_decoder *dec,
 static CURLcode ws_dec_pass(struct ws_decoder *dec,
                             struct Curl_easy *data,
                             struct bufq *inraw,
-                            ws_write_payload *write_payload,
+                            ws_write_payload *write_cb,
                             void *write_ctx)
 {
   CURLcode result;
@@ -517,7 +531,7 @@ static CURLcode ws_dec_pass(struct ws_decoder *dec,
     result = ws_dec_read_head(dec, data, inraw);
     if(result) {
       if(result != CURLE_AGAIN) {
-        infof(data, "[WS] decode error %d", (int)result);
+        failf(data, "[WS] decode frame error %d", (int)result);
         break;  /* real error */
       }
       /* incomplete ws frame head */
@@ -527,19 +541,19 @@ static CURLcode ws_dec_pass(struct ws_decoder *dec,
     /* head parsing done */
     dec->state = WS_DEC_PAYLOAD;
     if(dec->payload_len == 0) {
-      ssize_t nwritten;
+      size_t nwritten;
       const unsigned char tmp = '\0';
       /* special case of a 0 length frame, need to write once */
-      nwritten = write_payload(&tmp, 0, dec->frame_age, dec->frame_flags,
-                               0, 0, write_ctx, &result);
-      if(nwritten < 0)
+      result = write_cb(&tmp, 0, dec->frame_age, dec->frame_flags,
+                          0, 0, write_ctx, &nwritten);
+      if(result)
         return result;
       dec->state = WS_DEC_INIT;
       break;
     }
     FALLTHROUGH();
   case WS_DEC_PAYLOAD:
-    result = ws_dec_pass_payload(dec, data, inraw, write_payload, write_ctx);
+    result = ws_dec_pass_payload(dec, data, inraw, write_cb, write_ctx);
     ws_dec_info(dec, data, "passing");
     if(result)
       return result;
@@ -561,11 +575,11 @@ static void update_meta(struct websocket *ws,
 {
   curl_off_t bytesleft = (payload_len - payload_offset - cur_len);
 
-  ws->frame.age = frame_age;
-  ws->frame.flags = frame_flags;
-  ws->frame.offset = payload_offset;
-  ws->frame.len = cur_len;
-  ws->frame.bytesleft = bytesleft;
+  ws->recvframe.age = frame_age;
+  ws->recvframe.flags = frame_flags;
+  ws->recvframe.offset = payload_offset;
+  ws->recvframe.len = cur_len;
+  ws->recvframe.bytesleft = bytesleft;
 }
 
 /* WebSockets decoding client writer */
@@ -586,7 +600,7 @@ static CURLcode ws_cw_init(struct Curl_easy *data,
 static void ws_cw_close(struct Curl_easy *data, struct Curl_cwriter *writer)
 {
   struct ws_cw_ctx *ctx = writer->ctx;
-  (void) data;
+  (void)data;
   Curl_bufq_free(&ctx->buf);
 }
 
@@ -597,42 +611,82 @@ struct ws_cw_dec_ctx {
   int cw_type;
 };
 
-static ssize_t ws_cw_dec_next(const unsigned char *buf, size_t buflen,
-                              int frame_age, int frame_flags,
-                              curl_off_t payload_offset,
-                              curl_off_t payload_len,
-                              void *user_data,
-                              CURLcode *err)
+static CURLcode ws_flush(struct Curl_easy *data, struct websocket *ws,
+                         bool blocking);
+static CURLcode ws_enc_send(struct Curl_easy *data,
+                            struct websocket *ws,
+                            const unsigned char *buffer,
+                            size_t buflen,
+                            curl_off_t fragsize,
+                            unsigned int flags,
+                            size_t *sent);
+static CURLcode ws_enc_add_pending(struct Curl_easy *data,
+                                   struct websocket *ws);
+
+static CURLcode ws_enc_add_cntrl(struct Curl_easy *data,
+                                 struct websocket *ws,
+                                 const unsigned char *payload,
+                                 size_t plen,
+                                 unsigned int frame_type)
+{
+  DEBUGASSERT(plen <= WS_MAX_CNTRL_LEN);
+  if(plen > WS_MAX_CNTRL_LEN)
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+
+  /* Overwrite any pending frame with the new one, we keep
+   * only one. */
+  ws->pending.type = frame_type;
+  ws->pending.payload_len = plen;
+  memcpy(ws->pending.payload, payload, plen);
+
+  if(!ws->enc.payload_remain) { /* not in the middle of another frame */
+    CURLcode result = ws_enc_add_pending(data, ws);
+    if(!result)
+      (void)ws_flush(data, ws, Curl_is_in_callback(data));
+    return result;
+  }
+  return CURLE_OK;
+}
+
+static CURLcode ws_cw_dec_next(const unsigned char *buf, size_t buflen,
+                               int frame_age, int frame_flags,
+                               curl_off_t payload_offset,
+                               curl_off_t payload_len,
+                               void *user_data,
+                               size_t *pnwritten)
 {
   struct ws_cw_dec_ctx *ctx = user_data;
   struct Curl_easy *data = ctx->data;
   struct websocket *ws = ctx->ws;
   bool auto_pong = !data->set.ws_no_auto_pong;
   curl_off_t remain = (payload_len - (payload_offset + buflen));
+  CURLcode result;
 
   (void)frame_age;
+  *pnwritten = 0;
 
   if(auto_pong && (frame_flags & CURLWS_PING) && !remain) {
     /* auto-respond to PINGs, only works for single-frame payloads atm */
-    size_t bytes;
-    infof(data, "[WS] auto-respond to PING with a PONG");
+    CURL_TRC_WS(data, "auto PONG to [PING payload=%" FMT_OFF_T
+                "/%" FMT_OFF_T "]", payload_offset, payload_len);
     /* send back the exact same content as a PONG */
-    *err = curl_ws_send(data, buf, buflen, &bytes, 0, CURLWS_PONG);
-    if(*err)
-      return -1;
+    result = ws_enc_add_cntrl(data, ws, buf, buflen, CURLWS_PONG);
+    if(result)
+      return result;
   }
   else if(buflen || !remain) {
     /* forward the decoded frame to the next client writer. */
     update_meta(ws, frame_age, frame_flags, payload_offset,
                 payload_len, buflen);
 
-    *err = Curl_cwriter_write(data, ctx->next_writer, ctx->cw_type,
+    result = Curl_cwriter_write(data, ctx->next_writer,
+                              (ctx->cw_type | CLIENTWRITE_0LEN),
                               (const char *)buf, buflen);
-    if(*err)
-      return -1;
+    if(result)
+      return result;
   }
-  *err = CURLE_OK;
-  return (ssize_t)buflen;
+  *pnwritten = buflen;
+  return CURLE_OK;
 }
 
 static CURLcode ws_cw_write(struct Curl_easy *data,
@@ -643,6 +697,7 @@ static CURLcode ws_cw_write(struct Curl_easy *data,
   struct websocket *ws;
   CURLcode result;
 
+  CURL_TRC_WRITE(data, "ws_cw_write(len=%zu, type=%d)", nbytes, type);
   if(!(type & CLIENTWRITE_BODY) || data->set.ws_raw_mode)
     return Curl_cwriter_write(data, writer->next, type, buf, nbytes);
 
@@ -657,7 +712,7 @@ static CURLcode ws_cw_write(struct Curl_easy *data,
     result = Curl_bufq_write(&ctx->buf, (const unsigned char *)buf,
                              nbytes, &nwritten);
     if(result) {
-      infof(data, "WS: error adding data to buffer %d", result);
+      infof(data, "[WS] error adding data to buffer %d", result);
       return result;
     }
   }
@@ -673,11 +728,10 @@ static CURLcode ws_cw_write(struct Curl_easy *data,
     if(result == CURLE_AGAIN) {
       /* insufficient amount of data, keep it for later.
        * we pretend to have written all since we have a copy */
-      CURL_TRC_WS(data, "buffered incomplete frame head");
       return CURLE_OK;
     }
     else if(result) {
-      infof(data, "[WS] decode error %d", (int)result);
+      failf(data, "[WS] decode payload error %d", (int)result);
       return result;
     }
   }
@@ -747,36 +801,33 @@ static void ws_enc_init(struct ws_encoder *enc)
      +---------------------------------------------------------------+
 */
 
-static ssize_t ws_enc_write_head(struct Curl_easy *data,
+static CURLcode ws_enc_add_frame(struct Curl_easy *data,
                                  struct ws_encoder *enc,
                                  unsigned int flags,
                                  curl_off_t payload_len,
-                                 struct bufq *out,
-                                 CURLcode *err)
+                                 struct bufq *out)
 {
-  unsigned char firstbyte = 0;
+  unsigned char firstb = 0;
   unsigned char head[14];
-  size_t hlen, n;
+  CURLcode result;
+  size_t hlen, nwritten;
 
   if(payload_len < 0) {
     failf(data, "[WS] starting new frame with negative payload length %"
                 FMT_OFF_T, payload_len);
-    *err = CURLE_SEND_ERROR;
-    return -1;
+    return CURLE_SEND_ERROR;
   }
 
   if(enc->payload_remain > 0) {
     /* trying to write a new frame before the previous one is finished */
     failf(data, "[WS] starting new frame with %zd bytes from last one "
                 "remaining to be sent", (ssize_t)enc->payload_remain);
-    *err = CURLE_SEND_ERROR;
-    return -1;
+    return CURLE_SEND_ERROR;
   }
 
-  firstbyte = ws_frame_flags2firstbyte(data, flags, enc->contfragment, err);
-  if(*err) {
-    return -1;
-  }
+  result = ws_frame_flags2firstbyte(data, flags, enc->contfragment, &firstb);
+  if(result)
+    return result;
 
   /* fragmentation only applies to data frames (text/binary);
    * control frames (close/ping/pong) do not affect the CONT status */
@@ -784,26 +835,20 @@ static ssize_t ws_enc_write_head(struct Curl_easy *data,
     enc->contfragment = (flags & CURLWS_CONT) ? (bit)TRUE : (bit)FALSE;
   }
 
-  if(flags & CURLWS_PING && payload_len > 125) {
-    /* The maximum valid size of PING frames is 125 bytes. */
+  if(flags & CURLWS_PING && payload_len > WS_MAX_CNTRL_LEN) {
     failf(data, "[WS] given PING frame is too big");
-    *err = CURLE_TOO_LARGE;
-    return -1;
+    return CURLE_TOO_LARGE;
   }
-  if(flags & CURLWS_PONG && payload_len > 125) {
-    /* The maximum valid size of PONG frames is 125 bytes. */
+  if(flags & CURLWS_PONG && payload_len > WS_MAX_CNTRL_LEN) {
     failf(data, "[WS] given PONG frame is too big");
-    *err = CURLE_TOO_LARGE;
-    return -1;
+    return CURLE_TOO_LARGE;
   }
-  if(flags & CURLWS_CLOSE && payload_len > 125) {
-    /* The maximum valid size of CLOSE frames is 125 bytes. */
+  if(flags & CURLWS_CLOSE && payload_len > WS_MAX_CNTRL_LEN) {
     failf(data, "[WS] given CLOSE frame is too big");
-    *err = CURLE_TOO_LARGE;
-    return -1;
+    return CURLE_TOO_LARGE;
   }
 
-  head[0] = enc->firstbyte = firstbyte;
+  head[0] = enc->firstbyte = firstb;
   if(payload_len > 65535) {
     head[1] = 127 | WSBIT_MASK;
     head[2] = (unsigned char)((payload_len >> 56) & 0xff);
@@ -830,35 +875,63 @@ static ssize_t ws_enc_write_head(struct Curl_easy *data,
   enc->payload_remain = enc->payload_len = payload_len;
   ws_enc_info(enc, data, "sending");
 
+  /* 4 bytes random */
+
+  result = Curl_rand(data, (unsigned char *)&enc->mask, sizeof(enc->mask));
+  if(result)
+    return result;
+
+#ifdef DEBUGBUILD
+  if(getenv("CURL_WS_FORCE_ZERO_MASK"))
+    /* force the bit mask to 0x00000000, effectively disabling masking */
+    memset(&enc->mask, 0, sizeof(enc->mask));
+#endif
+
   /* add 4 bytes mask */
   memcpy(&head[hlen], &enc->mask, 4);
   hlen += 4;
   /* reset for payload to come */
   enc->xori = 0;
 
-  *err = Curl_bufq_write(out, head, hlen, &n);
-  if(*err)
-    return -1;
-  if(n != hlen) {
+  result = Curl_bufq_write(out, head, hlen, &nwritten);
+  if(result)
+    return result;
+  if(nwritten != hlen) {
     /* We use a bufq with SOFT_LIMIT, writing should always succeed */
     DEBUGASSERT(0);
-    *err = CURLE_SEND_ERROR;
-    return -1;
+    return CURLE_SEND_ERROR;
   }
-  return (ssize_t)n;
+  return CURLE_OK;
 }
 
-static ssize_t ws_enc_write_payload(struct ws_encoder *enc,
-                                    struct Curl_easy *data,
-                                    const unsigned char *buf, size_t buflen,
-                                    struct bufq *out, CURLcode *err)
+static CURLcode ws_enc_write_head(struct Curl_easy *data,
+                                  struct websocket *ws,
+                                  struct ws_encoder *enc,
+                                  unsigned int flags,
+                                  curl_off_t payload_len,
+                                  struct bufq *out)
+{
+  /* starting a new frame, we want a clean sendbuf.
+   * Any pending control frame we can add now as part of the flush. */
+  if(ws->pending.type) {
+    CURLcode result = ws_enc_add_pending(data, ws);
+    if(result)
+      return result;
+  }
+  return ws_enc_add_frame(data, enc, flags, payload_len, out);
+}
+
+static CURLcode ws_enc_write_payload(struct ws_encoder *enc,
+                                     struct Curl_easy *data,
+                                     const unsigned char *buf, size_t buflen,
+                                     struct bufq *out, size_t *pnwritten)
 {
+  CURLcode result;
   size_t i, len, n;
 
-  if(Curl_bufq_is_full(out)) {
-    *err = CURLE_AGAIN;
-    return -1;
-  }
+  *pnwritten = 0;
+  if(Curl_bufq_is_full(out))
+    return CURLE_AGAIN;
 
   /* not the most performant way to do this */
   len = buflen;
@@ -867,20 +940,274 @@ static ssize_t ws_enc_write_payload(struct ws_encoder *enc,
 
   for(i = 0; i < len; ++i) {
     unsigned char c = buf[i] ^ enc->mask[enc->xori];
-    *err = Curl_bufq_write(out, &c, 1, &n);
-    if(*err) {
-      if((*err != CURLE_AGAIN) || !i)
-        return -1;
+    result = Curl_bufq_write(out, &c, 1, &n);
+    if(result) {
+      if((result != CURLE_AGAIN) || !i)
+        return result;
       break;
     }
     enc->xori++;
     enc->xori &= 3;
   }
+  *pnwritten = i;
   enc->payload_remain -= (curl_off_t)i;
   ws_enc_info(enc, data, "buffered");
-  return (ssize_t)i;
+  return CURLE_OK;
+}
+
+static CURLcode ws_enc_add_pending(struct Curl_easy *data,
+                                   struct websocket *ws)
+{
+  CURLcode result;
+  size_t n;
+
+  if(!ws->pending.type) /* no pending frame here */
+    return CURLE_OK;
+  if(ws->enc.payload_remain) /* in the middle of another frame */
+    return CURLE_AGAIN;
+
+  result = ws_enc_add_frame(data, &ws->enc, ws->pending.type,
+                            (curl_off_t)ws->pending.payload_len,
+                            &ws->sendbuf);
+  if(result) {
+    CURL_TRC_WS(data, "ws_enc_cntrl(), error addiong head: %d",
+                result);
+    goto out;
+  }
+  result = ws_enc_write_payload(&ws->enc, data, ws->pending.payload,
+                                ws->pending.payload_len,
+                                &ws->sendbuf, &n);
+  if(result) {
+    CURL_TRC_WS(data, "ws_enc_cntrl(), error adding payload: %d",
+                result);
+    goto out;
+  }
+  /* our buffer should always be able to take in a control frame */
+  DEBUGASSERT(n == ws->pending.payload_len);
+  DEBUGASSERT(!ws->enc.payload_remain);
+
+out:
+  memset(&ws->pending, 0, sizeof(ws->pending));
+  return result;
+}
+
+static CURLcode ws_enc_send(struct Curl_easy *data,
+                            struct websocket *ws,
+                            const unsigned char *buffer,
+                            size_t buflen,
+                            curl_off_t fragsize,
+                            unsigned int flags,
+                            size_t *pnsent)
+{
+  size_t n;
+  CURLcode result = CURLE_OK;
+
+  DEBUGASSERT(!data->set.ws_raw_mode);
+  *pnsent = 0;
+
+  if(ws->enc.payload_remain || !Curl_bufq_is_empty(&ws->sendbuf)) {
+    /* a frame is ongoing with payload buffered or more payload
+     * that needs to be encoded into the buffer */
+    if(buflen < ws->sendbuf_payload) {
+      /* We have been called with LESS buffer data than before. This
+       * is not how it's supposed too work. */
+      failf(data, "[WS] curl_ws_send() called with smaller 'buflen' than "
+            "bytes already buffered in previous call, %zu vs %zu",
+            buflen, ws->sendbuf_payload);
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+    if((curl_off_t)buflen >
+       (ws->enc.payload_remain + (curl_off_t)ws->sendbuf_payload)) {
+      /* too large buflen beyond payload length of frame */
+      failf(data, "[WS] unaligned frame size (sending %zu instead of %"
+                  FMT_OFF_T ")",
+            buflen, ws->enc.payload_remain + ws->sendbuf_payload);
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+  }
+  else {
+    result = ws_flush(data, ws, Curl_is_in_callback(data));
+    if(result)
+      return result;
+
+    result = ws_enc_write_head(data, ws, &ws->enc, flags,
+                               (flags & CURLWS_OFFSET) ?
+                               fragsize : (curl_off_t)buflen,
+                               &ws->sendbuf);
+    if(result) {
+      CURL_TRC_WS(data, "curl_ws_send(), error writing frame head %d", result);
+      return result;
+    }
+  }
+
+  /* While there is either sendbuf to flush OR more payload to encode... */
+  while(!Curl_bufq_is_empty(&ws->sendbuf) || (buflen > ws->sendbuf_payload)) {
+    /* Try to add more payload to sendbuf */
+    if(buflen > ws->sendbuf_payload) {
+      size_t prev_len = Curl_bufq_len(&ws->sendbuf);
+      result = ws_enc_write_payload(&ws->enc, data,
+                                    buffer + ws->sendbuf_payload,
+                                    buflen - ws->sendbuf_payload,
+                                    &ws->sendbuf, &n);
+      if(result && (result != CURLE_AGAIN))
+        return result;
+      ws->sendbuf_payload += Curl_bufq_len(&ws->sendbuf) - prev_len;
+      if(!ws->sendbuf_payload) {
+        return CURLE_AGAIN;
+      }
+    }
+
+    /* flush, blocking when in callback */
+    result = ws_flush(data, ws, Curl_is_in_callback(data));
+    if(!result && ws->sendbuf_payload > 0) {
+      *pnsent += ws->sendbuf_payload;
+      buffer += ws->sendbuf_payload;
+      buflen -= ws->sendbuf_payload;
+      ws->sendbuf_payload = 0;
+    }
+    else if(result == CURLE_AGAIN) {
+      if(ws->sendbuf_payload > Curl_bufq_len(&ws->sendbuf)) {
+        /* blocked, part of payload bytes remain, report length
+         * that we managed to send. */
+        size_t flushed = (ws->sendbuf_payload - Curl_bufq_len(&ws->sendbuf));
+        *pnsent += flushed;
+        ws->sendbuf_payload -= flushed;
+        return CURLE_OK;
+      }
+      else {
+        /* blocked before sending headers or 1st payload byte. We cannot report
+         * OK on 0-length send (caller counts only payload) and EAGAIN */
+        CURL_TRC_WS(data, "EAGAIN flushing sendbuf, payload_encoded: %zu/%zu",
+                    ws->sendbuf_payload, buflen);
+        DEBUGASSERT(*pnsent == 0);
+        return CURLE_AGAIN;
+      }
+    }
+    else
+      return result;  /* real error sending the data */
+  }
+  return CURLE_OK;
+}
+
+struct cr_ws_ctx {
+  struct Curl_creader super;
+  BIT(read_eos);  /* we read an EOS from the next reader */
+  BIT(eos);       /* we have returned an EOS */
+};
+
+static CURLcode cr_ws_init(struct Curl_easy *data, struct Curl_creader *reader)
+{
+  (void)data;
+  (void)reader;
+  return CURLE_OK;
+}
+
+static void cr_ws_close(struct Curl_easy *data, struct Curl_creader *reader)
+{
+  (void)data;
+  (void)reader;
+}
+
+static CURLcode cr_ws_read(struct Curl_easy *data,
+                           struct Curl_creader *reader,
+                           char *buf, size_t blen,
+                           size_t *pnread, bool *peos)
+{
+  struct cr_ws_ctx *ctx = reader->ctx;
+  CURLcode result = CURLE_OK;
+  size_t nread, n;
+  struct websocket *ws;
+  bool eos;
+
+  *pnread = 0;
+  if(ctx->eos) {
+    *peos = TRUE;
+    return CURLE_OK;
+  }
+
+  ws = Curl_conn_meta_get(data->conn, CURL_META_PROTO_WS_CONN);
+  if(!ws) {
+    failf(data, "[WS] not a websocket transfer");
+    return CURLE_FAILED_INIT;
+  }
+
+  if(Curl_bufq_is_empty(&ws->sendbuf)) {
+    if(ctx->read_eos) {
+      ctx->eos = TRUE;
+      *peos = TRUE;
+      return CURLE_OK;
+    }
+
+    if(ws->enc.payload_remain) {
+      CURL_TRC_WS(data, "current frame, %" FMT_OFF_T " remaining",
+                  ws->enc.payload_remain);
+      if(ws->enc.payload_remain < (curl_off_t)blen)
+        blen = (size_t)ws->enc.payload_remain;
+    }
+
+    result = Curl_creader_read(data, reader->next, buf, blen, &nread, &eos);
+    if(result)
+      return result;
+    ctx->read_eos = eos;
+
+    if(!Curl_bufq_is_empty(&ws->sendbuf)) {
+      /* client_read started a new frame, we disregard any eos reported */
+      ctx->read_eos = FALSE;
+      Curl_creader_clear_eos(data, reader->next);
+    }
+    else if(!nread) {
+      /* nothing to convert, return this right away */
+      if(ctx->read_eos)
+        ctx->eos = TRUE;
+      *pnread = nread;
+      *peos = ctx->eos;
+      goto out;
+    }
+
+    if(!ws->enc.payload_remain && Curl_bufq_is_empty(&ws->sendbuf)) {
+      /* encode the data as a new BINARY frame */
+      result = ws_enc_write_head(data, ws, &ws->enc, CURLWS_BINARY, nread,
+                                 &ws->sendbuf);
+      if(result)
+        goto out;
+    }
+
+    result = ws_enc_write_payload(&ws->enc, data, (unsigned char *)buf,
+                                  nread, &ws->sendbuf, &n);
+    if(result)
+      goto out;
+    CURL_TRC_READ(data, "cr_ws_read, added %zu payload, len=%zu", nread, n);
+  }
+
+  DEBUGASSERT(!Curl_bufq_is_empty(&ws->sendbuf));
+  *peos = FALSE;
+  result = Curl_bufq_cread(&ws->sendbuf, buf, blen, pnread);
+  if(!result && ctx->read_eos && Curl_bufq_is_empty(&ws->sendbuf)) {
+    /* no more data, read all, done. */
+    ctx->eos = TRUE;
+    *peos = TRUE;
+  }
+
+out:
+  CURL_TRC_READ(data, "cr_ws_read(len=%zu) -> %d, nread=%zu, eos=%d",
+                blen, result, *pnread, *peos);
+  return result;
 }
 
+static const struct Curl_crtype ws_cr_encode = {
+  "ws-encode",
+  cr_ws_init,
+  cr_ws_read,
+  cr_ws_close,
+  Curl_creader_def_needs_rewind,
+  Curl_creader_def_total_length,
+  Curl_creader_def_resume_from,
+  Curl_creader_def_cntrl,
+  Curl_creader_def_is_paused,
+  Curl_creader_def_done,
+  sizeof(struct cr_ws_ctx)
+};
+
 
 struct wsfield {
   const char *name;
@@ -902,11 +1229,6 @@ CURLcode Curl_ws_request(struct Curl_easy *data, struct dynbuf *req)
          MUST include the "websocket" keyword. */
       "Upgrade", "websocket"
     },
-    {
-      /* The request MUST contain a |Connection| header field whose value
-         MUST include the "Upgrade" token. */
-      "Connection", "Upgrade",
-    },
     {
       /* The request MUST include a header field with the name
          |Sec-WebSocket-Version|. The value of this header field MUST be
@@ -922,7 +1244,7 @@ CURLcode Curl_ws_request(struct Curl_easy *data, struct dynbuf *req)
       "Sec-WebSocket-Key", NULL,
     }
   };
-  heads[3].val = &keyval[0];
+  heads[2].val = &keyval[0];
 
   /* 16 bytes random */
   result = Curl_rand(data, (unsigned char *)rand, sizeof(rand));
@@ -944,6 +1266,7 @@ CURLcode Curl_ws_request(struct Curl_easy *data, struct dynbuf *req)
                               heads[i].val);
     }
   }
+  data->state.http_hd_upgrade = TRUE;
   k->upgr101 = UPGR101_WS;
   return result;
 }
@@ -967,7 +1290,8 @@ CURLcode Curl_ws_accept(struct Curl_easy *data,
 {
   struct SingleRequest *k = &data->req;
   struct websocket *ws;
-  struct Curl_cwriter *ws_dec_writer;
+  struct Curl_cwriter *ws_dec_writer = NULL;
+  struct Curl_creader *ws_enc_reader = NULL;
   CURLcode result;
 
   DEBUGASSERT(data->conn);
@@ -1023,33 +1347,17 @@ CURLcode Curl_ws_accept(struct Curl_easy *data,
      subprotocol not requested by the client), the client MUST Fail
      the WebSocket Connection. */
 
-  /* 4 bytes random */
-
-  result = Curl_rand(data, (unsigned char *)&ws->enc.mask,
-                     sizeof(ws->enc.mask));
-  if(result)
-    return result;
-
-#ifdef DEBUGBUILD
-  if(getenv("CURL_WS_FORCE_ZERO_MASK"))
-    /* force the bit mask to 0x00000000, effectively disabling masking */
-    memset(ws->enc.mask, 0, sizeof(ws->enc.mask));
-#endif
-
-  infof(data, "[WS] Received 101, switch to WebSocket; mask %02x%02x%02x%02x",
-        ws->enc.mask[0], ws->enc.mask[1], ws->enc.mask[2], ws->enc.mask[3]);
+  infof(data, "[WS] Received 101, switch to WebSocket");
 
   /* Install our client writer that decodes WS frames payload */
   result = Curl_cwriter_create(&ws_dec_writer, data, &ws_cw_decode,
                                CURL_CW_CONTENT_DECODE);
   if(result)
-    return result;
-
+    goto out;
   result = Curl_cwriter_add(data, ws_dec_writer);
-  if(result) {
-    Curl_cwriter_free(data, ws_dec_writer);
-    return result;
-  }
+  if(result)
+    goto out;
+  ws_dec_writer = NULL; /* owned by transfer now */
 
   if(data->set.connect_only) {
     size_t nwritten;
@@ -1059,23 +1367,62 @@ CURLcode Curl_ws_accept(struct Curl_easy *data,
     result = Curl_bufq_write(&ws->recvbuf, (const unsigned char *)mem,
                              nread, &nwritten);
     if(result)
-      return result;
+      goto out;
     DEBUGASSERT(nread == nwritten);
-    infof(data, "%zu bytes websocket payload", nread);
+    k->keepon &= ~KEEP_RECV; /* read no more content */
   }
   else { /* !connect_only */
+    if(data->set.method == HTTPREQ_PUT) {
+      CURL_TRC_WS(data, "UPLOAD set, add ws-encode reader");
+      result = Curl_creader_set_fread(data, -1);
+      if(result)
+        goto out;
+
+      if(!data->set.ws_raw_mode) {
+        /* Add our client readerr encoding WS BINARY frames */
+        result = Curl_creader_create(&ws_enc_reader, data, &ws_cr_encode,
+                                     CURL_CR_CONTENT_ENCODE);
+        if(result)
+          goto out;
+        result = Curl_creader_add(data, ws_enc_reader);
+        if(result)
+          goto out;
+        ws_enc_reader = NULL; /* owned by transfer now */
+      }
+
+      /* start over with sending */
+      data->req.eos_read = FALSE;
+      data->req.upload_done = FALSE;
+      k->keepon |= KEEP_SEND;
+    }
+
     /* And pass any additional data to the writers */
     if(nread) {
       result = Curl_client_write(data, CLIENTWRITE_BODY, mem, nread);
+      if(result)
+        goto out;
     }
   }
+
   k->upgr101 = UPGR101_RECEIVED;
+  k->header = FALSE; /* we will not get more responses */
 
+out:
+  if(ws_dec_writer)
+    Curl_cwriter_free(data, ws_dec_writer);
+  if(ws_enc_reader)
+    Curl_creader_free(data, ws_enc_reader);
+  if(result)
+    CURL_TRC_WS(data, "Curl_ws_accept() failed -> %d", result);
+  else
+    CURL_TRC_WS(data, "websocket established, %s mode",
+                data->set.connect_only ? "connect-only" : "callback");
   return result;
 }
 
 struct ws_collect {
   struct Curl_easy *data;
+  struct websocket *ws;
   unsigned char *buffer;
   size_t buflen;
   size_t bufidx;
@@ -1086,19 +1433,20 @@ struct ws_collect {
   bool written;
 };
 
-static ssize_t ws_client_collect(const unsigned char *buf, size_t buflen,
-                                 int frame_age, int frame_flags,
-                                 curl_off_t payload_offset,
-                                 curl_off_t payload_len,
-                                 void *userp,
-                                 CURLcode *err)
+static CURLcode ws_client_collect(const unsigned char *buf, size_t buflen,
+                                  int frame_age, int frame_flags,
+                                  curl_off_t payload_offset,
+                                  curl_off_t payload_len,
+                                  void *userp,
+                                  size_t *pnwritten)
 {
   struct ws_collect *ctx = userp;
   struct Curl_easy *data = ctx->data;
   bool auto_pong = !data->set.ws_no_auto_pong;
-  size_t nwritten;
   curl_off_t remain = (payload_len - (payload_offset + buflen));
+  CURLcode result = CURLE_OK;
 
+  *pnwritten = 0;
   if(!ctx->bufidx) {
     /* first write */
     ctx->frame_age = frame_age;
@@ -1109,31 +1457,30 @@ static ssize_t ws_client_collect(const unsigned char *buf, size_t buflen,
 
   if(auto_pong && (frame_flags & CURLWS_PING) && !remain) {
     /* auto-respond to PINGs, only works for single-frame payloads atm */
-    size_t bytes;
-    infof(ctx->data, "[WS] auto-respond to PING with a PONG");
+    CURL_TRC_WS(data, "auto PONG to [PING payload=%" FMT_OFF_T
+                "/%" FMT_OFF_T "]", payload_offset, payload_len);
     /* send back the exact same content as a PONG */
-    *err = curl_ws_send(ctx->data, buf, buflen, &bytes, 0, CURLWS_PONG);
-    if(*err)
-      return -1;
-    nwritten = bytes;
+    result = ws_enc_add_cntrl(ctx->data, ctx->ws, buf, buflen, CURLWS_PONG);
+    if(result)
+      return result;
+    *pnwritten = buflen;
   }
   else {
+    size_t write_len;
+
     ctx->written = TRUE;
     DEBUGASSERT(ctx->buflen >= ctx->bufidx);
-    nwritten = CURLMIN(buflen, ctx->buflen - ctx->bufidx);
-    if(!nwritten) {
-      if(!buflen) {  /* 0 length write, we accept that */
-        *err = CURLE_OK;
-        return 0;
-      }
-      *err = CURLE_AGAIN;  /* no more space */
-      return -1;
+    write_len = CURLMIN(buflen, ctx->buflen - ctx->bufidx);
+    if(!write_len) {
+      if(!buflen)  /* 0 length write, we accept that */
+        return CURLE_OK;
+      return CURLE_AGAIN;  /* no more space */
     }
-    *err = CURLE_OK;
-    memcpy(ctx->buffer + ctx->bufidx, buf, nwritten);
-    ctx->bufidx += nwritten;
+    memcpy(ctx->buffer + ctx->bufidx, buf, write_len);
+    ctx->bufidx += write_len;
+    *pnwritten = write_len;
   }
-  return nwritten;
+  return result;
 }
 
 static CURLcode nw_in_recv(void *reader_ctx,
@@ -1149,13 +1496,16 @@ CURLcode curl_ws_recv(CURL *d, void *buffer,
                       const struct curl_ws_frame **metap)
 {
   struct Curl_easy *data = d;
-  struct connectdata *conn = data->conn;
+  struct connectdata *conn;
   struct websocket *ws;
   struct ws_collect ctx;
 
   *nread = 0;
   *metap = NULL;
+  if(!GOOD_EASY_HANDLE(data))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
 
+  conn = data->conn;
   if(!conn) {
     /* Unhappy hack with lifetimes of transfers and connection */
     if(!data->set.connect_only) {
@@ -1178,6 +1528,7 @@ CURLcode curl_ws_recv(CURL *d, void *buffer,
 
   memset(&ctx, 0, sizeof(ctx));
   ctx.data = data;
+  ctx.ws = ws;
   ctx.buffer = buffer;
   ctx.buflen = buflen;
 
@@ -1222,11 +1573,19 @@ CURLcode curl_ws_recv(CURL *d, void *buffer,
   /* update frame information to be passed back */
   update_meta(ws, ctx.frame_age, ctx.frame_flags, ctx.payload_offset,
               ctx.payload_len, ctx.bufidx);
-  *metap = &ws->frame;
-  *nread = ws->frame.len;
+  *metap = &ws->recvframe;
+  *nread = ws->recvframe.len;
   CURL_TRC_WS(data, "curl_ws_recv(len=%zu) -> %zu bytes (frame at %"
                FMT_OFF_T ", %" FMT_OFF_T " left)",
-               buflen, *nread, ws->frame.offset, ws->frame.bytesleft);
+               buflen, *nread, ws->recvframe.offset,
+               ws->recvframe.bytesleft);
+  /* all's well, try to send any pending control. we do not know
+   * when the application will call `curl_ws_send()` again. */
+  if(!data->set.ws_raw_mode && ws->pending.type) {
+    CURLcode r2 = ws_enc_add_pending(data, ws);
+    if(!r2)
+      (void)ws_flush(data, ws, Curl_is_in_callback(data));
+  }
   return CURLE_OK;
 }
 
@@ -1288,12 +1647,12 @@ static CURLcode ws_flush(struct Curl_easy *data, struct websocket *ws,
   return CURLE_OK;
 }
 
-static CURLcode ws_send_raw_blocking(CURL *d, struct websocket *ws,
+static CURLcode ws_send_raw_blocking(struct Curl_easy *data,
+                                     struct websocket *ws,
                                      const char *buffer, size_t buflen)
 {
   CURLcode result = CURLE_OK;
   size_t nwritten;
-  struct Curl_easy *data = d;
 
   (void)ws;
   while(buflen) {
@@ -1374,14 +1733,25 @@ CURLcode curl_ws_send(CURL *d, const void *buffer_arg,
 {
   struct websocket *ws;
   const unsigned char *buffer = buffer_arg;
-  ssize_t n;
   CURLcode result = CURLE_OK;
   struct Curl_easy *data = d;
+  size_t ndummy;
+  size_t *pnsent = sent ? sent : &ndummy;
 
+  if(!GOOD_EASY_HANDLE(data))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
   CURL_TRC_WS(data, "curl_ws_send(len=%zu, fragsize=%" FMT_OFF_T
               ", flags=%x), raw=%d",
               buflen, fragsize, flags, data->set.ws_raw_mode);
-  *sent = 0;
+
+  *pnsent = 0;
+
+  if(!buffer && buflen) {
+    failf(data, "[WS] buffer is NULL when buflen is not");
+    result = CURLE_BAD_FUNCTION_ARGUMENT;
+    goto out;
+  }
+
   if(!data->conn && data->set.connect_only) {
     result = Curl_connect_only_attach(data);
     if(result)
@@ -1406,106 +1776,30 @@ CURLcode curl_ws_send(CURL *d, const void *buffer_arg,
     if(result)
       goto out;
 
+    if(!buffer) {
+      failf(data, "[WS] buffer is NULL in raw mode");
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
+    if(!sent) {
+      failf(data, "[WS] sent is NULL in raw mode");
+      return CURLE_BAD_FUNCTION_ARGUMENT;
+    }
     if(fragsize || flags) {
       failf(data, "[WS] fragsize and flags must be zero in raw mode");
       return CURLE_BAD_FUNCTION_ARGUMENT;
     }
-    result = ws_send_raw(data, buffer, buflen, sent);
+    result = ws_send_raw(data, buffer, buflen, pnsent);
     goto out;
   }
 
-  /* Not RAW mode, buf we do the frame encoding */
-
-  if(ws->enc.payload_remain || !Curl_bufq_is_empty(&ws->sendbuf)) {
-    /* a frame is ongoing with payload buffered or more payload
-     * that needs to be encoded into the buffer */
-    if(buflen < ws->sendbuf_payload) {
-      /* We have been called with LESS buffer data than before. This
-       * is not how it's supposed too work. */
-      failf(data, "[WS] curl_ws_send() called with smaller 'buflen' than "
-            "bytes already buffered in previous call, %zu vs %zu",
-            buflen, ws->sendbuf_payload);
-      result = CURLE_BAD_FUNCTION_ARGUMENT;
-      goto out;
-    }
-    if((curl_off_t)buflen >
-       (ws->enc.payload_remain + (curl_off_t)ws->sendbuf_payload)) {
-      /* too large buflen beyond payload length of frame */
-      failf(data, "[WS] unaligned frame size (sending %zu instead of %"
-                  FMT_OFF_T ")",
-            buflen, ws->enc.payload_remain + ws->sendbuf_payload);
-      result = CURLE_BAD_FUNCTION_ARGUMENT;
-      goto out;
-    }
-  }
-  else {
-    /* starting a new frame, we want a clean sendbuf */
-    curl_off_t payload_len = (flags & CURLWS_OFFSET) ?
-                             fragsize : (curl_off_t)buflen;
-    result = ws_flush(data, ws, Curl_is_in_callback(data));
-    if(result)
-      goto out;
-
-    n = ws_enc_write_head(data, &ws->enc, flags, payload_len,
-                          &ws->sendbuf, &result);
-    if(n < 0)
-      goto out;
-  }
-
-  /* While there is either sendbuf to flush OR more payload to encode... */
-  while(!Curl_bufq_is_empty(&ws->sendbuf) || (buflen > ws->sendbuf_payload)) {
-    /* Try to add more payload to sendbuf */
-    if(buflen > ws->sendbuf_payload) {
-      size_t prev_len = Curl_bufq_len(&ws->sendbuf);
-      n = ws_enc_write_payload(&ws->enc, data,
-                               buffer + ws->sendbuf_payload,
-                               buflen - ws->sendbuf_payload,
-                               &ws->sendbuf, &result);
-      if(n < 0 && (result != CURLE_AGAIN))
-        goto out;
-      ws->sendbuf_payload += Curl_bufq_len(&ws->sendbuf) - prev_len;
-      if(!ws->sendbuf_payload) {
-        result = CURLE_AGAIN;
-        goto out;
-      }
-    }
-
-    /* flush, blocking when in callback */
-    result = ws_flush(data, ws, Curl_is_in_callback(data));
-    if(!result && ws->sendbuf_payload > 0) {
-      *sent += ws->sendbuf_payload;
-      buffer += ws->sendbuf_payload;
-      buflen -= ws->sendbuf_payload;
-      ws->sendbuf_payload = 0;
-    }
-    else if(result == CURLE_AGAIN) {
-      if(ws->sendbuf_payload > Curl_bufq_len(&ws->sendbuf)) {
-        /* blocked, part of payload bytes remain, report length
-         * that we managed to send. */
-        size_t flushed = (ws->sendbuf_payload - Curl_bufq_len(&ws->sendbuf));
-        *sent += flushed;
-        ws->sendbuf_payload -= flushed;
-        result = CURLE_OK;
-        goto out;
-      }
-      else {
-        /* blocked before sending headers or 1st payload byte. We cannot report
-         * OK on 0-length send (caller counts only payload) and EAGAIN */
-        CURL_TRC_WS(data, "EAGAIN flushing sendbuf, payload_encoded: %zu/%zu",
-                    ws->sendbuf_payload, buflen);
-        DEBUGASSERT(*sent == 0);
-        result = CURLE_AGAIN;
-        goto out;
-      }
-    }
-    else
-      goto out;  /* real error sending the data */
-  }
+  /* Not RAW mode, we do the frame encoding */
+  result = ws_enc_send(data, ws, buffer, buflen, fragsize, flags, pnsent);
 
 out:
   CURL_TRC_WS(data, "curl_ws_send(len=%zu, fragsize=%" FMT_OFF_T
               ", flags=%x, raw=%d) -> %d, %zu",
-              buflen, fragsize, flags, data->set.ws_raw_mode, result, *sent);
+              buflen, fragsize, flags, data->set.ws_raw_mode, result,
+              *pnsent);
   return result;
 }
 
@@ -1531,12 +1825,64 @@ const struct curl_ws_frame *curl_ws_meta(CURL *d)
     struct websocket *ws;
     ws = Curl_conn_meta_get(data->conn, CURL_META_PROTO_WS_CONN);
     if(ws)
-      return &ws->frame;
+      return &ws->recvframe;
 
   }
   return NULL;
 }
 
+CURL_EXTERN CURLcode curl_ws_start_frame(CURL *d,
+                                         unsigned int flags,
+                                         curl_off_t frame_len)
+{
+  struct websocket *ws;
+  CURLcode result = CURLE_OK;
+  struct Curl_easy *data = d;
+
+  if(!GOOD_EASY_HANDLE(data))
+    return CURLE_BAD_FUNCTION_ARGUMENT;
+  if(data->set.ws_raw_mode) {
+    failf(data, "cannot curl_ws_start_frame() with CURLWS_RAW_MODE enabled");
+    return CURLE_FAILED_INIT;
+  }
+
+  CURL_TRC_WS(data, "curl_ws_start_frame(flags=%x, frame_len=%" FMT_OFF_T,
+              flags, frame_len);
+
+  if(!data->conn) {
+    failf(data, "[WS] No associated connection");
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+  ws = Curl_conn_meta_get(data->conn, CURL_META_PROTO_WS_CONN);
+  if(!ws) {
+    failf(data, "[WS] Not a websocket transfer");
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+
+  if(data->set.ws_raw_mode) {
+    failf(data, "[WS] cannot start frame in raw mode");
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+
+  if(ws->enc.payload_remain) {
+    failf(data, "[WS] previous frame not finished");
+    result = CURLE_SEND_ERROR;
+    goto out;
+  }
+
+  result = ws_enc_write_head(data, ws, &ws->enc, flags, frame_len,
+                             &ws->sendbuf);
+  if(result)
+    CURL_TRC_WS(data, "curl_start_frame(), error  adding frame head %d",
+                result);
+
+out:
+  return result;
+}
+
 const struct Curl_handler Curl_handler_ws = {
   "WS",                                 /* scheme */
   ws_setup_conn,                        /* setup_connection */
@@ -1546,10 +1892,10 @@ const struct Curl_handler Curl_handler_ws = {
   Curl_http_connect,                    /* connect_it */
   ZERO_NULL,                            /* connecting */
   ZERO_NULL,                            /* doing */
-  ZERO_NULL,                            /* proto_getsock */
-  Curl_http_getsock_do,                 /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  ZERO_NULL,                            /* proto_pollset */
+  Curl_http_do_pollset,                 /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   Curl_http_write_resp,                 /* write_resp */
   Curl_http_write_resp_hd,              /* write_resp_hd */
@@ -1573,10 +1919,10 @@ const struct Curl_handler Curl_handler_wss = {
   Curl_http_connect,                    /* connect_it */
   NULL,                                 /* connecting */
   ZERO_NULL,                            /* doing */
-  NULL,                                 /* proto_getsock */
-  Curl_http_getsock_do,                 /* doing_getsock */
-  ZERO_NULL,                            /* domore_getsock */
-  ZERO_NULL,                            /* perform_getsock */
+  NULL,                                 /* proto_pollset */
+  Curl_http_do_pollset,                 /* doing_pollset */
+  ZERO_NULL,                            /* domore_pollset */
+  ZERO_NULL,                            /* perform_pollset */
   ZERO_NULL,                            /* disconnect */
   Curl_http_write_resp,                 /* write_resp */
   Curl_http_write_resp_hd,              /* write_resp_hd */
@@ -1625,4 +1971,15 @@ const struct curl_ws_frame *curl_ws_meta(CURL *data)
   (void)data;
   return NULL;
 }
+
+CURL_EXTERN CURLcode curl_ws_start_frame(CURL *curl,
+                                         unsigned int flags,
+                                         curl_off_t frame_len)
+{
+  (void)curl;
+  (void)flags;
+  (void)frame_len;
+  return CURLE_NOT_BUILT_IN;
+}
+
 #endif /* !CURL_DISABLE_WEBSOCKETS */
diff --git a/deps/grpc/.bazelignore b/deps/grpc/.bazelignore
index 13ca0ec3c7f..d17d3332cf9 100644
--- a/deps/grpc/.bazelignore
+++ b/deps/grpc/.bazelignore
@@ -26,6 +26,13 @@ test/distrib/bazel/cpp
 test/distrib/bazel/python
 test/distrib/bazel/python_second_test_repo
 
-# Directories generated by setuptools build containing BUILD files.
+# Directories build containing own BUILD files.
 src/python/grpcio_tests/src/
+tools/distrib/python/grpcio_tools/build/
+tools/distrib/python/grpcio_tools/protobuf/
+tools/distrib/python/grpcio_tools/grpc_plugin/
 tools/distrib/python/grpcio_tools/grpc_root/
+tools/distrib/python/grpcio_tools/third_party/
+src/python/grpcio_observability/build/
+src/python/grpcio_observability/grpc_root/
+src/python/grpcio_observability/third_party/
diff --git a/deps/grpc/.bcr/metadata.template.json b/deps/grpc/.bcr/metadata.template.json
index 048eeb52409..fa9185b0529 100644
--- a/deps/grpc/.bcr/metadata.template.json
+++ b/deps/grpc/.bcr/metadata.template.json
@@ -2,8 +2,70 @@
     "homepage": "https://github.com/grpc/grpc",
     "maintainers": [
         {
-            "email": "bcr-maintainers@bazel.build",
-            "name": "No Maintainer Specified"
+            "email": "veblush@google.com",
+            "github": "veblush",
+            "name": "Esun Kim",
+            "github_user_id": 2793282
+        },
+        {
+            "email": "bpawan@google.com",
+            "github": "pawbhard",
+            "name": "Pawan Bhardwaj",
+            "github_user_id": 13415978
+        },
+        {
+            "email": "eostroukhov@google.com",
+            "github": "eugeneo",
+            "name": "Eugene Ostroukhov",
+            "github_user_id": 287917
+        },
+        {
+            "email": "hork@google.com",
+            "github": "drfloob",
+            "name": "Adam Heller",
+            "github_user_id": 295906
+        },
+        {
+            "email": "rishesh@google.com",
+            "github": "rishesh007",
+            "name": "Rishesh Agarwal",
+            "github_user_id": 40896662
+        },
+        {
+            "email": "roth@google.com",
+            "github": "markdroth",
+            "name": "Mark Roth",
+            "github_user_id": 18664614
+        },
+        {
+            "email": "yashkt@google.com",
+            "github": "yashykt",
+            "name": "Yash Tibrewal",
+            "github_user_id": 4181124
+        },
+        {
+            "email": "apolcyn@google.com",
+            "github": "apolcyn",
+            "name": "Alexander Polcyn",
+            "github_user_id": 9566254
+        },
+        {
+            "email": "sergiitk@google.com",
+            "github": "sergiitk",
+            "name": "Sergii Tkachenko",
+            "github_user_id": 672669
+        },
+        {
+            "email": "ssreenithi@google.com",
+            "github": "sreenithi",
+            "name": "Sreenithi Sridharan",
+            "github_user_id": 22791051
+        },
+        {
+            "email": "stanleycheung@google.com",
+            "github": "stanley-cheung",
+            "name": "Stanley Cheung",
+            "github_user_id": 11674202
         }
     ],
     "repository": [
diff --git a/deps/grpc/.dockerignore b/deps/grpc/.dockerignore
index 8cd0034b50c..77aaecfdee6 100644
--- a/deps/grpc/.dockerignore
+++ b/deps/grpc/.dockerignore
@@ -4,3 +4,5 @@ bazel-out
 build
 .cache
 .git
+# python virtual environments
+*/.venv*
diff --git a/deps/grpc/.gitignore b/deps/grpc/.gitignore
index e1d15f966ba..350b04cbe06 100644
--- a/deps/grpc/.gitignore
+++ b/deps/grpc/.gitignore
@@ -18,11 +18,14 @@ dist/
 htmlcov/
 py3*/
 pyb/
-python_pylint_venv/
 src/python/grpcio_*/=*
 src/python/grpcio_*/build/
 src/python/grpcio_*/LICENSE
 src/python/grpcio_status/grpc_status/google/rpc/status.proto
+.venv
+# TODO(sergiitk): conform all "named" virtual environments to .venv-*
+.venv-*
+python_pylint_venv/
 black_virtual_environment/
 isort_virtual_environment/
 
diff --git a/deps/grpc/.pylintrc b/deps/grpc/.pylintrc
index 6cf4b94c88e..006796e54ed 100644
--- a/deps/grpc/.pylintrc
+++ b/deps/grpc/.pylintrc
@@ -1,4 +1,9 @@
-[MASTER]
+[MAIN]
+load-plugins=
+	pylint.extensions.no_self_use,
+	pylint.extensions.comparison_placement,
+	pylint.extensions.redefined_variable_type,
+
 ignore=
 	src/python/grpcio/grpc/beta,
 	src/python/grpcio/grpc/framework,
@@ -49,9 +54,6 @@ disable=
 	# TODO(https://github.com/grpc/grpc/issues/261): This doesn't seem to
 	# work for now? Try with a later pylint?
 	locally-disabled,
-	# NOTE(nathaniel): What even is this? *Enabling* an inspection results
-	# in a warning? How does that encourage more analysis and coverage?
-	locally-enabled,
 	# NOTE(nathaniel): We don't write doc strings for most private code
 	# elements.
 	missing-docstring,
@@ -60,9 +62,6 @@ disable=
 	# expression is true than it is to worry about which is an identifier
 	# and which a literal value.
 	misplaced-comparison-constant,
-	# NOTE(nathaniel): Our completely abstract interface classes don't have
-	# constructors.
-	no-init,
 	# TODO(https://github.com/grpc/grpc/issues/261): Doesn't yet play
 	# nicely with some of our code being implemented in Cython. Maybe in a
 	# later version?
@@ -99,5 +98,32 @@ disable=
 	wrong-import-order,
 	# TODO(https://github.com/PyCQA/pylint/issues/3882): Upgrade Pylint
 	unsubscriptable-object,
-  # NOTE(sergiitk): yapf compatibility, ref #25071
-  bad-continuation,
+
+	# NOTE(sergiitk): From here: just to make it work with pylint==2.17.7
+	#                 Pylint will be replaced with ruff anyway.
+	# Not enforced by ruff:
+	consider-using-f-string,
+	# TODO(sergiitk): Check; should probably be caught by pytype
+	abstract-class-instantiated,
+	# TODO(sergiitk): This is broken for protobuf enums.
+	redefined-variable-type,
+	# Expect to be caught (and fixed) by ruff.
+	# https://github.com/astral-sh/ruff/issues/970
+	# pylint                              | ruff          |
+	# ----------------------------------- | ------------- |
+	f-string-without-interpolation,       # F541
+	format-string-without-interpolation,  # F541
+	no-else-raise,                        # RET506
+	no-else-continue,                     # RET507
+	super-with-arguments,                 # UP008
+	unnecessary-lambda-assignment,        # E731
+	unnecessary-dunder-call,              # PLC2801
+	import-outside-toplevel,              # PLC0415
+	broad-exception-raised,               # TRY002
+	raise-missing-from,                   # B904
+	no-self-use,                          # PLR6301
+	inconsistent-return-statements,       # RET501, RET502
+	consider-using-dict-items,            # PLC0206
+	use-dict-literal,                     # C406
+	consider-iterating-dictionary,        # SIM118
+	unspecified-encoding,                 # PLW1514
diff --git a/deps/grpc/.pylintrc-examples b/deps/grpc/.pylintrc-examples
index db73aa8eca7..6690ae3d304 100644
--- a/deps/grpc/.pylintrc-examples
+++ b/deps/grpc/.pylintrc-examples
@@ -1,4 +1,9 @@
-[MASTER]
+[MAIN]
+load-plugins=
+	pylint.extensions.no_self_use,
+	pylint.extensions.comparison_placement,
+	pylint.extensions.redefined_variable_type,
+
 ignore=
 	src/python/grpcio/grpc/beta,
 	src/python/grpcio/grpc/framework,
@@ -52,9 +57,6 @@ disable=
 	# TODO(https://github.com/grpc/grpc/issues/261): This doesn't seem to
 	# work for now? Try with a later pylint?
 	locally-disabled,
-	# NOTE(nathaniel): What even is this? *Enabling* an inspection results
-	# in a warning? How does that encourage more analysis and coverage?
-	locally-enabled,
 	# NOTE(nathaniel): We don't write doc strings for most private code
 	# elements.
 	missing-docstring,
@@ -63,9 +65,6 @@ disable=
 	# expression is true than it is to worry about which is an identifier
 	# and which a literal value.
 	misplaced-comparison-constant,
-	# NOTE(nathaniel): Our completely abstract interface classes don't have
-	# constructors.
-	no-init,
 	# TODO(https://github.com/grpc/grpc/issues/261): Doesn't yet play
 	# nicely with some of our code being implemented in Cython. Maybe in a
 	# later version?
@@ -104,5 +103,32 @@ disable=
 	unsubscriptable-object,
 	# NOTE(rbellevi): Pylint doesn't understand .pyi files.
 	no-member,
-  # NOTE(sergiitk): yapf compatibility, ref #25071
-  bad-continuation,
+
+	# NOTE(sergiitk): From here: just to make it work with pylint==2.17.7
+	#                 Pylint will be replaced with ruff anyway.
+	# Not enforced by ruff:
+	consider-using-f-string,
+	invalid-overridden-method,  # not found in main
+	# Expect to be caught (and fixed) by ruff.
+	# https://github.com/astral-sh/ruff/issues/970
+	# pylint                              | ruff          |
+	# ----------------------------------- | ------------- |
+	super-with-arguments,                 # UP008
+	raise-missing-from,                   # B904
+	unspecified-encoding,                 # PLW1514
+	# Found in examples, but not in main:
+	consider-using-with,                  # SIM115
+	# Found in main, but not in examples:
+	# f-string-without-interpolation,       # F541
+	# format-string-without-interpolation,  # F541
+	# no-else-raise,                        # RET506
+	# no-else-continue,                     # RET507
+	# unnecessary-lambda-assignment,        # E731
+	# unnecessary-dunder-call,              # PLC2801
+	# import-outside-toplevel,              # PLC0415
+	# broad-exception-raised,               # TRY002
+	# no-self-use,                          # PLR6301
+	# inconsistent-return-statements,       # RET501, RET502
+	# consider-using-dict-items,            # PLC0206
+	# use-dict-literal,                     # C406
+	# consider-iterating-dictionary,        # SIM118
diff --git a/deps/grpc/.pylintrc-tests b/deps/grpc/.pylintrc-tests
index 7e34a14d866..794e776c653 100644
--- a/deps/grpc/.pylintrc-tests
+++ b/deps/grpc/.pylintrc-tests
@@ -1,4 +1,9 @@
-[MASTER]
+[MAIN]
+load-plugins=
+	pylint.extensions.no_self_use,
+	pylint.extensions.comparison_placement,
+	pylint.extensions.redefined_variable_type,
+
 ignore=
 	src/python/grpcio_tests/tests/unit/beta,
 	src/python/grpcio_tests/tests/unit/framework,
@@ -78,9 +83,6 @@ disable=
 	# TODO(https://github.com/grpc/grpc/issues/261): This doesn't seem to
 	# work for now? Try with a later pylint?
 	locally-disabled,
-	# NOTE(nathaniel): What even is this? *Enabling* an inspection results
-	# in a warning? How does that encourage more analysis and coverage?
-	locally-enabled,
 	# NOTE(nathaniel): We don't write doc strings for most private code
 	# elements.
 	missing-docstring,
@@ -89,9 +91,6 @@ disable=
 	# expression is true than it is to worry about which is an identifier
 	# and which a literal value.
 	misplaced-comparison-constant,
-	# NOTE(nathaniel): Our completely abstract interface classes don't have
-	# constructors.
-	no-init,
 	# TODO(https://github.com/grpc/grpc/issues/261): Doesn't yet play
 	# nicely with some of our code being implemented in Cython. Maybe in a
 	# later version?
@@ -128,5 +127,34 @@ disable=
 	wrong-import-order,
 	# TODO(https://github.com/PyCQA/pylint/issues/3882): Upgrade Pylint
 	unsubscriptable-object,
-  # NOTE(sergiitk): yapf compatibility, ref #25071
-  bad-continuation,
+
+	# NOTE(sergiitk): From here: just to make it work with pylint==2.17.7
+	#                 Pylint will be replaced with ruff anyway.
+	# Not enforced by ruff:
+	consider-using-f-string,
+	# Expect to be caught (and fixed) by ruff.
+	# https://github.com/astral-sh/ruff/issues/970
+	# pylint                              | ruff          |
+	# ----------------------------------- | ------------- |
+	f-string-without-interpolation,       # F541
+	format-string-without-interpolation,  # F541
+	no-else-raise,                        # RET506
+	super-with-arguments,                 # UP008
+	unnecessary-lambda-assignment,        # E731
+	unnecessary-dunder-call,              # PLC2801
+	import-outside-toplevel,              # PLC0415
+	broad-exception-raised,               # TRY002
+	raise-missing-from,                   # B904
+	use-dict-literal,                     # C406
+	unspecified-encoding,                 # PLW1514
+	# Found in tests, but not in main:
+	consider-using-with,                  # SIM115
+	broad-exception-caught,               # BLE001
+	consider-using-in,                    # PLR1714
+	consider-using-enumerate,             # C0200
+	# Found in main, but not in tests:
+	# no-else-continue,                     # RET507
+	# no-self-use,                          # PLR6301
+	# inconsistent-return-statements,       # RET501, RET502
+	# consider-using-dict-items,            # PLC0206
+	# consider-iterating-dictionary,        # SIM118
diff --git a/deps/grpc/Makefile b/deps/grpc/Makefile
index 1166ab2dad3..3a1240532f2 100644
--- a/deps/grpc/Makefile
+++ b/deps/grpc/Makefile
@@ -367,8 +367,8 @@ E = @echo
 Q = @
 endif
 
-CORE_VERSION = 49.0.0
-CPP_VERSION = 1.74.0
+CORE_VERSION = 50.0.0
+CPP_VERSION = 1.75.0
 
 CPPFLAGS_NO_ARCH += $(addprefix -I, $(INCLUDES)) $(addprefix -D, $(DEFINES))
 CPPFLAGS += $(CPPFLAGS_NO_ARCH) $(ARCH_FLAGS)
@@ -404,7 +404,7 @@ SHARED_EXT_CORE = dll
 SHARED_EXT_CPP = dll
 
 SHARED_PREFIX =
-SHARED_VERSION_CORE = -49
+SHARED_VERSION_CORE = -50
 SHARED_VERSION_CPP = -1
 else ifeq ($(SYSTEM),Darwin)
 EXECUTABLE_SUFFIX =
@@ -685,6 +685,9 @@ LIBGRPC_SRC = \
     src/core/channelz/channelz.cc \
     src/core/channelz/channelz_registry.cc \
     src/core/channelz/property_list.cc \
+    src/core/channelz/v2tov1/convert.cc \
+    src/core/channelz/v2tov1/legacy_api.cc \
+    src/core/channelz/v2tov1/property_list.cc \
     src/core/client_channel/backup_poller.cc \
     src/core/client_channel/client_channel.cc \
     src/core/client_channel/client_channel_factory.cc \
@@ -760,6 +763,7 @@ LIBGRPC_SRC = \
     src/core/credentials/transport/tls/load_system_roots_fallback.cc \
     src/core/credentials/transport/tls/load_system_roots_supported.cc \
     src/core/credentials/transport/tls/load_system_roots_windows.cc \
+    src/core/credentials/transport/tls/spiffe_utils.cc \
     src/core/credentials/transport/tls/ssl_utils.cc \
     src/core/credentials/transport/tls/tls_credentials.cc \
     src/core/credentials/transport/tls/tls_security_connector.cc \
@@ -809,6 +813,7 @@ LIBGRPC_SRC = \
     src/core/ext/transport/chttp2/transport/hpack_parser_table.cc \
     src/core/ext/transport/chttp2/transport/http2_client_transport.cc \
     src/core/ext/transport/chttp2/transport/http2_settings.cc \
+    src/core/ext/transport/chttp2/transport/http2_settings_manager.cc \
     src/core/ext/transport/chttp2/transport/http2_stats_collector.cc \
     src/core/ext/transport/chttp2/transport/http2_transport.cc \
     src/core/ext/transport/chttp2/transport/huffsyms.cc \
@@ -953,6 +958,7 @@ LIBGRPC_SRC = \
     src/core/ext/upb-gen/google/protobuf/timestamp.upb_minitable.c \
     src/core/ext/upb-gen/google/protobuf/wrappers.upb_minitable.c \
     src/core/ext/upb-gen/google/rpc/status.upb_minitable.c \
+    src/core/ext/upb-gen/src/proto/grpc/channelz/channelz.upb_minitable.c \
     src/core/ext/upb-gen/src/proto/grpc/channelz/v2/channelz.upb_minitable.c \
     src/core/ext/upb-gen/src/proto/grpc/channelz/v2/promise.upb_minitable.c \
     src/core/ext/upb-gen/src/proto/grpc/channelz/v2/property_list.upb_minitable.c \
@@ -1118,6 +1124,7 @@ LIBGRPC_SRC = \
     src/core/ext/upbdefs-gen/google/protobuf/timestamp.upbdefs.c \
     src/core/ext/upbdefs-gen/google/protobuf/wrappers.upbdefs.c \
     src/core/ext/upbdefs-gen/google/rpc/status.upbdefs.c \
+    src/core/ext/upbdefs-gen/src/proto/grpc/channelz/channelz.upbdefs.c \
     src/core/ext/upbdefs-gen/src/proto/grpc/channelz/v2/promise.upbdefs.c \
     src/core/ext/upbdefs-gen/src/proto/grpc/channelz/v2/property_list.upbdefs.c \
     src/core/ext/upbdefs-gen/src/proto/grpc/lookup/v1/rls_config.upbdefs.c \
@@ -1154,6 +1161,7 @@ LIBGRPC_SRC = \
     src/core/filter/auth/client_auth_filter.cc \
     src/core/filter/auth/server_auth_filter.cc \
     src/core/filter/blackboard.cc \
+    src/core/filter/fused_filters.cc \
     src/core/handshaker/endpoint_info/endpoint_info_handshaker.cc \
     src/core/handshaker/handshaker.cc \
     src/core/handshaker/handshaker_registry.cc \
@@ -1162,6 +1170,7 @@ LIBGRPC_SRC = \
     src/core/handshaker/http_connect/xds_http_proxy_mapper.cc \
     src/core/handshaker/proxy_mapper_registry.cc \
     src/core/handshaker/security/legacy_secure_endpoint.cc \
+    src/core/handshaker/security/pipelined_secure_endpoint.cc \
     src/core/handshaker/security/secure_endpoint.cc \
     src/core/handshaker/security/security_handshaker.cc \
     src/core/handshaker/tcp_connect/tcp_connect_handshaker.cc \
@@ -1181,6 +1190,7 @@ LIBGRPC_SRC = \
     src/core/lib/debug/trace_flags.cc \
     src/core/lib/event_engine/ares_resolver.cc \
     src/core/lib/event_engine/cf_engine/cf_engine.cc \
+    src/core/lib/event_engine/cf_engine/cfsocket_listener.cc \
     src/core/lib/event_engine/cf_engine/cfstream_endpoint.cc \
     src/core/lib/event_engine/cf_engine/dns_service_resolver.cc \
     src/core/lib/event_engine/channel_args_endpoint_config.cc \
@@ -1385,6 +1395,7 @@ LIBGRPC_SRC = \
     src/core/load_balancing/xds/xds_cluster_manager.cc \
     src/core/load_balancing/xds/xds_override_host.cc \
     src/core/load_balancing/xds/xds_wrr_locality.cc \
+    src/core/net/socket_mutator.cc \
     src/core/plugin_registry/grpc_plugin_registry.cc \
     src/core/plugin_registry/grpc_plugin_registry_extra.cc \
     src/core/resolver/dns/c_ares/dns_resolver_ares.cc \
@@ -1861,8 +1872,8 @@ $(LIBDIR)/$(CONFIG)/libgrpc$(SHARED_VERSION_CORE).$(SHARED_EXT_CORE): $(LIBGRPC_
 ifeq ($(SYSTEM),Darwin)
 	$(Q) $(LDXX) $(LDFLAGS) -L$(LIBDIR)/$(CONFIG) -install_name $(SHARED_PREFIX)grpc$(SHARED_VERSION_CORE).$(SHARED_EXT_CORE) -dynamiclib -o $(LIBDIR)/$(CONFIG)/libgrpc$(SHARED_VERSION_CORE).$(SHARED_EXT_CORE) $(LIBGRPC_OBJS) $(LIBDIR)/$(CONFIG)/libcares.a $(OPENSSL_MERGE_LIBS) $(ZLIB_MERGE_LIBS) $(LDLIBS_SECURE) $(LDLIBS)
 else
-	$(Q) $(LDXX) $(LDFLAGS) -L$(LIBDIR)/$(CONFIG) -shared -Wl,-soname,libgrpc.so.49 -o $(LIBDIR)/$(CONFIG)/libgrpc$(SHARED_VERSION_CORE).$(SHARED_EXT_CORE) $(LIBGRPC_OBJS) $(LIBDIR)/$(CONFIG)/libcares.a $(OPENSSL_MERGE_LIBS) $(ZLIB_MERGE_LIBS) $(LDLIBS_SECURE) $(LDLIBS)
-	$(Q) ln -sf $(SHARED_PREFIX)grpc$(SHARED_VERSION_CORE).$(SHARED_EXT_CORE) $(LIBDIR)/$(CONFIG)/libgrpc$(SHARED_VERSION_CORE).so.49
+	$(Q) $(LDXX) $(LDFLAGS) -L$(LIBDIR)/$(CONFIG) -shared -Wl,-soname,libgrpc.so.50 -o $(LIBDIR)/$(CONFIG)/libgrpc$(SHARED_VERSION_CORE).$(SHARED_EXT_CORE) $(LIBGRPC_OBJS) $(LIBDIR)/$(CONFIG)/libcares.a $(OPENSSL_MERGE_LIBS) $(ZLIB_MERGE_LIBS) $(LDLIBS_SECURE) $(LDLIBS)
+	$(Q) ln -sf $(SHARED_PREFIX)grpc$(SHARED_VERSION_CORE).$(SHARED_EXT_CORE) $(LIBDIR)/$(CONFIG)/libgrpc$(SHARED_VERSION_CORE).so.50
 	$(Q) ln -sf $(SHARED_PREFIX)grpc$(SHARED_VERSION_CORE).$(SHARED_EXT_CORE) $(LIBDIR)/$(CONFIG)/libgrpc$(SHARED_VERSION_CORE).so
 endif
 endif
@@ -2194,23 +2205,15 @@ endif
 # deps: []
 # transitive_deps: []
 LIBCARES_SRC = \
-    third_party/cares/cares/src/lib/ares__addrinfo2hostent.c \
-    third_party/cares/cares/src/lib/ares__addrinfo_localhost.c \
-    third_party/cares/cares/src/lib/ares__close_sockets.c \
-    third_party/cares/cares/src/lib/ares__get_hostent.c \
-    third_party/cares/cares/src/lib/ares__parse_into_addrinfo.c \
-    third_party/cares/cares/src/lib/ares__read_line.c \
-    third_party/cares/cares/src/lib/ares__readaddrinfo.c \
-    third_party/cares/cares/src/lib/ares__sortaddrinfo.c \
-    third_party/cares/cares/src/lib/ares__timeval.c \
+    third_party/cares/cares/src/lib/ares_addrinfo2hostent.c \
+    third_party/cares/cares/src/lib/ares_addrinfo_localhost.c \
     third_party/cares/cares/src/lib/ares_android.c \
     third_party/cares/cares/src/lib/ares_cancel.c \
-    third_party/cares/cares/src/lib/ares_create_query.c \
+    third_party/cares/cares/src/lib/ares_close_sockets.c \
+    third_party/cares/cares/src/lib/ares_conn.c \
+    third_party/cares/cares/src/lib/ares_cookie.c \
     third_party/cares/cares/src/lib/ares_data.c \
     third_party/cares/cares/src/lib/ares_destroy.c \
-    third_party/cares/cares/src/lib/ares_expand_name.c \
-    third_party/cares/cares/src/lib/ares_expand_string.c \
-    third_party/cares/cares/src/lib/ares_fds.c \
     third_party/cares/cares/src/lib/ares_free_hostent.c \
     third_party/cares/cares/src/lib/ares_free_string.c \
     third_party/cares/cares/src/lib/ares_freeaddrinfo.c \
@@ -2219,47 +2222,86 @@ LIBCARES_SRC = \
     third_party/cares/cares/src/lib/ares_gethostbyaddr.c \
     third_party/cares/cares/src/lib/ares_gethostbyname.c \
     third_party/cares/cares/src/lib/ares_getnameinfo.c \
-    third_party/cares/cares/src/lib/ares_getsock.c \
+    third_party/cares/cares/src/lib/ares_hosts_file.c \
     third_party/cares/cares/src/lib/ares_init.c \
     third_party/cares/cares/src/lib/ares_library_init.c \
-    third_party/cares/cares/src/lib/ares_llist.c \
-    third_party/cares/cares/src/lib/ares_mkquery.c \
-    third_party/cares/cares/src/lib/ares_nowarn.c \
+    third_party/cares/cares/src/lib/ares_metrics.c \
     third_party/cares/cares/src/lib/ares_options.c \
-    third_party/cares/cares/src/lib/ares_parse_a_reply.c \
-    third_party/cares/cares/src/lib/ares_parse_aaaa_reply.c \
-    third_party/cares/cares/src/lib/ares_parse_caa_reply.c \
-    third_party/cares/cares/src/lib/ares_parse_mx_reply.c \
-    third_party/cares/cares/src/lib/ares_parse_naptr_reply.c \
-    third_party/cares/cares/src/lib/ares_parse_ns_reply.c \
-    third_party/cares/cares/src/lib/ares_parse_ptr_reply.c \
-    third_party/cares/cares/src/lib/ares_parse_soa_reply.c \
-    third_party/cares/cares/src/lib/ares_parse_srv_reply.c \
-    third_party/cares/cares/src/lib/ares_parse_txt_reply.c \
-    third_party/cares/cares/src/lib/ares_parse_uri_reply.c \
-    third_party/cares/cares/src/lib/ares_platform.c \
+    third_party/cares/cares/src/lib/ares_parse_into_addrinfo.c \
     third_party/cares/cares/src/lib/ares_process.c \
+    third_party/cares/cares/src/lib/ares_qcache.c \
     third_party/cares/cares/src/lib/ares_query.c \
-    third_party/cares/cares/src/lib/ares_rand.c \
     third_party/cares/cares/src/lib/ares_search.c \
     third_party/cares/cares/src/lib/ares_send.c \
-    third_party/cares/cares/src/lib/ares_strcasecmp.c \
-    third_party/cares/cares/src/lib/ares_strdup.c \
+    third_party/cares/cares/src/lib/ares_set_socket_functions.c \
+    third_party/cares/cares/src/lib/ares_socket.c \
+    third_party/cares/cares/src/lib/ares_sortaddrinfo.c \
     third_party/cares/cares/src/lib/ares_strerror.c \
-    third_party/cares/cares/src/lib/ares_strsplit.c \
+    third_party/cares/cares/src/lib/ares_sysconfig.c \
+    third_party/cares/cares/src/lib/ares_sysconfig_files.c \
+    third_party/cares/cares/src/lib/ares_sysconfig_mac.c \
+    third_party/cares/cares/src/lib/ares_sysconfig_win.c \
     third_party/cares/cares/src/lib/ares_timeout.c \
+    third_party/cares/cares/src/lib/ares_update_servers.c \
     third_party/cares/cares/src/lib/ares_version.c \
-    third_party/cares/cares/src/lib/ares_writev.c \
-    third_party/cares/cares/src/lib/bitncmp.c \
+    third_party/cares/cares/src/lib/dsa/ares_array.c \
+    third_party/cares/cares/src/lib/dsa/ares_htable.c \
+    third_party/cares/cares/src/lib/dsa/ares_htable_asvp.c \
+    third_party/cares/cares/src/lib/dsa/ares_htable_dict.c \
+    third_party/cares/cares/src/lib/dsa/ares_htable_strvp.c \
+    third_party/cares/cares/src/lib/dsa/ares_htable_szvp.c \
+    third_party/cares/cares/src/lib/dsa/ares_htable_vpstr.c \
+    third_party/cares/cares/src/lib/dsa/ares_htable_vpvp.c \
+    third_party/cares/cares/src/lib/dsa/ares_llist.c \
+    third_party/cares/cares/src/lib/dsa/ares_slist.c \
+    third_party/cares/cares/src/lib/event/ares_event_configchg.c \
+    third_party/cares/cares/src/lib/event/ares_event_epoll.c \
+    third_party/cares/cares/src/lib/event/ares_event_kqueue.c \
+    third_party/cares/cares/src/lib/event/ares_event_poll.c \
+    third_party/cares/cares/src/lib/event/ares_event_select.c \
+    third_party/cares/cares/src/lib/event/ares_event_thread.c \
+    third_party/cares/cares/src/lib/event/ares_event_wake_pipe.c \
+    third_party/cares/cares/src/lib/event/ares_event_win32.c \
     third_party/cares/cares/src/lib/inet_net_pton.c \
     third_party/cares/cares/src/lib/inet_ntop.c \
+    third_party/cares/cares/src/lib/legacy/ares_create_query.c \
+    third_party/cares/cares/src/lib/legacy/ares_expand_name.c \
+    third_party/cares/cares/src/lib/legacy/ares_expand_string.c \
+    third_party/cares/cares/src/lib/legacy/ares_fds.c \
+    third_party/cares/cares/src/lib/legacy/ares_getsock.c \
+    third_party/cares/cares/src/lib/legacy/ares_parse_a_reply.c \
+    third_party/cares/cares/src/lib/legacy/ares_parse_aaaa_reply.c \
+    third_party/cares/cares/src/lib/legacy/ares_parse_caa_reply.c \
+    third_party/cares/cares/src/lib/legacy/ares_parse_mx_reply.c \
+    third_party/cares/cares/src/lib/legacy/ares_parse_naptr_reply.c \
+    third_party/cares/cares/src/lib/legacy/ares_parse_ns_reply.c \
+    third_party/cares/cares/src/lib/legacy/ares_parse_ptr_reply.c \
+    third_party/cares/cares/src/lib/legacy/ares_parse_soa_reply.c \
+    third_party/cares/cares/src/lib/legacy/ares_parse_srv_reply.c \
+    third_party/cares/cares/src/lib/legacy/ares_parse_txt_reply.c \
+    third_party/cares/cares/src/lib/legacy/ares_parse_uri_reply.c \
+    third_party/cares/cares/src/lib/record/ares_dns_mapping.c \
+    third_party/cares/cares/src/lib/record/ares_dns_multistring.c \
+    third_party/cares/cares/src/lib/record/ares_dns_name.c \
+    third_party/cares/cares/src/lib/record/ares_dns_parse.c \
+    third_party/cares/cares/src/lib/record/ares_dns_record.c \
+    third_party/cares/cares/src/lib/record/ares_dns_write.c \
+    third_party/cares/cares/src/lib/str/ares_buf.c \
+    third_party/cares/cares/src/lib/str/ares_str.c \
+    third_party/cares/cares/src/lib/str/ares_strsplit.c \
+    third_party/cares/cares/src/lib/util/ares_iface_ips.c \
+    third_party/cares/cares/src/lib/util/ares_math.c \
+    third_party/cares/cares/src/lib/util/ares_rand.c \
+    third_party/cares/cares/src/lib/util/ares_threads.c \
+    third_party/cares/cares/src/lib/util/ares_timeval.c \
+    third_party/cares/cares/src/lib/util/ares_uri.c \
     third_party/cares/cares/src/lib/windows_port.c \
 
 
 LIBCARES_OBJS = $(addprefix $(OBJDIR)/$(CONFIG)/, $(addsuffix .o, $(basename $(LIBCARES_SRC))))
 
 $(LIBCARES_OBJS): CFLAGS += -g
-$(LIBCARES_OBJS): CPPFLAGS += -Ithird_party/cares/cares/include -Ithird_party/cares -Ithird_party/cares/cares -fvisibility=hidden -D_GNU_SOURCE $(if $(subst Darwin,,$(SYSTEM)),,-Ithird_party/cares/config_darwin) $(if $(subst FreeBSD,,$(SYSTEM)),,-Ithird_party/cares/config_freebsd) $(if $(subst Linux,,$(SYSTEM)),,-Ithird_party/cares/config_linux) $(if $(subst OpenBSD,,$(SYSTEM)),,-Ithird_party/cares/config_openbsd) -DWIN32_LEAN_AND_MEAN -D_HAS_EXCEPTIONS=0 -DNOMINMAX $(if $(subst MINGW32,,$(SYSTEM)),-DHAVE_CONFIG_H,)
+$(LIBCARES_OBJS): CPPFLAGS += -Ithird_party/cares/cares/include -Ithird_party/cares -Ithird_party/cares/cares -Ithird_party/cares/cares/src/lib/include -Ithird_party/cares/cares/src/lib -fvisibility=hidden -D_GNU_SOURCE $(if $(subst Darwin,,$(SYSTEM)),,-Ithird_party/cares/config_darwin) $(if $(subst FreeBSD,,$(SYSTEM)),,-Ithird_party/cares/config_freebsd) $(if $(subst Linux,,$(SYSTEM)),,-Ithird_party/cares/config_linux) $(if $(subst OpenBSD,,$(SYSTEM)),,-Ithird_party/cares/config_openbsd) $(if $(subst MINGW32,,$(SYSTEM)),,-Ithird_party/cares/config_windows) -DWIN32_LEAN_AND_MEAN -D_HAS_EXCEPTIONS=0 -DNOMINMAX -DHAVE_CONFIG_H
 
 # static library for "cares"
 $(LIBDIR)/$(CONFIG)/libcares.a: $(LIBCARES_OBJS)
diff --git a/deps/grpc/grpc.gyp b/deps/grpc/grpc.gyp
index c9c2804e062..d49fc9065a7 100644
--- a/deps/grpc/grpc.gyp
+++ b/deps/grpc/grpc.gyp
@@ -213,6 +213,7 @@
         'src/core/credentials/transport/tls/load_system_roots_fallback.cc',
         'src/core/credentials/transport/tls/load_system_roots_supported.cc',
         'src/core/credentials/transport/tls/load_system_roots_windows.cc',
+        'src/core/credentials/transport/tls/spiffe_utils.cc',
         'src/core/credentials/transport/tls/ssl_utils.cc',
         'src/core/credentials/transport/tls/tls_credentials.cc',
         'src/core/credentials/transport/tls/tls_security_connector.cc',
@@ -262,7 +263,9 @@
         'src/core/ext/transport/chttp2/transport/hpack_parser_table.cc',
         'src/core/ext/transport/chttp2/transport/http2_client_transport.cc',
         'src/core/ext/transport/chttp2/transport/http2_settings.cc',
+        'src/core/ext/transport/chttp2/transport/http2_settings_manager.cc',
         'src/core/ext/transport/chttp2/transport/http2_stats_collector.cc',
+        'src/core/ext/transport/chttp2/transport/http2_transport.cc',
         'src/core/ext/transport/chttp2/transport/huffsyms.cc',
         'src/core/ext/transport/chttp2/transport/keepalive.cc',
         'src/core/ext/transport/chttp2/transport/parsing.cc',
@@ -604,6 +607,7 @@
         'src/core/filter/blackboard.cc',
         'src/core/filter/auth/client_auth_filter.cc',
         'src/core/filter/auth/server_auth_filter.cc',
+        'src/core/filter/fused_filters.cc',
         'src/core/handshaker/handshaker.cc',
         'src/core/handshaker/handshaker_registry.cc',
         'src/core/handshaker/proxy_mapper_registry.cc',
@@ -612,6 +616,7 @@
         'src/core/handshaker/http_connect/http_proxy_mapper.cc',
         'src/core/handshaker/http_connect/xds_http_proxy_mapper.cc',
         'src/core/handshaker/security/legacy_secure_endpoint.cc',
+        'src/core/handshaker/security/pipelined_secure_endpoint.cc',
         'src/core/handshaker/security/secure_endpoint.cc',
         'src/core/handshaker/security/security_handshaker.cc',
         'src/core/handshaker/tcp_connect/tcp_connect_handshaker.cc',
@@ -760,6 +765,7 @@
         'src/core/lib/transport/transport.cc',
         'src/core/lib/transport/transport_op_string.cc',
         'src/core/lib/event_engine/cf_engine/cf_engine.cc',
+        'src/core/lib/event_engine/cf_engine/cfsocket_listener.cc',
         'src/core/lib/event_engine/cf_engine/cfstream_endpoint.cc',
         'src/core/lib/event_engine/cf_engine/dns_service_resolver.cc',
         'src/core/lib/event_engine/posix_engine/ev_epoll1_linux.cc',
diff --git a/deps/grpc/include/grpc/credentials.h b/deps/grpc/include/grpc/credentials.h
index f4a614d7570..eb6c06b95af 100644
--- a/deps/grpc/include/grpc/credentials.h
+++ b/deps/grpc/include/grpc/credentials.h
@@ -656,6 +656,11 @@ grpc_tls_certificate_provider_static_data_create(
  *   be null if no identity credentials are needed.
  * - root_cert_path is the file path to the root certificate bundle. This
  *   may be null if no root certs are needed.
+ * - spiffe_bundle_map_path is the file path to the SPIFFE Bundle Map. If
+ * configured, this will be used to find the roots of trust for a given SPIFFE
+ * domain during verification. See
+ *   https://github.com/grpc/proposal/blob/master/A87-mtls-spiffe-support.md for
+ * more details on SPIFFE verification.
  * - refresh_interval_sec is the refreshing interval that we will check the
  *   files for updates.
  * It does not take ownership of parameters.
@@ -663,7 +668,8 @@ grpc_tls_certificate_provider_static_data_create(
 GRPCAPI grpc_tls_certificate_provider*
 grpc_tls_certificate_provider_file_watcher_create(
     const char* private_key_path, const char* identity_certificate_path,
-    const char* root_cert_path, unsigned int refresh_interval_sec);
+    const char* root_cert_path, const char* spiffe_bundle_map_path,
+    unsigned int refresh_interval_sec);
 
 /**
  * EXPERIMENTAL API - Subject to change
diff --git a/deps/grpc/include/grpcpp/ext/otel_plugin.h b/deps/grpc/include/grpcpp/ext/otel_plugin.h
index 1e475306c28..86261153559 100644
--- a/deps/grpc/include/grpcpp/ext/otel_plugin.h
+++ b/deps/grpc/include/grpcpp/ext/otel_plugin.h
@@ -100,6 +100,15 @@ class OpenTelemetryPluginBuilder {
       kServerCallRcvdTotalCompressedMessageSizeInstrumentName =
           "grpc.server.call.rcvd_total_compressed_message_size";
 
+  /// Experimental Retry Metrics
+  static constexpr absl::string_view kClientCallRetriesInstrumentName =
+      "grpc.client.call.retries";
+  static constexpr absl::string_view
+      kClientCallTransparentRetriesInstrumentName =
+          "grpc.client.call.transparent_retries";
+  static constexpr absl::string_view kClientCallRetryDelayInstrumentName =
+      "grpc.client.call.retry_delay";
+
   OpenTelemetryPluginBuilder();
   ~OpenTelemetryPluginBuilder();
   /// If `SetMeterProvider()` is not called, no metrics are collected.
diff --git a/deps/grpc/include/grpcpp/security/tls_certificate_provider.h b/deps/grpc/include/grpcpp/security/tls_certificate_provider.h
index 7912e4ccd26..d85785c17a9 100644
--- a/deps/grpc/include/grpcpp/security/tls_certificate_provider.h
+++ b/deps/grpc/include/grpcpp/security/tls_certificate_provider.h
@@ -109,19 +109,27 @@ class GRPCXX_DLL FileWatcherCertificateProvider final
   FileWatcherCertificateProvider(const std::string& private_key_path,
                                  const std::string& identity_certificate_path,
                                  const std::string& root_cert_path,
+                                 const std::string& spiffe_bundle_map_path,
                                  unsigned int refresh_interval_sec);
   // Constructor to get credential updates from identity file paths only.
   FileWatcherCertificateProvider(const std::string& private_key_path,
                                  const std::string& identity_certificate_path,
                                  unsigned int refresh_interval_sec)
       : FileWatcherCertificateProvider(private_key_path,
-                                       identity_certificate_path, "",
+                                       identity_certificate_path, "", "",
                                        refresh_interval_sec) {}
   // Constructor to get credential updates from root file path only.
   FileWatcherCertificateProvider(const std::string& root_cert_path,
                                  unsigned int refresh_interval_sec)
-      : FileWatcherCertificateProvider("", "", root_cert_path,
+      : FileWatcherCertificateProvider("", "", root_cert_path, "",
                                        refresh_interval_sec) {}
+  FileWatcherCertificateProvider(const std::string& private_key_path,
+                                 const std::string& identity_certificate_path,
+                                 const std::string& root_cert_path,
+                                 unsigned int refresh_interval_sec)
+      : FileWatcherCertificateProvider(
+            private_key_path, identity_certificate_path, root_cert_path, "",
+            refresh_interval_sec) {}
 
   ~FileWatcherCertificateProvider() override;
 
diff --git a/deps/grpc/include/grpcpp/version_info.h b/deps/grpc/include/grpcpp/version_info.h
index f48859926a1..1a36ef173b0 100644
--- a/deps/grpc/include/grpcpp/version_info.h
+++ b/deps/grpc/include/grpcpp/version_info.h
@@ -19,9 +19,9 @@
 #define GRPCPP_VERSION_INFO_H
 
 #define GRPC_CPP_VERSION_MAJOR 1
-#define GRPC_CPP_VERSION_MINOR 74
+#define GRPC_CPP_VERSION_MINOR 75
 #define GRPC_CPP_VERSION_PATCH 0
 #define GRPC_CPP_VERSION_TAG ""
-#define GRPC_CPP_VERSION_STRING "1.74.0"
+#define GRPC_CPP_VERSION_STRING "1.75.0"
 
 #endif  // GRPCPP_VERSION_INFO_H
diff --git a/deps/grpc/src/core/BUILD b/deps/grpc/src/core/BUILD
index da365d2ec67..adbe7b77cc9 100644
--- a/deps/grpc/src/core/BUILD
+++ b/deps/grpc/src/core/BUILD
@@ -12,8 +12,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+load("@bazel_skylib//lib:selects.bzl", "selects")
 load(
     "//bazel:grpc_build_system.bzl",
+    "grpc_add_well_known_proto_upb_targets",
     "grpc_cc_library",
     "grpc_cc_proto_library",
     "grpc_generate_one_off_internal_targets",
@@ -32,8 +34,18 @@ package(
 )
 
 config_setting(
-    name = "enable_latent_see",
-    values = {"define": "GRPC_ENABLE_LATENT_SEE=1"},
+    name = "disable_latent_see",
+    values = {"define": "GRPC_LATENT_SEE=none"},
+)
+
+config_setting(
+    name = "extra_latent_see",
+    values = {"define": "GRPC_LATENT_SEE=extra"},
+)
+
+config_setting(
+    name = "default_latent_see",
+    values = {"define": "GRPC_LATENT_SEE=default"},
 )
 
 config_setting(
@@ -59,6 +71,19 @@ config_setting(
     values = {"define": "GRPC_MINIMIZE_THREADYNESS=1"},
 )
 
+config_setting(
+    name = "grpc_no_filter_fusion_define",
+    values = {"define": "grpc_no_filter_fusion=true"},
+)
+
+selects.config_setting_group(
+    name = "grpc_no_filter_fusion",
+    match_any = [
+        ":grpc_no_filter_fusion_define",  # --define=grpc_no_filter_fusion=true
+        "//:grpc_small_clients",
+    ],
+)
+
 grpc_cc_library(
     name = "channel_fwd",
     hdrs = [
@@ -194,7 +219,9 @@ grpc_cc_library(
         "util/latent_see.h",
     ],
     defines = select({
-        ":enable_latent_see": ["GRPC_ENABLE_LATENT_SEE"],
+        ":disable_latent_see": ["GRPC_DISABLE_LATENT_SEE"],
+        ":extra_latent_see": ["GRPC_EXTRA_LATENT_SEE"],
+        ":default_latent_see": [],
         "//conditions:default": [],
     }),
     external_deps = [
@@ -204,12 +231,14 @@ grpc_cc_library(
         "absl/log",
         "absl/strings",
         "absl/strings:str_format",
+        "absl/container:flat_hash_map",
+        "absl/time",
     ],
     visibility = ["//bazel:latent_see"],
     deps = [
-        "per_cpu",
-        "ring_buffer",
+        "notification",
         "sync",
+        "//:backoff",
         "//:gpr",
     ],
 )
@@ -688,6 +717,7 @@ grpc_cc_library(
     public_hdrs = [
         "lib/promise/poll.h",
     ],
+    visibility = ["//bazel:core_credentials"],
     deps = [
         "construct_destruct",
         "//:gpr_platform",
@@ -1681,6 +1711,7 @@ grpc_cc_library(
     ],
     deps = [
         "activity",
+        "channelz_property_list",
         "event_engine_memory_allocator",
         "exec_ctx_wakeup_scheduler",
         "experiments",
@@ -1694,6 +1725,7 @@ grpc_cc_library(
         "sync",
         "time",
         "useful",
+        "//:channelz",
         "//:gpr",
         "//:grpc_trace",
         "//:orphanable",
@@ -1794,10 +1826,13 @@ grpc_cc_library(
     ],
     deps = [
         "memory_quota",
+        "no_destruct",
         "ref_counted",
+        "single_set_ptr",
         "thread_quota",
         "useful",
         "//:channel_arg_names",
+        "//:channelz",
         "//:cpp_impl_of",
         "//:event_engine_base_hdrs",
         "//:gpr_platform",
@@ -1947,6 +1982,7 @@ grpc_cc_library(
         "absl/log:check",
         "absl/strings:str_format",
     ],
+    visibility = ["//bazel:core_credentials"],
     deps = [
         "no_destruct",
         "time_precise",
@@ -2330,6 +2366,7 @@ grpc_cc_library(
         "absl/status",
     ],
     deps = [
+        "event_engine_thread_pool",
         "gpr_atm",
         "posix_event_engine_closure",
         "posix_event_engine_event_poller",
@@ -2438,6 +2475,7 @@ grpc_cc_library(
     ],
     deps = [
         "event_engine_poller",
+        "event_engine_thread_pool",
         "event_engine_time_util",
         "iomgr_port",
         "posix_event_engine_closure",
@@ -2478,6 +2516,7 @@ grpc_cc_library(
     deps = [
         "common_event_engine_closures",
         "event_engine_poller",
+        "event_engine_thread_pool",
         "event_engine_time_util",
         "iomgr_port",
         "posix_event_engine_closure",
@@ -2945,11 +2984,13 @@ grpc_cc_library(
     name = "cf_event_engine",
     srcs = [
         "lib/event_engine/cf_engine/cf_engine.cc",
+        "lib/event_engine/cf_engine/cfsocket_listener.cc",
         "lib/event_engine/cf_engine/cfstream_endpoint.cc",
         "lib/event_engine/cf_engine/dns_service_resolver.cc",
     ],
     hdrs = [
         "lib/event_engine/cf_engine/cf_engine.h",
+        "lib/event_engine/cf_engine/cfsocket_listener.h",
         "lib/event_engine/cf_engine/cfstream_endpoint.h",
         "lib/event_engine/cf_engine/cftype_unique_ref.h",
         "lib/event_engine/cf_engine/dns_service_resolver.h",
@@ -3293,11 +3334,13 @@ grpc_cc_library(
     name = "socket_mutator",
     srcs = [
         "lib/iomgr/socket_mutator.cc",
+        "net/socket_mutator.cc",
     ],
     hdrs = [
         "lib/iomgr/socket_mutator.h",
+        "net/socket_mutator.h",
     ],
-    visibility = ["//bazel:alt_grpc_base_legacy"],
+    visibility = ["//bazel:socket_mutator"],
     deps = [
         "channel_args",
         "useful",
@@ -3620,6 +3663,37 @@ grpc_cc_library(
     ],
 )
 
+grpc_cc_library(
+    name = "fused_filters",
+    srcs = [
+        "filter/fused_filters.cc",
+    ],
+    defines = select({
+        ":grpc_no_filter_fusion": ["GRPC_NO_FILTER_FUSION"],
+        "//conditions:default": [],
+    }),
+    select_deps = [{
+        ":grpc_no_filter_fusion": [],
+        "//conditions:default": [
+            "experiments",
+            "filter_fusion",
+            "grpc_authorization_base",
+            "grpc_client_authority_filter",
+            "grpc_lb_policy_grpclb",
+            "grpc_message_size_filter",
+            "server_call_tracer_filter",
+            "service_config_channel_arg_filter",
+            "//:grpc_http_filters",
+            "//:grpc_security_base",
+        ],
+    }],
+    deps = [
+        "//:config",
+        "//:gpr",
+        "//:grpc_public_hdrs",
+    ],
+)
+
 grpc_cc_library(
     name = "subchannel_connector",
     hdrs = [
@@ -3832,6 +3906,7 @@ grpc_cc_library(
     srcs = [
         "service_config/service_config_channel_arg_filter.cc",
     ],
+    hdrs = ["service_config/service_config_channel_arg_filter.h"],
     external_deps = [
         "absl/log",
         "absl/status",
@@ -4638,9 +4713,11 @@ grpc_cc_library(
         "error",
         "iomgr_fwd",
         "load_file",
+        "match",
         "ref_counted",
         "slice",
         "slice_refcount",
+        "spiffe_utils",
         "ssl_key_logging",
         "ssl_transport_security_utils",
         "status_helper",
@@ -4713,6 +4790,7 @@ grpc_cc_library(
         "absl/functional:any_invocable",
         "absl/status:statusor",
     ],
+    visibility = ["//bazel:core_credentials"],
     deps = [
         "arena_promise",
         "context",
@@ -5792,6 +5870,7 @@ grpc_cc_library(
     deps = [
         "certificate_provider_factory",
         "down_cast",
+        "env",
         "grpc_tls_credentials",
         "json",
         "json_args",
@@ -6775,6 +6854,7 @@ grpc_cc_library(
         "absl/functional:function_ref",
         "absl/log",
         "absl/log:check",
+        "absl/random",
         "absl/status",
         "absl/status:statusor",
     ],
@@ -6782,12 +6862,14 @@ grpc_cc_library(
         "channel_args",
         "delegating_helper",
         "down_cast",
+        "experiments",
         "grpc_lb_policy_pick_first",
         "json",
         "lb_policy",
         "lb_policy_registry",
         "pollset_set",
         "resolved_address",
+        "shared_bit_gen",
         "subchannel_interface",
         "//:config",
         "//:debug_location",
@@ -7842,6 +7924,7 @@ grpc_cc_library(
         "channelz_property_list",
         "experiments",
         "http2_settings",
+        "http2_settings_manager",
         "memory_quota",
         "time",
         "useful",
@@ -7968,6 +8051,35 @@ grpc_cc_library(
         "channelz_property_list",
         "http2_status",
         "useful",
+        "//:gpr_platform",
+    ],
+)
+
+grpc_cc_library(
+    name = "http2_settings_manager",
+    srcs = [
+        "ext/transport/chttp2/transport/http2_settings_manager.cc",
+    ],
+    hdrs = [
+        "ext/transport/chttp2/transport/http2_settings_manager.h",
+    ],
+    external_deps = [
+        "absl/functional:function_ref",
+        "absl/log:check",
+        "absl/log",
+        "absl/strings",
+    ],
+    deps = [
+        "channel_args",
+        "channelz_property_list",
+        "http2_settings",
+        "http2_status",
+        "poll",
+        "race",
+        "sleep",
+        "time",
+        "try_seq",
+        "useful",
         "//:chttp2_frame",
         "//:gpr_platform",
     ],
@@ -8064,8 +8176,10 @@ grpc_cc_library(
     ],
     deps = [
         "arena",
+        "header_assembler",
         "http2_status",
         "message",
+        "message_assembler",
         "metadata_batch",
     ],
 )
@@ -8096,6 +8210,7 @@ grpc_cc_library(
         "grpc_promise_endpoint",
         "header_assembler",
         "http2_settings",
+        "http2_settings_manager",
         "http2_status",
         "http2_transport",
         "inter_activity_mutex",
@@ -8110,8 +8225,10 @@ grpc_cc_library(
         "metadata_batch",
         "mpsc",
         "ping_promise",
+        "stream_data_queue",
         "sync",
         "transport_common",
+        "writable_streams",
         ":match_promise",
         ":poll",
         ":slice",
@@ -8153,6 +8270,7 @@ grpc_cc_library(
         "check_class_size",
         "grpc_promise_endpoint",
         "http2_settings",
+        "http2_settings_manager",
         "http2_status",
         "loop",
         "map",
@@ -8229,6 +8347,7 @@ grpc_cc_library(
         "http2_settings",
         "loop",
         "map",
+        "metadata_info",
         "mpsc",
         "sync",
         ":match_promise",
@@ -9749,11 +9868,13 @@ grpc_cc_library(
         "call_filters",
         "call_final_info",
         "channel_args",
+        "gpr_manual_constructor",
         "metadata",
         "status_helper",
         "type_list",
         "//:grpc_base",
         "//:grpc_public_hdrs",
+        "//:promise",
     ],
 )
 
@@ -9950,6 +10071,22 @@ grpc_cc_library(
     ],
 )
 
+grpc_cc_library(
+    name = "auth_context_comparator_registry",
+    hdrs = [
+        "transport/auth_context_comparator_registry.h",
+    ],
+    external_deps = [
+        "absl/functional:any_invocable",
+        "absl/strings",
+    ],
+    visibility = ["//transport_auth_context:__subpackages__"],
+    deps = [
+        "channel_args",
+        "//:grpc_public_hdrs",
+    ],
+)
+
 grpc_cc_library(
     name = "endpoint_transport_client_channel_factory",
     srcs = [
@@ -10055,6 +10192,38 @@ grpc_cc_library(
     ],
 )
 
+grpc_cc_library(
+    name = "instrument",
+    srcs = [
+        "telemetry/instrument.cc",
+    ],
+    hdrs = [
+        "telemetry/instrument.h",
+    ],
+    external_deps = [
+        "absl/base:core_headers",
+        "absl/functional:any_invocable",
+        "absl/functional:function_ref",
+        "absl/log:check",
+        "absl/log",
+        "absl/strings",
+        "absl/types:span",
+        "absl/container:flat_hash_set",
+        "absl/container:flat_hash_map",
+        "absl/container:node_hash_map",
+        "absl/hash",
+    ],
+    deps = [
+        "avl",
+        "match",
+        "per_cpu",
+        "ref_counted",
+        "sync",
+        "//:gpr",
+        "//:ref_counted_ptr",
+    ],
+)
+
 grpc_cc_library(
     name = "wait_for_single_owner",
     srcs = ["util/wait_for_single_owner.cc"],
@@ -10337,6 +10506,9 @@ grpc_cc_library(
         "channelz/zviz/layout.cc",
     ],
     hdrs = ["channelz/zviz/layout.h"],
+    external_deps = [
+        "absl/strings",
+    ],
     deps = [
         "zviz_environment",
         "//src/proto/grpc/channelz/v2:channelz_cc_proto",
@@ -10384,6 +10556,17 @@ grpc_cc_library(
     ],
 )
 
+grpc_cc_library(
+    name = "zviz_style",
+    srcs = [
+        "channelz/zviz/style.cc",
+    ],
+    hdrs = ["channelz/zviz/style.h"],
+    external_deps = [
+        "absl/strings:string_view",
+    ],
+)
+
 grpc_cc_library(
     name = "zviz_entity",
     srcs = [
@@ -10400,6 +10583,7 @@ grpc_cc_library(
         "zviz_environment",
         "zviz_layout",
         "zviz_strings",
+        "zviz_style",
         "zviz_trace",
         "//src/proto/grpc/channelz/v2:channelz_cc_proto",
     ],
@@ -10417,6 +10601,7 @@ grpc_cc_library(
         "absl/strings:string_view",
         "absl/types:span",
         "absl/functional:function_ref",
+        "absl/log:check",
     ],
 )
 
@@ -10440,6 +10625,94 @@ grpc_cc_library(
     ],
 )
 
+grpc_cc_library(
+    name = "channelz_v2tov1_property_list",
+    srcs = ["channelz/v2tov1/property_list.cc"],
+    hdrs = ["channelz/v2tov1/property_list.h"],
+    external_deps = [
+        "absl/strings:string_view",
+        "@com_google_protobuf//upb/mem",
+    ],
+    deps = [
+        ":upb_utils",
+        "//:channelz_property_list_upb",
+        "//:protobuf_any_upb",
+        "//:protobuf_duration_upb",
+        "//:protobuf_timestamp_upb",
+    ],
+)
+
+grpc_cc_library(
+    name = "channelz_v2tov1_convert",
+    srcs = ["channelz/v2tov1/convert.cc"],
+    hdrs = ["channelz/v2tov1/convert.h"],
+    external_deps = [
+        "absl/cleanup",
+        "absl/status",
+        "absl/status:statusor",
+        "absl/strings",
+        "@com_google_protobuf//upb/base",
+        "@com_google_protobuf//upb/mem",
+        "@com_google_protobuf//upb/json",
+        "@com_google_protobuf//upb/reflection",
+    ],
+    deps = [
+        "json",
+        "json_writer",
+        ":channelz_v2tov1_property_list",
+        ":protobuf_wrappers_upb",
+        ":upb_utils",
+        "//:channelz_property_list_upb",
+        "//:channelz_upb",
+        "//:channelz_v1_upb",
+        "//:channelz_v1_upbdefs",
+        "//:parse_address",
+        "//:protobuf_any_upb",
+        "//:protobuf_duration_upb",
+        "//:protobuf_timestamp_upb",
+        "//:protobuf_wrappers_upb",
+        "//:sockaddr_utils",
+        "//:uri",
+    ],
+)
+
+grpc_cc_library(
+    name = "channelz_v2tov1_legacy_api",
+    srcs = ["channelz/v2tov1/legacy_api.cc"],
+    hdrs = ["channelz/v2tov1/legacy_api.h"],
+    external_deps = [
+        "absl/log",
+        "absl/status:statusor",
+        "absl/strings",
+    ],
+    deps = [
+        ":channelz_v2tov1_convert",
+        ":experiments",
+        ":json",
+        ":json_reader",
+        ":json_writer",
+        "//:channelz",
+        "//:exec_ctx",
+        "//:gpr",
+        "//:grpc_public_hdrs",
+    ],
+)
+
+grpc_cc_library(
+    name = "writable_streams",
+    hdrs = ["ext/transport/chttp2/transport/writable_streams.h"],
+    external_deps = [
+        "absl/log",
+        "absl/log:check",
+    ],
+    deps = [
+        "if",
+        "mpsc",
+        "race",
+        "try_seq",
+    ],
+)
+
 ### UPB Targets
 
 grpc_upb_proto_library(
@@ -10767,20 +11040,6 @@ WELL_KNOWN_PROTO_TARGETS = [
     "wrappers",
 ]
 
-[
-    grpc_upb_proto_library(
-        name = "protobuf_" + target + "_upb",
-        deps = ["@com_google_protobuf//:" + target + "_proto"],
-    )
-    for target in WELL_KNOWN_PROTO_TARGETS
-]
-
-[
-    grpc_upb_proto_reflection_library(
-        name = "protobuf_" + target + "_upbdefs",
-        deps = ["@com_google_protobuf//:" + target + "_proto"],
-    )
-    for target in WELL_KNOWN_PROTO_TARGETS
-]
+grpc_add_well_known_proto_upb_targets(targets = WELL_KNOWN_PROTO_TARGETS)
 
 grpc_generate_one_off_internal_targets()
diff --git a/deps/grpc/src/core/GEMINI.md b/deps/grpc/src/core/GEMINI.md
new file mode 100644
index 00000000000..61df41a3159
--- /dev/null
+++ b/deps/grpc/src/core/GEMINI.md
@@ -0,0 +1,45 @@
+# gRPC Core Architecture
+
+This document provides a high-level overview of the gRPC Core architecture. gRPC Core is a library written in C++ that provides a portable and performant implementation of the gRPC protocol.
+
+## Core Concepts
+
+The gRPC Core is built around a few key concepts:
+
+*   **Channels and Calls**: A **channel** represents a connection to a gRPC service, while a **call** represents a single RPC. The [`call`](./call/GEMINI.md) directory contains the fundamental data structures for managing a call's lifecycle.
+*   **Transports**: A **transport** is responsible for sending and receiving data over the network. gRPC Core supports several transports, including CHTTP2, in-process, and an experimental "Chaotic Good" transport. See the [`transport`](./transport/GEMINI.md) and [`ext/transport`](./ext/transport/GEMINI.md) directories for more information.
+*   **Filters**: **Filters** are a mechanism for intercepting and modifying RPCs. They are used to implement a wide variety of features, including authentication, compression, and retry. See the [`filter`](./filter/GEMINI.md) and [`ext/filters`](./ext/filters/GEMINI.md) directories for more information.
+*   **Promises**: **Promises** are a framework for asynchronous programming. They are used extensively throughout the gRPC Core to implement non-blocking I/O and other asynchronous operations. See the [`lib/promise`](./lib/promise/GEMINI.md) directory for more information.
+*   **Event Engine**: The **Event Engine** is an abstraction layer that provides a consistent interface to the underlying operating system's I/O and threading primitives. See the [`lib/event_engine`](./lib/event_engine/GEMINI.md) directory for more information.
+
+## Coding Style
+
+*   **No Exceptions**: gRPC Core code does not use C++ exceptions. Functions should return an error code to indicate failure. Possible error types:
+    - bool - if the error is success or failure for a simple function, this is simple and efficient
+    - absl::Status, absl::StatusOr - a good fallback for cross layer code
+    - StatusFlag (in src/core/lib/promise) - a boolean that is recognizable as an error condition by the promise library; the same library provides ValueOrError that fills the role of StatusOr for this type
+    - It's ok and recommended to write a bespoke error type if your failures don't fit the above mold. It's strongly recommended to provide a mechanism to reduce custom errors to absl::Status for portability between layers.
+
+## Directory Structure
+
+The gRPC Core is organized into the following directories:
+
+*   [`call`](./call/GEMINI.md): The heart of the gRPC C++ core, defining the fundamental data structures for an RPC.
+*   [`channelz`](./channelz/GEMINI.md): A system for inspecting the state of gRPC channels.
+*   [`client_channel`](./client_channel/GEMINI.md): The core implementation of the client-side channel, including name resolution, load balancing, and connectivity.
+*   [`config`](./config/GEMINI.md): Manages static and dynamic configuration of the gRPC Core.
+*   [`credentials`](./credentials/GEMINI.md): The core implementation of gRPC's credential system.
+*   [`ext`](./ext/GEMINI.md): Contains extensions to the gRPC Core, including filters and transports.
+*   [`filter`](./filter/GEMINI.md): The fundamental building blocks for the gRPC channel filter mechanism.
+*   [`handshaker`](./handshaker/GEMINI.md): A framework for establishing a secure connection between a client and a server.
+*   [`lib`](./lib/GEMINI.md): A collection of libraries that provide common functionality, such as data structures, memory management, and platform-specific code.
+*   [`load_balancing`](./load_balancing/GEMINI.md): A flexible and extensible framework for load balancing.
+*   [`plugin_registry`](./plugin_registry/GEMINI.md): The main entry point for configuring the gRPC Core library.
+*   [`resolver`](./resolver/GEMINI.md): A pluggable mechanism for resolving a logical name into a list of network addresses.
+*   [`server`](./server/GEMINI.md): The core implementation of the gRPC server.
+*   [`service_config`](./service_config/GEMINI.md): A mechanism for per-service and per-method configuration of a gRPC channel.
+*   [`telemetry`](./telemetry/GEMINI.md): A system for collecting and reporting metrics about the behavior of gRPC.
+*   [`transport`](./transport/GEMINI.md): The core transport abstraction for gRPC.
+*   [`tsi`](./tsi/GEMINI.md): An abstraction for different transport security mechanisms like TLS and ALTS.
+*   [`util`](./util/GEMINI.md): A collection of utility classes and functions.
+*   [`xds`](./xds/GEMINI.md): An implementation of the xDS APIs, which allow a gRPC client or server to discover and configure itself dynamically.
diff --git a/deps/grpc/src/core/call/GEMINI.md b/deps/grpc/src/core/call/GEMINI.md
new file mode 100644
index 00000000000..1ed0780c00e
--- /dev/null
+++ b/deps/grpc/src/core/call/GEMINI.md
@@ -0,0 +1,34 @@
+# gRPC Core Call
+
+This directory is the heart of the gRPC C++ core, defining the fundamental data structures and mechanisms for representing and managing a single RPC.
+
+See also: [gRPC Core overview](../GEMINI.md)
+
+## Overarching Purpose
+
+The code in this directory provides the client and server-side representations of a call, the central "spine" that connects them, and the various components needed to manage the lifecycle of an RPC, including metadata, messages, and status.
+
+## Core Concepts
+
+*   **`CallSpine`**: The `CallSpine` is the central component of a gRPC call. It encapsulates the call's context, including the arena allocator, call filters, and the pipes for message and metadata communication. The `CallSpine` is shared between a `CallInitiator` (the client-side) and a `CallHandler` (the server-side).
+*   **`CallInitiator`**: The `CallInitiator` is the client-side view of a call. It is used for initiating requests and receiving responses.
+*   **`CallHandler`**: The `CallHandler` is the server-side view of a call. It is used for handling incoming requests and sending responses.
+*   **`ClientCall`**: The `ClientCall` is the public client-side API for a call. It wraps the `CallInitiator` and `CallSpine`.
+*   **`ServerCall`**: The `ServerCall` is the public server-side API for a call. It wraps the `CallHandler` and `CallSpine`.
+
+## Files
+
+*   **`call_spine.h`, `call_spine.cc`**: These files define the `CallSpine` class.
+*   **`client_call.h`, `client_call.cc`**: These files define the `ClientCall` class.
+*   **`server_call.h`, `server_call.cc`**: These files define the `ServerCall` class.
+*   **`metadata.h`, `metadata_batch.h`**: These files provide the data structures for representing and manipulating RPC metadata.
+*   **`message.h`**: Defines the `Message` class, which is a container for RPC messages.
+*   **`call_filters.h`, `call_filters.cc`**: These files define the `CallFilters` class, which is responsible for managing the filters for a call.
+*   **`interception_chain.h`, `interception_chain.cc`**: These files define the `InterceptionChain` class, which is used to manage the execution of a set of interceptors.
+
+## Notes
+
+*   The `CallSpine` is the key abstraction to understand in this directory. It's the "glue" that holds a call together.
+*   The use of `CallInitiator` and `CallHandler` provides a clean separation of concerns between the client and server sides of a call.
+*   This directory is heavily based on the [gRPC Core Promise API](../lib/promise/GEMINI.md). Familiarity with that API is essential for understanding the code here.
+*   The `CallFilters` class is responsible for managing the filters for a call. See the [channel documentation](../lib/channel/GEMINI.md) for more information about filters.
diff --git a/deps/grpc/src/core/call/client_call.cc b/deps/grpc/src/core/call/client_call.cc
index 089199be797..0c106685578 100644
--- a/deps/grpc/src/core/call/client_call.cc
+++ b/deps/grpc/src/core/call/client_call.cc
@@ -127,7 +127,7 @@ ClientCall::ClientCall(grpc_call*, uint32_t, grpc_completion_queue* cq,
 grpc_call_error ClientCall::StartBatch(const grpc_op* ops, size_t nops,
                                        void* notify_tag,
                                        bool is_notify_tag_closure) {
-  GRPC_LATENT_SEE_PARENT_SCOPE("ClientCall::StartBatch");
+  GRPC_LATENT_SEE_SCOPE("ClientCall::StartBatch");
   if (nops == 0) {
     EndOpImmediately(cq_, notify_tag, is_notify_tag_closure);
     return GRPC_CALL_OK;
@@ -183,7 +183,7 @@ void ClientCall::CancelWithError(grpc_error_handle error) {
 
 template <typename Batch>
 void ClientCall::ScheduleCommittedBatch(Batch batch) {
-  GRPC_LATENT_SEE_INNER_SCOPE("ClientCall::ScheduleCommittedBatch");
+  GRPC_LATENT_SEE_SCOPE("ClientCall::ScheduleCommittedBatch");
   auto cur_state = call_state_.load(std::memory_order_acquire);
   while (true) {
     switch (cur_state) {
@@ -226,7 +226,7 @@ void ClientCall::ScheduleCommittedBatch(Batch batch) {
 
 Party::WakeupHold ClientCall::StartCall(
     const grpc_op& send_initial_metadata_op) {
-  GRPC_LATENT_SEE_INNER_SCOPE("ClientCall::StartCall");
+  GRPC_LATENT_SEE_SCOPE("ClientCall::StartCall");
   auto cur_state = call_state_.load(std::memory_order_acquire);
   CToMetadata(send_initial_metadata_op.data.send_initial_metadata.metadata,
               send_initial_metadata_op.data.send_initial_metadata.count,
@@ -279,7 +279,7 @@ bool ClientCall::StartCallMaybeUpdateState(uintptr_t& cur_state,
 
 void ClientCall::CommitBatch(const grpc_op* ops, size_t nops, void* notify_tag,
                              bool is_notify_tag_closure) {
-  GRPC_LATENT_SEE_INNER_SCOPE("ClientCall::CommitBatch");
+  GRPC_LATENT_SEE_SCOPE("ClientCall::CommitBatch");
   if (nops == 1 && ops[0].op == GRPC_OP_SEND_INITIAL_METADATA) {
     StartCall(ops[0]);
     EndOpImmediately(cq_, notify_tag, is_notify_tag_closure);
diff --git a/deps/grpc/src/core/call/filter_fusion.h b/deps/grpc/src/core/call/filter_fusion.h
index 555f4338b7d..9afdf11c48b 100644
--- a/deps/grpc/src/core/call/filter_fusion.h
+++ b/deps/grpc/src/core/call/filter_fusion.h
@@ -32,8 +32,10 @@
 #include "src/core/call/metadata.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/lib/promise/promise.h"
 #include "src/core/lib/transport/call_final_info.h"
 #include "src/core/lib/transport/transport.h"
+#include "src/core/util/manual_constructor.h"
 #include "src/core/util/status_helper.h"
 #include "src/core/util/type_list.h"
 
@@ -240,6 +242,9 @@ struct HasStatusMethod<
   static constexpr bool value = true;
 };
 
+template <typename T>
+constexpr bool IsPromise = std::is_invocable_v<T>;
+
 // For types T which are of the form StatusOr<U>. Type TakeValue on Type T
 // must return a value of type U. Further type T must have a method called
 // status() and must return a bool when IsStatusOk is called on an object of
@@ -353,7 +358,7 @@ class AdaptMethod<T, R (Call::*)(), method,
                   absl::enable_if_t<StatusOrType<R, T>::value, void>> {
  public:
   explicit AdaptMethod(Call* call, void* /*filter*/ = nullptr) : call_(call) {}
-  auto operator()(Hdl<T> x) {
+  auto operator()(Hdl<T> /*x*/) {
     R result = (call_->*method)();
     if (IsStatusOk(result)) {
       return Immediate(
@@ -455,6 +460,74 @@ class AdaptMethod<T, R (Call::*)(Hdl<T>, Derived*), method,
   Derived* filter_;
 };
 
+// For methods which return a promise where the result of the promise
+template <typename T, typename R, typename Call, typename Derived,
+          R (Call::*method)(Hdl<T>, Derived*)>
+class AdaptMethod<
+    T, R (Call::*)(Hdl<T>, Derived*), method,
+    std::enable_if_t<IsPromise<R> && std::is_same_v<PromiseResult<R>,
+                                                    absl::StatusOr<Hdl<T>>>,
+                     void>> {
+ public:
+  explicit AdaptMethod(Call* call, Derived* filter)
+      : call_(call), filter_(filter) {}
+  auto operator()(Hdl<T> x) {
+    return Map((call_->*method)(std::move(x), filter_),
+               [](absl::StatusOr<Hdl<T>> result) {
+                 if (result.ok()) {
+                   return ServerMetadataOrHandle<T>::Ok(std::move(*result));
+                 }
+                 return ServerMetadataOrHandle<T>::Failure(
+                     ServerMetadataFromStatus(result.status()));
+               });
+  }
+
+ private:
+  Call* call_;
+  Derived* filter_;
+};
+
+template <typename T, typename R, typename Call, typename Derived,
+          R (Call::*method)(T&, Derived*)>
+class AdaptMethod<
+    T, R (Call::*)(T&, Derived*), method,
+    std::enable_if_t<
+        IsPromise<R> && std::is_same_v<absl::Status, PromiseResult<R>>, void>> {
+ public:
+  explicit AdaptMethod(Call* call, Derived* filter)
+      : call_(call), filter_(filter) {}
+  auto operator()(Hdl<T> x) {
+    return Map((call_->*method)(*x, filter_),
+               [hdl = std::move(x)](absl::Status status) mutable {
+                 if (status.ok()) {
+                   return ServerMetadataOrHandle<T>::Ok(std::move(hdl));
+                 }
+                 return ServerMetadataOrHandle<T>::Failure(
+                     ServerMetadataFromStatus(status));
+               });
+  }
+
+ private:
+  Call* call_;
+  Derived* filter_;
+};
+
+template <typename T, typename Call, typename Derived,
+          Hdl<T> (Call::*method)(Hdl<T>, Derived*)>
+class AdaptMethod<T, Hdl<T> (Call::*)(Hdl<T>, Derived*), method> {
+ public:
+  explicit AdaptMethod(Call* call, Derived* filter)
+      : call_(call), filter_(filter) {}
+  auto operator()(Hdl<T> x) {
+    Hdl<T> result = (call_->*method)(std::move(x), filter_);
+    return Immediate(ServerMetadataOrHandle<T>::Ok(std::move(result)));
+  }
+
+ private:
+  Call* call_;
+  Derived* filter_;
+};
+
 // Overrides for filter methods which return a ServerMetadataHandle type as
 // output.
 template <typename T, typename A, typename Call,
@@ -523,7 +596,7 @@ class AdaptOnServerTrailingMetadataMethod<T, const NoInterceptor*, method> {
  public:
   explicit AdaptOnServerTrailingMetadataMethod(void* /*call*/,
                                                void* /*filter*/ = nullptr) {}
-  auto operator()(T& x) {}
+  auto operator()(T& /*x*/) {}
   void operator()(T* /*x*/) {}
 };
 
@@ -552,7 +625,7 @@ class AdaptOnServerTrailingMetadataMethod<
   void operator()(T& x) {
     absl::Status status = (call_->*method)(x, filter_);
     if (!status.ok()) {
-      x = ServerMetadataFromStatus(status);
+      SetServerMetadataFromStatus(x, status);
     }
   }
 
@@ -583,7 +656,7 @@ class AdaptOnServerTrailingMetadataMethod<T, absl::Status (Call::*)(A), method,
   void operator()(T& x) {
     absl::Status status = (call_->*method)(x);
     if (!status.ok()) {
-      x = ServerMetadataFromStatus(status);
+      SetServerMetadataFromStatus(x, status);
     }
   }
 
@@ -623,6 +696,20 @@ struct FilterTypes {
   using Idxs = std::make_index_sequence<sizeof...(Filters)>;
 };
 
+template <std::size_t, typename FilterTypeList, typename Ignored = void>
+struct TypesFromIdx;
+
+template <typename... Filters>
+struct TypesFromIdx<0, Typelist<Filters...>> {
+  using Types = Typelist<Filters...>;
+};
+
+template <std::size_t N, typename Filter0, typename... Filters>
+struct TypesFromIdx<N, Typelist<Filter0, Filters...>,
+                    std::enable_if_t<N != 0>> {
+  using Types = typename TypesFromIdx<N - 1, Typelist<Filters...>>::Types;
+};
+
 template <std::size_t, typename>
 struct make_reverse_index_sequence_helper;
 
@@ -702,12 +789,15 @@ auto ExecuteCombinedWithChannelAccess(
     Call* call, Derived* channel, Hdl<T> hdl, Typelist<Filter0, Filters...>,
     Valuelist<filter_method_0, filter_methods...>,
     std::index_sequence<I0, Is...>) {
-  return TrySeq(AdaptMethod<T, decltype(filter_method_0), filter_method_0>(
-                    call->template fused_child<I0>(),
-                    reinterpret_cast<Filter0*>(channel))(std::move(hdl)),
-                AdaptMethod<T, decltype(filter_methods), filter_methods>(
-                    call->template fused_child<Is>(),
-                    reinterpret_cast<Filters*>(channel))...);
+  return TrySeq(
+      AdaptMethod<T, decltype(filter_method_0), filter_method_0>(
+          call->template fused_child<I0>(),
+          reinterpret_cast<Filter0*>(channel->template get_fused_filter<I0>()))(
+          std::move(hdl)),
+      AdaptMethod<T, decltype(filter_methods), filter_methods>(
+          call->template fused_child<Is>(),
+          reinterpret_cast<Filters*>(
+              channel->template get_fused_filter<Is>()))...);
 }
 
 template <typename FilterMethods, typename FilterTypes, typename Call,
@@ -730,7 +820,17 @@ void ExecuteCombinedOnFinalizeWithChannelAccess(Call* call, Derived* channel,
                                                 std::index_sequence<Is...>) {
   (AdaptMethod<T, decltype(filter_methods), filter_methods>(
        call->template fused_child<Is>(),
-       reinterpret_cast<Filters*>(channel))(call_final_info),
+       reinterpret_cast<Filters*>(channel->template get_fused_filter<Is>()))(
+       call_final_info),
+   ...);
+}
+
+template <typename Call, typename T, auto... filter_methods, size_t... Is>
+void ExecuteCombinedOnFinalize(Call* call, T* call_final_info,
+                               Valuelist<filter_methods...>,
+                               std::index_sequence<Is...>) {
+  (AdaptMethod<T, decltype(filter_methods), filter_methods>(
+       call->template fused_child<Is>(), nullptr)(call_final_info),
    ...);
 }
 
@@ -744,7 +844,8 @@ void ExecuteCombinedOnServerTrailingMetadataWithChannelAccess(
   (AdaptOnServerTrailingMetadataMethod<T, decltype(filter_methods),
                                        filter_methods>(
        call->template fused_child<Is>(),
-       reinterpret_cast<Filters*>(channel))(metadata),
+       reinterpret_cast<Filters*>(channel->template get_fused_filter<Is>()))(
+       metadata),
    ...);
 }
 
@@ -800,6 +901,13 @@ void ExecuteCombinedWithChannelAccess(Call* call, Derived* channel,
       typename FilterMethods::Methods(), typename FilterMethods::Idxs());
 }
 
+template <typename FilterMethods, typename Call, typename T>
+void ExecuteCombined(Call* call, T* call_final_info) {
+  ExecuteCombinedOnFinalize(call, call_final_info,
+                            typename FilterMethods::Methods(),
+                            typename FilterMethods::Idxs());
+}
+
 #define GRPC_FUSE_METHOD(name, type, forward)                                 \
   template <MethodVariant variant, typename Derived, typename... Filters>     \
   class FuseImpl##name;                                                       \
@@ -840,7 +948,7 @@ template <typename Derived, typename... Filters>
 class FuseImplOnServerTrailingMetadata<MethodVariant::kNoInterceptor, Derived,
                                        Filters...> {
  public:
-  static inline const NoInterceptor name;
+  static inline const NoInterceptor OnServerTrailingMetadata;
 };
 
 template <typename Derived, typename... Filters>
@@ -879,7 +987,7 @@ class FuseImplOnClientToServerHalfClose;
 template <typename Derived, typename... Filters>
 class FuseImplOnClientToServerHalfClose<true, Derived, Filters...> {
  public:
-  static inline const NoInterceptor name;
+  static inline const NoInterceptor OnClientToServerHalfClose;
 };
 
 template <typename Derived, typename... Filters>
@@ -903,11 +1011,11 @@ GRPC_FUSE_METHOD(OnClientToServerMessage, MessageHandle, true);
 GRPC_FUSE_METHOD(OnServerToClientMessage, MessageHandle, false);
 GRPC_FUSE_METHOD(OnFinalize, const grpc_call_final_info*, true);
 
-template <typename... Filters>
+template <typename FilterTypelist>
 struct FilterWrapper;
 
 template <typename Filter>
-struct FilterWrapper<Filter> {
+struct FilterWrapper<Typelist<Filter>> {
   FilterWrapper(const ChannelArgs& args, ChannelFilter::Args filter_args)
       : filter_(Filter::Create(args, filter_args)) {}
 
@@ -917,6 +1025,8 @@ struct FilterWrapper<Filter> {
     return (*filter_)->StartTransportOp(op);
   }
 
+  Filter* get_filter() { return (*filter_).get(); }
+
   bool GetChannelInfo(const grpc_channel_info* info) {
     CHECK(filter_.ok());
     return (*filter_)->GetChannelInfo(info);
@@ -927,39 +1037,101 @@ struct FilterWrapper<Filter> {
 };
 
 template <typename Filter0, typename... Filters>
-struct FilterWrapper<Filter0, Filters...> : public FilterWrapper<Filters...> {
+struct FilterWrapper<Typelist<Filter0, Filters...>>
+    : public FilterWrapper<Typelist<Filters...>> {
   FilterWrapper(const ChannelArgs& args, ChannelFilter::Args filter_args)
-      : filter0_(Filter0::Create(args, filter_args)),
-        FilterWrapper<Filters...>(args, filter_args) {}
+      : FilterWrapper<Typelist<Filters...>>(args, filter_args),
+        filter0_(Filter0::Create(args, filter_args)) {}
 
   absl::Status status() const {
     if (filter0_.ok()) {
-      return FilterWrapper<Filters...>::status();
+      return FilterWrapper<Typelist<Filters...>>::status();
     }
     return filter0_.status();
   }
 
+  Filter0* get_filter() { return (*filter0_).get(); }
+
   bool StartTransportOp(grpc_transport_op* op) {
     CHECK(filter0_.ok());
     return (*filter0_)->StartTransportOp(op) ||
-           FilterWrapper<Filters...>::StartTransportOp(op);
+           FilterWrapper<Typelist<Filters...>>::StartTransportOp(op);
   }
 
   bool GetChannelInfo(const grpc_channel_info* info) {
     CHECK(filter0_.ok());
     return (*filter0_)->GetChannelInfo(info) ||
-           FilterWrapper<Filters...>::GetChannelInfo(info);
+           FilterWrapper<Typelist<Filters...>>::GetChannelInfo(info);
   }
 
  private:
   absl::StatusOr<std::unique_ptr<Filter0>> filter0_;
 };
 
+template <typename Derived, typename SfinaeVoid = void>
+struct ConstructCall;
+
+template <typename Derived>
+struct ConstructCall<Derived, absl::void_t<decltype(typename Derived::Call(
+                                  std::declval<Derived*>()))>> {
+ public:
+  using Call = typename Derived::Call;
+  static void Run(ManualConstructor<Call>& call, Derived* channel) {
+    call.Init(channel);
+  }
+};
+
+template <typename Derived>
+struct ConstructCall<Derived,
+                     absl::void_t<decltype(typename Derived::Call())>> {
+ public:
+  using Call = typename Derived::Call;
+  static void Run(ManualConstructor<Call>& call, Derived* /*channel*/) {
+    call.Init();
+  }
+};
+
+template <typename FilterTypelist>
+struct CallWrapper;
+
+template <typename Filter>
+struct CallWrapper<Typelist<Filter>> {
+  using Call = typename Filter::Call;
+  explicit CallWrapper(FilterWrapper<Typelist<Filter>>* channel) {
+    ConstructCall<Filter>::Run(call_, channel->get_filter());
+  }
+
+  Call* get_call() { return call_.get(); }
+
+  ~CallWrapper() { call_.Destroy(); }
+
+ private:
+  ManualConstructor<Call> call_;
+};
+
+template <typename Filter0, typename... Filters>
+struct CallWrapper<Typelist<Filter0, Filters...>>
+    : public CallWrapper<Typelist<Filters...>> {
+  using Call = typename Filter0::Call;
+  explicit CallWrapper(FilterWrapper<Typelist<Filter0, Filters...>>* channel)
+      : CallWrapper<Typelist<Filters...>>(
+            reinterpret_cast<FilterWrapper<Typelist<Filters...>>*>(channel)) {
+    ConstructCall<Filter0>::Run(call_, channel->get_filter());
+  }
+
+  Call* get_call() { return call_.get(); }
+
+  ~CallWrapper() { call_.Destroy(); }
+
+ private:
+  ManualConstructor<Call> call_;
+};
+
 #undef GRPC_FUSE_METHOD
 
-template <FilterEndpoint ep, typename... Filters>
-class FusedFilter : public ImplementChannelFilter<FusedFilter<ep, Filters...>>,
-                    public Filters... {
+template <FilterEndpoint ep, uint8_t kFlags, typename... Filters>
+class FusedFilter
+    : public ImplementChannelFilter<FusedFilter<ep, kFlags, Filters...>> {
  public:
   static const grpc_channel_filter kFilter;
 
@@ -969,23 +1141,27 @@ class FusedFilter : public ImplementChannelFilter<FusedFilter<ep, Filters...>>,
     return kName;
   }
 
-  static absl::StatusOr<std::unique_ptr<FusedFilter<ep, Filters...>>> Create(
-      const ChannelArgs& args, ChannelFilter::Args filter_args) {
+  template <size_t I>
+  auto* get_fused_filter() {
+    return reinterpret_cast<FilterWrapper<
+        typename TypesFromIdx<I, Typelist<Filters...>>::Types>*>(filters_.get())
+        ->get_filter();
+  }
+
+  FilterWrapper<Typelist<Filters...>>* get_wrapper() { return filters_.get(); }
+
+  static absl::StatusOr<std::unique_ptr<FusedFilter<ep, kFlags, Filters...>>>
+  Create(const ChannelArgs& args, ChannelFilter::Args filter_args) {
     auto filters_wrapper =
-        std::make_unique<FilterWrapper<Filters...>>(args, filter_args);
+        std::make_unique<FilterWrapper<Typelist<Filters...>>>(args,
+                                                              filter_args);
     GRPC_RETURN_IF_ERROR(filters_wrapper->status());
-    return absl::WrapUnique<FusedFilter<ep, Filters...>>(
-        new FusedFilter<ep, Filters...>(std::move(filters_wrapper)));
+    return absl::WrapUnique<FusedFilter<ep, kFlags, Filters...>>(
+        new FusedFilter<ep, kFlags, Filters...>(std::move(filters_wrapper)));
   }
 
   static constexpr bool IsFused = true;
 
-  static constexpr bool FusedFilterHasAsyncErrorInterceptor() {
-    return (
-        promise_filter_detail::CallHasAsyncErrorInterceptor<Filters>::value ||
-        ...);
-  }
-
   class Call : public FuseOnClientInitialMetadata<FusedFilter, Filters...>,
                public FuseOnServerInitialMetadata<FusedFilter, Filters...>,
                public FuseOnClientToServerMessage<FusedFilter, Filters...>,
@@ -994,11 +1170,18 @@ class FusedFilter : public ImplementChannelFilter<FusedFilter<ep, Filters...>>,
                public FuseOnClientToServerHalfClose<FusedFilter, Filters...>,
                public FuseOnFinalize<FusedFilter, Filters...> {
    public:
+    using Idxs = std::make_index_sequence<sizeof...(Filters)>;
     template <size_t I>
     auto* fused_child() {
-      return &std::get<I>(filter_calls_);
+      return reinterpret_cast<CallWrapper<
+          typename TypesFromIdx<I, Typelist<Filters...>>::Types>*>(
+                 &filter_calls_)
+          ->get_call();
     }
 
+    explicit Call(FusedFilter<ep, kFlags, Filters...>* filter)
+        : filter_calls_(filter->get_wrapper()) {};
+
     using FuseOnClientInitialMetadata<FusedFilter,
                                       Filters...>::OnClientInitialMetadata;
     using FuseOnServerInitialMetadata<FusedFilter,
@@ -1014,7 +1197,7 @@ class FusedFilter : public ImplementChannelFilter<FusedFilter<ep, Filters...>>,
     using FuseOnFinalize<FusedFilter, Filters...>::OnFinalize;
 
    private:
-    std::tuple<typename Filters::Call...> filter_calls_;
+    CallWrapper<Typelist<Filters...>> filter_calls_;
   };
 
   bool StartTransportOp(grpc_transport_op* op) override {
@@ -1026,20 +1209,21 @@ class FusedFilter : public ImplementChannelFilter<FusedFilter<ep, Filters...>>,
   }
 
  private:
-  explicit FusedFilter(std::unique_ptr<FilterWrapper<Filters...>> filters)
+  explicit FusedFilter(
+      std::unique_ptr<FilterWrapper<Typelist<Filters...>>> filters)
       : filters_(std::move(filters)) {};
 
-  std::unique_ptr<FilterWrapper<Filters...>> filters_;
+  std::unique_ptr<FilterWrapper<Typelist<Filters...>>> filters_;
 };
 
-template <FilterEndpoint ep, typename... Filters>
-const grpc_channel_filter FusedFilter<ep, Filters...>::kFilter =
-    MakePromiseBasedFilter<FusedFilter<ep, Filters...>, ep>();
+template <FilterEndpoint ep, uint8_t kFlags, typename... Filters>
+const grpc_channel_filter FusedFilter<ep, kFlags, Filters...>::kFilter =
+    MakePromiseBasedFilter<FusedFilter<ep, kFlags, Filters...>, ep, kFlags>();
 
 }  // namespace filters_detail
 
-template <FilterEndpoint ep, typename... Filters>
-using FusedFilter = filters_detail::FusedFilter<ep, Filters...>;
+template <FilterEndpoint ep, uint8_t kFlags, typename... Filters>
+using FusedFilter = filters_detail::FusedFilter<ep, kFlags, Filters...>;
 
 }  // namespace grpc_core
 
diff --git a/deps/grpc/src/core/call/metadata.cc b/deps/grpc/src/core/call/metadata.cc
index e8a9926eccb..ff653478e61 100644
--- a/deps/grpc/src/core/call/metadata.cc
+++ b/deps/grpc/src/core/call/metadata.cc
@@ -34,6 +34,28 @@ ServerMetadataHandle ServerMetadataFromStatus(const absl::Status& status) {
   return hdl;
 }
 
+absl::Status ServerMetadataToStatus(ServerMetadata& md) {
+  const auto grpc_status =
+      md.get(GrpcStatusMetadata()).value_or(GRPC_STATUS_UNKNOWN);
+  const auto* error_slice = md.get_pointer(GrpcMessageMetadata());
+  return grpc_error_set_int(
+      absl::Status(static_cast<absl::StatusCode>(grpc_status),
+                   error_slice->as_string_view()),
+      StatusIntProperty::kRpcStatus, grpc_status);
+}
+
+void SetServerMetadataFromStatus(ServerMetadata& md,
+                                 const absl::Status& status) {
+  grpc_status_code code;
+  std::string message;
+  grpc_error_get_status(status, Timestamp::InfFuture(), &code, &message,
+                        nullptr, nullptr);
+  md.Set(GrpcStatusMetadata(), code);
+  if (!status.ok()) {
+    md.Set(GrpcMessageMetadata(), Slice::FromCopiedString(message));
+  }
+}
+
 ServerMetadataHandle CancelledServerMetadataFromStatus(
     const absl::Status& status) {
   auto hdl = ServerMetadataFromStatus(status);
diff --git a/deps/grpc/src/core/call/metadata.h b/deps/grpc/src/core/call/metadata.h
index fadd83f9e61..39f08500c05 100644
--- a/deps/grpc/src/core/call/metadata.h
+++ b/deps/grpc/src/core/call/metadata.h
@@ -32,6 +32,14 @@ using ServerMetadataHandle = Arena::PoolPtr<ServerMetadata>;
 using ClientMetadata = grpc_metadata_batch;
 using ClientMetadataHandle = Arena::PoolPtr<ClientMetadata>;
 
+// Convert absl::Status to ServerMetadata
+ServerMetadataHandle ServerMetadataFromStatus(const absl::Status& status);
+
+absl::Status ServerMetadataToStatus(ServerMetadata& md);
+
+void SetServerMetadataFromStatus(ServerMetadata& md,
+                                 const absl::Status& status);
+
 template <typename T>
 class ServerMetadataOrHandle {
  public:
@@ -95,6 +103,22 @@ struct FailureStatusCastImpl<ServerMetadataOrHandle<T>, ServerMetadataHandle&> {
   }
 };
 
+template <>
+struct FailureStatusCastImpl<ServerMetadataOrHandle<ServerMetadata>,
+                             const absl::Status&> {
+  static ServerMetadataOrHandle<ServerMetadata> Cast(const absl::Status& t) {
+    return ServerMetadataOrHandle<ServerMetadata>::Failure(
+        ServerMetadataFromStatus(t));
+  }
+};
+
+template <>
+struct FailureStatusCastImpl<absl::Status, ServerMetadataHandle&> {
+  static absl::Status Cast(ServerMetadataHandle& t) {
+    return ServerMetadataToStatus(*t);
+  }
+};
+
 template <>
 struct FailureStatusCastImpl<ServerMetadataHandle, ServerMetadataHandle&> {
   static ServerMetadataHandle Cast(ServerMetadataHandle& t) {
@@ -156,8 +180,6 @@ inline bool IsStatusOk(const ServerMetadataHandle& m) {
          GRPC_STATUS_OK;
 }
 
-// Convert absl::Status to ServerMetadata
-ServerMetadataHandle ServerMetadataFromStatus(const absl::Status& status);
 // Convert absl::Status to ServerMetadata, and set GrpcCallWasCancelled() to
 // true
 ServerMetadataHandle CancelledServerMetadataFromStatus(
diff --git a/deps/grpc/src/core/channelz/GEMINI.md b/deps/grpc/src/core/channelz/GEMINI.md
new file mode 100644
index 00000000000..c478dcea095
--- /dev/null
+++ b/deps/grpc/src/core/channelz/GEMINI.md
@@ -0,0 +1,23 @@
+# Channelz
+
+This directory contains the implementation of gRPC's Channelz, which is a system for inspecting the state of gRPC channels.
+
+## Overarching Purpose
+
+Channelz provides a way to get detailed information about the state of gRPC channels, including things like the number of calls, the amount of data sent and received, and the status of the underlying transport. This information can be used for debugging, monitoring, and performance tuning.
+
+## Files and Subdirectories
+
+- **`channelz.h` / `channelz.cc`**: Defines the `Channelz` class, which is the main class for Channelz.
+- **`channel_trace.h` / `channel_trace.cc`**: Defines the `ChannelTrace` class, which is used to trace events on a channel.
+- **`channelz_registry.h` / `channelz_registry.cc`**: Defines the `ChannelzRegistry` class, which is a registry for all Channelz entities.
+- **`property_list.h` / `property_list.cc`**: Defines a list of properties that can be attached to a Channelz entity.
+- **`ztrace_collector.h`**: A collector for Channelz trace events.
+- **`v2tov1/`**: Code for converting between Channelz v2 and v1 formats.
+- **`zviz/`**: A web-based viewer for Channelz data.
+
+## Notes
+
+- Channelz is a powerful tool for understanding the behavior of gRPC channels.
+- It can be used to debug a wide variety of problems, from simple connectivity issues to complex performance problems.
+- The Channelz data can be accessed through a variety of tools, including the `grpc_cli` command-line tool and the web-based viewer in the `zviz` directory.
diff --git a/deps/grpc/src/core/channelz/channelz.cc b/deps/grpc/src/core/channelz/channelz.cc
index 435c72a3c45..f0e14badff9 100644
--- a/deps/grpc/src/core/channelz/channelz.cc
+++ b/deps/grpc/src/core/channelz/channelz.cc
@@ -206,6 +206,8 @@ void BaseNode::SerializeEntity(grpc_channelz_v2_Entity* entity,
       data_source->AddData(make_data_sink());
     }
   }
+  make_data_sink().AddData("v1_compatibility",
+                           PropertyList().Set("name", name()));
   bool completed =
       done->WaitForNotificationWithTimeout(absl::Milliseconds(100));
   sink_impl->Finalize(!completed, entity, arena);
@@ -442,7 +444,7 @@ void ChannelNode::AddNodeSpecificData(DataSink sink) {
                               .Set("target", target_)
                               .Set("connectivity_state", connectivity_state()));
   sink.AddData("call_counts", call_counter_.GetCallCounts().ToPropertyList());
-  sink.AddData("channel_args", channel_args_.ToPropertyList());
+  sink.AddData("channel_args", channel_args().ToPropertyList());
 }
 
 void ChannelNode::PopulateChildRefs(Json::Object* json) {
@@ -491,12 +493,6 @@ void SubchannelNode::UpdateConnectivityState(grpc_connectivity_state state) {
   connectivity_state_.store(state, std::memory_order_relaxed);
 }
 
-void SubchannelNode::SetChildSocket(RefCountedPtr<SocketNode> socket) {
-  MutexLock lock(&socket_mu_);
-  child_socket_ =
-      socket == nullptr ? nullptr : socket->WeakRefAsSubclass<SocketNode>();
-}
-
 std::string SubchannelNode::connectivity_state() const {
   grpc_connectivity_state state =
       connectivity_state_.load(std::memory_order_relaxed);
@@ -526,16 +522,13 @@ Json SubchannelNode::RenderJson() {
       {"data", Json::FromObject(std::move(data))},
   };
   // Populate the child socket.
-  WeakRefCountedPtr<SocketNode> child_socket;
-  {
-    MutexLock lock(&socket_mu_);
-    child_socket = child_socket_;
-  }
-  if (child_socket != nullptr && child_socket->uuid() != 0) {
+  auto [children, _] = ChannelzRegistry::GetChildrenOfType(
+      0, this, BaseNode::EntityType::kSocket, 1);
+  if (!children.empty()) {
     object["socketRef"] = Json::FromArray({
         Json::FromObject({
-            {"socketId", Json::FromString(absl::StrCat(child_socket->uuid()))},
-            {"name", Json::FromString(child_socket->name())},
+            {"socketId", Json::FromString(absl::StrCat(children[0]->uuid()))},
+            {"name", Json::FromString(children[0]->name())},
         }),
     });
   }
@@ -548,7 +541,7 @@ void SubchannelNode::AddNodeSpecificData(DataSink sink) {
                               .Set("target", target_)
                               .Set("connectivity_state", connectivity_state()));
   sink.AddData("call_counts", call_counter_.GetCallCounts().ToPropertyList());
-  sink.AddData("channel_args", channel_args_.ToPropertyList());
+  sink.AddData("channel_args", channel_args().ToPropertyList());
 }
 
 //
@@ -620,7 +613,7 @@ Json ServerNode::RenderJson() {
 
 void ServerNode::AddNodeSpecificData(DataSink sink) {
   sink.AddData("call_counts", call_counter_.GetCallCounts().ToPropertyList());
-  sink.AddData("channel_args", channel_args_.ToPropertyList());
+  sink.AddData("channel_args", channel_args().ToPropertyList());
 }
 
 std::map<intptr_t, WeakRefCountedPtr<ListenSocketNode>>
diff --git a/deps/grpc/src/core/channelz/channelz.h b/deps/grpc/src/core/channelz/channelz.h
index 1de049c5c27..813ba020f37 100644
--- a/deps/grpc/src/core/channelz/channelz.h
+++ b/deps/grpc/src/core/channelz/channelz.h
@@ -105,6 +105,7 @@ class BaseNode : public DualRefCounted<BaseNode> {
     kListenSocket,
     kSocket,
     kCall,
+    kResourceQuota,
   };
 
   static absl::string_view EntityTypeString(EntityType type) {
@@ -123,6 +124,8 @@ class BaseNode : public DualRefCounted<BaseNode> {
         return "socket";
       case EntityType::kCall:
         return "call";
+      case EntityType::kResourceQuota:
+        return "resource_quota";
     }
     return "unknown";
   }
@@ -143,6 +146,8 @@ class BaseNode : public DualRefCounted<BaseNode> {
         return "socket";
       case EntityType::kCall:
         return "call";
+      case EntityType::kResourceQuota:
+        return "resource_quota";
     }
   }
 
@@ -154,6 +159,7 @@ class BaseNode : public DualRefCounted<BaseNode> {
     if (kind == "listen_socket") return EntityType::kListenSocket;
     if (kind == "socket") return EntityType::kSocket;
     if (kind == "call") return EntityType::kCall;
+    if (kind == "resource_quota") return EntityType::kResourceQuota;
     return std::nullopt;
   }
 
@@ -371,6 +377,7 @@ class DataSource {
  protected:
   ~DataSource();
   RefCountedPtr<BaseNode> channelz_node() { return node_; }
+  const BaseNode* channelz_node() const { return node_.get(); }
 
   // This method must be called in the most derived class's constructor.
   // It adds this data source to the node's list of data sources.
@@ -462,7 +469,11 @@ class ChannelNode final : public BaseNode {
               bool is_internal_channel);
 
   void Orphaned() override {
-    channel_args_ = ChannelArgs();
+    ChannelArgs to_destroy;
+    {
+      MutexLock lock(&channel_args_mu_);
+      std::swap(channel_args_, to_destroy);
+    }
     BaseNode::Orphaned();
   }
 
@@ -481,6 +492,9 @@ class ChannelNode final : public BaseNode {
 
   // proxy methods to composed classes.
   void SetChannelArgs(const ChannelArgs& channel_args) {
+    ChannelArgs to_destroy;
+    MutexLock lock(&channel_args_mu_);
+    std::swap(channel_args_, to_destroy);
     channel_args_ = channel_args;
   }
   void RecordCallStarted() { call_counter_.RecordCallStarted(); }
@@ -494,7 +508,10 @@ class ChannelNode final : public BaseNode {
   CallCounts GetCallCounts() const { return call_counter_.GetCallCounts(); }
   std::set<intptr_t> child_channels() const;
   std::set<intptr_t> child_subchannels() const;
-  const ChannelArgs& channel_args() const { return channel_args_; }
+  ChannelArgs channel_args() const {
+    MutexLock lock(&channel_args_mu_);
+    return channel_args_;
+  }
 
  private:
   void PopulateChildRefs(Json::Object* json);
@@ -504,7 +521,8 @@ class ChannelNode final : public BaseNode {
   CallCountingHelper call_counter_;
   // TODO(ctiller): keeping channel args here can create odd circular references
   // that are hard to reason about. Consider moving this to a DataSource.
-  ChannelArgs channel_args_;
+  mutable Mutex channel_args_mu_;
+  ChannelArgs channel_args_ ABSL_GUARDED_BY(channel_args_mu_);
 
   // Least significant bit indicates whether the value is set.  Remaining
   // bits are a grpc_connectivity_state value.
@@ -518,22 +536,24 @@ class SubchannelNode final : public BaseNode {
   ~SubchannelNode() override;
 
   void Orphaned() override {
-    channel_args_ = ChannelArgs();
+    ChannelArgs to_destroy;
+    {
+      MutexLock lock(&channel_args_mu_);
+      std::swap(channel_args_, to_destroy);
+    }
     BaseNode::Orphaned();
   }
 
   // Sets the subchannel's connectivity state without health checking.
   void UpdateConnectivityState(grpc_connectivity_state state);
 
-  // Used when the subchannel's child socket changes. This should be set when
-  // the subchannel's transport is created and set to nullptr when the
-  // subchannel unrefs the transport.
-  void SetChildSocket(RefCountedPtr<SocketNode> socket);
-
   Json RenderJson() override;
 
   // proxy methods to composed classes.
   void SetChannelArgs(const ChannelArgs& channel_args) {
+    ChannelArgs to_destroy;
+    MutexLock lock(&channel_args_mu_);
+    std::swap(channel_args_, to_destroy);
     channel_args_ = channel_args;
   }
   void RecordCallStarted() { call_counter_.RecordCallStarted(); }
@@ -543,11 +563,10 @@ class SubchannelNode final : public BaseNode {
   const std::string& target() const { return target_; }
   std::string connectivity_state() const;
   CallCounts GetCallCounts() const { return call_counter_.GetCallCounts(); }
-  WeakRefCountedPtr<SocketNode> child_socket() const {
-    MutexLock lock(&socket_mu_);
-    return child_socket_;
+  ChannelArgs channel_args() const {
+    MutexLock lock(&channel_args_mu_);
+    return channel_args_;
   }
-  const ChannelArgs& channel_args() const { return channel_args_; }
 
  private:
   void AddNodeSpecificData(DataSink sink) override;
@@ -556,13 +575,12 @@ class SubchannelNode final : public BaseNode {
   friend class testing::SubchannelNodePeer;
 
   std::atomic<grpc_connectivity_state> connectivity_state_{GRPC_CHANNEL_IDLE};
-  mutable Mutex socket_mu_;
-  WeakRefCountedPtr<SocketNode> child_socket_ ABSL_GUARDED_BY(socket_mu_);
   std::string target_;
   CallCountingHelper call_counter_;
   // TODO(ctiller): keeping channel args here can create odd circular references
   // that are hard to reason about. Consider moving this to a DataSource.
-  ChannelArgs channel_args_;
+  mutable Mutex channel_args_mu_;
+  ChannelArgs channel_args_ ABSL_GUARDED_BY(channel_args_mu_);
 };
 
 // Handles channelz bookkeeping for servers
@@ -573,7 +591,11 @@ class ServerNode final : public BaseNode {
   ~ServerNode() override;
 
   void Orphaned() override {
-    channel_args_ = ChannelArgs();
+    ChannelArgs to_destroy;
+    {
+      MutexLock lock(&channel_args_mu_);
+      std::swap(channel_args_, to_destroy);
+    }
     BaseNode::Orphaned();
   }
 
@@ -584,6 +606,9 @@ class ServerNode final : public BaseNode {
 
   // proxy methods to composed classes.
   void SetChannelArgs(const ChannelArgs& channel_args) {
+    ChannelArgs to_destroy;
+    MutexLock lock(&channel_args_mu_);
+    std::swap(channel_args_, to_destroy);
     channel_args_ = channel_args;
   }
   void RecordCallStarted() { call_counter_.RecordCallStarted(); }
@@ -596,7 +621,10 @@ class ServerNode final : public BaseNode {
       const;
   std::map<intptr_t, WeakRefCountedPtr<SocketNode>> child_sockets() const;
 
-  const ChannelArgs& channel_args() const { return channel_args_; }
+  ChannelArgs channel_args() const {
+    MutexLock lock(&channel_args_mu_);
+    return channel_args_;
+  }
 
  private:
   void AddNodeSpecificData(DataSink sink) override;
@@ -604,7 +632,8 @@ class ServerNode final : public BaseNode {
   PerCpuCallCountingHelper call_counter_;
   // TODO(ctiller): keeping channel args here can create odd circular references
   // that are hard to reason about. Consider moving this to a DataSource.
-  ChannelArgs channel_args_;
+  mutable Mutex channel_args_mu_;
+  ChannelArgs channel_args_ ABSL_GUARDED_BY(channel_args_mu_);
 };
 
 #define GRPC_ARG_CHANNELZ_SECURITY "grpc.internal.channelz_security"
@@ -751,6 +780,16 @@ class CallNode final : public BaseNode {
   Json RenderJson() override;
 };
 
+class ResourceQuotaNode final : public BaseNode {
+ public:
+  explicit ResourceQuotaNode(std::string name)
+      : BaseNode(EntityType::kResourceQuota, 0, std::move(name)) {
+    NodeConstructed();
+  }
+
+  Json RenderJson() override { return Json::FromString("ResourceQuota"); }
+};
+
 }  // namespace channelz
 }  // namespace grpc_core
 
diff --git a/deps/grpc/src/core/channelz/channelz_registry.cc b/deps/grpc/src/core/channelz/channelz_registry.cc
index 393b7e7f447..b0f92226231 100644
--- a/deps/grpc/src/core/channelz/channelz_registry.cc
+++ b/deps/grpc/src/core/channelz/channelz_registry.cc
@@ -47,61 +47,6 @@
 namespace grpc_core {
 namespace channelz {
 
-namespace {
-template <typename T>
-std::string RenderArray(std::tuple<T, bool> values_and_end,
-                        const std::string& key) {
-  auto& [values, end] = values_and_end;
-  Json::Object object;
-  if (!values.empty()) {
-    // Create list of channels.
-    Json::Array array;
-    for (size_t i = 0; i < values.size(); ++i) {
-      array.emplace_back(values[i]->RenderJson());
-    }
-    object[key] = Json::FromArray(std::move(array));
-  }
-  if (end) {
-    object["end"] = Json::FromBool(true);
-  }
-  return JsonDump(Json::FromObject(std::move(object)));
-}
-
-Json RemoveAdditionalInfo(const Json& json) {
-  switch (json.type()) {
-    case Json::Type::kArray: {
-      Json::Array out;
-      for (const auto& node : json.array()) {
-        out.emplace_back(RemoveAdditionalInfo(node));
-      }
-      return Json::FromArray(std::move(out));
-    } break;
-    case Json::Type::kObject: {
-      Json::Object out;
-      for (const auto& [key, value] : json.object()) {
-        if (key == "additionalInfo") continue;
-        out[key] = RemoveAdditionalInfo(value);
-      }
-      return Json::FromObject(std::move(out));
-    } break;
-    default:
-      return json;
-  }
-}
-
-// TODO(ctiller): Temporary hack to remove fields that are objectionable to the
-// protobuf parser (because we've not published them in protobuf yet).
-char* ApplyHacks(const std::string& json_str) {
-  return gpr_strdup(StripAdditionalInfoFromJson(json_str).c_str());
-}
-}  // namespace
-
-std::string StripAdditionalInfoFromJson(absl::string_view json_str) {
-  auto json = JsonParse(json_str);
-  if (!json.ok()) return gpr_strdup(std::string(json_str).c_str());
-  return JsonDump(RemoveAdditionalInfo(*json));
-}
-
 ChannelzRegistry* ChannelzRegistry::Default() {
   static ChannelzRegistry* singleton = new ChannelzRegistry();
   return singleton;
@@ -121,14 +66,6 @@ void ChannelzRegistry::InternalLogAllEntities() {
   }
 }
 
-std::string ChannelzRegistry::GetTopChannelsJson(intptr_t start_channel_id) {
-  return RenderArray(GetTopChannels(start_channel_id), "channel");
-}
-
-std::string ChannelzRegistry::GetServersJson(intptr_t start_server_id) {
-  return RenderArray(GetServers(start_server_id), "server");
-}
-
 void ChannelzRegistry::InternalRegister(BaseNode* node) {
   DCHECK_EQ(node->uuid_, -1);
   const size_t node_shard_index = NodeShardIndex(node);
@@ -379,102 +316,3 @@ void ChannelzRegistry::TestOnlyReset() {
 
 }  // namespace channelz
 }  // namespace grpc_core
-
-char* grpc_channelz_get_top_channels(intptr_t start_channel_id) {
-  grpc_core::ExecCtx exec_ctx;
-  return grpc_core::channelz::ApplyHacks(
-      grpc_core::channelz::ChannelzRegistry::GetTopChannelsJson(
-          start_channel_id)
-          .c_str());
-}
-
-char* grpc_channelz_get_servers(intptr_t start_server_id) {
-  grpc_core::ExecCtx exec_ctx;
-  return grpc_core::channelz::ApplyHacks(
-      grpc_core::channelz::ChannelzRegistry::GetServersJson(start_server_id)
-          .c_str());
-}
-
-char* grpc_channelz_get_server(intptr_t server_id) {
-  grpc_core::ExecCtx exec_ctx;
-  grpc_core::WeakRefCountedPtr<grpc_core::channelz::BaseNode> server_node =
-      grpc_core::channelz::ChannelzRegistry::Get(server_id);
-  if (server_node == nullptr ||
-      server_node->type() !=
-          grpc_core::channelz::BaseNode::EntityType::kServer) {
-    return nullptr;
-  }
-  grpc_core::Json json = grpc_core::Json::FromObject({
-      {"server", server_node->RenderJson()},
-  });
-  return grpc_core::channelz::ApplyHacks(grpc_core::JsonDump(json).c_str());
-}
-
-char* grpc_channelz_get_server_sockets(intptr_t server_id,
-                                       intptr_t start_socket_id,
-                                       intptr_t max_results) {
-  grpc_core::ExecCtx exec_ctx;
-  // Validate inputs before handing them of to the renderer.
-  grpc_core::WeakRefCountedPtr<grpc_core::channelz::BaseNode> base_node =
-      grpc_core::channelz::ChannelzRegistry::Get(server_id);
-  if (base_node == nullptr ||
-      base_node->type() != grpc_core::channelz::BaseNode::EntityType::kServer ||
-      start_socket_id < 0 || max_results < 0) {
-    return nullptr;
-  }
-  // This cast is ok since we have just checked to make sure base_node is
-  // actually a server node.
-  grpc_core::channelz::ServerNode* server_node =
-      static_cast<grpc_core::channelz::ServerNode*>(base_node.get());
-  return grpc_core::channelz::ApplyHacks(
-      server_node->RenderServerSockets(start_socket_id, max_results).c_str());
-}
-
-char* grpc_channelz_get_channel(intptr_t channel_id) {
-  grpc_core::ExecCtx exec_ctx;
-  grpc_core::WeakRefCountedPtr<grpc_core::channelz::BaseNode> channel_node =
-      grpc_core::channelz::ChannelzRegistry::Get(channel_id);
-  if (channel_node == nullptr ||
-      (channel_node->type() !=
-           grpc_core::channelz::BaseNode::EntityType::kTopLevelChannel &&
-       channel_node->type() !=
-           grpc_core::channelz::BaseNode::EntityType::kInternalChannel)) {
-    return nullptr;
-  }
-  grpc_core::Json json = grpc_core::Json::FromObject({
-      {"channel", channel_node->RenderJson()},
-  });
-  return grpc_core::channelz::ApplyHacks(grpc_core::JsonDump(json).c_str());
-}
-
-char* grpc_channelz_get_subchannel(intptr_t subchannel_id) {
-  grpc_core::ExecCtx exec_ctx;
-  grpc_core::WeakRefCountedPtr<grpc_core::channelz::BaseNode> subchannel_node =
-      grpc_core::channelz::ChannelzRegistry::Get(subchannel_id);
-  if (subchannel_node == nullptr ||
-      subchannel_node->type() !=
-          grpc_core::channelz::BaseNode::EntityType::kSubchannel) {
-    return nullptr;
-  }
-  grpc_core::Json json = grpc_core::Json::FromObject({
-      {"subchannel", subchannel_node->RenderJson()},
-  });
-  return grpc_core::channelz::ApplyHacks(grpc_core::JsonDump(json).c_str());
-}
-
-char* grpc_channelz_get_socket(intptr_t socket_id) {
-  grpc_core::ExecCtx exec_ctx;
-  grpc_core::WeakRefCountedPtr<grpc_core::channelz::BaseNode> socket_node =
-      grpc_core::channelz::ChannelzRegistry::Get(socket_id);
-  if (socket_node == nullptr ||
-      (socket_node->type() !=
-           grpc_core::channelz::BaseNode::EntityType::kSocket &&
-       socket_node->type() !=
-           grpc_core::channelz::BaseNode::EntityType::kListenSocket)) {
-    return nullptr;
-  }
-  grpc_core::Json json = grpc_core::Json::FromObject({
-      {"socket", socket_node->RenderJson()},
-  });
-  return grpc_core::channelz::ApplyHacks(grpc_core::JsonDump(json).c_str());
-}
diff --git a/deps/grpc/src/core/channelz/channelz_registry.h b/deps/grpc/src/core/channelz/channelz_registry.h
index 667c13fd5a5..dda958207fb 100644
--- a/deps/grpc/src/core/channelz/channelz_registry.h
+++ b/deps/grpc/src/core/channelz/channelz_registry.h
@@ -95,9 +95,6 @@ class ChannelzRegistry final {
             start_socket_id);
   }
 
-  static std::string GetTopChannelsJson(intptr_t start_channel_id);
-  static std::string GetServersJson(intptr_t start_server_id);
-
   // Returns the allocated JSON string that represents the proto
   // GetServersResponse as per channelz.proto.
   static auto GetServers(intptr_t start_server_id) {
@@ -106,6 +103,11 @@ class ChannelzRegistry final {
             start_server_id);
   }
 
+  static std::tuple<std::vector<WeakRefCountedPtr<BaseNode>>, bool> GetChildren(
+      const BaseNode* parent, intptr_t start_node, size_t max_results) {
+    return Default()->InternalGetChildren(parent, start_node, max_results);
+  }
+
   static std::tuple<std::vector<WeakRefCountedPtr<BaseNode>>, bool>
   GetChildrenOfType(intptr_t start_node, const BaseNode* parent,
                     BaseNode::EntityType type, size_t max_results) {
@@ -215,6 +217,15 @@ class ChannelzRegistry final {
       absl::FunctionRef<bool(const BaseNode*)> discriminator,
       size_t max_results);
 
+  std::tuple<std::vector<WeakRefCountedPtr<BaseNode>>, bool>
+  InternalGetChildren(const BaseNode* parent, intptr_t start_node,
+                      size_t max_results) {
+    return QueryNodes(
+        start_node,
+        [parent](const BaseNode* n) { return n->HasParent(parent); },
+        max_results);
+  }
+
   std::tuple<std::vector<WeakRefCountedPtr<BaseNode>>, bool>
   InternalGetChildrenOfType(intptr_t start_node, const BaseNode* parent,
                             BaseNode::EntityType type, size_t max_results) {
@@ -273,10 +284,6 @@ class ChannelzRegistry final {
   size_t max_orphaned_per_shard_;
 };
 
-// `additionalInfo` section is not yet in the protobuf format, so we
-// provide a utility to strip it for compatibility.
-std::string StripAdditionalInfoFromJson(absl::string_view json);
-
 }  // namespace channelz
 }  // namespace grpc_core
 
diff --git a/deps/grpc/src/core/channelz/property_list.cc b/deps/grpc/src/core/channelz/property_list.cc
index daaa0e526c9..dfb7b60123b 100644
--- a/deps/grpc/src/core/channelz/property_list.cc
+++ b/deps/grpc/src/core/channelz/property_list.cc
@@ -119,15 +119,13 @@ grpc_channelz_v2_PropertyValue* ToUpbProto(const PropertyValue& value,
 void PropertyList::SetInternal(absl::string_view key,
                                std::optional<PropertyValue> value) {
   if (value.has_value()) {
-    property_list_.insert_or_assign(key, *std::move(value));
-  } else {
-    property_list_.erase(std::string(key));
+    property_list_.emplace_back(std::string(key), *std::move(value));
   }
 }
 
 PropertyList& PropertyList::Merge(PropertyList other) {
   for (auto& [key, value] : other.property_list_) {
-    SetInternal(key, value);
+    SetInternal(key, std::move(value));
   }
   return *this;
 }
@@ -135,16 +133,24 @@ PropertyList& PropertyList::Merge(PropertyList other) {
 Json::Object PropertyList::TakeJsonObject() {
   Json::Object json;
   for (auto& [key, value] : property_list_) {
-    json.emplace(key, ToJson(value));
+    json.emplace(std::string(key), ToJson(value));
   }
   return json;
 }
 
 void PropertyList::FillUpbProto(grpc_channelz_v2_PropertyList* proto,
                                 upb_Arena* arena) {
+  auto* elements = grpc_channelz_v2_PropertyList_resize_properties(
+      proto, property_list_.size(), arena);
+  size_t i = 0;
   for (auto& [key, value] : property_list_) {
-    grpc_channelz_v2_PropertyList_properties_set(
-        proto, StdStringToUpbString(key), ToUpbProto(value, arena), arena);
+    auto* element = grpc_channelz_v2_PropertyList_Element_new(arena);
+    grpc_channelz_v2_PropertyList_Element_set_key(
+        element, CopyStdStringToUpbString(key, arena));
+    grpc_channelz_v2_PropertyList_Element_set_value(element,
+                                                    ToUpbProto(value, arena));
+    elements[i] = element;
+    i++;
   }
 }
 
@@ -244,28 +250,18 @@ void PropertyGrid::SetInternal(absl::string_view column, absl::string_view row,
 PropertyGrid& PropertyGrid::SetColumn(absl::string_view column,
                                       PropertyList values) {
   int c = GetIndex(columns_, column);
-  std::vector<std::string> keys;
-  for (const auto& [key, value] : values.property_list_) {
-    keys.push_back(key);
-  }
-  std::sort(keys.begin(), keys.end());
-  for (const auto& key : keys) {
-    grid_.emplace(std::pair(c, GetIndex(rows_, key)),
-                  std::move(values.property_list_.at(key)));
+  for (auto& [key, value] : values.property_list_) {
+    grid_.emplace(std::pair(c, GetIndex(rows_, std::move(key))),
+                  std::move(value));
   }
   return *this;
 }
 
 PropertyGrid& PropertyGrid::SetRow(absl::string_view row, PropertyList values) {
   int r = GetIndex(rows_, row);
-  std::vector<std::string> keys;
-  for (const auto& [key, value] : values.property_list_) {
-    keys.push_back(key);
-  }
-  std::sort(keys.begin(), keys.end());
-  for (const auto& key : keys) {
-    grid_.emplace(std::pair(GetIndex(columns_, key), r),
-                  std::move(values.property_list_.at(key)));
+  for (auto& [key, value] : values.property_list_) {
+    grid_.emplace(std::pair(GetIndex(columns_, std::move(key)), r),
+                  std::move(value));
   }
   return *this;
 }
diff --git a/deps/grpc/src/core/channelz/property_list.h b/deps/grpc/src/core/channelz/property_list.h
index 4593065aab4..7c1eaf85e0b 100644
--- a/deps/grpc/src/core/channelz/property_list.h
+++ b/deps/grpc/src/core/channelz/property_list.h
@@ -17,6 +17,8 @@
 
 #include <cstddef>
 #include <type_traits>
+#include <utility>
+#include <vector>
 
 #include "absl/container/flat_hash_map.h"
 #include "absl/status/status.h"
@@ -139,7 +141,7 @@ class PropertyList final : public OtherPropertyValue {
   friend class PropertyGrid;
   friend class PropertyTable;
 
-  absl::flat_hash_map<std::string, PropertyValue> property_list_;
+  std::vector<std::pair<std::string, PropertyValue>> property_list_;
 };
 
 // PropertyGrid is much the same as PropertyList, but it is two dimensional.
diff --git a/deps/grpc/src/core/channelz/v2tov1/convert.cc b/deps/grpc/src/core/channelz/v2tov1/convert.cc
new file mode 100644
index 00000000000..b9cb76f77c3
--- /dev/null
+++ b/deps/grpc/src/core/channelz/v2tov1/convert.cc
@@ -0,0 +1,683 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/core/channelz/v2tov1/convert.h"
+
+#include <optional>
+#include <string>
+#include <vector>
+
+#include "absl/cleanup/cleanup.h"
+#include "absl/status/status.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/escaping.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/strip.h"
+#include "google/protobuf/any.upb.h"
+#include "google/protobuf/duration.upb.h"
+#include "google/protobuf/timestamp.upb.h"
+#include "google/protobuf/wrappers.upb.h"
+#include "src/core/channelz/v2tov1/property_list.h"
+#include "src/core/lib/address_utils/parse_address.h"
+#include "src/core/lib/address_utils/sockaddr_utils.h"
+#include "src/core/util/json/json.h"
+#include "src/core/util/json/json_writer.h"
+#include "src/core/util/upb_utils.h"
+#include "src/core/util/uri.h"
+#include "src/proto/grpc/channelz/channelz.upb.h"
+#include "src/proto/grpc/channelz/channelz.upbdefs.h"
+#include "src/proto/grpc/channelz/v2/channelz.upb.h"
+#include "src/proto/grpc/channelz/v2/property_list.upb.h"
+#include "upb/base/status.h"
+#include "upb/json/encode.h"
+#include "upb/mem/arena.hpp"
+#include "upb/reflection/def.hpp"
+
+namespace grpc_core {
+namespace channelz {
+namespace v2tov1 {
+
+namespace {
+const grpc_channelz_v2_Data* FindData(const grpc_channelz_v2_Entity* entity,
+                                      absl::string_view name) {
+  size_t num_data;
+  const grpc_channelz_v2_Data* const* data =
+      grpc_channelz_v2_Entity_data(entity, &num_data);
+  for (size_t i = 0; i < num_data; ++i) {
+    upb_StringView data_name = grpc_channelz_v2_Data_name(data[i]);
+    if (absl::string_view(data_name.data, data_name.size) == name) {
+      return data[i];
+    }
+  }
+  return nullptr;
+}
+
+const grpc_channelz_v2_PropertyList* GetPropertyList(
+    const grpc_channelz_v2_Entity* entity, absl::string_view name,
+    upb_Arena* arena) {
+  const auto* data = FindData(entity, name);
+  if (data == nullptr) return nullptr;
+  const auto* value = grpc_channelz_v2_Data_value(data);
+  if (value == nullptr) return nullptr;
+  upb_StringView type_url = google_protobuf_Any_type_url(value);
+  if (absl::string_view(type_url.data, type_url.size) !=
+      "type.googleapis.com/grpc.channelz.v2.PropertyList") {
+    return nullptr;
+  }
+  upb_StringView bytes = google_protobuf_Any_value(value);
+  return grpc_channelz_v2_PropertyList_parse(bytes.data, bytes.size, arena);
+}
+
+void ParseAddress(const std::string& addr_str, upb_Arena* arena,
+                  grpc_channelz_v1_Address* address) {
+  absl::StatusOr<URI> uri = URI::Parse(addr_str);
+  if (!uri.ok()) {
+    grpc_channelz_v1_Address_OtherAddress_set_name(
+        grpc_channelz_v1_Address_mutable_other_address(address, arena),
+        CopyStdStringToUpbString(addr_str, arena));
+    return;
+  }
+  if (uri->scheme() == "ipv4" || uri->scheme() == "ipv6") {
+    absl::StatusOr<grpc_resolved_address> resolved_address =
+        StringToSockaddr(absl::StripPrefix(uri->path(), "/"));
+    if (resolved_address.ok()) {
+      auto* tcpip_address =
+          grpc_channelz_v1_Address_mutable_tcpip_address(address, arena);
+      grpc_channelz_v1_Address_TcpIpAddress_set_port(
+          tcpip_address, grpc_sockaddr_get_port(&*resolved_address));
+      grpc_channelz_v1_Address_TcpIpAddress_set_ip_address(
+          tcpip_address,
+          CopyStdStringToUpbString(
+              grpc_sockaddr_get_packed_host(&*resolved_address), arena));
+      return;
+    }
+  } else if (uri->scheme() == "unix") {
+    grpc_channelz_v1_Address_UdsAddress_set_filename(
+        grpc_channelz_v1_Address_mutable_uds_address(address, arena),
+        CopyStdStringToUpbString(std::string(uri->path()), arena));
+    return;
+  }
+  grpc_channelz_v1_Address_OtherAddress_set_name(
+      grpc_channelz_v1_Address_mutable_other_address(address, arena),
+      CopyStdStringToUpbString(addr_str, arena));
+}
+
+absl::StatusOr<std::string> SerializeJson(
+    const upb_Message* msg,
+    const upb_MessageDef* (*msg_def_maker)(upb_DefPool*)) {
+  upb::DefPool pool;
+  auto* msg_def = msg_def_maker(pool.ptr());
+  upb_Status status;
+  upb_Status_Clear(&status);
+  size_t len = upb_JsonEncode(msg, msg_def, pool.ptr(),
+                              upb_JsonEncode_EmitDefaults, nullptr, 0, &status);
+  if (!upb_Status_IsOk(&status)) {
+    return absl::InternalError(absl::StrCat("Failed to serialize to JSON: ",
+                                            upb_Status_ErrorMessage(&status)));
+  }
+  auto buf = std::make_unique<char[]>(len + 1);
+  upb_JsonEncode(msg, msg_def, pool.ptr(), upb_JsonEncode_EmitDefaults,
+                 buf.get(), len + 1, &status);
+  if (!upb_Status_IsOk(&status)) {
+    return absl::InternalError(absl::StrCat("Failed to serialize to JSON: ",
+                                            upb_Status_ErrorMessage(&status)));
+  }
+  return std::string(buf.get(), len);
+}
+
+grpc_channelz_v1_ChannelConnectivityState_State ConnectivityStateFromString(
+    absl::string_view state) {
+  if (state == "READY") return grpc_channelz_v1_ChannelConnectivityState_READY;
+  if (state == "IDLE") return grpc_channelz_v1_ChannelConnectivityState_IDLE;
+  if (state == "CONNECTING") {
+    return grpc_channelz_v1_ChannelConnectivityState_CONNECTING;
+  }
+  if (state == "TRANSIENT_FAILURE") {
+    return grpc_channelz_v1_ChannelConnectivityState_TRANSIENT_FAILURE;
+  }
+  if (state == "SHUTDOWN") {
+    return grpc_channelz_v1_ChannelConnectivityState_SHUTDOWN;
+  }
+  return grpc_channelz_v1_ChannelConnectivityState_UNKNOWN;
+}
+
+void PopulateV1Trace(const grpc_channelz_v2_TraceEvent* const* trace_events,
+                     size_t num_events, upb_Arena* arena,
+                     grpc_channelz_v1_ChannelTrace* trace) {
+  for (size_t i = 0; i < num_events; ++i) {
+    auto* v1_event = grpc_channelz_v1_ChannelTrace_add_events(trace, arena);
+    upb_StringView description =
+        grpc_channelz_v2_TraceEvent_description(trace_events[i]);
+    grpc_channelz_v1_ChannelTraceEvent_set_description(v1_event, description);
+    const auto* ts = grpc_channelz_v2_TraceEvent_timestamp(trace_events[i]);
+    if (ts != nullptr) {
+      auto* v1_ts =
+          grpc_channelz_v1_ChannelTraceEvent_mutable_timestamp(v1_event, arena);
+      google_protobuf_Timestamp_set_seconds(
+          v1_ts, google_protobuf_Timestamp_seconds(ts));
+      google_protobuf_Timestamp_set_nanos(v1_ts,
+                                          google_protobuf_Timestamp_nanos(ts));
+    }
+    grpc_channelz_v1_ChannelTraceEvent_set_severity(
+        v1_event, grpc_channelz_v1_ChannelTraceEvent_CT_INFO);
+  }
+}
+
+void PopulateV1ChannelData(
+    const grpc_channelz_v2_PropertyList* channel_props,
+    const grpc_channelz_v2_PropertyList* call_counts,
+    const grpc_channelz_v2_TraceEvent* const* trace_events, size_t num_events,
+    upb_Arena* arena, grpc_channelz_v1_ChannelData* data) {
+  if (channel_props) {
+    if (auto target = StringFromPropertyList(channel_props, "target");
+        target.has_value()) {
+      grpc_channelz_v1_ChannelData_set_target(
+          data, CopyStdStringToUpbString(*target, arena));
+    }
+    if (auto state =
+            StringFromPropertyList(channel_props, "connectivity_state");
+        state.has_value()) {
+      grpc_channelz_v1_ChannelConnectivityState_set_state(
+          grpc_channelz_v1_ChannelData_mutable_state(data, arena),
+          ConnectivityStateFromString(*state));
+    }
+  }
+  if (call_counts != nullptr) {
+    grpc_channelz_v1_ChannelData_set_calls_started(
+        data, Int64FromPropertyList(call_counts, "calls_started").value_or(0));
+    grpc_channelz_v1_ChannelData_set_calls_succeeded(
+        data,
+        Int64FromPropertyList(call_counts, "calls_succeeded").value_or(0));
+    grpc_channelz_v1_ChannelData_set_calls_failed(
+        data, Int64FromPropertyList(call_counts, "calls_failed").value_or(0));
+    if (auto* last_call_started_timestamp = TimestampFromPropertyList(
+            call_counts, "last_call_started_timestamp");
+        last_call_started_timestamp != nullptr) {
+      auto* v1_ts =
+          grpc_channelz_v1_ChannelData_mutable_last_call_started_timestamp(
+              data, arena);
+      google_protobuf_Timestamp_set_seconds(
+          v1_ts,
+          google_protobuf_Timestamp_seconds(last_call_started_timestamp));
+      google_protobuf_Timestamp_set_nanos(
+          v1_ts, google_protobuf_Timestamp_nanos(last_call_started_timestamp));
+    }
+  }
+  if (num_events > 0) {
+    auto* trace = grpc_channelz_v1_ChannelData_mutable_trace(data, arena);
+    PopulateV1Trace(trace_events, num_events, arena, trace);
+  }
+}
+
+}  // namespace
+
+absl::StatusOr<std::string> ConvertServer(const std::string& serialized_entity,
+                                          EntityFetcher& fetcher, bool json) {
+  upb::Arena arena;
+  const auto* entity = grpc_channelz_v2_Entity_parse(
+      serialized_entity.data(), serialized_entity.size(), arena.ptr());
+  if (entity == nullptr) {
+    return absl::InvalidArgumentError("Failed to parse entity");
+  }
+
+  upb_StringView kind = grpc_channelz_v2_Entity_kind(entity);
+  if (absl::string_view(kind.data, kind.size) != "server") {
+    return absl::InvalidArgumentError("Entity kind is not server");
+  }
+
+  grpc_channelz_v1_Server* v1 = grpc_channelz_v1_Server_new(arena.ptr());
+  grpc_channelz_v1_ServerRef_set_server_id(
+      grpc_channelz_v1_Server_mutable_ref(v1, arena.ptr()),
+      grpc_channelz_v2_Entity_id(entity));
+  const auto* call_counts = GetPropertyList(entity, "call_counts", arena.ptr());
+  size_t num_events;
+  const auto* trace_events = grpc_channelz_v2_Entity_trace(entity, &num_events);
+  if (call_counts != nullptr || num_events > 0) {
+    auto* data = grpc_channelz_v1_Server_mutable_data(v1, arena.ptr());
+    if (call_counts != nullptr) {
+      grpc_channelz_v1_ServerData_set_calls_started(
+          data,
+          Int64FromPropertyList(call_counts, "calls_started").value_or(0));
+      grpc_channelz_v1_ServerData_set_calls_succeeded(
+          data,
+          Int64FromPropertyList(call_counts, "calls_succeeded").value_or(0));
+      grpc_channelz_v1_ServerData_set_calls_failed(
+          data, Int64FromPropertyList(call_counts, "calls_failed").value_or(0));
+      if (auto* last_call_started_timestamp = TimestampFromPropertyList(
+              call_counts, "last_call_started_timestamp")) {
+        auto* v1_ts =
+            grpc_channelz_v1_ServerData_mutable_last_call_started_timestamp(
+                data, arena.ptr());
+        google_protobuf_Timestamp_set_seconds(
+            v1_ts,
+            google_protobuf_Timestamp_seconds(last_call_started_timestamp));
+        google_protobuf_Timestamp_set_nanos(
+            v1_ts,
+            google_protobuf_Timestamp_nanos(last_call_started_timestamp));
+      }
+    }
+    if (num_events > 0) {
+      auto* trace =
+          grpc_channelz_v1_ServerData_mutable_trace(data, arena.ptr());
+      PopulateV1Trace(trace_events, num_events, arena.ptr(), trace);
+    }
+  }
+  auto children =
+      fetcher.GetEntitiesWithParent(grpc_channelz_v2_Entity_id(entity));
+  if (children.ok()) {
+    for (const auto& child_str : *children) {
+      const auto* child_entity = grpc_channelz_v2_Entity_parse(
+          child_str.data(), child_str.size(), arena.ptr());
+      if (child_entity == nullptr) continue;
+      upb_StringView kind = grpc_channelz_v2_Entity_kind(child_entity);
+      if (absl::string_view(kind.data, kind.size) != "listen_socket") {
+        continue;
+      }
+      auto* added = grpc_channelz_v1_Server_add_listen_socket(v1, arena.ptr());
+      grpc_channelz_v1_SocketRef_set_socket_id(
+          added, grpc_channelz_v2_Entity_id(child_entity));
+      if (auto v1_compat =
+              GetPropertyList(child_entity, "v1_compatibility", arena.ptr());
+          v1_compat != nullptr) {
+        if (auto name = StringFromPropertyList(v1_compat, "name");
+            name.has_value()) {
+          grpc_channelz_v1_SocketRef_set_name(
+              added, CopyStdStringToUpbString(*name, arena.ptr()));
+        }
+      }
+    }
+  }
+  if (json) {
+    return SerializeJson((upb_Message*)v1, grpc_channelz_v1_Server_getmsgdef);
+  }
+  size_t length;
+  char* bytes = grpc_channelz_v1_Server_serialize(v1, arena.ptr(), &length);
+  return std::string(bytes, length);
+}
+
+absl::StatusOr<std::string> ConvertSocket(const std::string& serialized_entity,
+                                          EntityFetcher&, bool json) {
+  upb::Arena arena;
+  const auto* entity = grpc_channelz_v2_Entity_parse(
+      serialized_entity.data(), serialized_entity.size(), arena.ptr());
+  if (entity == nullptr) {
+    return absl::InvalidArgumentError("Failed to parse entity");
+  }
+  upb_StringView kind = grpc_channelz_v2_Entity_kind(entity);
+  if (absl::string_view(kind.data, kind.size) != "socket") {
+    return absl::InvalidArgumentError("Entity kind is not socket");
+  }
+
+  grpc_channelz_v1_Socket* v1 = grpc_channelz_v1_Socket_new(arena.ptr());
+  auto* v1_ref = grpc_channelz_v1_Socket_mutable_ref(v1, arena.ptr());
+  grpc_channelz_v1_SocketRef_set_socket_id(v1_ref,
+                                           grpc_channelz_v2_Entity_id(entity));
+  if (auto v1_compat = GetPropertyList(entity, "v1_compatibility", arena.ptr());
+      v1_compat != nullptr) {
+    if (auto name = StringFromPropertyList(v1_compat, "name");
+        name.has_value()) {
+      grpc_channelz_v1_SocketRef_set_name(
+          v1_ref, CopyStdStringToUpbString(*name, arena.ptr()));
+    }
+  }
+  const auto* call_counts = GetPropertyList(entity, "call_counts", arena.ptr());
+  const auto* http2 = GetPropertyList(entity, "http2", arena.ptr());
+  if (call_counts != nullptr || http2 != nullptr) {
+    auto* data = grpc_channelz_v1_Socket_mutable_data(v1, arena.ptr());
+    if (call_counts != nullptr) {
+      if (auto streams_started =
+              Int64FromPropertyList(call_counts, "streams_started");
+          streams_started.has_value()) {
+        grpc_channelz_v1_SocketData_set_streams_started(data, *streams_started);
+      }
+      if (auto streams_succeeded =
+              Int64FromPropertyList(call_counts, "streams_succeeded");
+          streams_succeeded.has_value()) {
+        grpc_channelz_v1_SocketData_set_streams_succeeded(data,
+                                                          *streams_succeeded);
+      }
+      if (auto streams_failed =
+              Int64FromPropertyList(call_counts, "streams_failed");
+          streams_failed.has_value()) {
+        grpc_channelz_v1_SocketData_set_streams_failed(data, *streams_failed);
+      }
+      if (auto messages_sent =
+              Int64FromPropertyList(call_counts, "messages_sent");
+          messages_sent.has_value()) {
+        grpc_channelz_v1_SocketData_set_messages_sent(data, *messages_sent);
+      }
+      if (auto messages_received =
+              Int64FromPropertyList(call_counts, "messages_received");
+          messages_received.has_value()) {
+        grpc_channelz_v1_SocketData_set_messages_received(data,
+                                                          *messages_received);
+      }
+      if (auto keepalives_sent =
+              Int64FromPropertyList(call_counts, "keepalives_sent");
+          keepalives_sent.has_value()) {
+        grpc_channelz_v1_SocketData_set_keep_alives_sent(data,
+                                                         *keepalives_sent);
+      }
+      if (auto* last_local_stream_created_timestamp = TimestampFromPropertyList(
+              call_counts, "last_local_stream_created_timestamp");
+          last_local_stream_created_timestamp != nullptr) {
+        auto* v1_ts =
+            grpc_channelz_v1_SocketData_mutable_last_local_stream_created_timestamp(
+                data, arena.ptr());
+        google_protobuf_Timestamp_set_seconds(
+            v1_ts, google_protobuf_Timestamp_seconds(
+                       last_local_stream_created_timestamp));
+        google_protobuf_Timestamp_set_nanos(
+            v1_ts, google_protobuf_Timestamp_nanos(
+                       last_local_stream_created_timestamp));
+      }
+      if (auto* last_remote_stream_created_timestamp =
+              TimestampFromPropertyList(call_counts,
+                                        "last_remote_stream_created_timestamp");
+          last_remote_stream_created_timestamp != nullptr) {
+        auto* v1_ts =
+            grpc_channelz_v1_SocketData_mutable_last_remote_stream_created_timestamp(
+                data, arena.ptr());
+        google_protobuf_Timestamp_set_seconds(
+            v1_ts, google_protobuf_Timestamp_seconds(
+                       last_remote_stream_created_timestamp));
+        google_protobuf_Timestamp_set_nanos(
+            v1_ts, google_protobuf_Timestamp_nanos(
+                       last_remote_stream_created_timestamp));
+      }
+      if (auto* last_message_sent_timestamp = TimestampFromPropertyList(
+              call_counts, "last_message_sent_timestamp");
+          last_message_sent_timestamp != nullptr) {
+        auto* v1_ts =
+            grpc_channelz_v1_SocketData_mutable_last_message_sent_timestamp(
+                data, arena.ptr());
+        google_protobuf_Timestamp_set_seconds(
+            v1_ts,
+            google_protobuf_Timestamp_seconds(last_message_sent_timestamp));
+        google_protobuf_Timestamp_set_nanos(
+            v1_ts,
+            google_protobuf_Timestamp_nanos(last_message_sent_timestamp));
+      }
+      if (auto* last_message_received_timestamp = TimestampFromPropertyList(
+              call_counts, "last_message_received_timestamp");
+          last_message_received_timestamp != nullptr) {
+        auto* v1_ts =
+            grpc_channelz_v1_SocketData_mutable_last_message_received_timestamp(
+                data, arena.ptr());
+        google_protobuf_Timestamp_set_seconds(
+            v1_ts,
+            google_protobuf_Timestamp_seconds(last_message_received_timestamp));
+        google_protobuf_Timestamp_set_nanos(
+            v1_ts,
+            google_protobuf_Timestamp_nanos(last_message_received_timestamp));
+      }
+    }
+    if (http2 != nullptr) {
+      if (auto flow_control =
+              PropertyListFromPropertyList(http2, "flow_control", arena.ptr());
+          flow_control != nullptr) {
+        if (auto remote_window =
+                Int64FromPropertyList(flow_control, "remote_window");
+            remote_window.has_value()) {
+          google_protobuf_Int64Value_set_value(
+              grpc_channelz_v1_SocketData_mutable_local_flow_control_window(
+                  data, arena.ptr()),
+              *remote_window);
+        }
+        if (auto announced_window =
+                Int64FromPropertyList(flow_control, "announced_window");
+            announced_window.has_value()) {
+          google_protobuf_Int64Value_set_value(
+              grpc_channelz_v1_SocketData_mutable_remote_flow_control_window(
+                  data, arena.ptr()),
+              *announced_window);
+        }
+      }
+    }
+  }
+
+  if (auto socket_props = GetPropertyList(entity, "socket", arena.ptr());
+      socket_props != nullptr) {
+    if (auto local = StringFromPropertyList(socket_props, "local");
+        local.has_value()) {
+      ParseAddress(*local, arena.ptr(),
+                   grpc_channelz_v1_Socket_mutable_local(v1, arena.ptr()));
+    }
+    if (auto remote = StringFromPropertyList(socket_props, "remote");
+        remote.has_value()) {
+      ParseAddress(*remote, arena.ptr(),
+                   grpc_channelz_v1_Socket_mutable_remote(v1, arena.ptr()));
+    }
+  }
+
+  if (auto security = GetPropertyList(entity, "security", arena.ptr());
+      security != nullptr) {
+    auto* v1_security =
+        grpc_channelz_v1_Socket_mutable_security(v1, arena.ptr());
+    if (auto other = StringFromPropertyList(security, "other");
+        other.has_value()) {
+      grpc_channelz_v1_Security_OtherSecurity_set_name(
+          grpc_channelz_v1_Security_mutable_other(v1_security, arena.ptr()),
+          CopyStdStringToUpbString(*other, arena.ptr()));
+    } else {
+      auto* tls =
+          grpc_channelz_v1_Security_mutable_tls(v1_security, arena.ptr());
+      if (auto standard_name =
+              StringFromPropertyList(security, "standard_name");
+          standard_name.has_value()) {
+        grpc_channelz_v1_Security_Tls_set_standard_name(
+            tls, CopyStdStringToUpbString(*standard_name, arena.ptr()));
+      }
+      if (auto other_name = StringFromPropertyList(security, "other_name");
+          other_name.has_value()) {
+        grpc_channelz_v1_Security_Tls_set_other_name(
+            tls, CopyStdStringToUpbString(*other_name, arena.ptr()));
+      }
+      if (auto local_cert =
+              StringFromPropertyList(security, "local_certificate");
+          local_cert.has_value()) {
+        std::string decoded;
+        if (absl::Base64Unescape(*local_cert, &decoded)) {
+          grpc_channelz_v1_Security_Tls_set_local_certificate(
+              tls, CopyStdStringToUpbString(decoded, arena.ptr()));
+        }
+      }
+      if (auto remote_cert =
+              StringFromPropertyList(security, "remote_certificate");
+          remote_cert.has_value()) {
+        std::string decoded;
+        if (absl::Base64Unescape(*remote_cert, &decoded)) {
+          grpc_channelz_v1_Security_Tls_set_remote_certificate(
+              tls, CopyStdStringToUpbString(decoded, arena.ptr()));
+        }
+      }
+    }
+  }
+
+  if (json) {
+    return SerializeJson((upb_Message*)v1, grpc_channelz_v1_Socket_getmsgdef);
+  }
+  size_t length;
+  char* bytes = grpc_channelz_v1_Socket_serialize(v1, arena.ptr(), &length);
+  return std::string(bytes, length);
+}
+
+absl::StatusOr<std::string> ConvertChannel(const std::string& serialized_entity,
+                                           EntityFetcher& fetcher, bool json) {
+  upb::Arena arena;
+  const auto* entity = grpc_channelz_v2_Entity_parse(
+      serialized_entity.data(), serialized_entity.size(), arena.ptr());
+  if (entity == nullptr) {
+    return absl::InvalidArgumentError("Failed to parse entity");
+  }
+  upb_StringView kind = grpc_channelz_v2_Entity_kind(entity);
+  if (absl::string_view(kind.data, kind.size) != "channel" &&
+      absl::string_view(kind.data, kind.size) != "top_level_channel") {
+    return absl::InvalidArgumentError(
+        "Entity kind is not channel or top_level_channel");
+  }
+  grpc_channelz_v1_Channel* v1 = grpc_channelz_v1_Channel_new(arena.ptr());
+  grpc_channelz_v1_ChannelRef_set_channel_id(
+      grpc_channelz_v1_Channel_mutable_ref(v1, arena.ptr()),
+      grpc_channelz_v2_Entity_id(entity));
+  const auto* channel_props = GetPropertyList(entity, "channel", arena.ptr());
+  const auto* call_counts = GetPropertyList(entity, "call_counts", arena.ptr());
+  size_t num_events;
+  const auto* trace_events = grpc_channelz_v2_Entity_trace(entity, &num_events);
+  auto* data = grpc_channelz_v1_Channel_mutable_data(v1, arena.ptr());
+  PopulateV1ChannelData(channel_props, call_counts, trace_events, num_events,
+                        arena.ptr(), data);
+  auto children =
+      fetcher.GetEntitiesWithParent(grpc_channelz_v2_Entity_id(entity));
+  if (children.ok()) {
+    for (const auto& child_str : *children) {
+      const auto* child = grpc_channelz_v2_Entity_parse(
+          child_str.data(), child_str.size(), arena.ptr());
+      if (child == nullptr) continue;
+      upb_StringView child_kind = grpc_channelz_v2_Entity_kind(child);
+      if (absl::string_view(child_kind.data, child_kind.size) == "channel") {
+        auto* child_ref =
+            grpc_channelz_v1_Channel_add_channel_ref(v1, arena.ptr());
+        grpc_channelz_v1_ChannelRef_set_channel_id(
+            child_ref, grpc_channelz_v2_Entity_id(child));
+      } else if (absl::string_view(child_kind.data, child_kind.size) ==
+                 "subchannel") {
+        auto* child_ref =
+            grpc_channelz_v1_Channel_add_subchannel_ref(v1, arena.ptr());
+        grpc_channelz_v1_SubchannelRef_set_subchannel_id(
+            child_ref, grpc_channelz_v2_Entity_id(child));
+      }
+    }
+  }
+  if (json) {
+    return SerializeJson((upb_Message*)v1, grpc_channelz_v1_Channel_getmsgdef);
+  }
+  size_t length;
+  char* bytes = grpc_channelz_v1_Channel_serialize(v1, arena.ptr(), &length);
+  return std::string(bytes, length);
+}
+
+absl::StatusOr<std::string> ConvertSubchannel(
+    const std::string& serialized_entity, EntityFetcher& fetcher, bool json) {
+  upb::Arena arena;
+  const auto* entity = grpc_channelz_v2_Entity_parse(
+      serialized_entity.data(), serialized_entity.size(), arena.ptr());
+  if (entity == nullptr) {
+    return absl::InvalidArgumentError("Failed to parse entity");
+  }
+  upb_StringView kind = grpc_channelz_v2_Entity_kind(entity);
+  if (absl::string_view(kind.data, kind.size) != "subchannel") {
+    return absl::InvalidArgumentError("Entity kind is not subchannel");
+  }
+  grpc_channelz_v1_Subchannel* v1 =
+      grpc_channelz_v1_Subchannel_new(arena.ptr());
+  grpc_channelz_v1_SubchannelRef_set_subchannel_id(
+      grpc_channelz_v1_Subchannel_mutable_ref(v1, arena.ptr()),
+      grpc_channelz_v2_Entity_id(entity));
+  const auto* channel_props = GetPropertyList(entity, "channel", arena.ptr());
+  const auto* call_counts = GetPropertyList(entity, "call_counts", arena.ptr());
+  size_t num_events;
+  const auto* trace_events = grpc_channelz_v2_Entity_trace(entity, &num_events);
+  auto* data = grpc_channelz_v1_Subchannel_mutable_data(v1, arena.ptr());
+  PopulateV1ChannelData(channel_props, call_counts, trace_events, num_events,
+                        arena.ptr(), data);
+  auto children =
+      fetcher.GetEntitiesWithParent(grpc_channelz_v2_Entity_id(entity));
+  if (children.ok()) {
+    for (const auto& child_str : *children) {
+      const auto* child = grpc_channelz_v2_Entity_parse(
+          child_str.data(), child_str.size(), arena.ptr());
+      if (child == nullptr) continue;
+      upb_StringView child_kind = grpc_channelz_v2_Entity_kind(child);
+      if (absl::string_view(child_kind.data, child_kind.size) == "channel") {
+        auto* child_ref =
+            grpc_channelz_v1_Subchannel_add_channel_ref(v1, arena.ptr());
+        grpc_channelz_v1_ChannelRef_set_channel_id(
+            child_ref, grpc_channelz_v2_Entity_id(child));
+      } else if (absl::string_view(child_kind.data, child_kind.size) ==
+                 "subchannel") {
+        auto* child_ref =
+            grpc_channelz_v1_Subchannel_add_subchannel_ref(v1, arena.ptr());
+        grpc_channelz_v1_SubchannelRef_set_subchannel_id(
+            child_ref, grpc_channelz_v2_Entity_id(child));
+      } else if (absl::string_view(child_kind.data, child_kind.size) ==
+                 "socket") {
+        auto* child_ref =
+            grpc_channelz_v1_Subchannel_add_socket_ref(v1, arena.ptr());
+        grpc_channelz_v1_SocketRef_set_socket_id(
+            child_ref, grpc_channelz_v2_Entity_id(child));
+        if (auto v1_compat =
+                GetPropertyList(child, "v1_compatibility", arena.ptr());
+            v1_compat != nullptr) {
+          if (auto name = StringFromPropertyList(v1_compat, "name");
+              name.has_value()) {
+            grpc_channelz_v1_SocketRef_set_name(
+                child_ref, CopyStdStringToUpbString(*name, arena.ptr()));
+          }
+        }
+      }
+    }
+  }
+  if (json) {
+    return SerializeJson((upb_Message*)v1,
+                         grpc_channelz_v1_Subchannel_getmsgdef);
+  }
+  size_t length;
+  char* bytes = grpc_channelz_v1_Subchannel_serialize(v1, arena.ptr(), &length);
+  return std::string(bytes, length);
+}
+
+absl::StatusOr<std::string> ConvertListenSocket(
+    const std::string& serialized_entity, EntityFetcher&, bool json) {
+  upb::Arena arena;
+  const auto* entity = grpc_channelz_v2_Entity_parse(
+      serialized_entity.data(), serialized_entity.size(), arena.ptr());
+  if (entity == nullptr) {
+    return absl::InvalidArgumentError("Failed to parse entity");
+  }
+  upb_StringView kind = grpc_channelz_v2_Entity_kind(entity);
+  if (absl::string_view(kind.data, kind.size) != "listen_socket") {
+    return absl::InvalidArgumentError("Entity kind is not listen_socket");
+  }
+  grpc_channelz_v1_Socket* v1 = grpc_channelz_v1_Socket_new(arena.ptr());
+  auto* v1_ref = grpc_channelz_v1_Socket_mutable_ref(v1, arena.ptr());
+  grpc_channelz_v1_SocketRef_set_socket_id(v1_ref,
+                                           grpc_channelz_v2_Entity_id(entity));
+  if (auto v1_compat = GetPropertyList(entity, "v1_compatibility", arena.ptr());
+      v1_compat != nullptr) {
+    if (auto name = StringFromPropertyList(v1_compat, "name");
+        name.has_value()) {
+      grpc_channelz_v1_SocketRef_set_name(
+          v1_ref, CopyStdStringToUpbString(*name, arena.ptr()));
+    }
+  }
+  if (auto socket_props = GetPropertyList(entity, "socket", arena.ptr());
+      socket_props != nullptr) {
+    if (auto local = StringFromPropertyList(socket_props, "local");
+        local.has_value()) {
+      ParseAddress(*local, arena.ptr(),
+                   grpc_channelz_v1_Socket_mutable_local(v1, arena.ptr()));
+    }
+  }
+  if (json) {
+    return SerializeJson((upb_Message*)v1, grpc_channelz_v1_Socket_getmsgdef);
+  }
+  size_t length;
+  char* bytes = grpc_channelz_v1_Socket_serialize(v1, arena.ptr(), &length);
+  return std::string(bytes, length);
+}
+
+}  // namespace v2tov1
+}  // namespace channelz
+}  // namespace grpc_core
diff --git a/deps/grpc/src/core/channelz/v2tov1/convert.h b/deps/grpc/src/core/channelz/v2tov1/convert.h
new file mode 100644
index 00000000000..d602412a542
--- /dev/null
+++ b/deps/grpc/src/core/channelz/v2tov1/convert.h
@@ -0,0 +1,58 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_CHANNELZ_V2TOV1_CONVERT_H
+#define GRPC_SRC_CORE_CHANNELZ_V2TOV1_CONVERT_H
+
+#include <string>
+#include <vector>
+
+#include "absl/status/statusor.h"
+
+namespace grpc_core {
+namespace channelz {
+namespace v2tov1 {
+
+class EntityFetcher {
+ public:
+  virtual ~EntityFetcher() = default;
+  // returns serialized grpc::channelz::v2::Entity
+  virtual absl::StatusOr<std::string> GetEntity(int64_t id) = 0;
+  // returns list of serialized grpc::channelz::v2::Entity
+  virtual absl::StatusOr<std::vector<std::string>> GetEntitiesWithParent(
+      int64_t parent_id) = 0;
+};
+
+// Converts a v2 entity to a v1 entity.
+// `serialized_entity` is the serialized v2 entity.
+// `fetcher` is used to fetch child entities.
+// `json` is true if the output should be a json string, false if it should be
+// a serialized proto. The serialized proto will be of the appropriate channelz
+// v1 proto type.
+absl::StatusOr<std::string> ConvertServer(const std::string& serialized_entity,
+                                          EntityFetcher& fetcher, bool json);
+absl::StatusOr<std::string> ConvertSocket(const std::string& serialized_entity,
+                                          EntityFetcher& fetcher, bool json);
+absl::StatusOr<std::string> ConvertChannel(const std::string& serialized_entity,
+                                           EntityFetcher& fetcher, bool json);
+absl::StatusOr<std::string> ConvertSubchannel(
+    const std::string& serialized_entity, EntityFetcher& fetcher, bool json);
+absl::StatusOr<std::string> ConvertListenSocket(
+    const std::string& serialized_entity, EntityFetcher& fetcher, bool json);
+
+}  // namespace v2tov1
+}  // namespace channelz
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_CHANNELZ_V2TOV1_CONVERT_H
diff --git a/deps/grpc/src/core/channelz/v2tov1/legacy_api.cc b/deps/grpc/src/core/channelz/v2tov1/legacy_api.cc
new file mode 100644
index 00000000000..7b8afaa7530
--- /dev/null
+++ b/deps/grpc/src/core/channelz/v2tov1/legacy_api.cc
@@ -0,0 +1,425 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/grpc.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/log.h>
+#include <grpc/support/string_util.h>
+
+#include <string>
+#include <vector>
+
+#include "absl/log/log.h"
+#include "absl/status/statusor.h"
+#include "absl/strings/str_cat.h"
+#include "src/core/channelz/channelz_registry.h"
+#include "src/core/channelz/v2tov1/convert.h"
+#include "src/core/lib/experiments/experiments.h"
+#include "src/core/lib/iomgr/exec_ctx.h"
+#include "src/core/util/json/json.h"
+#include "src/core/util/json/json_reader.h"
+#include "src/core/util/json/json_writer.h"
+
+// This file is a temporary compatibility layer between the v2 channelz data
+// model and the v1 C-API. It should be removed when the v1 C-API is removed.
+
+namespace grpc_core {
+namespace channelz {
+namespace v2tov1 {
+namespace {
+
+class RegistryEntityFetcher : public EntityFetcher {
+ public:
+  absl::StatusOr<std::string> GetEntity(int64_t id) override {
+    auto node = ChannelzRegistry::GetNode(id);
+    if (node == nullptr) {
+      return absl::NotFoundError(absl::StrCat("Entity not found: ", id));
+    }
+    return node->SerializeEntityToString();
+  }
+
+  absl::StatusOr<std::vector<std::string>> GetEntitiesWithParent(
+      int64_t parent_id) override {
+    auto node = ChannelzRegistry::GetNode(parent_id);
+    if (node == nullptr) {
+      return absl::NotFoundError(
+          absl::StrCat("Parent entity not found: ", parent_id));
+    }
+    auto [nodes, end] = ChannelzRegistry::GetChildren(
+        node.get(), 0, std::numeric_limits<size_t>::max());
+    DCHECK(end);
+    std::vector<std::string> children_str;
+    for (const auto& child_node : nodes) {
+      if (child_node == nullptr) continue;
+      children_str.push_back(child_node->SerializeEntityToString());
+    }
+    return children_str;
+  }
+};
+
+template <typename T>
+std::string RenderArray(std::tuple<T, bool> values_and_end,
+                        const std::string& key) {
+  auto& [values, end] = values_and_end;
+  Json::Object object;
+  if (!values.empty()) {
+    // Create list of channels.
+    Json::Array array;
+    for (size_t i = 0; i < values.size(); ++i) {
+      array.emplace_back(values[i]->RenderJson());
+    }
+    object[key] = Json::FromArray(std::move(array));
+  }
+  if (end) {
+    object["end"] = Json::FromBool(true);
+  }
+  return JsonDump(Json::FromObject(std::move(object)));
+}
+
+Json RemoveAdditionalInfo(const Json& json) {
+  switch (json.type()) {
+    case Json::Type::kArray: {
+      Json::Array out;
+      for (const auto& node : json.array()) {
+        out.emplace_back(RemoveAdditionalInfo(node));
+      }
+      return Json::FromArray(std::move(out));
+    } break;
+    case Json::Type::kObject: {
+      Json::Object out;
+      for (const auto& [key, value] : json.object()) {
+        if (key == "additionalInfo") continue;
+        out[key] = RemoveAdditionalInfo(value);
+      }
+      return Json::FromObject(std::move(out));
+    } break;
+    default:
+      return json;
+  }
+}
+
+}  // namespace
+
+std::string StripAdditionalInfoFromJson(absl::string_view json_str) {
+  auto json = JsonParse(json_str);
+  if (!json.ok()) return std::string(json_str);
+  return JsonDump(RemoveAdditionalInfo(*json));
+}
+
+// TODO(ctiller): Temporary hack to remove fields that are objectionable to the
+// protobuf parser (because we've not published them in protobuf yet).
+char* ApplyHacks(const std::string& json_str) {
+  return gpr_strdup(StripAdditionalInfoFromJson(json_str).c_str());
+}
+
+}  // namespace v2tov1
+}  // namespace channelz
+}  // namespace grpc_core
+
+using grpc_core::channelz::ChannelzRegistry;
+using grpc_core::channelz::v2tov1::RegistryEntityFetcher;
+
+char* grpc_channelz_get_top_channels(intptr_t start_channel_id) {
+  grpc_core::ExecCtx exec_ctx;
+  if (grpc_core::IsChannelzUseV2ForV1ApiEnabled()) {
+    RegistryEntityFetcher fetcher;
+    auto [channels, end] = ChannelzRegistry::GetTopChannels(start_channel_id);
+    grpc_core::Json::Array array;
+    for (const auto& channel_node : channels) {
+      if (channel_node == nullptr) continue;
+      auto serialized_v2 = channel_node->SerializeEntityToString();
+      auto serialized_v1 = grpc_core::channelz::v2tov1::ConvertChannel(
+          serialized_v2, fetcher, true);
+      if (!serialized_v1.ok()) {
+        LOG(ERROR) << "Failed to convert channel: " << serialized_v1.status();
+        continue;
+      }
+      auto json = grpc_core::JsonParse(*serialized_v1);
+      if (!json.ok()) {
+        LOG(ERROR) << "Failed to parse converted channel json: "
+                   << json.status();
+        continue;
+      }
+      array.emplace_back(std::move(*json));
+    }
+    grpc_core::Json json = grpc_core::Json::FromObject({
+        {"channel", grpc_core::Json::FromArray(std::move(array))},
+        {"end", grpc_core::Json::FromBool(end)},
+    });
+    std::string json_str = grpc_core::JsonDump(json);
+    return gpr_strdup(json_str.c_str());
+  } else {
+    return grpc_core::channelz::v2tov1::ApplyHacks(
+        grpc_core::channelz::v2tov1::RenderArray(
+            grpc_core::channelz::ChannelzRegistry::GetTopChannels(
+                start_channel_id),
+            "channel"));
+  }
+}
+
+char* grpc_channelz_get_servers(intptr_t start_server_id) {
+  grpc_core::ExecCtx exec_ctx;
+  if (grpc_core::IsChannelzUseV2ForV1ApiEnabled()) {
+    RegistryEntityFetcher fetcher;
+    auto [servers, end] = ChannelzRegistry::GetServers(start_server_id);
+    grpc_core::Json::Array array;
+    for (const auto& server_node : servers) {
+      if (server_node == nullptr) continue;
+      auto serialized_v2 = server_node->SerializeEntityToString();
+      auto serialized_v1 = grpc_core::channelz::v2tov1::ConvertServer(
+          serialized_v2, fetcher, true);
+      if (!serialized_v1.ok()) {
+        LOG(ERROR) << "Failed to convert server: " << serialized_v1.status();
+        continue;
+      }
+      auto json = grpc_core::JsonParse(*serialized_v1);
+      if (!json.ok()) {
+        LOG(ERROR) << "Failed to parse converted server json: "
+                   << json.status();
+        continue;
+      }
+      array.emplace_back(std::move(*json));
+    }
+    grpc_core::Json json = grpc_core::Json::FromObject({
+        {"server", grpc_core::Json::FromArray(std::move(array))},
+        {"end", grpc_core::Json::FromBool(end)},
+    });
+    std::string json_str = grpc_core::JsonDump(json);
+    return gpr_strdup(json_str.c_str());
+  } else {
+    return grpc_core::channelz::v2tov1::ApplyHacks(
+        grpc_core::channelz::v2tov1::RenderArray(
+            grpc_core::channelz::ChannelzRegistry::GetServers(start_server_id),
+            "server"));
+  }
+}
+
+char* grpc_channelz_get_server(intptr_t server_id) {
+  grpc_core::ExecCtx exec_ctx;
+  if (grpc_core::IsChannelzUseV2ForV1ApiEnabled()) {
+    auto server_node = ChannelzRegistry::GetServer(server_id);
+    if (server_node == nullptr) return nullptr;
+    RegistryEntityFetcher fetcher;
+    auto serialized_v2 = server_node->SerializeEntityToString();
+    auto serialized_v1 = grpc_core::channelz::v2tov1::ConvertServer(
+        serialized_v2, fetcher, true);
+    if (!serialized_v1.ok()) {
+      LOG(ERROR) << "Failed to convert server: " << serialized_v1.status();
+      return nullptr;
+    }
+    auto json = grpc_core::JsonParse(*serialized_v1);
+    if (!json.ok()) {
+      LOG(ERROR) << "Failed to parse converted server json: " << json.status();
+      return nullptr;
+    }
+    grpc_core::Json wrapped_json = grpc_core::Json::FromObject({
+        {"server", std::move(*json)},
+    });
+    std::string json_str = grpc_core::JsonDump(wrapped_json);
+    return gpr_strdup(json_str.c_str());
+  } else {
+    grpc_core::WeakRefCountedPtr<grpc_core::channelz::BaseNode> server_node =
+        grpc_core::channelz::ChannelzRegistry::Get(server_id);
+    if (server_node == nullptr ||
+        server_node->type() !=
+            grpc_core::channelz::BaseNode::EntityType::kServer) {
+      return nullptr;
+    }
+    grpc_core::Json json = grpc_core::Json::FromObject({
+        {"server", server_node->RenderJson()},
+    });
+    return grpc_core::channelz::v2tov1::ApplyHacks(
+        grpc_core::JsonDump(json).c_str());
+  }
+}
+
+char* grpc_channelz_get_server_sockets(intptr_t server_id,
+                                       intptr_t start_socket_id,
+                                       intptr_t max_results) {
+  grpc_core::ExecCtx exec_ctx;
+  if (grpc_core::IsChannelzUseV2ForV1ApiEnabled()) {
+    auto server_node = ChannelzRegistry::GetServer(server_id);
+    if (server_node == nullptr) return nullptr;
+    size_t max =
+        max_results == 0 ? std::numeric_limits<size_t>::max() : max_results;
+    auto [sockets, end] = ChannelzRegistry::GetChildrenOfType(
+        start_socket_id, server_node.get(),
+        grpc_core::channelz::BaseNode::EntityType::kSocket, max);
+    grpc_core::Json::Array array;
+    for (const auto& socket_node : sockets) {
+      if (socket_node == nullptr) continue;
+      array.emplace_back(grpc_core::Json::FromObject({
+          {"socketId",
+           grpc_core::Json::FromString(absl::StrCat(socket_node->uuid()))},
+          {"name", grpc_core::Json::FromString(socket_node->name())},
+      }));
+    }
+    grpc_core::Json json = grpc_core::Json::FromObject({
+        {"socketRef", grpc_core::Json::FromArray(std::move(array))},
+        {"end", grpc_core::Json::FromBool(end)},
+    });
+    std::string json_str = grpc_core::JsonDump(json);
+    return gpr_strdup(json_str.c_str());
+  } else {
+    // Validate inputs before handing them of to the renderer.
+    grpc_core::WeakRefCountedPtr<grpc_core::channelz::BaseNode> base_node =
+        grpc_core::channelz::ChannelzRegistry::Get(server_id);
+    if (base_node == nullptr ||
+        base_node->type() !=
+            grpc_core::channelz::BaseNode::EntityType::kServer ||
+        start_socket_id < 0 || max_results < 0) {
+      return nullptr;
+    }
+    // This cast is ok since we have just checked to make sure base_node is
+    // actually a server node.
+    grpc_core::channelz::ServerNode* server_node =
+        static_cast<grpc_core::channelz::ServerNode*>(base_node.get());
+    return grpc_core::channelz::v2tov1::ApplyHacks(
+        server_node->RenderServerSockets(start_socket_id, max_results).c_str());
+  }
+}
+
+char* grpc_channelz_get_channel(intptr_t channel_id) {
+  grpc_core::ExecCtx exec_ctx;
+  if (grpc_core::IsChannelzUseV2ForV1ApiEnabled()) {
+    auto channel_node = ChannelzRegistry::GetChannel(channel_id);
+    if (channel_node == nullptr) return nullptr;
+    RegistryEntityFetcher fetcher;
+    auto serialized_v2 = channel_node->SerializeEntityToString();
+    auto serialized_v1 = grpc_core::channelz::v2tov1::ConvertChannel(
+        serialized_v2, fetcher, true);
+    if (!serialized_v1.ok()) {
+      LOG(ERROR) << "Failed to convert channel: " << serialized_v1.status();
+      return nullptr;
+    }
+    auto json = grpc_core::JsonParse(*serialized_v1);
+    if (!json.ok()) {
+      LOG(ERROR) << "Failed to parse converted channel json: " << json.status();
+      return nullptr;
+    }
+    grpc_core::Json wrapped_json = grpc_core::Json::FromObject({
+        {"channel", std::move(*json)},
+    });
+    std::string json_str = grpc_core::JsonDump(wrapped_json);
+    return gpr_strdup(json_str.c_str());
+  } else {
+    grpc_core::WeakRefCountedPtr<grpc_core::channelz::BaseNode> channel_node =
+        grpc_core::channelz::ChannelzRegistry::Get(channel_id);
+    if (channel_node == nullptr ||
+        (channel_node->type() !=
+             grpc_core::channelz::BaseNode::EntityType::kTopLevelChannel &&
+         channel_node->type() !=
+             grpc_core::channelz::BaseNode::EntityType::kInternalChannel)) {
+      return nullptr;
+    }
+    grpc_core::Json json = grpc_core::Json::FromObject({
+        {"channel", channel_node->RenderJson()},
+    });
+    return grpc_core::channelz::v2tov1::ApplyHacks(
+        grpc_core::JsonDump(json).c_str());
+  }
+}
+
+char* grpc_channelz_get_subchannel(intptr_t subchannel_id) {
+  grpc_core::ExecCtx exec_ctx;
+  if (grpc_core::IsChannelzUseV2ForV1ApiEnabled()) {
+    auto subchannel_node = ChannelzRegistry::GetSubchannel(subchannel_id);
+    if (subchannel_node == nullptr) return nullptr;
+    RegistryEntityFetcher fetcher;
+    auto serialized_v2 = subchannel_node->SerializeEntityToString();
+    auto serialized_v1 = grpc_core::channelz::v2tov1::ConvertSubchannel(
+        serialized_v2, fetcher, true);
+    if (!serialized_v1.ok()) {
+      LOG(ERROR) << "Failed to convert subchannel: " << serialized_v1.status();
+      return nullptr;
+    }
+    auto json = grpc_core::JsonParse(*serialized_v1);
+    if (!json.ok()) {
+      LOG(ERROR) << "Failed to parse converted subchannel json: "
+                 << json.status();
+      return nullptr;
+    }
+    grpc_core::Json wrapped_json = grpc_core::Json::FromObject({
+        {"subchannel", std::move(*json)},
+    });
+    std::string json_str = grpc_core::JsonDump(wrapped_json);
+    return gpr_strdup(json_str.c_str());
+  } else {
+    grpc_core::WeakRefCountedPtr<grpc_core::channelz::BaseNode>
+        subchannel_node =
+            grpc_core::channelz::ChannelzRegistry::Get(subchannel_id);
+    if (subchannel_node == nullptr ||
+        subchannel_node->type() !=
+            grpc_core::channelz::BaseNode::EntityType::kSubchannel) {
+      return nullptr;
+    }
+    grpc_core::Json json = grpc_core::Json::FromObject({
+        {"subchannel", subchannel_node->RenderJson()},
+    });
+    return grpc_core::channelz::v2tov1::ApplyHacks(
+        grpc_core::JsonDump(json).c_str());
+  }
+}
+
+char* grpc_channelz_get_socket(intptr_t socket_id) {
+  grpc_core::ExecCtx exec_ctx;
+  if (grpc_core::IsChannelzUseV2ForV1ApiEnabled()) {
+    auto node = ChannelzRegistry::GetNode(socket_id);
+    if (node == nullptr) return nullptr;
+    RegistryEntityFetcher fetcher;
+    auto serialized_v2 = node->SerializeEntityToString();
+    absl::StatusOr<std::string> serialized_v1;
+    if (node->type() == grpc_core::channelz::BaseNode::EntityType::kSocket) {
+      serialized_v1 = grpc_core::channelz::v2tov1::ConvertSocket(serialized_v2,
+                                                                 fetcher, true);
+    } else if (node->type() ==
+               grpc_core::channelz::BaseNode::EntityType::kListenSocket) {
+      serialized_v1 = grpc_core::channelz::v2tov1::ConvertListenSocket(
+          serialized_v2, fetcher, true);
+    } else {
+      return nullptr;
+    }
+    if (!serialized_v1.ok()) {
+      LOG(ERROR) << "Failed to convert socket: " << serialized_v1.status();
+      return nullptr;
+    }
+    // The old API returned a JSON object with a "socket" key.
+    // The new converter returns the socket JSON directly. We need to wrap it.
+    auto json = grpc_core::JsonParse(*serialized_v1);
+    if (!json.ok()) {
+      LOG(ERROR) << "Failed to parse converted socket json: " << json.status();
+      return nullptr;
+    }
+    grpc_core::Json wrapped_json = grpc_core::Json::FromObject({
+        {"socket", std::move(*json)},
+    });
+    std::string json_str = grpc_core::JsonDump(wrapped_json);
+    return gpr_strdup(json_str.c_str());
+  } else {
+    grpc_core::WeakRefCountedPtr<grpc_core::channelz::BaseNode> socket_node =
+        grpc_core::channelz::ChannelzRegistry::Get(socket_id);
+    if (socket_node == nullptr ||
+        (socket_node->type() !=
+             grpc_core::channelz::BaseNode::EntityType::kSocket &&
+         socket_node->type() !=
+             grpc_core::channelz::BaseNode::EntityType::kListenSocket)) {
+      return nullptr;
+    }
+    grpc_core::Json json = grpc_core::Json::FromObject({
+        {"socket", socket_node->RenderJson()},
+    });
+    return grpc_core::channelz::v2tov1::ApplyHacks(
+        grpc_core::JsonDump(json).c_str());
+  }
+}
diff --git a/deps/grpc/src/core/channelz/v2tov1/legacy_api.h b/deps/grpc/src/core/channelz/v2tov1/legacy_api.h
new file mode 100644
index 00000000000..0c5c3e68245
--- /dev/null
+++ b/deps/grpc/src/core/channelz/v2tov1/legacy_api.h
@@ -0,0 +1,32 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_CHANNELZ_V2TOV1_LEGACY_API_H
+#define GRPC_SRC_CORE_CHANNELZ_V2TOV1_LEGACY_API_H
+
+#include <string>
+
+#include "absl/strings/string_view.h"
+
+namespace grpc_core {
+namespace channelz {
+namespace v2tov1 {
+
+std::string StripAdditionalInfoFromJson(absl::string_view json_str);
+
+}  // namespace v2tov1
+}  // namespace channelz
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_CHANNELZ_V2TOV1_LEGACY_API_H
diff --git a/deps/grpc/src/core/channelz/v2tov1/property_list.cc b/deps/grpc/src/core/channelz/v2tov1/property_list.cc
new file mode 100644
index 00000000000..64bbb6307cf
--- /dev/null
+++ b/deps/grpc/src/core/channelz/v2tov1/property_list.cc
@@ -0,0 +1,118 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/core/channelz/v2tov1/property_list.h"
+
+#include <cstdint>
+#include <optional>
+#include <string>
+
+#include "absl/strings/string_view.h"
+#include "google/protobuf/any.upb.h"
+#include "google/protobuf/duration.upb.h"
+#include "google/protobuf/timestamp.upb.h"
+#include "src/core/util/upb_utils.h"
+#include "src/proto/grpc/channelz/v2/property_list.upb.h"
+#include "upb/mem/arena.hpp"
+
+namespace grpc_core {
+namespace channelz {
+namespace v2tov1 {
+
+namespace {
+
+const grpc_channelz_v2_PropertyValue* FindProperty(
+    const grpc_channelz_v2_PropertyList* pl, absl::string_view name) {
+  size_t size;
+  const grpc_channelz_v2_PropertyList_Element* const* elements =
+      grpc_channelz_v2_PropertyList_properties(pl, &size);
+  for (size_t i = 0; i < size; i++) {
+    const grpc_channelz_v2_PropertyList_Element* element = elements[i];
+    upb_StringView label = grpc_channelz_v2_PropertyList_Element_key(element);
+    if (absl::string_view(label.data, label.size) == name) {
+      return grpc_channelz_v2_PropertyList_Element_value(element);
+    }
+  }
+  return nullptr;
+}
+
+}  // namespace
+
+std::optional<int64_t> Int64FromPropertyList(
+    const grpc_channelz_v2_PropertyList* pl, absl::string_view name) {
+  const auto* prop = FindProperty(pl, name);
+  if (prop == nullptr) return std::nullopt;
+  if (grpc_channelz_v2_PropertyValue_has_int64_value(prop)) {
+    return grpc_channelz_v2_PropertyValue_int64_value(prop);
+  }
+  if (grpc_channelz_v2_PropertyValue_has_uint64_value(prop)) {
+    uint64_t val = grpc_channelz_v2_PropertyValue_uint64_value(prop);
+    if (val <= static_cast<uint64_t>(std::numeric_limits<int64_t>::max())) {
+      return static_cast<int64_t>(val);
+    }
+  }
+  return std::nullopt;
+}
+
+std::optional<std::string> StringFromPropertyList(
+    const grpc_channelz_v2_PropertyList* pl, absl::string_view name) {
+  const auto* prop = FindProperty(pl, name);
+  if (prop == nullptr) return std::nullopt;
+  if (grpc_channelz_v2_PropertyValue_has_string_value(prop)) {
+    return UpbStringToStdString(
+        grpc_channelz_v2_PropertyValue_string_value(prop));
+  }
+  return std::nullopt;
+}
+
+const google_protobuf_Timestamp* TimestampFromPropertyList(
+    const grpc_channelz_v2_PropertyList* pl, absl::string_view name) {
+  const auto* prop = FindProperty(pl, name);
+  if (prop == nullptr) return nullptr;
+  if (grpc_channelz_v2_PropertyValue_has_timestamp_value(prop)) {
+    return grpc_channelz_v2_PropertyValue_timestamp_value(prop);
+  }
+  return nullptr;
+}
+
+const grpc_channelz_v2_PropertyList* PropertyListFromPropertyList(
+    const grpc_channelz_v2_PropertyList* pl, absl::string_view name,
+    upb_Arena* arena) {
+  const auto* prop = FindProperty(pl, name);
+  if (prop == nullptr) return nullptr;
+  if (grpc_channelz_v2_PropertyValue_has_any_value(prop)) {
+    const auto* any = grpc_channelz_v2_PropertyValue_any_value(prop);
+    auto type_url = UpbStringToAbsl(google_protobuf_Any_type_url(any));
+    if (type_url != "type.googleapis.com/grpc.channelz.v2.PropertyList") {
+      return nullptr;
+    }
+    upb_StringView value = google_protobuf_Any_value(any);
+    return grpc_channelz_v2_PropertyList_parse(value.data, value.size, arena);
+  }
+  return nullptr;
+}
+
+const google_protobuf_Duration* DurationFromPropertyList(
+    const grpc_channelz_v2_PropertyList* pl, absl::string_view name) {
+  const auto* prop = FindProperty(pl, name);
+  if (prop == nullptr) return nullptr;
+  if (grpc_channelz_v2_PropertyValue_has_duration_value(prop)) {
+    return grpc_channelz_v2_PropertyValue_duration_value(prop);
+  }
+  return nullptr;
+}
+
+}  // namespace v2tov1
+}  // namespace channelz
+}  // namespace grpc_core
diff --git a/deps/grpc/src/core/channelz/v2tov1/property_list.h b/deps/grpc/src/core/channelz/v2tov1/property_list.h
new file mode 100644
index 00000000000..44aec3cb01a
--- /dev/null
+++ b/deps/grpc/src/core/channelz/v2tov1/property_list.h
@@ -0,0 +1,52 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_CHANNELZ_V2TOV1_PROPERTY_LIST_H
+#define GRPC_SRC_CORE_CHANNELZ_V2TOV1_PROPERTY_LIST_H
+
+#include <cstdint>
+#include <optional>
+#include <string>
+#include <utility>
+
+#include "absl/strings/string_view.h"
+
+// Forward declarations for UPB types.
+struct grpc_channelz_v2_PropertyList;
+struct upb_Arena;
+struct google_protobuf_Timestamp;
+struct google_protobuf_Duration;
+
+namespace grpc_core {
+namespace channelz {
+namespace v2tov1 {
+
+// Helpers for extracting values from a PropertyList.
+std::optional<int64_t> Int64FromPropertyList(
+    const grpc_channelz_v2_PropertyList* pl, absl::string_view name);
+std::optional<std::string> StringFromPropertyList(
+    const grpc_channelz_v2_PropertyList* pl, absl::string_view name);
+const google_protobuf_Timestamp* TimestampFromPropertyList(
+    const grpc_channelz_v2_PropertyList* pl, absl::string_view name);
+const grpc_channelz_v2_PropertyList* PropertyListFromPropertyList(
+    const grpc_channelz_v2_PropertyList* pl, absl::string_view name,
+    upb_Arena* arena);
+const google_protobuf_Duration* DurationFromPropertyList(
+    const grpc_channelz_v2_PropertyList* pl, absl::string_view name);
+
+}  // namespace v2tov1
+}  // namespace channelz
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_CHANNELZ_V2TOV1_PROPERTY_LIST_H
diff --git a/deps/grpc/src/core/channelz/zviz/data.cc b/deps/grpc/src/core/channelz/zviz/data.cc
index d4d1074b8ef..40bc432441f 100644
--- a/deps/grpc/src/core/channelz/zviz/data.cc
+++ b/deps/grpc/src/core/channelz/zviz/data.cc
@@ -14,6 +14,9 @@
 
 #include "src/core/channelz/zviz/data.h"
 
+#include <algorithm>
+#include <vector>
+
 #include "absl/container/flat_hash_map.h"
 #include "absl/strings/str_cat.h"
 #include "absl/strings/string_view.h"
@@ -69,10 +72,11 @@ bool PropertyListFormatter(Environment& env, google::protobuf::Any value,
                            layout::Element& element) {
   grpc::channelz::v2::PropertyList property_list;
   if (!value.UnpackTo(&property_list)) return false;
+  if (property_list.properties().empty()) return true;
   auto& table = element.AppendTable(layout::TableIntent::kPropertyList);
-  for (const auto& [key, value] : property_list.properties()) {
-    table.AppendColumn().AppendText(layout::Intent::kKey, key);
-    Format(env, value, table.AppendColumn());
+  for (const auto& el : property_list.properties()) {
+    table.AppendColumn().AppendText(layout::Intent::kKey, el.key());
+    Format(env, el.value(), table.AppendColumn());
     table.NewRow();
   }
   return true;
@@ -87,12 +91,30 @@ bool PropertyGridFormatter(Environment& env, google::protobuf::Any value,
   for (const auto& column : property_grid.columns()) {
     table.AppendColumn().AppendText(layout::Intent::kKey, column);
   }
+  table.NewRow();
   for (const auto& row : property_grid.rows()) {
-    table.NewRow();
     table.AppendColumn().AppendText(layout::Intent::kKey, row.label());
     for (const auto& value : row.value()) {
       Format(env, value, table.AppendColumn());
     }
+    table.NewRow();
+  }
+  return true;
+}
+
+bool PropertyTableFormatter(Environment& env, google::protobuf::Any value,
+                            layout::Element& element) {
+  grpc::channelz::v2::PropertyTable property_table;
+  if (!value.UnpackTo(&property_table)) return false;
+  auto& table = element.AppendTable(layout::TableIntent::kPropertyTable);
+  for (const auto& column : property_table.columns()) {
+    table.AppendColumn().AppendText(layout::Intent::kKey, column);
+  }
+  for (const auto& row : property_table.rows()) {
+    table.NewRow();
+    for (const auto& value : row.value()) {
+      Format(env, value, table.AppendColumn());
+    }
   }
   return true;
 }
@@ -107,6 +129,8 @@ const grpc_core::NoDestruct<absl::flat_hash_map<absl::string_view, Formatter>>
                          PropertyListFormatter);
       formatters.emplace("type.googleapis.com/grpc.channelz.v2.PropertyGrid",
                          PropertyGridFormatter);
+      formatters.emplace("type.googleapis.com/grpc.channelz.v2.PropertyTable",
+                         PropertyTableFormatter);
       return formatters;
     }());
 
diff --git a/deps/grpc/src/core/channelz/zviz/html.cc b/deps/grpc/src/core/channelz/zviz/html.cc
index c6db99c8dca..760af4f6ff4 100644
--- a/deps/grpc/src/core/channelz/zviz/html.cc
+++ b/deps/grpc/src/core/channelz/zviz/html.cc
@@ -37,19 +37,24 @@ Container Div(std::string clazz, absl::FunctionRef<void(Container&)> f) {
 }
 
 std::string Container::Render() const {
-  std::string s = absl::StrCat("<", tag_);
-  for (const auto& [name, value] : attributes_) {
-    absl::StrAppend(&s, " ", name, "=\"", HtmlEscape(value), "\"");
-  }
-  if (items_.empty()) {
-    absl::StrAppend(&s, "/>");
-    return s;
+  std::string s;
+  if (tag_.has_value()) {
+    absl::StrAppend(&s, "<", *tag_);
+    for (const auto& [name, value] : attributes_) {
+      absl::StrAppend(&s, " ", name, "=\"", HtmlEscape(value), "\"");
+    }
+    if (items_.empty()) {
+      absl::StrAppend(&s, "/>");
+      return s;
+    }
+    absl::StrAppend(&s, ">");
   }
-  absl::StrAppend(&s, ">");
   for (const auto& item : items_) {
     absl::StrAppend(&s, item->Render());
   }
-  absl::StrAppend(&s, "</", tag_, ">");
+  if (tag_.has_value()) {
+    absl::StrAppend(&s, "</", *tag_, ">");
+  }
   return s;
 }
 
@@ -71,33 +76,65 @@ Container& Container::NewDiv(std::string clazz) {
   return div;
 }
 
-Table& Container::NewTable() { return NewItem<Table>(); }
+Container& Container::AddStyle(absl::string_view style) {
+  NewItem<Container>("style").Text(std::string(style));
+  return *this;
+}
+
+Table& Container::NewTable(std::string clazz) {
+  return NewItem<Table>(std::move(clazz));
+}
 
 Container& Table::Cell(int column, int row) {
   num_columns_ = std::max(num_columns_, column + 1);
   num_rows_ = std::max(num_rows_, row + 1);
   auto it = cells_.find(std::tuple(column, row));
   if (it == cells_.end()) {
-    it = cells_.emplace(std::tuple(column, row), Container("td")).first;
+    it = cells_.emplace(std::tuple(column, row), Container("div")).first;
   }
   return it->second;
 }
 
 std::string Table::Render() const {
-  if (cells_.empty()) return "<table/>";
-  std::string s = "<table>";
-  for (int r = 0; r < num_rows_; ++r) {
-    absl::StrAppend(&s, "<tr>");
-    for (int c = 0; c < num_columns_; ++c) {
-      auto it = cells_.find(std::tuple(c, r));
-      if (it == cells_.end()) {
-        absl::StrAppend(&s, "<td/>");
-      } else {
-        absl::StrAppend(&s, it->second.Render());
+  std::string s = absl::StrCat("<table class=\"", HtmlEscape(clazz_), "\">");
+
+  int r = 0;
+  if (num_header_rows_ > 0) {
+    absl::StrAppend(&s, "<thead>");
+    for (; r < num_header_rows_; ++r) {
+      absl::StrAppend(&s, "<tr>");
+      for (int c = 0; c < num_columns_; ++c) {
+        auto it = cells_.find(std::tuple(c, r));
+        if (it == cells_.end()) {
+          absl::StrAppend(&s, "<th/>");
+        } else {
+          absl::StrAppend(&s, "<th>", it->second.Render(), "</th>");
+        }
       }
+      absl::StrAppend(&s, "</tr>");
     }
-    absl::StrAppend(&s, "</tr>");
+    absl::StrAppend(&s, "</thead>");
   }
+
+  absl::StrAppend(&s, "<tbody>");
+  if (r < num_rows_) {
+    for (; r < num_rows_; ++r) {
+      absl::StrAppend(&s, "<tr>");
+      for (int c = 0; c < num_columns_; ++c) {
+        auto it = cells_.find(std::tuple(c, r));
+        const char* tag = c < num_header_columns_ ? "th" : "td";
+        if (it == cells_.end()) {
+          absl::StrAppend(&s, "<", tag, "/>");
+        } else {
+          absl::StrAppend(&s, "<", tag, ">", it->second.Render(), "</", tag,
+                          ">");
+        }
+      }
+      absl::StrAppend(&s, "</tr>");
+    }
+  }
+  absl::StrAppend(&s, "</tbody>");
+
   absl::StrAppend(&s, "</table>");
   return s;
 }
diff --git a/deps/grpc/src/core/channelz/zviz/html.h b/deps/grpc/src/core/channelz/zviz/html.h
index 92c9cb20e29..11cf4476c37 100644
--- a/deps/grpc/src/core/channelz/zviz/html.h
+++ b/deps/grpc/src/core/channelz/zviz/html.h
@@ -22,6 +22,7 @@
 
 #include "absl/container/flat_hash_map.h"
 #include "absl/functional/function_ref.h"
+#include "absl/log/check.h"
 #include "absl/strings/string_view.h"
 
 namespace grpc_zviz::html {
@@ -48,9 +49,12 @@ class Table;
 class Container final : public Item {
  public:
   explicit Container(std::string tag) : tag_(std::move(tag)) {}
+  Container() = default;
   std::string Render() const override;
 
   Container& Attribute(std::string name, std::string value) {
+    CHECK(tag_.has_value())
+        << "Attributes can only be set on containers with a tag.";
     attributes_.emplace_back(std::move(name), std::move(value));
     return *this;
   }
@@ -76,10 +80,11 @@ class Container final : public Item {
   Container& LinkDiv(std::string clazz, std::string text, std::string url) {
     return Div(clazz, [&](Container& div) { div.Link(std::move(text), url); });
   }
-  Table& NewTable();
+  Table& NewTable(std::string clazz);
+  Container& AddStyle(absl::string_view style);
 
  private:
-  std::string tag_;
+  std::optional<std::string> tag_;
   std::vector<std::pair<std::string, std::string>> attributes_;
   std::vector<std::unique_ptr<html::Item>> items_;
 };
@@ -88,11 +93,18 @@ Container Div(std::string clazz, absl::FunctionRef<void(Container&)> f);
 
 class Table final : public Item {
  public:
+  explicit Table(std::string clazz) : clazz_(std::move(clazz)) {}
+
   Container& Cell(int column, int row);
+  void set_num_header_columns(int n) { num_header_columns_ = n; }
+  void set_num_header_rows(int n) { num_header_rows_ = n; }
   std::string Render() const override;
 
  private:
   using Address = std::tuple<int, int>;
+  std::string clazz_;
+  int num_header_columns_ = 0;
+  int num_header_rows_ = 0;
   int num_columns_ = 0;
   int num_rows_ = 0;
   absl::flat_hash_map<Address, Container> cells_;
diff --git a/deps/grpc/src/core/channelz/zviz/layout.h b/deps/grpc/src/core/channelz/zviz/layout.h
index f932bd34738..6ebf20c9bdb 100644
--- a/deps/grpc/src/core/channelz/zviz/layout.h
+++ b/deps/grpc/src/core/channelz/zviz/layout.h
@@ -17,6 +17,7 @@
 
 #include <string>
 
+#include "absl/strings/str_cat.h"
 #include "google/protobuf/duration.pb.h"
 #include "google/protobuf/timestamp.pb.h"
 #include "src/core/channelz/zviz/environment.h"
@@ -47,13 +48,13 @@ void AbslStringify(Sink& sink, Intent intent) {
       sink.Append("heading");
       break;
     case Intent::kEntityRef:
-      sink.Append("entity_ref");
+      sink.Append("entity-ref");
       break;
     case Intent::kTrace:
       sink.Append("trace");
       break;
     case Intent::kTraceDescription:
-      sink.Append("trace_description");
+      sink.Append("trace-description");
       break;
     case Intent::kTimestamp:
       sink.Append("timestamp");
@@ -80,6 +81,7 @@ enum class TableIntent {
   kTrace,
   kPropertyList,
   kPropertyGrid,
+  kPropertyTable,
 };
 
 template <typename Sink>
@@ -89,10 +91,13 @@ void AbslStringify(Sink& sink, TableIntent intent) {
       sink.Append("trace");
       break;
     case TableIntent::kPropertyList:
-      sink.Append("property_list");
+      sink.Append("property-list");
       break;
     case TableIntent::kPropertyGrid:
-      sink.Append("property_grid");
+      sink.Append("property-grid");
+      break;
+    case TableIntent::kPropertyTable:
+      sink.Append("property-table");
       break;
   }
 }
diff --git a/deps/grpc/src/core/channelz/zviz/layout_html.cc b/deps/grpc/src/core/channelz/zviz/layout_html.cc
index 43cbccaf116..de2db4e2eee 100644
--- a/deps/grpc/src/core/channelz/zviz/layout_html.cc
+++ b/deps/grpc/src/core/channelz/zviz/layout_html.cc
@@ -14,54 +14,33 @@
 
 #include "src/core/channelz/zviz/layout_html.h"
 
+#include "absl/strings/str_cat.h"
+
 namespace grpc_zviz::layout {
 
 namespace {
 
-std::string IntentToStyle(Intent intent) {
-  switch (intent) {
-    case Intent::kBanner:
-      return "zviz-banner";
-    case Intent::kHeading:
-      return "zviz-heading";
-    case Intent::kEntityRef:
-      return "zviz-entity-ref";
-    case Intent::kTrace:
-      return "zviz-trace";
-    case Intent::kTraceDescription:
-      return "zviz-trace-description";
-    case Intent::kData:
-      return "zviz-data";
-    case Intent::kTimestamp:
-      return "zviz-timestamp";
-    case Intent::kNote:
-      return "zviz-note";
-    case Intent::kKey:
-      return "zviz-key";
-    case Intent::kValue:
-      return "zviz-value";
-    case Intent::kDuration:
-      return "zviz-duration";
-  }
+template <typename T>
+std::string Stringify(T V) {
+  return absl::StrCat("zviz-", V);
 }
 
 }  // namespace
 
 Element& HtmlElement::AppendText(Intent intent, absl::string_view text) {
-  container_.TextDiv(IntentToStyle(intent), std::string(text));
+  container_.TextDiv(Stringify(intent), std::string(text));
   return *this;
 }
 
 Element& HtmlElement::AppendLink(Intent intent, absl::string_view text,
                                  absl::string_view href) {
-  container_.LinkDiv(IntentToStyle(intent), std::string(text),
-                     std::string(href));
+  container_.LinkDiv(Stringify(intent), std::string(text), std::string(href));
   return *this;
 }
 
 Element& HtmlElement::AppendGroup(Intent intent) {
   return *children_.emplace_back(
-      std::make_unique<HtmlElement>(container_.NewDiv(IntentToStyle(intent))));
+      std::make_unique<HtmlElement>(container_.NewDiv(Stringify(intent))));
 }
 
 Element& HtmlElement::AppendData(absl::string_view name, absl::string_view) {
@@ -70,13 +49,44 @@ Element& HtmlElement::AppendData(absl::string_view name, absl::string_view) {
   return grp;
 }
 
-Table& HtmlElement::AppendTable(TableIntent) {
-  return *tables_.emplace_back(
-      std::make_unique<HtmlTable>(container_.NewTable()));
+Table& HtmlElement::AppendTable(TableIntent intent) {
+  return *tables_.emplace_back(std::make_unique<HtmlTable>(
+      container_.NewTable(Stringify(intent)), intent));
+}
+
+HtmlTable::HtmlTable(html::Table& table, TableIntent intent) : table_(table) {
+  switch (intent) {
+    case TableIntent::kPropertyList:
+      in_header_ = false;
+      break;
+    case TableIntent::kPropertyGrid:
+      table_.set_num_header_columns(1);
+      in_header_ = true;
+      break;
+    case TableIntent::kPropertyTable:
+    case TableIntent::kTrace:
+      in_header_ = true;
+      break;
+  }
+  if (in_header_) {
+    table_.set_num_header_rows(1);
+  }
 }
 
 Element& HtmlTable::AppendColumn() {
+  if (in_header_) {
+    table_.set_num_header_rows(1);
+  }
   return *elements_.emplace_back(
       std::make_unique<HtmlElement>(table_.Cell(column_++, row_)));
 }
+
+void HtmlTable::NewRow() {
+  if (in_header_) {
+    in_header_ = false;
+  }
+  row_++;
+  column_ = 0;
+}
+
 }  // namespace grpc_zviz::layout
diff --git a/deps/grpc/src/core/channelz/zviz/layout_html.h b/deps/grpc/src/core/channelz/zviz/layout_html.h
index 03151a68b74..6f6837555af 100644
--- a/deps/grpc/src/core/channelz/zviz/layout_html.h
+++ b/deps/grpc/src/core/channelz/zviz/layout_html.h
@@ -15,7 +15,8 @@
 #ifndef GRPC_SRC_CORE_CHANNELZ_ZVIZ_LAYOUT_HTML_H
 #define GRPC_SRC_CORE_CHANNELZ_ZVIZ_LAYOUT_HTML_H
 
-#include "src/core/channelz/zviz/environment.h"
+#include <vector>
+
 #include "src/core/channelz/zviz/html.h"
 #include "src/core/channelz/zviz/layout.h"
 
@@ -23,9 +24,10 @@ namespace grpc_zviz::layout {
 
 class HtmlTable;
 
-class HtmlElement final : public Element {
+class HtmlElement : public Element {
  public:
   explicit HtmlElement(html::Container& container) : container_(container) {}
+
   Element& AppendText(Intent intent, absl::string_view text) override;
   Element& AppendLink(Intent intent, absl::string_view text,
                       absl::string_view href) override;
@@ -39,21 +41,19 @@ class HtmlElement final : public Element {
   std::vector<std::unique_ptr<HtmlTable>> tables_;
 };
 
-class HtmlTable final : public Table {
+class HtmlTable : public Table {
  public:
-  explicit HtmlTable(html::Table& table) : table_(table) {}
-  Element& AppendColumn() override;
+  HtmlTable(html::Table& table, TableIntent intent);
 
-  void NewRow() override {
-    column_ = 0;
-    ++row_;
-  }
+  Element& AppendColumn() override;
+  void NewRow() override;
 
  private:
   html::Table& table_;
-  std::vector<std::unique_ptr<HtmlElement>> elements_;
   int column_ = 0;
   int row_ = 0;
+  bool in_header_;
+  std::vector<std::unique_ptr<Element>> elements_;
 };
 
 }  // namespace grpc_zviz::layout
diff --git a/deps/grpc/src/core/channelz/zviz/style.cc b/deps/grpc/src/core/channelz/zviz/style.cc
new file mode 100644
index 00000000000..88066594f44
--- /dev/null
+++ b/deps/grpc/src/core/channelz/zviz/style.cc
@@ -0,0 +1,90 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/core/channelz/zviz/style.h"
+
+#include <string>
+
+namespace grpc_zviz {
+
+// Returns a std::string because this is passed to a handler that may outlive
+// the current library.
+std::string DefaultStyle() {
+  return R"css(
+body {
+  font-family: sans-serif;
+  background-color: #f8f8f8;
+  color: #333;
+}
+.zviz-banner {
+  background-color: #e0e0e0;
+  padding: 10px;
+  font-size: 1.2em;
+  font-weight: bold;
+}
+.zviz-heading {
+  font-weight: bold;
+  margin-top: 10px;
+  margin-bottom: 5px;
+  background-color: #eee;
+  padding: 5px;
+  border-radius: 3px;
+}
+.zviz-property-list > .zviz-heading,
+.zviz-property-table > .zviz-heading,
+.zviz-property-grid > .zviz-heading {
+  background-color: transparent;
+  padding: 0;
+  border-radius: 0;
+  margin-top: 0;
+}
+.zviz-data {
+}
+.zviz-key {
+  font-weight: bold;
+  padding-right: 1em;
+  vertical-align: top;
+}
+table {
+  border-collapse: collapse;
+  width: auto;
+  margin-bottom: 10px;
+}
+.zviz-property-list td {
+  vertical-align: top;
+}
+.zviz-property-list > tbody > tr {
+  border-bottom: 1px solid #ccc;
+}
+.zviz-property-list > tbody > tr:last-child {
+  border-bottom: none;
+}
+th, td {
+  padding: 8px;
+  text-align: left;
+}
+.zviz-property-table th,
+.zviz-property-table td,
+.zviz-property-grid th,
+.zviz-property-grid td {
+  padding: 8px 4px;
+}
+thead {
+  background-color: #f2f2f2;
+  border-bottom: 2px solid #ccc;
+}
+)css";
+}
+
+}  // namespace grpc_zviz
diff --git a/deps/grpc/src/core/channelz/zviz/style.h b/deps/grpc/src/core/channelz/zviz/style.h
new file mode 100644
index 00000000000..b322101566f
--- /dev/null
+++ b/deps/grpc/src/core/channelz/zviz/style.h
@@ -0,0 +1,26 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_CHANNELZ_ZVIZ_STYLE_H
+#define GRPC_SRC_CORE_CHANNELZ_ZVIZ_STYLE_H
+
+#include <string>
+
+namespace grpc_zviz {
+
+std::string DefaultStyle();
+
+}  // namespace grpc_zviz
+
+#endif  // GRPC_SRC_CORE_CHANNELZ_ZVIZ_STYLE_H
diff --git a/deps/grpc/src/core/client_channel/GEMINI.md b/deps/grpc/src/core/client_channel/GEMINI.md
new file mode 100644
index 00000000000..a6d7f65378e
--- /dev/null
+++ b/deps/grpc/src/core/client_channel/GEMINI.md
@@ -0,0 +1,57 @@
+# gRPC Client Channel
+
+This directory contains the core implementation of the client-side channel in gRPC. It's responsible for managing the entire lifecycle of a connection from a client to a server, including name resolution, load balancing, and connectivity.
+
+## Overarching Purpose
+
+The code in this directory provides the building blocks for creating and managing client-side channels. It orchestrates the process of turning a target URI into a set of connections to backend servers, and then distributing RPCs across those connections.
+
+## Core Concepts
+
+The client channel is built around a few key abstractions:
+
+*   **`ClientChannel`**: The top-level object that represents a connection to a service. It owns the other components and is responsible for orchestrating the overall process of name resolution, load balancing, and connection management.
+*   **`Subchannel`**: A `Subchannel` represents a connection to a single backend address. A `ClientChannel` typically manages multiple `Subchannel`s, one for each address returned by the resolver.
+*   **`Resolver`**: The `Resolver` is responsible for taking a target URI (e.g., "dns:///my-service.example.com") and resolving it to a list of backend addresses. See the [resolver documentation](../resolver/GEMINI.md) for more details.
+*   **`LoadBalancingPolicy`**: The `LoadBalancingPolicy` is responsible for taking the list of subchannels from the `ClientChannel` and deciding which one to use for each RPC. See the [load balancing documentation](../load_balancing/GEMINI.md) for more details.
+
+## Legacy Architecture
+
+The original architecture of the client channel relied heavily on callback-based filters. This approach is still present in some parts of the code, but is being actively migrated to a more modern, promise-based model.
+
+*   **`retry_filter.h`, `retry_filter.cc`**: Implements a channel filter that provides automatic retries for failed RPCs, based on the service config. This is an example of a "dynamic filter", which can be configured on a per-service or per-method basis.
+*   **`dynamic_filters.h`, `dynamic_filters.cc`**: These files provide the framework for creating and managing dynamic filters.
+
+## Modern Architecture
+
+The newer architecture of the client channel is based on promise-based interceptors. This approach is more flexible and easier to reason about, and is the preferred way to implement new features.
+
+*   **`retry_interceptor.h`, `retry_interceptor.cc`**: Implements an interceptor that provides automatic retries for failed RPCs, based on the service config. This is the modern, promise-based replacement for `retry_filter`.
+
+## Files
+
+*   **`client_channel.h`, `client_channel.cc`**: These files contain the main `ClientChannel` class, which is the primary implementation of the `grpc::Channel` interface for clients. It manages the entire lifecycle of a client-side channel.
+*   **`subchannel.h`, `subchannel.cc`**: These files define the `Subchannel` class, which represents a connection to a single backend address.
+*   **`client_channel_factory.h`, `client_channel_factory.cc`**: These files define the `ClientChannelFactory`, which is responsible for creating `ClientChannel` and `Subchannel` instances.
+*   **`connector.h`**: Defines the `Connector` interface, which is responsible for establishing a transport-level connection to a given address.
+*   **`load_balanced_call_destination.h`, `load_balanced_call_destination.cc`**: Defines the `LoadBalancedCallDestination`, which is a call destination that uses a `LoadBalancingPolicy` to select a subchannel for each call.
+*   **`retry_filter.h`, `retry_filter.cc`**: Implements a channel filter that provides automatic retries for failed RPCs, based on the service config. This is an example of a "dynamic filter", which can be configured on a per-service or per-method basis.
+*   **`retry_interceptor.h`, `retry_interceptor.cc`**: Implements an interceptor that provides automatic retries for failed RPCs, based on the service config.
+*   **`config_selector.h`**: Defines the `ConfigSelector` class, which is used to select the appropriate service config for a given RPC.
+*   **`subchannel_pool_interface.h`, `subchannel_pool_interface.cc`**: Defines the interface for a subchannel pool, which is used to cache and reuse subchannels.
+*   **`global_subchannel_pool.h`, `global_subchannel_pool.cc`**: Implements a global subchannel pool that can be shared across multiple channels.
+
+## Major Classes
+
+*   **`grpc_core::ClientChannel`**: The main client-side channel implementation. It integrates the [resolver](../resolver/GEMINI.md), [load balancing policy](../load_balancing/GEMINI.md), and subchannels to provide a unified view of a connection to a service.
+*   **`grpc_core::Subchannel`**: Represents a single connection to a backend. It manages the connectivity state of that connection and provides a mechanism for creating transports.
+*   **`grpc_core::ClientChannelFactory`**: A factory class for creating client channels and subchannels.
+*   **`grpc_core::Connector`**: An interface for creating a transport-level connection.
+
+## Notes
+
+*   The client channel is a complex piece of machinery that coordinates several different components. Understanding the roles of the [resolver](../resolver/GEMINI.md), [load balancing policy](../load_balancing/GEMINI.md), and subchannels is key to understanding how it works.
+*   Much of the client channel is being migrated to a new, promise-based architecture. As a result, you will see a mix of legacy callback-based code and newer promise-based code. The `retry_filter.h` and `retry_interceptor.h` files are a good example of this transition, where the former is the legacy implementation and the latter is the new promise-based one.
+*   The `dynamic_filters` are a legacy mechanism for adding filters to the channel. They are being replaced by the more flexible interceptor model.
+*   The `ClientChannel` uses a `WorkSerializer` to ensure that all of its internal state is accessed in a thread-safe manner.
+*   The `ConfigSelector` allows for different service configs to be used for different RPCs on the same channel. This is used to support features like per-method retry policies.
diff --git a/deps/grpc/src/core/client_channel/client_channel_filter.cc b/deps/grpc/src/core/client_channel/client_channel_filter.cc
index 3a3490e6839..38212489bdd 100644
--- a/deps/grpc/src/core/client_channel/client_channel_filter.cc
+++ b/deps/grpc/src/core/client_channel/client_channel_filter.cc
@@ -2290,7 +2290,8 @@ class ClientChannelFilter::LoadBalancedCall::LbCallState final
   ServiceConfigCallData::CallAttributeInterface* GetCallAttribute(
       UniqueTypeName type) const override;
 
-  ClientCallTracer::CallAttemptTracer* GetCallAttemptTracer() const override;
+  ClientCallTracerInterface::CallAttemptTracer* GetCallAttemptTracer()
+      const override;
 
  private:
   LoadBalancedCall* lb_call_;
@@ -2307,7 +2308,7 @@ ClientChannelFilter::LoadBalancedCall::LbCallState::GetCallAttribute(
   return service_config_call_data->GetCallAttribute(type);
 }
 
-ClientCallTracer::CallAttemptTracer*
+ClientCallTracerInterface::CallAttemptTracer*
 ClientChannelFilter::LoadBalancedCall::LbCallState::GetCallAttemptTracer()
     const {
   return lb_call_->call_attempt_tracer();
@@ -2364,9 +2365,9 @@ class ClientChannelFilter::LoadBalancedCall::BackendMetricAccessor final
 
 namespace {
 
-ClientCallTracer::CallAttemptTracer* CreateCallAttemptTracer(
+ClientCallTracerInterface::CallAttemptTracer* CreateCallAttemptTracer(
     Arena* arena, bool is_transparent_retry) {
-  auto* call_tracer = DownCast<ClientCallTracer*>(
+  auto* call_tracer = DownCast<ClientCallTracerInterface*>(
       arena->GetContext<CallTracerAnnotationInterface>());
   if (call_tracer == nullptr) return nullptr;
   auto* tracer = call_tracer->StartNewAttempt(is_transparent_retry);
diff --git a/deps/grpc/src/core/client_channel/client_channel_filter.h b/deps/grpc/src/core/client_channel/client_channel_filter.h
index 94c70abdf68..ed5ed5afd9d 100644
--- a/deps/grpc/src/core/client_channel/client_channel_filter.h
+++ b/deps/grpc/src/core/client_channel/client_channel_filter.h
@@ -373,7 +373,7 @@ class ClientChannelFilter::LoadBalancedCall
 
  protected:
   ClientChannelFilter* chand() const { return chand_; }
-  ClientCallTracer::CallAttemptTracer* call_attempt_tracer() const {
+  ClientCallTracerInterface::CallAttemptTracer* call_attempt_tracer() const {
     return call_attempt_tracer_;
   }
   ConnectedSubchannel* connected_subchannel() const {
@@ -434,7 +434,7 @@ class ClientChannelFilter::LoadBalancedCall
   // previous attempt yet leading to a situation where we have two active call
   // attempt tracers, and so we cannot rely on the arena to give us the right
   // tracer when performing cleanup.
-  ClientCallTracer::CallAttemptTracer* call_attempt_tracer_;
+  ClientCallTracerInterface::CallAttemptTracer* call_attempt_tracer_;
 
   absl::AnyInvocable<void()> on_commit_;
 
diff --git a/deps/grpc/src/core/client_channel/client_channel_internal.h b/deps/grpc/src/core/client_channel/client_channel_internal.h
index 4fbba6966b7..f251fca3633 100644
--- a/deps/grpc/src/core/client_channel/client_channel_internal.h
+++ b/deps/grpc/src/core/client_channel/client_channel_internal.h
@@ -54,7 +54,8 @@ class ClientChannelLbCallState : public LoadBalancingPolicy::CallState {
 
   virtual ServiceConfigCallData::CallAttributeInterface* GetCallAttribute(
       UniqueTypeName type) const = 0;
-  virtual ClientCallTracer::CallAttemptTracer* GetCallAttemptTracer() const = 0;
+  virtual ClientCallTracerInterface::CallAttemptTracer* GetCallAttemptTracer()
+      const = 0;
 };
 
 // Internal type for ServiceConfigCallData.  Handles call commits.
diff --git a/deps/grpc/src/core/client_channel/load_balanced_call_destination.cc b/deps/grpc/src/core/client_channel/load_balanced_call_destination.cc
index d0ce948d227..10ffd387fec 100644
--- a/deps/grpc/src/core/client_channel/load_balanced_call_destination.cc
+++ b/deps/grpc/src/core/client_channel/load_balanced_call_destination.cc
@@ -29,7 +29,7 @@ namespace grpc_core {
 namespace {
 
 void MaybeCreateCallAttemptTracer(bool is_transparent_retry) {
-  auto* call_tracer = MaybeGetContext<ClientCallTracer>();
+  auto* call_tracer = MaybeGetContext<ClientCallTracerInterface>();
   if (call_tracer == nullptr) return;
   auto* tracer = call_tracer->StartNewAttempt(is_transparent_retry);
   SetContext<CallTracerInterface>(tracer);
@@ -47,8 +47,9 @@ class LbCallState : public ClientChannelLbCallState {
     return service_config_call_data->GetCallAttribute(type);
   }
 
-  ClientCallTracer::CallAttemptTracer* GetCallAttemptTracer() const override {
-    return GetContext<ClientCallTracer::CallAttemptTracer>();
+  ClientCallTracerInterface::CallAttemptTracer* GetCallAttemptTracer()
+      const override {
+    return GetContext<ClientCallTracerInterface::CallAttemptTracer>();
   }
 };
 
@@ -239,8 +240,8 @@ void LoadBalancedCallDestination::StartCall(
               }
               // If it was queued, add a trace annotation.
               if (was_queued) {
-                auto* tracer =
-                    MaybeGetContext<ClientCallTracer::CallAttemptTracer>();
+                auto* tracer = MaybeGetContext<
+                    ClientCallTracerInterface::CallAttemptTracer>();
                 if (tracer != nullptr) {
                   tracer->RecordAnnotation("Delayed LB pick complete.");
                 }
diff --git a/deps/grpc/src/core/client_channel/subchannel.cc b/deps/grpc/src/core/client_channel/subchannel.cc
index 643a1a7b12c..132df0779a9 100644
--- a/deps/grpc/src/core/client_channel/subchannel.cc
+++ b/deps/grpc/src/core/client_channel/subchannel.cc
@@ -117,7 +117,7 @@ class LegacyConnectedSubchannel : public ConnectedSubchannel {
     channel_stack_.reset(DEBUG_LOCATION, "ConnectedSubchannel");
   }
 
-  channelz::SubchannelNode* channelz_node() const {
+  channelz::SubchannelNode* channelz_node() const override {
     return channelz_node_.get();
   }
 
@@ -220,6 +220,8 @@ class NewConnectedSubchannel : public ConnectedSubchannel {
     Crash("legacy ping method called in call v3 impl");
   }
 
+  channelz::SubchannelNode* channelz_node() const override { return nullptr; }
+
  private:
   RefCountedPtr<UnstartedCallDestination> call_destination_;
   RefCountedPtr<TransportCallDestination> transport_;
@@ -410,17 +412,21 @@ class Subchannel::ConnectedSubchannelStateWatcher final
       // we will see TRANSIENT_FAILURE followed by SHUTDOWN, but if not, we
       // will see only SHUTDOWN.  Either way, we react to the first one we
       // see, ignoring anything that happens after that.
-      if (c->connected_subchannel_ == nullptr) return;
       if (new_state == GRPC_CHANNEL_TRANSIENT_FAILURE ||
           new_state == GRPC_CHANNEL_SHUTDOWN) {
+        RefCountedPtr<ConnectedSubchannel> connected_subchannel =
+            std::move(c->connected_subchannel_);
+        if (connected_subchannel == nullptr) return;
         GRPC_TRACE_LOG(subchannel, INFO)
             << "subchannel " << c << " " << c->key_.ToString()
-            << ": Connected subchannel " << c->connected_subchannel_.get()
+            << ": Connected subchannel " << connected_subchannel.get()
             << " reports " << ConnectivityStateName(new_state) << ": "
             << status;
-        c->connected_subchannel_.reset();
         if (c->channelz_node() != nullptr) {
-          c->channelz_node()->SetChildSocket(nullptr);
+          if (connected_subchannel->channelz_node() != nullptr) {
+            connected_subchannel->channelz_node()->RemoveParent(
+                c->channelz_node());
+          }
         }
         // If the subchannel was created from an endpoint, then we report
         // TRANSIENT_FAILURE here instead of IDLE. The subchannel will never
@@ -880,7 +886,9 @@ bool Subchannel::PublishTransportLocked() {
       << "subchannel " << this << " " << key_.ToString()
       << ": new connected subchannel at " << connected_subchannel_.get();
   if (channelz_node_ != nullptr) {
-    channelz_node_->SetChildSocket(std::move(socket_node));
+    if (socket_node != nullptr) {
+      socket_node->AddParent(channelz_node_.get());
+    }
   }
   // Start watching connected subchannel.
   connected_subchannel_->StartWatch(
diff --git a/deps/grpc/src/core/client_channel/subchannel.h b/deps/grpc/src/core/client_channel/subchannel.h
index 1392f5c2854..b11d54143a9 100644
--- a/deps/grpc/src/core/client_channel/subchannel.h
+++ b/deps/grpc/src/core/client_channel/subchannel.h
@@ -85,6 +85,8 @@ class ConnectedSubchannel : public RefCounted<ConnectedSubchannel> {
   virtual size_t GetInitialCallSizeEstimate() const = 0;
   virtual void Ping(grpc_closure* on_initiate, grpc_closure* on_ack) = 0;
 
+  virtual channelz::SubchannelNode* channelz_node() const = 0;
+
  protected:
   explicit ConnectedSubchannel(const ChannelArgs& args);
 
diff --git a/deps/grpc/src/core/config/GEMINI.md b/deps/grpc/src/core/config/GEMINI.md
new file mode 100644
index 00000000000..2c3e1f92daa
--- /dev/null
+++ b/deps/grpc/src/core/config/GEMINI.md
@@ -0,0 +1,33 @@
+# gRPC Core Configuration
+
+This directory contains the fundamental building blocks for configuring the gRPC core library.
+
+See also: [gRPC Core overview](../GEMINI.md)
+
+## Overarching Purpose
+
+This directory manages both static configuration (via config variables) and dynamic configuration (via pluggable components). It provides a centralized and extensible way to configure the behavior of the gRPC core library.
+
+## Core Concepts
+
+*   **`ConfigVars`**: `ConfigVars` is a singleton that holds configuration properties for gRPC. These properties are loaded from environment variables, Abseil flags, and can be programmatically overridden. This provides a unified way to access configuration values throughout the library. The values are automatically generated from `config_vars.yaml`.
+*   **`CoreConfiguration`**: `CoreConfiguration` is a singleton that acts as a central registry for all pluggable components in gRPC. It uses a builder pattern (`CoreConfiguration::Builder`) to allow different parts of the system to register factories for things like resolvers, load balancing policies, handshakers, and channel filters. This is the primary mechanism for extending gRPC's functionality.
+
+## Files
+
+*   **`config_vars.h`, `config_vars.cc`**: These files define the `ConfigVars` class.
+*   **`config_vars.yaml`**: This file contains the definitions of all of the configuration variables that are available in gRPC. The `config_vars.h` and `config_vars.cc` files are generated from this file.
+*   **`core_configuration.h`, `core_configuration.cc`**: These files define the `CoreConfiguration` class and its builder.
+*   **`load_config.h`, `load_config.cc`**: These files provide helper functions to load configuration values from various sources (flags, environment variables, and programmatic overrides) with a defined order of precedence.
+
+## Major Classes
+
+*   **`grpc_core::ConfigVars`**: A singleton class that provides access to gRPC's core configuration variables. It's initialized once and can be accessed via `ConfigVars::Get()`.
+*   **`grpc_core::CoreConfiguration`**: A singleton that holds registries for various pluggable components. It's constructed via a `Builder` pattern, and is the main extension point for adding functionality to gRPC.
+*   **`grpc_core::CoreConfiguration::Builder`**: A builder class that is used to construct the `CoreConfiguration` singleton. It provides methods for registering factories for the different types of pluggable components.
+
+## Notes
+
+*   The configuration system is designed to be highly extensible. The `CoreConfiguration` class and its builder pattern are key to this design, allowing for a la carte inclusion of features.
+*   The `ConfigVars` are a good example of how gRPC uses code generation to ensure a single source of truth for configuration variables.
+*   The `CoreConfiguration` is initialized at startup, and it can be customized by registering new factories with the builder. This is the primary mechanism for extending gRPC's functionality. For example, to add a new load balancing policy, you would implement the `LoadBalancingPolicyFactory` interface and then register your factory with the `CoreConfiguration::Builder`.
diff --git a/deps/grpc/src/core/config/core_configuration.cc b/deps/grpc/src/core/config/core_configuration.cc
index 94dfeac0c6e..def26c2941d 100644
--- a/deps/grpc/src/core/config/core_configuration.cc
+++ b/deps/grpc/src/core/config/core_configuration.cc
@@ -51,7 +51,9 @@ CoreConfiguration::CoreConfiguration(Builder* builder)
       certificate_provider_registry_(
           builder->certificate_provider_registry_.Build()),
       endpoint_transport_registry_(
-          builder->endpoint_transport_registry_.Build()) {}
+          builder->endpoint_transport_registry_.Build()),
+      auth_context_comparator_registry_(
+          builder->auth_context_comparator_registry_.Build()) {}
 
 void CoreConfiguration::RegisterBuilder(
     BuilderScope scope, absl::AnyInvocable<void(Builder*)> builder,
diff --git a/deps/grpc/src/core/config/core_configuration.h b/deps/grpc/src/core/config/core_configuration.h
index b3522d92948..e6b779bc967 100644
--- a/deps/grpc/src/core/config/core_configuration.h
+++ b/deps/grpc/src/core/config/core_configuration.h
@@ -32,6 +32,7 @@
 #include "src/core/load_balancing/lb_policy_registry.h"
 #include "src/core/resolver/resolver_registry.h"
 #include "src/core/service_config/service_config_parser.h"
+#include "src/core/transport/auth_context_comparator_registry.h"
 #include "src/core/transport/endpoint_transport.h"
 #include "src/core/util/debug_location.h"
 
@@ -111,6 +112,10 @@ class GRPC_DLL CoreConfiguration {
       return &endpoint_transport_registry_;
     }
 
+    AuthContextComparatorRegistry::Builder* auth_context_comparator_registry() {
+      return &auth_context_comparator_registry_;
+    }
+
    private:
     friend class CoreConfiguration;
 
@@ -125,6 +130,7 @@ class GRPC_DLL CoreConfiguration {
     ProxyMapperRegistry::Builder proxy_mapper_registry_;
     CertificateProviderRegistry::Builder certificate_provider_registry_;
     EndpointTransportRegistry::Builder endpoint_transport_registry_;
+    AuthContextComparatorRegistry::Builder auth_context_comparator_registry_;
 
     Builder();
     CoreConfiguration* Build();
@@ -275,6 +281,11 @@ class GRPC_DLL CoreConfiguration {
     return endpoint_transport_registry_;
   }
 
+  const AuthContextComparatorRegistry& auth_context_comparator_registry()
+      const {
+    return auth_context_comparator_registry_;
+  }
+
   static void SetDefaultBuilder(void (*builder)(CoreConfiguration::Builder*)) {
     default_builder_ = builder;
   }
@@ -309,6 +320,7 @@ class GRPC_DLL CoreConfiguration {
   ProxyMapperRegistry proxy_mapper_registry_;
   CertificateProviderRegistry certificate_provider_registry_;
   EndpointTransportRegistry endpoint_transport_registry_;
+  AuthContextComparatorRegistry auth_context_comparator_registry_;
 };
 
 template <typename Sink>
diff --git a/deps/grpc/src/core/credentials/GEMINI.md b/deps/grpc/src/core/credentials/GEMINI.md
new file mode 100644
index 00000000000..5b7caacf1aa
--- /dev/null
+++ b/deps/grpc/src/core/credentials/GEMINI.md
@@ -0,0 +1,18 @@
+# gRPC Credentials
+
+This directory contains the core implementation of gRPC's credential system.
+
+## Overarching Purpose
+
+The credential system provides a pluggable mechanism for authenticating and authorizing gRPC calls. It is designed to be extensible, allowing new credential types to be added easily.
+
+## Subdirectories
+
+- **`call/`**: Defines the `grpc_call_credentials` interface, which is used to add per-call security information to a gRPC call.
+- **`transport/`**: Contains credentials implementations that are tied to a specific transport security type.
+
+## Notes
+
+- The credential system is a key component of gRPC's security infrastructure.
+- It is responsible for ensuring that all gRPC calls are properly authenticated and authorized.
+- The framework is designed to be flexible and extensible, allowing it to be adapted to different security requirements.
diff --git a/deps/grpc/src/core/credentials/call/GEMINI.md b/deps/grpc/src/core/credentials/call/GEMINI.md
new file mode 100644
index 00000000000..a6f2f9d1117
--- /dev/null
+++ b/deps/grpc/src/core/credentials/call/GEMINI.md
@@ -0,0 +1,25 @@
+# Call Credentials
+
+This directory defines the `grpc_call_credentials` interface, which is used to add per-call security information to a gRPC call.
+
+## Overarching Purpose
+
+Call credentials are used to attach security information to individual gRPC calls. This can be used for things like OAuth 2.0 access tokens, which need to be refreshed periodically.
+
+## Files
+
+- **`call_creds_util.h` / `call_creds_util.cc`**: Utilities for working with call credentials.
+- **`composite_call_credentials.h` / `composite_call_credentials.cc`**: A call credential that is composed of multiple other call credentials.
+- **`context_authenticator.h`**: A `grpc_auth_context` that is populated from call credentials.
+- **`credentials.h`**: The base `grpc_credentials` class.
+- **`fake_credentials.h`**: A fake implementation of call credentials for testing.
+- **`jwt_credentials.h` / `jwt_credentials.cc`**: An implementation of call credentials that uses JWTs.
+- **`oauth2_credentials.h` / `oauth2_credentials.cc`**: An implementation of call credentials that uses OAuth 2.0.
+- **`plugin_credentials.h` / `plugin_credentials.cc`**: An implementation of call credentials that uses a plugin.
+- **`sts_credentials.h` / `sts_credentials.cc`**: An implementation of call credentials that uses STS.
+
+## Notes
+
+- Call credentials are a powerful tool for adding per-call security to gRPC.
+- They are often used in conjunction with channel credentials to provide a complete security solution.
+- The `grpc_call_credentials` interface is designed to be extensible, allowing new call credential types to be added easily.
diff --git a/deps/grpc/src/core/credentials/transport/GEMINI.md b/deps/grpc/src/core/credentials/transport/GEMINI.md
new file mode 100644
index 00000000000..c1e29f2ca5a
--- /dev/null
+++ b/deps/grpc/src/core/credentials/transport/GEMINI.md
@@ -0,0 +1,23 @@
+# Transport-Specific Credentials
+
+This directory contains credentials implementations that are tied to a specific transport security type.
+
+## Overarching Purpose
+
+These credentials are used to configure the security of the underlying transport. For example, the `TlsCredentials` are used to configure TLS for the Chttp2 transport.
+
+## Files
+
+- **`alts_credentials.h` / `alts_credentials.cc`**: An implementation of credentials that uses ALTS.
+- **`google_compute_engine_credentials.h` / `google_compute_engine_credentials.cc`**: An implementation of credentials that uses GCE credentials.
+- **`google_iam_credentials.h` / `google_iam_credentials.cc`**: An implementation of credentials that uses Google IAM credentials.
+- **`insecure_credentials.h` / `insecure_credentials.cc`**: An implementation of credentials that does not use any security.
+- **`local_credentials.h` / `local_credentials.cc`**: An implementation of credentials that uses local credentials (e.g., UDS).
+- **`tls_credentials.h` / `tls_credentials.cc`**: An implementation of credentials that uses TLS.
+- **`xds_credentials.h` / `xds_credentials.cc`**: An implementation of credentials that uses XDS.
+
+## Notes
+
+- These credentials are used to configure the security of the underlying transport.
+- They are typically used in conjunction with channel credentials to provide a complete security solution.
+- The credentials in this directory are specific to certain transport security types, and will not work with other transport security types.
diff --git a/deps/grpc/src/core/credentials/transport/alts/alts_credentials.cc b/deps/grpc/src/core/credentials/transport/alts/alts_credentials.cc
index bf09de16e64..bd3226fe166 100644
--- a/deps/grpc/src/core/credentials/transport/alts/alts_credentials.cc
+++ b/deps/grpc/src/core/credentials/transport/alts/alts_credentials.cc
@@ -25,6 +25,7 @@
 
 #include <utility>
 
+#include "absl/log/log.h"
 #include "src/core/credentials/transport/alts/alts_security_connector.h"
 #include "src/core/credentials/transport/alts/check_gcp_environment.h"
 #include "src/core/credentials/transport/alts/grpc_alts_credentials_options.h"
@@ -89,6 +90,8 @@ grpc_channel_credentials* grpc_alts_credentials_create_customized(
     const grpc_alts_credentials_options* options,
     const char* handshaker_service_url, bool enable_untrusted_alts) {
   if (!enable_untrusted_alts && !grpc_alts_is_running_on_gcp()) {
+    LOG(ERROR) << "ALTS creds ignored. Not running on GCP and untrusted ALTS "
+                  "is not enabled.";
     return nullptr;
   }
   return new grpc_alts_credentials(options, handshaker_service_url);
@@ -98,6 +101,8 @@ grpc_server_credentials* grpc_alts_server_credentials_create_customized(
     const grpc_alts_credentials_options* options,
     const char* handshaker_service_url, bool enable_untrusted_alts) {
   if (!enable_untrusted_alts && !grpc_alts_is_running_on_gcp()) {
+    LOG(ERROR) << "ALTS server creds ignored. Not running on GCP and untrusted "
+                  "ALTS is not enabled.";
     return nullptr;
   }
   return new grpc_alts_server_credentials(options, handshaker_service_url);
diff --git a/deps/grpc/src/core/credentials/transport/alts/check_gcp_environment_windows.cc b/deps/grpc/src/core/credentials/transport/alts/check_gcp_environment_windows.cc
index 1982e10272e..dfbd5ec3962 100644
--- a/deps/grpc/src/core/credentials/transport/alts/check_gcp_environment_windows.cc
+++ b/deps/grpc/src/core/credentials/transport/alts/check_gcp_environment_windows.cc
@@ -27,6 +27,8 @@
 #include <tchar.h>
 #include <windows.h>
 
+#include <memory>
+
 #include "src/core/credentials/transport/alts/check_gcp_environment.h"
 #include "src/core/util/crash.h"
 
diff --git a/deps/grpc/src/core/credentials/transport/channel_creds_registry_init.cc b/deps/grpc/src/core/credentials/transport/channel_creds_registry_init.cc
index 2ab6c1d949b..79448e44e59 100644
--- a/deps/grpc/src/core/credentials/transport/channel_creds_registry_init.cc
+++ b/deps/grpc/src/core/credentials/transport/channel_creds_registry_init.cc
@@ -87,10 +87,12 @@ class TlsChannelCredsFactory : public ChannelCredsFactory<> {
     auto options = MakeRefCounted<grpc_tls_credentials_options>();
     if (!config->certificate_file().empty() ||
         !config->ca_certificate_file().empty()) {
+      // TODO(gtcooke94): Expose the spiffe_bundle_map option in the XDS
+      // bootstrap config to use here.
       options->set_certificate_provider(
           MakeRefCounted<FileWatcherCertificateProvider>(
               config->private_key_file(), config->certificate_file(),
-              config->ca_certificate_file(),
+              config->ca_certificate_file(), /*spiffe_bundle_map_file=*/"",
               config->refresh_interval().millis() / GPR_MS_PER_SEC));
     }
     options->set_watch_root_cert(!config->ca_certificate_file().empty());
diff --git a/deps/grpc/src/core/credentials/transport/ssl/ssl_credentials.cc b/deps/grpc/src/core/credentials/transport/ssl/ssl_credentials.cc
index 97b485622a2..e4e22c757e4 100644
--- a/deps/grpc/src/core/credentials/transport/ssl/ssl_credentials.cc
+++ b/deps/grpc/src/core/credentials/transport/ssl/ssl_credentials.cc
@@ -193,7 +193,7 @@ grpc_security_status grpc_ssl_credentials::InitializeClientHandshakerFactory(
                   "be nullptr";
     return GRPC_SECURITY_ERROR;
   }
-  options.pem_root_certs = pem_root_certs;
+  options.root_cert_info = std::make_shared<RootCertInfo>(pem_root_certs);
   options.root_store = root_store;
   options.alpn_protocols =
       grpc_fill_alpn_protocol_strings(&options.num_alpn_protocols);
diff --git a/deps/grpc/src/core/credentials/transport/ssl/ssl_security_connector.cc b/deps/grpc/src/core/credentials/transport/ssl/ssl_security_connector.cc
index 70368ee2755..a433b355472 100644
--- a/deps/grpc/src/core/credentials/transport/ssl/ssl_security_connector.cc
+++ b/deps/grpc/src/core/credentials/transport/ssl/ssl_security_connector.cc
@@ -243,8 +243,10 @@ class grpc_ssl_server_security_connector
           server_credentials->config().pem_key_cert_pairs;
       options.num_key_cert_pairs =
           server_credentials->config().num_key_cert_pairs;
-      options.pem_client_root_certs =
-          server_credentials->config().pem_root_certs;
+      if (server_credentials->config().pem_root_certs != nullptr) {
+        options.root_cert_info = std::make_shared<RootCertInfo>(
+            server_credentials->config().pem_root_certs);
+      }
       options.client_certificate_request =
           grpc_get_tsi_client_certificate_request_type(
               server_credentials->config().client_certificate_request);
@@ -360,7 +362,10 @@ class grpc_ssl_server_security_connector
     options.pem_key_cert_pairs = grpc_convert_grpc_to_tsi_cert_pairs(
         config->pem_key_cert_pairs, config->num_key_cert_pairs);
     options.num_key_cert_pairs = config->num_key_cert_pairs;
-    options.pem_client_root_certs = config->pem_root_certs;
+    if (config->pem_root_certs != nullptr) {
+      options.root_cert_info =
+          std::make_shared<RootCertInfo>(config->pem_root_certs);
+    }
     options.client_certificate_request =
         grpc_get_tsi_client_certificate_request_type(
             server_creds->config().client_certificate_request);
diff --git a/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.cc b/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.cc
index 4ffee101d30..075824db95d 100644
--- a/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.cc
+++ b/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.cc
@@ -22,14 +22,20 @@
 
 #include "absl/log/check.h"
 #include "absl/status/status.h"
+#include "src/core/credentials/transport/tls/spiffe_utils.h"
+#include "src/core/tsi/ssl_transport_security.h"
+
+bool grpc_tls_certificate_distributor::CertificateInfo::AreRootsEmpty() {
+  return IsRootCertInfoEmpty(roots.get());
+}
 
 void grpc_tls_certificate_distributor::SetKeyMaterials(
-    const std::string& cert_name, std::optional<std::string> pem_root_certs,
+    const std::string& cert_name, std::shared_ptr<RootCertInfo> roots,
     std::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs) {
-  CHECK(pem_root_certs.has_value() || pem_key_cert_pairs.has_value());
+  CHECK(roots != nullptr || pem_key_cert_pairs.has_value());
   grpc_core::MutexLock lock(&mu_);
   auto& cert_info = certificate_info_map_[cert_name];
-  if (pem_root_certs.has_value()) {
+  if (roots != nullptr) {
     // Successful credential updates will clear any pre-existing error.
     cert_info.SetRootError(absl::OkStatus());
     for (auto* watcher_ptr : cert_info.root_cert_watchers) {
@@ -49,9 +55,9 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
         }
       }
       watcher_ptr->OnCertificatesChanged(
-          pem_root_certs, std::move(pem_key_cert_pairs_to_report));
+          roots, std::move(pem_key_cert_pairs_to_report));
     }
-    cert_info.pem_root_certs = std::move(*pem_root_certs);
+    cert_info.roots = roots;
   }
   if (pem_key_cert_pairs.has_value()) {
     // Successful credential updates will clear any pre-existing error.
@@ -61,20 +67,19 @@ void grpc_tls_certificate_distributor::SetKeyMaterials(
       const auto watcher_it = watchers_.find(watcher_ptr);
       CHECK(watcher_it != watchers_.end());
       CHECK(watcher_it->second.identity_cert_name.has_value());
-      std::optional<absl::string_view> pem_root_certs_to_report;
-      if (pem_root_certs.has_value() &&
-          watcher_it->second.root_cert_name == cert_name) {
+      std::shared_ptr<RootCertInfo> roots_to_report;
+      if (roots != nullptr && watcher_it->second.root_cert_name == cert_name) {
         // In this case, We've already sent the credential updates at the time
         // when checking pem_root_certs, so we will skip here.
         continue;
       } else if (watcher_it->second.root_cert_name.has_value()) {
         auto& root_cert_info =
             certificate_info_map_[*watcher_it->second.root_cert_name];
-        if (!root_cert_info.pem_root_certs.empty()) {
-          pem_root_certs_to_report = root_cert_info.pem_root_certs;
+        if (!root_cert_info.AreRootsEmpty()) {
+          roots_to_report = root_cert_info.roots;
         }
       }
-      watcher_ptr->OnCertificatesChanged(pem_root_certs_to_report,
+      watcher_ptr->OnCertificatesChanged(std::move(roots_to_report),
                                          pem_key_cert_pairs);
     }
     cert_info.pem_key_cert_pairs = std::move(*pem_key_cert_pairs);
@@ -85,8 +90,7 @@ bool grpc_tls_certificate_distributor::HasRootCerts(
     const std::string& root_cert_name) {
   grpc_core::MutexLock lock(&mu_);
   const auto it = certificate_info_map_.find(root_cert_name);
-  return it != certificate_info_map_.end() &&
-         !it->second.pem_root_certs.empty();
+  return it != certificate_info_map_.end() && !it->second.AreRootsEmpty();
 };
 
 bool grpc_tls_certificate_distributor::HasKeyCertPairs(
@@ -129,9 +133,9 @@ void grpc_tls_certificate_distributor::SetErrorForCert(
       CHECK_NE(watcher_ptr, nullptr);
       const auto watcher_it = watchers_.find(watcher_ptr);
       CHECK(watcher_it != watchers_.end());
-      // root_cert_error_to_report is the error of the root cert this watcher is
-      // watching, if there is any.
-      grpc_error_handle root_cert_error_to_report;
+      // root_error_to_report is the error of the roots this watcher
+      // is watching, if there is any.
+      grpc_error_handle root_error_to_report;
       if (root_cert_error.has_value() &&
           watcher_it->second.root_cert_name == cert_name) {
         // In this case, We've already sent the error updates at the time when
@@ -140,9 +144,9 @@ void grpc_tls_certificate_distributor::SetErrorForCert(
       } else if (watcher_it->second.root_cert_name.has_value()) {
         auto& root_cert_info =
             certificate_info_map_[*watcher_it->second.root_cert_name];
-        root_cert_error_to_report = root_cert_info.root_cert_error;
+        root_error_to_report = root_cert_info.root_cert_error;
       }
-      watcher_ptr->OnError(root_cert_error_to_report, *identity_cert_error);
+      watcher_ptr->OnError(root_error_to_report, *identity_cert_error);
     }
     cert_info.SetIdentityError(*identity_cert_error);
   }
@@ -186,7 +190,7 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
     CHECK(watcher_it == watchers_.end());
     watchers_[watcher_ptr] = {std::move(watcher), root_cert_name,
                               identity_cert_name};
-    std::optional<absl::string_view> updated_root_certs;
+    std::shared_ptr<RootCertInfo> updated_roots;
     std::optional<grpc_core::PemKeyCertPairList> updated_identity_pairs;
     grpc_error_handle root_error;
     grpc_error_handle identity_error;
@@ -198,8 +202,8 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
       cert_info.root_cert_watchers.insert(watcher_ptr);
       root_error = cert_info.root_cert_error;
       // Empty credentials will be treated as no updates.
-      if (!cert_info.pem_root_certs.empty()) {
-        updated_root_certs = cert_info.pem_root_certs;
+      if (!cert_info.AreRootsEmpty()) {
+        updated_roots = cert_info.roots;
       }
     }
     if (identity_cert_name.has_value()) {
@@ -219,11 +223,12 @@ void grpc_tls_certificate_distributor::WatchTlsCertificates(
     // occurred while trying to fetch the latest cert, but the updated_*_certs
     // should always be valid. So we will send the updates regardless of
     // *_cert_error.
-    if (updated_root_certs.has_value() || updated_identity_pairs.has_value()) {
-      watcher_ptr->OnCertificatesChanged(updated_root_certs,
+    if (updated_roots != nullptr || updated_identity_pairs.has_value()) {
+      watcher_ptr->OnCertificatesChanged(updated_roots,
                                          std::move(updated_identity_pairs));
     }
-    // Notify this watcher if the certs it is watching already had some errors.
+    // Notify this watcher if the certs it is watching already had some
+    // errors.
     if (!root_error.ok() || !identity_error.ok()) {
       watcher_ptr->OnError(root_error, identity_error);
     }
diff --git a/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h b/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h
index 848ac805f41..125035f861d 100644
--- a/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h
+++ b/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h
@@ -29,8 +29,10 @@
 
 #include "absl/base/thread_annotations.h"
 #include "absl/strings/string_view.h"
+#include "src/core/credentials/transport/tls/spiffe_utils.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/lib/iomgr/error.h"
+#include "src/core/tsi/ssl_transport_security.h"
 #include "src/core/util/ref_counted.h"
 #include "src/core/util/sync.h"
 
@@ -53,11 +55,11 @@ struct grpc_tls_certificate_distributor
     // latest contents for both root and identity certificates, even when only
     // one side of it got updated.
     //
-    // @param root_certs the contents of the reloaded root certs.
+    // @param roots the contents of the reloaded roots.
     // @param key_cert_pairs the contents of the reloaded identity key-cert
     // pairs.
     virtual void OnCertificatesChanged(
-        std::optional<absl::string_view> root_certs,
+        std::shared_ptr<RootCertInfo> roots,
         std::optional<grpc_core::PemKeyCertPairList> key_cert_pairs) = 0;
 
     // Handles an error that occurs while attempting to fetch certificate data.
@@ -81,10 +83,11 @@ struct grpc_tls_certificate_distributor
   // Sets the key materials based on their certificate name.
   //
   // @param cert_name The name of the certificates being updated.
-  // @param pem_root_certs The content of root certificates.
+  // @param roots The content of the roots, either the pem root certificates or
+  // the SpiffeBundleMap.
   // @param pem_key_cert_pairs The content of identity key-cert pairs.
   void SetKeyMaterials(
-      const std::string& cert_name, std::optional<std::string> pem_root_certs,
+      const std::string& cert_name, std::shared_ptr<RootCertInfo> roots,
       std::optional<grpc_core::PemKeyCertPairList> pem_key_cert_pairs);
 
   bool HasRootCerts(const std::string& root_cert_name);
@@ -171,10 +174,12 @@ struct grpc_tls_certificate_distributor
   // root certs, while pem_root_certs still contains the valid old data.
   struct CertificateInfo {
     // The contents of the root certificates.
-    std::string pem_root_certs;
+    std::shared_ptr<RootCertInfo> roots;
     // The contents of the identity key-certificate pairs.
     grpc_core::PemKeyCertPairList pem_key_cert_pairs;
-    // The root cert reloading error propagated by the caller.
+    // TODO(gtcooke94) Swap to using absl::StatusOr<>
+    // https://github.com/grpc/grpc/pull/39708/files#r2144014200 The root cert
+    // reloading error propagated by the caller.
     grpc_error_handle root_cert_error;
     // The identity cert reloading error propagated by the caller.
     grpc_error_handle identity_cert_error;
@@ -188,10 +193,16 @@ struct grpc_tls_certificate_distributor
     std::set<TlsCertificatesWatcherInterface*> identity_cert_watchers;
 
     ~CertificateInfo() {}
+    // TODO(gtcooke94) These can be set directly, no need for setters
+    // https://github.com/grpc/grpc/pull/39708/files#r2144015746
     void SetRootError(grpc_error_handle error) { root_cert_error = error; }
     void SetIdentityError(grpc_error_handle error) {
       identity_cert_error = error;
     }
+
+    // Returns if the root variant contains either "", an empty SpiffeBundleMap,
+    // or a nullptr to a SpiffeBundleMap
+    bool AreRootsEmpty();
   };
 
   grpc_core::Mutex mu_;
@@ -202,8 +213,8 @@ struct grpc_tls_certificate_distributor
   // Stores information about each watcher.
   std::map<TlsCertificatesWatcherInterface*, WatcherInfo> watchers_
       ABSL_GUARDED_BY(mu_);
-  // The callback to notify the caller, e.g. the Producer, that the watch status
-  // is changed.
+  // The callback to notify the caller, e.g. the Producer, that the watch
+  // status is changed.
   std::function<void(std::string, bool, bool)> watch_status_callback_
       ABSL_GUARDED_BY(callback_mu_);
   // Stores the names of each certificate, and their corresponding credential
diff --git a/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_provider.cc b/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_provider.cc
index e7feeba2d65..2855c1e3016 100644
--- a/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_provider.cc
+++ b/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_provider.cc
@@ -31,6 +31,7 @@
 #include "absl/log/log.h"
 #include "absl/status/status.h"
 #include "absl/strings/string_view.h"
+#include "src/core/credentials/transport/tls/spiffe_utils.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/iomgr/error.h"
@@ -39,26 +40,37 @@
 #include "src/core/lib/slice/slice_internal.h"
 #include "src/core/tsi/ssl_transport_security_utils.h"
 #include "src/core/util/load_file.h"
+#include "src/core/util/match.h"
 #include "src/core/util/stat.h"
 #include "src/core/util/status_helper.h"
 
 namespace grpc_core {
 namespace {
 
-absl::Status ValidateRootCertificates(absl::string_view root_certificates) {
-  if (root_certificates.empty()) return absl::OkStatus();
-  absl::StatusOr<std::vector<X509*>> parsed_roots =
-      ParsePemCertificateChain(root_certificates);
-  if (!parsed_roots.ok()) {
-    return absl::Status(
-        parsed_roots.status().code(),
-        absl::StrCat("Failed to parse root certificates as PEM: ",
-                     parsed_roots.status().message()));
-  }
-  for (X509* x509 : *parsed_roots) {
-    X509_free(x509);
-  }
-  return absl::OkStatus();
+absl::Status ValidateRootCertificates(const RootCertInfo* root_cert_info) {
+  if (root_cert_info == nullptr) return absl::OkStatus();
+  return Match(
+      *root_cert_info,
+      [&](const std::string& root_certificates) {
+        if (root_certificates.empty()) return absl::OkStatus();
+        absl::StatusOr<std::vector<X509*>> parsed_roots =
+            ParsePemCertificateChain(root_certificates);
+        if (!parsed_roots.ok()) {
+          return absl::Status(
+              parsed_roots.status().code(),
+              absl::StrCat("Failed to parse root certificates as PEM: ",
+                           parsed_roots.status().message()));
+        }
+        for (X509* x509 : *parsed_roots) {
+          X509_free(x509);
+        }
+        return absl::OkStatus();
+      },
+      [&](const SpiffeBundleMap&) {
+        // SpiffeBundleMap validation is done when it is created - a value here
+        // inherently means that it is valid.
+        return absl::OkStatus();
+      });
 }
 
 absl::Status ValidatePemKeyCertPair(absl::string_view cert_chain,
@@ -88,23 +100,35 @@ absl::Status ValidatePemKeyCertPair(absl::string_view cert_chain,
   return absl::OkStatus();
 }
 
+bool HasRootCertInfoChanged(
+    const absl::StatusOr<std::shared_ptr<RootCertInfo>>& old,
+    const absl::StatusOr<std::shared_ptr<RootCertInfo>>& updated) {
+  if (old.status() != updated.status()) return true;  // Status changed.
+  if (!old.ok()) return false;  // Both have same non-OK status.
+  // Both have OK status.
+  if (*old == nullptr) return *updated != nullptr;
+  if (*updated == nullptr) return true;
+  // Both have non-null value.
+  return **old != **updated;
+}
+
 }  // namespace
 
 StaticDataCertificateProvider::StaticDataCertificateProvider(
     std::string root_certificate, PemKeyCertPairList pem_key_cert_pairs)
     : distributor_(MakeRefCounted<grpc_tls_certificate_distributor>()),
-      root_certificate_(std::move(root_certificate)),
+      root_cert_info_(std::make_shared<RootCertInfo>(root_certificate)),
       pem_key_cert_pairs_(std::move(pem_key_cert_pairs)) {
   distributor_->SetWatchStatusCallback([this](std::string cert_name,
                                               bool root_being_watched,
                                               bool identity_being_watched) {
     MutexLock lock(&mu_);
-    std::optional<std::string> root_certificate;
+    std::shared_ptr<RootCertInfo> root_cert_info;
     std::optional<PemKeyCertPairList> pem_key_cert_pairs;
     StaticDataCertificateProvider::WatcherInfo& info = watcher_info_[cert_name];
     if (!info.root_being_watched && root_being_watched &&
-        !root_certificate_.empty()) {
-      root_certificate = root_certificate_;
+        !IsRootCertInfoEmpty(root_cert_info_.get())) {
+      root_cert_info = root_cert_info_;
     }
     info.root_being_watched = root_being_watched;
     if (!info.identity_being_watched && identity_being_watched &&
@@ -115,10 +139,10 @@ StaticDataCertificateProvider::StaticDataCertificateProvider(
     if (!info.root_being_watched && !info.identity_being_watched) {
       watcher_info_.erase(cert_name);
     }
-    const bool root_has_update = root_certificate.has_value();
+    const bool root_has_update = root_cert_info != nullptr;
     const bool identity_has_update = pem_key_cert_pairs.has_value();
     if (root_has_update || identity_has_update) {
-      distributor_->SetKeyMaterials(cert_name, std::move(root_certificate),
+      distributor_->SetKeyMaterials(cert_name, std::move(root_cert_info),
                                     std::move(pem_key_cert_pairs));
     }
     grpc_error_handle root_cert_error;
@@ -150,7 +174,7 @@ UniqueTypeName StaticDataCertificateProvider::type() const {
 }
 
 absl::Status StaticDataCertificateProvider::ValidateCredentials() const {
-  absl::Status status = ValidateRootCertificates(root_certificate_);
+  absl::Status status = ValidateRootCertificates(root_cert_info_.get());
   if (!status.ok()) {
     return status;
   }
@@ -177,10 +201,12 @@ static constexpr int64_t kMinimumFileWatcherRefreshIntervalSeconds = 1;
 
 FileWatcherCertificateProvider::FileWatcherCertificateProvider(
     std::string private_key_path, std::string identity_certificate_path,
-    std::string root_cert_path, int64_t refresh_interval_sec)
+    std::string root_cert_path, std::string spiffe_bundle_map_path,
+    int64_t refresh_interval_sec)
     : private_key_path_(std::move(private_key_path)),
       identity_certificate_path_(std::move(identity_certificate_path)),
       root_cert_path_(std::move(root_cert_path)),
+      spiffe_bundle_map_path_(std::move(spiffe_bundle_map_path)),
       refresh_interval_sec_(refresh_interval_sec),
       distributor_(MakeRefCounted<grpc_tls_certificate_distributor>()) {
   if (refresh_interval_sec_ < kMinimumFileWatcherRefreshIntervalSeconds) {
@@ -192,7 +218,9 @@ FileWatcherCertificateProvider::FileWatcherCertificateProvider(
   // Private key and identity cert files must be both set or both unset.
   CHECK(private_key_path_.empty() == identity_certificate_path_.empty());
   // Must be watching either root or identity certs.
-  CHECK(!private_key_path_.empty() || !root_cert_path_.empty());
+  bool watching_root =
+      !root_cert_path_.empty() || !spiffe_bundle_map_path_.empty();
+  CHECK(!private_key_path_.empty() || watching_root);
   gpr_event_init(&shutdown_event_);
   ForceUpdate();
   auto thread_lambda = [](void* arg) {
@@ -216,13 +244,13 @@ FileWatcherCertificateProvider::FileWatcherCertificateProvider(
                                               bool root_being_watched,
                                               bool identity_being_watched) {
     MutexLock lock(&mu_);
-    std::optional<std::string> root_certificate;
+    absl::StatusOr<std::shared_ptr<RootCertInfo>> roots = nullptr;
     std::optional<PemKeyCertPairList> pem_key_cert_pairs;
     FileWatcherCertificateProvider::WatcherInfo& info =
         watcher_info_[cert_name];
     if (!info.root_being_watched && root_being_watched &&
-        !root_certificate_.empty()) {
-      root_certificate = root_certificate_;
+        root_cert_info_.ok() && *root_cert_info_ != nullptr) {
+      roots = root_cert_info_;
     }
     info.root_being_watched = root_being_watched;
     if (!info.identity_being_watched && identity_being_watched &&
@@ -234,13 +262,13 @@ FileWatcherCertificateProvider::FileWatcherCertificateProvider(
       watcher_info_.erase(cert_name);
     }
     ExecCtx exec_ctx;
-    if (root_certificate.has_value() || pem_key_cert_pairs.has_value()) {
-      distributor_->SetKeyMaterials(cert_name, root_certificate,
+    if ((roots.ok() && *roots != nullptr) || pem_key_cert_pairs.has_value()) {
+      distributor_->SetKeyMaterials(cert_name, roots.ok() ? *roots : nullptr,
                                     pem_key_cert_pairs);
     }
     grpc_error_handle root_cert_error;
     grpc_error_handle identity_cert_error;
-    if (root_being_watched && !root_certificate.has_value()) {
+    if (root_being_watched && (!roots.ok() || *roots == nullptr)) {
       root_cert_error =
           GRPC_ERROR_CREATE("Unable to get latest root certificates.");
     }
@@ -270,7 +298,10 @@ UniqueTypeName FileWatcherCertificateProvider::type() const {
 
 absl::Status FileWatcherCertificateProvider::ValidateCredentials() const {
   MutexLock lock(&mu_);
-  absl::Status status = ValidateRootCertificates(root_certificate_);
+  if (!root_cert_info_.ok()) {
+    return root_cert_info_.status();
+  }
+  absl::Status status = ValidateRootCertificates(root_cert_info_->get());
   if (!status.ok()) {
     return status;
   }
@@ -285,25 +316,34 @@ absl::Status FileWatcherCertificateProvider::ValidateCredentials() const {
 }
 
 void FileWatcherCertificateProvider::ForceUpdate() {
-  std::optional<std::string> root_certificate;
+  absl::StatusOr<std::shared_ptr<RootCertInfo>> root_cert_info = nullptr;
   std::optional<PemKeyCertPairList> pem_key_cert_pairs;
-  if (!root_cert_path_.empty()) {
-    root_certificate = ReadRootCertificatesFromFile(root_cert_path_);
+  if (!spiffe_bundle_map_path_.empty()) {
+    auto map = SpiffeBundleMap::FromFile(spiffe_bundle_map_path_);
+    if (map.ok()) {
+      root_cert_info = std::make_shared<RootCertInfo>(std::move(*map));
+    } else {
+      root_cert_info = absl::InvalidArgumentError(
+          absl::StrFormat("spiffe bundle map file %s failed to load: %s",
+                          spiffe_bundle_map_path_, map.status().ToString()));
+    }
+  } else if (!root_cert_path_.empty()) {
+    std::optional<std::string> root_certificate =
+        ReadRootCertificatesFromFile(root_cert_path_);
+    if (root_certificate.has_value()) {
+      root_cert_info =
+          std::make_shared<RootCertInfo>(std::move(*root_certificate));
+    }
   }
   if (!private_key_path_.empty()) {
     pem_key_cert_pairs = ReadIdentityKeyCertPairFromFiles(
         private_key_path_, identity_certificate_path_);
   }
   MutexLock lock(&mu_);
-  const bool root_cert_changed =
-      (!root_certificate.has_value() && !root_certificate_.empty()) ||
-      (root_certificate.has_value() && root_certificate_ != *root_certificate);
-  if (root_cert_changed) {
-    if (root_certificate.has_value()) {
-      root_certificate_ = std::move(*root_certificate);
-    } else {
-      root_certificate_ = "";
-    }
+  const bool root_changed =
+      HasRootCertInfoChanged(root_cert_info_, root_cert_info);
+  if (root_changed) {
+    root_cert_info_ = std::move(root_cert_info);
   }
   const bool identity_cert_changed =
       (!pem_key_cert_pairs.has_value() && !pem_key_cert_pairs_.empty()) ||
@@ -316,7 +356,7 @@ void FileWatcherCertificateProvider::ForceUpdate() {
       pem_key_cert_pairs_ = {};
     }
   }
-  if (root_cert_changed || identity_cert_changed) {
+  if (root_changed || identity_cert_changed) {
     ExecCtx exec_ctx;
     grpc_error_handle root_cert_error =
         GRPC_ERROR_CREATE("Unable to get latest root certificates.");
@@ -325,24 +365,24 @@ void FileWatcherCertificateProvider::ForceUpdate() {
     for (const auto& p : watcher_info_) {
       const std::string& cert_name = p.first;
       const WatcherInfo& info = p.second;
-      std::optional<std::string> root_to_report;
+      std::shared_ptr<RootCertInfo> root_to_report;
       std::optional<PemKeyCertPairList> identity_to_report;
       // Set key materials to the distributor if their contents changed.
-      if (info.root_being_watched && !root_certificate_.empty() &&
-          root_cert_changed) {
-        root_to_report = root_certificate_;
+      if (info.root_being_watched && root_changed) {
+        root_to_report = root_cert_info_.ok() ? *root_cert_info_ : nullptr;
       }
       if (info.identity_being_watched && !pem_key_cert_pairs_.empty() &&
           identity_cert_changed) {
         identity_to_report = pem_key_cert_pairs_;
       }
-      if (root_to_report.has_value() || identity_to_report.has_value()) {
+      if (root_to_report != nullptr || identity_to_report.has_value()) {
         distributor_->SetKeyMaterials(cert_name, std::move(root_to_report),
                                       std::move(identity_to_report));
       }
       // Report errors to the distributor if the contents are empty.
       const bool report_root_error =
-          info.root_being_watched && root_certificate_.empty();
+          info.root_being_watched &&
+          (!root_cert_info_.ok() || *root_cert_info_ == nullptr);
       const bool report_identity_error =
           info.identity_being_watched && pem_key_cert_pairs_.empty();
       if (report_root_error || report_identity_error) {
@@ -369,9 +409,8 @@ FileWatcherCertificateProvider::ReadRootCertificatesFromFile(
 }
 
 namespace {
-
-// This helper function gets the last-modified time of |filename|. When failed,
-// it logs the error and returns 0.
+// This helper function gets the last-modified time of |filename|. When
+// failed, it logs the error and returns 0.
 time_t GetModificationTime(const char* filename) {
   time_t ts = 0;
   (void)GetFileModificationTime(filename, &ts);
@@ -473,12 +512,15 @@ grpc_tls_certificate_provider* grpc_tls_certificate_provider_static_data_create(
 grpc_tls_certificate_provider*
 grpc_tls_certificate_provider_file_watcher_create(
     const char* private_key_path, const char* identity_certificate_path,
-    const char* root_cert_path, unsigned int refresh_interval_sec) {
+    const char* root_cert_path, const char* spiffe_bundle_map_path,
+    unsigned int refresh_interval_sec) {
   grpc_core::ExecCtx exec_ctx;
   return new grpc_core::FileWatcherCertificateProvider(
       private_key_path == nullptr ? "" : private_key_path,
       identity_certificate_path == nullptr ? "" : identity_certificate_path,
-      root_cert_path == nullptr ? "" : root_cert_path, refresh_interval_sec);
+      root_cert_path == nullptr ? "" : root_cert_path,
+      spiffe_bundle_map_path == nullptr ? "" : spiffe_bundle_map_path,
+      refresh_interval_sec);
 }
 
 void grpc_tls_certificate_provider_release(
diff --git a/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_provider.h b/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_provider.h
index d69aa6e7d59..b3d38f61550 100644
--- a/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_provider.h
+++ b/deps/grpc/src/core/credentials/transport/tls/grpc_tls_certificate_provider.h
@@ -31,6 +31,7 @@
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_distributor.h"
+#include "src/core/credentials/transport/tls/spiffe_utils.h"
 #include "src/core/credentials/transport/tls/ssl_utils.h"
 #include "src/core/util/ref_counted.h"
 #include "src/core/util/ref_counted_ptr.h"
@@ -121,7 +122,7 @@ class StaticDataCertificateProvider final
   }
 
   RefCountedPtr<grpc_tls_certificate_distributor> distributor_;
-  std::string root_certificate_;
+  std::shared_ptr<RootCertInfo> root_cert_info_;
   PemKeyCertPairList pem_key_cert_pairs_;
   // Guards members below.
   Mutex mu_;
@@ -137,6 +138,7 @@ class FileWatcherCertificateProvider final
   FileWatcherCertificateProvider(std::string private_key_path,
                                  std::string identity_certificate_path,
                                  std::string root_cert_path,
+                                 std::string spiffe_bundle_map_path,
                                  int64_t refresh_interval_sec);
 
   ~FileWatcherCertificateProvider() override;
@@ -178,6 +180,7 @@ class FileWatcherCertificateProvider final
   std::string private_key_path_;
   std::string identity_certificate_path_;
   std::string root_cert_path_;
+  std::string spiffe_bundle_map_path_;
   int64_t refresh_interval_sec_ = 0;
 
   RefCountedPtr<grpc_tls_certificate_distributor> distributor_;
@@ -188,8 +191,18 @@ class FileWatcherCertificateProvider final
   mutable Mutex mu_;
   // The most-recent credential data. It will be empty if the most recent read
   // attempt failed.
-  std::string root_certificate_ ABSL_GUARDED_BY(mu_);
   PemKeyCertPairList pem_key_cert_pairs_ ABSL_GUARDED_BY(mu_);
+  // The most-recent root data.
+  // - If unset, the status will be OK and the value will be nullptr
+  // - If a SPIFFE Bundle Map is configured and fails to read, the status will
+  // be not-Ok
+  // - If a string root cert is configured and fails to read, the status will be
+  // OK with a nullptr
+  // - Otherwise, holds either a SpiffeBundleMap or a string root cert
+  // TODO(gtcooke94) - refactor the handling for string root cert files such
+  // that their failure is a non-ok status rather than a nullptr
+  absl::StatusOr<std::shared_ptr<RootCertInfo>> root_cert_info_
+      ABSL_GUARDED_BY(mu_) = nullptr;
   // Stores each cert_name we get from the distributor callback and its watcher
   // information.
   std::map<std::string, WatcherInfo> watcher_info_ ABSL_GUARDED_BY(mu_);
diff --git a/deps/grpc/src/core/credentials/transport/tls/spiffe_utils.cc b/deps/grpc/src/core/credentials/transport/tls/spiffe_utils.cc
index 203c3546106..4d9b16d449d 100644
--- a/deps/grpc/src/core/credentials/transport/tls/spiffe_utils.cc
+++ b/deps/grpc/src/core/credentials/transport/tls/spiffe_utils.cc
@@ -130,6 +130,11 @@ absl::Status ValidatePath(absl::string_view path) {
 
 }  // namespace
 
+std::string AddPemBlockWrapping(absl::string_view spiffe_bundle_root) {
+  return absl::StrCat(kCertificatePrefix, spiffe_bundle_root,
+                      kCertificateSuffix);
+}
+
 absl::StatusOr<SpiffeId> SpiffeId::FromString(absl::string_view input) {
   GRPC_RETURN_IF_ERROR(DoInitialUriValidation(input));
   if (!absl::StartsWithIgnoreCase(input, kSpiffePrefix)) {
@@ -202,8 +207,7 @@ void SpiffeBundleKey::JsonPostLoad(const Json& json, const JsonArgs& args,
     }
     if (!x5c->empty()) {
       ValidationErrors::ScopedField field(errors, "[0]");
-      std::string pem_cert =
-          absl::StrCat(kCertificatePrefix, (*x5c)[0], kCertificateSuffix);
+      std::string pem_cert = AddPemBlockWrapping((*x5c)[0]);
       auto certs = ParsePemCertificateChain(pem_cert);
       if (!certs.ok()) {
         errors->AddError(certs.status().ToString());
@@ -219,6 +223,11 @@ void SpiffeBundleKey::JsonPostLoad(const Json& json, const JsonArgs& args,
 
 absl::string_view SpiffeBundleKey::GetRoot() { return root_; }
 
+const JsonLoaderInterface* SpiffeBundle::JsonLoader(const JsonArgs&) {
+  static const auto* kLoader = JsonObjectLoader<SpiffeBundle>().Finish();
+  return kLoader;
+}
+
 void SpiffeBundle::JsonPostLoad(const Json& json, const JsonArgs& args,
                                 ValidationErrors* errors) {
   auto keys = LoadJsonObjectField<std::vector<SpiffeBundleKey>>(
@@ -229,10 +238,94 @@ void SpiffeBundle::JsonPostLoad(const Json& json, const JsonArgs& args,
   for (size_t i = 0; i < keys->size(); ++i) {
     roots_.emplace_back((*keys)[i].GetRoot());
   }
+  ValidationErrors::ScopedField field(errors, "keys");
+  absl::Status status = CreateX509Stack();
+  if (!status.ok()) {
+    errors->AddError(status.ToString());
+  }
+}
+
+SpiffeBundle::~SpiffeBundle() {
+  if (root_stack_ != nullptr) {
+    sk_X509_pop_free(*root_stack_, X509_free);
+  }
+}
+
+SpiffeBundle::SpiffeBundle(const SpiffeBundle& other) {
+  roots_ = other.roots_;
+  if (other.root_stack_ != nullptr) {
+    root_stack_ =
+        std::make_unique<STACK_OF(X509)*>(sk_X509_dup(*other.root_stack_));
+    for (size_t i = 0; i < sk_X509_num(*root_stack_); i++) {
+      X509* x = sk_X509_value(*root_stack_, i);
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+      CHECK(X509_up_ref(x));
+#else
+      CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
+#endif
+    }
+  }
+}
+
+SpiffeBundle& SpiffeBundle::operator=(const SpiffeBundle& other) {
+  if (this != &other) {
+    roots_ = other.roots_;
+    if (other.root_stack_ != nullptr) {
+      root_stack_ =
+          std::make_unique<STACK_OF(X509)*>(sk_X509_dup(*other.root_stack_));
+      for (size_t i = 0; i < sk_X509_num(*root_stack_); i++) {
+        X509* x = sk_X509_value(*root_stack_, i);
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+        CHECK(X509_up_ref(x));
+#else
+        CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
+#endif
+      }
+    }
+  }
+  return *this;
+}
+
+const JsonLoaderInterface* SpiffeBundleMap::JsonLoader(const JsonArgs&) {
+  static const auto* kLoader =
+      JsonObjectLoader<SpiffeBundleMap>()
+          .Field("trust_domains", &SpiffeBundleMap::bundles_)
+          .Finish();
+  return kLoader;
 }
 
 absl::Span<const std::string> SpiffeBundle::GetRoots() { return roots_; }
 
+absl::StatusOr<STACK_OF(X509) *> SpiffeBundle::GetRootStack() {
+  if (root_stack_ == nullptr) {
+    return absl::FailedPreconditionError(
+        "root_stack_ has not been initialized");
+  }
+  return *root_stack_;
+}
+
+absl::Status SpiffeBundle::CreateX509Stack() {
+  root_stack_ = std::make_unique<STACK_OF(X509)*>(sk_X509_new_null());
+  absl::Status status = absl::OkStatus();
+  for (const auto& pem_cert : roots_) {
+    auto cert = ParsePemCertificateChain(AddPemBlockWrapping(pem_cert));
+    if (!cert.status().ok()) {
+      status = cert.status();
+      break;
+    }
+    if (cert->size() != 1) {
+      status = absl::InvalidArgumentError("Got a malformed root certificate.");
+      break;
+    }
+    sk_X509_push(*root_stack_, (*cert)[0]);
+  }
+  // If there was an error parsing we don't want a partially filled root stack.
+  if (!status.ok()) {
+    sk_X509_pop_free(*root_stack_, X509_free);
+  }
+  return status;
+}
+
 void SpiffeBundleMap::JsonPostLoad(const Json&, const JsonArgs&,
                                    ValidationErrors* errors) {
   {
@@ -266,4 +359,13 @@ absl::StatusOr<absl::Span<const std::string>> SpiffeBundleMap::GetRoots(
       "No spiffe bundle found for trust domain %s", trust_domain));
 }
 
-}  // namespace grpc_core
\ No newline at end of file
+absl::StatusOr<STACK_OF(X509) *> SpiffeBundleMap::GetRootStack(
+    absl::string_view trust_domain) {
+  if (auto it = bundles_.find(trust_domain); it != bundles_.end()) {
+    return it->second.GetRootStack();
+  }
+  return absl::NotFoundError(absl::StrFormat(
+      "No spiffe bundle found for trust domain %s", trust_domain));
+}
+
+}  // namespace grpc_core
diff --git a/deps/grpc/src/core/credentials/transport/tls/spiffe_utils.h b/deps/grpc/src/core/credentials/transport/tls/spiffe_utils.h
index c0a3c6c910e..1c4f011e472 100644
--- a/deps/grpc/src/core/credentials/transport/tls/spiffe_utils.h
+++ b/deps/grpc/src/core/credentials/transport/tls/spiffe_utils.h
@@ -19,6 +19,9 @@
 #ifndef GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_SPIFFE_UTILS_H
 #define GRPC_SRC_CORE_CREDENTIALS_TRANSPORT_TLS_SPIFFE_UTILS_H
 
+#include <openssl/stack.h>
+#include <openssl/x509.h>
+
 #include <string>
 
 #include "absl/status/statusor.h"
@@ -28,6 +31,10 @@
 
 namespace grpc_core {
 
+// Adds the leading and trailing lines expected for a PEM formatted certificate
+// around the raw base64 certificate data stored in a SPIFFE bundle map.
+std::string AddPemBlockWrapping(absl::string_view spiffe_bundle_root);
+
 // A representation of a SPIFFE ID per the spec:
 // https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE-ID.md#the-spiffe-identity-and-verifiable-identity-document
 class SpiffeId final {
@@ -72,21 +79,43 @@ class SpiffeBundleKey final {
 // domain.
 // https://github.com/spiffe/spiffe/blob/main/standards/SPIFFE_Trust_Domain_and_Bundle.md#3-spiffe-bundles
 // https://github.com/grpc/proposal/blob/master/A87-mtls-spiffe-support.md
+// Not thread-safe
 class SpiffeBundle final {
  public:
-  static const JsonLoaderInterface* JsonLoader(const JsonArgs&) {
-    static const auto* kLoader = JsonObjectLoader<SpiffeBundle>().Finish();
-    return kLoader;
-  }
+  // Do not use - only exists to work with the JSON library.
+  // SpiffeBundles should be used by loading a SpiffeBundleMap via
+  // SpiffeBundleMap::FromFile
+  SpiffeBundle() = default;
+  ~SpiffeBundle();
+  SpiffeBundle(const SpiffeBundle& other);
+  SpiffeBundle& operator=(const SpiffeBundle& other);
 
+  static const JsonLoaderInterface* JsonLoader(const JsonArgs&);
   void JsonPostLoad(const Json& json, const JsonArgs&,
                     ValidationErrors* errors);
 
   // Returns a vector of the roots in this SPIFFE Bundle.
   absl::Span<const std::string> GetRoots();
 
+  // The caller does not take ownership of the stack of roots.
+  // The caller MUST NOT mutate this value.
+  absl::StatusOr<STACK_OF(X509) *> GetRootStack();
+
+  bool operator==(const SpiffeBundle& other) const {
+    // For our purposes SPIFFE Bundles are equal if their roots are the same.
+    return roots_ == other.roots_;
+  }
+
+  bool operator!=(const SpiffeBundle& other) const {
+    return roots_ != other.roots_;
+  }
+
  private:
+  // Constructs the `root_stack_` OpenSSL representation of the roots.
+  absl::Status CreateX509Stack();
+
   std::vector<std::string> roots_;
+  std::unique_ptr<STACK_OF(X509)*> root_stack_;
 };
 
 // A map of SPIFFE bundles keyed to trust domains. This functions as a map of a
@@ -95,16 +124,10 @@ class SpiffeBundle final {
 // https://github.com/grpc/proposal/blob/master/A87-mtls-spiffe-support.md
 // https://github.com/grpc/proposal/blob/master/A87-mtls-spiffe-support.md
 // Only configuring X509 roots is supported.
+// Not thread-safe
 class SpiffeBundleMap final {
  public:
-  static const JsonLoaderInterface* JsonLoader(const JsonArgs&) {
-    static const auto* kLoader =
-        JsonObjectLoader<SpiffeBundleMap>()
-            .Field("trust_domains", &SpiffeBundleMap::bundles_)
-            .Finish();
-    return kLoader;
-  }
-
+  static const JsonLoaderInterface* JsonLoader(const JsonArgs&);
   void JsonPostLoad(const Json& json, const JsonArgs&,
                     ValidationErrors* errors);
 
@@ -119,7 +142,18 @@ class SpiffeBundleMap final {
   absl::StatusOr<absl::Span<const std::string>> GetRoots(
       absl::string_view trust_domain);
 
-  size_t size() { return bundles_.size(); }
+  // The caller does not take ownership of the stack of roots.
+  absl::StatusOr<STACK_OF(X509) *> GetRootStack(
+      const absl::string_view trust_domain);
+  size_t size() const { return bundles_.size(); }
+
+  bool operator==(const SpiffeBundleMap& other) const {
+    return bundles_ == other.bundles_;
+  }
+
+  bool operator!=(const SpiffeBundleMap& other) const {
+    return bundles_ != other.bundles_;
+  }
 
  private:
   struct StringCmp {
diff --git a/deps/grpc/src/core/credentials/transport/tls/ssl_utils.cc b/deps/grpc/src/core/credentials/transport/tls/ssl_utils.cc
index f9c1337e1e8..06e2c28cdd1 100644
--- a/deps/grpc/src/core/credentials/transport/tls/ssl_utils.cc
+++ b/deps/grpc/src/core/credentials/transport/tls/ssl_utils.cc
@@ -427,16 +427,19 @@ void grpc_shallow_peer_destruct(tsi_peer* peer) {
 }
 
 grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
-    tsi_ssl_pem_key_cert_pair* pem_key_cert_pair, const char* pem_root_certs,
+    tsi_ssl_pem_key_cert_pair* pem_key_cert_pair,
+    std::shared_ptr<RootCertInfo> root_cert_info,
     bool skip_server_certificate_verification, tsi_tls_version min_tls_version,
     tsi_tls_version max_tls_version, tsi_ssl_session_cache* ssl_session_cache,
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
     const char* crl_directory,
     std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider,
     tsi_ssl_client_handshaker_factory** handshaker_factory) {
-  const char* root_certs;
-  const tsi_ssl_root_certs_store* root_store;
-  if (pem_root_certs == nullptr && !skip_server_certificate_verification) {
+  const char* root_certs = nullptr;
+  const tsi_ssl_root_certs_store* root_store = nullptr;
+  tsi_ssl_client_handshaker_options options;
+  bool roots_are_configured = root_cert_info != nullptr;
+  if (!roots_are_configured && !skip_server_certificate_verification) {
     GRPC_TRACE_LOG(tsi, INFO)
         << "No root certificates specified; use ones stored in system "
            "default locations instead";
@@ -447,15 +450,13 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
       return GRPC_SECURITY_ERROR;
     }
     root_store = grpc_core::DefaultSslRootStore::GetRootStore();
+    options.root_cert_info = std::make_shared<RootCertInfo>(root_certs);
   } else {
-    root_certs = pem_root_certs;
-    root_store = nullptr;
+    options.root_cert_info = std::move(root_cert_info);
   }
   bool has_key_cert_pair = pem_key_cert_pair != nullptr &&
                            pem_key_cert_pair->private_key != nullptr &&
                            pem_key_cert_pair->cert_chain != nullptr;
-  tsi_ssl_client_handshaker_options options;
-  options.pem_root_certs = root_certs;
   options.root_store = root_store;
   options.alpn_protocols =
       grpc_fill_alpn_protocol_strings(&options.num_alpn_protocols);
@@ -485,7 +486,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
 
 grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
     tsi_ssl_pem_key_cert_pair* pem_key_cert_pairs, size_t num_key_cert_pairs,
-    const char* pem_root_certs,
+    std::shared_ptr<RootCertInfo> root_cert_info,
     grpc_ssl_client_certificate_request_type client_certificate_request,
     tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
@@ -498,7 +499,6 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
   tsi_ssl_server_handshaker_options options;
   options.pem_key_cert_pairs = pem_key_cert_pairs;
   options.num_key_cert_pairs = num_key_cert_pairs;
-  options.pem_client_root_certs = pem_root_certs;
   options.client_certificate_request =
       grpc_get_tsi_client_certificate_request_type(client_certificate_request);
   options.cipher_suites = grpc_get_ssl_cipher_suites();
@@ -510,6 +510,7 @@ grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
   options.crl_directory = crl_directory;
   options.crl_provider = std::move(crl_provider);
   options.send_client_ca_list = send_client_ca_list;
+  options.root_cert_info = std::move(root_cert_info);
   const tsi_result result =
       tsi_create_ssl_server_handshaker_factory_with_options(&options,
                                                             handshaker_factory);
diff --git a/deps/grpc/src/core/credentials/transport/tls/ssl_utils.h b/deps/grpc/src/core/credentials/transport/tls/ssl_utils.h
index ad6f0e23b02..4257d8a609a 100644
--- a/deps/grpc/src/core/credentials/transport/tls/ssl_utils.h
+++ b/deps/grpc/src/core/credentials/transport/tls/ssl_utils.h
@@ -34,6 +34,7 @@
 #include "absl/status/status.h"
 #include "absl/strings/string_view.h"
 #include "src/core/credentials/transport/security_connector.h"
+#include "src/core/credentials/transport/tls/spiffe_utils.h"
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
 #include "src/core/tsi/ssl_transport_security.h"
@@ -84,7 +85,8 @@ const char** ParseAlpnStringIntoArray(absl::string_view preferred_protocols,
 
 // Initialize TSI SSL server/client handshaker factory.
 grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
-    tsi_ssl_pem_key_cert_pair* key_cert_pair, const char* pem_root_certs,
+    tsi_ssl_pem_key_cert_pair* key_cert_pair,
+    std::shared_ptr<RootCertInfo> root_cert_info,
     bool skip_server_certificate_verification, tsi_tls_version min_tls_version,
     tsi_tls_version max_tls_version, tsi_ssl_session_cache* ssl_session_cache,
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
@@ -94,7 +96,7 @@ grpc_security_status grpc_ssl_tsi_client_handshaker_factory_init(
 
 grpc_security_status grpc_ssl_tsi_server_handshaker_factory_init(
     tsi_ssl_pem_key_cert_pair* key_cert_pairs, size_t num_key_cert_pairs,
-    const char* pem_root_certs,
+    std::shared_ptr<RootCertInfo> root_cert_info,
     grpc_ssl_client_certificate_request_type client_certificate_request,
     tsi_tls_version min_tls_version, tsi_tls_version max_tls_version,
     tsi::TlsSessionKeyLoggerCache::TlsSessionKeyLogger* tls_session_key_logger,
diff --git a/deps/grpc/src/core/credentials/transport/tls/tls_credentials.cc b/deps/grpc/src/core/credentials/transport/tls/tls_credentials.cc
index 40ee7e81d36..fe7e60595ef 100644
--- a/deps/grpc/src/core/credentials/transport/tls/tls_credentials.cc
+++ b/deps/grpc/src/core/credentials/transport/tls/tls_credentials.cc
@@ -154,6 +154,7 @@ grpc_core::UniqueTypeName TlsServerCredentials::Type() {
 grpc_channel_credentials* grpc_tls_credentials_create(
     grpc_tls_credentials_options* options) {
   if (!CredentialOptionSanityCheck(options, true /* is_client */)) {
+    LOG(ERROR) << "TLS credentials options sanity check failed.";
     return nullptr;
   }
   return new TlsCredentials(
@@ -163,6 +164,7 @@ grpc_channel_credentials* grpc_tls_credentials_create(
 grpc_server_credentials* grpc_tls_server_credentials_create(
     grpc_tls_credentials_options* options) {
   if (!CredentialOptionSanityCheck(options, false /* is_client */)) {
+    LOG(ERROR) << "TLS server credentials options sanity check failed.";
     return nullptr;
   }
   return new TlsServerCredentials(
diff --git a/deps/grpc/src/core/credentials/transport/tls/tls_security_connector.cc b/deps/grpc/src/core/credentials/transport/tls/tls_security_connector.cc
index c33f32b7125..e4c717067eb 100644
--- a/deps/grpc/src/core/credentials/transport/tls/tls_security_connector.cc
+++ b/deps/grpc/src/core/credentials/transport/tls/tls_security_connector.cc
@@ -312,7 +312,7 @@ TlsChannelSecurityConnector::TlsChannelSecurityConnector(
   // hence no need to register the watcher.
   bool use_default_roots = !options_->watch_root_cert();
   if (use_default_roots && !options_->watch_identity_pair()) {
-    watcher_ptr->OnCertificatesChanged(std::nullopt, std::nullopt);
+    watcher_ptr->OnCertificatesChanged(nullptr, std::nullopt);
   } else {
     distributor->WatchTlsCertificates(std::move(watcher_ptr),
                                       watched_root_cert_name,
@@ -429,18 +429,18 @@ ArenaPromise<absl::Status> TlsChannelSecurityConnector::CheckCallHost(
 }
 
 void TlsChannelSecurityConnector::TlsChannelCertificateWatcher::
-    OnCertificatesChanged(std::optional<absl::string_view> root_certs,
+    OnCertificatesChanged(std::shared_ptr<RootCertInfo> root_certs,
                           std::optional<PemKeyCertPairList> key_cert_pairs) {
   CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
-  if (root_certs.has_value()) {
-    security_connector_->pem_root_certs_ = root_certs;
+  if (root_certs != nullptr) {
+    security_connector_->root_cert_info_ = std::move(root_certs);
   }
   if (key_cert_pairs.has_value()) {
     security_connector_->pem_key_cert_pair_list_ = std::move(key_cert_pairs);
   }
   const bool root_ready = !security_connector_->options_->watch_root_cert() ||
-                          security_connector_->pem_root_certs_.has_value();
+                          security_connector_->root_cert_info_ != nullptr;
   const bool identity_ready =
       !security_connector_->options_->watch_identity_pair() ||
       security_connector_->pem_key_cert_pair_list_.has_value();
@@ -525,21 +525,13 @@ TlsChannelSecurityConnector::UpdateHandshakerFactoryLocked() {
   if (client_handshaker_factory_ != nullptr) {
     tsi_ssl_client_handshaker_factory_unref(client_handshaker_factory_);
   }
-  std::string pem_root_certs;
-  if (pem_root_certs_.has_value()) {
-    // TODO(ZhenLian): update the underlying TSI layer to use C++ types like
-    // std::string and absl::string_view to avoid making another copy here.
-    pem_root_certs = std::string(*pem_root_certs_);
-  }
   tsi_ssl_pem_key_cert_pair* pem_key_cert_pair = nullptr;
   if (pem_key_cert_pair_list_.has_value()) {
     pem_key_cert_pair = ConvertToTsiPemKeyCertPair(*pem_key_cert_pair_list_);
   }
   bool use_default_roots = !options_->watch_root_cert();
   grpc_security_status status = grpc_ssl_tsi_client_handshaker_factory_init(
-      pem_key_cert_pair,
-      pem_root_certs.empty() || use_default_roots ? nullptr
-                                                  : pem_root_certs.c_str(),
+      pem_key_cert_pair, use_default_roots ? nullptr : root_cert_info_,
       skip_server_certificate_verification,
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()), ssl_session_cache_,
@@ -689,18 +681,18 @@ int TlsServerSecurityConnector::cmp(
 }
 
 void TlsServerSecurityConnector::TlsServerCertificateWatcher::
-    OnCertificatesChanged(std::optional<absl::string_view> root_certs,
+    OnCertificatesChanged(std::shared_ptr<RootCertInfo> roots,
                           std::optional<PemKeyCertPairList> key_cert_pairs) {
   CHECK_NE(security_connector_, nullptr);
   MutexLock lock(&security_connector_->mu_);
-  if (root_certs.has_value()) {
-    security_connector_->pem_root_certs_ = root_certs;
+  if (roots != nullptr) {
+    security_connector_->root_cert_info_ = std::move(roots);
   }
   if (key_cert_pairs.has_value()) {
     security_connector_->pem_key_cert_pair_list_ = std::move(key_cert_pairs);
   }
   bool root_being_watched = security_connector_->options_->watch_root_cert();
-  bool root_has_value = security_connector_->pem_root_certs_.has_value();
+  bool root_has_value = security_connector_->root_cert_info_ != nullptr;
   bool identity_being_watched =
       security_connector_->options_->watch_identity_pair();
   bool identity_has_value =
@@ -790,18 +782,11 @@ TlsServerSecurityConnector::UpdateHandshakerFactoryLocked() {
   // The identity certs on the server side shouldn't be empty.
   CHECK(pem_key_cert_pair_list_.has_value());
   CHECK(!(*pem_key_cert_pair_list_).empty());
-  std::string pem_root_certs;
-  if (pem_root_certs_.has_value()) {
-    // TODO(ZhenLian): update the underlying TSI layer to use C++ types like
-    // std::string and absl::string_view to avoid making another copy here.
-    pem_root_certs = std::string(*pem_root_certs_);
-  }
   tsi_ssl_pem_key_cert_pair* pem_key_cert_pairs = nullptr;
   pem_key_cert_pairs = ConvertToTsiPemKeyCertPair(*pem_key_cert_pair_list_);
   size_t num_key_cert_pairs = (*pem_key_cert_pair_list_).size();
   grpc_security_status status = grpc_ssl_tsi_server_handshaker_factory_init(
-      pem_key_cert_pairs, num_key_cert_pairs,
-      pem_root_certs.empty() ? nullptr : pem_root_certs.c_str(),
+      pem_key_cert_pairs, num_key_cert_pairs, root_cert_info_,
       options_->cert_request_type(),
       grpc_get_tsi_tls_version(options_->min_tls_version()),
       grpc_get_tsi_tls_version(options_->max_tls_version()),
diff --git a/deps/grpc/src/core/credentials/transport/tls/tls_security_connector.h b/deps/grpc/src/core/credentials/transport/tls/tls_security_connector.h
index fefb1387911..4e58ef13bf5 100644
--- a/deps/grpc/src/core/credentials/transport/tls/tls_security_connector.h
+++ b/deps/grpc/src/core/credentials/transport/tls/tls_security_connector.h
@@ -94,14 +94,14 @@ class TlsChannelSecurityConnector final
     return client_handshaker_factory_;
   };
 
-  std::optional<absl::string_view> RootCertsForTesting() {
+  std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
     MutexLock lock(&mu_);
-    return pem_root_certs_;
+    return pem_key_cert_pair_list_;
   }
 
-  std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
+  std::shared_ptr<RootCertInfo> RootCertInfoForTesting() {
     MutexLock lock(&mu_);
-    return pem_key_cert_pair_list_;
+    return root_cert_info_;
   }
 
  private:
@@ -115,7 +115,7 @@ class TlsChannelSecurityConnector final
         TlsChannelSecurityConnector* security_connector)
         : security_connector_(security_connector) {}
     void OnCertificatesChanged(
-        std::optional<absl::string_view> root_certs,
+        std::shared_ptr<RootCertInfo> root_certs,
         std::optional<PemKeyCertPairList> key_cert_pairs) override;
     void OnError(grpc_error_handle root_cert_error,
                  grpc_error_handle identity_cert_error) override;
@@ -165,9 +165,9 @@ class TlsChannelSecurityConnector final
       ABSL_GUARDED_BY(mu_) = nullptr;
   tsi_ssl_session_cache* ssl_session_cache_ ABSL_GUARDED_BY(mu_) = nullptr;
   RefCountedPtr<TlsSessionKeyLogger> tls_session_key_logger_;
-  std::optional<absl::string_view> pem_root_certs_ ABSL_GUARDED_BY(mu_);
   std::optional<PemKeyCertPairList> pem_key_cert_pair_list_
       ABSL_GUARDED_BY(mu_);
+  std::shared_ptr<RootCertInfo> root_cert_info_ ABSL_GUARDED_BY(mu_);
   std::map<grpc_closure* /*on_peer_checked*/, ChannelPendingVerifierRequest*>
       pending_verifier_requests_ ABSL_GUARDED_BY(verifier_request_map_mu_);
 };
@@ -204,14 +204,14 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
     return server_handshaker_factory_;
   };
 
-  std::optional<absl::string_view> RootCertsForTesting() {
+  std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
     MutexLock lock(&mu_);
-    return pem_root_certs_;
+    return pem_key_cert_pair_list_;
   }
 
-  std::optional<PemKeyCertPairList> KeyCertPairListForTesting() {
+  std::shared_ptr<RootCertInfo> RootCertInfoForTesting() {
     MutexLock lock(&mu_);
-    return pem_key_cert_pair_list_;
+    return root_cert_info_;
   }
 
  private:
@@ -225,7 +225,7 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
         TlsServerSecurityConnector* security_connector)
         : security_connector_(security_connector) {}
     void OnCertificatesChanged(
-        std::optional<absl::string_view> root_certs,
+        std::shared_ptr<RootCertInfo> roots,
         std::optional<PemKeyCertPairList> key_cert_pairs) override;
 
     void OnError(grpc_error_handle root_cert_error,
@@ -272,9 +272,9 @@ class TlsServerSecurityConnector final : public grpc_server_security_connector {
       certificate_watcher_ = nullptr;
   tsi_ssl_server_handshaker_factory* server_handshaker_factory_
       ABSL_GUARDED_BY(mu_) = nullptr;
-  std::optional<absl::string_view> pem_root_certs_ ABSL_GUARDED_BY(mu_);
   std::optional<PemKeyCertPairList> pem_key_cert_pair_list_
       ABSL_GUARDED_BY(mu_);
+  std::shared_ptr<RootCertInfo> root_cert_info_ ABSL_GUARDED_BY(mu_);
   RefCountedPtr<TlsSessionKeyLogger> tls_session_key_logger_;
   std::map<grpc_closure* /*on_peer_checked*/, ServerPendingVerifierRequest*>
       pending_verifier_requests_ ABSL_GUARDED_BY(verifier_request_map_mu_);
diff --git a/deps/grpc/src/core/ext/filters/backend_metrics/GEMINI.md b/deps/grpc/src/core/ext/filters/backend_metrics/GEMINI.md
new file mode 100644
index 00000000000..fc97f5b8edf
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/backend_metrics/GEMINI.md
@@ -0,0 +1,22 @@
+# Backend Metrics Filter
+
+This directory contains a server-side filter for reporting backend metrics.
+
+## Overarching Purpose
+
+The filter provides a mechanism to collect backend metric data, serialize it, and send it as trailing metadata in a gRPC call. This data can be used by clients to make load balancing decisions.
+
+## Files
+
+*   `backend_metric_filter.h`, `backend_metric_filter.cc`: These files define the `BackendMetricFilter` class, a server-side channel filter that retrieves backend metrics from a `BackendMetricProvider`, serializes them using the `xds.data.orca.v3.OrcaLoadReport` protobuf message, and attaches the result to the server's trailing metadata. The filter is activated by the `GRPC_ARG_SERVER_CALL_METRIC_RECORDING` channel argument.
+*   `backend_metric_provider.h`: This file defines the `BackendMetricProvider` interface, which is responsible for providing the backend metric data to the filter.
+
+## Major Classes
+
+*   `grpc_core::BackendMetricFilter`: The channel filter implementation.
+*   `grpc_core::BackendMetricProvider`: An interface for a class that can provide backend metric data.
+
+## Notes
+
+*   This filter is a key component of gRPC's custom load balancing support. It allows backends to provide real-time load information to clients, enabling more intelligent load balancing decisions.
+*   The filter is configured to run on the server and is only active when the appropriate channel argument is set.
diff --git a/deps/grpc/src/core/ext/filters/backend_metrics/backend_metric_filter.cc b/deps/grpc/src/core/ext/filters/backend_metrics/backend_metric_filter.cc
index 03a8c859c68..328140720c3 100644
--- a/deps/grpc/src/core/ext/filters/backend_metrics/backend_metric_filter.cc
+++ b/deps/grpc/src/core/ext/filters/backend_metrics/backend_metric_filter.cc
@@ -116,8 +116,7 @@ BackendMetricFilter::Create(const ChannelArgs&, ChannelFilter::Args) {
 }
 
 void BackendMetricFilter::Call::OnServerTrailingMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "BackendMetricFilter::Call::OnServerTrailingMetadata");
+  GRPC_LATENT_SEE_SCOPE("BackendMetricFilter::Call::OnServerTrailingMetadata");
   if (md.get(GrpcCallWasCancelled()).value_or(false)) return;
   auto* ctx = MaybeGetContext<BackendMetricProvider>();
   if (ctx == nullptr) {
diff --git a/deps/grpc/src/core/ext/filters/census/GEMINI.md b/deps/grpc/src/core/ext/filters/census/GEMINI.md
new file mode 100644
index 00000000000..819b015619f
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/census/GEMINI.md
@@ -0,0 +1,22 @@
+# Census Integration
+
+This directory contains minimal, legacy functionality for integrating with the
+now-deprecated Census library.
+
+
+
+## Overarching Purpose
+
+This code provides a way to attach a `census_context` to a `grpc_call`,
+allowing for the propagation of tracing and stats information.
+
+## Files
+
+*   `grpc_context.cc`: Implements `grpc_census_call_set_context` and
+    `grpc_census_call_get_context`, which are used to attach and retrieve a
+    `census_context` from a `grpc_call`'s arena.
+
+## Notes
+
+*   This integration is considered obsolete. OpenCensus and OpenTelemetry are
+    the modern, recommended ways to instrument gRPC.
diff --git a/deps/grpc/src/core/ext/filters/channel_idle/GEMINI.md b/deps/grpc/src/core/ext/filters/channel_idle/GEMINI.md
new file mode 100644
index 00000000000..5c76ae763cb
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/channel_idle/GEMINI.md
@@ -0,0 +1,28 @@
+# Channel Idle and Max Age Filters
+
+This directory contains filters for managing the lifecycle of a gRPC channel based on idleness and maximum connection age.
+
+See also: [gRPC Filters overview](../../filter/GEMINI.md)
+
+## Overarching Purpose
+
+These filters provide mechanisms to automatically close connections that are either idle for too long or have been active for a maximum allowed duration. This helps with resource management and can prevent connections from becoming stale.
+
+## Files
+
+*   `legacy_channel_idle_filter.h`, `legacy_channel_idle_filter.cc`: These files implement the `LegacyChannelIdleFilter` class, which is a base class for the following filters:
+    *   `LegacyClientIdleFilter`: A client-side filter that closes the transport if the channel has been idle (i.e., has no active calls) for a configurable amount of time. This is controlled by the `GRPC_ARG_CLIENT_IDLE_TIMEOUT_MS` channel argument.
+    *   `LegacyMaxAgeFilter`: A server-side filter that enforces a maximum connection age. It sends a `GOAWAY` frame when the connection reaches its maximum age and, after a grace period, closes the connection. It also supports a maximum idle time. These are configured via the `GRPC_ARG_MAX_CONNECTION_AGE_MS`, `GRPC_ARG_MAX_CONNECTION_IDLE_MS`, and `GRPC_ARG_MAX_CONNECTION_AGE_GRACE_MS` channel arguments.
+*   `idle_filter_state.h`, `idle_filter_state.cc`: These files define the `IdleFilterState` class, which encapsulates the state machine for tracking the number of active calls on a channel and determining if the idle timer should be active.
+
+## Major Classes
+
+*   `grpc_core::LegacyChannelIdleFilter`: A base class for the `LegacyClientIdleFilter` and `LegacyMaxAgeFilter` classes. It provides the common functionality for managing the idle state of a channel. It is not a channel filter itself.
+*   `grpc_core::LegacyClientIdleFilter`: A client-side filter for closing idle connections.
+*   `grpc_core::LegacyMaxAgeFilter`: A server-side filter for enforcing maximum connection age.
+*   `grpc_core::IdleFilterState`: A helper class that implements a state machine for managing the idle state of a channel. It tracks the number of active calls and whether an idle timer is active.
+
+## Notes
+
+*   The "legacy" prefix in the class names indicates that these filters are based on the older channel filter API. They will likely be replaced by a more modern implementation in the future.
+*   These filters are crucial for maintaining healthy and efficient connections in long-running gRPC applications. They are configured via channel arguments, which can be set when the channel is created.
diff --git a/deps/grpc/src/core/ext/filters/fault_injection/GEMINI.md b/deps/grpc/src/core/ext/filters/fault_injection/GEMINI.md
new file mode 100644
index 00000000000..5c9b6415196
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/fault_injection/GEMINI.md
@@ -0,0 +1,22 @@
+# Fault Injection Filter
+
+This directory contains a client-side filter for injecting faults into gRPC calls.
+
+## Overarching Purpose
+
+The fault injection filter provides a mechanism for testing the resilience of a gRPC application by programmatically introducing delays and aborting requests. This can be used to simulate various failure scenarios, such as network latency or server errors.
+
+## Files
+
+*   `fault_injection_filter.h`, `fault_injection_filter.cc`: These files define the `FaultInjectionFilter` class, a client-side filter that can inject delays and aborts into outgoing requests. The behavior of the filter is controlled by a fault injection policy, which is configured via xDS.
+*   `fault_injection_service_config_parser.h`, `fault_injection_service_config_parser.cc`: These files define the `FaultInjectionServiceConfigParser` class, which is responsible for parsing the fault injection policy from the service config.
+
+## Major Classes
+
+*   `grpc_core::FaultInjectionFilter`: The channel filter implementation.
+*   `grpc_core::FaultInjectionServiceConfigParser`: The service config parser for the fault injection policy.
+
+## Notes
+
+*   The filter limits the number of concurrent faults to a configured maximum, which can be useful for preventing fault injection from overwhelming the system.
+*   This filter is a powerful tool for reliability testing and can help to identify and fix potential issues in a gRPC application before they occur in production.
diff --git a/deps/grpc/src/core/ext/filters/gcp_authentication/GEMINI.md b/deps/grpc/src/core/ext/filters/gcp_authentication/GEMINI.md
new file mode 100644
index 00000000000..d72754ce99e
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/gcp_authentication/GEMINI.md
@@ -0,0 +1,24 @@
+# GCP Authentication Filter
+
+This directory contains a client-side filter for adding GCP authentication to gRPC calls.
+
+## Overarching Purpose
+
+The GCP authentication filter provides a mechanism for authenticating to Google Cloud services using service account credentials. It is designed to be used in conjunction with xDS for service discovery and configuration.
+
+## Files
+
+*   `gcp_authentication_filter.h`, `gcp_authentication_filter.cc`: These files define the `GcpAuthenticationFilter` class, a client-side filter that adds GCP authentication to outgoing requests.
+*   `gcp_authentication_service_config_parser.h`, `gcp_authentication_service_config_parser.cc`: These files define the `GcpAuthenticationServiceConfigParser` class, which is responsible for parsing the GCP authentication configuration from the service config.
+
+## Major Classes
+
+*   `grpc_core::GcpAuthenticationFilter`: The channel filter implementation.
+*   `grpc_core::GcpAuthenticationFilter::CallCredentialsCache`: A cache for storing `grpc_call_credentials` objects.
+*   `grpc_core::GcpAuthenticationServiceConfigParser`: The service config parser for the GCP authentication configuration.
+
+## Notes
+
+*   This filter is tightly coupled with xDS. It relies on the `XdsConfig` to determine the audience for GCP authentication based on the cluster that the call is being sent to.
+*   The filter uses a cache to store `grpc_call_credentials` objects, which helps to improve performance by avoiding the need to create new credentials for each call.
+*   This filter is an essential component for any gRPC application that needs to securely communicate with Google Cloud services.
diff --git a/deps/grpc/src/core/ext/filters/http/GEMINI.md b/deps/grpc/src/core/ext/filters/http/GEMINI.md
new file mode 100644
index 00000000000..7d105b3ff78
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/http/GEMINI.md
@@ -0,0 +1,25 @@
+# HTTP Filters
+
+This directory contains various HTTP-related channel filters and functionality.
+
+
+
+## Overarching Purpose
+
+This directory contains a collection of filters that are responsible for handling HTTP/2-specific functionality in gRPC. This includes things like header manipulation, message compression, and authority checking.
+
+## Subdirectories
+
+*   **[`client`](./client/GEMINI.md)**: Contains client-side HTTP filters.
+*   **[`server`](./server/GEMINI.md)**: Contains server-side HTTP filters.
+
+## Files
+
+*   **`client_authority_filter.h`, `client_authority_filter.cc`**: These files contain the implementation of the `ClientAuthorityFilter`, a client-side filter that sets the `:authority` pseudo-header in HTTP/2 requests.
+*   **`http_filters_plugin.cc`**: This file registers the HTTP filters with the `CoreConfiguration`.
+
+## Notes
+
+*   The filters in this directory are essential for ensuring that gRPC is compliant with the HTTP/2 specification.
+*   The `ClientAuthorityFilter` is a good example of a simple, single-purpose filter. It has one job (to set the `:authority` header), and it does it well.
+*   The `message_compress` filter is a good example of a more complex filter that is used on both the client and the server. It is responsible for compressing and decompressing messages, and it supports a variety of different compression algorithms.
diff --git a/deps/grpc/src/core/ext/filters/http/client/GEMINI.md b/deps/grpc/src/core/ext/filters/http/client/GEMINI.md
new file mode 100644
index 00000000000..a32d469379e
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/http/client/GEMINI.md
@@ -0,0 +1,23 @@
+# HTTP Client Filter
+
+This directory contains a client-side filter for setting HTTP/2 pseudo-headers.
+
+See also: [gRPC HTTP Filters overview](../GEMINI.md)
+
+## Overarching Purpose
+
+The HTTP client filter is responsible for setting various HTTP/2 pseudo-headers that are required for gRPC calls to function correctly. It also performs some basic validation of the server's response headers.
+
+## Files
+
+*   `http_client_filter.h`, `http_client_filter.cc`: These files define the `HttpClientFilter` class, a client-side filter that sets the `:method`, `:scheme`, `te`, `content-type`, and `user-agent` headers on outgoing requests.
+
+## Major Classes
+
+*   `grpc_core::HttpClientFilter`: The channel filter implementation.
+
+## Notes
+
+*   This filter is an essential part of the gRPC client-side channel stack. Without it, gRPC calls would not be compliant with the HTTP/2 specification.
+*   The filter's behavior can be customized using various channel arguments, such as those for setting the user agent and scheme.
+*   The `GRPC_ARG_TEST_ONLY_USE_PUT_REQUESTS` channel argument can be used to force the filter to use `PUT` requests instead of `POST`. This is intended for testing purposes only, and should not be used in production.
diff --git a/deps/grpc/src/core/ext/filters/http/client/http_client_filter.cc b/deps/grpc/src/core/ext/filters/http/client/http_client_filter.cc
index b9c11b67dbf..6f0aaa7497d 100644
--- a/deps/grpc/src/core/ext/filters/http/client/http_client_filter.cc
+++ b/deps/grpc/src/core/ext/filters/http/client/http_client_filter.cc
@@ -107,8 +107,7 @@ Slice UserAgentFromArgs(const ChannelArgs& args,
 
 void HttpClientFilter::Call::OnClientInitialMetadata(ClientMetadata& md,
                                                      HttpClientFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "HttpClientFilter::Call::OnClientInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("HttpClientFilter::Call::OnClientInitialMetadata");
   if (filter->test_only_use_put_requests_) {
     md.Set(HttpMethodMetadata(), HttpMethodMetadata::kPut);
   } else {
@@ -122,15 +121,13 @@ void HttpClientFilter::Call::OnClientInitialMetadata(ClientMetadata& md,
 
 absl::Status HttpClientFilter::Call::OnServerInitialMetadata(
     ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "HttpClientFilter::Call::OnServerInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("HttpClientFilter::Call::OnServerInitialMetadata");
   return CheckServerMetadata(&md);
 }
 
 absl::Status HttpClientFilter::Call::OnServerTrailingMetadata(
     ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "HttpClientFilter::Call::OnServerTrailingMetadata");
+  GRPC_LATENT_SEE_SCOPE("HttpClientFilter::Call::OnServerTrailingMetadata");
   return CheckServerMetadata(&md);
 }
 
diff --git a/deps/grpc/src/core/ext/filters/http/client_authority_filter.cc b/deps/grpc/src/core/ext/filters/http/client_authority_filter.cc
index 42ec6e40021..73c3149fd8e 100644
--- a/deps/grpc/src/core/ext/filters/http/client_authority_filter.cc
+++ b/deps/grpc/src/core/ext/filters/http/client_authority_filter.cc
@@ -51,8 +51,7 @@ ClientAuthorityFilter::Create(const ChannelArgs& args, ChannelFilter::Args) {
 
 void ClientAuthorityFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, ClientAuthorityFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ClientAuthorityFilter::Call::OnClientInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("ClientAuthorityFilter::Call::OnClientInitialMetadata");
   // If no authority is set, set the default authority.
   if (md.get_pointer(HttpAuthorityMetadata()) == nullptr) {
     md.Set(HttpAuthorityMetadata(), filter->default_authority_.Ref());
diff --git a/deps/grpc/src/core/ext/filters/http/message_compress/GEMINI.md b/deps/grpc/src/core/ext/filters/http/message_compress/GEMINI.md
new file mode 100644
index 00000000000..8f85236e205
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/http/message_compress/GEMINI.md
@@ -0,0 +1,23 @@
+# Message Compression Filter
+
+This directory contains the implementation of the message compression filter.
+
+## Overarching Purpose
+
+The message compression filter is responsible for compressing and decompressing gRPC messages. It can be used on both the client and the server to reduce the amount of data sent over the network.
+
+## Files
+
+*   `compression_filter.h`, `compression_filter.cc`: These files define the `ClientCompressionFilter` and `ServerCompressionFilter` classes, which are client-side and server-side channel filters, respectively. They also define the `ChannelCompression` class, which encapsulates the core compression and decompression logic.
+
+## Major Classes
+
+*   `grpc_core::ClientCompressionFilter`: The client-side channel filter for compression.
+*   `grpc_core::ServerCompressionFilter`: The server-side channel filter for compression.
+*   `grpc_core::ChannelCompression`: A helper class that encapsulates the logic for compressing and decompressing messages, as well as for handling compression-related metadata.
+
+## Notes
+
+*   The compression filter supports various compression algorithms, such as gzip and deflate. The desired compression algorithm can be specified through channel arguments or on a per-call basis via metadata.
+*   The filter also supports disabling compression for individual messages, which can be useful for preventing security vulnerabilities like CRIME and BEAST.
+*   This filter is an important part of gRPC's performance story, as it can significantly reduce network bandwidth usage and improve latency.
diff --git a/deps/grpc/src/core/ext/filters/http/message_compress/compression_filter.cc b/deps/grpc/src/core/ext/filters/http/message_compress/compression_filter.cc
index baf52243919..8b39085b6a6 100644
--- a/deps/grpc/src/core/ext/filters/http/message_compress/compression_filter.cc
+++ b/deps/grpc/src/core/ext/filters/http/message_compress/compression_filter.cc
@@ -229,7 +229,7 @@ ChannelCompression::DecompressArgs ChannelCompression::HandleIncomingMetadata(
 
 void ClientCompressionFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, ClientCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientCompressionFilter::Call::OnClientInitialMetadata");
   compression_algorithm_ =
       filter->compression_engine_.HandleOutgoingMetadata(md);
@@ -238,7 +238,7 @@ void ClientCompressionFilter::Call::OnClientInitialMetadata(
 
 MessageHandle ClientCompressionFilter::Call::OnClientToServerMessage(
     MessageHandle message, ClientCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientCompressionFilter::Call::OnClientToServerMessage");
   return filter->compression_engine_.CompressMessage(
       std::move(message), compression_algorithm_, call_tracer_);
@@ -246,7 +246,7 @@ MessageHandle ClientCompressionFilter::Call::OnClientToServerMessage(
 
 void ClientCompressionFilter::Call::OnServerInitialMetadata(
     ServerMetadata& md, ClientCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientCompressionFilter::Call::OnServerInitialMetadata");
   decompress_args_ = filter->compression_engine_.HandleIncomingMetadata(md);
 }
@@ -254,7 +254,7 @@ void ClientCompressionFilter::Call::OnServerInitialMetadata(
 absl::StatusOr<MessageHandle>
 ClientCompressionFilter::Call::OnServerToClientMessage(
     MessageHandle message, ClientCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientCompressionFilter::Call::OnServerToClientMessage");
   return filter->compression_engine_.DecompressMessage(
       /*is_client=*/true, std::move(message), decompress_args_, call_tracer_);
@@ -262,7 +262,7 @@ ClientCompressionFilter::Call::OnServerToClientMessage(
 
 void ServerCompressionFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, ServerCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerCompressionFilter::Call::OnClientInitialMetadata");
   decompress_args_ = filter->compression_engine_.HandleIncomingMetadata(md);
 }
@@ -270,7 +270,7 @@ void ServerCompressionFilter::Call::OnClientInitialMetadata(
 absl::StatusOr<MessageHandle>
 ServerCompressionFilter::Call::OnClientToServerMessage(
     MessageHandle message, ServerCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerCompressionFilter::Call::OnClientToServerMessage");
   return filter->compression_engine_.DecompressMessage(
       /*is_client=*/false, std::move(message), decompress_args_,
@@ -279,7 +279,7 @@ ServerCompressionFilter::Call::OnClientToServerMessage(
 
 void ServerCompressionFilter::Call::OnServerInitialMetadata(
     ServerMetadata& md, ServerCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerCompressionFilter::Call::OnServerInitialMetadata");
   compression_algorithm_ =
       filter->compression_engine_.HandleOutgoingMetadata(md);
@@ -287,7 +287,7 @@ void ServerCompressionFilter::Call::OnServerInitialMetadata(
 
 MessageHandle ServerCompressionFilter::Call::OnServerToClientMessage(
     MessageHandle message, ServerCompressionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerCompressionFilter::Call::OnServerToClientMessage");
   return filter->compression_engine_.CompressMessage(
       std::move(message), compression_algorithm_,
diff --git a/deps/grpc/src/core/ext/filters/http/server/GEMINI.md b/deps/grpc/src/core/ext/filters/http/server/GEMINI.md
new file mode 100644
index 00000000000..ad0ddc6456a
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/http/server/GEMINI.md
@@ -0,0 +1,40 @@
+# HTTP Server Filter
+
+This directory contains a server-side filter for processing HTTP/2 headers.
+
+See also: [gRPC HTTP Filters overview](../GEMINI.md)
+
+## Overarching Purpose
+
+The HTTP server filter is a critical component of the gRPC server-side channel stack. It is responsible for processing incoming HTTP/2 headers to ensure that they are valid for a gRPC request, as defined by the [gRPC-over-HTTP/2 specification](https://github.com/grpc/grpc/blob/master/doc/PROTOCOL-HTTP2.md).
+
+## Files
+
+*   `http_server_filter.h`, `http_server_filter.cc`: These files define the `HttpServerFilter` class, a server-side filter that validates incoming HTTP/2 headers and manipulates metadata.
+
+## Header Validation
+
+The filter performs the following validation checks on the incoming headers:
+
+*   It ensures that the `:scheme` header is `http` or `https`.
+*   It ensures that the `:method` header is `POST`. It can be configured to allow `PUT` requests for testing purposes, but this is not recommended for production use.
+*   It ensures that the `content-type` header is `application/grpc` or a variation thereof.
+*   It ensures that the `te` header is `trailers`.
+
+If any of these checks fail, the filter will send an error to the client.
+
+## Header Manipulation
+
+The filter also performs the following header manipulations:
+
+*   It can be configured to surface the `user-agent` header to the application.
+
+## Major Classes
+
+*   `grpc_core::HttpServerFilter`: The channel filter implementation.
+
+## Notes
+
+*   This filter is an essential part of the gRPC server-side channel stack. It ensures that incoming requests are compliant with the gRPC-over-HTTP/2 specification.
+*   The `GRPC_ARG_DO_NOT_USE_UNLESS_YOU_HAVE_PERMISSION_FROM_GRPC_TEAM_ALLOW_BROKEN_PUT_REQUESTS` channel argument can be used to allow `PUT` requests. This is intended for testing purposes only, and should not be used in production. `PUT` requests are not compliant with the gRPC specification, and can cause problems with some gRPC features, such as retries.
+*   The filter also has an option to surface the `user-agent` header to the application, which can be useful for analytics or other purposes. This is controlled by the `GRPC_ARG_SURFACE_USER_AGENT` channel argument.
diff --git a/deps/grpc/src/core/ext/filters/http/server/http_server_filter.cc b/deps/grpc/src/core/ext/filters/http/server/http_server_filter.cc
index f55591806e9..fa0a472398a 100644
--- a/deps/grpc/src/core/ext/filters/http/server/http_server_filter.cc
+++ b/deps/grpc/src/core/ext/filters/http/server/http_server_filter.cc
@@ -71,8 +71,7 @@ ServerMetadataHandle MalformedRequest(absl::string_view explanation) {
 
 ServerMetadataHandle HttpServerFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, HttpServerFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "HttpServerFilter::Call::OnClientInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("HttpServerFilter::Call::OnClientInitialMetadata");
   auto method = md.get(HttpMethodMetadata());
   if (method.has_value()) {
     switch (*method) {
@@ -135,8 +134,7 @@ ServerMetadataHandle HttpServerFilter::Call::OnClientInitialMetadata(
 }
 
 void HttpServerFilter::Call::OnServerInitialMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "HttpServerFilter::Call::OnServerInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("HttpServerFilter::Call::OnServerInitialMetadata");
   GRPC_TRACE_LOG(call, INFO)
       << GetContext<Activity>()->DebugTag() << "[http-server] Write metadata";
   FilterOutgoingMetadata(&md);
@@ -145,8 +143,7 @@ void HttpServerFilter::Call::OnServerInitialMetadata(ServerMetadata& md) {
 }
 
 void HttpServerFilter::Call::OnServerTrailingMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "HttpServerFilter::Call::OnServerTrailingMetadata");
+  GRPC_LATENT_SEE_SCOPE("HttpServerFilter::Call::OnServerTrailingMetadata");
   FilterOutgoingMetadata(&md);
 }
 
diff --git a/deps/grpc/src/core/ext/filters/load_reporting/GEMINI.md b/deps/grpc/src/core/ext/filters/load_reporting/GEMINI.md
new file mode 100644
index 00000000000..7a9c4d58ada
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/load_reporting/GEMINI.md
@@ -0,0 +1,28 @@
+# Server Load Reporting Filter
+
+This directory contains a server-side filter for reporting load data to a load balancer.
+
+See also: [gRPC Filters overview](../GEMINI.md)
+
+## Overarching Purpose
+
+The server load reporting filter provides a mechanism for a gRPC server to report load data to a load balancer. This data can be used by the load balancer to make more intelligent load balancing decisions, such as routing requests to the least loaded backend.
+
+## How it Works
+
+1.  The filter is added to the server's channel stack.
+2.  When a request is received, the filter extracts a load balancing token from the initial metadata of the request. This token is used to associate the load report with a specific backend.
+3.  The filter records various metrics throughout the lifecycle of the call, such as the number of bytes sent and received, and the call latency.
+4.  When the call is complete, the filter can extract custom cost metrics from the trailing metadata of the response.
+5.  The filter then uses OpenCensus to record the metrics. The metrics are tagged with the load balancing token, which allows the load balancer to correlate the metrics with the backend that handled the request.
+
+## Files
+
+*   `server_load_reporting_filter.h`, `server_load_reporting_filter.cc`: These files define the `ServerLoadReportingFilter` class, a server-side filter that reports load data to a load balancer.
+*   `registered_opencensus_objects.h`: This file defines the OpenCensus measures and tags that are used by the filter.
+
+## Notes
+
+*   This filter is an important component of gRPC's load balancing story, as it enables backends to provide real-time load information to load balancers.
+*   The filter is designed to be used with the `grpclb` load balancing policy, but it can be used with any load balancing policy that supports load reporting.
+*   The filter uses OpenCensus to record metrics. This means that the metrics can be exported to a variety of monitoring systems, such as Prometheus and Stackdriver.
diff --git a/deps/grpc/src/core/ext/filters/load_reporting/server_load_reporting_filter.cc b/deps/grpc/src/core/ext/filters/load_reporting/server_load_reporting_filter.cc
index e109541738b..a71c1d70c0b 100644
--- a/deps/grpc/src/core/ext/filters/load_reporting/server_load_reporting_filter.cc
+++ b/deps/grpc/src/core/ext/filters/load_reporting/server_load_reporting_filter.cc
@@ -174,7 +174,7 @@ const char* GetStatusTagForStatus(grpc_status_code status) {
 
 void ServerLoadReportingFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, ServerLoadReportingFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerLoadReportingFilter::Call::OnClientInitialMetadata");
   // Gather up basic facts about the request
   Slice service_method;
@@ -200,7 +200,7 @@ void ServerLoadReportingFilter::Call::OnClientInitialMetadata(
 
 void ServerLoadReportingFilter::Call::OnServerTrailingMetadata(
     ServerMetadata& md, ServerLoadReportingFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerLoadReportingFilter::Call::OnServerTrailingMetadata");
   const auto& costs = md.Take(LbCostBinMetadata());
   for (const auto& cost : costs) {
@@ -219,7 +219,7 @@ void ServerLoadReportingFilter::Call::OnServerTrailingMetadata(
 
 void ServerLoadReportingFilter::Call::OnFinalize(
     const grpc_call_final_info* final_info, ServerLoadReportingFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE("ServerLoadReportingFilter::Call::OnFinalize");
+  GRPC_LATENT_SEE_SCOPE("ServerLoadReportingFilter::Call::OnFinalize");
   if (final_info == nullptr) return;
   // After the last bytes have been placed on the wire we record
   // final measurements
diff --git a/deps/grpc/src/core/ext/filters/logging/GEMINI.md b/deps/grpc/src/core/ext/filters/logging/GEMINI.md
new file mode 100644
index 00000000000..e97632daeb7
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/logging/GEMINI.md
@@ -0,0 +1,17 @@
+# Logging Filter
+
+This directory contains a gRPC filter that logs call data.
+
+## Overarching Purpose
+
+The logging filter provides a way to log information about gRPC calls, such as the method name, the peer address, and the status of the call. This can be useful for debugging and for generating audit logs.
+
+## Files
+
+- **`logging_filter.h` / `logging_filter.cc`**: The implementation of the logging filter.
+- **`logging_sink.h`**: Defines the `LoggingSink` interface, which is used to output log messages.
+
+## Notes
+
+- The logging filter is a simple but powerful tool for understanding the behavior of gRPC applications.
+- It can be configured to log different levels of detail, and the output can be sent to a variety of different sinks.
diff --git a/deps/grpc/src/core/ext/filters/logging/logging_filter.cc b/deps/grpc/src/core/ext/filters/logging/logging_filter.cc
index 0e5cff73f63..8394a31d4ee 100644
--- a/deps/grpc/src/core/ext/filters/logging/logging_filter.cc
+++ b/deps/grpc/src/core/ext/filters/logging/logging_filter.cc
@@ -354,8 +354,7 @@ ClientLoggingFilter::Create(const ChannelArgs& args,
 
 void ClientLoggingFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, ClientLoggingFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ClientLoggingFilter::Call::OnClientInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("ClientLoggingFilter::Call::OnClientInitialMetadata");
   call_data_.emplace(true, md, filter->default_authority_);
   if (!call_data_->ShouldLog()) {
     call_data_.reset();
@@ -366,8 +365,7 @@ void ClientLoggingFilter::Call::OnClientInitialMetadata(
 }
 
 void ClientLoggingFilter::Call::OnServerInitialMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ClientLoggingFilter::Call::OnServerInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("ClientLoggingFilter::Call::OnServerInitialMetadata");
   if (!call_data_.has_value()) return;
   call_data_->LogServerHeader(
       /*is_client=*/true, MaybeGetContext<CallTracerAnnotationInterface>(),
@@ -375,8 +373,7 @@ void ClientLoggingFilter::Call::OnServerInitialMetadata(ServerMetadata& md) {
 }
 
 void ClientLoggingFilter::Call::OnServerTrailingMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ClientLoggingFilter::Call::OnServerTrailingMetadata");
+  GRPC_LATENT_SEE_SCOPE("ClientLoggingFilter::Call::OnServerTrailingMetadata");
   if (!call_data_.has_value()) return;
   if (md.get(GrpcCallWasCancelled()).value_or(false) &&
       md.get(GrpcStatusMetadata()) == GRPC_STATUS_CANCELLED) {
@@ -391,8 +388,7 @@ void ClientLoggingFilter::Call::OnServerTrailingMetadata(ServerMetadata& md) {
 
 void ClientLoggingFilter::Call::OnClientToServerMessage(
     const Message& message) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ClientLoggingFilter::Call::OnClientToServerMessage");
+  GRPC_LATENT_SEE_SCOPE("ClientLoggingFilter::Call::OnClientToServerMessage");
   if (!call_data_.has_value()) return;
   call_data_->LogClientMessage(
       /*is_client=*/true, MaybeGetContext<CallTracerAnnotationInterface>(),
@@ -400,8 +396,7 @@ void ClientLoggingFilter::Call::OnClientToServerMessage(
 }
 
 void ClientLoggingFilter::Call::OnClientToServerHalfClose() {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ClientLoggingFilter::Call::OnClientToServerHalfClose");
+  GRPC_LATENT_SEE_SCOPE("ClientLoggingFilter::Call::OnClientToServerHalfClose");
   if (!call_data_.has_value()) return;
   call_data_->LogClientHalfClose(
       /*is_client=*/true, MaybeGetContext<CallTracerAnnotationInterface>());
@@ -409,8 +404,7 @@ void ClientLoggingFilter::Call::OnClientToServerHalfClose() {
 
 void ClientLoggingFilter::Call::OnServerToClientMessage(
     const Message& message) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ClientLoggingFilter::Call::OnServerToClientMessage");
+  GRPC_LATENT_SEE_SCOPE("ClientLoggingFilter::Call::OnServerToClientMessage");
   if (!call_data_.has_value()) return;
   call_data_->LogServerMessage(
       /*is_client=*/true, MaybeGetContext<CallTracerAnnotationInterface>(),
@@ -431,8 +425,7 @@ ServerLoggingFilter::Create(const ChannelArgs& /*args*/,
 
 // Construct a promise for one call.
 void ServerLoggingFilter::Call::OnClientInitialMetadata(ClientMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ServerLoggingFilter::Call::OnClientInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("ServerLoggingFilter::Call::OnClientInitialMetadata");
   call_data_.emplace(false, md, "");
   if (!call_data_->ShouldLog()) {
     call_data_.reset();
@@ -444,8 +437,7 @@ void ServerLoggingFilter::Call::OnClientInitialMetadata(ClientMetadata& md) {
 }
 
 void ServerLoggingFilter::Call::OnServerInitialMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ServerLoggingFilter::Call::OnServerInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("ServerLoggingFilter::Call::OnServerInitialMetadata");
   if (!call_data_.has_value()) return;
   call_data_->LogServerHeader(
       /*is_client=*/false, MaybeGetContext<CallTracerAnnotationInterface>(),
@@ -453,8 +445,7 @@ void ServerLoggingFilter::Call::OnServerInitialMetadata(ServerMetadata& md) {
 }
 
 void ServerLoggingFilter::Call::OnServerTrailingMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ServerLoggingFilter::Call::OnServerTrailingMetadata");
+  GRPC_LATENT_SEE_SCOPE("ServerLoggingFilter::Call::OnServerTrailingMetadata");
   if (!call_data_.has_value()) return;
   if (md.get(GrpcCallWasCancelled()).value_or(false) &&
       md.get(GrpcStatusMetadata()) == GRPC_STATUS_CANCELLED) {
@@ -469,8 +460,7 @@ void ServerLoggingFilter::Call::OnServerTrailingMetadata(ServerMetadata& md) {
 
 void ServerLoggingFilter::Call::OnClientToServerMessage(
     const Message& message) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ServerLoggingFilter::Call::OnClientToServerMessage");
+  GRPC_LATENT_SEE_SCOPE("ServerLoggingFilter::Call::OnClientToServerMessage");
   if (!call_data_.has_value()) return;
   call_data_->LogClientMessage(
       /*is_client=*/false, MaybeGetContext<CallTracerAnnotationInterface>(),
@@ -478,8 +468,7 @@ void ServerLoggingFilter::Call::OnClientToServerMessage(
 }
 
 void ServerLoggingFilter::Call::OnClientToServerHalfClose() {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ServerLoggingFilter::Call::OnClientToServerHalfClose");
+  GRPC_LATENT_SEE_SCOPE("ServerLoggingFilter::Call::OnClientToServerHalfClose");
   if (!call_data_.has_value()) return;
   call_data_->LogClientHalfClose(
       /*is_client=*/false, MaybeGetContext<CallTracerAnnotationInterface>());
@@ -487,8 +476,7 @@ void ServerLoggingFilter::Call::OnClientToServerHalfClose() {
 
 void ServerLoggingFilter::Call::OnServerToClientMessage(
     const Message& message) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "ServerLoggingFilter::Call::OnServerToClientMessage");
+  GRPC_LATENT_SEE_SCOPE("ServerLoggingFilter::Call::OnServerToClientMessage");
   if (!call_data_.has_value()) return;
   call_data_->LogServerMessage(
       /*is_client=*/false, MaybeGetContext<CallTracerAnnotationInterface>(),
diff --git a/deps/grpc/src/core/ext/filters/message_size/GEMINI.md b/deps/grpc/src/core/ext/filters/message_size/GEMINI.md
new file mode 100644
index 00000000000..58c25897a48
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/message_size/GEMINI.md
@@ -0,0 +1,32 @@
+# Message Size Filter
+
+This directory contains the implementation of the message size filter, which is
+a channel filter that enforces limits on the size of incoming and outgoing
+messages.
+
+## Overarching Purpose
+
+The message size filter can be used to prevent clients and servers from sending
+or receiving messages that are too large, which can help to prevent
+denial-of-service attacks and other resource exhaustion issues.
+
+## Files
+
+*   **`message_size_filter.h`, `message_size_filter.cc`**: These files
+    contain the implementation of the `MessageSizeFilter`, which is a channel
+    filter that checks the size of each message against the configured limits.
+
+## Major Classes
+
+*   **`grpc_core::MessageSizeFilter`**: The channel filter implementation.
+*   **`grpc_core::MessageSizeParsedConfig`**: A class that holds the parsed
+    message size limits from the service config or channel arguments.
+
+## Notes
+
+*   The message size limits can be configured on both the client and the
+    server.
+*   The limits can be set via channel arguments (e.g.,
+    `GRPC_ARG_MAX_RECEIVE_MESSAGE_LENGTH`) or through the service config.
+*   If a message exceeds the configured limit, the filter will fail the RPC
+    with a `RESOURCE_EXHAUSTED` status.
diff --git a/deps/grpc/src/core/ext/filters/message_size/message_size_filter.cc b/deps/grpc/src/core/ext/filters/message_size/message_size_filter.cc
index 3000e73518d..4b041fd1372 100644
--- a/deps/grpc/src/core/ext/filters/message_size/message_size_filter.cc
+++ b/deps/grpc/src/core/ext/filters/message_size/message_size_filter.cc
@@ -187,7 +187,7 @@ void ClientMessageSizeFilter::Call::OnClientInitialMetadata(
 
 ServerMetadataHandle ServerMessageSizeFilter::Call::OnClientToServerMessage(
     const Message& message, ServerMessageSizeFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerMessageSizeFilter::Call::OnClientToServerMessage");
   return CheckPayload(message, filter->parsed_config_.max_recv_size(),
                       /*is_client=*/false, false);
@@ -195,7 +195,7 @@ ServerMetadataHandle ServerMessageSizeFilter::Call::OnClientToServerMessage(
 
 ServerMetadataHandle ServerMessageSizeFilter::Call::OnServerToClientMessage(
     const Message& message, ServerMessageSizeFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerMessageSizeFilter::Call::OnServerToClientMessage");
   return CheckPayload(message, filter->parsed_config_.max_send_size(),
                       /*is_client=*/false, true);
@@ -203,7 +203,7 @@ ServerMetadataHandle ServerMessageSizeFilter::Call::OnServerToClientMessage(
 
 ServerMetadataHandle ClientMessageSizeFilter::Call::OnClientToServerMessage(
     const Message& message) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientMessageSizeFilter::Call::OnClientToServerMessage");
   return CheckPayload(message, limits_.max_send_size(), /*is_client=*/true,
                       true);
@@ -211,7 +211,7 @@ ServerMetadataHandle ClientMessageSizeFilter::Call::OnClientToServerMessage(
 
 ServerMetadataHandle ClientMessageSizeFilter::Call::OnServerToClientMessage(
     const Message& message) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientMessageSizeFilter::Call::OnServerToClientMessage");
   return CheckPayload(message, limits_.max_recv_size(), /*is_client=*/true,
                       false);
diff --git a/deps/grpc/src/core/ext/filters/rbac/GEMINI.md b/deps/grpc/src/core/ext/filters/rbac/GEMINI.md
new file mode 100644
index 00000000000..8bbb9b90de2
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/rbac/GEMINI.md
@@ -0,0 +1,23 @@
+# RBAC Filter
+
+This directory contains a server-side filter for enforcing Role-Based Access Control (RBAC) policies.
+
+## Overarching Purpose
+
+The RBAC filter provides a mechanism for authorizing incoming requests based on a set of rules defined in an RBAC policy. This can be used to control access to gRPC services and methods based on the authenticated user's identity and other request metadata. The filter is designed to be used with xDS, which can be used to dynamically update the RBAC policy at runtime.
+
+## Files
+
+*   `rbac_filter.h`, `rbac_filter.cc`: These files define the `RbacFilter` class, a server-side filter that enforces RBAC policies on incoming requests. The filter fetches the RBAC policy from the method config of the service config, and then uses the `GrpcAuthorizationEngine` to evaluate the policy against the request.
+*   `rbac_service_config_parser.h`, `rbac_service_config_parser.cc`: These files define the `RbacServiceConfigParser` class, which is responsible for parsing the RBAC policy from the service config. The parser is registered with the `ServiceConfigParser` registry, and is invoked when the `rbac` key is present in the service config.
+
+## Major Classes
+
+*   `grpc_core::RbacFilter`: The channel filter implementation. This filter is responsible for enforcing the RBAC policy.
+*   `grpc_core::RbacServiceConfigParser`: The service config parser for the RBAC policy. This parser is responsible for parsing the RBAC policy from the service config and creating a `RbacMethodParsedConfig` object.
+*   `grpc_core::RbacMethodParsedConfig`: This class holds the parsed RBAC policies. It contains a vector of `GrpcAuthorizationEngine` objects, one for each RBAC policy.
+
+## Notes
+
+*   The RBAC filter is a powerful tool for securing gRPC services. It can be used to implement a wide range of authorization policies, from simple access control lists to complex, attribute-based policies.
+*   This filter is an important component of gRPC's security story, as it provides a flexible and extensible way to control access to gRPC services.
diff --git a/deps/grpc/src/core/ext/filters/rbac/rbac_filter.cc b/deps/grpc/src/core/ext/filters/rbac/rbac_filter.cc
index e8a7ad6f9e9..1573e263add 100644
--- a/deps/grpc/src/core/ext/filters/rbac/rbac_filter.cc
+++ b/deps/grpc/src/core/ext/filters/rbac/rbac_filter.cc
@@ -43,7 +43,7 @@ namespace grpc_core {
 
 absl::Status RbacFilter::Call::OnClientInitialMetadata(ClientMetadata& md,
                                                        RbacFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE("RbacFilter::Call::OnClientInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("RbacFilter::Call::OnClientInitialMetadata");
   // Fetch and apply the rbac policy from the service config.
   auto* service_config_call_data = GetContext<ServiceConfigCallData>();
   auto* method_params = static_cast<RbacMethodParsedConfig*>(
diff --git a/deps/grpc/src/core/ext/filters/stateful_session/GEMINI.md b/deps/grpc/src/core/ext/filters/stateful_session/GEMINI.md
new file mode 100644
index 00000000000..8d0b4cd3c17
--- /dev/null
+++ b/deps/grpc/src/core/ext/filters/stateful_session/GEMINI.md
@@ -0,0 +1,24 @@
+# Stateful Session Filter
+
+This directory contains a client-side filter for providing cookie-based stateful session affinity.
+
+## Overarching Purpose
+
+The stateful session filter provides a mechanism for routing requests to the same backend endpoint that handled previous requests from the same client. This is useful for applications that require session affinity, such as those that use in-memory caches or other stateful resources.
+
+## Files
+
+*   `stateful_session_filter.h`, `stateful_session_filter.cc`: These files define the `StatefulSessionFilter` class, a client-side filter that provides cookie-based stateful session affinity.
+*   `stateful_session_service_config_parser.h`, `stateful_session_service_config_parser.cc`: These files define the `StatefulSessionServiceConfigParser` class, which is responsible for parsing the stateful session configuration from the service config.
+
+## Major Classes
+
+*   `grpc_core::StatefulSessionFilter`: The channel filter implementation.
+*   `grpc_core::XdsOverrideHostAttribute`: A call attribute that is used to pass state between the `StatefulSessionFilter` and the `xds_override_host` load balancing policy.
+*   `grpc_core::StatefulSessionServiceConfigParser`: The service config parser for the stateful session configuration.
+
+## Notes
+
+*   The stateful session filter works in conjunction with the `xds_override_host` load balancing policy. The filter extracts a cookie from the incoming request's metadata, which the LB policy then uses to select an endpoint.
+*   The filter is designed to be used with xDS, which can be used to dynamically update the stateful session configuration at runtime.
+*   This filter is an important component of gRPC's load balancing story, as it enables applications to maintain session affinity across multiple requests.
diff --git a/deps/grpc/src/core/ext/filters/stateful_session/stateful_session_filter.cc b/deps/grpc/src/core/ext/filters/stateful_session/stateful_session_filter.cc
index 5ee89d53720..cb9fe9556f1 100644
--- a/deps/grpc/src/core/ext/filters/stateful_session/stateful_session_filter.cc
+++ b/deps/grpc/src/core/ext/filters/stateful_session/stateful_session_filter.cc
@@ -213,8 +213,7 @@ bool IsConfiguredPath(absl::string_view configured_path,
 
 void StatefulSessionFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, StatefulSessionFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "StatefulSessionFilter::Call::OnClientInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("StatefulSessionFilter::Call::OnClientInitialMetadata");
   // Get config.
   auto* service_config_call_data = GetContext<ServiceConfigCallData>();
   CHECK_NE(service_config_call_data, nullptr);
@@ -254,8 +253,7 @@ void StatefulSessionFilter::Call::OnClientInitialMetadata(
 }
 
 void StatefulSessionFilter::Call::OnServerInitialMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "StatefulSessionFilter::Call::OnServerInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("StatefulSessionFilter::Call::OnServerInitialMetadata");
   if (!perform_filtering_) return;
   // Add cookie to server initial metadata if needed.
   MaybeUpdateServerInitialMetadata(cookie_config_, cluster_changed_,
@@ -264,7 +262,7 @@ void StatefulSessionFilter::Call::OnServerInitialMetadata(ServerMetadata& md) {
 }
 
 void StatefulSessionFilter::Call::OnServerTrailingMetadata(ServerMetadata& md) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "StatefulSessionFilter::Call::OnServerTrailingMetadata");
   if (!perform_filtering_) return;
   // If we got a Trailers-Only response, then add the
diff --git a/deps/grpc/src/core/ext/transport/chaotic_good/GEMINI.md b/deps/grpc/src/core/ext/transport/chaotic_good/GEMINI.md
new file mode 100644
index 00000000000..b72e87cd970
--- /dev/null
+++ b/deps/grpc/src/core/ext/transport/chaotic_good/GEMINI.md
@@ -0,0 +1,45 @@
+# "Chaotic Good" Transport
+
+This directory contains the implementation of a new, experimental gRPC transport called "Chaotic Good".
+
+See also: [gRPC Transports overview](../transport/GEMINI.md)
+
+## Overarching Purpose
+
+The "Chaotic Good" transport is a new transport implementation for gRPC that is designed to be more performant and flexible than the existing CHTTP2 transport. It is based on a custom framing format and is heavily reliant on the gRPC Core Promise API.
+
+See also: [gRPC Transports directory](../)
+## Core Concepts
+
+The "Chaotic Good" transport is built around a few key concepts:
+
+*   **Custom Framing Format**: The transport uses a custom framing format that is defined in the `chaotic_good_frame.proto` file. The framing format is designed to be simple and efficient, and it supports all of the features of gRPC, including headers, messages, and trailers.
+*   **Promise-Based Architecture**: The transport is heavily based on the [gRPC Core Promise API](../../lib/promise/GEMINI.md). This allows the transport to be implemented in a more asynchronous and non-blocking way, which can lead to better performance and scalability.
+*   **Separation of Control and Data Planes**: The transport separates the control plane (e.g., sending and receiving headers) from the data plane (e.g., sending and receiving messages). This allows the transport to be more flexible and to support a variety of different use cases.
+
+## Files
+
+*   **`chaotic_good.h`, `chaotic_good.cc`**: These files contain the main entry points for the Chaotic Good transport.
+*   **`client_transport.h`, `client_transport.cc`**: These files contain the implementation of the client-side transport.
+*   **`server_transport.h`, `server_transport.cc`**: These files contain the implementation of the server-side transport.
+*   **`frame.h`, `frame.cc`**: These files define the C++ classes that represent the different types of frames in the custom framing format.
+*   **`frame_header.h`, `frame_header.cc`**: These files define the header for each frame in the custom framing format.
+*   **`chaotic_good_frame.proto`**: This file contains the protobuf definition of the framing format.
+*   **`frame_transport.h`**: Defines the interface for a transport that can send and receive frames.
+*   **`control_endpoint.h`, `control_endpoint.cc`**: Implements the control plane for the transport.
+*   **`data_endpoints.h`, `data_endpoints.cc`**: Implements the data plane for the transport.
+*   **`scheduler.h`, `scheduler.cc`**: A simple scheduler for running promises.
+
+## Major Classes
+
+*   `grpc_core::chaotic_good::ChaoticGoodClientTransport`: The client-side transport implementation.
+*   `grpc_core::chaotic_good::ChaoticGoodServerTransport`: The server-side transport implementation.
+*   `grpc_core::chaotic_good::FrameInterface`: The base class for all frame types.
+*   `grpc_core::chaotic_good::FrameTransport`: The interface for a transport that can send and receive frames.
+
+## Notes
+
+*   This transport is still under development and is not yet recommended for production use.
+*   The name "Chaotic Good" is a reference to the Dungeons & Dragons alignment system. It originally reflected that Chaotic Good was a transport with an alignment story, as it guaranteed alignment for received messages.
+*   The transport is a good example of how the gRPC Core Promise API can be used to build high-performance, asynchronous network applications.
+*   The separation of the control and data planes is a key design feature of the transport. It allows the transport to be more flexible and to support a variety of different use cases. For example, the control plane could be implemented over a reliable transport like TCP, while the data plane could be implemented over a less reliable transport like UDP.
diff --git a/deps/grpc/src/core/ext/transport/chaotic_good/data_endpoints.cc b/deps/grpc/src/core/ext/transport/chaotic_good/data_endpoints.cc
index fe4e2c4803d..4fc49330751 100644
--- a/deps/grpc/src/core/ext/transport/chaotic_good/data_endpoints.cc
+++ b/deps/grpc/src/core/ext/transport/chaotic_good/data_endpoints.cc
@@ -155,10 +155,10 @@ void OutputBuffers::Reader::EndReadNext() {
 
 Poll<std::vector<OutputBuffers::QueuedFrame>>
 OutputBuffers::Reader::PollReadNext() {
-  GRPC_LATENT_SEE_INNER_SCOPE("OutputBuffers::PollReadNext");
+  GRPC_LATENT_SEE_SCOPE("OutputBuffers::PollReadNext");
   mu_.Lock();
   while (true) {
-    GRPC_LATENT_SEE_INNER_SCOPE("OutputBuffers::PollReadNext::loop");
+    GRPC_LATENT_SEE_SCOPE("OutputBuffers::PollReadNext::loop");
     if (frames_.empty()) {
       if (!reading_) {
         reading_ = true;
@@ -245,7 +245,7 @@ void OutputBuffers::DestroyReader(uint32_t id) {
 }
 
 void OutputBuffers::WakeupScheduler() {
-  GRPC_LATENT_SEE_INNER_SCOPE("OutputBuffers::WakeupScheduler");
+  GRPC_LATENT_SEE_SCOPE("OutputBuffers::WakeupScheduler");
   auto state = scheduling_state_.load(std::memory_order_acquire);
   // CAS's here-in need to be acq-rel, so that we get an acquire on failure (at
   // which point we may be loading a Waker pointer).
@@ -276,7 +276,7 @@ void OutputBuffers::WakeupScheduler() {
 }
 
 Poll<Empty> OutputBuffers::SchedulerPollForWork() {
-  GRPC_LATENT_SEE_INNER_SCOPE("OutputBuffers::SchedulerPollForWork");
+  GRPC_LATENT_SEE_SCOPE("OutputBuffers::SchedulerPollForWork");
   auto state = scheduling_state_.load(std::memory_order_acquire);
   while (true) {
     switch (state) {
@@ -306,13 +306,13 @@ Poll<Empty> OutputBuffers::SchedulerPollForWork() {
 }
 
 void OutputBuffers::Schedule() {
-  GRPC_LATENT_SEE_INNER_SCOPE("OutputBuffers::Schedule");
+  GRPC_LATENT_SEE_SCOPE("OutputBuffers::Schedule");
   auto* first_message = frames_queue_.Peek();
   if (first_message == nullptr) return;
   std::vector<SchedulingData> scheduling_data;
   uint64_t queued_tokens = 0;
   {
-    GRPC_LATENT_SEE_INNER_SCOPE("OutputBuffers::Schedule::CollectData1");
+    GRPC_LATENT_SEE_SCOPE("OutputBuffers::Schedule::CollectData1");
     MutexLock lock(&mu_reader_data_);
     scheduling_data.reserve(readers_.size());
     for (const auto& reader : readers_) {
@@ -329,7 +329,7 @@ void OutputBuffers::Schedule() {
   const auto now = clock_->Now();
   bool any_readers = false;
   {
-    GRPC_LATENT_SEE_INNER_SCOPE("OutputBuffers::Schedule::CollectData2");
+    GRPC_LATENT_SEE_SCOPE("OutputBuffers::Schedule::CollectData2");
     for (size_t i = 0; i < scheduling_data.size(); ++i) {
       SchedulingData& scheduling = scheduling_data[i];
       if (scheduling.reader == nullptr) continue;
@@ -344,11 +344,11 @@ void OutputBuffers::Schedule() {
   }
   if (!any_readers) return;
   {
-    GRPC_LATENT_SEE_INNER_SCOPE("OutputBuffers::Schedule::MakePlan");
+    GRPC_LATENT_SEE_SCOPE("OutputBuffers::Schedule::MakePlan");
     scheduler_->MakePlan(*ztrace_collector_);
   }
   {
-    GRPC_LATENT_SEE_INNER_SCOPE("OutputBuffers::Schedule::PlaceMessages");
+    GRPC_LATENT_SEE_SCOPE("OutputBuffers::Schedule::PlaceMessages");
     while (true) {
       auto* message = frames_queue_.Peek();
       if (message == nullptr) break;
@@ -371,7 +371,7 @@ void OutputBuffers::Schedule() {
     }
   }
   {
-    GRPC_LATENT_SEE_INNER_SCOPE("OutputBuffers::Schedule::PublishSchedule");
+    GRPC_LATENT_SEE_SCOPE("OutputBuffers::Schedule::PublishSchedule");
     for (auto& scheduling : scheduling_data) {
       if (scheduling.frames.empty()) continue;
       auto& reader = scheduling.reader;
@@ -400,7 +400,7 @@ void OutputBuffers::Schedule() {
 
 void OutputBuffers::Write(uint64_t payload_tag,
                           MpscQueued<OutgoingFrame> output_buffer) {
-  GRPC_LATENT_SEE_INNER_SCOPE("OutputBuffers::Write");
+  GRPC_LATENT_SEE_SCOPE("OutputBuffers::Write");
   GRPC_TRACE_LOG(chaotic_good, INFO)
       << "CHAOTIC_GOOD: " << this
       << " Queue data frame write, payload_tag=" << payload_tag;
@@ -460,7 +460,7 @@ InputQueue::ReadTicket InputQueue::Read(uint64_t payload_tag) {
 }
 
 void InputQueue::CompleteRead(uint64_t payload_tag, SliceBuffer buffer) {
-  GRPC_LATENT_SEE_INNER_SCOPE("InputQueue::CompleteRead");
+  GRPC_LATENT_SEE_SCOPE("InputQueue::CompleteRead");
   if (payload_tag == 0) return;
   mu_.Lock();
   if (!closed_error_.ok()) {
@@ -648,7 +648,7 @@ class MetricsCollector
         [reader, ztrace_collector, write_size, self = Ref()](
             EventEngine::Endpoint::WriteEvent event, absl::Time timestamp,
             std::vector<EventEngine::Endpoint::WriteMetric> metrics) {
-          GRPC_LATENT_SEE_PARENT_SCOPE("MetricsCollector::WriteEventSink");
+          GRPC_LATENT_SEE_SCOPE("MetricsCollector::WriteEventSink");
           ztrace_collector->Append([event, timestamp, &metrics,
                                     telemetry_info = self->telemetry_info_,
                                     &reader]() {
@@ -706,7 +706,7 @@ auto Endpoint::PullDataPayload(RefCountedPtr<EndpointContext> ctx) {
             << " frames to data endpoint #" << ctx->id;
         using grpc_event_engine::experimental::EventEngine;
 
-        GRPC_LATENT_SEE_INNER_SCOPE("SerializePayload");
+        GRPC_LATENT_SEE_SCOPE("SerializePayload");
         // Frame everything into a slice buffer.
         SliceBuffer buffer;
         const size_t header_padding = DataConnectionPadding(
diff --git a/deps/grpc/src/core/ext/transport/chaotic_good/server/chaotic_good_server.cc b/deps/grpc/src/core/ext/transport/chaotic_good/server/chaotic_good_server.cc
index 8435cf2b1eb..b65bfe3dd44 100644
--- a/deps/grpc/src/core/ext/transport/chaotic_good/server/chaotic_good_server.cc
+++ b/deps/grpc/src/core/ext/transport/chaotic_good/server/chaotic_good_server.cc
@@ -178,7 +178,9 @@ ChaoticGoodServerListener::CreateListener(bool must_be_posix) {
     return event_engine_supports_fd->CreatePosixListener(
         std::move(accept_cb), std::move(shutdown_cb),
         grpc_event_engine::experimental::ChannelArgsEndpointConfig(args_),
-        std::make_unique<MemoryQuota>("chaotic_good_server_listener"));
+        std::make_unique<MemoryQuota>(
+            MakeRefCounted<channelz::ResourceQuotaNode>(
+                "chaotic_good_server_listener")));
   }
   EventEngine::Listener::AcceptCallback accept_cb =
       [self = RefAsSubclass<ChaoticGoodServerListener>()](
@@ -197,7 +199,8 @@ ChaoticGoodServerListener::CreateListener(bool must_be_posix) {
   return event_engine_->CreateListener(
       std::move(accept_cb), std::move(shutdown_cb),
       grpc_event_engine::experimental::ChannelArgsEndpointConfig(args_),
-      std::make_unique<MemoryQuota>("chaotic_good_server_listener"));
+      std::make_unique<MemoryQuota>(MakeRefCounted<channelz::ResourceQuotaNode>(
+          "chaotic_good_server_listener")));
 }
 
 absl::StatusOr<int> ChaoticGoodServerListener::Bind(
diff --git a/deps/grpc/src/core/ext/transport/chaotic_good_legacy/GEMINI.md b/deps/grpc/src/core/ext/transport/chaotic_good_legacy/GEMINI.md
new file mode 100644
index 00000000000..e2e9b2322d9
--- /dev/null
+++ b/deps/grpc/src/core/ext/transport/chaotic_good_legacy/GEMINI.md
@@ -0,0 +1,24 @@
+# "Chaotic Good" Transport (Legacy)
+
+This directory contains a legacy implementation of the "Chaotic Good" transport.
+
+See also: [gRPC Transports overview](../GEMINI.md)
+
+## Overarching Purpose
+
+This directory contains an older implementation of the "Chaotic Good" transport. It's currently the default used by many applications, and is being transitioned away from to the new implementation found in the [`chaotic_good`](../chaotic_good/GEMINI.md) directory.
+
+## Files
+
+*   `chaotic_good_transport.h`: This file contains the main entry points for the legacy Chaotic Good transport.
+*   `client_transport.h`, `client_transport.cc`: These files contain the implementation of the client-side transport.
+*   `server_transport.h`, `server_transport.cc`: These files contain the implementation of the server-side transport.
+*   `frame.h`, `frame.cc`, `frame_header.h`, `frame_header.cc`: These files define the custom framing format used by the transport.
+
+## Major Classes
+
+*   `grpc_core::chaotic_good_legacy::ChaoticGoodTransport`: The main transport implementation.
+
+## Notes
+
+*   This implementation is considered obsolete and should not be used in new code.
diff --git a/deps/grpc/src/core/ext/transport/chaotic_good_legacy/server/chaotic_good_server.cc b/deps/grpc/src/core/ext/transport/chaotic_good_legacy/server/chaotic_good_server.cc
index 1b74a8fc4b1..7d703189e6a 100644
--- a/deps/grpc/src/core/ext/transport/chaotic_good_legacy/server/chaotic_good_server.cc
+++ b/deps/grpc/src/core/ext/transport/chaotic_good_legacy/server/chaotic_good_server.cc
@@ -127,7 +127,8 @@ absl::StatusOr<int> ChaoticGoodServerListener::Bind(
   auto ee_listener = event_engine_->CreateListener(
       std::move(accept_cb), std::move(shutdown_cb),
       grpc_event_engine::experimental::ChannelArgsEndpointConfig(args_),
-      std::make_unique<MemoryQuota>("chaotic_good_server_listener"));
+      std::make_unique<MemoryQuota>(MakeRefCounted<channelz::ResourceQuotaNode>(
+          "chaotic_good_server_listener")));
   if (!ee_listener.ok()) {
     LOG(ERROR) << "Bind failed: " << ee_listener.status().ToString();
     return ee_listener.status();
diff --git a/deps/grpc/src/core/ext/transport/chttp2/GEMINI.md b/deps/grpc/src/core/ext/transport/chttp2/GEMINI.md
new file mode 100644
index 00000000000..014b40cfc44
--- /dev/null
+++ b/deps/grpc/src/core/ext/transport/chttp2/GEMINI.md
@@ -0,0 +1,46 @@
+# CHTTP2 Transport
+
+This directory contains the implementation of the CHTTP2 transport, which is the primary transport used in gRPC.
+
+See also: [gRPC Transports overview](../GEMINI.md)
+
+## Overarching Purpose
+
+The CHTTP2 transport is a highly optimized and feature-rich implementation of HTTP/2 that is used for both client and server communication. It is responsible for managing the HTTP/2 connection, including stream multiplexing, flow control, and header compression.
+
+## Core Concepts
+
+*   **HPACK**: The CHTTP2 transport includes a full implementation of the [HPACK](https://httpwg.org/specs/rfc7541.html) header compression algorithm. This is used to compress the headers of gRPC requests and responses, which can significantly reduce the amount of data that needs to be sent over the network.
+*   **Flow Control**: The transport implements both stream-level and connection-level flow control. This is used to prevent a single stream or connection from consuming too much memory, and to ensure that all streams get a fair share of the available bandwidth.
+*   **Stream Multiplexing**: The transport supports multiplexing multiple gRPC streams over a single TCP connection. This is a key feature of HTTP/2, and it allows gRPC to achieve high performance and low latency.
+
+## Subdirectories
+
+*   **`alpn`**: Contains code for ALPN (Application-Layer Protocol Negotiation), which is used to select the HTTP/2 protocol during the TLS handshake.
+*   **`client`**: Contains the client-side implementation of the CHTTP2 transport.
+*   **`server`**: Contains the server-side implementation of the CHTTP2 transport.
+*   **`transport`**: Contains the core implementation of the CHTTP2 transport, including the logic for parsing and serializing HTTP/2 frames, managing streams, and handling flow control.
+
+## Files
+
+*   **`transport/chttp2_transport.h`, `transport/chttp2_transport.cc`**: These files define the `Http2Transport` class, which is the main transport class.
+*   **`transport/frame.h`, `transport/frame.cc`**: These files define the C++ classes that represent the different types of HTTP/2 frames.
+*   **`transport/hpack_encoder.h`, `transport/hpack_encoder.cc`**: These files define the HPACK encoder.
+*   **`transport/hpack_parser.h`, `transport/hpack_parser.cc`**: These files define the HPACK parser.
+*   **`transport/flow_control.h`, `transport/flow_control.cc`**: These files define the flow control logic.
+*   **`client/chttp2_connector.h`, `client/chttp2_connector.cc`**: These files define the client-side connector, which is responsible for creating a new CHTTP2 transport.
+*   **`server/chttp2_server.h`, `server/chttp2_server.cc`**: These files define the server-side listener, which is responsible for accepting new connections and creating new CHTTP2 transports.
+
+## Major Classes
+
+*   **`grpc_core::chttp2::Http2Transport`**: The main transport class.
+*   **`grpc_core::chttp2::Stream`**: Represents a single HTTP/2 stream.
+*   **`grpc_core::chttp2::HpackEncoder`**: The HPACK encoder.
+*   **`grpc_core::chttp2::HpackParser`**: The HPACK parser.
+
+## Notes
+
+*   The CHTTP2 transport is the default transport used by gRPC.
+*   It is highly configurable and can be tuned for a variety of different workloads.
+*   It supports all of the features of HTTP/2, including multiplexing, flow control, and header compression.
+*   The CHTTP2 transport is a complex piece of machinery, and it can be difficult to understand how all of the different pieces fit together. The best way to understand it is to read the code and to trace the execution of a simple RPC.
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/chttp2_transport.cc b/deps/grpc/src/core/ext/transport/chttp2/transport/chttp2_transport.cc
index 02608aa03eb..e320e3343cf 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/chttp2_transport.cc
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/chttp2_transport.cc
@@ -69,6 +69,7 @@
 #include "src/core/ext/transport/chttp2/transport/frame_security.h"
 #include "src/core/ext/transport/chttp2/transport/hpack_encoder.h"
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings_manager.h"
 #include "src/core/ext/transport/chttp2/transport/http2_stats_collector.h"
 #include "src/core/ext/transport/chttp2/transport/http2_status.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
@@ -1136,7 +1137,7 @@ static const char* begin_writing_desc(bool partial) {
 static void write_action_begin_locked(
     grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
     grpc_error_handle /*error_ignored*/) {
-  GRPC_LATENT_SEE_INNER_SCOPE("write_action_begin_locked");
+  GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("write_action_begin_locked");
   CHECK(t->write_state != GRPC_CHTTP2_WRITE_STATE_IDLE);
   grpc_chttp2_begin_write_result r;
   if (!t->closed_with_error.ok()) {
@@ -2896,7 +2897,7 @@ static void read_action(grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
 static void read_action_parse_loop_locked(
     grpc_core::RefCountedPtr<grpc_chttp2_transport> t,
     grpc_error_handle error) {
-  GRPC_LATENT_SEE_INNER_SCOPE("read_action_parse_loop_locked");
+  GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("read_action_parse_loop_locked");
   if (t->closed_with_error.ok()) {
     grpc_error_handle errors[3] = {error, absl::OkStatus(), absl::OkStatus()};
     size_t requests_started = 0;
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/flow_control.cc b/deps/grpc/src/core/ext/transport/chttp2/transport/flow_control.cc
index 91f611959d0..33b612f7acf 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/flow_control.cc
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/flow_control.cc
@@ -34,6 +34,7 @@
 #include "absl/strings/str_format.h"
 #include "absl/strings/str_join.h"
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings_manager.h"
 #include "src/core/lib/experiments/experiments.h"
 #include "src/core/lib/resource_quota/memory_quota.h"
 #include "src/core/util/useful.h"
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/flow_control.h b/deps/grpc/src/core/ext/transport/chttp2/transport/flow_control.h
index 54eb4a06cd6..4293084b77c 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/flow_control.h
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/flow_control.h
@@ -34,6 +34,7 @@
 #include "absl/strings/string_view.h"
 #include "src/core/channelz/property_list.h"
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings_manager.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/resource_quota/memory_quota.h"
 #include "src/core/lib/transport/bdp_estimator.h"
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/frame.cc b/deps/grpc/src/core/ext/transport/chttp2/transport/frame.cc
index 95f90e40f8a..cd721bc1d13 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/frame.cc
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/frame.cc
@@ -24,20 +24,69 @@
 #include "absl/log/check.h"
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_buffer.h"
 #include "src/core/util/crash.h"
 
+// TODO(tjagtap) TODO(akshitpatel): [PH2][P3] : Write micro benchmarks for
+// framing code
+
 using grpc_core::http2::Http2ErrorCode;
 using grpc_core::http2::Http2Status;
 using grpc_core::http2::ValueOrHttp2Status;
 
 namespace grpc_core {
 
+///////////////////////////////////////////////////////////////////////////////
+// Settings Frame Validations
+
+bool IsUnknownSetting(const uint16_t setting_id) {
+  // RFC9113 : An endpoint that receives a SETTINGS frame with any unknown
+  // or unsupported identifier MUST ignore that setting.
+  return setting_id < Http2Settings::kHeaderTableSizeWireId ||
+         setting_id > Http2Settings::kGrpcAllowSecurityFrameWireId ||
+         (setting_id > Http2Settings::kMaxHeaderListSizeWireId &&
+          setting_id < Http2Settings::kGrpcAllowTrueBinaryMetadataWireId);
+}
+
+Http2Status ValidateSettingsValues(
+    std::vector<Http2SettingsFrame::Setting>& list) {
+  for (const auto& setting : list) {
+    if (GPR_UNLIKELY(setting.id == Http2Settings::kInitialWindowSizeWireId &&
+                     setting.value > RFC9113::kMaxSize31Bit)) {
+      LOG(ERROR)
+          << "ValidateSettingsValues Invalid "
+             "Setting:{setting.id:kInitialWindowSizeWireId, setting.value: "
+          << setting.value << "}";
+      return Http2Status::Http2ConnectionError(
+          Http2ErrorCode::kFlowControlError,
+          absl::StrCat(RFC9113::kIncorrectWindowSizeSetting,
+                       "Invalid Setting:{setting.id:kInitialWindowSizeWireId, "
+                       "setting.value: ",
+                       setting.value));
+    } else if (GPR_UNLIKELY(setting.id == Http2Settings::kMaxFrameSizeWireId &&
+                            (setting.value < RFC9113::kMinimumFrameSize ||
+                             setting.value > RFC9113::kMaximumFrameSize))) {
+      LOG(ERROR) << "ValidateSettingsValues Invalid "
+                    "Setting:{setting.id:kMaxFrameSizeWireId, setting.value: "
+                 << setting.value << "}";
+      return Http2Status::Http2ConnectionError(
+          Http2ErrorCode::kProtocolError,
+          absl::StrCat(RFC9113::kIncorrectFrameSizeSetting,
+                       "Invalid Setting:{setting.id:kMaxFrameSizeWireId, "
+                       "setting.value: ",
+                       setting.value));
+    }
+  }
+  DVLOG(2) << "Http2Transport ValidateSettingsValues Valid";
+  return Http2Status::Ok();
+}
+
 namespace {
 
-// TODO(tjagtap) TODO(akshitpatel): [PH2][P3] : Write micro benchmarks for
-// framing code
+///////////////////////////////////////////////////////////////////////////////
+// HTTP2 Framing Code
 
 // HTTP2 Frame Types
 enum class FrameType : uint8_t {
@@ -431,7 +480,8 @@ ValueOrHttp2Status<Http2Frame> ParseSettingsFrame(const Http2FrameHeader& hdr,
           Http2ErrorCode::kFrameSizeError,
           absl::StrCat(RFC9113::kSettingsLength0, hdr.ToString()));
     }
-    return ValueOrHttp2Status<Http2Frame>(Http2SettingsFrame{true, {}});
+    return ValueOrHttp2Status<Http2Frame>(
+        Http2SettingsFrame{/*ack=*/true, /*settings=*/{}});
   }
 
   if (GPR_UNLIKELY(payload.Length() % 6 != 0)) {
@@ -440,13 +490,18 @@ ValueOrHttp2Status<Http2Frame> ParseSettingsFrame(const Http2FrameHeader& hdr,
         absl::StrCat(RFC9113::kSettingsLength6x, hdr.ToString()));
   }
 
-  Http2SettingsFrame frame{false, {}};
+  Http2SettingsFrame frame{/*ack=*/false, /*settings=*/{}};
   while (payload.Length() != 0) {
     uint8_t buffer[6];
     payload.MoveFirstNBytesIntoBuffer(6, buffer);
+    uint16_t setting_id = Read2b(buffer);
+    uint32_t setting_value = Read4b(buffer + 2);
+    if (GPR_UNLIKELY(IsUnknownSetting(setting_id))) {
+      continue;
+    }
     frame.settings.push_back({
-        Read2b(buffer),
-        Read4b(buffer + 2),
+        setting_id,
+        setting_value,
     });
   }
   return ValueOrHttp2Status<Http2Frame>(std::move(frame));
@@ -578,6 +633,7 @@ std::string Http2FrameTypeString(FrameType frame_type) {
   }
   return absl::StrCat("UNKNOWN(", static_cast<uint8_t>(frame_type), ")");
 }
+
 }  // namespace
 
 std::string Http2FrameHeader::ToString() const {
@@ -642,6 +698,9 @@ http2::Http2ErrorCode Http2ErrorCodeFromRstFrameErrorCode(uint32_t error_code) {
   return static_cast<http2::Http2ErrorCode>(error_code);
 }
 
+///////////////////////////////////////////////////////////////////////////////
+// GRPC Header
+
 GrpcMessageHeader ExtractGrpcHeader(SliceBuffer& payload) {
   CHECK_GE(payload.Length(), kGrpcHeaderSizeInBytes);
   uint8_t buffer[kGrpcHeaderSizeInBytes];
@@ -659,4 +718,28 @@ void AppendGrpcHeaderToSliceBuffer(SliceBuffer& payload, const uint8_t flags,
   Write4b(length, frame_hdr + 1);
 }
 
+Http2Status ValidateFrameHeader(const uint32_t max_frame_size_setting,
+                                const bool incoming_header_in_progress,
+                                const uint32_t incoming_header_stream_id,
+                                Http2FrameHeader& current_frame_header) {
+  if (GPR_UNLIKELY(current_frame_header.length > max_frame_size_setting)) {
+    return Http2Status::Http2ConnectionError(
+        Http2ErrorCode::kFrameSizeError,
+        absl::StrCat(RFC9113::kFrameSizeLargerThanMaxFrameSizeSetting,
+                     ", Current Size = ", current_frame_header.length,
+                     ", Max Size = ", max_frame_size_setting));
+  }
+  if (GPR_UNLIKELY(
+          incoming_header_in_progress &&
+          (current_frame_header.type !=
+               static_cast<uint8_t>(FrameType::kContinuation) ||
+           current_frame_header.stream_id != incoming_header_stream_id))) {
+    return Http2Status::Http2ConnectionError(
+        Http2ErrorCode::kProtocolError,
+        std::string(RFC9113::kAssemblerContiguousSequenceError));
+  }
+  // TODO(tjagtap) : [PH2][P2]:Consider validating MAX_CONCURRENT_STREAMS here
+  return Http2Status::Ok();
+}
+
 }  // namespace grpc_core
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/frame.h b/deps/grpc/src/core/ext/transport/chttp2/transport/frame.h
index 94a5f537783..a714c0c460a 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/frame.h
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/frame.h
@@ -25,6 +25,7 @@
 #include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 #include "absl/types/span.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings.h"
 #include "src/core/ext/transport/chttp2/transport/http2_status.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_buffer.h"
@@ -257,6 +258,20 @@ GrpcMessageHeader ExtractGrpcHeader(SliceBuffer& payload);
 void AppendGrpcHeaderToSliceBuffer(SliceBuffer& payload, const uint8_t flags,
                                    const uint32_t length);
 
+///////////////////////////////////////////////////////////////////////////////
+// Validations
+
+http2::Http2Status ValidateSettingsValues(
+    std::vector<Http2SettingsFrame::Setting>& list);
+
+http2::Http2Status ValidateFrameHeader(uint32_t max_frame_size_setting,
+                                       bool incoming_header_in_progress,
+                                       uint32_t incoming_header_stream_id,
+                                       Http2FrameHeader& current_frame_header);
+
+///////////////////////////////////////////////////////////////////////////////
+// RFC9113 Related Strings and Consts
+
 namespace RFC9113 {
 // RFC9113: 5.1.1.
 inline constexpr absl::string_view kStreamIdMustBeOdd =
@@ -316,6 +331,18 @@ inline constexpr absl::string_view kNoPushPromise =
     "setting of the "
     "peer endpoint is set to 0";
 
+inline constexpr absl::string_view kAssemblerContiguousSequenceError =
+    "RFC9113 : Field blocks MUST be transmitted as a contiguous sequence "
+    "of frames, with no interleaved frames of any other type or from any "
+    "other stream.";
+inline constexpr absl::string_view kHalfClosedRemoteState =
+    "RFC9113: half-closed (remote): If an endpoint receives additional frames, "
+    "other than WINDOW_UPDATE, PRIORITY, or RST_STREAM, for a stream that is "
+    "in this state, it MUST respond with a stream error of type STREAM_CLOSED.";
+inline constexpr absl::string_view kFrameSizeLargerThanMaxFrameSizeSetting =
+    "RFC9113: An endpoint MUST send an error code of FRAME_SIZE_ERROR if a "
+    "frame exceeds the size defined in SETTINGS_MAX_FRAME_SIZE";
+
 inline constexpr absl::string_view kFrameParserIncorrectPadding =
     "Incorrect length of padding in frame";
 inline constexpr absl::string_view kIncorrectFrame = "Incorrect Frame";
@@ -323,7 +350,18 @@ inline constexpr absl::string_view kGoAwayLength8 =
     "GOAWAY frame should have a Last-Stream-ID and Error Code making the "
     "minimum length 8 octets";
 
+inline constexpr absl::string_view kIncorrectWindowSizeSetting =
+    "RFC9113: Values above the maximum flow-control window size of (2^31)-1 "
+    "MUST be treated as a connection error of type FLOW_CONTROL_ERROR.";
+inline constexpr absl::string_view kIncorrectFrameSizeSetting =
+    "RFC9113: The initial value is 2^14 (16,384) octets. The value advertised"
+    " by an endpoint MUST be between this initial value and the maximum allowed"
+    " frame size (2^24)-1 or 16,777,215 octets), inclusive. ";
+
 inline constexpr uint32_t kMaxStreamId31Bit = 0x7fffffffu;
+inline constexpr uint32_t kMaxSize31Bit = 0x7fffffffu;
+inline constexpr uint32_t kMinimumFrameSize = 16384;
+inline constexpr uint32_t kMaximumFrameSize = 16777215;
 
 }  // namespace RFC9113
 }  // namespace grpc_core
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/header_assembler.h b/deps/grpc/src/core/ext/transport/chttp2/transport/header_assembler.h
index 6415a3aac3f..9dff88ff85d 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/header_assembler.h
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/header_assembler.h
@@ -47,15 +47,6 @@ namespace http2 {
 
 #define ASSEMBLER_LOG DVLOG(3)
 
-constexpr absl::string_view kAssemblerContiguousSequenceError =
-    "RFC9113 : Field blocks MUST be transmitted as a contiguous sequence "
-    "of frames, with no interleaved frames of any other type or from any "
-    "other stream.";
-
-constexpr absl::string_view kAssemblerMismatchedStreamId =
-    "CONTINUATION frame has a different Stream Identifier than the preceeding "
-    "HEADERS frame.";
-
 constexpr absl::string_view kAssemblerHpackError =
     "RFC9113 : A decoding error in a field block MUST be treated as a "
     "connection error of type COMPRESSION_ERROR.";
@@ -148,7 +139,9 @@ class HeaderAssembler {
 
   // The caller MUST check using IsReady() before calling this function
   ValueOrHttp2Status<Arena::PoolPtr<grpc_metadata_batch>> ReadMetadata(
-      HPackParser& parser, bool is_initial_metadata, bool is_client) {
+      HPackParser& parser, bool is_initial_metadata, bool is_client,
+      const uint32_t max_header_list_size_soft_limit,
+      const uint32_t max_header_list_size_hard_limit) {
     ASSEMBLER_LOG << "ReadMetadata " << buffer_.Length() << " Bytes.";
 
     // Validate
@@ -162,10 +155,8 @@ class HeaderAssembler {
     Arena::PoolPtr<grpc_metadata_batch> metadata =
         Arena::MakePooledForOverwrite<grpc_metadata_batch>();
     parser.BeginFrame(
-        /*grpc_metadata_batch*/ metadata.get(),
-        // TODO(tjagtap) : [PH2][P2] : Manage limits
-        /*metadata_size_soft_limit*/ std::numeric_limits<uint32_t>::max(),
-        /*metadata_size_hard_limit*/ std::numeric_limits<uint32_t>::max(),
+        /*grpc_metadata_batch*/ metadata.get(), max_header_list_size_soft_limit,
+        max_header_list_size_hard_limit,
         is_initial_metadata ? HPackParser::Boundary::EndOfHeaders
                             : HPackParser::Boundary::EndOfStream,
         HPackParser::Priority::None,
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.h b/deps/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.h
index 785588a638e..d4248c79f56 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.h
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/hpack_parser.h
@@ -92,7 +92,10 @@ class HPackParser {
   HPackParser& operator=(HPackParser&&) = default;
 
   // Begin parsing a new frame
-  // Sink receives each parsed header,
+  // Sink receives each parsed header.
+  // You can pass metadata_buffer as a nullptr if you need to discard this frame
+  // after processing it. This would be needed if the stream is already closed,
+  // or multiple other cases.
   void BeginFrame(grpc_metadata_batch* metadata_buffer,
                   uint32_t metadata_size_soft_limit,
                   uint32_t metadata_size_hard_limit, Boundary boundary,
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_client_transport.cc b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_client_transport.cc
index 157da63d568..fde1d60e5ef 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_client_transport.cc
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_client_transport.cc
@@ -35,6 +35,7 @@
 #include "src/core/ext/transport/chttp2/transport/frame.h"
 #include "src/core/ext/transport/chttp2/transport/header_assembler.h"
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings_manager.h"
 #include "src/core/ext/transport/chttp2/transport/http2_status.h"
 #include "src/core/ext/transport/chttp2/transport/internal_channel_arg_names.h"
 #include "src/core/ext/transport/chttp2/transport/message_assembler.h"
@@ -155,6 +156,12 @@ Http2Status Http2ClientTransport::ProcessHttp2DataFrame(Http2DataFrame frame) {
     return Http2Status::Ok();
   }
 
+  if (stream->GetStreamState() == HttpStreamState::kHalfClosedRemote) {
+    return Http2Status::Http2StreamError(
+        Http2ErrorCode::kStreamClosed,
+        std::string(RFC9113::kHalfClosedRemoteState));
+  }
+
   // Add frame to assembler
   GRPC_HTTP2_CLIENT_DLOG
       << "Http2Transport ProcessHttp2DataFrame AppendNewDataFrame";
@@ -227,6 +234,11 @@ Http2Status Http2ClientTransport::ProcessHttp2HeaderFrame(
         << frame.stream_id << "} Lookup Failed";
     return Http2Status::Ok();
   }
+  if (stream->GetStreamState() == HttpStreamState::kHalfClosedRemote) {
+    return Http2Status::Http2StreamError(
+        Http2ErrorCode::kStreamClosed,
+        std::string(RFC9113::kHalfClosedRemoteState));
+  }
 
   incoming_header_in_progress_ = !frame.end_headers;
   incoming_header_stream_id_ = frame.stream_id;
@@ -256,7 +268,11 @@ Http2Status Http2ClientTransport::ProcessMetadata(
   if (assembler.IsReady()) {
     ValueOrHttp2Status<Arena::PoolPtr<grpc_metadata_batch>> read_result =
         assembler.ReadMetadata(parser_, !incoming_header_end_stream_,
-                               /*is_client=*/true);
+                               /*is_client=*/true,
+                               /*max_header_list_size_soft_limit=*/
+                               max_header_list_size_soft_limit_,
+                               /*max_header_list_size_hard_limit=*/
+                               settings_.acked().max_header_list_size());
     if (read_result.IsOk()) {
       Arena::PoolPtr<grpc_metadata_batch> metadata =
           TakeValue(std::move(read_result));
@@ -315,17 +331,33 @@ Http2Status Http2ClientTransport::ProcessHttp2RstStreamFrame(
 Http2Status Http2ClientTransport::ProcessHttp2SettingsFrame(
     Http2SettingsFrame frame) {
   // https://www.rfc-editor.org/rfc/rfc9113.html#name-settings
-  GRPC_HTTP2_CLIENT_DLOG << "Http2Transport ProcessHttp2SettingsFrame Factory";
-  // TODO(tjagtap) : [PH2][P2] : Implement this.
-  // Load into this.settings_
-  // Take necessary actions as per settings that have changed.
-  GRPC_HTTP2_CLIENT_DLOG
-      << "Http2Transport ProcessHttp2SettingsFrame Promise { ack=" << frame.ack
-      << ", settings length=" << frame.settings.size() << "}";
+
+  GRPC_HTTP2_CLIENT_DLOG << "Http2Transport ProcessHttp2SettingsFrame { ack="
+                         << frame.ack
+                         << ", settings length=" << frame.settings.size()
+                         << "}";
+
+  // The connector code needs us to run this
   if (on_receive_settings_ != nullptr) {
     ExecCtx::Run(DEBUG_LOCATION, on_receive_settings_, absl::OkStatus());
     on_receive_settings_ = nullptr;
   }
+
+  if (!frame.ack) {
+    // Check if the received settings have legal values
+    Http2Status status = ValidateSettingsValues(frame.settings);
+    if (!status.IsOk()) {
+      return status;
+    }
+    // TODO(tjagtap) : [PH2][P1]
+    // Apply the new settings
+    // Quickly send the ACK to the peer once the settings are applied
+  } else {
+    // TODO(tjagtap) : [PH2][P1]
+    // Stop the setting timeout promise
+    // Update the ACKed setting data structure
+  }
+
   return Http2Status::Ok();
 }
 
@@ -337,11 +369,7 @@ auto Http2ClientTransport::ProcessHttp2PingFrame(Http2PingFrame frame) {
       frame.ack,
       [self = RefAsSubclass<Http2ClientTransport>(), opaque = frame.opaque]() {
         // Received a ping ack.
-        if (!self->ping_manager_.AckPing(opaque)) {
-          GRPC_HTTP2_CLIENT_DLOG
-              << "Unknown ping response received for ping id=" << opaque;
-        }
-        return Immediate(Http2Status::Ok());
+        return self->AckPing(opaque);
       },
       [self = RefAsSubclass<Http2ClientTransport>(), opaque = frame.opaque]() {
         // TODO(akshitpatel) : [PH2][P2] : Have a counter to track number of
@@ -411,6 +439,11 @@ Http2Status Http2ClientTransport::ProcessHttp2ContinuationFrame(
     // error (Section 5.4.1) of type PROTOCOL_ERROR.
     return Http2Status::Ok();
   }
+  if (stream->GetStreamState() == HttpStreamState::kHalfClosedRemote) {
+    return Http2Status::Http2StreamError(
+        Http2ErrorCode::kStreamClosed,
+        std::string(RFC9113::kHalfClosedRemoteState));
+  }
 
   HeaderAssembler& assember = stream->header_assembler;
   Http2Status result = assember.AppendContinuationFrame(std::move(frame));
@@ -424,11 +457,19 @@ Http2Status Http2ClientTransport::ProcessHttp2ContinuationFrame(
 
 Http2Status Http2ClientTransport::ProcessHttp2SecurityFrame(
     Http2SecurityFrame frame) {
-  GRPC_HTTP2_CLIENT_DLOG << "Http2Transport ProcessHttp2SecurityFrame Factory";
-  // TODO(tjagtap) : [PH2][P2] : Implement this.
-  GRPC_HTTP2_CLIENT_DLOG
-      << "Http2Transport ProcessHttp2SecurityFrame Promise { payload="
-      << frame.payload.JoinIntoString() << " }";
+  GRPC_HTTP2_CLIENT_DLOG << "Http2Transport ProcessHttp2SecurityFrame "
+                            "ProcessHttp2SecurityFrame { payload="
+                         << frame.payload.JoinIntoString() << " }";
+  if ((settings_.acked().allow_security_frame() ||
+       settings_.local().allow_security_frame()) &&
+      settings_.peer().allow_security_frame()) {
+    // TODO(tjagtap) : [PH2][P4] : Evaluate when to accept the frame and when to
+    // reject it. Compare it with the requirement and with CHTTP2.
+    // TODO(tjagtap) : [PH2][P3] : Add handling of Security frame
+    // Just the frame.payload needs to be passed to the endpoint_ object.
+    // Refer usage of TransportFramingEndpointExtension.
+  }
+  // Ignore the Security frame if it is not expected.
   return Http2Status::Ok();
 }
 
@@ -497,15 +538,14 @@ auto Http2ClientTransport::ReadAndProcessOneFrame() {
       },
       // Validate the incoming frame as per the current state of the transport
       [self = RefAsSubclass<Http2ClientTransport>()](Http2FrameHeader header) {
-        if (self->incoming_header_in_progress_ &&
-            (self->current_frame_header_.type != 9 /*Continuation*/ ||
-             self->current_frame_header_.stream_id !=
-                 self->incoming_header_stream_id_)) {
-          LOG(ERROR) << "Closing Connection " << header.ToString() << " "
-                     << kAssemblerContiguousSequenceError;
-          return self->HandleError(Http2Status::Http2ConnectionError(
-              Http2ErrorCode::kProtocolError,
-              std::string(kAssemblerContiguousSequenceError)));
+        Http2Status status = ValidateFrameHeader(
+            /*max_frame_size_setting*/ self->settings_.acked().max_frame_size(),
+            /*incoming_header_in_progress*/ self->incoming_header_in_progress_,
+            /*incoming_header_stream_id*/ self->incoming_header_stream_id_,
+            /*current_frame_header*/ header);
+
+        if (!status.IsOk()) {
+          return self->HandleError(std::move(status));
         }
         GRPC_HTTP2_CLIENT_DLOG << "Http2ClientTransport ReadAndProcessOneFrame "
                                   "Validated Frame Header:"
@@ -649,6 +689,110 @@ auto Http2ClientTransport::OnWriteLoopEnded() {
       };
 }
 
+auto Http2ClientTransport::StreamMultiplexerLoop() {
+  GRPC_HTTP2_CLIENT_DLOG
+      << "Http2ClientTransport StreamMultiplexerLoop Factory";
+  // This loop iterates over all the writable streams and drains them. If
+  // there are no writable streams, StreamMultiplexerLoop blocks until there
+  // is a writable stream.
+  return Loop([self = RefAsSubclass<Http2ClientTransport>()]() mutable {
+    // Overview:
+    // 1. Get the next writable stream.
+    // 2. Dequeue frames from the stream queue based on available transport
+    //    tokens.
+    // 3. If the stream is still writable, enqueue the stream back to the
+    //    writable stream list.
+    // 4. Enqueue the dequeued frames to the MPSC queue.
+    return TrySeq(
+        self->writable_stream_list_.Next(/*transport_tokens_available*/ true),
+        [self](const uint32_t stream_id) mutable
+            -> absl::StatusOr<std::vector<Http2Frame>> {
+          RefCountedPtr<Stream> stream = self->LookupStream(stream_id);
+          if (GPR_UNLIKELY(stream == nullptr)) {
+            // Stream was closed before we could dequeue.
+            // TODO(akshitpatel) : [PH2][P2] : Race condition. Determine should
+            // we have a DCHECK here based on how ResetStream/Aborts are
+            // handled.
+            return std::vector<Http2Frame>();
+          }
+
+          // TODO(akshitpatel) : [PH2][P3] : Plug transport_tokens when
+          // transport flow control is implemented.
+          absl::StatusOr<StreamDataQueue<ClientMetadataHandle>::DequeueResult>
+              result = stream->DequeueFrames(
+                  /*transport_tokens*/ std::numeric_limits<uint32_t>::max(),
+                  self->settings_.peer().max_frame_size(), self->encoder_);
+          if (result.ok() && result->is_writable) {
+            // Stream is still writable. Enqueue it back to the writable stream
+            // list.
+            // TODO(akshitpatel) : [PH2][P3] : Plug transport_tokens when
+            // transport flow control is implemented.
+            absl::Status status = self->writable_stream_list_.Enqueue(
+                stream_id, WritableStreams::StreamPriority::kDefault);
+
+            if (GPR_UNLIKELY(!status.ok())) {
+              LOG(ERROR) << "Failed to enqueue stream " << stream_id
+                         << " with status: " << status;
+              // Close transport if we fail to enqueue stream.
+              return absl::InternalError("Failed to enqueue stream");
+            }
+          } else if (GPR_UNLIKELY(!result.ok())) {
+            // Close the corresponding stream if we fail to dequeue frames from
+            // the stream queue.
+            LOG(ERROR) << "Failed to dequeue frames for stream " << stream_id
+                       << " with status: " << result.status();
+            absl::Status status =
+                self->HandleError(Http2Status::AbslStreamError(
+                    absl::StatusCode::kInternal, "Failed to dequeue frames"));
+            return std::vector<Http2Frame>();
+          }
+          GRPC_HTTP2_CLIENT_DLOG
+              << "Http2ClientTransport StreamMultiplexerLoop. Dequeued "
+              << result->frames.size()
+              << " frames for "
+                 "stream: "
+              << stream_id;
+          return std::move(result->frames);
+        },
+        [self](std::vector<Http2Frame> frames) {
+          // Enqueue the frames to the MPSC queue.
+          return Loop([self, frames = std::move(frames), idx = 0u]() mutable {
+            return If(
+                idx < frames.size(),
+                [self, &frames, &idx]() {
+                  return Map(
+                      // Enqueue to the MPSC queue could return pending. This
+                      // induces backpressure for the sender. Only after writing
+                      // to the MPSC queue we will loop back to read more
+                      // streams.
+                      self->EnqueueOutgoingFrame(std::move(frames[idx++])),
+                      [](absl::Status status) -> LoopCtl<absl::Status> {
+                        if (GPR_UNLIKELY(!status.ok())) {
+                          return status;
+                        }
+                        return Continue{};
+                      });
+                },
+                []() -> LoopCtl<absl::Status> { return absl::OkStatus(); });
+          });
+        },
+        []() -> LoopCtl<absl::Status> { return Continue{}; });
+  });
+}
+
+auto Http2ClientTransport::OnStreamMultiplexerLoopEnded() {
+  GRPC_HTTP2_CLIENT_DLOG
+      << "Http2ClientTransport OnStreamMultiplexerLoopEnded Factory";
+  return [self = RefAsSubclass<Http2ClientTransport>()](absl::Status status) {
+    GRPC_HTTP2_CLIENT_DLOG
+        << "Http2ClientTransport OnStreamMultiplexerLoopEnded Promise Status="
+        << status;
+    GRPC_UNUSED absl::Status error =
+        self->HandleError(Http2Status::AbslConnectionError(
+            status.code(), std::string(status.message())));
+  };
+}
+
 ///////////////////////////////////////////////////////////////////////////////
 // Constructor Destructor
 
@@ -665,6 +809,8 @@ Http2ClientTransport::Http2ClientTransport(
       is_first_write_(true),
       incoming_header_stream_id_(0),
       on_receive_settings_(on_receive_settings),
+      max_header_list_size_soft_limit_(
+          GetSoftLimitFromChannelArgs(channel_args)),
       keepalive_time_(std::max(
           Duration::Seconds(10),
           channel_args.GetDurationFromIntMillis(GRPC_ARG_KEEPALIVE_TIME_MS)
@@ -693,11 +839,12 @@ Http2ClientTransport::Http2ClientTransport(
                                                 : Duration::Infinity()),
           keepalive_time_),
       keepalive_permit_without_calls_(false) {
-  // TODO(tjagtap) : [PH2][P2] : Save and apply channel_args.
-  // TODO(tjagtap) : [PH2][P2] : Initialize settings_ to appropriate values.
-
   GRPC_HTTP2_CLIENT_DLOG << "Http2ClientTransport Constructor Begin";
 
+  InitLocalSettings(settings_.mutable_local(), /*is_client=*/true);
+  ReadSettingsFromChannelArgs(channel_args, settings_.mutable_local(),
+                              /*is_client=*/true);
+
   // Initialize the general party and write party.
   auto general_party_arena = SimpleArenaAllocator(0)->MakeArena();
   general_party_arena->SetContext<EventEngine>(event_engine.get());
@@ -706,18 +853,38 @@ Http2ClientTransport::Http2ClientTransport(
   general_party_->Spawn("ReadLoop", ReadLoop(), OnReadLoopEnded());
   // TODO(tjagtap) : [PH2][P2] Fix when needed.
   general_party_->Spawn("WriteLoop", WriteLoop(), OnWriteLoopEnded());
+  general_party_->Spawn("StreamMultiplexerLoop", StreamMultiplexerLoop(),
+                        OnStreamMultiplexerLoopEnded());
 
   // The keepalive loop is only spawned if the keepalive time is not infinity.
   keepalive_manager_.Spawn(general_party_.get());
 
-  // TODO(tjagtap) : [PH2][P2] Fix Settings workflow.
+  // TODO(tjagtap) : [PH2][P2] Delete this hack once flow control is done.
+  // We are increasing the flow control window so that we can avoid sending
+  // WINDOW_UPDATE frames while flow control is under development. Once it is
+  // ready we should remove these lines.
+  // <DeleteAfterFlowControl>
   Http2ErrorCode code = settings_.mutable_local().Apply(
       Http2Settings::kInitialWindowSizeWireId,
       (Http2Settings::max_initial_window_size() - 1));
   DCHECK(code == Http2ErrorCode::kNoError);
+  // </DeleteAfterFlowControl>
+
+  const int max_hpack_table_size =
+      channel_args.GetInt(GRPC_ARG_HTTP2_HPACK_TABLE_SIZE_ENCODER).value_or(-1);
+  if (max_hpack_table_size >= 0) {
+    encoder_.SetMaxUsableSize(max_hpack_table_size);
+  }
+
+  settings_timeout_ =
+      channel_args.GetDurationFromIntMillis(GRPC_ARG_SETTINGS_TIMEOUT)
+          .value_or(std::max(keepalive_timeout_ * 2, Duration::Minutes(1)));
+
   std::optional<Http2SettingsFrame> settings_frame =
       settings_.MaybeSendUpdate();
   if (settings_frame.has_value()) {
+    GRPC_HTTP2_CLIENT_DLOG
+        << "Http2ClientTransport Constructor Spawn SendFirstSettingsFrame";
     general_party_->Spawn(
         "SendFirstSettingsFrame",
         [self = RefAsSubclass<Http2ClientTransport>(),
@@ -726,6 +893,12 @@ Http2ClientTransport::Http2ClientTransport(
         },
         [](GRPC_UNUSED absl::Status status) {});
   }
+  if (settings_.local().allow_security_frame()) {
+    // TODO(tjagtap) : [PH2][P3] : Setup the plumbing to pass the security frame
+    // to the endpoing via TransportFramingEndpointExtension.
+    // Also decide if this plumbing is done here, or when the peer sends
+    // allow_security_frame too.
+  }
   GRPC_HTTP2_CLIENT_DLOG << "Http2ClientTransport Constructor End";
 }
 
@@ -915,60 +1088,91 @@ auto Http2ClientTransport::CallOutboundLoop(
     ClientMetadataHandle metadata) {
   GRPC_HTTP2_CLIENT_DLOG << "Http2ClientTransport CallOutboundLoop";
 
-  // Convert a message to a Http2DataFrame and send the frame out.
-  auto send_message =
-      [self = RefAsSubclass<Http2ClientTransport>(),
-       stream_id](MessageHandle message) mutable {
-        // TODO(akshitpatel) : [PH2][P2] : Assuming one message per frame.
-        // This will eventually change as more logic is added.
-        SliceBuffer frame_payload;
-        size_t payload_size = message->payload()->Length();
-        AppendGrpcHeaderToSliceBuffer(frame_payload, message->flags(),
-                                      payload_size);
-        frame_payload.TakeAndAppend(*message->payload());
-        Http2DataFrame frame{stream_id, /*end_stream*/ false,
-                             std::move(frame_payload)};
-        GRPC_HTTP2_CLIENT_DLOG
-            << "Http2ClientTransport CallOutboundLoop send_message";
-        return self->EnqueueOutgoingFrame(std::move(frame));
-      };
-
-  SliceBuffer buf;
-  encoder_.EncodeRawHeaders(*metadata.get(), buf);
-  Http2Frame frame = Http2HeaderFrame{stream_id, /*end_headers*/ true,
-                                      /*end_stream*/ false, std::move(buf)};
+  auto send_message = [self = RefAsSubclass<Http2ClientTransport>(),
+                       stream_id](MessageHandle&& message) mutable {
+    RefCountedPtr<Stream> stream = self->LookupStream(stream_id);
+    return If(
+        stream != nullptr,
+        [self, stream, message = std::move(message), stream_id]() mutable {
+          return TrySeq(stream->EnqueueMessage(std::move(message)),
+                        [self, stream_id](bool became_writable) {
+                          GRPC_HTTP2_CLIENT_DLOG
+                              << "Http2ClientTransport CallOutboundLoop "
+                                 "Enqueued Message";
+                          return self->MaybeAddStreamToWritableStreamList(
+                              stream_id, became_writable);
+                        });
+        },
+        []() {
+          // This will trigger Call stack cleanup.
+          return absl::InternalError("Stream not found while sending message");
+        });
+  };
+
+  auto send_initial_metadata = [self = RefAsSubclass<Http2ClientTransport>(),
+                                stream_id,
+                                metadata = std::move(metadata)]() mutable {
+    RefCountedPtr<Stream> stream = self->LookupStream(stream_id);
+    return If(
+        stream != nullptr,
+        [self, stream, metadata = std::move(metadata), stream_id]() mutable {
+          return TrySeq(
+              stream->EnqueueInitialMetadata(std::move(metadata)),
+              [self, stream_id](bool became_writable) {
+                GRPC_HTTP2_CLIENT_DLOG
+                    << "Http2ClientTransport CallOutboundLoop "
+                       "Enqueued Initial Metadata";
+                return self->MaybeAddStreamToWritableStreamList(
+                    stream_id, became_writable);
+              },
+              [stream] {
+                // TODO(akshitpatel) : [PH2][P2] : Think how to handle stream
+                // states.
+                stream->SentInitialMetadata();
+                return absl::OkStatus();
+              });
+        },
+        []() {
+          // This will trigger Call stack cleanup.
+          return absl::InternalError(
+              "Stream not found while sending initial metadata");
+        });
+  };
+
+  auto send_half_closed = [self = RefAsSubclass<Http2ClientTransport>(),
+                           stream_id]() mutable {
+    RefCountedPtr<Stream> stream = self->LookupStream(stream_id);
+    return If(
+        stream != nullptr,
+        [self, stream, stream_id]() mutable {
+          return TrySeq(stream->EnqueueHalfClosed(),
+                        [self, stream_id](bool became_writable) {
+                          GRPC_HTTP2_CLIENT_DLOG
+                              << "Http2ClientTransport CallOutboundLoop "
+                                 "Enqueued Half Closed";
+                          return self->MaybeAddStreamToWritableStreamList(
+                              stream_id, became_writable);
+                        });
+        },
+        []() {
+          // This will trigger Call stack cleanup.
+          return absl::InternalError(
+              "Stream not found while sending half closed");
+        });
+  };
   return GRPC_LATENT_SEE_PROMISE(
       "Ph2CallOutboundLoop",
       TrySeq(
-          Map(EnqueueOutgoingFrame(std::move(frame)),
-              [self = RefAsSubclass<Http2ClientTransport>(),
-               stream_id](absl::Status status) {
-                if (status.ok()) {
-                  // TODO(akshitpatel) : [PH2][P3] : Investigate if stream
-                  // lookup can be done once outside the promise and all the
-                  // promises can hold a reference to the stream.
-                  auto stream = self->LookupStream(stream_id);
-                  if (GPR_UNLIKELY(stream == nullptr)) {
-                    LOG(ERROR)
-                        << "Stream not found while sending initial metadata";
-                    return absl::InternalError(
-                        "Stream not found while sending initial metadata");
-                  }
-                  stream->SentInitialMetadata();
-                }
-                return status;
-              }),
+          send_initial_metadata(),
           [call_handler, send_message, lock = std::move(lock)]() {
             // The lock will be released once the promise is constructed from
             // this factory. ForEach will be polled after the lock is
             // released.
             return ForEach(MessagesFrom(call_handler), send_message);
           },
-          [self = RefAsSubclass<Http2ClientTransport>(), stream_id]() mutable {
-            // TODO(akshitpatel): [PH2][P2] : Figure out a way to send the end
-            // of stream frame in the same frame as the last message.
-            Http2DataFrame frame{stream_id, /*end_stream*/ true, SliceBuffer()};
-            return self->EnqueueOutgoingFrame(std::move(frame));
+          [self = RefAsSubclass<Http2ClientTransport>(),
+           send_half_closed = std::move(send_half_closed)]() mutable {
+            return send_half_closed();
           },
           [call_handler]() mutable {
             return Map(call_handler.WasCancelled(), [](bool cancelled) {
@@ -995,8 +1199,20 @@ void Http2ClientTransport::StartCall(CallHandler call_handler) {
           },
           [self = RefAsSubclass<Http2ClientTransport>(),
            call_handler](auto args /* Locked stream_id_mutex */) mutable {
-            // TODO (akshitpatel) : [PH2][P2] :
-            // Check for max concurrent streams.
+            // For a gRPC Client, we only need to check the
+            // MAX_CONCURRENT_STREAMS setting compliance at the time of
+            // sending (that is write path). A gRPC Client will never
+            // receive a stream initiated by a server, so we dont have to
+            // check MAX_CONCURRENT_STREAMS compliance on the Read-Path.
+            //
+            // TODO(tjagtap) : [PH2][P1] Check for MAX_CONCURRENT_STREAMS
+            // sent by peer before making a stream. Decide behaviour if we are
+            // crossing this threshold.
+            //
+            // TODO(tjagtap) : [PH2][P1] : For a server we will have to do
+            // this for incoming streams only. If a server receives more streams
+            // from a client than is allowed by the clients settings, whether or
+            // not we should fail is debatable.
             const uint32_t stream_id = self->NextStreamId(std::get<0>(args));
             return If(
                 self->MakeStream(call_handler, stream_id),
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_client_transport.h b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_client_transport.h
index 87059487352..098c28dbf3a 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_client_transport.h
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_client_transport.h
@@ -27,13 +27,16 @@
 #include "src/core/ext/transport/chttp2/transport/header_assembler.h"
 #include "src/core/ext/transport/chttp2/transport/hpack_encoder.h"
 #include "src/core/ext/transport/chttp2/transport/hpack_parser.h"
-#include "src/core/ext/transport/chttp2/transport/http2_settings.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings_manager.h"
 #include "src/core/ext/transport/chttp2/transport/http2_status.h"
 #include "src/core/ext/transport/chttp2/transport/http2_transport.h"
 #include "src/core/ext/transport/chttp2/transport/keepalive.h"
 #include "src/core/ext/transport/chttp2/transport/message_assembler.h"
 #include "src/core/ext/transport/chttp2/transport/ping_promise.h"
+#include "src/core/ext/transport/chttp2/transport/stream_data_queue.h"
+#include "src/core/ext/transport/chttp2/transport/writable_streams.h"
 #include "src/core/lib/promise/inter_activity_mutex.h"
+#include "src/core/lib/promise/loop.h"
 #include "src/core/lib/promise/mpsc.h"
 #include "src/core/lib/promise/party.h"
 #include "src/core/lib/transport/connectivity_state.h"
@@ -69,10 +72,11 @@ namespace http2 {
 // |---------------------|--------------|-----------------------|------------|
 // | Endpoint Read Loop  | Infinite     | On transport close    | One        |
 // | Endpoint Write Loop | Infinite     | On transport close    | One        |
+// | Stream Multiplexer  | Infinite     | On transport close    | One        |
 // | Close Transport     | CloseTimeout | On transport close    | One        |
 
-// Max Party Slots (Always): 2
-// Max Promise Slots (Worst Case): 3
+// Max Party Slots (Always): 3
+// Max Promise Slots (Worst Case): 4
 
 // Experimental : This is just the initial skeleton of class
 // and it is functions. The code will be written iteratively.
@@ -137,8 +141,9 @@ class Http2ClientTransport final : public ClientTransport {
         }));
   }
 
-  auto TestOnlySendPing(absl::AnyInvocable<void()> on_initiate) {
-    return ping_manager_.RequestPing(std::move(on_initiate));
+  auto TestOnlySendPing(absl::AnyInvocable<void()> on_initiate,
+                        bool important = false) {
+    return ping_manager_.RequestPing(std::move(on_initiate), important);
   }
 
   template <typename Factory>
@@ -189,6 +194,15 @@ class Http2ClientTransport final : public ClientTransport {
   // Returns a promise that will do the cleanup after the WriteLoop ends.
   auto OnWriteLoopEnded();
 
+  // Returns a promise to keep draining data and control frames from all the
+  // active streams. This includes all stream specific frames like data, header,
+  // continuation and reset stream frames.
+  auto StreamMultiplexerLoop();
+
+  // Returns a promise that will do the cleanup after the StreamMultiplexerLoop
+  // ends.
+  auto OnStreamMultiplexerLoopEnded();
+
   // Returns a promise to fetch data from the callhandler and pass it further
   // down towards the endpoint.
   auto CallOutboundLoop(CallHandler call_handler, uint32_t stream_id,
@@ -219,6 +233,7 @@ class Http2ClientTransport final : public ClientTransport {
 
   PromiseEndpoint endpoint_;
   Http2SettingsManager settings_;
+  Duration settings_timeout_;
 
   Http2FrameHeader current_frame_header_;
 
@@ -230,7 +245,59 @@ class Http2ClientTransport final : public ClientTransport {
           stream_id(stream_id1),
           header_assembler(stream_id1),
           did_push_initial_metadata(false),
-          did_push_trailing_metadata(false) {}
+          did_push_trailing_metadata(false),
+          data_queue(MakeRefCounted<StreamDataQueue<ClientMetadataHandle>>(
+              /*is_client*/ true, /*stream_id*/ stream_id1,
+              /*queue_size*/ kStreamQueueSize)) {}
+
+    ////////////////////////////////////////////////////////////////////////////
+    // Data Queue Helpers
+
+    auto EnqueueInitialMetadata(ClientMetadataHandle&& metadata) {
+      GRPC_HTTP2_CLIENT_DLOG
+          << "Http2ClientTransport::Stream::EnqueueInitialMetadata stream_id="
+          << stream_id;
+      return data_queue->EnqueueInitialMetadata(std::move(metadata));
+    }
+
+    auto EnqueueTrailingMetadata(ClientMetadataHandle&& metadata) {
+      GRPC_HTTP2_CLIENT_DLOG
+          << "Http2ClientTransport::Stream::EnqueueTrailingMetadata stream_id="
+          << stream_id;
+      return data_queue->EnqueueTrailingMetadata(std::move(metadata));
+    }
+
+    auto EnqueueMessage(MessageHandle&& message) {
+      GRPC_HTTP2_CLIENT_DLOG
+          << "Http2ClientTransport::Stream::EnqueueMessage stream_id="
+          << stream_id
+          << " with payload size = " << message->payload()->Length();
+      return data_queue->EnqueueMessage(std::move(message));
+    }
+
+    auto EnqueueHalfClosed() {
+      GRPC_HTTP2_CLIENT_DLOG
+          << "Http2ClientTransport::Stream::EnqueueHalfClosed stream_id="
+          << stream_id;
+      return data_queue->EnqueueHalfClosed();
+    }
+
+    auto EnqueueResetStream(const uint32_t error_code) {
+      GRPC_HTTP2_CLIENT_DLOG
+          << "Http2ClientTransport::Stream::EnqueueResetStream stream_id="
+          << stream_id << " with error_code = " << error_code;
+      return data_queue->EnqueueResetStream(error_code);
+    }
+
+    auto DequeueFrames(const uint32_t transport_tokens,
+                       const uint32_t max_frame_length,
+                       HPackCompressor& encoder) {
+      return data_queue->DequeueFrames(transport_tokens, max_frame_length,
+                                       encoder);
+    }
+
+    ////////////////////////////////////////////////////////////////////////////
+    // Stream State Management
 
     // Modify the stream state
     // The possible stream transitions are as follows:
@@ -257,6 +324,7 @@ class Http2ClientTransport final : public ClientTransport {
         case HttpStreamState::kHalfClosedLocal:
           break;
         case HttpStreamState::kClosed:
+          DCHECK(false) << "MarkHalfClosedLocal called for a closed stream";
           break;
       }
     }
@@ -275,10 +343,13 @@ class Http2ClientTransport final : public ClientTransport {
         case HttpStreamState::kHalfClosedRemote:
           break;
         case HttpStreamState::kClosed:
+          DCHECK(false) << "MarkHalfClosedRemote called for a closed stream";
           break;
       }
     }
 
+    HttpStreamState GetStreamState() const { return stream_state; }
+
     inline bool IsClosed() const {
       return stream_state == HttpStreamState::kClosed;
     }
@@ -287,7 +358,6 @@ class Http2ClientTransport final : public ClientTransport {
     // TODO(akshitpatel) : [PH2][P3] : Investigate if this needs to be atomic.
     HttpStreamState stream_state;
     const uint32_t stream_id;
-    TransportSendQeueue send_queue;
     GrpcMessageAssembler assembler;
     HeaderAssembler header_assembler;
     // TODO(akshitpatel) : [PH2][P2] : StreamQ should maintain a flag that
@@ -300,6 +370,7 @@ class Http2ClientTransport final : public ClientTransport {
     // transition to HalfClosedLocal till the end_stream frame is sent.
     bool did_push_initial_metadata;
     bool did_push_trailing_metadata;
+    RefCountedPtr<StreamDataQueue<ClientMetadataHandle>> data_queue;
   };
 
   uint32_t NextStreamId(
@@ -430,6 +501,8 @@ class Http2ClientTransport final : public ClientTransport {
   uint32_t incoming_header_stream_id_;
   grpc_closure* on_receive_settings_;
 
+  uint32_t max_header_list_size_soft_limit_;
+
   // Ping related members
   // TODO(akshitpatel) : [PH2][P2] : Consider removing the timeout related
   // members.
@@ -447,8 +520,8 @@ class Http2ClientTransport final : public ClientTransport {
   // Flags
   bool keepalive_permit_without_calls_;
 
-  auto SendPing(absl::AnyInvocable<void()> on_initiate) {
-    return ping_manager_.RequestPing(std::move(on_initiate));
+  auto SendPing(absl::AnyInvocable<void()> on_initiate, bool important) {
+    return ping_manager_.RequestPing(std::move(on_initiate), important);
   }
   auto WaitForPingAck() { return ping_manager_.WaitForPingAck(); }
 
@@ -490,6 +563,33 @@ class Http2ClientTransport final : public ClientTransport {
         }));
   }
 
+  auto AckPing(uint64_t opaque_data) {
+    bool valid_ping_ack_received = true;
+
+    if (!ping_manager_.AckPing(opaque_data)) {
+      GRPC_HTTP2_CLIENT_DLOG << "Unknown ping response received for ping id="
+                             << opaque_data;
+      valid_ping_ack_received = false;
+    }
+
+    return If(
+        // It is possible that the PingRatePolicy may decide to not send a ping
+        // request (in cases like the number of inflight pings is too high).
+        // When this happens, it becomes important to ensure that if a ping ack
+        // is received and there is an "important" outstanding ping request, we
+        // should retry to send it out now.
+        valid_ping_ack_received && ping_manager_.ImportantPingRequested(),
+        [self = RefAsSubclass<Http2ClientTransport>()] {
+          return Map(self->TriggerWriteCycle(), [](const absl::Status status) {
+            return (status.ok())
+                       ? Http2Status::Ok()
+                       : Http2Status::AbslConnectionError(
+                             status.code(), std::string(status.message()));
+          });
+        },
+        [] { return Immediate(Http2Status::Ok()); });
+  }
+
   class PingSystemInterfaceImpl : public PingInterface {
    public:
     static std::unique_ptr<PingInterface> Make(
@@ -579,6 +679,25 @@ class Http2ClientTransport final : public ClientTransport {
     // transport and greatly simpilfy the cleanup path.
     Http2ClientTransport* transport_;
   };
+
+  WritableStreams writable_stream_list_;
+
+  auto MaybeAddStreamToWritableStreamList(const uint32_t stream_id,
+                                          const bool became_writable) {
+    if (became_writable) {
+      GRPC_HTTP2_CLIENT_DLOG
+          << "Http2ClientTransport MaybeAddStreamToWritableStreamList "
+             " Stream id: "
+          << stream_id << " became writable";
+      absl::Status status = writable_stream_list_.Enqueue(
+          stream_id, WritableStreams::StreamPriority::kDefault);
+      if (!status.ok()) {
+        return HandleError(Http2Status::Http2ConnectionError(
+            Http2ErrorCode::kProtocolError, "Failed to enqueue stream"));
+      }
+    }
+    return absl::OkStatus();
+  }
 };
 
 // Since the corresponding class in CHTTP2 is about 3.9KB, our goal is to
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_server_transport.h b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_server_transport.h
index c5903ce1755..97bad949c07 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_server_transport.h
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_server_transport.h
@@ -29,6 +29,7 @@
 #include "src/core/ext/transport/chttp2/transport/hpack_encoder.h"
 #include "src/core/ext/transport/chttp2/transport/hpack_parser.h"
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings_manager.h"
 #include "src/core/lib/promise/mpsc.h"
 #include "src/core/lib/promise/party.h"
 #include "src/core/lib/transport/promise_endpoint.h"
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings.cc b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings.cc
index 1701bb1d770..8e7eda6ab18 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings.cc
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings.cc
@@ -23,7 +23,6 @@
 #include <grpc/support/port_platform.h>
 
 #include "absl/strings/str_cat.h"
-#include "src/core/ext/transport/chttp2/transport/frame.h"
 #include "src/core/ext/transport/chttp2/transport/http2_status.h"
 #include "src/core/util/useful.h"
 
@@ -32,35 +31,36 @@ using grpc_core::http2::Http2ErrorCode;
 namespace grpc_core {
 
 void Http2Settings::Diff(
-    bool is_first_send, const Http2Settings& old,
+    bool is_first_send, const Http2Settings& old_setting,
     absl::FunctionRef<void(uint16_t key, uint32_t value)> cb) const {
-  if (header_table_size_ != old.header_table_size_) {
+  if (header_table_size_ != old_setting.header_table_size_) {
     cb(kHeaderTableSizeWireId, header_table_size_);
   }
-  if (enable_push_ != old.enable_push_) {
+  if (enable_push_ != old_setting.enable_push_) {
     cb(kEnablePushWireId, enable_push_);
   }
-  if (max_concurrent_streams_ != old.max_concurrent_streams_) {
+  if (max_concurrent_streams_ != old_setting.max_concurrent_streams_) {
     cb(kMaxConcurrentStreamsWireId, max_concurrent_streams_);
   }
-  if (is_first_send || initial_window_size_ != old.initial_window_size_) {
+  if (is_first_send ||
+      initial_window_size_ != old_setting.initial_window_size_) {
     cb(kInitialWindowSizeWireId, initial_window_size_);
   }
-  if (max_frame_size_ != old.max_frame_size_) {
+  if (max_frame_size_ != old_setting.max_frame_size_) {
     cb(kMaxFrameSizeWireId, max_frame_size_);
   }
-  if (max_header_list_size_ != old.max_header_list_size_) {
+  if (max_header_list_size_ != old_setting.max_header_list_size_) {
     cb(kMaxHeaderListSizeWireId, max_header_list_size_);
   }
-  if (allow_true_binary_metadata_ != old.allow_true_binary_metadata_) {
+  if (allow_true_binary_metadata_ != old_setting.allow_true_binary_metadata_) {
     cb(kGrpcAllowTrueBinaryMetadataWireId, allow_true_binary_metadata_);
   }
   if (preferred_receive_crypto_message_size_ !=
-      old.preferred_receive_crypto_message_size_) {
+      old_setting.preferred_receive_crypto_message_size_) {
     cb(kGrpcPreferredReceiveCryptoFrameSizeWireId,
        preferred_receive_crypto_message_size_);
   }
-  if (allow_security_frame_ != old.allow_security_frame_) {
+  if (allow_security_frame_ != old_setting.allow_security_frame_) {
     cb(kGrpcAllowSecurityFrameWireId, allow_security_frame_);
   }
 }
@@ -134,31 +134,4 @@ Http2ErrorCode Http2Settings::Apply(uint16_t key, uint32_t value) {
   return Http2ErrorCode::kNoError;
 }
 
-std::optional<Http2SettingsFrame> Http2SettingsManager::MaybeSendUpdate() {
-  switch (update_state_) {
-    case UpdateState::kSending:
-      return std::nullopt;
-    case UpdateState::kIdle:
-      if (local_ == sent_) return std::nullopt;
-      break;
-    case UpdateState::kFirst:
-      break;
-  }
-  Http2SettingsFrame frame;
-  local_.Diff(update_state_ == UpdateState::kFirst, sent_,
-              [&frame](uint16_t key, uint32_t value) {
-                frame.settings.emplace_back(key, value);
-              });
-  sent_ = local_;
-  update_state_ = UpdateState::kSending;
-  return frame;
-}
-
-bool Http2SettingsManager::AckLastSend() {
-  if (update_state_ != UpdateState::kSending) return false;
-  update_state_ = UpdateState::kIdle;
-  acked_ = sent_;
-  return true;
-}
-
 }  // namespace grpc_core
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings.h b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings.h
index 725cb332e96..c69167dba11 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings.h
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings.h
@@ -26,7 +26,6 @@
 #include "absl/functional/function_ref.h"
 #include "absl/strings/string_view.h"
 #include "src/core/channelz/property_list.h"
-#include "src/core/ext/transport/chttp2/transport/frame.h"
 #include "src/core/ext/transport/chttp2/transport/http2_status.h"
 #include "src/core/util/useful.h"
 
@@ -35,18 +34,21 @@ namespace grpc_core {
 class Http2Settings {
  public:
   enum : uint16_t {
+    // These values are as defined in RFC9113
+    // https://www.rfc-editor.org/rfc/rfc9113.html#name-defined-settings
     kHeaderTableSizeWireId = 1,
     kEnablePushWireId = 2,
     kMaxConcurrentStreamsWireId = 3,
     kInitialWindowSizeWireId = 4,
     kMaxFrameSizeWireId = 5,
     kMaxHeaderListSizeWireId = 6,
+    // gRPC specific settings
     kGrpcAllowTrueBinaryMetadataWireId = 65027,
     kGrpcPreferredReceiveCryptoFrameSizeWireId = 65028,
     kGrpcAllowSecurityFrameWireId = 65029,
   };
 
-  void Diff(bool is_first_send, const Http2Settings& old,
+  void Diff(bool is_first_send, const Http2Settings& old_setting,
             absl::FunctionRef<void(uint16_t key, uint32_t value)> cb) const;
   GRPC_MUST_USE_RESULT http2::Http2ErrorCode Apply(uint16_t key,
                                                    uint32_t value);
@@ -148,47 +150,62 @@ class Http2Settings {
   }
 
  private:
-  uint32_t header_table_size_ = 4096;
+  // RFC9113 states the default value for SETTINGS_HEADER_TABLE_SIZE
+  // Currently this is set only once in the lifetime of a transport.
+  // We plan to change that in the future.
+  uint32_t header_table_size_ = 4096u;
+
+  // TODO(tjagtap) [PH2][P4] : Get the history of why this default was decided
+  // and write it here.
+  // CLIENT : Set only once in the lifetime of a client transport. This is set
+  // to 0 for client.
+  // SERVER : This setting can change for the server. This is usually changed to
+  // handle memory pressure.
   uint32_t max_concurrent_streams_ = 4294967295u;
+
+  // RFC9113 states the default for SETTINGS_INITIAL_WINDOW_SIZE
+  // Both client and servers can change this setting. This is usually changed to
+  // handle memory pressure.
   uint32_t initial_window_size_ = 65535u;
+
+  // RFC9113 states the default for SETTINGS_MAX_FRAME_SIZE
+  // Both client and servers can change this setting. This is usually changed to
+  // handle memory pressure.
   uint32_t max_frame_size_ = 16384u;
+
+  // TODO(tjagtap) [PH2][P4] : Get the history of why this default was decided
+  // and write it here.
+  // This is an advisory but we currently enforce it.
+  // Set only once in the lifetime of a transport currently.
+  // When a peer that updates this more than once, that may indicate either an
+  // underlying issue or a malicious peer.
   uint32_t max_header_list_size_ = 16777216u;
-  uint32_t preferred_receive_crypto_message_size_ = 0u;
-  bool enable_push_ = true;
-  bool allow_true_binary_metadata_ = false;
-  bool allow_security_frame_ = false;
-};
 
-class Http2SettingsManager {
- public:
-  Http2Settings& mutable_local() { return local_; }
-  const Http2Settings& local() const { return local_; }
-  const Http2Settings& acked() const { return acked_; }
-  Http2Settings& mutable_peer() { return peer_; }
-  const Http2Settings& peer() const { return peer_; }
+  // gRPC defined setting
+  // Both client and servers can change this setting. This is usually changed to
+  // handle memory pressure.
+  uint32_t preferred_receive_crypto_message_size_ = 0u;
 
-  channelz::PropertyGrid ChannelzProperties() const {
-    return channelz::PropertyGrid()
-        .SetColumn("local", local_.ChannelzProperties())
-        .SetColumn("sent", sent_.ChannelzProperties())
-        .SetColumn("peer", peer_.ChannelzProperties())
-        .SetColumn("acked", acked_.ChannelzProperties());
-  }
+  // RFC9113 defined default is true. However, for gRPC we always then set it to
+  // false via the SetEnablePush function
+  // Currently this is set only once in the lifetime of a transport.
+  // We have no plans to support this in the future.
+  bool enable_push_ = true;
 
-  std::optional<Http2SettingsFrame> MaybeSendUpdate();
-  GRPC_MUST_USE_RESULT bool AckLastSend();
+  // gRPC defined setting
+  // Unlike most other SETTINGS, this setting is negotiated between the client
+  // and the server.
+  // Currently this is set only once in the lifetime of a transport.
+  // Disconnect if it is received more than once from the peer.
+  bool allow_true_binary_metadata_ = false;
 
- private:
-  enum class UpdateState : uint8_t {
-    kFirst,
-    kSending,
-    kIdle,
-  };
-  UpdateState update_state_ = UpdateState::kFirst;
-  Http2Settings local_;
-  Http2Settings sent_;
-  Http2Settings peer_;
-  Http2Settings acked_;
+  // gRPC defined setting
+  // Unlike most other SETTINGS, this setting is negotiated between the client
+  // and the server. Both have to set it to true for the system to successfully
+  // apply the custom SECURITY frame.
+  // Currently this is set only once in the lifetime of a transport.
+  // Disconnect if it is received more than once from the peer.
+  bool allow_security_frame_ = false;
 };
 
 }  // namespace grpc_core
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings_manager.cc b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings_manager.cc
new file mode 100644
index 00000000000..921a33aa888
--- /dev/null
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings_manager.cc
@@ -0,0 +1,61 @@
+//
+// Copyright 2017 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+//
+// Automatically generated by tools/codegen/core/gen_settings_ids.py
+//
+
+#include "src/core/ext/transport/chttp2/transport/http2_settings_manager.h"
+
+#include <grpc/support/port_platform.h>
+
+#include "absl/strings/str_cat.h"
+#include "src/core/ext/transport/chttp2/transport/frame.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings.h"
+#include "src/core/ext/transport/chttp2/transport/http2_status.h"
+#include "src/core/util/useful.h"
+
+namespace grpc_core {
+
+std::optional<Http2SettingsFrame> Http2SettingsManager::MaybeSendUpdate() {
+  switch (update_state_) {
+    case UpdateState::kSending:
+      return std::nullopt;
+    case UpdateState::kIdle:
+      if (local_ == sent_) return std::nullopt;
+      break;
+    case UpdateState::kFirst:
+      break;
+  }
+  Http2SettingsFrame frame;
+  local_.Diff(/*is_first_send=*/update_state_ == UpdateState::kFirst,
+              /*old_setting=*/sent_,
+              /*cb=*/[&frame](uint16_t key, uint32_t value) {
+                frame.settings.emplace_back(key, value);
+              });
+  sent_ = local_;
+  update_state_ = UpdateState::kSending;
+  return frame;
+}
+
+bool Http2SettingsManager::AckLastSend() {
+  if (update_state_ != UpdateState::kSending) return false;
+  update_state_ = UpdateState::kIdle;
+  acked_ = sent_;
+  return true;
+}
+
+}  // namespace grpc_core
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings_manager.h b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings_manager.h
new file mode 100644
index 00000000000..c048317376e
--- /dev/null
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_settings_manager.h
@@ -0,0 +1,142 @@
+//
+// Copyright 2017 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_HTTP2_SETTINGS_MANAGER_H
+#define GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_HTTP2_SETTINGS_MANAGER_H
+
+#include <grpc/support/port_platform.h>
+#include <stdint.h>
+
+#include <cstdint>
+#include <optional>
+
+#include "absl/functional/function_ref.h"
+#include "absl/strings/string_view.h"
+#include "src/core/channelz/property_list.h"
+#include "src/core/ext/transport/chttp2/transport/frame.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings.h"
+#include "src/core/ext/transport/chttp2/transport/http2_status.h"
+#include "src/core/util/useful.h"
+
+namespace grpc_core {
+
+class Http2SettingsManager {
+ public:
+  // Only local and peer settings can be edited by the transport.
+  Http2Settings& mutable_local() { return local_; }
+  Http2Settings& mutable_peer() { return peer_; }
+
+  const Http2Settings& local() const { return local_; }
+  // Before the first SETTINGS ACK frame is received acked_ will hold the
+  // default values.
+  const Http2Settings& acked() const { return acked_; }
+  const Http2Settings& peer() const { return peer_; }
+
+  channelz::PropertyGrid ChannelzProperties() const {
+    return channelz::PropertyGrid()
+        .SetColumn("local", local_.ChannelzProperties())
+        .SetColumn("sent", sent_.ChannelzProperties())
+        .SetColumn("peer", peer_.ChannelzProperties())
+        .SetColumn("acked", acked_.ChannelzProperties());
+  }
+
+  // Returns nullopt if we don't need to send a SETTINGS frame to the peer.
+  // Returns Http2SettingsFrame if we need to send a SETTINGS frame to the
+  // peer. Transport MUST send a frame returned by this function to the peer.
+  // This function is not idempotent.
+  std::optional<Http2SettingsFrame> MaybeSendUpdate();
+
+  // To be called from a promise based HTTP2 transport only
+  http2::Http2ErrorCode ApplyIncomingSettings(
+      std::vector<Http2SettingsFrame::Setting>& settings) {
+    for (const auto& setting : settings) {
+      http2::Http2ErrorCode error1 =
+          count_updates_.IsUpdatePermitted(setting.id, setting.value, peer_);
+      if (GPR_UNLIKELY(error1 != http2::Http2ErrorCode::kNoError)) {
+        return error1;
+      }
+      http2::Http2ErrorCode error = peer_.Apply(setting.id, setting.value);
+      if (GPR_UNLIKELY(error != http2::Http2ErrorCode::kNoError)) {
+        return error;
+      }
+    }
+    return http2::Http2ErrorCode::kNoError;
+  }
+
+  // Call when we receive an ACK from our peer.
+  // This function is not idempotent.
+  GRPC_MUST_USE_RESULT bool AckLastSend();
+
+ private:
+  struct CountUpdates {
+    http2::Http2ErrorCode IsUpdatePermitted(const uint16_t setting_id,
+                                            const uint32_t value,
+                                            const Http2Settings& peer) {
+      switch (setting_id) {
+        case Http2Settings::kGrpcAllowTrueBinaryMetadataWireId:
+          // These settings must not change more than once. This is a gRPC
+          // defined settings.
+          if (allow_true_binary_metadata_update &&
+              peer.allow_true_binary_metadata() != static_cast<bool>(value)) {
+            return http2::Http2ErrorCode::kConnectError;
+          }
+          allow_true_binary_metadata_update = true;
+          break;
+        case Http2Settings::kGrpcAllowSecurityFrameWireId:
+          // These settings must not change more than once. This is a gRPC
+          // defined settings.
+          if (allow_security_frame_update &&
+              peer.allow_security_frame() != static_cast<bool>(value)) {
+            return http2::Http2ErrorCode::kConnectError;
+          }
+          allow_security_frame_update = true;
+          break;
+        default:
+          break;
+      }
+      return http2::Http2ErrorCode::kNoError;
+    }
+    bool allow_true_binary_metadata_update = false;
+    bool allow_security_frame_update = false;
+  };
+  CountUpdates count_updates_;
+
+  enum class UpdateState : uint8_t {
+    kFirst,
+    kSending,
+    kIdle,
+  };
+  UpdateState update_state_ = UpdateState::kFirst;
+
+  // This holds a copy of the peers settings.
+  Http2Settings peer_;
+
+  // These are different sets of our settings.
+  // local_  : Setting that has been changed inside our transport,
+  //           but not yet sent to the peer.
+  // sent_   : New settings frame is sent to the peer but we have not yet
+  //           received the ACK from the peer.
+  // acked_  : The settings that have already been ACKed by the peer. These
+  //           settings can be enforced and any violation of these settings by a
+  //           peer may cause an error.
+  Http2Settings local_;
+  Http2Settings sent_;
+  Http2Settings acked_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_HTTP2_SETTINGS_MANAGER_H
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_transport.cc b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_transport.cc
index 605e09d6435..48f2c5e90e1 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_transport.cc
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_transport.cc
@@ -16,12 +16,14 @@
 //
 //
 
+#include "src/core/ext/transport/chttp2/transport/http2_transport.h"
+
 #include <cstdint>
 #include <utility>
 
 #include "src/core/call/call_spine.h"
+#include "src/core/call/metadata_info.h"
 #include "src/core/ext/transport/chttp2/transport/frame.h"
-#include "src/core/ext/transport/chttp2/transport/http2_settings.h"
 #include "src/core/lib/promise/mpsc.h"
 #include "src/core/lib/promise/party.h"
 #include "src/core/lib/transport/promise_endpoint.h"
@@ -36,8 +38,84 @@ namespace http2 {
 // and it is functions. The code will be written iteratively.
 // Do not use or edit any of these functions unless you are
 // familiar with the PH2 project (Moving chttp2 to promises.)
-// TODO(tjagtap) : [PH2][P3] : We may not need this file. Delete once Server
-// Transport is complete.
+
+void InitLocalSettings(Http2Settings& settings, const bool is_client) {
+  if (is_client) {
+    // gRPC has never supported PUSH_PROMISE and we have no plan to do so in the
+    // future.
+    settings.SetEnablePush(false);
+    // This is to make it double-sure that server cannot initite a stream.
+    settings.SetMaxConcurrentStreams(0);
+  }
+  settings.SetMaxHeaderListSize(DEFAULT_MAX_HEADER_LIST_SIZE);
+  settings.SetAllowTrueBinaryMetadata(true);
+}
+
+void ReadSettingsFromChannelArgs(const ChannelArgs& channel_args,
+                                 Http2Settings& settings,
+                                 const bool is_client) {
+  if (channel_args.Contains(GRPC_ARG_HTTP2_HPACK_TABLE_SIZE_DECODER)) {
+    settings.SetHeaderTableSize(
+        channel_args.GetInt(GRPC_ARG_HTTP2_HPACK_TABLE_SIZE_DECODER)
+            .value_or(-1));
+  }
+
+  if (channel_args.Contains(GRPC_ARG_MAX_CONCURRENT_STREAMS)) {
+    if (!is_client) {
+      settings.SetMaxConcurrentStreams(
+          channel_args.GetInt(GRPC_ARG_MAX_CONCURRENT_STREAMS).value_or(-1));
+    } else {
+      // We do not allow the channel arg to alter our 0 setting for
+      // MAX_CONCURRENT_STREAMS for clients because we dont support PUSH_PROMISE
+      LOG(WARNING) << "ChannelArg GRPC_ARG_MAX_CONCURRENT_STREAMS is not "
+                      "available on clients";
+    }
+  }
+
+  if (channel_args.Contains(GRPC_ARG_HTTP2_STREAM_LOOKAHEAD_BYTES)) {
+    settings.SetInitialWindowSize(
+        channel_args.GetInt(GRPC_ARG_HTTP2_STREAM_LOOKAHEAD_BYTES)
+            .value_or(-1));
+    // TODO(tjagtap) [PH2][P2] : Also set this for flow control.
+    // Refer to read_channel_args() in chttp2_transport.cc for more details.
+  }
+
+  settings.SetMaxHeaderListSize(GetHardLimitFromChannelArgs(channel_args));
+
+  if (channel_args.Contains(GRPC_ARG_HTTP2_MAX_FRAME_SIZE)) {
+    settings.SetMaxFrameSize(
+        channel_args.GetInt(GRPC_ARG_HTTP2_MAX_FRAME_SIZE).value_or(-1));
+  }
+
+  if (channel_args
+          .GetBool(GRPC_ARG_EXPERIMENTAL_HTTP2_PREFERRED_CRYPTO_FRAME_SIZE)
+          .value_or(false)) {
+    settings.SetPreferredReceiveCryptoMessageSize(INT_MAX);
+  }
+
+  if (channel_args.Contains(GRPC_ARG_HTTP2_ENABLE_TRUE_BINARY)) {
+    settings.SetAllowTrueBinaryMetadata(
+        channel_args.GetInt(GRPC_ARG_HTTP2_ENABLE_TRUE_BINARY).value_or(-1) !=
+        0);
+  }
+
+  settings.SetAllowSecurityFrame(
+      channel_args.GetBool(GRPC_ARG_SECURITY_FRAME_ALLOWED).value_or(false));
+
+  GRPC_HTTP2_COMMON_DLOG
+      << "Http2Settings: {"
+      << "header_table_size: " << settings.header_table_size()
+      << ", max_concurrent_streams: " << settings.max_concurrent_streams()
+      << ", initial_window_size: " << settings.initial_window_size()
+      << ", max_frame_size: " << settings.max_frame_size()
+      << ", max_header_list_size: " << settings.max_header_list_size()
+      << ", preferred_receive_crypto_message_size: "
+      << settings.preferred_receive_crypto_message_size()
+      << ", enable_push: " << settings.enable_push()
+      << ", allow_true_binary_metadata: "
+      << settings.allow_true_binary_metadata()
+      << ", allow_security_frame: " << settings.allow_security_frame() << "}";
+}
 
 }  // namespace http2
 }  // namespace grpc_core
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_transport.h b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_transport.h
index 92e7a2a78e6..3fdcd9e525c 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/http2_transport.h
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/http2_transport.h
@@ -23,6 +23,7 @@
 #include <utility>
 
 #include "src/core/call/call_spine.h"
+#include "src/core/call/metadata_info.h"
 #include "src/core/ext/transport/chttp2/transport/frame.h"
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
 #include "src/core/lib/promise/mpsc.h"
@@ -45,8 +46,15 @@ namespace http2 {
 #define GRPC_HTTP2_CLIENT_DLOG \
   DLOG_IF(INFO, GRPC_TRACE_FLAG_ENABLED(http2_ph2_transport))
 
+#define GRPC_HTTP2_COMMON_DLOG \
+  DLOG_IF(INFO, GRPC_TRACE_FLAG_ENABLED(http2_ph2_transport))
+
+// Timeout for getting an ack back on settings changes
+#define GRPC_ARG_SETTINGS_TIMEOUT "grpc.http2.settings_timeout"
+
 // TODO(akshitpatel) : [PH2][P2] : Choose appropriate size later.
 constexpr int kMpscSize = 10;
+constexpr uint32_t kStreamQueueSize = /*1 MB*/ 1024u * 1024u;
 
 enum class HttpStreamState : uint8_t {
   // https://www.rfc-editor.org/rfc/rfc9113.html#name-stream-states
@@ -57,7 +65,10 @@ enum class HttpStreamState : uint8_t {
   kClosed,
 };
 
-class TransportSendQeueue {};
+void InitLocalSettings(Http2Settings& settings, const bool is_client);
+
+void ReadSettingsFromChannelArgs(const ChannelArgs& channel_args,
+                                 Http2Settings& settings, const bool is_client);
 
 }  // namespace http2
 }  // namespace grpc_core
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/message_assembler.h b/deps/grpc/src/core/ext/transport/chttp2/transport/message_assembler.h
index cc4af0c54d7..92a99d7d83a 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/message_assembler.h
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/message_assembler.h
@@ -76,8 +76,7 @@ class GrpcMessageAssembler {
   ValueOrHttp2Status<MessageHandle> ExtractMessage() {
     const size_t current_len = message_buffer_.Length();
     if (current_len < kGrpcHeaderSizeInBytes) {
-      // TODO(tjagtap) : [PH2][P3] : Write a test for this failure.
-      LOG(ERROR) << "Incomplete gRPC message received";
+      // TODO(tjagtap) : [PH2][P3] : Write a test for this.
       return ReturnNullOrError();
     }
     GrpcMessageHeader header = ExtractGrpcHeader(message_buffer_);
@@ -113,6 +112,7 @@ class GrpcMessageAssembler {
       return Http2Status::Http2StreamError(Http2ErrorCode::kInternalError,
                                            "Incomplete gRPC frame received");
     }
+    VLOG(2) << "Incomplete gRPC message received. Return nullptr";
     return ValueOrHttp2Status<MessageHandle>(nullptr);
   }
   bool is_end_stream_ = false;
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/parsing.cc b/deps/grpc/src/core/ext/transport/chttp2/transport/parsing.cc
index 491ecf24b3b..d6889afdf12 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/parsing.cc
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/parsing.cc
@@ -54,6 +54,7 @@
 #include "src/core/ext/transport/chttp2/transport/hpack_parser.h"
 #include "src/core/ext/transport/chttp2/transport/hpack_parser_table.h"
 #include "src/core/ext/transport/chttp2/transport/http2_settings.h"
+#include "src/core/ext/transport/chttp2/transport/http2_settings_manager.h"
 #include "src/core/ext/transport/chttp2/transport/http2_status.h"
 #include "src/core/ext/transport/chttp2/transport/http2_ztrace_collector.h"
 #include "src/core/ext/transport/chttp2/transport/internal.h"
@@ -212,7 +213,7 @@ std::string FrameTypeString(uint8_t frame_type, uint8_t flags) {
 std::variant<size_t, absl::Status> grpc_chttp2_perform_read(
     grpc_chttp2_transport* t, const grpc_slice& slice,
     size_t& requests_started) {
-  GRPC_LATENT_SEE_INNER_SCOPE("grpc_chttp2_perform_read");
+  GRPC_LATENT_SEE_SCOPE("grpc_chttp2_perform_read");
 
   const uint8_t* beg = GRPC_SLICE_START_PTR(slice);
   const uint8_t* end = GRPC_SLICE_END_PTR(slice);
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/ping_promise.cc b/deps/grpc/src/core/ext/transport/chttp2/transport/ping_promise.cc
index df5f7687a92..6e4be1991ae 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/ping_promise.cc
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/ping_promise.cc
@@ -40,7 +40,8 @@ using grpc_event_engine::experimental::EventEngine;
                 GRPC_TRACE_FLAG_ENABLED(http2_ping)))
 
 Promise<absl::Status> PingManager::PingPromiseCallbacks::RequestPing(
-    Callback on_initiate) {
+    Callback on_initiate, bool important) {
+  important_ping_requested_ = (important_ping_requested_ || important);
   std::shared_ptr<Latch<void>> latch = std::make_shared<Latch<void>>();
   auto on_ack = [latch]() { latch->Set(); };
   ping_callbacks_.OnPing(std::move(on_initiate), std::move(on_ack));
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/ping_promise.h b/deps/grpc/src/core/ext/transport/chttp2/transport/ping_promise.h
index 820954ffa5a..ea391fbbaa5 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/ping_promise.h
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/ping_promise.h
@@ -110,8 +110,8 @@ class PingManager {
   // Returns a promise that resolves once a new ping is initiated and ack is
   // received for the same. The on_initiate callback is executed when the
   // ping is initiated.
-  auto RequestPing(absl::AnyInvocable<void()> on_initiate) {
-    return ping_callbacks_.RequestPing(std::move(on_initiate));
+  auto RequestPing(absl::AnyInvocable<void()> on_initiate, bool important) {
+    return ping_callbacks_.RequestPing(std::move(on_initiate), important);
   }
 
   // Returns a promise that resolves once the next valid ping ack is received.
@@ -125,6 +125,9 @@ class PingManager {
 
   uint64_t StartPing() { return ping_callbacks_.StartPing(); }
   bool PingRequested() { return ping_callbacks_.PingRequested(); }
+  bool ImportantPingRequested() const {
+    return ping_callbacks_.ImportantPingRequested();
+  }
   bool AckPing(uint64_t id) { return ping_callbacks_.AckPing(id); }
   size_t CountPingInflight() { return ping_callbacks_.CountPingInflight(); }
 
@@ -135,11 +138,19 @@ class PingManager {
         std::shared_ptr<grpc_event_engine::experimental::EventEngine>
             event_engine)
         : event_engine_(event_engine) {}
-    Promise<absl::Status> RequestPing(absl::AnyInvocable<void()> on_initiate);
+    Promise<absl::Status> RequestPing(absl::AnyInvocable<void()> on_initiate,
+                                      bool important);
     Promise<absl::Status> WaitForPingAck();
-    void CancelCallbacks() { ping_callbacks_.CancelAll(event_engine_.get()); }
-    uint64_t StartPing() { return ping_callbacks_.StartPing(SharedBitGen()); }
+    void CancelCallbacks() {
+      important_ping_requested_ = false;
+      ping_callbacks_.CancelAll(event_engine_.get());
+    }
+    uint64_t StartPing() {
+      important_ping_requested_ = false;
+      return ping_callbacks_.StartPing(SharedBitGen());
+    }
     bool PingRequested() { return ping_callbacks_.ping_requested(); }
+    bool ImportantPingRequested() const { return important_ping_requested_; }
     bool AckPing(uint64_t id) {
       return ping_callbacks_.AckPing(id, event_engine_.get());
     }
@@ -160,6 +171,12 @@ class PingManager {
    private:
     Chttp2PingCallbacks ping_callbacks_;
     std::shared_ptr<grpc_event_engine::experimental::EventEngine> event_engine_;
+    // Return true if an "important" ping request needs to be started. This can
+    // be used to determine if a ping should be sent as soon as possible. If
+    // there are no outstanding ping requests, this is guaranteed to be false.
+    // If there is at least one outstanding ping request, this may be true or
+    // false.
+    bool important_ping_requested_ = false;
   };
 
   PingPromiseCallbacks ping_callbacks_;
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/stream_data_queue.h b/deps/grpc/src/core/ext/transport/chttp2/transport/stream_data_queue.h
index e3af898cab7..745e0a9cd0c 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/stream_data_queue.h
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/stream_data_queue.h
@@ -19,17 +19,157 @@
 #ifndef GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_STREAM_DATA_QUEUE_H
 #define GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_STREAM_DATA_QUEUE_H
 
+#include <queue>
+
 #include "absl/log/check.h"
 #include "absl/log/log.h"
-#include "src/core/ext/transport/chttp2/transport/frame.h"
 #include "src/core/ext/transport/chttp2/transport/header_assembler.h"
 #include "src/core/ext/transport/chttp2/transport/message_assembler.h"
 
 namespace grpc_core {
 namespace http2 {
 
-class StreamDataQueue {
+#define GRPC_STREAM_DATA_QUEUE_DEBUG VLOG(2)
+
+// SimpleQueue is a NOT thread safe.
+// Note: SimpleQueue is a single producer single consumer queue.
+template <typename T>
+class SimpleQueue {
+ public:
+  struct EnqueueResult {
+    absl::Status status;
+    bool became_non_empty;
+  };
+
+  explicit SimpleQueue(const uint32_t max_tokens) : max_tokens_(max_tokens) {}
+  SimpleQueue(SimpleQueue&& rhs) = delete;
+  SimpleQueue& operator=(SimpleQueue&& rhs) = delete;
+  SimpleQueue(const SimpleQueue&) = delete;
+  SimpleQueue& operator=(const SimpleQueue&) = delete;
+
+  // A promise that resolves when the data is enqueued.
+  // If tokens_consumed_ is 0 or the new tokens fit within max_tokens_, then
+  // allow the enqueue to go through. Otherwise, return pending. Here, we are
+  // using tokens_consumed over queue_.empty() because there can be enqueues
+  // with tokens = 0. Enqueues with tokens = 0 are primarily for sending
+  // metadata as flow control does not apply to them. This function is NOT
+  // thread safe.
+  auto Enqueue(T& data, const uint32_t tokens) {
+    return PollEnqueue(data, tokens);
+  }
+
+  // Sync function to dequeue the next entry. Returns nullopt if the queue is
+  // empty or if the front of the queue has more tokens than
+  // allowed_dequeue_tokens. When allow_oversized_dequeue parameter is set to
+  // true, it allows an item to be dequeued even if its token cost is greater
+  // than allowed_dequeue_tokens. It does not cause the item itself to be
+  // partially dequeued; either the entire item is returned or nullopt is
+  // returned. This function is NOT thread safe.
+  std::optional<T> Dequeue(const uint32_t allowed_dequeue_tokens,
+                           const bool allow_oversized_dequeue) {
+    return DequeueInternal(allowed_dequeue_tokens, allow_oversized_dequeue);
+  }
+
+  // Dequeues the next entry immediately ignoring the tokens. If the queue is
+  // empty, returns nullopt. This function is NOT thread safe.
+  std::optional<T> ImmediateDequeue() {
+    return DequeueInternal(std::numeric_limits<uint32_t>::max(), true);
+  }
+
+  // Returns true if the queue is empty. This function is NOT thread safe.
+  bool TestOnlyIsEmpty() const { return IsEmpty(); }
+
+ private:
+  Poll<EnqueueResult> PollEnqueue(T& data, const uint32_t tokens) {
+    GRPC_STREAM_DATA_QUEUE_DEBUG << "Enqueueing data. Data tokens: " << tokens;
+    const uint32_t max_tokens_consumed_threshold =
+        max_tokens_ >= tokens ? max_tokens_ - tokens : 0;
+    if (tokens_consumed_ == 0 ||
+        tokens_consumed_ <= max_tokens_consumed_threshold) {
+      tokens_consumed_ += tokens;
+      queue_.emplace(Entry{std::move(data), tokens});
+      GRPC_STREAM_DATA_QUEUE_DEBUG
+          << "Enqueue successful. Data tokens: " << tokens
+          << " Current tokens consumed: " << tokens_consumed_;
+      return EnqueueResult{absl::OkStatus(),
+                           /*became_non_empty=*/queue_.size() == 1};
+    }
+
+    GRPC_STREAM_DATA_QUEUE_DEBUG
+        << "Token threshold reached. Data tokens: " << tokens
+        << " Tokens consumed: " << tokens_consumed_
+        << " Max tokens: " << max_tokens_;
+    waker_ = GetContext<Activity>()->MakeNonOwningWaker();
+    return Pending{};
+  }
+
+  std::optional<T> DequeueInternal(const uint32_t allowed_dequeue_tokens,
+                                   const bool allow_oversized_dequeue) {
+    if (queue_.empty() || (queue_.front().tokens > allowed_dequeue_tokens &&
+                           !allow_oversized_dequeue)) {
+      GRPC_STREAM_DATA_QUEUE_DEBUG
+          << "Dequeueing data. Queue size: " << queue_.size()
+          << " Max allowed dequeue tokens: " << allowed_dequeue_tokens
+          << " Front tokens: "
+          << (!queue_.empty() ? std::to_string(queue_.front().tokens)
+                              : std::string("NA"))
+          << " Allow oversized dequeue: " << allow_oversized_dequeue;
+      return std::nullopt;
+    }
+
+    auto entry = std::move(queue_.front());
+    queue_.pop();
+    tokens_consumed_ -= entry.tokens;
+    auto waker = std::move(waker_);
+    GRPC_STREAM_DATA_QUEUE_DEBUG
+        << "Dequeue successful. Data tokens released: " << entry.tokens
+        << " Current tokens consumed: " << tokens_consumed_;
+
+    // TODO(akshitpatel) : [PH2][P2] : Investigate a mechanism to only wake up
+    // if the sender will be able to send more data. There is a high chance that
+    // this queue is revamped soon and so not spending time on optimization
+    // right now.
+    waker.Wakeup();
+    return std::move(entry.data);
+  }
+
+  bool IsEmpty() const { return queue_.empty(); }
+
+  struct Entry {
+    T data;
+    uint32_t tokens;
+  };
+
+  std::queue<Entry> queue_;
+  // The maximum number of tokens that can be enqueued. This limit is used to
+  // exert back pressure on the sender. If the sender tries to enqueue more
+  // tokens than this limit, the enqueue promise will not resolve until the
+  // required number of tokens are consumed by the receiver. There is an
+  // exception to this rule: if the sender tries to enqueue an item when the
+  // queue has 0 tokens, the enqueue will always go through regardless of the
+  // number of tokens.
+  uint32_t max_tokens_;
+  // The number of tokens that have been enqueued in the queue but not yet
+  // dequeued.
+  uint32_t tokens_consumed_ = 0;
+  Waker waker_;
+};
+
+// StreamDataQueue is a thread safe.
+// Note: StreamDataQueue is a single producer single
+// consumer queue.
+template <typename MetadataHandle>
+class StreamDataQueue : public RefCounted<StreamDataQueue<MetadataHandle>> {
  public:
+  explicit StreamDataQueue(const bool is_client, const uint32_t stream_id,
+                           const uint32_t queue_size)
+      : stream_id_(stream_id),
+        is_client_(is_client),
+        queue_(queue_size),
+        initial_metadata_disassembler_(stream_id,
+                                       /*is_trailing_metadata=*/false),
+        trailing_metadata_disassembler_(stream_id,
+                                        /*is_trailing_metadata=*/true) {};
   ~StreamDataQueue() = default;
 
   StreamDataQueue(StreamDataQueue&& rhs) = delete;
@@ -37,10 +177,428 @@ class StreamDataQueue {
   StreamDataQueue(const StreamDataQueue&) = delete;
   StreamDataQueue& operator=(const StreamDataQueue&) = delete;
 
+  //////////////////////////////////////////////////////////////////////////////
+  // Enqueue Helpers
+  // These enqueue helpers are based on following assumptions:
+  // 1. The ordering of initial metadata, messages and trailing metadata is
+  //    taken care by the Callv-3 stack.
+  // 2. Initial metadata MUST be enqueued before the first message.
+  // 3. Initial metadata and trailing metadata are both optional. A server can
+  //    skip initial metadata and a client will never send trailing metadata.
+  // 4. A server will never send half close.
+  // 5. Trailing metadata/HalfClose/ResetStream MUST be enqueued at most once
+  //    per stream.
+  // 6. After trailing metadata/HalfClose only ResetStream MAY be enqueued.
+  // 7. The ResetStream MUST be the final thing that is queued.
+  // 8. Currently initial metadata is not expected to be enqueued with
+  //    end_stream set. If the stream needs to be half closed, the client should
+  //    enqueue a half close message.
+
+  // Enqueue Initial Metadata.
+  // 1. MUST be called at most once.
+  // 2. This MUST be called before any messages are enqueued.
+  // 3. MUST not be called after trailing metadata is enqueued.
+  // 4. This function is thread safe.
+  auto EnqueueInitialMetadata(MetadataHandle metadata) {
+    DCHECK(!is_initial_metadata_queued_);
+    DCHECK(!is_trailing_metadata_or_half_close_queued_);
+    DCHECK(metadata != nullptr);
+    DCHECK(!is_reset_stream_queued_);
+
+    is_initial_metadata_queued_ = true;
+    return [self = this->Ref(),
+            entry = QueueEntry{InitialMetadataType{
+                std::move(metadata)}}]() mutable -> Poll<absl::StatusOr<bool>> {
+      MutexLock lock(&self->mu_);
+      auto result = self->queue_.Enqueue(entry, /*tokens=*/0);
+      if (result.ready()) {
+        GRPC_STREAM_DATA_QUEUE_DEBUG
+            << "Enqueued initial metadata for stream " << self->stream_id_
+            << " with status: " << result.value().status;
+        if (result.value().status.ok()) {
+          DCHECK(result.value().became_non_empty);
+          return self->UpdateWritableStateLocked(
+              result.value().became_non_empty);
+        }
+        return result.value().status;
+      }
+      return Pending{};
+    };
+  }
+
+  // Enqueue Trailing Metadata.
+  // 1. MUST be called at most once.
+  // 2. MUST be called only for a server.
+  // 3. This function is thread safe.
+  auto EnqueueTrailingMetadata(MetadataHandle metadata) {
+    DCHECK(metadata != nullptr);
+    DCHECK(!is_reset_stream_queued_);
+    DCHECK(!is_client_);
+    DCHECK(!is_trailing_metadata_or_half_close_queued_);
+
+    is_trailing_metadata_or_half_close_queued_ = true;
+    return [self = this->Ref(),
+            entry = QueueEntry{TrailingMetadataType{
+                std::move(metadata)}}]() mutable -> Poll<absl::StatusOr<bool>> {
+      MutexLock lock(&self->mu_);
+      auto result = self->queue_.Enqueue(entry, /*tokens=*/0);
+      if (result.ready()) {
+        GRPC_STREAM_DATA_QUEUE_DEBUG
+            << "Enqueued trailing metadata for stream " << self->stream_id_
+            << " with status: " << result.value().status;
+        if (result.value().status.ok()) {
+          return self->UpdateWritableStateLocked(
+              result.value().became_non_empty);
+        }
+        return result.value().status;
+      }
+      return Pending{};
+    };
+  }
+
+  // Returns a promise that resolves when the message is enqueued. There may be
+  // delays in queueing the message if data queue is full.
+  // 1. MUST be called after initial metadata is enqueued.
+  // 2. MUST not be called after trailing metadata is enqueued.
+  // 3. This function is thread safe.
+  auto EnqueueMessage(MessageHandle message) {
+    DCHECK(is_initial_metadata_queued_);
+    DCHECK(message != nullptr);
+    DCHECK(!is_reset_stream_queued_);
+    DCHECK_LE(message->payload()->Length(),
+              std::numeric_limits<uint32_t>::max() - kGrpcHeaderSizeInBytes);
+    DCHECK(!is_trailing_metadata_or_half_close_queued_);
+
+    const uint32_t tokens =
+        message->payload()->Length() + kGrpcHeaderSizeInBytes;
+    return [self = this->Ref(), entry = QueueEntry{std::move(message)},
+            tokens]() mutable -> Poll<absl::StatusOr<bool>> {
+      MutexLock lock(&self->mu_);
+      auto result = self->queue_.Enqueue(entry, tokens);
+      if (result.ready()) {
+        GRPC_STREAM_DATA_QUEUE_DEBUG
+            << "Enqueued message for stream " << self->stream_id_
+            << " with status: " << result.value().status;
+        // TODO(akshitpatel) : [PH2][P2] : Add check for flow control tokens.
+        if (result.value().status.ok()) {
+          return self->UpdateWritableStateLocked(
+              result.value().became_non_empty);
+        }
+        return result.value().status;
+      }
+      return Pending{};
+    };
+  }
+
+  // Enqueue Half Closed.
+  // 1. MUST be called at most once.
+  // 2. MUST be called only for a client.
+  // 3. This function is thread safe.
+  auto EnqueueHalfClosed() {
+    DCHECK(is_initial_metadata_queued_);
+    DCHECK(is_client_);
+    DCHECK(!is_reset_stream_queued_);
+    DCHECK(!is_trailing_metadata_or_half_close_queued_);
+
+    is_trailing_metadata_or_half_close_queued_ = true;
+    return [self = this->Ref(), entry = QueueEntry{HalfClosed{}}]() mutable
+               -> Poll<absl::StatusOr<bool>> {
+      MutexLock lock(&self->mu_);
+      auto result = self->queue_.Enqueue(entry, /*tokens=*/0);
+      if (result.ready()) {
+        GRPC_STREAM_DATA_QUEUE_DEBUG
+            << "Marking stream " << self->stream_id_ << " as half closed"
+            << " with status: " << result.value().status;
+        if (result.value().status.ok()) {
+          return self->UpdateWritableStateLocked(
+              result.value().became_non_empty);
+        }
+        return result.value().status;
+      }
+      return Pending{};
+    };
+  }
+
+  // Enqueue Reset Stream.
+  // 1. MUST be called at most once.
+  // 3. This function is thread safe.
+  auto EnqueueResetStream(uint32_t error_code) {
+    DCHECK(is_initial_metadata_queued_);
+    DCHECK(!is_reset_stream_queued_);
+
+    is_reset_stream_queued_ = true;
+    return [self = this->Ref(),
+            entry = QueueEntry{ResetStream{
+                error_code}}]() mutable -> Poll<absl::StatusOr<bool>> {
+      MutexLock lock(&self->mu_);
+      auto result = self->queue_.Enqueue(entry, /*tokens=*/0);
+      if (result.ready()) {
+        GRPC_STREAM_DATA_QUEUE_DEBUG
+            << "Enqueueing reset stream for stream " << self->stream_id_
+            << " with status: " << result.value().status;
+        if (result.value().status.ok()) {
+          return self->UpdateWritableStateLocked(
+              result.value().became_non_empty);
+        }
+        return result.value().status;
+      }
+      return Pending{};
+    };
+  }
+
+  //////////////////////////////////////////////////////////////////////////////
+  // Dequeue Helpers
+
+  // TODO(akshitpatel) : [PH2][P2] : Decide on whether it is needed to return
+  // the number of tokens consumed by one call of this function.
+  struct DequeueResult {
+    std::vector<Http2Frame> frames;
+    bool is_writable;
+  };
+
+  // TODO(akshitpatel) : [PH2][P4] : Measure the performance of this function
+  // and optimize it if needed.
+
+  // This function is deliberately a synchronous call. The caller of this
+  // function should not be blocked till we have enough data to return. This is
+  // because the caller needs to dequeue frames from multiple streams in a
+  // single cycle. The goal here is to return as much data as possible in one go
+  // with max_tokens as the upper limit. General idea: Out goal here is to push
+  // as much data as possible with max_tokens as the upper limit. Though we will
+  // not prefer sending incomplete messages. We handle the scenario of
+  // incomplete messages in the following way:
+  // 1. If we have sent x full messages and available flow control tokens cannot
+  //    accommodate x+1 message, we will not dequeue the x+1st message and
+  //    create frames for x messages.
+  // 2. If the flow control tokens cannot accommodate first message, we
+  //    dequeue the first message from the queue and create frames for
+  //    the partial first message (sum of payload of all returned frames <=
+  //    max_fc_tokens).
+  // This function is thread safe.
+  absl::StatusOr<DequeueResult> DequeueFrames(const uint32_t max_fc_tokens,
+                                              const uint32_t max_frame_length,
+                                              HPackCompressor& encoder) {
+    MutexLock lock(&mu_);
+    GRPC_STREAM_DATA_QUEUE_DEBUG << "Dequeueing frames for stream "
+                                 << stream_id_
+                                 << " Max fc tokens: " << max_fc_tokens
+                                 << " Max frame length: " << max_frame_length
+                                 << " Message disassembler buffered length: "
+                                 << message_disassembler_.GetBufferedLength();
+
+    HandleDequeue handle_dequeue(max_fc_tokens, max_frame_length, encoder,
+                                 *this);
+    while (message_disassembler_.GetBufferedLength() <= max_fc_tokens) {
+      const uint32_t tokens_to_dequeue =
+          max_fc_tokens - message_disassembler_.GetBufferedLength();
+      std::optional<QueueEntry> queue_entry =
+          queue_.Dequeue(tokens_to_dequeue, /*allow_oversized_dequeue*/ (
+                             message_disassembler_.GetBufferedLength() == 0 &&
+                             tokens_to_dequeue > 0));
+      if (!queue_entry.has_value()) {
+        // Nothing more to dequeue right now.
+        GRPC_STREAM_DATA_QUEUE_DEBUG << "No more data to dequeue";
+        break;
+      }
+      std::visit(handle_dequeue, std::move(*queue_entry));
+    }
+
+    // TODO(akshitpatel) : [PH2][P2] : Add a check for flow control tokens.
+    is_writable_ = false;
+    GRPC_STREAM_DATA_QUEUE_DEBUG << "Stream id: " << stream_id_
+                                 << " writable state changed to "
+                                 << is_writable_;
+    return DequeueResult{handle_dequeue.GetFrames(), is_writable_};
+  }
+
+  // Returns true if the queue is empty. This function is thread safe.
+  bool TestOnlyIsEmpty() {
+    MutexLock lock(&mu_);
+    return queue_.TestOnlyIsEmpty();
+  }
+
  private:
-  // TODO(akshitpatel) : [PH2][P2] Keep this either in the transport or here.
-  // Not both places.
-  GrpcMessageDisassembler disassembler;
+  struct InitialMetadataType {
+    MetadataHandle metadata;
+  };
+  struct TrailingMetadataType {
+    MetadataHandle metadata;
+  };
+  struct HalfClosed {};
+  struct ResetStream {
+    uint32_t error_code;
+  };
+  using QueueEntry = std::variant<InitialMetadataType, TrailingMetadataType,
+                                  MessageHandle, HalfClosed, ResetStream>;
+
+  class HandleDequeue {
+   public:
+    HandleDequeue(uint32_t max_tokens, uint32_t max_frame_length,
+                  HPackCompressor& encoder, StreamDataQueue& queue)
+        : queue_(queue),
+          max_frame_length_(max_frame_length),
+          max_fc_tokens_(max_tokens),
+          fc_tokens_available_(max_tokens),
+          encoder_(encoder) {}
+
+    void operator()(InitialMetadataType initial_metadata) {
+      GRPC_STREAM_DATA_QUEUE_DEBUG << "Preparing initial metadata for sending";
+      queue_.initial_metadata_disassembler_.PrepareForSending(
+          std::move(initial_metadata.metadata), encoder_);
+      MaybeAppendInitialMetadataFrames();
+    }
+
+    void operator()(TrailingMetadataType trailing_metadata) {
+      GRPC_STREAM_DATA_QUEUE_DEBUG << "Preparing trailing metadata for sending";
+      queue_.trailing_metadata_disassembler_.PrepareForSending(
+          std::move(trailing_metadata.metadata), encoder_);
+    }
+
+    void operator()(MessageHandle message) {
+      GRPC_STREAM_DATA_QUEUE_DEBUG << "Preparing message for sending";
+      queue_.message_disassembler_.PrepareBatchedMessageForSending(
+          std::move(message));
+    }
+
+    void operator()(GRPC_UNUSED HalfClosed half_closed) {
+      GRPC_STREAM_DATA_QUEUE_DEBUG << "Preparing end of stream for sending";
+      is_half_closed_ = true;
+    }
+
+    void operator()(ResetStream reset_stream) {
+      GRPC_STREAM_DATA_QUEUE_DEBUG << "Preparing reset stream for sending";
+      is_reset_stream_ = true;
+      error_code_ = reset_stream.error_code;
+    }
+
+    std::vector<Http2Frame> GetFrames() {
+      // TODO(akshitpatel) : [PH2][P3] : There is a second option here. We can
+      //  only append messages here. Additionally, when Trailing
+      //  Metadata/HalfClose/ResetStream is dequeued, we can first flush the
+      //  buffered messages and then append the respective frames. This will
+      //  ensure that we do not break the ordering of the queue.
+
+      // Order of appending frames is important. There may be scenarios where a
+      // reset stream frames is appended after HalfClose or Trailing Metadata.
+      MaybeAppendMessageFrames();
+      MaybeAppendEndOfStreamFrame();
+      MaybeAppendTrailingMetadataFrames();
+      MaybeAppendResetStreamFrame();
+      return std::move(frames_);
+    }
+
+   private:
+    inline void MaybeAppendInitialMetadataFrames() {
+      while (queue_.initial_metadata_disassembler_.HasMoreData()) {
+        DCHECK(!is_half_closed_);
+        DCHECK(!is_reset_stream_);
+        // TODO(akshitpatel) : [PH2][P2] : I do not think we need this.
+        // HasMoreData() should be enough.
+        bool is_end_headers = false;
+        frames_.emplace_back(queue_.initial_metadata_disassembler_.GetNextFrame(
+            max_frame_length_, is_end_headers));
+      }
+    }
+
+    inline void MaybeAppendTrailingMetadataFrames() {
+      while (queue_.trailing_metadata_disassembler_.HasMoreData()) {
+        DCHECK(!is_half_closed_);
+        DCHECK_EQ(queue_.message_disassembler_.GetBufferedLength(), 0u);
+        DCHECK_EQ(queue_.initial_metadata_disassembler_.GetBufferedLength(),
+                  0u);
+        // TODO(akshitpatel) : [PH2][P2] : I do not think we need this.
+        // HasMoreData() should be enough.
+        bool is_end_headers = false;
+        frames_.emplace_back(
+            queue_.trailing_metadata_disassembler_.GetNextFrame(
+                max_frame_length_, is_end_headers));
+      }
+    }
+
+    inline void MaybeAppendEndOfStreamFrame() {
+      if (is_half_closed_) {
+        DCHECK_EQ(queue_.message_disassembler_.GetBufferedLength(), 0u);
+        DCHECK_EQ(queue_.initial_metadata_disassembler_.GetBufferedLength(),
+                  0u);
+        DCHECK_EQ(queue_.trailing_metadata_disassembler_.GetBufferedLength(),
+                  0u);
+        frames_.emplace_back(Http2DataFrame{/*stream_id=*/queue_.stream_id_,
+                                            /*end_stream=*/true,
+                                            /*payload=*/SliceBuffer()});
+      }
+    }
+
+    inline void MaybeAppendMessageFrames() {
+      while (queue_.message_disassembler_.GetBufferedLength() > 0 &&
+             fc_tokens_available_ > 0) {
+        DCHECK_EQ(queue_.initial_metadata_disassembler_.GetBufferedLength(),
+                  0u);
+        Http2DataFrame frame = queue_.message_disassembler_.GenerateNextFrame(
+            queue_.stream_id_,
+            std::min(fc_tokens_available_, max_frame_length_));
+        fc_tokens_available_ -= frame.payload.Length();
+        GRPC_STREAM_DATA_QUEUE_DEBUG
+            << "Appending message frame with length " << frame.payload.Length()
+            << "Available tokens: " << fc_tokens_available_;
+        frames_.emplace_back(std::move(frame));
+      }
+    }
+
+    inline void MaybeAppendResetStreamFrame() {
+      if (is_reset_stream_) {
+        // TODO(akshitpatel) : [PH2][P2] : Consider if we can send reset stream
+        // frame without flushing all the messages enqueued until now.
+        DCHECK_EQ(queue_.message_disassembler_.GetBufferedLength(), 0u);
+        DCHECK_EQ(queue_.initial_metadata_disassembler_.GetBufferedLength(),
+                  0u);
+        DCHECK_EQ(queue_.trailing_metadata_disassembler_.GetBufferedLength(),
+                  0u);
+        frames_.emplace_back(
+            Http2RstStreamFrame{queue_.stream_id_, error_code_});
+      }
+    }
+
+    StreamDataQueue& queue_;
+    const uint32_t max_frame_length_;
+    const uint32_t max_fc_tokens_;
+    uint32_t fc_tokens_available_;
+    bool is_half_closed_ = false;
+    bool is_reset_stream_ = false;
+    uint32_t error_code_ = static_cast<uint32_t>(Http2ErrorCode::kNoError);
+    std::vector<Http2Frame> frames_;
+    HPackCompressor& encoder_;
+  };
+
+  // Returns true if the queue is now writable. It is expected that the caller
+  // will hold the lock on the queue when calling this function.
+  bool UpdateWritableStateLocked(const bool became_non_empty)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(mu_) {
+    if (!is_writable_ && became_non_empty) {
+      GRPC_STREAM_DATA_QUEUE_DEBUG << "Stream id: " << stream_id_
+                                   << " writeable state changed to true";
+      is_writable_ = true;
+      return true;
+    }
+    return false;
+  }
+
+  const uint32_t stream_id_;
+  const bool is_client_;
+
+  // Accessed only during enqueue.
+  bool is_initial_metadata_queued_ = false;
+  bool is_trailing_metadata_or_half_close_queued_ = false;
+  bool is_reset_stream_queued_ = false;
+
+  // Access both during enqueue and dequeue.
+  Mutex mu_;
+  bool is_writable_ ABSL_GUARDED_BY(mu_) = false;
+  SimpleQueue<QueueEntry> queue_;
+
+  // Accessed only during dequeue.
+  HeaderDisassembler initial_metadata_disassembler_;
+  HeaderDisassembler trailing_metadata_disassembler_;
+  GrpcMessageDisassembler message_disassembler_;
 };
 
 }  // namespace http2
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/writable_streams.h b/deps/grpc/src/core/ext/transport/chttp2/transport/writable_streams.h
new file mode 100644
index 00000000000..52e517fcaa6
--- /dev/null
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/writable_streams.h
@@ -0,0 +1,254 @@
+//
+//
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_WRITABLE_STREAMS_H
+#define GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_WRITABLE_STREAMS_H
+
+#include <queue>
+
+#include "absl/log/check.h"
+#include "absl/log/log.h"
+#include "src/core/lib/promise/if.h"
+#include "src/core/lib/promise/mpsc.h"
+#include "src/core/lib/promise/race.h"
+#include "src/core/lib/promise/try_seq.h"
+
+namespace grpc_core {
+namespace http2 {
+
+#define GRPC_WRITABLE_STREAMS_DEBUG VLOG(2)
+
+class WritableStreams {
+ public:
+  enum class StreamPriority : uint8_t {
+    // Highest priority
+    kStreamClosed = 0,
+    kWaitForTransportFlowControl,
+    // Lowest Priority
+    kDefault,
+    kLastPriority
+  };
+  explicit WritableStreams(
+      const uint32_t max_queue_size = std::numeric_limits<uint32_t>::max())
+      : queue_(max_queue_size), sender_(queue_.MakeSender()) {}
+
+  // WritableStreams is neither copyable nor movable.
+  WritableStreams(const WritableStreams&) = delete;
+  WritableStreams& operator=(const WritableStreams&) = delete;
+  WritableStreams(WritableStreams&&) = delete;
+  WritableStreams& operator=(WritableStreams&&) = delete;
+
+  // Enqueues a stream id with the given priority.
+  // If this returns error, transport MUST be closed.
+  absl::Status Enqueue(const uint32_t stream_id,
+                       const StreamPriority priority) {
+    // Streams waiting for transport flow control MUST not be added to list of
+    // writable streams via this API, instead they MUST be added via
+    // BlockedOnTransportFlowControl. The reason being there is no merit in
+    // re-adding the stream to mpsc queue while it can be immediately enqueued
+    // to the prioritized queue.
+    DCHECK(priority != StreamPriority::kWaitForTransportFlowControl);
+    StatusFlag status = sender_.UnbufferedImmediateSend(
+        StreamIDAndPriority{stream_id, priority}, /*tokens*/ 1);
+    GRPC_WRITABLE_STREAMS_DEBUG << "UnbufferedImmediateEnqueue stream id "
+                                << stream_id << " with priority "
+                                << GetPriorityString(priority) << " status "
+                                << status;
+    return (status.ok()) ? absl::OkStatus()
+                         : absl::InternalError(absl::StrCat(
+                               "Failed to enqueue stream id ", stream_id));
+  }
+
+  // A synchronous function to add a stream id to the transport flow control
+  // wait list.
+  absl::Status BlockedOnTransportFlowControl(const uint32_t stream_id) {
+    prioritized_queue_.Push(stream_id,
+                            StreamPriority::kWaitForTransportFlowControl);
+    GRPC_WRITABLE_STREAMS_DEBUG << "BlockedOnTransportFlowControl stream id "
+                                << stream_id;
+    return absl::OkStatus();
+  }
+
+  // Dequeues a single stream id from the queue.
+  // Returns a promise that resolves to the next stream id or an error if the
+  // dequeue fails. High level flow:
+  // 1. Synchronous dequeue from the mpsc queue to get a batch of stream ids.
+  // 2. If the batch is non-empty, the stream ids are pushed to the prioritized
+  //    queue.
+  // 3. If the prioritized queue is non-empty, the stream with the highest
+  //    priority is popped. If there are multiple stream ids with the same
+  //    priority, the stream enqueued first is popped first.
+  // 4. If the prioritized queue is empty, the mpsc queue is queried again for
+  //    a batch of stream ids. If the mpsc queue is empty, we block until a
+  //    stream id is enqueued.
+  // 5. Once mpsc dequeue promise is resolved, the stream ids are pushed to the
+  //    prioritized queue.
+  // 6. Return the stream id with the highest priority.
+  // If this returns error, transport MUST be closed.
+  auto Next(const bool transport_tokens_available) {
+    // TODO(akshitpatel) : [PH2][P2] - Need to add an immediate dequeue option
+    // for the mpsc queue in favor of the race.
+
+    return AssertResultType<absl::StatusOr<uint32_t>>(TrySeq(
+        // The current MPSC queue does not have a version of NextBatch that
+        // resolves immediately. So we made this Race to ensure that the
+        // "Dequeue" from the mpsc resolves immediately - Either with data , or
+        // empty.
+        Race(queue_.NextBatch(kMaxBatchSize),
+             Immediate(ValueOrFailure<std::vector<StreamIDAndPriority>>(
+                 std::vector<StreamIDAndPriority>()))),
+        [this,
+         transport_tokens_available](std::vector<StreamIDAndPriority> batch) {
+          AddToPrioritizedQueue(batch);
+          std::optional<uint32_t> stream_id =
+              prioritized_queue_.Pop(transport_tokens_available);
+          return If(
+              stream_id.has_value(),
+              [stream_id]() -> absl::StatusOr<uint32_t> {
+                GRPC_WRITABLE_STREAMS_DEBUG << "Next stream id "
+                                            << stream_id.value();
+                return stream_id.value();
+              },
+              [this, transport_tokens_available] {
+                GRPC_WRITABLE_STREAMS_DEBUG << "Query queue for next batch";
+                return Map(
+                    // PrioritizedQueue is empty at this point. Hence we block
+                    // on mpsc queue to get a new batch of stream ids.
+                    queue_.NextBatch(kMaxBatchSize),
+                    [this, transport_tokens_available](
+                        ValueOrFailure<std::vector<StreamIDAndPriority>> batch)
+                        -> absl::StatusOr<uint32_t> {
+                      if (batch.ok()) {
+                        GRPC_WRITABLE_STREAMS_DEBUG << "Next batch size "
+                                                    << batch.value().size();
+                        AddToPrioritizedQueue(batch.value());
+                        std::optional<uint32_t> stream_id =
+                            prioritized_queue_.Pop(transport_tokens_available);
+                        // TODO(akshitpatel) : [PH2][P4] - This DCHECK should
+                        // ideally be fine. But in case if queue_.NextBatch
+                        // spuriously returns an empty batch, move to a Loop
+                        // to avoid this.
+                        DCHECK(stream_id.has_value());
+                        GRPC_WRITABLE_STREAMS_DEBUG << "Next stream id "
+                                                    << stream_id.value();
+                        return stream_id.value();
+                      }
+                      return absl::InternalError("Failed to read from queue");
+                    });
+              });
+        }));
+  }
+
+  // Debug helper function to convert a StreamPriority to a string.
+  static inline std::string GetPriorityString(const StreamPriority priority) {
+    switch (priority) {
+      case StreamPriority::kStreamClosed:
+        return "StreamClosed";
+      case StreamPriority::kWaitForTransportFlowControl:
+        return "WaitForTransportFlowControl";
+      case StreamPriority::kDefault:
+        return "Default";
+      default:
+        return "unknown";
+    }
+  }
+
+ private:
+  class PrioritizedQueue {
+   public:
+    PrioritizedQueue() : buckets_(kLastPriority) {}
+
+    // Pushes a stream id with the given priority to the queue. Sorting is done
+    // based on the priority. If the priority is higher than the max priority,
+    // it will be set to the default priority.
+    void Push(const uint32_t stream_id, StreamPriority priority) {
+      if (priority >= StreamPriority::kLastPriority) {
+        priority = StreamPriority::kDefault;
+      }
+
+      GRPC_WRITABLE_STREAMS_DEBUG << "Pushing stream id " << stream_id
+                                  << " with priority "
+                                  << GetPriorityString(priority);
+      buckets_[static_cast<uint8_t>(priority)].push(stream_id);
+    }
+
+    // Pops a stream id from the queue based on the priority. If the priority is
+    // kWaitForTransportFlowControl, transport_tokens_available is checked to
+    // see if the stream id can be popped.
+    std::optional<uint32_t> Pop(const bool transport_tokens_available) {
+      for (uint8_t i = 0; i < buckets_.size(); ++i) {
+        auto& bucket = buckets_[i];
+        if (!bucket.empty()) {
+          if (i == kWaitForTransportFlowControlIndex &&
+              !transport_tokens_available) {
+            GRPC_WRITABLE_STREAMS_DEBUG
+                << "Transport tokens unavailable, skipping "
+                   "transport flow control wait list";
+            continue;
+          }
+
+          uint32_t stream_id = bucket.front();
+          bucket.pop();
+          GRPC_WRITABLE_STREAMS_DEBUG
+              << "Popping stream id " << stream_id << " from priority "
+              << GetPriorityString(static_cast<StreamPriority>(i));
+          return stream_id;
+        }
+      }
+      return std::nullopt;
+    }
+
+    static constexpr uint8_t kLastPriority =
+        static_cast<uint8_t>(StreamPriority::kLastPriority);
+    static constexpr uint8_t kWaitForTransportFlowControlIndex =
+        static_cast<uint8_t>(StreamPriority::kWaitForTransportFlowControl);
+    std::vector<std::queue<uint32_t>> buckets_;
+  };
+
+  struct StreamIDAndPriority {
+    const uint32_t stream_id;
+    const StreamPriority priority;
+  };
+
+  void AddToPrioritizedQueue(const std::vector<StreamIDAndPriority>& batch) {
+    for (auto stream_id_priority : batch) {
+      prioritized_queue_.Push(stream_id_priority.stream_id,
+                              stream_id_priority.priority);
+    }
+  }
+
+  // TODO(akshitpatel) : [PH2][P4] - Verify if this works for large number of
+  // active streams based on the load tests. The reasoning to use max uint32_t
+  // is that even when the streams are dequeued from the queue, the streams
+  // will only be marked as non-writable after stream data queue dequeue
+  // happens. With this said, it should not matter whether the streams are
+  // kept in mpsc queue or in the PriorityQueue. Additionally, having all
+  // the writable streams in the PriorityQueue will return streams based on
+  // a more recent enqueue snapshot.
+  static constexpr uint32_t kMaxBatchSize =
+      std::numeric_limits<uint32_t>::max();
+
+  MpscReceiver<StreamIDAndPriority> queue_;
+  MpscSender<StreamIDAndPriority> sender_;
+  PrioritizedQueue prioritized_queue_;
+};
+
+}  // namespace http2
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_EXT_TRANSPORT_CHTTP2_TRANSPORT_WRITABLE_STREAMS_H
diff --git a/deps/grpc/src/core/ext/transport/chttp2/transport/writing.cc b/deps/grpc/src/core/ext/transport/chttp2/transport/writing.cc
index 5768bc043b5..96aafa80363 100644
--- a/deps/grpc/src/core/ext/transport/chttp2/transport/writing.cc
+++ b/deps/grpc/src/core/ext/transport/chttp2/transport/writing.cc
@@ -693,7 +693,7 @@ class StreamWriteContext {
 
 grpc_chttp2_begin_write_result grpc_chttp2_begin_write(
     grpc_chttp2_transport* t) {
-  GRPC_LATENT_SEE_INNER_SCOPE("grpc_chttp2_begin_write");
+  GRPC_LATENT_SEE_SCOPE("grpc_chttp2_begin_write");
 
   int64_t outbuf_relative_start_pos = 0;
   WriteContext ctx(t);
@@ -738,8 +738,10 @@ grpc_chttp2_begin_write_result grpc_chttp2_begin_write(
                    grpc_event_engine::experimental::
                        grpc_is_event_engine_endpoint(t->ep.get())) {
           // New way of collecting TCP traces
-          ctx.AddTcpCallTracer(s->call_tracer->StartNewTcpTrace(),
-                               s->byte_counter);
+          auto tcp_call_tracer = s->call_tracer->StartNewTcpTrace();
+          if (tcp_call_tracer != nullptr) {
+            ctx.AddTcpCallTracer(std::move(tcp_call_tracer), s->byte_counter);
+          }
         }
       }
       outbuf_relative_start_pos += num_stream_bytes;
@@ -766,7 +768,7 @@ grpc_chttp2_begin_write_result grpc_chttp2_begin_write(
 }
 
 void grpc_chttp2_end_write(grpc_chttp2_transport* t, grpc_error_handle error) {
-  GRPC_LATENT_SEE_INNER_SCOPE("grpc_chttp2_end_write");
+  GRPC_LATENT_SEE_SCOPE("grpc_chttp2_end_write");
   grpc_chttp2_stream* s;
 
   t->write_flow.End();
diff --git a/deps/grpc/src/core/ext/transport/inproc/GEMINI.md b/deps/grpc/src/core/ext/transport/inproc/GEMINI.md
new file mode 100644
index 00000000000..017296c31f4
--- /dev/null
+++ b/deps/grpc/src/core/ext/transport/inproc/GEMINI.md
@@ -0,0 +1,26 @@
+# In-Process Transport
+
+This directory contains an in-process transport implementation for gRPC.
+
+See also: [gRPC Transports overview](../../transport/GEMINI.md)
+
+## Overarching Purpose
+
+The in-process transport provides a mechanism for a client and server to communicate within the same process. This is primarily used for testing purposes, as it allows for end-to-end testing of gRPC applications without the need for a network connection. It can also be useful for building tightly-coupled services that need to communicate with each other in a low-latency, high-performance way.
+
+## Files
+
+*   `inproc_transport.h`, `inproc_transport.cc`: These files contain the modern, `Transport`-based implementation of the in-process transport. This is the recommended implementation for new code.
+*   `legacy_inproc_transport.h`, `legacy_inproc_transport.cc`: These files contain the legacy implementation of the in-process transport. This implementation is preserved for backwards compatibility.
+
+## Major Functions
+
+*   `grpc_core::MakeInProcessTransportPair`: Creates a pair of connected in-process transports. This is the main entry point for the modern implementation.
+*   `grpc_inproc_channel_create`: Creates an in-process channel. This is a convenience function that wraps `MakeInProcessTransportPair`.
+*   `grpc_legacy_inproc_channel_create`: Creates a legacy in-process channel. This is the main entry point for the legacy implementation.
+
+## Notes
+
+*   The in-process transport is a powerful tool for testing gRPC applications. It allows for fast and reliable end-to-end testing without the overhead of a network connection.
+*   The modern implementation of the in-process transport is a good example of how to implement a custom transport for gRPC. It is a relatively simple transport, and it demonstrates how to use the core transport APIs to send and receive messages.
+*   When using the in-process transport, the client and server are running in the same process, so they can share the same memory. This means that there is no need to serialize and deserialize messages, which can lead to significant performance improvements.
diff --git a/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/channelz.upb.h b/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/channelz.upb.h
new file mode 100644
index 00000000000..47db1453496
--- /dev/null
+++ b/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/channelz.upb.h
@@ -0,0 +1,4959 @@
+/* This file was generated by upb_generator from the input file:
+ *
+ *     src/proto/grpc/channelz/channelz.proto
+ *
+ * Do not edit -- your changes will be discarded when the file is
+ * regenerated.
+ * NO CHECKED-IN PROTOBUF GENCODE */
+
+#ifndef SRC_PROTO_GRPC_CHANNELZ_CHANNELZ_PROTO_UPB_H__UPB_H_
+#define SRC_PROTO_GRPC_CHANNELZ_CHANNELZ_PROTO_UPB_H__UPB_H_
+
+#include "upb/generated_code_support.h"
+
+#include "src/proto/grpc/channelz/channelz.upb_minitable.h"
+
+#include "google/protobuf/any.upb_minitable.h"
+#include "google/protobuf/duration.upb_minitable.h"
+#include "google/protobuf/timestamp.upb_minitable.h"
+#include "google/protobuf/wrappers.upb_minitable.h"
+
+// Must be last.
+#include "upb/port/def.inc"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+typedef struct grpc_channelz_v1_Channel { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_Channel;
+typedef struct grpc_channelz_v1_Subchannel { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_Subchannel;
+typedef struct grpc_channelz_v1_ChannelConnectivityState { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_ChannelConnectivityState;
+typedef struct grpc_channelz_v1_ChannelData { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_ChannelData;
+typedef struct grpc_channelz_v1_ChannelTraceEvent { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_ChannelTraceEvent;
+typedef struct grpc_channelz_v1_ChannelTrace { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_ChannelTrace;
+typedef struct grpc_channelz_v1_ChannelRef { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_ChannelRef;
+typedef struct grpc_channelz_v1_SubchannelRef { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_SubchannelRef;
+typedef struct grpc_channelz_v1_SocketRef { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_SocketRef;
+typedef struct grpc_channelz_v1_ServerRef { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_ServerRef;
+typedef struct grpc_channelz_v1_Server { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_Server;
+typedef struct grpc_channelz_v1_ServerData { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_ServerData;
+typedef struct grpc_channelz_v1_Socket { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_Socket;
+typedef struct grpc_channelz_v1_SocketData { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_SocketData;
+typedef struct grpc_channelz_v1_Address { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_Address;
+typedef struct grpc_channelz_v1_Address_TcpIpAddress { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_Address_TcpIpAddress;
+typedef struct grpc_channelz_v1_Address_UdsAddress { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_Address_UdsAddress;
+typedef struct grpc_channelz_v1_Address_OtherAddress { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_Address_OtherAddress;
+typedef struct grpc_channelz_v1_Security { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_Security;
+typedef struct grpc_channelz_v1_Security_Tls { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_Security_Tls;
+typedef struct grpc_channelz_v1_Security_OtherSecurity { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_Security_OtherSecurity;
+typedef struct grpc_channelz_v1_SocketOption { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_SocketOption;
+typedef struct grpc_channelz_v1_SocketOptionTimeout { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_SocketOptionTimeout;
+typedef struct grpc_channelz_v1_SocketOptionLinger { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_SocketOptionLinger;
+typedef struct grpc_channelz_v1_SocketOptionTcpInfo { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_SocketOptionTcpInfo;
+typedef struct grpc_channelz_v1_GetTopChannelsRequest { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetTopChannelsRequest;
+typedef struct grpc_channelz_v1_GetTopChannelsResponse { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetTopChannelsResponse;
+typedef struct grpc_channelz_v1_GetServersRequest { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetServersRequest;
+typedef struct grpc_channelz_v1_GetServersResponse { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetServersResponse;
+typedef struct grpc_channelz_v1_GetServerRequest { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetServerRequest;
+typedef struct grpc_channelz_v1_GetServerResponse { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetServerResponse;
+typedef struct grpc_channelz_v1_GetServerSocketsRequest { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetServerSocketsRequest;
+typedef struct grpc_channelz_v1_GetServerSocketsResponse { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetServerSocketsResponse;
+typedef struct grpc_channelz_v1_GetChannelRequest { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetChannelRequest;
+typedef struct grpc_channelz_v1_GetChannelResponse { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetChannelResponse;
+typedef struct grpc_channelz_v1_GetSubchannelRequest { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetSubchannelRequest;
+typedef struct grpc_channelz_v1_GetSubchannelResponse { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetSubchannelResponse;
+typedef struct grpc_channelz_v1_GetSocketRequest { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetSocketRequest;
+typedef struct grpc_channelz_v1_GetSocketResponse { upb_Message UPB_PRIVATE(base); } grpc_channelz_v1_GetSocketResponse;
+struct google_protobuf_Any;
+struct google_protobuf_Duration;
+struct google_protobuf_Int64Value;
+struct google_protobuf_Timestamp;
+
+typedef enum {
+  grpc_channelz_v1_ChannelConnectivityState_UNKNOWN = 0,
+  grpc_channelz_v1_ChannelConnectivityState_IDLE = 1,
+  grpc_channelz_v1_ChannelConnectivityState_CONNECTING = 2,
+  grpc_channelz_v1_ChannelConnectivityState_READY = 3,
+  grpc_channelz_v1_ChannelConnectivityState_TRANSIENT_FAILURE = 4,
+  grpc_channelz_v1_ChannelConnectivityState_SHUTDOWN = 5
+} grpc_channelz_v1_ChannelConnectivityState_State;
+
+typedef enum {
+  grpc_channelz_v1_ChannelTraceEvent_CT_UNKNOWN = 0,
+  grpc_channelz_v1_ChannelTraceEvent_CT_INFO = 1,
+  grpc_channelz_v1_ChannelTraceEvent_CT_WARNING = 2,
+  grpc_channelz_v1_ChannelTraceEvent_CT_ERROR = 3
+} grpc_channelz_v1_ChannelTraceEvent_Severity;
+
+
+
+/* grpc.channelz.v1.Channel */
+
+UPB_INLINE grpc_channelz_v1_Channel* grpc_channelz_v1_Channel_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_Channel*)_upb_Message_New(&grpc__channelz__v1__Channel_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_Channel* grpc_channelz_v1_Channel_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_Channel* ret = grpc_channelz_v1_Channel_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Channel_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_Channel* grpc_channelz_v1_Channel_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_Channel* ret = grpc_channelz_v1_Channel_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Channel_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_Channel_serialize(const grpc_channelz_v1_Channel* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Channel_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_Channel_serialize_ex(const grpc_channelz_v1_Channel* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Channel_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_Channel_clear_ref(grpc_channelz_v1_Channel* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_ChannelRef* grpc_channelz_v1_Channel_ref(const grpc_channelz_v1_Channel* msg) {
+  const grpc_channelz_v1_ChannelRef* default_val = NULL;
+  const grpc_channelz_v1_ChannelRef* ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Channel_has_ref(const grpc_channelz_v1_Channel* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Channel_clear_data(grpc_channelz_v1_Channel* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_ChannelData* grpc_channelz_v1_Channel_data(const grpc_channelz_v1_Channel* msg) {
+  const grpc_channelz_v1_ChannelData* default_val = NULL;
+  const grpc_channelz_v1_ChannelData* ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelData_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Channel_has_data(const grpc_channelz_v1_Channel* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Channel_clear_channel_ref(grpc_channelz_v1_Channel* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_ChannelRef* const* grpc_channelz_v1_Channel_channel_ref(const grpc_channelz_v1_Channel* msg, size_t* size) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (const grpc_channelz_v1_ChannelRef* const*)upb_Array_DataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE const upb_Array* _grpc_channelz_v1_Channel_channel_ref_upb_array(const grpc_channelz_v1_Channel* msg, size_t* size) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE upb_Array* _grpc_channelz_v1_Channel_channel_ref_mutable_upb_array(grpc_channelz_v1_Channel* msg, size_t* size, upb_Arena* arena) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(UPB_UPCAST(msg),
+                                                       &field, arena);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE void grpc_channelz_v1_Channel_clear_subchannel_ref(grpc_channelz_v1_Channel* msg) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_SubchannelRef* const* grpc_channelz_v1_Channel_subchannel_ref(const grpc_channelz_v1_Channel* msg, size_t* size) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (const grpc_channelz_v1_SubchannelRef* const*)upb_Array_DataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE const upb_Array* _grpc_channelz_v1_Channel_subchannel_ref_upb_array(const grpc_channelz_v1_Channel* msg, size_t* size) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE upb_Array* _grpc_channelz_v1_Channel_subchannel_ref_mutable_upb_array(grpc_channelz_v1_Channel* msg, size_t* size, upb_Arena* arena) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(UPB_UPCAST(msg),
+                                                       &field, arena);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE void grpc_channelz_v1_Channel_clear_socket_ref(grpc_channelz_v1_Channel* msg) {
+  const upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_SocketRef* const* grpc_channelz_v1_Channel_socket_ref(const grpc_channelz_v1_Channel* msg, size_t* size) {
+  const upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (const grpc_channelz_v1_SocketRef* const*)upb_Array_DataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE const upb_Array* _grpc_channelz_v1_Channel_socket_ref_upb_array(const grpc_channelz_v1_Channel* msg, size_t* size) {
+  const upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE upb_Array* _grpc_channelz_v1_Channel_socket_ref_mutable_upb_array(grpc_channelz_v1_Channel* msg, size_t* size, upb_Arena* arena) {
+  const upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(UPB_UPCAST(msg),
+                                                       &field, arena);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+
+UPB_INLINE void grpc_channelz_v1_Channel_set_ref(grpc_channelz_v1_Channel *msg, grpc_channelz_v1_ChannelRef* value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_ChannelRef* grpc_channelz_v1_Channel_mutable_ref(grpc_channelz_v1_Channel* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_ChannelRef* sub = (struct grpc_channelz_v1_ChannelRef*)grpc_channelz_v1_Channel_ref(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_ChannelRef*)_upb_Message_New(&grpc__channelz__v1__ChannelRef_msg_init, arena);
+    if (sub) grpc_channelz_v1_Channel_set_ref(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_Channel_set_data(grpc_channelz_v1_Channel *msg, grpc_channelz_v1_ChannelData* value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelData_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_ChannelData* grpc_channelz_v1_Channel_mutable_data(grpc_channelz_v1_Channel* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_ChannelData* sub = (struct grpc_channelz_v1_ChannelData*)grpc_channelz_v1_Channel_data(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_ChannelData*)_upb_Message_New(&grpc__channelz__v1__ChannelData_msg_init, arena);
+    if (sub) grpc_channelz_v1_Channel_set_data(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE grpc_channelz_v1_ChannelRef** grpc_channelz_v1_Channel_mutable_channel_ref(grpc_channelz_v1_Channel* msg, size_t* size) {
+  upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  upb_Array* arr = upb_Message_GetMutableArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (grpc_channelz_v1_ChannelRef**)upb_Array_MutableDataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE grpc_channelz_v1_ChannelRef** grpc_channelz_v1_Channel_resize_channel_ref(grpc_channelz_v1_Channel* msg, size_t size, upb_Arena* arena) {
+  upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_ChannelRef**)upb_Message_ResizeArrayUninitialized(UPB_UPCAST(msg),
+                                                   &field, size, arena);
+}
+UPB_INLINE struct grpc_channelz_v1_ChannelRef* grpc_channelz_v1_Channel_add_channel_ref(grpc_channelz_v1_Channel* msg, upb_Arena* arena) {
+  upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(
+      UPB_UPCAST(msg), &field, arena);
+  if (!arr || !UPB_PRIVATE(_upb_Array_ResizeUninitialized)(
+                  arr, arr->UPB_PRIVATE(size) + 1, arena)) {
+    return NULL;
+  }
+  struct grpc_channelz_v1_ChannelRef* sub = (struct grpc_channelz_v1_ChannelRef*)_upb_Message_New(&grpc__channelz__v1__ChannelRef_msg_init, arena);
+  if (!arr || !sub) return NULL;
+  UPB_PRIVATE(_upb_Array_Set)
+  (arr, arr->UPB_PRIVATE(size) - 1, &sub, sizeof(sub));
+  return sub;
+}
+UPB_INLINE grpc_channelz_v1_SubchannelRef** grpc_channelz_v1_Channel_mutable_subchannel_ref(grpc_channelz_v1_Channel* msg, size_t* size) {
+  upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  upb_Array* arr = upb_Message_GetMutableArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (grpc_channelz_v1_SubchannelRef**)upb_Array_MutableDataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE grpc_channelz_v1_SubchannelRef** grpc_channelz_v1_Channel_resize_subchannel_ref(grpc_channelz_v1_Channel* msg, size_t size, upb_Arena* arena) {
+  upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_SubchannelRef**)upb_Message_ResizeArrayUninitialized(UPB_UPCAST(msg),
+                                                   &field, size, arena);
+}
+UPB_INLINE struct grpc_channelz_v1_SubchannelRef* grpc_channelz_v1_Channel_add_subchannel_ref(grpc_channelz_v1_Channel* msg, upb_Arena* arena) {
+  upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(
+      UPB_UPCAST(msg), &field, arena);
+  if (!arr || !UPB_PRIVATE(_upb_Array_ResizeUninitialized)(
+                  arr, arr->UPB_PRIVATE(size) + 1, arena)) {
+    return NULL;
+  }
+  struct grpc_channelz_v1_SubchannelRef* sub = (struct grpc_channelz_v1_SubchannelRef*)_upb_Message_New(&grpc__channelz__v1__SubchannelRef_msg_init, arena);
+  if (!arr || !sub) return NULL;
+  UPB_PRIVATE(_upb_Array_Set)
+  (arr, arr->UPB_PRIVATE(size) - 1, &sub, sizeof(sub));
+  return sub;
+}
+UPB_INLINE grpc_channelz_v1_SocketRef** grpc_channelz_v1_Channel_mutable_socket_ref(grpc_channelz_v1_Channel* msg, size_t* size) {
+  upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  upb_Array* arr = upb_Message_GetMutableArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (grpc_channelz_v1_SocketRef**)upb_Array_MutableDataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE grpc_channelz_v1_SocketRef** grpc_channelz_v1_Channel_resize_socket_ref(grpc_channelz_v1_Channel* msg, size_t size, upb_Arena* arena) {
+  upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_SocketRef**)upb_Message_ResizeArrayUninitialized(UPB_UPCAST(msg),
+                                                   &field, size, arena);
+}
+UPB_INLINE struct grpc_channelz_v1_SocketRef* grpc_channelz_v1_Channel_add_socket_ref(grpc_channelz_v1_Channel* msg, upb_Arena* arena) {
+  upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(
+      UPB_UPCAST(msg), &field, arena);
+  if (!arr || !UPB_PRIVATE(_upb_Array_ResizeUninitialized)(
+                  arr, arr->UPB_PRIVATE(size) + 1, arena)) {
+    return NULL;
+  }
+  struct grpc_channelz_v1_SocketRef* sub = (struct grpc_channelz_v1_SocketRef*)_upb_Message_New(&grpc__channelz__v1__SocketRef_msg_init, arena);
+  if (!arr || !sub) return NULL;
+  UPB_PRIVATE(_upb_Array_Set)
+  (arr, arr->UPB_PRIVATE(size) - 1, &sub, sizeof(sub));
+  return sub;
+}
+
+/* grpc.channelz.v1.Subchannel */
+
+UPB_INLINE grpc_channelz_v1_Subchannel* grpc_channelz_v1_Subchannel_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_Subchannel*)_upb_Message_New(&grpc__channelz__v1__Subchannel_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_Subchannel* grpc_channelz_v1_Subchannel_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_Subchannel* ret = grpc_channelz_v1_Subchannel_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Subchannel_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_Subchannel* grpc_channelz_v1_Subchannel_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_Subchannel* ret = grpc_channelz_v1_Subchannel_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Subchannel_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_Subchannel_serialize(const grpc_channelz_v1_Subchannel* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Subchannel_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_Subchannel_serialize_ex(const grpc_channelz_v1_Subchannel* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Subchannel_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_Subchannel_clear_ref(grpc_channelz_v1_Subchannel* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_SubchannelRef* grpc_channelz_v1_Subchannel_ref(const grpc_channelz_v1_Subchannel* msg) {
+  const grpc_channelz_v1_SubchannelRef* default_val = NULL;
+  const grpc_channelz_v1_SubchannelRef* ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Subchannel_has_ref(const grpc_channelz_v1_Subchannel* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Subchannel_clear_data(grpc_channelz_v1_Subchannel* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_ChannelData* grpc_channelz_v1_Subchannel_data(const grpc_channelz_v1_Subchannel* msg) {
+  const grpc_channelz_v1_ChannelData* default_val = NULL;
+  const grpc_channelz_v1_ChannelData* ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelData_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Subchannel_has_data(const grpc_channelz_v1_Subchannel* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Subchannel_clear_channel_ref(grpc_channelz_v1_Subchannel* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_ChannelRef* const* grpc_channelz_v1_Subchannel_channel_ref(const grpc_channelz_v1_Subchannel* msg, size_t* size) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (const grpc_channelz_v1_ChannelRef* const*)upb_Array_DataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE const upb_Array* _grpc_channelz_v1_Subchannel_channel_ref_upb_array(const grpc_channelz_v1_Subchannel* msg, size_t* size) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE upb_Array* _grpc_channelz_v1_Subchannel_channel_ref_mutable_upb_array(grpc_channelz_v1_Subchannel* msg, size_t* size, upb_Arena* arena) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(UPB_UPCAST(msg),
+                                                       &field, arena);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE void grpc_channelz_v1_Subchannel_clear_subchannel_ref(grpc_channelz_v1_Subchannel* msg) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_SubchannelRef* const* grpc_channelz_v1_Subchannel_subchannel_ref(const grpc_channelz_v1_Subchannel* msg, size_t* size) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (const grpc_channelz_v1_SubchannelRef* const*)upb_Array_DataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE const upb_Array* _grpc_channelz_v1_Subchannel_subchannel_ref_upb_array(const grpc_channelz_v1_Subchannel* msg, size_t* size) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE upb_Array* _grpc_channelz_v1_Subchannel_subchannel_ref_mutable_upb_array(grpc_channelz_v1_Subchannel* msg, size_t* size, upb_Arena* arena) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(UPB_UPCAST(msg),
+                                                       &field, arena);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE void grpc_channelz_v1_Subchannel_clear_socket_ref(grpc_channelz_v1_Subchannel* msg) {
+  const upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_SocketRef* const* grpc_channelz_v1_Subchannel_socket_ref(const grpc_channelz_v1_Subchannel* msg, size_t* size) {
+  const upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (const grpc_channelz_v1_SocketRef* const*)upb_Array_DataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE const upb_Array* _grpc_channelz_v1_Subchannel_socket_ref_upb_array(const grpc_channelz_v1_Subchannel* msg, size_t* size) {
+  const upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE upb_Array* _grpc_channelz_v1_Subchannel_socket_ref_mutable_upb_array(grpc_channelz_v1_Subchannel* msg, size_t* size, upb_Arena* arena) {
+  const upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(UPB_UPCAST(msg),
+                                                       &field, arena);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+
+UPB_INLINE void grpc_channelz_v1_Subchannel_set_ref(grpc_channelz_v1_Subchannel *msg, grpc_channelz_v1_SubchannelRef* value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_SubchannelRef* grpc_channelz_v1_Subchannel_mutable_ref(grpc_channelz_v1_Subchannel* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_SubchannelRef* sub = (struct grpc_channelz_v1_SubchannelRef*)grpc_channelz_v1_Subchannel_ref(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_SubchannelRef*)_upb_Message_New(&grpc__channelz__v1__SubchannelRef_msg_init, arena);
+    if (sub) grpc_channelz_v1_Subchannel_set_ref(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_Subchannel_set_data(grpc_channelz_v1_Subchannel *msg, grpc_channelz_v1_ChannelData* value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelData_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_ChannelData* grpc_channelz_v1_Subchannel_mutable_data(grpc_channelz_v1_Subchannel* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_ChannelData* sub = (struct grpc_channelz_v1_ChannelData*)grpc_channelz_v1_Subchannel_data(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_ChannelData*)_upb_Message_New(&grpc__channelz__v1__ChannelData_msg_init, arena);
+    if (sub) grpc_channelz_v1_Subchannel_set_data(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE grpc_channelz_v1_ChannelRef** grpc_channelz_v1_Subchannel_mutable_channel_ref(grpc_channelz_v1_Subchannel* msg, size_t* size) {
+  upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  upb_Array* arr = upb_Message_GetMutableArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (grpc_channelz_v1_ChannelRef**)upb_Array_MutableDataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE grpc_channelz_v1_ChannelRef** grpc_channelz_v1_Subchannel_resize_channel_ref(grpc_channelz_v1_Subchannel* msg, size_t size, upb_Arena* arena) {
+  upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_ChannelRef**)upb_Message_ResizeArrayUninitialized(UPB_UPCAST(msg),
+                                                   &field, size, arena);
+}
+UPB_INLINE struct grpc_channelz_v1_ChannelRef* grpc_channelz_v1_Subchannel_add_channel_ref(grpc_channelz_v1_Subchannel* msg, upb_Arena* arena) {
+  upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(
+      UPB_UPCAST(msg), &field, arena);
+  if (!arr || !UPB_PRIVATE(_upb_Array_ResizeUninitialized)(
+                  arr, arr->UPB_PRIVATE(size) + 1, arena)) {
+    return NULL;
+  }
+  struct grpc_channelz_v1_ChannelRef* sub = (struct grpc_channelz_v1_ChannelRef*)_upb_Message_New(&grpc__channelz__v1__ChannelRef_msg_init, arena);
+  if (!arr || !sub) return NULL;
+  UPB_PRIVATE(_upb_Array_Set)
+  (arr, arr->UPB_PRIVATE(size) - 1, &sub, sizeof(sub));
+  return sub;
+}
+UPB_INLINE grpc_channelz_v1_SubchannelRef** grpc_channelz_v1_Subchannel_mutable_subchannel_ref(grpc_channelz_v1_Subchannel* msg, size_t* size) {
+  upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  upb_Array* arr = upb_Message_GetMutableArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (grpc_channelz_v1_SubchannelRef**)upb_Array_MutableDataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE grpc_channelz_v1_SubchannelRef** grpc_channelz_v1_Subchannel_resize_subchannel_ref(grpc_channelz_v1_Subchannel* msg, size_t size, upb_Arena* arena) {
+  upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_SubchannelRef**)upb_Message_ResizeArrayUninitialized(UPB_UPCAST(msg),
+                                                   &field, size, arena);
+}
+UPB_INLINE struct grpc_channelz_v1_SubchannelRef* grpc_channelz_v1_Subchannel_add_subchannel_ref(grpc_channelz_v1_Subchannel* msg, upb_Arena* arena) {
+  upb_MiniTableField field = {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(
+      UPB_UPCAST(msg), &field, arena);
+  if (!arr || !UPB_PRIVATE(_upb_Array_ResizeUninitialized)(
+                  arr, arr->UPB_PRIVATE(size) + 1, arena)) {
+    return NULL;
+  }
+  struct grpc_channelz_v1_SubchannelRef* sub = (struct grpc_channelz_v1_SubchannelRef*)_upb_Message_New(&grpc__channelz__v1__SubchannelRef_msg_init, arena);
+  if (!arr || !sub) return NULL;
+  UPB_PRIVATE(_upb_Array_Set)
+  (arr, arr->UPB_PRIVATE(size) - 1, &sub, sizeof(sub));
+  return sub;
+}
+UPB_INLINE grpc_channelz_v1_SocketRef** grpc_channelz_v1_Subchannel_mutable_socket_ref(grpc_channelz_v1_Subchannel* msg, size_t* size) {
+  upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  upb_Array* arr = upb_Message_GetMutableArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (grpc_channelz_v1_SocketRef**)upb_Array_MutableDataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE grpc_channelz_v1_SocketRef** grpc_channelz_v1_Subchannel_resize_socket_ref(grpc_channelz_v1_Subchannel* msg, size_t size, upb_Arena* arena) {
+  upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_SocketRef**)upb_Message_ResizeArrayUninitialized(UPB_UPCAST(msg),
+                                                   &field, size, arena);
+}
+UPB_INLINE struct grpc_channelz_v1_SocketRef* grpc_channelz_v1_Subchannel_add_socket_ref(grpc_channelz_v1_Subchannel* msg, upb_Arena* arena) {
+  upb_MiniTableField field = {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(
+      UPB_UPCAST(msg), &field, arena);
+  if (!arr || !UPB_PRIVATE(_upb_Array_ResizeUninitialized)(
+                  arr, arr->UPB_PRIVATE(size) + 1, arena)) {
+    return NULL;
+  }
+  struct grpc_channelz_v1_SocketRef* sub = (struct grpc_channelz_v1_SocketRef*)_upb_Message_New(&grpc__channelz__v1__SocketRef_msg_init, arena);
+  if (!arr || !sub) return NULL;
+  UPB_PRIVATE(_upb_Array_Set)
+  (arr, arr->UPB_PRIVATE(size) - 1, &sub, sizeof(sub));
+  return sub;
+}
+
+/* grpc.channelz.v1.ChannelConnectivityState */
+
+UPB_INLINE grpc_channelz_v1_ChannelConnectivityState* grpc_channelz_v1_ChannelConnectivityState_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_ChannelConnectivityState*)_upb_Message_New(&grpc__channelz__v1__ChannelConnectivityState_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_ChannelConnectivityState* grpc_channelz_v1_ChannelConnectivityState_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_ChannelConnectivityState* ret = grpc_channelz_v1_ChannelConnectivityState_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ChannelConnectivityState_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_ChannelConnectivityState* grpc_channelz_v1_ChannelConnectivityState_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_ChannelConnectivityState* ret = grpc_channelz_v1_ChannelConnectivityState_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ChannelConnectivityState_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_ChannelConnectivityState_serialize(const grpc_channelz_v1_ChannelConnectivityState* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ChannelConnectivityState_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_ChannelConnectivityState_serialize_ex(const grpc_channelz_v1_ChannelConnectivityState* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ChannelConnectivityState_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelConnectivityState_clear_state(grpc_channelz_v1_ChannelConnectivityState* msg) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 5, (int)kUpb_FieldMode_Scalar | (int)kUpb_LabelFlags_IsAlternate | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int32_t grpc_channelz_v1_ChannelConnectivityState_state(const grpc_channelz_v1_ChannelConnectivityState* msg) {
+  int32_t default_val = 0;
+  int32_t ret;
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 5, (int)kUpb_FieldMode_Scalar | (int)kUpb_LabelFlags_IsAlternate | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_ChannelConnectivityState_set_state(grpc_channelz_v1_ChannelConnectivityState *msg, int32_t value) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 5, (int)kUpb_FieldMode_Scalar | (int)kUpb_LabelFlags_IsAlternate | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.ChannelData */
+
+UPB_INLINE grpc_channelz_v1_ChannelData* grpc_channelz_v1_ChannelData_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_ChannelData*)_upb_Message_New(&grpc__channelz__v1__ChannelData_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_ChannelData* grpc_channelz_v1_ChannelData_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_ChannelData* ret = grpc_channelz_v1_ChannelData_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ChannelData_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_ChannelData* grpc_channelz_v1_ChannelData_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_ChannelData* ret = grpc_channelz_v1_ChannelData_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ChannelData_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_ChannelData_serialize(const grpc_channelz_v1_ChannelData* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ChannelData_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_ChannelData_serialize_ex(const grpc_channelz_v1_ChannelData* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ChannelData_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelData_clear_state(grpc_channelz_v1_ChannelData* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_ChannelConnectivityState* grpc_channelz_v1_ChannelData_state(const grpc_channelz_v1_ChannelData* msg) {
+  const grpc_channelz_v1_ChannelConnectivityState* default_val = NULL;
+  const grpc_channelz_v1_ChannelConnectivityState* ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelConnectivityState_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_ChannelData_has_state(const grpc_channelz_v1_ChannelData* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelData_clear_target(grpc_channelz_v1_ChannelData* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(24, 16), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_ChannelData_target(const grpc_channelz_v1_ChannelData* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(24, 16), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelData_clear_trace(grpc_channelz_v1_ChannelData* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 40), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_ChannelTrace* grpc_channelz_v1_ChannelData_trace(const grpc_channelz_v1_ChannelData* msg) {
+  const grpc_channelz_v1_ChannelTrace* default_val = NULL;
+  const grpc_channelz_v1_ChannelTrace* ret;
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 40), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelTrace_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_ChannelData_has_trace(const grpc_channelz_v1_ChannelData* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 40), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelData_clear_calls_started(grpc_channelz_v1_ChannelData* msg) {
+  const upb_MiniTableField field = {4, UPB_SIZE(32, 48), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_ChannelData_calls_started(const grpc_channelz_v1_ChannelData* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {4, UPB_SIZE(32, 48), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelData_clear_calls_succeeded(grpc_channelz_v1_ChannelData* msg) {
+  const upb_MiniTableField field = {5, UPB_SIZE(40, 56), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_ChannelData_calls_succeeded(const grpc_channelz_v1_ChannelData* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {5, UPB_SIZE(40, 56), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelData_clear_calls_failed(grpc_channelz_v1_ChannelData* msg) {
+  const upb_MiniTableField field = {6, UPB_SIZE(48, 64), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_ChannelData_calls_failed(const grpc_channelz_v1_ChannelData* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {6, UPB_SIZE(48, 64), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelData_clear_last_call_started_timestamp(grpc_channelz_v1_ChannelData* msg) {
+  const upb_MiniTableField field = {7, UPB_SIZE(20, 72), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Timestamp* grpc_channelz_v1_ChannelData_last_call_started_timestamp(const grpc_channelz_v1_ChannelData* msg) {
+  const struct google_protobuf_Timestamp* default_val = NULL;
+  const struct google_protobuf_Timestamp* ret;
+  const upb_MiniTableField field = {7, UPB_SIZE(20, 72), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_ChannelData_has_last_call_started_timestamp(const grpc_channelz_v1_ChannelData* msg) {
+  const upb_MiniTableField field = {7, UPB_SIZE(20, 72), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_ChannelData_set_state(grpc_channelz_v1_ChannelData *msg, grpc_channelz_v1_ChannelConnectivityState* value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelConnectivityState_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_ChannelConnectivityState* grpc_channelz_v1_ChannelData_mutable_state(grpc_channelz_v1_ChannelData* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_ChannelConnectivityState* sub = (struct grpc_channelz_v1_ChannelConnectivityState*)grpc_channelz_v1_ChannelData_state(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_ChannelConnectivityState*)_upb_Message_New(&grpc__channelz__v1__ChannelConnectivityState_msg_init, arena);
+    if (sub) grpc_channelz_v1_ChannelData_set_state(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelData_set_target(grpc_channelz_v1_ChannelData *msg, upb_StringView value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(24, 16), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelData_set_trace(grpc_channelz_v1_ChannelData *msg, grpc_channelz_v1_ChannelTrace* value) {
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 40), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelTrace_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_ChannelTrace* grpc_channelz_v1_ChannelData_mutable_trace(grpc_channelz_v1_ChannelData* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_ChannelTrace* sub = (struct grpc_channelz_v1_ChannelTrace*)grpc_channelz_v1_ChannelData_trace(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_ChannelTrace*)_upb_Message_New(&grpc__channelz__v1__ChannelTrace_msg_init, arena);
+    if (sub) grpc_channelz_v1_ChannelData_set_trace(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelData_set_calls_started(grpc_channelz_v1_ChannelData *msg, int64_t value) {
+  const upb_MiniTableField field = {4, UPB_SIZE(32, 48), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelData_set_calls_succeeded(grpc_channelz_v1_ChannelData *msg, int64_t value) {
+  const upb_MiniTableField field = {5, UPB_SIZE(40, 56), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelData_set_calls_failed(grpc_channelz_v1_ChannelData *msg, int64_t value) {
+  const upb_MiniTableField field = {6, UPB_SIZE(48, 64), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelData_set_last_call_started_timestamp(grpc_channelz_v1_ChannelData *msg, struct google_protobuf_Timestamp* value) {
+  const upb_MiniTableField field = {7, UPB_SIZE(20, 72), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Timestamp* grpc_channelz_v1_ChannelData_mutable_last_call_started_timestamp(grpc_channelz_v1_ChannelData* msg, upb_Arena* arena) {
+  struct google_protobuf_Timestamp* sub = (struct google_protobuf_Timestamp*)grpc_channelz_v1_ChannelData_last_call_started_timestamp(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Timestamp*)_upb_Message_New(&google__protobuf__Timestamp_msg_init, arena);
+    if (sub) grpc_channelz_v1_ChannelData_set_last_call_started_timestamp(msg, sub);
+  }
+  return sub;
+}
+
+/* grpc.channelz.v1.ChannelTraceEvent */
+
+UPB_INLINE grpc_channelz_v1_ChannelTraceEvent* grpc_channelz_v1_ChannelTraceEvent_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_ChannelTraceEvent*)_upb_Message_New(&grpc__channelz__v1__ChannelTraceEvent_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_ChannelTraceEvent* grpc_channelz_v1_ChannelTraceEvent_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_ChannelTraceEvent* ret = grpc_channelz_v1_ChannelTraceEvent_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ChannelTraceEvent_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_ChannelTraceEvent* grpc_channelz_v1_ChannelTraceEvent_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_ChannelTraceEvent* ret = grpc_channelz_v1_ChannelTraceEvent_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ChannelTraceEvent_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_ChannelTraceEvent_serialize(const grpc_channelz_v1_ChannelTraceEvent* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ChannelTraceEvent_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_ChannelTraceEvent_serialize_ex(const grpc_channelz_v1_ChannelTraceEvent* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ChannelTraceEvent_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+typedef enum {
+  grpc_channelz_v1_ChannelTraceEvent_child_ref_channel_ref = 4,
+  grpc_channelz_v1_ChannelTraceEvent_child_ref_subchannel_ref = 5,
+  grpc_channelz_v1_ChannelTraceEvent_child_ref_NOT_SET = 0
+} grpc_channelz_v1_ChannelTraceEvent_child_ref_oneofcases;
+UPB_INLINE grpc_channelz_v1_ChannelTraceEvent_child_ref_oneofcases grpc_channelz_v1_ChannelTraceEvent_child_ref_case(const grpc_channelz_v1_ChannelTraceEvent* msg) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 48), UPB_SIZE(-21, -17), 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_ChannelTraceEvent_child_ref_oneofcases)upb_Message_WhichOneofFieldNumber(
+      UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTraceEvent_clear_child_ref(grpc_channelz_v1_ChannelTraceEvent* msg) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 48), UPB_SIZE(-21, -17), 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearOneof(UPB_UPCAST(msg), &grpc__channelz__v1__ChannelTraceEvent_msg_init, &field);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTraceEvent_clear_description(grpc_channelz_v1_ChannelTraceEvent* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(28, 24), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_ChannelTraceEvent_description(const grpc_channelz_v1_ChannelTraceEvent* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(28, 24), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTraceEvent_clear_severity(grpc_channelz_v1_ChannelTraceEvent* msg) {
+  const upb_MiniTableField field = {2, 12, 0, kUpb_NoSub, 5, (int)kUpb_FieldMode_Scalar | (int)kUpb_LabelFlags_IsAlternate | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int32_t grpc_channelz_v1_ChannelTraceEvent_severity(const grpc_channelz_v1_ChannelTraceEvent* msg) {
+  int32_t default_val = 0;
+  int32_t ret;
+  const upb_MiniTableField field = {2, 12, 0, kUpb_NoSub, 5, (int)kUpb_FieldMode_Scalar | (int)kUpb_LabelFlags_IsAlternate | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTraceEvent_clear_timestamp(grpc_channelz_v1_ChannelTraceEvent* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 40), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Timestamp* grpc_channelz_v1_ChannelTraceEvent_timestamp(const grpc_channelz_v1_ChannelTraceEvent* msg) {
+  const struct google_protobuf_Timestamp* default_val = NULL;
+  const struct google_protobuf_Timestamp* ret;
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 40), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_ChannelTraceEvent_has_timestamp(const grpc_channelz_v1_ChannelTraceEvent* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 40), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTraceEvent_clear_channel_ref(grpc_channelz_v1_ChannelTraceEvent* msg) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 48), UPB_SIZE(-21, -17), 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_ChannelRef* grpc_channelz_v1_ChannelTraceEvent_channel_ref(const grpc_channelz_v1_ChannelTraceEvent* msg) {
+  const grpc_channelz_v1_ChannelRef* default_val = NULL;
+  const grpc_channelz_v1_ChannelRef* ret;
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 48), UPB_SIZE(-21, -17), 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_ChannelTraceEvent_has_channel_ref(const grpc_channelz_v1_ChannelTraceEvent* msg) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 48), UPB_SIZE(-21, -17), 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTraceEvent_clear_subchannel_ref(grpc_channelz_v1_ChannelTraceEvent* msg) {
+  const upb_MiniTableField field = {5, UPB_SIZE(24, 48), UPB_SIZE(-21, -17), 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_SubchannelRef* grpc_channelz_v1_ChannelTraceEvent_subchannel_ref(const grpc_channelz_v1_ChannelTraceEvent* msg) {
+  const grpc_channelz_v1_SubchannelRef* default_val = NULL;
+  const grpc_channelz_v1_SubchannelRef* ret;
+  const upb_MiniTableField field = {5, UPB_SIZE(24, 48), UPB_SIZE(-21, -17), 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_ChannelTraceEvent_has_subchannel_ref(const grpc_channelz_v1_ChannelTraceEvent* msg) {
+  const upb_MiniTableField field = {5, UPB_SIZE(24, 48), UPB_SIZE(-21, -17), 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_ChannelTraceEvent_set_description(grpc_channelz_v1_ChannelTraceEvent *msg, upb_StringView value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(28, 24), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTraceEvent_set_severity(grpc_channelz_v1_ChannelTraceEvent *msg, int32_t value) {
+  const upb_MiniTableField field = {2, 12, 0, kUpb_NoSub, 5, (int)kUpb_FieldMode_Scalar | (int)kUpb_LabelFlags_IsAlternate | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTraceEvent_set_timestamp(grpc_channelz_v1_ChannelTraceEvent *msg, struct google_protobuf_Timestamp* value) {
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 40), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Timestamp* grpc_channelz_v1_ChannelTraceEvent_mutable_timestamp(grpc_channelz_v1_ChannelTraceEvent* msg, upb_Arena* arena) {
+  struct google_protobuf_Timestamp* sub = (struct google_protobuf_Timestamp*)grpc_channelz_v1_ChannelTraceEvent_timestamp(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Timestamp*)_upb_Message_New(&google__protobuf__Timestamp_msg_init, arena);
+    if (sub) grpc_channelz_v1_ChannelTraceEvent_set_timestamp(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTraceEvent_set_channel_ref(grpc_channelz_v1_ChannelTraceEvent *msg, grpc_channelz_v1_ChannelRef* value) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 48), UPB_SIZE(-21, -17), 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelRef_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_ChannelRef* grpc_channelz_v1_ChannelTraceEvent_mutable_channel_ref(grpc_channelz_v1_ChannelTraceEvent* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_ChannelRef* sub = (struct grpc_channelz_v1_ChannelRef*)grpc_channelz_v1_ChannelTraceEvent_channel_ref(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_ChannelRef*)_upb_Message_New(&grpc__channelz__v1__ChannelRef_msg_init, arena);
+    if (sub) grpc_channelz_v1_ChannelTraceEvent_set_channel_ref(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTraceEvent_set_subchannel_ref(grpc_channelz_v1_ChannelTraceEvent *msg, grpc_channelz_v1_SubchannelRef* value) {
+  const upb_MiniTableField field = {5, UPB_SIZE(24, 48), UPB_SIZE(-21, -17), 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SubchannelRef_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_SubchannelRef* grpc_channelz_v1_ChannelTraceEvent_mutable_subchannel_ref(grpc_channelz_v1_ChannelTraceEvent* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_SubchannelRef* sub = (struct grpc_channelz_v1_SubchannelRef*)grpc_channelz_v1_ChannelTraceEvent_subchannel_ref(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_SubchannelRef*)_upb_Message_New(&grpc__channelz__v1__SubchannelRef_msg_init, arena);
+    if (sub) grpc_channelz_v1_ChannelTraceEvent_set_subchannel_ref(msg, sub);
+  }
+  return sub;
+}
+
+/* grpc.channelz.v1.ChannelTrace */
+
+UPB_INLINE grpc_channelz_v1_ChannelTrace* grpc_channelz_v1_ChannelTrace_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_ChannelTrace*)_upb_Message_New(&grpc__channelz__v1__ChannelTrace_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_ChannelTrace* grpc_channelz_v1_ChannelTrace_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_ChannelTrace* ret = grpc_channelz_v1_ChannelTrace_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ChannelTrace_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_ChannelTrace* grpc_channelz_v1_ChannelTrace_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_ChannelTrace* ret = grpc_channelz_v1_ChannelTrace_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ChannelTrace_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_ChannelTrace_serialize(const grpc_channelz_v1_ChannelTrace* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ChannelTrace_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_ChannelTrace_serialize_ex(const grpc_channelz_v1_ChannelTrace* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ChannelTrace_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTrace_clear_num_events_logged(grpc_channelz_v1_ChannelTrace* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(24, 16), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_ChannelTrace_num_events_logged(const grpc_channelz_v1_ChannelTrace* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(24, 16), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTrace_clear_creation_timestamp(grpc_channelz_v1_ChannelTrace* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 24), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Timestamp* grpc_channelz_v1_ChannelTrace_creation_timestamp(const grpc_channelz_v1_ChannelTrace* msg) {
+  const struct google_protobuf_Timestamp* default_val = NULL;
+  const struct google_protobuf_Timestamp* ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 24), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_ChannelTrace_has_creation_timestamp(const grpc_channelz_v1_ChannelTrace* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 24), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTrace_clear_events(grpc_channelz_v1_ChannelTrace* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 32), 0, 1, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_ChannelTraceEvent* const* grpc_channelz_v1_ChannelTrace_events(const grpc_channelz_v1_ChannelTrace* msg, size_t* size) {
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 32), 0, 1, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelTraceEvent_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (const grpc_channelz_v1_ChannelTraceEvent* const*)upb_Array_DataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE const upb_Array* _grpc_channelz_v1_ChannelTrace_events_upb_array(const grpc_channelz_v1_ChannelTrace* msg, size_t* size) {
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 32), 0, 1, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelTraceEvent_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE upb_Array* _grpc_channelz_v1_ChannelTrace_events_mutable_upb_array(grpc_channelz_v1_ChannelTrace* msg, size_t* size, upb_Arena* arena) {
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 32), 0, 1, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelTraceEvent_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(UPB_UPCAST(msg),
+                                                       &field, arena);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+
+UPB_INLINE void grpc_channelz_v1_ChannelTrace_set_num_events_logged(grpc_channelz_v1_ChannelTrace *msg, int64_t value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(24, 16), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelTrace_set_creation_timestamp(grpc_channelz_v1_ChannelTrace *msg, struct google_protobuf_Timestamp* value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 24), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Timestamp* grpc_channelz_v1_ChannelTrace_mutable_creation_timestamp(grpc_channelz_v1_ChannelTrace* msg, upb_Arena* arena) {
+  struct google_protobuf_Timestamp* sub = (struct google_protobuf_Timestamp*)grpc_channelz_v1_ChannelTrace_creation_timestamp(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Timestamp*)_upb_Message_New(&google__protobuf__Timestamp_msg_init, arena);
+    if (sub) grpc_channelz_v1_ChannelTrace_set_creation_timestamp(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE grpc_channelz_v1_ChannelTraceEvent** grpc_channelz_v1_ChannelTrace_mutable_events(grpc_channelz_v1_ChannelTrace* msg, size_t* size) {
+  upb_MiniTableField field = {3, UPB_SIZE(16, 32), 0, 1, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelTraceEvent_msg_init);
+  upb_Array* arr = upb_Message_GetMutableArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (grpc_channelz_v1_ChannelTraceEvent**)upb_Array_MutableDataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE grpc_channelz_v1_ChannelTraceEvent** grpc_channelz_v1_ChannelTrace_resize_events(grpc_channelz_v1_ChannelTrace* msg, size_t size, upb_Arena* arena) {
+  upb_MiniTableField field = {3, UPB_SIZE(16, 32), 0, 1, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_ChannelTraceEvent**)upb_Message_ResizeArrayUninitialized(UPB_UPCAST(msg),
+                                                   &field, size, arena);
+}
+UPB_INLINE struct grpc_channelz_v1_ChannelTraceEvent* grpc_channelz_v1_ChannelTrace_add_events(grpc_channelz_v1_ChannelTrace* msg, upb_Arena* arena) {
+  upb_MiniTableField field = {3, UPB_SIZE(16, 32), 0, 1, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelTraceEvent_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(
+      UPB_UPCAST(msg), &field, arena);
+  if (!arr || !UPB_PRIVATE(_upb_Array_ResizeUninitialized)(
+                  arr, arr->UPB_PRIVATE(size) + 1, arena)) {
+    return NULL;
+  }
+  struct grpc_channelz_v1_ChannelTraceEvent* sub = (struct grpc_channelz_v1_ChannelTraceEvent*)_upb_Message_New(&grpc__channelz__v1__ChannelTraceEvent_msg_init, arena);
+  if (!arr || !sub) return NULL;
+  UPB_PRIVATE(_upb_Array_Set)
+  (arr, arr->UPB_PRIVATE(size) - 1, &sub, sizeof(sub));
+  return sub;
+}
+
+/* grpc.channelz.v1.ChannelRef */
+
+UPB_INLINE grpc_channelz_v1_ChannelRef* grpc_channelz_v1_ChannelRef_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_ChannelRef*)_upb_Message_New(&grpc__channelz__v1__ChannelRef_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_ChannelRef* grpc_channelz_v1_ChannelRef_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_ChannelRef* ret = grpc_channelz_v1_ChannelRef_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ChannelRef_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_ChannelRef* grpc_channelz_v1_ChannelRef_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_ChannelRef* ret = grpc_channelz_v1_ChannelRef_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ChannelRef_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_ChannelRef_serialize(const grpc_channelz_v1_ChannelRef* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ChannelRef_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_ChannelRef_serialize_ex(const grpc_channelz_v1_ChannelRef* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ChannelRef_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelRef_clear_channel_id(grpc_channelz_v1_ChannelRef* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_ChannelRef_channel_id(const grpc_channelz_v1_ChannelRef* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_ChannelRef_clear_name(grpc_channelz_v1_ChannelRef* msg) {
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_ChannelRef_name(const grpc_channelz_v1_ChannelRef* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_ChannelRef_set_channel_id(grpc_channelz_v1_ChannelRef *msg, int64_t value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_ChannelRef_set_name(grpc_channelz_v1_ChannelRef *msg, upb_StringView value) {
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.SubchannelRef */
+
+UPB_INLINE grpc_channelz_v1_SubchannelRef* grpc_channelz_v1_SubchannelRef_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_SubchannelRef*)_upb_Message_New(&grpc__channelz__v1__SubchannelRef_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_SubchannelRef* grpc_channelz_v1_SubchannelRef_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_SubchannelRef* ret = grpc_channelz_v1_SubchannelRef_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SubchannelRef_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_SubchannelRef* grpc_channelz_v1_SubchannelRef_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_SubchannelRef* ret = grpc_channelz_v1_SubchannelRef_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SubchannelRef_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_SubchannelRef_serialize(const grpc_channelz_v1_SubchannelRef* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SubchannelRef_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_SubchannelRef_serialize_ex(const grpc_channelz_v1_SubchannelRef* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SubchannelRef_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_SubchannelRef_clear_subchannel_id(grpc_channelz_v1_SubchannelRef* msg) {
+  const upb_MiniTableField field = {7, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_SubchannelRef_subchannel_id(const grpc_channelz_v1_SubchannelRef* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {7, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SubchannelRef_clear_name(grpc_channelz_v1_SubchannelRef* msg) {
+  const upb_MiniTableField field = {8, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_SubchannelRef_name(const grpc_channelz_v1_SubchannelRef* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {8, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_SubchannelRef_set_subchannel_id(grpc_channelz_v1_SubchannelRef *msg, int64_t value) {
+  const upb_MiniTableField field = {7, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SubchannelRef_set_name(grpc_channelz_v1_SubchannelRef *msg, upb_StringView value) {
+  const upb_MiniTableField field = {8, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.SocketRef */
+
+UPB_INLINE grpc_channelz_v1_SocketRef* grpc_channelz_v1_SocketRef_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_SocketRef*)_upb_Message_New(&grpc__channelz__v1__SocketRef_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_SocketRef* grpc_channelz_v1_SocketRef_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_SocketRef* ret = grpc_channelz_v1_SocketRef_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SocketRef_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_SocketRef* grpc_channelz_v1_SocketRef_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_SocketRef* ret = grpc_channelz_v1_SocketRef_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SocketRef_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_SocketRef_serialize(const grpc_channelz_v1_SocketRef* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SocketRef_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_SocketRef_serialize_ex(const grpc_channelz_v1_SocketRef* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SocketRef_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_SocketRef_clear_socket_id(grpc_channelz_v1_SocketRef* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_SocketRef_socket_id(const grpc_channelz_v1_SocketRef* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketRef_clear_name(grpc_channelz_v1_SocketRef* msg) {
+  const upb_MiniTableField field = {4, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_SocketRef_name(const grpc_channelz_v1_SocketRef* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {4, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_SocketRef_set_socket_id(grpc_channelz_v1_SocketRef *msg, int64_t value) {
+  const upb_MiniTableField field = {3, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketRef_set_name(grpc_channelz_v1_SocketRef *msg, upb_StringView value) {
+  const upb_MiniTableField field = {4, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.ServerRef */
+
+UPB_INLINE grpc_channelz_v1_ServerRef* grpc_channelz_v1_ServerRef_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_ServerRef*)_upb_Message_New(&grpc__channelz__v1__ServerRef_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_ServerRef* grpc_channelz_v1_ServerRef_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_ServerRef* ret = grpc_channelz_v1_ServerRef_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ServerRef_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_ServerRef* grpc_channelz_v1_ServerRef_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_ServerRef* ret = grpc_channelz_v1_ServerRef_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ServerRef_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_ServerRef_serialize(const grpc_channelz_v1_ServerRef* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ServerRef_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_ServerRef_serialize_ex(const grpc_channelz_v1_ServerRef* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ServerRef_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_ServerRef_clear_server_id(grpc_channelz_v1_ServerRef* msg) {
+  const upb_MiniTableField field = {5, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_ServerRef_server_id(const grpc_channelz_v1_ServerRef* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {5, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_ServerRef_clear_name(grpc_channelz_v1_ServerRef* msg) {
+  const upb_MiniTableField field = {6, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_ServerRef_name(const grpc_channelz_v1_ServerRef* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {6, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_ServerRef_set_server_id(grpc_channelz_v1_ServerRef *msg, int64_t value) {
+  const upb_MiniTableField field = {5, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_ServerRef_set_name(grpc_channelz_v1_ServerRef *msg, upb_StringView value) {
+  const upb_MiniTableField field = {6, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.Server */
+
+UPB_INLINE grpc_channelz_v1_Server* grpc_channelz_v1_Server_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_Server*)_upb_Message_New(&grpc__channelz__v1__Server_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_Server* grpc_channelz_v1_Server_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_Server* ret = grpc_channelz_v1_Server_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Server_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_Server* grpc_channelz_v1_Server_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_Server* ret = grpc_channelz_v1_Server_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Server_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_Server_serialize(const grpc_channelz_v1_Server* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Server_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_Server_serialize_ex(const grpc_channelz_v1_Server* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Server_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_Server_clear_ref(grpc_channelz_v1_Server* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_ServerRef* grpc_channelz_v1_Server_ref(const grpc_channelz_v1_Server* msg) {
+  const grpc_channelz_v1_ServerRef* default_val = NULL;
+  const grpc_channelz_v1_ServerRef* ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ServerRef_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Server_has_ref(const grpc_channelz_v1_Server* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Server_clear_data(grpc_channelz_v1_Server* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_ServerData* grpc_channelz_v1_Server_data(const grpc_channelz_v1_Server* msg) {
+  const grpc_channelz_v1_ServerData* default_val = NULL;
+  const grpc_channelz_v1_ServerData* ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ServerData_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Server_has_data(const grpc_channelz_v1_Server* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Server_clear_listen_socket(grpc_channelz_v1_Server* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_SocketRef* const* grpc_channelz_v1_Server_listen_socket(const grpc_channelz_v1_Server* msg, size_t* size) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (const grpc_channelz_v1_SocketRef* const*)upb_Array_DataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE const upb_Array* _grpc_channelz_v1_Server_listen_socket_upb_array(const grpc_channelz_v1_Server* msg, size_t* size) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE upb_Array* _grpc_channelz_v1_Server_listen_socket_mutable_upb_array(grpc_channelz_v1_Server* msg, size_t* size, upb_Arena* arena) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(UPB_UPCAST(msg),
+                                                       &field, arena);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+
+UPB_INLINE void grpc_channelz_v1_Server_set_ref(grpc_channelz_v1_Server *msg, grpc_channelz_v1_ServerRef* value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ServerRef_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_ServerRef* grpc_channelz_v1_Server_mutable_ref(grpc_channelz_v1_Server* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_ServerRef* sub = (struct grpc_channelz_v1_ServerRef*)grpc_channelz_v1_Server_ref(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_ServerRef*)_upb_Message_New(&grpc__channelz__v1__ServerRef_msg_init, arena);
+    if (sub) grpc_channelz_v1_Server_set_ref(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_Server_set_data(grpc_channelz_v1_Server *msg, grpc_channelz_v1_ServerData* value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ServerData_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_ServerData* grpc_channelz_v1_Server_mutable_data(grpc_channelz_v1_Server* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_ServerData* sub = (struct grpc_channelz_v1_ServerData*)grpc_channelz_v1_Server_data(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_ServerData*)_upb_Message_New(&grpc__channelz__v1__ServerData_msg_init, arena);
+    if (sub) grpc_channelz_v1_Server_set_data(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE grpc_channelz_v1_SocketRef** grpc_channelz_v1_Server_mutable_listen_socket(grpc_channelz_v1_Server* msg, size_t* size) {
+  upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  upb_Array* arr = upb_Message_GetMutableArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (grpc_channelz_v1_SocketRef**)upb_Array_MutableDataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE grpc_channelz_v1_SocketRef** grpc_channelz_v1_Server_resize_listen_socket(grpc_channelz_v1_Server* msg, size_t size, upb_Arena* arena) {
+  upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_SocketRef**)upb_Message_ResizeArrayUninitialized(UPB_UPCAST(msg),
+                                                   &field, size, arena);
+}
+UPB_INLINE struct grpc_channelz_v1_SocketRef* grpc_channelz_v1_Server_add_listen_socket(grpc_channelz_v1_Server* msg, upb_Arena* arena) {
+  upb_MiniTableField field = {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(
+      UPB_UPCAST(msg), &field, arena);
+  if (!arr || !UPB_PRIVATE(_upb_Array_ResizeUninitialized)(
+                  arr, arr->UPB_PRIVATE(size) + 1, arena)) {
+    return NULL;
+  }
+  struct grpc_channelz_v1_SocketRef* sub = (struct grpc_channelz_v1_SocketRef*)_upb_Message_New(&grpc__channelz__v1__SocketRef_msg_init, arena);
+  if (!arr || !sub) return NULL;
+  UPB_PRIVATE(_upb_Array_Set)
+  (arr, arr->UPB_PRIVATE(size) - 1, &sub, sizeof(sub));
+  return sub;
+}
+
+/* grpc.channelz.v1.ServerData */
+
+UPB_INLINE grpc_channelz_v1_ServerData* grpc_channelz_v1_ServerData_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_ServerData*)_upb_Message_New(&grpc__channelz__v1__ServerData_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_ServerData* grpc_channelz_v1_ServerData_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_ServerData* ret = grpc_channelz_v1_ServerData_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ServerData_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_ServerData* grpc_channelz_v1_ServerData_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_ServerData* ret = grpc_channelz_v1_ServerData_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__ServerData_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_ServerData_serialize(const grpc_channelz_v1_ServerData* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ServerData_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_ServerData_serialize_ex(const grpc_channelz_v1_ServerData* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__ServerData_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_ServerData_clear_trace(grpc_channelz_v1_ServerData* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_ChannelTrace* grpc_channelz_v1_ServerData_trace(const grpc_channelz_v1_ServerData* msg) {
+  const grpc_channelz_v1_ChannelTrace* default_val = NULL;
+  const grpc_channelz_v1_ChannelTrace* ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelTrace_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_ServerData_has_trace(const grpc_channelz_v1_ServerData* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_ServerData_clear_calls_started(grpc_channelz_v1_ServerData* msg) {
+  const upb_MiniTableField field = {2, 24, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_ServerData_calls_started(const grpc_channelz_v1_ServerData* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {2, 24, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_ServerData_clear_calls_succeeded(grpc_channelz_v1_ServerData* msg) {
+  const upb_MiniTableField field = {3, 32, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_ServerData_calls_succeeded(const grpc_channelz_v1_ServerData* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {3, 32, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_ServerData_clear_calls_failed(grpc_channelz_v1_ServerData* msg) {
+  const upb_MiniTableField field = {4, 40, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_ServerData_calls_failed(const grpc_channelz_v1_ServerData* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {4, 40, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_ServerData_clear_last_call_started_timestamp(grpc_channelz_v1_ServerData* msg) {
+  const upb_MiniTableField field = {5, UPB_SIZE(16, 48), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Timestamp* grpc_channelz_v1_ServerData_last_call_started_timestamp(const grpc_channelz_v1_ServerData* msg) {
+  const struct google_protobuf_Timestamp* default_val = NULL;
+  const struct google_protobuf_Timestamp* ret;
+  const upb_MiniTableField field = {5, UPB_SIZE(16, 48), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_ServerData_has_last_call_started_timestamp(const grpc_channelz_v1_ServerData* msg) {
+  const upb_MiniTableField field = {5, UPB_SIZE(16, 48), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_ServerData_set_trace(grpc_channelz_v1_ServerData *msg, grpc_channelz_v1_ChannelTrace* value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__ChannelTrace_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_ChannelTrace* grpc_channelz_v1_ServerData_mutable_trace(grpc_channelz_v1_ServerData* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_ChannelTrace* sub = (struct grpc_channelz_v1_ChannelTrace*)grpc_channelz_v1_ServerData_trace(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_ChannelTrace*)_upb_Message_New(&grpc__channelz__v1__ChannelTrace_msg_init, arena);
+    if (sub) grpc_channelz_v1_ServerData_set_trace(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_ServerData_set_calls_started(grpc_channelz_v1_ServerData *msg, int64_t value) {
+  const upb_MiniTableField field = {2, 24, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_ServerData_set_calls_succeeded(grpc_channelz_v1_ServerData *msg, int64_t value) {
+  const upb_MiniTableField field = {3, 32, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_ServerData_set_calls_failed(grpc_channelz_v1_ServerData *msg, int64_t value) {
+  const upb_MiniTableField field = {4, 40, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_ServerData_set_last_call_started_timestamp(grpc_channelz_v1_ServerData *msg, struct google_protobuf_Timestamp* value) {
+  const upb_MiniTableField field = {5, UPB_SIZE(16, 48), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Timestamp* grpc_channelz_v1_ServerData_mutable_last_call_started_timestamp(grpc_channelz_v1_ServerData* msg, upb_Arena* arena) {
+  struct google_protobuf_Timestamp* sub = (struct google_protobuf_Timestamp*)grpc_channelz_v1_ServerData_last_call_started_timestamp(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Timestamp*)_upb_Message_New(&google__protobuf__Timestamp_msg_init, arena);
+    if (sub) grpc_channelz_v1_ServerData_set_last_call_started_timestamp(msg, sub);
+  }
+  return sub;
+}
+
+/* grpc.channelz.v1.Socket */
+
+UPB_INLINE grpc_channelz_v1_Socket* grpc_channelz_v1_Socket_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_Socket*)_upb_Message_New(&grpc__channelz__v1__Socket_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_Socket* grpc_channelz_v1_Socket_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_Socket* ret = grpc_channelz_v1_Socket_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Socket_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_Socket* grpc_channelz_v1_Socket_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_Socket* ret = grpc_channelz_v1_Socket_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Socket_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_Socket_serialize(const grpc_channelz_v1_Socket* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Socket_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_Socket_serialize_ex(const grpc_channelz_v1_Socket* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Socket_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_Socket_clear_ref(grpc_channelz_v1_Socket* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_SocketRef* grpc_channelz_v1_Socket_ref(const grpc_channelz_v1_Socket* msg) {
+  const grpc_channelz_v1_SocketRef* default_val = NULL;
+  const grpc_channelz_v1_SocketRef* ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Socket_has_ref(const grpc_channelz_v1_Socket* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Socket_clear_data(grpc_channelz_v1_Socket* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 40), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_SocketData* grpc_channelz_v1_Socket_data(const grpc_channelz_v1_Socket* msg) {
+  const grpc_channelz_v1_SocketData* default_val = NULL;
+  const grpc_channelz_v1_SocketData* ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 40), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketData_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Socket_has_data(const grpc_channelz_v1_Socket* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 40), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Socket_clear_local(grpc_channelz_v1_Socket* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 48), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Address* grpc_channelz_v1_Socket_local(const grpc_channelz_v1_Socket* msg) {
+  const grpc_channelz_v1_Address* default_val = NULL;
+  const grpc_channelz_v1_Address* ret;
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 48), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Address_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Socket_has_local(const grpc_channelz_v1_Socket* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 48), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Socket_clear_remote(grpc_channelz_v1_Socket* msg) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 56), 67, 3, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Address* grpc_channelz_v1_Socket_remote(const grpc_channelz_v1_Socket* msg) {
+  const grpc_channelz_v1_Address* default_val = NULL;
+  const grpc_channelz_v1_Address* ret;
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 56), 67, 3, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Address_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Socket_has_remote(const grpc_channelz_v1_Socket* msg) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 56), 67, 3, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Socket_clear_security(grpc_channelz_v1_Socket* msg) {
+  const upb_MiniTableField field = {5, UPB_SIZE(28, 64), 68, 4, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Security* grpc_channelz_v1_Socket_security(const grpc_channelz_v1_Socket* msg) {
+  const grpc_channelz_v1_Security* default_val = NULL;
+  const grpc_channelz_v1_Security* ret;
+  const upb_MiniTableField field = {5, UPB_SIZE(28, 64), 68, 4, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Security_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Socket_has_security(const grpc_channelz_v1_Socket* msg) {
+  const upb_MiniTableField field = {5, UPB_SIZE(28, 64), 68, 4, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Socket_clear_remote_name(grpc_channelz_v1_Socket* msg) {
+  const upb_MiniTableField field = {6, UPB_SIZE(32, 16), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_Socket_remote_name(const grpc_channelz_v1_Socket* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {6, UPB_SIZE(32, 16), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_Socket_set_ref(grpc_channelz_v1_Socket *msg, grpc_channelz_v1_SocketRef* value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_SocketRef* grpc_channelz_v1_Socket_mutable_ref(grpc_channelz_v1_Socket* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_SocketRef* sub = (struct grpc_channelz_v1_SocketRef*)grpc_channelz_v1_Socket_ref(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_SocketRef*)_upb_Message_New(&grpc__channelz__v1__SocketRef_msg_init, arena);
+    if (sub) grpc_channelz_v1_Socket_set_ref(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_Socket_set_data(grpc_channelz_v1_Socket *msg, grpc_channelz_v1_SocketData* value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(16, 40), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketData_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_SocketData* grpc_channelz_v1_Socket_mutable_data(grpc_channelz_v1_Socket* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_SocketData* sub = (struct grpc_channelz_v1_SocketData*)grpc_channelz_v1_Socket_data(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_SocketData*)_upb_Message_New(&grpc__channelz__v1__SocketData_msg_init, arena);
+    if (sub) grpc_channelz_v1_Socket_set_data(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_Socket_set_local(grpc_channelz_v1_Socket *msg, grpc_channelz_v1_Address* value) {
+  const upb_MiniTableField field = {3, UPB_SIZE(20, 48), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Address_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_Address* grpc_channelz_v1_Socket_mutable_local(grpc_channelz_v1_Socket* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_Address* sub = (struct grpc_channelz_v1_Address*)grpc_channelz_v1_Socket_local(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_Address*)_upb_Message_New(&grpc__channelz__v1__Address_msg_init, arena);
+    if (sub) grpc_channelz_v1_Socket_set_local(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_Socket_set_remote(grpc_channelz_v1_Socket *msg, grpc_channelz_v1_Address* value) {
+  const upb_MiniTableField field = {4, UPB_SIZE(24, 56), 67, 3, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Address_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_Address* grpc_channelz_v1_Socket_mutable_remote(grpc_channelz_v1_Socket* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_Address* sub = (struct grpc_channelz_v1_Address*)grpc_channelz_v1_Socket_remote(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_Address*)_upb_Message_New(&grpc__channelz__v1__Address_msg_init, arena);
+    if (sub) grpc_channelz_v1_Socket_set_remote(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_Socket_set_security(grpc_channelz_v1_Socket *msg, grpc_channelz_v1_Security* value) {
+  const upb_MiniTableField field = {5, UPB_SIZE(28, 64), 68, 4, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Security_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_Security* grpc_channelz_v1_Socket_mutable_security(grpc_channelz_v1_Socket* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_Security* sub = (struct grpc_channelz_v1_Security*)grpc_channelz_v1_Socket_security(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_Security*)_upb_Message_New(&grpc__channelz__v1__Security_msg_init, arena);
+    if (sub) grpc_channelz_v1_Socket_set_security(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_Socket_set_remote_name(grpc_channelz_v1_Socket *msg, upb_StringView value) {
+  const upb_MiniTableField field = {6, UPB_SIZE(32, 16), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.SocketData */
+
+UPB_INLINE grpc_channelz_v1_SocketData* grpc_channelz_v1_SocketData_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_SocketData*)_upb_Message_New(&grpc__channelz__v1__SocketData_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_SocketData* grpc_channelz_v1_SocketData_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_SocketData* ret = grpc_channelz_v1_SocketData_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SocketData_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_SocketData* grpc_channelz_v1_SocketData_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_SocketData* ret = grpc_channelz_v1_SocketData_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SocketData_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_SocketData_serialize(const grpc_channelz_v1_SocketData* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SocketData_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_SocketData_serialize_ex(const grpc_channelz_v1_SocketData* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SocketData_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_clear_streams_started(grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(40, 16), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_SocketData_streams_started(const grpc_channelz_v1_SocketData* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(40, 16), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_clear_streams_succeeded(grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(48, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_SocketData_streams_succeeded(const grpc_channelz_v1_SocketData* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(48, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_clear_streams_failed(grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(56, 32), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_SocketData_streams_failed(const grpc_channelz_v1_SocketData* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {3, UPB_SIZE(56, 32), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_clear_messages_sent(grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {4, UPB_SIZE(64, 40), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_SocketData_messages_sent(const grpc_channelz_v1_SocketData* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {4, UPB_SIZE(64, 40), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_clear_messages_received(grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {5, UPB_SIZE(72, 48), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_SocketData_messages_received(const grpc_channelz_v1_SocketData* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {5, UPB_SIZE(72, 48), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_clear_keep_alives_sent(grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {6, UPB_SIZE(80, 56), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_SocketData_keep_alives_sent(const grpc_channelz_v1_SocketData* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {6, UPB_SIZE(80, 56), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_clear_last_local_stream_created_timestamp(grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {7, UPB_SIZE(12, 64), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Timestamp* grpc_channelz_v1_SocketData_last_local_stream_created_timestamp(const grpc_channelz_v1_SocketData* msg) {
+  const struct google_protobuf_Timestamp* default_val = NULL;
+  const struct google_protobuf_Timestamp* ret;
+  const upb_MiniTableField field = {7, UPB_SIZE(12, 64), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_SocketData_has_last_local_stream_created_timestamp(const grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {7, UPB_SIZE(12, 64), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_clear_last_remote_stream_created_timestamp(grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {8, UPB_SIZE(16, 72), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Timestamp* grpc_channelz_v1_SocketData_last_remote_stream_created_timestamp(const grpc_channelz_v1_SocketData* msg) {
+  const struct google_protobuf_Timestamp* default_val = NULL;
+  const struct google_protobuf_Timestamp* ret;
+  const upb_MiniTableField field = {8, UPB_SIZE(16, 72), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_SocketData_has_last_remote_stream_created_timestamp(const grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {8, UPB_SIZE(16, 72), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_clear_last_message_sent_timestamp(grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {9, UPB_SIZE(20, 80), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Timestamp* grpc_channelz_v1_SocketData_last_message_sent_timestamp(const grpc_channelz_v1_SocketData* msg) {
+  const struct google_protobuf_Timestamp* default_val = NULL;
+  const struct google_protobuf_Timestamp* ret;
+  const upb_MiniTableField field = {9, UPB_SIZE(20, 80), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_SocketData_has_last_message_sent_timestamp(const grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {9, UPB_SIZE(20, 80), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_clear_last_message_received_timestamp(grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {10, UPB_SIZE(24, 88), 67, 3, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Timestamp* grpc_channelz_v1_SocketData_last_message_received_timestamp(const grpc_channelz_v1_SocketData* msg) {
+  const struct google_protobuf_Timestamp* default_val = NULL;
+  const struct google_protobuf_Timestamp* ret;
+  const upb_MiniTableField field = {10, UPB_SIZE(24, 88), 67, 3, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_SocketData_has_last_message_received_timestamp(const grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {10, UPB_SIZE(24, 88), 67, 3, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_clear_local_flow_control_window(grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {11, UPB_SIZE(28, 96), 68, 4, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Int64Value* grpc_channelz_v1_SocketData_local_flow_control_window(const grpc_channelz_v1_SocketData* msg) {
+  const struct google_protobuf_Int64Value* default_val = NULL;
+  const struct google_protobuf_Int64Value* ret;
+  const upb_MiniTableField field = {11, UPB_SIZE(28, 96), 68, 4, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Int64Value_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_SocketData_has_local_flow_control_window(const grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {11, UPB_SIZE(28, 96), 68, 4, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_clear_remote_flow_control_window(grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {12, UPB_SIZE(32, 104), 69, 5, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Int64Value* grpc_channelz_v1_SocketData_remote_flow_control_window(const grpc_channelz_v1_SocketData* msg) {
+  const struct google_protobuf_Int64Value* default_val = NULL;
+  const struct google_protobuf_Int64Value* ret;
+  const upb_MiniTableField field = {12, UPB_SIZE(32, 104), 69, 5, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Int64Value_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_SocketData_has_remote_flow_control_window(const grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {12, UPB_SIZE(32, 104), 69, 5, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_clear_option(grpc_channelz_v1_SocketData* msg) {
+  const upb_MiniTableField field = {13, UPB_SIZE(36, 112), 0, 6, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_SocketOption* const* grpc_channelz_v1_SocketData_option(const grpc_channelz_v1_SocketData* msg, size_t* size) {
+  const upb_MiniTableField field = {13, UPB_SIZE(36, 112), 0, 6, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketOption_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (const grpc_channelz_v1_SocketOption* const*)upb_Array_DataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE const upb_Array* _grpc_channelz_v1_SocketData_option_upb_array(const grpc_channelz_v1_SocketData* msg, size_t* size) {
+  const upb_MiniTableField field = {13, UPB_SIZE(36, 112), 0, 6, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketOption_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE upb_Array* _grpc_channelz_v1_SocketData_option_mutable_upb_array(grpc_channelz_v1_SocketData* msg, size_t* size, upb_Arena* arena) {
+  const upb_MiniTableField field = {13, UPB_SIZE(36, 112), 0, 6, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketOption_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(UPB_UPCAST(msg),
+                                                       &field, arena);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+
+UPB_INLINE void grpc_channelz_v1_SocketData_set_streams_started(grpc_channelz_v1_SocketData *msg, int64_t value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(40, 16), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_set_streams_succeeded(grpc_channelz_v1_SocketData *msg, int64_t value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(48, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_set_streams_failed(grpc_channelz_v1_SocketData *msg, int64_t value) {
+  const upb_MiniTableField field = {3, UPB_SIZE(56, 32), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_set_messages_sent(grpc_channelz_v1_SocketData *msg, int64_t value) {
+  const upb_MiniTableField field = {4, UPB_SIZE(64, 40), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_set_messages_received(grpc_channelz_v1_SocketData *msg, int64_t value) {
+  const upb_MiniTableField field = {5, UPB_SIZE(72, 48), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_set_keep_alives_sent(grpc_channelz_v1_SocketData *msg, int64_t value) {
+  const upb_MiniTableField field = {6, UPB_SIZE(80, 56), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_set_last_local_stream_created_timestamp(grpc_channelz_v1_SocketData *msg, struct google_protobuf_Timestamp* value) {
+  const upb_MiniTableField field = {7, UPB_SIZE(12, 64), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Timestamp* grpc_channelz_v1_SocketData_mutable_last_local_stream_created_timestamp(grpc_channelz_v1_SocketData* msg, upb_Arena* arena) {
+  struct google_protobuf_Timestamp* sub = (struct google_protobuf_Timestamp*)grpc_channelz_v1_SocketData_last_local_stream_created_timestamp(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Timestamp*)_upb_Message_New(&google__protobuf__Timestamp_msg_init, arena);
+    if (sub) grpc_channelz_v1_SocketData_set_last_local_stream_created_timestamp(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_set_last_remote_stream_created_timestamp(grpc_channelz_v1_SocketData *msg, struct google_protobuf_Timestamp* value) {
+  const upb_MiniTableField field = {8, UPB_SIZE(16, 72), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Timestamp* grpc_channelz_v1_SocketData_mutable_last_remote_stream_created_timestamp(grpc_channelz_v1_SocketData* msg, upb_Arena* arena) {
+  struct google_protobuf_Timestamp* sub = (struct google_protobuf_Timestamp*)grpc_channelz_v1_SocketData_last_remote_stream_created_timestamp(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Timestamp*)_upb_Message_New(&google__protobuf__Timestamp_msg_init, arena);
+    if (sub) grpc_channelz_v1_SocketData_set_last_remote_stream_created_timestamp(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_set_last_message_sent_timestamp(grpc_channelz_v1_SocketData *msg, struct google_protobuf_Timestamp* value) {
+  const upb_MiniTableField field = {9, UPB_SIZE(20, 80), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Timestamp* grpc_channelz_v1_SocketData_mutable_last_message_sent_timestamp(grpc_channelz_v1_SocketData* msg, upb_Arena* arena) {
+  struct google_protobuf_Timestamp* sub = (struct google_protobuf_Timestamp*)grpc_channelz_v1_SocketData_last_message_sent_timestamp(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Timestamp*)_upb_Message_New(&google__protobuf__Timestamp_msg_init, arena);
+    if (sub) grpc_channelz_v1_SocketData_set_last_message_sent_timestamp(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_set_last_message_received_timestamp(grpc_channelz_v1_SocketData *msg, struct google_protobuf_Timestamp* value) {
+  const upb_MiniTableField field = {10, UPB_SIZE(24, 88), 67, 3, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Timestamp_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Timestamp* grpc_channelz_v1_SocketData_mutable_last_message_received_timestamp(grpc_channelz_v1_SocketData* msg, upb_Arena* arena) {
+  struct google_protobuf_Timestamp* sub = (struct google_protobuf_Timestamp*)grpc_channelz_v1_SocketData_last_message_received_timestamp(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Timestamp*)_upb_Message_New(&google__protobuf__Timestamp_msg_init, arena);
+    if (sub) grpc_channelz_v1_SocketData_set_last_message_received_timestamp(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_set_local_flow_control_window(grpc_channelz_v1_SocketData *msg, struct google_protobuf_Int64Value* value) {
+  const upb_MiniTableField field = {11, UPB_SIZE(28, 96), 68, 4, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Int64Value_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Int64Value* grpc_channelz_v1_SocketData_mutable_local_flow_control_window(grpc_channelz_v1_SocketData* msg, upb_Arena* arena) {
+  struct google_protobuf_Int64Value* sub = (struct google_protobuf_Int64Value*)grpc_channelz_v1_SocketData_local_flow_control_window(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Int64Value*)_upb_Message_New(&google__protobuf__Int64Value_msg_init, arena);
+    if (sub) grpc_channelz_v1_SocketData_set_local_flow_control_window(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_SocketData_set_remote_flow_control_window(grpc_channelz_v1_SocketData *msg, struct google_protobuf_Int64Value* value) {
+  const upb_MiniTableField field = {12, UPB_SIZE(32, 104), 69, 5, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Int64Value_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Int64Value* grpc_channelz_v1_SocketData_mutable_remote_flow_control_window(grpc_channelz_v1_SocketData* msg, upb_Arena* arena) {
+  struct google_protobuf_Int64Value* sub = (struct google_protobuf_Int64Value*)grpc_channelz_v1_SocketData_remote_flow_control_window(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Int64Value*)_upb_Message_New(&google__protobuf__Int64Value_msg_init, arena);
+    if (sub) grpc_channelz_v1_SocketData_set_remote_flow_control_window(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE grpc_channelz_v1_SocketOption** grpc_channelz_v1_SocketData_mutable_option(grpc_channelz_v1_SocketData* msg, size_t* size) {
+  upb_MiniTableField field = {13, UPB_SIZE(36, 112), 0, 6, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketOption_msg_init);
+  upb_Array* arr = upb_Message_GetMutableArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (grpc_channelz_v1_SocketOption**)upb_Array_MutableDataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE grpc_channelz_v1_SocketOption** grpc_channelz_v1_SocketData_resize_option(grpc_channelz_v1_SocketData* msg, size_t size, upb_Arena* arena) {
+  upb_MiniTableField field = {13, UPB_SIZE(36, 112), 0, 6, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_SocketOption**)upb_Message_ResizeArrayUninitialized(UPB_UPCAST(msg),
+                                                   &field, size, arena);
+}
+UPB_INLINE struct grpc_channelz_v1_SocketOption* grpc_channelz_v1_SocketData_add_option(grpc_channelz_v1_SocketData* msg, upb_Arena* arena) {
+  upb_MiniTableField field = {13, UPB_SIZE(36, 112), 0, 6, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketOption_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(
+      UPB_UPCAST(msg), &field, arena);
+  if (!arr || !UPB_PRIVATE(_upb_Array_ResizeUninitialized)(
+                  arr, arr->UPB_PRIVATE(size) + 1, arena)) {
+    return NULL;
+  }
+  struct grpc_channelz_v1_SocketOption* sub = (struct grpc_channelz_v1_SocketOption*)_upb_Message_New(&grpc__channelz__v1__SocketOption_msg_init, arena);
+  if (!arr || !sub) return NULL;
+  UPB_PRIVATE(_upb_Array_Set)
+  (arr, arr->UPB_PRIVATE(size) - 1, &sub, sizeof(sub));
+  return sub;
+}
+
+/* grpc.channelz.v1.Address */
+
+UPB_INLINE grpc_channelz_v1_Address* grpc_channelz_v1_Address_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_Address*)_upb_Message_New(&grpc__channelz__v1__Address_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_Address* grpc_channelz_v1_Address_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_Address* ret = grpc_channelz_v1_Address_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Address_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_Address* grpc_channelz_v1_Address_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_Address* ret = grpc_channelz_v1_Address_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Address_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_Address_serialize(const grpc_channelz_v1_Address* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Address_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_Address_serialize_ex(const grpc_channelz_v1_Address* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Address_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+typedef enum {
+  grpc_channelz_v1_Address_address_tcpip_address = 1,
+  grpc_channelz_v1_Address_address_uds_address = 2,
+  grpc_channelz_v1_Address_address_other_address = 3,
+  grpc_channelz_v1_Address_address_NOT_SET = 0
+} grpc_channelz_v1_Address_address_oneofcases;
+UPB_INLINE grpc_channelz_v1_Address_address_oneofcases grpc_channelz_v1_Address_address_case(const grpc_channelz_v1_Address* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_Address_address_oneofcases)upb_Message_WhichOneofFieldNumber(
+      UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Address_clear_address(grpc_channelz_v1_Address* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearOneof(UPB_UPCAST(msg), &grpc__channelz__v1__Address_msg_init, &field);
+}
+UPB_INLINE void grpc_channelz_v1_Address_clear_tcpip_address(grpc_channelz_v1_Address* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Address_TcpIpAddress* grpc_channelz_v1_Address_tcpip_address(const grpc_channelz_v1_Address* msg) {
+  const grpc_channelz_v1_Address_TcpIpAddress* default_val = NULL;
+  const grpc_channelz_v1_Address_TcpIpAddress* ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Address__TcpIpAddress_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Address_has_tcpip_address(const grpc_channelz_v1_Address* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Address_clear_uds_address(grpc_channelz_v1_Address* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 16), -9, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Address_UdsAddress* grpc_channelz_v1_Address_uds_address(const grpc_channelz_v1_Address* msg) {
+  const grpc_channelz_v1_Address_UdsAddress* default_val = NULL;
+  const grpc_channelz_v1_Address_UdsAddress* ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 16), -9, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Address__UdsAddress_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Address_has_uds_address(const grpc_channelz_v1_Address* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 16), -9, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Address_clear_other_address(grpc_channelz_v1_Address* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(12, 16), -9, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Address_OtherAddress* grpc_channelz_v1_Address_other_address(const grpc_channelz_v1_Address* msg) {
+  const grpc_channelz_v1_Address_OtherAddress* default_val = NULL;
+  const grpc_channelz_v1_Address_OtherAddress* ret;
+  const upb_MiniTableField field = {3, UPB_SIZE(12, 16), -9, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Address__OtherAddress_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Address_has_other_address(const grpc_channelz_v1_Address* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(12, 16), -9, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_Address_set_tcpip_address(grpc_channelz_v1_Address *msg, grpc_channelz_v1_Address_TcpIpAddress* value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Address__TcpIpAddress_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_Address_TcpIpAddress* grpc_channelz_v1_Address_mutable_tcpip_address(grpc_channelz_v1_Address* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_Address_TcpIpAddress* sub = (struct grpc_channelz_v1_Address_TcpIpAddress*)grpc_channelz_v1_Address_tcpip_address(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_Address_TcpIpAddress*)_upb_Message_New(&grpc__channelz__v1__Address__TcpIpAddress_msg_init, arena);
+    if (sub) grpc_channelz_v1_Address_set_tcpip_address(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_Address_set_uds_address(grpc_channelz_v1_Address *msg, grpc_channelz_v1_Address_UdsAddress* value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 16), -9, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Address__UdsAddress_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_Address_UdsAddress* grpc_channelz_v1_Address_mutable_uds_address(grpc_channelz_v1_Address* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_Address_UdsAddress* sub = (struct grpc_channelz_v1_Address_UdsAddress*)grpc_channelz_v1_Address_uds_address(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_Address_UdsAddress*)_upb_Message_New(&grpc__channelz__v1__Address__UdsAddress_msg_init, arena);
+    if (sub) grpc_channelz_v1_Address_set_uds_address(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_Address_set_other_address(grpc_channelz_v1_Address *msg, grpc_channelz_v1_Address_OtherAddress* value) {
+  const upb_MiniTableField field = {3, UPB_SIZE(12, 16), -9, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Address__OtherAddress_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_Address_OtherAddress* grpc_channelz_v1_Address_mutable_other_address(grpc_channelz_v1_Address* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_Address_OtherAddress* sub = (struct grpc_channelz_v1_Address_OtherAddress*)grpc_channelz_v1_Address_other_address(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_Address_OtherAddress*)_upb_Message_New(&grpc__channelz__v1__Address__OtherAddress_msg_init, arena);
+    if (sub) grpc_channelz_v1_Address_set_other_address(msg, sub);
+  }
+  return sub;
+}
+
+/* grpc.channelz.v1.Address.TcpIpAddress */
+
+UPB_INLINE grpc_channelz_v1_Address_TcpIpAddress* grpc_channelz_v1_Address_TcpIpAddress_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_Address_TcpIpAddress*)_upb_Message_New(&grpc__channelz__v1__Address__TcpIpAddress_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_Address_TcpIpAddress* grpc_channelz_v1_Address_TcpIpAddress_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_Address_TcpIpAddress* ret = grpc_channelz_v1_Address_TcpIpAddress_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Address__TcpIpAddress_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_Address_TcpIpAddress* grpc_channelz_v1_Address_TcpIpAddress_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_Address_TcpIpAddress* ret = grpc_channelz_v1_Address_TcpIpAddress_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Address__TcpIpAddress_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_Address_TcpIpAddress_serialize(const grpc_channelz_v1_Address_TcpIpAddress* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Address__TcpIpAddress_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_Address_TcpIpAddress_serialize_ex(const grpc_channelz_v1_Address_TcpIpAddress* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Address__TcpIpAddress_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_Address_TcpIpAddress_clear_ip_address(grpc_channelz_v1_Address_TcpIpAddress* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, kUpb_NoSub, 12, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_Address_TcpIpAddress_ip_address(const grpc_channelz_v1_Address_TcpIpAddress* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, kUpb_NoSub, 12, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_Address_TcpIpAddress_clear_port(grpc_channelz_v1_Address_TcpIpAddress* msg) {
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 5, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int32_t grpc_channelz_v1_Address_TcpIpAddress_port(const grpc_channelz_v1_Address_TcpIpAddress* msg) {
+  int32_t default_val = (int32_t)0;
+  int32_t ret;
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 5, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_Address_TcpIpAddress_set_ip_address(grpc_channelz_v1_Address_TcpIpAddress *msg, upb_StringView value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, kUpb_NoSub, 12, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_Address_TcpIpAddress_set_port(grpc_channelz_v1_Address_TcpIpAddress *msg, int32_t value) {
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 5, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.Address.UdsAddress */
+
+UPB_INLINE grpc_channelz_v1_Address_UdsAddress* grpc_channelz_v1_Address_UdsAddress_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_Address_UdsAddress*)_upb_Message_New(&grpc__channelz__v1__Address__UdsAddress_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_Address_UdsAddress* grpc_channelz_v1_Address_UdsAddress_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_Address_UdsAddress* ret = grpc_channelz_v1_Address_UdsAddress_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Address__UdsAddress_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_Address_UdsAddress* grpc_channelz_v1_Address_UdsAddress_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_Address_UdsAddress* ret = grpc_channelz_v1_Address_UdsAddress_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Address__UdsAddress_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_Address_UdsAddress_serialize(const grpc_channelz_v1_Address_UdsAddress* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Address__UdsAddress_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_Address_UdsAddress_serialize_ex(const grpc_channelz_v1_Address_UdsAddress* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Address__UdsAddress_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_Address_UdsAddress_clear_filename(grpc_channelz_v1_Address_UdsAddress* msg) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_Address_UdsAddress_filename(const grpc_channelz_v1_Address_UdsAddress* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_Address_UdsAddress_set_filename(grpc_channelz_v1_Address_UdsAddress *msg, upb_StringView value) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.Address.OtherAddress */
+
+UPB_INLINE grpc_channelz_v1_Address_OtherAddress* grpc_channelz_v1_Address_OtherAddress_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_Address_OtherAddress*)_upb_Message_New(&grpc__channelz__v1__Address__OtherAddress_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_Address_OtherAddress* grpc_channelz_v1_Address_OtherAddress_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_Address_OtherAddress* ret = grpc_channelz_v1_Address_OtherAddress_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Address__OtherAddress_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_Address_OtherAddress* grpc_channelz_v1_Address_OtherAddress_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_Address_OtherAddress* ret = grpc_channelz_v1_Address_OtherAddress_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Address__OtherAddress_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_Address_OtherAddress_serialize(const grpc_channelz_v1_Address_OtherAddress* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Address__OtherAddress_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_Address_OtherAddress_serialize_ex(const grpc_channelz_v1_Address_OtherAddress* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Address__OtherAddress_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_Address_OtherAddress_clear_name(grpc_channelz_v1_Address_OtherAddress* msg) {
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_Address_OtherAddress_name(const grpc_channelz_v1_Address_OtherAddress* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_Address_OtherAddress_clear_value(grpc_channelz_v1_Address_OtherAddress* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Any* grpc_channelz_v1_Address_OtherAddress_value(const grpc_channelz_v1_Address_OtherAddress* msg) {
+  const struct google_protobuf_Any* default_val = NULL;
+  const struct google_protobuf_Any* ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Any_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Address_OtherAddress_has_value(const grpc_channelz_v1_Address_OtherAddress* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_Address_OtherAddress_set_name(grpc_channelz_v1_Address_OtherAddress *msg, upb_StringView value) {
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_Address_OtherAddress_set_value(grpc_channelz_v1_Address_OtherAddress *msg, struct google_protobuf_Any* value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Any_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Any* grpc_channelz_v1_Address_OtherAddress_mutable_value(grpc_channelz_v1_Address_OtherAddress* msg, upb_Arena* arena) {
+  struct google_protobuf_Any* sub = (struct google_protobuf_Any*)grpc_channelz_v1_Address_OtherAddress_value(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Any*)_upb_Message_New(&google__protobuf__Any_msg_init, arena);
+    if (sub) grpc_channelz_v1_Address_OtherAddress_set_value(msg, sub);
+  }
+  return sub;
+}
+
+/* grpc.channelz.v1.Security */
+
+UPB_INLINE grpc_channelz_v1_Security* grpc_channelz_v1_Security_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_Security*)_upb_Message_New(&grpc__channelz__v1__Security_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_Security* grpc_channelz_v1_Security_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_Security* ret = grpc_channelz_v1_Security_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Security_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_Security* grpc_channelz_v1_Security_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_Security* ret = grpc_channelz_v1_Security_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Security_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_Security_serialize(const grpc_channelz_v1_Security* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Security_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_Security_serialize_ex(const grpc_channelz_v1_Security* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Security_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+typedef enum {
+  grpc_channelz_v1_Security_model_tls = 1,
+  grpc_channelz_v1_Security_model_other = 2,
+  grpc_channelz_v1_Security_model_NOT_SET = 0
+} grpc_channelz_v1_Security_model_oneofcases;
+UPB_INLINE grpc_channelz_v1_Security_model_oneofcases grpc_channelz_v1_Security_model_case(const grpc_channelz_v1_Security* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_Security_model_oneofcases)upb_Message_WhichOneofFieldNumber(
+      UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Security_clear_model(grpc_channelz_v1_Security* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearOneof(UPB_UPCAST(msg), &grpc__channelz__v1__Security_msg_init, &field);
+}
+UPB_INLINE void grpc_channelz_v1_Security_clear_tls(grpc_channelz_v1_Security* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Security_Tls* grpc_channelz_v1_Security_tls(const grpc_channelz_v1_Security* msg) {
+  const grpc_channelz_v1_Security_Tls* default_val = NULL;
+  const grpc_channelz_v1_Security_Tls* ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Security__Tls_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Security_has_tls(const grpc_channelz_v1_Security* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Security_clear_other(grpc_channelz_v1_Security* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 16), -9, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Security_OtherSecurity* grpc_channelz_v1_Security_other(const grpc_channelz_v1_Security* msg) {
+  const grpc_channelz_v1_Security_OtherSecurity* default_val = NULL;
+  const grpc_channelz_v1_Security_OtherSecurity* ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 16), -9, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Security__OtherSecurity_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Security_has_other(const grpc_channelz_v1_Security* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 16), -9, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_Security_set_tls(grpc_channelz_v1_Security *msg, grpc_channelz_v1_Security_Tls* value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Security__Tls_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_Security_Tls* grpc_channelz_v1_Security_mutable_tls(grpc_channelz_v1_Security* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_Security_Tls* sub = (struct grpc_channelz_v1_Security_Tls*)grpc_channelz_v1_Security_tls(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_Security_Tls*)_upb_Message_New(&grpc__channelz__v1__Security__Tls_msg_init, arena);
+    if (sub) grpc_channelz_v1_Security_set_tls(msg, sub);
+  }
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_Security_set_other(grpc_channelz_v1_Security *msg, grpc_channelz_v1_Security_OtherSecurity* value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 16), -9, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Security__OtherSecurity_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_Security_OtherSecurity* grpc_channelz_v1_Security_mutable_other(grpc_channelz_v1_Security* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_Security_OtherSecurity* sub = (struct grpc_channelz_v1_Security_OtherSecurity*)grpc_channelz_v1_Security_other(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_Security_OtherSecurity*)_upb_Message_New(&grpc__channelz__v1__Security__OtherSecurity_msg_init, arena);
+    if (sub) grpc_channelz_v1_Security_set_other(msg, sub);
+  }
+  return sub;
+}
+
+/* grpc.channelz.v1.Security.Tls */
+
+UPB_INLINE grpc_channelz_v1_Security_Tls* grpc_channelz_v1_Security_Tls_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_Security_Tls*)_upb_Message_New(&grpc__channelz__v1__Security__Tls_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_Security_Tls* grpc_channelz_v1_Security_Tls_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_Security_Tls* ret = grpc_channelz_v1_Security_Tls_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Security__Tls_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_Security_Tls* grpc_channelz_v1_Security_Tls_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_Security_Tls* ret = grpc_channelz_v1_Security_Tls_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Security__Tls_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_Security_Tls_serialize(const grpc_channelz_v1_Security_Tls* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Security__Tls_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_Security_Tls_serialize_ex(const grpc_channelz_v1_Security_Tls* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Security__Tls_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+typedef enum {
+  grpc_channelz_v1_Security_Tls_cipher_suite_standard_name = 1,
+  grpc_channelz_v1_Security_Tls_cipher_suite_other_name = 2,
+  grpc_channelz_v1_Security_Tls_cipher_suite_NOT_SET = 0
+} grpc_channelz_v1_Security_Tls_cipher_suite_oneofcases;
+UPB_INLINE grpc_channelz_v1_Security_Tls_cipher_suite_oneofcases grpc_channelz_v1_Security_Tls_cipher_suite_case(const grpc_channelz_v1_Security_Tls* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(28, 48), -9, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_Security_Tls_cipher_suite_oneofcases)upb_Message_WhichOneofFieldNumber(
+      UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Security_Tls_clear_cipher_suite(grpc_channelz_v1_Security_Tls* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(28, 48), -9, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearOneof(UPB_UPCAST(msg), &grpc__channelz__v1__Security__Tls_msg_init, &field);
+}
+UPB_INLINE void grpc_channelz_v1_Security_Tls_clear_standard_name(grpc_channelz_v1_Security_Tls* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(28, 48), -9, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_Security_Tls_standard_name(const grpc_channelz_v1_Security_Tls* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(28, 48), -9, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Security_Tls_has_standard_name(const grpc_channelz_v1_Security_Tls* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(28, 48), -9, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Security_Tls_clear_other_name(grpc_channelz_v1_Security_Tls* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(28, 48), -9, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_Security_Tls_other_name(const grpc_channelz_v1_Security_Tls* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(28, 48), -9, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Security_Tls_has_other_name(const grpc_channelz_v1_Security_Tls* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(28, 48), -9, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE void grpc_channelz_v1_Security_Tls_clear_local_certificate(grpc_channelz_v1_Security_Tls* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(12, 16), 0, kUpb_NoSub, 12, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_Security_Tls_local_certificate(const grpc_channelz_v1_Security_Tls* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {3, UPB_SIZE(12, 16), 0, kUpb_NoSub, 12, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_Security_Tls_clear_remote_certificate(grpc_channelz_v1_Security_Tls* msg) {
+  const upb_MiniTableField field = {4, UPB_SIZE(20, 32), 0, kUpb_NoSub, 12, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_Security_Tls_remote_certificate(const grpc_channelz_v1_Security_Tls* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {4, UPB_SIZE(20, 32), 0, kUpb_NoSub, 12, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_Security_Tls_set_standard_name(grpc_channelz_v1_Security_Tls *msg, upb_StringView value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(28, 48), -9, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_Security_Tls_set_other_name(grpc_channelz_v1_Security_Tls *msg, upb_StringView value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(28, 48), -9, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_Security_Tls_set_local_certificate(grpc_channelz_v1_Security_Tls *msg, upb_StringView value) {
+  const upb_MiniTableField field = {3, UPB_SIZE(12, 16), 0, kUpb_NoSub, 12, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_Security_Tls_set_remote_certificate(grpc_channelz_v1_Security_Tls *msg, upb_StringView value) {
+  const upb_MiniTableField field = {4, UPB_SIZE(20, 32), 0, kUpb_NoSub, 12, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.Security.OtherSecurity */
+
+UPB_INLINE grpc_channelz_v1_Security_OtherSecurity* grpc_channelz_v1_Security_OtherSecurity_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_Security_OtherSecurity*)_upb_Message_New(&grpc__channelz__v1__Security__OtherSecurity_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_Security_OtherSecurity* grpc_channelz_v1_Security_OtherSecurity_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_Security_OtherSecurity* ret = grpc_channelz_v1_Security_OtherSecurity_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Security__OtherSecurity_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_Security_OtherSecurity* grpc_channelz_v1_Security_OtherSecurity_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_Security_OtherSecurity* ret = grpc_channelz_v1_Security_OtherSecurity_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__Security__OtherSecurity_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_Security_OtherSecurity_serialize(const grpc_channelz_v1_Security_OtherSecurity* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Security__OtherSecurity_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_Security_OtherSecurity_serialize_ex(const grpc_channelz_v1_Security_OtherSecurity* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__Security__OtherSecurity_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_Security_OtherSecurity_clear_name(grpc_channelz_v1_Security_OtherSecurity* msg) {
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_Security_OtherSecurity_name(const grpc_channelz_v1_Security_OtherSecurity* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_Security_OtherSecurity_clear_value(grpc_channelz_v1_Security_OtherSecurity* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Any* grpc_channelz_v1_Security_OtherSecurity_value(const grpc_channelz_v1_Security_OtherSecurity* msg) {
+  const struct google_protobuf_Any* default_val = NULL;
+  const struct google_protobuf_Any* ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Any_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_Security_OtherSecurity_has_value(const grpc_channelz_v1_Security_OtherSecurity* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_Security_OtherSecurity_set_name(grpc_channelz_v1_Security_OtherSecurity *msg, upb_StringView value) {
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_Security_OtherSecurity_set_value(grpc_channelz_v1_Security_OtherSecurity *msg, struct google_protobuf_Any* value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Any_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Any* grpc_channelz_v1_Security_OtherSecurity_mutable_value(grpc_channelz_v1_Security_OtherSecurity* msg, upb_Arena* arena) {
+  struct google_protobuf_Any* sub = (struct google_protobuf_Any*)grpc_channelz_v1_Security_OtherSecurity_value(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Any*)_upb_Message_New(&google__protobuf__Any_msg_init, arena);
+    if (sub) grpc_channelz_v1_Security_OtherSecurity_set_value(msg, sub);
+  }
+  return sub;
+}
+
+/* grpc.channelz.v1.SocketOption */
+
+UPB_INLINE grpc_channelz_v1_SocketOption* grpc_channelz_v1_SocketOption_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_SocketOption*)_upb_Message_New(&grpc__channelz__v1__SocketOption_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_SocketOption* grpc_channelz_v1_SocketOption_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_SocketOption* ret = grpc_channelz_v1_SocketOption_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SocketOption_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_SocketOption* grpc_channelz_v1_SocketOption_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_SocketOption* ret = grpc_channelz_v1_SocketOption_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SocketOption_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_SocketOption_serialize(const grpc_channelz_v1_SocketOption* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SocketOption_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_SocketOption_serialize_ex(const grpc_channelz_v1_SocketOption* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SocketOption_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOption_clear_name(grpc_channelz_v1_SocketOption* msg) {
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_SocketOption_name(const grpc_channelz_v1_SocketOption* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOption_clear_value(grpc_channelz_v1_SocketOption* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(24, 32), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v1_SocketOption_value(const grpc_channelz_v1_SocketOption* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(24, 32), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOption_clear_additional(grpc_channelz_v1_SocketOption* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(12, 48), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Any* grpc_channelz_v1_SocketOption_additional(const grpc_channelz_v1_SocketOption* msg) {
+  const struct google_protobuf_Any* default_val = NULL;
+  const struct google_protobuf_Any* ret;
+  const upb_MiniTableField field = {3, UPB_SIZE(12, 48), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Any_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_SocketOption_has_additional(const grpc_channelz_v1_SocketOption* msg) {
+  const upb_MiniTableField field = {3, UPB_SIZE(12, 48), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_SocketOption_set_name(grpc_channelz_v1_SocketOption *msg, upb_StringView value) {
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOption_set_value(grpc_channelz_v1_SocketOption *msg, upb_StringView value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(24, 32), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOption_set_additional(grpc_channelz_v1_SocketOption *msg, struct google_protobuf_Any* value) {
+  const upb_MiniTableField field = {3, UPB_SIZE(12, 48), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Any_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Any* grpc_channelz_v1_SocketOption_mutable_additional(grpc_channelz_v1_SocketOption* msg, upb_Arena* arena) {
+  struct google_protobuf_Any* sub = (struct google_protobuf_Any*)grpc_channelz_v1_SocketOption_additional(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Any*)_upb_Message_New(&google__protobuf__Any_msg_init, arena);
+    if (sub) grpc_channelz_v1_SocketOption_set_additional(msg, sub);
+  }
+  return sub;
+}
+
+/* grpc.channelz.v1.SocketOptionTimeout */
+
+UPB_INLINE grpc_channelz_v1_SocketOptionTimeout* grpc_channelz_v1_SocketOptionTimeout_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_SocketOptionTimeout*)_upb_Message_New(&grpc__channelz__v1__SocketOptionTimeout_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_SocketOptionTimeout* grpc_channelz_v1_SocketOptionTimeout_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_SocketOptionTimeout* ret = grpc_channelz_v1_SocketOptionTimeout_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SocketOptionTimeout_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_SocketOptionTimeout* grpc_channelz_v1_SocketOptionTimeout_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_SocketOptionTimeout* ret = grpc_channelz_v1_SocketOptionTimeout_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SocketOptionTimeout_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_SocketOptionTimeout_serialize(const grpc_channelz_v1_SocketOptionTimeout* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SocketOptionTimeout_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_SocketOptionTimeout_serialize_ex(const grpc_channelz_v1_SocketOptionTimeout* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SocketOptionTimeout_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTimeout_clear_duration(grpc_channelz_v1_SocketOptionTimeout* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Duration* grpc_channelz_v1_SocketOptionTimeout_duration(const grpc_channelz_v1_SocketOptionTimeout* msg) {
+  const struct google_protobuf_Duration* default_val = NULL;
+  const struct google_protobuf_Duration* ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Duration_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_SocketOptionTimeout_has_duration(const grpc_channelz_v1_SocketOptionTimeout* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_SocketOptionTimeout_set_duration(grpc_channelz_v1_SocketOptionTimeout *msg, struct google_protobuf_Duration* value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Duration_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Duration* grpc_channelz_v1_SocketOptionTimeout_mutable_duration(grpc_channelz_v1_SocketOptionTimeout* msg, upb_Arena* arena) {
+  struct google_protobuf_Duration* sub = (struct google_protobuf_Duration*)grpc_channelz_v1_SocketOptionTimeout_duration(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Duration*)_upb_Message_New(&google__protobuf__Duration_msg_init, arena);
+    if (sub) grpc_channelz_v1_SocketOptionTimeout_set_duration(msg, sub);
+  }
+  return sub;
+}
+
+/* grpc.channelz.v1.SocketOptionLinger */
+
+UPB_INLINE grpc_channelz_v1_SocketOptionLinger* grpc_channelz_v1_SocketOptionLinger_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_SocketOptionLinger*)_upb_Message_New(&grpc__channelz__v1__SocketOptionLinger_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_SocketOptionLinger* grpc_channelz_v1_SocketOptionLinger_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_SocketOptionLinger* ret = grpc_channelz_v1_SocketOptionLinger_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SocketOptionLinger_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_SocketOptionLinger* grpc_channelz_v1_SocketOptionLinger_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_SocketOptionLinger* ret = grpc_channelz_v1_SocketOptionLinger_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SocketOptionLinger_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_SocketOptionLinger_serialize(const grpc_channelz_v1_SocketOptionLinger* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SocketOptionLinger_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_SocketOptionLinger_serialize_ex(const grpc_channelz_v1_SocketOptionLinger* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SocketOptionLinger_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionLinger_clear_active(grpc_channelz_v1_SocketOptionLinger* msg) {
+  const upb_MiniTableField field = {1, 9, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE bool grpc_channelz_v1_SocketOptionLinger_active(const grpc_channelz_v1_SocketOptionLinger* msg) {
+  bool default_val = false;
+  bool ret;
+  const upb_MiniTableField field = {1, 9, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionLinger_clear_duration(grpc_channelz_v1_SocketOptionLinger* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const struct google_protobuf_Duration* grpc_channelz_v1_SocketOptionLinger_duration(const grpc_channelz_v1_SocketOptionLinger* msg) {
+  const struct google_protobuf_Duration* default_val = NULL;
+  const struct google_protobuf_Duration* ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Duration_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_SocketOptionLinger_has_duration(const grpc_channelz_v1_SocketOptionLinger* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_SocketOptionLinger_set_active(grpc_channelz_v1_SocketOptionLinger *msg, bool value) {
+  const upb_MiniTableField field = {1, 9, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionLinger_set_duration(grpc_channelz_v1_SocketOptionLinger *msg, struct google_protobuf_Duration* value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&google__protobuf__Duration_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct google_protobuf_Duration* grpc_channelz_v1_SocketOptionLinger_mutable_duration(grpc_channelz_v1_SocketOptionLinger* msg, upb_Arena* arena) {
+  struct google_protobuf_Duration* sub = (struct google_protobuf_Duration*)grpc_channelz_v1_SocketOptionLinger_duration(msg);
+  if (sub == NULL) {
+    sub = (struct google_protobuf_Duration*)_upb_Message_New(&google__protobuf__Duration_msg_init, arena);
+    if (sub) grpc_channelz_v1_SocketOptionLinger_set_duration(msg, sub);
+  }
+  return sub;
+}
+
+/* grpc.channelz.v1.SocketOptionTcpInfo */
+
+UPB_INLINE grpc_channelz_v1_SocketOptionTcpInfo* grpc_channelz_v1_SocketOptionTcpInfo_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_SocketOptionTcpInfo*)_upb_Message_New(&grpc__channelz__v1__SocketOptionTcpInfo_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_SocketOptionTcpInfo* grpc_channelz_v1_SocketOptionTcpInfo_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_SocketOptionTcpInfo* ret = grpc_channelz_v1_SocketOptionTcpInfo_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SocketOptionTcpInfo_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_SocketOptionTcpInfo* grpc_channelz_v1_SocketOptionTcpInfo_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_SocketOptionTcpInfo* ret = grpc_channelz_v1_SocketOptionTcpInfo_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__SocketOptionTcpInfo_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_SocketOptionTcpInfo_serialize(const grpc_channelz_v1_SocketOptionTcpInfo* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SocketOptionTcpInfo_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_SocketOptionTcpInfo_serialize_ex(const grpc_channelz_v1_SocketOptionTcpInfo* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__SocketOptionTcpInfo_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_state(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_state(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_ca_state(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {2, 12, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_ca_state(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {2, 12, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_retransmits(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {3, 16, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_retransmits(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {3, 16, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_probes(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {4, 20, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_probes(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {4, 20, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_backoff(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {5, 24, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_backoff(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {5, 24, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_options(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {6, 28, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_options(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {6, 28, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_snd_wscale(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {7, 32, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_snd_wscale(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {7, 32, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_rcv_wscale(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {8, 36, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_rcv_wscale(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {8, 36, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_rto(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {9, 40, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_rto(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {9, 40, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_ato(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {10, 44, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_ato(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {10, 44, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_snd_mss(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {11, 48, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_snd_mss(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {11, 48, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_rcv_mss(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {12, 52, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_rcv_mss(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {12, 52, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_unacked(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {13, 56, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_unacked(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {13, 56, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_sacked(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {14, 60, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_sacked(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {14, 60, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_lost(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {15, 64, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_lost(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {15, 64, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_retrans(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {16, 68, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_retrans(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {16, 68, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_fackets(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {17, 72, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_fackets(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {17, 72, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_last_data_sent(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {18, 76, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_last_data_sent(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {18, 76, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_last_ack_sent(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {19, 80, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_last_ack_sent(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {19, 80, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_last_data_recv(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {20, 84, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_last_data_recv(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {20, 84, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_last_ack_recv(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {21, 88, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_last_ack_recv(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {21, 88, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_pmtu(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {22, 92, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_pmtu(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {22, 92, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_rcv_ssthresh(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {23, 96, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_rcv_ssthresh(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {23, 96, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_rtt(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {24, 100, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_rtt(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {24, 100, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_rttvar(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {25, 104, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_rttvar(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {25, 104, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_snd_ssthresh(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {26, 108, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_snd_ssthresh(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {26, 108, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_snd_cwnd(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {27, 112, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_snd_cwnd(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {27, 112, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_advmss(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {28, 116, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_advmss(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {28, 116, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_clear_tcpi_reordering(grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  const upb_MiniTableField field = {29, 120, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE uint32_t grpc_channelz_v1_SocketOptionTcpInfo_tcpi_reordering(const grpc_channelz_v1_SocketOptionTcpInfo* msg) {
+  uint32_t default_val = (uint32_t)0u;
+  uint32_t ret;
+  const upb_MiniTableField field = {29, 120, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_state(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_ca_state(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {2, 12, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_retransmits(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {3, 16, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_probes(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {4, 20, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_backoff(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {5, 24, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_options(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {6, 28, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_snd_wscale(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {7, 32, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_rcv_wscale(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {8, 36, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_rto(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {9, 40, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_ato(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {10, 44, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_snd_mss(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {11, 48, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_rcv_mss(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {12, 52, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_unacked(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {13, 56, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_sacked(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {14, 60, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_lost(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {15, 64, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_retrans(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {16, 68, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_fackets(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {17, 72, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_last_data_sent(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {18, 76, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_last_ack_sent(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {19, 80, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_last_data_recv(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {20, 84, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_last_ack_recv(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {21, 88, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_pmtu(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {22, 92, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_rcv_ssthresh(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {23, 96, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_rtt(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {24, 100, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_rttvar(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {25, 104, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_snd_ssthresh(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {26, 108, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_snd_cwnd(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {27, 112, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_advmss(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {28, 116, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_SocketOptionTcpInfo_set_tcpi_reordering(grpc_channelz_v1_SocketOptionTcpInfo *msg, uint32_t value) {
+  const upb_MiniTableField field = {29, 120, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.GetTopChannelsRequest */
+
+UPB_INLINE grpc_channelz_v1_GetTopChannelsRequest* grpc_channelz_v1_GetTopChannelsRequest_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetTopChannelsRequest*)_upb_Message_New(&grpc__channelz__v1__GetTopChannelsRequest_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetTopChannelsRequest* grpc_channelz_v1_GetTopChannelsRequest_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetTopChannelsRequest* ret = grpc_channelz_v1_GetTopChannelsRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetTopChannelsRequest_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetTopChannelsRequest* grpc_channelz_v1_GetTopChannelsRequest_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetTopChannelsRequest* ret = grpc_channelz_v1_GetTopChannelsRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetTopChannelsRequest_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetTopChannelsRequest_serialize(const grpc_channelz_v1_GetTopChannelsRequest* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetTopChannelsRequest_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetTopChannelsRequest_serialize_ex(const grpc_channelz_v1_GetTopChannelsRequest* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetTopChannelsRequest_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetTopChannelsRequest_clear_start_channel_id(grpc_channelz_v1_GetTopChannelsRequest* msg) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_GetTopChannelsRequest_start_channel_id(const grpc_channelz_v1_GetTopChannelsRequest* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_GetTopChannelsRequest_clear_max_results(grpc_channelz_v1_GetTopChannelsRequest* msg) {
+  const upb_MiniTableField field = {2, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_GetTopChannelsRequest_max_results(const grpc_channelz_v1_GetTopChannelsRequest* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {2, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_GetTopChannelsRequest_set_start_channel_id(grpc_channelz_v1_GetTopChannelsRequest *msg, int64_t value) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_GetTopChannelsRequest_set_max_results(grpc_channelz_v1_GetTopChannelsRequest *msg, int64_t value) {
+  const upb_MiniTableField field = {2, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.GetTopChannelsResponse */
+
+UPB_INLINE grpc_channelz_v1_GetTopChannelsResponse* grpc_channelz_v1_GetTopChannelsResponse_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetTopChannelsResponse*)_upb_Message_New(&grpc__channelz__v1__GetTopChannelsResponse_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetTopChannelsResponse* grpc_channelz_v1_GetTopChannelsResponse_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetTopChannelsResponse* ret = grpc_channelz_v1_GetTopChannelsResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetTopChannelsResponse_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetTopChannelsResponse* grpc_channelz_v1_GetTopChannelsResponse_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetTopChannelsResponse* ret = grpc_channelz_v1_GetTopChannelsResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetTopChannelsResponse_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetTopChannelsResponse_serialize(const grpc_channelz_v1_GetTopChannelsResponse* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetTopChannelsResponse_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetTopChannelsResponse_serialize_ex(const grpc_channelz_v1_GetTopChannelsResponse* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetTopChannelsResponse_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetTopChannelsResponse_clear_channel(grpc_channelz_v1_GetTopChannelsResponse* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Channel* const* grpc_channelz_v1_GetTopChannelsResponse_channel(const grpc_channelz_v1_GetTopChannelsResponse* msg, size_t* size) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Channel_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (const grpc_channelz_v1_Channel* const*)upb_Array_DataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE const upb_Array* _grpc_channelz_v1_GetTopChannelsResponse_channel_upb_array(const grpc_channelz_v1_GetTopChannelsResponse* msg, size_t* size) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Channel_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE upb_Array* _grpc_channelz_v1_GetTopChannelsResponse_channel_mutable_upb_array(grpc_channelz_v1_GetTopChannelsResponse* msg, size_t* size, upb_Arena* arena) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Channel_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(UPB_UPCAST(msg),
+                                                       &field, arena);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE void grpc_channelz_v1_GetTopChannelsResponse_clear_end(grpc_channelz_v1_GetTopChannelsResponse* msg) {
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE bool grpc_channelz_v1_GetTopChannelsResponse_end(const grpc_channelz_v1_GetTopChannelsResponse* msg) {
+  bool default_val = false;
+  bool ret;
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE grpc_channelz_v1_Channel** grpc_channelz_v1_GetTopChannelsResponse_mutable_channel(grpc_channelz_v1_GetTopChannelsResponse* msg, size_t* size) {
+  upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Channel_msg_init);
+  upb_Array* arr = upb_Message_GetMutableArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (grpc_channelz_v1_Channel**)upb_Array_MutableDataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE grpc_channelz_v1_Channel** grpc_channelz_v1_GetTopChannelsResponse_resize_channel(grpc_channelz_v1_GetTopChannelsResponse* msg, size_t size, upb_Arena* arena) {
+  upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_Channel**)upb_Message_ResizeArrayUninitialized(UPB_UPCAST(msg),
+                                                   &field, size, arena);
+}
+UPB_INLINE struct grpc_channelz_v1_Channel* grpc_channelz_v1_GetTopChannelsResponse_add_channel(grpc_channelz_v1_GetTopChannelsResponse* msg, upb_Arena* arena) {
+  upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Channel_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(
+      UPB_UPCAST(msg), &field, arena);
+  if (!arr || !UPB_PRIVATE(_upb_Array_ResizeUninitialized)(
+                  arr, arr->UPB_PRIVATE(size) + 1, arena)) {
+    return NULL;
+  }
+  struct grpc_channelz_v1_Channel* sub = (struct grpc_channelz_v1_Channel*)_upb_Message_New(&grpc__channelz__v1__Channel_msg_init, arena);
+  if (!arr || !sub) return NULL;
+  UPB_PRIVATE(_upb_Array_Set)
+  (arr, arr->UPB_PRIVATE(size) - 1, &sub, sizeof(sub));
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_GetTopChannelsResponse_set_end(grpc_channelz_v1_GetTopChannelsResponse *msg, bool value) {
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.GetServersRequest */
+
+UPB_INLINE grpc_channelz_v1_GetServersRequest* grpc_channelz_v1_GetServersRequest_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetServersRequest*)_upb_Message_New(&grpc__channelz__v1__GetServersRequest_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetServersRequest* grpc_channelz_v1_GetServersRequest_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetServersRequest* ret = grpc_channelz_v1_GetServersRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetServersRequest_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetServersRequest* grpc_channelz_v1_GetServersRequest_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetServersRequest* ret = grpc_channelz_v1_GetServersRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetServersRequest_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetServersRequest_serialize(const grpc_channelz_v1_GetServersRequest* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetServersRequest_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetServersRequest_serialize_ex(const grpc_channelz_v1_GetServersRequest* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetServersRequest_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetServersRequest_clear_start_server_id(grpc_channelz_v1_GetServersRequest* msg) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_GetServersRequest_start_server_id(const grpc_channelz_v1_GetServersRequest* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_GetServersRequest_clear_max_results(grpc_channelz_v1_GetServersRequest* msg) {
+  const upb_MiniTableField field = {2, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_GetServersRequest_max_results(const grpc_channelz_v1_GetServersRequest* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {2, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_GetServersRequest_set_start_server_id(grpc_channelz_v1_GetServersRequest *msg, int64_t value) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_GetServersRequest_set_max_results(grpc_channelz_v1_GetServersRequest *msg, int64_t value) {
+  const upb_MiniTableField field = {2, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.GetServersResponse */
+
+UPB_INLINE grpc_channelz_v1_GetServersResponse* grpc_channelz_v1_GetServersResponse_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetServersResponse*)_upb_Message_New(&grpc__channelz__v1__GetServersResponse_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetServersResponse* grpc_channelz_v1_GetServersResponse_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetServersResponse* ret = grpc_channelz_v1_GetServersResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetServersResponse_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetServersResponse* grpc_channelz_v1_GetServersResponse_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetServersResponse* ret = grpc_channelz_v1_GetServersResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetServersResponse_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetServersResponse_serialize(const grpc_channelz_v1_GetServersResponse* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetServersResponse_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetServersResponse_serialize_ex(const grpc_channelz_v1_GetServersResponse* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetServersResponse_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetServersResponse_clear_server(grpc_channelz_v1_GetServersResponse* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Server* const* grpc_channelz_v1_GetServersResponse_server(const grpc_channelz_v1_GetServersResponse* msg, size_t* size) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Server_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (const grpc_channelz_v1_Server* const*)upb_Array_DataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE const upb_Array* _grpc_channelz_v1_GetServersResponse_server_upb_array(const grpc_channelz_v1_GetServersResponse* msg, size_t* size) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Server_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE upb_Array* _grpc_channelz_v1_GetServersResponse_server_mutable_upb_array(grpc_channelz_v1_GetServersResponse* msg, size_t* size, upb_Arena* arena) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Server_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(UPB_UPCAST(msg),
+                                                       &field, arena);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE void grpc_channelz_v1_GetServersResponse_clear_end(grpc_channelz_v1_GetServersResponse* msg) {
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE bool grpc_channelz_v1_GetServersResponse_end(const grpc_channelz_v1_GetServersResponse* msg) {
+  bool default_val = false;
+  bool ret;
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE grpc_channelz_v1_Server** grpc_channelz_v1_GetServersResponse_mutable_server(grpc_channelz_v1_GetServersResponse* msg, size_t* size) {
+  upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Server_msg_init);
+  upb_Array* arr = upb_Message_GetMutableArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (grpc_channelz_v1_Server**)upb_Array_MutableDataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE grpc_channelz_v1_Server** grpc_channelz_v1_GetServersResponse_resize_server(grpc_channelz_v1_GetServersResponse* msg, size_t size, upb_Arena* arena) {
+  upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_Server**)upb_Message_ResizeArrayUninitialized(UPB_UPCAST(msg),
+                                                   &field, size, arena);
+}
+UPB_INLINE struct grpc_channelz_v1_Server* grpc_channelz_v1_GetServersResponse_add_server(grpc_channelz_v1_GetServersResponse* msg, upb_Arena* arena) {
+  upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Server_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(
+      UPB_UPCAST(msg), &field, arena);
+  if (!arr || !UPB_PRIVATE(_upb_Array_ResizeUninitialized)(
+                  arr, arr->UPB_PRIVATE(size) + 1, arena)) {
+    return NULL;
+  }
+  struct grpc_channelz_v1_Server* sub = (struct grpc_channelz_v1_Server*)_upb_Message_New(&grpc__channelz__v1__Server_msg_init, arena);
+  if (!arr || !sub) return NULL;
+  UPB_PRIVATE(_upb_Array_Set)
+  (arr, arr->UPB_PRIVATE(size) - 1, &sub, sizeof(sub));
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_GetServersResponse_set_end(grpc_channelz_v1_GetServersResponse *msg, bool value) {
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.GetServerRequest */
+
+UPB_INLINE grpc_channelz_v1_GetServerRequest* grpc_channelz_v1_GetServerRequest_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetServerRequest*)_upb_Message_New(&grpc__channelz__v1__GetServerRequest_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetServerRequest* grpc_channelz_v1_GetServerRequest_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetServerRequest* ret = grpc_channelz_v1_GetServerRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetServerRequest_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetServerRequest* grpc_channelz_v1_GetServerRequest_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetServerRequest* ret = grpc_channelz_v1_GetServerRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetServerRequest_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetServerRequest_serialize(const grpc_channelz_v1_GetServerRequest* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetServerRequest_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetServerRequest_serialize_ex(const grpc_channelz_v1_GetServerRequest* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetServerRequest_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetServerRequest_clear_server_id(grpc_channelz_v1_GetServerRequest* msg) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_GetServerRequest_server_id(const grpc_channelz_v1_GetServerRequest* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_GetServerRequest_set_server_id(grpc_channelz_v1_GetServerRequest *msg, int64_t value) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.GetServerResponse */
+
+UPB_INLINE grpc_channelz_v1_GetServerResponse* grpc_channelz_v1_GetServerResponse_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetServerResponse*)_upb_Message_New(&grpc__channelz__v1__GetServerResponse_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetServerResponse* grpc_channelz_v1_GetServerResponse_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetServerResponse* ret = grpc_channelz_v1_GetServerResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetServerResponse_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetServerResponse* grpc_channelz_v1_GetServerResponse_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetServerResponse* ret = grpc_channelz_v1_GetServerResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetServerResponse_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetServerResponse_serialize(const grpc_channelz_v1_GetServerResponse* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetServerResponse_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetServerResponse_serialize_ex(const grpc_channelz_v1_GetServerResponse* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetServerResponse_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetServerResponse_clear_server(grpc_channelz_v1_GetServerResponse* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Server* grpc_channelz_v1_GetServerResponse_server(const grpc_channelz_v1_GetServerResponse* msg) {
+  const grpc_channelz_v1_Server* default_val = NULL;
+  const grpc_channelz_v1_Server* ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Server_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_GetServerResponse_has_server(const grpc_channelz_v1_GetServerResponse* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_GetServerResponse_set_server(grpc_channelz_v1_GetServerResponse *msg, grpc_channelz_v1_Server* value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Server_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_Server* grpc_channelz_v1_GetServerResponse_mutable_server(grpc_channelz_v1_GetServerResponse* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_Server* sub = (struct grpc_channelz_v1_Server*)grpc_channelz_v1_GetServerResponse_server(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_Server*)_upb_Message_New(&grpc__channelz__v1__Server_msg_init, arena);
+    if (sub) grpc_channelz_v1_GetServerResponse_set_server(msg, sub);
+  }
+  return sub;
+}
+
+/* grpc.channelz.v1.GetServerSocketsRequest */
+
+UPB_INLINE grpc_channelz_v1_GetServerSocketsRequest* grpc_channelz_v1_GetServerSocketsRequest_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetServerSocketsRequest*)_upb_Message_New(&grpc__channelz__v1__GetServerSocketsRequest_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetServerSocketsRequest* grpc_channelz_v1_GetServerSocketsRequest_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetServerSocketsRequest* ret = grpc_channelz_v1_GetServerSocketsRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetServerSocketsRequest_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetServerSocketsRequest* grpc_channelz_v1_GetServerSocketsRequest_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetServerSocketsRequest* ret = grpc_channelz_v1_GetServerSocketsRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetServerSocketsRequest_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetServerSocketsRequest_serialize(const grpc_channelz_v1_GetServerSocketsRequest* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetServerSocketsRequest_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetServerSocketsRequest_serialize_ex(const grpc_channelz_v1_GetServerSocketsRequest* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetServerSocketsRequest_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetServerSocketsRequest_clear_server_id(grpc_channelz_v1_GetServerSocketsRequest* msg) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_GetServerSocketsRequest_server_id(const grpc_channelz_v1_GetServerSocketsRequest* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_GetServerSocketsRequest_clear_start_socket_id(grpc_channelz_v1_GetServerSocketsRequest* msg) {
+  const upb_MiniTableField field = {2, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_GetServerSocketsRequest_start_socket_id(const grpc_channelz_v1_GetServerSocketsRequest* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {2, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_GetServerSocketsRequest_clear_max_results(grpc_channelz_v1_GetServerSocketsRequest* msg) {
+  const upb_MiniTableField field = {3, 24, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_GetServerSocketsRequest_max_results(const grpc_channelz_v1_GetServerSocketsRequest* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {3, 24, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_GetServerSocketsRequest_set_server_id(grpc_channelz_v1_GetServerSocketsRequest *msg, int64_t value) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_GetServerSocketsRequest_set_start_socket_id(grpc_channelz_v1_GetServerSocketsRequest *msg, int64_t value) {
+  const upb_MiniTableField field = {2, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_GetServerSocketsRequest_set_max_results(grpc_channelz_v1_GetServerSocketsRequest *msg, int64_t value) {
+  const upb_MiniTableField field = {3, 24, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.GetServerSocketsResponse */
+
+UPB_INLINE grpc_channelz_v1_GetServerSocketsResponse* grpc_channelz_v1_GetServerSocketsResponse_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetServerSocketsResponse*)_upb_Message_New(&grpc__channelz__v1__GetServerSocketsResponse_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetServerSocketsResponse* grpc_channelz_v1_GetServerSocketsResponse_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetServerSocketsResponse* ret = grpc_channelz_v1_GetServerSocketsResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetServerSocketsResponse_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetServerSocketsResponse* grpc_channelz_v1_GetServerSocketsResponse_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetServerSocketsResponse* ret = grpc_channelz_v1_GetServerSocketsResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetServerSocketsResponse_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetServerSocketsResponse_serialize(const grpc_channelz_v1_GetServerSocketsResponse* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetServerSocketsResponse_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetServerSocketsResponse_serialize_ex(const grpc_channelz_v1_GetServerSocketsResponse* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetServerSocketsResponse_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetServerSocketsResponse_clear_socket_ref(grpc_channelz_v1_GetServerSocketsResponse* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_SocketRef* const* grpc_channelz_v1_GetServerSocketsResponse_socket_ref(const grpc_channelz_v1_GetServerSocketsResponse* msg, size_t* size) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (const grpc_channelz_v1_SocketRef* const*)upb_Array_DataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE const upb_Array* _grpc_channelz_v1_GetServerSocketsResponse_socket_ref_upb_array(const grpc_channelz_v1_GetServerSocketsResponse* msg, size_t* size) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE upb_Array* _grpc_channelz_v1_GetServerSocketsResponse_socket_ref_mutable_upb_array(grpc_channelz_v1_GetServerSocketsResponse* msg, size_t* size, upb_Arena* arena) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(UPB_UPCAST(msg),
+                                                       &field, arena);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+UPB_INLINE void grpc_channelz_v1_GetServerSocketsResponse_clear_end(grpc_channelz_v1_GetServerSocketsResponse* msg) {
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE bool grpc_channelz_v1_GetServerSocketsResponse_end(const grpc_channelz_v1_GetServerSocketsResponse* msg) {
+  bool default_val = false;
+  bool ret;
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE grpc_channelz_v1_SocketRef** grpc_channelz_v1_GetServerSocketsResponse_mutable_socket_ref(grpc_channelz_v1_GetServerSocketsResponse* msg, size_t* size) {
+  upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  upb_Array* arr = upb_Message_GetMutableArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (grpc_channelz_v1_SocketRef**)upb_Array_MutableDataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE grpc_channelz_v1_SocketRef** grpc_channelz_v1_GetServerSocketsResponse_resize_socket_ref(grpc_channelz_v1_GetServerSocketsResponse* msg, size_t size, upb_Arena* arena) {
+  upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v1_SocketRef**)upb_Message_ResizeArrayUninitialized(UPB_UPCAST(msg),
+                                                   &field, size, arena);
+}
+UPB_INLINE struct grpc_channelz_v1_SocketRef* grpc_channelz_v1_GetServerSocketsResponse_add_socket_ref(grpc_channelz_v1_GetServerSocketsResponse* msg, upb_Arena* arena) {
+  upb_MiniTableField field = {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__SocketRef_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(
+      UPB_UPCAST(msg), &field, arena);
+  if (!arr || !UPB_PRIVATE(_upb_Array_ResizeUninitialized)(
+                  arr, arr->UPB_PRIVATE(size) + 1, arena)) {
+    return NULL;
+  }
+  struct grpc_channelz_v1_SocketRef* sub = (struct grpc_channelz_v1_SocketRef*)_upb_Message_New(&grpc__channelz__v1__SocketRef_msg_init, arena);
+  if (!arr || !sub) return NULL;
+  UPB_PRIVATE(_upb_Array_Set)
+  (arr, arr->UPB_PRIVATE(size) - 1, &sub, sizeof(sub));
+  return sub;
+}
+UPB_INLINE void grpc_channelz_v1_GetServerSocketsResponse_set_end(grpc_channelz_v1_GetServerSocketsResponse *msg, bool value) {
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.GetChannelRequest */
+
+UPB_INLINE grpc_channelz_v1_GetChannelRequest* grpc_channelz_v1_GetChannelRequest_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetChannelRequest*)_upb_Message_New(&grpc__channelz__v1__GetChannelRequest_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetChannelRequest* grpc_channelz_v1_GetChannelRequest_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetChannelRequest* ret = grpc_channelz_v1_GetChannelRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetChannelRequest_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetChannelRequest* grpc_channelz_v1_GetChannelRequest_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetChannelRequest* ret = grpc_channelz_v1_GetChannelRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetChannelRequest_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetChannelRequest_serialize(const grpc_channelz_v1_GetChannelRequest* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetChannelRequest_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetChannelRequest_serialize_ex(const grpc_channelz_v1_GetChannelRequest* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetChannelRequest_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetChannelRequest_clear_channel_id(grpc_channelz_v1_GetChannelRequest* msg) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_GetChannelRequest_channel_id(const grpc_channelz_v1_GetChannelRequest* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_GetChannelRequest_set_channel_id(grpc_channelz_v1_GetChannelRequest *msg, int64_t value) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.GetChannelResponse */
+
+UPB_INLINE grpc_channelz_v1_GetChannelResponse* grpc_channelz_v1_GetChannelResponse_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetChannelResponse*)_upb_Message_New(&grpc__channelz__v1__GetChannelResponse_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetChannelResponse* grpc_channelz_v1_GetChannelResponse_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetChannelResponse* ret = grpc_channelz_v1_GetChannelResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetChannelResponse_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetChannelResponse* grpc_channelz_v1_GetChannelResponse_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetChannelResponse* ret = grpc_channelz_v1_GetChannelResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetChannelResponse_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetChannelResponse_serialize(const grpc_channelz_v1_GetChannelResponse* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetChannelResponse_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetChannelResponse_serialize_ex(const grpc_channelz_v1_GetChannelResponse* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetChannelResponse_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetChannelResponse_clear_channel(grpc_channelz_v1_GetChannelResponse* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Channel* grpc_channelz_v1_GetChannelResponse_channel(const grpc_channelz_v1_GetChannelResponse* msg) {
+  const grpc_channelz_v1_Channel* default_val = NULL;
+  const grpc_channelz_v1_Channel* ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Channel_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_GetChannelResponse_has_channel(const grpc_channelz_v1_GetChannelResponse* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_GetChannelResponse_set_channel(grpc_channelz_v1_GetChannelResponse *msg, grpc_channelz_v1_Channel* value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Channel_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_Channel* grpc_channelz_v1_GetChannelResponse_mutable_channel(grpc_channelz_v1_GetChannelResponse* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_Channel* sub = (struct grpc_channelz_v1_Channel*)grpc_channelz_v1_GetChannelResponse_channel(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_Channel*)_upb_Message_New(&grpc__channelz__v1__Channel_msg_init, arena);
+    if (sub) grpc_channelz_v1_GetChannelResponse_set_channel(msg, sub);
+  }
+  return sub;
+}
+
+/* grpc.channelz.v1.GetSubchannelRequest */
+
+UPB_INLINE grpc_channelz_v1_GetSubchannelRequest* grpc_channelz_v1_GetSubchannelRequest_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetSubchannelRequest*)_upb_Message_New(&grpc__channelz__v1__GetSubchannelRequest_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetSubchannelRequest* grpc_channelz_v1_GetSubchannelRequest_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetSubchannelRequest* ret = grpc_channelz_v1_GetSubchannelRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetSubchannelRequest_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetSubchannelRequest* grpc_channelz_v1_GetSubchannelRequest_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetSubchannelRequest* ret = grpc_channelz_v1_GetSubchannelRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetSubchannelRequest_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetSubchannelRequest_serialize(const grpc_channelz_v1_GetSubchannelRequest* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetSubchannelRequest_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetSubchannelRequest_serialize_ex(const grpc_channelz_v1_GetSubchannelRequest* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetSubchannelRequest_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetSubchannelRequest_clear_subchannel_id(grpc_channelz_v1_GetSubchannelRequest* msg) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_GetSubchannelRequest_subchannel_id(const grpc_channelz_v1_GetSubchannelRequest* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_GetSubchannelRequest_set_subchannel_id(grpc_channelz_v1_GetSubchannelRequest *msg, int64_t value) {
+  const upb_MiniTableField field = {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.GetSubchannelResponse */
+
+UPB_INLINE grpc_channelz_v1_GetSubchannelResponse* grpc_channelz_v1_GetSubchannelResponse_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetSubchannelResponse*)_upb_Message_New(&grpc__channelz__v1__GetSubchannelResponse_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetSubchannelResponse* grpc_channelz_v1_GetSubchannelResponse_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetSubchannelResponse* ret = grpc_channelz_v1_GetSubchannelResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetSubchannelResponse_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetSubchannelResponse* grpc_channelz_v1_GetSubchannelResponse_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetSubchannelResponse* ret = grpc_channelz_v1_GetSubchannelResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetSubchannelResponse_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetSubchannelResponse_serialize(const grpc_channelz_v1_GetSubchannelResponse* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetSubchannelResponse_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetSubchannelResponse_serialize_ex(const grpc_channelz_v1_GetSubchannelResponse* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetSubchannelResponse_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetSubchannelResponse_clear_subchannel(grpc_channelz_v1_GetSubchannelResponse* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Subchannel* grpc_channelz_v1_GetSubchannelResponse_subchannel(const grpc_channelz_v1_GetSubchannelResponse* msg) {
+  const grpc_channelz_v1_Subchannel* default_val = NULL;
+  const grpc_channelz_v1_Subchannel* ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Subchannel_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_GetSubchannelResponse_has_subchannel(const grpc_channelz_v1_GetSubchannelResponse* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_GetSubchannelResponse_set_subchannel(grpc_channelz_v1_GetSubchannelResponse *msg, grpc_channelz_v1_Subchannel* value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Subchannel_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_Subchannel* grpc_channelz_v1_GetSubchannelResponse_mutable_subchannel(grpc_channelz_v1_GetSubchannelResponse* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_Subchannel* sub = (struct grpc_channelz_v1_Subchannel*)grpc_channelz_v1_GetSubchannelResponse_subchannel(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_Subchannel*)_upb_Message_New(&grpc__channelz__v1__Subchannel_msg_init, arena);
+    if (sub) grpc_channelz_v1_GetSubchannelResponse_set_subchannel(msg, sub);
+  }
+  return sub;
+}
+
+/* grpc.channelz.v1.GetSocketRequest */
+
+UPB_INLINE grpc_channelz_v1_GetSocketRequest* grpc_channelz_v1_GetSocketRequest_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetSocketRequest*)_upb_Message_New(&grpc__channelz__v1__GetSocketRequest_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetSocketRequest* grpc_channelz_v1_GetSocketRequest_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetSocketRequest* ret = grpc_channelz_v1_GetSocketRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetSocketRequest_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetSocketRequest* grpc_channelz_v1_GetSocketRequest_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetSocketRequest* ret = grpc_channelz_v1_GetSocketRequest_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetSocketRequest_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetSocketRequest_serialize(const grpc_channelz_v1_GetSocketRequest* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetSocketRequest_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetSocketRequest_serialize_ex(const grpc_channelz_v1_GetSocketRequest* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetSocketRequest_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetSocketRequest_clear_socket_id(grpc_channelz_v1_GetSocketRequest* msg) {
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE int64_t grpc_channelz_v1_GetSocketRequest_socket_id(const grpc_channelz_v1_GetSocketRequest* msg) {
+  int64_t default_val = (int64_t)0ll;
+  int64_t ret;
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v1_GetSocketRequest_clear_summary(grpc_channelz_v1_GetSocketRequest* msg) {
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE bool grpc_channelz_v1_GetSocketRequest_summary(const grpc_channelz_v1_GetSocketRequest* msg) {
+  bool default_val = false;
+  bool ret;
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+
+UPB_INLINE void grpc_channelz_v1_GetSocketRequest_set_socket_id(grpc_channelz_v1_GetSocketRequest *msg, int64_t value) {
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE void grpc_channelz_v1_GetSocketRequest_set_summary(grpc_channelz_v1_GetSocketRequest *msg, bool value) {
+  const upb_MiniTableField field = {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+
+/* grpc.channelz.v1.GetSocketResponse */
+
+UPB_INLINE grpc_channelz_v1_GetSocketResponse* grpc_channelz_v1_GetSocketResponse_new(upb_Arena* arena) {
+  return (grpc_channelz_v1_GetSocketResponse*)_upb_Message_New(&grpc__channelz__v1__GetSocketResponse_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v1_GetSocketResponse* grpc_channelz_v1_GetSocketResponse_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v1_GetSocketResponse* ret = grpc_channelz_v1_GetSocketResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetSocketResponse_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE grpc_channelz_v1_GetSocketResponse* grpc_channelz_v1_GetSocketResponse_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v1_GetSocketResponse* ret = grpc_channelz_v1_GetSocketResponse_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v1__GetSocketResponse_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v1_GetSocketResponse_serialize(const grpc_channelz_v1_GetSocketResponse* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetSocketResponse_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v1_GetSocketResponse_serialize_ex(const grpc_channelz_v1_GetSocketResponse* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v1__GetSocketResponse_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v1_GetSocketResponse_clear_socket(grpc_channelz_v1_GetSocketResponse* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v1_Socket* grpc_channelz_v1_GetSocketResponse_socket(const grpc_channelz_v1_GetSocketResponse* msg) {
+  const grpc_channelz_v1_Socket* default_val = NULL;
+  const grpc_channelz_v1_Socket* ret;
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Socket_msg_init);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v1_GetSocketResponse_has_socket(const grpc_channelz_v1_GetSocketResponse* msg) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
+}
+
+UPB_INLINE void grpc_channelz_v1_GetSocketResponse_set_socket(grpc_channelz_v1_GetSocketResponse *msg, grpc_channelz_v1_Socket* value) {
+  const upb_MiniTableField field = {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v1__Socket_msg_init);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v1_Socket* grpc_channelz_v1_GetSocketResponse_mutable_socket(grpc_channelz_v1_GetSocketResponse* msg, upb_Arena* arena) {
+  struct grpc_channelz_v1_Socket* sub = (struct grpc_channelz_v1_Socket*)grpc_channelz_v1_GetSocketResponse_socket(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v1_Socket*)_upb_Message_New(&grpc__channelz__v1__Socket_msg_init, arena);
+    if (sub) grpc_channelz_v1_GetSocketResponse_set_socket(msg, sub);
+  }
+  return sub;
+}
+
+#ifdef __cplusplus
+}  /* extern "C" */
+#endif
+
+#include "upb/port/undef.inc"
+
+#endif  /* SRC_PROTO_GRPC_CHANNELZ_CHANNELZ_PROTO_UPB_H__UPB_H_ */
diff --git a/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/channelz.upb_minitable.c b/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/channelz.upb_minitable.c
new file mode 100644
index 00000000000..2a96f6d6d61
--- /dev/null
+++ b/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/channelz.upb_minitable.c
@@ -0,0 +1,1111 @@
+/* This file was generated by upb_generator from the input file:
+ *
+ *     src/proto/grpc/channelz/channelz.proto
+ *
+ * Do not edit -- your changes will be discarded when the file is
+ * regenerated.
+ * NO CHECKED-IN PROTOBUF GENCODE */
+
+#include <stddef.h>
+#include "upb/generated_code_support.h"
+#include "src/proto/grpc/channelz/channelz.upb_minitable.h"
+#include "google/protobuf/any.upb_minitable.h"
+#include "google/protobuf/duration.upb_minitable.h"
+#include "google/protobuf/timestamp.upb_minitable.h"
+#include "google/protobuf/wrappers.upb_minitable.h"
+
+// Must be last.
+#include "upb/port/def.inc"
+
+extern const struct upb_MiniTable UPB_PRIVATE(_kUpb_MiniTable_StaticallyTreeShaken);
+static const upb_MiniTableSubInternal grpc_channelz_v1_Channel__submsgs[5] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__ChannelRef_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__ChannelData_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__ChannelRef_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__SubchannelRef_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__SocketRef_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_Channel__fields[5] = {
+  {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__Channel_msg_init = {
+  &grpc_channelz_v1_Channel__submsgs[0],
+  &grpc_channelz_v1_Channel__fields[0],
+  UPB_SIZE(32, 56), 5, kUpb_ExtMode_NonExtendable, 5, UPB_FASTTABLE_MASK(56), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.Channel",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x002000003f02001a, &upb_prm_1bt_max64b},
+    {0x002800003f030022, &upb_prm_1bt_max64b},
+    {0x003000003f04002a, &upb_prm_1bt_max64b},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__Channel_msg_init_ptr = &grpc__channelz__v1__Channel_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_Subchannel__submsgs[5] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__SubchannelRef_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__ChannelData_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__ChannelRef_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__SubchannelRef_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__SocketRef_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_Subchannel__fields[5] = {
+  {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {4, UPB_SIZE(24, 40), 0, 3, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {5, UPB_SIZE(28, 48), 0, 4, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__Subchannel_msg_init = {
+  &grpc_channelz_v1_Subchannel__submsgs[0],
+  &grpc_channelz_v1_Subchannel__fields[0],
+  UPB_SIZE(32, 56), 5, kUpb_ExtMode_NonExtendable, 5, UPB_FASTTABLE_MASK(56), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.Subchannel",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x002000003f02001a, &upb_prm_1bt_max64b},
+    {0x002800003f030022, &upb_prm_1bt_max64b},
+    {0x003000003f04002a, &upb_prm_1bt_max64b},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__Subchannel_msg_init_ptr = &grpc__channelz__v1__Subchannel_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_ChannelConnectivityState__fields[1] = {
+  {1, 8, 0, kUpb_NoSub, 5, (int)kUpb_FieldMode_Scalar | (int)kUpb_LabelFlags_IsAlternate | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__ChannelConnectivityState_msg_init = {
+  NULL,
+  &grpc_channelz_v1_ChannelConnectivityState__fields[0],
+  16, 1, kUpb_ExtMode_NonExtendable, 1, UPB_FASTTABLE_MASK(8), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.ChannelConnectivityState",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x000800003f000008, &upb_psv4_1bt},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__ChannelConnectivityState_msg_init_ptr = &grpc__channelz__v1__ChannelConnectivityState_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_ChannelData__submsgs[3] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__ChannelConnectivityState_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__ChannelTrace_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Timestamp_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_ChannelData__fields[7] = {
+  {1, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(24, 16), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {3, UPB_SIZE(16, 40), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {4, UPB_SIZE(32, 48), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {5, UPB_SIZE(40, 56), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {6, UPB_SIZE(48, 64), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {7, UPB_SIZE(20, 72), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__ChannelData_msg_init = {
+  &grpc_channelz_v1_ChannelData__submsgs[0],
+  &grpc_channelz_v1_ChannelData__fields[0],
+  UPB_SIZE(56, 80), 7, kUpb_ExtMode_NonExtendable, 7, UPB_FASTTABLE_MASK(56), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.ChannelData",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000003f000012, &upb_pss_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x003000003f000020, &upb_psv8_1bt},
+    {0x003800003f000028, &upb_psv8_1bt},
+    {0x004000003f000030, &upb_psv8_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__ChannelData_msg_init_ptr = &grpc__channelz__v1__ChannelData_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_ChannelTraceEvent__submsgs[3] = {
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Timestamp_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__ChannelRef_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__SubchannelRef_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_ChannelTraceEvent__fields[5] = {
+  {1, UPB_SIZE(28, 24), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {2, 12, 0, kUpb_NoSub, 5, (int)kUpb_FieldMode_Scalar | (int)kUpb_LabelFlags_IsAlternate | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {3, UPB_SIZE(16, 40), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {4, UPB_SIZE(24, 48), UPB_SIZE(-21, -17), 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {5, UPB_SIZE(24, 48), UPB_SIZE(-21, -17), 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__ChannelTraceEvent_msg_init = {
+  &grpc_channelz_v1_ChannelTraceEvent__submsgs[0],
+  &grpc_channelz_v1_ChannelTraceEvent__fields[0],
+  UPB_SIZE(40, 56), 5, kUpb_ExtMode_NonExtendable, 5, UPB_FASTTABLE_MASK(56), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.ChannelTraceEvent",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001800003f00000a, &upb_pss_1bt},
+    {0x000c00003f000010, &upb_psv4_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0030001004010022, &upb_pom_1bt_max64b},
+    {0x003000100502002a, &upb_pom_1bt_max64b},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__ChannelTraceEvent_msg_init_ptr = &grpc__channelz__v1__ChannelTraceEvent_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_ChannelTrace__submsgs[2] = {
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Timestamp_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__ChannelTraceEvent_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_ChannelTrace__fields[3] = {
+  {1, UPB_SIZE(24, 16), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(12, 24), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {3, UPB_SIZE(16, 32), 0, 1, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__ChannelTrace_msg_init = {
+  &grpc_channelz_v1_ChannelTrace__submsgs[0],
+  &grpc_channelz_v1_ChannelTrace__fields[0],
+  UPB_SIZE(32, 40), 3, kUpb_ExtMode_NonExtendable, 3, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.ChannelTrace",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000003f000008, &upb_psv8_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x002000003f01001a, &upb_prm_1bt_max64b},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__ChannelTrace_msg_init_ptr = &grpc__channelz__v1__ChannelTrace_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_ChannelRef__fields[2] = {
+  {1, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {2, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__ChannelRef_msg_init = {
+  NULL,
+  &grpc_channelz_v1_ChannelRef__fields[0],
+  UPB_SIZE(24, 32), 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.ChannelRef",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001800003f000008, &upb_psv8_1bt},
+    {0x000800003f000012, &upb_pss_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__ChannelRef_msg_init_ptr = &grpc__channelz__v1__ChannelRef_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_SubchannelRef__fields[2] = {
+  {7, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {8, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__SubchannelRef_msg_init = {
+  NULL,
+  &grpc_channelz_v1_SubchannelRef__fields[0],
+  UPB_SIZE(24, 32), 2, kUpb_ExtMode_NonExtendable, 0, UPB_FASTTABLE_MASK(120), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.SubchannelRef",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001800003f000038, &upb_psv8_1bt},
+    {0x000800003f000042, &upb_pss_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__SubchannelRef_msg_init_ptr = &grpc__channelz__v1__SubchannelRef_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_SocketRef__fields[2] = {
+  {3, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {4, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__SocketRef_msg_init = {
+  NULL,
+  &grpc_channelz_v1_SocketRef__fields[0],
+  UPB_SIZE(24, 32), 2, kUpb_ExtMode_NonExtendable, 0, UPB_FASTTABLE_MASK(56), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.SocketRef",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001800003f000018, &upb_psv8_1bt},
+    {0x000800003f000022, &upb_pss_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__SocketRef_msg_init_ptr = &grpc__channelz__v1__SocketRef_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_ServerRef__fields[2] = {
+  {5, UPB_SIZE(16, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {6, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__ServerRef_msg_init = {
+  NULL,
+  &grpc_channelz_v1_ServerRef__fields[0],
+  UPB_SIZE(24, 32), 2, kUpb_ExtMode_NonExtendable, 0, UPB_FASTTABLE_MASK(56), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.ServerRef",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001800003f000028, &upb_psv8_1bt},
+    {0x000800003f000032, &upb_pss_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__ServerRef_msg_init_ptr = &grpc__channelz__v1__ServerRef_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_Server__submsgs[3] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__ServerRef_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__ServerData_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__SocketRef_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_Server__fields[3] = {
+  {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(16, 24), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {3, UPB_SIZE(20, 32), 0, 2, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__Server_msg_init = {
+  &grpc_channelz_v1_Server__submsgs[0],
+  &grpc_channelz_v1_Server__fields[0],
+  UPB_SIZE(24, 40), 3, kUpb_ExtMode_NonExtendable, 3, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.Server",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x002000003f02001a, &upb_prm_1bt_max64b},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__Server_msg_init_ptr = &grpc__channelz__v1__Server_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_ServerData__submsgs[2] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__ChannelTrace_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Timestamp_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_ServerData__fields[5] = {
+  {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {2, 24, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {3, 32, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {4, 40, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {5, UPB_SIZE(16, 48), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__ServerData_msg_init = {
+  &grpc_channelz_v1_ServerData__submsgs[0],
+  &grpc_channelz_v1_ServerData__fields[0],
+  UPB_SIZE(48, 56), 5, kUpb_ExtMode_NonExtendable, 5, UPB_FASTTABLE_MASK(56), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.ServerData",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001800003f000010, &upb_psv8_1bt},
+    {0x002000003f000018, &upb_psv8_1bt},
+    {0x002800003f000020, &upb_psv8_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__ServerData_msg_init_ptr = &grpc__channelz__v1__ServerData_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_Socket__submsgs[5] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__SocketRef_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__SocketData_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Address_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Address_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Security_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_Socket__fields[6] = {
+  {1, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(16, 40), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {3, UPB_SIZE(20, 48), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {4, UPB_SIZE(24, 56), 67, 3, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {5, UPB_SIZE(28, 64), 68, 4, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {6, UPB_SIZE(32, 16), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__Socket_msg_init = {
+  &grpc_channelz_v1_Socket__submsgs[0],
+  &grpc_channelz_v1_Socket__fields[0],
+  UPB_SIZE(40, 72), 6, kUpb_ExtMode_NonExtendable, 6, UPB_FASTTABLE_MASK(56), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.Socket",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000003f000032, &upb_pss_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__Socket_msg_init_ptr = &grpc__channelz__v1__Socket_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_SocketData__submsgs[7] = {
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Timestamp_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Timestamp_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Timestamp_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Timestamp_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Int64Value_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Int64Value_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__SocketOption_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_SocketData__fields[13] = {
+  {1, UPB_SIZE(40, 16), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(48, 24), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {3, UPB_SIZE(56, 32), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {4, UPB_SIZE(64, 40), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {5, UPB_SIZE(72, 48), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {6, UPB_SIZE(80, 56), 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {7, UPB_SIZE(12, 64), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {8, UPB_SIZE(16, 72), 65, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {9, UPB_SIZE(20, 80), 66, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {10, UPB_SIZE(24, 88), 67, 3, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {11, UPB_SIZE(28, 96), 68, 4, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {12, UPB_SIZE(32, 104), 69, 5, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {13, UPB_SIZE(36, 112), 0, 6, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__SocketData_msg_init = {
+  &grpc_channelz_v1_SocketData__submsgs[0],
+  &grpc_channelz_v1_SocketData__fields[0],
+  UPB_SIZE(88, 120), 13, kUpb_ExtMode_NonExtendable, 13, UPB_FASTTABLE_MASK(120), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.SocketData",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000003f000008, &upb_psv8_1bt},
+    {0x001800003f000010, &upb_psv8_1bt},
+    {0x002000003f000018, &upb_psv8_1bt},
+    {0x002800003f000020, &upb_psv8_1bt},
+    {0x003000003f000028, &upb_psv8_1bt},
+    {0x003800003f000030, &upb_psv8_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x007000003f06006a, &upb_prm_1bt_max64b},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__SocketData_msg_init_ptr = &grpc__channelz__v1__SocketData_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_Address__submsgs[3] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Address__TcpIpAddress_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Address__UdsAddress_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Address__OtherAddress_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_Address__fields[3] = {
+  {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(12, 16), -9, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {3, UPB_SIZE(12, 16), -9, 2, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__Address_msg_init = {
+  &grpc_channelz_v1_Address__submsgs[0],
+  &grpc_channelz_v1_Address__fields[0],
+  UPB_SIZE(16, 24), 3, kUpb_ExtMode_NonExtendable, 3, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.Address",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000080100000a, &upb_pom_1bt_max64b},
+    {0x0010000802010012, &upb_pom_1bt_max64b},
+    {0x001000080302001a, &upb_pom_1bt_max64b},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__Address_msg_init_ptr = &grpc__channelz__v1__Address_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_Address_TcpIpAddress__fields[2] = {
+  {1, UPB_SIZE(12, 16), 0, kUpb_NoSub, 12, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {2, 8, 0, kUpb_NoSub, 5, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__Address__TcpIpAddress_msg_init = {
+  NULL,
+  &grpc_channelz_v1_Address_TcpIpAddress__fields[0],
+  UPB_SIZE(24, 32), 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.Address.TcpIpAddress",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000003f00000a, &upb_psb_1bt},
+    {0x000800003f000010, &upb_psv4_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__Address__TcpIpAddress_msg_init_ptr = &grpc__channelz__v1__Address__TcpIpAddress_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_Address_UdsAddress__fields[1] = {
+  {1, 8, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__Address__UdsAddress_msg_init = {
+  NULL,
+  &grpc_channelz_v1_Address_UdsAddress__fields[0],
+  UPB_SIZE(16, 24), 1, kUpb_ExtMode_NonExtendable, 1, UPB_FASTTABLE_MASK(8), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.Address.UdsAddress",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x000800003f00000a, &upb_pss_1bt},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__Address__UdsAddress_msg_init_ptr = &grpc__channelz__v1__Address__UdsAddress_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_Address_OtherAddress__submsgs[1] = {
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Any_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_Address_OtherAddress__fields[2] = {
+  {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__Address__OtherAddress_msg_init = {
+  &grpc_channelz_v1_Address_OtherAddress__submsgs[0],
+  &grpc_channelz_v1_Address_OtherAddress__fields[0],
+  UPB_SIZE(24, 40), 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(8), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.Address.OtherAddress",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000003f00000a, &upb_pss_1bt},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__Address__OtherAddress_msg_init_ptr = &grpc__channelz__v1__Address__OtherAddress_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_Security__submsgs[2] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Security__Tls_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Security__OtherSecurity_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_Security__fields[2] = {
+  {1, UPB_SIZE(12, 16), -9, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(12, 16), -9, 1, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__Security_msg_init = {
+  &grpc_channelz_v1_Security__submsgs[0],
+  &grpc_channelz_v1_Security__fields[0],
+  UPB_SIZE(16, 24), 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.Security",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000080100000a, &upb_pom_1bt_max128b},
+    {0x0010000802010012, &upb_pom_1bt_max64b},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__Security_msg_init_ptr = &grpc__channelz__v1__Security_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_Security_Tls__fields[4] = {
+  {1, UPB_SIZE(28, 48), -9, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(28, 48), -9, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {3, UPB_SIZE(12, 16), 0, kUpb_NoSub, 12, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {4, UPB_SIZE(20, 32), 0, kUpb_NoSub, 12, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__Security__Tls_msg_init = {
+  NULL,
+  &grpc_channelz_v1_Security_Tls__fields[0],
+  UPB_SIZE(40, 64), 4, kUpb_ExtMode_NonExtendable, 4, UPB_FASTTABLE_MASK(56), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.Security.Tls",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x003000080100000a, &upb_pos_1bt},
+    {0x0030000802000012, &upb_pos_1bt},
+    {0x001000003f00001a, &upb_psb_1bt},
+    {0x002000003f000022, &upb_psb_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__Security__Tls_msg_init_ptr = &grpc__channelz__v1__Security__Tls_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_Security_OtherSecurity__submsgs[1] = {
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Any_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_Security_OtherSecurity__fields[2] = {
+  {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__Security__OtherSecurity_msg_init = {
+  &grpc_channelz_v1_Security_OtherSecurity__submsgs[0],
+  &grpc_channelz_v1_Security_OtherSecurity__fields[0],
+  UPB_SIZE(24, 40), 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(8), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.Security.OtherSecurity",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000003f00000a, &upb_pss_1bt},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__Security__OtherSecurity_msg_init_ptr = &grpc__channelz__v1__Security__OtherSecurity_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_SocketOption__submsgs[1] = {
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Any_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_SocketOption__fields[3] = {
+  {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(24, 32), 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
+  {3, UPB_SIZE(12, 48), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__SocketOption_msg_init = {
+  &grpc_channelz_v1_SocketOption__submsgs[0],
+  &grpc_channelz_v1_SocketOption__fields[0],
+  UPB_SIZE(32, 56), 3, kUpb_ExtMode_NonExtendable, 3, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.SocketOption",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000003f00000a, &upb_pss_1bt},
+    {0x002000003f000012, &upb_pss_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__SocketOption_msg_init_ptr = &grpc__channelz__v1__SocketOption_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_SocketOptionTimeout__submsgs[1] = {
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Duration_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_SocketOptionTimeout__fields[1] = {
+  {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__SocketOptionTimeout_msg_init = {
+  &grpc_channelz_v1_SocketOptionTimeout__submsgs[0],
+  &grpc_channelz_v1_SocketOptionTimeout__fields[0],
+  UPB_SIZE(16, 24), 1, kUpb_ExtMode_NonExtendable, 1, UPB_FASTTABLE_MASK(255), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.SocketOptionTimeout",
+#endif
+};
+
+const upb_MiniTable* grpc__channelz__v1__SocketOptionTimeout_msg_init_ptr = &grpc__channelz__v1__SocketOptionTimeout_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_SocketOptionLinger__submsgs[1] = {
+  {.UPB_PRIVATE(submsg) = &google__protobuf__Duration_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_SocketOptionLinger__fields[2] = {
+  {1, 9, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__SocketOptionLinger_msg_init = {
+  &grpc_channelz_v1_SocketOptionLinger__submsgs[0],
+  &grpc_channelz_v1_SocketOptionLinger__fields[0],
+  UPB_SIZE(16, 24), 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(8), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.SocketOptionLinger",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x000900003f000008, &upb_psb1_1bt},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__SocketOptionLinger_msg_init_ptr = &grpc__channelz__v1__SocketOptionLinger_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_SocketOptionTcpInfo__fields[29] = {
+  {1, 8, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {2, 12, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {3, 16, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {4, 20, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {5, 24, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {6, 28, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {7, 32, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {8, 36, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {9, 40, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {10, 44, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {11, 48, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {12, 52, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {13, 56, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {14, 60, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {15, 64, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {16, 68, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {17, 72, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {18, 76, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {19, 80, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {20, 84, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {21, 88, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {22, 92, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {23, 96, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {24, 100, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {25, 104, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {26, 108, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {27, 112, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {28, 116, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+  {29, 120, 0, kUpb_NoSub, 13, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_4Byte << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__SocketOptionTcpInfo_msg_init = {
+  NULL,
+  &grpc_channelz_v1_SocketOptionTcpInfo__fields[0],
+  128, 29, kUpb_ExtMode_NonExtendable, 29, UPB_FASTTABLE_MASK(248), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.SocketOptionTcpInfo",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x000800003f000008, &upb_psv4_1bt},
+    {0x000c00003f000010, &upb_psv4_1bt},
+    {0x001000003f000018, &upb_psv4_1bt},
+    {0x001400003f000020, &upb_psv4_1bt},
+    {0x001800003f000028, &upb_psv4_1bt},
+    {0x001c00003f000030, &upb_psv4_1bt},
+    {0x002000003f000038, &upb_psv4_1bt},
+    {0x002400003f000040, &upb_psv4_1bt},
+    {0x002800003f000048, &upb_psv4_1bt},
+    {0x002c00003f000050, &upb_psv4_1bt},
+    {0x003000003f000058, &upb_psv4_1bt},
+    {0x003400003f000060, &upb_psv4_1bt},
+    {0x003800003f000068, &upb_psv4_1bt},
+    {0x003c00003f000070, &upb_psv4_1bt},
+    {0x004000003f000078, &upb_psv4_1bt},
+    {0x004400003f000180, &upb_psv4_2bt},
+    {0x004800003f000188, &upb_psv4_2bt},
+    {0x004c00003f000190, &upb_psv4_2bt},
+    {0x005000003f000198, &upb_psv4_2bt},
+    {0x005400003f0001a0, &upb_psv4_2bt},
+    {0x005800003f0001a8, &upb_psv4_2bt},
+    {0x005c00003f0001b0, &upb_psv4_2bt},
+    {0x006000003f0001b8, &upb_psv4_2bt},
+    {0x006400003f0001c0, &upb_psv4_2bt},
+    {0x006800003f0001c8, &upb_psv4_2bt},
+    {0x006c00003f0001d0, &upb_psv4_2bt},
+    {0x007000003f0001d8, &upb_psv4_2bt},
+    {0x007400003f0001e0, &upb_psv4_2bt},
+    {0x007800003f0001e8, &upb_psv4_2bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__SocketOptionTcpInfo_msg_init_ptr = &grpc__channelz__v1__SocketOptionTcpInfo_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_GetTopChannelsRequest__fields[2] = {
+  {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {2, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetTopChannelsRequest_msg_init = {
+  NULL,
+  &grpc_channelz_v1_GetTopChannelsRequest__fields[0],
+  24, 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetTopChannelsRequest",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x000800003f000008, &upb_psv8_1bt},
+    {0x001000003f000010, &upb_psv8_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetTopChannelsRequest_msg_init_ptr = &grpc__channelz__v1__GetTopChannelsRequest_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_GetTopChannelsResponse__submsgs[1] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Channel_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_GetTopChannelsResponse__fields[2] = {
+  {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetTopChannelsResponse_msg_init = {
+  &grpc_channelz_v1_GetTopChannelsResponse__submsgs[0],
+  &grpc_channelz_v1_GetTopChannelsResponse__fields[0],
+  UPB_SIZE(16, 24), 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetTopChannelsResponse",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000003f00000a, &upb_prm_1bt_max64b},
+    {0x000800003f000010, &upb_psb1_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetTopChannelsResponse_msg_init_ptr = &grpc__channelz__v1__GetTopChannelsResponse_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_GetServersRequest__fields[2] = {
+  {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {2, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetServersRequest_msg_init = {
+  NULL,
+  &grpc_channelz_v1_GetServersRequest__fields[0],
+  24, 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetServersRequest",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x000800003f000008, &upb_psv8_1bt},
+    {0x001000003f000010, &upb_psv8_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetServersRequest_msg_init_ptr = &grpc__channelz__v1__GetServersRequest_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_GetServersResponse__submsgs[1] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Server_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_GetServersResponse__fields[2] = {
+  {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetServersResponse_msg_init = {
+  &grpc_channelz_v1_GetServersResponse__submsgs[0],
+  &grpc_channelz_v1_GetServersResponse__fields[0],
+  UPB_SIZE(16, 24), 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetServersResponse",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000003f00000a, &upb_prm_1bt_max64b},
+    {0x000800003f000010, &upb_psb1_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetServersResponse_msg_init_ptr = &grpc__channelz__v1__GetServersResponse_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_GetServerRequest__fields[1] = {
+  {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetServerRequest_msg_init = {
+  NULL,
+  &grpc_channelz_v1_GetServerRequest__fields[0],
+  16, 1, kUpb_ExtMode_NonExtendable, 1, UPB_FASTTABLE_MASK(8), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetServerRequest",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x000800003f000008, &upb_psv8_1bt},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetServerRequest_msg_init_ptr = &grpc__channelz__v1__GetServerRequest_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_GetServerResponse__submsgs[1] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Server_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_GetServerResponse__fields[1] = {
+  {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetServerResponse_msg_init = {
+  &grpc_channelz_v1_GetServerResponse__submsgs[0],
+  &grpc_channelz_v1_GetServerResponse__fields[0],
+  UPB_SIZE(16, 24), 1, kUpb_ExtMode_NonExtendable, 1, UPB_FASTTABLE_MASK(255), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetServerResponse",
+#endif
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetServerResponse_msg_init_ptr = &grpc__channelz__v1__GetServerResponse_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_GetServerSocketsRequest__fields[3] = {
+  {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {2, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {3, 24, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetServerSocketsRequest_msg_init = {
+  NULL,
+  &grpc_channelz_v1_GetServerSocketsRequest__fields[0],
+  32, 3, kUpb_ExtMode_NonExtendable, 3, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetServerSocketsRequest",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x000800003f000008, &upb_psv8_1bt},
+    {0x001000003f000010, &upb_psv8_1bt},
+    {0x001800003f000018, &upb_psv8_1bt},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetServerSocketsRequest_msg_init_ptr = &grpc__channelz__v1__GetServerSocketsRequest_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_GetServerSocketsResponse__submsgs[1] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__SocketRef_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_GetServerSocketsResponse__fields[2] = {
+  {1, UPB_SIZE(12, 16), 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetServerSocketsResponse_msg_init = {
+  &grpc_channelz_v1_GetServerSocketsResponse__submsgs[0],
+  &grpc_channelz_v1_GetServerSocketsResponse__fields[0],
+  UPB_SIZE(16, 24), 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetServerSocketsResponse",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000003f00000a, &upb_prm_1bt_max64b},
+    {0x000800003f000010, &upb_psb1_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetServerSocketsResponse_msg_init_ptr = &grpc__channelz__v1__GetServerSocketsResponse_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_GetChannelRequest__fields[1] = {
+  {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetChannelRequest_msg_init = {
+  NULL,
+  &grpc_channelz_v1_GetChannelRequest__fields[0],
+  16, 1, kUpb_ExtMode_NonExtendable, 1, UPB_FASTTABLE_MASK(8), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetChannelRequest",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x000800003f000008, &upb_psv8_1bt},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetChannelRequest_msg_init_ptr = &grpc__channelz__v1__GetChannelRequest_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_GetChannelResponse__submsgs[1] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Channel_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_GetChannelResponse__fields[1] = {
+  {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetChannelResponse_msg_init = {
+  &grpc_channelz_v1_GetChannelResponse__submsgs[0],
+  &grpc_channelz_v1_GetChannelResponse__fields[0],
+  UPB_SIZE(16, 24), 1, kUpb_ExtMode_NonExtendable, 1, UPB_FASTTABLE_MASK(255), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetChannelResponse",
+#endif
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetChannelResponse_msg_init_ptr = &grpc__channelz__v1__GetChannelResponse_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_GetSubchannelRequest__fields[1] = {
+  {1, 8, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetSubchannelRequest_msg_init = {
+  NULL,
+  &grpc_channelz_v1_GetSubchannelRequest__fields[0],
+  16, 1, kUpb_ExtMode_NonExtendable, 1, UPB_FASTTABLE_MASK(8), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetSubchannelRequest",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x000800003f000008, &upb_psv8_1bt},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetSubchannelRequest_msg_init_ptr = &grpc__channelz__v1__GetSubchannelRequest_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_GetSubchannelResponse__submsgs[1] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Subchannel_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_GetSubchannelResponse__fields[1] = {
+  {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetSubchannelResponse_msg_init = {
+  &grpc_channelz_v1_GetSubchannelResponse__submsgs[0],
+  &grpc_channelz_v1_GetSubchannelResponse__fields[0],
+  UPB_SIZE(16, 24), 1, kUpb_ExtMode_NonExtendable, 1, UPB_FASTTABLE_MASK(255), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetSubchannelResponse",
+#endif
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetSubchannelResponse_msg_init_ptr = &grpc__channelz__v1__GetSubchannelResponse_msg_init;
+static const upb_MiniTableField grpc_channelz_v1_GetSocketRequest__fields[2] = {
+  {1, 16, 0, kUpb_NoSub, 3, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_8Byte << kUpb_FieldRep_Shift)},
+  {2, 8, 0, kUpb_NoSub, 8, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_1Byte << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetSocketRequest_msg_init = {
+  NULL,
+  &grpc_channelz_v1_GetSocketRequest__fields[0],
+  24, 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(24), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetSocketRequest",
+#endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x001000003f000008, &upb_psv8_1bt},
+    {0x000800003f000010, &upb_psb1_1bt},
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+  })
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetSocketRequest_msg_init_ptr = &grpc__channelz__v1__GetSocketRequest_msg_init;
+static const upb_MiniTableSubInternal grpc_channelz_v1_GetSocketResponse__submsgs[1] = {
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v1__Socket_msg_init_ptr},
+};
+
+static const upb_MiniTableField grpc_channelz_v1_GetSocketResponse__fields[1] = {
+  {1, UPB_SIZE(12, 16), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+};
+
+const upb_MiniTable grpc__channelz__v1__GetSocketResponse_msg_init = {
+  &grpc_channelz_v1_GetSocketResponse__submsgs[0],
+  &grpc_channelz_v1_GetSocketResponse__fields[0],
+  UPB_SIZE(16, 24), 1, kUpb_ExtMode_NonExtendable, 1, UPB_FASTTABLE_MASK(255), 0,
+#ifdef UPB_TRACING_ENABLED
+  "grpc.channelz.v1.GetSocketResponse",
+#endif
+};
+
+const upb_MiniTable* grpc__channelz__v1__GetSocketResponse_msg_init_ptr = &grpc__channelz__v1__GetSocketResponse_msg_init;
+static const upb_MiniTable *messages_layout[39] = {
+  &grpc__channelz__v1__Channel_msg_init,
+  &grpc__channelz__v1__Subchannel_msg_init,
+  &grpc__channelz__v1__ChannelConnectivityState_msg_init,
+  &grpc__channelz__v1__ChannelData_msg_init,
+  &grpc__channelz__v1__ChannelTraceEvent_msg_init,
+  &grpc__channelz__v1__ChannelTrace_msg_init,
+  &grpc__channelz__v1__ChannelRef_msg_init,
+  &grpc__channelz__v1__SubchannelRef_msg_init,
+  &grpc__channelz__v1__SocketRef_msg_init,
+  &grpc__channelz__v1__ServerRef_msg_init,
+  &grpc__channelz__v1__Server_msg_init,
+  &grpc__channelz__v1__ServerData_msg_init,
+  &grpc__channelz__v1__Socket_msg_init,
+  &grpc__channelz__v1__SocketData_msg_init,
+  &grpc__channelz__v1__Address_msg_init,
+  &grpc__channelz__v1__Address__TcpIpAddress_msg_init,
+  &grpc__channelz__v1__Address__UdsAddress_msg_init,
+  &grpc__channelz__v1__Address__OtherAddress_msg_init,
+  &grpc__channelz__v1__Security_msg_init,
+  &grpc__channelz__v1__Security__Tls_msg_init,
+  &grpc__channelz__v1__Security__OtherSecurity_msg_init,
+  &grpc__channelz__v1__SocketOption_msg_init,
+  &grpc__channelz__v1__SocketOptionTimeout_msg_init,
+  &grpc__channelz__v1__SocketOptionLinger_msg_init,
+  &grpc__channelz__v1__SocketOptionTcpInfo_msg_init,
+  &grpc__channelz__v1__GetTopChannelsRequest_msg_init,
+  &grpc__channelz__v1__GetTopChannelsResponse_msg_init,
+  &grpc__channelz__v1__GetServersRequest_msg_init,
+  &grpc__channelz__v1__GetServersResponse_msg_init,
+  &grpc__channelz__v1__GetServerRequest_msg_init,
+  &grpc__channelz__v1__GetServerResponse_msg_init,
+  &grpc__channelz__v1__GetServerSocketsRequest_msg_init,
+  &grpc__channelz__v1__GetServerSocketsResponse_msg_init,
+  &grpc__channelz__v1__GetChannelRequest_msg_init,
+  &grpc__channelz__v1__GetChannelResponse_msg_init,
+  &grpc__channelz__v1__GetSubchannelRequest_msg_init,
+  &grpc__channelz__v1__GetSubchannelResponse_msg_init,
+  &grpc__channelz__v1__GetSocketRequest_msg_init,
+  &grpc__channelz__v1__GetSocketResponse_msg_init,
+};
+
+const upb_MiniTableFile src_proto_grpc_channelz_channelz_proto_upb_file_layout = {
+  messages_layout,
+  NULL,
+  NULL,
+  39,
+  0,
+  0,
+};
+
+#include "upb/port/undef.inc"
+
diff --git a/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/channelz.upb_minitable.h b/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/channelz.upb_minitable.h
new file mode 100644
index 00000000000..5508cc5f5b9
--- /dev/null
+++ b/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/channelz.upb_minitable.h
@@ -0,0 +1,108 @@
+/* This file was generated by upb_generator from the input file:
+ *
+ *     src/proto/grpc/channelz/channelz.proto
+ *
+ * Do not edit -- your changes will be discarded when the file is
+ * regenerated.
+ * NO CHECKED-IN PROTOBUF GENCODE */
+
+#ifndef SRC_PROTO_GRPC_CHANNELZ_CHANNELZ_PROTO_UPB_H__UPB_MINITABLE_H_
+#define SRC_PROTO_GRPC_CHANNELZ_CHANNELZ_PROTO_UPB_H__UPB_MINITABLE_H_
+
+#include "upb/generated_code_support.h"
+
+// Must be last.
+#include "upb/port/def.inc"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern const upb_MiniTable grpc__channelz__v1__Channel_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__Channel_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__Subchannel_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__Subchannel_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__ChannelConnectivityState_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__ChannelConnectivityState_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__ChannelData_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__ChannelData_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__ChannelTraceEvent_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__ChannelTraceEvent_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__ChannelTrace_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__ChannelTrace_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__ChannelRef_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__ChannelRef_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__SubchannelRef_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__SubchannelRef_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__SocketRef_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__SocketRef_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__ServerRef_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__ServerRef_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__Server_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__Server_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__ServerData_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__ServerData_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__Socket_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__Socket_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__SocketData_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__SocketData_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__Address_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__Address_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__Address__TcpIpAddress_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__Address__TcpIpAddress_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__Address__UdsAddress_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__Address__UdsAddress_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__Address__OtherAddress_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__Address__OtherAddress_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__Security_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__Security_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__Security__Tls_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__Security__Tls_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__Security__OtherSecurity_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__Security__OtherSecurity_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__SocketOption_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__SocketOption_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__SocketOptionTimeout_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__SocketOptionTimeout_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__SocketOptionLinger_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__SocketOptionLinger_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__SocketOptionTcpInfo_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__SocketOptionTcpInfo_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetTopChannelsRequest_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetTopChannelsRequest_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetTopChannelsResponse_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetTopChannelsResponse_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetServersRequest_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetServersRequest_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetServersResponse_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetServersResponse_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetServerRequest_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetServerRequest_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetServerResponse_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetServerResponse_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetServerSocketsRequest_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetServerSocketsRequest_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetServerSocketsResponse_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetServerSocketsResponse_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetChannelRequest_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetChannelRequest_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetChannelResponse_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetChannelResponse_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetSubchannelRequest_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetSubchannelRequest_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetSubchannelResponse_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetSubchannelResponse_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetSocketRequest_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetSocketRequest_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v1__GetSocketResponse_msg_init;
+extern const upb_MiniTable* grpc__channelz__v1__GetSocketResponse_msg_init_ptr;
+
+extern const upb_MiniTableFile src_proto_grpc_channelz_channelz_proto_upb_file_layout;
+
+#ifdef __cplusplus
+}  /* extern "C" */
+#endif
+
+#include "upb/port/undef.inc"
+
+#endif  /* SRC_PROTO_GRPC_CHANNELZ_CHANNELZ_PROTO_UPB_H__UPB_MINITABLE_H_ */
diff --git a/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/v2/property_list.upb.h b/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/v2/property_list.upb.h
index b1702c7bc65..3192b886237 100644
--- a/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/v2/property_list.upb.h
+++ b/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/v2/property_list.upb.h
@@ -14,9 +14,9 @@
 #include "src/proto/grpc/channelz/v2/property_list.upb_minitable.h"
 
 #include "google/protobuf/any.upb_minitable.h"
+#include "google/protobuf/duration.upb_minitable.h"
 #include "google/protobuf/empty.upb_minitable.h"
 #include "google/protobuf/timestamp.upb_minitable.h"
-#include "google/protobuf/duration.upb_minitable.h"
 
 // Must be last.
 #include "upb/port/def.inc"
@@ -26,6 +26,7 @@ extern "C" {
 #endif
 
 typedef struct grpc_channelz_v2_PropertyList { upb_Message UPB_PRIVATE(base); } grpc_channelz_v2_PropertyList;
+typedef struct grpc_channelz_v2_PropertyList_Element { upb_Message UPB_PRIVATE(base); } grpc_channelz_v2_PropertyList_Element;
 typedef struct grpc_channelz_v2_PropertyGrid { upb_Message UPB_PRIVATE(base); } grpc_channelz_v2_PropertyGrid;
 typedef struct grpc_channelz_v2_PropertyGrid_Row { upb_Message UPB_PRIVATE(base); } grpc_channelz_v2_PropertyGrid_Row;
 typedef struct grpc_channelz_v2_PropertyTable { upb_Message UPB_PRIVATE(base); } grpc_channelz_v2_PropertyTable;
@@ -75,69 +76,156 @@ UPB_INLINE char* grpc_channelz_v2_PropertyList_serialize_ex(const grpc_channelz_
   return ptr;
 }
 UPB_INLINE void grpc_channelz_v2_PropertyList_clear_properties(grpc_channelz_v2_PropertyList* msg) {
-  const upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Map | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  const upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
   upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
 }
-UPB_INLINE size_t grpc_channelz_v2_PropertyList_properties_size(const grpc_channelz_v2_PropertyList* msg) {
-  const upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Map | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
-  const upb_Map* map = upb_Message_GetMap(UPB_UPCAST(msg), &field);
-  return map ? _upb_Map_Size(map) : 0;
+UPB_INLINE const grpc_channelz_v2_PropertyList_Element* const* grpc_channelz_v2_PropertyList_properties(const grpc_channelz_v2_PropertyList* msg, size_t* size) {
+  const upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyList__Element_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (const grpc_channelz_v2_PropertyList_Element* const*)upb_Array_DataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
 }
-UPB_INLINE bool grpc_channelz_v2_PropertyList_properties_get(const grpc_channelz_v2_PropertyList* msg, upb_StringView key, grpc_channelz_v2_PropertyValue** val) {
-  const upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Map | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
-  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyList__PropertiesEntry_msg_init);
-  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyValue_msg_init);
-  const upb_Map* map = upb_Message_GetMap(UPB_UPCAST(msg), &field);
-  if (!map) return false;
-  return _upb_Map_Get(map, &key, 0, val, sizeof(*val));
-}
-UPB_INLINE bool grpc_channelz_v2_PropertyList_properties_next(const grpc_channelz_v2_PropertyList* msg, upb_StringView* key, const grpc_channelz_v2_PropertyValue** val,
-                           size_t* iter) {
-  const upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Map | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
-  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyList__PropertiesEntry_msg_init);
-  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyValue_msg_init);
-  const upb_Map* map = upb_Message_GetMap(UPB_UPCAST(msg), &field);
-  if (!map) return false;
-  upb_MessageValue k;
-  upb_MessageValue v;
-  if (!upb_Map_Next(map, &k, &v, iter)) return false;
-  memcpy(key, &k, sizeof(*key));
-  memcpy(val, &v, sizeof(*val));
-  return true;
+UPB_INLINE const upb_Array* _grpc_channelz_v2_PropertyList_properties_upb_array(const grpc_channelz_v2_PropertyList* msg, size_t* size) {
+  const upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyList__Element_msg_init);
+  const upb_Array* arr = upb_Message_GetArray(UPB_UPCAST(msg), &field);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
 }
-UPB_INLINE const upb_Map* _grpc_channelz_v2_PropertyList_properties_upb_map(grpc_channelz_v2_PropertyList* msg) {
-  const upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Map | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
-  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyList__PropertiesEntry_msg_init);
-  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyValue_msg_init);
-  return upb_Message_GetMap(UPB_UPCAST(msg), &field);
+UPB_INLINE upb_Array* _grpc_channelz_v2_PropertyList_properties_mutable_upb_array(grpc_channelz_v2_PropertyList* msg, size_t* size, upb_Arena* arena) {
+  const upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyList__Element_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(UPB_UPCAST(msg),
+                                                       &field, arena);
+  if (size) {
+    *size = arr ? arr->UPB_PRIVATE(size) : 0;
+  }
+  return arr;
+}
+
+UPB_INLINE grpc_channelz_v2_PropertyList_Element** grpc_channelz_v2_PropertyList_mutable_properties(grpc_channelz_v2_PropertyList* msg, size_t* size) {
+  upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyList__Element_msg_init);
+  upb_Array* arr = upb_Message_GetMutableArray(UPB_UPCAST(msg), &field);
+  if (arr) {
+    if (size) *size = arr->UPB_PRIVATE(size);
+    return (grpc_channelz_v2_PropertyList_Element**)upb_Array_MutableDataPtr(arr);
+  } else {
+    if (size) *size = 0;
+    return NULL;
+  }
+}
+UPB_INLINE grpc_channelz_v2_PropertyList_Element** grpc_channelz_v2_PropertyList_resize_properties(grpc_channelz_v2_PropertyList* msg, size_t size, upb_Arena* arena) {
+  upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return (grpc_channelz_v2_PropertyList_Element**)upb_Message_ResizeArrayUninitialized(UPB_UPCAST(msg),
+                                                   &field, size, arena);
+}
+UPB_INLINE struct grpc_channelz_v2_PropertyList_Element* grpc_channelz_v2_PropertyList_add_properties(grpc_channelz_v2_PropertyList* msg, upb_Arena* arena) {
+  upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyList__Element_msg_init);
+  upb_Array* arr = upb_Message_GetOrCreateMutableArray(
+      UPB_UPCAST(msg), &field, arena);
+  if (!arr || !UPB_PRIVATE(_upb_Array_ResizeUninitialized)(
+                  arr, arr->UPB_PRIVATE(size) + 1, arena)) {
+    return NULL;
+  }
+  struct grpc_channelz_v2_PropertyList_Element* sub = (struct grpc_channelz_v2_PropertyList_Element*)_upb_Message_New(&grpc__channelz__v2__PropertyList__Element_msg_init, arena);
+  if (!arr || !sub) return NULL;
+  UPB_PRIVATE(_upb_Array_Set)
+  (arr, arr->UPB_PRIVATE(size) - 1, &sub, sizeof(sub));
+  return sub;
+}
+
+/* grpc.channelz.v2.PropertyList.Element */
+
+UPB_INLINE grpc_channelz_v2_PropertyList_Element* grpc_channelz_v2_PropertyList_Element_new(upb_Arena* arena) {
+  return (grpc_channelz_v2_PropertyList_Element*)_upb_Message_New(&grpc__channelz__v2__PropertyList__Element_msg_init, arena);
+}
+UPB_INLINE grpc_channelz_v2_PropertyList_Element* grpc_channelz_v2_PropertyList_Element_parse(const char* buf, size_t size, upb_Arena* arena) {
+  grpc_channelz_v2_PropertyList_Element* ret = grpc_channelz_v2_PropertyList_Element_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v2__PropertyList__Element_msg_init, NULL, 0, arena) !=
+      kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
 }
-UPB_INLINE upb_Map* _grpc_channelz_v2_PropertyList_properties_mutable_upb_map(grpc_channelz_v2_PropertyList* msg, upb_Arena* a) {
-  const upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Map | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
-  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyList__PropertiesEntry_msg_init);
+UPB_INLINE grpc_channelz_v2_PropertyList_Element* grpc_channelz_v2_PropertyList_Element_parse_ex(const char* buf, size_t size,
+                           const upb_ExtensionRegistry* extreg,
+                           int options, upb_Arena* arena) {
+  grpc_channelz_v2_PropertyList_Element* ret = grpc_channelz_v2_PropertyList_Element_new(arena);
+  if (!ret) return NULL;
+  if (upb_Decode(buf, size, UPB_UPCAST(ret), &grpc__channelz__v2__PropertyList__Element_msg_init, extreg, options,
+                 arena) != kUpb_DecodeStatus_Ok) {
+    return NULL;
+  }
+  return ret;
+}
+UPB_INLINE char* grpc_channelz_v2_PropertyList_Element_serialize(const grpc_channelz_v2_PropertyList_Element* msg, upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v2__PropertyList__Element_msg_init, 0, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE char* grpc_channelz_v2_PropertyList_Element_serialize_ex(const grpc_channelz_v2_PropertyList_Element* msg, int options,
+                                 upb_Arena* arena, size_t* len) {
+  char* ptr;
+  (void)upb_Encode(UPB_UPCAST(msg), &grpc__channelz__v2__PropertyList__Element_msg_init, options, arena, &ptr, len);
+  return ptr;
+}
+UPB_INLINE void grpc_channelz_v2_PropertyList_Element_clear_key(grpc_channelz_v2_PropertyList_Element* msg) {
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE upb_StringView grpc_channelz_v2_PropertyList_Element_key(const grpc_channelz_v2_PropertyList_Element* msg) {
+  upb_StringView default_val = upb_StringView_FromString("");
+  upb_StringView ret;
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE void grpc_channelz_v2_PropertyList_Element_clear_value(grpc_channelz_v2_PropertyList_Element* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  upb_Message_ClearBaseField(UPB_UPCAST(msg), &field);
+}
+UPB_INLINE const grpc_channelz_v2_PropertyValue* grpc_channelz_v2_PropertyList_Element_value(const grpc_channelz_v2_PropertyList_Element* msg) {
+  const grpc_channelz_v2_PropertyValue* default_val = NULL;
+  const grpc_channelz_v2_PropertyValue* ret;
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
   UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyValue_msg_init);
-  return _upb_Message_GetOrCreateMutableMap(UPB_UPCAST(msg), &field, 0, sizeof(grpc_channelz_v2_PropertyValue*), a);
+  _upb_Message_GetNonExtensionField(UPB_UPCAST(msg), &field,
+                                    &default_val, &ret);
+  return ret;
+}
+UPB_INLINE bool grpc_channelz_v2_PropertyList_Element_has_value(const grpc_channelz_v2_PropertyList_Element* msg) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
+  return upb_Message_HasBaseField(UPB_UPCAST(msg), &field);
 }
 
-UPB_INLINE void grpc_channelz_v2_PropertyList_properties_clear(grpc_channelz_v2_PropertyList* msg) {
-  const upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Map | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
-  upb_Map* map = (upb_Map*)upb_Message_GetMap(UPB_UPCAST(msg), &field);
-  if (!map) return;
-  _upb_Map_Clear(map);
+UPB_INLINE void grpc_channelz_v2_PropertyList_Element_set_key(grpc_channelz_v2_PropertyList_Element *msg, upb_StringView value) {
+  const upb_MiniTableField field = {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)};
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
 }
-UPB_INLINE bool grpc_channelz_v2_PropertyList_properties_set(grpc_channelz_v2_PropertyList* msg, upb_StringView key, grpc_channelz_v2_PropertyValue* val, upb_Arena* a) {
-  const upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Map | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
-  UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyList__PropertiesEntry_msg_init);
+UPB_INLINE void grpc_channelz_v2_PropertyList_Element_set_value(grpc_channelz_v2_PropertyList_Element *msg, grpc_channelz_v2_PropertyValue* value) {
+  const upb_MiniTableField field = {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
   UPB_PRIVATE(_upb_MiniTable_StrongReference)(&grpc__channelz__v2__PropertyValue_msg_init);
-  upb_Map* map = _upb_Message_GetOrCreateMutableMap(UPB_UPCAST(msg),
-                                                    &field, 0, sizeof(val), a);
-  return _upb_Map_Insert(map, &key, 0, &val, sizeof(val), a) !=
-         kUpb_MapInsertStatus_OutOfMemory;
-}
-UPB_INLINE bool grpc_channelz_v2_PropertyList_properties_delete(grpc_channelz_v2_PropertyList* msg, upb_StringView key) {
-  const upb_MiniTableField field = {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Map | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)};
-  upb_Map* map = (upb_Map*)upb_Message_GetMap(UPB_UPCAST(msg), &field);
-  if (!map) return false;
-  return _upb_Map_Delete(map, &key, 0, NULL);
+  upb_Message_SetBaseField((upb_Message *)msg, &field, &value);
+}
+UPB_INLINE struct grpc_channelz_v2_PropertyValue* grpc_channelz_v2_PropertyList_Element_mutable_value(grpc_channelz_v2_PropertyList_Element* msg, upb_Arena* arena) {
+  struct grpc_channelz_v2_PropertyValue* sub = (struct grpc_channelz_v2_PropertyValue*)grpc_channelz_v2_PropertyList_Element_value(msg);
+  if (sub == NULL) {
+    sub = (struct grpc_channelz_v2_PropertyValue*)_upb_Message_New(&grpc__channelz__v2__PropertyValue_msg_init, arena);
+    if (sub) grpc_channelz_v2_PropertyList_Element_set_value(msg, sub);
+  }
+  return sub;
 }
 
 /* grpc.channelz.v2.PropertyGrid */
diff --git a/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/v2/property_list.upb_minitable.c b/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/v2/property_list.upb_minitable.c
index 89e18195755..6270db15395 100644
--- a/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/v2/property_list.upb_minitable.c
+++ b/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/v2/property_list.upb_minitable.c
@@ -10,47 +10,51 @@
 #include "upb/generated_code_support.h"
 #include "src/proto/grpc/channelz/v2/property_list.upb_minitable.h"
 #include "google/protobuf/any.upb_minitable.h"
+#include "google/protobuf/duration.upb_minitable.h"
 #include "google/protobuf/empty.upb_minitable.h"
 #include "google/protobuf/timestamp.upb_minitable.h"
-#include "google/protobuf/duration.upb_minitable.h"
 
 // Must be last.
 #include "upb/port/def.inc"
 
 extern const struct upb_MiniTable UPB_PRIVATE(_kUpb_MiniTable_StaticallyTreeShaken);
 static const upb_MiniTableSubInternal grpc_channelz_v2_PropertyList__submsgs[1] = {
-  {.UPB_PRIVATE(submsg) = &grpc__channelz__v2__PropertyList__PropertiesEntry_msg_init_ptr},
+  {.UPB_PRIVATE(submsg) = &grpc__channelz__v2__PropertyList__Element_msg_init_ptr},
 };
 
 static const upb_MiniTableField grpc_channelz_v2_PropertyList__fields[1] = {
-  {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Map | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {1, 8, 0, 0, 11, (int)kUpb_FieldMode_Array | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
 };
 
 const upb_MiniTable grpc__channelz__v2__PropertyList_msg_init = {
   &grpc_channelz_v2_PropertyList__submsgs[0],
   &grpc_channelz_v2_PropertyList__fields[0],
-  16, 1, kUpb_ExtMode_NonExtendable, 1, UPB_FASTTABLE_MASK(255), 0,
+  16, 1, kUpb_ExtMode_NonExtendable, 1, UPB_FASTTABLE_MASK(8), 0,
 #ifdef UPB_TRACING_ENABLED
   "grpc.channelz.v2.PropertyList",
 #endif
+  UPB_FASTTABLE_INIT({
+    {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
+    {0x000800003f00000a, &upb_prm_1bt_max64b},
+  })
 };
 
 const upb_MiniTable* grpc__channelz__v2__PropertyList_msg_init_ptr = &grpc__channelz__v2__PropertyList_msg_init;
-static const upb_MiniTableSubInternal grpc_channelz_v2_PropertyList_PropertiesEntry__submsgs[1] = {
+static const upb_MiniTableSubInternal grpc_channelz_v2_PropertyList_Element__submsgs[1] = {
   {.UPB_PRIVATE(submsg) = &grpc__channelz__v2__PropertyValue_msg_init_ptr},
 };
 
-static const upb_MiniTableField grpc_channelz_v2_PropertyList_PropertiesEntry__fields[2] = {
+static const upb_MiniTableField grpc_channelz_v2_PropertyList_Element__fields[2] = {
   {1, 16, 0, kUpb_NoSub, 9, (int)kUpb_FieldMode_Scalar | ((int)kUpb_FieldRep_StringView << kUpb_FieldRep_Shift)},
-  {2, 32, 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
+  {2, UPB_SIZE(12, 32), 64, 0, 11, (int)kUpb_FieldMode_Scalar | ((int)UPB_SIZE(kUpb_FieldRep_4Byte, kUpb_FieldRep_8Byte) << kUpb_FieldRep_Shift)},
 };
 
-const upb_MiniTable grpc__channelz__v2__PropertyList__PropertiesEntry_msg_init = {
-  &grpc_channelz_v2_PropertyList_PropertiesEntry__submsgs[0],
-  &grpc_channelz_v2_PropertyList_PropertiesEntry__fields[0],
-  48, 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(8), 0,
+const upb_MiniTable grpc__channelz__v2__PropertyList__Element_msg_init = {
+  &grpc_channelz_v2_PropertyList_Element__submsgs[0],
+  &grpc_channelz_v2_PropertyList_Element__fields[0],
+  UPB_SIZE(24, 40), 2, kUpb_ExtMode_NonExtendable, 2, UPB_FASTTABLE_MASK(8), 0,
 #ifdef UPB_TRACING_ENABLED
-  "grpc.channelz.v2.PropertyList.PropertiesEntry",
+  "grpc.channelz.v2.PropertyList.Element",
 #endif
   UPB_FASTTABLE_INIT({
     {0x0000000000000000, &_upb_FastDecoder_DecodeGeneric},
@@ -58,7 +62,7 @@ const upb_MiniTable grpc__channelz__v2__PropertyList__PropertiesEntry_msg_init =
   })
 };
 
-const upb_MiniTable* grpc__channelz__v2__PropertyList__PropertiesEntry_msg_init_ptr = &grpc__channelz__v2__PropertyList__PropertiesEntry_msg_init;
+const upb_MiniTable* grpc__channelz__v2__PropertyList__Element_msg_init_ptr = &grpc__channelz__v2__PropertyList__Element_msg_init;
 static const upb_MiniTableSubInternal grpc_channelz_v2_PropertyGrid__submsgs[1] = {
   {.UPB_PRIVATE(submsg) = &grpc__channelz__v2__PropertyGrid__Row_msg_init_ptr},
 };
@@ -205,7 +209,7 @@ const upb_MiniTable grpc__channelz__v2__PropertyValue_msg_init = {
 const upb_MiniTable* grpc__channelz__v2__PropertyValue_msg_init_ptr = &grpc__channelz__v2__PropertyValue_msg_init;
 static const upb_MiniTable *messages_layout[7] = {
   &grpc__channelz__v2__PropertyList_msg_init,
-  &grpc__channelz__v2__PropertyList__PropertiesEntry_msg_init,
+  &grpc__channelz__v2__PropertyList__Element_msg_init,
   &grpc__channelz__v2__PropertyGrid_msg_init,
   &grpc__channelz__v2__PropertyGrid__Row_msg_init,
   &grpc__channelz__v2__PropertyTable_msg_init,
diff --git a/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/v2/property_list.upb_minitable.h b/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/v2/property_list.upb_minitable.h
index c580d6b0c14..8a7f4808d69 100644
--- a/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/v2/property_list.upb_minitable.h
+++ b/deps/grpc/src/core/ext/upb-gen/src/proto/grpc/channelz/v2/property_list.upb_minitable.h
@@ -20,8 +20,8 @@ extern "C" {
 
 extern const upb_MiniTable grpc__channelz__v2__PropertyList_msg_init;
 extern const upb_MiniTable* grpc__channelz__v2__PropertyList_msg_init_ptr;
-extern const upb_MiniTable grpc__channelz__v2__PropertyList__PropertiesEntry_msg_init;
-extern const upb_MiniTable* grpc__channelz__v2__PropertyList__PropertiesEntry_msg_init_ptr;
+extern const upb_MiniTable grpc__channelz__v2__PropertyList__Element_msg_init;
+extern const upb_MiniTable* grpc__channelz__v2__PropertyList__Element_msg_init_ptr;
 extern const upb_MiniTable grpc__channelz__v2__PropertyGrid_msg_init;
 extern const upb_MiniTable* grpc__channelz__v2__PropertyGrid_msg_init_ptr;
 extern const upb_MiniTable grpc__channelz__v2__PropertyGrid__Row_msg_init;
diff --git a/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/channelz.upbdefs.c b/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/channelz.upbdefs.c
new file mode 100644
index 00000000000..0f5945abbdc
--- /dev/null
+++ b/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/channelz.upbdefs.c
@@ -0,0 +1,716 @@
+/* This file was generated by upb_generator from the input file:
+ *
+ *     src/proto/grpc/channelz/channelz.proto
+ *
+ * Do not edit -- your changes will be discarded when the file is
+ * regenerated.
+ * NO CHECKED-IN PROTOBUF GENCODE */
+
+
+#include "upb/reflection/def.h"
+#include "src/proto/grpc/channelz/channelz.upbdefs.h"
+#include "src/proto/grpc/channelz/channelz.upb_minitable.h"
+
+extern _upb_DefPool_Init google_protobuf_any_proto_upbdefinit;
+extern _upb_DefPool_Init google_protobuf_duration_proto_upbdefinit;
+extern _upb_DefPool_Init google_protobuf_timestamp_proto_upbdefinit;
+extern _upb_DefPool_Init google_protobuf_wrappers_proto_upbdefinit;
+
+static const char descriptor[8166] = {
+    '\n', '&', 's', 'r', 'c', '/', 'p', 'r', 'o', 't', 'o', '/',
+    'g', 'r', 'p', 'c', '/', 'c', 'h', 'a', 'n', 'n', 'e', 'l',
+    'z', '/', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'p',
+    'r', 'o', 't', 'o', '\022', '\020', 'g', 'r', 'p', 'c', '.', 'c',
+    'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '\032', '\031',
+    'g', 'o', 'o', 'g', 'l', 'e', '/', 'p', 'r', 'o', 't', 'o',
+    'b', 'u', 'f', '/', 'a', 'n', 'y', '.', 'p', 'r', 'o', 't',
+    'o', '\032', '\036', 'g', 'o', 'o', 'g', 'l', 'e', '/', 'p', 'r',
+    'o', 't', 'o', 'b', 'u', 'f', '/', 'd', 'u', 'r', 'a', 't',
+    'i', 'o', 'n', '.', 'p', 'r', 'o', 't', 'o', '\032', '\037', 'g',
+    'o', 'o', 'g', 'l', 'e', '/', 'p', 'r', 'o', 't', 'o', 'b',
+    'u', 'f', '/', 't', 'i', 'm', 'e', 's', 't', 'a', 'm', 'p',
+    '.', 'p', 'r', 'o', 't', 'o', '\032', '\036', 'g', 'o', 'o', 'g',
+    'l', 'e', '/', 'p', 'r', 'o', 't', 'o', 'b', 'u', 'f', '/',
+    'w', 'r', 'a', 'p', 'p', 'e', 'r', 's', '.', 'p', 'r', 'o',
+    't', 'o', '\"', '\257', '\002', '\n', '\007', 'C', 'h', 'a', 'n', 'n',
+    'e', 'l', '\022', '.', '\n', '\003', 'r', 'e', 'f', '\030', '\001', ' ',
+    '\001', '(', '\013', '2', '\034', '.', 'g', 'r', 'p', 'c', '.', 'c',
+    'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'C',
+    'h', 'a', 'n', 'n', 'e', 'l', 'R', 'e', 'f', 'R', '\003', 'r',
+    'e', 'f', '\022', '1', '\n', '\004', 'd', 'a', 't', 'a', '\030', '\002',
+    ' ', '\001', '(', '\013', '2', '\035', '.', 'g', 'r', 'p', 'c', '.',
+    'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.',
+    'C', 'h', 'a', 'n', 'n', 'e', 'l', 'D', 'a', 't', 'a', 'R',
+    '\004', 'd', 'a', 't', 'a', '\022', '=', '\n', '\013', 'c', 'h', 'a',
+    'n', 'n', 'e', 'l', '_', 'r', 'e', 'f', '\030', '\003', ' ', '\003',
+    '(', '\013', '2', '\034', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h',
+    'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'C', 'h',
+    'a', 'n', 'n', 'e', 'l', 'R', 'e', 'f', 'R', '\n', 'c', 'h',
+    'a', 'n', 'n', 'e', 'l', 'R', 'e', 'f', '\022', 'F', '\n', '\016',
+    's', 'u', 'b', 'c', 'h', 'a', 'n', 'n', 'e', 'l', '_', 'r',
+    'e', 'f', '\030', '\004', ' ', '\003', '(', '\013', '2', '\037', '.', 'g',
+    'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z',
+    '.', 'v', '1', '.', 'S', 'u', 'b', 'c', 'h', 'a', 'n', 'n',
+    'e', 'l', 'R', 'e', 'f', 'R', '\r', 's', 'u', 'b', 'c', 'h',
+    'a', 'n', 'n', 'e', 'l', 'R', 'e', 'f', '\022', ':', '\n', '\n',
+    's', 'o', 'c', 'k', 'e', 't', '_', 'r', 'e', 'f', '\030', '\005',
+    ' ', '\003', '(', '\013', '2', '\033', '.', 'g', 'r', 'p', 'c', '.',
+    'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.',
+    'S', 'o', 'c', 'k', 'e', 't', 'R', 'e', 'f', 'R', '\t', 's',
+    'o', 'c', 'k', 'e', 't', 'R', 'e', 'f', '\"', '\265', '\002', '\n',
+    '\n', 'S', 'u', 'b', 'c', 'h', 'a', 'n', 'n', 'e', 'l', '\022',
+    '1', '\n', '\003', 'r', 'e', 'f', '\030', '\001', ' ', '\001', '(', '\013',
+    '2', '\037', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n',
+    'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'S', 'u', 'b', 'c',
+    'h', 'a', 'n', 'n', 'e', 'l', 'R', 'e', 'f', 'R', '\003', 'r',
+    'e', 'f', '\022', '1', '\n', '\004', 'd', 'a', 't', 'a', '\030', '\002',
+    ' ', '\001', '(', '\013', '2', '\035', '.', 'g', 'r', 'p', 'c', '.',
+    'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.',
+    'C', 'h', 'a', 'n', 'n', 'e', 'l', 'D', 'a', 't', 'a', 'R',
+    '\004', 'd', 'a', 't', 'a', '\022', '=', '\n', '\013', 'c', 'h', 'a',
+    'n', 'n', 'e', 'l', '_', 'r', 'e', 'f', '\030', '\003', ' ', '\003',
+    '(', '\013', '2', '\034', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h',
+    'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'C', 'h',
+    'a', 'n', 'n', 'e', 'l', 'R', 'e', 'f', 'R', '\n', 'c', 'h',
+    'a', 'n', 'n', 'e', 'l', 'R', 'e', 'f', '\022', 'F', '\n', '\016',
+    's', 'u', 'b', 'c', 'h', 'a', 'n', 'n', 'e', 'l', '_', 'r',
+    'e', 'f', '\030', '\004', ' ', '\003', '(', '\013', '2', '\037', '.', 'g',
+    'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z',
+    '.', 'v', '1', '.', 'S', 'u', 'b', 'c', 'h', 'a', 'n', 'n',
+    'e', 'l', 'R', 'e', 'f', 'R', '\r', 's', 'u', 'b', 'c', 'h',
+    'a', 'n', 'n', 'e', 'l', 'R', 'e', 'f', '\022', ':', '\n', '\n',
+    's', 'o', 'c', 'k', 'e', 't', '_', 'r', 'e', 'f', '\030', '\005',
+    ' ', '\003', '(', '\013', '2', '\033', '.', 'g', 'r', 'p', 'c', '.',
+    'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.',
+    'S', 'o', 'c', 'k', 'e', 't', 'R', 'e', 'f', 'R', '\t', 's',
+    'o', 'c', 'k', 'e', 't', 'R', 'e', 'f', '\"', '\302', '\001', '\n',
+    '\030', 'C', 'h', 'a', 'n', 'n', 'e', 'l', 'C', 'o', 'n', 'n',
+    'e', 'c', 't', 'i', 'v', 'i', 't', 'y', 'S', 't', 'a', 't',
+    'e', '\022', 'F', '\n', '\005', 's', 't', 'a', 't', 'e', '\030', '\001',
+    ' ', '\001', '(', '\016', '2', '0', '.', 'g', 'r', 'p', 'c', '.',
+    'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.',
+    'C', 'h', 'a', 'n', 'n', 'e', 'l', 'C', 'o', 'n', 'n', 'e',
+    'c', 't', 'i', 'v', 'i', 't', 'y', 'S', 't', 'a', 't', 'e',
+    '.', 'S', 't', 'a', 't', 'e', 'R', '\005', 's', 't', 'a', 't',
+    'e', '\"', '^', '\n', '\005', 'S', 't', 'a', 't', 'e', '\022', '\013',
+    '\n', '\007', 'U', 'N', 'K', 'N', 'O', 'W', 'N', '\020', '\000', '\022',
+    '\010', '\n', '\004', 'I', 'D', 'L', 'E', '\020', '\001', '\022', '\016', '\n',
+    '\n', 'C', 'O', 'N', 'N', 'E', 'C', 'T', 'I', 'N', 'G', '\020',
+    '\002', '\022', '\t', '\n', '\005', 'R', 'E', 'A', 'D', 'Y', '\020', '\003',
+    '\022', '\025', '\n', '\021', 'T', 'R', 'A', 'N', 'S', 'I', 'E', 'N',
+    'T', '_', 'F', 'A', 'I', 'L', 'U', 'R', 'E', '\020', '\004', '\022',
+    '\014', '\n', '\010', 'S', 'H', 'U', 'T', 'D', 'O', 'W', 'N', '\020',
+    '\005', '\"', '\351', '\002', '\n', '\013', 'C', 'h', 'a', 'n', 'n', 'e',
+    'l', 'D', 'a', 't', 'a', '\022', '@', '\n', '\005', 's', 't', 'a',
+    't', 'e', '\030', '\001', ' ', '\001', '(', '\013', '2', '*', '.', 'g',
+    'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z',
+    '.', 'v', '1', '.', 'C', 'h', 'a', 'n', 'n', 'e', 'l', 'C',
+    'o', 'n', 'n', 'e', 'c', 't', 'i', 'v', 'i', 't', 'y', 'S',
+    't', 'a', 't', 'e', 'R', '\005', 's', 't', 'a', 't', 'e', '\022',
+    '\026', '\n', '\006', 't', 'a', 'r', 'g', 'e', 't', '\030', '\002', ' ',
+    '\001', '(', '\t', 'R', '\006', 't', 'a', 'r', 'g', 'e', 't', '\022',
+    '4', '\n', '\005', 't', 'r', 'a', 'c', 'e', '\030', '\003', ' ', '\001',
+    '(', '\013', '2', '\036', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h',
+    'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'C', 'h',
+    'a', 'n', 'n', 'e', 'l', 'T', 'r', 'a', 'c', 'e', 'R', '\005',
+    't', 'r', 'a', 'c', 'e', '\022', '#', '\n', '\r', 'c', 'a', 'l',
+    'l', 's', '_', 's', 't', 'a', 'r', 't', 'e', 'd', '\030', '\004',
+    ' ', '\001', '(', '\003', 'R', '\014', 'c', 'a', 'l', 'l', 's', 'S',
+    't', 'a', 'r', 't', 'e', 'd', '\022', '\'', '\n', '\017', 'c', 'a',
+    'l', 'l', 's', '_', 's', 'u', 'c', 'c', 'e', 'e', 'd', 'e',
+    'd', '\030', '\005', ' ', '\001', '(', '\003', 'R', '\016', 'c', 'a', 'l',
+    'l', 's', 'S', 'u', 'c', 'c', 'e', 'e', 'd', 'e', 'd', '\022',
+    '!', '\n', '\014', 'c', 'a', 'l', 'l', 's', '_', 'f', 'a', 'i',
+    'l', 'e', 'd', '\030', '\006', ' ', '\001', '(', '\003', 'R', '\013', 'c',
+    'a', 'l', 'l', 's', 'F', 'a', 'i', 'l', 'e', 'd', '\022', 'Y',
+    '\n', '\033', 'l', 'a', 's', 't', '_', 'c', 'a', 'l', 'l', '_',
+    's', 't', 'a', 'r', 't', 'e', 'd', '_', 't', 'i', 'm', 'e',
+    's', 't', 'a', 'm', 'p', '\030', '\007', ' ', '\001', '(', '\013', '2',
+    '\032', '.', 'g', 'o', 'o', 'g', 'l', 'e', '.', 'p', 'r', 'o',
+    't', 'o', 'b', 'u', 'f', '.', 'T', 'i', 'm', 'e', 's', 't',
+    'a', 'm', 'p', 'R', '\030', 'l', 'a', 's', 't', 'C', 'a', 'l',
+    'l', 'S', 't', 'a', 'r', 't', 'e', 'd', 'T', 'i', 'm', 'e',
+    's', 't', 'a', 'm', 'p', '\"', '\230', '\003', '\n', '\021', 'C', 'h',
+    'a', 'n', 'n', 'e', 'l', 'T', 'r', 'a', 'c', 'e', 'E', 'v',
+    'e', 'n', 't', '\022', ' ', '\n', '\013', 'd', 'e', 's', 'c', 'r',
+    'i', 'p', 't', 'i', 'o', 'n', '\030', '\001', ' ', '\001', '(', '\t',
+    'R', '\013', 'd', 'e', 's', 'c', 'r', 'i', 'p', 't', 'i', 'o',
+    'n', '\022', 'H', '\n', '\010', 's', 'e', 'v', 'e', 'r', 'i', 't',
+    'y', '\030', '\002', ' ', '\001', '(', '\016', '2', ',', '.', 'g', 'r',
+    'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.',
+    'v', '1', '.', 'C', 'h', 'a', 'n', 'n', 'e', 'l', 'T', 'r',
+    'a', 'c', 'e', 'E', 'v', 'e', 'n', 't', '.', 'S', 'e', 'v',
+    'e', 'r', 'i', 't', 'y', 'R', '\010', 's', 'e', 'v', 'e', 'r',
+    'i', 't', 'y', '\022', '8', '\n', '\t', 't', 'i', 'm', 'e', 's',
+    't', 'a', 'm', 'p', '\030', '\003', ' ', '\001', '(', '\013', '2', '\032',
+    '.', 'g', 'o', 'o', 'g', 'l', 'e', '.', 'p', 'r', 'o', 't',
+    'o', 'b', 'u', 'f', '.', 'T', 'i', 'm', 'e', 's', 't', 'a',
+    'm', 'p', 'R', '\t', 't', 'i', 'm', 'e', 's', 't', 'a', 'm',
+    'p', '\022', '?', '\n', '\013', 'c', 'h', 'a', 'n', 'n', 'e', 'l',
+    '_', 'r', 'e', 'f', '\030', '\004', ' ', '\001', '(', '\013', '2', '\034',
+    '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e',
+    'l', 'z', '.', 'v', '1', '.', 'C', 'h', 'a', 'n', 'n', 'e',
+    'l', 'R', 'e', 'f', 'H', '\000', 'R', '\n', 'c', 'h', 'a', 'n',
+    'n', 'e', 'l', 'R', 'e', 'f', '\022', 'H', '\n', '\016', 's', 'u',
+    'b', 'c', 'h', 'a', 'n', 'n', 'e', 'l', '_', 'r', 'e', 'f',
+    '\030', '\005', ' ', '\001', '(', '\013', '2', '\037', '.', 'g', 'r', 'p',
+    'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v',
+    '1', '.', 'S', 'u', 'b', 'c', 'h', 'a', 'n', 'n', 'e', 'l',
+    'R', 'e', 'f', 'H', '\000', 'R', '\r', 's', 'u', 'b', 'c', 'h',
+    'a', 'n', 'n', 'e', 'l', 'R', 'e', 'f', '\"', 'E', '\n', '\010',
+    'S', 'e', 'v', 'e', 'r', 'i', 't', 'y', '\022', '\016', '\n', '\n',
+    'C', 'T', '_', 'U', 'N', 'K', 'N', 'O', 'W', 'N', '\020', '\000',
+    '\022', '\013', '\n', '\007', 'C', 'T', '_', 'I', 'N', 'F', 'O', '\020',
+    '\001', '\022', '\016', '\n', '\n', 'C', 'T', '_', 'W', 'A', 'R', 'N',
+    'I', 'N', 'G', '\020', '\002', '\022', '\014', '\n', '\010', 'C', 'T', '_',
+    'E', 'R', 'R', 'O', 'R', '\020', '\003', 'B', '\013', '\n', '\t', 'c',
+    'h', 'i', 'l', 'd', '_', 'r', 'e', 'f', '\"', '\302', '\001', '\n',
+    '\014', 'C', 'h', 'a', 'n', 'n', 'e', 'l', 'T', 'r', 'a', 'c',
+    'e', '\022', '*', '\n', '\021', 'n', 'u', 'm', '_', 'e', 'v', 'e',
+    'n', 't', 's', '_', 'l', 'o', 'g', 'g', 'e', 'd', '\030', '\001',
+    ' ', '\001', '(', '\003', 'R', '\017', 'n', 'u', 'm', 'E', 'v', 'e',
+    'n', 't', 's', 'L', 'o', 'g', 'g', 'e', 'd', '\022', 'I', '\n',
+    '\022', 'c', 'r', 'e', 'a', 't', 'i', 'o', 'n', '_', 't', 'i',
+    'm', 'e', 's', 't', 'a', 'm', 'p', '\030', '\002', ' ', '\001', '(',
+    '\013', '2', '\032', '.', 'g', 'o', 'o', 'g', 'l', 'e', '.', 'p',
+    'r', 'o', 't', 'o', 'b', 'u', 'f', '.', 'T', 'i', 'm', 'e',
+    's', 't', 'a', 'm', 'p', 'R', '\021', 'c', 'r', 'e', 'a', 't',
+    'i', 'o', 'n', 'T', 'i', 'm', 'e', 's', 't', 'a', 'm', 'p',
+    '\022', ';', '\n', '\006', 'e', 'v', 'e', 'n', 't', 's', '\030', '\003',
+    ' ', '\003', '(', '\013', '2', '#', '.', 'g', 'r', 'p', 'c', '.',
+    'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.',
+    'C', 'h', 'a', 'n', 'n', 'e', 'l', 'T', 'r', 'a', 'c', 'e',
+    'E', 'v', 'e', 'n', 't', 'R', '\006', 'e', 'v', 'e', 'n', 't',
+    's', '\"', 'c', '\n', '\n', 'C', 'h', 'a', 'n', 'n', 'e', 'l',
+    'R', 'e', 'f', '\022', '\035', '\n', '\n', 'c', 'h', 'a', 'n', 'n',
+    'e', 'l', '_', 'i', 'd', '\030', '\001', ' ', '\001', '(', '\003', 'R',
+    '\t', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'I', 'd', '\022', '\022',
+    '\n', '\004', 'n', 'a', 'm', 'e', '\030', '\002', ' ', '\001', '(', '\t',
+    'R', '\004', 'n', 'a', 'm', 'e', 'J', '\004', '\010', '\003', '\020', '\004',
+    'J', '\004', '\010', '\004', '\020', '\005', 'J', '\004', '\010', '\005', '\020', '\006',
+    'J', '\004', '\010', '\006', '\020', '\007', 'J', '\004', '\010', '\007', '\020', '\010',
+    'J', '\004', '\010', '\010', '\020', '\t', '\"', 'l', '\n', '\r', 'S', 'u',
+    'b', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'R', 'e', 'f', '\022',
+    '#', '\n', '\r', 's', 'u', 'b', 'c', 'h', 'a', 'n', 'n', 'e',
+    'l', '_', 'i', 'd', '\030', '\007', ' ', '\001', '(', '\003', 'R', '\014',
+    's', 'u', 'b', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'I', 'd',
+    '\022', '\022', '\n', '\004', 'n', 'a', 'm', 'e', '\030', '\010', ' ', '\001',
+    '(', '\t', 'R', '\004', 'n', 'a', 'm', 'e', 'J', '\004', '\010', '\001',
+    '\020', '\002', 'J', '\004', '\010', '\002', '\020', '\003', 'J', '\004', '\010', '\003',
+    '\020', '\004', 'J', '\004', '\010', '\004', '\020', '\005', 'J', '\004', '\010', '\005',
+    '\020', '\006', 'J', '\004', '\010', '\006', '\020', '\007', '\"', '`', '\n', '\t',
+    'S', 'o', 'c', 'k', 'e', 't', 'R', 'e', 'f', '\022', '\033', '\n',
+    '\t', 's', 'o', 'c', 'k', 'e', 't', '_', 'i', 'd', '\030', '\003',
+    ' ', '\001', '(', '\003', 'R', '\010', 's', 'o', 'c', 'k', 'e', 't',
+    'I', 'd', '\022', '\022', '\n', '\004', 'n', 'a', 'm', 'e', '\030', '\004',
+    ' ', '\001', '(', '\t', 'R', '\004', 'n', 'a', 'm', 'e', 'J', '\004',
+    '\010', '\001', '\020', '\002', 'J', '\004', '\010', '\002', '\020', '\003', 'J', '\004',
+    '\010', '\005', '\020', '\006', 'J', '\004', '\010', '\006', '\020', '\007', 'J', '\004',
+    '\010', '\007', '\020', '\010', 'J', '\004', '\010', '\010', '\020', '\t', '\"', '`',
+    '\n', '\t', 'S', 'e', 'r', 'v', 'e', 'r', 'R', 'e', 'f', '\022',
+    '\033', '\n', '\t', 's', 'e', 'r', 'v', 'e', 'r', '_', 'i', 'd',
+    '\030', '\005', ' ', '\001', '(', '\003', 'R', '\010', 's', 'e', 'r', 'v',
+    'e', 'r', 'I', 'd', '\022', '\022', '\n', '\004', 'n', 'a', 'm', 'e',
+    '\030', '\006', ' ', '\001', '(', '\t', 'R', '\004', 'n', 'a', 'm', 'e',
+    'J', '\004', '\010', '\001', '\020', '\002', 'J', '\004', '\010', '\002', '\020', '\003',
+    'J', '\004', '\010', '\003', '\020', '\004', 'J', '\004', '\010', '\004', '\020', '\005',
+    'J', '\004', '\010', '\007', '\020', '\010', 'J', '\004', '\010', '\010', '\020', '\t',
+    '\"', '\253', '\001', '\n', '\006', 'S', 'e', 'r', 'v', 'e', 'r', '\022',
+    '-', '\n', '\003', 'r', 'e', 'f', '\030', '\001', ' ', '\001', '(', '\013',
+    '2', '\033', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n',
+    'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'S', 'e', 'r', 'v',
+    'e', 'r', 'R', 'e', 'f', 'R', '\003', 'r', 'e', 'f', '\022', '0',
+    '\n', '\004', 'd', 'a', 't', 'a', '\030', '\002', ' ', '\001', '(', '\013',
+    '2', '\034', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n',
+    'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'S', 'e', 'r', 'v',
+    'e', 'r', 'D', 'a', 't', 'a', 'R', '\004', 'd', 'a', 't', 'a',
+    '\022', '@', '\n', '\r', 'l', 'i', 's', 't', 'e', 'n', '_', 's',
+    'o', 'c', 'k', 'e', 't', '\030', '\003', ' ', '\003', '(', '\013', '2',
+    '\033', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n',
+    'e', 'l', 'z', '.', 'v', '1', '.', 'S', 'o', 'c', 'k', 'e',
+    't', 'R', 'e', 'f', 'R', '\014', 'l', 'i', 's', 't', 'e', 'n',
+    'S', 'o', 'c', 'k', 'e', 't', '\"', '\216', '\002', '\n', '\n', 'S',
+    'e', 'r', 'v', 'e', 'r', 'D', 'a', 't', 'a', '\022', '4', '\n',
+    '\005', 't', 'r', 'a', 'c', 'e', '\030', '\001', ' ', '\001', '(', '\013',
+    '2', '\036', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n',
+    'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'C', 'h', 'a', 'n',
+    'n', 'e', 'l', 'T', 'r', 'a', 'c', 'e', 'R', '\005', 't', 'r',
+    'a', 'c', 'e', '\022', '#', '\n', '\r', 'c', 'a', 'l', 'l', 's',
+    '_', 's', 't', 'a', 'r', 't', 'e', 'd', '\030', '\002', ' ', '\001',
+    '(', '\003', 'R', '\014', 'c', 'a', 'l', 'l', 's', 'S', 't', 'a',
+    'r', 't', 'e', 'd', '\022', '\'', '\n', '\017', 'c', 'a', 'l', 'l',
+    's', '_', 's', 'u', 'c', 'c', 'e', 'e', 'd', 'e', 'd', '\030',
+    '\003', ' ', '\001', '(', '\003', 'R', '\016', 'c', 'a', 'l', 'l', 's',
+    'S', 'u', 'c', 'c', 'e', 'e', 'd', 'e', 'd', '\022', '!', '\n',
+    '\014', 'c', 'a', 'l', 'l', 's', '_', 'f', 'a', 'i', 'l', 'e',
+    'd', '\030', '\004', ' ', '\001', '(', '\003', 'R', '\013', 'c', 'a', 'l',
+    'l', 's', 'F', 'a', 'i', 'l', 'e', 'd', '\022', 'Y', '\n', '\033',
+    'l', 'a', 's', 't', '_', 'c', 'a', 'l', 'l', '_', 's', 't',
+    'a', 'r', 't', 'e', 'd', '_', 't', 'i', 'm', 'e', 's', 't',
+    'a', 'm', 'p', '\030', '\005', ' ', '\001', '(', '\013', '2', '\032', '.',
+    'g', 'o', 'o', 'g', 'l', 'e', '.', 'p', 'r', 'o', 't', 'o',
+    'b', 'u', 'f', '.', 'T', 'i', 'm', 'e', 's', 't', 'a', 'm',
+    'p', 'R', '\030', 'l', 'a', 's', 't', 'C', 'a', 'l', 'l', 'S',
+    't', 'a', 'r', 't', 'e', 'd', 'T', 'i', 'm', 'e', 's', 't',
+    'a', 'm', 'p', '\"', '\246', '\002', '\n', '\006', 'S', 'o', 'c', 'k',
+    'e', 't', '\022', '-', '\n', '\003', 'r', 'e', 'f', '\030', '\001', ' ',
+    '\001', '(', '\013', '2', '\033', '.', 'g', 'r', 'p', 'c', '.', 'c',
+    'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'S',
+    'o', 'c', 'k', 'e', 't', 'R', 'e', 'f', 'R', '\003', 'r', 'e',
+    'f', '\022', '0', '\n', '\004', 'd', 'a', 't', 'a', '\030', '\002', ' ',
+    '\001', '(', '\013', '2', '\034', '.', 'g', 'r', 'p', 'c', '.', 'c',
+    'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'S',
+    'o', 'c', 'k', 'e', 't', 'D', 'a', 't', 'a', 'R', '\004', 'd',
+    'a', 't', 'a', '\022', '/', '\n', '\005', 'l', 'o', 'c', 'a', 'l',
+    '\030', '\003', ' ', '\001', '(', '\013', '2', '\031', '.', 'g', 'r', 'p',
+    'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v',
+    '1', '.', 'A', 'd', 'd', 'r', 'e', 's', 's', 'R', '\005', 'l',
+    'o', 'c', 'a', 'l', '\022', '1', '\n', '\006', 'r', 'e', 'm', 'o',
+    't', 'e', '\030', '\004', ' ', '\001', '(', '\013', '2', '\031', '.', 'g',
+    'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z',
+    '.', 'v', '1', '.', 'A', 'd', 'd', 'r', 'e', 's', 's', 'R',
+    '\006', 'r', 'e', 'm', 'o', 't', 'e', '\022', '6', '\n', '\010', 's',
+    'e', 'c', 'u', 'r', 'i', 't', 'y', '\030', '\005', ' ', '\001', '(',
+    '\013', '2', '\032', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a',
+    'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'S', 'e', 'c',
+    'u', 'r', 'i', 't', 'y', 'R', '\010', 's', 'e', 'c', 'u', 'r',
+    'i', 't', 'y', '\022', '\037', '\n', '\013', 'r', 'e', 'm', 'o', 't',
+    'e', '_', 'n', 'a', 'm', 'e', '\030', '\006', ' ', '\001', '(', '\t',
+    'R', '\n', 'r', 'e', 'm', 'o', 't', 'e', 'N', 'a', 'm', 'e',
+    '\"', '\203', '\007', '\n', '\n', 'S', 'o', 'c', 'k', 'e', 't', 'D',
+    'a', 't', 'a', '\022', '\'', '\n', '\017', 's', 't', 'r', 'e', 'a',
+    'm', 's', '_', 's', 't', 'a', 'r', 't', 'e', 'd', '\030', '\001',
+    ' ', '\001', '(', '\003', 'R', '\016', 's', 't', 'r', 'e', 'a', 'm',
+    's', 'S', 't', 'a', 'r', 't', 'e', 'd', '\022', '+', '\n', '\021',
+    's', 't', 'r', 'e', 'a', 'm', 's', '_', 's', 'u', 'c', 'c',
+    'e', 'e', 'd', 'e', 'd', '\030', '\002', ' ', '\001', '(', '\003', 'R',
+    '\020', 's', 't', 'r', 'e', 'a', 'm', 's', 'S', 'u', 'c', 'c',
+    'e', 'e', 'd', 'e', 'd', '\022', '%', '\n', '\016', 's', 't', 'r',
+    'e', 'a', 'm', 's', '_', 'f', 'a', 'i', 'l', 'e', 'd', '\030',
+    '\003', ' ', '\001', '(', '\003', 'R', '\r', 's', 't', 'r', 'e', 'a',
+    'm', 's', 'F', 'a', 'i', 'l', 'e', 'd', '\022', '#', '\n', '\r',
+    'm', 'e', 's', 's', 'a', 'g', 'e', 's', '_', 's', 'e', 'n',
+    't', '\030', '\004', ' ', '\001', '(', '\003', 'R', '\014', 'm', 'e', 's',
+    's', 'a', 'g', 'e', 's', 'S', 'e', 'n', 't', '\022', '+', '\n',
+    '\021', 'm', 'e', 's', 's', 'a', 'g', 'e', 's', '_', 'r', 'e',
+    'c', 'e', 'i', 'v', 'e', 'd', '\030', '\005', ' ', '\001', '(', '\003',
+    'R', '\020', 'm', 'e', 's', 's', 'a', 'g', 'e', 's', 'R', 'e',
+    'c', 'e', 'i', 'v', 'e', 'd', '\022', '(', '\n', '\020', 'k', 'e',
+    'e', 'p', '_', 'a', 'l', 'i', 'v', 'e', 's', '_', 's', 'e',
+    'n', 't', '\030', '\006', ' ', '\001', '(', '\003', 'R', '\016', 'k', 'e',
+    'e', 'p', 'A', 'l', 'i', 'v', 'e', 's', 'S', 'e', 'n', 't',
+    '\022', 'h', '\n', '#', 'l', 'a', 's', 't', '_', 'l', 'o', 'c',
+    'a', 'l', '_', 's', 't', 'r', 'e', 'a', 'm', '_', 'c', 'r',
+    'e', 'a', 't', 'e', 'd', '_', 't', 'i', 'm', 'e', 's', 't',
+    'a', 'm', 'p', '\030', '\007', ' ', '\001', '(', '\013', '2', '\032', '.',
+    'g', 'o', 'o', 'g', 'l', 'e', '.', 'p', 'r', 'o', 't', 'o',
+    'b', 'u', 'f', '.', 'T', 'i', 'm', 'e', 's', 't', 'a', 'm',
+    'p', 'R', '\037', 'l', 'a', 's', 't', 'L', 'o', 'c', 'a', 'l',
+    'S', 't', 'r', 'e', 'a', 'm', 'C', 'r', 'e', 'a', 't', 'e',
+    'd', 'T', 'i', 'm', 'e', 's', 't', 'a', 'm', 'p', '\022', 'j',
+    '\n', '$', 'l', 'a', 's', 't', '_', 'r', 'e', 'm', 'o', 't',
+    'e', '_', 's', 't', 'r', 'e', 'a', 'm', '_', 'c', 'r', 'e',
+    'a', 't', 'e', 'd', '_', 't', 'i', 'm', 'e', 's', 't', 'a',
+    'm', 'p', '\030', '\010', ' ', '\001', '(', '\013', '2', '\032', '.', 'g',
+    'o', 'o', 'g', 'l', 'e', '.', 'p', 'r', 'o', 't', 'o', 'b',
+    'u', 'f', '.', 'T', 'i', 'm', 'e', 's', 't', 'a', 'm', 'p',
+    'R', ' ', 'l', 'a', 's', 't', 'R', 'e', 'm', 'o', 't', 'e',
+    'S', 't', 'r', 'e', 'a', 'm', 'C', 'r', 'e', 'a', 't', 'e',
+    'd', 'T', 'i', 'm', 'e', 's', 't', 'a', 'm', 'p', '\022', 'Y',
+    '\n', '\033', 'l', 'a', 's', 't', '_', 'm', 'e', 's', 's', 'a',
+    'g', 'e', '_', 's', 'e', 'n', 't', '_', 't', 'i', 'm', 'e',
+    's', 't', 'a', 'm', 'p', '\030', '\t', ' ', '\001', '(', '\013', '2',
+    '\032', '.', 'g', 'o', 'o', 'g', 'l', 'e', '.', 'p', 'r', 'o',
+    't', 'o', 'b', 'u', 'f', '.', 'T', 'i', 'm', 'e', 's', 't',
+    'a', 'm', 'p', 'R', '\030', 'l', 'a', 's', 't', 'M', 'e', 's',
+    's', 'a', 'g', 'e', 'S', 'e', 'n', 't', 'T', 'i', 'm', 'e',
+    's', 't', 'a', 'm', 'p', '\022', 'a', '\n', '\037', 'l', 'a', 's',
+    't', '_', 'm', 'e', 's', 's', 'a', 'g', 'e', '_', 'r', 'e',
+    'c', 'e', 'i', 'v', 'e', 'd', '_', 't', 'i', 'm', 'e', 's',
+    't', 'a', 'm', 'p', '\030', '\n', ' ', '\001', '(', '\013', '2', '\032',
+    '.', 'g', 'o', 'o', 'g', 'l', 'e', '.', 'p', 'r', 'o', 't',
+    'o', 'b', 'u', 'f', '.', 'T', 'i', 'm', 'e', 's', 't', 'a',
+    'm', 'p', 'R', '\034', 'l', 'a', 's', 't', 'M', 'e', 's', 's',
+    'a', 'g', 'e', 'R', 'e', 'c', 'e', 'i', 'v', 'e', 'd', 'T',
+    'i', 'm', 'e', 's', 't', 'a', 'm', 'p', '\022', 'V', '\n', '\031',
+    'l', 'o', 'c', 'a', 'l', '_', 'f', 'l', 'o', 'w', '_', 'c',
+    'o', 'n', 't', 'r', 'o', 'l', '_', 'w', 'i', 'n', 'd', 'o',
+    'w', '\030', '\013', ' ', '\001', '(', '\013', '2', '\033', '.', 'g', 'o',
+    'o', 'g', 'l', 'e', '.', 'p', 'r', 'o', 't', 'o', 'b', 'u',
+    'f', '.', 'I', 'n', 't', '6', '4', 'V', 'a', 'l', 'u', 'e',
+    'R', '\026', 'l', 'o', 'c', 'a', 'l', 'F', 'l', 'o', 'w', 'C',
+    'o', 'n', 't', 'r', 'o', 'l', 'W', 'i', 'n', 'd', 'o', 'w',
+    '\022', 'X', '\n', '\032', 'r', 'e', 'm', 'o', 't', 'e', '_', 'f',
+    'l', 'o', 'w', '_', 'c', 'o', 'n', 't', 'r', 'o', 'l', '_',
+    'w', 'i', 'n', 'd', 'o', 'w', '\030', '\014', ' ', '\001', '(', '\013',
+    '2', '\033', '.', 'g', 'o', 'o', 'g', 'l', 'e', '.', 'p', 'r',
+    'o', 't', 'o', 'b', 'u', 'f', '.', 'I', 'n', 't', '6', '4',
+    'V', 'a', 'l', 'u', 'e', 'R', '\027', 'r', 'e', 'm', 'o', 't',
+    'e', 'F', 'l', 'o', 'w', 'C', 'o', 'n', 't', 'r', 'o', 'l',
+    'W', 'i', 'n', 'd', 'o', 'w', '\022', '6', '\n', '\006', 'o', 'p',
+    't', 'i', 'o', 'n', '\030', '\r', ' ', '\003', '(', '\013', '2', '\036',
+    '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e',
+    'l', 'z', '.', 'v', '1', '.', 'S', 'o', 'c', 'k', 'e', 't',
+    'O', 'p', 't', 'i', 'o', 'n', 'R', '\006', 'o', 'p', 't', 'i',
+    'o', 'n', '\"', '\270', '\003', '\n', '\007', 'A', 'd', 'd', 'r', 'e',
+    's', 's', '\022', 'M', '\n', '\r', 't', 'c', 'p', 'i', 'p', '_',
+    'a', 'd', 'd', 'r', 'e', 's', 's', '\030', '\001', ' ', '\001', '(',
+    '\013', '2', '&', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a',
+    'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'A', 'd', 'd',
+    'r', 'e', 's', 's', '.', 'T', 'c', 'p', 'I', 'p', 'A', 'd',
+    'd', 'r', 'e', 's', 's', 'H', '\000', 'R', '\014', 't', 'c', 'p',
+    'i', 'p', 'A', 'd', 'd', 'r', 'e', 's', 's', '\022', 'G', '\n',
+    '\013', 'u', 'd', 's', '_', 'a', 'd', 'd', 'r', 'e', 's', 's',
+    '\030', '\002', ' ', '\001', '(', '\013', '2', '$', '.', 'g', 'r', 'p',
+    'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v',
+    '1', '.', 'A', 'd', 'd', 'r', 'e', 's', 's', '.', 'U', 'd',
+    's', 'A', 'd', 'd', 'r', 'e', 's', 's', 'H', '\000', 'R', '\n',
+    'u', 'd', 's', 'A', 'd', 'd', 'r', 'e', 's', 's', '\022', 'M',
+    '\n', '\r', 'o', 't', 'h', 'e', 'r', '_', 'a', 'd', 'd', 'r',
+    'e', 's', 's', '\030', '\003', ' ', '\001', '(', '\013', '2', '&', '.',
+    'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l',
+    'z', '.', 'v', '1', '.', 'A', 'd', 'd', 'r', 'e', 's', 's',
+    '.', 'O', 't', 'h', 'e', 'r', 'A', 'd', 'd', 'r', 'e', 's',
+    's', 'H', '\000', 'R', '\014', 'o', 't', 'h', 'e', 'r', 'A', 'd',
+    'd', 'r', 'e', 's', 's', '\032', 'A', '\n', '\014', 'T', 'c', 'p',
+    'I', 'p', 'A', 'd', 'd', 'r', 'e', 's', 's', '\022', '\035', '\n',
+    '\n', 'i', 'p', '_', 'a', 'd', 'd', 'r', 'e', 's', 's', '\030',
+    '\001', ' ', '\001', '(', '\014', 'R', '\t', 'i', 'p', 'A', 'd', 'd',
+    'r', 'e', 's', 's', '\022', '\022', '\n', '\004', 'p', 'o', 'r', 't',
+    '\030', '\002', ' ', '\001', '(', '\005', 'R', '\004', 'p', 'o', 'r', 't',
+    '\032', '(', '\n', '\n', 'U', 'd', 's', 'A', 'd', 'd', 'r', 'e',
+    's', 's', '\022', '\032', '\n', '\010', 'f', 'i', 'l', 'e', 'n', 'a',
+    'm', 'e', '\030', '\001', ' ', '\001', '(', '\t', 'R', '\010', 'f', 'i',
+    'l', 'e', 'n', 'a', 'm', 'e', '\032', 'N', '\n', '\014', 'O', 't',
+    'h', 'e', 'r', 'A', 'd', 'd', 'r', 'e', 's', 's', '\022', '\022',
+    '\n', '\004', 'n', 'a', 'm', 'e', '\030', '\001', ' ', '\001', '(', '\t',
+    'R', '\004', 'n', 'a', 'm', 'e', '\022', '*', '\n', '\005', 'v', 'a',
+    'l', 'u', 'e', '\030', '\002', ' ', '\001', '(', '\013', '2', '\024', '.',
+    'g', 'o', 'o', 'g', 'l', 'e', '.', 'p', 'r', 'o', 't', 'o',
+    'b', 'u', 'f', '.', 'A', 'n', 'y', 'R', '\005', 'v', 'a', 'l',
+    'u', 'e', 'B', '\t', '\n', '\007', 'a', 'd', 'd', 'r', 'e', 's',
+    's', '\"', '\226', '\003', '\n', '\010', 'S', 'e', 'c', 'u', 'r', 'i',
+    't', 'y', '\022', '2', '\n', '\003', 't', 'l', 's', '\030', '\001', ' ',
+    '\001', '(', '\013', '2', '\036', '.', 'g', 'r', 'p', 'c', '.', 'c',
+    'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'S',
+    'e', 'c', 'u', 'r', 'i', 't', 'y', '.', 'T', 'l', 's', 'H',
+    '\000', 'R', '\003', 't', 'l', 's', '\022', '@', '\n', '\005', 'o', 't',
+    'h', 'e', 'r', '\030', '\002', ' ', '\001', '(', '\013', '2', '(', '.',
+    'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l',
+    'z', '.', 'v', '1', '.', 'S', 'e', 'c', 'u', 'r', 'i', 't',
+    'y', '.', 'O', 't', 'h', 'e', 'r', 'S', 'e', 'c', 'u', 'r',
+    'i', 't', 'y', 'H', '\000', 'R', '\005', 'o', 't', 'h', 'e', 'r',
+    '\032', '\271', '\001', '\n', '\003', 'T', 'l', 's', '\022', '%', '\n', '\r',
+    's', 't', 'a', 'n', 'd', 'a', 'r', 'd', '_', 'n', 'a', 'm',
+    'e', '\030', '\001', ' ', '\001', '(', '\t', 'H', '\000', 'R', '\014', 's',
+    't', 'a', 'n', 'd', 'a', 'r', 'd', 'N', 'a', 'm', 'e', '\022',
+    '\037', '\n', '\n', 'o', 't', 'h', 'e', 'r', '_', 'n', 'a', 'm',
+    'e', '\030', '\002', ' ', '\001', '(', '\t', 'H', '\000', 'R', '\t', 'o',
+    't', 'h', 'e', 'r', 'N', 'a', 'm', 'e', '\022', '+', '\n', '\021',
+    'l', 'o', 'c', 'a', 'l', '_', 'c', 'e', 'r', 't', 'i', 'f',
+    'i', 'c', 'a', 't', 'e', '\030', '\003', ' ', '\001', '(', '\014', 'R',
+    '\020', 'l', 'o', 'c', 'a', 'l', 'C', 'e', 'r', 't', 'i', 'f',
+    'i', 'c', 'a', 't', 'e', '\022', '-', '\n', '\022', 'r', 'e', 'm',
+    'o', 't', 'e', '_', 'c', 'e', 'r', 't', 'i', 'f', 'i', 'c',
+    'a', 't', 'e', '\030', '\004', ' ', '\001', '(', '\014', 'R', '\021', 'r',
+    'e', 'm', 'o', 't', 'e', 'C', 'e', 'r', 't', 'i', 'f', 'i',
+    'c', 'a', 't', 'e', 'B', '\016', '\n', '\014', 'c', 'i', 'p', 'h',
+    'e', 'r', '_', 's', 'u', 'i', 't', 'e', '\032', 'O', '\n', '\r',
+    'O', 't', 'h', 'e', 'r', 'S', 'e', 'c', 'u', 'r', 'i', 't',
+    'y', '\022', '\022', '\n', '\004', 'n', 'a', 'm', 'e', '\030', '\001', ' ',
+    '\001', '(', '\t', 'R', '\004', 'n', 'a', 'm', 'e', '\022', '*', '\n',
+    '\005', 'v', 'a', 'l', 'u', 'e', '\030', '\002', ' ', '\001', '(', '\013',
+    '2', '\024', '.', 'g', 'o', 'o', 'g', 'l', 'e', '.', 'p', 'r',
+    'o', 't', 'o', 'b', 'u', 'f', '.', 'A', 'n', 'y', 'R', '\005',
+    'v', 'a', 'l', 'u', 'e', 'B', '\007', '\n', '\005', 'm', 'o', 'd',
+    'e', 'l', '\"', 'n', '\n', '\014', 'S', 'o', 'c', 'k', 'e', 't',
+    'O', 'p', 't', 'i', 'o', 'n', '\022', '\022', '\n', '\004', 'n', 'a',
+    'm', 'e', '\030', '\001', ' ', '\001', '(', '\t', 'R', '\004', 'n', 'a',
+    'm', 'e', '\022', '\024', '\n', '\005', 'v', 'a', 'l', 'u', 'e', '\030',
+    '\002', ' ', '\001', '(', '\t', 'R', '\005', 'v', 'a', 'l', 'u', 'e',
+    '\022', '4', '\n', '\n', 'a', 'd', 'd', 'i', 't', 'i', 'o', 'n',
+    'a', 'l', '\030', '\003', ' ', '\001', '(', '\013', '2', '\024', '.', 'g',
+    'o', 'o', 'g', 'l', 'e', '.', 'p', 'r', 'o', 't', 'o', 'b',
+    'u', 'f', '.', 'A', 'n', 'y', 'R', '\n', 'a', 'd', 'd', 'i',
+    't', 'i', 'o', 'n', 'a', 'l', '\"', 'L', '\n', '\023', 'S', 'o',
+    'c', 'k', 'e', 't', 'O', 'p', 't', 'i', 'o', 'n', 'T', 'i',
+    'm', 'e', 'o', 'u', 't', '\022', '5', '\n', '\010', 'd', 'u', 'r',
+    'a', 't', 'i', 'o', 'n', '\030', '\001', ' ', '\001', '(', '\013', '2',
+    '\031', '.', 'g', 'o', 'o', 'g', 'l', 'e', '.', 'p', 'r', 'o',
+    't', 'o', 'b', 'u', 'f', '.', 'D', 'u', 'r', 'a', 't', 'i',
+    'o', 'n', 'R', '\010', 'd', 'u', 'r', 'a', 't', 'i', 'o', 'n',
+    '\"', 'c', '\n', '\022', 'S', 'o', 'c', 'k', 'e', 't', 'O', 'p',
+    't', 'i', 'o', 'n', 'L', 'i', 'n', 'g', 'e', 'r', '\022', '\026',
+    '\n', '\006', 'a', 'c', 't', 'i', 'v', 'e', '\030', '\001', ' ', '\001',
+    '(', '\010', 'R', '\006', 'a', 'c', 't', 'i', 'v', 'e', '\022', '5',
+    '\n', '\010', 'd', 'u', 'r', 'a', 't', 'i', 'o', 'n', '\030', '\002',
+    ' ', '\001', '(', '\013', '2', '\031', '.', 'g', 'o', 'o', 'g', 'l',
+    'e', '.', 'p', 'r', 'o', 't', 'o', 'b', 'u', 'f', '.', 'D',
+    'u', 'r', 'a', 't', 'i', 'o', 'n', 'R', '\010', 'd', 'u', 'r',
+    'a', 't', 'i', 'o', 'n', '\"', '\262', '\010', '\n', '\023', 'S', 'o',
+    'c', 'k', 'e', 't', 'O', 'p', 't', 'i', 'o', 'n', 'T', 'c',
+    'p', 'I', 'n', 'f', 'o', '\022', '\035', '\n', '\n', 't', 'c', 'p',
+    'i', '_', 's', 't', 'a', 't', 'e', '\030', '\001', ' ', '\001', '(',
+    '\r', 'R', '\t', 't', 'c', 'p', 'i', 'S', 't', 'a', 't', 'e',
+    '\022', '\"', '\n', '\r', 't', 'c', 'p', 'i', '_', 'c', 'a', '_',
+    's', 't', 'a', 't', 'e', '\030', '\002', ' ', '\001', '(', '\r', 'R',
+    '\013', 't', 'c', 'p', 'i', 'C', 'a', 'S', 't', 'a', 't', 'e',
+    '\022', ')', '\n', '\020', 't', 'c', 'p', 'i', '_', 'r', 'e', 't',
+    'r', 'a', 'n', 's', 'm', 'i', 't', 's', '\030', '\003', ' ', '\001',
+    '(', '\r', 'R', '\017', 't', 'c', 'p', 'i', 'R', 'e', 't', 'r',
+    'a', 'n', 's', 'm', 'i', 't', 's', '\022', '\037', '\n', '\013', 't',
+    'c', 'p', 'i', '_', 'p', 'r', 'o', 'b', 'e', 's', '\030', '\004',
+    ' ', '\001', '(', '\r', 'R', '\n', 't', 'c', 'p', 'i', 'P', 'r',
+    'o', 'b', 'e', 's', '\022', '!', '\n', '\014', 't', 'c', 'p', 'i',
+    '_', 'b', 'a', 'c', 'k', 'o', 'f', 'f', '\030', '\005', ' ', '\001',
+    '(', '\r', 'R', '\013', 't', 'c', 'p', 'i', 'B', 'a', 'c', 'k',
+    'o', 'f', 'f', '\022', '!', '\n', '\014', 't', 'c', 'p', 'i', '_',
+    'o', 'p', 't', 'i', 'o', 'n', 's', '\030', '\006', ' ', '\001', '(',
+    '\r', 'R', '\013', 't', 'c', 'p', 'i', 'O', 'p', 't', 'i', 'o',
+    'n', 's', '\022', '&', '\n', '\017', 't', 'c', 'p', 'i', '_', 's',
+    'n', 'd', '_', 'w', 's', 'c', 'a', 'l', 'e', '\030', '\007', ' ',
+    '\001', '(', '\r', 'R', '\r', 't', 'c', 'p', 'i', 'S', 'n', 'd',
+    'W', 's', 'c', 'a', 'l', 'e', '\022', '&', '\n', '\017', 't', 'c',
+    'p', 'i', '_', 'r', 'c', 'v', '_', 'w', 's', 'c', 'a', 'l',
+    'e', '\030', '\010', ' ', '\001', '(', '\r', 'R', '\r', 't', 'c', 'p',
+    'i', 'R', 'c', 'v', 'W', 's', 'c', 'a', 'l', 'e', '\022', '\031',
+    '\n', '\010', 't', 'c', 'p', 'i', '_', 'r', 't', 'o', '\030', '\t',
+    ' ', '\001', '(', '\r', 'R', '\007', 't', 'c', 'p', 'i', 'R', 't',
+    'o', '\022', '\031', '\n', '\010', 't', 'c', 'p', 'i', '_', 'a', 't',
+    'o', '\030', '\n', ' ', '\001', '(', '\r', 'R', '\007', 't', 'c', 'p',
+    'i', 'A', 't', 'o', '\022', ' ', '\n', '\014', 't', 'c', 'p', 'i',
+    '_', 's', 'n', 'd', '_', 'm', 's', 's', '\030', '\013', ' ', '\001',
+    '(', '\r', 'R', '\n', 't', 'c', 'p', 'i', 'S', 'n', 'd', 'M',
+    's', 's', '\022', ' ', '\n', '\014', 't', 'c', 'p', 'i', '_', 'r',
+    'c', 'v', '_', 'm', 's', 's', '\030', '\014', ' ', '\001', '(', '\r',
+    'R', '\n', 't', 'c', 'p', 'i', 'R', 'c', 'v', 'M', 's', 's',
+    '\022', '!', '\n', '\014', 't', 'c', 'p', 'i', '_', 'u', 'n', 'a',
+    'c', 'k', 'e', 'd', '\030', '\r', ' ', '\001', '(', '\r', 'R', '\013',
+    't', 'c', 'p', 'i', 'U', 'n', 'a', 'c', 'k', 'e', 'd', '\022',
+    '\037', '\n', '\013', 't', 'c', 'p', 'i', '_', 's', 'a', 'c', 'k',
+    'e', 'd', '\030', '\016', ' ', '\001', '(', '\r', 'R', '\n', 't', 'c',
+    'p', 'i', 'S', 'a', 'c', 'k', 'e', 'd', '\022', '\033', '\n', '\t',
+    't', 'c', 'p', 'i', '_', 'l', 'o', 's', 't', '\030', '\017', ' ',
+    '\001', '(', '\r', 'R', '\010', 't', 'c', 'p', 'i', 'L', 'o', 's',
+    't', '\022', '!', '\n', '\014', 't', 'c', 'p', 'i', '_', 'r', 'e',
+    't', 'r', 'a', 'n', 's', '\030', '\020', ' ', '\001', '(', '\r', 'R',
+    '\013', 't', 'c', 'p', 'i', 'R', 'e', 't', 'r', 'a', 'n', 's',
+    '\022', '!', '\n', '\014', 't', 'c', 'p', 'i', '_', 'f', 'a', 'c',
+    'k', 'e', 't', 's', '\030', '\021', ' ', '\001', '(', '\r', 'R', '\013',
+    't', 'c', 'p', 'i', 'F', 'a', 'c', 'k', 'e', 't', 's', '\022',
+    '-', '\n', '\023', 't', 'c', 'p', 'i', '_', 'l', 'a', 's', 't',
+    '_', 'd', 'a', 't', 'a', '_', 's', 'e', 'n', 't', '\030', '\022',
+    ' ', '\001', '(', '\r', 'R', '\020', 't', 'c', 'p', 'i', 'L', 'a',
+    's', 't', 'D', 'a', 't', 'a', 'S', 'e', 'n', 't', '\022', '+',
+    '\n', '\022', 't', 'c', 'p', 'i', '_', 'l', 'a', 's', 't', '_',
+    'a', 'c', 'k', '_', 's', 'e', 'n', 't', '\030', '\023', ' ', '\001',
+    '(', '\r', 'R', '\017', 't', 'c', 'p', 'i', 'L', 'a', 's', 't',
+    'A', 'c', 'k', 'S', 'e', 'n', 't', '\022', '-', '\n', '\023', 't',
+    'c', 'p', 'i', '_', 'l', 'a', 's', 't', '_', 'd', 'a', 't',
+    'a', '_', 'r', 'e', 'c', 'v', '\030', '\024', ' ', '\001', '(', '\r',
+    'R', '\020', 't', 'c', 'p', 'i', 'L', 'a', 's', 't', 'D', 'a',
+    't', 'a', 'R', 'e', 'c', 'v', '\022', '+', '\n', '\022', 't', 'c',
+    'p', 'i', '_', 'l', 'a', 's', 't', '_', 'a', 'c', 'k', '_',
+    'r', 'e', 'c', 'v', '\030', '\025', ' ', '\001', '(', '\r', 'R', '\017',
+    't', 'c', 'p', 'i', 'L', 'a', 's', 't', 'A', 'c', 'k', 'R',
+    'e', 'c', 'v', '\022', '\033', '\n', '\t', 't', 'c', 'p', 'i', '_',
+    'p', 'm', 't', 'u', '\030', '\026', ' ', '\001', '(', '\r', 'R', '\010',
+    't', 'c', 'p', 'i', 'P', 'm', 't', 'u', '\022', '*', '\n', '\021',
+    't', 'c', 'p', 'i', '_', 'r', 'c', 'v', '_', 's', 's', 't',
+    'h', 'r', 'e', 's', 'h', '\030', '\027', ' ', '\001', '(', '\r', 'R',
+    '\017', 't', 'c', 'p', 'i', 'R', 'c', 'v', 'S', 's', 't', 'h',
+    'r', 'e', 's', 'h', '\022', '\031', '\n', '\010', 't', 'c', 'p', 'i',
+    '_', 'r', 't', 't', '\030', '\030', ' ', '\001', '(', '\r', 'R', '\007',
+    't', 'c', 'p', 'i', 'R', 't', 't', '\022', '\037', '\n', '\013', 't',
+    'c', 'p', 'i', '_', 'r', 't', 't', 'v', 'a', 'r', '\030', '\031',
+    ' ', '\001', '(', '\r', 'R', '\n', 't', 'c', 'p', 'i', 'R', 't',
+    't', 'v', 'a', 'r', '\022', '*', '\n', '\021', 't', 'c', 'p', 'i',
+    '_', 's', 'n', 'd', '_', 's', 's', 't', 'h', 'r', 'e', 's',
+    'h', '\030', '\032', ' ', '\001', '(', '\r', 'R', '\017', 't', 'c', 'p',
+    'i', 'S', 'n', 'd', 'S', 's', 't', 'h', 'r', 'e', 's', 'h',
+    '\022', '\"', '\n', '\r', 't', 'c', 'p', 'i', '_', 's', 'n', 'd',
+    '_', 'c', 'w', 'n', 'd', '\030', '\033', ' ', '\001', '(', '\r', 'R',
+    '\013', 't', 'c', 'p', 'i', 'S', 'n', 'd', 'C', 'w', 'n', 'd',
+    '\022', '\037', '\n', '\013', 't', 'c', 'p', 'i', '_', 'a', 'd', 'v',
+    'm', 's', 's', '\030', '\034', ' ', '\001', '(', '\r', 'R', '\n', 't',
+    'c', 'p', 'i', 'A', 'd', 'v', 'm', 's', 's', '\022', '\'', '\n',
+    '\017', 't', 'c', 'p', 'i', '_', 'r', 'e', 'o', 'r', 'd', 'e',
+    'r', 'i', 'n', 'g', '\030', '\035', ' ', '\001', '(', '\r', 'R', '\016',
+    't', 'c', 'p', 'i', 'R', 'e', 'o', 'r', 'd', 'e', 'r', 'i',
+    'n', 'g', '\"', 'b', '\n', '\025', 'G', 'e', 't', 'T', 'o', 'p',
+    'C', 'h', 'a', 'n', 'n', 'e', 'l', 's', 'R', 'e', 'q', 'u',
+    'e', 's', 't', '\022', '(', '\n', '\020', 's', 't', 'a', 'r', 't',
+    '_', 'c', 'h', 'a', 'n', 'n', 'e', 'l', '_', 'i', 'd', '\030',
+    '\001', ' ', '\001', '(', '\003', 'R', '\016', 's', 't', 'a', 'r', 't',
+    'C', 'h', 'a', 'n', 'n', 'e', 'l', 'I', 'd', '\022', '\037', '\n',
+    '\013', 'm', 'a', 'x', '_', 'r', 'e', 's', 'u', 'l', 't', 's',
+    '\030', '\002', ' ', '\001', '(', '\003', 'R', '\n', 'm', 'a', 'x', 'R',
+    'e', 's', 'u', 'l', 't', 's', '\"', '_', '\n', '\026', 'G', 'e',
+    't', 'T', 'o', 'p', 'C', 'h', 'a', 'n', 'n', 'e', 'l', 's',
+    'R', 'e', 's', 'p', 'o', 'n', 's', 'e', '\022', '3', '\n', '\007',
+    'c', 'h', 'a', 'n', 'n', 'e', 'l', '\030', '\001', ' ', '\003', '(',
+    '\013', '2', '\031', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a',
+    'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'C', 'h', 'a',
+    'n', 'n', 'e', 'l', 'R', '\007', 'c', 'h', 'a', 'n', 'n', 'e',
+    'l', '\022', '\020', '\n', '\003', 'e', 'n', 'd', '\030', '\002', ' ', '\001',
+    '(', '\010', 'R', '\003', 'e', 'n', 'd', '\"', '\\', '\n', '\021', 'G',
+    'e', 't', 'S', 'e', 'r', 'v', 'e', 'r', 's', 'R', 'e', 'q',
+    'u', 'e', 's', 't', '\022', '&', '\n', '\017', 's', 't', 'a', 'r',
+    't', '_', 's', 'e', 'r', 'v', 'e', 'r', '_', 'i', 'd', '\030',
+    '\001', ' ', '\001', '(', '\003', 'R', '\r', 's', 't', 'a', 'r', 't',
+    'S', 'e', 'r', 'v', 'e', 'r', 'I', 'd', '\022', '\037', '\n', '\013',
+    'm', 'a', 'x', '_', 'r', 'e', 's', 'u', 'l', 't', 's', '\030',
+    '\002', ' ', '\001', '(', '\003', 'R', '\n', 'm', 'a', 'x', 'R', 'e',
+    's', 'u', 'l', 't', 's', '\"', 'X', '\n', '\022', 'G', 'e', 't',
+    'S', 'e', 'r', 'v', 'e', 'r', 's', 'R', 'e', 's', 'p', 'o',
+    'n', 's', 'e', '\022', '0', '\n', '\006', 's', 'e', 'r', 'v', 'e',
+    'r', '\030', '\001', ' ', '\003', '(', '\013', '2', '\030', '.', 'g', 'r',
+    'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.',
+    'v', '1', '.', 'S', 'e', 'r', 'v', 'e', 'r', 'R', '\006', 's',
+    'e', 'r', 'v', 'e', 'r', '\022', '\020', '\n', '\003', 'e', 'n', 'd',
+    '\030', '\002', ' ', '\001', '(', '\010', 'R', '\003', 'e', 'n', 'd', '\"',
+    '/', '\n', '\020', 'G', 'e', 't', 'S', 'e', 'r', 'v', 'e', 'r',
+    'R', 'e', 'q', 'u', 'e', 's', 't', '\022', '\033', '\n', '\t', 's',
+    'e', 'r', 'v', 'e', 'r', '_', 'i', 'd', '\030', '\001', ' ', '\001',
+    '(', '\003', 'R', '\010', 's', 'e', 'r', 'v', 'e', 'r', 'I', 'd',
+    '\"', 'E', '\n', '\021', 'G', 'e', 't', 'S', 'e', 'r', 'v', 'e',
+    'r', 'R', 'e', 's', 'p', 'o', 'n', 's', 'e', '\022', '0', '\n',
+    '\006', 's', 'e', 'r', 'v', 'e', 'r', '\030', '\001', ' ', '\001', '(',
+    '\013', '2', '\030', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a',
+    'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'S', 'e', 'r',
+    'v', 'e', 'r', 'R', '\006', 's', 'e', 'r', 'v', 'e', 'r', '\"',
+    '\177', '\n', '\027', 'G', 'e', 't', 'S', 'e', 'r', 'v', 'e', 'r',
+    'S', 'o', 'c', 'k', 'e', 't', 's', 'R', 'e', 'q', 'u', 'e',
+    's', 't', '\022', '\033', '\n', '\t', 's', 'e', 'r', 'v', 'e', 'r',
+    '_', 'i', 'd', '\030', '\001', ' ', '\001', '(', '\003', 'R', '\010', 's',
+    'e', 'r', 'v', 'e', 'r', 'I', 'd', '\022', '&', '\n', '\017', 's',
+    't', 'a', 'r', 't', '_', 's', 'o', 'c', 'k', 'e', 't', '_',
+    'i', 'd', '\030', '\002', ' ', '\001', '(', '\003', 'R', '\r', 's', 't',
+    'a', 'r', 't', 'S', 'o', 'c', 'k', 'e', 't', 'I', 'd', '\022',
+    '\037', '\n', '\013', 'm', 'a', 'x', '_', 'r', 'e', 's', 'u', 'l',
+    't', 's', '\030', '\003', ' ', '\001', '(', '\003', 'R', '\n', 'm', 'a',
+    'x', 'R', 'e', 's', 'u', 'l', 't', 's', '\"', 'h', '\n', '\030',
+    'G', 'e', 't', 'S', 'e', 'r', 'v', 'e', 'r', 'S', 'o', 'c',
+    'k', 'e', 't', 's', 'R', 'e', 's', 'p', 'o', 'n', 's', 'e',
+    '\022', ':', '\n', '\n', 's', 'o', 'c', 'k', 'e', 't', '_', 'r',
+    'e', 'f', '\030', '\001', ' ', '\003', '(', '\013', '2', '\033', '.', 'g',
+    'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z',
+    '.', 'v', '1', '.', 'S', 'o', 'c', 'k', 'e', 't', 'R', 'e',
+    'f', 'R', '\t', 's', 'o', 'c', 'k', 'e', 't', 'R', 'e', 'f',
+    '\022', '\020', '\n', '\003', 'e', 'n', 'd', '\030', '\002', ' ', '\001', '(',
+    '\010', 'R', '\003', 'e', 'n', 'd', '\"', '2', '\n', '\021', 'G', 'e',
+    't', 'C', 'h', 'a', 'n', 'n', 'e', 'l', 'R', 'e', 'q', 'u',
+    'e', 's', 't', '\022', '\035', '\n', '\n', 'c', 'h', 'a', 'n', 'n',
+    'e', 'l', '_', 'i', 'd', '\030', '\001', ' ', '\001', '(', '\003', 'R',
+    '\t', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'I', 'd', '\"', 'I',
+    '\n', '\022', 'G', 'e', 't', 'C', 'h', 'a', 'n', 'n', 'e', 'l',
+    'R', 'e', 's', 'p', 'o', 'n', 's', 'e', '\022', '3', '\n', '\007',
+    'c', 'h', 'a', 'n', 'n', 'e', 'l', '\030', '\001', ' ', '\001', '(',
+    '\013', '2', '\031', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a',
+    'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'C', 'h', 'a',
+    'n', 'n', 'e', 'l', 'R', '\007', 'c', 'h', 'a', 'n', 'n', 'e',
+    'l', '\"', ';', '\n', '\024', 'G', 'e', 't', 'S', 'u', 'b', 'c',
+    'h', 'a', 'n', 'n', 'e', 'l', 'R', 'e', 'q', 'u', 'e', 's',
+    't', '\022', '#', '\n', '\r', 's', 'u', 'b', 'c', 'h', 'a', 'n',
+    'n', 'e', 'l', '_', 'i', 'd', '\030', '\001', ' ', '\001', '(', '\003',
+    'R', '\014', 's', 'u', 'b', 'c', 'h', 'a', 'n', 'n', 'e', 'l',
+    'I', 'd', '\"', 'U', '\n', '\025', 'G', 'e', 't', 'S', 'u', 'b',
+    'c', 'h', 'a', 'n', 'n', 'e', 'l', 'R', 'e', 's', 'p', 'o',
+    'n', 's', 'e', '\022', '<', '\n', '\n', 's', 'u', 'b', 'c', 'h',
+    'a', 'n', 'n', 'e', 'l', '\030', '\001', ' ', '\001', '(', '\013', '2',
+    '\034', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n',
+    'e', 'l', 'z', '.', 'v', '1', '.', 'S', 'u', 'b', 'c', 'h',
+    'a', 'n', 'n', 'e', 'l', 'R', '\n', 's', 'u', 'b', 'c', 'h',
+    'a', 'n', 'n', 'e', 'l', '\"', 'I', '\n', '\020', 'G', 'e', 't',
+    'S', 'o', 'c', 'k', 'e', 't', 'R', 'e', 'q', 'u', 'e', 's',
+    't', '\022', '\033', '\n', '\t', 's', 'o', 'c', 'k', 'e', 't', '_',
+    'i', 'd', '\030', '\001', ' ', '\001', '(', '\003', 'R', '\010', 's', 'o',
+    'c', 'k', 'e', 't', 'I', 'd', '\022', '\030', '\n', '\007', 's', 'u',
+    'm', 'm', 'a', 'r', 'y', '\030', '\002', ' ', '\001', '(', '\010', 'R',
+    '\007', 's', 'u', 'm', 'm', 'a', 'r', 'y', '\"', 'E', '\n', '\021',
+    'G', 'e', 't', 'S', 'o', 'c', 'k', 'e', 't', 'R', 'e', 's',
+    'p', 'o', 'n', 's', 'e', '\022', '0', '\n', '\006', 's', 'o', 'c',
+    'k', 'e', 't', '\030', '\001', ' ', '\001', '(', '\013', '2', '\030', '.',
+    'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l',
+    'z', '.', 'v', '1', '.', 'S', 'o', 'c', 'k', 'e', 't', 'R',
+    '\006', 's', 'o', 'c', 'k', 'e', 't', '2', '\232', '\005', '\n', '\010',
+    'C', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '\022', 'c', '\n', '\016',
+    'G', 'e', 't', 'T', 'o', 'p', 'C', 'h', 'a', 'n', 'n', 'e',
+    'l', 's', '\022', '\'', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h',
+    'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'G', 'e',
+    't', 'T', 'o', 'p', 'C', 'h', 'a', 'n', 'n', 'e', 'l', 's',
+    'R', 'e', 'q', 'u', 'e', 's', 't', '\032', '(', '.', 'g', 'r',
+    'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.',
+    'v', '1', '.', 'G', 'e', 't', 'T', 'o', 'p', 'C', 'h', 'a',
+    'n', 'n', 'e', 'l', 's', 'R', 'e', 's', 'p', 'o', 'n', 's',
+    'e', '\022', 'W', '\n', '\n', 'G', 'e', 't', 'S', 'e', 'r', 'v',
+    'e', 'r', 's', '\022', '#', '.', 'g', 'r', 'p', 'c', '.', 'c',
+    'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'G',
+    'e', 't', 'S', 'e', 'r', 'v', 'e', 'r', 's', 'R', 'e', 'q',
+    'u', 'e', 's', 't', '\032', '$', '.', 'g', 'r', 'p', 'c', '.',
+    'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.',
+    'G', 'e', 't', 'S', 'e', 'r', 'v', 'e', 'r', 's', 'R', 'e',
+    's', 'p', 'o', 'n', 's', 'e', '\022', 'T', '\n', '\t', 'G', 'e',
+    't', 'S', 'e', 'r', 'v', 'e', 'r', '\022', '\"', '.', 'g', 'r',
+    'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.',
+    'v', '1', '.', 'G', 'e', 't', 'S', 'e', 'r', 'v', 'e', 'r',
+    'R', 'e', 'q', 'u', 'e', 's', 't', '\032', '#', '.', 'g', 'r',
+    'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.',
+    'v', '1', '.', 'G', 'e', 't', 'S', 'e', 'r', 'v', 'e', 'r',
+    'R', 'e', 's', 'p', 'o', 'n', 's', 'e', '\022', 'i', '\n', '\020',
+    'G', 'e', 't', 'S', 'e', 'r', 'v', 'e', 'r', 'S', 'o', 'c',
+    'k', 'e', 't', 's', '\022', ')', '.', 'g', 'r', 'p', 'c', '.',
+    'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.',
+    'G', 'e', 't', 'S', 'e', 'r', 'v', 'e', 'r', 'S', 'o', 'c',
+    'k', 'e', 't', 's', 'R', 'e', 'q', 'u', 'e', 's', 't', '\032',
+    '*', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n',
+    'e', 'l', 'z', '.', 'v', '1', '.', 'G', 'e', 't', 'S', 'e',
+    'r', 'v', 'e', 'r', 'S', 'o', 'c', 'k', 'e', 't', 's', 'R',
+    'e', 's', 'p', 'o', 'n', 's', 'e', '\022', 'W', '\n', '\n', 'G',
+    'e', 't', 'C', 'h', 'a', 'n', 'n', 'e', 'l', '\022', '#', '.',
+    'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l',
+    'z', '.', 'v', '1', '.', 'G', 'e', 't', 'C', 'h', 'a', 'n',
+    'n', 'e', 'l', 'R', 'e', 'q', 'u', 'e', 's', 't', '\032', '$',
+    '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e',
+    'l', 'z', '.', 'v', '1', '.', 'G', 'e', 't', 'C', 'h', 'a',
+    'n', 'n', 'e', 'l', 'R', 'e', 's', 'p', 'o', 'n', 's', 'e',
+    '\022', '`', '\n', '\r', 'G', 'e', 't', 'S', 'u', 'b', 'c', 'h',
+    'a', 'n', 'n', 'e', 'l', '\022', '&', '.', 'g', 'r', 'p', 'c',
+    '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1',
+    '.', 'G', 'e', 't', 'S', 'u', 'b', 'c', 'h', 'a', 'n', 'n',
+    'e', 'l', 'R', 'e', 'q', 'u', 'e', 's', 't', '\032', '\'', '.',
+    'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l',
+    'z', '.', 'v', '1', '.', 'G', 'e', 't', 'S', 'u', 'b', 'c',
+    'h', 'a', 'n', 'n', 'e', 'l', 'R', 'e', 's', 'p', 'o', 'n',
+    's', 'e', '\022', 'T', '\n', '\t', 'G', 'e', 't', 'S', 'o', 'c',
+    'k', 'e', 't', '\022', '\"', '.', 'g', 'r', 'p', 'c', '.', 'c',
+    'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'G',
+    'e', 't', 'S', 'o', 'c', 'k', 'e', 't', 'R', 'e', 'q', 'u',
+    'e', 's', 't', '\032', '#', '.', 'g', 'r', 'p', 'c', '.', 'c',
+    'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '1', '.', 'G',
+    'e', 't', 'S', 'o', 'c', 'k', 'e', 't', 'R', 'e', 's', 'p',
+    'o', 'n', 's', 'e', 'B', 'X', '\n', '\023', 'i', 'o', '.', 'g',
+    'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z',
+    '.', 'v', '1', 'B', '\r', 'C', 'h', 'a', 'n', 'n', 'e', 'l',
+    'z', 'P', 'r', 'o', 't', 'o', 'P', '\001', 'Z', '0', 'g', 'o',
+    'o', 'g', 'l', 'e', '.', 'g', 'o', 'l', 'a', 'n', 'g', '.',
+    'o', 'r', 'g', '/', 'g', 'r', 'p', 'c', '/', 'c', 'h', 'a',
+    'n', 'n', 'e', 'l', 'z', '/', 'g', 'r', 'p', 'c', '_', 'c',
+    'h', 'a', 'n', 'n', 'e', 'l', 'z', '_', 'v', '1', 'b', '\006',
+    'p', 'r', 'o', 't', 'o', '3',
+};
+
+static _upb_DefPool_Init *deps[5] = {
+    &google_protobuf_any_proto_upbdefinit,
+    &google_protobuf_duration_proto_upbdefinit,
+    &google_protobuf_timestamp_proto_upbdefinit,
+    &google_protobuf_wrappers_proto_upbdefinit,
+    NULL,
+};
+
+_upb_DefPool_Init src_proto_grpc_channelz_channelz_proto_upbdefinit = {
+    deps,
+    &src_proto_grpc_channelz_channelz_proto_upb_file_layout,
+    "src/proto/grpc/channelz/channelz.proto",
+    UPB_STRINGVIEW_INIT(descriptor, sizeof(descriptor)),
+};
diff --git a/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/channelz.upbdefs.h b/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/channelz.upbdefs.h
new file mode 100644
index 00000000000..8e699f5149b
--- /dev/null
+++ b/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/channelz.upbdefs.h
@@ -0,0 +1,227 @@
+/* This file was generated by upb_generator from the input file:
+ *
+ *     src/proto/grpc/channelz/channelz.proto
+ *
+ * Do not edit -- your changes will be discarded when the file is
+ * regenerated.
+ * NO CHECKED-IN PROTOBUF GENCODE */
+
+
+
+#ifndef SRC_PROTO_GRPC_CHANNELZ_CHANNELZ_PROTO_UPB_H__UPBDEFS_H_
+#define SRC_PROTO_GRPC_CHANNELZ_CHANNELZ_PROTO_UPB_H__UPBDEFS_H_
+
+#include "upb/reflection/def.h"
+#include "upb/reflection/internal/def_pool.h"
+
+#include "upb/port/def.inc"
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+extern _upb_DefPool_Init src_proto_grpc_channelz_channelz_proto_upbdefinit;
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_Channel_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.Channel");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_Subchannel_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.Subchannel");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_ChannelConnectivityState_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.ChannelConnectivityState");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_ChannelData_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.ChannelData");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_ChannelTraceEvent_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.ChannelTraceEvent");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_ChannelTrace_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.ChannelTrace");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_ChannelRef_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.ChannelRef");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_SubchannelRef_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.SubchannelRef");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_SocketRef_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.SocketRef");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_ServerRef_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.ServerRef");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_Server_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.Server");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_ServerData_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.ServerData");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_Socket_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.Socket");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_SocketData_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.SocketData");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_Address_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.Address");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_Address_TcpIpAddress_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.Address.TcpIpAddress");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_Address_UdsAddress_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.Address.UdsAddress");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_Address_OtherAddress_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.Address.OtherAddress");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_Security_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.Security");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_Security_Tls_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.Security.Tls");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_Security_OtherSecurity_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.Security.OtherSecurity");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_SocketOption_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.SocketOption");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_SocketOptionTimeout_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.SocketOptionTimeout");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_SocketOptionLinger_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.SocketOptionLinger");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_SocketOptionTcpInfo_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.SocketOptionTcpInfo");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetTopChannelsRequest_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetTopChannelsRequest");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetTopChannelsResponse_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetTopChannelsResponse");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetServersRequest_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetServersRequest");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetServersResponse_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetServersResponse");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetServerRequest_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetServerRequest");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetServerResponse_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetServerResponse");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetServerSocketsRequest_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetServerSocketsRequest");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetServerSocketsResponse_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetServerSocketsResponse");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetChannelRequest_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetChannelRequest");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetChannelResponse_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetChannelResponse");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetSubchannelRequest_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetSubchannelRequest");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetSubchannelResponse_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetSubchannelResponse");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetSocketRequest_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetSocketRequest");
+}
+
+UPB_INLINE const upb_MessageDef *grpc_channelz_v1_GetSocketResponse_getmsgdef(upb_DefPool *s) {
+  _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_channelz_proto_upbdefinit);
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v1.GetSocketResponse");
+}
+
+
+#ifdef __cplusplus
+}  /* extern "C" */
+#endif
+
+#include "upb/port/undef.inc"
+
+#endif  /* SRC_PROTO_GRPC_CHANNELZ_CHANNELZ_PROTO_UPB_H__UPBDEFS_H_ */
diff --git a/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/v2/property_list.upbdefs.c b/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/v2/property_list.upbdefs.c
index 92163fb2d70..063268ca349 100644
--- a/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/v2/property_list.upbdefs.c
+++ b/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/v2/property_list.upbdefs.c
@@ -12,11 +12,11 @@
 #include "src/proto/grpc/channelz/v2/property_list.upb_minitable.h"
 
 extern _upb_DefPool_Init google_protobuf_any_proto_upbdefinit;
+extern _upb_DefPool_Init google_protobuf_duration_proto_upbdefinit;
 extern _upb_DefPool_Init google_protobuf_empty_proto_upbdefinit;
 extern _upb_DefPool_Init google_protobuf_timestamp_proto_upbdefinit;
-extern _upb_DefPool_Init google_protobuf_duration_proto_upbdefinit;
 
-static const char descriptor[1190] = {
+static const char descriptor[1170] = {
     '\n', '.', 's', 'r', 'c', '/', 'p', 'r', 'o', 't', 'o', '/',
     'g', 'r', 'p', 'c', '/', 'c', 'h', 'a', 'n', 'n', 'e', 'l',
     'z', '/', 'v', '2', '/', 'p', 'r', 'o', 'p', 'e', 'r', 't',
@@ -24,106 +24,104 @@ static const char descriptor[1190] = {
     '\022', '\020', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n',
     'e', 'l', 'z', '.', 'v', '2', '\032', '\031', 'g', 'o', 'o', 'g',
     'l', 'e', '/', 'p', 'r', 'o', 't', 'o', 'b', 'u', 'f', '/',
-    'a', 'n', 'y', '.', 'p', 'r', 'o', 't', 'o', '\032', '\033', 'g',
+    'a', 'n', 'y', '.', 'p', 'r', 'o', 't', 'o', '\032', '\036', 'g',
     'o', 'o', 'g', 'l', 'e', '/', 'p', 'r', 'o', 't', 'o', 'b',
-    'u', 'f', '/', 'e', 'm', 'p', 't', 'y', '.', 'p', 'r', 'o',
-    't', 'o', '\032', '\037', 'g', 'o', 'o', 'g', 'l', 'e', '/', 'p',
-    'r', 'o', 't', 'o', 'b', 'u', 'f', '/', 't', 'i', 'm', 'e',
-    's', 't', 'a', 'm', 'p', '.', 'p', 'r', 'o', 't', 'o', '\032',
-    '\036', 'g', 'o', 'o', 'g', 'l', 'e', '/', 'p', 'r', 'o', 't',
-    'o', 'b', 'u', 'f', '/', 'd', 'u', 'r', 'a', 't', 'i', 'o',
-    'n', '.', 'p', 'r', 'o', 't', 'o', '\"', '\276', '\001', '\n', '\014',
+    'u', 'f', '/', 'd', 'u', 'r', 'a', 't', 'i', 'o', 'n', '.',
+    'p', 'r', 'o', 't', 'o', '\032', '\033', 'g', 'o', 'o', 'g', 'l',
+    'e', '/', 'p', 'r', 'o', 't', 'o', 'b', 'u', 'f', '/', 'e',
+    'm', 'p', 't', 'y', '.', 'p', 'r', 'o', 't', 'o', '\032', '\037',
+    'g', 'o', 'o', 'g', 'l', 'e', '/', 'p', 'r', 'o', 't', 'o',
+    'b', 'u', 'f', '/', 't', 'i', 'm', 'e', 's', 't', 'a', 'm',
+    'p', '.', 'p', 'r', 'o', 't', 'o', '\"', '\252', '\001', '\n', '\014',
     'P', 'r', 'o', 'p', 'e', 'r', 't', 'y', 'L', 'i', 's', 't',
-    '\022', 'N', '\n', '\n', 'p', 'r', 'o', 'p', 'e', 'r', 't', 'i',
-    'e', 's', '\030', '\001', ' ', '\003', '(', '\013', '2', '.', '.', 'g',
+    '\022', 'F', '\n', '\n', 'p', 'r', 'o', 'p', 'e', 'r', 't', 'i',
+    'e', 's', '\030', '\001', ' ', '\003', '(', '\013', '2', '&', '.', 'g',
+    'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z',
+    '.', 'v', '2', '.', 'P', 'r', 'o', 'p', 'e', 'r', 't', 'y',
+    'L', 'i', 's', 't', '.', 'E', 'l', 'e', 'm', 'e', 'n', 't',
+    'R', '\n', 'p', 'r', 'o', 'p', 'e', 'r', 't', 'i', 'e', 's',
+    '\032', 'R', '\n', '\007', 'E', 'l', 'e', 'm', 'e', 'n', 't', '\022',
+    '\020', '\n', '\003', 'k', 'e', 'y', '\030', '\001', ' ', '\001', '(', '\t',
+    'R', '\003', 'k', 'e', 'y', '\022', '5', '\n', '\005', 'v', 'a', 'l',
+    'u', 'e', '\030', '\002', ' ', '\001', '(', '\013', '2', '\037', '.', 'g',
     'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z',
     '.', 'v', '2', '.', 'P', 'r', 'o', 'p', 'e', 'r', 't', 'y',
-    'L', 'i', 's', 't', '.', 'P', 'r', 'o', 'p', 'e', 'r', 't',
-    'i', 'e', 's', 'E', 'n', 't', 'r', 'y', 'R', '\n', 'p', 'r',
-    'o', 'p', 'e', 'r', 't', 'i', 'e', 's', '\032', '^', '\n', '\017',
-    'P', 'r', 'o', 'p', 'e', 'r', 't', 'i', 'e', 's', 'E', 'n',
-    't', 'r', 'y', '\022', '\020', '\n', '\003', 'k', 'e', 'y', '\030', '\001',
-    ' ', '\001', '(', '\t', 'R', '\003', 'k', 'e', 'y', '\022', '5', '\n',
-    '\005', 'v', 'a', 'l', 'u', 'e', '\030', '\002', ' ', '\001', '(', '\013',
-    '2', '\037', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n',
-    'n', 'e', 'l', 'z', '.', 'v', '2', '.', 'P', 'r', 'o', 'p',
-    'e', 'r', 't', 'y', 'V', 'a', 'l', 'u', 'e', 'R', '\005', 'v',
-    'a', 'l', 'u', 'e', ':', '\002', '8', '\001', '\"', '\264', '\001', '\n',
-    '\014', 'P', 'r', 'o', 'p', 'e', 'r', 't', 'y', 'G', 'r', 'i',
-    'd', '\022', '\030', '\n', '\007', 'c', 'o', 'l', 'u', 'm', 'n', 's',
-    '\030', '\001', ' ', '\003', '(', '\t', 'R', '\007', 'c', 'o', 'l', 'u',
-    'm', 'n', 's', '\022', '6', '\n', '\004', 'r', 'o', 'w', 's', '\030',
-    '\002', ' ', '\003', '(', '\013', '2', '\"', '.', 'g', 'r', 'p', 'c',
-    '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '2',
-    '.', 'P', 'r', 'o', 'p', 'e', 'r', 't', 'y', 'G', 'r', 'i',
-    'd', '.', 'R', 'o', 'w', 'R', '\004', 'r', 'o', 'w', 's', '\032',
-    'R', '\n', '\003', 'R', 'o', 'w', '\022', '\024', '\n', '\005', 'l', 'a',
-    'b', 'e', 'l', '\030', '\001', ' ', '\001', '(', '\t', 'R', '\005', 'l',
-    'a', 'b', 'e', 'l', '\022', '5', '\n', '\005', 'v', 'a', 'l', 'u',
-    'e', '\030', '\002', ' ', '\003', '(', '\013', '2', '\037', '.', 'g', 'r',
-    'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.',
-    'v', '2', '.', 'P', 'r', 'o', 'p', 'e', 'r', 't', 'y', 'V',
-    'a', 'l', 'u', 'e', 'R', '\005', 'v', 'a', 'l', 'u', 'e', '\"',
-    '\240', '\001', '\n', '\r', 'P', 'r', 'o', 'p', 'e', 'r', 't', 'y',
-    'T', 'a', 'b', 'l', 'e', '\022', '\030', '\n', '\007', 'c', 'o', 'l',
+    'V', 'a', 'l', 'u', 'e', 'R', '\005', 'v', 'a', 'l', 'u', 'e',
+    '\"', '\264', '\001', '\n', '\014', 'P', 'r', 'o', 'p', 'e', 'r', 't',
+    'y', 'G', 'r', 'i', 'd', '\022', '\030', '\n', '\007', 'c', 'o', 'l',
     'u', 'm', 'n', 's', '\030', '\001', ' ', '\003', '(', '\t', 'R', '\007',
-    'c', 'o', 'l', 'u', 'm', 'n', 's', '\022', '7', '\n', '\004', 'r',
-    'o', 'w', 's', '\030', '\002', ' ', '\003', '(', '\013', '2', '#', '.',
+    'c', 'o', 'l', 'u', 'm', 'n', 's', '\022', '6', '\n', '\004', 'r',
+    'o', 'w', 's', '\030', '\002', ' ', '\003', '(', '\013', '2', '\"', '.',
     'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l',
     'z', '.', 'v', '2', '.', 'P', 'r', 'o', 'p', 'e', 'r', 't',
-    'y', 'T', 'a', 'b', 'l', 'e', '.', 'R', 'o', 'w', 'R', '\004',
-    'r', 'o', 'w', 's', '\032', '<', '\n', '\003', 'R', 'o', 'w', '\022',
-    '5', '\n', '\005', 'v', 'a', 'l', 'u', 'e', '\030', '\001', ' ', '\003',
-    '(', '\013', '2', '\037', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h',
-    'a', 'n', 'n', 'e', 'l', 'z', '.', 'v', '2', '.', 'P', 'r',
-    'o', 'p', 'e', 'r', 't', 'y', 'V', 'a', 'l', 'u', 'e', 'R',
-    '\005', 'v', 'a', 'l', 'u', 'e', '\"', '\305', '\003', '\n', '\r', 'P',
-    'r', 'o', 'p', 'e', 'r', 't', 'y', 'V', 'a', 'l', 'u', 'e',
-    '\022', '9', '\n', '\013', 'e', 'm', 'p', 't', 'y', '_', 'v', 'a',
-    'l', 'u', 'e', '\030', '\001', ' ', '\001', '(', '\013', '2', '\026', '.',
-    'g', 'o', 'o', 'g', 'l', 'e', '.', 'p', 'r', 'o', 't', 'o',
-    'b', 'u', 'f', '.', 'E', 'm', 'p', 't', 'y', 'H', '\000', 'R',
-    '\n', 'e', 'm', 'p', 't', 'y', 'V', 'a', 'l', 'u', 'e', '\022',
-    '3', '\n', '\t', 'a', 'n', 'y', '_', 'v', 'a', 'l', 'u', 'e',
-    '\030', '\002', ' ', '\001', '(', '\013', '2', '\024', '.', 'g', 'o', 'o',
+    'y', 'G', 'r', 'i', 'd', '.', 'R', 'o', 'w', 'R', '\004', 'r',
+    'o', 'w', 's', '\032', 'R', '\n', '\003', 'R', 'o', 'w', '\022', '\024',
+    '\n', '\005', 'l', 'a', 'b', 'e', 'l', '\030', '\001', ' ', '\001', '(',
+    '\t', 'R', '\005', 'l', 'a', 'b', 'e', 'l', '\022', '5', '\n', '\005',
+    'v', 'a', 'l', 'u', 'e', '\030', '\002', ' ', '\003', '(', '\013', '2',
+    '\037', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a', 'n', 'n',
+    'e', 'l', 'z', '.', 'v', '2', '.', 'P', 'r', 'o', 'p', 'e',
+    'r', 't', 'y', 'V', 'a', 'l', 'u', 'e', 'R', '\005', 'v', 'a',
+    'l', 'u', 'e', '\"', '\240', '\001', '\n', '\r', 'P', 'r', 'o', 'p',
+    'e', 'r', 't', 'y', 'T', 'a', 'b', 'l', 'e', '\022', '\030', '\n',
+    '\007', 'c', 'o', 'l', 'u', 'm', 'n', 's', '\030', '\001', ' ', '\003',
+    '(', '\t', 'R', '\007', 'c', 'o', 'l', 'u', 'm', 'n', 's', '\022',
+    '7', '\n', '\004', 'r', 'o', 'w', 's', '\030', '\002', ' ', '\003', '(',
+    '\013', '2', '#', '.', 'g', 'r', 'p', 'c', '.', 'c', 'h', 'a',
+    'n', 'n', 'e', 'l', 'z', '.', 'v', '2', '.', 'P', 'r', 'o',
+    'p', 'e', 'r', 't', 'y', 'T', 'a', 'b', 'l', 'e', '.', 'R',
+    'o', 'w', 'R', '\004', 'r', 'o', 'w', 's', '\032', '<', '\n', '\003',
+    'R', 'o', 'w', '\022', '5', '\n', '\005', 'v', 'a', 'l', 'u', 'e',
+    '\030', '\001', ' ', '\003', '(', '\013', '2', '\037', '.', 'g', 'r', 'p',
+    'c', '.', 'c', 'h', 'a', 'n', 'n', 'e', 'l', 'z', '.', 'v',
+    '2', '.', 'P', 'r', 'o', 'p', 'e', 'r', 't', 'y', 'V', 'a',
+    'l', 'u', 'e', 'R', '\005', 'v', 'a', 'l', 'u', 'e', '\"', '\305',
+    '\003', '\n', '\r', 'P', 'r', 'o', 'p', 'e', 'r', 't', 'y', 'V',
+    'a', 'l', 'u', 'e', '\022', '9', '\n', '\013', 'e', 'm', 'p', 't',
+    'y', '_', 'v', 'a', 'l', 'u', 'e', '\030', '\001', ' ', '\001', '(',
+    '\013', '2', '\026', '.', 'g', 'o', 'o', 'g', 'l', 'e', '.', 'p',
+    'r', 'o', 't', 'o', 'b', 'u', 'f', '.', 'E', 'm', 'p', 't',
+    'y', 'H', '\000', 'R', '\n', 'e', 'm', 'p', 't', 'y', 'V', 'a',
+    'l', 'u', 'e', '\022', '3', '\n', '\t', 'a', 'n', 'y', '_', 'v',
+    'a', 'l', 'u', 'e', '\030', '\002', ' ', '\001', '(', '\013', '2', '\024',
+    '.', 'g', 'o', 'o', 'g', 'l', 'e', '.', 'p', 'r', 'o', 't',
+    'o', 'b', 'u', 'f', '.', 'A', 'n', 'y', 'H', '\000', 'R', '\010',
+    'a', 'n', 'y', 'V', 'a', 'l', 'u', 'e', '\022', '#', '\n', '\014',
+    's', 't', 'r', 'i', 'n', 'g', '_', 'v', 'a', 'l', 'u', 'e',
+    '\030', '\003', ' ', '\001', '(', '\t', 'H', '\000', 'R', '\013', 's', 't',
+    'r', 'i', 'n', 'g', 'V', 'a', 'l', 'u', 'e', '\022', '!', '\n',
+    '\013', 'i', 'n', 't', '6', '4', '_', 'v', 'a', 'l', 'u', 'e',
+    '\030', '\004', ' ', '\001', '(', '\003', 'H', '\000', 'R', '\n', 'i', 'n',
+    't', '6', '4', 'V', 'a', 'l', 'u', 'e', '\022', '#', '\n', '\014',
+    'u', 'i', 'n', 't', '6', '4', '_', 'v', 'a', 'l', 'u', 'e',
+    '\030', '\005', ' ', '\001', '(', '\004', 'H', '\000', 'R', '\013', 'u', 'i',
+    'n', 't', '6', '4', 'V', 'a', 'l', 'u', 'e', '\022', '#', '\n',
+    '\014', 'd', 'o', 'u', 'b', 'l', 'e', '_', 'v', 'a', 'l', 'u',
+    'e', '\030', '\006', ' ', '\001', '(', '\001', 'H', '\000', 'R', '\013', 'd',
+    'o', 'u', 'b', 'l', 'e', 'V', 'a', 'l', 'u', 'e', '\022', '\037',
+    '\n', '\n', 'b', 'o', 'o', 'l', '_', 'v', 'a', 'l', 'u', 'e',
+    '\030', '\007', ' ', '\001', '(', '\010', 'H', '\000', 'R', '\t', 'b', 'o',
+    'o', 'l', 'V', 'a', 'l', 'u', 'e', '\022', 'E', '\n', '\017', 't',
+    'i', 'm', 'e', 's', 't', 'a', 'm', 'p', '_', 'v', 'a', 'l',
+    'u', 'e', '\030', '\010', ' ', '\001', '(', '\013', '2', '\032', '.', 'g',
+    'o', 'o', 'g', 'l', 'e', '.', 'p', 'r', 'o', 't', 'o', 'b',
+    'u', 'f', '.', 'T', 'i', 'm', 'e', 's', 't', 'a', 'm', 'p',
+    'H', '\000', 'R', '\016', 't', 'i', 'm', 'e', 's', 't', 'a', 'm',
+    'p', 'V', 'a', 'l', 'u', 'e', '\022', 'B', '\n', '\016', 'd', 'u',
+    'r', 'a', 't', 'i', 'o', 'n', '_', 'v', 'a', 'l', 'u', 'e',
+    '\030', '\t', ' ', '\001', '(', '\013', '2', '\031', '.', 'g', 'o', 'o',
     'g', 'l', 'e', '.', 'p', 'r', 'o', 't', 'o', 'b', 'u', 'f',
-    '.', 'A', 'n', 'y', 'H', '\000', 'R', '\010', 'a', 'n', 'y', 'V',
-    'a', 'l', 'u', 'e', '\022', '#', '\n', '\014', 's', 't', 'r', 'i',
-    'n', 'g', '_', 'v', 'a', 'l', 'u', 'e', '\030', '\003', ' ', '\001',
-    '(', '\t', 'H', '\000', 'R', '\013', 's', 't', 'r', 'i', 'n', 'g',
-    'V', 'a', 'l', 'u', 'e', '\022', '!', '\n', '\013', 'i', 'n', 't',
-    '6', '4', '_', 'v', 'a', 'l', 'u', 'e', '\030', '\004', ' ', '\001',
-    '(', '\003', 'H', '\000', 'R', '\n', 'i', 'n', 't', '6', '4', 'V',
-    'a', 'l', 'u', 'e', '\022', '#', '\n', '\014', 'u', 'i', 'n', 't',
-    '6', '4', '_', 'v', 'a', 'l', 'u', 'e', '\030', '\005', ' ', '\001',
-    '(', '\004', 'H', '\000', 'R', '\013', 'u', 'i', 'n', 't', '6', '4',
-    'V', 'a', 'l', 'u', 'e', '\022', '#', '\n', '\014', 'd', 'o', 'u',
-    'b', 'l', 'e', '_', 'v', 'a', 'l', 'u', 'e', '\030', '\006', ' ',
-    '\001', '(', '\001', 'H', '\000', 'R', '\013', 'd', 'o', 'u', 'b', 'l',
-    'e', 'V', 'a', 'l', 'u', 'e', '\022', '\037', '\n', '\n', 'b', 'o',
-    'o', 'l', '_', 'v', 'a', 'l', 'u', 'e', '\030', '\007', ' ', '\001',
-    '(', '\010', 'H', '\000', 'R', '\t', 'b', 'o', 'o', 'l', 'V', 'a',
-    'l', 'u', 'e', '\022', 'E', '\n', '\017', 't', 'i', 'm', 'e', 's',
-    't', 'a', 'm', 'p', '_', 'v', 'a', 'l', 'u', 'e', '\030', '\010',
-    ' ', '\001', '(', '\013', '2', '\032', '.', 'g', 'o', 'o', 'g', 'l',
-    'e', '.', 'p', 'r', 'o', 't', 'o', 'b', 'u', 'f', '.', 'T',
-    'i', 'm', 'e', 's', 't', 'a', 'm', 'p', 'H', '\000', 'R', '\016',
-    't', 'i', 'm', 'e', 's', 't', 'a', 'm', 'p', 'V', 'a', 'l',
-    'u', 'e', '\022', 'B', '\n', '\016', 'd', 'u', 'r', 'a', 't', 'i',
-    'o', 'n', '_', 'v', 'a', 'l', 'u', 'e', '\030', '\t', ' ', '\001',
-    '(', '\013', '2', '\031', '.', 'g', 'o', 'o', 'g', 'l', 'e', '.',
-    'p', 'r', 'o', 't', 'o', 'b', 'u', 'f', '.', 'D', 'u', 'r',
-    'a', 't', 'i', 'o', 'n', 'H', '\000', 'R', '\r', 'd', 'u', 'r',
-    'a', 't', 'i', 'o', 'n', 'V', 'a', 'l', 'u', 'e', 'B', '\006',
-    '\n', '\004', 'k', 'i', 'n', 'd', 'b', '\006', 'p', 'r', 'o', 't',
-    'o', '3',
+    '.', 'D', 'u', 'r', 'a', 't', 'i', 'o', 'n', 'H', '\000', 'R',
+    '\r', 'd', 'u', 'r', 'a', 't', 'i', 'o', 'n', 'V', 'a', 'l',
+    'u', 'e', 'B', '\006', '\n', '\004', 'k', 'i', 'n', 'd', 'b', '\006',
+    'p', 'r', 'o', 't', 'o', '3',
 };
 
 static _upb_DefPool_Init *deps[5] = {
     &google_protobuf_any_proto_upbdefinit,
+    &google_protobuf_duration_proto_upbdefinit,
     &google_protobuf_empty_proto_upbdefinit,
     &google_protobuf_timestamp_proto_upbdefinit,
-    &google_protobuf_duration_proto_upbdefinit,
     NULL,
 };
 
diff --git a/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/v2/property_list.upbdefs.h b/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/v2/property_list.upbdefs.h
index c92206cafef..201ab0d43b9 100644
--- a/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/v2/property_list.upbdefs.h
+++ b/deps/grpc/src/core/ext/upbdefs-gen/src/proto/grpc/channelz/v2/property_list.upbdefs.h
@@ -27,9 +27,9 @@ UPB_INLINE const upb_MessageDef *grpc_channelz_v2_PropertyList_getmsgdef(upb_Def
   return upb_DefPool_FindMessageByName(s, "grpc.channelz.v2.PropertyList");
 }
 
-UPB_INLINE const upb_MessageDef *grpc_channelz_v2_PropertyList_PropertiesEntry_getmsgdef(upb_DefPool *s) {
+UPB_INLINE const upb_MessageDef *grpc_channelz_v2_PropertyList_Element_getmsgdef(upb_DefPool *s) {
   _upb_DefPool_LoadDefInit(s, &src_proto_grpc_channelz_v2_property_list_proto_upbdefinit);
-  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v2.PropertyList.PropertiesEntry");
+  return upb_DefPool_FindMessageByName(s, "grpc.channelz.v2.PropertyList.Element");
 }
 
 UPB_INLINE const upb_MessageDef *grpc_channelz_v2_PropertyGrid_getmsgdef(upb_DefPool *s) {
diff --git a/deps/grpc/src/core/filter/GEMINI.md b/deps/grpc/src/core/filter/GEMINI.md
new file mode 100644
index 00000000000..acd80bc94b9
--- /dev/null
+++ b/deps/grpc/src/core/filter/GEMINI.md
@@ -0,0 +1,29 @@
+# gRPC Core Filter
+
+This directory contains the fundamental building blocks for the gRPC channel filter mechanism.
+
+See also: [gRPC Core overview](../GEMINI.md)
+
+## Overarching Purpose
+
+The code in this directory provides the infrastructure for creating, composing, and managing channel filters. It defines the interfaces that filters must implement and provides the machinery for invoking them in the correct order. Filters are used to intercept and modify RPCs as they flow through the client and server channel stacks.
+
+## Core Concepts
+
+*   **`Blackboard`**: A `Blackboard` is a key-value store that allows filters to share state with each other. This is useful for filters that need to coordinate their behavior, but it should be used with care to avoid creating tight coupling between filters.
+*   **`FilterArgs`**: The `FilterArgs` class provides arguments to filters that are independent of channel args. This includes things like the filter's instance ID and access to the blackboard.
+*   **Fused Filters**: Fused filters are an optimization that allows multiple filters to be combined into a single filter. This can reduce the overhead of the filter chain, and it is particularly useful for filters that are very simple and have low overhead. This is an experimental feature.
+
+## Files
+
+*   **`blackboard.h`, `blackboard.cc`**: These files define the `Blackboard` class.
+*   **`filter_args.h`**: Defines the `FilterArgs` class.
+*   **`fused_filters.cc`**: Contains an optimization to fuse multiple filters together to reduce overhead.
+*   **`auth/`**: This subdirectory contains authentication-related filters.
+
+## Notes
+
+*   The filter mechanism is a powerful tool for extending gRPC's functionality. It's used to implement features like authentication, retry, and compression.
+*   Filters are arranged in a stack, and each filter can pass the RPC on to the next filter in the stack, or it can terminate the RPC.
+*   Filters are used in both client and server channel stacks. See `../client_channel/GEMINI.md` and `../server/GEMINI.md` for more details about how filters are used in those stacks.
+*   Filters are registered with the `CoreConfiguration`. See `../config/GEMINI.md` for more details about how the `CoreConfiguration` works.
diff --git a/deps/grpc/src/core/filter/auth/auth_filters.h b/deps/grpc/src/core/filter/auth/auth_filters.h
index ef089b53de2..d97bbd4c69d 100644
--- a/deps/grpc/src/core/filter/auth/auth_filters.h
+++ b/deps/grpc/src/core/filter/auth/auth_filters.h
@@ -173,12 +173,12 @@ class ServerAuthFilter final : public ImplementChannelFilter<ServerAuthFilter> {
    public:
     explicit Call(ServerAuthFilter* filter);
     auto OnClientInitialMetadata(ClientMetadata& md, ServerAuthFilter* filter) {
-      return If(
+      return AssertResultType<absl::Status>(If(
           filter->server_credentials_ == nullptr ||
               filter->server_credentials_->auth_metadata_processor().process ==
                   nullptr,
           ImmediateOkStatus(),
-          [filter, md = &md]() { return RunApplicationCode(filter, *md); });
+          [filter, md = &md]() { return RunApplicationCode(filter, *md); }));
     }
     static inline const NoInterceptor OnServerInitialMetadata;
     static inline const NoInterceptor OnClientToServerMessage;
diff --git a/deps/grpc/src/core/filter/fused_filters.cc b/deps/grpc/src/core/filter/fused_filters.cc
new file mode 100644
index 00000000000..e0d2a7a6a93
--- /dev/null
+++ b/deps/grpc/src/core/filter/fused_filters.cc
@@ -0,0 +1,154 @@
+//
+//
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/grpc.h>
+#include <grpc/support/port_platform.h>
+
+#include "src/core/config/core_configuration.h"
+
+#ifndef GRPC_NO_FILTER_FUSION
+
+#include "src/core/call/filter_fusion.h"
+#include "src/core/ext/filters/http/client/http_client_filter.h"
+#include "src/core/ext/filters/http/client_authority_filter.h"
+#include "src/core/ext/filters/http/message_compress/compression_filter.h"
+#include "src/core/ext/filters/http/server/http_server_filter.h"
+#include "src/core/ext/filters/message_size/message_size_filter.h"
+#include "src/core/filter/auth/auth_filters.h"
+#include "src/core/lib/experiments/experiments.h"
+#include "src/core/lib/security/authorization/grpc_server_authz_filter.h"
+#include "src/core/load_balancing/grpclb/client_load_reporting_filter.h"
+#include "src/core/server/server_call_tracer_filter.h"
+#include "src/core/service_config/service_config_channel_arg_filter.h"
+
+namespace grpc_core {
+
+using FusedClientSubchannelMinimalHttp2StackFilter = FusedFilter<
+    FilterEndpoint::kClient,
+    kFilterExaminesServerInitialMetadata | kFilterExaminesInboundMessages |
+        kFilterExaminesOutboundMessages,
+    ClientMessageSizeFilter, HttpClientFilter, ClientCompressionFilter>;
+
+using FusedClientSubchannelMinimalHttp2StackFilterExtended =
+    FusedFilter<FilterEndpoint::kClient,
+                kFilterExaminesServerInitialMetadata |
+                    kFilterExaminesInboundMessages |
+                    kFilterExaminesOutboundMessages,
+                ClientLoadReportingFilter, ClientMessageSizeFilter,
+                HttpClientFilter, ClientCompressionFilter>;
+
+using FusedClientSubchannelMinimalHttp2StackFilterExtendedV3 = FusedFilter<
+    FilterEndpoint::kClient,
+    kFilterExaminesServerInitialMetadata | kFilterExaminesInboundMessages |
+        kFilterExaminesOutboundMessages,
+    ClientAuthorityFilter, ClientAuthFilter, ClientLoadReportingFilter,
+    ClientMessageSizeFilter, HttpClientFilter, ClientCompressionFilter>;
+
+using FusedClientDirectChannelMinimalHttp2StackFilter = FusedFilter<
+    FilterEndpoint::kClient,
+    kFilterExaminesServerInitialMetadata | kFilterExaminesInboundMessages |
+        kFilterExaminesOutboundMessages,
+    ClientMessageSizeFilter, HttpClientFilter, ClientCompressionFilter>;
+
+using FusedClientDirectChannelMinimalHttp2StackFilterExtended =
+    FusedFilter<FilterEndpoint::kClient,
+                kFilterExaminesServerInitialMetadata |
+                    kFilterExaminesInboundMessages |
+                    kFilterExaminesOutboundMessages,
+                ServiceConfigChannelArgFilter, ClientMessageSizeFilter,
+                HttpClientFilter, ClientCompressionFilter>;
+
+using FusedClientDirectChannelMinimalHttp2StackFilterExtendedV3 = FusedFilter<
+    FilterEndpoint::kClient,
+    kFilterExaminesServerInitialMetadata | kFilterExaminesInboundMessages |
+        kFilterExaminesOutboundMessages,
+    ClientAuthorityFilter, ClientAuthFilter, ServiceConfigChannelArgFilter,
+    ClientMessageSizeFilter, HttpClientFilter, ClientCompressionFilter>;
+
+using FusedServerChannelMinimalHttp2StackFilter =
+    FusedFilter<FilterEndpoint::kServer,
+                kFilterExaminesServerInitialMetadata |
+                    kFilterExaminesOutboundMessages |
+                    kFilterExaminesInboundMessages,
+                ServerMessageSizeFilter, HttpServerFilter,
+                ServerCompressionFilter, ServerCallTracerFilter>;
+
+using FusedMessageSizeHttpServerCompressionAuthFilter =
+    FusedFilter<FilterEndpoint::kServer,
+                kFilterExaminesServerInitialMetadata |
+                    kFilterExaminesOutboundMessages |
+                    kFilterExaminesInboundMessages,
+                ServerMessageSizeFilter, HttpServerFilter,
+                ServerCompressionFilter, ServerAuthFilter>;
+
+using FusedMessageSizeHttpServerCompressionAuthServerAuthzCallTracerFilter =
+    FusedFilter<
+        FilterEndpoint::kServer,
+        kFilterExaminesServerInitialMetadata | kFilterExaminesOutboundMessages |
+            kFilterExaminesInboundMessages,
+        ServerMessageSizeFilter, HttpServerFilter, ServerCompressionFilter,
+        ServerAuthFilter, GrpcServerAuthzFilter, ServerCallTracerFilter>;
+
+void RegisterFusedFilters(CoreConfiguration::Builder* builder) {
+  if (!IsFuseFiltersEnabled()) {
+    return;
+  }
+  builder->channel_init()->RegisterFusedFilter(
+      GRPC_CLIENT_SUBCHANNEL,
+      &FusedClientSubchannelMinimalHttp2StackFilterExtendedV3::kFilter);
+  builder->channel_init()->RegisterFusedFilter(
+      GRPC_CLIENT_DIRECT_CHANNEL,
+      &FusedClientDirectChannelMinimalHttp2StackFilterExtendedV3::kFilter);
+
+  // CLIENT_SUBCHANNEL
+  builder->channel_init()->RegisterFusedFilter(
+      GRPC_CLIENT_SUBCHANNEL,
+      &FusedClientSubchannelMinimalHttp2StackFilter::kFilter);
+  builder->channel_init()->RegisterFusedFilter(
+      GRPC_CLIENT_SUBCHANNEL,
+      &FusedClientSubchannelMinimalHttp2StackFilterExtended::kFilter);
+
+  // CLIENT_DIRECT_CHANNEL
+  builder->channel_init()->RegisterFusedFilter(
+      GRPC_CLIENT_DIRECT_CHANNEL,
+      &FusedClientDirectChannelMinimalHttp2StackFilter::kFilter);
+  builder->channel_init()->RegisterFusedFilter(
+      GRPC_CLIENT_DIRECT_CHANNEL,
+      &FusedClientDirectChannelMinimalHttp2StackFilterExtended::kFilter);
+
+  // SERVER_CHANNEL
+  builder->channel_init()->RegisterFusedFilter(
+      GRPC_SERVER_CHANNEL, &FusedServerChannelMinimalHttp2StackFilter::kFilter);
+  builder->channel_init()->RegisterFusedFilter(
+      GRPC_SERVER_CHANNEL,
+      &FusedMessageSizeHttpServerCompressionAuthFilter::kFilter);
+  builder->channel_init()->RegisterFusedFilter(
+      GRPC_SERVER_CHANNEL,
+      &FusedMessageSizeHttpServerCompressionAuthServerAuthzCallTracerFilter::
+          kFilter);
+}
+
+}  // namespace grpc_core
+
+#else  // GRPC_NO_FILTER_FUSION
+
+namespace grpc_core {
+void RegisterFusedFilters(CoreConfiguration::Builder* /*builder*/) {}
+}  // namespace grpc_core
+
+#endif
\ No newline at end of file
diff --git a/deps/grpc/src/core/handshaker/GEMINI.md b/deps/grpc/src/core/handshaker/GEMINI.md
new file mode 100644
index 00000000000..cd84d184d20
--- /dev/null
+++ b/deps/grpc/src/core/handshaker/GEMINI.md
@@ -0,0 +1,25 @@
+# gRPC Handshaker
+
+This directory contains the implementation of gRPC's handshaker framework, which is responsible for establishing a secure connection between a client and a server.
+
+## Overarching Purpose
+
+The handshaker framework provides a pluggable mechanism for performing various handshakes, such as TLS, ALTS, and HTTP CONNECT. It is designed to be extensible, allowing new handshaker implementations to be added easily.
+
+## Files and Subdirectories
+
+- **`handshaker.h` / `handshaker.cc`**: Defines the core `Handshaker` class, which represents a single handshaking operation.
+- **`handshaker_factory.h`**: Defines the `HandshakerFactory` class, which is responsible for creating `Handshaker` instances.
+- **`handshaker_registry.h` / `handshaker_registry.cc`**: Defines a registry for `HandshakerFactory` instances, allowing handshakers to be looked up by name.
+- **`proxy_mapper.h`**: Defines the `ProxyMapper` interface, which is used to determine the proxy settings for a given target address.
+- **`proxy_mapper_registry.h` / `proxy_mapper_registry.cc`**: Defines a registry for `ProxyMapper` instances.
+- **`endpoint_info/`**: Contains the `EndpointInfo` class, which is a data structure that contains information about the local and remote endpoints of a connection.
+- **`http_connect/`**: Contains the implementation of the HTTP CONNECT handshaker.
+- **`security/`**: Contains the implementation of the security handshakers, which are responsible for performing TLS and ALTS handshakes.
+- **`tcp_connect/`**: Contains a basic handshaker for TCP connections.
+
+## Notes
+
+- The handshaker framework is a critical component of gRPC's security infrastructure.
+- It is responsible for ensuring that all connections are properly authenticated and encrypted.
+- The framework is designed to be flexible and extensible, allowing it to be adapted to different security requirements.
diff --git a/deps/grpc/src/core/handshaker/endpoint_info/GEMINI.md b/deps/grpc/src/core/handshaker/endpoint_info/GEMINI.md
new file mode 100644
index 00000000000..34d93d59853
--- /dev/null
+++ b/deps/grpc/src/core/handshaker/endpoint_info/GEMINI.md
@@ -0,0 +1,19 @@
+# Endpoint Info
+
+This directory contains the `EndpointInfo` class, which is a data structure that contains information about the local and remote endpoints of a connection.
+
+## Overarching Purpose
+
+The `EndpointInfo` class provides a convenient way to access information about a connection's endpoints, such as the local and remote addresses.
+
+## Files
+
+- **`endpoint_info.h`**: Defines the `EndpointInfo` class.
+
+## Major Classes
+
+- **`grpc_core::EndpointInfo`**: A data structure that contains information about the local and remote endpoints of a connection.
+
+## Notes
+
+- The `EndpointInfo` class is used by handshakers to access information about the connection they are operating on.
diff --git a/deps/grpc/src/core/handshaker/http_connect/GEMINI.md b/deps/grpc/src/core/handshaker/http_connect/GEMINI.md
new file mode 100644
index 00000000000..c8dcc04e1ee
--- /dev/null
+++ b/deps/grpc/src/core/handshaker/http_connect/GEMINI.md
@@ -0,0 +1,16 @@
+# HTTP CONNECT Handshaker
+
+This directory contains the implementation of the HTTP CONNECT handshaker.
+
+## Overarching Purpose
+
+The HTTP CONNECT handshaker is responsible for establishing a connection to a target server through an HTTP proxy.
+
+## Files
+
+- **`http_connect_handshaker.cc`**: The implementation of the HTTP CONNECT handshaker.
+
+## Notes
+
+- The HTTP CONNECT handshaker is used when gRPC needs to connect to a server through an HTTP proxy that supports the CONNECT method.
+- This handshaker is typically used in conjunction with a security handshaker, such as the TLS handshaker, to establish a secure connection to the target server.
diff --git a/deps/grpc/src/core/handshaker/security/GEMINI.md b/deps/grpc/src/core/handshaker/security/GEMINI.md
new file mode 100644
index 00000000000..5d5bb6501db
--- /dev/null
+++ b/deps/grpc/src/core/handshaker/security/GEMINI.md
@@ -0,0 +1,20 @@
+# Security Handshakers
+
+This directory contains the implementation of the security handshakers, which are responsible for performing TLS and ALTS handshakes.
+
+## Overarching Purpose
+
+The security handshakers are responsible for establishing a secure connection between a client and a server. They use a transport security mechanism, such as TLS or ALTS, to authenticate the server and encrypt all communication between the client and the server.
+
+## Files
+
+- **`security_handshaker.h` / `security_handshaker.cc`**: Defines the `SecurityHandshaker` class, which is the base class for all security handshakers.
+- **`secure_endpoint.h` / `secure_endpoint.cc`**: Defines the `SecureEndpoint` class, which is a wrapper around a `grpc_endpoint` that provides a secure channel.
+- **`legacy_secure_endpoint.cc`**: An older implementation of `SecureEndpoint`.
+- **`pipelined_secure_endpoint.cc`**: A `SecureEndpoint` implementation that supports pipelining.
+
+## Notes
+
+- The security handshakers are a critical component of gRPC's security infrastructure.
+- They are responsible for ensuring that all connections are properly authenticated and encrypted.
+- The `SecurityHandshaker` class is designed to be extensible, allowing new security mechanisms to be added easily.
diff --git a/deps/grpc/src/core/handshaker/security/legacy_secure_endpoint.cc b/deps/grpc/src/core/handshaker/security/legacy_secure_endpoint.cc
index c20b84aa3d0..9c321529978 100644
--- a/deps/grpc/src/core/handshaker/security/legacy_secure_endpoint.cc
+++ b/deps/grpc/src/core/handshaker/security/legacy_secure_endpoint.cc
@@ -400,7 +400,7 @@ static void on_write(void* user_data, grpc_error_handle error) {
 static void endpoint_write(
     grpc_endpoint* secure_ep, grpc_slice_buffer* slices, grpc_closure* cb,
     grpc_event_engine::experimental::EventEngine::Endpoint::WriteArgs args) {
-  GRPC_LATENT_SEE_INNER_SCOPE("secure_endpoint write");
+  GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("secure_endpoint write");
   unsigned i;
   tsi_result result = TSI_OK;
   secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
diff --git a/deps/grpc/src/core/handshaker/security/pipelined_secure_endpoint.cc b/deps/grpc/src/core/handshaker/security/pipelined_secure_endpoint.cc
new file mode 100644
index 00000000000..c754c2e111e
--- /dev/null
+++ b/deps/grpc/src/core/handshaker/security/pipelined_secure_endpoint.cc
@@ -0,0 +1,965 @@
+//
+//
+// Copyright 2015 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#include <grpc/event_engine/memory_allocator.h>
+#include <grpc/event_engine/memory_request.h>
+#include <grpc/slice.h>
+#include <grpc/slice_buffer.h>
+#include <grpc/support/alloc.h>
+#include <grpc/support/atm.h>
+#include <grpc/support/port_platform.h>
+#include <grpc/support/sync.h>
+
+#include <algorithm>
+#include <atomic>
+#include <cstddef>
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <utility>
+#include <vector>
+
+#include "absl/base/thread_annotations.h"
+#include "absl/functional/any_invocable.h"
+#include "absl/log/check.h"
+#include "absl/log/log.h"
+#include "absl/status/status.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/span.h"
+#include "src/core/handshaker/security/secure_endpoint.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/debug/trace.h"
+#include "src/core/lib/experiments/experiments.h"
+#include "src/core/lib/iomgr/endpoint.h"
+#include "src/core/lib/iomgr/error.h"
+#include "src/core/lib/iomgr/event_engine_shims/endpoint.h"
+#include "src/core/lib/resource_quota/memory_quota.h"
+#include "src/core/lib/resource_quota/resource_quota.h"
+#include "src/core/lib/slice/slice.h"
+#include "src/core/lib/slice/slice_buffer.h"
+#include "src/core/lib/slice/slice_string_helpers.h"
+#include "src/core/tsi/transport_security_grpc.h"
+#include "src/core/tsi/transport_security_interface.h"
+#include "src/core/util/latent_see.h"
+#include "src/core/util/orphanable.h"
+#include "src/core/util/ref_counted.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/string.h"
+#include "src/core/util/sync.h"
+
+#define STAGING_BUFFER_SIZE 8192
+
+namespace grpc_core {
+namespace {
+class FrameProtector : public RefCounted<FrameProtector> {
+ public:
+  FrameProtector(tsi_frame_protector* protector,
+                 tsi_zero_copy_grpc_protector* zero_copy_protector,
+                 grpc_slice* leftover_slices, size_t leftover_nslices,
+                 const ChannelArgs& args)
+      : protector_(protector),
+        zero_copy_protector_(zero_copy_protector),
+        memory_owner_(args.GetObject<ResourceQuota>()
+                          ->memory_quota()
+                          ->CreateMemoryOwner()),
+        self_reservation_(memory_owner_.MakeReservation(sizeof(*this))) {
+    GRPC_TRACE_LOG(secure_endpoint, INFO)
+        << "FrameProtector: " << this << " protector: " << protector_
+        << " zero_copy_protector: " << zero_copy_protector_
+        << " leftover_nslices: " << leftover_nslices;
+    if (leftover_nslices > 0) {
+      leftover_bytes_ = std::make_unique<SliceBuffer>();
+      for (size_t i = 0; i < leftover_nslices; i++) {
+        leftover_bytes_->Append(Slice(CSliceRef(leftover_slices[i])));
+      }
+    }
+    if (zero_copy_protector_ != nullptr) {
+      read_staging_buffer_ = grpc_empty_slice();
+      write_staging_buffer_ = grpc_empty_slice();
+    } else {
+      read_staging_buffer_ =
+          memory_owner_.MakeSlice(MemoryRequest(STAGING_BUFFER_SIZE));
+      write_staging_buffer_ =
+          memory_owner_.MakeSlice(MemoryRequest(STAGING_BUFFER_SIZE));
+    }
+  }
+
+  ~FrameProtector() override {
+    tsi_frame_protector_destroy(protector_);
+    tsi_zero_copy_grpc_protector_destroy(zero_copy_protector_);
+    CSliceUnref(read_staging_buffer_);
+    CSliceUnref(write_staging_buffer_);
+  }
+
+  Mutex* read_mu() ABSL_LOCK_RETURNED(read_mu_) { return &read_mu_; }
+  Mutex* write_mu() ABSL_LOCK_RETURNED(write_mu_) { return &write_mu_; }
+
+  void TraceOp(absl::string_view op, grpc_slice_buffer* slices) {
+    if (GRPC_TRACE_FLAG_ENABLED(secure_endpoint)) {
+      size_t i;
+      if (slices->length < 64) {
+        for (i = 0; i < slices->count; i++) {
+          char* data =
+              grpc_dump_slice(slices->slices[i], GPR_DUMP_HEX | GPR_DUMP_ASCII);
+          LOG(INFO) << op << " " << this << ": " << data;
+          gpr_free(data);
+        }
+      } else {
+        grpc_slice first = GRPC_SLICE_MALLOC(64);
+        grpc_slice_buffer_copy_first_into_buffer(slices, 64,
+                                                 GRPC_SLICE_START_PTR(first));
+        char* data = grpc_dump_slice(first, GPR_DUMP_HEX | GPR_DUMP_ASCII);
+        LOG(INFO) << op << " first:" << this << ": " << data;
+        gpr_free(data);
+        CSliceUnref(first);
+      }
+    }
+  }
+
+  void MaybePostReclaimer() {
+    if (!has_posted_reclaimer_.exchange(true, std::memory_order_relaxed)) {
+      memory_owner_.PostReclaimer(
+          ReclamationPass::kBenign,
+          [self = Ref()](std::optional<ReclamationSweep> sweep) {
+            if (sweep.has_value()) {
+              GRPC_TRACE_LOG(resource_quota, INFO)
+                  << "secure endpoint: benign reclamation to free memory";
+              grpc_slice temp_read_slice;
+              grpc_slice temp_write_slice;
+
+              self->read_mu_.Lock();
+              temp_read_slice =
+                  std::exchange(self->read_staging_buffer_, grpc_empty_slice());
+              self->read_mu_.Unlock();
+
+              self->write_mu_.Lock();
+              temp_write_slice = std::exchange(self->write_staging_buffer_,
+                                               grpc_empty_slice());
+              self->write_mu_.Unlock();
+
+              CSliceUnref(temp_read_slice);
+              CSliceUnref(temp_write_slice);
+              self->has_posted_reclaimer_.store(false,
+                                                std::memory_order_relaxed);
+            }
+          });
+    }
+  }
+
+  void FlushReadStagingBuffer(uint8_t** cur, uint8_t** end)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(read_mu_) {
+    grpc_slice_buffer_add_indexed(read_buffer_, read_staging_buffer_);
+    read_staging_buffer_ =
+        memory_owner_.MakeSlice(MemoryRequest(STAGING_BUFFER_SIZE));
+    *cur = GRPC_SLICE_START_PTR(read_staging_buffer_);
+    *end = GRPC_SLICE_END_PTR(read_staging_buffer_);
+  }
+
+  void FinishRead(bool ok) {
+    TraceOp("FinishRead", read_buffer_);
+    // TODO(yangg) experiment with moving this block after read_cb to see if it
+    // helps latency
+    source_buffer_.Clear();
+    if (!ok) grpc_slice_buffer_reset_and_unref(read_buffer_);
+    read_buffer_ = nullptr;
+  }
+
+  absl::Status Unprotect(absl::Status read_status)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(read_mu_) {
+    if (shutdown_) {
+      return absl::CancelledError("secure endpoint shutdown");
+    }
+
+    GRPC_LATENT_SEE_SCOPE("unprotect");
+    bool keep_looping = false;
+    tsi_result result = TSI_OK;
+
+    uint8_t* cur = GRPC_SLICE_START_PTR(read_staging_buffer_);
+    uint8_t* end = GRPC_SLICE_END_PTR(read_staging_buffer_);
+
+    if (!read_status.ok()) {
+      grpc_slice_buffer_reset_and_unref(read_buffer_);
+    } else if (zero_copy_protector_ != nullptr) {
+      // Use zero-copy grpc protector to unprotect.
+      int min_progress_size = 1;
+      // Get the size of the last frame which is not yet fully decrypted.
+      // This estimated frame size is stored in ep->min_progress_size which is
+      // passed to the TCP layer to indicate the minimum number of
+      // bytes that need to be read to make meaningful progress. This would
+      // avoid reading of small slices from the network.
+      // TODO(vigneshbabu): Set min_progress_size in the regular
+      // (non-zero-copy) frame protector code path as well.
+      result = tsi_zero_copy_grpc_protector_unprotect(
+          zero_copy_protector_, source_buffer_.c_slice_buffer(), read_buffer_,
+          &min_progress_size);
+      min_progress_size = std::max(1, min_progress_size);
+      min_progress_size_ = result != TSI_OK ? 1 : min_progress_size;
+    } else {
+      // Use frame protector to unprotect.
+      // TODO(yangg) check error, maybe bail out early
+      for (size_t i = 0; i < source_buffer_.Count(); i++) {
+        grpc_slice encrypted = source_buffer_.c_slice_buffer()->slices[i];
+        uint8_t* message_bytes = GRPC_SLICE_START_PTR(encrypted);
+        size_t message_size = GRPC_SLICE_LENGTH(encrypted);
+
+        while (message_size > 0 || keep_looping) {
+          size_t unprotected_buffer_size_written =
+              static_cast<size_t>(end - cur);
+          size_t processed_message_size = message_size;
+          if (IsTsiFrameProtectorWithoutLocksEnabled()) {
+            result = tsi_frame_protector_unprotect(
+                protector_, message_bytes, &processed_message_size, cur,
+                &unprotected_buffer_size_written);
+          } else {
+            protector_mu_.Lock();
+            result = tsi_frame_protector_unprotect(
+                protector_, message_bytes, &processed_message_size, cur,
+                &unprotected_buffer_size_written);
+            protector_mu_.Unlock();
+          }
+          if (result != TSI_OK) {
+            LOG(ERROR) << "Decryption error: " << tsi_result_to_string(result);
+            break;
+          }
+          message_bytes += processed_message_size;
+          message_size -= processed_message_size;
+          cur += unprotected_buffer_size_written;
+
+          if (cur == end) {
+            FlushReadStagingBuffer(&cur, &end);
+            // Force to enter the loop again to extract buffered bytes in
+            // protector. The bytes could be buffered because of running out
+            // of staging_buffer. If this happens at the end of all slices,
+            // doing another unprotect avoids leaving data in the protector.
+            keep_looping = true;
+          } else if (unprotected_buffer_size_written > 0) {
+            keep_looping = true;
+          } else {
+            keep_looping = false;
+          }
+        }
+        if (result != TSI_OK) break;
+      }
+
+      if (cur != GRPC_SLICE_START_PTR(read_staging_buffer_)) {
+        grpc_slice_buffer_add(
+            read_buffer_,
+            grpc_slice_split_head(
+                &read_staging_buffer_,
+                static_cast<size_t>(
+                    cur - GRPC_SLICE_START_PTR(read_staging_buffer_))));
+      }
+    }
+
+    if (read_status.ok() && result != TSI_OK) {
+      read_status = GRPC_ERROR_CREATE(
+          absl::StrCat("Unwrap failed (", tsi_result_to_string(result), ")"));
+    }
+
+    GRPC_TRACE_LOG(secure_endpoint, INFO)
+        << "Unprotect: " << this << " read_status: " << read_status;
+
+    return read_status;
+  }
+
+  void BeginRead(grpc_slice_buffer* slices) {
+    read_buffer_ = slices;
+    grpc_slice_buffer_reset_and_unref(read_buffer_);
+  }
+
+  bool MaybeReadLeftoverBytes(
+      grpc_event_engine::experimental::SliceBuffer* dest) {
+    GRPC_TRACE_LOG(secure_endpoint, INFO)
+        << "ReadLeftoverBytes: " << this
+        << " leftover_bytes_: " << leftover_bytes_.get();
+    if (leftover_bytes_ == nullptr) {
+      return false;
+    }
+    grpc_slice_buffer_swap(leftover_bytes_->c_slice_buffer(),
+                           dest->c_slice_buffer());
+    leftover_bytes_.reset();
+    return true;
+  }
+
+  void SetSourceBuffer(
+      std::unique_ptr<grpc_event_engine::experimental::SliceBuffer>
+          source_buffer) {
+    source_buffer_ = std::move(*source_buffer);
+    source_buffer.reset();
+  }
+
+  int min_progress_size() const { return min_progress_size_; }
+
+  void FlushWriteStagingBuffer(uint8_t** cur, uint8_t** end)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(write_mu_) {
+    output_buffer_.AppendIndexed(
+        grpc_event_engine::experimental::Slice(write_staging_buffer_));
+    write_staging_buffer_ =
+        memory_owner_.MakeSlice(MemoryRequest(STAGING_BUFFER_SIZE));
+    *cur = GRPC_SLICE_START_PTR(write_staging_buffer_);
+    *end = GRPC_SLICE_END_PTR(write_staging_buffer_);
+    MaybePostReclaimer();
+  }
+
+  tsi_result Protect(grpc_slice_buffer* slices, int max_frame_size)
+      ABSL_EXCLUSIVE_LOCKS_REQUIRED(write_mu_) {
+    if (shutdown_) return TSI_FAILED_PRECONDITION;
+
+    GRPC_LATENT_SEE_SCOPE("protect");
+    uint8_t* cur = GRPC_SLICE_START_PTR(write_staging_buffer_);
+    uint8_t* end = GRPC_SLICE_END_PTR(write_staging_buffer_);
+
+    output_buffer_.Clear();
+
+    TraceOp("Protect", slices);
+
+    tsi_result result = TSI_OK;
+    if (zero_copy_protector_ != nullptr) {
+      // Use zero-copy grpc protector to protect.
+      // Break the input slices into chunks of size = max_frame_size and call
+      // tsi_zero_copy_grpc_protector_protect on each chunk. This ensures that
+      // the protector cannot create frames larger than the specified
+      // max_frame_size.
+      while (slices->length > static_cast<size_t>(max_frame_size) &&
+             result == TSI_OK) {
+        grpc_slice_buffer_move_first(
+            slices, static_cast<size_t>(max_frame_size),
+            protector_staging_buffer_.c_slice_buffer());
+        result = tsi_zero_copy_grpc_protector_protect(
+            zero_copy_protector_, protector_staging_buffer_.c_slice_buffer(),
+            output_buffer_.c_slice_buffer());
+      }
+      if (result == TSI_OK && slices->length > 0) {
+        result = tsi_zero_copy_grpc_protector_protect(
+            zero_copy_protector_, slices, output_buffer_.c_slice_buffer());
+      }
+      protector_staging_buffer_.Clear();
+    } else {
+      // Use frame protector to protect.
+      for (size_t i = 0; i < slices->count; i++) {
+        grpc_slice plain = slices->slices[i];
+        uint8_t* message_bytes = GRPC_SLICE_START_PTR(plain);
+        size_t message_size = GRPC_SLICE_LENGTH(plain);
+        while (message_size > 0) {
+          size_t protected_buffer_size_to_send = static_cast<size_t>(end - cur);
+          size_t processed_message_size = message_size;
+          if (IsTsiFrameProtectorWithoutLocksEnabled()) {
+            result = tsi_frame_protector_protect(
+                protector_, message_bytes, &processed_message_size, cur,
+                &protected_buffer_size_to_send);
+          } else {
+            protector_mu_.Lock();
+            result = tsi_frame_protector_protect(
+                protector_, message_bytes, &processed_message_size, cur,
+                &protected_buffer_size_to_send);
+            protector_mu_.Unlock();
+          }
+          if (result != TSI_OK) {
+            LOG(ERROR) << "Encryption error: " << tsi_result_to_string(result);
+            break;
+          }
+          message_bytes += processed_message_size;
+          message_size -= processed_message_size;
+          cur += protected_buffer_size_to_send;
+
+          if (cur == end) {
+            FlushWriteStagingBuffer(&cur, &end);
+          }
+        }
+        if (result != TSI_OK) break;
+      }
+      if (result == TSI_OK) {
+        size_t still_pending_size;
+        do {
+          size_t protected_buffer_size_to_send = static_cast<size_t>(end - cur);
+          if (IsTsiFrameProtectorWithoutLocksEnabled()) {
+            result = tsi_frame_protector_protect_flush(
+                protector_, cur, &protected_buffer_size_to_send,
+                &still_pending_size);
+          } else {
+            protector_mu_.Lock();
+            result = tsi_frame_protector_protect_flush(
+                protector_, cur, &protected_buffer_size_to_send,
+                &still_pending_size);
+            protector_mu_.Unlock();
+          }
+          if (result != TSI_OK) break;
+          cur += protected_buffer_size_to_send;
+          if (cur == end) {
+            FlushWriteStagingBuffer(&cur, &end);
+          }
+        } while (still_pending_size > 0);
+        if (cur != GRPC_SLICE_START_PTR(write_staging_buffer_)) {
+          output_buffer_.Append(
+              grpc_event_engine::experimental::Slice(grpc_slice_split_head(
+                  &write_staging_buffer_,
+                  static_cast<size_t>(
+                      cur - GRPC_SLICE_START_PTR(write_staging_buffer_)))));
+        }
+      }
+    }
+    // TODO(yangg) do different things according to the error type?
+    if (result != TSI_OK) output_buffer_.Clear();
+    return result;
+  }
+
+  grpc_event_engine::experimental::SliceBuffer* output_buffer() {
+    return &output_buffer_;
+  }
+
+  void Shutdown() {
+    shutdown_ = true;
+    memory_owner_.Reset();
+  }
+
+ private:
+  struct tsi_frame_protector* const protector_;
+  struct tsi_zero_copy_grpc_protector* const zero_copy_protector_;
+  Mutex mu_;
+  Mutex write_mu_;
+  // The read mutex must be acquired after the write mutex for shutdown
+  // purposes.
+  Mutex read_mu_ ABSL_ACQUIRED_AFTER(write_mu_);
+  Mutex protector_mu_;
+  grpc_slice_buffer* read_buffer_ = nullptr;
+  grpc_event_engine::experimental::SliceBuffer source_buffer_;
+  // saved handshaker leftover data to unprotect.
+  std::unique_ptr<SliceBuffer> leftover_bytes_;
+  // buffers for read and write
+  grpc_slice read_staging_buffer_ ABSL_GUARDED_BY(read_mu_);
+  grpc_slice write_staging_buffer_ ABSL_GUARDED_BY(write_mu_);
+  grpc_event_engine::experimental::SliceBuffer output_buffer_;
+  MemoryOwner memory_owner_;
+  MemoryAllocator::Reservation self_reservation_;
+  std::atomic<bool> has_posted_reclaimer_{false};
+  int min_progress_size_ = 1;
+  SliceBuffer protector_staging_buffer_;
+  bool shutdown_ = false;
+};
+}  // namespace
+}  // namespace grpc_core
+
+namespace grpc_event_engine::experimental {
+namespace {
+
+class PipelinedSecureEndpoint final : public EventEngine::Endpoint {
+ public:
+  PipelinedSecureEndpoint(
+      std::unique_ptr<grpc_event_engine::experimental::EventEngine::Endpoint>
+          wrapped_ep,
+      struct tsi_frame_protector* protector,
+      struct tsi_zero_copy_grpc_protector* zero_copy_protector,
+      grpc_slice* leftover_slices, size_t leftover_nslices,
+      const grpc_core::ChannelArgs& channel_args)
+      : impl_(grpc_core::MakeRefCounted<Impl>(
+            std::move(wrapped_ep), protector, zero_copy_protector,
+            leftover_slices, leftover_nslices, channel_args)) {}
+
+  ~PipelinedSecureEndpoint() override { impl_->Shutdown(); }
+
+  bool Read(absl::AnyInvocable<void(absl::Status)> on_read, SliceBuffer* buffer,
+            ReadArgs in_args) override {
+    return impl_->Read(std::move(on_read), buffer, std::move(in_args));
+  }
+
+  bool Write(absl::AnyInvocable<void(absl::Status)> on_writable,
+             SliceBuffer* data, WriteArgs args) override {
+    return impl_->Write(std::move(on_writable), data, std::move(args));
+  }
+
+  const EventEngine::ResolvedAddress& GetPeerAddress() const override {
+    return impl_->GetPeerAddress();
+  }
+
+  const EventEngine::ResolvedAddress& GetLocalAddress() const override {
+    return impl_->GetLocalAddress();
+  }
+
+  void* QueryExtension(absl::string_view id) override {
+    return impl_->QueryExtension(id);
+  }
+
+  std::shared_ptr<TelemetryInfo> GetTelemetryInfo() const override {
+    return std::make_shared<Impl::TelemetryInfo>(impl_->GetTelemetryInfo());
+  }
+
+ private:
+  class Impl : public grpc_core::RefCounted<Impl> {
+   public:
+    class TelemetryInfo : public EventEngine::Endpoint::TelemetryInfo {
+     public:
+      explicit TelemetryInfo(
+          std::shared_ptr<EventEngine::Endpoint::TelemetryInfo>
+              wrapped_telemetry_info)
+          : wrapped_telemetry_info_(std::move(wrapped_telemetry_info)) {}
+
+      std::vector<size_t> AllWriteMetrics() const override {
+        return wrapped_telemetry_info_
+                   ? wrapped_telemetry_info_->AllWriteMetrics()
+                   : std::vector<size_t>{};
+      }
+
+      std::optional<absl::string_view> GetMetricName(
+          size_t key) const override {
+        return wrapped_telemetry_info_
+                   ? wrapped_telemetry_info_->GetMetricName(key)
+                   : std::nullopt;
+      }
+
+      std::optional<size_t> GetMetricKey(
+          absl::string_view name) const override {
+        return wrapped_telemetry_info_
+                   ? wrapped_telemetry_info_->GetMetricKey(name)
+                   : std::nullopt;
+      }
+
+      std::shared_ptr<EventEngine::Endpoint::MetricsSet> GetMetricsSet(
+          absl::Span<const size_t> keys) const override {
+        return wrapped_telemetry_info_
+                   ? wrapped_telemetry_info_->GetMetricsSet(keys)
+                   : nullptr;
+      }
+
+      std::shared_ptr<EventEngine::Endpoint::MetricsSet> GetFullMetricsSet()
+          const override {
+        return wrapped_telemetry_info_
+                   ? wrapped_telemetry_info_->GetFullMetricsSet()
+                   : nullptr;
+      }
+
+     private:
+      std::shared_ptr<EventEngine::Endpoint::TelemetryInfo>
+          wrapped_telemetry_info_;
+    };
+
+    Impl(std::unique_ptr<grpc_event_engine::experimental::EventEngine::Endpoint>
+             wrapped_ep,
+         struct tsi_frame_protector* protector,
+         struct tsi_zero_copy_grpc_protector* zero_copy_protector,
+         grpc_slice* leftover_slices, size_t leftover_nslices,
+         const grpc_core::ChannelArgs& channel_args)
+        : staging_protected_data_buffer_(std::make_unique<SliceBuffer>()),
+          frame_protector_(protector, zero_copy_protector, leftover_slices,
+                           leftover_nslices, channel_args),
+          wrapped_ep_(std::move(wrapped_ep)),
+          event_engine_(channel_args.GetObjectRef<
+                        grpc_event_engine::experimental::EventEngine>()) {
+      if (event_engine_ == nullptr) {
+        event_engine_ = GetDefaultEventEngine();
+      }
+      // Kick off the first endpoint read ahead of the first transport read.
+      StartFirstRead();
+    }
+
+    bool Read(absl::AnyInvocable<void(absl::Status)> on_read,
+              SliceBuffer* buffer, ReadArgs args) {
+      GRPC_LATENT_SEE_SCOPE("secure_endpoint read");
+
+      grpc_core::ReleasableMutexLock lock(&read_queue_mu_);
+      // If there's been an error observed asynchronously, then fail out with
+      // that error.
+      if (!unprotecting_.ok()) {
+        event_engine_->Run(
+            [on_read = std::move(on_read),
+             status = unprotecting_.status()]() mutable { on_read(status); });
+        return false;
+      }
+
+      // If we already have some unprotected bytes available, we can just return
+      // those here.
+      if (waiting_for_transport_read_) {
+        waiting_for_transport_read_ = false;
+        if (unprotected_data_buffer_ != nullptr) {
+          *buffer = std::move(*unprotected_data_buffer_);
+          unprotected_data_buffer_.reset();
+        }
+        // We might have been waiting for this transport read before continuing
+        // to unprotect. If we were (the last read completed and there are now
+        // bytes to unprotect), then calling ContinueUnprotect will start
+        // unprotecting these bytes. If we weren't (the last read has not
+        // completed yet), then ContinueUnprotect will just return early and be
+        // called again once that read completes.
+        if (unprotecting_.value()) {
+          lock.Release();
+          event_engine_->Run(
+              [impl = Ref()]() mutable { ContinueUnprotect(std::move(impl)); });
+        }
+        return true;
+      }
+
+      // If we're already unprotecting on another thread, we need to store the
+      // buffer until we have some unprotected bytes to give it.
+      CHECK(on_read_ == nullptr);
+      pending_output_buffer_ = buffer;
+      on_read_ = std::move(on_read);
+      last_read_args_ = std::move(args);
+      return false;
+    }
+
+    bool Write(absl::AnyInvocable<void(absl::Status)> on_writable,
+               SliceBuffer* data, WriteArgs args) {
+      GRPC_LATENT_SEE_SCOPE("secure_endpoint write");
+      tsi_result result;
+      frame_protector_.TraceOp("Write", data->c_slice_buffer());
+      {
+        grpc_core::MutexLock lock(frame_protector_.write_mu());
+        result = frame_protector_.Protect(data->c_slice_buffer(),
+                                          args.max_frame_size());
+      }
+      if (result != TSI_OK) {
+        event_engine_->Run(
+            [on_writable = std::move(on_writable), result]() mutable {
+              on_writable(GRPC_ERROR_CREATE(absl::StrCat(
+                  "Wrap failed (", tsi_result_to_string(result), ")")));
+            });
+        return false;
+      }
+      on_write_ = std::move(on_writable);
+      frame_protector_.TraceOp(
+          "Write", frame_protector_.output_buffer()->c_slice_buffer());
+      return wrapped_ep_->Write(
+          [impl = Ref()](absl::Status status) mutable {
+            auto on_write = std::move(impl->on_write_);
+            impl.reset();
+            on_write(status);
+          },
+          frame_protector_.output_buffer(), std::move(args));
+    }
+
+    const EventEngine::ResolvedAddress& GetPeerAddress() const {
+      return wrapped_ep_->GetPeerAddress();
+    }
+
+    const EventEngine::ResolvedAddress& GetLocalAddress() const {
+      return wrapped_ep_->GetLocalAddress();
+    }
+
+    void* QueryExtension(absl::string_view id) {
+      return wrapped_ep_->QueryExtension(id);
+    }
+
+    void Shutdown() {
+      std::unique_ptr<EventEngine::Endpoint> wrapped_ep;
+      grpc_core::MutexLock write_lock(frame_protector_.write_mu());
+      grpc_core::MutexLock read_lock(frame_protector_.read_mu());
+      grpc_core::MutexLock shutdown_read_lock(&shutdown_read_mu_);
+      wrapped_ep = std::move(wrapped_ep_);
+      frame_protector_.Shutdown();
+    }
+
+    std::shared_ptr<TelemetryInfo> GetTelemetryInfo() const {
+      return std::make_shared<Impl::TelemetryInfo>(
+          wrapped_ep_->GetTelemetryInfo());
+    }
+
+   private:
+    void StartFirstRead() ABSL_LOCKS_EXCLUDED(read_queue_mu_) {
+      grpc_core::ReleasableMutexLock lock(&read_queue_mu_);
+      unprotecting_ = true;
+      CHECK(protected_data_buffer_ == nullptr);
+      CHECK(unprotected_data_buffer_ == nullptr);
+      // First, check if there are any leftover bytes to unprotect. If there
+      // are, we can immediately start unprotecting those bytes.
+      if (frame_protector_.MaybeReadLeftoverBytes(
+              staging_protected_data_buffer_.get())) {
+        MoveStagingIntoProtectedBuffer();
+        lock.Release();
+        // Unprotect inline since we expect a small number of leftover bytes.
+        ContinueUnprotect(Ref());
+        return;
+      }
+
+      // Kick off the first read in another thread.
+      ReadArgs args;
+      args.set_read_hint_bytes(frame_protector_.min_progress_size());
+      lock.Release();
+      event_engine_->Run([impl = Ref(), args = std::move(args)]() mutable {
+        // If the endpoint closed whilst waiting for this callback, then
+        // fail out the read and we're done.
+        grpc_core::ReleasableMutexLock lock(impl->frame_protector_.read_mu());
+        if (impl->wrapped_ep_ == nullptr) {
+          lock.Release();
+          FailReads(std::move(impl),
+                    absl::CancelledError("secure endpoint shutdown"));
+          return;
+        }
+        const bool read_finished_immediately = impl->wrapped_ep_->Read(
+            [impl = impl->Ref()](absl::Status status) mutable {
+              FinishFirstRead(std::move(impl), status);
+            },
+            impl->staging_protected_data_buffer_.get(), std::move(args));
+        if (read_finished_immediately) {
+          lock.Release();
+          {
+            grpc_core::MutexLock lock(&impl->read_queue_mu_);
+            impl->frame_protector_.TraceOp(
+                "ReadImm",
+                impl->staging_protected_data_buffer_->c_slice_buffer());
+            impl->MoveStagingIntoProtectedBuffer();
+          }
+          ContinueUnprotect(std::move(impl));
+        }
+      });
+    }
+
+    static void FinishFirstRead(grpc_core::RefCountedPtr<Impl> impl,
+                                absl::Status status)
+        ABSL_LOCKS_EXCLUDED(impl->read_queue_mu_) {
+      if (status.ok()) {
+        {
+          grpc_core::MutexLock lock(&impl->read_queue_mu_);
+          impl->frame_protector_.TraceOp(
+              "Read", impl->staging_protected_data_buffer_->c_slice_buffer());
+          impl->MoveStagingIntoProtectedBuffer();
+        }
+        ContinueUnprotect(std::move(impl));
+        return;
+      }
+      FailReads(std::move(impl), status);
+    }
+
+    void MoveStagingIntoProtectedBuffer()
+        ABSL_EXCLUSIVE_LOCKS_REQUIRED(read_queue_mu_) {
+      protected_data_buffer_ = std::move(staging_protected_data_buffer_);
+      staging_protected_data_buffer_ = std::make_unique<SliceBuffer>();
+    }
+
+    bool ShouldContinueUnprotect()
+        ABSL_EXCLUSIVE_LOCKS_REQUIRED(read_queue_mu_) {
+      if (unprotecting_.ok() && !unprotecting_.value()) {
+        unprotecting_ = true;
+        return true;
+      }
+      return false;
+    }
+
+    static void FailReads(grpc_core::RefCountedPtr<Impl> impl,
+                          absl::Status status)
+        ABSL_LOCKS_EXCLUDED(frame_protector_.read_mu(), read_queue_mu_) {
+      impl->read_queue_mu_.Lock();
+      impl->unprotecting_ = status;
+      auto on_read = std::move(impl->on_read_);
+      impl->read_queue_mu_.Unlock();
+      impl.reset();
+      if (on_read != nullptr) on_read(status);
+    };
+
+    static void ContinueUnprotect(grpc_core::RefCountedPtr<Impl> impl) {
+      GRPC_LATENT_SEE_SCOPE("secure endpoint continue unprotect");
+      ReadArgs args;
+      std::unique_ptr<SliceBuffer> source_buffer;
+      std::unique_ptr<SliceBuffer> read_buffer;
+      absl::Status unprotect_status;
+      absl::AnyInvocable<void(absl::Status)> on_read;
+
+      /*
+      Data passes through the buffers as follows:
+      (1) Data is read into staging buffer.
+      (2) Once ready to be unprotected, data is moved from staging buffer to
+      protected data buffer.
+      (3) Data is passed to frame protector's source buffer and unprotected into
+      read buffer.
+      (4) Unprotected data is passed from read buffer to unprotected data
+      buffer.
+      (5) Lastly, data is optionally passed to pending output buffer if there is
+      currently a pending read.
+      */
+      while (true) {
+        {
+          grpc_core::ReleasableMutexLock lock(&impl->read_queue_mu_);
+          if (!impl->unprotecting_.ok()) {
+            // Something failed or we're shutting down, so fail reads.
+            auto status = impl->unprotecting_.status();
+            lock.Release();
+            FailReads(std::move(impl), status);
+            return;
+          }
+
+          if (impl->protected_data_buffer_ == nullptr) {
+            // No pending data to unprotect - we're done.
+            impl->unprotecting_ = false;
+            lock.Release();
+            return;
+          }
+
+          // There's more data to unprotect - grab it under the queue lock.
+          source_buffer = std::move(impl->protected_data_buffer_);
+          impl->frame_protector_.TraceOp("data",
+                                         source_buffer->c_slice_buffer());
+          args = std::move(impl->last_read_args_);
+          args.set_read_hint_bytes(impl->frame_protector_.min_progress_size());
+        }
+
+        // Kick off the next read in another thread while we unprotect in this
+        // thread.
+        impl->event_engine_->Run(
+            [impl = impl->Ref(), args = std::move(args)]() mutable {
+              StartAsyncRead(std::move(impl), std::move(args));
+            });
+
+        {
+          grpc_core::ReleasableMutexLock lock(impl->frame_protector_.read_mu());
+          // Unprotect the bytes.
+          CHECK(read_buffer == nullptr);
+          impl->frame_protector_.SetSourceBuffer(std::move(source_buffer));
+          read_buffer = std::make_unique<SliceBuffer>();
+          impl->frame_protector_.BeginRead(read_buffer->c_slice_buffer());
+          unprotect_status = impl->frame_protector_.Unprotect(absl::OkStatus());
+          impl->frame_protector_.FinishRead(unprotect_status.ok());
+          if (!unprotect_status.ok()) {
+            lock.Release();
+            FailReads(std::move(impl), unprotect_status);
+            return;
+          }
+        }
+
+        impl->read_queue_mu_.Lock();
+        impl->unprotected_data_buffer_ = std::move(read_buffer);
+        // We have a read waiting on this unprotected data - call the
+        // callback and continue in loop.
+        if (impl->on_read_ != nullptr) {
+          *impl->pending_output_buffer_ =
+              std::move(*impl->unprotected_data_buffer_);
+          impl->unprotected_data_buffer_.reset();
+          on_read = std::move(impl->on_read_);
+          impl->read_queue_mu_.Unlock();
+          impl->event_engine_->Run([on_read = std::move(on_read)]() mutable {
+            on_read(absl::OkStatus());
+          });
+        } else {
+          // We're waiting on the next read to read this data. We're done
+          // for now.
+          impl->waiting_for_transport_read_ = true;
+          impl->read_queue_mu_.Unlock();
+          break;
+        }
+      }
+    }
+
+    static void StartAsyncRead(grpc_core::RefCountedPtr<Impl> impl,
+                               ReadArgs args)
+        ABSL_LOCKS_EXCLUDED(impl->shutdown_read_mu_, impl->read_queue_mu_) {
+      grpc_core::ReleasableMutexLock lock(&impl->shutdown_read_mu_);
+      if (impl->wrapped_ep_ == nullptr) {
+        lock.Release();
+        FailReads(std::move(impl),
+                  absl::CancelledError("secure endpoint shutdown"));
+        return;
+      }
+      const bool read_finished_immediately = impl->wrapped_ep_->Read(
+          [impl = impl->Ref()](absl::Status status) mutable {
+            FinishAsyncRead(std::move(impl), status);
+          },
+          impl->staging_protected_data_buffer_.get(), std::move(args));
+      if (read_finished_immediately) {
+        lock.Release();
+        bool should_unprotect = false;
+        {
+          grpc_core::MutexLock lock(&impl->read_queue_mu_);
+          impl->frame_protector_.TraceOp(
+              "ReadImm",
+              impl->staging_protected_data_buffer_->c_slice_buffer());
+          impl->MoveStagingIntoProtectedBuffer();
+          should_unprotect = impl->ShouldContinueUnprotect();
+        }
+        // We now have data to unprotect so we should continue unprotecting
+        // if not currently doing so.
+        if (should_unprotect) {
+          ContinueUnprotect(std::move(impl));
+        }
+      }
+    }
+
+    static void FinishAsyncRead(grpc_core::RefCountedPtr<Impl> impl,
+                                absl::Status status)
+        ABSL_LOCKS_EXCLUDED(impl->read_queue_mu_) {
+      bool should_unprotect = false;
+      {
+        grpc_core::MutexLock lock(&impl->read_queue_mu_);
+        should_unprotect = impl->ShouldContinueUnprotect();
+        if (!status.ok()) {
+          // We rely on ContinueUnprotect to fail the read if the
+          // status is not ok, since we might currently have an
+          // unprotect in progress and we want to return that data
+          // before we fail future reads.
+          impl->unprotecting_ = status;
+        } else {
+          impl->frame_protector_.TraceOp(
+              "Read", impl->staging_protected_data_buffer_->c_slice_buffer());
+          impl->MoveStagingIntoProtectedBuffer();
+        }
+      }
+      // We now have data to unprotect so we should continue unprotecting
+      // if not currently doing so.
+      if (should_unprotect) {
+        ContinueUnprotect(std::move(impl));
+      }
+    }
+
+    grpc_core::Mutex read_queue_mu_;
+    // We have a separate read shutdown lock in order to avoid sharing a lock
+    // between read and unprotect. This way, we can perform reads and
+    // unprotects in parallel. We also must acquire this after both frame
+    // protector mutexes for shutdown purposes.
+    grpc_core::Mutex shutdown_read_mu_
+        ABSL_ACQUIRED_AFTER(frame_protector_.read_mu());
+    bool waiting_for_transport_read_ ABSL_GUARDED_BY(read_queue_mu_) = false;
+    absl::StatusOr<bool> unprotecting_ ABSL_GUARDED_BY(read_queue_mu_) = false;
+    std::unique_ptr<SliceBuffer> unprotected_data_buffer_
+        ABSL_GUARDED_BY(read_queue_mu_);
+    std::unique_ptr<SliceBuffer> staging_protected_data_buffer_;
+    SliceBuffer* pending_output_buffer_ ABSL_GUARDED_BY(read_queue_mu_);
+    std::unique_ptr<SliceBuffer> protected_data_buffer_
+        ABSL_GUARDED_BY(read_queue_mu_);
+    ReadArgs last_read_args_ ABSL_GUARDED_BY(read_queue_mu_);
+    absl::AnyInvocable<void(absl::Status)> on_read_
+        ABSL_GUARDED_BY(read_queue_mu_) = nullptr;
+    // Since writes are currently not pipelined, we don't need to protect this
+    // callback with a mutex.
+    absl::AnyInvocable<void(absl::Status)> on_write_ = nullptr;
+    // Operations to the frame protector are protected by mutexes, so the frame
+    // protector itself does not need to be protected.
+    grpc_core::FrameProtector frame_protector_;
+    // Resetting wrapped endpoint requires holding three different locks, but
+    // other operations using it require holding only one of those locks, so we
+    // don't want any guard annotations on the wrapped_ep_ field.
+    std::unique_ptr<EventEngine::Endpoint> wrapped_ep_;
+    std::shared_ptr<EventEngine> event_engine_;
+  };
+
+  grpc_core::RefCountedPtr<Impl> impl_;
+};
+
+}  // namespace
+}  // namespace grpc_event_engine::experimental
+
+grpc_core::OrphanablePtr<grpc_endpoint> grpc_pipelined_secure_endpoint_create(
+    struct tsi_frame_protector* protector,
+    struct tsi_zero_copy_grpc_protector* zero_copy_protector,
+    std::unique_ptr<grpc_event_engine::experimental::EventEngine::Endpoint>
+        to_wrap,
+    grpc_slice* leftover_slices, const grpc_core::ChannelArgs& channel_args,
+    size_t leftover_nslices) {
+  return grpc_core::OrphanablePtr<grpc_endpoint>(
+      grpc_event_engine::experimental::grpc_event_engine_endpoint_create(
+          std::make_unique<
+              grpc_event_engine::experimental::PipelinedSecureEndpoint>(
+              std::move(to_wrap), protector, zero_copy_protector,
+              leftover_slices, leftover_nslices, channel_args)));
+}
diff --git a/deps/grpc/src/core/handshaker/security/secure_endpoint.cc b/deps/grpc/src/core/handshaker/security/secure_endpoint.cc
index 1520300314d..dae7efe93db 100644
--- a/deps/grpc/src/core/handshaker/security/secure_endpoint.cc
+++ b/deps/grpc/src/core/handshaker/security/secure_endpoint.cc
@@ -186,11 +186,13 @@ class FrameProtector : public RefCounted<FrameProtector> {
 
   absl::Status Unprotect(absl::Status read_status)
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(read_mu_) {
+    GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("unprotect");
+
     if (shutdown_) {
       return absl::CancelledError("secure endpoint shutdown");
     }
 
-    GRPC_LATENT_SEE_INNER_SCOPE("unprotect");
+    GRPC_TRACE_LOG(secure_endpoint, INFO) << "Starting unprotect for " << this;
     bool keep_looping = false;
     tsi_result result = TSI_OK;
 
@@ -321,7 +323,8 @@ class FrameProtector : public RefCounted<FrameProtector> {
       ABSL_EXCLUSIVE_LOCKS_REQUIRED(write_mu_) {
     if (shutdown_) return TSI_FAILED_PRECONDITION;
 
-    GRPC_LATENT_SEE_INNER_SCOPE("protect");
+    GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("protect");
+    GRPC_TRACE_LOG(secure_endpoint, INFO) << "Starting protect for " << this;
     uint8_t* cur = GRPC_SLICE_START_PTR(write_staging_buffer_);
     uint8_t* end = GRPC_SLICE_END_PTR(write_staging_buffer_);
 
@@ -416,6 +419,10 @@ class FrameProtector : public RefCounted<FrameProtector> {
     }
     // TODO(yangg) do different things according to the error type?
     if (result != TSI_OK) output_buffer_.Clear();
+
+    GRPC_TRACE_LOG(secure_endpoint, INFO)
+        << "Protect: " << this << " result: " << result;
+
     return result;
   }
 
@@ -583,7 +590,7 @@ static void on_write(void* user_data, grpc_error_handle error) {
 static void endpoint_write(
     grpc_endpoint* secure_ep, grpc_slice_buffer* slices, grpc_closure* cb,
     grpc_event_engine::experimental::EventEngine::Endpoint::WriteArgs args) {
-  GRPC_LATENT_SEE_INNER_SCOPE("secure_endpoint write");
+  GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("secure_endpoint write");
   secure_endpoint* ep = reinterpret_cast<secure_endpoint*>(secure_ep);
   tsi_result result;
   {
@@ -800,7 +807,7 @@ class SecureEndpoint final : public EventEngine::Endpoint {
 
     bool Write(absl::AnyInvocable<void(absl::Status)> on_writable,
                SliceBuffer* data, WriteArgs args) {
-      GRPC_LATENT_SEE_INNER_SCOPE("secure_endpoint write");
+      GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("secure_endpoint write");
       tsi_result result;
       frame_protector_.TraceOp("Write", data->c_slice_buffer());
       if (grpc_core::IsSecureEndpointOffloadLargeWritesEnabled()) {
@@ -887,6 +894,8 @@ class SecureEndpoint final : public EventEngine::Endpoint {
       grpc_core::MutexLock read_lock(frame_protector_.read_mu());
       wrapped_ep = std::move(wrapped_ep_);
       frame_protector_.Shutdown();
+      GRPC_TRACE_LOG(secure_endpoint, INFO)
+          << "Shutdown for secure endpoint: " << this;
     }
 
     std::shared_ptr<TelemetryInfo> GetTelemetryInfo() const {
@@ -896,7 +905,7 @@ class SecureEndpoint final : public EventEngine::Endpoint {
 
    private:
     bool MaybeFinishReadImmediately() {
-      GRPC_LATENT_SEE_INNER_SCOPE("secure_endpoint maybe finish read");
+      GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("secure_endpoint maybe finish read");
       grpc_core::MutexLock lock(frame_protector_.read_mu());
       // If the read is large, since we got the bytes whilst still calling read,
       // offload the decryption to event engine.
@@ -927,7 +936,7 @@ class SecureEndpoint final : public EventEngine::Endpoint {
 
     static void FinishAsyncRead(grpc_core::RefCountedPtr<Impl> impl,
                                 absl::Status status) {
-      GRPC_LATENT_SEE_PARENT_SCOPE("secure endpoint finish async read");
+      GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("secure endpoint finish async read");
       {
         grpc_core::MutexLock lock(impl->frame_protector_.read_mu());
         if (status.ok() && impl->wrapped_ep_ == nullptr) {
@@ -962,7 +971,7 @@ class SecureEndpoint final : public EventEngine::Endpoint {
     };
 
     static void FinishAsyncWrite(grpc_core::RefCountedPtr<Impl> impl) {
-      GRPC_LATENT_SEE_PARENT_SCOPE("secure endpoint finish async write");
+      GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("secure endpoint finish async write");
       tsi_result result;
       std::unique_ptr<SliceBuffer> data;
       WriteArgs args;
@@ -1067,12 +1076,18 @@ grpc_core::OrphanablePtr<grpc_endpoint> grpc_secure_endpoint_create(
         event_engine_endpoint = grpc_event_engine::experimental::
             grpc_take_wrapped_event_engine_endpoint(to_wrap.release());
     CHECK(event_engine_endpoint != nullptr);
-    return grpc_core::OrphanablePtr<grpc_endpoint>(
-        grpc_event_engine::experimental::grpc_event_engine_endpoint_create(
-            std::make_unique<grpc_event_engine::experimental::SecureEndpoint>(
-                std::move(event_engine_endpoint), protector,
-                zero_copy_protector, leftover_slices, leftover_nslices,
-                channel_args)));
+    if (grpc_core::IsPipelinedReadSecureEndpointEnabled()) {
+      return grpc_pipelined_secure_endpoint_create(
+          protector, zero_copy_protector, std::move(event_engine_endpoint),
+          leftover_slices, channel_args, leftover_nslices);
+    } else {
+      return grpc_core::OrphanablePtr<grpc_endpoint>(
+          grpc_event_engine::experimental::grpc_event_engine_endpoint_create(
+              std::make_unique<grpc_event_engine::experimental::SecureEndpoint>(
+                  std::move(event_engine_endpoint), protector,
+                  zero_copy_protector, leftover_slices, leftover_nslices,
+                  channel_args)));
+    }
   }
   return grpc_core::MakeOrphanable<secure_endpoint>(
       &vtable, protector, zero_copy_protector, std::move(to_wrap),
diff --git a/deps/grpc/src/core/handshaker/security/secure_endpoint.h b/deps/grpc/src/core/handshaker/security/secure_endpoint.h
index b3d9d577d95..35fd1a2c950 100644
--- a/deps/grpc/src/core/handshaker/security/secure_endpoint.h
+++ b/deps/grpc/src/core/handshaker/security/secure_endpoint.h
@@ -55,4 +55,12 @@ grpc_core::OrphanablePtr<grpc_endpoint> grpc_legacy_secure_endpoint_create(
     grpc_slice* leftover_slices, const grpc_channel_args* channel_args,
     size_t leftover_nslices);
 
+grpc_core::OrphanablePtr<grpc_endpoint> grpc_pipelined_secure_endpoint_create(
+    struct tsi_frame_protector* protector,
+    struct tsi_zero_copy_grpc_protector* zero_copy_protector,
+    std::unique_ptr<grpc_event_engine::experimental::EventEngine::Endpoint>
+        to_wrap,
+    grpc_slice* leftover_slices, const grpc_core::ChannelArgs& channel_args,
+    size_t leftover_nslices);
+
 #endif  // GRPC_SRC_CORE_HANDSHAKER_SECURITY_SECURE_ENDPOINT_H
diff --git a/deps/grpc/src/core/handshaker/tcp_connect/GEMINI.md b/deps/grpc/src/core/handshaker/tcp_connect/GEMINI.md
new file mode 100644
index 00000000000..96553c66baf
--- /dev/null
+++ b/deps/grpc/src/core/handshaker/tcp_connect/GEMINI.md
@@ -0,0 +1,16 @@
+# TCP Connect Handshaker
+
+This directory contains a basic handshaker for TCP connections.
+
+## Overarching Purpose
+
+This handshaker is responsible for creating a TCP connection to a remote host. It is the simplest handshaker and is used as the base for more complex handshakers, such as the security handshakers.
+
+## Files
+
+- **`tcp_connect_handshaker.cc`**: The implementation of the TCP connect handshaker.
+
+## Notes
+
+- This handshaker does not provide any security features. It simply establishes a plain TCP connection.
+- It is typically used as the first step in a handshaking process, followed by a security handshaker to establish a secure channel.
diff --git a/deps/grpc/src/core/lib/address_utils/GEMINI.md b/deps/grpc/src/core/lib/address_utils/GEMINI.md
new file mode 100644
index 00000000000..36bf35ca370
--- /dev/null
+++ b/deps/grpc/src/core/lib/address_utils/GEMINI.md
@@ -0,0 +1,18 @@
+# Address Utilities
+
+This directory contains utility functions for working with network addresses.
+
+## Overarching Purpose
+
+This directory provides a set of functions for parsing, formatting, and manipulating network addresses. It is used throughout the gRPC core to handle network addresses in a consistent way.
+
+## Files
+
+- **`parse_address.h` / `parse_address.cc`**: Defines functions for parsing string representations of network addresses into `grpc_resolved_address` structures.
+- **`sockaddr_utils.h` / `sockaddr_utils.cc`**: Defines functions for working with `sockaddr` structures, including converting them to and from string representations, and comparing them for equality.
+
+## Notes
+
+- These utilities are essential for gRPC's networking code.
+- They provide a platform-independent way to work with network addresses.
+- The functions in this directory are carefully designed to be efficient and to avoid common pitfalls when working with network addresses.
diff --git a/deps/grpc/src/core/lib/channel/GEMINI.md b/deps/grpc/src/core/lib/channel/GEMINI.md
new file mode 100644
index 00000000000..9304be8f704
--- /dev/null
+++ b/deps/grpc/src/core/lib/channel/GEMINI.md
@@ -0,0 +1,31 @@
+# Channel
+
+This directory contains the core implementation of the gRPC channel stack.
+
+## Overarching Purpose
+
+The channel library provides the building blocks for creating and managing gRPC channels. It includes the implementation of the channel stack, which is a pipeline of filters that process incoming and outgoing call operations. The channel library is a low-level component of the gRPC stack, and it is used by both the client and server implementations.
+
+## Core Concepts
+
+The channel library is built around a few key abstractions:
+
+*   **`ChannelStack`**: A `ChannelStack` is a pipeline of channel filters. Each filter in the stack can inspect and modify the call operations that pass through it. The channel stack is a key component of the gRPC architecture, and it provides a flexible and extensible way to add functionality to a channel.
+*   **`ChannelStackBuilder`**: A `ChannelStackBuilder` is used to build a `ChannelStack`. It provides a convenient way to add filters to the stack and to configure the channel.
+*   **`ChannelArgs`**: A `ChannelArgs` is an immutable set of key-value pairs that can be used to configure a channel. Channel args are used to control the behavior of the channel stack and its filters.
+*   **`PromiseBasedFilter`**: A `PromiseBasedFilter` is a new type of channel filter that is based on the [gRPC Core Promise API](../../promise/GEMINI.md). Promise-based filters are designed to be more asynchronous and non-blocking than traditional, callback-based filters.
+
+## Files
+
+*   **`channel_args.h`, `channel_args.cc`**: These files define the `ChannelArgs` class.
+*   **`channel_stack.h`, `channel_stack.cc`**: These files define the `ChannelStack` class.
+*   **`channel_stack_builder.h`, `channel_stack_builder.cc`**: These files define the `ChannelStackBuilder` class.
+*   **`promise_based_filter.h`, `promise_based_filter.cc`**: These files define the `PromiseBasedFilter` class.
+*   **`connected_channel.h`, `connected_channel.cc`**: Defines a helper class for building channels that are based on a single transport.
+
+## Notes
+
+*   The channel stack is a powerful mechanism for adding functionality to a gRPC channel. It is used to implement a wide variety of features, including compression, error handling, and load balancing.
+*   The channel library is in the process of being migrated to a new, promise-based architecture. As a result, you will see a mix of legacy callback-based code and newer promise-based code. The `PromiseBasedFilter` is a key part of this transition.
+*   The channel library is a low-level component of the gRPC stack. Most application developers will not need to interact with it directly.
+*   The channel stack is a linear pipeline of filters. This means that each filter in the stack has a single "next" filter that it can pass call operations to. This simple, linear design is one of the things that makes the channel stack so efficient and easy to reason about.
diff --git a/deps/grpc/src/core/lib/channel/promise_based_filter.cc b/deps/grpc/src/core/lib/channel/promise_based_filter.cc
index d13e13bb19a..5f525da1539 100644
--- a/deps/grpc/src/core/lib/channel/promise_based_filter.cc
+++ b/deps/grpc/src/core/lib/channel/promise_based_filter.cc
@@ -242,8 +242,7 @@ void BaseCallData::CapturedBatch::CancelWith(grpc_error_handle error,
 ///////////////////////////////////////////////////////////////////////////////
 // BaseCallData::Flusher
 
-BaseCallData::Flusher::Flusher(BaseCallData* call, latent_see::Metadata* desc)
-    : latent_see::InnerScope(desc), call_(call) {
+BaseCallData::Flusher::Flusher(BaseCallData* call) : call_(call) {
   GRPC_CALL_STACK_REF(call_->call_stack(), "flusher");
 }
 
@@ -395,7 +394,7 @@ bool BaseCallData::SendMessage::IsIdle() const {
 }
 
 void BaseCallData::SendMessage::OnComplete(absl::Status status) {
-  Flusher flusher(base_, GRPC_LATENT_SEE_METADATA("SendMessage::OnComplete"));
+  Flusher flusher(base_);
   GRPC_TRACE_LOG(channel, INFO)
       << base_->LogTag() << " SendMessage.OnComplete st=" << StateString(state_)
       << " status=" << status;
@@ -705,8 +704,7 @@ void BaseCallData::ReceiveMessage::OnComplete(absl::Status status) {
       break;
   }
   completed_status_ = status;
-  Flusher flusher(base_,
-                  GRPC_LATENT_SEE_METADATA("ReceiveMessage::OnComplete"));
+  Flusher flusher(base_);
   ScopedContext ctx(base_);
   base_->WakeInsideCombiner(&flusher);
 }
@@ -1220,9 +1218,7 @@ class ClientCallData::PollContext {
         auto* next_poll = static_cast<NextPoll*>(p);
         {
           ScopedContext ctx(next_poll->call_data);
-          Flusher flusher(next_poll->call_data,
-                          GRPC_LATENT_SEE_METADATA(
-                              "ClientCallData::PollContext::~PollContext"));
+          Flusher flusher(next_poll->call_data);
           next_poll->call_data->WakeInsideCombiner(&flusher);
         }
         GRPC_CALL_STACK_UNREF(next_poll->call_stack, "re-poll");
@@ -1351,7 +1347,7 @@ void ClientCallData::StartBatch(grpc_transport_stream_op_batch* b) {
   // Fake out the activity based context.
   ScopedContext context(this);
   CapturedBatch batch(b);
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA("ClientCallData::StartBatch"));
+  Flusher flusher(this);
 
   GRPC_TRACE_LOG(channel, INFO) << LogTag() << " StartBatch " << DebugString();
 
@@ -1557,8 +1553,7 @@ void ClientCallData::RecvInitialMetadataReady(grpc_error_handle error) {
       << DebugString() << " error:" << error.ToString()
       << " md:" << recv_initial_metadata_->metadata->DebugString();
   ScopedContext context(this);
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA(
-                            "ClientCallData::RecvInitialMetadataReady"));
+  Flusher flusher(this);
   if (!error.ok()) {
     switch (recv_initial_metadata_->state) {
       case RecvInitialMetadata::kHookedWaitingForPipe:
@@ -1744,8 +1739,7 @@ void ClientCallData::RecvTrailingMetadataReadyCallback(
 }
 
 void ClientCallData::RecvTrailingMetadataReady(grpc_error_handle error) {
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA(
-                            "ClientCallData::RecvTrailingMetadataReady"));
+  Flusher flusher(this);
   GRPC_TRACE_LOG(channel, INFO)
       << LogTag() << " ClientCallData.RecvTrailingMetadataReady "
       << "recv_trailing_state=" << StateString(recv_trailing_state_)
@@ -1796,12 +1790,12 @@ void ClientCallData::SetStatusFromError(grpc_metadata_batch* metadata,
 
 // Wakeup and poll the promise if appropriate.
 void ClientCallData::WakeInsideCombiner(Flusher* flusher) {
-  GRPC_LATENT_SEE_INNER_SCOPE("ClientCallData::WakeInsideCombiner");
+  GRPC_LATENT_SEE_SCOPE("ClientCallData::WakeInsideCombiner");
   PollContext(this, flusher).Run();
 }
 
 void ClientCallData::OnWakeup() {
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA("ClientCallData::OnWakeup"));
+  Flusher flusher(this);
   ScopedContext context(this);
   WakeInsideCombiner(&flusher);
 }
@@ -1877,9 +1871,7 @@ class ServerCallData::PollContext {
       auto run = [](void* p, grpc_error_handle) {
         auto* next_poll = static_cast<NextPoll*>(p);
         {
-          Flusher flusher(next_poll->call_data,
-                          GRPC_LATENT_SEE_METADATA(
-                              "ServerCallData::PollContext::~PollContext"));
+          Flusher flusher(next_poll->call_data);
           ScopedContext context(next_poll->call_data);
           next_poll->call_data->WakeInsideCombiner(&flusher);
         }
@@ -1983,7 +1975,7 @@ void ServerCallData::StartBatch(grpc_transport_stream_op_batch* b) {
   // Fake out the activity based context.
   ScopedContext context(this);
   CapturedBatch batch(b);
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA("ServerCallData::StartBatch"));
+  Flusher flusher(this);
   bool wake = false;
 
   GRPC_TRACE_LOG(channel, INFO) << LogTag() << " StartBatch: " << DebugString();
@@ -2272,8 +2264,7 @@ void ServerCallData::RecvTrailingMetadataReady(grpc_error_handle error) {
   GRPC_TRACE_LOG(channel, INFO)
       << LogTag() << ": RecvTrailingMetadataReady error=" << error
       << " md=" << recv_trailing_metadata_->DebugString();
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA(
-                            "ServerCallData::RecvTrailingMetadataReady"));
+  Flusher flusher(this);
   PollContext poll_ctx(this, &flusher);
   Completed(error, recv_trailing_metadata_->get(GrpcTarPit()).has_value(),
             &flusher);
@@ -2287,8 +2278,7 @@ void ServerCallData::RecvInitialMetadataReadyCallback(void* arg,
 }
 
 void ServerCallData::RecvInitialMetadataReady(grpc_error_handle error) {
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA(
-                            "ServerCallData::RecvInitialMetadataReady"));
+  Flusher flusher(this);
   GRPC_TRACE_LOG(channel, INFO)
       << LogTag() << ": RecvInitialMetadataReady " << error;
   CHECK(recv_initial_state_ == RecvInitialState::kForwarded);
@@ -2351,7 +2341,7 @@ std::string ServerCallData::DebugString() const {
 
 // Wakeup and poll the promise if appropriate.
 void ServerCallData::WakeInsideCombiner(Flusher* flusher) {
-  GRPC_LATENT_SEE_INNER_SCOPE("ServerCallData::WakeInsideCombiner");
+  GRPC_LATENT_SEE_SCOPE("ServerCallData::WakeInsideCombiner");
   PollContext poll_ctx(this, flusher);
   GRPC_TRACE_LOG(channel, INFO)
       << LogTag() << ": WakeInsideCombiner " << DebugString();
@@ -2503,7 +2493,7 @@ void ServerCallData::WakeInsideCombiner(Flusher* flusher) {
 }
 
 void ServerCallData::OnWakeup() {
-  Flusher flusher(this, GRPC_LATENT_SEE_METADATA("ServerCallData::OnWakeup"));
+  Flusher flusher(this);
   ScopedContext context(this);
   WakeInsideCombiner(&flusher);
 }
diff --git a/deps/grpc/src/core/lib/channel/promise_based_filter.h b/deps/grpc/src/core/lib/channel/promise_based_filter.h
index 9ebf87f404f..d6374992892 100644
--- a/deps/grpc/src/core/lib/channel/promise_based_filter.h
+++ b/deps/grpc/src/core/lib/channel/promise_based_filter.h
@@ -196,7 +196,10 @@ struct CallHasAsyncErrorInterceptor<
 template <typename Derived>
 struct CallHasAsyncErrorInterceptor<
     Derived, std::enable_if_t<IsFusedFilter<Derived>::value>> {
-  static constexpr bool value = Derived::FusedFilterHasAsyncErrorInterceptor();
+  // Fused filter types return a promise, which resolves to a
+  // ServerMetadataHandle type. So we assume that an async error interceptor is
+  // always needed.
+  static constexpr bool value = true;
 };
 
 // Given a boolean X export a type:
@@ -1304,11 +1307,9 @@ class BaseCallData : public Activity, private Wakeable {
     }
   };
 
-  class Flusher : public latent_see::InnerScope {
+  class Flusher {
    public:
-    explicit Flusher(BaseCallData* call,
-                     latent_see::Metadata* desc = GRPC_LATENT_SEE_METADATA(
-                         "PromiseBasedFilter::Flusher"));
+    explicit Flusher(BaseCallData* call);
     // Calls closures, schedules batches, relinquishes call combiner.
     ~Flusher();
 
diff --git a/deps/grpc/src/core/lib/compression/GEMINI.md b/deps/grpc/src/core/lib/compression/GEMINI.md
new file mode 100644
index 00000000000..6c7790417a3
--- /dev/null
+++ b/deps/grpc/src/core/lib/compression/GEMINI.md
@@ -0,0 +1,18 @@
+# Compression
+
+This directory contains the implementation of gRPC's compression framework.
+
+## Overarching Purpose
+
+The compression framework provides a pluggable mechanism for compressing and decompressing message payloads. It is designed to be extensible, allowing new compression algorithms to be added easily.
+
+## Files
+
+- **`compression_internal.h` / `compression_internal.cc`**: Defines the core `grpc_compression_algorithm` enum and related functions.
+- **`message_compress.h` / `message_compress.cc`**: Defines functions for compressing and decompressing message payloads.
+
+## Notes
+
+- The compression framework is a key component of gRPC's performance infrastructure.
+- It is responsible for reducing the size of message payloads, which can significantly improve performance over slow networks.
+- The framework is designed to be flexible and extensible, allowing it to be adapted to different performance requirements.
diff --git a/deps/grpc/src/core/lib/debug/GEMINI.md b/deps/grpc/src/core/lib/debug/GEMINI.md
new file mode 100644
index 00000000000..f77f9c26c20
--- /dev/null
+++ b/deps/grpc/src/core/lib/debug/GEMINI.md
@@ -0,0 +1,37 @@
+# gRPC Core Debugging & Tracing
+
+This directory contains the implementation of the gRPC tracing library.
+
+## Overarching Purpose
+
+The tracing library provides a mechanism for logging trace messages from different parts of the gRPC stack. This can be useful for debugging and performance analysis. It is designed to be lightweight and should have a minimal impact on performance when it is disabled.
+
+## How to Add a New Trace Flag
+
+1.  Add a new entry to the `trace_flags.yaml` file. The entry should include the name of the trace flag and a brief description of what it does.
+2.  Run the `tools/codegen/core/gen_trace_flags.py` script to regenerate the `trace_flags.h` and `trace_flags.cc` files.
+3.  Use the `GRPC_TRACE_FLAG_ENABLED` macro to check if the trace flag is enabled, and the `GRPC_TRACE_LOG`, `GRPC_TRACE_DLOG`, or `GRPC_TRACE_VLOG` macros to log trace messages.
+
+## Files
+
+*   **`trace.h`**: The public interface to the tracing library.
+*   **`trace_impl.h`**: The implementation of the tracing library.
+*   **`trace_flags.yaml`**: The definition of all of the available trace flags.
+
+## Major Classes
+
+*   `grpc_core::TraceFlag`: Represents a single trace flag.
+
+## Major Macros
+
+*   **`GRPC_TRACE_FLAG_ENABLED(tracer)`**: Checks if a trace flag is enabled. `tracer` is the name of the trace flag, without the `grpc_` prefix.
+*   **`GRPC_TRACE_LOG(tracer, level)`**: Logs a trace message if a trace flag is enabled. This is equivalent to `LOG_IF(level, GRPC_TRACE_FLAG_ENABLED(tracer))`.
+*   **`GRPC_TRACE_DLOG(tracer, level)`**: Logs a trace message in debug builds if a trace flag is enabled. This is equivalent to `DLOG_IF(level, GRPC_TRACE_FLAG_ENABLED(tracer))`.
+*   **`GRPC_TRACE_VLOG(tracer, level)`**: Logs a verbose trace message if a trace flag is enabled. This is equivalent to `if (GRPC_TRACE_FLAG_ENABLED(tracer)) VLOG(level)`.
+
+## Notes
+
+*   Trace flags can be enabled at runtime by setting the `GRPC_TRACE` environment variable to a comma-separated list of trace flag names. For example, `GRPC_TRACE=api,http` will enable the `api` and `http` trace flags.
+*   The special value `all` can be used to enable all trace flags.
+*   Prefixing a trace flag with a `-` will disable it. For example, `GRPC_TRACE=all,-http` will enable all trace flags except for `http`.
+*   The tracing library is a powerful tool for debugging gRPC. It can be used to trace the execution of an RPC, to inspect the contents of messages, and to identify performance bottlenecks.
diff --git a/deps/grpc/src/core/lib/event_engine/GEMINI.md b/deps/grpc/src/core/lib/event_engine/GEMINI.md
new file mode 100644
index 00000000000..e6f64d75a93
--- /dev/null
+++ b/deps/grpc/src/core/lib/event_engine/GEMINI.md
@@ -0,0 +1,31 @@
+# EventEngine
+
+This directory contains the implementation of the gRPC EventEngine.
+
+## Overarching Purpose
+
+The EventEngine is an abstraction layer that provides a consistent interface to the underlying operating system's I/O and threading primitives. It is used by gRPC to perform asynchronous I/O, schedule tasks, and resolve DNS names.
+
+## Files
+
+*   `event_engine.h`: The public interface to the EventEngine. This file is not located in this directory, but in `include/grpc/event_engine/`.
+*   `default_event_engine_factory.h`, `default_event_engine_factory.cc`: These files provide the default, cross-platform implementation of the EventEngine.
+*   `posix_engine`, `windows`, `cf_engine`: These directories contain the platform-specific implementations of the EventEngine.
+
+## Major Classes
+
+*   `grpc_event_engine::experimental::EventEngine`: The abstract base class for an EventEgine.
+*   `grpc_event_engine::experimental::EventEngine::Endpoint`: Represents one end of a connection.
+*   `grpc_event_engine::experimental::EventEngine::Listener`: Used to accept incoming connections.
+*   `grpc_event_engine::experimental::EventEngine::DNSResolver`: Used to resolve DNS names.
+
+## Notes
+
+*   The EventEngine is a key component of gRPC's performance and portability. It allows gRPC to be easily ported to new platforms and to take advantage of the latest I/O and threading features.
+*   Applications can provide their own implementation of the EventEngine by calling `SetEventEngineFactory`. This can be useful for integrating gRPC with an existing event loop or for using a custom network stack.
+*   The EventEngine is a low-level component of the gRPC stack. Most application developers will not need to interact with it directly.
+
+## See also
+
+*   `src/core/lib/iomgr/GEMINI.md`
+    *   The EventEngine is replacing the `iomgr` subsystem.
diff --git a/deps/grpc/src/core/lib/event_engine/ares_resolver.h b/deps/grpc/src/core/lib/event_engine/ares_resolver.h
index 4658163cb5c..895bf0b3ffd 100644
--- a/deps/grpc/src/core/lib/event_engine/ares_resolver.h
+++ b/deps/grpc/src/core/lib/event_engine/ares_resolver.h
@@ -22,8 +22,10 @@
 
 #if GRPC_ARES == 1
 
-#include <ares.h>
 #include <grpc/event_engine/event_engine.h>
+// ares.h is not self-contained w.r.t. windows headers so pull in
+// event_engine.h first
+#include <ares.h>
 
 #include <list>
 #include <memory>
diff --git a/deps/grpc/src/core/lib/event_engine/cf_engine/cf_engine.cc b/deps/grpc/src/core/lib/event_engine/cf_engine/cf_engine.cc
index f93225b3646..80c4f1913be 100644
--- a/deps/grpc/src/core/lib/event_engine/cf_engine/cf_engine.cc
+++ b/deps/grpc/src/core/lib/event_engine/cf_engine/cf_engine.cc
@@ -24,6 +24,7 @@
 #include "absl/log/check.h"
 #include "absl/log/log.h"
 #include "src/core/lib/event_engine/cf_engine/cf_engine.h"
+#include "src/core/lib/event_engine/cf_engine/cfsocket_listener.h"
 #include "src/core/lib/event_engine/cf_engine/cfstream_endpoint.h"
 #include "src/core/lib/event_engine/cf_engine/dns_service_resolver.h"
 #include "src/core/lib/event_engine/posix_engine/timer_manager.h"
@@ -81,11 +82,14 @@ CFEventEngine::~CFEventEngine() {
 
 absl::StatusOr<std::unique_ptr<EventEngine::Listener>>
 CFEventEngine::CreateListener(
-    Listener::AcceptCallback /* on_accept */,
-    absl::AnyInvocable<void(absl::Status)> /* on_shutdown */,
-    const EndpointConfig& /* config */,
-    std::unique_ptr<MemoryAllocatorFactory> /* memory_allocator_factory */) {
-  grpc_core::Crash("unimplemented");
+    Listener::AcceptCallback on_accept,
+    absl::AnyInvocable<void(absl::Status)> on_shutdown,
+    const EndpointConfig& config,
+    std::unique_ptr<MemoryAllocatorFactory> memory_allocator_factory) {
+  return std::make_unique<CFSocketListener>(
+      std::static_pointer_cast<CFEventEngine>(shared_from_this()),
+      std::move(on_accept), std::move(on_shutdown), config,
+      std::move(memory_allocator_factory));
 }
 
 CFEventEngine::ConnectionHandle CFEventEngine::Connect(
diff --git a/deps/grpc/src/core/lib/event_engine/cf_engine/cf_engine.h b/deps/grpc/src/core/lib/event_engine/cf_engine/cf_engine.h
index b488460e152..78f6f99100c 100644
--- a/deps/grpc/src/core/lib/event_engine/cf_engine/cf_engine.h
+++ b/deps/grpc/src/core/lib/event_engine/cf_engine/cf_engine.h
@@ -30,7 +30,7 @@
 
 namespace grpc_event_engine::experimental {
 
-class CFEventEngine : public EventEngine, public Scheduler {
+class CFEventEngine : public EventEngine {
  public:
   CFEventEngine();
   ~CFEventEngine() override;
@@ -57,6 +57,7 @@ class CFEventEngine : public EventEngine, public Scheduler {
   TaskHandle RunAfter(Duration when,
                       absl::AnyInvocable<void()> closure) override;
   bool Cancel(TaskHandle handle) override;
+  ThreadPool* thread_pool() const { return thread_pool_.get(); }
 
  private:
   struct Closure;
diff --git a/deps/grpc/src/core/lib/event_engine/cf_engine/cfsocket_listener.cc b/deps/grpc/src/core/lib/event_engine/cf_engine/cfsocket_listener.cc
new file mode 100644
index 00000000000..a68d7fe594d
--- /dev/null
+++ b/deps/grpc/src/core/lib/event_engine/cf_engine/cfsocket_listener.cc
@@ -0,0 +1,263 @@
+// Copyright 2025 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include <grpc/support/port_platform.h>
+
+#ifdef GPR_APPLE
+#include <AvailabilityMacros.h>
+#ifdef AVAILABLE_MAC_OS_X_VERSION_10_12_AND_LATER
+
+#include <netinet/in.h>
+#include <sys/socket.h>
+
+#include "src/core/lib/debug/trace_flags.h"
+#include "src/core/lib/debug/trace_impl.h"
+#include "src/core/lib/event_engine/cf_engine/cfsocket_listener.h"
+#include "src/core/lib/event_engine/cf_engine/cfstream_endpoint.h"
+#include "src/core/lib/event_engine/tcp_socket_utils.h"
+#include "src/core/util/strerror.h"
+
+namespace grpc_event_engine::experimental {
+
+namespace {
+
+auto GetCfSocketResolvedAddress6(CFSocketRef ipv6cfsock) {
+  CFTypeUniqueRef<CFDataRef> sin6cfd = CFSocketCopyAddress(ipv6cfsock);
+  auto sin6 = reinterpret_cast<const sockaddr*>(CFDataGetBytePtr(sin6cfd));
+  return EventEngine::ResolvedAddress{sin6, sin6->sa_len};
+}
+
+}  // namespace
+
+CFSocketListenerImpl::CFSocketListenerImpl(
+    std::shared_ptr<CFEventEngine> engine,
+    EventEngine::Listener::AcceptCallback on_accept,
+    absl::AnyInvocable<void(absl::Status)> on_shutdown,
+    const EndpointConfig& config,
+    std::unique_ptr<MemoryAllocatorFactory> memory_allocator_factory)
+    : engine_(std::move(engine)),
+      on_accept_(std::move(on_accept)),
+      on_shutdown_(std::move(on_shutdown)),
+      memory_allocator_factory_(std::move(memory_allocator_factory)) {}
+
+CFSocketListenerImpl::~CFSocketListenerImpl() {
+  on_shutdown_(absl::OkStatus());
+  dispatch_release(queue_);
+
+  GRPC_TRACE_LOG(event_engine, INFO)
+      << "CFSocketListenerImpl::~CFSocketListenerImpl, this: " << this;
+}
+
+void CFSocketListenerImpl::Shutdown() {
+  GRPC_TRACE_LOG(event_engine, INFO)
+      << "CFSocketListenerImpl::Shutdown: this: " << this;
+
+  grpc_core::MutexLock lock(&mu_);
+
+  shutdown_ = true;
+  for (auto& [ipv6cfsock] : ipv6cfsocks_) {
+    CFSocketInvalidate(ipv6cfsock);
+  }
+  if (runloop_) {
+    CFRunLoopWakeUp(runloop_);
+    CFRunLoopStop(runloop_);
+  }
+}
+
+absl::StatusOr<int> CFSocketListenerImpl::Bind(
+    const EventEngine::ResolvedAddress& addr) {
+  grpc_core::MutexLock lock(&mu_);
+
+  if (started_) {
+    return absl::FailedPreconditionError(
+        "Listener is already started, ports can no longer be bound");
+  }
+  CHECK(addr.size() <= EventEngine::ResolvedAddress::MAX_SIZE_BYTES);
+
+  int port = ResolvedAddressGetPort(addr);
+  // if port is not specified, reuse any listening port
+  if (port == 0) {
+    for (auto& [ipv6cfsock] : ipv6cfsocks_) {
+      auto bind_addr = GetCfSocketResolvedAddress6(ipv6cfsock);
+      int bind_port = ResolvedAddressGetPort(bind_addr);
+      if (bind_port > 0) {
+        port = bind_port;
+        break;
+      }
+    }
+  }
+
+  EventEngine::ResolvedAddress addr6;
+  // treat :: or 0.0.0.0 as a family-agnostic wildcard.
+  if (MaybeGetWildcardPortFromAddress(addr).has_value()) {
+    addr6 = ResolvedAddressMakeWild6(port);
+  }
+  // convert to ipv6 if needed
+  if (!ResolvedAddressToV4Mapped(addr, &addr6)) {
+    addr6 = addr;
+  }
+  // update port
+  ResolvedAddressSetPort(addr6, port);
+
+  // open socket
+  CFSocketContext ipv6cfsock_context = {0, this, Retain, Release, nullptr};
+  auto ipv6cfsock = CFSocketCreate(kCFAllocatorDefault, PF_INET6, SOCK_STREAM,
+                                   IPPROTO_TCP, kCFSocketAcceptCallBack,
+                                   handleConnect, &ipv6cfsock_context);
+
+  // allow reuse of the address and port
+  auto sin6_fd = CFSocketGetNative(ipv6cfsock);
+  int sock_flag = 1;
+  int err = setsockopt(sin6_fd, SOL_SOCKET, SO_REUSEADDR, &sock_flag,
+                       sizeof(sock_flag));
+  if (err != 0) {
+    return absl::InternalError(absl::StrCat(
+        "CFSocketListenerImpl::Bind, setsockopt(SO_REUSEADDR) errors: ",
+        grpc_core::StrError(errno)));
+  }
+  err = setsockopt(sin6_fd, SOL_SOCKET, SO_REUSEPORT, &sock_flag,
+                   sizeof(sock_flag));
+  if (err != 0) {
+    return absl::InternalError(absl::StrCat(
+        "CFSocketListenerImpl::Bind, setsockopt(SO_REUSEPORT) errors: ",
+        grpc_core::StrError(errno)));
+  }
+
+  // bind socket to address
+  CFTypeUniqueRef<CFDataRef> sin6cfd =
+      CFDataCreate(kCFAllocatorDefault, (UInt8*)addr6.address(), addr6.size());
+  CFSocketError cf_error = CFSocketSetAddress(ipv6cfsock, sin6cfd);
+  if (cf_error != kCFSocketSuccess) {
+    return absl::InternalError(absl::StrCat(
+        "CFSocketListenerImpl::Bind, CFSocketSetAddress error: ", cf_error));
+  }
+
+  // find actual bind address and port
+  auto bind_addr = GetCfSocketResolvedAddress6(ipv6cfsock);
+  int bind_port = ResolvedAddressGetPort(bind_addr);
+
+  ipv6cfsocks_.emplace_back(ipv6cfsock);
+
+  GRPC_TRACE_LOG(event_engine, INFO)
+      << "CFSocketListenerImpl::Bind, addr: "
+      << ResolvedAddressToString(addr).value_or("")
+      << ", bind_addr: " << ResolvedAddressToString(bind_addr).value_or("")
+      << ", this: " << this;
+
+  return bind_port;
+}
+
+absl::Status CFSocketListenerImpl::Start() {
+  grpc_core::MutexLock lock(&mu_);
+
+  CHECK(!started_);
+  started_ = true;
+
+  dispatch_async_f(queue_, Ref().release(), [](void* thatPtr) {
+    grpc_core::RefCountedPtr<CFSocketListenerImpl> that{
+        static_cast<CFSocketListenerImpl*>(thatPtr)};
+
+    GRPC_TRACE_LOG(event_engine, INFO)
+        << "CFSocketListenerImpl::Start, running CFRunLoop"
+        << ", this: " << thatPtr;
+
+    {
+      grpc_core::MutexLock lock(&that->mu_);
+      if (that->shutdown_) {
+        return;
+      }
+
+      that->runloop_ = CFRunLoopGetCurrent();
+      for (auto& [ipv6cfsock] : that->ipv6cfsocks_) {
+        CFTypeUniqueRef<CFRunLoopSourceRef> ipv6cfsock_source =
+            CFSocketCreateRunLoopSource(kCFAllocatorDefault, ipv6cfsock, 0);
+        CFRunLoopAddSource(CFRunLoopGetCurrent(), ipv6cfsock_source,
+                           kCFRunLoopDefaultMode);
+      }
+    }
+
+    CFRunLoopRun();
+
+    GRPC_TRACE_LOG(event_engine, INFO)
+        << "CFSocketListenerImpl::Start, CFRunLoop stopped"
+        << ", this: " << thatPtr;
+  });
+
+  return absl::OkStatus();
+}
+
+/* static */
+void CFSocketListenerImpl::handleConnect(CFSocketRef s,
+                                         CFSocketCallBackType type,
+                                         CFDataRef address, const void* data,
+                                         void* info) {
+  CFSocketListenerImpl* self = static_cast<CFSocketListenerImpl*>(info);
+
+  switch (type) {
+    case kCFSocketAcceptCallBack: {
+      std::string peer_name = "unknown";
+      auto peer_sin6 =
+          reinterpret_cast<const sockaddr*>(CFDataGetBytePtr(address));
+      auto peer_addr =
+          EventEngine::ResolvedAddress(peer_sin6, peer_sin6->sa_len);
+      auto addr_uri = ResolvedAddressToURI(peer_addr);
+      if (!addr_uri.ok()) {
+        GRPC_TRACE_LOG(event_engine, ERROR)
+            << "invalid peer name: " << addr_uri.status() << ", this: " << self;
+      } else {
+        peer_name = *addr_uri;
+      }
+
+      auto socketHandle = *static_cast<const CFSocketNativeHandle*>(data);
+      auto endpoint = std::make_unique<CFStreamEndpoint>(
+          self->engine_,
+          self->memory_allocator_factory_->CreateMemoryAllocator(
+              absl::StrCat("endpoint-tcp-server-connection: ", peer_name)));
+
+      endpoint->AcceptSocket(
+          [that = self->Ref(), socketHandle, peer_name = std::move(peer_name),
+           endpoint = std::move(endpoint)](absl::Status status) mutable {
+            if (!status.ok()) {
+              GRPC_TRACE_LOG(event_engine, ERROR)
+                  << "CFSocketListenerImpl::handleConnect, accept failed: "
+                  << status << ", this: " << that.get();
+              return;
+            }
+
+            that->on_accept_(
+                std::move(endpoint),
+                that->memory_allocator_factory_->CreateMemoryAllocator(
+                    absl::StrCat("on-accept-tcp-server-connection: ",
+                                 peer_name)));
+            GRPC_TRACE_LOG(event_engine, INFO)
+                << "CFSocketListenerImpl::handleConnect, accepted socket: "
+                << socketHandle << ", peer_name: " << peer_name
+                << ", this: " << that.get();
+          },
+          socketHandle, peer_addr);
+
+      break;
+    }
+    default:
+      GRPC_TRACE_LOG(event_engine, ERROR)
+          << "CFSocketListenerImpl::handleConnect, unexpected type: " << type
+          << ", this: " << self;
+      break;
+  }
+}
+
+}  // namespace grpc_event_engine::experimental
+
+#endif  // AVAILABLE_MAC_OS_X_VERSION_10_12_AND_LATER
+#endif  // GPR_APPLE
diff --git a/deps/grpc/src/core/lib/event_engine/cf_engine/cfsocket_listener.h b/deps/grpc/src/core/lib/event_engine/cf_engine/cfsocket_listener.h
new file mode 100644
index 00000000000..f4ad8fc487e
--- /dev/null
+++ b/deps/grpc/src/core/lib/event_engine/cf_engine/cfsocket_listener.h
@@ -0,0 +1,107 @@
+// Copyright 2025 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+#ifndef GRPC_SRC_CORE_LIB_EVENT_ENGINE_CF_ENGINE_CFSOCKET_LISTENER_H
+#define GRPC_SRC_CORE_LIB_EVENT_ENGINE_CF_ENGINE_CFSOCKET_LISTENER_H
+#include <grpc/support/port_platform.h>
+
+#ifdef GPR_APPLE
+#include <AvailabilityMacros.h>
+#ifdef AVAILABLE_MAC_OS_X_VERSION_10_12_AND_LATER
+
+#include <CoreFoundation/CoreFoundation.h>
+#include <grpc/event_engine/event_engine.h>
+
+#include "src/core/lib/event_engine/cf_engine/cf_engine.h"
+#include "src/core/lib/event_engine/cf_engine/cftype_unique_ref.h"
+#include "src/core/util/ref_counted.h"
+#include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/sync.h"
+
+namespace grpc_event_engine::experimental {
+
+class CFSocketListenerImpl
+    : public grpc_core::RefCounted<CFSocketListenerImpl> {
+ public:
+  CFSocketListenerImpl(
+      std::shared_ptr<CFEventEngine> engine,
+      EventEngine::Listener::AcceptCallback on_accept,
+      absl::AnyInvocable<void(absl::Status)> on_shutdown,
+      const EndpointConfig& config,
+      std::unique_ptr<MemoryAllocatorFactory> memory_allocator_factory);
+  ~CFSocketListenerImpl();
+
+  absl::StatusOr<int> Bind(const EventEngine::ResolvedAddress& addr);
+  absl::Status Start();
+
+  void Shutdown();
+
+ private:
+  static const void* Retain(const void* info) {
+    auto that = static_cast<const CFSocketListenerImpl*>(info);
+    return that->Ref().release();
+  }
+
+  static void Release(const void* info) {
+    auto that = static_cast<const CFSocketListenerImpl*>(info);
+    that->Unref();
+  }
+
+  static void handleConnect(CFSocketRef s, CFSocketCallBackType type,
+                            CFDataRef address, const void* data, void* info);
+
+ private:
+  std::shared_ptr<CFEventEngine> engine_;
+  dispatch_queue_t queue_ = dispatch_queue_create("cfsocket_listener", nullptr);
+
+  grpc_core::Mutex mu_;
+  bool started_ ABSL_GUARDED_BY(mu_) = false;
+  bool shutdown_ ABSL_GUARDED_BY(mu_) = false;
+  std::vector<std::tuple<CFTypeUniqueRef<CFSocketRef>>> ipv6cfsocks_
+      ABSL_GUARDED_BY(mu_);
+  CFRunLoopRef runloop_ ABSL_GUARDED_BY(mu_);
+
+  EventEngine::Listener::AcceptCallback on_accept_;
+  absl::AnyInvocable<void(absl::Status)> on_shutdown_;
+  std::unique_ptr<MemoryAllocatorFactory> memory_allocator_factory_;
+};
+
+class CFSocketListener : public EventEngine::Listener {
+ public:
+  CFSocketListener(
+      std::shared_ptr<CFEventEngine> engine, Listener::AcceptCallback on_accept,
+      absl::AnyInvocable<void(absl::Status)> on_shutdown,
+      const EndpointConfig& config,
+      std::unique_ptr<MemoryAllocatorFactory> memory_allocator_factory)
+      : impl_(grpc_core::MakeRefCounted<CFSocketListenerImpl>(
+            std::move(engine), std::move(on_accept), std::move(on_shutdown),
+            config, std::move(memory_allocator_factory))) {}
+
+  ~CFSocketListener() override { impl_->Shutdown(); }
+
+  absl::StatusOr<int> Bind(const EventEngine::ResolvedAddress& addr) override {
+    return impl_->Bind(addr);
+  };
+
+  absl::Status Start() override { return impl_->Start(); };
+
+ private:
+  grpc_core::RefCountedPtr<CFSocketListenerImpl> impl_;
+};
+
+}  // namespace grpc_event_engine::experimental
+
+#endif  // AVAILABLE_MAC_OS_X_VERSION_10_12_AND_LATER
+#endif  // GPR_APPLE
+
+#endif  // GRPC_SRC_CORE_LIB_EVENT_ENGINE_CF_ENGINE_CFSOCKET_LISTENER_H
diff --git a/deps/grpc/src/core/lib/event_engine/cf_engine/cfstream_endpoint.cc b/deps/grpc/src/core/lib/event_engine/cf_engine/cfstream_endpoint.cc
index 8b9e30a1243..c7694ecd13d 100644
--- a/deps/grpc/src/core/lib/event_engine/cf_engine/cfstream_endpoint.cc
+++ b/deps/grpc/src/core/lib/event_engine/cf_engine/cfstream_endpoint.cc
@@ -72,6 +72,26 @@ bool CFStreamEndpointImpl::CancelConnect(absl::Status status) {
   return open_event_.SetShutdown(std::move(status));
 }
 
+void CFStreamEndpointImpl::AcceptSocket(
+    absl::AnyInvocable<void(absl::Status)> on_connect,
+    CFSocketNativeHandle sock, const EventEngine::ResolvedAddress& addr) {
+  peer_address_ = addr;
+  auto host_port = ResolvedAddressToNormalizedString(peer_address_);
+  if (!host_port.ok()) {
+    on_connect(std::move(host_port).status());
+    return;
+  }
+
+  peer_address_string_ = host_port.value();
+  GRPC_TRACE_LOG(event_engine_endpoint, INFO)
+      << "CFStreamEndpointImpl::AcceptSocket, host_port: "
+      << peer_address_string_;
+
+  CFStreamCreatePairWithSocket(nullptr, sock, &cf_read_stream_,
+                               &cf_write_stream_);
+  SetupStreams(std::move(on_connect));
+}
+
 void CFStreamEndpointImpl::Connect(
     absl::AnyInvocable<void(absl::Status)> on_connect,
     EventEngine::ResolvedAddress addr) {
@@ -105,6 +125,11 @@ void CFStreamEndpointImpl::Connect(
   CFStreamCreatePairWithSocketToHost(NULL, host, port, &cf_read_stream_,
                                      &cf_write_stream_);
 
+  SetupStreams(std::move(on_connect));
+}
+
+void CFStreamEndpointImpl::SetupStreams(
+    absl::AnyInvocable<void(absl::Status)> on_connect) {
   CFStreamClientContext cf_context = {0, this, Retain, Release, nullptr};
   CFReadStreamSetClient(
       cf_read_stream_,
@@ -223,9 +248,9 @@ CFStreamEndpointImpl::CFStreamEndpointImpl(
     std::shared_ptr<CFEventEngine> engine, MemoryAllocator memory_allocator)
     : engine_(std::move(engine)),
       memory_allocator_(std::move(memory_allocator)),
-      open_event_(engine_.get()),
-      read_event_(engine_.get()),
-      write_event_(engine_.get()) {
+      open_event_(engine_->thread_pool()),
+      read_event_(engine_->thread_pool()),
+      write_event_(engine_->thread_pool()) {
   open_event_.InitEvent();
   read_event_.InitEvent();
   write_event_.InitEvent();
@@ -235,6 +260,9 @@ CFStreamEndpointImpl::~CFStreamEndpointImpl() {
   open_event_.DestroyEvent();
   read_event_.DestroyEvent();
   write_event_.DestroyEvent();
+
+  GRPC_TRACE_LOG(event_engine_endpoint, INFO)
+      << "CFStreamEndpointImpl::~CFStreamEndpointImpl: this: " << this;
 }
 
 void CFStreamEndpointImpl::Shutdown() {
diff --git a/deps/grpc/src/core/lib/event_engine/cf_engine/cfstream_endpoint.h b/deps/grpc/src/core/lib/event_engine/cf_engine/cfstream_endpoint.h
index 517a5c2ba26..b13e48efff3 100644
--- a/deps/grpc/src/core/lib/event_engine/cf_engine/cfstream_endpoint.h
+++ b/deps/grpc/src/core/lib/event_engine/cf_engine/cfstream_endpoint.h
@@ -60,7 +60,13 @@ class CFStreamEndpointImpl
                EventEngine::ResolvedAddress addr);
   bool CancelConnect(absl::Status status);
 
+  void AcceptSocket(absl::AnyInvocable<void(absl::Status)> on_connect,
+                    CFSocketNativeHandle sock,
+                    const EventEngine::ResolvedAddress& addr);
+
  private:
+  void SetupStreams(absl::AnyInvocable<void(absl::Status)> on_connect);
+
   void DoWrite(absl::AnyInvocable<void(absl::Status)> on_writable,
                SliceBuffer* data);
   void DoRead(absl::AnyInvocable<void(absl::Status)> on_read,
@@ -137,6 +143,12 @@ class CFStreamEndpoint : public EventEngine::Endpoint {
     return impl_->CancelConnect(std::move(status));
   }
 
+  void AcceptSocket(absl::AnyInvocable<void(absl::Status)> on_connect,
+                    CFSocketNativeHandle sock,
+                    const EventEngine::ResolvedAddress& addr) {
+    return impl_->AcceptSocket(std::move(on_connect), sock, addr);
+  }
+
  private:
   grpc_core::RefCountedPtr<CFStreamEndpointImpl> impl_;
 };
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/ev_epoll1_linux.cc b/deps/grpc/src/core/lib/event_engine/posix_engine/ev_epoll1_linux.cc
index d8e00dd1ec0..8adbae3fef5 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/ev_epoll1_linux.cc
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/ev_epoll1_linux.cc
@@ -60,9 +60,9 @@ class Epoll1EventHandle : public EventHandle {
   Epoll1EventHandle(const FileDescriptor& fd, Epoll1Poller* poller)
       : fd_(fd),
         poller_(poller),
-        read_closure_(poller->GetScheduler()),
-        write_closure_(poller->GetScheduler()),
-        error_closure_(poller->GetScheduler()) {
+        read_closure_(poller->GetThreadPool()),
+        write_closure_(poller->GetThreadPool()),
+        error_closure_(poller->GetThreadPool()) {
     read_closure_.InitEvent();
     write_closure_.InitEvent();
     error_closure_.InitEvent();
@@ -217,7 +217,7 @@ void Epoll1EventHandle::OrphanHandle(PosixEngineClosure* on_done,
   }
   if (on_done != nullptr) {
     on_done->SetStatus(absl::OkStatus());
-    poller_->GetScheduler()->Run(on_done);
+    poller_->GetThreadPool()->Run(on_done);
   }
 }
 
@@ -243,8 +243,8 @@ void Epoll1EventHandle::HandleShutdownInternal(absl::Status why,
   }
 }
 
-Epoll1Poller::Epoll1Poller(Scheduler* scheduler)
-    : scheduler_(scheduler), was_kicked_(false), closed_(false) {
+Epoll1Poller::Epoll1Poller(std::shared_ptr<ThreadPool> thread_pool)
+    : thread_pool_(thread_pool), was_kicked_(false), closed_(false) {
   g_epoll_set_.epfd = posix_interface().EpollCreateAndCloexec().value();
   wakeup_fd_ = CreateWakeupFd(&posix_interface()).value();
   CHECK(wakeup_fd_ != nullptr);
@@ -493,10 +493,11 @@ void Epoll1Poller::ResetKickState() {
   was_kicked_ = false;
 }
 
-std::shared_ptr<Epoll1Poller> MakeEpoll1Poller(Scheduler* scheduler) {
+std::shared_ptr<Epoll1Poller> MakeEpoll1Poller(
+    std::shared_ptr<ThreadPool> thread_pool) {
   static bool kEpoll1PollerSupported = InitEpoll1PollerLinux();
   if (kEpoll1PollerSupported) {
-    return std::make_shared<Epoll1Poller>(scheduler);
+    return std::make_shared<Epoll1Poller>(std::move(thread_pool));
   }
   return nullptr;
 }
@@ -511,7 +512,7 @@ namespace grpc_event_engine::experimental {
 using ::grpc_event_engine::experimental::EventEngine;
 using ::grpc_event_engine::experimental::Poller;
 
-Epoll1Poller::Epoll1Poller(Scheduler* /* engine */) {
+Epoll1Poller::Epoll1Poller(std::shared_ptr<ThreadPool> /* thread_pool */) {
   grpc_core::Crash("unimplemented");
 }
 
@@ -548,7 +549,8 @@ void Epoll1Poller::ResetKickState() { grpc_core::Crash("unimplemented"); }
 
 // If GRPC_LINUX_EPOLL is not defined, it means epoll is not available. Return
 // nullptr.
-std::shared_ptr<Epoll1Poller> MakeEpoll1Poller(Scheduler* /*scheduler*/) {
+std::shared_ptr<Epoll1Poller> MakeEpoll1Poller(
+    std::shared_ptr<ThreadPool> /*thread_pool*/) {
   return nullptr;
 }
 
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/ev_epoll1_linux.h b/deps/grpc/src/core/lib/event_engine/posix_engine/ev_epoll1_linux.h
index d3f48eeef5a..a432864ae42 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/ev_epoll1_linux.h
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/ev_epoll1_linux.h
@@ -30,6 +30,7 @@
 #include "src/core/lib/event_engine/posix_engine/event_poller.h"
 #include "src/core/lib/event_engine/posix_engine/internal_errqueue.h"
 #include "src/core/lib/event_engine/posix_engine/wakeup_fd_posix.h"
+#include "src/core/lib/event_engine/thread_pool/thread_pool.h"
 #include "src/core/lib/iomgr/port.h"
 #include "src/core/util/sync.h"
 
@@ -46,7 +47,7 @@ class Epoll1EventHandle;
 // Definition of epoll1 based poller.
 class Epoll1Poller : public PosixEventPoller {
  public:
-  explicit Epoll1Poller(Scheduler* scheduler);
+  explicit Epoll1Poller(std::shared_ptr<ThreadPool> thread_pool);
   EventHandle* CreateHandle(FileDescriptor fd, absl::string_view name,
                             bool track_err) override;
   Poller::WorkResult Work(
@@ -54,7 +55,7 @@ class Epoll1Poller : public PosixEventPoller {
       absl::FunctionRef<void()> schedule_poll_again) override;
   std::string Name() override { return "epoll1"; }
   void Kick() override;
-  Scheduler* GetScheduler() { return scheduler_; }
+  ThreadPool* GetThreadPool() { return thread_pool_.get(); }
   bool CanTrackErrors() const override {
 #ifdef GRPC_POSIX_SOCKET_TCP
     return KernelSupportsErrqueue();
@@ -109,7 +110,7 @@ class Epoll1Poller : public PosixEventPoller {
   struct EpollSet {};
 #endif
   grpc_core::Mutex mu_;
-  Scheduler* scheduler_;
+  std::shared_ptr<ThreadPool> thread_pool_;
   // A singleton epoll set
   EpollSet g_epoll_set_;
   bool was_kicked_ ABSL_GUARDED_BY(mu_);
@@ -123,7 +124,8 @@ class Epoll1Poller : public PosixEventPoller {
 
 // Return an instance of a epoll1 based poller tied to the specified event
 // engine.
-std::shared_ptr<Epoll1Poller> MakeEpoll1Poller(Scheduler* scheduler);
+std::shared_ptr<Epoll1Poller> MakeEpoll1Poller(
+    std::shared_ptr<ThreadPool> thread_pool);
 
 }  // namespace grpc_event_engine::experimental
 
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/ev_poll_posix.cc b/deps/grpc/src/core/lib/event_engine/posix_engine/ev_poll_posix.cc
index a54b418fd53..f354c61e126 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/ev_poll_posix.cc
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/ev_poll_posix.cc
@@ -72,7 +72,7 @@ class PollEventHandle : public EventHandle {
       : fd_(fd),
         pending_actions_(0),
         poller_handles_list_(this),
-        scheduler_(poller->GetScheduler()),
+        thread_pool_(poller->GetThreadPool()),
         poller_(std::move(poller)),
         is_orphaned_(false),
         is_shutdown_(false),
@@ -175,7 +175,7 @@ class PollEventHandle : public EventHandle {
   void Unref() {
     if (ref_count_.fetch_sub(1, std::memory_order_acq_rel) == 1) {
       if (on_done_ != nullptr) {
-        scheduler_->Run(on_done_);
+        thread_pool_->Run(on_done_);
       }
       delete this;
     }
@@ -200,7 +200,7 @@ class PollEventHandle : public EventHandle {
   FileDescriptor fd_;
   int pending_actions_;
   PollPoller::HandlesList poller_handles_list_;
-  Scheduler* scheduler_;
+  ThreadPool* thread_pool_;
   std::shared_ptr<PollPoller> poller_;
   bool is_orphaned_;
   bool is_shutdown_;
@@ -293,7 +293,7 @@ int PollEventHandle::NotifyOnLocked(PosixEngineClosure** st,
                                     PosixEngineClosure* closure) {
   if (is_shutdown_ || pollhup_) {
     closure->SetStatus(shutdown_error_);
-    scheduler_->Run(closure);
+    thread_pool_->Run(closure);
   } else if (*st == reinterpret_cast<PosixEngineClosure*>(kClosureNotReady)) {
     // not ready ==> switch to a waiting state by setting the closure
     *st = closure;
@@ -302,7 +302,7 @@ int PollEventHandle::NotifyOnLocked(PosixEngineClosure** st,
     // already ready ==> queue the closure to run immediately
     *st = reinterpret_cast<PosixEngineClosure*>(kClosureNotReady);
     closure->SetStatus(shutdown_error_);
-    scheduler_->Run(closure);
+    thread_pool_->Run(closure);
     return 1;
   } else {
     // upcallptr was set to a different closure.  This is an error!
@@ -327,7 +327,7 @@ int PollEventHandle::SetReadyLocked(PosixEngineClosure** st) {
     PosixEngineClosure* closure = *st;
     *st = reinterpret_cast<PosixEngineClosure*>(kClosureNotReady);
     closure->SetStatus(shutdown_error_);
-    scheduler_->Run(closure);
+    thread_pool_->Run(closure);
     return 1;
   }
 }
@@ -402,7 +402,7 @@ void PollEventHandle::NotifyOnError(PosixEngineClosure* on_error) {
   on_error->SetStatus(
       absl::Status(absl::StatusCode::kCancelled,
                    "Polling engine does not support tracking errors"));
-  scheduler_->Run(on_error);
+  thread_pool_->Run(on_error);
 }
 
 void PollEventHandle::SetReadable() {
@@ -503,8 +503,9 @@ void PollPoller::PollerHandlesListRemoveHandle(PollEventHandle* handle) {
   --num_poll_handles_;
 }
 
-PollPoller::PollPoller(Scheduler* scheduler, bool use_phony_poll)
-    : scheduler_(scheduler),
+PollPoller::PollPoller(std::shared_ptr<ThreadPool> thread_pool,
+                       bool use_phony_poll)
+    : thread_pool_(std::move(thread_pool)),
       use_phony_poll_(use_phony_poll),
       was_kicked_(false),
       was_kicked_ext_(false),
@@ -752,12 +753,12 @@ void PollPoller::ResetKickState() {
   was_kicked_ext_ = false;
 }
 
-std::shared_ptr<PollPoller> MakePollPoller(Scheduler* scheduler,
-                                           bool use_phony_poll) {
+std::shared_ptr<PollPoller> MakePollPoller(
+    std::shared_ptr<ThreadPool> thread_pool, bool use_phony_poll) {
   static bool kPollPollerSupported =
       grpc_event_engine::experimental::SupportsWakeupFd();
   if (kPollPollerSupported) {
-    return std::make_shared<PollPoller>(scheduler, use_phony_poll);
+    return std::make_shared<PollPoller>(std::move(thread_pool), use_phony_poll);
   }
   return nullptr;
 }
@@ -788,8 +789,8 @@ void PollPoller::Kick() { grpc_core::Crash("unimplemented"); }
 
 // If GRPC_LINUX_EPOLL is not defined, it means epoll is not available. Return
 // nullptr.
-std::shared_ptr<PollPoller> MakePollPoller(Scheduler* /*scheduler*/,
-                                           bool /* use_phony_poll */) {
+std::shared_ptr<PollPoller> MakePollPoller(
+    std::shared_ptr<ThreadPool> /*thread_pool*/, bool /* use_phony_poll */) {
   return nullptr;
 }
 
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/ev_poll_posix.h b/deps/grpc/src/core/lib/event_engine/posix_engine/ev_poll_posix.h
index 166e18c3bda..b888f389a2c 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/ev_poll_posix.h
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/ev_poll_posix.h
@@ -27,6 +27,7 @@
 #include "src/core/lib/event_engine/poller.h"
 #include "src/core/lib/event_engine/posix_engine/event_poller.h"
 #include "src/core/lib/event_engine/posix_engine/wakeup_fd_posix.h"
+#include "src/core/lib/event_engine/thread_pool/thread_pool.h"
 #include "src/core/util/sync.h"
 
 namespace grpc_event_engine::experimental {
@@ -37,7 +38,8 @@ class PollEventHandle;
 class PollPoller : public PosixEventPoller,
                    public std::enable_shared_from_this<PollPoller> {
  public:
-  explicit PollPoller(Scheduler* scheduler, bool use_phony_poll = false);
+  explicit PollPoller(std::shared_ptr<ThreadPool> thread_pool,
+                      bool use_phony_poll = false);
   EventHandle* CreateHandle(FileDescriptor fd, absl::string_view name,
                             bool track_err) override;
   Poller::WorkResult Work(
@@ -45,7 +47,7 @@ class PollPoller : public PosixEventPoller,
       absl::FunctionRef<void()> schedule_poll_again) override;
   std::string Name() override { return "poll"; }
   void Kick() override;
-  Scheduler* GetScheduler() { return scheduler_; }
+  ThreadPool* GetThreadPool() { return thread_pool_.get(); }
   bool CanTrackErrors() const override { return false; }
   ~PollPoller() override;
 
@@ -71,7 +73,7 @@ class PollPoller : public PosixEventPoller,
     PollEventHandle* prev = nullptr;
   };
   grpc_core::Mutex mu_;
-  Scheduler* scheduler_;
+  std::shared_ptr<ThreadPool> thread_pool_;
   bool use_phony_poll_;
   bool was_kicked_ ABSL_GUARDED_BY(mu_);
   bool was_kicked_ext_ ABSL_GUARDED_BY(mu_);
@@ -85,8 +87,8 @@ class PollPoller : public PosixEventPoller,
 // It use_phony_poll is true, it implies that the poller is declared
 // non-polling and any attempt to schedule a blocking poll will result in a
 // crash failure.
-std::shared_ptr<PollPoller> MakePollPoller(Scheduler* scheduler,
-                                           bool use_phony_poll);
+std::shared_ptr<PollPoller> MakePollPoller(
+    std::shared_ptr<ThreadPool> thread_pool, bool use_phony_poll);
 
 }  // namespace grpc_event_engine::experimental
 
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/event_poller.h b/deps/grpc/src/core/lib/event_engine/posix_engine/event_poller.h
index 43eeecef2ad..c4a9e517e1a 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/event_poller.h
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/event_poller.h
@@ -19,7 +19,6 @@
 
 #include <string>
 
-#include "absl/functional/any_invocable.h"
 #include "absl/status/status.h"
 #include "absl/strings/string_view.h"
 #include "src/core/lib/event_engine/poller.h"
@@ -28,13 +27,6 @@
 
 namespace grpc_event_engine::experimental {
 
-class Scheduler {
- public:
-  virtual void Run(experimental::EventEngine::Closure* closure) = 0;
-  virtual void Run(absl::AnyInvocable<void()>) = 0;
-  virtual ~Scheduler() = default;
-};
-
 class PosixEventPoller;
 
 class EventHandle {
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/event_poller_posix_default.cc b/deps/grpc/src/core/lib/event_engine/posix_engine/event_poller_posix_default.cc
index 78f4e5edd1d..0dd03e824f3 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/event_poller_posix_default.cc
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/event_poller_posix_default.cc
@@ -15,6 +15,7 @@
 #include <grpc/support/port_platform.h>
 
 #include <memory>
+#include <utility>
 
 #include "absl/strings/str_split.h"
 #include "absl/strings/string_view.h"
@@ -34,22 +35,26 @@ bool PollStrategyMatches(absl::string_view strategy, absl::string_view want) {
 }
 }  // namespace
 
-std::shared_ptr<PosixEventPoller> MakeDefaultPoller(Scheduler* scheduler) {
+std::shared_ptr<PosixEventPoller> MakeDefaultPoller(
+    std::shared_ptr<ThreadPool> thread_pool) {
+  // Note that Make*Poller are allowed to return nullptr - e.g. MakeEpoll1Poller
+  // would return nullptr if an epoll poller is requested on unsupported
+  // platform.
   std::shared_ptr<PosixEventPoller> poller;
   auto strings =
       absl::StrSplit(grpc_core::ConfigVars::Get().PollStrategy(), ',');
   for (auto it = strings.begin(); it != strings.end() && poller == nullptr;
        it++) {
     if (PollStrategyMatches(*it, "epoll1")) {
-      poller = MakeEpoll1Poller(scheduler);
+      poller = MakeEpoll1Poller(thread_pool);
     }
     if (poller == nullptr && PollStrategyMatches(*it, "poll")) {
       // If epoll1 fails and if poll strategy matches "poll", use Poll poller
-      poller = MakePollPoller(scheduler, /*use_phony_poll=*/false);
+      poller = MakePollPoller(thread_pool, /*use_phony_poll=*/false);
     } else if (poller == nullptr && PollStrategyMatches(*it, "none")) {
       // If epoll1 fails and if poll strategy matches "none", use phony poll
       // poller.
-      poller = MakePollPoller(scheduler, /*use_phony_poll=*/true);
+      poller = MakePollPoller(thread_pool, /*use_phony_poll=*/true);
     }
   }
   return poller;
@@ -57,7 +62,8 @@ std::shared_ptr<PosixEventPoller> MakeDefaultPoller(Scheduler* scheduler) {
 
 #else  // GRPC_POSIX_SOCKET_TCP
 
-std::shared_ptr<PosixEventPoller> MakeDefaultPoller(Scheduler* /*scheduler*/) {
+std::shared_ptr<PosixEventPoller> MakeDefaultPoller(
+    std::shared_ptr<ThreadPool> /*thread_pool*/) {
   return nullptr;
 }
 
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/event_poller_posix_default.h b/deps/grpc/src/core/lib/event_engine/posix_engine/event_poller_posix_default.h
index 6dfa897a24e..dd7945eab14 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/event_poller_posix_default.h
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/event_poller_posix_default.h
@@ -22,11 +22,12 @@
 namespace grpc_event_engine::experimental {
 
 class PosixEventPoller;
-class Scheduler;
+class ThreadPool;
 
 // Return an instance of an event poller which is tied to the specified
 // scheduler.
-std::shared_ptr<PosixEventPoller> MakeDefaultPoller(Scheduler* scheduler);
+std::shared_ptr<PosixEventPoller> MakeDefaultPoller(
+    std::shared_ptr<ThreadPool> thread_pool);
 
 }  // namespace grpc_event_engine::experimental
 
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/grpc_polled_fd_posix.h b/deps/grpc/src/core/lib/event_engine/posix_engine/grpc_polled_fd_posix.h
index 6e312e90731..f17b390638c 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/grpc_polled_fd_posix.h
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/grpc_polled_fd_posix.h
@@ -118,6 +118,7 @@ class GrpcPolledFdFactoryPosix : public GrpcPolledFdFactory {
       ares_socket_t as) override {
     grpc_core::MutexLock lock(&mu_);
     owned_fds_.insert(as);
+    CHECK_NE(poller_, nullptr);
     FileDescriptor fd(as, poller_->posix_interface().generation());
     return std::make_unique<GrpcPolledFdPosix>(
         as,
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/lockfree_event.cc b/deps/grpc/src/core/lib/event_engine/posix_engine/lockfree_event.cc
index eda19bb2dc6..b746ac84c5c 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/lockfree_event.cc
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/lockfree_event.cc
@@ -117,7 +117,7 @@ void LockfreeEvent::NotifyOn(PosixEngineClosure* closure) {
         if (state_.compare_exchange_strong(curr, kClosureNotReady,
                                            std::memory_order_acq_rel,
                                            std::memory_order_acquire)) {
-          scheduler_->Run(closure);
+          thread_pool_->Run(closure);
           return;  // Successful. Return.
         }
         break;  // retry
@@ -131,7 +131,7 @@ void LockfreeEvent::NotifyOn(PosixEngineClosure* closure) {
           absl::Status shutdown_err =
               grpc_core::internal::StatusGetFromHeapPtr(curr & ~kShutdownBit);
           closure->SetStatus(shutdown_err);
-          scheduler_->Run(closure);
+          thread_pool_->Run(closure);
           return;
         }
 
@@ -187,7 +187,7 @@ bool LockfreeEvent::SetShutdown(absl::Status shutdown_error) {
                                            std::memory_order_acquire)) {
           auto closure = reinterpret_cast<PosixEngineClosure*>(curr);
           closure->SetStatus(shutdown_error);
-          scheduler_->Run(closure);
+          thread_pool_->Run(closure);
           return true;
         }
         // 'curr' was a closure but now changed to a different state. We will
@@ -234,7 +234,7 @@ void LockfreeEvent::SetReady() {
           // notify_on (or set_shutdown)
           auto closure = reinterpret_cast<PosixEngineClosure*>(curr);
           closure->SetStatus(absl::OkStatus());
-          scheduler_->Run(closure);
+          thread_pool_->Run(closure);
           return;
         }
         // else the state changed again (only possible by either a racing
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/lockfree_event.h b/deps/grpc/src/core/lib/event_engine/posix_engine/lockfree_event.h
index 36b7a0796b4..609fc22348e 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/lockfree_event.h
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/lockfree_event.h
@@ -21,14 +21,13 @@
 
 #include "absl/status/status.h"
 #include "src/core/lib/event_engine/posix_engine/posix_engine_closure.h"
+#include "src/core/lib/event_engine/thread_pool/thread_pool.h"
 
 namespace grpc_event_engine::experimental {
 
-class Scheduler;
-
 class LockfreeEvent {
  public:
-  explicit LockfreeEvent(Scheduler* scheduler) : scheduler_(scheduler) {}
+  explicit LockfreeEvent(ThreadPool* thread_pool) : thread_pool_(thread_pool) {}
 
   LockfreeEvent(const LockfreeEvent&) = delete;
   LockfreeEvent& operator=(const LockfreeEvent&) = delete;
@@ -62,7 +61,7 @@ class LockfreeEvent {
   enum State { kClosureNotReady = 0, kClosureReady = 2, kShutdownBit = 1 };
 
   std::atomic<intptr_t> state_;
-  Scheduler* scheduler_;
+  ThreadPool* thread_pool_;
 };
 
 }  // namespace grpc_event_engine::experimental
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/posix_endpoint.cc b/deps/grpc/src/core/lib/event_engine/posix_engine/posix_endpoint.cc
index 528cf77b729..56a8b745295 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/posix_endpoint.cc
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/posix_endpoint.cc
@@ -99,7 +99,7 @@ PosixErrorOr<int64_t> TcpSend(EventEnginePosixInterface* posix_interface,
                               const FileDescriptor& fd,
                               const struct msghdr* msg, int* saved_errno,
                               int additional_flags = 0) {
-  GRPC_LATENT_SEE_PARENT_SCOPE("TcpSend");
+  GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("TcpSend");
   PosixErrorOr<int64_t> send_result;
   do {
     grpc_core::global_stats().IncrementSyscallWrite();
@@ -290,7 +290,7 @@ absl::Status PosixEndpointImpl::TcpAnnotateError(absl::Status src_error) const {
 
 // Returns true if data available to read or error other than EAGAIN.
 bool PosixEndpointImpl::TcpDoRead(absl::Status& status) {
-  GRPC_LATENT_SEE_INNER_SCOPE("TcpDoRead");
+  GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("TcpDoRead");
 
   struct msghdr msg;
   struct iovec iov[MAX_READ_IOVEC];
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/posix_engine.cc b/deps/grpc/src/core/lib/event_engine/posix_engine/posix_engine.cc
index dc23d0b9995..5ac52af9601 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/posix_engine.cc
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/posix_engine.cc
@@ -70,13 +70,6 @@
 
 // IWYU pragma: no_include <ratio>
 
-#if defined(GRPC_POSIX_SOCKET_TCP) && \
-    !defined(GRPC_DO_NOT_INSTANTIATE_POSIX_POLLER)
-#define GRPC_PLATFORM_SUPPORTS_POSIX_POLLING true
-#else
-#define GRPC_PLATFORM_SUPPORTS_POSIX_POLLING false
-#endif
-
 using namespace std::chrono_literals;
 
 namespace grpc_event_engine::experimental {
@@ -184,8 +177,7 @@ void RegisterEventEngineForFork(
                               ptr.executor.expired();
                      }),
       fork_handlers->end());
-  fork_handlers->emplace_back(std::move(posix_engine), std::move(executor),
-                              std::move(timer_manager));
+  fork_handlers->emplace_back(posix_engine, executor, timer_manager);
   static bool handlers_installed = false;
   if (!handlers_installed) {
     pthread_atfork(PrepareFork, PostForkInParent, PostForkInChild);
@@ -193,27 +185,6 @@ void RegisterEventEngineForFork(
   }
 }
 
-#if GRPC_ARES && GRPC_POSIX_SOCKET_ARES_EV_DRIVER && \
-    GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-
-void RegisterResolver(
-    absl::InlinedVector<std::weak_ptr<AresResolver::ReinitHandle>, 16>*
-        resolver_handles,
-    std::weak_ptr<AresResolver::ReinitHandle> resolver_handle) {
-  resolver_handles->emplace_back(std::move(resolver_handle));
-  // Cleanup in case we have expired callbacks, prevents the list from
-  // growing indefinitely
-  auto new_end = std::remove_if(
-      resolver_handles->begin(), resolver_handles->end(),
-      +[](const std::weak_ptr<AresResolver::ReinitHandle>& callback) {
-        return callback.expired();
-      });
-  resolver_handles->erase(new_end, resolver_handles->end());
-}
-
-#endif  // GRPC_ARES && GRPC_POSIX_SOCKET_ARES_EV_DRIVER
-        //   && GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-
 #else  // GRPC_ENABLE_FORK_SUPPORT && GRPC_POSIX_FORK_ALLOW_PTHREAD_ATFORK
 
 void RegisterEventEngineForFork(
@@ -230,17 +201,18 @@ void RegisterEventEngineForFork(
 #if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
 
 PosixEventEngine::PollingCycle::PollingCycle(
-    PosixEnginePollerManager* poller_manager)
-    : poller_manager_(poller_manager), is_scheduled_(1) {
-  poller_manager_->Executor()->Run([this]() { PollerWorkInternal(); });
+    std::shared_ptr<ThreadPool> executor,
+    std::shared_ptr<PosixEventPoller> poller)
+    : executor_(std::move(executor)),
+      poller_(std::move(poller)),
+      is_scheduled_(1) {
+  CHECK_NE(poller_, nullptr);
+  executor_->Run([this]() { PollerWorkInternal(); });
 }
 
 PosixEventEngine::PollingCycle::~PollingCycle() {
   done_ = true;
-  auto poller = poller_manager_->Poller();
-  if (poller != nullptr) {
-    poller->Kick();
-  }
+  poller_->Kick();
   grpc_core::MutexLock lock(&mu_);
   while (is_scheduled_ > 0) {
     cond_.Wait(&mu_);
@@ -255,15 +227,14 @@ void PosixEventEngine::PollingCycle::PollerWorkInternal() {
   // TODO(vigneshbabu): The timeout specified here is arbitrary. For
   // instance, this can be improved by setting the timeout to the next
   // expiring timer.
-  PosixEventPoller* poller = poller_manager_->Poller();
-  auto result = poller->Work(24h, [&]() { again = true; });
+  auto result = poller_->Work(24h, [&]() { again = true; });
   if (result == Poller::WorkResult::kDeadlineExceeded) {
     // The EventEngine is not shutting down but the next asynchronous
     // PollerWorkInternal did not get scheduled. Schedule it now.
     again = true;
   }
   if (!done_ && again) {
-    poller_manager_->Executor()->Run([this]() { PollerWorkInternal(); });
+    executor_->Run([this]() { PollerWorkInternal(); });
     ++is_scheduled_;
   }
   cond_.SignalAll();
@@ -428,9 +399,9 @@ PosixEventEngine::CreateEndpointFromUnconnectedFdInternal(
 #if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
   PosixError err;
   int connect_errno;
+  PosixEventPoller* poller = poller_.get();
   do {
-    err = poller_manager_.Poller()->posix_interface().Connect(
-        fd, addr.address(), addr.size());
+    err = poller->posix_interface().Connect(fd, addr.address(), addr.size());
   } while (err.IsPosixError(EINTR));
   if (err.IsWrongGenerationError()) {
     Run([on_connect = std::move(on_connect),
@@ -452,7 +423,6 @@ PosixEventEngine::CreateEndpointFromUnconnectedFdInternal(
   }
 
   std::string name = absl::StrCat("tcp-client:", addr_uri.value());
-  PosixEventPoller* poller = poller_manager_.Poller();
   EventHandle* handle =
       poller->CreateHandle(fd, name, poller->CanTrackErrors());
 
@@ -507,47 +477,6 @@ void PosixEventEngine::OnConnectFinishInternal(int connection_handle) {
   }
 }
 
-PosixEnginePollerManager::PosixEnginePollerManager(
-    std::shared_ptr<ThreadPool> executor)
-    : poller_(grpc_event_engine::experimental::MakeDefaultPoller(this)),
-      executor_(std::move(executor)),
-      trigger_shutdown_called_(false) {}
-
-PosixEnginePollerManager::PosixEnginePollerManager(
-    std::shared_ptr<PosixEventPoller> poller)
-    : poller_(std::move(poller)),
-      poller_state_(PollerState::kExternal),
-      executor_(nullptr),
-      trigger_shutdown_called_(false) {
-  DCHECK_NE(poller_, nullptr);
-}
-
-void PosixEnginePollerManager::Run(
-    experimental::EventEngine::Closure* closure) {
-  if (executor_ != nullptr) {
-    executor_->Run(closure);
-  }
-}
-
-void PosixEnginePollerManager::Run(absl::AnyInvocable<void()> cb) {
-  if (executor_ != nullptr) {
-    executor_->Run(std::move(cb));
-  }
-}
-
-void PosixEnginePollerManager::TriggerShutdown() {
-  DCHECK(trigger_shutdown_called_ == false);
-  trigger_shutdown_called_ = true;
-  // If the poller is external, dont try to shut it down. Otherwise
-  // set poller state to PollerState::kShuttingDown.
-  if (poller_state_.exchange(PollerState::kShuttingDown) ==
-      PollerState::kExternal) {
-    poller_ = nullptr;
-    return;
-  }
-  poller_->Kick();
-}
-
 std::shared_ptr<PosixEventEngine> PosixEventEngine::MakePosixEventEngine() {
   // Can't use make_shared as ctor is private
   std::shared_ptr<PosixEventEngine> engine(new PosixEventEngine());
@@ -555,6 +484,8 @@ std::shared_ptr<PosixEventEngine> PosixEventEngine::MakePosixEventEngine() {
   return engine;
 }
 
+#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
+
 std::shared_ptr<PosixEventEngine>
 PosixEventEngine::MakeTestOnlyPosixEventEngine(
     std::shared_ptr<grpc_event_engine::experimental::PosixEventPoller>
@@ -568,24 +499,35 @@ PosixEventEngine::MakeTestOnlyPosixEventEngine(
 PosixEventEngine::PosixEventEngine(std::shared_ptr<PosixEventPoller> poller)
     : connection_shards_(std::max(2 * gpr_cpu_num_cores(), 1u)),
       executor_(MakeThreadPool(grpc_core::Clamp(gpr_cpu_num_cores(), 4u, 16u))),
-#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-      poller_manager_(poller),
-#endif
-      timer_manager_(std::make_shared<TimerManager>(executor_)) {
-}
+      poller_(std::move(poller)),
+      timer_manager_(std::make_shared<TimerManager>(executor_)) {}
 
 PosixEventEngine::PosixEventEngine()
     : connection_shards_(std::max(2 * gpr_cpu_num_cores(), 1u)),
       executor_(MakeThreadPool(grpc_core::Clamp(gpr_cpu_num_cores(), 4u, 16u))),
-#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-      poller_manager_(executor_),
       timer_manager_(std::make_shared<TimerManager>(executor_)) {
+  poller_ = grpc_event_engine::experimental::MakeDefaultPoller(executor_);
   SchedulePoller();
-#else   // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-      timer_manager_(std::make_shared<TimerManager>(executor_)) {
-#endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
 }
 
+#else  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
+
+std::shared_ptr<PosixEventEngine>
+PosixEventEngine::MakeTestOnlyPosixEventEngine(
+    std::shared_ptr<grpc_event_engine::experimental::PosixEventPoller>
+        test_only_poller) {
+  grpc_core::Crash(
+      "PosixEventEngine::MakeTestOnlyPosixEventEngine not available on this "
+      "platform");
+}
+
+PosixEventEngine::PosixEventEngine()
+    : connection_shards_(std::max(2 * gpr_cpu_num_cores(), 1u)),
+      executor_(MakeThreadPool(grpc_core::Clamp(gpr_cpu_num_cores(), 4u, 16u))),
+      timer_manager_(std::make_shared<TimerManager>(executor_)) {}
+
+#endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
+
 #endif  // GRPC_POSIX_SOCKET_TCP
 
 struct PosixEventEngine::ClosureData final : public EventEngine::Closure {
@@ -620,7 +562,6 @@ PosixEventEngine::~PosixEventEngine() {
   }
 #if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
   polling_cycle_.reset();
-  poller_manager_.TriggerShutdown();
 #endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
   timer_manager_->Shutdown();
   executor_->Quiesce();
@@ -695,50 +636,95 @@ void PosixEventEngine::PosixDNSResolver::LookupTXT(LookupTXTCallback on_resolve,
   dns_resolver_->LookupTXT(std::move(on_resolve), name);
 }
 
+#ifdef GRPC_POSIX_SOCKET_RESOLVE_ADDRESS
+#if GRPC_ARES == 1 && defined(GRPC_POSIX_SOCKET_ARES_EV_DRIVER)
+
+void PosixEventEngine::RegisterAresResolverForFork(
+    GRPC_UNUSED AresResolver* resolver) {
+#if GRPC_ENABLE_FORK_SUPPORT && GRPC_POSIX_FORK_ALLOW_PTHREAD_ATFORK
+  grpc_core::MutexLock lock(&resolver_handles_mu_);
+  resolver_handles_.emplace_back(resolver->GetReinitHandle());
+  // Cleanup in case we have expired callbacks, prevents the list from
+  // growing indefinitely
+  auto new_end = std::remove_if(
+      resolver_handles_.begin(), resolver_handles_.end(),
+      +[](const std::weak_ptr<AresResolver::ReinitHandle>& callback) {
+        return callback.expired();
+      });
+  resolver_handles_.erase(new_end, resolver_handles_.end());
+#endif  // GRPC_ENABLE_FORK_SUPPORT && GRPC_POSIX_FORK_ALLOW_PTHREAD_ATFORK
+}
+
 absl::StatusOr<std::unique_ptr<EventEngine::DNSResolver>>
 PosixEventEngine::GetDNSResolver(
     GRPC_UNUSED const EventEngine::DNSResolver::ResolverOptions& options) {
-#ifndef GRPC_POSIX_SOCKET_RESOLVE_ADDRESS
-  grpc_core::Crash("Unable to get DNS resolver for this platform.");
-#else  // GRPC_POSIX_SOCKET_RESOLVE_ADDRESS
   // If c-ares is supported on the platform, build according to user's
   // configuration.
-  if (ShouldUseAresDnsResolver()) {
-#if GRPC_ARES == 1 && defined(GRPC_POSIX_SOCKET_ARES_EV_DRIVER)
-#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
+  if (!ShouldUseAresDnsResolver()) {
     GRPC_TRACE_LOG(event_engine_dns, INFO)
-        << "PosixEventEngine::" << this << " creating AresResolver";
-    auto ares_resolver = AresResolver::CreateAresResolver(
-        options.dns_server,
-        std::make_unique<GrpcPolledFdFactoryPosix>(poller_manager_.Poller()),
-        shared_from_this());
-    if (!ares_resolver.ok()) {
-      return ares_resolver.status();
-    }
-#if GRPC_ENABLE_FORK_SUPPORT && GRPC_POSIX_FORK_ALLOW_PTHREAD_ATFORK
-    {
-      grpc_core::MutexLock lock(&resolver_handles_mu_);
-      RegisterResolver(&resolver_handles_,
-                       ares_resolver->get()->GetReinitHandle());
-    }
-#endif  // GRPC_ENABLE_FORK_SUPPORT && GRPC_POSIX_FORK_ALLOW_PTHREAD_ATFORK
-    return std::make_unique<PosixEventEngine::PosixDNSResolver>(
-        std::move(*ares_resolver));
+        << "PosixEventEngine::" << this << " creating NativePosixDNSResolver";
+    return std::make_unique<NativePosixDNSResolver>(shared_from_this());
+  }
+#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
+  GRPC_TRACE_LOG(event_engine_dns, INFO)
+      << "PosixEventEngine::" << this << " creating AresResolver";
+  auto ares_resolver = AresResolver::CreateAresResolver(
+      options.dns_server,
+      std::make_unique<GrpcPolledFdFactoryPosix>(poller_.get()),
+      shared_from_this());
+  if (!ares_resolver.ok()) {
+    return ares_resolver.status();
+  }
+  RegisterAresResolverForFork(ares_resolver->get());
+  return std::make_unique<PosixEventEngine::PosixDNSResolver>(
+      std::move(*ares_resolver));
 #else   // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-    grpc_core::Crash("Can not create CAres resolver with disabled poller");
+  grpc_core::Crash("Can not create CAres resolver with disabled poller");
 #endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-#endif  // GRPC_ARES == 1 && defined(GRPC_POSIX_SOCKET_ARES_EV_DRIVER)
-  }
+}
+
+#else  // GRPC_ARES == 1 && defined(GRPC_POSIX_SOCKET_ARES_EV_DRIVER)
+
+absl::StatusOr<std::unique_ptr<EventEngine::DNSResolver>>
+PosixEventEngine::GetDNSResolver(
+    GRPC_UNUSED const EventEngine::DNSResolver::ResolverOptions& options) {
   GRPC_TRACE_LOG(event_engine_dns, INFO)
       << "PosixEventEngine::" << this << " creating NativePosixDNSResolver";
   return std::make_unique<NativePosixDNSResolver>(shared_from_this());
-#endif  // GRPC_POSIX_SOCKET_RESOLVE_ADDRESS
 }
 
+#endif  // GRPC_ARES == 1 && defined(GRPC_POSIX_SOCKET_ARES_EV_DRIVER)
+#else   // GRPC_POSIX_SOCKET_RESOLVE_ADDRESS
+
+absl::StatusOr<std::unique_ptr<EventEngine::DNSResolver>>
+PosixEventEngine::GetDNSResolver(
+    GRPC_UNUSED const EventEngine::DNSResolver::ResolverOptions& options) {
+  grpc_core::Crash("Unable to get DNS resolver for this platform.");
+}
+
+#endif  // GRPC_POSIX_SOCKET_RESOLVE_ADDRESS
+
 bool PosixEventEngine::IsWorkerThread() { grpc_core::Crash("unimplemented"); }
 
-bool PosixEventEngine::CancelConnect(EventEngine::ConnectionHandle handle) {
+std::unique_ptr<EventEngine::Endpoint> PosixEventEngine::CreateEndpointFromFd(
+    int fd, const EndpointConfig& config) {
+  auto options = TcpOptionsFromEndpointConfig(config);
+  MemoryAllocator allocator;
+  if (options.memory_allocator_factory != nullptr) {
+    return CreatePosixEndpointFromFd(
+        fd, config,
+        options.memory_allocator_factory->CreateMemoryAllocator(
+            absl::StrCat("allocator:", fd)));
+  }
+  return CreatePosixEndpointFromFd(
+      fd, config,
+      options.resource_quota->memory_quota()->CreateMemoryAllocator(
+          absl::StrCat("allocator:", fd)));
+}
+
 #if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
+
+bool PosixEventEngine::CancelConnect(EventEngine::ConnectionHandle handle) {
   int connection_handle = handle.keys[0];
   if (connection_handle <= 0) {
     return false;
@@ -787,22 +773,16 @@ bool PosixEventEngine::CancelConnect(EventEngine::ConnectionHandle handle) {
     delete ac;
   }
   return connection_cancel_success;
-#else   // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-  grpc_core::Crash(
-      "EventEngine::CancelConnect is not supported on this platform");
-#endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
 }
 
 EventEngine::ConnectionHandle PosixEventEngine::Connect(
     OnConnectCallback on_connect, const ResolvedAddress& addr,
     const EndpointConfig& args, MemoryAllocator memory_allocator,
     Duration timeout) {
-#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
   PosixTcpOptions options = TcpOptionsFromEndpointConfig(args);
   absl::StatusOr<EventEnginePosixInterface::PosixSocketCreateResult> socket =
-      poller_manager_.Poller()
-          ->posix_interface()
-          .CreateAndPrepareTcpClientSocket(options, addr);
+      GetPollerChecked()->posix_interface().CreateAndPrepareTcpClientSocket(
+          options, addr);
   if (!socket.ok()) {
     Run([on_connect = std::move(on_connect),
          status = socket.status()]() mutable { on_connect(status); });
@@ -811,62 +791,30 @@ EventEngine::ConnectionHandle PosixEventEngine::Connect(
   return CreateEndpointFromUnconnectedFdInternal(
       (*socket).sock, std::move(on_connect), (*socket).mapped_target_addr,
       options, std::move(memory_allocator), timeout);
-#else   // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-  grpc_core::Crash("EventEngine::Connect is not supported on this platform");
-#endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
 }
 
 EventEngine::ConnectionHandle PosixEventEngine::CreateEndpointFromUnconnectedFd(
     int fd, EventEngine::OnConnectCallback on_connect,
     const EventEngine::ResolvedAddress& addr, const EndpointConfig& config,
     MemoryAllocator memory_allocator, EventEngine::Duration timeout) {
-#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
   return CreateEndpointFromUnconnectedFdInternal(
-      poller_manager_.Poller()->posix_interface().Adopt(fd),
-      std::move(on_connect), addr, TcpOptionsFromEndpointConfig(config),
-      std::move(memory_allocator), timeout);
-#else   // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-  grpc_core::Crash(
-      "EventEngine::CreateEndpointFromUnconnectedFd is not supported on this "
-      "platform");
-#endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
+      GetPollerChecked()->posix_interface().Adopt(fd), std::move(on_connect),
+      addr, TcpOptionsFromEndpointConfig(config), std::move(memory_allocator),
+      timeout);
 }
 
 std::unique_ptr<EventEngine::Endpoint>
 PosixEventEngine::CreatePosixEndpointFromFd(int fd,
                                             const EndpointConfig& config,
                                             MemoryAllocator memory_allocator) {
-#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
   DCHECK_GT(fd, 0);
-  PosixEventPoller* poller = poller_manager_.Poller();
-  DCHECK_NE(poller, nullptr);
+  PosixEventPoller* poller = GetPollerChecked();
   EventHandle* handle =
       poller->CreateHandle(poller->posix_interface().Adopt(fd), "tcp-client",
                            poller->CanTrackErrors());
   return CreatePosixEndpoint(handle, nullptr, shared_from_this(),
                              std::move(memory_allocator),
                              TcpOptionsFromEndpointConfig(config));
-#else   // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-  grpc_core::Crash(
-      "PosixEventEngine::CreatePosixEndpointFromFd is not supported on "
-      "this platform");
-#endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-}
-
-std::unique_ptr<EventEngine::Endpoint> PosixEventEngine::CreateEndpointFromFd(
-    int fd, const EndpointConfig& config) {
-  auto options = TcpOptionsFromEndpointConfig(config);
-  MemoryAllocator allocator;
-  if (options.memory_allocator_factory != nullptr) {
-    return CreatePosixEndpointFromFd(
-        fd, config,
-        options.memory_allocator_factory->CreateMemoryAllocator(
-            absl::StrCat("allocator:", fd)));
-  }
-  return CreatePosixEndpointFromFd(
-      fd, config,
-      options.resource_quota->memory_quota()->CreateMemoryAllocator(
-          absl::StrCat("allocator:", fd)));
 }
 
 absl::StatusOr<std::unique_ptr<EventEngine::Listener>>
@@ -875,7 +823,6 @@ PosixEventEngine::CreateListener(
     absl::AnyInvocable<void(absl::Status)> on_shutdown,
     const EndpointConfig& config,
     std::unique_ptr<MemoryAllocatorFactory> memory_allocator_factory) {
-#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
   PosixEventEngineWithFdSupport::PosixAcceptCallback posix_on_accept =
       [on_accept_cb = std::move(on_accept)](
           int /*listener_fd*/, std::unique_ptr<EventEngine::Endpoint> ep,
@@ -885,12 +832,7 @@ PosixEventEngine::CreateListener(
       };
   return std::make_unique<PosixEngineListener>(
       std::move(posix_on_accept), std::move(on_shutdown), config,
-      std::move(memory_allocator_factory), poller_manager_.Poller(),
-      shared_from_this());
-#else   // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-  grpc_core::Crash(
-      "EventEngine::CreateListener is not supported on this platform");
-#endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
+      std::move(memory_allocator_factory), poller_.get(), shared_from_this());
 }
 
 absl::StatusOr<std::unique_ptr<EventEngine::Listener>>
@@ -899,32 +841,96 @@ PosixEventEngine::CreatePosixListener(
     absl::AnyInvocable<void(absl::Status)> on_shutdown,
     const EndpointConfig& config,
     std::unique_ptr<MemoryAllocatorFactory> memory_allocator_factory) {
-#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
   return std::make_unique<PosixEngineListener>(
       std::move(on_accept), std::move(on_shutdown), config,
-      std::move(memory_allocator_factory), poller_manager_.Poller(),
-      shared_from_this());
-#else   // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
+      std::move(memory_allocator_factory), poller_.get(), shared_from_this());
+}
+
+void PosixEventEngine::SchedulePoller() {
+  if (poller_ != nullptr) {
+    grpc_core::MutexLock lock(&mu_);
+    CHECK(!polling_cycle_.has_value());
+    polling_cycle_.emplace(executor_, poller_);
+  }
+}
+
+void PosixEventEngine::ResetPollCycle() {
+  grpc_core::MutexLock lock(&mu_);
+  polling_cycle_.reset();
+}
+
+#else  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
+
+bool PosixEventEngine::CancelConnect(EventEngine::ConnectionHandle handle) {
+  grpc_core::Crash(
+      "EventEngine::CancelConnect is not supported on this platform");
+}
+
+EventEngine::ConnectionHandle PosixEventEngine::Connect(
+    OnConnectCallback on_connect, const ResolvedAddress& addr,
+    const EndpointConfig& args, MemoryAllocator memory_allocator,
+    Duration timeout) {
+  grpc_core::Crash("EventEngine::Connect is not supported on this platform");
+}
+
+EventEngine::ConnectionHandle PosixEventEngine::CreateEndpointFromUnconnectedFd(
+    int fd, EventEngine::OnConnectCallback on_connect,
+    const EventEngine::ResolvedAddress& addr, const EndpointConfig& config,
+    MemoryAllocator memory_allocator, EventEngine::Duration timeout) {
+  grpc_core::Crash(
+      "EventEngine::CreateEndpointFromUnconnectedFd is not supported on this "
+      "platform");
+}
+
+std::unique_ptr<EventEngine::Endpoint>
+PosixEventEngine::CreatePosixEndpointFromFd(int fd,
+                                            const EndpointConfig& config,
+                                            MemoryAllocator memory_allocator) {
+  grpc_core::Crash(
+      "PosixEventEngine::CreatePosixEndpointFromFd is not supported on "
+      "this platform");
+}
+
+absl::StatusOr<std::unique_ptr<EventEngine::Listener>>
+PosixEventEngine::CreateListener(
+    Listener::AcceptCallback on_accept,
+    absl::AnyInvocable<void(absl::Status)> on_shutdown,
+    const EndpointConfig& config,
+    std::unique_ptr<MemoryAllocatorFactory> memory_allocator_factory) {
   grpc_core::Crash(
       "EventEngine::CreateListener is not supported on this platform");
-#endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
 }
 
+absl::StatusOr<std::unique_ptr<EventEngine::Listener>>
+PosixEventEngine::CreatePosixListener(
+    PosixEventEngineWithFdSupport::PosixAcceptCallback on_accept,
+    absl::AnyInvocable<void(absl::Status)> on_shutdown,
+    const EndpointConfig& config,
+    std::unique_ptr<MemoryAllocatorFactory> memory_allocator_factory) {
+  grpc_core::Crash(
+      "EventEngine::CreateListener is not supported on this platform");
+}
+
+#endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
+
 #if GRPC_POSIX_SOCKET_TCP && GRPC_ENABLE_FORK_SUPPORT && \
     GRPC_POSIX_FORK_ALLOW_PTHREAD_ATFORK
 
 void PosixEventEngine::AfterFork(OnForkRole on_fork_role) {
+#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
+  PosixEventPoller* poller = GetPollerChecked();
+#endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
   if (on_fork_role == OnForkRole::kChild) {
     if (grpc_core::IsEventEngineForkEnabled()) {
       AfterForkInChild();
     } else {
 #if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-      poller_manager_.Poller()->HandleForkInChild();
+      poller->HandleForkInChild();
 #endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
     }
   }
 #if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-  poller_manager_.Poller()->ResetKickState();
+  poller->ResetKickState();
   SchedulePoller();
 #endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
 }
@@ -946,7 +952,7 @@ void PosixEventEngine::AfterForkInChild() {
   }
 #endif
 #if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-  poller_manager_.Poller()->HandleForkInChild();
+  GetPollerChecked()->HandleForkInChild();
 #endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
 #if GRPC_ARES == 1 && defined(GRPC_POSIX_SOCKET_ARES_EV_DRIVER)
   for (const auto& cb : resolver_handles_) {
@@ -961,21 +967,4 @@ void PosixEventEngine::AfterForkInChild() {
 #endif  // GRPC_POSIX_SOCKET_TCP && GRPC_ENABLE_FORK_SUPPORT &&
         // GRPC_POSIX_FORK_ALLOW_PTHREAD_ATFORK
 
-#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-
-void PosixEventEngine::SchedulePoller() {
-  if (poller_manager_.Poller() != nullptr) {
-    grpc_core::MutexLock lock(&mu_);
-    CHECK(!polling_cycle_.has_value());
-    polling_cycle_.emplace(&poller_manager_);
-  }
-}
-
-void PosixEventEngine::ResetPollCycle() {
-  grpc_core::MutexLock lock(&mu_);
-  polling_cycle_.reset();
-}
-
-#endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
-
 }  // namespace grpc_event_engine::experimental
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/posix_engine.h b/deps/grpc/src/core/lib/event_engine/posix_engine/posix_engine.h
index b1c3ba00c11..f5a98a3bb39 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/posix_engine.h
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/posix_engine.h
@@ -48,6 +48,13 @@
 #include "src/core/lib/event_engine/posix_engine/tcp_socket_utils.h"
 #endif  // GRPC_POSIX_SOCKET_TCP
 
+#if defined(GRPC_POSIX_SOCKET_TCP) && \
+    !defined(GRPC_DO_NOT_INSTANTIATE_POSIX_POLLER)
+#define GRPC_PLATFORM_SUPPORTS_POSIX_POLLING true
+#else
+#define GRPC_PLATFORM_SUPPORTS_POSIX_POLLING false
+#endif
+
 namespace grpc_event_engine::experimental {
 
 #ifdef GRPC_POSIX_SOCKET_TCP
@@ -94,38 +101,6 @@ class AsyncConnect {
   bool connect_cancelled_;
 };
 
-// A helper class to manager lifetime of the poller associated with the
-// posix EventEngine.
-class PosixEnginePollerManager
-    : public grpc_event_engine::experimental::Scheduler {
- public:
-  explicit PosixEnginePollerManager(std::shared_ptr<ThreadPool> executor);
-  explicit PosixEnginePollerManager(
-      std::shared_ptr<grpc_event_engine::experimental::PosixEventPoller>
-          poller);
-  grpc_event_engine::experimental::PosixEventPoller* Poller() const {
-    return poller_.get();
-  }
-
-  ThreadPool* Executor() { return executor_.get(); }
-
-  void Run(experimental::EventEngine::Closure* closure) override;
-  void Run(absl::AnyInvocable<void()>) override;
-
-  bool IsShuttingDown() {
-    return poller_state_.load(std::memory_order_acquire) ==
-           PollerState::kShuttingDown;
-  }
-  void TriggerShutdown();
-
- private:
-  enum class PollerState { kExternal, kOk, kShuttingDown };
-  std::shared_ptr<grpc_event_engine::experimental::PosixEventPoller> poller_;
-  std::atomic<PollerState> poller_state_{PollerState::kOk};
-  std::shared_ptr<ThreadPool> executor_;
-  bool trigger_shutdown_called_;
-};
-
 #endif  // GRPC_POSIX_SOCKET_TCP
 
 // An iomgr-based Posix EventEngine implementation.
@@ -219,14 +194,14 @@ class PosixEventEngine final : public PosixEventEngineWithFdSupport {
 
   PosixEventEngine();
 
-#ifdef GRPC_POSIX_SOCKET_TCP
+#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
   // Constructs an EventEngine which has a shared ownership of the poller. Use
   // the MakeTestOnlyPosixEventEngine static method to call this. Its expected
   // to be used only in tests.
   explicit PosixEventEngine(
       std::shared_ptr<grpc_event_engine::experimental::PosixEventPoller>
           poller);
-#endif  // GRPC_POSIX_SOCKET_TCP
+#endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
 
   EventEngine::TaskHandle RunAfterInternal(Duration when,
                                            absl::AnyInvocable<void()> cb);
@@ -258,30 +233,36 @@ class PosixEventEngine final : public PosixEventEngineWithFdSupport {
   grpc_core::Mutex mu_;
   TaskHandleSet known_handles_ ABSL_GUARDED_BY(mu_);
   std::atomic<intptr_t> aba_token_{0};
-#if GRPC_ENABLE_FORK_SUPPORT && GRPC_ARES == 1 && \
-    defined(GRPC_POSIX_SOCKET_ARES_EV_DRIVER)
+#if GRPC_ARES == 1 && defined(GRPC_POSIX_SOCKET_ARES_EV_DRIVER)
+
+  void RegisterAresResolverForFork(AresResolver* resolver);
+
+#if GRPC_ENABLE_FORK_SUPPORT
   // A separate mutex to avoid deadlocks.
   grpc_core::Mutex resolver_handles_mu_;
   absl::InlinedVector<std::weak_ptr<AresResolver::ReinitHandle>, 16>
       resolver_handles_ ABSL_GUARDED_BY(resolver_handles_mu_);
-#endif  // defined(GRPC_ENABLE_FORK_SUPPORT) && GRPC_ARES == 1 &&
-        // defined(GRPC_POSIX_SOCKET_ARES_EV_DRIVER)
+#endif  // GRPC_ENABLE_FORK_SUPPORT
+#endif  // GRPC_ARES == 1 && defined(GRPC_POSIX_SOCKET_ARES_EV_DRIVER)
   std::shared_ptr<ThreadPool> executor_;
 
-#if defined(GRPC_POSIX_SOCKET_TCP) && \
-    !defined(GRPC_DO_NOT_INSTANTIATE_POSIX_POLLER)
+#if GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
 
   // RAII wrapper for a polling cycle. Starts a new one in ctor and stops
   // in dtor.
   class PollingCycle {
    public:
-    explicit PollingCycle(PosixEnginePollerManager* poller_manager);
+    explicit PollingCycle(
+        std::shared_ptr<ThreadPool> executor,
+        std::shared_ptr<grpc_event_engine::experimental::PosixEventPoller>
+            poller);
     ~PollingCycle();
 
    private:
     void PollerWorkInternal();
 
-    PosixEnginePollerManager* poller_manager_;
+    std::shared_ptr<ThreadPool> executor_;
+    std::shared_ptr<grpc_event_engine::experimental::PosixEventPoller> poller_;
     grpc_core::Mutex mu_;
     std::atomic_bool done_{false};
     int is_scheduled_ ABSL_GUARDED_BY(&mu_) = 0;
@@ -291,13 +272,17 @@ class PosixEventEngine final : public PosixEventEngineWithFdSupport {
   void SchedulePoller();
   void ResetPollCycle();
 
-  PosixEnginePollerManager poller_manager_;
+  PosixEventPoller* GetPollerChecked() const {
+    CHECK_NE(poller_, nullptr);
+    return poller_.get();
+  }
+
+  std::shared_ptr<grpc_event_engine::experimental::PosixEventPoller> poller_;
 
   // Ensures there's ever only one of these.
   std::optional<PollingCycle> polling_cycle_ ABSL_GUARDED_BY(&mu_);
 
-#endif  // defined(GRPC_POSIX_SOCKET_TCP) &&
-        // !defined(GRPC_DO_NOT_INSTANTIATE_POSIX_POLLER)
+#endif  // GRPC_PLATFORM_SUPPORTS_POSIX_POLLING
 
   std::shared_ptr<TimerManager> timer_manager_;
 };
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/posix_engine_listener.cc b/deps/grpc/src/core/lib/event_engine/posix_engine/posix_engine_listener.cc
index b3f8bcc9c2a..d2f901c8c91 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/posix_engine_listener.cc
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/posix_engine_listener.cc
@@ -44,7 +44,7 @@
 #include "src/core/lib/event_engine/posix_engine/posix_interface.h"
 #include "src/core/lib/event_engine/posix_engine/tcp_socket_utils.h"
 #include "src/core/lib/event_engine/tcp_socket_utils.h"
-#include "src/core/lib/iomgr/socket_mutator.h"
+#include "src/core/net/socket_mutator.h"
 #include "src/core/util/status_helper.h"
 #include "src/core/util/strerror.h"
 #include "src/core/util/time.h"
diff --git a/deps/grpc/src/core/lib/event_engine/posix_engine/tcp_socket_utils.h b/deps/grpc/src/core/lib/event_engine/posix_engine/tcp_socket_utils.h
index 58c21a63f14..e04c71c77d9 100644
--- a/deps/grpc/src/core/lib/event_engine/posix_engine/tcp_socket_utils.h
+++ b/deps/grpc/src/core/lib/event_engine/posix_engine/tcp_socket_utils.h
@@ -24,8 +24,8 @@
 #include <utility>
 
 #include "src/core/lib/iomgr/port.h"
-#include "src/core/lib/iomgr/socket_mutator.h"
 #include "src/core/lib/resource_quota/resource_quota.h"
+#include "src/core/net/socket_mutator.h"
 #include "src/core/util/ref_counted_ptr.h"
 
 #ifdef GRPC_POSIX_SOCKET_UTILS_COMMON
diff --git a/deps/grpc/src/core/lib/event_engine/windows/grpc_polled_fd_windows.cc b/deps/grpc/src/core/lib/event_engine/windows/grpc_polled_fd_windows.cc
index fb766318070..d5de526508c 100644
--- a/deps/grpc/src/core/lib/event_engine/windows/grpc_polled_fd_windows.cc
+++ b/deps/grpc/src/core/lib/event_engine/windows/grpc_polled_fd_windows.cc
@@ -18,7 +18,6 @@
 
 #if GRPC_ARES == 1 && defined(GRPC_WINDOWS_SOCKET_ARES_EV_DRIVER)
 
-#include <ares.h>
 #include <grpc/support/log_windows.h>
 #include <winsock2.h>
 
@@ -27,6 +26,8 @@
 #include "absl/status/status.h"
 #include "absl/strings/str_format.h"
 #include "src/core/lib/address_utils/sockaddr_utils.h"
+// We pull in ares.h transitively here, ares.h is not self-contained
+// w.r.t. windows headers though, so make sure pull them in above.
 #include "src/core/lib/event_engine/ares_resolver.h"
 #include "src/core/lib/event_engine/grpc_polled_fd.h"
 #include "src/core/lib/event_engine/windows/grpc_polled_fd_windows.h"
diff --git a/deps/grpc/src/core/lib/experiments/GEMINI.md b/deps/grpc/src/core/lib/experiments/GEMINI.md
new file mode 100644
index 00000000000..295c3c87c9c
--- /dev/null
+++ b/deps/grpc/src/core/lib/experiments/GEMINI.md
@@ -0,0 +1,33 @@
+# Experiments
+
+This directory contains the implementation of the gRPC experiments system.
+
+## Overarching Purpose
+
+The experiments system provides a mechanism for controlling the behavior of gRPC at runtime. It is used to enable or disable new features, to change the default values of configuration parameters, and to collect data on the performance of different implementations.
+
+## Core Concepts
+
+The experiments system is built around a simple key-value store. The keys are the names of the experiments, and the values are booleans that indicate whether the experiment is enabled or disabled. The experiments are defined in a YAML file, and they can be enabled or disabled at runtime via a flag.
+
+## How to Add a New Experiment
+
+1.  Add a new entry to the `experiments.yaml` file. The entry should include the name of the experiment, a brief description of what it does, and the default value.
+2.  Run the `tools/codegen/core/gen_experiments.py` script to regenerate the `experiments.h` and `experiments.cc` files, and the `bazel/experiments.bzl` file in the grpc root.
+3.  Use the `grpc_core::IsExperimentEnabled` function to check if the experiment is enabled.
+
+## Files
+
+*   **`config.h`, `config.cc`**: These files contain the core logic for managing gRPC experiments.
+*   **`experiments.yaml`**: This file defines all of the available experiments.
+*   **`experiments.h`, `experiments.cc`**: These files are generated from `experiments.yaml`. They contain the definitions of the experiment enums and the `g_experiment_metadata` array.
+
+## Major Functions
+
+*   `grpc_core::IsExperimentEnabled`: Checks if an experiment is enabled.
+*   `grpc_core::ForceEnableExperiment`: Forces an experiment to be enabled or disabled. This is intended for testing purposes only.
+
+## Notes
+
+*   Experiments can be enabled at runtime by setting the `grpc_experiments` flag with a comma-separated list of experiment names.
+*   The experiments system is a powerful tool for developing and testing new features in gRPC. It allows developers to enable or disable features at runtime, which can be useful for A/B testing, for canarying new features, and for debugging.
diff --git a/deps/grpc/src/core/lib/experiments/experiments.cc b/deps/grpc/src/core/lib/experiments/experiments.cc
index d355b9aa01e..a67b69105ea 100644
--- a/deps/grpc/src/core/lib/experiments/experiments.cc
+++ b/deps/grpc/src/core/lib/experiments/experiments.cc
@@ -26,6 +26,12 @@ namespace {
 const char* const description_call_tracer_in_transport =
     "Transport directly passes byte counts to CallTracer.";
 const char* const additional_constraints_call_tracer_in_transport = "{}";
+const char* const description_channelz_use_v2_for_v1_api =
+    "Use the v2 channelz API for the v1 channelz API.";
+const char* const additional_constraints_channelz_use_v2_for_v1_api = "{}";
+const char* const description_channelz_use_v2_for_v1_service =
+    "Use the v2 channelz service for the v1 channelz service.";
+const char* const additional_constraints_channelz_use_v2_for_v1_service = "{}";
 const char* const description_chaotic_good_framing_layer =
     "Enable the chaotic good framing layer.";
 const char* const additional_constraints_chaotic_good_framing_layer = "{}";
@@ -76,6 +82,9 @@ const char* const additional_constraints_event_engine_secure_endpoint = "{}";
 const char* const description_free_large_allocator =
     "If set, return all free bytes from a \042big\042 allocator";
 const char* const additional_constraints_free_large_allocator = "{}";
+const char* const description_fuse_filters =
+    "If set, individual filters are merged into fused filters";
+const char* const additional_constraints_fuse_filters = "{}";
 const char* const description_keep_alive_ping_timer_batch =
     "Avoid explicitly cancelling the keepalive timer. Instead adjust the "
     "callback to re-schedule itself to the next ping interval.";
@@ -96,6 +105,13 @@ const char* const additional_constraints_multiping = "{}";
 const char* const description_pick_first_ignore_empty_updates =
     "Ignore empty resolutions in pick_first";
 const char* const additional_constraints_pick_first_ignore_empty_updates = "{}";
+const char* const description_pipelined_read_secure_endpoint =
+    "Enable pipelined reads for EventEngine secure endpoints";
+const char* const additional_constraints_pipelined_read_secure_endpoint = "{}";
+const uint8_t required_experiments_pipelined_read_secure_endpoint[] = {
+    static_cast<uint8_t>(grpc_core::kExperimentIdEventEngineClient),
+    static_cast<uint8_t>(grpc_core::kExperimentIdEventEngineListener),
+    static_cast<uint8_t>(grpc_core::kExperimentIdEventEngineSecureEndpoint)};
 const char* const description_pollset_alternative =
     "Code outside iomgr that relies directly on pollsets will use non-pollset "
     "alternatives when enabled.";
@@ -124,6 +140,11 @@ const char* const description_promise_based_inproc_transport =
 const char* const additional_constraints_promise_based_inproc_transport = "{}";
 const char* const description_retry_in_callv3 = "Support retries with call-v3";
 const char* const additional_constraints_retry_in_callv3 = "{}";
+const char* const description_rr_wrr_connect_from_random_index =
+    "RR and WRR LB policies start connecting from a random index in the "
+    "address list.";
+const char* const additional_constraints_rr_wrr_connect_from_random_index =
+    "{}";
 const char* const description_schedule_cancellation_over_write =
     "Allow cancellation op to be scheduled over a write";
 const char* const additional_constraints_schedule_cancellation_over_write =
@@ -179,6 +200,13 @@ namespace grpc_core {
 const ExperimentMetadata g_experiment_metadata[] = {
     {"call_tracer_in_transport", description_call_tracer_in_transport,
      additional_constraints_call_tracer_in_transport, nullptr, 0, true, false},
+    {"channelz_use_v2_for_v1_api", description_channelz_use_v2_for_v1_api,
+     additional_constraints_channelz_use_v2_for_v1_api, nullptr, 0, false,
+     true},
+    {"channelz_use_v2_for_v1_service",
+     description_channelz_use_v2_for_v1_service,
+     additional_constraints_channelz_use_v2_for_v1_service, nullptr, 0, false,
+     true},
     {"chaotic_good_framing_layer", description_chaotic_good_framing_layer,
      additional_constraints_chaotic_good_framing_layer, nullptr, 0, true,
      false},
@@ -210,6 +238,8 @@ const ExperimentMetadata g_experiment_metadata[] = {
      false},
     {"free_large_allocator", description_free_large_allocator,
      additional_constraints_free_large_allocator, nullptr, 0, false, true},
+    {"fuse_filters", description_fuse_filters,
+     additional_constraints_fuse_filters, nullptr, 0, false, false},
     {"keep_alive_ping_timer_batch", description_keep_alive_ping_timer_batch,
      additional_constraints_keep_alive_ping_timer_batch, nullptr, 0, false,
      true},
@@ -227,6 +257,10 @@ const ExperimentMetadata g_experiment_metadata[] = {
      description_pick_first_ignore_empty_updates,
      additional_constraints_pick_first_ignore_empty_updates, nullptr, 0, false,
      true},
+    {"pipelined_read_secure_endpoint",
+     description_pipelined_read_secure_endpoint,
+     additional_constraints_pipelined_read_secure_endpoint,
+     required_experiments_pipelined_read_secure_endpoint, 3, false, false},
     {"pollset_alternative", description_pollset_alternative,
      additional_constraints_pollset_alternative,
      required_experiments_pollset_alternative, 2, false, false},
@@ -247,6 +281,10 @@ const ExperimentMetadata g_experiment_metadata[] = {
      false},
     {"retry_in_callv3", description_retry_in_callv3,
      additional_constraints_retry_in_callv3, nullptr, 0, false, true},
+    {"rr_wrr_connect_from_random_index",
+     description_rr_wrr_connect_from_random_index,
+     additional_constraints_rr_wrr_connect_from_random_index, nullptr, 0, false,
+     true},
     {"schedule_cancellation_over_write",
      description_schedule_cancellation_over_write,
      additional_constraints_schedule_cancellation_over_write, nullptr, 0, false,
@@ -261,8 +299,8 @@ const ExperimentMetadata g_experiment_metadata[] = {
      required_experiments_secure_endpoint_offload_large_writes, 3, false, true},
     {"server_global_callbacks_ownership",
      description_server_global_callbacks_ownership,
-     additional_constraints_server_global_callbacks_ownership, nullptr, 0,
-     false, true},
+     additional_constraints_server_global_callbacks_ownership, nullptr, 0, true,
+     true},
     {"shard_global_connection_pool", description_shard_global_connection_pool,
      additional_constraints_shard_global_connection_pool, nullptr, 0, true,
      true},
@@ -291,6 +329,12 @@ namespace {
 const char* const description_call_tracer_in_transport =
     "Transport directly passes byte counts to CallTracer.";
 const char* const additional_constraints_call_tracer_in_transport = "{}";
+const char* const description_channelz_use_v2_for_v1_api =
+    "Use the v2 channelz API for the v1 channelz API.";
+const char* const additional_constraints_channelz_use_v2_for_v1_api = "{}";
+const char* const description_channelz_use_v2_for_v1_service =
+    "Use the v2 channelz service for the v1 channelz service.";
+const char* const additional_constraints_channelz_use_v2_for_v1_service = "{}";
 const char* const description_chaotic_good_framing_layer =
     "Enable the chaotic good framing layer.";
 const char* const additional_constraints_chaotic_good_framing_layer = "{}";
@@ -341,6 +385,9 @@ const char* const additional_constraints_event_engine_secure_endpoint = "{}";
 const char* const description_free_large_allocator =
     "If set, return all free bytes from a \042big\042 allocator";
 const char* const additional_constraints_free_large_allocator = "{}";
+const char* const description_fuse_filters =
+    "If set, individual filters are merged into fused filters";
+const char* const additional_constraints_fuse_filters = "{}";
 const char* const description_keep_alive_ping_timer_batch =
     "Avoid explicitly cancelling the keepalive timer. Instead adjust the "
     "callback to re-schedule itself to the next ping interval.";
@@ -361,6 +408,13 @@ const char* const additional_constraints_multiping = "{}";
 const char* const description_pick_first_ignore_empty_updates =
     "Ignore empty resolutions in pick_first";
 const char* const additional_constraints_pick_first_ignore_empty_updates = "{}";
+const char* const description_pipelined_read_secure_endpoint =
+    "Enable pipelined reads for EventEngine secure endpoints";
+const char* const additional_constraints_pipelined_read_secure_endpoint = "{}";
+const uint8_t required_experiments_pipelined_read_secure_endpoint[] = {
+    static_cast<uint8_t>(grpc_core::kExperimentIdEventEngineClient),
+    static_cast<uint8_t>(grpc_core::kExperimentIdEventEngineListener),
+    static_cast<uint8_t>(grpc_core::kExperimentIdEventEngineSecureEndpoint)};
 const char* const description_pollset_alternative =
     "Code outside iomgr that relies directly on pollsets will use non-pollset "
     "alternatives when enabled.";
@@ -389,6 +443,11 @@ const char* const description_promise_based_inproc_transport =
 const char* const additional_constraints_promise_based_inproc_transport = "{}";
 const char* const description_retry_in_callv3 = "Support retries with call-v3";
 const char* const additional_constraints_retry_in_callv3 = "{}";
+const char* const description_rr_wrr_connect_from_random_index =
+    "RR and WRR LB policies start connecting from a random index in the "
+    "address list.";
+const char* const additional_constraints_rr_wrr_connect_from_random_index =
+    "{}";
 const char* const description_schedule_cancellation_over_write =
     "Allow cancellation op to be scheduled over a write";
 const char* const additional_constraints_schedule_cancellation_over_write =
@@ -444,6 +503,13 @@ namespace grpc_core {
 const ExperimentMetadata g_experiment_metadata[] = {
     {"call_tracer_in_transport", description_call_tracer_in_transport,
      additional_constraints_call_tracer_in_transport, nullptr, 0, true, false},
+    {"channelz_use_v2_for_v1_api", description_channelz_use_v2_for_v1_api,
+     additional_constraints_channelz_use_v2_for_v1_api, nullptr, 0, false,
+     true},
+    {"channelz_use_v2_for_v1_service",
+     description_channelz_use_v2_for_v1_service,
+     additional_constraints_channelz_use_v2_for_v1_service, nullptr, 0, false,
+     true},
     {"chaotic_good_framing_layer", description_chaotic_good_framing_layer,
      additional_constraints_chaotic_good_framing_layer, nullptr, 0, true,
      false},
@@ -475,6 +541,8 @@ const ExperimentMetadata g_experiment_metadata[] = {
      false},
     {"free_large_allocator", description_free_large_allocator,
      additional_constraints_free_large_allocator, nullptr, 0, false, true},
+    {"fuse_filters", description_fuse_filters,
+     additional_constraints_fuse_filters, nullptr, 0, false, false},
     {"keep_alive_ping_timer_batch", description_keep_alive_ping_timer_batch,
      additional_constraints_keep_alive_ping_timer_batch, nullptr, 0, false,
      true},
@@ -492,6 +560,10 @@ const ExperimentMetadata g_experiment_metadata[] = {
      description_pick_first_ignore_empty_updates,
      additional_constraints_pick_first_ignore_empty_updates, nullptr, 0, false,
      true},
+    {"pipelined_read_secure_endpoint",
+     description_pipelined_read_secure_endpoint,
+     additional_constraints_pipelined_read_secure_endpoint,
+     required_experiments_pipelined_read_secure_endpoint, 3, false, false},
     {"pollset_alternative", description_pollset_alternative,
      additional_constraints_pollset_alternative,
      required_experiments_pollset_alternative, 2, false, false},
@@ -512,6 +584,10 @@ const ExperimentMetadata g_experiment_metadata[] = {
      false},
     {"retry_in_callv3", description_retry_in_callv3,
      additional_constraints_retry_in_callv3, nullptr, 0, false, true},
+    {"rr_wrr_connect_from_random_index",
+     description_rr_wrr_connect_from_random_index,
+     additional_constraints_rr_wrr_connect_from_random_index, nullptr, 0, false,
+     true},
     {"schedule_cancellation_over_write",
      description_schedule_cancellation_over_write,
      additional_constraints_schedule_cancellation_over_write, nullptr, 0, false,
@@ -526,8 +602,8 @@ const ExperimentMetadata g_experiment_metadata[] = {
      required_experiments_secure_endpoint_offload_large_writes, 3, false, true},
     {"server_global_callbacks_ownership",
      description_server_global_callbacks_ownership,
-     additional_constraints_server_global_callbacks_ownership, nullptr, 0,
-     false, true},
+     additional_constraints_server_global_callbacks_ownership, nullptr, 0, true,
+     true},
     {"shard_global_connection_pool", description_shard_global_connection_pool,
      additional_constraints_shard_global_connection_pool, nullptr, 0, true,
      true},
@@ -556,6 +632,12 @@ namespace {
 const char* const description_call_tracer_in_transport =
     "Transport directly passes byte counts to CallTracer.";
 const char* const additional_constraints_call_tracer_in_transport = "{}";
+const char* const description_channelz_use_v2_for_v1_api =
+    "Use the v2 channelz API for the v1 channelz API.";
+const char* const additional_constraints_channelz_use_v2_for_v1_api = "{}";
+const char* const description_channelz_use_v2_for_v1_service =
+    "Use the v2 channelz service for the v1 channelz service.";
+const char* const additional_constraints_channelz_use_v2_for_v1_service = "{}";
 const char* const description_chaotic_good_framing_layer =
     "Enable the chaotic good framing layer.";
 const char* const additional_constraints_chaotic_good_framing_layer = "{}";
@@ -606,6 +688,9 @@ const char* const additional_constraints_event_engine_secure_endpoint = "{}";
 const char* const description_free_large_allocator =
     "If set, return all free bytes from a \042big\042 allocator";
 const char* const additional_constraints_free_large_allocator = "{}";
+const char* const description_fuse_filters =
+    "If set, individual filters are merged into fused filters";
+const char* const additional_constraints_fuse_filters = "{}";
 const char* const description_keep_alive_ping_timer_batch =
     "Avoid explicitly cancelling the keepalive timer. Instead adjust the "
     "callback to re-schedule itself to the next ping interval.";
@@ -626,6 +711,13 @@ const char* const additional_constraints_multiping = "{}";
 const char* const description_pick_first_ignore_empty_updates =
     "Ignore empty resolutions in pick_first";
 const char* const additional_constraints_pick_first_ignore_empty_updates = "{}";
+const char* const description_pipelined_read_secure_endpoint =
+    "Enable pipelined reads for EventEngine secure endpoints";
+const char* const additional_constraints_pipelined_read_secure_endpoint = "{}";
+const uint8_t required_experiments_pipelined_read_secure_endpoint[] = {
+    static_cast<uint8_t>(grpc_core::kExperimentIdEventEngineClient),
+    static_cast<uint8_t>(grpc_core::kExperimentIdEventEngineListener),
+    static_cast<uint8_t>(grpc_core::kExperimentIdEventEngineSecureEndpoint)};
 const char* const description_pollset_alternative =
     "Code outside iomgr that relies directly on pollsets will use non-pollset "
     "alternatives when enabled.";
@@ -654,6 +746,11 @@ const char* const description_promise_based_inproc_transport =
 const char* const additional_constraints_promise_based_inproc_transport = "{}";
 const char* const description_retry_in_callv3 = "Support retries with call-v3";
 const char* const additional_constraints_retry_in_callv3 = "{}";
+const char* const description_rr_wrr_connect_from_random_index =
+    "RR and WRR LB policies start connecting from a random index in the "
+    "address list.";
+const char* const additional_constraints_rr_wrr_connect_from_random_index =
+    "{}";
 const char* const description_schedule_cancellation_over_write =
     "Allow cancellation op to be scheduled over a write";
 const char* const additional_constraints_schedule_cancellation_over_write =
@@ -709,6 +806,13 @@ namespace grpc_core {
 const ExperimentMetadata g_experiment_metadata[] = {
     {"call_tracer_in_transport", description_call_tracer_in_transport,
      additional_constraints_call_tracer_in_transport, nullptr, 0, true, false},
+    {"channelz_use_v2_for_v1_api", description_channelz_use_v2_for_v1_api,
+     additional_constraints_channelz_use_v2_for_v1_api, nullptr, 0, false,
+     true},
+    {"channelz_use_v2_for_v1_service",
+     description_channelz_use_v2_for_v1_service,
+     additional_constraints_channelz_use_v2_for_v1_service, nullptr, 0, false,
+     true},
     {"chaotic_good_framing_layer", description_chaotic_good_framing_layer,
      additional_constraints_chaotic_good_framing_layer, nullptr, 0, true,
      false},
@@ -740,6 +844,8 @@ const ExperimentMetadata g_experiment_metadata[] = {
      false},
     {"free_large_allocator", description_free_large_allocator,
      additional_constraints_free_large_allocator, nullptr, 0, false, true},
+    {"fuse_filters", description_fuse_filters,
+     additional_constraints_fuse_filters, nullptr, 0, false, false},
     {"keep_alive_ping_timer_batch", description_keep_alive_ping_timer_batch,
      additional_constraints_keep_alive_ping_timer_batch, nullptr, 0, false,
      true},
@@ -757,6 +863,10 @@ const ExperimentMetadata g_experiment_metadata[] = {
      description_pick_first_ignore_empty_updates,
      additional_constraints_pick_first_ignore_empty_updates, nullptr, 0, false,
      true},
+    {"pipelined_read_secure_endpoint",
+     description_pipelined_read_secure_endpoint,
+     additional_constraints_pipelined_read_secure_endpoint,
+     required_experiments_pipelined_read_secure_endpoint, 3, false, false},
     {"pollset_alternative", description_pollset_alternative,
      additional_constraints_pollset_alternative,
      required_experiments_pollset_alternative, 2, false, false},
@@ -777,6 +887,10 @@ const ExperimentMetadata g_experiment_metadata[] = {
      false},
     {"retry_in_callv3", description_retry_in_callv3,
      additional_constraints_retry_in_callv3, nullptr, 0, false, true},
+    {"rr_wrr_connect_from_random_index",
+     description_rr_wrr_connect_from_random_index,
+     additional_constraints_rr_wrr_connect_from_random_index, nullptr, 0, false,
+     true},
     {"schedule_cancellation_over_write",
      description_schedule_cancellation_over_write,
      additional_constraints_schedule_cancellation_over_write, nullptr, 0, false,
@@ -791,8 +905,8 @@ const ExperimentMetadata g_experiment_metadata[] = {
      required_experiments_secure_endpoint_offload_large_writes, 3, false, true},
     {"server_global_callbacks_ownership",
      description_server_global_callbacks_ownership,
-     additional_constraints_server_global_callbacks_ownership, nullptr, 0,
-     false, true},
+     additional_constraints_server_global_callbacks_ownership, nullptr, 0, true,
+     true},
     {"shard_global_connection_pool", description_shard_global_connection_pool,
      additional_constraints_shard_global_connection_pool, nullptr, 0, true,
      true},
diff --git a/deps/grpc/src/core/lib/experiments/experiments.h b/deps/grpc/src/core/lib/experiments/experiments.h
index da49caab738..8004f8fc896 100644
--- a/deps/grpc/src/core/lib/experiments/experiments.h
+++ b/deps/grpc/src/core/lib/experiments/experiments.h
@@ -59,6 +59,8 @@ namespace grpc_core {
 #if defined(GRPC_CFSTREAM)
 #define GRPC_EXPERIMENT_IS_INCLUDED_CALL_TRACER_IN_TRANSPORT
 inline bool IsCallTracerInTransportEnabled() { return true; }
+inline bool IsChannelzUseV2ForV1ApiEnabled() { return false; }
+inline bool IsChannelzUseV2ForV1ServiceEnabled() { return false; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_CHAOTIC_GOOD_FRAMING_LAYER
 inline bool IsChaoticGoodFramingLayerEnabled() { return true; }
 inline bool IsChttp2BoundWriteSizeEnabled() { return false; }
@@ -79,6 +81,7 @@ inline bool IsEventEngineForAllOtherEndpointsEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_EVENT_ENGINE_SECURE_ENDPOINT
 inline bool IsEventEngineSecureEndpointEnabled() { return true; }
 inline bool IsFreeLargeAllocatorEnabled() { return false; }
+inline bool IsFuseFiltersEnabled() { return false; }
 inline bool IsKeepAlivePingTimerBatchEnabled() { return false; }
 inline bool IsLocalConnectorSecureEnabled() { return false; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_MAX_INFLIGHT_PINGS_STRICT_LIMIT
@@ -87,16 +90,19 @@ inline bool IsMaxInflightPingsStrictLimitEnabled() { return true; }
 inline bool IsMonitoringExperimentEnabled() { return true; }
 inline bool IsMultipingEnabled() { return false; }
 inline bool IsPickFirstIgnoreEmptyUpdatesEnabled() { return false; }
+inline bool IsPipelinedReadSecureEndpointEnabled() { return false; }
 inline bool IsPollsetAlternativeEnabled() { return false; }
 inline bool IsPrioritizeFinishedRequestsEnabled() { return false; }
 inline bool IsPromiseBasedHttp2ClientTransportEnabled() { return false; }
 inline bool IsPromiseBasedHttp2ServerTransportEnabled() { return false; }
 inline bool IsPromiseBasedInprocTransportEnabled() { return false; }
 inline bool IsRetryInCallv3Enabled() { return false; }
+inline bool IsRrWrrConnectFromRandomIndexEnabled() { return false; }
 inline bool IsScheduleCancellationOverWriteEnabled() { return false; }
 inline bool IsSecureEndpointOffloadLargeReadsEnabled() { return false; }
 inline bool IsSecureEndpointOffloadLargeWritesEnabled() { return false; }
-inline bool IsServerGlobalCallbacksOwnershipEnabled() { return false; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_SERVER_GLOBAL_CALLBACKS_OWNERSHIP
+inline bool IsServerGlobalCallbacksOwnershipEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_SHARD_GLOBAL_CONNECTION_POOL
 inline bool IsShardGlobalConnectionPoolEnabled() { return true; }
 inline bool IsSleepPromiseExecCtxRemovalEnabled() { return false; }
@@ -108,6 +114,8 @@ inline bool IsUnconstrainedMaxQuotaBufferSizeEnabled() { return false; }
 #elif defined(GPR_WINDOWS)
 #define GRPC_EXPERIMENT_IS_INCLUDED_CALL_TRACER_IN_TRANSPORT
 inline bool IsCallTracerInTransportEnabled() { return true; }
+inline bool IsChannelzUseV2ForV1ApiEnabled() { return false; }
+inline bool IsChannelzUseV2ForV1ServiceEnabled() { return false; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_CHAOTIC_GOOD_FRAMING_LAYER
 inline bool IsChaoticGoodFramingLayerEnabled() { return true; }
 inline bool IsChttp2BoundWriteSizeEnabled() { return false; }
@@ -128,6 +136,7 @@ inline bool IsEventEngineForAllOtherEndpointsEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_EVENT_ENGINE_SECURE_ENDPOINT
 inline bool IsEventEngineSecureEndpointEnabled() { return true; }
 inline bool IsFreeLargeAllocatorEnabled() { return false; }
+inline bool IsFuseFiltersEnabled() { return false; }
 inline bool IsKeepAlivePingTimerBatchEnabled() { return false; }
 inline bool IsLocalConnectorSecureEnabled() { return false; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_MAX_INFLIGHT_PINGS_STRICT_LIMIT
@@ -136,16 +145,19 @@ inline bool IsMaxInflightPingsStrictLimitEnabled() { return true; }
 inline bool IsMonitoringExperimentEnabled() { return true; }
 inline bool IsMultipingEnabled() { return false; }
 inline bool IsPickFirstIgnoreEmptyUpdatesEnabled() { return false; }
+inline bool IsPipelinedReadSecureEndpointEnabled() { return false; }
 inline bool IsPollsetAlternativeEnabled() { return false; }
 inline bool IsPrioritizeFinishedRequestsEnabled() { return false; }
 inline bool IsPromiseBasedHttp2ClientTransportEnabled() { return false; }
 inline bool IsPromiseBasedHttp2ServerTransportEnabled() { return false; }
 inline bool IsPromiseBasedInprocTransportEnabled() { return false; }
 inline bool IsRetryInCallv3Enabled() { return false; }
+inline bool IsRrWrrConnectFromRandomIndexEnabled() { return false; }
 inline bool IsScheduleCancellationOverWriteEnabled() { return false; }
 inline bool IsSecureEndpointOffloadLargeReadsEnabled() { return false; }
 inline bool IsSecureEndpointOffloadLargeWritesEnabled() { return false; }
-inline bool IsServerGlobalCallbacksOwnershipEnabled() { return false; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_SERVER_GLOBAL_CALLBACKS_OWNERSHIP
+inline bool IsServerGlobalCallbacksOwnershipEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_SHARD_GLOBAL_CONNECTION_POOL
 inline bool IsShardGlobalConnectionPoolEnabled() { return true; }
 inline bool IsSleepPromiseExecCtxRemovalEnabled() { return false; }
@@ -157,6 +169,8 @@ inline bool IsUnconstrainedMaxQuotaBufferSizeEnabled() { return false; }
 #else
 #define GRPC_EXPERIMENT_IS_INCLUDED_CALL_TRACER_IN_TRANSPORT
 inline bool IsCallTracerInTransportEnabled() { return true; }
+inline bool IsChannelzUseV2ForV1ApiEnabled() { return false; }
+inline bool IsChannelzUseV2ForV1ServiceEnabled() { return false; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_CHAOTIC_GOOD_FRAMING_LAYER
 inline bool IsChaoticGoodFramingLayerEnabled() { return true; }
 inline bool IsChttp2BoundWriteSizeEnabled() { return false; }
@@ -177,6 +191,7 @@ inline bool IsEventEngineForAllOtherEndpointsEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_EVENT_ENGINE_SECURE_ENDPOINT
 inline bool IsEventEngineSecureEndpointEnabled() { return true; }
 inline bool IsFreeLargeAllocatorEnabled() { return false; }
+inline bool IsFuseFiltersEnabled() { return false; }
 inline bool IsKeepAlivePingTimerBatchEnabled() { return false; }
 inline bool IsLocalConnectorSecureEnabled() { return false; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_MAX_INFLIGHT_PINGS_STRICT_LIMIT
@@ -185,16 +200,19 @@ inline bool IsMaxInflightPingsStrictLimitEnabled() { return true; }
 inline bool IsMonitoringExperimentEnabled() { return true; }
 inline bool IsMultipingEnabled() { return false; }
 inline bool IsPickFirstIgnoreEmptyUpdatesEnabled() { return false; }
+inline bool IsPipelinedReadSecureEndpointEnabled() { return false; }
 inline bool IsPollsetAlternativeEnabled() { return false; }
 inline bool IsPrioritizeFinishedRequestsEnabled() { return false; }
 inline bool IsPromiseBasedHttp2ClientTransportEnabled() { return false; }
 inline bool IsPromiseBasedHttp2ServerTransportEnabled() { return false; }
 inline bool IsPromiseBasedInprocTransportEnabled() { return false; }
 inline bool IsRetryInCallv3Enabled() { return false; }
+inline bool IsRrWrrConnectFromRandomIndexEnabled() { return false; }
 inline bool IsScheduleCancellationOverWriteEnabled() { return false; }
 inline bool IsSecureEndpointOffloadLargeReadsEnabled() { return false; }
 inline bool IsSecureEndpointOffloadLargeWritesEnabled() { return false; }
-inline bool IsServerGlobalCallbacksOwnershipEnabled() { return false; }
+#define GRPC_EXPERIMENT_IS_INCLUDED_SERVER_GLOBAL_CALLBACKS_OWNERSHIP
+inline bool IsServerGlobalCallbacksOwnershipEnabled() { return true; }
 #define GRPC_EXPERIMENT_IS_INCLUDED_SHARD_GLOBAL_CONNECTION_POOL
 inline bool IsShardGlobalConnectionPoolEnabled() { return true; }
 inline bool IsSleepPromiseExecCtxRemovalEnabled() { return false; }
@@ -207,6 +225,8 @@ inline bool IsUnconstrainedMaxQuotaBufferSizeEnabled() { return false; }
 #else
 enum ExperimentIds {
   kExperimentIdCallTracerInTransport,
+  kExperimentIdChannelzUseV2ForV1Api,
+  kExperimentIdChannelzUseV2ForV1Service,
   kExperimentIdChaoticGoodFramingLayer,
   kExperimentIdChttp2BoundWriteSize,
   kExperimentIdErrorFlatten,
@@ -219,18 +239,21 @@ enum ExperimentIds {
   kExperimentIdEventEngineForAllOtherEndpoints,
   kExperimentIdEventEngineSecureEndpoint,
   kExperimentIdFreeLargeAllocator,
+  kExperimentIdFuseFilters,
   kExperimentIdKeepAlivePingTimerBatch,
   kExperimentIdLocalConnectorSecure,
   kExperimentIdMaxInflightPingsStrictLimit,
   kExperimentIdMonitoringExperiment,
   kExperimentIdMultiping,
   kExperimentIdPickFirstIgnoreEmptyUpdates,
+  kExperimentIdPipelinedReadSecureEndpoint,
   kExperimentIdPollsetAlternative,
   kExperimentIdPrioritizeFinishedRequests,
   kExperimentIdPromiseBasedHttp2ClientTransport,
   kExperimentIdPromiseBasedHttp2ServerTransport,
   kExperimentIdPromiseBasedInprocTransport,
   kExperimentIdRetryInCallv3,
+  kExperimentIdRrWrrConnectFromRandomIndex,
   kExperimentIdScheduleCancellationOverWrite,
   kExperimentIdSecureEndpointOffloadLargeReads,
   kExperimentIdSecureEndpointOffloadLargeWrites,
@@ -247,6 +270,14 @@ enum ExperimentIds {
 inline bool IsCallTracerInTransportEnabled() {
   return IsExperimentEnabled<kExperimentIdCallTracerInTransport>();
 }
+#define GRPC_EXPERIMENT_IS_INCLUDED_CHANNELZ_USE_V2_FOR_V1_API
+inline bool IsChannelzUseV2ForV1ApiEnabled() {
+  return IsExperimentEnabled<kExperimentIdChannelzUseV2ForV1Api>();
+}
+#define GRPC_EXPERIMENT_IS_INCLUDED_CHANNELZ_USE_V2_FOR_V1_SERVICE
+inline bool IsChannelzUseV2ForV1ServiceEnabled() {
+  return IsExperimentEnabled<kExperimentIdChannelzUseV2ForV1Service>();
+}
 #define GRPC_EXPERIMENT_IS_INCLUDED_CHAOTIC_GOOD_FRAMING_LAYER
 inline bool IsChaoticGoodFramingLayerEnabled() {
   return IsExperimentEnabled<kExperimentIdChaoticGoodFramingLayer>();
@@ -295,6 +326,10 @@ inline bool IsEventEngineSecureEndpointEnabled() {
 inline bool IsFreeLargeAllocatorEnabled() {
   return IsExperimentEnabled<kExperimentIdFreeLargeAllocator>();
 }
+#define GRPC_EXPERIMENT_IS_INCLUDED_FUSE_FILTERS
+inline bool IsFuseFiltersEnabled() {
+  return IsExperimentEnabled<kExperimentIdFuseFilters>();
+}
 #define GRPC_EXPERIMENT_IS_INCLUDED_KEEP_ALIVE_PING_TIMER_BATCH
 inline bool IsKeepAlivePingTimerBatchEnabled() {
   return IsExperimentEnabled<kExperimentIdKeepAlivePingTimerBatch>();
@@ -319,6 +354,10 @@ inline bool IsMultipingEnabled() {
 inline bool IsPickFirstIgnoreEmptyUpdatesEnabled() {
   return IsExperimentEnabled<kExperimentIdPickFirstIgnoreEmptyUpdates>();
 }
+#define GRPC_EXPERIMENT_IS_INCLUDED_PIPELINED_READ_SECURE_ENDPOINT
+inline bool IsPipelinedReadSecureEndpointEnabled() {
+  return IsExperimentEnabled<kExperimentIdPipelinedReadSecureEndpoint>();
+}
 #define GRPC_EXPERIMENT_IS_INCLUDED_POLLSET_ALTERNATIVE
 inline bool IsPollsetAlternativeEnabled() {
   return IsExperimentEnabled<kExperimentIdPollsetAlternative>();
@@ -343,6 +382,10 @@ inline bool IsPromiseBasedInprocTransportEnabled() {
 inline bool IsRetryInCallv3Enabled() {
   return IsExperimentEnabled<kExperimentIdRetryInCallv3>();
 }
+#define GRPC_EXPERIMENT_IS_INCLUDED_RR_WRR_CONNECT_FROM_RANDOM_INDEX
+inline bool IsRrWrrConnectFromRandomIndexEnabled() {
+  return IsExperimentEnabled<kExperimentIdRrWrrConnectFromRandomIndex>();
+}
 #define GRPC_EXPERIMENT_IS_INCLUDED_SCHEDULE_CANCELLATION_OVER_WRITE
 inline bool IsScheduleCancellationOverWriteEnabled() {
   return IsExperimentEnabled<kExperimentIdScheduleCancellationOverWrite>();
diff --git a/deps/grpc/src/core/lib/experiments/experiments.yaml b/deps/grpc/src/core/lib/experiments/experiments.yaml
index f11387076bb..265bdb53211 100644
--- a/deps/grpc/src/core/lib/experiments/experiments.yaml
+++ b/deps/grpc/src/core/lib/experiments/experiments.yaml
@@ -18,7 +18,8 @@
 # expiry:      when is the next time this experiment *must* be updated
 #              (date, YYYY/MM/DD)
 # test_tags:   a set of bazel tags, that if a test declares them signals
-#              that that test should be run with this experiment enabled in CI
+#              that the test should be run with this experiment both enabled
+#              and disabled in CI
 # allow_in_fuzzing_config: optional boolean (true if not specified)
 #              if false, this experiment will not be included in fuzzers that
 #              explore the config space
@@ -46,6 +47,16 @@
   owner: roth@google.com
   test_tags: []
   allow_in_fuzzing_config: false
+- name: channelz_use_v2_for_v1_api
+  description: Use the v2 channelz API for the v1 channelz API.
+  expiry: 2025/09/01
+  owner: ctiller@google.com
+  test_tags: [channelz_test]
+- name: channelz_use_v2_for_v1_service
+  description: Use the v2 channelz service for the v1 channelz service.
+  expiry: 2025/09/01
+  owner: ctiller@google.com
+  test_tags: [channelz_test]
 - name: chaotic_good_framing_layer
   description: Enable the chaotic good framing layer.
   expiry: 2025/09/01
@@ -107,7 +118,7 @@
     ]
 - name: event_engine_fork
   description: Enables event engine fork handling, including onfork events and file descriptor generations
-  expiry: 2025/08/01
+  expiry: 2025/10/01
   owner: eostroukhov@google.com
   test_tags: ["core_end2end_test", "event_engine_fork_test"]
   uses_polling: true
@@ -131,6 +142,12 @@
   expiry: 2025/09/30
   owner: alishananda@google.com
   test_tags: [resource_quota_test]
+- name: fuse_filters
+  description: If set, individual filters are merged into fused filters 
+  expiry: 2025/09/30
+  owner: vigneshbabu@google.com
+  test_tags: ["minimal_stack_test"]
+  allow_in_fuzzing_config: false
 - name: keep_alive_ping_timer_batch
   description:
     Avoid explicitly cancelling the keepalive timer. Instead adjust the callback to re-schedule
@@ -140,7 +157,7 @@
   test_tags: []
 - name: local_connector_secure
   description: Local security connector uses TSI_SECURITY_NONE for LOCAL_TCP connections.
-  expiry: 2025/07/31
+  expiry: 2025/09/30
   owner: mattstev@google.com
   test_tags: ["core_end2end_test"]
 - name: max_inflight_pings_strict_limit
@@ -162,6 +179,14 @@
   description: Ignore empty resolutions in pick_first
   expiry: 2026/02/02
   owner: ctiller@google.com
+- name: pipelined_read_secure_endpoint
+  description: Enable pipelined reads for EventEngine secure endpoints
+  expiry: 2025/10/30
+  owner: alishananda@google.com
+  test_tags: ["core_end2end_test", "secure_endpoint_test"]
+  requires: ["event_engine_client", "event_engine_listener", "event_engine_secure_endpoint"]
+  uses_polling: true
+  allow_in_fuzzing_config: false
 - name: pollset_alternative
   description:
     Code outside iomgr that relies directly on pollsets will use non-pollset alternatives when
@@ -184,7 +209,7 @@
     and also help with interop testing.
   expiry: 2025/10/03
   owner: tjagtap@google.com
-  test_tags: []
+  test_tags: ["core_end2end_test"]
   allow_in_fuzzing_config: true
 - name: promise_based_http2_server_transport
   description:
@@ -206,6 +231,13 @@
   expiry: 2025/09/06
   owner: ctiller@google.com
   test_tags: [core_end2end_test]
+- name: rr_wrr_connect_from_random_index
+  description:
+    RR and WRR LB policies start connecting from a random index in the
+    address list.
+  expiry: 2025/10/31
+  owner: roth@google.com
+  test_tags: ["lb_unit_test", "cpp_lb_end2end_test"]
 - name: schedule_cancellation_over_write
   description: Allow cancellation op to be scheduled over a write
   expiry: 2025/10/01
@@ -235,7 +267,7 @@
     ]
 - name: server_global_callbacks_ownership
   description: If set, server global callbacks ownership is fixed to not be owned by gRPC.
-  expiry: 2025/06/30
+  expiry: 2025/09/30
   owner: yashkt@google.com
   test_tags: []
 - name: shard_global_connection_pool
diff --git a/deps/grpc/src/core/lib/experiments/rollouts.yaml b/deps/grpc/src/core/lib/experiments/rollouts.yaml
index 80aafd2eefe..b33d8a1e7dc 100644
--- a/deps/grpc/src/core/lib/experiments/rollouts.yaml
+++ b/deps/grpc/src/core/lib/experiments/rollouts.yaml
@@ -64,6 +64,8 @@
   default: true
 - name: free_large_allocator
   default: false
+- name: fuse_filters
+  default: false
 - name: keep_alive_ping_timer_batch
   default: false
 - name: local_connector_secure
@@ -83,7 +85,7 @@
 - name: schedule_cancellation_over_write
   default: false
 - name: server_global_callbacks_ownership
-  default: false
+  default: true
 - name: shard_global_connection_pool
   default: true
 - name: sleep_promise_exec_ctx_removal
diff --git a/deps/grpc/src/core/lib/iomgr/GEMINI.md b/deps/grpc/src/core/lib/iomgr/GEMINI.md
new file mode 100644
index 00000000000..8d224a9de8a
--- /dev/null
+++ b/deps/grpc/src/core/lib/iomgr/GEMINI.md
@@ -0,0 +1,46 @@
+# I/O Manager (iomgr)
+
+This directory contains the implementation of the gRPC I/O manager, a platform-abstraction layer for I/O and threading.
+
+**NOTE:** The I/O manager is a legacy component that is being replaced by the [Event Engine](../event_engine/GEMINI.md). New code should use the Event Engine instead of the I/O manager.
+
+## Overarching Purpose
+
+The I/O manager is responsible for all of the I/O in gRPC's C-core. It provides a platform-independent abstraction layer for network I/O, timers, and asynchronous execution. It is designed to be highly scalable and performant, and it uses a variety of techniques to achieve this, including non-blocking I/O, event-driven programming, and a thread pool.
+
+## Core Concepts
+
+The I/O manager is built around a few key abstractions:
+
+*   **`grpc_endpoint`**: An endpoint is an abstraction for a communication channel, such as a TCP socket. It provides a platform-independent way to read and write data, and to register for I/O events.
+*   **`grpc_closure`**: A closure is a callback function that is executed when an I/O event occurs. It is the basic unit of work in the I/O manager.
+*   **`ExecCtx`**: An execution context is a thread-local object that is used to track a list of work that needs to be done. It provides a way to batch work together and to execute it in a specific order.
+*   **`grpc_pollset`**: A pollset is a set of file descriptors that are being monitored for I/O events. The I/O manager uses pollsets to efficiently wait for I/O events on a large number of file descriptors.
+*   **Threading Model**: The I/O manager uses a thread pool to execute closures. The number of threads in the pool is configurable, and the I/O manager can be configured to use a variety of different polling strategies, depending on the platform.
+
+## Polling Strategies
+
+The I/O manager supports several different polling strategies, which are used to wait for I/O events on different platforms:
+
+*   **`epoll`**: The `epoll` polling strategy is used on Linux. It is a highly scalable and efficient polling mechanism that can handle a large number of file descriptors.
+*   **`poll`**: The `poll` polling strategy is used on most other POSIX-like systems. It is a more traditional polling mechanism that is not as scalable as `epoll`, but is more portable.
+*   **`iocp`**: The `iocp` (I/O Completion Ports) polling strategy is used on Windows. It is a highly scalable and efficient polling mechanism that is similar to `epoll`.
+*   **`cfstream`**: The `cfstream` polling strategy is used on Apple platforms (macOS, iOS). It is based on the Core Foundation `CFStream` API.
+
+## Files
+
+*   **`iomgr.h`**: The public interface to the I/O manager. It provides functions for initializing and shutting down the I/O manager, and for scheduling work to be done.
+*   **`endpoint.h`**: Defines the `grpc_endpoint` structure, which represents a communication channel.
+*   **`closure.h`**: Defines the `grpc_closure` structure, which is used to represent a callback function.
+*   **`exec_ctx.h`**: Defines the `ExecCtx` class, which represents an execution context.
+*   **`timer.h`**: Defines the `grpc_timer` structure, which is used to represent a timer.
+*   **`tcp_posix.h`, `tcp_windows.h`**: Platform-specific implementations of the TCP endpoint.
+*   **`ev_epoll1_linux.cc`, `ev_poll_posix.cc`, `iocp_windows.cc`**: Platform-specific implementations of the polling strategies.
+*   **`resolve_address.h`**: Provides a platform-independent way to resolve a hostname to a list of IP addresses.
+*   **`combiner.h`**: A mechanism for serializing access to data that is shared between multiple threads.
+
+## Notes
+
+*   The I/O manager is a low-level component of the gRPC stack. Most application developers will not need to interact with it directly.
+*   The I/O manager is a complex piece of machinery, and it can be difficult to understand how all of the different pieces fit together. The best way to understand it is to read the code and to trace the execution of a simple RPC.
+*   The `ExecCtx` is a particularly important concept to understand. It is used to manage the execution of closures, and it plays a key role in ensuring that the I/O manager is thread-safe.
diff --git a/deps/grpc/src/core/lib/iomgr/combiner.cc b/deps/grpc/src/core/lib/iomgr/combiner.cc
index fd87dc3f924..5fd261b72ce 100644
--- a/deps/grpc/src/core/lib/iomgr/combiner.cc
+++ b/deps/grpc/src/core/lib/iomgr/combiner.cc
@@ -166,7 +166,7 @@ static void queue_offload(grpc_core::Combiner* lock) {
 }
 
 bool grpc_combiner_continue_exec_ctx() {
-  GRPC_LATENT_SEE_PARENT_SCOPE("grpc_combiner_continue_exec_ctx");
+  GRPC_LATENT_SEE_SCOPE("grpc_combiner_continue_exec_ctx");
 
   grpc_core::Combiner* lock =
       grpc_core::ExecCtx::Get()->combiner_data()->active_combiner;
diff --git a/deps/grpc/src/core/lib/iomgr/exec_ctx.h b/deps/grpc/src/core/lib/iomgr/exec_ctx.h
index 24b10413006..da02ab0193b 100644
--- a/deps/grpc/src/core/lib/iomgr/exec_ctx.h
+++ b/deps/grpc/src/core/lib/iomgr/exec_ctx.h
@@ -108,23 +108,17 @@ class Combiner;
 ///               since that implies a core re-entry outside of application
 ///               callbacks.
 ///
-class GRPC_DLL ExecCtx : public latent_see::ParentScope {
+class GRPC_DLL ExecCtx {
  public:
   /// Default Constructor
 
-  ExecCtx()
-      : latent_see::ParentScope(GRPC_LATENT_SEE_METADATA("ExecCtx")),
-        flags_(GRPC_EXEC_CTX_FLAG_IS_FINISHED) {
+  ExecCtx() : flags_(GRPC_EXEC_CTX_FLAG_IS_FINISHED) {
     Fork::IncExecCtxCount();
     Set(this);
   }
 
   /// Parameterised Constructor
-  explicit ExecCtx(uintptr_t fl)
-      : ExecCtx(fl, GRPC_LATENT_SEE_METADATA("ExecCtx")) {}
-
-  explicit ExecCtx(uintptr_t fl, latent_see::Metadata* latent_see_metadata)
-      : latent_see::ParentScope(latent_see_metadata), flags_(fl) {
+  explicit ExecCtx(uintptr_t fl) : flags_(fl) {
     if (!(GRPC_EXEC_CTX_FLAG_IS_INTERNAL_THREAD & flags_)) {
       Fork::IncExecCtxCount();
     }
diff --git a/deps/grpc/src/core/lib/iomgr/socket_mutator.cc b/deps/grpc/src/core/lib/iomgr/socket_mutator.cc
index d2afe272f12..09945c82783 100644
--- a/deps/grpc/src/core/lib/iomgr/socket_mutator.cc
+++ b/deps/grpc/src/core/lib/iomgr/socket_mutator.cc
@@ -16,7 +16,7 @@
 //
 //
 
-#include "src/core/lib/iomgr/socket_mutator.h"
+#include "src/core/net/socket_mutator.h"
 
 #include <grpc/impl/grpc_types.h>
 #include <grpc/support/port_platform.h>
diff --git a/deps/grpc/src/core/lib/iomgr/socket_utils_posix.cc b/deps/grpc/src/core/lib/iomgr/socket_utils_posix.cc
index 9fc24733d2f..28a7e50d8dd 100644
--- a/deps/grpc/src/core/lib/iomgr/socket_utils_posix.cc
+++ b/deps/grpc/src/core/lib/iomgr/socket_utils_posix.cc
@@ -40,9 +40,9 @@
 #include <grpc/impl/grpc_types.h>
 
 #include "src/core/lib/channel/channel_args.h"
-#include "src/core/lib/iomgr/socket_mutator.h"
 #include "src/core/lib/iomgr/socket_utils_posix.h"
 #include "src/core/lib/resource_quota/resource_quota.h"
+#include "src/core/net/socket_mutator.h"
 #include "src/core/util/useful.h"
 
 namespace {
diff --git a/deps/grpc/src/core/lib/iomgr/socket_utils_posix.h b/deps/grpc/src/core/lib/iomgr/socket_utils_posix.h
index d9dfe55af34..a8afe6c4402 100644
--- a/deps/grpc/src/core/lib/iomgr/socket_utils_posix.h
+++ b/deps/grpc/src/core/lib/iomgr/socket_utils_posix.h
@@ -30,8 +30,8 @@
 
 #include "src/core/lib/iomgr/error.h"
 #include "src/core/lib/iomgr/resolved_address.h"
-#include "src/core/lib/iomgr/socket_mutator.h"
 #include "src/core/lib/resource_quota/resource_quota.h"
+#include "src/core/net/socket_mutator.h"
 #include "src/core/util/ref_counted_ptr.h"
 
 #ifdef GRPC_LINUX_ERRQUEUE
diff --git a/deps/grpc/src/core/lib/iomgr/tcp_client_posix.cc b/deps/grpc/src/core/lib/iomgr/tcp_client_posix.cc
index 4d7da7e35b5..cccdbce258a 100644
--- a/deps/grpc/src/core/lib/iomgr/tcp_client_posix.cc
+++ b/deps/grpc/src/core/lib/iomgr/tcp_client_posix.cc
@@ -44,7 +44,6 @@
 #include "src/core/lib/iomgr/exec_ctx.h"
 #include "src/core/lib/iomgr/iomgr_internal.h"
 #include "src/core/lib/iomgr/sockaddr.h"
-#include "src/core/lib/iomgr/socket_mutator.h"
 #include "src/core/lib/iomgr/socket_utils_posix.h"
 #include "src/core/lib/iomgr/tcp_client_posix.h"
 #include "src/core/lib/iomgr/tcp_posix.h"
@@ -52,6 +51,7 @@
 #include "src/core/lib/iomgr/unix_sockets_posix.h"
 #include "src/core/lib/iomgr/vsock.h"
 #include "src/core/lib/slice/slice_internal.h"
+#include "src/core/net/socket_mutator.h"
 #include "src/core/util/crash.h"
 #include "src/core/util/status_helper.h"
 #include "src/core/util/string.h"
diff --git a/deps/grpc/src/core/lib/iomgr/tcp_posix.cc b/deps/grpc/src/core/lib/iomgr/tcp_posix.cc
index 6dc45c59d02..3301ed45c4d 100644
--- a/deps/grpc/src/core/lib/iomgr/tcp_posix.cc
+++ b/deps/grpc/src/core/lib/iomgr/tcp_posix.cc
@@ -894,7 +894,7 @@ static void update_rcvlowat(grpc_tcp* tcp)
 #define MAX_READ_IOVEC 64
 static bool tcp_do_read(grpc_tcp* tcp, grpc_error_handle* error)
     ABSL_EXCLUSIVE_LOCKS_REQUIRED(tcp->read_mu) {
-  GRPC_LATENT_SEE_INNER_SCOPE("tcp_do_read");
+  GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("tcp_do_read");
   GRPC_TRACE_LOG(tcp, INFO) << "TCP:" << tcp << " do_read";
   struct msghdr msg;
   struct iovec iov[MAX_READ_IOVEC];
@@ -1184,7 +1184,7 @@ static void tcp_read(grpc_endpoint* ep, grpc_slice_buffer* incoming_buffer,
 // of bytes sent.
 ssize_t tcp_send(int fd, const struct msghdr* msg, int* saved_errno,
                  int additional_flags = 0) {
-  GRPC_LATENT_SEE_INNER_SCOPE("tcp_send");
+  GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("tcp_send");
   ssize_t sent_length;
   do {
     // TODO(klempner): Cork if this is a partial write
@@ -1375,7 +1375,7 @@ struct cmsghdr* process_timestamp(grpc_tcp* tcp, msghdr* msg,
 /// messages from the queue.
 ///
 static bool process_errors(grpc_tcp* tcp) {
-  GRPC_LATENT_SEE_INNER_SCOPE("process_errors");
+  GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("process_errors");
   bool processed_err = false;
   struct iovec iov;
   iov.iov_base = nullptr;
diff --git a/deps/grpc/src/core/lib/promise/GEMINI.md b/deps/grpc/src/core/lib/promise/GEMINI.md
new file mode 100644
index 00000000000..f2a879f42d8
--- /dev/null
+++ b/deps/grpc/src/core/lib/promise/GEMINI.md
@@ -0,0 +1,54 @@
+# gRPC Promise Library
+
+This directory contains the implementation of gRPC's promise library, a framework for asynchronous programming.
+
+## Overarching Purpose
+
+The promise library provides a set of tools for writing asynchronous code in a composable and easy-to-understand way. It is based on the concept of a "promise," which is an object that represents the eventual result of an asynchronous operation. Promises are polled to advance their state, and can be chained together to form complex asynchronous workflows. They are designed to be lightweight and efficient, with a focus on minimizing memory allocations and avoiding virtual function calls.
+
+## Files and Subdirectories
+
+- **`activity.h` / `activity.cc`**: Defines `Activity`, the execution context for promises. An `Activity` is responsible for running a promise to completion, and provides a mechanism for waking up a suspended promise when it's ready to make progress.
+- **`all_ok.h`**: `AllOk` is a combinator that takes a number of promises and returns a new promise that resolves when all of the input promises have resolved successfully.
+- **`arena_promise.h`**: `ArenaPromise<T>` is a promise that is allocated from an arena, which can be useful for performance-critical code.
+- **`context.h`**: `GetContext<T>()` allows retrieving a `T` from the current activity's context.
+- **`detail/`**: Implementation details for the promise library.
+- **`event_engine_wakeup_scheduler.h`**: A wakeup scheduler that uses the `EventEngine` to schedule wakeups.
+- **`exec_ctx_wakeup_scheduler.h`**: A wakeup scheduler that uses the `ExecCtx` to schedule wakeups.
+- **`for_each.h`**: `ForEach` is a combinator that iterates over a sequence and applies a function to each element, returning a promise that resolves when all of the function calls have completed.
+- **`if.h`**: `If` is a combinator that conditionally executes one of two promises.
+- **`inter_activity_latch.h`**: A latch that can be used to synchronize between different activities.
+- **`inter_activity_mutex.h`**: A mutex that can be used to protect shared data between different activities.
+- **`inter_activity_pipe.h`**: A pipe that can be used for communication between different activities.
+- **`interceptor_list.h`**: A list of interceptors that can be used to add functionality to a promise.
+- **`join.h`**: `Join` is a combinator that takes a number of promises and returns a new promise that resolves when all of the input promises have resolved.
+- **`latch.h`**: A simple latch that can be used for synchronization within a single activity.
+- **`loop.h`**: `Loop` is a combinator that repeatedly executes a promise.
+- **`map.h`**: `Map` is a combinator that applies a function to the result of a promise.
+- **`match_promise.h`**: `Match` is a combinator that allows for pattern matching on the result of a promise.
+- **`mpsc.h` / `mpsc.cc`**: A multi-producer, single-consumer queue that can be used for communication between promises.
+- **`observable.h`**: `Observable` is a promise that can be observed by multiple other promises.
+- **`party.h` / `party.cc`**: A `Party` is a collection of activities that are managed together.
+- **`pipe.h`**: `Pipe` provides a mechanism for communicating between two promises within the same activity.
+- **`poll.h`**: Defines `Poll<T>`, the return type of a promise. A `Poll` can be either `Pending` or `Ready` with a value of type `T`.
+- **`prioritized_race.h`**: `PrioritizedRace` is a combinator that races multiple promises against each other, but with a priority given to the first promise.
+- **`promise.h`**: Defines the core `Promise` class and related helpers. A `Promise` is a functor that returns a `Poll<T>`.
+- **`promise_mutex.h`**: A mutex that can be used to protect shared data within a single activity.
+- **`race.h`**: `Race` is a combinator that races multiple promises against each other.
+- **`seq.h`**: `Seq` is a combinator that executes a sequence of promises one after another.
+- **`sleep.h` / `sleep.cc`**: `Sleep` is a promise that resolves after a given duration.
+- **`status_flag.h`**: A simple flag that can be used to indicate the status of an asynchronous operation.
+- **`switch.h`**: `Switch` is a combinator that allows for switching between different promises based on a condition.
+- **`try_join.h`**: `TryJoin` is a combinator that is similar to `Join`, but it resolves with an error if any of the input promises resolve with an error.
+- **`try_seq.h`**: `TrySeq` is a combinator that is similar to `Seq`, but it stops executing if any of the promises in the sequence resolve with an error.
+- **`wait_for_callback.h`**: `WaitForCallback` is a promise that waits for a callback to be called.
+- **`wait_set.h` / `wait_set.cc`**: A set of promises that can be waited on together.
+
+## Notes
+
+- The promise library is a key component of gRPC's asynchronous programming model.
+- It is used extensively throughout the gRPC core to implement non-blocking I/O and other asynchronous operations.
+- The library provides a rich set of combinators for composing promises together to create complex asynchronous workflows.
+- Pay close attention to the distinction between inter-activity and intra-activity synchronization primitives. Using the wrong one can lead to deadlocks.
+- The use of `ArenaPromise` should be considered in performance-sensitive code to avoid heap allocations.
+- The `detail/` directory contains internal implementation details and should not be used directly by consumers of the library.
diff --git a/deps/grpc/src/core/lib/promise/activity.h b/deps/grpc/src/core/lib/promise/activity.h
index f3aa85925ae..b77013b8e02 100644
--- a/deps/grpc/src/core/lib/promise/activity.h
+++ b/deps/grpc/src/core/lib/promise/activity.h
@@ -565,7 +565,7 @@ class PromiseActivity final
   }
 
   void WakeupAsync(WakeupMask) final {
-    GRPC_LATENT_SEE_INNER_SCOPE("PromiseActivity::WakeupAsync");
+    GRPC_LATENT_SEE_SCOPE("PromiseActivity::WakeupAsync");
     wakeup_flow_.Begin(GRPC_LATENT_SEE_METADATA("Activity::Wakeup"));
     if (!wakeup_scheduled_.exchange(true, std::memory_order_acq_rel)) {
       // Can't safely run, so ask to run later.
@@ -590,7 +590,7 @@ class PromiseActivity final
   // In response to Wakeup, run the Promise state machine again until it
   // settles. Then check for completion, and if we have completed, call on_done.
   void Step() ABSL_LOCKS_EXCLUDED(mu()) {
-    GRPC_LATENT_SEE_PARENT_SCOPE("PromiseActivity::Step");
+    GRPC_LATENT_SEE_SCOPE("PromiseActivity::Step");
     wakeup_flow_.End();
     // Poll the promise until things settle out under a lock.
     mu()->Lock();
diff --git a/deps/grpc/src/core/lib/promise/mpsc.cc b/deps/grpc/src/core/lib/promise/mpsc.cc
index 87c0c475922..4b4667a8c95 100644
--- a/deps/grpc/src/core/lib/promise/mpsc.cc
+++ b/deps/grpc/src/core/lib/promise/mpsc.cc
@@ -27,7 +27,7 @@ namespace grpc_core::mpscpipe_detail {
 Mpsc::~Mpsc() { Close(false); }
 
 void Mpsc::Enqueue(Node* node) {
-  GRPC_LATENT_SEE_INNER_SCOPE("Mpsc::Enqueue");
+  GRPC_LATENT_SEE_SCOPE("Mpsc::Enqueue");
   auto actors = actors_.load(std::memory_order_relaxed);
   while (true) {
     if (actors == 0) {
@@ -67,7 +67,7 @@ void Mpsc::Enqueue(Node* node) {
 }
 
 StatusFlag Mpsc::UnbufferedImmediateSend(Node* node) {
-  GRPC_LATENT_SEE_INNER_SCOPE("Mpsc::UnbufferedImmediateSend");
+  GRPC_LATENT_SEE_SCOPE("Mpsc::UnbufferedImmediateSend");
   auto actors = actors_.load(std::memory_order_relaxed);
   while (true) {
     if (actors == 0) {
@@ -120,7 +120,7 @@ channelz::PropertyList Mpsc::PollNextChannelzProperties() const {
 }
 
 Poll<ValueOrFailure<Mpsc::Node*>> Mpsc::PollNext() {
-  GRPC_LATENT_SEE_INNER_SCOPE("Mpsc::Next");
+  GRPC_LATENT_SEE_SCOPE("Mpsc::Next");
   Node* accepted_head = accepted_head_;
   if (accepted_head != nullptr) {
     accepted_head_ = accepted_head->spsc_next_;
@@ -150,7 +150,7 @@ Poll<ValueOrFailure<Mpsc::Node*>> Mpsc::PollNext() {
 }
 
 bool Mpsc::AcceptNode(Node* node) {
-  GRPC_LATENT_SEE_INNER_SCOPE("Mpsc::AcceptNode");
+  GRPC_LATENT_SEE_SCOPE("Mpsc::AcceptNode");
   DCHECK_NE(node, nullptr);
   if (node->state_.fetch_and(255 - Node::kBlockedState,
                              std::memory_order_relaxed) &
@@ -163,7 +163,7 @@ bool Mpsc::AcceptNode(Node* node) {
 }
 
 bool Mpsc::CheckActiveTokens() {
-  GRPC_LATENT_SEE_INNER_SCOPE("Mpsc::CheckActiveTokens");
+  GRPC_LATENT_SEE_SCOPE("Mpsc::CheckActiveTokens");
   // First step: see if the active token count is lower than max_queued_.
   // If it's not, we do not supply any nodes.
   auto active_tokens = active_tokens_.load(std::memory_order_relaxed);
@@ -189,7 +189,7 @@ bool Mpsc::CheckActiveTokens() {
 }
 
 void Mpsc::DrainMpsc() {
-  GRPC_LATENT_SEE_INNER_SCOPE("Mpsc::DrainMpsc");
+  GRPC_LATENT_SEE_SCOPE("Mpsc::DrainMpsc");
 #ifndef NDEBUG
   DCHECK(!drained);
   drained = true;
@@ -213,7 +213,7 @@ void Mpsc::DrainMpsc() {
 }
 
 Poll<Mpsc::Node*> Mpsc::Dequeue() {
-  GRPC_LATENT_SEE_INNER_SCOPE("Mpsc::Dequeue");
+  GRPC_LATENT_SEE_SCOPE("Mpsc::Dequeue");
   Node* tail = tail_;
   uintptr_t next = tail->next_.load(std::memory_order_acquire);
 retry_all:
@@ -304,7 +304,7 @@ void Mpsc::PushStub() {
 }
 
 Mpsc::Node* Mpsc::DequeueImmediate() {
-  GRPC_LATENT_SEE_INNER_SCOPE("Mpsc::DequeueImmediate");
+  GRPC_LATENT_SEE_SCOPE("Mpsc::DequeueImmediate");
   Node* tail = tail_;
   uintptr_t next = tail->next_.load(std::memory_order_acquire);
   if (tail == &stub_) {
diff --git a/deps/grpc/src/core/lib/promise/party.cc b/deps/grpc/src/core/lib/promise/party.cc
index 3c02cba906b..70e5395f21c 100644
--- a/deps/grpc/src/core/lib/promise/party.cc
+++ b/deps/grpc/src/core/lib/promise/party.cc
@@ -155,7 +155,7 @@ Party::Participant::~Participant() {
 // Party::SpawnSerializer
 
 bool Party::SpawnSerializer::PollParticipantPromise() {
-  GRPC_LATENT_SEE_INNER_SCOPE("SpawnSerializer::PollParticipantPromise");
+  GRPC_LATENT_SEE_SCOPE("SpawnSerializer::PollParticipantPromise");
   if (active_ == nullptr) {
     active_ = next_.Pop().value_or(nullptr);
   }
@@ -278,7 +278,7 @@ void Party::ForceImmediateRepoll(WakeupMask mask) {
 }
 
 void Party::RunLockedAndUnref(Party* party, uint64_t prev_state) {
-  GRPC_LATENT_SEE_PARENT_SCOPE("Party::RunLocked");
+  GRPC_LATENT_SEE_SCOPE("Party::RunLocked");
 #ifdef GRPC_MAXIMIZE_THREADYNESS
   Thread thd(
       "RunParty",
@@ -305,7 +305,7 @@ void Party::RunLockedAndUnref(Party* party, uint64_t prev_state) {
     GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION void Run() {
       g_run_state = this;
       do {
-        GRPC_LATENT_SEE_INNER_SCOPE("run_one_party");
+        GRPC_LATENT_SEE_SCOPE("run_one_party");
         CHECK(first.party != nullptr);
         first.party->RunPartyAndUnref(first.prev_state);
         first = std::exchange(next, PartyWakeup{});
@@ -342,9 +342,9 @@ void Party::RunLockedAndUnref(Party* party, uint64_t prev_state) {
       auto* event_engine =
           arena->GetContext<grpc_event_engine::experimental::EventEngine>();
       CHECK(event_engine != nullptr) << "; " << GRPC_DUMP_ARGS(party, arena);
-      GRPC_LATENT_SEE_INNER_SCOPE("offload_one_party");
+      GRPC_LATENT_SEE_SCOPE("offload_one_party");
       event_engine->Run([wakeup]() {
-        GRPC_LATENT_SEE_PARENT_SCOPE("Party::RunLocked offload");
+        GRPC_LATENT_SEE_SCOPE("Party::RunLocked offload");
         ExecCtx exec_ctx;
         RunState{wakeup}.Run();
       });
@@ -478,7 +478,7 @@ uint64_t Party::NextAllocationMask(uint64_t current_allocation_mask) {
 #endif
 
 size_t Party::AddParticipant(Participant* participant) {
-  GRPC_LATENT_SEE_INNER_SCOPE("Party::AddParticipant");
+  GRPC_LATENT_SEE_SCOPE("Party::AddParticipant");
   uint64_t state = state_.load(std::memory_order_acquire);
   uint64_t allocated;
   size_t slot;
@@ -544,7 +544,7 @@ void Party::WakeupAsync(WakeupMask wakeup_mask) {
         wakeup_mask_ |= wakeup_mask;
         arena_->GetContext<grpc_event_engine::experimental::EventEngine>()->Run(
             [this, prev_state]() {
-              GRPC_LATENT_SEE_PARENT_SCOPE("Party::WakeupAsync");
+              GRPC_LATENT_SEE_SCOPE("Party::WakeupAsync");
               ExecCtx exec_ctx;
               RunLockedAndUnref(this, prev_state);
             });
diff --git a/deps/grpc/src/core/lib/promise/party.h b/deps/grpc/src/core/lib/promise/party.h
index 7e74f65bd91..462b56c11f1 100644
--- a/deps/grpc/src/core/lib/promise/party.h
+++ b/deps/grpc/src/core/lib/promise/party.h
@@ -436,7 +436,7 @@ class Party : public Activity, private Wakeable {
     }
 
     bool PollParticipantPromise() override {
-      GRPC_LATENT_SEE_INNER_SCOPE(TypeName<SuppliedFactory>());
+      GRPC_LATENT_SEE_SCOPE(TypeName<SuppliedFactory>());
       if (!started_) {
         auto p = factory_.Make();
         Destruct(&factory_);
@@ -508,7 +508,7 @@ class Party : public Activity, private Wakeable {
 
     // Inside party poll: drive from factory -> promise -> result
     bool PollParticipantPromise() override {
-      GRPC_LATENT_SEE_INNER_SCOPE(TypeName<SuppliedFactory>());
+      GRPC_LATENT_SEE_SCOPE(TypeName<SuppliedFactory>());
       switch (state_.load(std::memory_order_relaxed)) {
         case State::kFactory: {
           auto p = factory_.Make();
@@ -623,7 +623,7 @@ class Party : public Activity, private Wakeable {
 
   // Wakeable implementation
   void Wakeup(WakeupMask wakeup_mask) final {
-    GRPC_LATENT_SEE_INNER_SCOPE("Party::Wakeup");
+    GRPC_LATENT_SEE_SCOPE("Party::Wakeup");
     if (Activity::current() == this) {
       wakeup_mask_ |= wakeup_mask;
       Unref();
@@ -635,7 +635,7 @@ class Party : public Activity, private Wakeable {
   template <bool kReffed>
   GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION void WakeupFromState(
       uint64_t cur_state, WakeupMask wakeup_mask) {
-    GRPC_LATENT_SEE_INNER_SCOPE("Party::WakeupFromState");
+    GRPC_LATENT_SEE_SCOPE("Party::WakeupFromState");
     DCHECK_NE(wakeup_mask & kWakeupMask, 0u)
         << "Wakeup mask must be non-zero: " << wakeup_mask;
     while (true) {
diff --git a/deps/grpc/src/core/lib/promise/poll.h b/deps/grpc/src/core/lib/promise/poll.h
index aaf3d12eaea..5167f3de6cb 100644
--- a/deps/grpc/src/core/lib/promise/poll.h
+++ b/deps/grpc/src/core/lib/promise/poll.h
@@ -270,6 +270,16 @@ GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION inline Poll<T> poll_cast(U poll) {
   return PollCastImpl<T, U>::Cast(std::move(poll));
 }
 
+template <typename T>
+bool IsPending(const T&) {
+  return false;
+}
+
+template <typename T>
+bool IsPending(const Poll<T>& poll) {
+  return poll.pending();
+}
+
 // Convert a poll to a string
 template <typename T, typename F>
 std::string PollToString(
diff --git a/deps/grpc/src/core/lib/resource_quota/GEMINI.md b/deps/grpc/src/core/lib/resource_quota/GEMINI.md
new file mode 100644
index 00000000000..4bf2508d63d
--- /dev/null
+++ b/deps/grpc/src/core/lib/resource_quota/GEMINI.md
@@ -0,0 +1,28 @@
+# Resource Quota
+
+This directory contains the implementation of the gRPC resource quota system.
+
+## Overarching Purpose
+
+The resource quota system provides a mechanism for controlling the amount of resources (e.g., memory, threads) that are used by gRPC. This can be used to prevent gRPC from consuming too many resources and to ensure that the system remains stable.
+
+## Core Concepts
+
+*   **`ResourceQuota`**: The `ResourceQuota` class is the main class for managing resource quotas. It is a container for a `MemoryQuota` and a `ThreadQuota`.
+*   **`MemoryQuota`**: The `MemoryQuota` class is responsible for managing memory usage. It provides a way to reserve and release memory, and it can be configured to limit the total amount of memory that can be used.
+*   **`ThreadQuota`**: The `ThreadQuota` class is responsible for managing thread usage. It provides a way to reserve and release threads, and it can be configured to limit the total number of threads that can be used.
+*   **`Arena`**: An `Arena` is a custom memory allocator that is used by the resource quota system. It is designed to be very fast, and it is used to allocate memory for things like call objects and metadata. In addition to memory allocation, the Arena also serves as an index for context objects associated with a call, indexed by type. This allows various parts of the gRPC stack to attach and retrieve objects within the scope of a single Arena.
+
+## Files
+
+*   **`resource_quota.h`, `resource_quota.cc`**: These files define the `ResourceQuota` class.
+*   **`memory_quota.h`, `memory_quota.cc`**: These files define the `MemoryQuota` class.
+*   **`thread_quota.h`, `thread_quota.cc`**: These files define the `ThreadQuota` class.
+*   **`arena.h`, `arena.cc`**: These files define the `Arena` class.
+*   **`api.h`, `api.cc`**: These files define the public C API for the resource quota system.
+
+## Notes
+
+*   The resource quota system is a key component of gRPC's reliability and stability story. It helps to prevent gRPC from consuming too many resources and to ensure that the system remains stable under heavy load.
+*   The resource quota system is highly configurable. It can be configured to limit the amount of memory and threads that are used by gRPC, as well as the rate at which these resources are consumed.
+*   The `Arena` is a particularly important component of the resource quota system. It is a highly optimized memory allocator that is designed to be very fast. It is used to allocate memory for all of the per-call data structures in gRPC, and it is a key reason why gRPC is so performant.
diff --git a/deps/grpc/src/core/lib/resource_quota/memory_quota.cc b/deps/grpc/src/core/lib/resource_quota/memory_quota.cc
index 70e909f0dda..11eb8a6c30f 100644
--- a/deps/grpc/src/core/lib/resource_quota/memory_quota.cc
+++ b/deps/grpc/src/core/lib/resource_quota/memory_quota.cc
@@ -32,6 +32,8 @@
 #include "absl/log/log.h"
 #include "absl/status/status.h"
 #include "absl/strings/str_cat.h"
+#include "src/core/channelz/channelz.h"
+#include "src/core/channelz/property_list.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/promise/exec_ctx_wakeup_scheduler.h"
 #include "src/core/lib/promise/loop.h"
@@ -407,6 +409,20 @@ grpc_slice GrpcMemoryAllocatorImpl::MakeSlice(MemoryRequest request) {
   return slice;
 }
 
+void GrpcMemoryAllocatorImpl::FillChannelzProperties(
+    channelz::PropertyList& list) {
+  list.Set("free_bytes", free_bytes_.load(std::memory_order_relaxed))
+      .Set("taken_bytes", taken_bytes_.load(std::memory_order_relaxed))
+      .Set("chosen_shard_idx",
+           chosen_shard_idx_.load(std::memory_order_relaxed))
+      .Set("donate_back_period", donate_back_.period());
+  donate_back_.Interrupt([&list](Duration so_far) {
+    list.Set("donate_back_period_expired", so_far);
+  });
+  MutexLock lock(&reclaimer_mu_);
+  list.Set("shutdown", shutdown_);
+}
+
 //
 // BasicMemoryQuota
 //
@@ -431,7 +447,11 @@ class BasicMemoryQuota::WaitForSweepPromise {
   uint64_t token_;
 };
 
-BasicMemoryQuota::BasicMemoryQuota(std::string name) : name_(std::move(name)) {}
+BasicMemoryQuota::BasicMemoryQuota(
+    RefCountedPtr<channelz::ResourceQuotaNode> channelz_node)
+    : channelz::DataSource(channelz_node) {
+  channelz::DataSource::SourceConstructed();
+}
 
 void BasicMemoryQuota::Start() {
   auto self = shared_from_this();
@@ -471,7 +491,7 @@ void BasicMemoryQuota::Start() {
           if (GRPC_TRACE_FLAG_ENABLED(resource_quota)) {
             double free = std::max(intptr_t{0}, self->free_bytes_.load());
             size_t quota_size = self->quota_size_.load();
-            LOG(INFO) << "RQ: " << self->name_ << " perform "
+            LOG(INFO) << "RQ: " << self->name() << " perform "
                       << std::get<0>(arg)
                       << " reclamation. Available free bytes: " << free
                       << ", total quota_size: " << quota_size;
@@ -555,7 +575,7 @@ void BasicMemoryQuota::FinishReclamation(uint64_t token, Waker waker) {
     if (GRPC_TRACE_FLAG_ENABLED(resource_quota)) {
       double free = std::max(intptr_t{0}, free_bytes_.load());
       size_t quota_size = quota_size_.load();
-      LOG(INFO) << "RQ: " << name_
+      LOG(INFO) << "RQ: " << name()
                 << " reclamation complete. Available free bytes: " << free
                 << ", total quota_size: " << quota_size;
     }
@@ -678,6 +698,44 @@ BasicMemoryQuota::PressureInfo BasicMemoryQuota::GetPressureInfo() {
   return pressure_info;
 }
 
+void BasicMemoryQuota::AddData(channelz::DataSink sink) {
+  sink.AddData(
+      "memory_quota",
+      channelz::PropertyList()
+          .Set("free_bytes", free_bytes_.load(std::memory_order_relaxed))
+          .Set("quota_size", quota_size_.load(std::memory_order_relaxed))
+          .Merge(pressure_tracker_.ChannelzProperties())
+          .Set("allocators",
+               [this]() {
+                 channelz::PropertyTable table;
+                 for (auto& shard : small_allocators_.shards) {
+                   MutexLock l(&shard.shard_mu);
+                   size_t i = 0;
+                   for (auto& allocator : shard.allocators) {
+                     i++;
+                     channelz::PropertyList list;
+                     list.Set("shard", absl::StrCat("small", i));
+                     allocator->FillChannelzProperties(list);
+                     table.AppendRow(std::move(list));
+                   }
+                 }
+                 for (auto& shard : big_allocators_.shards) {
+                   MutexLock l(&shard.shard_mu);
+                   size_t i = 0;
+                   for (auto& allocator : shard.allocators) {
+                     i++;
+                     channelz::PropertyList list;
+                     list.Set("shard", absl::StrCat("big", i));
+                     allocator->FillChannelzProperties(list);
+                     table.AppendRow(std::move(list));
+                   }
+                 }
+                 return table;
+               }())
+          .Set("reclamation_counter",
+               reclamation_counter_.load(std::memory_order_relaxed)));
+}
+
 //
 // PressureTracker
 //
@@ -789,6 +847,35 @@ double PressureTracker::AddSampleAndGetControlValue(double sample) {
   return report_.load(std::memory_order_relaxed);
 }
 
+channelz::PropertyList PressureController::ChannelzProperties() const {
+  return channelz::PropertyList()
+      .Set("ticks_same_pressure", ticks_same_)
+      .Set("max_ticks_same_pressure", max_ticks_same_)
+      .Set("max_pressure_reduction_per_tick", max_reduction_per_tick_ * 0.001)
+      .Set("last_pressure_was_low", last_was_low_)
+      .Set("min_pressure", min_)
+      .Set("max_pressure", max_)
+      .Set("last_control", last_control_);
+}
+
+channelz::PropertyList PressureTracker::ChannelzProperties() {
+  return channelz::PropertyList()
+      .Set("max_pressure_this_round",
+           max_this_round_.load(std::memory_order_relaxed))
+      .Set("pressure_report", report_.load(std::memory_order_relaxed))
+      .Merge([this]() {
+        channelz::PropertyList list;
+        if (!update_.Interrupt([&](Duration duration) {
+              list = controller_.ChannelzProperties();
+              list.Set("time_since_last_pressure_update", duration);
+              list.Set("pressure_update_period", update_.period());
+            })) {
+          list.Set("pressure_controller_busy", true)
+              .Set("pressure_update_period", update_.period());
+        }
+        return list;
+      }());
+}
 }  // namespace memory_quota_detail
 
 //
diff --git a/deps/grpc/src/core/lib/resource_quota/memory_quota.h b/deps/grpc/src/core/lib/resource_quota/memory_quota.h
index dd5038123a4..52714d48ef3 100644
--- a/deps/grpc/src/core/lib/resource_quota/memory_quota.h
+++ b/deps/grpc/src/core/lib/resource_quota/memory_quota.h
@@ -35,6 +35,7 @@
 #include "absl/log/check.h"
 #include "absl/log/log.h"
 #include "absl/strings/string_view.h"
+#include "src/core/channelz/channelz.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/experiments/experiments.h"
 #include "src/core/lib/promise/activity.h"
@@ -233,6 +234,7 @@ class PressureController {
   double Update(double error);
   // Textual representation of the controller.
   std::string DebugString() const;
+  channelz::PropertyList ChannelzProperties() const;
 
  private:
   // How many update periods have we reached the same decision in a row?
@@ -264,6 +266,8 @@ class PressureTracker {
  public:
   double AddSampleAndGetControlValue(double sample);
 
+  channelz::PropertyList ChannelzProperties();
+
  private:
   std::atomic<double> max_this_round_{0.0};
   std::atomic<double> report_{0.0};
@@ -279,7 +283,8 @@ static constexpr size_t kBigAllocatorThreshold = 0.5 * 1024 * 1024;
 static constexpr size_t kSmallAllocatorThreshold = 0.1 * 1024 * 1024;
 
 class BasicMemoryQuota final
-    : public std::enable_shared_from_this<BasicMemoryQuota> {
+    : public std::enable_shared_from_this<BasicMemoryQuota>,
+      public channelz::DataSource {
  public:
   // Data about current memory pressure.
   struct PressureInfo {
@@ -292,7 +297,9 @@ class BasicMemoryQuota final
     size_t max_recommended_allocation_size = 0;
   };
 
-  explicit BasicMemoryQuota(std::string name);
+  explicit BasicMemoryQuota(
+      RefCountedPtr<channelz::ResourceQuotaNode> channelz_node);
+  ~BasicMemoryQuota() { channelz::DataSource::SourceDestructing(); }
 
   // Start the reclamation activity.
   void Start();
@@ -324,7 +331,9 @@ class BasicMemoryQuota final
   ReclaimerQueue* reclaimer_queue(size_t i) { return &reclaimers_[i]; }
 
   // The name of this quota
-  absl::string_view name() const { return name_; }
+  absl::string_view name() const { return channelz_node()->name(); }
+
+  void AddData(channelz::DataSink sink) override;
 
  private:
   friend class ReclamationSweep;
@@ -378,8 +387,6 @@ class BasicMemoryQuota final
   std::atomic<uint64_t> reclamation_counter_{0};
   // Memory pressure smoothing
   memory_quota_detail::PressureTracker pressure_tracker_;
-  // The name of this quota - used for debugging/tracing/etc..
-  std::string name_;
 };
 
 // MemoryAllocatorImpl grants the owner the ability to allocate memory from an
@@ -453,6 +460,8 @@ class GrpcMemoryAllocatorImpl final : public EventEngineMemoryAllocatorImpl {
     return chosen_shard_idx_.fetch_add(1, std::memory_order_relaxed);
   }
 
+  void FillChannelzProperties(channelz::PropertyList& list);
+
  private:
   static constexpr size_t kMaxQuotaBufferSize = 1024 * 1024;
 
@@ -550,8 +559,9 @@ class MemoryOwner final : public MemoryAllocator {
 class MemoryQuota final
     : public grpc_event_engine::experimental::MemoryAllocatorFactory {
  public:
-  explicit MemoryQuota(std::string name)
-      : memory_quota_(std::make_shared<BasicMemoryQuota>(std::move(name))) {
+  explicit MemoryQuota(RefCountedPtr<channelz::ResourceQuotaNode> channelz_node)
+      : memory_quota_(
+            std::make_shared<BasicMemoryQuota>(std::move(channelz_node))) {
     memory_quota_->Start();
   }
   ~MemoryQuota() override {
@@ -580,8 +590,9 @@ class MemoryQuota final
 };
 
 using MemoryQuotaRefPtr = std::shared_ptr<MemoryQuota>;
-inline MemoryQuotaRefPtr MakeMemoryQuota(std::string name) {
-  return std::make_shared<MemoryQuota>(std::move(name));
+inline MemoryQuotaRefPtr MakeMemoryQuota(
+    RefCountedPtr<channelz::ResourceQuotaNode> channelz_node) {
+  return std::make_shared<MemoryQuota>(std::move(channelz_node));
 }
 
 std::vector<std::shared_ptr<BasicMemoryQuota>> AllMemoryQuotas();
diff --git a/deps/grpc/src/core/lib/resource_quota/periodic_update.cc b/deps/grpc/src/core/lib/resource_quota/periodic_update.cc
index 6cfa7631d47..793667acdfd 100644
--- a/deps/grpc/src/core/lib/resource_quota/periodic_update.cc
+++ b/deps/grpc/src/core/lib/resource_quota/periodic_update.cc
@@ -22,6 +22,20 @@
 
 namespace grpc_core {
 
+bool PeriodicUpdate::Interrupt(absl::FunctionRef<void(Duration)> f) {
+  int64_t old_value = updates_remaining_.load(std::memory_order_acquire);
+  while (true) {
+    if (old_value <= 1) return false;
+    if (!updates_remaining_.compare_exchange_weak(old_value, 0,
+                                                  std::memory_order_acquire)) {
+      continue;
+    }
+    f(Timestamp::Now() - period_start_);
+    updates_remaining_.store(old_value, std::memory_order_release);
+    return true;
+  }
+}
+
 bool PeriodicUpdate::MaybeEndPeriod(absl::FunctionRef<void(Duration)> f) {
   if (period_start_ == Timestamp::ProcessEpoch()) {
     period_start_ = Timestamp::Now();
diff --git a/deps/grpc/src/core/lib/resource_quota/periodic_update.h b/deps/grpc/src/core/lib/resource_quota/periodic_update.h
index 950df574815..336cc84ecff 100644
--- a/deps/grpc/src/core/lib/resource_quota/periodic_update.h
+++ b/deps/grpc/src/core/lib/resource_quota/periodic_update.h
@@ -48,6 +48,14 @@ class PeriodicUpdate {
     return false;
   }
 
+  // Interrupt execution: call f as if the period expired, and then continue
+  // from where we left off.
+  // Returns false if this was not possible (eg we were at the end of a tick)
+  // Argument to the callback is the amount of time expired so far.
+  bool Interrupt(absl::FunctionRef<void(Duration)> f);
+
+  Duration period() const { return period_; }
+
  private:
   bool MaybeEndPeriod(absl::FunctionRef<void(Duration)> f);
 
diff --git a/deps/grpc/src/core/lib/resource_quota/resource_quota.cc b/deps/grpc/src/core/lib/resource_quota/resource_quota.cc
index 0a266756e19..5361ef3bbd0 100644
--- a/deps/grpc/src/core/lib/resource_quota/resource_quota.cc
+++ b/deps/grpc/src/core/lib/resource_quota/resource_quota.cc
@@ -16,18 +16,29 @@
 
 #include <grpc/support/port_platform.h>
 
+#include "src/core/util/no_destruct.h"
+#include "src/core/util/single_set_ptr.h"
+
 namespace grpc_core {
 
 ResourceQuota::ResourceQuota(std::string name)
-    : memory_quota_(MakeMemoryQuota(std::move(name))),
+    : channelz_node_(
+          MakeRefCounted<channelz::ResourceQuotaNode>(std::move(name))),
+      memory_quota_(MakeMemoryQuota(channelz_node_)),
       thread_quota_(MakeRefCounted<ThreadQuota>()) {}
 
 ResourceQuota::~ResourceQuota() = default;
 
+namespace {
+NoDestruct<SingleSetRefCountedPtr<ResourceQuota>> default_resource_quota{};
+}  // namespace
+
 ResourceQuotaRefPtr ResourceQuota::Default() {
-  static auto default_resource_quota =
-      MakeResourceQuota("default_resource_quota").release();
-  return default_resource_quota->Ref();
+  return default_resource_quota->GetOrCreate("default_resource_quota");
+}
+
+void ResourceQuota::TestOnlyResetDefaultResourceQuota() {
+  default_resource_quota->Reset();
 }
 
 }  // namespace grpc_core
diff --git a/deps/grpc/src/core/lib/resource_quota/resource_quota.h b/deps/grpc/src/core/lib/resource_quota/resource_quota.h
index ffe61903255..9f34ec566f6 100644
--- a/deps/grpc/src/core/lib/resource_quota/resource_quota.h
+++ b/deps/grpc/src/core/lib/resource_quota/resource_quota.h
@@ -23,6 +23,7 @@
 #include <utility>
 
 #include "absl/strings/string_view.h"
+#include "src/core/channelz/channelz.h"
 #include "src/core/lib/resource_quota/memory_quota.h"
 #include "src/core/lib/resource_quota/thread_quota.h"
 #include "src/core/util/cpp_impl_of.h"
@@ -53,6 +54,7 @@ class ResourceQuota : public RefCounted<ResourceQuota>,
 
   // The default global resource quota
   static ResourceQuotaRefPtr Default();
+  static void TestOnlyResetDefaultResourceQuota();
 
   static int ChannelArgsCompare(const ResourceQuota* a,
                                 const ResourceQuota* b) {
@@ -60,6 +62,7 @@ class ResourceQuota : public RefCounted<ResourceQuota>,
   }
 
  private:
+  RefCountedPtr<channelz::ResourceQuotaNode> channelz_node_;
   MemoryQuotaRefPtr memory_quota_;
   RefCountedPtr<ThreadQuota> thread_quota_;
 };
diff --git a/deps/grpc/src/core/lib/security/authorization/GEMINI.md b/deps/grpc/src/core/lib/security/authorization/GEMINI.md
new file mode 100644
index 00000000000..14e207b8db6
--- /dev/null
+++ b/deps/grpc/src/core/lib/security/authorization/GEMINI.md
@@ -0,0 +1,40 @@
+# Authorization
+
+This directory contains the implementation of the gRPC authorization framework.
+
+## Overarching Purpose
+
+The authorization framework provides a mechanism for authorizing incoming requests based on a set of rules defined in an authorization policy. This can be used to control access to gRPC services and methods based on the authenticated user's identity and other request metadata.
+
+## Core Concepts
+
+The authorization framework is built around a few key abstractions:
+
+*   **`AuthorizationEngine`**: The `AuthorizationEngine` is the main interface for making authorization decisions. It takes a set of evaluation arguments and returns an authorization decision.
+*   **`AuthorizationPolicyProvider`**: The `AuthorizationPolicyProvider` is responsible for providing the authorization policy to the `AuthorizationEngine`. This allows the authorization policy to be loaded from a variety of sources, such as a local file or a remote server.
+*   **`EvaluateArgs`**: The `EvaluateArgs` struct contains the information that is needed to make an authorization decision. This includes the request headers, the peer identity, and other information about the request.
+
+## Implementations
+
+The authorization framework includes two main implementations of the `AuthorizationEngine`:
+
+*   **`GrpcAuthorizationEngine`**: This implementation is based on the [Envoy RBAC filter](https://www.envoyproxy.io/docs/envoy/latest/configuration/http/http_filters/rbac_filter). It uses a set of RBAC policies to make authorization decisions.
+*   **`CelAuthorizationEngine`**: This implementation is based on the [Common Expression Language (CEL)](https://cel-spec.dev/). It uses a set of CEL expressions to make authorization decisions. This implementation is still experimental.
+
+## Files
+
+*   **`authorization_engine.h`**: Defines the `AuthorizationEngine` interface.
+*   **`grpc_authorization_engine.h`, `grpc_authorization_engine.cc`**: These files define the `GrpcAuthorizationEngine` class.
+*   **`cel_authorization_engine.h`, `cel_authorization_engine.cc`**: These files define the `CelAuthorizationEngine` class.
+*   **`grpc_server_authz_filter.h`, `grpc_server_authz_filter.cc`**: These files define the `GrpcServerAuthzFilter` class, which is a server-side filter that uses an `AuthorizationEngine` to authorize incoming requests.
+*   **`rbac_policy.h`, `rbac_policy.cc`**: These files define the `Rbac` struct, which represents an RBAC policy.
+*   **`authorization_policy_provider.h`**: Defines the `AuthorizationPolicyProvider` interface.
+*   **`grpc_authorization_policy_provider.h`, `grpc_authorization_policy_provider.cc`**: These files define a concrete implementation of the `AuthorizationPolicyProvider` interface that loads the authorization policy from a static string.
+*   **`audit_logging.h`, `audit_logging.cc`**: These files define the interfaces for audit logging. Audit logging can be used to record information about authorization decisions.
+
+## Notes
+
+*   The authorization framework is a powerful tool for securing gRPC services. It can be used to implement a wide range of authorization policies, from simple access control lists to complex, attribute-based policies.
+*   The framework is designed to be used in conjunction with xDS, which can be used to dynamically update the authorization policy at runtime.
+*   The CEL-based authorization engine is still experimental and is not yet recommended for production use.
+*   Audit logging can be used to record information about authorization decisions. This can be useful for security auditing and for debugging authorization policies.
diff --git a/deps/grpc/src/core/lib/security/authorization/grpc_server_authz_filter.cc b/deps/grpc/src/core/lib/security/authorization/grpc_server_authz_filter.cc
index 4e88deb2a0c..4bf48518240 100644
--- a/deps/grpc/src/core/lib/security/authorization/grpc_server_authz_filter.cc
+++ b/deps/grpc/src/core/lib/security/authorization/grpc_server_authz_filter.cc
@@ -92,8 +92,7 @@ bool GrpcServerAuthzFilter::IsAuthorized(ClientMetadata& initial_metadata) {
 
 absl::Status GrpcServerAuthzFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, GrpcServerAuthzFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
-      "GrpcServerAuthzFilter::Call::OnClientInitialMetadata");
+  GRPC_LATENT_SEE_SCOPE("GrpcServerAuthzFilter::Call::OnClientInitialMetadata");
   if (!filter->IsAuthorized(md)) {
     return absl::PermissionDeniedError("Unauthorized RPC request rejected.");
   }
diff --git a/deps/grpc/src/core/lib/slice/GEMINI.md b/deps/grpc/src/core/lib/slice/GEMINI.md
new file mode 100644
index 00000000000..58b77d80dbf
--- /dev/null
+++ b/deps/grpc/src/core/lib/slice/GEMINI.md
@@ -0,0 +1,70 @@
+# Slice
+
+This directory contains the implementation of the gRPC slice library, which
+provides a set of data structures for representing and manipulating blocks of
+memory.
+
+## Overarching Purpose
+
+The slice library is a core component of gRPC's C-core. It is used extensively
+throughout the gRPC codebase to represent message payloads, metadata, and other
+data. Its primary purpose is to provide a safe, efficient, and flexible way to
+manage memory.
+
+## Core Concepts
+
+The slice library is built around a few key abstractions:
+
+*   **`Slice`**: A `Slice` is a reference-counted, immutable string-like object. It is the most common type of slice, and it is used to represent data that is shared between multiple parts of the codebase.
+*   **`MutableSlice`**: A `MutableSlice` is a slice that is guaranteed to have a unique owner. This means that the underlying data can be mutated safely.
+*   **`StaticSlice`**: A `StaticSlice` is a slice that points to a
+    statically-allocated block of memory. It is not reference-counted, and it is
+    very fast to copy.
+*   **`SliceBuffer`**: A `SliceBuffer` is a container for a collection of `Slice`
+    objects. It is used to represent a sequence of slices, such as a message.
+
+The key to understanding the slice library is to understand the ownership model.
+A `Slice` can be either "owned" or "unowned". An owned slice has a reference
+count, and the underlying memory is freed when the reference count drops to zero.
+An unowned slice does not have a reference count, and the underlying memory is
+not freed when the slice is destroyed. The type of a slice determines its
+ownership model.
+
+## Performance
+
+The slice library is a key component of gRPC's performance and memory
+efficiency. It allows gRPC to avoid unnecessary data copies and to manage memory
+in a more efficient way. For example, when a message is received, it can be
+represented as a `SliceBuffer` of `Slice`s. Each `Slice` can point to a different
+part of the underlying network buffer. This allows the message to be processed
+without having to copy the data into a contiguous block of memory.
+
+## Files
+
+*   **`slice.h`, `slice.cc`**: These files define the `Slice`, `MutableSlice`, and
+    `StaticSlice` classes.
+*   **`slice_buffer.h`, `slice_buffer.cc`**: These files define the `SliceBuffer` class.
+*   **`slice_internal.h`**: This file contains the internal implementation details
+    of the slice library.
+*   **`slice_refcount.h`**: This file defines the `grpc_slice_refcount` class,
+    which is used to manage the reference count of a slice.
+*   **`percent_encoding.h`, `percent_encoding.cc`**: These files provide
+    functions for percent-encoding and decoding slices. This is used to encode
+    binary data in a way that is safe for transmission over HTTP/2.
+
+## Major Classes
+
+*   `grpc_core::Slice`: A reference-counted, immutable string-like object.
+*   `grpc_core::MutableSlice`: A slice with a unique owner, allowing for safe mutation.
+*   `grpc_core::StaticSlice`: A slice that points to statically-allocated memory.
+*   `grpc_core::SliceBuffer`: A container for a collection of `Slice` objects.
+
+## Notes
+
+*   The slice library is a low-level component of the gRPC stack. Most
+    application developers will not need to interact with it directly.
+*   The `Slice` and `SliceBuffer` classes are designed to be thread-safe.
+*   The slice library is a good example of how gRPC uses a combination of C and
+    C++ to achieve high performance and memory efficiency. The core data
+    structures are implemented in C, and then wrapped in C++ classes to provide a
+    more convenient and safe API.
diff --git a/deps/grpc/src/core/lib/surface/call.cc b/deps/grpc/src/core/lib/surface/call.cc
index 88747943fde..4ed21b04c3d 100644
--- a/deps/grpc/src/core/lib/surface/call.cc
+++ b/deps/grpc/src/core/lib/surface/call.cc
@@ -490,13 +490,13 @@ grpc_call_error grpc_call_start_batch_and_execute(grpc_call* call,
 }
 
 void grpc_call_tracer_set(grpc_call* call,
-                          grpc_core::ClientCallTracer* tracer) {
-  grpc_core::Arena* arena = grpc_call_get_arena(call);
-  return arena->SetContext<grpc_core::CallTracerAnnotationInterface>(tracer);
+                          grpc_core::ClientCallTracerInterface* tracer) {
+  grpc_call_get_arena(call)
+      ->SetContext<grpc_core::CallTracerAnnotationInterface>(tracer);
 }
 
-void grpc_call_tracer_set_and_manage(grpc_call* call,
-                                     grpc_core::ClientCallTracer* tracer) {
+void grpc_call_tracer_set_and_manage(
+    grpc_call* call, grpc_core::ClientCallTracerInterface* tracer) {
   grpc_core::Arena* arena = grpc_call_get_arena(call);
   arena->ManagedNew<ClientCallTracerWrapper>(tracer);
   return arena->SetContext<grpc_core::CallTracerAnnotationInterface>(tracer);
diff --git a/deps/grpc/src/core/lib/surface/call.h b/deps/grpc/src/core/lib/surface/call.h
index bc7220ac609..9dd89db7332 100644
--- a/deps/grpc/src/core/lib/surface/call.h
+++ b/deps/grpc/src/core/lib/surface/call.h
@@ -262,7 +262,8 @@ grpc_call* grpc_call_from_top_element(grpc_call_element* surface_element);
 void grpc_call_log_batch(const char* file, int line, const grpc_op* ops,
                          size_t nops);
 
-void grpc_call_tracer_set(grpc_call* call, grpc_core::ClientCallTracer* tracer);
+void grpc_call_tracer_set(grpc_call* call,
+                          grpc_core::ClientCallTracerInterface* tracer);
 
 // Sets call tracer on the call and manages its life by using the call's arena.
 // When using this API, the tracer will be destroyed by grpc_call arena when
@@ -271,8 +272,8 @@ void grpc_call_tracer_set(grpc_call* call, grpc_core::ClientCallTracer* tracer);
 // Arena to manage the lifetime of the call tracer. Python needs this API
 // because the tracer was created within a separate shared object library which
 // doesn't have access to core functions like arena->ManagedNew<>.
-void grpc_call_tracer_set_and_manage(grpc_call* call,
-                                     grpc_core::ClientCallTracer* tracer);
+void grpc_call_tracer_set_and_manage(
+    grpc_call* call, grpc_core::ClientCallTracerInterface* tracer);
 
 void* grpc_call_tracer_get(grpc_call* call);
 
@@ -287,11 +288,11 @@ uint8_t grpc_call_is_client(grpc_call* call);
 
 class ClientCallTracerWrapper {
  public:
-  explicit ClientCallTracerWrapper(grpc_core::ClientCallTracer* tracer)
+  explicit ClientCallTracerWrapper(grpc_core::ClientCallTracerInterface* tracer)
       : tracer_(tracer) {}
 
  private:
-  std::unique_ptr<grpc_core::ClientCallTracer> tracer_;
+  std::unique_ptr<grpc_core::ClientCallTracerInterface> tracer_;
 };
 
 // Return an appropriate compression algorithm for the requested compression \a
diff --git a/deps/grpc/src/core/lib/surface/completion_queue.cc b/deps/grpc/src/core/lib/surface/completion_queue.cc
index 5e9b82871e6..5fc23b65652 100644
--- a/deps/grpc/src/core/lib/surface/completion_queue.cc
+++ b/deps/grpc/src/core/lib/surface/completion_queue.cc
@@ -933,8 +933,7 @@ struct cq_is_finished_arg {
 class ExecCtxNext : public grpc_core::ExecCtx {
  public:
   explicit ExecCtxNext(void* arg)
-      : ExecCtx(0, GRPC_LATENT_SEE_METADATA("ExecCtx for CqNext")),
-        check_ready_to_finish_arg_(arg) {}
+      : ExecCtx(0), check_ready_to_finish_arg_(arg) {}
 
   bool CheckReadyToFinish() override {
     cq_is_finished_arg* a =
@@ -1181,8 +1180,7 @@ static void del_plucker(grpc_completion_queue* cq, void* tag,
 class ExecCtxPluck : public grpc_core::ExecCtx {
  public:
   explicit ExecCtxPluck(void* arg)
-      : ExecCtx(0, GRPC_LATENT_SEE_METADATA("ExecCtx for CqPluck")),
-        check_ready_to_finish_arg_(arg) {}
+      : ExecCtx(0), check_ready_to_finish_arg_(arg) {}
 
   bool CheckReadyToFinish() override {
     cq_is_finished_arg* a =
diff --git a/deps/grpc/src/core/lib/surface/filter_stack_call.cc b/deps/grpc/src/core/lib/surface/filter_stack_call.cc
index 683e5c820b8..3064f64fc98 100644
--- a/deps/grpc/src/core/lib/surface/filter_stack_call.cc
+++ b/deps/grpc/src/core/lib/surface/filter_stack_call.cc
@@ -746,7 +746,7 @@ void FilterStackCall::BatchControl::FinishBatch(grpc_error_handle error) {
 grpc_call_error FilterStackCall::StartBatch(const grpc_op* ops, size_t nops,
                                             void* notify_tag,
                                             bool is_notify_tag_closure) {
-  GRPC_LATENT_SEE_INNER_SCOPE("FilterStackCall::StartBatch");
+  GRPC_LATENT_SEE_SCOPE("FilterStackCall::StartBatch");
 
   size_t i;
   const grpc_op* op;
diff --git a/deps/grpc/src/core/lib/surface/version.cc b/deps/grpc/src/core/lib/surface/version.cc
index 7c65589991b..375428d07f8 100644
--- a/deps/grpc/src/core/lib/surface/version.cc
+++ b/deps/grpc/src/core/lib/surface/version.cc
@@ -22,6 +22,6 @@
 #include <grpc/grpc.h>
 #include <grpc/support/port_platform.h>
 
-const char* grpc_version_string(void) { return "49.0.0"; }
+const char* grpc_version_string(void) { return "50.0.0"; }
 
-const char* grpc_g_stands_for(void) { return "gee"; }
+const char* grpc_g_stands_for(void) { return "gemini"; }
diff --git a/deps/grpc/src/core/lib/transport/promise_endpoint.cc b/deps/grpc/src/core/lib/transport/promise_endpoint.cc
index e229d5bd28f..26ef74bcced 100644
--- a/deps/grpc/src/core/lib/transport/promise_endpoint.cc
+++ b/deps/grpc/src/core/lib/transport/promise_endpoint.cc
@@ -57,7 +57,7 @@ PromiseEndpoint::GetLocalAddress() const {
 
 void PromiseEndpoint::ReadState::Complete(absl::Status status,
                                           const size_t num_bytes_requested) {
-  GRPC_LATENT_SEE_INNER_SCOPE("PromiseEndpoint::ReadState::Complete");
+  GRPC_LATENT_SEE_SCOPE("PromiseEndpoint::ReadState::Complete");
   while (true) {
     if (!status.ok()) {
       // Invalidates all previous reads.
@@ -74,7 +74,7 @@ void PromiseEndpoint::ReadState::Complete(absl::Status status,
                                                   buffer);
     DCHECK(pending_buffer.Count() == 0u);
     if (buffer.Length() < num_bytes_requested) {
-      GRPC_LATENT_SEE_INNER_SCOPE("PromiseEndpoint::ReadState::Continue");
+      GRPC_LATENT_SEE_SCOPE("PromiseEndpoint::ReadState::Continue");
       // A further read is needed.
       // Set read args with number of bytes needed as hint.
       grpc_event_engine::experimental::EventEngine::Endpoint::ReadArgs
diff --git a/deps/grpc/src/core/lib/transport/promise_endpoint.h b/deps/grpc/src/core/lib/transport/promise_endpoint.h
index d98a38f6878..c7863b117c7 100644
--- a/deps/grpc/src/core/lib/transport/promise_endpoint.h
+++ b/deps/grpc/src/core/lib/transport/promise_endpoint.h
@@ -74,7 +74,7 @@ class PromiseEndpoint {
   // `Write()` before the previous write finishes. Doing that results in
   // undefined behavior.
   auto Write(SliceBuffer data, WriteArgs write_args) {
-    GRPC_LATENT_SEE_PARENT_SCOPE("GRPC:Write");
+    GRPC_LATENT_SEE_SCOPE("GRPC:Write");
     // Start write and assert previous write finishes.
     auto prev = write_state_->state.exchange(WriteState::kWriting,
                                              std::memory_order_relaxed);
@@ -136,14 +136,14 @@ class PromiseEndpoint {
   // `Read()` before the previous read finishes. Doing that results in
   // undefined behavior.
   auto Read(size_t num_bytes) {
-    GRPC_LATENT_SEE_PARENT_SCOPE("GRPC:Read");
+    GRPC_LATENT_SEE_SCOPE("GRPC:Read");
     // Assert previous read finishes.
     CHECK(!read_state_->complete.load(std::memory_order_relaxed));
     // Should not have pending reads.
     CHECK_EQ(read_state_->pending_buffer.Count(), 0u);
     bool complete = true;
     while (read_state_->buffer.Length() < num_bytes) {
-      GRPC_LATENT_SEE_INNER_SCOPE("GRPC:Read:Loop");
+      GRPC_LATENT_SEE_SCOPE("GRPC:Read:Loop");
       // Set read args with hinted bytes.
       grpc_event_engine::experimental::EventEngine::Endpoint::ReadArgs
           read_args;
diff --git a/deps/grpc/src/core/load_balancing/GEMINI.md b/deps/grpc/src/core/load_balancing/GEMINI.md
new file mode 100644
index 00000000000..5f273c387ea
--- /dev/null
+++ b/deps/grpc/src/core/load_balancing/GEMINI.md
@@ -0,0 +1,45 @@
+# gRPC Load Balancing
+
+This directory contains the implementation of gRPC's load balancing framework.
+
+See also: [gRPC Client Channel overview](../client_channel/GEMINI.md)
+
+## Overarching Purpose
+
+The code in this directory provides a flexible and extensible framework for load balancing. It allows different load balancing policies to be plugged in to gRPC to control how RPCs are distributed across a set of backend servers.
+
+## Core Concepts
+
+The load balancing framework is built around a few key abstractions:
+
+*   **`LoadBalancingPolicy`**: The `LoadBalancingPolicy` is the main abstraction for load balancing in gRPC. It is responsible for creating and managing subchannels, and for deciding which subchannel to use for each RPC.
+*   **`SubchannelPicker`**: The `SubchannelPicker` is a simple interface that is used to select a subchannel for a given RPC. Each `LoadBalancingPolicy` has a `SubchannelPicker` that is used to make the final routing decision.
+*   **`LoadBalancingPolicyFactory`**: A `LoadBalancingPolicyFactory` is responsible for creating instances of a particular `LoadBalancingPolicy`.
+*   **`LoadBalancingPolicyRegistry`**: The `LoadBalancingPolicyRegistry` is a global registry of `LoadBalancingPolicyFactory` instances. This registry is used to create `LoadBalancingPolicy` instances by name.
+
+## Load Balancing Policies
+
+gRPC comes with a number of built-in load balancing policies, each of which is implemented in its own subdirectory:
+
+*   **`pick_first`**: This policy tries to connect to the first address in the list, and if that fails, it tries the next one, and so on. It's the default policy if no other is specified.
+*   **`round_robin`**: This policy distributes RPCs across all available backend connections in a round-robin fashion.
+*   **`weighted_round_robin`**: A more advanced version of round-robin that takes into account the weights of the different backends.
+*   **`ring_hash`**: This policy uses a consistent hashing algorithm to distribute RPCs across the backends. This is useful for session affinity, as it ensures that all RPCs for a given session are sent to the same backend.
+*   **`grpclb`**: This policy uses an external load balancer to make load balancing decisions. The external load balancer is typically a separate process that is running on the same machine as the gRPC client.
+*   **`xds`**: This policy uses the xDS protocol to configure load balancing. xDS is a set of APIs that are used to configure service discovery, load balancing, and other features in a service mesh. See the [xDS documentation](../xds/GEMINI.md) for more details.
+*   **`rls`**: Route Lookup Service. This policy uses a separate service to determine the route for each RPC.
+
+## Files
+
+*   **`lb_policy.h`, `lb_policy.cc`**: These files define the core `LoadBalancingPolicy` interface.
+*   **`lb_policy_registry.h`, `lb_policy_registry.cc`**: These files define the `LoadBalancingPolicyRegistry`.
+*   **`subchannel_interface.h`**: Defines the interface that a subchannel must implement to be used by a `LoadBalancingPolicy`.
+*   **`child_policy_handler.h`, `child_policy_handler.cc`**: A helper class for implementing composite load balancing policies that delegate to child policies. This is used by policies like `xds` and `priority`.
+*   **`address_filtering.h`, `address_filtering.cc`**: A helper class for filtering addresses based on a set of attributes. This is used by policies like `xds` to implement locality-based routing.
+*   **`health_check_client.h`, `health_check_client.cc`**: A client for the gRPC health checking protocol. This is used by some LB policies to determine the health of the backends.
+
+## Notes
+
+*   gRPC's load balancing framework is highly extensible. New load balancing policies can be added by implementing the `LoadBalancingPolicy` and `LoadBalancingPolicyFactory` interfaces and registering the factory with the `LoadBalancingPolicyRegistry`.
+*   The load balancing policy is chosen based on the service config, which can be provided by the [resolver](../resolver/GEMINI.md).
+*   Load balancing is primarily used in the client channel. See the [client channel documentation](../client_channel/GEMINI.md) for more details.
diff --git a/deps/grpc/src/core/load_balancing/endpoint_list.cc b/deps/grpc/src/core/load_balancing/endpoint_list.cc
index 8dd402f9cfc..ecf5d50149b 100644
--- a/deps/grpc/src/core/load_balancing/endpoint_list.cc
+++ b/deps/grpc/src/core/load_balancing/endpoint_list.cc
@@ -28,10 +28,12 @@
 
 #include "absl/log/check.h"
 #include "absl/log/log.h"
+#include "absl/random/random.h"
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
 #include "src/core/config/core_configuration.h"
 #include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/experiments/experiments.h"
 #include "src/core/lib/iomgr/pollset_set.h"
 #include "src/core/load_balancing/delegating_helper.h"
 #include "src/core/load_balancing/lb_policy.h"
@@ -42,6 +44,7 @@
 #include "src/core/util/json/json.h"
 #include "src/core/util/orphanable.h"
 #include "src/core/util/ref_counted_ptr.h"
+#include "src/core/util/shared_bit_gen.h"
 
 namespace grpc_core {
 
@@ -168,10 +171,34 @@ void EndpointList::Init(
                                               const ChannelArgs&)>
         create_endpoint) {
   if (endpoints == nullptr) return;
+  if (!IsRrWrrConnectFromRandomIndexEnabled()) {
+    endpoints->ForEach([&](const EndpointAddresses& endpoint) {
+      endpoints_.push_back(
+          create_endpoint(Ref(DEBUG_LOCATION, "Endpoint"), endpoint, args));
+    });
+    return;
+  }
+  // If all clients get the same endpoint list in the same order, and they
+  // all start connection attempts in that order, and all connection attempts
+  // take approximately the same amount of time, then all clients are
+  // likely to connect to the first endpoint in the list before any of
+  // the others.  As soon as the client has that initial connection,
+  // it will send all queued RPCs on that connection while it waits for
+  // other endpoints to become connected.  This can result in sending a
+  // potentially large burst of traffic to the first endpoint in the list.
+  // To avoid that, we start connecting from a random index into the list.
+  std::vector<EndpointAddresses> endpoint_list;
   endpoints->ForEach([&](const EndpointAddresses& endpoint) {
-    endpoints_.push_back(
-        create_endpoint(Ref(DEBUG_LOCATION, "Endpoint"), endpoint, args));
+    endpoint_list.push_back(endpoint);
   });
+  endpoints_.resize(endpoint_list.size());
+  size_t start_index = absl::Uniform(SharedBitGen(), 0UL, endpoint_list.size());
+  for (size_t i = 0; i < endpoint_list.size(); ++i) {
+    size_t index = (start_index + i) % endpoint_list.size();
+    EndpointAddresses& endpoint = endpoint_list[index];
+    endpoints_[index] =
+        create_endpoint(Ref(DEBUG_LOCATION, "Endpoint"), endpoint, args);
+  }
 }
 
 void EndpointList::ResetBackoffLocked() {
diff --git a/deps/grpc/src/core/load_balancing/grpclb/client_load_reporting_filter.cc b/deps/grpc/src/core/load_balancing/grpclb/client_load_reporting_filter.cc
index e75cfa78ee8..1ebec3e8c1c 100644
--- a/deps/grpc/src/core/load_balancing/grpclb/client_load_reporting_filter.cc
+++ b/deps/grpc/src/core/load_balancing/grpclb/client_load_reporting_filter.cc
@@ -50,7 +50,7 @@ ClientLoadReportingFilter::Create(const ChannelArgs&, ChannelFilter::Args) {
 
 void ClientLoadReportingFilter::Call::OnClientInitialMetadata(
     ClientMetadata& client_initial_metadata) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientLoadReportingFilter::Call::OnClientInitialMetadata");
   // Handle client initial metadata.
   // Grab client stats object from metadata.
@@ -62,14 +62,14 @@ void ClientLoadReportingFilter::Call::OnClientInitialMetadata(
 }
 
 void ClientLoadReportingFilter::Call::OnServerInitialMetadata(ServerMetadata&) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientLoadReportingFilter::Call::OnServerInitialMetadata");
   saw_initial_metadata_ = true;
 }
 
 void ClientLoadReportingFilter::Call::OnServerTrailingMetadata(
     ServerMetadata& server_trailing_metadata) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ClientLoadReportingFilter::Call::OnServerTrailingMetadata");
   if (client_stats_ != nullptr) {
     client_stats_->AddCallFinished(
diff --git a/deps/grpc/src/core/load_balancing/grpclb/client_load_reporting_filter.h b/deps/grpc/src/core/load_balancing/grpclb/client_load_reporting_filter.h
index aecab0e101b..767cd24d8d8 100644
--- a/deps/grpc/src/core/load_balancing/grpclb/client_load_reporting_filter.h
+++ b/deps/grpc/src/core/load_balancing/grpclb/client_load_reporting_filter.h
@@ -31,7 +31,7 @@
 
 namespace grpc_core {
 
-class ClientLoadReportingFilter final
+class ClientLoadReportingFilter
     : public ImplementChannelFilter<ClientLoadReportingFilter> {
  public:
   static const grpc_channel_filter kFilter;
diff --git a/deps/grpc/src/core/load_balancing/pick_first/pick_first.cc b/deps/grpc/src/core/load_balancing/pick_first/pick_first.cc
index d201a74b76a..517e361d182 100644
--- a/deps/grpc/src/core/load_balancing/pick_first/pick_first.cc
+++ b/deps/grpc/src/core/load_balancing/pick_first/pick_first.cc
@@ -875,11 +875,18 @@ void PickFirst::SubchannelList::SubchannelData::OnConnectivityStateChange(
   // Otherwise, process connectivity state change.
   switch (*connectivity_state_) {
     case GRPC_CHANNEL_TRANSIENT_FAILURE: {
-      bool prev_seen_transient_failure =
-          std::exchange(seen_transient_failure_, true);
       // If this is the first failure we've seen on this subchannel,
       // then we're still in the Happy Eyeballs pass.
-      if (!prev_seen_transient_failure && seen_transient_failure_) {
+      if (!seen_transient_failure_) {
+        // Only set seen_transient_failure_ on subchannels that we've
+        // already gotten to in this Happy Eyeballs pass.  We don't want
+        // to do this if a subchannel that we haven't yet gotten to reports
+        // TF, since that connection attempt might have been triggered by a
+        // different channel, and the subchannel may already be back in IDLE
+        // by the time we get there later in our Happy Eyeballs pass.
+        if (index_ <= subchannel_list_->attempting_index_) {
+          seen_transient_failure_ = true;
+        }
         // If a connection attempt fails before the timer fires, then
         // cancel the timer and start connecting on the next subchannel.
         if (index_ == subchannel_list_->attempting_index_) {
@@ -890,8 +897,8 @@ void PickFirst::SubchannelList::SubchannelData::OnConnectivityStateChange(
           ++subchannel_list_->attempting_index_;
           subchannel_list_->StartConnectingNextSubchannel();
         } else {
-          // If this was the last subchannel to fail, check if the Happy
-          // Eyeballs pass is complete.
+          // In case this was the last subchannel to fail, check if the
+          // Happy Eyeballs pass is complete.
           subchannel_list_->MaybeFinishHappyEyeballsPass();
         }
       } else if (subchannel_list_->IsHappyEyeballsPassComplete()) {
diff --git a/deps/grpc/src/core/load_balancing/xds/xds_cluster_impl.cc b/deps/grpc/src/core/load_balancing/xds/xds_cluster_impl.cc
index 45edef70d10..8b069dd8ecf 100644
--- a/deps/grpc/src/core/load_balancing/xds/xds_cluster_impl.cc
+++ b/deps/grpc/src/core/load_balancing/xds/xds_cluster_impl.cc
@@ -407,10 +407,11 @@ LoadBalancingPolicy::PickResult XdsClusterImplLb::Picker::Pick(
   auto* call_attempt_tracer = call_state->GetCallAttemptTracer();
   if (call_attempt_tracer != nullptr) {
     call_attempt_tracer->SetOptionalLabel(
-        ClientCallTracer::CallAttemptTracer::OptionalLabelKey::kXdsServiceName,
+        ClientCallTracerInterface::CallAttemptTracer::OptionalLabelKey::
+            kXdsServiceName,
         service_telemetry_label_);
     call_attempt_tracer->SetOptionalLabel(
-        ClientCallTracer::CallAttemptTracer::OptionalLabelKey::
+        ClientCallTracerInterface::CallAttemptTracer::OptionalLabelKey::
             kXdsServiceNamespace,
         namespace_telemetry_label_);
   }
@@ -444,7 +445,8 @@ LoadBalancingPolicy::PickResult XdsClusterImplLb::Picker::Pick(
     // Add locality label to per-call metrics if needed.
     if (call_attempt_tracer != nullptr) {
       call_attempt_tracer->SetOptionalLabel(
-          ClientCallTracer::CallAttemptTracer::OptionalLabelKey::kLocality,
+          ClientCallTracerInterface::CallAttemptTracer::OptionalLabelKey::
+              kLocality,
           subchannel_wrapper->locality());
     }
     // Handle load reporting.
diff --git a/deps/grpc/src/core/net/socket_mutator.cc b/deps/grpc/src/core/net/socket_mutator.cc
new file mode 100644
index 00000000000..395a666afca
--- /dev/null
+++ b/deps/grpc/src/core/net/socket_mutator.cc
@@ -0,0 +1,19 @@
+//
+//
+// Copyright 2015 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+// TODO(hork): move src/core/lib/iomgr/socket_mutator.cc here
diff --git a/deps/grpc/src/core/net/socket_mutator.h b/deps/grpc/src/core/net/socket_mutator.h
new file mode 100644
index 00000000000..d8dce6ea547
--- /dev/null
+++ b/deps/grpc/src/core/net/socket_mutator.h
@@ -0,0 +1,25 @@
+//
+//
+// Copyright 2015 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+//
+
+#ifndef GRPC_SRC_CORE_NET_SOCKET_MUTATOR_H
+#define GRPC_SRC_CORE_NET_SOCKET_MUTATOR_H
+
+// TODO(hork): move src/core/lib/iomgr/socket_mutator.h here
+#include "src/core/lib/iomgr/socket_mutator.h"
+
+#endif  // GRPC_SRC_CORE_NET_SOCKET_MUTATOR_H
diff --git a/deps/grpc/src/core/plugin_registry/GEMINI.md b/deps/grpc/src/core/plugin_registry/GEMINI.md
new file mode 100644
index 00000000000..3452fc9094c
--- /dev/null
+++ b/deps/grpc/src/core/plugin_registry/GEMINI.md
@@ -0,0 +1,25 @@
+# Plugin Registry
+
+This directory contains the source code for the gRPC plugin registry.
+
+See also: [gRPC Core overview](../GEMINI.md)
+
+## Overarching Purpose
+
+The plugin registry is responsible for initializing and configuring the gRPC core by registering a variety of plugins, including handshakers, transports, filters, and resolvers. It is the main entry point for configuring the gRPC core library, and it is called at startup to register all of the core plugins.
+
+## Core Concepts
+
+The plugin registry is built around the `CoreConfiguration::Builder` class, which is defined in the `core/config` directory. The `CoreConfiguration::Builder` provides a set of methods for registering different types of plugins. The plugin registry uses these methods to register all of the core plugins that are part of the gRPC library.
+
+## Files
+
+*   **`grpc_plugin_registry.cc`**: This is the core of the plugin registration system. It defines the `BuildCoreConfiguration` function, which is called at startup to register all the core plugins that are part of the gRPC library.
+*   **`grpc_plugin_registry_extra.cc`**: This file registers "extra" filters and plugins, most notably those related to XDS (xDS is a protocol for dynamic resource discovery). These plugins are conditionally compiled, guarded by the `GRPC_NO_XDS` macro, so that they can be excluded from builds that don't need them.
+*   **`grpc_plugin_registry_noextra.cc`**: This file provides an empty implementation of `RegisterExtraFilters`, which is used when the "extra" filters are not needed. This allows the core to be built without the XDS dependencies.
+
+## Notes
+
+*   The order of plugin registration matters, especially for handshakers. The TCP connect handshaker is intentionally registered last so that it's the first one to be tried.
+*   The use of the `GRPC_NO_XDS` macro to control the inclusion of extra plugins is a key feature of this directory. It allows for a more lightweight build of gRPC when XDS is not needed.
+*   The plugin registry is a good example of how gRPC uses a modular, plugin-based architecture. This architecture makes it easy to add new features to gRPC, and it allows for a high degree of customization.
diff --git a/deps/grpc/src/core/plugin_registry/grpc_plugin_registry.cc b/deps/grpc/src/core/plugin_registry/grpc_plugin_registry.cc
index e7cadb99b84..23f0bbbfa21 100644
--- a/deps/grpc/src/core/plugin_registry/grpc_plugin_registry.cc
+++ b/deps/grpc/src/core/plugin_registry/grpc_plugin_registry.cc
@@ -71,6 +71,7 @@ extern void RegisterConnectedChannel(CoreConfiguration::Builder* builder);
 extern void RegisterLoadBalancedCallDestination(
     CoreConfiguration::Builder* builder);
 extern void RegisterChttp2Transport(CoreConfiguration::Builder* builder);
+extern void RegisterFusedFilters(CoreConfiguration::Builder* builder);
 #ifndef GRPC_NO_RLS
 extern void RegisterRlsLbPolicy(CoreConfiguration::Builder* builder);
 #endif  // !GRPC_NO_RLS
@@ -100,13 +101,17 @@ void BuildCoreConfiguration(CoreConfiguration::Builder* builder) {
   RegisterHttpConnectHandshaker(builder);
   RegisterTCPConnectHandshaker(builder);
   RegisterChttp2Transport(builder);
+#ifndef GRPC_MINIMAL_LB_POLICY
   RegisterPriorityLbPolicy(builder);
   RegisterOutlierDetectionLbPolicy(builder);
   RegisterWeightedTargetLbPolicy(builder);
+#endif
   RegisterPickFirstLbPolicy(builder);
+#ifndef GRPC_MINIMAL_LB_POLICY
   RegisterRoundRobinLbPolicy(builder);
   RegisterRingHashLbPolicy(builder);
   RegisterWeightedRoundRobinLbPolicy(builder);
+#endif
   BuildClientChannelConfiguration(builder);
   SecurityRegisterHandshakerFactories(builder);
   RegisterClientAuthorityFilter(builder);
@@ -131,6 +136,7 @@ void BuildCoreConfiguration(CoreConfiguration::Builder* builder) {
   RegisterBackendMetricFilter(builder);
   RegisterSecurityFilters(builder);
   RegisterExtraFilters(builder);
+  RegisterFusedFilters(builder);
   RegisterBuiltins(builder);
 }
 
diff --git a/deps/grpc/src/core/resolver/GEMINI.md b/deps/grpc/src/core/resolver/GEMINI.md
new file mode 100644
index 00000000000..88273415b91
--- /dev/null
+++ b/deps/grpc/src/core/resolver/GEMINI.md
@@ -0,0 +1,24 @@
+# Name Resolution
+
+This directory contains the implementation of gRPC's name resolution framework.
+
+## Overarching Purpose
+
+The name resolution framework provides a pluggable mechanism for resolving a logical name into a list of network addresses. This is a key component of gRPC's load balancing and failover systems.
+
+## Files and Subdirectories
+
+- **`resolver.h` / `resolver.cc`**: Defines the core `Resolver` class, which is the main interface for name resolution.
+- **`resolver_factory.h`**: Defines the `ResolverFactory` class, which is used to create `Resolver` instances.
+- **`resolver_registry.h` / `resolver_registry.cc`**: Defines a registry for `ResolverFactory` instances.
+- **`dns/`**: An implementation of name resolution that uses DNS.
+- **`fake/`**: A fake implementation of name resolution for testing.
+- **`google_c2p/`**: An implementation of name resolution that is specific to Google's C2P infrastructure.
+- **`sockaddr/`**: An implementation of name resolution that uses a list of socket addresses.
+- **`xds/`**: An implementation of name resolution that uses XDS.
+
+## Notes
+
+- The name resolution framework is a key component of gRPC's networking infrastructure.
+- It provides a flexible and extensible way to add new name resolution mechanisms to gRPC.
+- The `Resolver` interface is designed to be simple and easy to implement, which makes it easy to add support for new name resolution mechanisms.
diff --git a/deps/grpc/src/core/resolver/dns/GEMINI.md b/deps/grpc/src/core/resolver/dns/GEMINI.md
new file mode 100644
index 00000000000..b4a82bc63ff
--- /dev/null
+++ b/deps/grpc/src/core/resolver/dns/GEMINI.md
@@ -0,0 +1,19 @@
+# DNS Name Resolution
+
+This directory contains an implementation of name resolution that uses DNS.
+
+## Overarching Purpose
+
+This directory provides a concrete implementation of the `Resolver` interface that can be used to resolve names using DNS.
+
+## Subdirectories
+
+- **`c_ares/`**: An implementation of DNS resolution that uses the c-ares library.
+- **`event_engine/`**: An implementation of DNS resolution that uses the EventEngine.
+- **`native/`**: An implementation of DNS resolution that uses the native DNS resolver of the operating system.
+
+## Notes
+
+- This is the default name resolution mechanism for gRPC.
+- It is well-tested and has been used in production for many years.
+- The choice of which DNS resolver to use can have a significant impact on performance, so it is important to choose the right one for your application.
diff --git a/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_ev_driver.h b/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_ev_driver.h
index eeaeddf0cdf..b7c6fe8f1c5 100644
--- a/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_ev_driver.h
+++ b/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_ev_driver.h
@@ -19,7 +19,6 @@
 #ifndef GRPC_SRC_CORE_RESOLVER_DNS_C_ARES_GRPC_ARES_EV_DRIVER_H
 #define GRPC_SRC_CORE_RESOLVER_DNS_C_ARES_GRPC_ARES_EV_DRIVER_H
 
-#include <ares.h>
 #include <grpc/support/port_platform.h>
 
 #include <memory>
@@ -31,6 +30,10 @@
 #include "src/core/resolver/dns/c_ares/grpc_ares_wrapper.h"
 #include "src/core/util/sync.h"
 
+#if GRPC_ARES == 1
+
+#include <ares.h>
+
 namespace grpc_core {
 
 // A wrapped fd that integrates with the grpc iomgr of the current platform.
@@ -85,4 +88,6 @@ std::unique_ptr<GrpcPolledFdFactory> NewGrpcPolledFdFactory(Mutex* mu);
 
 }  // namespace grpc_core
 
+#endif  // GRPC_ARES
+
 #endif  // GRPC_SRC_CORE_RESOLVER_DNS_C_ARES_GRPC_ARES_EV_DRIVER_H
diff --git a/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_ev_driver_windows.cc b/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_ev_driver_windows.cc
index f30826bbb43..1d591080c6e 100644
--- a/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_ev_driver_windows.cc
+++ b/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_ev_driver_windows.cc
@@ -20,7 +20,6 @@
 #include "src/core/lib/iomgr/port.h"  // IWYU pragma: keep
 #if GRPC_ARES == 1 && defined(GRPC_WINDOWS_SOCKET_ARES_EV_DRIVER)
 
-#include <ares.h>
 #include <grpc/support/alloc.h>
 #include <grpc/support/log_windows.h>
 #include <grpc/support/string_util.h>
@@ -41,6 +40,8 @@
 #include "src/core/lib/iomgr/tcp_windows.h"
 #include "src/core/lib/slice/slice.h"
 #include "src/core/lib/slice/slice_internal.h"
+// We pull in ares.h transitively here, ares.h is not self-contained
+// w.r.t. windows headers though, so make sure pull them in above.
 #include "src/core/resolver/dns/c_ares/grpc_ares_ev_driver.h"
 #include "src/core/resolver/dns/c_ares/grpc_ares_wrapper.h"
 #include "src/core/util/crash.h"
diff --git a/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_wrapper.cc b/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_wrapper.cc
index cad4cfa1918..ad4a9157d63 100644
--- a/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_wrapper.cc
+++ b/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_wrapper.cc
@@ -484,14 +484,17 @@ static void grpc_ares_notify_on_event_locked(grpc_ares_ev_driver* ev_driver)
       }
     }
   }
-  // Any remaining fds in ev_driver->fds were not returned by ares_getsock() and
-  // are therefore no longer in use, so they can be shut down and removed from
-  // the list.
+  // We may be shutting down to completion of all requests, or due to a timeout
+  // or explicit caller-triggered cancellation. In any of these cases, shut
+  // down and destroy any remaining fds.
   while (ev_driver->fds != nullptr) {
     fd_node* cur = ev_driver->fds;
     ev_driver->fds = ev_driver->fds->next;
-    fd_node_shutdown_locked(cur, "c-ares fd shutdown");
-    if (!cur->readable_registered && !cur->writable_registered) {
+    if (ev_driver->shutting_down) {
+      fd_node_shutdown_locked(cur, "grpc_ares_notify_on_event_locked");
+    }
+    if (cur->already_shutdown && !cur->readable_registered &&
+        !cur->writable_registered) {
       fd_node_destroy_locked(cur);
     } else {
       cur->next = new_list;
diff --git a/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_wrapper.h b/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_wrapper.h
index 7ceae3da27f..6300914f5f2 100644
--- a/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_wrapper.h
+++ b/deps/grpc/src/core/resolver/dns/c_ares/grpc_ares_wrapper.h
@@ -19,7 +19,6 @@
 #ifndef GRPC_SRC_CORE_RESOLVER_DNS_C_ARES_GRPC_ARES_WRAPPER_H
 #define GRPC_SRC_CORE_RESOLVER_DNS_C_ARES_GRPC_ARES_WRAPPER_H
 
-#include <ares.h>
 #include <grpc/support/port_platform.h>
 #include <stddef.h>
 
@@ -36,6 +35,8 @@
 
 #if GRPC_ARES == 1
 
+#include <ares.h>
+
 #define GRPC_DNS_ARES_DEFAULT_QUERY_TIMEOUT_MS 120000
 
 typedef struct grpc_ares_ev_driver grpc_ares_ev_driver;
diff --git a/deps/grpc/src/core/resolver/fake/GEMINI.md b/deps/grpc/src/core/resolver/fake/GEMINI.md
new file mode 100644
index 00000000000..d0c2fbd33aa
--- /dev/null
+++ b/deps/grpc/src/core/resolver/fake/GEMINI.md
@@ -0,0 +1,17 @@
+# Fake Name Resolution
+
+This directory contains a fake implementation of name resolution for testing.
+
+## Overarching Purpose
+
+This directory provides a concrete implementation of the `Resolver` interface that can be used for testing. It allows you to specify the results of a name resolution query in your test code, which can be useful for testing error conditions and other corner cases.
+
+## Files
+
+- **`fake_resolver.h` / `fake_resolver.cc`**: The implementation of the fake resolver.
+
+## Notes
+
+- This is a very useful tool for testing gRPC applications.
+- It allows you to write deterministic tests that are not dependent on the state of the network.
+- It is important to note that this is a fake implementation of name resolution, and it should not be used in production.
diff --git a/deps/grpc/src/core/resolver/google_c2p/GEMINI.md b/deps/grpc/src/core/resolver/google_c2p/GEMINI.md
new file mode 100644
index 00000000000..4f9f50658eb
--- /dev/null
+++ b/deps/grpc/src/core/resolver/google_c2p/GEMINI.md
@@ -0,0 +1,17 @@
+# Google C2P Name Resolution
+
+This directory contains an implementation of name resolution that is specific to Google's C2P infrastructure.
+
+## Overarching Purpose
+
+This directory provides a concrete implementation of the `Resolver` interface that can be used to resolve names in Google's C2P infrastructure.
+
+## Files
+
+- **`google_c2p_resolver.h` / `google_c2p_resolver.cc`**: The implementation of the Google C2P resolver.
+
+## Notes
+
+- This is a Google-specific implementation of name resolution.
+- It is designed to be used by gRPC applications that run within Google's C2P infrastructure.
+- It is not intended for use outside of Google.
diff --git a/deps/grpc/src/core/resolver/sockaddr/GEMINI.md b/deps/grpc/src/core/resolver/sockaddr/GEMINI.md
new file mode 100644
index 00000000000..736247c137b
--- /dev/null
+++ b/deps/grpc/src/core/resolver/sockaddr/GEMINI.md
@@ -0,0 +1,17 @@
+# Sockaddr Name Resolution
+
+This directory contains an implementation of name resolution that uses a list of socket addresses.
+
+## Overarching Purpose
+
+This directory provides a concrete implementation of the `Resolver` interface that can be used to resolve names from a list of socket addresses. This is useful for testing and for cases where the list of addresses is known in advance.
+
+## Files
+
+- **`sockaddr_resolver.h` / `sockaddr_resolver.cc`**: The implementation of the sockaddr resolver.
+
+## Notes
+
+- This is a simple but useful implementation of name resolution.
+- It can be used to test gRPC applications without having to set up a DNS server.
+- It can also be used in production for cases where the list of addresses is static and known in advance.
diff --git a/deps/grpc/src/core/resolver/xds/GEMINI.md b/deps/grpc/src/core/resolver/xds/GEMINI.md
new file mode 100644
index 00000000000..d74606acade
--- /dev/null
+++ b/deps/grpc/src/core/resolver/xds/GEMINI.md
@@ -0,0 +1,17 @@
+# XDS Name Resolution
+
+This directory contains an implementation of name resolution that uses XDS.
+
+## Overarching Purpose
+
+This directory provides a concrete implementation of the `Resolver` interface that can be used to resolve names using the XDS API. This is a key component of gRPC's integration with service meshes like Istio.
+
+## Files
+
+- **`xds_resolver.h` / `xds_resolver.cc`**: The implementation of the XDS resolver.
+
+## Notes
+
+- This is a complex but powerful implementation of name resolution.
+- It provides a wide range of features, including load balancing, health checking, and traffic management.
+- It is designed to be used in conjunction with a service mesh, and it is not intended for use in standalone gRPC applications.
diff --git a/deps/grpc/src/core/resolver/xds/xds_dependency_manager.cc b/deps/grpc/src/core/resolver/xds/xds_dependency_manager.cc
index d3d0c1a2ad4..af5ad8bec43 100644
--- a/deps/grpc/src/core/resolver/xds/xds_dependency_manager.cc
+++ b/deps/grpc/src/core/resolver/xds/xds_dependency_manager.cc
@@ -940,7 +940,7 @@ void XdsDependencyManager::MaybeReportUpdate() {
     endpoint_watchers_.erase(it++);
   }
   // Remove entries in dns_resolvers_ for any DNS name not in
-  // eds_resources_seen.
+  // dns_names_seen.
   for (auto it = dns_resolvers_.begin(); it != dns_resolvers_.end();) {
     const std::string& dns_name = it->first;
     if (dns_names_seen.find(dns_name) != dns_names_seen.end()) {
diff --git a/deps/grpc/src/core/server/GEMINI.md b/deps/grpc/src/core/server/GEMINI.md
new file mode 100644
index 00000000000..523ee4b8a7f
--- /dev/null
+++ b/deps/grpc/src/core/server/GEMINI.md
@@ -0,0 +1,31 @@
+# gRPC Server
+
+This directory contains the core implementation of the gRPC server.
+
+## Overarching Purpose
+
+The gRPC server is responsible for listening for incoming connections, handling requests, and sending responses. It is the main entry point for all server-side gRPC applications.
+
+## Files
+
+- **`server.h` / `server.cc`**: Defines the `Server` class, which is the main class for the gRPC server.
+- **`server_interface.h`**: Defines the `ServerInterface` class, which is an interface that can be used to interact with the server.
+- **`add_port.cc`**: Contains the implementation of the `grpc_server_add_http2_port` function, which is used to add a listening port to the server.
+- **`server_call_tracer_filter.h` / `server_call_tracer_filter.cc`**: Defines a filter that can be used to trace server-side calls.
+- **`server_config_selector.h`**: Defines the `ServerConfigSelector` class, which is used to select the server configuration for a given request.
+- **`server_config_selector_filter.h` / `server_config_selector_filter.cc`**: Defines a filter that uses the `ServerConfigSelector` to select the server configuration.
+- **`xds_channel_stack_modifier.h` / `xds_channel_stack_modifier.cc`**: Defines a class that can be used to modify the channel stack for XDS-enabled servers.
+- **`xds_server_config_fetcher.cc`**: Fetches server configuration from an XDS server.
+
+## Major Classes
+
+- **`grpc_core::Server`**: The main class for the gRPC server.
+- **`grpc_core::ServerInterface`**: An interface that can be used to interact with the server.
+- **`grpc_core::ServerConfigSelector`**: A class that is used to select the server configuration for a given request.
+
+## Notes
+
+- The gRPC server is a complex piece of software with many different components.
+- The `Server` class is the main entry point for all server-side gRPC applications.
+- The `ServerBuilder` class can be used to create and configure a `Server` instance.
+- The server can be configured with a variety of options, including the number of threads, the maximum number of concurrent requests, and the security credentials to use.
diff --git a/deps/grpc/src/core/server/server.cc b/deps/grpc/src/core/server/server.cc
index 6b10d930ca2..4f88583fbc6 100644
--- a/deps/grpc/src/core/server/server.cc
+++ b/deps/grpc/src/core/server/server.cc
@@ -1311,7 +1311,7 @@ grpc_error_handle Server::SetupTransport(Transport* transport,
                                          grpc_pollset* accepting_pollset,
                                          const ChannelArgs& args,
                                          const Blackboard* blackboard) {
-  GRPC_LATENT_SEE_INNER_SCOPE("Server::SetupTransport");
+  GRPC_LATENT_SEE_SCOPE("Server::SetupTransport");
   // Create channel.
   global_stats().IncrementServerChannelsCreated();
   // Set up channelz node.
diff --git a/deps/grpc/src/core/server/server_call_tracer_filter.cc b/deps/grpc/src/core/server/server_call_tracer_filter.cc
index cc85a700f65..6e359e4a720 100644
--- a/deps/grpc/src/core/server/server_call_tracer_filter.cc
+++ b/deps/grpc/src/core/server/server_call_tracer_filter.cc
@@ -18,81 +18,17 @@
 
 #include <grpc/support/port_platform.h>
 
-#include <functional>
 #include <memory>
-#include <utility>
 
-#include "absl/status/status.h"
 #include "absl/status/statusor.h"
-#include "src/core/call/call_finalization.h"
 #include "src/core/config/core_configuration.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
-#include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/channel/promise_based_filter.h"
-#include "src/core/lib/promise/arena_promise.h"
-#include "src/core/lib/promise/cancel_callback.h"
-#include "src/core/lib/promise/context.h"
-#include "src/core/lib/promise/map.h"
-#include "src/core/lib/promise/pipe.h"
 #include "src/core/lib/surface/channel_stack_type.h"
-#include "src/core/lib/transport/transport.h"
-#include "src/core/telemetry/call_tracer.h"
-#include "src/core/util/latent_see.h"
 
 namespace grpc_core {
 
-namespace {
-
-class ServerCallTracerFilter
-    : public ImplementChannelFilter<ServerCallTracerFilter> {
- public:
-  static const grpc_channel_filter kFilter;
-
-  static absl::string_view TypeName() { return "server_call_tracer"; }
-
-  static absl::StatusOr<std::unique_ptr<ServerCallTracerFilter>> Create(
-      const ChannelArgs& /*args*/, ChannelFilter::Args /*filter_args*/);
-
-  class Call {
-   public:
-    void OnClientInitialMetadata(ClientMetadata& client_initial_metadata) {
-      GRPC_LATENT_SEE_INNER_SCOPE(
-          "ServerCallTracerFilter::Call::OnClientInitialMetadata");
-      auto* call_tracer = MaybeGetContext<ServerCallTracer>();
-      if (call_tracer == nullptr) return;
-      call_tracer->RecordReceivedInitialMetadata(&client_initial_metadata);
-    }
-
-    void OnServerInitialMetadata(ServerMetadata& server_initial_metadata) {
-      GRPC_LATENT_SEE_INNER_SCOPE(
-          "ServerCallTracerFilter::Call::OnServerInitialMetadata");
-      auto* call_tracer = MaybeGetContext<ServerCallTracer>();
-      if (call_tracer == nullptr) return;
-      call_tracer->RecordSendInitialMetadata(&server_initial_metadata);
-    }
-
-    void OnFinalize(const grpc_call_final_info* final_info) {
-      GRPC_LATENT_SEE_INNER_SCOPE("ServerCallTracerFilter::Call::OnFinalize");
-      auto* call_tracer = MaybeGetContext<ServerCallTracer>();
-      if (call_tracer == nullptr) return;
-      call_tracer->RecordEnd(final_info);
-    }
-
-    void OnServerTrailingMetadata(ServerMetadata& server_trailing_metadata) {
-      GRPC_LATENT_SEE_INNER_SCOPE(
-          "ServerCallTracerFilter::Call::OnServerTrailingMetadata");
-      auto* call_tracer = MaybeGetContext<ServerCallTracer>();
-      if (call_tracer == nullptr) return;
-      call_tracer->RecordSendTrailingMetadata(&server_trailing_metadata);
-    }
-
-    static inline const NoInterceptor OnClientToServerMessage;
-    static inline const NoInterceptor OnClientToServerHalfClose;
-    static inline const NoInterceptor OnServerToClientMessage;
-  };
-};
-
 const grpc_channel_filter ServerCallTracerFilter::kFilter =
     MakePromiseBasedFilter<ServerCallTracerFilter, FilterEndpoint::kServer,
                            kFilterExaminesServerInitialMetadata>();
@@ -103,8 +39,6 @@ ServerCallTracerFilter::Create(const ChannelArgs& /*args*/,
   return std::make_unique<ServerCallTracerFilter>();
 }
 
-}  // namespace
-
 void RegisterServerCallTracerFilter(CoreConfiguration::Builder* builder) {
   builder->channel_init()->RegisterFilter<ServerCallTracerFilter>(
       GRPC_SERVER_CHANNEL);
diff --git a/deps/grpc/src/core/server/server_call_tracer_filter.h b/deps/grpc/src/core/server/server_call_tracer_filter.h
index d8348571441..361dc1a7230 100644
--- a/deps/grpc/src/core/server/server_call_tracer_filter.h
+++ b/deps/grpc/src/core/server/server_call_tracer_filter.h
@@ -17,10 +17,74 @@
 
 #include <grpc/support/port_platform.h>
 
+#include <functional>
+#include <utility>
+
+#include "absl/status/status.h"
+#include "src/core/call/call_finalization.h"
 #include "src/core/config/core_configuration.h"
+#include "src/core/lib/channel/channel_stack.h"
+#include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/lib/promise/arena_promise.h"
+#include "src/core/lib/promise/cancel_callback.h"
+#include "src/core/lib/promise/context.h"
+#include "src/core/lib/promise/map.h"
+#include "src/core/lib/promise/pipe.h"
+#include "src/core/lib/transport/transport.h"
+#include "src/core/telemetry/call_tracer.h"
+#include "src/core/util/latent_see.h"
 
 namespace grpc_core {
 
+class ServerCallTracerFilter
+    : public ImplementChannelFilter<ServerCallTracerFilter> {
+ public:
+  static const grpc_channel_filter kFilter;
+
+  static absl::string_view TypeName() { return "server_call_tracer"; }
+
+  static absl::StatusOr<std::unique_ptr<ServerCallTracerFilter>> Create(
+      const ChannelArgs& /*args*/, ChannelFilter::Args /*filter_args*/);
+
+  class Call {
+   public:
+    void OnClientInitialMetadata(ClientMetadata& client_initial_metadata) {
+      GRPC_LATENT_SEE_SCOPE(
+          "ServerCallTracerFilter::Call::OnClientInitialMetadata");
+      auto* call_tracer = MaybeGetContext<ServerCallTracerInterface>();
+      if (call_tracer == nullptr) return;
+      call_tracer->RecordReceivedInitialMetadata(&client_initial_metadata);
+    }
+
+    void OnServerInitialMetadata(ServerMetadata& server_initial_metadata) {
+      GRPC_LATENT_SEE_SCOPE(
+          "ServerCallTracerFilter::Call::OnServerInitialMetadata");
+      auto* call_tracer = MaybeGetContext<ServerCallTracerInterface>();
+      if (call_tracer == nullptr) return;
+      call_tracer->RecordSendInitialMetadata(&server_initial_metadata);
+    }
+
+    void OnFinalize(const grpc_call_final_info* final_info) {
+      GRPC_LATENT_SEE_SCOPE("ServerCallTracerFilter::Call::OnFinalize");
+      auto* call_tracer = MaybeGetContext<ServerCallTracerInterface>();
+      if (call_tracer == nullptr) return;
+      call_tracer->RecordEnd(final_info);
+    }
+
+    void OnServerTrailingMetadata(ServerMetadata& server_trailing_metadata) {
+      GRPC_LATENT_SEE_SCOPE(
+          "ServerCallTracerFilter::Call::OnServerTrailingMetadata");
+      auto* call_tracer = MaybeGetContext<ServerCallTracerInterface>();
+      if (call_tracer == nullptr) return;
+      call_tracer->RecordSendTrailingMetadata(&server_trailing_metadata);
+    }
+
+    static inline const NoInterceptor OnClientToServerMessage;
+    static inline const NoInterceptor OnClientToServerHalfClose;
+    static inline const NoInterceptor OnServerToClientMessage;
+  };
+};
+
 void RegisterServerCallTracerFilter(CoreConfiguration::Builder* builder);
 
 }  // namespace grpc_core
diff --git a/deps/grpc/src/core/server/server_config_selector_filter.cc b/deps/grpc/src/core/server/server_config_selector_filter.cc
index a15aef703ef..049d526743f 100644
--- a/deps/grpc/src/core/server/server_config_selector_filter.cc
+++ b/deps/grpc/src/core/server/server_config_selector_filter.cc
@@ -144,7 +144,7 @@ void ServerConfigSelectorFilter::Orphan() {
 
 absl::Status ServerConfigSelectorFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, ServerConfigSelectorFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServerConfigSelectorFilter::Call::OnClientInitialMetadata");
   auto sel = filter->config_selector();
   if (!sel.ok()) return sel.status();
diff --git a/deps/grpc/src/core/service_config/GEMINI.md b/deps/grpc/src/core/service_config/GEMINI.md
new file mode 100644
index 00000000000..694f4ab249d
--- /dev/null
+++ b/deps/grpc/src/core/service_config/GEMINI.md
@@ -0,0 +1,34 @@
+# gRPC Service Config
+
+This directory contains the implementation of gRPC's service config feature, which allows for per-service and per-method configuration of a gRPC channel.
+
+See also: [gRPC Core overview](../GEMINI.md)
+
+## Overarching Purpose
+
+The code in this directory provides a mechanism for parsing and applying service configs. Service configs can be used to configure a variety of features, such as load balancing, retries, and message size limits.
+
+## Core Concepts
+
+*   **`ServiceConfig`**: The `ServiceConfig` class is an abstract base class for service configs. It provides methods for retrieving the raw JSON string of the service config, as well as for retrieving parsed config values for a given method.
+*   **`ServiceConfigParser`**: The `ServiceConfigParser` class is a registry of `Parser` instances. Each `Parser` is responsible for parsing a specific part of the service config. This makes the service config framework highly extensible.
+
+## How to Add a New Service Config Parser
+
+1.  Create a new class that derives from `ServiceConfigParser::Parser`.
+2.  Implement the `ParseGlobalParams` and/or `ParsePerMethodParams` methods. These methods will be called by the `ServiceConfig` framework to parse the global and per-method parts of the service config, respectively.
+3.  Register your parser with the `CoreConfiguration` builder at startup.
+
+## Files
+
+*   **`service_config.h`**: Defines the `ServiceConfig` class.
+*   **`service_config_parser.h`, `service_config_parser.cc`**: These files define the `ServiceConfigParser` class.
+*   **`service_config_impl.h`, `service_config_impl.cc`**: These files define the `ServiceConfigImpl` class, which is the concrete implementation of the `ServiceConfig` interface.
+*   **`service_config_call_data.h`**: Defines the `ServiceConfigCallData` class, which is used to store the per-call service config data.
+
+## Notes
+
+*   Service configs are typically provided by the name resolver (see [`../resolver/GEMINI.md`](../resolver/GEMINI.md)).
+*   Service configs can also be delivered via xDS (see [`../xds/GEMINI.md`](../xds/GEMINI.md)).
+*   The service config is a powerful feature that allows for a great deal of flexibility in configuring gRPC channels.
+*   The service config is used to configure load balancing (see [`../load_balancing/GEMINI.md`](../load_balancing/GEMINI.md)).
diff --git a/deps/grpc/src/core/service_config/service_config_channel_arg_filter.cc b/deps/grpc/src/core/service_config/service_config_channel_arg_filter.cc
index bd51db9a968..c6afbc2ee32 100644
--- a/deps/grpc/src/core/service_config/service_config_channel_arg_filter.cc
+++ b/deps/grpc/src/core/service_config/service_config_channel_arg_filter.cc
@@ -17,85 +17,30 @@
 // This filter reads GRPC_ARG_SERVICE_CONFIG and populates ServiceConfigCallData
 // in the call context per call for direct channels.
 
+#include "src/core/service_config/service_config_channel_arg_filter.h"
+
 #include <grpc/impl/channel_arg_names.h>
 #include <grpc/support/port_platform.h>
 
-#include <functional>
-#include <memory>
-#include <optional>
-#include <string>
-#include <utility>
-
-#include "absl/log/log.h"
-#include "absl/status/status.h"
-#include "absl/status/statusor.h"
 #include "src/core/call/metadata_batch.h"
 #include "src/core/config/core_configuration.h"
 #include "src/core/ext/filters/message_size/message_size_filter.h"
-#include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/channel/channel_fwd.h"
-#include "src/core/lib/channel/channel_stack.h"
 #include "src/core/lib/channel/promise_based_filter.h"
-#include "src/core/lib/promise/arena_promise.h"
 #include "src/core/lib/promise/context.h"
 #include "src/core/lib/resource_quota/arena.h"
 #include "src/core/lib/surface/channel_stack_type.h"
-#include "src/core/lib/transport/transport.h"
 #include "src/core/service_config/service_config.h"
 #include "src/core/service_config/service_config_call_data.h"
-#include "src/core/service_config/service_config_impl.h"
 #include "src/core/service_config/service_config_parser.h"
 #include "src/core/util/latent_see.h"
 #include "src/core/util/ref_counted_ptr.h"
 
 namespace grpc_core {
 
-namespace {
-
-class ServiceConfigChannelArgFilter final
-    : public ImplementChannelFilter<ServiceConfigChannelArgFilter> {
- public:
-  static const grpc_channel_filter kFilter;
-
-  static absl::string_view TypeName() { return "service_config_channel_arg"; }
-
-  static absl::StatusOr<std::unique_ptr<ServiceConfigChannelArgFilter>> Create(
-      const ChannelArgs& args, ChannelFilter::Args) {
-    return std::make_unique<ServiceConfigChannelArgFilter>(args);
-  }
-
-  explicit ServiceConfigChannelArgFilter(const ChannelArgs& args) {
-    auto service_config_str = args.GetOwnedString(GRPC_ARG_SERVICE_CONFIG);
-    if (service_config_str.has_value()) {
-      auto service_config =
-          ServiceConfigImpl::Create(args, *service_config_str);
-      if (!service_config.ok()) {
-        LOG(ERROR) << service_config.status().ToString();
-      } else {
-        service_config_ = std::move(*service_config);
-      }
-    }
-  }
-
-  class Call {
-   public:
-    void OnClientInitialMetadata(ClientMetadata& md,
-                                 ServiceConfigChannelArgFilter* filter);
-    static inline const NoInterceptor OnServerInitialMetadata;
-    static inline const NoInterceptor OnServerTrailingMetadata;
-    static inline const NoInterceptor OnClientToServerMessage;
-    static inline const NoInterceptor OnClientToServerHalfClose;
-    static inline const NoInterceptor OnServerToClientMessage;
-    static inline const NoInterceptor OnFinalize;
-  };
-
- private:
-  RefCountedPtr<ServiceConfig> service_config_;
-};
-
 void ServiceConfigChannelArgFilter::Call::OnClientInitialMetadata(
     ClientMetadata& md, ServiceConfigChannelArgFilter* filter) {
-  GRPC_LATENT_SEE_INNER_SCOPE(
+  GRPC_LATENT_SEE_SCOPE(
       "ServiceConfigChannelArgFilter::Call::OnClientInitialMetadata");
   const ServiceConfigParser::ParsedConfigVector* method_configs = nullptr;
   if (filter->service_config_ != nullptr) {
@@ -112,8 +57,6 @@ const grpc_channel_filter ServiceConfigChannelArgFilter::kFilter =
     MakePromiseBasedFilter<ServiceConfigChannelArgFilter,
                            FilterEndpoint::kClient>();
 
-}  // namespace
-
 void RegisterServiceConfigChannelArgFilter(
     CoreConfiguration::Builder* builder) {
   builder->channel_init()
diff --git a/deps/grpc/src/core/service_config/service_config_channel_arg_filter.h b/deps/grpc/src/core/service_config/service_config_channel_arg_filter.h
new file mode 100644
index 00000000000..b16e4949dd3
--- /dev/null
+++ b/deps/grpc/src/core/service_config/service_config_channel_arg_filter.h
@@ -0,0 +1,82 @@
+//
+// Copyright 2020 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+// This filter reads GRPC_ARG_SERVICE_CONFIG and populates ServiceConfigCallData
+// in the call context per call for direct channels.
+
+#ifndef GRPC_SRC_CORE_SERVICE_CONFIG_SERVICE_CONFIG_CHANNEL_ARG_FILTER_H
+#define GRPC_SRC_CORE_SERVICE_CONFIG_SERVICE_CONFIG_CHANNEL_ARG_FILTER_H
+
+#include <grpc/slice.h>
+#include <grpc/support/port_platform.h>
+#include <stddef.h>
+
+#include <memory>
+
+#include "absl/status/statusor.h"
+#include "src/core/lib/channel/channel_args.h"
+#include "src/core/lib/channel/channel_fwd.h"
+#include "src/core/lib/channel/promise_based_filter.h"
+#include "src/core/service_config/service_config.h"
+#include "src/core/service_config/service_config_impl.h"
+#include "src/core/util/ref_counted_ptr.h"
+
+namespace grpc_core {
+
+class ServiceConfigChannelArgFilter final
+    : public ImplementChannelFilter<ServiceConfigChannelArgFilter> {
+ public:
+  static const grpc_channel_filter kFilter;
+
+  static absl::string_view TypeName() { return "service_config_channel_arg"; }
+
+  static absl::StatusOr<std::unique_ptr<ServiceConfigChannelArgFilter>> Create(
+      const ChannelArgs& args, ChannelFilter::Args) {
+    return std::make_unique<ServiceConfigChannelArgFilter>(args);
+  }
+
+  explicit ServiceConfigChannelArgFilter(const ChannelArgs& args) {
+    auto service_config_str = args.GetOwnedString(GRPC_ARG_SERVICE_CONFIG);
+    if (service_config_str.has_value()) {
+      auto service_config =
+          ServiceConfigImpl::Create(args, *service_config_str);
+      if (!service_config.ok()) {
+        LOG(ERROR) << service_config.status().ToString();
+      } else {
+        service_config_ = std::move(*service_config);
+      }
+    }
+  }
+
+  class Call {
+   public:
+    void OnClientInitialMetadata(ClientMetadata& md,
+                                 ServiceConfigChannelArgFilter* filter);
+    static inline const NoInterceptor OnServerInitialMetadata;
+    static inline const NoInterceptor OnServerTrailingMetadata;
+    static inline const NoInterceptor OnClientToServerMessage;
+    static inline const NoInterceptor OnClientToServerHalfClose;
+    static inline const NoInterceptor OnServerToClientMessage;
+    static inline const NoInterceptor OnFinalize;
+  };
+
+ private:
+  RefCountedPtr<ServiceConfig> service_config_;
+};
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_SERVICE_CONFIG_SERVICE_CONFIG_CHANNEL_ARG_FILTER_H
diff --git a/deps/grpc/src/core/telemetry/GEMINI.md b/deps/grpc/src/core/telemetry/GEMINI.md
new file mode 100644
index 00000000000..7bcb31fee66
--- /dev/null
+++ b/deps/grpc/src/core/telemetry/GEMINI.md
@@ -0,0 +1,20 @@
+# Telemetry
+
+This directory contains the implementation of gRPC's telemetry system.
+
+## Overarching Purpose
+
+The telemetry system provides a way to collect and report metrics and tracing about the behavior of gRPC. This information can be used for monitoring, debugging, and performance tuning.
+
+## Files
+
+- **`call_tracer.h` / `call_tracer.cc`**: Defines the `CallTracer` class, which is used to trace the lifecycle of a gRPC call.
+- **`metrics.h` / `metrics.cc`**: Defines the `Metrics` class, which is used to collect and report metrics.
+- **`stats.h` / `stats.cc`**: Defines the `Stats` class, which is used to collect and report statistics.
+- **`tcp_tracer.h` / `tcp_tracer.cc`**: Defines the `TcpTracer` class, which is used to trace TCP-level events.
+
+## Notes
+
+- The telemetry system is a key component of gRPC's observability infrastructure.
+- It provides a wealth of information about the behavior of gRPC, which can be used to diagnose and fix a wide variety of problems.
+- The telemetry data can be exported to a variety of monitoring systems, such as Prometheus and OpenCensus.
diff --git a/deps/grpc/src/core/telemetry/call_tracer.cc b/deps/grpc/src/core/telemetry/call_tracer.cc
index 6014458f275..f80ecaee9e0 100644
--- a/deps/grpc/src/core/telemetry/call_tracer.cc
+++ b/deps/grpc/src/core/telemetry/call_tracer.cc
@@ -78,10 +78,10 @@ absl::string_view ServerCallTracerFactory::ChannelArgName() {
   return kServerCallTracerFactoryChannelArgName;
 }
 
-class DelegatingClientCallTracer : public ClientCallTracer {
+class DelegatingClientCallTracer : public ClientCallTracerInterface {
  public:
   class DelegatingClientCallAttemptTracer
-      : public ClientCallTracer::CallAttemptTracer {
+      : public ClientCallTracerInterface::CallAttemptTracer {
    public:
     explicit DelegatingClientCallAttemptTracer(
         std::vector<CallAttemptTracer*> tracers)
@@ -190,7 +190,7 @@ class DelegatingClientCallTracer : public ClientCallTracer {
     // call at any moment).
     std::vector<CallAttemptTracer*> tracers_;
   };
-  explicit DelegatingClientCallTracer(ClientCallTracer* tracer)
+  explicit DelegatingClientCallTracer(ClientCallTracerInterface* tracer)
       : tracers_{tracer} {}
   ~DelegatingClientCallTracer() override {}
   CallAttemptTracer* StartNewAttempt(bool is_transparent_retry) override {
@@ -224,15 +224,17 @@ class DelegatingClientCallTracer : public ClientCallTracer {
   // will be adding call tracers to the context and these are already
   // synchronized through promises/call combiners (single promise running per
   // call at any moment).
-  void AddTracer(ClientCallTracer* tracer) { tracers_.push_back(tracer); }
+  void AddTracer(ClientCallTracerInterface* tracer) {
+    tracers_.push_back(tracer);
+  }
 
  private:
-  std::vector<ClientCallTracer*> tracers_;
+  std::vector<ClientCallTracerInterface*> tracers_;
 };
 
-class DelegatingServerCallTracer : public ServerCallTracer {
+class DelegatingServerCallTracer : public ServerCallTracerInterface {
  public:
-  explicit DelegatingServerCallTracer(ServerCallTracer* tracer)
+  explicit DelegatingServerCallTracer(ServerCallTracerInterface* tracer)
       : tracers_{tracer} {}
   ~DelegatingServerCallTracer() override {}
   void RecordSendInitialMetadata(
@@ -319,23 +321,26 @@ class DelegatingServerCallTracer : public ServerCallTracer {
   bool IsSampled() override { return tracers_[0]->IsSampled(); }
   bool IsDelegatingTracer() override { return true; }
 
-  void AddTracer(ServerCallTracer* tracer) { tracers_.push_back(tracer); }
+  void AddTracer(ServerCallTracerInterface* tracer) {
+    tracers_.push_back(tracer);
+  }
 
  private:
   // The ServerCallTracerFilter will be responsible for making sure that the
   // tracers are added in a thread-safe manner. It is imagined that the filter
   // will just invoke the factories in the server call tracer factory list
   // sequentially, removing the need for any synchronization.
-  std::vector<ServerCallTracer*> tracers_;
+  std::vector<ServerCallTracerInterface*> tracers_;
 };
 
-void AddClientCallTracerToContext(Arena* arena, ClientCallTracer* tracer) {
+void AddClientCallTracerToContext(Arena* arena,
+                                  ClientCallTracerInterface* tracer) {
   if (arena->GetContext<CallTracerAnnotationInterface>() == nullptr) {
     // This is the first call tracer. Set it directly.
     arena->SetContext<CallTracerAnnotationInterface>(tracer);
   } else {
     // There was already a call tracer present.
-    auto* orig_tracer = DownCast<ClientCallTracer*>(
+    auto* orig_tracer = DownCast<ClientCallTracerInterface*>(
         arena->GetContext<CallTracerAnnotationInterface>());
     if (orig_tracer->IsDelegatingTracer()) {
       // We already created a delegating tracer. Just add the new tracer to the
@@ -353,7 +358,8 @@ void AddClientCallTracerToContext(Arena* arena, ClientCallTracer* tracer) {
   }
 }
 
-void AddServerCallTracerToContext(Arena* arena, ServerCallTracer* tracer) {
+void AddServerCallTracerToContext(Arena* arena,
+                                  ServerCallTracerInterface* tracer) {
   DCHECK_EQ(arena->GetContext<CallTracerInterface>(),
             arena->GetContext<CallTracerAnnotationInterface>());
   if (arena->GetContext<CallTracerAnnotationInterface>() == nullptr) {
@@ -362,7 +368,7 @@ void AddServerCallTracerToContext(Arena* arena, ServerCallTracer* tracer) {
     arena->SetContext<CallTracerInterface>(tracer);
   } else {
     // There was already a call tracer present.
-    auto* orig_tracer = DownCast<ServerCallTracer*>(
+    auto* orig_tracer = DownCast<ServerCallTracerInterface*>(
         arena->GetContext<CallTracerAnnotationInterface>());
     if (orig_tracer->IsDelegatingTracer()) {
       // We already created a delegating tracer. Just add the new tracer to the
@@ -381,4 +387,4 @@ void AddServerCallTracerToContext(Arena* arena, ServerCallTracer* tracer) {
   }
 }
 
-}  // namespace grpc_core
+}  // namespace grpc_core
\ No newline at end of file
diff --git a/deps/grpc/src/core/telemetry/call_tracer.h b/deps/grpc/src/core/telemetry/call_tracer.h
index a07ae668d25..1d26adf01b8 100644
--- a/deps/grpc/src/core/telemetry/call_tracer.h
+++ b/deps/grpc/src/core/telemetry/call_tracer.h
@@ -44,9 +44,9 @@ namespace grpc_core {
 // The interface hierarchy is as follows -
 //                 CallTracerAnnotationInterface
 //                    |                  |
-//        ClientCallTracer       CallTracerInterface
+//        ClientCallTracerInterface       CallTracerInterface
 //                                |              |
-//                      CallAttemptTracer    ServerCallTracer
+//                      CallAttemptTracer    ServerCallTracerInterface
 
 // The base class for all tracer implementations.
 class CallTracerAnnotationInterface {
@@ -129,10 +129,13 @@ class CallTracerInterface : public CallTracerAnnotationInterface {
   virtual std::shared_ptr<TcpCallTracer> StartNewTcpTrace() = 0;
 };
 
+class ClientCallTracerInterface;
+class ServerCallTracerInterface;
+
 // Interface for a tracer that records activities on a call. Actual attempts for
 // this call are traced with CallAttemptTracer after invoking RecordNewAttempt()
 // on the ClientCallTracer object.
-class ClientCallTracer : public CallTracerAnnotationInterface {
+class ClientCallTracerInterface : public CallTracerAnnotationInterface {
  public:
   // Interface for a tracer that records activities on a particular call
   // attempt.
@@ -170,22 +173,22 @@ class ClientCallTracer : public CallTracerAnnotationInterface {
                                   RefCountedStringValue value) = 0;
   };
 
-  ~ClientCallTracer() override {}
+  ~ClientCallTracerInterface() override {}
 
   // Records a new attempt for the associated call. \a transparent denotes
   // whether the attempt is being made as a transparent retry or as a
   // non-transparent retry/hedging attempt. (There will be at least one attempt
-  // even if the call is not being retried.) The `ClientCallTracer` object
-  // retains ownership to the newly created `CallAttemptTracer` object.
+  // even if the call is not being retried.) The `ClientCallTracerInterface`
+  // object retains ownership to the newly created `CallAttemptTracer` object.
   // RecordEnd() serves as an indication that the call stack is done with all
   // API calls, and the tracer library is free to destroy it after that.
   virtual CallAttemptTracer* StartNewAttempt(bool is_transparent_retry) = 0;
 };
 
 // Interface for a tracer that records activities on a server call.
-class ServerCallTracer : public CallTracerInterface {
+class ServerCallTracerInterface : public CallTracerInterface {
  public:
-  ~ServerCallTracer() override {}
+  ~ServerCallTracerInterface() override {}
   // TODO(yashykt): The following two methods `RecordReceivedTrailingMetadata`
   // and `RecordEnd` should be moved into CallTracerInterface.
   virtual void RecordReceivedTrailingMetadata(
@@ -195,15 +198,15 @@ class ServerCallTracer : public CallTracerInterface {
   virtual void RecordEnd(const grpc_call_final_info* final_info) = 0;
 };
 
-// Interface for a factory that can create a ServerCallTracer object per
-// server call.
+// Interface for a factory that can create a ServerCallTracerInterface object
+// per server call.
 class ServerCallTracerFactory {
  public:
   struct RawPointerChannelArgTag {};
 
   virtual ~ServerCallTracerFactory() {}
 
-  virtual ServerCallTracer* CreateNewServerCallTracer(
+  virtual ServerCallTracerInterface* CreateNewServerCallTracer(
       Arena* arena, const ChannelArgs& channel_args) = 0;
 
   // Returns true if a server is to be traced, false otherwise.
@@ -228,11 +231,13 @@ class ServerCallTracerFactory {
 // Convenience functions to add call tracers to a call context. Allows setting
 // multiple call tracers to a single call. It is only valid to add client call
 // tracers before the client_channel filter sees the send_initial_metadata op.
-void AddClientCallTracerToContext(Arena* arena, ClientCallTracer* tracer);
+void AddClientCallTracerToContext(Arena* arena,
+                                  ClientCallTracerInterface* tracer);
 
 // TODO(yashykt): We want server call tracers to be registered through the
 // ServerCallTracerFactory, which has yet to be made into a list.
-void AddServerCallTracerToContext(Arena* arena, ServerCallTracer* tracer);
+void AddServerCallTracerToContext(Arena* arena,
+                                  ServerCallTracerInterface* tracer);
 
 template <>
 struct ArenaContextType<CallTracerInterface> {
@@ -245,20 +250,20 @@ struct ArenaContextType<CallTracerAnnotationInterface> {
 };
 
 template <>
-struct ContextSubclass<ClientCallTracer::CallAttemptTracer> {
+struct ContextSubclass<ClientCallTracerInterface::CallAttemptTracer> {
   using Base = CallTracerInterface;
 };
 
 template <>
-struct ContextSubclass<ServerCallTracer> {
+struct ContextSubclass<ServerCallTracerInterface> {
   using Base = CallTracerInterface;
 };
 
 template <>
-struct ContextSubclass<ClientCallTracer> {
+struct ContextSubclass<ClientCallTracerInterface> {
   using Base = CallTracerAnnotationInterface;
 };
 
 }  // namespace grpc_core
 
-#endif  // GRPC_SRC_CORE_TELEMETRY_CALL_TRACER_H
+#endif  // GRPC_SRC_CORE_TELEMETRY_CALL_TRACER_H
\ No newline at end of file
diff --git a/deps/grpc/src/core/telemetry/instrument.cc b/deps/grpc/src/core/telemetry/instrument.cc
new file mode 100644
index 00000000000..9b10e41cfc8
--- /dev/null
+++ b/deps/grpc/src/core/telemetry/instrument.cc
@@ -0,0 +1,233 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/core/telemetry/instrument.h"
+
+#include <cstddef>
+#include <cstdint>
+#include <string>
+#include <tuple>
+#include <utility>
+#include <vector>
+
+#include "absl/container/flat_hash_map.h"
+#include "absl/log/check.h"
+#include "absl/log/log.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/span.h"
+
+namespace grpc_core {
+
+MetricsQuery& MetricsQuery::WithLabelEq(absl::string_view label,
+                                        std::string value) {
+  label_eqs_.emplace(label, std::move(value));
+  return *this;
+}
+
+MetricsQuery& MetricsQuery::CollapseLabels(
+    absl::Span<const std::string> labels) {
+  for (const auto& label : labels) {
+    collapsed_labels_.insert(label);
+  }
+  return *this;
+}
+
+MetricsQuery& MetricsQuery::OnlyMetrics(absl::Span<const std::string> metrics) {
+  only_metrics_.emplace(metrics.begin(), metrics.end());
+  return *this;
+}
+
+void MetricsQuery::Run(MetricsSink& sink) const {
+  QueryableDomain::ExportMetrics(*this, sink);
+}
+
+const InstrumentIndex::Description* InstrumentIndex::Register(
+    QueryableDomain* domain, uint64_t offset, absl::string_view name,
+    absl::string_view description, absl::string_view unit, Shape shape) {
+  auto it = metrics_.emplace(
+      name, Description{domain, offset, name, description, unit, shape});
+  if (!it.second) {
+    LOG(FATAL) << "Metric with name '" << name << "' already registered.";
+  }
+  return &it.first->second;
+}
+
+const InstrumentIndex::Description* InstrumentIndex::Find(
+    absl::string_view name) const {
+  auto it = metrics_.find(name);
+  if (it == metrics_.end()) {
+    return nullptr;
+  }
+  return &it->second;
+}
+
+template <typename Fn>
+void MetricsQuery::Apply(absl::Span<const std::string> label_names, Fn fn,
+                         MetricsSink& sink) const {
+  if (collapsed_labels_.empty()) {
+    ApplyLabelChecks(label_names, std::move(fn), sink);
+    return;
+  }
+  std::vector<size_t> include_labels;
+  for (size_t i = 0; i < label_names.size(); ++i) {
+    if (!collapsed_labels_.contains(label_names[i])) {
+      include_labels.push_back(i);
+    }
+  }
+  if (include_labels.size() == label_names.size()) {
+    ApplyLabelChecks(label_names, std::move(fn), sink);
+    return;
+  }
+  class Filter final : public MetricsSink {
+   public:
+    explicit Filter(absl::Span<const size_t> include_labels)
+        : include_labels_(include_labels) {}
+
+    void Counter(absl::Span<const std::string> label, absl::string_view name,
+                 uint64_t value) override {
+      uint64_counters_[ConstructKey(label, name)] += value;
+    }
+
+    void Publish(MetricsSink& sink) const {
+      for (const auto& [key, value] : uint64_counters_) {
+        sink.Counter(std::get<0>(key), std::get<1>(key), value);
+      }
+    }
+
+   private:
+    std::tuple<std::vector<std::string>, absl::string_view> ConstructKey(
+        absl::Span<const std::string> label, absl::string_view name) const {
+      std::vector<std::string> key;
+      key.reserve(include_labels_.size());
+      for (auto i : include_labels_) {
+        key.push_back(label[i]);
+      }
+      return std::tuple(std::move(key), name);
+    }
+
+    absl::Span<const size_t> include_labels_;
+    absl::flat_hash_map<std::tuple<std::vector<std::string>, absl::string_view>,
+                        uint64_t>
+        uint64_counters_;
+  };
+  Filter filter(include_labels);
+  ApplyLabelChecks(label_names, std::move(fn), filter);
+  filter.Publish(sink);
+}
+
+template <typename Fn, typename Sink>
+void MetricsQuery::ApplyLabelChecks(absl::Span<const std::string> label_names,
+                                    Fn fn, Sink& sink) const {
+  if (label_eqs_.empty()) {
+    fn(sink);
+    return;
+  }
+  struct LabelEq {
+    size_t offset;
+    absl::string_view value;
+  };
+  std::vector<LabelEq> label_eqs;
+  for (size_t i = 0; i < label_names.size(); ++i) {
+    const auto& label = label_names[i];
+    auto it = label_eqs_.find(label);
+    if (it != label_eqs_.end()) label_eqs.push_back({i, it->second});
+  }
+  // If there are labels to match, but this domain doesn't have all the labels
+  // requested, skip it - it can never match all!
+  if (label_eqs.size() < label_eqs_.size()) return;
+  class Filter final : public MetricsSink {
+   public:
+    explicit Filter(Sink& sink, absl::Span<const LabelEq> inclusion_checks)
+        : inclusion_checks_(inclusion_checks), sink_(sink) {}
+
+    void Counter(absl::Span<const std::string> label, absl::string_view name,
+                 uint64_t value) override {
+      if (!Matches(label)) return;
+      sink_.Counter(label, name, value);
+    }
+
+   private:
+    bool Matches(absl::Span<const std::string> label) const {
+      for (const auto& check : inclusion_checks_) {
+        if (label[check.offset] != check.value) return false;
+      }
+      return true;
+    }
+
+    absl::Span<const LabelEq> inclusion_checks_;
+    Sink& sink_;
+  };
+  Filter filter(sink, label_eqs);
+  fn(filter);
+}
+
+void QueryableDomain::Constructed() {
+  CHECK_EQ(prev_, nullptr);
+  prev_ = last_;
+  last_ = this;
+}
+
+void QueryableDomain::ExportMetrics(const MetricsQuery& query,
+                                    MetricsSink& sink) {
+  auto selected_metrics = query.selected_metrics();
+  if (selected_metrics.has_value()) {
+    absl::flat_hash_map<QueryableDomain*,
+                        std::vector<const InstrumentIndex::Description*>>
+        what;
+    for (const auto& metric : *selected_metrics) {
+      const auto* desc = InstrumentIndex::Get().Find(metric);
+      if (desc == nullptr) continue;
+      what[desc->domain].push_back(desc);
+    }
+    for (auto it = what.begin(); it != what.end(); ++it) {
+      // TODO(ctiller): switch to structured bindings when we have C++20.
+      // Avoids "error: captured structured bindings are a C++20 extension
+      // [-Werror,-Wc++20-extensions]"
+      auto* domain = it->first;
+      auto& metrics = it->second;
+      query.Apply(
+          domain->label_names(),
+          [&](MetricsSink& sink) { domain->ExportMetrics(sink, metrics); },
+          sink);
+    }
+  } else {
+    for (auto* domain = last_; domain != nullptr; domain = domain->prev_) {
+      query.Apply(
+          domain->label_names(),
+          [&](MetricsSink& sink) {
+            domain->ExportMetrics(sink, domain->all_metrics());
+          },
+          sink);
+    }
+  }
+}
+
+uint64_t QueryableDomain::AllocateCounter(absl::string_view name,
+                                          absl::string_view description,
+                                          absl::string_view unit) {
+  const size_t offset = Allocate(1);
+  metrics_.push_back(InstrumentIndex::Get().Register(
+      this, offset, name, description, unit, InstrumentIndex::Counter{}));
+  return offset;
+}
+
+void QueryableDomain::TestOnlyResetAll() {
+  for (auto* domain = last_; domain != nullptr; domain = domain->prev_) {
+    domain->TestOnlyReset();
+  }
+}
+
+void TestOnlyResetInstruments() { QueryableDomain::TestOnlyResetAll(); }
+
+}  // namespace grpc_core
diff --git a/deps/grpc/src/core/telemetry/instrument.h b/deps/grpc/src/core/telemetry/instrument.h
new file mode 100644
index 00000000000..a61998026bf
--- /dev/null
+++ b/deps/grpc/src/core/telemetry/instrument.h
@@ -0,0 +1,462 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CORE_TELEMETRY_INSTRUMENT_H
+#define GRPC_SRC_CORE_TELEMETRY_INSTRUMENT_H
+
+#include <grpc/support/cpu.h>
+
+#include <algorithm>
+#include <atomic>
+#include <cstdint>
+#include <memory>
+#include <optional>
+#include <string>
+#include <tuple>
+#include <utility>
+#include <variant>
+#include <vector>
+
+#include "absl/base/thread_annotations.h"
+#include "absl/container/flat_hash_map.h"
+#include "absl/container/flat_hash_set.h"
+#include "absl/container/node_hash_map.h"
+#include "absl/hash/hash.h"
+#include "absl/log/check.h"
+#include "absl/log/log.h"
+#include "absl/strings/str_cat.h"
+#include "absl/strings/string_view.h"
+#include "absl/types/span.h"
+#include "src/core/util/avl.h"
+#include "src/core/util/match.h"
+#include "src/core/util/per_cpu.h"
+#include "src/core/util/sync.h"
+
+namespace grpc_core {
+
+// An InstrumentDomain is a collection of metrics with a common set of labels.
+// The metrics can be of any type (counter, gauge, histogram, etc) and are
+// all managed by a single instance of the InstrumentDomain.
+// InstrumentDomains should be created at static initialization time.
+// The InstrumentDomain has a Backend, which defines how metrics are
+// accumulated.
+template <typename Backend, typename... Label>
+class InstrumentDomain;
+
+namespace instrument_detail {
+// An InstrumentHandle is a handle to a single metric in an InstrumentDomain.
+// kType is used in using statements to disambiguate between different
+// InstrumentHandle specializations.
+// Backed, Label... are per InstrumentDomain.
+template <int kType, typename Backend, typename... Label>
+class InstrumentHandle {
+ private:
+  friend class InstrumentDomain<Backend, Label...>;
+
+  InstrumentHandle(InstrumentDomain<Backend, Label...>* instrument_domain,
+                   uint64_t offset)
+      : instrument_domain_(instrument_domain), offset_(offset) {}
+
+  InstrumentDomain<Backend, Label...>* instrument_domain_;
+  uint64_t offset_;
+};
+}  // namespace instrument_detail
+
+// A domain backend for low contention domains.
+// We use a simple array of atomics to back the collection - each increment
+// is a relaxed add.
+class LowContentionBackend {
+ public:
+  explicit LowContentionBackend(size_t size)
+      : counters_(new std::atomic<uint64_t>[size]) {
+    for (size_t i = 0; i < size; ++i) {
+      counters_[i].store(0, std::memory_order_relaxed);
+    }
+  }
+
+  void Increment(size_t index) {
+    counters_[index].fetch_add(1, std::memory_order_relaxed);
+  }
+
+  uint64_t Sum(size_t index) {
+    return counters_[index].load(std::memory_order_relaxed);
+  }
+
+ private:
+  std::unique_ptr<std::atomic<uint64_t>[]> counters_;
+};
+
+// A domain backend for high contention domains.
+// We shard the counters to reduce contention: increments happen on a shard
+// selected by the current CPU, and reads need to accumulate across all the
+// shards.
+class HighContentionBackend {
+ public:
+  explicit HighContentionBackend(size_t size) {
+    for (auto& shard : counters_) {
+      shard = std::make_unique<std::atomic<uint64_t>[]>(size);
+      for (size_t i = 0; i < size; ++i) {
+        shard[i].store(0, std::memory_order_relaxed);
+      }
+    }
+  }
+
+  void Increment(size_t index) {
+    counters_.this_cpu()[index].fetch_add(1, std::memory_order_relaxed);
+  }
+
+  uint64_t Sum(size_t index) {
+    uint64_t sum = 0;
+    for (auto& shard : counters_) {
+      sum += shard[index].load(std::memory_order_relaxed);
+    }
+    return sum;
+  }
+
+ private:
+  PerCpu<std::unique_ptr<std::atomic<uint64_t>[]>> counters_{
+      PerCpuOptions().SetMaxShards(16)};
+};
+
+// MetricsSink is an interface for accumulating metrics.
+// Importantly it's the output interface for MetricsQuery.
+class MetricsSink {
+ public:
+  // Called once per label per metric, with the value of that metric for that
+  // label.
+  virtual void Counter(absl::Span<const std::string> label,
+                       absl::string_view name, uint64_t value) = 0;
+
+ protected:
+  ~MetricsSink() = default;
+};
+
+// A MetricsQuery allows querying across the global set of metrics and
+// fetching their values.
+// Allows a level of filtering so that we only get the values for metrics
+// that match a set of criteria.
+// Also allows collapsing labels (effectively omitting them) and aggregating
+// over the remaining labels.
+class MetricsQuery {
+ public:
+  // Only include metrics that include `label` and have that label equal to
+  // `value`.
+  MetricsQuery& WithLabelEq(absl::string_view label, std::string value);
+  // Collapse labels, effectively omitting them. Counters are summed over the
+  // remaining dimensions, etc.
+  MetricsQuery& CollapseLabels(absl::Span<const std::string> labels);
+  // Only include metrics that are in `metrics`.
+  MetricsQuery& OnlyMetrics(absl::Span<const std::string> metrics);
+
+  // Returns the metrics that are selected by this query.
+  std::optional<absl::Span<const std::string>> selected_metrics() const {
+    return only_metrics_;
+  }
+
+  // Adapts `sink` by including the filtering requested, and then calls `fn`
+  // with the filtering sink. This is mainly an implementation detail.
+  template <typename Fn>
+  void Apply(absl::Span<const std::string> label_names, Fn fn,
+             MetricsSink& sink) const;
+
+  // Runs the query, outputting the results to `sink`.
+  void Run(MetricsSink& sink) const;
+
+ private:
+  template <typename Fn, typename Sink>
+  void ApplyLabelChecks(absl::Span<const std::string> label_names, Fn fn,
+                        Sink& sink) const;
+
+  absl::flat_hash_map<absl::string_view, std::string> label_eqs_;
+  std::optional<std::vector<std::string>> only_metrics_;
+  absl::flat_hash_set<std::string> collapsed_labels_;
+};
+
+class QueryableDomain;
+
+// A registry of metrics.
+// In this singleton we maintain metadata about all registered metrics.
+class InstrumentIndex {
+ public:
+  struct Counter {};
+  // TODO(ctiller): Add support for other metric types.
+
+  using Shape = std::variant<Counter>;
+
+  // A description of a metric.
+  struct Description {
+    // The domain that owns the metric.
+    QueryableDomain* domain;
+    // The offset of the metric within the domain's allocated metrics.
+    uint64_t offset;
+    // The name of the metric.
+    absl::string_view name;
+    // A description of the metric.
+    absl::string_view description;
+    // The unit of the metric.
+    absl::string_view unit;
+    // The shape of the metric - for counters this is empty.
+    // For histograms, it defines the buckets.
+    Shape shape;
+  };
+
+  // Returns the singleton instance of the InstrumentIndex.
+  static InstrumentIndex& Get() {
+    static InstrumentIndex* index = new InstrumentIndex();
+    return *index;
+  }
+
+  // Registers a metric with the given name, description, unit, and shape.
+  // Returns a pointer to the Description struct, which contains metadata about
+  // the metric.
+  const Description* Register(QueryableDomain* domain, uint64_t offset,
+                              absl::string_view name,
+                              absl::string_view description,
+                              absl::string_view unit, Shape shape);
+
+  // Finds a metric with the given name, or nullptr if not found.
+  const Description* Find(absl::string_view name) const;
+
+ private:
+  InstrumentIndex() = default;
+
+  // A map of metric name to Description. We use node_hash_map because we need
+  // pointer stability for the values.
+  absl::node_hash_map<absl::string_view, Description> metrics_;
+};
+
+// A QueryableDomain is a collection of metrics with a common set of labels.
+// The metrics can be of any type (counter, gauge, histogram, etc) and are
+// all managed by a single instance of the QueryableDomain.
+// QueryableDomain is the base class for InstrumentDomain, and contains common
+// functionality that doesn't need to know about exact types.
+class QueryableDomain {
+ public:
+  // Exports all metrics selected by `query` to `sink`.
+  // This is the backing function for MetricsQuery::Run, which should be the
+  // preferred way to export metrics.
+  static void ExportMetrics(const MetricsQuery& query, MetricsSink& sink);
+
+  // Reset the internal state of all domains. For test use only.
+  static void TestOnlyResetAll();
+  // Reset the internal state of this domain. For test use only.
+  virtual void TestOnlyReset() = 0;
+
+  // Returns the names of the labels in the domain.
+  absl::Span<const std::string> label_names() const { return label_names_; }
+
+ protected:
+  explicit QueryableDomain(std::vector<std::string> label_names)
+      : label_names_(std::move(label_names)) {}
+
+  // QueryableDomain should never be destroyed.
+  ~QueryableDomain() { LOG(FATAL) << "QueryableDomain destroyed."; }
+
+  // Called by InstrumentDomain when construction is complete.
+  void Constructed();
+
+  // Allocates a counter with the given name, description, and unit.
+  uint64_t AllocateCounter(absl::string_view name,
+                           absl::string_view description,
+                           absl::string_view unit);
+
+  // Returns all metrics in the domain.
+  absl::Span<const InstrumentIndex::Description* const> all_metrics() const {
+    return metrics_;
+  }
+
+  // Returns the number of metrics allocated in the domain.
+  uint64_t allocated() const { return allocated_; }
+
+ private:
+  // Exports all metrics in `metrics` to `sink`.
+  virtual void ExportMetrics(
+      MetricsSink& sink,
+      absl::Span<const InstrumentIndex::Description* const> metrics) = 0;
+
+  // Allocate `size` elements in the domain.
+  // Counters will allocate one element. Histograms will allocate one per
+  // bucket.
+  uint64_t Allocate(size_t size) {
+    const uint64_t offset = allocated_;
+    allocated_ += size;
+    return offset;
+  }
+
+  // We keep a linked list of all QueryableDomains, so that we can walk
+  // them in order to export metrics.
+  static inline QueryableDomain* last_ = nullptr;
+  QueryableDomain* prev_ = nullptr;
+
+  const std::vector<std::string> label_names_;
+  std::vector<const InstrumentIndex::Description*> metrics_;
+  uint64_t allocated_ = 0;
+};
+
+// An InstrumentDomain is a collection of instruments with a common set of
+// labels.
+template <typename Backend, typename... Label>
+class InstrumentDomain final : public QueryableDomain {
+ public:
+  using LabelTuple = std::tuple<Label...>;
+  using CounterHandle =
+      instrument_detail::InstrumentHandle<1, Backend, Label...>;
+
+  // Storage is a ref-counted object that holds the backend for an
+  // InstrumentDomain for a single set of labels.
+  class Storage final : public RefCounted<Storage, NonPolymorphicRefCount> {
+   public:
+    ~Storage() = default;
+
+    // Increments the counter specified by `handle` by 1 for this storages
+    // labels.
+    void Increment(CounterHandle handle) {
+      DCHECK_EQ(handle.instrument_domain_, instrument_domain_);
+      backend_.Increment(handle.offset_);
+    }
+
+   protected:
+    explicit Storage(InstrumentDomain* instrument_domain)
+        : instrument_domain_(instrument_domain),
+          backend_(instrument_domain->allocated()) {}
+
+   private:
+    friend class InstrumentDomain<Backend, Label...>;
+
+    InstrumentDomain* instrument_domain_;
+    Backend backend_;
+  };
+
+  explicit InstrumentDomain(std::vector<std::string> label_names,
+                            size_t map_shards = std::min(16u,
+                                                         gpr_cpu_num_cores()))
+      : QueryableDomain(std::move(label_names)) {
+    CHECK_EQ(this->label_names().size(), sizeof...(Label));
+    if constexpr (sizeof...(Label) == 0) {
+      map_shards_size_ = 1;
+    } else {
+      map_shards_size_ = std::max<size_t>(1, map_shards);
+    }
+    map_shards_ = std::make_unique<MapShard[]>(map_shards_size_);
+    Constructed();
+  }
+
+  // Registration functions: must all complete before the first GetStorage call.
+  // No locking is performed, so registrations must be performed with external
+  // synchronization.
+  // Effectively: Do this at static initialization time.
+
+  CounterHandle RegisterCounter(absl::string_view name,
+                                absl::string_view description,
+                                absl::string_view unit) {
+    return CounterHandle{this, AllocateCounter(name, description, unit)};
+  }
+
+  // GetStorage: returns a pointer to the storage for the given key, creating
+  // it if necessary.
+  RefCountedPtr<Storage> GetStorage(Label... labels) {
+    auto label = LabelTuple(std::move(labels)...);
+    size_t shard;
+    if constexpr (sizeof...(Label) == 0) {
+      shard = 0;
+    } else if constexpr (sizeof...(Label) == 1) {
+      // Use a salted label to shard, so that we remove minimal entropy from the
+      // main table.
+      shard = absl::HashOf(std::get<0>(label), this) % map_shards_size_;
+    } else {
+      // Use the first label to shard, all labels to index.
+      shard = absl::HashOf(std::get<0>(label)) % map_shards_size_;
+    }
+    RefCountedPtr<Storage> new_storage;
+    MapShard& map_shard = map_shards_[shard];
+    // First try to get an existing storage.
+    map_shard.mu.Lock();
+    auto storage_map = map_shard.storage_map;
+    map_shard.mu.Unlock();
+    // With an AVL we can search outside the lock.
+    auto* storage = storage_map.Lookup(label);
+    if (storage == nullptr) {
+      // No hit: now we lock and search again.
+      MutexLock lock(&map_shard.mu);
+      storage_map = map_shard.storage_map;
+      // We must look up the storage map again, as it may have been created
+      // by another thread while we were not holding the lock.
+      storage = storage_map.Lookup(label);
+      if (storage == nullptr) {
+        // Still no hit: with the lock held we allocate a new storage and insert
+        // it into the map.
+        new_storage.reset(new Storage(this));
+        map_shard.storage_map = storage_map.Add(label, new_storage);
+        storage = &new_storage;
+      }
+    }
+    return *storage;
+  }
+
+ private:
+  struct MapShard {
+    Mutex mu;
+    AVL<LabelTuple, RefCountedPtr<Storage>> storage_map ABSL_GUARDED_BY(mu);
+  };
+
+  ~InstrumentDomain() = delete;
+
+  void TestOnlyReset() override {
+    map_shards_.reset(new MapShard[map_shards_size_]);
+  }
+
+  // Exports all metrics in `metrics` to `sink`.
+  void ExportMetrics(
+      MetricsSink& sink,
+      absl::Span<const InstrumentIndex::Description* const> metrics) override {
+    // Walk over the map shards.
+    for (size_t i = 0; i < map_shards_size_; ++i) {
+      // Fetch the storage map, then process it outside the lock.
+      auto& map_shard = map_shards_[i];
+      map_shard.mu.Lock();
+      auto storage_map = map_shard.storage_map;
+      map_shard.mu.Unlock();
+      storage_map.ForEach([&](const auto& label, const auto& storage) {
+        std::vector<std::string> label_names = std::apply(
+            [&](auto&&... args) {
+              return std::vector<std::string>{absl::StrCat(args)...};
+            },
+            label);
+        for (const auto* metric : metrics) {
+          Match(metric->shape, [metric, &sink, storage = storage.get(),
+                                &label_names](InstrumentIndex::Counter) {
+            sink.Counter(label_names, metric->name,
+                         storage->backend_.Sum(metric->offset));
+          });
+        }
+      });
+    }
+  }
+
+  std::unique_ptr<MapShard[]> map_shards_;
+  size_t map_shards_size_;
+};
+
+template <typename Backend, typename... Label>
+auto* MakeInstrumentDomain(Label... labels) {
+  return new InstrumentDomain<Backend, Label...>(
+      std::vector<std::string>{absl::StrCat(labels)...});
+}
+
+// Reset all registered instruments. For test use only.
+void TestOnlyResetInstruments();
+
+}  // namespace grpc_core
+
+#endif  // GRPC_SRC_CORE_TELEMETRY_INSTRUMENT_H
diff --git a/deps/grpc/src/core/telemetry/metrics.h b/deps/grpc/src/core/telemetry/metrics.h
index 4d2c8acad50..e63b344fc9b 100644
--- a/deps/grpc/src/core/telemetry/metrics.h
+++ b/deps/grpc/src/core/telemetry/metrics.h
@@ -285,12 +285,12 @@ class StatsPlugin {
 
   // Whether this stats plugin is enabled for the channel specified by \a scope.
   // Returns true and a channel-specific ScopeConfig which may then be used to
-  // configure the ClientCallTracer in GetClientCallTracer().
+  // configure the ClientCallTracerInterface in GetClientCallTracer().
   virtual std::pair<bool, std::shared_ptr<ScopeConfig>> IsEnabledForChannel(
       const experimental::StatsPluginChannelScope& scope) const = 0;
   // Whether this stats plugin is enabled for the server specified by \a args.
   // Returns true and a server-specific ScopeConfig which may then be used to
-  // configure the ServerCallTracer in GetServerCallTracer().
+  // configure the ServerCallTracerInterface in GetServerCallTracer().
   virtual std::pair<bool, std::shared_ptr<ScopeConfig>> IsEnabledForServer(
       const ChannelArgs& args) const = 0;
   // Gets a scope config for the client channel specified by \a scope. Note that
@@ -344,14 +344,14 @@ class StatsPlugin {
   virtual bool IsInstrumentEnabled(
       GlobalInstrumentsRegistry::GlobalInstrumentHandle handle) const = 0;
 
-  // Gets a ClientCallTracer associated with this stats plugin which can be used
-  // in a call.
-  virtual ClientCallTracer* GetClientCallTracer(
+  // Gets a ClientCallTracerInterface associated with this stats plugin which
+  // can be used in a call.
+  virtual ClientCallTracerInterface* GetClientCallTracer(
       const Slice& path, bool registered_method,
       std::shared_ptr<ScopeConfig> scope_config) = 0;
-  // Gets a ServerCallTracer associated with this stats plugin which can be used
-  // in a call.
-  virtual ServerCallTracer* GetServerCallTracer(
+  // Gets a ServerCallTracerInterface associated with this stats plugin which
+  // can be used in a call.
+  virtual ServerCallTracerInterface* GetServerCallTracer(
       std::shared_ptr<ScopeConfig> scope_config) = 0;
 
   // TODO(yijiem): This is an optimization for the StatsPlugin to create its own
diff --git a/deps/grpc/src/core/telemetry/stats_data.cc b/deps/grpc/src/core/telemetry/stats_data.cc
index bbcbcc9dbb1..4990760411a 100644
--- a/deps/grpc/src/core/telemetry/stats_data.cc
+++ b/deps/grpc/src/core/telemetry/stats_data.cc
@@ -1,4 +1,4 @@
-// Copyright 2017 gRPC authors.
+// Copyright 2025 gRPC authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -26,29 +26,27 @@ union DblUint {
   uint64_t uint;
 };
 }  // namespace
-void HistogramCollector_16777216_20_64::Collect(
-    Histogram_16777216_20_64* result) const {
-  for (int i = 0; i < 20; i++) {
+void HistogramCollector_80_10_64::Collect(Histogram_80_10_64* result) const {
+  for (int i = 0; i < 10; i++) {
     result->buckets_[i] += buckets_[i].load(std::memory_order_relaxed);
   }
 }
-Histogram_16777216_20_64 operator-(const Histogram_16777216_20_64& left,
-                                   const Histogram_16777216_20_64& right) {
-  Histogram_16777216_20_64 result;
-  for (int i = 0; i < 20; i++) {
+Histogram_80_10_64 operator-(const Histogram_80_10_64& left,
+                             const Histogram_80_10_64& right) {
+  Histogram_80_10_64 result;
+  for (int i = 0; i < 10; i++) {
     result.buckets_[i] = left.buckets_[i] - right.buckets_[i];
   }
   return result;
 }
-void HistogramCollector_100000_20_64::Collect(
-    Histogram_100000_20_64* result) const {
+void HistogramCollector_100_20_64::Collect(Histogram_100_20_64* result) const {
   for (int i = 0; i < 20; i++) {
     result->buckets_[i] += buckets_[i].load(std::memory_order_relaxed);
   }
 }
-Histogram_100000_20_64 operator-(const Histogram_100000_20_64& left,
-                                 const Histogram_100000_20_64& right) {
-  Histogram_100000_20_64 result;
+Histogram_100_20_64 operator-(const Histogram_100_20_64& left,
+                              const Histogram_100_20_64& right) {
+  Histogram_100_20_64 result;
   for (int i = 0; i < 20; i++) {
     result.buckets_[i] = left.buckets_[i] - right.buckets_[i];
   }
@@ -82,74 +80,69 @@ Histogram_65536_26_64 operator-(const Histogram_65536_26_64& left,
   }
   return result;
 }
-void HistogramCollector_100_20_64::Collect(Histogram_100_20_64* result) const {
+void HistogramCollector_100000_20_64::Collect(
+    Histogram_100000_20_64* result) const {
   for (int i = 0; i < 20; i++) {
     result->buckets_[i] += buckets_[i].load(std::memory_order_relaxed);
   }
 }
-Histogram_100_20_64 operator-(const Histogram_100_20_64& left,
-                              const Histogram_100_20_64& right) {
-  Histogram_100_20_64 result;
+Histogram_100000_20_64 operator-(const Histogram_100000_20_64& left,
+                                 const Histogram_100000_20_64& right) {
+  Histogram_100000_20_64 result;
   for (int i = 0; i < 20; i++) {
     result.buckets_[i] = left.buckets_[i] - right.buckets_[i];
   }
   return result;
 }
-void HistogramCollector_16777216_50_64::Collect(
-    Histogram_16777216_50_64* result) const {
-  for (int i = 0; i < 50; i++) {
+void HistogramCollector_1800000_40_64::Collect(
+    Histogram_1800000_40_64* result) const {
+  for (int i = 0; i < 40; i++) {
     result->buckets_[i] += buckets_[i].load(std::memory_order_relaxed);
   }
 }
-Histogram_16777216_50_64 operator-(const Histogram_16777216_50_64& left,
-                                   const Histogram_16777216_50_64& right) {
-  Histogram_16777216_50_64 result;
-  for (int i = 0; i < 50; i++) {
+Histogram_1800000_40_64 operator-(const Histogram_1800000_40_64& left,
+                                  const Histogram_1800000_40_64& right) {
+  Histogram_1800000_40_64 result;
+  for (int i = 0; i < 40; i++) {
     result.buckets_[i] = left.buckets_[i] - right.buckets_[i];
   }
   return result;
 }
-void HistogramCollector_80_10_64::Collect(Histogram_80_10_64* result) const {
-  for (int i = 0; i < 10; i++) {
+void HistogramCollector_16777216_20_64::Collect(
+    Histogram_16777216_20_64* result) const {
+  for (int i = 0; i < 20; i++) {
     result->buckets_[i] += buckets_[i].load(std::memory_order_relaxed);
   }
 }
-Histogram_80_10_64 operator-(const Histogram_80_10_64& left,
-                             const Histogram_80_10_64& right) {
-  Histogram_80_10_64 result;
-  for (int i = 0; i < 10; i++) {
+Histogram_16777216_20_64 operator-(const Histogram_16777216_20_64& left,
+                                   const Histogram_16777216_20_64& right) {
+  Histogram_16777216_20_64 result;
+  for (int i = 0; i < 20; i++) {
     result.buckets_[i] = left.buckets_[i] - right.buckets_[i];
   }
   return result;
 }
-void HistogramCollector_1800000_40_64::Collect(
-    Histogram_1800000_40_64* result) const {
-  for (int i = 0; i < 40; i++) {
+void HistogramCollector_16777216_50_64::Collect(
+    Histogram_16777216_50_64* result) const {
+  for (int i = 0; i < 50; i++) {
     result->buckets_[i] += buckets_[i].load(std::memory_order_relaxed);
   }
 }
-Histogram_1800000_40_64 operator-(const Histogram_1800000_40_64& left,
-                                  const Histogram_1800000_40_64& right) {
-  Histogram_1800000_40_64 result;
-  for (int i = 0; i < 40; i++) {
+Histogram_16777216_50_64 operator-(const Histogram_16777216_50_64& left,
+                                   const Histogram_16777216_50_64& right) {
+  Histogram_16777216_50_64 result;
+  for (int i = 0; i < 50; i++) {
     result.buckets_[i] = left.buckets_[i] - right.buckets_[i];
   }
   return result;
 }
 namespace {
-const int kStatsTable0[21] = {
-    0,     1,      3,      8,       19,      45,      106,
-    250,   588,    1383,   3252,    7646,    17976,   42262,
-    99359, 233593, 549177, 1291113, 3035402, 7136218, 16777216};
-const uint8_t kStatsTable1[23] = {2,  3,  3,  4,  5,  6,  7,  8,
-                                  8,  9,  10, 11, 12, 12, 13, 14,
-                                  15, 16, 16, 17, 18, 19, 20};
-const int kStatsTable2[21] = {0,    1,    2,    4,     8,     15,    27,
-                              49,   89,   160,  288,   517,   928,   1666,
-                              2991, 5369, 9637, 17297, 31045, 55719, 100000};
-const uint8_t kStatsTable3[30] = {3,  3,  4,  4,  5,  6,  6,  7,  7,  8,
-                                  9,  9,  10, 10, 11, 11, 12, 13, 13, 14,
-                                  15, 15, 16, 16, 17, 17, 18, 19, 19, 20};
+const int kStatsTable0[11] = {0, 1, 2, 4, 7, 11, 17, 26, 38, 56, 80};
+const uint8_t kStatsTable1[9] = {3, 3, 4, 5, 6, 6, 7, 8, 9};
+const int kStatsTable2[21] = {0,  1,  2,  3,  4,  5,  7,  9,  11, 14, 17,
+                              21, 25, 30, 36, 43, 51, 61, 72, 85, 100};
+const uint8_t kStatsTable3[16] = {6,  6,  7,  8,  9,  9,  10, 11,
+                                  12, 13, 14, 15, 16, 17, 18, 19};
 const int kStatsTable4[21] = {0,   1,    2,    4,    7,    12,   19,
                               30,  47,   74,   116,  182,  285,  445,
                               695, 1084, 1691, 2637, 4113, 6414, 10000};
@@ -163,14 +156,32 @@ const int kStatsTable6[27] = {0,    1,     2,     4,     7,     11,   17,
 const uint8_t kStatsTable7[29] = {3,  3,  4,  5,  6,  6,  7,  8,  9,  10,
                                   11, 11, 12, 13, 14, 15, 16, 16, 17, 18,
                                   19, 20, 21, 21, 22, 23, 24, 25, 26};
-const int kStatsTable8[9] = {0,     1,      11,      119,     1275,
-                             13656, 146259, 1566467, 16777216};
-const uint8_t kStatsTable9[11] = {2, 2, 3, 4, 4, 5, 5, 6, 6, 7, 8};
-const int kStatsTable10[21] = {0,  1,  2,  3,  4,  5,  7,  9,  11, 14, 17,
-                               21, 25, 30, 36, 43, 51, 61, 72, 85, 100};
-const uint8_t kStatsTable11[16] = {6,  6,  7,  8,  9,  9,  10, 11,
-                                   12, 13, 14, 15, 16, 17, 18, 19};
-const int kStatsTable12[51] = {
+const int kStatsTable8[21] = {0,    1,    2,    4,     8,     15,    27,
+                              49,   89,   160,  288,   517,   928,   1666,
+                              2991, 5369, 9637, 17297, 31045, 55719, 100000};
+const uint8_t kStatsTable9[30] = {3,  3,  4,  4,  5,  6,  6,  7,  7,  8,
+                                  9,  9,  10, 10, 11, 11, 12, 13, 13, 14,
+                                  15, 15, 16, 16, 17, 17, 18, 19, 19, 20};
+const int kStatsTable10[41] = {
+    0,      1,      2,      3,       5,      8,      12,     18,     26,
+    37,     53,     76,     108,     153,    217,    308,    436,    617,
+    873,    1235,   1748,   2473,    3499,   4950,   7003,   9907,   14015,
+    19825,  28044,  39670,  56116,   79379,  112286, 158835, 224680, 317821,
+    449574, 635945, 899575, 1272492, 1800000};
+const uint8_t kStatsTable11[37] = {
+    4,  5,  5,  6,  7,  8,  9,  10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21,
+    22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39};
+const int kStatsTable12[9] = {0,     1,      11,      119,     1275,
+                              13656, 146259, 1566467, 16777216};
+const uint8_t kStatsTable13[11] = {2, 2, 3, 4, 4, 5, 5, 6, 6, 7, 8};
+const int kStatsTable14[21] = {
+    0,     1,      3,      8,       19,      45,      106,
+    250,   588,    1383,   3252,    7646,    17976,   42262,
+    99359, 233593, 549177, 1291113, 3035402, 7136218, 16777216};
+const uint8_t kStatsTable15[23] = {2,  3,  3,  4,  5,  6,  7,  8,
+                                   8,  9,  10, 11, 12, 12, 13, 14,
+                                   15, 16, 16, 17, 18, 19, 20};
+const int kStatsTable16[51] = {
     0,       1,        2,       3,       5,       7,       10,      14,
     20,      28,       39,      54,      75,      104,     144,     200,
     277,     383,      530,     733,     1014,    1402,    1939,    2681,
@@ -178,59 +189,56 @@ const int kStatsTable12[51] = {
     49412,   68303,    94416,   130512,  180408,  249380,  344720,  476509,
     658682,  910501,   1258592, 1739760, 2404882, 3324285, 4595181, 6351949,
     8780340, 12137120, 16777216};
-const uint8_t kStatsTable13[88] = {
+const uint8_t kStatsTable17[88] = {
     4,  4,  5,  5,  6,  6,  7,  7,  8,  8,  9,  9,  10, 11, 11, 12, 12, 13,
     13, 14, 14, 15, 15, 16, 16, 17, 18, 18, 18, 19, 20, 20, 21, 21, 22, 22,
     23, 23, 24, 24, 25, 25, 26, 27, 27, 28, 28, 29, 29, 30, 30, 31, 31, 32,
     32, 33, 33, 34, 35, 35, 36, 36, 37, 37, 38, 38, 39, 39, 40, 40, 41, 42,
     42, 43, 43, 44, 44, 45, 45, 46, 46, 47, 47, 48, 48, 49, 50, 50};
-const int kStatsTable14[11] = {0, 1, 2, 4, 7, 11, 17, 26, 38, 56, 80};
-const uint8_t kStatsTable15[9] = {3, 3, 4, 5, 6, 6, 7, 8, 9};
-const int kStatsTable16[41] = {
-    0,      1,      2,      3,       5,      8,      12,     18,     26,
-    37,     53,     76,     108,     153,    217,    308,    436,    617,
-    873,    1235,   1748,   2473,    3499,   4950,   7003,   9907,   14015,
-    19825,  28044,  39670,  56116,   79379,  112286, 158835, 224680, 317821,
-    449574, 635945, 899575, 1272492, 1800000};
-const uint8_t kStatsTable17[37] = {
-    4,  5,  5,  6,  7,  8,  9,  10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21,
-    22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39};
 }  // namespace
-int Histogram_16777216_20_64::BucketFor(int value) {
-  if (value < 2) {
+int Histogram_80_10_64::BucketFor(int value) {
+  if (value < 3) {
     if (value < 0) {
       return 0;
     } else {
       return value;
     }
   } else {
-    if (value < 8388609) {
+    if (value < 49) {
       DblUint val;
       val.dbl = value;
       const int bucket =
-          kStatsTable1[((val.uint - 4611686018427387904ull) >> 52)];
+          kStatsTable1[((val.uint - 4613937818241073152ull) >> 51)];
       return bucket - (value < kStatsTable0[bucket]);
     } else {
-      return 19;
+      if (value < 56) {
+        return 8;
+      } else {
+        return 9;
+      }
     }
   }
 }
-int Histogram_100000_20_64::BucketFor(int value) {
-  if (value < 3) {
+int Histogram_100_20_64::BucketFor(int value) {
+  if (value < 6) {
     if (value < 0) {
       return 0;
     } else {
       return value;
     }
   } else {
-    if (value < 65537) {
+    if (value < 81) {
       DblUint val;
       val.dbl = value;
       const int bucket =
-          kStatsTable3[((val.uint - 4613937818241073152ull) >> 51)];
+          kStatsTable3[((val.uint - 4618441417868443648ull) >> 50)];
       return bucket - (value < kStatsTable2[bucket]);
     } else {
-      return 19;
+      if (value < 85) {
+        return 18;
+      } else {
+        return 19;
+      }
     }
   }
 }
@@ -276,91 +284,87 @@ int Histogram_65536_26_64::BucketFor(int value) {
     }
   }
 }
-int Histogram_16777216_8_8::BucketFor(int value) {
-  if (value < 2) {
+int Histogram_100000_20_64::BucketFor(int value) {
+  if (value < 3) {
     if (value < 0) {
       return 0;
     } else {
       return value;
     }
   } else {
-    if (value < 2097153) {
+    if (value < 65537) {
       DblUint val;
       val.dbl = value;
       const int bucket =
-          kStatsTable9[((val.uint - 4611686018427387904ull) >> 53)];
+          kStatsTable9[((val.uint - 4613937818241073152ull) >> 51)];
       return bucket - (value < kStatsTable8[bucket]);
     } else {
-      return 7;
+      return 19;
     }
   }
 }
-int Histogram_100_20_64::BucketFor(int value) {
-  if (value < 6) {
+int Histogram_1800000_40_64::BucketFor(int value) {
+  if (value < 4) {
     if (value < 0) {
       return 0;
     } else {
       return value;
     }
   } else {
-    if (value < 81) {
+    if (value < 1048577) {
       DblUint val;
       val.dbl = value;
       const int bucket =
-          kStatsTable11[((val.uint - 4618441417868443648ull) >> 50)];
+          kStatsTable11[((val.uint - 4616189618054758400ull) >> 51)];
       return bucket - (value < kStatsTable10[bucket]);
     } else {
-      if (value < 85) {
-        return 18;
+      if (value < 1272492) {
+        return 38;
       } else {
-        return 19;
+        return 39;
       }
     }
   }
 }
-int Histogram_16777216_50_64::BucketFor(int value) {
-  if (value < 4) {
+int Histogram_16777216_8_8::BucketFor(int value) {
+  if (value < 2) {
     if (value < 0) {
       return 0;
     } else {
       return value;
     }
   } else {
-    if (value < 14680065) {
+    if (value < 2097153) {
       DblUint val;
       val.dbl = value;
       const int bucket =
-          kStatsTable13[((val.uint - 4616189618054758400ull) >> 50)];
+          kStatsTable13[((val.uint - 4611686018427387904ull) >> 53)];
       return bucket - (value < kStatsTable12[bucket]);
     } else {
-      return 49;
+      return 7;
     }
   }
 }
-int Histogram_80_10_64::BucketFor(int value) {
-  if (value < 3) {
+int Histogram_16777216_20_64::BucketFor(int value) {
+  if (value < 2) {
     if (value < 0) {
       return 0;
     } else {
       return value;
     }
   } else {
-    if (value < 49) {
+    if (value < 8388609) {
       DblUint val;
       val.dbl = value;
       const int bucket =
-          kStatsTable15[((val.uint - 4613937818241073152ull) >> 51)];
+          kStatsTable15[((val.uint - 4611686018427387904ull) >> 52)];
       return bucket - (value < kStatsTable14[bucket]);
     } else {
-      if (value < 56) {
-        return 8;
-      } else {
-        return 9;
-      }
+      return 19;
     }
   }
 }
-int Histogram_1800000_40_64::BucketFor(int value) {
+int Histogram_16777216_50_64::BucketFor(int value) {
   if (value < 4) {
     if (value < 0) {
       return 0;
@@ -368,18 +372,14 @@ int Histogram_1800000_40_64::BucketFor(int value) {
       return value;
     }
   } else {
-    if (value < 1048577) {
+    if (value < 14680065) {
       DblUint val;
       val.dbl = value;
       const int bucket =
-          kStatsTable17[((val.uint - 4616189618054758400ull) >> 51)];
+          kStatsTable17[((val.uint - 4616189618054758400ull) >> 50)];
       return bucket - (value < kStatsTable16[bucket]);
     } else {
-      if (value < 1272492) {
-        return 38;
-      } else {
-        return 39;
-      }
+      return 49;
     }
   }
 }
@@ -551,19 +551,19 @@ HistogramView GlobalStats::histogram(Histogram which) const {
       return HistogramView{&Histogram_65536_26_64::BucketFor, kStatsTable6, 26,
                            call_initial_size.buckets()};
     case Histogram::kTcpWriteSize:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, tcp_write_size.buckets()};
     case Histogram::kTcpWriteIovSize:
-      return HistogramView{&Histogram_80_10_64::BucketFor, kStatsTable14, 10,
+      return HistogramView{&Histogram_80_10_64::BucketFor, kStatsTable0, 10,
                            tcp_write_iov_size.buckets()};
     case Histogram::kTcpReadSize:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, tcp_read_size.buckets()};
     case Histogram::kTcpReadOffer:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, tcp_read_offer.buckets()};
     case Histogram::kTcpReadOfferIovSize:
-      return HistogramView{&Histogram_80_10_64::BucketFor, kStatsTable14, 10,
+      return HistogramView{&Histogram_80_10_64::BucketFor, kStatsTable0, 10,
                            tcp_read_offer_iov_size.buckets()};
     case Histogram::kWrrSubchannelListSize:
       return HistogramView{&Histogram_10000_20_64::BucketFor, kStatsTable4, 20,
@@ -572,59 +572,59 @@ HistogramView GlobalStats::histogram(Histogram which) const {
       return HistogramView{&Histogram_10000_20_64::BucketFor, kStatsTable4, 20,
                            wrr_subchannel_ready_size.buckets()};
     case Histogram::kWorkSerializerRunTimeMs:
-      return HistogramView{&Histogram_100000_20_64::BucketFor, kStatsTable2, 20,
+      return HistogramView{&Histogram_100000_20_64::BucketFor, kStatsTable8, 20,
                            work_serializer_run_time_ms.buckets()};
     case Histogram::kWorkSerializerWorkTimeMs:
-      return HistogramView{&Histogram_100000_20_64::BucketFor, kStatsTable2, 20,
+      return HistogramView{&Histogram_100000_20_64::BucketFor, kStatsTable8, 20,
                            work_serializer_work_time_ms.buckets()};
     case Histogram::kWorkSerializerWorkTimePerItemMs:
-      return HistogramView{&Histogram_100000_20_64::BucketFor, kStatsTable2, 20,
+      return HistogramView{&Histogram_100000_20_64::BucketFor, kStatsTable8, 20,
                            work_serializer_work_time_per_item_ms.buckets()};
     case Histogram::kWorkSerializerItemsPerRun:
       return HistogramView{&Histogram_10000_20_64::BucketFor, kStatsTable4, 20,
                            work_serializer_items_per_run.buckets()};
     case Histogram::kChaoticGoodSendmsgsPerWriteControl:
-      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable10, 20,
+      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable2, 20,
                            chaotic_good_sendmsgs_per_write_control.buckets()};
     case Histogram::kChaoticGoodRecvmsgsPerReadControl:
-      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable10, 20,
+      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable2, 20,
                            chaotic_good_recvmsgs_per_read_control.buckets()};
     case Histogram::kChaoticGoodSendmsgsPerWriteData:
-      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable10, 20,
+      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable2, 20,
                            chaotic_good_sendmsgs_per_write_data.buckets()};
     case Histogram::kChaoticGoodRecvmsgsPerReadData:
-      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable10, 20,
+      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable2, 20,
                            chaotic_good_recvmsgs_per_read_data.buckets()};
     case Histogram::kChaoticGoodThreadHopsPerWriteControl:
       return HistogramView{
-          &Histogram_100_20_64::BucketFor, kStatsTable10, 20,
+          &Histogram_100_20_64::BucketFor, kStatsTable2, 20,
           chaotic_good_thread_hops_per_write_control.buckets()};
     case Histogram::kChaoticGoodThreadHopsPerReadControl:
-      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable10, 20,
+      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable2, 20,
                            chaotic_good_thread_hops_per_read_control.buckets()};
     case Histogram::kChaoticGoodThreadHopsPerWriteData:
-      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable10, 20,
+      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable2, 20,
                            chaotic_good_thread_hops_per_write_data.buckets()};
     case Histogram::kChaoticGoodThreadHopsPerReadData:
-      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable10, 20,
+      return HistogramView{&Histogram_100_20_64::BucketFor, kStatsTable2, 20,
                            chaotic_good_thread_hops_per_read_data.buckets()};
     case Histogram::kChaoticGoodTcpReadSizeData:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, chaotic_good_tcp_read_size_data.buckets()};
     case Histogram::kChaoticGoodTcpReadSizeControl:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, chaotic_good_tcp_read_size_control.buckets()};
     case Histogram::kChaoticGoodTcpReadOfferData:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, chaotic_good_tcp_read_offer_data.buckets()};
     case Histogram::kChaoticGoodTcpReadOfferControl:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, chaotic_good_tcp_read_offer_control.buckets()};
     case Histogram::kChaoticGoodTcpWriteSizeData:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, chaotic_good_tcp_write_size_data.buckets()};
     case Histogram::kChaoticGoodTcpWriteSizeControl:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, chaotic_good_tcp_write_size_control.buckets()};
   }
 }
@@ -906,53 +906,53 @@ HistogramView Http2GlobalStats::histogram(Histogram which) const {
     default:
       GPR_UNREACHABLE_CODE(return HistogramView());
     case Histogram::kHttp2SendMessageSize:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, http2_send_message_size.buckets()};
     case Histogram::kHttp2MetadataSize:
       return HistogramView{&Histogram_65536_26_64::BucketFor, kStatsTable6, 26,
                            http2_metadata_size.buckets()};
     case Histogram::kHttp2HpackEntryLifetime:
-      return HistogramView{&Histogram_1800000_40_64::BucketFor, kStatsTable16,
+      return HistogramView{&Histogram_1800000_40_64::BucketFor, kStatsTable10,
                            40, http2_hpack_entry_lifetime.buckets()};
     case Histogram::kHttp2HeaderTableSize:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, http2_header_table_size.buckets()};
     case Histogram::kHttp2InitialWindowSize:
-      return HistogramView{&Histogram_16777216_50_64::BucketFor, kStatsTable12,
+      return HistogramView{&Histogram_16777216_50_64::BucketFor, kStatsTable16,
                            50, http2_initial_window_size.buckets()};
     case Histogram::kHttp2MaxConcurrentStreams:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, http2_max_concurrent_streams.buckets()};
     case Histogram::kHttp2MaxFrameSize:
-      return HistogramView{&Histogram_16777216_50_64::BucketFor, kStatsTable12,
+      return HistogramView{&Histogram_16777216_50_64::BucketFor, kStatsTable16,
                            50, http2_max_frame_size.buckets()};
     case Histogram::kHttp2MaxHeaderListSize:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, http2_max_header_list_size.buckets()};
     case Histogram::kHttp2PreferredReceiveCryptoMessageSize:
       return HistogramView{
-          &Histogram_16777216_20_64::BucketFor, kStatsTable0, 20,
+          &Histogram_16777216_20_64::BucketFor, kStatsTable14, 20,
           http2_preferred_receive_crypto_message_size.buckets()};
     case Histogram::kHttp2StreamRemoteWindowUpdate:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, http2_stream_remote_window_update.buckets()};
     case Histogram::kHttp2TransportRemoteWindowUpdate:
-      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable0,
+      return HistogramView{&Histogram_16777216_20_64::BucketFor, kStatsTable14,
                            20, http2_transport_remote_window_update.buckets()};
     case Histogram::kHttp2TransportWindowUpdatePeriod:
-      return HistogramView{&Histogram_100000_20_64::BucketFor, kStatsTable2, 20,
+      return HistogramView{&Histogram_100000_20_64::BucketFor, kStatsTable8, 20,
                            http2_transport_window_update_period.buckets()};
     case Histogram::kHttp2StreamWindowUpdatePeriod:
-      return HistogramView{&Histogram_100000_20_64::BucketFor, kStatsTable2, 20,
+      return HistogramView{&Histogram_100000_20_64::BucketFor, kStatsTable8, 20,
                            http2_stream_window_update_period.buckets()};
     case Histogram::kHttp2WriteDataFrameSize:
-      return HistogramView{&Histogram_16777216_50_64::BucketFor, kStatsTable12,
+      return HistogramView{&Histogram_16777216_50_64::BucketFor, kStatsTable16,
                            50, http2_write_data_frame_size.buckets()};
     case Histogram::kHttp2ReadDataFrameSize:
-      return HistogramView{&Histogram_16777216_50_64::BucketFor, kStatsTable12,
+      return HistogramView{&Histogram_16777216_50_64::BucketFor, kStatsTable16,
                            50, http2_read_data_frame_size.buckets()};
     case Histogram::kHttp2WriteTargetSize:
-      return HistogramView{&Histogram_16777216_50_64::BucketFor, kStatsTable12,
+      return HistogramView{&Histogram_16777216_50_64::BucketFor, kStatsTable16,
                            50, http2_write_target_size.buckets()};
   }
 }
diff --git a/deps/grpc/src/core/telemetry/stats_data.h b/deps/grpc/src/core/telemetry/stats_data.h
index dabafeb04fa..c5ec6208641 100644
--- a/deps/grpc/src/core/telemetry/stats_data.h
+++ b/deps/grpc/src/core/telemetry/stats_data.h
@@ -1,4 +1,4 @@
-// Copyright 2017 gRPC authors.
+// Copyright 2025 gRPC authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -32,57 +32,56 @@ namespace grpc_core {
 class GlobalStatsCollector;
 class Http2GlobalStatsCollector;
 class Http2StatsCollector;
-class HistogramCollector_16777216_20_64;
-class Histogram_16777216_20_64 {
+class HistogramCollector_80_10_64;
+class Histogram_80_10_64 {
  public:
   static int BucketFor(int value);
   const uint64_t* buckets() const { return buckets_; }
-  size_t bucket_count() const { return 20; }
+  size_t bucket_count() const { return 10; }
   void Increment(int value) {
-    ++buckets_[Histogram_16777216_20_64::BucketFor(value)];
+    ++buckets_[Histogram_80_10_64::BucketFor(value)];
   }
-  friend Histogram_16777216_20_64 operator-(
-      const Histogram_16777216_20_64& left,
-      const Histogram_16777216_20_64& right);
+  friend Histogram_80_10_64 operator-(const Histogram_80_10_64& left,
+                                      const Histogram_80_10_64& right);
 
  private:
-  friend class HistogramCollector_16777216_20_64;
-  uint64_t buckets_[20]{};
+  friend class HistogramCollector_80_10_64;
+  uint64_t buckets_[10]{};
 };
-class HistogramCollector_16777216_20_64 {
+class HistogramCollector_80_10_64 {
  public:
   void Increment(int value) {
-    buckets_[Histogram_16777216_20_64::BucketFor(value)].fetch_add(
+    buckets_[Histogram_80_10_64::BucketFor(value)].fetch_add(
         1, std::memory_order_relaxed);
   }
-  void Collect(Histogram_16777216_20_64* result) const;
+  void Collect(Histogram_80_10_64* result) const;
 
  private:
-  std::atomic<uint64_t> buckets_[20]{};
+  std::atomic<uint64_t> buckets_[10]{};
 };
-class HistogramCollector_100000_20_64;
-class Histogram_100000_20_64 {
+class HistogramCollector_100_20_64;
+class Histogram_100_20_64 {
  public:
   static int BucketFor(int value);
   const uint64_t* buckets() const { return buckets_; }
   size_t bucket_count() const { return 20; }
   void Increment(int value) {
-    ++buckets_[Histogram_100000_20_64::BucketFor(value)];
+    ++buckets_[Histogram_100_20_64::BucketFor(value)];
   }
-  friend Histogram_100000_20_64 operator-(const Histogram_100000_20_64& left,
-                                          const Histogram_100000_20_64& right);
+  friend Histogram_100_20_64 operator-(const Histogram_100_20_64& left,
+                                       const Histogram_100_20_64& right);
 
  private:
-  friend class HistogramCollector_100000_20_64;
+  friend class HistogramCollector_100_20_64;
   uint64_t buckets_[20]{};
 };
-class HistogramCollector_100000_20_64 {
+class HistogramCollector_100_20_64 {
  public:
   void Increment(int value) {
-    buckets_[Histogram_100000_20_64::BucketFor(value)].fetch_add(
+    buckets_[Histogram_100_20_64::BucketFor(value)].fetch_add(
         1, std::memory_order_relaxed);
   }
-  void Collect(Histogram_100000_20_64* result) const;
+  void Collect(Histogram_100_20_64* result) const;
 
  private:
   std::atomic<uint64_t> buckets_[20]{};
@@ -141,6 +140,61 @@ class HistogramCollector_65536_26_64 {
  private:
   std::atomic<uint64_t> buckets_[26]{};
 };
+class HistogramCollector_100000_20_64;
+class Histogram_100000_20_64 {
+ public:
+  static int BucketFor(int value);
+  const uint64_t* buckets() const { return buckets_; }
+  size_t bucket_count() const { return 20; }
+  void Increment(int value) {
+    ++buckets_[Histogram_100000_20_64::BucketFor(value)];
+  }
+  friend Histogram_100000_20_64 operator-(const Histogram_100000_20_64& left,
+                                          const Histogram_100000_20_64& right);
+
+ private:
+  friend class HistogramCollector_100000_20_64;
+  uint64_t buckets_[20]{};
+};
+class HistogramCollector_100000_20_64 {
+ public:
+  void Increment(int value) {
+    buckets_[Histogram_100000_20_64::BucketFor(value)].fetch_add(
+        1, std::memory_order_relaxed);
+  }
+  void Collect(Histogram_100000_20_64* result) const;
+
+ private:
+  std::atomic<uint64_t> buckets_[20]{};
+};
+class HistogramCollector_1800000_40_64;
+class Histogram_1800000_40_64 {
+ public:
+  static int BucketFor(int value);
+  const uint64_t* buckets() const { return buckets_; }
+  size_t bucket_count() const { return 40; }
+  void Increment(int value) {
+    ++buckets_[Histogram_1800000_40_64::BucketFor(value)];
+  }
+  friend Histogram_1800000_40_64 operator-(
+      const Histogram_1800000_40_64& left,
+      const Histogram_1800000_40_64& right);
+
+ private:
+  friend class HistogramCollector_1800000_40_64;
+  uint64_t buckets_[40]{};
+};
+class HistogramCollector_1800000_40_64 {
+ public:
+  void Increment(int value) {
+    buckets_[Histogram_1800000_40_64::BucketFor(value)].fetch_add(
+        1, std::memory_order_relaxed);
+  }
+  void Collect(Histogram_1800000_40_64* result) const;
+
+ private:
+  std::atomic<uint64_t> buckets_[40]{};
+};
 class Histogram_16777216_8_8 {
  public:
   static int BucketFor(int value);
@@ -159,29 +213,30 @@ class Histogram_16777216_8_8 {
  private:
   uint8_t buckets_[8]{};
 };
-class HistogramCollector_100_20_64;
-class Histogram_100_20_64 {
+class HistogramCollector_16777216_20_64;
+class Histogram_16777216_20_64 {
  public:
   static int BucketFor(int value);
   const uint64_t* buckets() const { return buckets_; }
   size_t bucket_count() const { return 20; }
   void Increment(int value) {
-    ++buckets_[Histogram_100_20_64::BucketFor(value)];
+    ++buckets_[Histogram_16777216_20_64::BucketFor(value)];
   }
-  friend Histogram_100_20_64 operator-(const Histogram_100_20_64& left,
-                                       const Histogram_100_20_64& right);
+  friend Histogram_16777216_20_64 operator-(
+      const Histogram_16777216_20_64& left,
+      const Histogram_16777216_20_64& right);
 
  private:
-  friend class HistogramCollector_100_20_64;
+  friend class HistogramCollector_16777216_20_64;
   uint64_t buckets_[20]{};
 };
-class HistogramCollector_100_20_64 {
+class HistogramCollector_16777216_20_64 {
  public:
   void Increment(int value) {
-    buckets_[Histogram_100_20_64::BucketFor(value)].fetch_add(
+    buckets_[Histogram_16777216_20_64::BucketFor(value)].fetch_add(
         1, std::memory_order_relaxed);
   }
-  void Collect(Histogram_100_20_64* result) const;
+  void Collect(Histogram_16777216_20_64* result) const;
 
  private:
   std::atomic<uint64_t> buckets_[20]{};
@@ -214,61 +269,6 @@ class HistogramCollector_16777216_50_64 {
  private:
   std::atomic<uint64_t> buckets_[50]{};
 };
-class HistogramCollector_80_10_64;
-class Histogram_80_10_64 {
- public:
-  static int BucketFor(int value);
-  const uint64_t* buckets() const { return buckets_; }
-  size_t bucket_count() const { return 10; }
-  void Increment(int value) {
-    ++buckets_[Histogram_80_10_64::BucketFor(value)];
-  }
-  friend Histogram_80_10_64 operator-(const Histogram_80_10_64& left,
-                                      const Histogram_80_10_64& right);
-
- private:
-  friend class HistogramCollector_80_10_64;
-  uint64_t buckets_[10]{};
-};
-class HistogramCollector_80_10_64 {
- public:
-  void Increment(int value) {
-    buckets_[Histogram_80_10_64::BucketFor(value)].fetch_add(
-        1, std::memory_order_relaxed);
-  }
-  void Collect(Histogram_80_10_64* result) const;
-
- private:
-  std::atomic<uint64_t> buckets_[10]{};
-};
-class HistogramCollector_1800000_40_64;
-class Histogram_1800000_40_64 {
- public:
-  static int BucketFor(int value);
-  const uint64_t* buckets() const { return buckets_; }
-  size_t bucket_count() const { return 40; }
-  void Increment(int value) {
-    ++buckets_[Histogram_1800000_40_64::BucketFor(value)];
-  }
-  friend Histogram_1800000_40_64 operator-(
-      const Histogram_1800000_40_64& left,
-      const Histogram_1800000_40_64& right);
-
- private:
-  friend class HistogramCollector_1800000_40_64;
-  uint64_t buckets_[40]{};
-};
-class HistogramCollector_1800000_40_64 {
- public:
-  void Increment(int value) {
-    buckets_[Histogram_1800000_40_64::BucketFor(value)].fetch_add(
-        1, std::memory_order_relaxed);
-  }
-  void Collect(Histogram_1800000_40_64* result) const;
-
- private:
-  std::atomic<uint64_t> buckets_[40]{};
-};
 struct GlobalStats {
   enum class Counter {
     kClientCallsCreated,
diff --git a/deps/grpc/src/core/transport/GEMINI.md b/deps/grpc/src/core/transport/GEMINI.md
new file mode 100644
index 00000000000..fb6ccb5ee8e
--- /dev/null
+++ b/deps/grpc/src/core/transport/GEMINI.md
@@ -0,0 +1,19 @@
+# Transport
+
+This directory contains the core transport abstraction for gRPC.
+
+## Overarching Purpose
+
+The transport abstraction provides a unified interface for sending and receiving data over a network. It is responsible for things like flow control, multiplexing, and error handling.
+
+## Files
+
+- **`endpoint_transport.h`**: Defines the `grpc_endpoint_transport` interface, which is the core transport abstraction.
+- **`auth_context.h` / `auth_context.cc`**: Defines the `grpc_auth_context` class, which is used to represent the security context of a connection.
+- **`endpoint_transport_client_channel_factory.h` / `endpoint_transport_client_channel_factory.cc`**: Defines a factory for creating client channels that are backed by an `endpoint_transport`.
+
+## Notes
+
+- The transport abstraction is a key component of gRPC's networking infrastructure.
+- It is responsible for providing a reliable and efficient way to send and receive data over a network.
+- The `grpc_endpoint_transport` interface is designed to be extensible, allowing new transport implementations to be added easily.
diff --git a/deps/grpc/src/core/transport/auth_context.cc b/deps/grpc/src/core/transport/auth_context.cc
index ceba020ef0f..3eea835b294 100644
--- a/deps/grpc/src/core/transport/auth_context.cc
+++ b/deps/grpc/src/core/transport/auth_context.cc
@@ -27,6 +27,7 @@
 
 #include "absl/log/check.h"
 #include "absl/log/log.h"
+#include "src/core/config/core_configuration.h"
 #include "src/core/lib/channel/channel_args.h"
 #include "src/core/lib/debug/trace.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
@@ -151,6 +152,10 @@ void grpc_auth_context::add_property(const char* name, const char* value,
   prop->value_length = value_length;
 }
 
+void grpc_auth_context::set_protocol(absl::string_view protocol) {
+  protocol_ = protocol;
+}
+
 void grpc_auth_context_add_property(grpc_auth_context* ctx, const char* name,
                                     const char* value, size_t value_length) {
   GRPC_TRACE_LOG(api, INFO) << absl::StrFormat(
@@ -233,3 +238,18 @@ grpc_auth_context* grpc_find_auth_context_in_args(
   }
   return nullptr;
 }
+
+std::optional<bool> grpc_auth_context::CompareAuthContext(
+    const grpc_auth_context* other) {
+  if (protocol_.empty() || other->protocol_.empty() ||
+      protocol_ != other->protocol_) {
+    return std::nullopt;
+  }
+  auto* comparator = grpc_core::CoreConfiguration::Get()
+                         .auth_context_comparator_registry()
+                         .GetComparator(protocol_);
+  if (comparator == nullptr) {
+    return std::nullopt;
+  }
+  return (*comparator)(this, other);
+}
diff --git a/deps/grpc/src/core/transport/auth_context.h b/deps/grpc/src/core/transport/auth_context.h
index e6036600423..dbadba9744e 100644
--- a/deps/grpc/src/core/transport/auth_context.h
+++ b/deps/grpc/src/core/transport/auth_context.h
@@ -120,6 +120,9 @@ struct grpc_auth_context
   void ensure_capacity();
   void add_property(const char* name, const char* value, size_t value_length);
   void add_cstring_property(const char* name, const char* value);
+  void set_protocol(absl::string_view protocol);
+  // Returns std::nullopt if auth context comparison is not supported.
+  std::optional<bool> CompareAuthContext(const grpc_auth_context* other);
 
  private:
   grpc_core::RefCountedPtr<grpc_auth_context> chained_;
@@ -127,6 +130,7 @@ struct grpc_auth_context
   const char* peer_identity_property_name_ = nullptr;
   std::unique_ptr<Extension> extension_;
   grpc_core::OrphanablePtr<grpc_core::ConnectionContext> connection_context_;
+  std::string protocol_;
 };
 
 // --- Channel args for auth context ---
diff --git a/deps/grpc/src/core/transport/auth_context_comparator_registry.h b/deps/grpc/src/core/transport/auth_context_comparator_registry.h
new file mode 100644
index 00000000000..187b9a08ad4
--- /dev/null
+++ b/deps/grpc/src/core/transport/auth_context_comparator_registry.h
@@ -0,0 +1,69 @@
+//
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//
+
+#ifndef GRPC_SRC_CORE_TRANSPORT_AUTH_CONTEXT_COMPARATOR_REGISTRY_H
+#define GRPC_SRC_CORE_TRANSPORT_AUTH_CONTEXT_COMPARATOR_REGISTRY_H
+
+#include <grpc/impl/grpc_types.h>
+
+#include "absl/functional/any_invocable.h"
+#include "src/core/lib/channel/channel_args.h"
+
+struct grpc_auth_context;
+
+class AuthContextComparatorRegistry {
+ private:
+  using Compare = absl::AnyInvocable<bool(const grpc_auth_context*,
+                                          const grpc_auth_context*)>;
+  using ComparatorMap = std::map<std::string, std::unique_ptr<Compare>>;
+
+ public:
+  class Builder {
+   public:
+    void RegisterComparator(
+        std::string name,
+        std::unique_ptr<absl::AnyInvocable<bool(const grpc_auth_context*,
+                                                const grpc_auth_context*)>>
+            comparator) {
+      if (comparators_.find(name) != comparators_.end()) {
+        LOG(FATAL) << "Duplicate comparator registration: " << name;
+      }
+      comparators_[name] = std::move(comparator);
+    }
+
+    AuthContextComparatorRegistry Build() {
+      return AuthContextComparatorRegistry(std::move(comparators_));
+    }
+
+   private:
+    ComparatorMap comparators_;
+  };
+
+  Compare* GetComparator(absl::string_view name) const {
+    auto it = comparators_.find(std::string(name));
+    if (it == comparators_.end()) {
+      return nullptr;
+    }
+    return it->second.get();
+  }
+
+ private:
+  explicit AuthContextComparatorRegistry(ComparatorMap comparators)
+      : comparators_(std::move(comparators)) {}
+  ComparatorMap comparators_;
+};
+
+#endif  // GRPC_SRC_CORE_TRANSPORT_AUTH_CONTEXT_COMPARATOR_REGISTRY_H
diff --git a/deps/grpc/src/core/tsi/GEMINI.md b/deps/grpc/src/core/tsi/GEMINI.md
new file mode 100644
index 00000000000..d94c601c7b9
--- /dev/null
+++ b/deps/grpc/src/core/tsi/GEMINI.md
@@ -0,0 +1,23 @@
+# Transport Security Interface (TSI)
+
+This directory contains the implementation of gRPC's Transport Security Interface (TSI), which is an abstraction for different transport security mechanisms like TLS and ALTS.
+
+## Overarching Purpose
+
+TSI provides a unified interface for performing transport-level security handshakes and protecting data. This allows gRPC to support different security mechanisms without having to change the core transport code.
+
+## Files and Subdirectories
+
+- **`transport_security_interface.h`**: Defines the core `tsi_handshaker` and `tsi_frame_protector` interfaces.
+- **`transport_security.h` / `transport_security.cc`**: Defines the `tsi_transport_security` interface, which is a higher-level abstraction that combines the `tsi_handshaker` and `tsi_frame_protector` interfaces.
+- **`transport_security_grpc.h` / `transport_security_grpc.cc`**: Provides a gRPC-specific implementation of the `tsi_transport_security` interface.
+- **`ssl/`**: An implementation of TSI that uses OpenSSL.
+- **`alts/`**: An implementation of TSI that uses ALTS.
+- **`fake_transport_security.h` / `fake_transport_security.cc`**: A fake implementation of TSI for testing.
+- **`local_transport_security.h` / `local_transport_security.cc`**: An implementation of TSI for local (e.g., UDS) connections.
+
+## Notes
+
+- TSI is a key component of gRPC's security infrastructure.
+- It provides a flexible and extensible way to add new security mechanisms to gRPC.
+- The TSI interfaces are designed to be simple and easy to implement, which makes it easy to add support for new security mechanisms.
diff --git a/deps/grpc/src/core/tsi/alts/GEMINI.md b/deps/grpc/src/core/tsi/alts/GEMINI.md
new file mode 100644
index 00000000000..c3737bc136f
--- /dev/null
+++ b/deps/grpc/src/core/tsi/alts/GEMINI.md
@@ -0,0 +1,20 @@
+# ALTS TSI Implementation
+
+This directory contains an implementation of the Transport Security Interface (TSI) that uses Application Layer Transport Security (ALTS).
+
+## Overarching Purpose
+
+This directory provides a concrete implementation of the TSI interfaces that can be used to secure gRPC connections with ALTS. ALTS is a mutual authentication and transport encryption system developed by Google.
+
+## Subdirectories
+
+- **`crypt/`**: Contains code for performing cryptographic operations.
+- **`frame_protector/`**: Contains the implementation of the `tsi_frame_proteator` interface for ALTS.
+- **`handshaker/`**: Contains the implementation of the `tsi_handshaker` interface for ALTS.
+- **`zero_copy_frame_protector/`**: Contains an implementation of the `tsi_frame_protector` interface that avoids copying data.
+
+## Notes
+
+- ALTS is a Google-specific security protocol.
+- It is designed to be efficient and to provide strong security for connections between services running within Google's infrastructure.
+- The ALTS TSI implementation is used by gRPC applications that need to communicate with other services that use ALTS.
diff --git a/deps/grpc/src/core/tsi/alts/handshaker/alts_handshaker_client.cc b/deps/grpc/src/core/tsi/alts/handshaker/alts_handshaker_client.cc
index 5cc8c62fc7c..53c93eea9ce 100644
--- a/deps/grpc/src/core/tsi/alts/handshaker/alts_handshaker_client.cc
+++ b/deps/grpc/src/core/tsi/alts/handshaker/alts_handshaker_client.cc
@@ -235,11 +235,10 @@ void alts_handshaker_client_handle_response(alts_handshaker_client* c,
     return;
   }
   if (recv_buffer == nullptr) {
-    VLOG(2)
-        << "recv_buffer is nullptr in alts_tsi_handshaker_handle_response()";
+    VLOG(2) << "failed to receive a response from the alts handshaker service";
     handle_response_done(
         client, TSI_INTERNAL_ERROR,
-        "recv_buffer is nullptr in alts_tsi_handshaker_handle_response()",
+        "failed to receive a response from the alts handshaker service",
         nullptr, 0, nullptr);
     return;
   }
diff --git a/deps/grpc/src/core/tsi/ssl/GEMINI.md b/deps/grpc/src/core/tsi/ssl/GEMINI.md
new file mode 100644
index 00000000000..cbc63fc6633
--- /dev/null
+++ b/deps/grpc/src/core/tsi/ssl/GEMINI.md
@@ -0,0 +1,18 @@
+# SSL TSI Implementation
+
+This directory contains an implementation of the Transport Security Interface (TSI) that uses OpenSSL.
+
+## Overarching Purpose
+
+This directory provides a concrete implementation of the TSI interfaces that can be used to secure gRPC connections with TLS.
+
+## Subdirectories
+
+- **`key_logging/`**: Contains code for logging SSL keys, which can be useful for debugging.
+- **`session_cache/`**: Contains a cache for SSL sessions, which can be used to speed up reconnections.
+
+## Notes
+
+- This is the default TSI implementation for gRPC.
+- It is well-tested and has been used in production for many years.
+- It is important to keep OpenSSL up-to-date to ensure that your gRPC applications are secure.
diff --git a/deps/grpc/src/core/tsi/ssl_transport_security.cc b/deps/grpc/src/core/tsi/ssl_transport_security.cc
index f7d44bf3af8..12cff2e9e06 100644
--- a/deps/grpc/src/core/tsi/ssl_transport_security.cc
+++ b/deps/grpc/src/core/tsi/ssl_transport_security.cc
@@ -71,6 +71,7 @@
 #include "src/core/tsi/transport_security_interface.h"
 #include "src/core/util/crash.h"
 #include "src/core/util/env.h"
+#include "src/core/util/match.h"
 #include "src/core/util/sync.h"
 #include "src/core/util/useful.h"
 
@@ -118,6 +119,7 @@ struct tsi_ssl_client_handshaker_factory {
   size_t alpn_protocol_list_length;
   grpc_core::RefCountedPtr<tsi::SslSessionLRUCache> session_cache;
   grpc_core::RefCountedPtr<TlsSessionKeyLogger> key_logger;
+  std::shared_ptr<RootCertInfo> root_cert_info;
 };
 
 struct tsi_ssl_server_handshaker_factory {
@@ -131,6 +133,7 @@ struct tsi_ssl_server_handshaker_factory {
   unsigned char* alpn_protocol_list;
   size_t alpn_protocol_list_length;
   grpc_core::RefCountedPtr<TlsSessionKeyLogger> key_logger;
+  std::shared_ptr<RootCertInfo> root_cert_info;
 };
 
 struct tsi_ssl_handshaker {
@@ -250,6 +253,7 @@ int ServerHandshakerFactoryAlpnCallback(SSL* /*ssl*/, const unsigned char** out,
 static gpr_once g_init_openssl_once = GPR_ONCE_INIT;
 static int g_ssl_ctx_ex_factory_index = -1;
 static int g_ssl_ctx_ex_crl_provider_index = -1;
+static int g_ssl_ctx_ex_spiffe_bundle_map_index = -1;
 static const unsigned char kSslSessionIdContext[] = {'g', 'r', 'p', 'c'};
 static int g_ssl_ex_verified_root_cert_index = -1;
 #if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_NO_ENGINE)
@@ -340,6 +344,10 @@ static void init_openssl(void) {
       SSL_CTX_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
   CHECK_NE(g_ssl_ctx_ex_crl_provider_index, -1);
 
+  g_ssl_ctx_ex_spiffe_bundle_map_index =
+      SSL_CTX_get_ex_new_index(0, nullptr, nullptr, nullptr, nullptr);
+  CHECK_NE(g_ssl_ctx_ex_spiffe_bundle_map_index, -1);
+
   g_ssl_ex_verified_root_cert_index = SSL_get_ex_new_index(
       0, nullptr, nullptr, nullptr, verified_root_cert_free);
   CHECK_NE(g_ssl_ex_verified_root_cert_index, -1);
@@ -1231,6 +1239,114 @@ static int CheckChainRevocation(
   return 1;
 }
 
+static grpc_core::SpiffeBundleMap* GetSpiffeBundleMap(X509_STORE_CTX* ctx) {
+  CHECK(ctx != nullptr);
+  ERR_clear_error();
+  int ssl_index = SSL_get_ex_data_X509_STORE_CTX_idx();
+  if (ssl_index < 0) {
+    char err_str[256];
+    ERR_error_string_n(ERR_get_error(), err_str, sizeof(err_str));
+    GRPC_TRACE_LOG(tsi, INFO)
+        << "error getting the SSL index from the X509_STORE_CTX while getting "
+           "the SPIFFE Bundle Map: "
+        << err_str;
+    return nullptr;
+  }
+  SSL* ssl = static_cast<SSL*>(X509_STORE_CTX_get_ex_data(ctx, ssl_index));
+  if (ssl == nullptr) {
+    GRPC_TRACE_LOG(tsi, INFO)
+        << "error while fetching SPIFFE Bundle Map. SSL object is null";
+    return nullptr;
+  }
+  SSL_CTX* ssl_ctx = SSL_get_SSL_CTX(ssl);
+  return static_cast<grpc_core::SpiffeBundleMap*>(
+      SSL_CTX_get_ex_data(ssl_ctx, g_ssl_ctx_ex_spiffe_bundle_map_index));
+}
+
+static absl::StatusOr<std::string> GetSpiffeUriFromCert(X509* cert) {
+  CHECK(cert != nullptr);
+  GENERAL_NAMES* subject_alt_names = static_cast<GENERAL_NAMES*>(
+      X509_get_ext_d2i(cert, NID_subject_alt_name, nullptr, nullptr));
+  int uri_count = 0;
+  absl::StatusOr<std::string> spiffe_uri = absl::InvalidArgumentError(
+      "spiffe: no SPIFFE ID found in leaf certificate.");
+  if (subject_alt_names != nullptr) {
+    size_t subject_alt_name_count = sk_GENERAL_NAME_num(subject_alt_names);
+    for (size_t i = 0; i < subject_alt_name_count; i++) {
+      GENERAL_NAME* subject_alt_name =
+          sk_GENERAL_NAME_value(subject_alt_names, TSI_SIZE_AS_SIZE(i));
+      if (subject_alt_name == nullptr) {
+        continue;
+      }
+      if (subject_alt_name->type == GEN_URI) {
+        uri_count++;
+        if (uri_count > 1) {
+          sk_GENERAL_NAME_pop_free(subject_alt_names, GENERAL_NAME_free);
+          return absl::InvalidArgumentError(
+              "spiffe: more than one SAN URI found while doing SPIFFE "
+              "validation. Must "
+              "have exactly one URI SAN that is the SPIFFE ID.");
+        }
+        spiffe_uri = grpc_core::ParseUriString(subject_alt_name);
+      }
+    }
+  }
+  sk_GENERAL_NAME_pop_free(subject_alt_names, GENERAL_NAME_free);
+  GRPC_RETURN_IF_ERROR(spiffe_uri.status());
+  if (spiffe_uri->empty()) {
+    return absl::InvalidArgumentError(
+        "spiffe: no URI SAN found in leaf certificate");
+  }
+  return spiffe_uri;
+}
+
+static absl::StatusOr<std::string> SpiffeTrustDomainFromCert(X509* cert) {
+  CHECK(cert != nullptr);
+  auto subject_name = GetSpiffeUriFromCert(cert);
+  GRPC_RETURN_IF_ERROR(subject_name.status());
+  auto spiffe_id = grpc_core::SpiffeId::FromString(*subject_name);
+  GRPC_RETURN_IF_ERROR(spiffe_id.status());
+  return std::string(spiffe_id->trust_domain());
+}
+
+// Fills ctx's trusted roots with the roots in the SPIFFE Bundle Map that
+// are associated with the to-be-verified leaf certificate's trust domain.
+// For more detail see
+// https://github.com/grpc/proposal/blob/master/A87-mtls-spiffe-support.md
+absl::Status ConfigureSpiffeRoots(
+    X509_STORE_CTX* ctx, grpc_core::SpiffeBundleMap* spiffe_bundle_map) {
+  CHECK(ctx != nullptr);
+  if (spiffe_bundle_map == nullptr) {
+    return absl::InvalidArgumentError(
+        "cannot configure spiffe roots with a nullptr spiffe_bundle_map.");
+  }
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L
+  X509* leaf_cert = X509_STORE_CTX_get0_cert(ctx);
+#else
+  X509* leaf_cert = ctx->cert;
+#endif
+  if (leaf_cert == nullptr) {
+    return absl::InvalidArgumentError(
+        "A SPIFFE bundle map was configured but the leaf cert is null");
+  }
+  absl::StatusOr<std::string> trust_domain =
+      SpiffeTrustDomainFromCert(leaf_cert);
+  GRPC_RETURN_IF_ERROR(trust_domain.status());
+  auto root_stack = spiffe_bundle_map->GetRootStack(*trust_domain);
+  GRPC_RETURN_IF_ERROR(root_stack.status());
+  if (*root_stack == nullptr) {
+    return absl::InvalidArgumentError(
+        "spiffe: root stack in the SPIFFE Bundle Map is nullptr.");
+  }
+// the boringSSL library objective-C used did not have this function defined
+#if OPENSSL_VERSION_NUMBER >= 0x10100000L && !defined(OPENSSL_APPLE)
+  X509_STORE_CTX_set0_trusted_stack(ctx, *root_stack);
+#else
+  X509_STORE_CTX_trusted_stack(ctx, *root_stack);
+#endif
+  return absl::OkStatus();
+}
+
 // The custom verification function to set in OpenSSL using
 // X509_set_cert_verify_callback. This calls the standard OpenSSL procedure
 // (X509_verify_cert), then also extracts the root certificate in the built
@@ -1238,12 +1354,24 @@ static int CheckChainRevocation(
 // returns 1 on success, indicating a trusted chain to a root of trust was
 // found, 0 if a trusted chain could not be built.
 static int CustomVerificationFunction(X509_STORE_CTX* ctx, void* arg) {
+  CHECK(ctx != nullptr);
+  grpc_core::SpiffeBundleMap* spiffe_bundle_map = GetSpiffeBundleMap(ctx);
+  if (spiffe_bundle_map != nullptr) {
+    // If a SPIFFE Bundle Map is configured, we'll use
+    // X509_STORE_CTX_set0_trusted_stack to then configure these as the roots
+    // for verification.
+    absl::Status status = ConfigureSpiffeRoots(ctx, spiffe_bundle_map);
+    if (!status.ok()) {
+      VLOG(2) << "Failed to configure SPIFFE roots: " << status;
+      return -1;
+    }
+  }
   int ret = X509_verify_cert(ctx);
   if (ret <= 0) {
     VLOG(2) << "Failed to verify cert chain.";
     // Verification failed. We shouldn't expect to have a verified chain, so
-    // there is no need to attempt to extract the root cert from it, check for
-    // revocation, or check anything else.
+    // there is no need to attempt to extract the root cert from it, check
+    // for revocation, or check anything else.
     return ret;
   }
   grpc_core::experimental::CrlProvider* provider = GetCrlProvider(ctx);
@@ -1257,9 +1385,9 @@ static int CustomVerificationFunction(X509_STORE_CTX* ctx, void* arg) {
   return RootCertExtractCallback(ctx, arg);
 }
 
-// Sets the min and max TLS version of |ssl_context| to |min_tls_version| and
-// |max_tls_version|, respectively. Calling this method is a no-op when using
-// OpenSSL versions < 1.1.
+// Sets the min and max TLS version of |ssl_context| to |min_tls_version|
+// and |max_tls_version|, respectively. Calling this method is a no-op when
+// using OpenSSL versions < 1.1.
 static tsi_result tsi_set_min_and_max_tls_versions(
     SSL_CTX* ssl_context, tsi_tls_version min_tls_version,
     tsi_tls_version max_tls_version) {
@@ -2155,9 +2283,7 @@ static void tsi_ssl_client_handshaker_factory_destroy(
       reinterpret_cast<tsi_ssl_client_handshaker_factory*>(factory);
   if (self->ssl_context != nullptr) SSL_CTX_free(self->ssl_context);
   if (self->alpn_protocol_list != nullptr) gpr_free(self->alpn_protocol_list);
-  self->session_cache.reset();
-  self->key_logger.reset();
-  gpr_free(self);
+  delete self;
 }
 
 static int client_handshaker_factory_npn_callback(
@@ -2206,8 +2332,7 @@ static void tsi_ssl_server_handshaker_factory_destroy(
     gpr_free(self->ssl_context_x509_subject_names);
   }
   if (self->alpn_protocol_list != nullptr) gpr_free(self->alpn_protocol_list);
-  self->key_logger.reset();
-  gpr_free(self);
+  delete self;
 }
 
 static int does_entry_match_name(absl::string_view entry,
@@ -2330,7 +2455,9 @@ tsi_result tsi_create_ssl_client_handshaker_factory(
     tsi_ssl_client_handshaker_factory** factory) {
   tsi_ssl_client_handshaker_options options;
   options.pem_key_cert_pair = pem_key_cert_pair;
-  options.pem_root_certs = pem_root_certs;
+  if (pem_root_certs != nullptr) {
+    options.root_cert_info = std::make_shared<RootCertInfo>(pem_root_certs);
+  }
   options.cipher_suites = cipher_suites;
   options.alpn_protocols = alpn_protocols;
   options.num_alpn_protocols = num_alpn_protocols;
@@ -2349,7 +2476,7 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
 
   if (factory == nullptr) return TSI_INVALID_ARGUMENT;
   *factory = nullptr;
-  if (options->pem_root_certs == nullptr && options->root_store == nullptr &&
+  if (options->root_store == nullptr && options->root_cert_info == nullptr &&
       !options->skip_server_certificate_verification) {
     return TSI_INVALID_ARGUMENT;
   }
@@ -2372,8 +2499,7 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
       ssl_context, options->min_tls_version, options->max_tls_version);
   if (result != TSI_OK) return result;
 
-  impl = static_cast<tsi_ssl_client_handshaker_factory*>(
-      gpr_zalloc(sizeof(*impl)));
+  impl = new tsi_ssl_client_handshaker_factory();
   tsi_ssl_handshaker_factory_init(&impl->base);
   impl->base.vtable = &client_handshaker_factory_vtable;
   impl->ssl_context = ssl_context;
@@ -2386,6 +2512,9 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
                             server_handshaker_factory_new_session_callback);
     SSL_CTX_set_session_cache_mode(ssl_context, SSL_SESS_CACHE_CLIENT);
   }
+  if (options->root_cert_info != nullptr) {
+    impl->root_cert_info = options->root_cert_info;
+  }
 
 #if OPENSSL_VERSION_NUMBER >= 0x10101000 && !defined(LIBRESSL_VERSION_NUMBER)
   if (options->key_logger != nullptr) {
@@ -2417,10 +2546,23 @@ tsi_result tsi_create_ssl_client_handshaker_factory_with_options(
 #endif
     if (OPENSSL_VERSION_NUMBER < 0x10100000 ||
         (options->root_store == nullptr &&
-         options->pem_root_certs != nullptr)) {
-      result = ssl_ctx_load_verification_certs(
-          ssl_context, options->pem_root_certs, strlen(options->pem_root_certs),
-          nullptr);
+         options->root_cert_info != nullptr)) {
+      Match(
+          *options->root_cert_info,
+          [&](const std::string& pem_root_certs) {
+            result = ssl_ctx_load_verification_certs(
+                ssl_context, pem_root_certs.c_str(), pem_root_certs.size(),
+                nullptr);
+          },
+          [&](const grpc_core::SpiffeBundleMap& spiffe_bundle_map) {
+            X509_STORE* cert_store = SSL_CTX_get_cert_store(ssl_context);
+            X509_STORE_set_flags(cert_store, X509_V_FLAG_PARTIAL_CHAIN |
+                                                 X509_V_FLAG_TRUSTED_FIRST);
+            const void* p = &spiffe_bundle_map;
+            void* map = const_cast<void*>(p);
+            SSL_CTX_set_ex_data(ssl_context,
+                                g_ssl_ctx_ex_spiffe_bundle_map_index, map);
+          });
       X509_STORE* cert_store = SSL_CTX_get_cert_store(ssl_context);
 #if OPENSSL_VERSION_NUMBER >= 0x10100000
       X509_VERIFY_PARAM* param = X509_STORE_get0_param(cert_store);
@@ -2518,7 +2660,10 @@ tsi_result tsi_create_ssl_server_handshaker_factory_ex(
   tsi_ssl_server_handshaker_options options;
   options.pem_key_cert_pairs = pem_key_cert_pairs;
   options.num_key_cert_pairs = num_key_cert_pairs;
-  options.pem_client_root_certs = pem_client_root_certs;
+  if (pem_client_root_certs != nullptr) {
+    options.root_cert_info =
+        std::make_shared<RootCertInfo>(pem_client_root_certs);
+  }
   options.client_certificate_request = client_certificate_request;
   options.cipher_suites = cipher_suites;
   options.alpn_protocols = alpn_protocols;
@@ -2543,8 +2688,7 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
     return TSI_INVALID_ARGUMENT;
   }
 
-  impl = static_cast<tsi_ssl_server_handshaker_factory*>(
-      gpr_zalloc(sizeof(*impl)));
+  impl = new tsi_ssl_server_handshaker_factory();
   tsi_ssl_handshaker_factory_init(&impl->base);
   impl->base.vtable = &server_handshaker_factory_vtable;
 
@@ -2558,6 +2702,9 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
     return TSI_OUT_OF_RESOURCES;
   }
   impl->ssl_context_count = options->num_key_cert_pairs;
+  if (options->root_cert_info != nullptr) {
+    impl->root_cert_info = options->root_cert_info;
+  }
 
   if (options->num_alpn_protocols > 0) {
     result = BuildAlpnProtocolNameList(
@@ -2622,20 +2769,34 @@ tsi_result tsi_create_ssl_server_handshaker_factory_with_options(
           break;
         }
       }
-
-      if (options->pem_client_root_certs != nullptr) {
-        STACK_OF(X509_NAME)* root_names = nullptr;
-        result = ssl_ctx_load_verification_certs(
-            impl->ssl_contexts[i], options->pem_client_root_certs,
-            strlen(options->pem_client_root_certs),
-            options->send_client_ca_list ? &root_names : nullptr);
+      if (options->root_cert_info != nullptr) {
+        Match(
+            *options->root_cert_info,
+            [&](const std::string& pem_root_certs) {
+              STACK_OF(X509_NAME)* root_names = nullptr;
+              result = ssl_ctx_load_verification_certs(
+                  impl->ssl_contexts[i], pem_root_certs.c_str(),
+                  pem_root_certs.size(), nullptr);
+              if (result != TSI_OK) {
+                LOG(ERROR) << "Invalid verification certs.";
+              }
+              if (options->send_client_ca_list) {
+                SSL_CTX_set_client_CA_list(impl->ssl_contexts[i], root_names);
+              }
+            },
+            [&](const grpc_core::SpiffeBundleMap& spiffe_bundle_map) {
+              X509_STORE* cert_store =
+                  SSL_CTX_get_cert_store(impl->ssl_contexts[i]);
+              X509_STORE_set_flags(cert_store, X509_V_FLAG_PARTIAL_CHAIN |
+                                                   X509_V_FLAG_TRUSTED_FIRST);
+              const void* p = &spiffe_bundle_map;
+              void* map = const_cast<void*>(p);
+              SSL_CTX_set_ex_data(impl->ssl_contexts[i],
+                                  g_ssl_ctx_ex_spiffe_bundle_map_index, map);
+            });
         if (result != TSI_OK) {
-          LOG(ERROR) << "Invalid verification certs.";
           break;
         }
-        if (options->send_client_ca_list) {
-          SSL_CTX_set_client_CA_list(impl->ssl_contexts[i], root_names);
-        }
       }
       switch (options->client_certificate_request) {
         case TSI_DONT_REQUEST_CLIENT_CERTIFICATE:
@@ -2770,6 +2931,16 @@ int tsi_ssl_peer_matches_name(const tsi_peer* peer, absl::string_view name) {
   return 0;  // Not found.
 }
 
+bool IsRootCertInfoEmpty(const RootCertInfo* root_cert_info) {
+  if (root_cert_info == nullptr) return true;
+  return Match(
+      *root_cert_info,
+      [&](const std::string& pem_root_certs) { return pem_root_certs.empty(); },
+      [&](const grpc_core::SpiffeBundleMap& spiffe_bundle_map) {
+        return spiffe_bundle_map.size() == 0;
+      });
+}
+
 // --- Testing support. ---
 const tsi_ssl_handshaker_factory_vtable* tsi_ssl_handshaker_factory_swap_vtable(
     tsi_ssl_handshaker_factory* factory,
diff --git a/deps/grpc/src/core/tsi/ssl_transport_security.h b/deps/grpc/src/core/tsi/ssl_transport_security.h
index 437192e9010..820d562d05e 100644
--- a/deps/grpc/src/core/tsi/ssl_transport_security.h
+++ b/deps/grpc/src/core/tsi/ssl_transport_security.h
@@ -27,6 +27,7 @@
 #include <memory>
 
 #include "absl/strings/string_view.h"
+#include "src/core/credentials/transport/tls/spiffe_utils.h"
 #include "src/core/tsi/ssl/key_logging/ssl_key_logging.h"
 #include "src/core/tsi/ssl_transport_security_utils.h"
 #include "src/core/tsi/transport_security_interface.h"
@@ -50,6 +51,8 @@
 #define TSI_X509_VERIFIED_ROOT_CERT_SUBECT_PEER_PROPERTY \
   "x509_verified_root_cert_subject"
 
+using RootCertInfo = std::variant<std::string, grpc_core::SpiffeBundleMap>;
+
 // --- tsi_ssl_root_certs_store object ---
 
 // This object stores SSL root certificates. It can be shared by multiple SSL
@@ -142,9 +145,6 @@ struct tsi_ssl_client_handshaker_options {
   // key and certificate chain. This parameter can be NULL if the client does
   // not have such a key/cert pair.
   const tsi_ssl_pem_key_cert_pair* pem_key_cert_pair;
-  // pem_roots_cert is the NULL-terminated string containing the PEM encoding of
-  // the client root certificates.
-  const char* pem_root_certs;
   // root_store is a pointer to the ssl_root_certs_store object. If root_store
   // is not nullptr and SSL implementation permits, root_store will be used as
   // root certificates. Otherwise, pem_roots_cert will be used to load server
@@ -190,9 +190,14 @@ struct tsi_ssl_client_handshaker_options {
   // options as a shared_ptr.
   std::shared_ptr<grpc_core::experimental::CrlProvider> crl_provider;
 
+  // root_cert_info is either the string containing the PEM encoding of the
+  // client root certificates or a SPIFFE bundle map.
+  std::shared_ptr<RootCertInfo> root_cert_info;
+
+  // TODO(gtcooke94) this ctor is not needed
+  // https://github.com/grpc/grpc/pull/39708/files#r2143735662
   tsi_ssl_client_handshaker_options()
       : pem_key_cert_pair(nullptr),
-        pem_root_certs(nullptr),
         root_store(nullptr),
         cipher_suites(nullptr),
         alpn_protocols(nullptr),
@@ -303,13 +308,9 @@ struct tsi_ssl_server_handshaker_options {
   // num_key_cert_pairs is the number of items in the pem_key_cert_pairs
   // array.
   size_t num_key_cert_pairs;
-  // pem_root_certs is the NULL-terminated string containing the PEM encoding
-  // of the server root certificates. This parameter may be NULL if the server
-  // does not want the client to be authenticated with SSL.
-  const char* pem_client_root_certs;
   // client_certificate_request, if set to non-zero will force the client to
   // authenticate with an SSL cert. Note that this option is ignored if
-  // pem_client_root_certs is NULL or pem_client_roots_certs_size is 0.
+  // root_cert_info is NULL
   tsi_client_certificate_request_type client_certificate_request;
   // cipher_suites contains an optional list of the ciphers that the server
   // supports. The format of this string is described in:
@@ -360,10 +361,16 @@ struct tsi_ssl_server_handshaker_options {
   // will be unusable.
   bool send_client_ca_list;
 
+  // root_cert_info is either the string containing the PEM encoding of the
+  // server root certificates or a SPIFFE bundle map. This parameter may be NULL
+  // if the server does not want the client to be authenticated with SSL.
+  std::shared_ptr<RootCertInfo> root_cert_info;
+
+  // TODO(gtcooke94) this ctor is not needed
+  // https://github.com/grpc/grpc/pull/39708/files#r2143735662
   tsi_ssl_server_handshaker_options()
       : pem_key_cert_pairs(nullptr),
         num_key_cert_pairs(0),
-        pem_client_root_certs(nullptr),
         client_certificate_request(TSI_DONT_REQUEST_CLIENT_CERTIFICATE),
         cipher_suites(nullptr),
         alpn_protocols(nullptr),
@@ -441,4 +448,6 @@ tsi_result tsi_ssl_extract_x509_subject_names_from_pem_cert(
 tsi_result tsi_ssl_get_cert_chain_contents(STACK_OF(X509) * peer_chain,
                                            tsi_peer_property* property);
 
+bool IsRootCertInfoEmpty(const RootCertInfo* root_cert_info);
+
 #endif  // GRPC_SRC_CORE_TSI_SSL_TRANSPORT_SECURITY_H
diff --git a/deps/grpc/src/core/tsi/ssl_transport_security_utils.cc b/deps/grpc/src/core/tsi/ssl_transport_security_utils.cc
index 5c3b828751e..65301cfe047 100644
--- a/deps/grpc/src/core/tsi/ssl_transport_security_utils.cc
+++ b/deps/grpc/src/core/tsi/ssl_transport_security_utils.cc
@@ -428,4 +428,25 @@ absl::StatusOr<EVP_PKEY*> ParsePemPrivateKey(
   return pkey;
 }
 
+absl::StatusOr<std::string> ParseUriString(GENERAL_NAME* subject_alt_name) {
+  if (subject_alt_name == nullptr || subject_alt_name->type != GEN_URI) {
+    return absl::InvalidArgumentError("Could not parse ASN1 string to UTF8");
+  }
+  // This shouldn't be a possible if statement to enter because if the type is
+  // GEN_URI it then by definition should have a d.uniformResourceIdentifier.
+  // But we can still keep it for safety.
+  if (subject_alt_name->d.uniformResourceIdentifier == nullptr) {
+    return absl::InvalidArgumentError("Could not parse ASN1 string to UTF8");
+  }
+  unsigned char* name = nullptr;
+  int name_size =
+      ASN1_STRING_to_UTF8(&name, subject_alt_name->d.uniformResourceIdentifier);
+  if (name_size < 0 || name == nullptr) {
+    OPENSSL_free(name);
+    return absl::InvalidArgumentError("Could not parse ASN1 string to UTF8");
+  }
+  std::string ret(reinterpret_cast<char const*>(name), name_size);
+  OPENSSL_free(name);
+  return ret;
+}
 }  // namespace grpc_core
diff --git a/deps/grpc/src/core/tsi/ssl_transport_security_utils.h b/deps/grpc/src/core/tsi/ssl_transport_security_utils.h
index 038b40dcaba..d71847accc7 100644
--- a/deps/grpc/src/core/tsi/ssl_transport_security_utils.h
+++ b/deps/grpc/src/core/tsi/ssl_transport_security_utils.h
@@ -23,6 +23,7 @@
 #include <grpc/support/port_platform.h>
 #include <openssl/evp.h>
 #include <openssl/x509.h>
+#include <openssl/x509v3.h>
 
 #include "absl/status/status.h"
 #include "absl/status/statusor.h"
@@ -177,6 +178,9 @@ absl::StatusOr<std::vector<X509*>> ParsePemCertificateChain(
 // Returns an EVP_PKEY instance parsed from the non-empty PEM private key block
 // in private_key_pem. Caller takes ownership of the EVP_PKEY pointer.
 absl::StatusOr<EVP_PKEY*> ParsePemPrivateKey(absl::string_view private_key_pem);
+
+// Safely parses a URI from OpenSSL's GENERAL_NAME to a string representation.
+absl::StatusOr<std::string> ParseUriString(GENERAL_NAME* subject_alt_name);
 }  // namespace grpc_core
 
 #endif  // GRPC_SRC_CORE_TSI_SSL_TRANSPORT_SECURITY_UTILS_H
diff --git a/deps/grpc/src/core/util/GEMINI.md b/deps/grpc/src/core/util/GEMINI.md
new file mode 100644
index 00000000000..40297295325
--- /dev/null
+++ b/deps/grpc/src/core/util/GEMINI.md
@@ -0,0 +1,35 @@
+# gRPC Utilities
+
+This directory contains a collection of utility classes and functions that are used throughout the gRPC core.
+
+## Overarching Purpose
+
+This directory provides a set of common utilities that are not specific to any particular part of gRPC. This includes things like string manipulation, data structures, and platform-specific code.
+
+## Files and Subdirectories
+
+- **`alloc.h` / `alloc.cc`**: Memory allocation utilities.
+- **`atomic_utils.h`**: Utilities for working with atomic operations.
+- **`backoff.h` / `backoff.cc`**: Implements exponential backoff.
+- **`crash.h` / `crash.cc`**: Utilities for crashing the process.
+- **`env.h`**: Functions for getting and setting environment variables.
+- **`fork.h` / `fork.cc`**: Functions for handling `fork()`.
+- **`host_port.h` / `host_port.cc`**: Utilities for joining and splitting host and port strings.
+- **`json/`**: A JSON parser and writer.
+- **`log.cc`**: The implementation of gpr_log.
+- **`orphanable.h`**: The `Orphanable` class, which is a base class for objects that can be orphaned.
+- **`ref_counted.h`**: The `RefCounted` class, which is a base class for reference-counted objects.
+- **`ref_counted_ptr.h`**: A smart pointer for `RefCounted` objects.
+- **`status_helper.h` / `status_helper.cc`**: Utilities for creating `grpc_status_code` and `grpc_slice` instances.
+- **`string.h` / `string.cc`**: String manipulation functions.
+- **`sync.h` / `sync.cc`**: Synchronization primitives.
+- **`time.h` / `time.cc`**: Time-related functions.
+- **`uri.h` / `uri.cc`**: A URI parser.
+- **`work_serializer.h` / `work_serializer.cc`**: A class that serializes callbacks so that only one runs at a time, in order.
+
+## Notes
+
+- This directory contains a lot of code, much of which is highly specialized.
+- When looking for a particular utility, it is often helpful to search for the relevant keywords in this directory.
+- The code in this directory is generally well-documented, so it is often possible to understand what a particular utility does by reading the comments in the header file.
+- [README.md](README.md) in this directory also has useful information.
\ No newline at end of file
diff --git a/deps/grpc/src/core/util/http_client/httpcli_security_connector.cc b/deps/grpc/src/core/util/http_client/httpcli_security_connector.cc
index 66f09cc5697..cc8ec14dbba 100644
--- a/deps/grpc/src/core/util/http_client/httpcli_security_connector.cc
+++ b/deps/grpc/src/core/util/http_client/httpcli_security_connector.cc
@@ -77,7 +77,9 @@ class grpc_httpcli_ssl_channel_security_connector final
   tsi_result InitHandshakerFactory(const char* pem_root_certs,
                                    const tsi_ssl_root_certs_store* root_store) {
     tsi_ssl_client_handshaker_options options;
-    options.pem_root_certs = pem_root_certs;
+    if (pem_root_certs != nullptr) {
+      options.root_cert_info = std::make_shared<RootCertInfo>(pem_root_certs);
+    }
     options.root_store = root_store;
     return tsi_create_ssl_client_handshaker_factory_with_options(
         &options, &handshaker_factory_);
diff --git a/deps/grpc/src/core/util/json/GEMINI.md b/deps/grpc/src/core/util/json/GEMINI.md
new file mode 100644
index 00000000000..3e27bc59cdc
--- /dev/null
+++ b/deps/grpc/src/core/util/json/GEMINI.md
@@ -0,0 +1,21 @@
+# JSON Utilities
+
+This directory contains a JSON parser and writer.
+
+## Overarching Purpose
+
+This directory provides a set of tools for working with JSON data. It is used throughout the gRPC core to parse and generate JSON for things like service configs and load balancing policies.
+
+## Files
+
+- **`json.h`**: The main header file for the JSON library.
+- **`json_reader.h` / `json_reader.cc`**: A JSON parser.
+- **`json_writer.h` / `json_writer.cc`**: A JSON writer.
+- **`json_object_loader.h` / `json_object_loader.cc`**: A helper for loading C++ objects from a JSON representation.
+- **`json_util.h` / `json_util.cc`**: Miscellaneous JSON utilities.
+
+## Notes
+
+- This is a C++-native JSON library, with no external dependencies.
+- It is designed to be efficient and to avoid unnecessary memory allocations.
+- The `JsonObjectLoader` is a particularly useful tool for converting JSON data into C++ objects in a safe and structured way.
diff --git a/deps/grpc/src/core/util/latent_see.cc b/deps/grpc/src/core/util/latent_see.cc
index c1bd75e4296..2710827c286 100644
--- a/deps/grpc/src/core/util/latent_see.cc
+++ b/deps/grpc/src/core/util/latent_see.cc
@@ -14,174 +14,206 @@
 
 #include "src/core/util/latent_see.h"
 
-#ifdef GRPC_ENABLE_LATENT_SEE
 #include <atomic>
-#include <chrono>
 #include <cstdint>
-#include <optional>
+#include <memory>
 #include <string>
 #include <vector>
 
+#include "absl/log/log.h"
 #include "absl/strings/str_cat.h"
-#include "absl/strings/str_format.h"
-#include "absl/strings/string_view.h"
-#include "src/core/util/ring_buffer.h"
+#include "src/core/util/backoff.h"
+#include "src/core/util/notification.h"
 #include "src/core/util/sync.h"
 
+namespace grpc_core::latent_see {
+
+thread_local std::unique_ptr<Bin> Appender::bin_;
+std::atomic<Sink*> Appender::active_sink_;
+
+std::string JsonOutput::MicrosString(int64_t nanos) {
+  CHECK_GE(nanos, 0);
+  const auto micros = nanos / 1000;
+  const auto remainder = nanos % 1000;
+  return absl::StrFormat("%d.%03d", micros, remainder);
+}
+
+void JsonOutput::Mark(absl::string_view name, int64_t tid, int64_t timestamp) {
+  out_ << absl::StrCat(sep_, "{\"name\":\"", name,
+                       "\",\"ph\":\"i\",\"ts\":", MicrosString(timestamp),
+                       ",\"pid\":0,\"tid\":", tid, "}");
+  sep_ = ",\n";
+}
+
+void JsonOutput::FlowBegin(absl::string_view name, int64_t tid,
+                           int64_t timestamp, int64_t flow_id) {
+  out_ << absl::StrCat(sep_, "{\"name\":\"", name,
+                       "\",\"ph\":\"s\",\"ts\":", MicrosString(timestamp),
+                       ",\"pid\":0,\"tid\":", tid, ",\"id\":", flow_id, "}");
+  sep_ = ",\n";
+}
+
+void JsonOutput::FlowEnd(absl::string_view name, int64_t tid, int64_t timestamp,
+                         int64_t flow_id) {
+  out_ << absl::StrCat(sep_, "{\"name\":\"", name,
+                       "\",\"ph\":\"f\",\"ts\":", MicrosString(timestamp),
+                       ",\"pid\":0,\"tid\":", tid, ",\"id\":", flow_id, "}");
+  sep_ = ",\n";
+}
+
+void JsonOutput::Span(absl::string_view name, int64_t tid,
+                      int64_t timestamp_begin, int64_t duration) {
+  out_ << absl::StrCat(sep_, "{\"name\":\"", name,
+                       "\",\"ph\":\"X\",\"ts\":", MicrosString(timestamp_begin),
+                       ",\"pid\":0,\"tid\":", tid,
+                       ",\"dur\":", MicrosString(duration), "}");
+  sep_ = ",\n";
+}
+
+void JsonOutput::Finish() { out_ << "\n]"; }
+}  // namespace grpc_core::latent_see
+
+#ifndef GRPC_DISABLE_LATENT_SEE
+
 namespace grpc_core {
 namespace latent_see {
 
-thread_local uint64_t Log::thread_id_ = Log::Get().next_thread_id_.fetch_add(1);
-thread_local Bin* Log::bin_ = nullptr;
-thread_local void* Log::bin_owner_ = nullptr;
-std::atomic<uint64_t> Flow::next_flow_id_{1};
-std::atomic<uintptr_t> Log::free_bins_{0};
-const std::chrono::steady_clock::time_point start_time =
-    std::chrono::steady_clock::now();
-
-void Log::InstallAtExitHandler() {
-  atexit([] {
-    auto& log = Log::Get();
-    auto json = log.TryGenerateJson();
-    if (!json.has_value()) {
-      LOG(INFO) << "Failed to generate latent_see.json (contention with "
-                   "another writer)";
-      return;
-    }
-    if (log.stats_flusher_ != nullptr) {
-      log.stats_flusher_(*json);
-      return;
-    }
-    LOG(INFO) << "Writing latent_see.json in " << get_current_dir_name();
-    FILE* f = fopen("latent_see.json", "w");
-    if (f == nullptr) return;
-    fprintf(f, "%s", json->c_str());
-    fclose(f);
-  });
+namespace {
+const Duration kMaxBackoff = Duration::Milliseconds(300);
+}
+
+void Appender::Enable(Sink* sink) {
+  active_sink_.store(sink, std::memory_order_release);
 }
 
-void Log::TryPullEventsAndFlush(
-    absl::FunctionRef<void(absl::Span<const RecordedEvent>)> callback) {
-  // Try to lock... if we fail then clear the active events.
-  // This guarantees freeing up memory even if we're still serializing the
-  // previous pull.
-  if (!mu_flushing_.TryLock()) {
-    for (auto& fragment : fragments_) {
-      MutexLock lock(&fragment.mu_active);
-      fragment.active.clear();
+void Appender::Disable() {
+  active_sink_.store(nullptr, std::memory_order_relaxed);
+}
+
+Sink::Sink() : gatherer_("grpc_latent_see_gatherer", [this]() { Gather(); }) {
+  gatherer_.Start();
+}
+
+void Sink::Append(std::unique_ptr<Bin> bin) { appending_.Push(bin.release()); }
+
+void Sink::Gather() {
+  BackOff backoff(BackOff::Options()
+                      .set_initial_backoff(Duration::Milliseconds(1))
+                      .set_multiplier(1.1)
+                      .set_jitter(0.05)
+                      .set_max_backoff(kMaxBackoff));
+  while (true) {
+    std::unique_ptr<Bin> bin(static_cast<Bin*>(appending_.Pop()));
+    if (bin == nullptr) {
+      absl::SleepFor(absl::Milliseconds(backoff.NextAttemptDelay().millis()));
+      continue;
     }
-    return;
-  }
-  // Now we hold the lock; swap all active fragments to flushing.
-  // This is relatively quick and ensures that we don't stall capture for
-  // long.
-  for (auto& fragment : fragments_) {
-    CHECK_EQ(fragment.flushing.size(), 0);
-    MutexLock lock(&fragment.mu_active);
-    fragment.flushing.swap(fragment.active);
+    backoff.Reset();
+    Record(std::move(bin));
   }
-  // Now we've swapped out, call the callback repeatedly with each fragment.
-  // This is the slow part - there's a lot of copying and transformation that
-  // happens here.
-  // We keep the mu_flushing_ held so that we can guarantee only one thread is
-  // consumed by this at a time.
-  // Once we've called the callback for each fragment we can clear it, so that
-  // when we next swap it with the active fragment it will be empty.
-  // This also retains the memory, so if we're serializing with a regular
-  // cadence we'll tend to stabilize memory usage for latent_see relatively
-  // quickly.
-  for (auto& fragment : fragments_) {
-    callback(fragment.flushing);
-    fragment.flushing.clear();
-  }
-  mu_flushing_.Unlock();
 }
 
-std::optional<std::string> Log::TryGenerateJson() {
-  using Nanos = std::chrono::duration<unsigned long long, std::nano>;
-  std::string json = "[\n";
-  bool first = true;
-  int callbacks = 0;
-  TryPullEventsAndFlush([&](absl::Span<const RecordedEvent> events) {
-    ++callbacks;
-    for (const auto& event : events) {
-      absl::string_view phase;
-      bool has_id;
-      switch (event.event.type) {
-        case EventType::kBegin:
-          phase = "B";
-          has_id = false;
-          break;
-        case EventType::kEnd:
-          phase = "E";
-          has_id = false;
-          break;
-        case EventType::kFlowStart:
-          phase = "s";
-          has_id = true;
-          break;
-        case EventType::kFlowEnd:
-          phase = "f";
-          has_id = true;
-          break;
-        case EventType::kMark:
-          phase = "i";
-          has_id = false;
-          break;
-      }
-      if (!first) {
-        absl::StrAppend(&json, ",\n");
-      }
-      first = false;
-      if (event.event.metadata->name[0] != '"') {
-        absl::StrAppend(
-            &json, "{\"name\": \"", event.event.metadata->name,
-            "\", \"ph\": \"", phase, "\", \"ts\": ",
-            absl::StrFormat(
-                "%.12g",
-                Nanos(event.event.timestamp - start_time).count() / 1000.0),
-            ", \"pid\": 0, \"tid\": ", event.thread_id);
-      } else {
-        absl::StrAppend(
-            &json, "{\"name\": ", event.event.metadata->name, ", \"ph\": \"",
-            phase, "\", \"ts\": ",
-            absl::StrFormat(
-                "%.12g",
-                Nanos(event.event.timestamp - start_time).count() / 1000.0),
-            ", \"pid\": 0, \"tid\": ", event.thread_id);
-      }
+void Sink::Start(size_t max_bins) {
+  auto events = std::make_unique<EventDump>();
+  MutexLock lock(&mu_);
+  max_bins_ = max_bins;
+  events_ = std::move(events);
+}
 
-      if (has_id) {
-        absl::StrAppend(&json, ", \"id\": ", event.event.id);
-      }
-      if (event.event.type == EventType::kFlowEnd) {
-        absl::StrAppend(&json, ", \"bp\": \"e\"");
-      }
-      absl::StrAppend(&json, ", \"args\": {\"file\": \"",
-                      event.event.metadata->file,
-                      "\", \"line\": ", event.event.metadata->line,
-                      ", \"batch\": ", event.batch_id, "}}");
-    }
-  });
-  if (callbacks == 0) return std::nullopt;
-  absl::StrAppend(&json, "\n]");
-  return json;
+std::unique_ptr<Sink::EventDump> Sink::Stop() {
+  MutexLock lock(&mu_);
+  auto events = std::move(events_);
+  events_ = nullptr;
+  return events;
+}
+
+void Sink::Record(std::unique_ptr<Bin> bin) {
+  MutexLock lock(&mu_);
+  if (events_ == nullptr) return;
+  CHECK_LE(bin->num_events, Bin::kEventsPerBin);
+  events_->emplace_back(std::move(bin));
+  if (events_->size() > max_bins_) events_->pop_front();
 }
 
-void Log::FlushBin(Bin* bin) {
-  if (bin->events.empty()) return;
-  auto& log = Get();
-  const auto batch_id =
-      log.next_batch_id_.fetch_add(1, std::memory_order_relaxed);
-  auto& fragment = log.fragments_.this_cpu();
-  const auto thread_id = thread_id_;
-  {
-    MutexLock lock(&fragment.mu_active);
-    for (auto event : bin->events) {
-      fragment.active.push_back(RecordedEvent{thread_id, batch_id, event});
+void Collect(Notification* n, absl::Duration timeout, size_t memory_limit,
+             Output* output) {
+  static Sink* sink = new Sink;
+  static Mutex* mu = new Mutex;
+
+  // Collection phase - under a mutex to prevent multiple collections at once.
+  mu->Lock();
+  // First we enable the appender and then wait for a short time to clear out
+  // any backoff
+  LOG(INFO) << "Latent-see collection enabling";
+  Appender::Enable(sink);
+  absl::SleepFor(2 * absl::Milliseconds(kMaxBackoff.millis()));
+  // Now we start the collection
+  LOG(INFO) << "Latent-see collection recording";
+  sink->Start(memory_limit / sizeof(Bin) + 1);
+  // If we got a Notification object, use that to sleep until we're notified;
+  // if not just sleep.
+  if (n == nullptr) {
+    absl::SleepFor(timeout);
+  } else {
+    n->WaitForNotificationWithTimeout(timeout);
+  }
+  // Grab all events
+  LOG(INFO) << "Latent-see collection stopping";
+  auto events = sink->Stop();
+  // Disable the sink
+  Appender::Disable();
+  mu->Unlock();
+  CHECK(events != nullptr);
+  LOG(INFO) << "Latent-see collection stopped: processing " << events->size()
+            << " bins";
+
+  // Next: find the earliest timestamp
+  // We save a lot of bytes by subtracting that out
+  int64_t earliest_timestamp = std::numeric_limits<int64_t>::max();
+  for (const auto& bin : *events) {
+    for (const auto& event : *bin) {
+      // Exclude negative timestamps as they're used for event type markers
+      if (event.timestamp_begin > 0) {
+        earliest_timestamp = std::min(
+            {earliest_timestamp, event.timestamp_begin, event.timestamp_end});
+      } else {
+        earliest_timestamp = std::min(earliest_timestamp, -event.timestamp_end);
+      }
+    }
+  }
+  std::string json = "[\n";
+  // TODO(ctiller): Fuschia Trace Format backend
+  absl::flat_hash_map<gpr_thd_id, size_t> thread_id_map;
+  for (const auto& bin : *events) {
+    size_t displayed_thread_id;
+    auto it = thread_id_map.find(bin->thd_id);
+    if (it == thread_id_map.end()) {
+      displayed_thread_id = thread_id_map.size() + 1;
+      thread_id_map[bin->thd_id] = displayed_thread_id;
+    } else {
+      displayed_thread_id = it->second;
+    }
+    for (const auto& event : *bin) {
+      if (event.timestamp_begin == event.timestamp_end) {
+        output->Mark(event.metadata->name, displayed_thread_id,
+                     event.timestamp_begin - earliest_timestamp);
+      } else if (event.timestamp_begin < 0 && event.timestamp_end > 0) {
+        output->FlowBegin(event.metadata->name, displayed_thread_id,
+                          event.timestamp_end - earliest_timestamp,
+                          -event.timestamp_begin);
+      } else if (event.timestamp_begin < 0) {
+        output->FlowEnd(event.metadata->name, displayed_thread_id,
+                        -event.timestamp_end - earliest_timestamp,
+                        -event.timestamp_begin);
+      } else {
+        output->Span(event.metadata->name, displayed_thread_id,
+                     event.timestamp_begin - earliest_timestamp,
+                     event.timestamp_end - event.timestamp_begin);
+      }
     }
   }
-  bin->events.clear();
+  output->Finish();
+  LOG(INFO) << "Latent-see collection complete";
 }
 
 }  // namespace latent_see
diff --git a/deps/grpc/src/core/util/latent_see.h b/deps/grpc/src/core/util/latent_see.h
index 595e8030bd8..ef1ddd30cdc 100644
--- a/deps/grpc/src/core/util/latent_see.h
+++ b/deps/grpc/src/core/util/latent_see.h
@@ -16,30 +16,73 @@
 #define GRPC_SRC_CORE_UTIL_LATENT_SEE_H
 
 #include <grpc/support/port_platform.h>
-
-#ifdef GRPC_ENABLE_LATENT_SEE
-#include <sys/syscall.h>
-#include <unistd.h>
+#include <grpc/support/thd_id.h>
 
 #include <atomic>
-#include <chrono>
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
-#include <optional>
-#include <string>
+#include <memory>
 #include <utility>
-#include <vector>
 
-#include "absl/base/thread_annotations.h"
-#include "absl/functional/any_invocable.h"
-#include "absl/functional/function_ref.h"
-#include "absl/log/log.h"
+#include "absl/container/flat_hash_map.h"
 #include "absl/strings/string_view.h"
-#include "src/core/util/per_cpu.h"
-#include "src/core/util/sync.h"
+#include "absl/time/clock.h"
+#include "src/core/util/mpscq.h"
+#include "src/core/util/notification.h"
+#include "src/core/util/thd.h"
+
+namespace grpc_core {
+namespace latent_see {
+
+class Output {
+ public:
+  virtual void Mark(absl::string_view name, int64_t tid, int64_t timestamp) = 0;
+  virtual void FlowBegin(absl::string_view name, int64_t tid, int64_t timestamp,
+                         int64_t flow_id) = 0;
+  virtual void FlowEnd(absl::string_view name, int64_t tid, int64_t timestamp,
+                       int64_t flow_id) = 0;
+  virtual void Span(absl::string_view name, int64_t tid,
+                    int64_t timestamp_begin, int64_t duration) = 0;
+  virtual void Finish() = 0;
+
+ protected:
+  ~Output() = default;
+};
+
+class DiscardOutput final : public Output {
+ public:
+  void Mark(absl::string_view, int64_t, int64_t) override {}
+  void FlowBegin(absl::string_view, int64_t, int64_t, int64_t) override {}
+  void FlowEnd(absl::string_view, int64_t, int64_t, int64_t) override {}
+  void Span(absl::string_view, int64_t, int64_t, int64_t) override {}
+  void Finish() override {}
+};
+
+class JsonOutput final : public Output {
+ public:
+  explicit JsonOutput(std::ostream& out) : out_(out) { out_ << "[\n"; }
+
+  void Mark(absl::string_view name, int64_t tid, int64_t timestamp) override;
+  void FlowBegin(absl::string_view name, int64_t tid, int64_t timestamp,
+                 int64_t flow_id) override;
+  void FlowEnd(absl::string_view name, int64_t tid, int64_t timestamp,
+               int64_t flow_id) override;
+  void Span(absl::string_view name, int64_t tid, int64_t timestamp_begin,
+            int64_t duration) override;
+  void Finish() override;
+
+ private:
+  static std::string MicrosString(int64_t nanos);
+
+  std::ostream& out_;
+  const char* sep_ = "";
+};
+
+}  // namespace latent_see
+}  // namespace grpc_core
 
-#define TAGGED_POINTER_SIZE_BITS 48
+#ifndef GRPC_DISABLE_LATENT_SEE
 
 namespace grpc_core {
 namespace latent_see {
@@ -50,211 +93,215 @@ struct Metadata {
   absl::string_view name;
 };
 
-enum class EventType : uint8_t { kBegin, kEnd, kFlowStart, kFlowEnd, kMark };
-
 // A bin collects all events that occur within a parent scope.
-struct Bin {
+struct Bin : public MultiProducerSingleConsumerQueue::Node {
   struct Event {
     const Metadata* metadata;
-    std::chrono::steady_clock::time_point timestamp;
-    uint64_t id;
-    EventType type;
+    int64_t timestamp_begin;
+    int64_t timestamp_end;
+
+    static constexpr uint64_t kSpan = 0;
+    static constexpr uint64_t kFlow = 1;
   };
 
-  void Append(const Metadata* metadata, EventType type, uint64_t id) {
-    events.push_back(
-        Event{metadata, std::chrono::steady_clock::now(), id, type});
+  bool Append(const Metadata* metadata, int64_t timestamp_begin,
+              int64_t timestamp_end) {
+    Event* ev = &events[num_events];
+    ++num_events;
+    ev->metadata = metadata;
+    ev->timestamp_begin = timestamp_begin;
+    ev->timestamp_end = timestamp_end;
+    return num_events == kEventsPerBin;
   }
 
-  std::vector<Event> events;
-  uintptr_t next_free = 0;
+  const Event* begin() const { return events.data(); }
+  const Event* end() const { return events.data() + num_events; }
+
+  static constexpr size_t kEventsPerBin = 8192 / sizeof(Event) - 1;
+  size_t num_events = 0;
+  gpr_thd_id thd_id = gpr_thd_currentid();
+  std::array<Event, kEventsPerBin> events;
 };
 
-class Log {
+void Collect(Notification* notification, absl::Duration timeout,
+             size_t memory_limit, Output* output);
+
+class Sink {
  public:
-  static constexpr uintptr_t kTagMask = (1ULL << TAGGED_POINTER_SIZE_BITS) - 1;
+  using EventDump = std::deque<std::unique_ptr<Bin>>;
 
-  struct RecordedEvent {
-    uint64_t thread_id;
-    uint64_t batch_id;
-    Bin::Event event;
-  };
+  Sink();
+  ~Sink() = delete;
+  void Append(std::unique_ptr<Bin> bin);
 
-  GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION static uintptr_t IncrementTag(
-      uintptr_t input) {
-    return input + (1UL << TAGGED_POINTER_SIZE_BITS);
-  }
+ private:
+  friend void Collect(Notification*, absl::Duration, size_t, Output*);
 
-  GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION static Bin* ToBin(uintptr_t ptr) {
-    return reinterpret_cast<Bin*>(ptr & kTagMask);
-  }
+  void Gather();
+  void Record(std::unique_ptr<Bin> bin);
 
-  static uintptr_t StartBin(void* owner) {
-    uintptr_t bin_descriptor = free_bins_.load(std::memory_order_acquire);
-    Bin* bin;
-    do {
-      if (bin_descriptor == 0) {
-        bin = new Bin();
-        break;
-      }
-      bin = ToBin(bin_descriptor);
-    } while (!free_bins_.compare_exchange_strong(bin_descriptor, bin->next_free,
-                                                 std::memory_order_acq_rel));
-    bin_ = bin;
-    bin_owner_ = owner;
-    return reinterpret_cast<uintptr_t>(bin);
-  }
+  void Start(size_t max_bins);
+  std::unique_ptr<EventDump> Stop();
 
-  static void EndBin(uintptr_t bin_descriptor, void* owner) {
-    if (bin_owner_ != owner || bin_descriptor == 0) return;
-    FlushBin(ToBin(bin_descriptor));
-    uintptr_t next_free = free_bins_.load(std::memory_order_acquire);
-    while (!free_bins_.compare_exchange_strong(
-        next_free, IncrementTag(bin_descriptor), std::memory_order_acq_rel)) {
+  MultiProducerSingleConsumerQueue appending_;
+  Thread gatherer_;
+  Mutex mu_;
+  std::unique_ptr<EventDump> events_ ABSL_GUARDED_BY(mu_);
+  size_t max_bins_ ABSL_GUARDED_BY(mu_);
+};
+
+class Appender {
+ public:
+  GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION Appender()
+      : Appender(active_sink_.load(std::memory_order_acquire)) {};
+  GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION explicit Appender(Sink* sink)
+      : sink_(sink) {}
+  Appender(const Appender&) = delete;
+  Appender& operator=(const Appender&) = delete;
+
+  GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION bool Enabled() const {
+    return sink_ != nullptr;
+  }
+  void Append(const Metadata* metadata, int64_t timestamp_begin,
+              int64_t timestamp_end) {
+    DCHECK(Enabled());
+    DCHECK_NE(metadata, nullptr);
+    if (GPR_UNLIKELY(bin_ == nullptr)) bin_ = std::make_unique<Bin>();
+    if (GPR_UNLIKELY(bin_->Append(metadata, timestamp_begin, timestamp_end))) {
+      sink_->Append(std::move(bin_));
     }
-    bin_ = nullptr;
-    bin_owner_ = nullptr;
   }
 
-  static Bin* CurrentThreadBin() { return bin_; }
-
-  GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION static Log& Get() {
-    static Log* log = new Log();
-    return *log;
+  void Flush() {
+    if (GPR_UNLIKELY(bin_ != nullptr)) sink_->Append(std::move(bin_));
   }
 
-  void TryPullEventsAndFlush(
-      absl::FunctionRef<void(absl::Span<const RecordedEvent>)> callback);
-  std::optional<std::string> TryGenerateJson();
-
-  void OverrideStatsFlusher(
-      absl::AnyInvocable<void(absl::string_view)> stats_exporter) {
-    stats_flusher_ = std::move(stats_exporter);
-  }
+ private:
+  friend void Collect(Notification*, absl::Duration, size_t, Output*);
 
-  // Install an atexit callback that will log to latent_see.json in the working
-  // directory
-  static void InstallAtExitHandler();
+  static void Enable(Sink* sink);
+  static void Disable();
 
- private:
-  Log() = default;
-
-  static void FlushBin(Bin* bin);
-
-  std::atomic<uint64_t> next_thread_id_{1};
-  std::atomic<uint64_t> next_batch_id_{1};
-  static thread_local uint64_t thread_id_;
-  static thread_local Bin* bin_;
-  static thread_local void* bin_owner_;
-  static std::atomic<uintptr_t> free_bins_;
-  absl::AnyInvocable<void(absl::string_view)> stats_flusher_ = nullptr;
-  Mutex mu_flushing_;
-  struct Fragment {
-    Mutex mu_active ABSL_ACQUIRED_AFTER(mu_flushing_);
-    std::vector<RecordedEvent> active ABSL_GUARDED_BY(mu_active);
-    std::vector<RecordedEvent> flushing ABSL_GUARDED_BY(&Log::mu_flushing_);
-  };
-  PerCpu<Fragment> fragments_{PerCpuOptions()};
+  Sink* sink_;
+  static thread_local std::unique_ptr<Bin> bin_;
+  static std::atomic<Sink*> active_sink_;
 };
 
-template <bool kParent>
-class Scope {
+inline void Flush() {
+  Appender appender;
+  if (GPR_UNLIKELY(!appender.Enabled())) return;
+  appender.Flush();
+}
+
+class Scope final {
  public:
-  GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION explicit Scope(const Metadata* metadata)
-      : metadata_(metadata) {
-    bin_ = Log::CurrentThreadBin();
-    if (kParent && bin_ == nullptr) {
-      bin_descriptor_ = Log::StartBin(this);
-      bin_ = Log::ToBin(bin_descriptor_);
-    }
-    CHECK_NE(bin_, nullptr);
-    bin_->Append(metadata_, EventType::kBegin, 0);
+  Scope(const Scope&) = delete;
+  Scope& operator=(const Scope&) = delete;
+
+  GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION explicit Scope(
+      const Metadata* metadata) {
+    if (GPR_LIKELY(!appender_.Enabled())) return;
+    metadata_ = metadata;
+    timestamp_begin_ = absl::GetCurrentTimeNanos();
   }
+
   GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION ~Scope() {
-    bin_->Append(metadata_, EventType::kEnd, 0);
-    if (kParent) Log::EndBin(bin_descriptor_, this);
+    if (GPR_LIKELY(!appender_.Enabled())) return;
+    appender_.Append(metadata_, timestamp_begin_, absl::GetCurrentTimeNanos());
   }
 
-  Scope(const Scope&) = delete;
-  Scope& operator=(const Scope&) = delete;
-
  private:
-  const Metadata* const metadata_;
-  uintptr_t bin_descriptor_ = 0;
-  Bin* bin_ = nullptr;
+  Appender appender_;
+  int64_t timestamp_begin_;
+  const Metadata* metadata_;
 };
 
-using ParentScope = Scope<true>;
-using InnerScope = Scope<false>;
+GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION static inline void Mark(
+    const Metadata* metadata) {
+  Appender appender;
+  if (GPR_LIKELY(!appender.Enabled())) return;
+  const auto ts = absl::GetCurrentTimeNanos();
+  appender.Append(metadata, ts, ts);
+}
 
 class Flow {
  public:
-  GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION Flow() : metadata_(nullptr) {}
-  GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION explicit Flow(const Metadata* metadata)
-      : metadata_(metadata),
-        id_(next_flow_id_.fetch_add(1, std::memory_order_relaxed)) {
-    Log::CurrentThreadBin()->Append(metadata_, EventType::kFlowStart, id_);
+  GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION Flow() : id_(0) {}
+  GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION explicit Flow(const Metadata* metadata) {
+    Appender appender;
+    if (GPR_LIKELY(!appender.Enabled())) {
+      id_ = 0;
+      return;
+    }
+    metadata_ = metadata;
+    AppendBegin(appender);
   }
   GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION ~Flow() {
-    if (metadata_ != nullptr) {
-      Log::CurrentThreadBin()->Append(metadata_, EventType::kFlowEnd, id_);
-    }
+    if (GPR_LIKELY(id_ == 0)) return;
+    Appender appender;
+    if (GPR_LIKELY(!appender.Enabled())) return;
+    AppendEnd(appender);
   }
 
   Flow(const Flow&) = delete;
   Flow& operator=(const Flow&) = delete;
   Flow(Flow&& other) noexcept
-      : metadata_(std::exchange(other.metadata_, nullptr)), id_(other.id_) {}
+      : metadata_(other.metadata_), id_(std::exchange(other.id_, 0)) {}
   Flow& operator=(Flow&& other) noexcept {
-    if (metadata_ != nullptr) {
-      Log::CurrentThreadBin()->Append(metadata_, EventType::kFlowEnd, id_);
+    if (id_ != 0) {
+      Appender appender;
+      if (GPR_LIKELY(!appender.Enabled())) AppendEnd(appender);
     }
-    metadata_ = std::exchange(other.metadata_, nullptr);
-    id_ = other.id_;
+    metadata_ = other.metadata_;
+    id_ = std::exchange(other.id_, 0);
     return *this;
   }
 
   GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION bool is_active() const {
-    return metadata_ != nullptr;
+    return id_ != 0;
   }
   GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION void End() {
-    if (metadata_ == nullptr) return;
-    Log::CurrentThreadBin()->Append(metadata_, EventType::kFlowEnd, id_);
-    metadata_ = nullptr;
+    if (GPR_LIKELY(id_ == 0)) return;
+    Appender appender;
+    if (GPR_LIKELY(!appender.Enabled())) return;
+    AppendEnd(appender);
   }
   GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION void Begin(const Metadata* metadata) {
-    auto* bin = Log::CurrentThreadBin();
-    if (metadata_ != nullptr) {
-      bin->Append(metadata_, EventType::kFlowEnd, id_);
-    }
+    Appender appender;
+    if (GPR_LIKELY(!appender.Enabled())) return;
+    if (id_ != 0) AppendEnd(appender);
     metadata_ = metadata;
-    if (metadata_ == nullptr) return;
-    id_ = next_flow_id_.fetch_add(1, std::memory_order_relaxed);
-    bin->Append(metadata_, EventType::kFlowStart, id_);
+    AppendBegin(appender);
   }
+  GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION void Begin() { Begin(metadata_); }
 
  private:
+  void AppendBegin(Appender& appender) {
+    id_ = next_id_.fetch_add(1, std::memory_order_relaxed);
+    appender.Append(metadata_, -id_, absl::GetCurrentTimeNanos());
+  }
+  void AppendEnd(Appender& appender) {
+    DCHECK_NE(id_, 0);
+    appender.Append(metadata_, -id_, -absl::GetCurrentTimeNanos());
+    id_ = 0;
+  }
   const Metadata* metadata_;
-  uint64_t id_;
-  static std::atomic<uint64_t> next_flow_id_;
+  static inline std::atomic<int64_t> next_id_{1};
+  int64_t id_;
 };
 
-GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION inline void Mark(const Metadata* md) {
-  Log::CurrentThreadBin()->Append(md, EventType::kMark, 0);
-}
-
 template <typename P>
 GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION auto Promise(const Metadata* md_poll,
                                                   const Metadata* md_flow,
                                                   P promise) {
-  return [md_poll, md_flow, promise = std::move(promise),
-          flow = Flow(md_flow)]() mutable {
-    InnerScope scope(md_poll);
-    flow.End();
-    auto r = promise();
-    flow.Begin(md_flow);
-    return r;
-  };
+  return
+      [md_poll, promise = std::move(promise), flow = Flow(md_flow)]() mutable {
+        Scope scope(md_poll);
+        flow.End();
+        auto r = promise();
+        if (IsPending(r)) flow.Begin();
+        return r;
+      };
 }
 
 }  // namespace latent_see
@@ -268,30 +315,35 @@ GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION auto Promise(const Metadata* md_poll,
                                                        name};              \
     return &metadata;                                                      \
   }()
-// Parent scope: logs a begin and end event, and flushes the thread log on scope
-// exit. Because the flush takes some time it's better to place one parent scope
-// at the top of the stack, and use lighter weight scopes within it.
-#define GRPC_LATENT_SEE_PARENT_SCOPE(name)                                     \
-  grpc_core::latent_see::ParentScope GRPC_LATENT_SEE_SYMBOL(latent_see_scope)( \
-      GRPC_LATENT_SEE_METADATA(name))
-// Inner scope: logs a begin and end event. Lighter weight than parent scope,
-// but does not flush the thread state - so should only be enclosed by a parent
-// scope.
-#define GRPC_LATENT_SEE_INNER_SCOPE(name)                                     \
-  grpc_core::latent_see::InnerScope GRPC_LATENT_SEE_SYMBOL(latent_see_scope)( \
+// Scope: marks a begin/end event in the log.
+#define GRPC_LATENT_SEE_ALWAYS_ON_SCOPE(name)                            \
+  grpc_core::latent_see::Scope GRPC_LATENT_SEE_SYMBOL(latent_see_scope)( \
       GRPC_LATENT_SEE_METADATA(name))
 // Mark: logs a single event.
-// This is not flushed automatically, and so should only be used within a parent
-// scope.
-#define GRPC_LATENT_SEE_MARK(name) \
+#define GRPC_LATENT_SEE_ALWAYS_ON_MARK(name) \
   grpc_core::latent_see::Mark(GRPC_LATENT_SEE_METADATA(name))
-#define GRPC_LATENT_SEE_PROMISE(name, promise)                                 \
-  grpc_core::latent_see::Promise(GRPC_LATENT_SEE_METADATA("Poll:" name),       \
-                                 GRPC_LATENT_SEE_METADATA(name), [&]() {       \
-                                   GRPC_LATENT_SEE_INNER_SCOPE("Setup:" name); \
-                                   return promise;                             \
-                                 }())
-#else  // !def(GRPC_ENABLE_LATENT_SEE)
+#define GRPC_LATENT_SEE_ALWAYS_ON_PROMISE(name, promise)                      \
+  grpc_core::latent_see::Promise(                                             \
+      GRPC_LATENT_SEE_METADATA("Poll:" name), GRPC_LATENT_SEE_METADATA(name), \
+      [&]() {                                                                 \
+        GRPC_LATENT_SEE_ALWAYS_ON_SCOPE("Setup:" name);                       \
+        return promise;                                                       \
+      }())
+#ifdef GRPC_EXTRA_LATENT_SEE
+#define GRPC_LATENT_SEE_SCOPE(name) GRPC_LATENT_SEE_ALWAYS_ON_SCOPE(name)
+#define GRPC_LATENT_SEE_MARK(name) GRPC_LATENT_SEE_ALWAYS_ON_MARK(name)
+#define GRPC_LATENT_SEE_PROMISE(name, promise) \
+  GRPC_LATENT_SEE_ALWAYS_ON_PROMISE(name, promise)
+#else
+#define GRPC_LATENT_SEE_SCOPE(name) \
+  do {                              \
+  } while (0)
+#define GRPC_LATENT_SEE_MARK(name) \
+  do {                             \
+  } while (0)
+#define GRPC_LATENT_SEE_PROMISE(name, promise) promise
+#endif
+#else  // def(GRPC_DISABLE_LATENT_SEE)
 namespace grpc_core {
 namespace latent_see {
 struct Metadata {};
@@ -300,26 +352,31 @@ struct Flow {
   GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION void End() {}
   GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION void Begin(Metadata*) {}
 };
-struct ParentScope {
-  explicit ParentScope(Metadata*) {}
-};
-struct InnerScope {
-  explicit InnerScope(Metadata*) {}
+struct Scope {
+  explicit Scope(Metadata*) {}
 };
+
+inline void Collect(Notification*, absl::Duration, size_t, Output* output) {
+  output->Finish();
+}
 }  // namespace latent_see
 }  // namespace grpc_core
 #define GRPC_LATENT_SEE_METADATA(name) nullptr
 #define GRPC_LATENT_SEE_METADATA_RAW(name) nullptr
-#define GRPC_LATENT_SEE_PARENT_SCOPE(name) \
-  do {                                     \
+#define GRPC_LATENT_SEE_ALWAYS_ON_SCOPE(name) \
+  do {                                        \
+  } while (0)
+#define GRPC_LATENT_SEE_ALWAYS_ON_MARK(name) \
+  do {                                       \
   } while (0)
-#define GRPC_LATENT_SEE_INNER_SCOPE(name) \
-  do {                                    \
+#define GRPC_LATENT_SEE_ALWAYS_ON_PROMISE(name, promise) promise
+#define GRPC_LATENT_SEE_SCOPE(name) \
+  do {                              \
   } while (0)
 #define GRPC_LATENT_SEE_MARK(name) \
   do {                             \
   } while (0)
 #define GRPC_LATENT_SEE_PROMISE(name, promise) promise
-#endif  // GRPC_ENABLE_LATENT_SEE
+#endif  // GRPC_DISABLE_LATENT_SEE
 
 #endif  // GRPC_SRC_CORE_UTIL_LATENT_SEE_H
diff --git a/deps/grpc/src/core/util/single_set_ptr.h b/deps/grpc/src/core/util/single_set_ptr.h
index 7268208d273..073535e6468 100644
--- a/deps/grpc/src/core/util/single_set_ptr.h
+++ b/deps/grpc/src/core/util/single_set_ptr.h
@@ -90,9 +90,10 @@ class SingleSetRefCountedPtr {
 
   bool is_set() const { return p_.is_set(); }
 
-  RefCountedPtr<T> GetOrCreate() {
+  template <typename... Args>
+  RefCountedPtr<T> GetOrCreate(Args&&... args) {
     T* p = Get();
-    if (p == nullptr) p = Set(MakeRefCounted<T>());
+    if (p == nullptr) p = Set(MakeRefCounted<T>(std::forward<Args>(args)...));
     return p->Ref();
   }
   T* Get() const { return p_.Get(); }
@@ -107,6 +108,8 @@ class SingleSetRefCountedPtr {
 
   T* Set(RefCountedPtr<T> p) { return p_.Set(p.release()); }
 
+  void Reset() { p_.Reset(); }
+
  private:
   struct UnrefDeleter {
     void operator()(T* p) { p->Unref(); }
diff --git a/deps/grpc/src/core/util/subprocess_windows.cc b/deps/grpc/src/core/util/subprocess_windows.cc
index 71fd6497e78..4db3d3f9d41 100644
--- a/deps/grpc/src/core/util/subprocess_windows.cc
+++ b/deps/grpc/src/core/util/subprocess_windows.cc
@@ -25,6 +25,8 @@
 #include <tchar.h>
 #include <windows.h>
 
+#include <memory>
+
 #include "absl/log/log.h"
 #include "absl/strings/str_join.h"
 #include "absl/types/span.h"
diff --git a/deps/grpc/src/core/util/useful.h b/deps/grpc/src/core/util/useful.h
index c59fb574912..78b11f367c3 100644
--- a/deps/grpc/src/core/util/useful.h
+++ b/deps/grpc/src/core/util/useful.h
@@ -197,6 +197,97 @@ GPR_ATTRIBUTE_ALWAYS_INLINE_FUNCTION inline uint64_t LowestOneBit(uint64_t x) {
   return x & -x;
 }
 
+namespace useful_detail {
+
+// Constexpr implementation of std::log for base e.
+// This is a simple implementation using a Taylor series expansion and may not
+// be as accurate as std::log from <cmath>. It is intended for use in constexpr
+// contexts.
+// It uses the identity log(y) = 2 * atanh((y-1)/(y+1))
+// where atanh(x) = x + x^3/3 + x^5/5 + ...
+constexpr double ConstexprLog(double y) {
+  if (y < 0) {
+    return std::numeric_limits<double>::quiet_NaN();
+  }
+  if (y == 0) {
+    return -std::numeric_limits<double>::infinity();
+  }
+  if (y == 1) {
+    return 0.0;
+  }
+  // Bring y into the range [1, 2) to improve convergence.
+  // log(y) = log(y / 2^k) + k*log(2)
+  int k = 0;
+  while (y > 2.0) {
+    y /= 2.0;
+    k++;
+  }
+  while (y < 1.0) {
+    y *= 2.0;
+    k--;
+  }
+  // Now y is in [1, 2).
+  // x = (y-1)/(y+1) is in [0, 1/3).
+  // The series will converge quickly.
+  double x = (y - 1) / (y + 1);
+  double x2 = x * x;
+  double term = x;
+  double sum = term;
+  for (int i = 1; i < 100; ++i) {
+    term *= x2;
+    double next_sum = sum + term / (2 * i + 1);
+    if (next_sum == sum) break;
+    sum = next_sum;
+  }
+  constexpr double kLog2 = 0.693147180559945309417;
+  return 2 * sum + k * kLog2;
+}
+
+// Constexpr implementation of std::exp.
+// This is a simple implementation using a Taylor series expansion and may not
+// be as accurate as std::exp from <cmath>. It is intended for use in constexpr
+// contexts.
+// It uses exp(x) = 1 + x + x^2/2! + x^3/3! + ...
+// For better convergence, we use range reduction via exp(x) = (exp(x/2))^2.
+constexpr double ConstexprExp(double x) {
+  if (x > 2.0 || x < -2.0) {
+    const double half = ConstexprExp(x / 2.0);
+    return half * half;
+  }
+  double sum = 1.0;
+  double term = 1.0;
+  for (int i = 1; i < 30; ++i) {
+    term *= x / i;
+    double next_sum = sum + term;
+    if (next_sum == sum) break;
+    sum = next_sum;
+  }
+  return sum;
+}
+
+}  // namespace useful_detail
+
+// Constexpr implementation of std::pow.
+// This is a simple implementation and may not be as accurate as std::pow from
+// <cmath>. It is intended for use in constexpr contexts.
+// Fuzztests exist in useful_fuzztest.cc to test that the constexpr and
+// non-constexpr implementations are within an acceptable error bound.
+// Replace with std::pow when we move to C++26.
+constexpr double ConstexprPow(double base, double exponent) {
+  // For simplicity, only handle non-negative bases.
+  // std::pow has more complex rules for negative bases.
+  if (base < 0) return std::numeric_limits<double>::quiet_NaN();
+  if (base == 0) {
+    if (exponent > 0) return 0.0;
+    if (exponent == 0) return 1.0;
+    return std::numeric_limits<double>::infinity();
+  }
+  if (exponent == 0.0) return 1.0;
+  if (exponent == 1.0) return base;
+  return useful_detail::ConstexprExp(exponent *
+                                     useful_detail::ConstexprLog(base));
+}
+
 }  // namespace grpc_core
 
 #define GPR_ARRAY_SIZE(array) (sizeof(array) / sizeof(*(array)))
diff --git a/deps/grpc/src/core/util/windows/directory_reader.cc b/deps/grpc/src/core/util/windows/directory_reader.cc
index 9ae07c6357b..2848d01924e 100644
--- a/deps/grpc/src/core/util/windows/directory_reader.cc
+++ b/deps/grpc/src/core/util/windows/directory_reader.cc
@@ -23,6 +23,7 @@
 #include <sys/stat.h>
 #include <windows.h>
 
+#include <memory>
 #include <string>
 #include <vector>
 
diff --git a/deps/grpc/src/core/util/windows/thd.cc b/deps/grpc/src/core/util/windows/thd.cc
index 464d8a6d06c..98cd406bffb 100644
--- a/deps/grpc/src/core/util/windows/thd.cc
+++ b/deps/grpc/src/core/util/windows/thd.cc
@@ -175,8 +175,6 @@ Thread::Thread(const char* /* thd_name */, void (*thd_body)(void* arg),
 
 }  // namespace grpc_core
 
-gpr_thd_id gpr_thd_currentid(void) {
-  return reinterpret_cast<gpr_thd_id>(g_thd_info);
-}
+gpr_thd_id gpr_thd_currentid(void) { return GetCurrentThreadId(); }
 
 #endif  // GPR_WINDOWS
diff --git a/deps/grpc/src/core/util/work_serializer.cc b/deps/grpc/src/core/util/work_serializer.cc
index 72cf7323e69..582a402ec6e 100644
--- a/deps/grpc/src/core/util/work_serializer.cc
+++ b/deps/grpc/src/core/util/work_serializer.cc
@@ -187,7 +187,7 @@ void WorkSerializer::WorkSerializerImpl::Run(
 
 // Implementation of EventEngine::Closure::Run - our actual work loop
 void WorkSerializer::WorkSerializerImpl::Run() {
-  GRPC_LATENT_SEE_PARENT_SCOPE("WorkSerializer::Run");
+  GRPC_LATENT_SEE_SCOPE("WorkSerializer::Run");
   flow_.End();
   // TODO(ctiller): remove these when we can deprecate ExecCtx
   ExecCtx exec_ctx;
diff --git a/deps/grpc/src/core/xds/GEMINI.md b/deps/grpc/src/core/xds/GEMINI.md
new file mode 100644
index 00000000000..5fa052cdd9f
--- /dev/null
+++ b/deps/grpc/src/core/xds/GEMINI.md
@@ -0,0 +1,44 @@
+# gRPC xDS
+
+This directory contains the implementation of gRPC's xDS support. xDS is a set of APIs that allow a gRPC client or server to discover and configure itself dynamically.
+
+See also: [gRPC Core overview](../GEMINI.md)
+
+## Overarching Purpose
+
+The code in this directory provides a gRPC implementation of the xDS APIs. This allows gRPC clients and servers to be configured by a central control plane. xDS is one way that service configurations can be delivered to a gRPC application; see [service config](../service_config/GEMINI.md) for more information.
+
+## Core Concepts
+
+*   **`XdsClient`**: The `XdsClient` is the core of the xDS implementation. It is responsible for managing the connection to the xDS server, sending resource requests, and receiving and processing resource updates.
+*   **Bootstrap File**: The `XdsClient` is configured via a bootstrap file. The bootstrap file is a JSON file that contains the information that the `XdsClient` needs to connect to the xDS server.
+*   **xDS Resources**: xDS is a set of APIs for discovering and configuring different types of resources. The most important resource types for gRPC are:
+    *   **LDS (Listener Discovery Service)**: Used to discover the listeners that are running on a gRPC server.
+    *   **RDS (Route Discovery Service)**: Used to discover the routes that are available for a given listener.
+    *   **CDS (Cluster Discovery Service)**: Used to discover the clusters that are available to the gRPC client.
+    *   **EDS (Endpoint Discovery Service)**: Used to discover the endpoints (i.e., the backend servers) that are in a given cluster.
+
+## `xds_client` Directory
+
+The `xds_client` directory contains the core implementation of the xDS client.
+
+### Files
+
+*   **`xds_client.h`, `xds_client.cc`**: These files define the `XdsClient` class.
+*   **`xds_bootstrap.h`, `xds_bootstrap.cc`**: These files define the `XdsBootstrap` class, which is responsible for reading the xDS bootstrap file and creating the initial `XdsClient` configuration.
+*   **`xds_api.h`, `xds_api.cc`**: These files define the `XdsApi` class, which provides a high-level API for interacting with the xDS server.
+*   **`lrs_client.h`, `lrs_client.cc`**: These files define the `LrsClient` class, which is used to send load reports to the xDS server.
+*   **`xds_resource_type.h`**: Defines the interface for a specific xDS resource type. Each resource type (e.g., LDS, RDS, CDS, EDS) has its own implementation of this interface.
+
+### Major Classes
+
+*   **`grpc_core::XdsClient`**: The core of the xDS client implementation.
+*   **`grpc_core::XdsBootstrap`**: Responsible for reading the xDS bootstrap file.
+*   **`grpc_core::XdsApi`**: A high-level API for interacting with the xDS server.
+*   **`grpc_core::LrsClient`**: A client for sending load reports to the xDS server.
+
+## Notes
+
+*   xDS is a complex and powerful feature. A full understanding of xDS requires reading the official [Envoy documentation](https://www.envoyproxy.io/docs/envoy/latest/api-docs/xds_protocol).
+*   The gRPC xDS implementation is still under active development.
+*   The xDS implementation is a good example of how gRPC can be extended with new features. It is implemented as a set of plugins that are loaded at runtime, and it uses the `CoreConfiguration` class to register its factories.
diff --git a/deps/grpc/src/core/xds/grpc/file_watcher_certificate_provider_factory.cc b/deps/grpc/src/core/xds/grpc/file_watcher_certificate_provider_factory.cc
index 5f2fd3d4f8b..40466d59343 100644
--- a/deps/grpc/src/core/xds/grpc/file_watcher_certificate_provider_factory.cc
+++ b/deps/grpc/src/core/xds/grpc/file_watcher_certificate_provider_factory.cc
@@ -31,6 +31,7 @@
 #include "src/core/config/core_configuration.h"
 #include "src/core/credentials/transport/tls/grpc_tls_certificate_provider.h"
 #include "src/core/util/down_cast.h"
+#include "src/core/util/env.h"
 
 namespace grpc_core {
 
@@ -38,6 +39,14 @@ namespace {
 
 constexpr absl::string_view kFileWatcherPlugin = "file_watcher";
 
+bool SpiffeBundleMapEnabled() {
+  auto value = GetEnv("GRPC_EXPERIMENTAL_XDS_MTLS_SPIFFE");
+  if (!value.has_value()) return false;
+  bool parsed_value;
+  bool parse_succeeded = gpr_parse_bool_value(value->c_str(), &parsed_value);
+  return parse_succeeded && parsed_value;
+}
+
 }  // namespace
 
 //
@@ -63,6 +72,10 @@ std::string FileWatcherCertificateProviderFactory::Config::ToString() const {
     parts.push_back(
         absl::StrFormat("ca_certificate_file=\"%s\", ", root_cert_file_));
   }
+  if (!spiffe_bundle_map_file_.empty()) {
+    parts.push_back(absl::StrFormat("spiffe_bundle_map_file=\"%s\", ",
+                                    spiffe_bundle_map_file_));
+  }
   parts.push_back(
       absl::StrFormat("refresh_interval=%ldms}", refresh_interval_.millis()));
   return absl::StrJoin(parts, "");
@@ -75,6 +88,8 @@ FileWatcherCertificateProviderFactory::Config::JsonLoader(const JsonArgs&) {
           .OptionalField("certificate_file", &Config::identity_cert_file_)
           .OptionalField("private_key_file", &Config::private_key_file_)
           .OptionalField("ca_certificate_file", &Config::root_cert_file_)
+          .OptionalField("spiffe_bundle_map_file",
+                         &Config::spiffe_bundle_map_file_)
           .OptionalField("refresh_interval", &Config::refresh_interval_)
           .Finish();
   return loader;
@@ -88,11 +103,22 @@ void FileWatcherCertificateProviderFactory::Config::JsonPostLoad(
         "fields \"certificate_file\" and \"private_key_file\" must be both set "
         "or both unset");
   }
-  if ((json.object().find("certificate_file") == json.object().end()) &&
-      (json.object().find("ca_certificate_file") == json.object().end())) {
-    errors->AddError(
-        "at least one of \"certificate_file\" and \"ca_certificate_file\" must "
-        "be specified");
+  if (SpiffeBundleMapEnabled()) {
+    if (json.object().find("certificate_file") == json.object().end() &&
+        json.object().find("ca_certificate_file") == json.object().end() &&
+        json.object().find("spiffe_bundle_map_file") == json.object().end()) {
+      errors->AddError(
+          "at least one of \"certificate_file\", \"ca_certificate_file\", and "
+          "\"spiffe_bundle_map_file\" must be specified");
+    }
+  } else {
+    spiffe_bundle_map_file_ = "";
+    if ((json.object().find("certificate_file") == json.object().end()) &&
+        (json.object().find("ca_certificate_file") == json.object().end())) {
+      errors->AddError(
+          "at least one of \"certificate_file\" and \"ca_certificate_file\" "
+          "must be specified");
+    }
   }
 }
 
@@ -124,6 +150,7 @@ FileWatcherCertificateProviderFactory::CreateCertificateProvider(
       file_watcher_config->private_key_file(),
       file_watcher_config->identity_cert_file(),
       file_watcher_config->root_cert_file(),
+      file_watcher_config->spiffe_bundle_map_file(),
       file_watcher_config->refresh_interval().millis() / GPR_MS_PER_SEC);
 }
 
diff --git a/deps/grpc/src/core/xds/grpc/file_watcher_certificate_provider_factory.h b/deps/grpc/src/core/xds/grpc/file_watcher_certificate_provider_factory.h
index d65e4b3bebf..6f828c06438 100644
--- a/deps/grpc/src/core/xds/grpc/file_watcher_certificate_provider_factory.h
+++ b/deps/grpc/src/core/xds/grpc/file_watcher_certificate_provider_factory.h
@@ -52,6 +52,10 @@ class FileWatcherCertificateProviderFactory final
 
     const std::string& root_cert_file() const { return root_cert_file_; }
 
+    const std::string& spiffe_bundle_map_file() const {
+      return spiffe_bundle_map_file_;
+    }
+
     Duration refresh_interval() const { return refresh_interval_; }
 
     static const JsonLoaderInterface* JsonLoader(const JsonArgs& args);
@@ -62,6 +66,7 @@ class FileWatcherCertificateProviderFactory final
     std::string identity_cert_file_;
     std::string private_key_file_;
     std::string root_cert_file_;
+    std::string spiffe_bundle_map_file_;
     Duration refresh_interval_ = Duration::Minutes(10);
   };
 
diff --git a/deps/grpc/src/core/xds/grpc/xds_certificate_provider.cc b/deps/grpc/src/core/xds/grpc/xds_certificate_provider.cc
index 25fcd6b9608..33a1d6bd625 100644
--- a/deps/grpc/src/core/xds/grpc/xds_certificate_provider.cc
+++ b/deps/grpc/src/core/xds/grpc/xds_certificate_provider.cc
@@ -45,12 +45,11 @@ class RootCertificatesWatcher final
       RefCountedPtr<grpc_tls_certificate_distributor> parent)
       : parent_(std::move(parent)) {}
 
-  void OnCertificatesChanged(std::optional<absl::string_view> root_certs,
+  void OnCertificatesChanged(std::shared_ptr<RootCertInfo> roots,
                              std::optional<PemKeyCertPairList>
                              /* key_cert_pairs */) override {
-    if (root_certs.has_value()) {
-      parent_->SetKeyMaterials("", std::string(root_certs.value()),
-                               std::nullopt);
+    if (roots != nullptr) {
+      parent_->SetKeyMaterials("", roots, std::nullopt);
     }
   }
 
@@ -79,10 +78,10 @@ class IdentityCertificatesWatcher final
       : parent_(std::move(parent)) {}
 
   void OnCertificatesChanged(
-      std::optional<absl::string_view> /* root_certs */,
+      std::shared_ptr<RootCertInfo> /* root_certs */,
       std::optional<PemKeyCertPairList> key_cert_pairs) override {
     if (key_cert_pairs.has_value()) {
-      parent_->SetKeyMaterials("", std::nullopt, key_cert_pairs);
+      parent_->SetKeyMaterials("", nullptr, key_cert_pairs);
     }
   }
 
diff --git a/deps/grpc/src/cpp/README.md b/deps/grpc/src/cpp/README.md
index 43939580c06..8035752100d 100755
--- a/deps/grpc/src/cpp/README.md
+++ b/deps/grpc/src/cpp/README.md
@@ -62,6 +62,25 @@ To add gRPC as a Bazel dependency:
 bazel_dep(name = "grpc", version = "1.72.0")
 ```
 
+## Projects using legacy Bazel WORKSPACE file
+
+To add gRPC as a dependency for projects that are built using legacy Bazel WORKSPACE files:
+1. determine commit SHA for the grpc release you want to use
+2. Use the [http_archive](https://docs.bazel.build/versions/master/repo/http.html#http_archive) bazel rule to include gRPC source
+  ```
+  http_archive(
+      name = "com_github_grpc_grpc",
+      urls = [
+          "https://github.com/grpc/grpc/archive/YOUR_GRPC_COMMIT_SHA.tar.gz",
+      ],
+      strip_prefix = "grpc-YOUR_GRPC_COMMIT_SHA",
+  )
+  load("@com_github_grpc_grpc//bazel:grpc_deps.bzl", "grpc_deps")
+  grpc_deps()
+  load("@com_github_grpc_grpc//bazel:grpc_extra_deps.bzl", "grpc_extra_deps")
+  grpc_extra_deps()
+  ```
+
 ## CMake
 
 `cmake` is your best option if you cannot use bazel. It supports building on Linux,
diff --git a/deps/grpc/src/cpp/common/channel_arguments.cc b/deps/grpc/src/cpp/common/channel_arguments.cc
index af1838571ca..ab4798c7acb 100644
--- a/deps/grpc/src/cpp/common/channel_arguments.cc
+++ b/deps/grpc/src/cpp/common/channel_arguments.cc
@@ -28,7 +28,7 @@
 
 #include "absl/log/check.h"
 #include "src/core/lib/iomgr/exec_ctx.h"
-#include "src/core/lib/iomgr/socket_mutator.h"
+#include "src/core/net/socket_mutator.h"
 
 namespace grpc {
 
diff --git a/deps/grpc/src/cpp/common/tls_certificate_provider.cc b/deps/grpc/src/cpp/common/tls_certificate_provider.cc
index da0d3b1407c..5c6123a5091 100644
--- a/deps/grpc/src/cpp/common/tls_certificate_provider.cc
+++ b/deps/grpc/src/cpp/common/tls_certificate_provider.cc
@@ -55,10 +55,13 @@ absl::Status StaticDataCertificateProvider::ValidateCredentials() const {
 FileWatcherCertificateProvider::FileWatcherCertificateProvider(
     const std::string& private_key_path,
     const std::string& identity_certificate_path,
-    const std::string& root_cert_path, unsigned int refresh_interval_sec) {
+    const std::string& root_cert_path,
+    const std::string& spiffe_bundle_map_path,
+    unsigned int refresh_interval_sec) {
   c_provider_ = grpc_tls_certificate_provider_file_watcher_create(
       private_key_path.c_str(), identity_certificate_path.c_str(),
-      root_cert_path.c_str(), refresh_interval_sec);
+      root_cert_path.c_str(), spiffe_bundle_map_path.c_str(),
+      refresh_interval_sec);
   CHECK_NE(c_provider_, nullptr);
 };
 
diff --git a/deps/grpc/src/cpp/ext/csm/metadata_exchange.cc b/deps/grpc/src/cpp/ext/csm/metadata_exchange.cc
index abe38ccd853..53e31d2dfb3 100644
--- a/deps/grpc/src/cpp/ext/csm/metadata_exchange.cc
+++ b/deps/grpc/src/cpp/ext/csm/metadata_exchange.cc
@@ -47,7 +47,7 @@ namespace grpc {
 namespace internal {
 
 using OptionalLabelKey =
-    grpc_core::ClientCallTracer::CallAttemptTracer::OptionalLabelKey;
+    grpc_core::ClientCallTracerInterface::CallAttemptTracer::OptionalLabelKey;
 
 namespace {
 
@@ -357,15 +357,17 @@ bool ServiceMeshLabelsInjector::AddOptionalLabels(
   // Performs JSON label name format to CSM Observability Metric spec format
   // conversion.
   absl::string_view service_name =
-      optional_labels[static_cast<size_t>(
-                          grpc_core::ClientCallTracer::CallAttemptTracer::
-                              OptionalLabelKey::kXdsServiceName)]
-          .as_string_view();
+      optional_labels
+          [static_cast<size_t>(
+               grpc_core::ClientCallTracerInterface::CallAttemptTracer::
+                   OptionalLabelKey::kXdsServiceName)]
+              .as_string_view();
   absl::string_view service_namespace =
-      optional_labels[static_cast<size_t>(
-                          grpc_core::ClientCallTracer::CallAttemptTracer::
-                              OptionalLabelKey::kXdsServiceNamespace)]
-          .as_string_view();
+      optional_labels
+          [static_cast<size_t>(
+               grpc_core::ClientCallTracerInterface::CallAttemptTracer::
+                   OptionalLabelKey::kXdsServiceNamespace)]
+              .as_string_view();
   return callback("csm.service_name",
                   service_name.empty()
                       ? "unknown"
diff --git a/deps/grpc/src/cpp/ext/filters/census/open_census_call_tracer.h b/deps/grpc/src/cpp/ext/filters/census/open_census_call_tracer.h
index a147035a1d2..75559a7df58 100644
--- a/deps/grpc/src/cpp/ext/filters/census/open_census_call_tracer.h
+++ b/deps/grpc/src/cpp/ext/filters/census/open_census_call_tracer.h
@@ -61,7 +61,7 @@
 namespace grpc {
 namespace internal {
 
-class OpenCensusCallTracer : public grpc_core::ClientCallTracer {
+class OpenCensusCallTracer : public grpc_core::ClientCallTracerInterface {
  public:
   class OpenCensusCallAttemptTracer : public CallAttemptTracer {
    public:
diff --git a/deps/grpc/src/cpp/ext/filters/census/server_call_tracer.cc b/deps/grpc/src/cpp/ext/filters/census/server_call_tracer.cc
index 22bc798e39e..ab4c456409c 100644
--- a/deps/grpc/src/cpp/ext/filters/census/server_call_tracer.cc
+++ b/deps/grpc/src/cpp/ext/filters/census/server_call_tracer.cc
@@ -92,7 +92,7 @@ void FilterInitialMetadata(grpc_metadata_batch* b,
 
 // OpenCensusServerCallTracer implementation
 
-class OpenCensusServerCallTracer : public grpc_core::ServerCallTracer {
+class OpenCensusServerCallTracer : public grpc_core::ServerCallTracerInterface {
  public:
   // Maximum size of server stats that are sent on the wire.
   static constexpr uint32_t kMaxServerStatsLen = 16;
@@ -293,7 +293,7 @@ void OpenCensusServerCallTracer::RecordOutgoingBytes(
 // OpenCensusServerCallTracerFactory
 //
 
-grpc_core::ServerCallTracer*
+grpc_core::ServerCallTracerInterface*
 OpenCensusServerCallTracerFactory::CreateNewServerCallTracer(
     grpc_core::Arena* arena, const grpc_core::ChannelArgs& /*args*/) {
   return arena->ManagedNew<OpenCensusServerCallTracer>();
diff --git a/deps/grpc/src/cpp/ext/filters/census/server_call_tracer.h b/deps/grpc/src/cpp/ext/filters/census/server_call_tracer.h
index 25bb0f19303..de1992e2396 100644
--- a/deps/grpc/src/cpp/ext/filters/census/server_call_tracer.h
+++ b/deps/grpc/src/cpp/ext/filters/census/server_call_tracer.h
@@ -30,7 +30,7 @@ namespace internal {
 class OpenCensusServerCallTracerFactory
     : public grpc_core::ServerCallTracerFactory {
  public:
-  grpc_core::ServerCallTracer* CreateNewServerCallTracer(
+  grpc_core::ServerCallTracerInterface* CreateNewServerCallTracer(
       grpc_core::Arena* arena, const grpc_core::ChannelArgs& /*args*/) override;
 };
 
diff --git a/deps/grpc/src/cpp/ext/otel/key_value_iterable.h b/deps/grpc/src/cpp/ext/otel/key_value_iterable.h
index c6f7f154f3e..77da36213c5 100644
--- a/deps/grpc/src/cpp/ext/otel/key_value_iterable.h
+++ b/deps/grpc/src/cpp/ext/otel/key_value_iterable.h
@@ -100,17 +100,18 @@ class OpenTelemetryPluginImpl::KeyValueIterable
     }
     // Add per-call optional labels
     if (!optional_labels_.empty()) {
-      CHECK(optional_labels_.size() ==
-            static_cast<size_t>(grpc_core::ClientCallTracer::CallAttemptTracer::
-                                    OptionalLabelKey::kSize));
+      CHECK(
+          optional_labels_.size() ==
+          static_cast<size_t>(grpc_core::ClientCallTracerInterface::
+                                  CallAttemptTracer::OptionalLabelKey::kSize));
       for (size_t i = 0; i < optional_labels_.size(); ++i) {
         if (!otel_plugin_->per_call_optional_label_bits_.test(i)) {
           continue;
         }
         if (!callback(
                 AbslStrViewToOpenTelemetryStrView(OptionalLabelKeyToString(
-                    static_cast<grpc_core::ClientCallTracer::CallAttemptTracer::
-                                    OptionalLabelKey>(i))),
+                    static_cast<grpc_core::ClientCallTracerInterface::
+                                    CallAttemptTracer::OptionalLabelKey>(i))),
                 AbslStrViewToOpenTelemetryStrView(
                     optional_labels_[i].as_string_view()))) {
           return false;
diff --git a/deps/grpc/src/cpp/ext/otel/otel_client_call_tracer.cc b/deps/grpc/src/cpp/ext/otel/otel_client_call_tracer.cc
index 8d6c1b546b4..662d215b539 100644
--- a/deps/grpc/src/cpp/ext/otel/otel_client_call_tracer.cc
+++ b/deps/grpc/src/cpp/ext/otel/otel_client_call_tracer.cc
@@ -65,12 +65,13 @@ namespace grpc {
 namespace internal {
 
 template <typename UnrefBehavior>
-class OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+class OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::TcpCallTracer : public grpc_core::TcpCallTracer {
  public:
   explicit TcpCallTracer(
-      grpc_core::RefCountedPtr<OpenTelemetryPluginImpl::ClientCallTracer::
-                                   CallAttemptTracer<UnrefBehavior>>
+      grpc_core::RefCountedPtr<
+          OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
+              UnrefBehavior>>
           call_attempt_tracer)
       : call_attempt_tracer_(std::move(call_attempt_tracer)) {
     // Take a ref on the call if tracing is enabled, since TCP traces might
@@ -78,7 +79,8 @@ class OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
     call_attempt_tracer_->parent_->arena_
         ->template GetContext<grpc_core::Call>()
         ->InternalRef(
-            "OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer::"
+            "OpenTelemetryPluginImpl::ClientCallTracerInterface::"
+            "CallAttemptTracer::"
             "TcpCallTracer");
   }
 
@@ -89,7 +91,8 @@ class OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
     // reset before unreffing the call.
     call_attempt_tracer_.reset();
     arena->template GetContext<grpc_core::Call>()->InternalUnref(
-        "OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer::~"
+        "OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer:"
+        ":~"
         "TcpCallTracer");
   }
 
@@ -105,18 +108,19 @@ class OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
   }
 
  private:
-  grpc_core::RefCountedPtr<OpenTelemetryPluginImpl::ClientCallTracer::
+  grpc_core::RefCountedPtr<OpenTelemetryPluginImpl::ClientCallTracerInterface::
                                CallAttemptTracer<UnrefBehavior>>
       call_attempt_tracer_;
 };
 
 //
-// OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer
+// OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer
 //
 template <typename UnrefBehavior>
-OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<UnrefBehavior>::
-    CallAttemptTracer(const OpenTelemetryPluginImpl::ClientCallTracer* parent,
-                      uint64_t attempt_num, bool is_transparent_retry)
+OpenTelemetryPluginImpl::ClientCallTracerInterface::
+    CallAttemptTracer<UnrefBehavior>::CallAttemptTracer(
+        OpenTelemetryPluginImpl::ClientCallTracerInterface* const parent,
+        uint64_t attempt_num, bool is_transparent_retry)
     : parent_(parent), start_time_(absl::Now()) {
   if (parent_->otel_plugin_->client_.attempt.started != nullptr) {
     std::array<std::pair<absl::string_view, absl::string_view>, 2>
@@ -148,7 +152,7 @@ OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<UnrefBehavior>::
 }
 
 template <typename UnrefBehavior>
-OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::~CallAttemptTracer<UnrefBehavior>() {
   if (span_ != nullptr) {
     span_->End();
@@ -156,7 +160,7 @@ OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::RecordReceivedInitialMetadata(grpc_metadata_batch*
                                                       recv_initial_metadata) {
   if (recv_initial_metadata != nullptr &&
@@ -169,7 +173,7 @@ void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::RecordSendInitialMetadata(grpc_metadata_batch*
                                                   send_initial_metadata) {
   parent_->scope_config_->active_plugin_options_view().ForEach(
@@ -183,10 +187,12 @@ void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
       },
       parent_->otel_plugin_);
   if (span_ != nullptr) {
-    GrpcTextMapCarrier carrier(send_initial_metadata);
-    opentelemetry::context::Context context;
-    context = opentelemetry::trace::SetSpan(context, span_);
-    parent_->otel_plugin_->text_map_propagator_->Inject(carrier, context);
+    if (parent_->otel_plugin_->text_map_propagator_ != nullptr) {
+      GrpcTextMapCarrier carrier(send_initial_metadata);
+      opentelemetry::context::Context context;
+      context = opentelemetry::trace::SetSpan(context, span_);
+      parent_->otel_plugin_->text_map_propagator_->Inject(carrier, context);
+    }
     if (IsSampled()) {
       parent_->arena_->GetContext<grpc_core::Call>()->set_traced(true);
     }
@@ -194,7 +200,7 @@ void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::RecordSendMessage(const grpc_core::Message& send_message) {
   if (span_ != nullptr) {
     std::array<std::pair<opentelemetry::nostd::string_view,
@@ -208,7 +214,7 @@ void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::RecordSendCompressedMessage(const grpc_core::Message&
                                                     send_compressed_message) {
   if (span_ != nullptr) {
@@ -226,7 +232,7 @@ void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::RecordReceivedMessage(const grpc_core::Message&
                                               recv_message) {
   if (span_ != nullptr) {
@@ -249,7 +255,7 @@ void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::
     CallAttemptTracer<UnrefBehavior>::RecordReceivedDecompressedMessage(
         const grpc_core::Message& recv_decompressed_message) {
   if (span_ != nullptr) {
@@ -267,7 +273,7 @@ void OpenTelemetryPluginImpl::ClientCallTracer::
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::
     CallAttemptTracer<UnrefBehavior>::RecordReceivedTrailingMetadata(
         absl::Status status, grpc_metadata_batch* recv_trailing_metadata,
         const grpc_transport_stream_stats* transport_stream_stats) {
@@ -310,6 +316,12 @@ void OpenTelemetryPluginImpl::ClientCallTracer::
     parent_->otel_plugin_->client_.attempt.rcvd_total_compressed_message_size
         ->Record(incoming_bytes, labels, opentelemetry::context::Context{});
   }
+  if (parent_->otel_plugin_->client_.call.retry_delay != nullptr) {
+    grpc_core::MutexLock lock(&parent_->mu_);
+    if (--parent_->num_active_attempts_ == 0) {
+      parent_->time_at_last_attempt_end_ = absl::Now();
+    }
+  }
   if (span_ != nullptr) {
     if (status.ok()) {
       span_->SetStatus(opentelemetry::trace::StatusCode::kOk);
@@ -321,31 +333,31 @@ void OpenTelemetryPluginImpl::ClientCallTracer::
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::RecordIncomingBytes(const TransportByteSize&
                                             transport_byte_size) {
   incoming_bytes_.fetch_add(transport_byte_size.data_bytes);
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::RecordOutgoingBytes(const TransportByteSize&
                                             transport_byte_size) {
   outgoing_bytes_.fetch_add(transport_byte_size.data_bytes);
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::RecordCancel(absl::Status /*cancel_error*/) {}
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::RecordEnd() {
   this->Unref(DEBUG_LOCATION, "RecordEnd");
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::RecordAnnotation(absl::string_view annotation) {
   if (span_ != nullptr) {
     span_->AddEvent(AbslStringViewToNoStdStringView(annotation));
@@ -353,13 +365,13 @@ void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::RecordAnnotation(const Annotation& /*annotation*/) {
   // Not implemented
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::RecordAnnotation(absl::string_view annotation,
                                      absl::Time time) {
   if (span_ != nullptr) {
@@ -369,8 +381,9 @@ void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
 }
 
 template <typename UnrefBehavior>
-std::shared_ptr<grpc_core::TcpCallTracer> OpenTelemetryPluginImpl::
-    ClientCallTracer::CallAttemptTracer<UnrefBehavior>::StartNewTcpTrace() {
+std::shared_ptr<grpc_core::TcpCallTracer>
+OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
+    UnrefBehavior>::StartNewTcpTrace() {
   if (span_ != nullptr) {
     return std::make_shared<TcpCallTracer>(
         this->Ref(DEBUG_LOCATION, "StartNewTcpTrace"));
@@ -379,7 +392,7 @@ std::shared_ptr<grpc_core::TcpCallTracer> OpenTelemetryPluginImpl::
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::SetOptionalLabel(OptionalLabelKey key,
                                      grpc_core::RefCountedStringValue value) {
   CHECK(key < OptionalLabelKey::kSize);
@@ -387,7 +400,7 @@ void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
 }
 
 template <typename UnrefBehavior>
-void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::CallAttemptTracer<
     UnrefBehavior>::PopulateLabelInjectors(grpc_metadata_batch* metadata) {
   parent_->scope_config_->active_plugin_options_view().ForEach(
       [&](const InternalOpenTelemetryPluginOption& plugin_option,
@@ -403,10 +416,10 @@ void OpenTelemetryPluginImpl::ClientCallTracer::CallAttemptTracer<
 }
 
 //
-// OpenTelemetryPluginImpl::ClientCallTracer
+// OpenTelemetryPluginImpl::ClientCallTracerInterface
 //
 
-OpenTelemetryPluginImpl::ClientCallTracer::ClientCallTracer(
+OpenTelemetryPluginImpl::ClientCallTracerInterface::ClientCallTracerInterface(
     const grpc_core::Slice& path, grpc_core::Arena* arena,
     bool registered_method, OpenTelemetryPluginImpl* otel_plugin,
     std::shared_ptr<OpenTelemetryPluginImpl::ClientScopeConfig> scope_config)
@@ -440,14 +453,41 @@ OpenTelemetryPluginImpl::ClientCallTracer::ClientCallTracer(
   }
 }
 
-OpenTelemetryPluginImpl::ClientCallTracer::~ClientCallTracer() {
+OpenTelemetryPluginImpl::ClientCallTracerInterface::
+    ~ClientCallTracerInterface() {
+  std::array<std::pair<opentelemetry::nostd::string_view,
+                       opentelemetry::common::AttributeValue>,
+             2>
+      attributes = {
+          std::pair(AbslStringViewToNoStdStringView(OpenTelemetryMethodKey()),
+                    opentelemetry::common::AttributeValue(
+                        AbslStringViewToNoStdStringView(MethodForStats()))),
+          std::pair(AbslStringViewToNoStdStringView(OpenTelemetryTargetKey()),
+                    opentelemetry::common::AttributeValue(
+                        AbslStringViewToNoStdStringView(
+                            scope_config_->filtered_target())))};
+  if (otel_plugin_->client_.call.retries != nullptr && retries_ > 1) {
+    otel_plugin_->client_.call.retries->Record(
+        retries_ - 1, attributes, opentelemetry::context::Context{});
+  }
+  if (otel_plugin_->client_.call.transparent_retries != nullptr &&
+      transparent_retries_ != 0) {
+    otel_plugin_->client_.call.transparent_retries->Record(
+        transparent_retries_, attributes, opentelemetry::context::Context{});
+  }
+  if (otel_plugin_->client_.call.retry_delay != nullptr &&
+      retry_delay_ != absl::ZeroDuration() && retries_ > 1) {
+    otel_plugin_->client_.call.retry_delay->Record(
+        absl::ToDoubleSeconds(retry_delay_), attributes,
+        opentelemetry::context::Context{});
+  }
   if (span_ != nullptr) {
     span_->End();
   }
 }
 
-grpc_core::ClientCallTracer::CallAttemptTracer*
-OpenTelemetryPluginImpl::ClientCallTracer::StartNewAttempt(
+grpc_core::ClientCallTracerInterface::CallAttemptTracer*
+OpenTelemetryPluginImpl::ClientCallTracerInterface::StartNewAttempt(
     bool is_transparent_retry) {
   // We allocate the first attempt on the arena and all subsequent attempts
   // on the heap, so that in the common case we don't require a heap
@@ -458,6 +498,10 @@ OpenTelemetryPluginImpl::ClientCallTracer::StartNewAttempt(
     grpc_core::MutexLock lock(&mu_);
     if (transparent_retries_ != 0 || retries_ != 0) {
       is_first_attempt = false;
+      if (otel_plugin_->client_.call.retry_delay != nullptr &&
+          num_active_attempts_ == 0 && !is_transparent_retry) {
+        retry_delay_ += absl::Now() - time_at_last_attempt_end_;
+      }
     }
     if (is_transparent_retry) {
       ++transparent_retries_;
@@ -465,6 +509,7 @@ OpenTelemetryPluginImpl::ClientCallTracer::StartNewAttempt(
       ++retries_;
     }
     attempt_num = retries_ - 1;  // Sequence starts at 0
+    ++num_active_attempts_;
   }
   if (is_first_attempt) {
     return arena_
@@ -476,8 +521,8 @@ OpenTelemetryPluginImpl::ClientCallTracer::StartNewAttempt(
                                                        is_transparent_retry);
 }
 
-absl::string_view OpenTelemetryPluginImpl::ClientCallTracer::MethodForStats()
-    const {
+absl::string_view
+OpenTelemetryPluginImpl::ClientCallTracerInterface::MethodForStats() const {
   absl::string_view method = absl::StripPrefix(path_.as_string_view(), "/");
   if (registered_method_ ||
       (otel_plugin_->generic_method_attribute_filter() != nullptr &&
@@ -487,14 +532,14 @@ absl::string_view OpenTelemetryPluginImpl::ClientCallTracer::MethodForStats()
   return "other";
 }
 
-void OpenTelemetryPluginImpl::ClientCallTracer::RecordAnnotation(
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::RecordAnnotation(
     absl::string_view annotation) {
   if (span_ != nullptr) {
     span_->AddEvent(AbslStringViewToNoStdStringView(annotation));
   }
 }
 
-void OpenTelemetryPluginImpl::ClientCallTracer::RecordAnnotation(
+void OpenTelemetryPluginImpl::ClientCallTracerInterface::RecordAnnotation(
     const Annotation& /*annotation*/) {
   // Not implemented
 }
diff --git a/deps/grpc/src/cpp/ext/otel/otel_client_call_tracer.h b/deps/grpc/src/cpp/ext/otel/otel_client_call_tracer.h
index 6d3ec7f7a47..b6240e4e2d8 100644
--- a/deps/grpc/src/cpp/ext/otel/otel_client_call_tracer.h
+++ b/deps/grpc/src/cpp/ext/otel/otel_client_call_tracer.h
@@ -45,18 +45,19 @@
 namespace grpc {
 namespace internal {
 
-class OpenTelemetryPluginImpl::ClientCallTracer
-    : public grpc_core::ClientCallTracer {
+class OpenTelemetryPluginImpl::ClientCallTracerInterface
+    : public grpc_core::ClientCallTracerInterface {
  public:
   template <typename UnrefBehavior>
   class CallAttemptTracer
-      : public grpc_core::ClientCallTracer::CallAttemptTracer,
+      : public grpc_core::ClientCallTracerInterface::CallAttemptTracer,
         public grpc_core::RefCounted<CallAttemptTracer<UnrefBehavior>,
                                      grpc_core::NonPolymorphicRefCount,
                                      UnrefBehavior> {
    public:
-    CallAttemptTracer(const OpenTelemetryPluginImpl::ClientCallTracer* parent,
-                      uint64_t attempt_num, bool is_transparent_retry);
+    CallAttemptTracer(
+        OpenTelemetryPluginImpl::ClientCallTracerInterface* const parent,
+        uint64_t attempt_num, bool is_transparent_retry);
 
     ~CallAttemptTracer() override;
 
@@ -105,7 +106,7 @@ class OpenTelemetryPluginImpl::ClientCallTracer
 
     void PopulateLabelInjectors(grpc_metadata_batch* metadata);
 
-    const ClientCallTracer* parent_;
+    ClientCallTracerInterface* const parent_;
     // Start time (for measuring latency).
     absl::Time start_time_;
     std::unique_ptr<LabelsIterable> injected_labels_;
@@ -127,11 +128,11 @@ class OpenTelemetryPluginImpl::ClientCallTracer
     uint64_t recv_seq_num_ = 0;
   };
 
-  ClientCallTracer(
+  ClientCallTracerInterface(
       const grpc_core::Slice& path, grpc_core::Arena* arena,
       bool registered_method, OpenTelemetryPluginImpl* otel_plugin,
       std::shared_ptr<OpenTelemetryPluginImpl::ClientScopeConfig> scope_config);
-  ~ClientCallTracer() override;
+  ~ClientCallTracerInterface() override;
 
   std::string TraceId() override {
     return OTelSpanTraceIdToString(span_.get());
@@ -143,7 +144,7 @@ class OpenTelemetryPluginImpl::ClientCallTracer
     return span_ != nullptr && span_->GetContext().IsSampled();
   }
 
-  grpc_core::ClientCallTracer::CallAttemptTracer* StartNewAttempt(
+  grpc_core::ClientCallTracerInterface::CallAttemptTracer* StartNewAttempt(
       bool is_transparent_retry) override;
   void RecordAnnotation(absl::string_view annotation) override;
   void RecordAnnotation(const Annotation& /*annotation*/) override;
@@ -157,11 +158,18 @@ class OpenTelemetryPluginImpl::ClientCallTracer
   const bool registered_method_;
   OpenTelemetryPluginImpl* otel_plugin_;
   std::shared_ptr<OpenTelemetryPluginImpl::ClientScopeConfig> scope_config_;
+  // TODO(ctiller@): When refactoring the tracer code, consider the possibility
+  // of removing this mutex. More discussion in
+  // https://github.com/grpc/grpc/pull/39195/files#r2191231973.
   grpc_core::Mutex mu_;
-  // Non-transparent attempts per call (including first attempt)
+  // Non-transparent retry attempts per call (includes initial attempt)
   uint64_t retries_ ABSL_GUARDED_BY(&mu_) = 0;
   // Transparent retries per call
   uint64_t transparent_retries_ ABSL_GUARDED_BY(&mu_) = 0;
+  // Retry delay
+  absl::Duration retry_delay_ ABSL_GUARDED_BY(&mu_);
+  absl::Time time_at_last_attempt_end_ ABSL_GUARDED_BY(&mu_);
+  uint64_t num_active_attempts_ ABSL_GUARDED_BY(&mu_) = 0;
   opentelemetry::nostd::shared_ptr<opentelemetry::trace::Span> span_;
 };
 
diff --git a/deps/grpc/src/cpp/ext/otel/otel_plugin.cc b/deps/grpc/src/cpp/ext/otel/otel_plugin.cc
index b20eeb7fc1f..2def64952d2 100644
--- a/deps/grpc/src/cpp/ext/otel/otel_plugin.cc
+++ b/deps/grpc/src/cpp/ext/otel/otel_plugin.cc
@@ -502,9 +502,36 @@ OpenTelemetryPluginImpl::OpenTelemetryPluginImpl(
                       kServerCallRcvdTotalCompressedMessageSizeInstrumentName),
               "Compressed message bytes received per server call", "By");
     }
+    if (metrics.contains(grpc::OpenTelemetryPluginBuilder::
+                             kClientCallRetriesInstrumentName)) {
+      client_.call.retries = meter->CreateUInt64Histogram(
+          std::string(grpc::OpenTelemetryPluginBuilder::
+                          kClientCallRetriesInstrumentName),
+          "EXPERIMENTAL: Number of retries during the client call. If there "
+          "were no retries, 0 is not reported.",
+          "{retry}");
+    }
+    if (metrics.contains(grpc::OpenTelemetryPluginBuilder::
+                             kClientCallTransparentRetriesInstrumentName)) {
+      client_.call.transparent_retries = meter->CreateUInt64Histogram(
+          std::string(grpc::OpenTelemetryPluginBuilder::
+                          kClientCallTransparentRetriesInstrumentName),
+          "EXPERIMENTAL: Number of transparent retries during the client call. "
+          "If there were no transparent retries, 0 is not reported.",
+          "{transparent_retry}");
+    }
+    if (metrics.contains(grpc::OpenTelemetryPluginBuilder::
+                             kClientCallRetryDelayInstrumentName)) {
+      client_.call.retry_delay = meter->CreateDoubleHistogram(
+          std::string(grpc::OpenTelemetryPluginBuilder::
+                          kClientCallRetryDelayInstrumentName),
+          "EXPERIMENTAL: Total time of delay while there is no active attempt "
+          "during the client call",
+          "s");
+    }
     // Store optional label keys for per call metrics
-    CHECK(static_cast<size_t>(grpc_core::ClientCallTracer::CallAttemptTracer::
-                                  OptionalLabelKey::kSize) <=
+    CHECK(static_cast<size_t>(grpc_core::ClientCallTracerInterface::
+                                  CallAttemptTracer::OptionalLabelKey::kSize) <=
           kOptionalLabelsSizeLimit);
     for (const auto& key : optional_label_keys) {
       auto optional_key = OptionalLabelStringToKey(key);
@@ -659,21 +686,23 @@ constexpr absl::string_view kLocality = "grpc.lb.locality";
 }
 
 absl::string_view OpenTelemetryPluginImpl::OptionalLabelKeyToString(
-    grpc_core::ClientCallTracer::CallAttemptTracer::OptionalLabelKey key) {
+    grpc_core::ClientCallTracerInterface::CallAttemptTracer::OptionalLabelKey
+        key) {
   switch (key) {
-    case grpc_core::ClientCallTracer::CallAttemptTracer::OptionalLabelKey::
-        kLocality:
+    case grpc_core::ClientCallTracerInterface::CallAttemptTracer::
+        OptionalLabelKey::kLocality:
       return kLocality;
     default:
       grpc_core::Crash("Illegal OptionalLabelKey index");
   }
 }
 
-std::optional<grpc_core::ClientCallTracer::CallAttemptTracer::OptionalLabelKey>
+std::optional<
+    grpc_core::ClientCallTracerInterface::CallAttemptTracer::OptionalLabelKey>
 OpenTelemetryPluginImpl::OptionalLabelStringToKey(absl::string_view key) {
   if (key == kLocality) {
-    return grpc_core::ClientCallTracer::CallAttemptTracer::OptionalLabelKey::
-        kLocality;
+    return grpc_core::ClientCallTracerInterface::CallAttemptTracer::
+        OptionalLabelKey::kLocality;
   }
   return std::nullopt;
 }
@@ -1039,22 +1068,24 @@ void OpenTelemetryPluginImpl::CallbackGaugeState<ValueType>::
   }
 }
 
-grpc_core::ClientCallTracer* OpenTelemetryPluginImpl::GetClientCallTracer(
+grpc_core::ClientCallTracerInterface*
+OpenTelemetryPluginImpl::GetClientCallTracer(
     const grpc_core::Slice& path, bool registered_method,
     std::shared_ptr<grpc_core::StatsPlugin::ScopeConfig> scope_config) {
   return grpc_core::GetContext<grpc_core::Arena>()
-      ->ManagedNew<ClientCallTracer>(
+      ->ManagedNew<ClientCallTracerInterface>(
           path, grpc_core::GetContext<grpc_core::Arena>(), registered_method,
           this,
           std::static_pointer_cast<OpenTelemetryPluginImpl::ClientScopeConfig>(
               scope_config));
 }
 
-grpc_core::ServerCallTracer* OpenTelemetryPluginImpl::GetServerCallTracer(
+grpc_core::ServerCallTracerInterface*
+OpenTelemetryPluginImpl::GetServerCallTracer(
     std::shared_ptr<grpc_core::StatsPlugin::ScopeConfig> scope_config) {
   auto arena = grpc_core::GetContext<grpc_core::Arena>();
   return arena
-      ->MakeRefCounted<ServerCallTracer>(
+      ->MakeRefCounted<ServerCallTracerInterface>(
           this, arena,
           std::static_pointer_cast<OpenTelemetryPluginImpl::ServerScopeConfig>(
               scope_config))
diff --git a/deps/grpc/src/cpp/ext/otel/otel_plugin.h b/deps/grpc/src/cpp/ext/otel/otel_plugin.h
index 415d727066d..3c53aafb309 100644
--- a/deps/grpc/src/cpp/ext/otel/otel_plugin.h
+++ b/deps/grpc/src/cpp/ext/otel/otel_plugin.h
@@ -241,10 +241,10 @@ class OpenTelemetryPluginImpl
   ~OpenTelemetryPluginImpl() override;
 
  private:
-  class ClientCallTracer;
+  class ClientCallTracerInterface;
   class KeyValueIterable;
   class NPCMetricsKeyValueIterable;
-  class ServerCallTracer;
+  class ServerCallTracerInterface;
 
   // Creates a convenience wrapper to help iterate over only those plugin
   // options that are active over a given channel/server.
@@ -356,6 +356,12 @@ class OpenTelemetryPluginImpl
   };
 
   struct ClientMetrics {
+    struct Call {
+      std::unique_ptr<opentelemetry::metrics::Histogram<uint64_t>> retries;
+      std::unique_ptr<opentelemetry::metrics::Histogram<uint64_t>>
+          transparent_retries;
+      std::unique_ptr<opentelemetry::metrics::Histogram<double>> retry_delay;
+    } call;
     struct Attempt {
       std::unique_ptr<opentelemetry::metrics::Counter<uint64_t>> started;
       std::unique_ptr<opentelemetry::metrics::Histogram<double>> duration;
@@ -416,12 +422,13 @@ class OpenTelemetryPluginImpl
 
   // Returns the string form of \a key
   static absl::string_view OptionalLabelKeyToString(
-      grpc_core::ClientCallTracer::CallAttemptTracer::OptionalLabelKey key);
+      grpc_core::ClientCallTracerInterface::CallAttemptTracer::OptionalLabelKey
+          key);
 
   // Returns the OptionalLabelKey form of \a key if \a key is recognized and
   // is public, std::nullopt otherwise.
   static std::optional<
-      grpc_core::ClientCallTracer::CallAttemptTracer::OptionalLabelKey>
+      grpc_core::ClientCallTracerInterface::CallAttemptTracer::OptionalLabelKey>
   OptionalLabelStringToKey(absl::string_view key);
 
   static absl::string_view GetMethodFromPath(const grpc_core::Slice& path);
@@ -460,11 +467,11 @@ class OpenTelemetryPluginImpl
       ABSL_LOCKS_EXCLUDED(mu_) override;
   void RemoveCallback(grpc_core::RegisteredMetricCallback* callback)
       ABSL_LOCKS_EXCLUDED(mu_) override;
-  grpc_core::ClientCallTracer* GetClientCallTracer(
+  grpc_core::ClientCallTracerInterface* GetClientCallTracer(
       const grpc_core::Slice& path, bool registered_method,
       std::shared_ptr<grpc_core::StatsPlugin::ScopeConfig> scope_config)
       override;
-  grpc_core::ServerCallTracer* GetServerCallTracer(
+  grpc_core::ServerCallTracerInterface* GetServerCallTracer(
       std::shared_ptr<grpc_core::StatsPlugin::ScopeConfig> scope_config)
       override;
   bool IsInstrumentEnabled(
diff --git a/deps/grpc/src/cpp/ext/otel/otel_server_call_tracer.cc b/deps/grpc/src/cpp/ext/otel/otel_server_call_tracer.cc
index 62403849c8f..c41526d54b5 100644
--- a/deps/grpc/src/cpp/ext/otel/otel_server_call_tracer.cc
+++ b/deps/grpc/src/cpp/ext/otel/otel_server_call_tracer.cc
@@ -53,27 +53,27 @@
 namespace grpc {
 namespace internal {
 
-class OpenTelemetryPluginImpl::ServerCallTracer::TcpCallTracer
+class OpenTelemetryPluginImpl::ServerCallTracerInterface::TcpCallTracer
     : public grpc_core::TcpCallTracer {
  public:
-  explicit TcpCallTracer(
-      grpc_core::RefCountedPtr<OpenTelemetryPluginImpl::ServerCallTracer>
-          server_call_tracer)
+  explicit TcpCallTracer(grpc_core::RefCountedPtr<
+                         OpenTelemetryPluginImpl::ServerCallTracerInterface>
+                             server_call_tracer)
       : server_call_tracer_(server_call_tracer) {
     // Take a ref on the call if tracing is enabled, since TCP traces might
     // arrive after all the other refs on the call are gone.
     server_call_tracer_->arena_->GetContext<grpc_core::Call>()->InternalRef(
-        "OpenTelemetryPluginImpl::ServerCallTracer::TcpCallTracer");
+        "OpenTelemetryPluginImpl::ServerCallTracerInterface::TcpCallTracer");
   }
 
   ~TcpCallTracer() override {
     grpc_core::ExecCtx exec_ctx;
     auto* arena = server_call_tracer_->arena_;
-    // The ServerCallTracer is allocated on the arena and hence needs to be
-    // reset before unreffing the call.
+    // The ServerCallTracerInterface is allocated on the arena and hence needs
+    // to be reset before unreffing the call.
     server_call_tracer_.reset();
     arena->GetContext<grpc_core::Call>()->InternalUnref(
-        "OpenTelemetryPluginImpl::ServerCallTracer::~TcpCallTracer");
+        "OpenTelemetryPluginImpl::ServerCallTracerInterface::~TcpCallTracer");
   }
 
   void RecordEvent(grpc_event_engine::experimental::internal::WriteEvent type,
@@ -88,11 +88,11 @@ class OpenTelemetryPluginImpl::ServerCallTracer::TcpCallTracer
   }
 
  private:
-  grpc_core::RefCountedPtr<OpenTelemetryPluginImpl::ServerCallTracer>
+  grpc_core::RefCountedPtr<OpenTelemetryPluginImpl::ServerCallTracerInterface>
       server_call_tracer_;
 };
 
-OpenTelemetryPluginImpl::ServerCallTracer::ServerCallTracer(
+OpenTelemetryPluginImpl::ServerCallTracerInterface::ServerCallTracerInterface(
     OpenTelemetryPluginImpl* otel_plugin, grpc_core::Arena* arena,
     std::shared_ptr<OpenTelemetryPluginImpl::ServerScopeConfig> scope_config)
     : start_time_(absl::Now()),
@@ -102,14 +102,15 @@ OpenTelemetryPluginImpl::ServerCallTracer::ServerCallTracer(
       arena_(arena),
       scope_config_(std::move(scope_config)) {}
 
-OpenTelemetryPluginImpl::ServerCallTracer::~ServerCallTracer() {
+OpenTelemetryPluginImpl::ServerCallTracerInterface::
+    ~ServerCallTracerInterface() {
   if (span_ != nullptr) {
     span_->End();
   }
 }
 
-void OpenTelemetryPluginImpl::ServerCallTracer::RecordReceivedInitialMetadata(
-    grpc_metadata_batch* recv_initial_metadata) {
+void OpenTelemetryPluginImpl::ServerCallTracerInterface::
+    RecordReceivedInitialMetadata(grpc_metadata_batch* recv_initial_metadata) {
   path_ =
       recv_initial_metadata->get_pointer(grpc_core::HttpPathMetadata())->Ref();
   scope_config_->active_plugin_options_view().ForEach(
@@ -138,11 +139,13 @@ void OpenTelemetryPluginImpl::ServerCallTracer::RecordReceivedInitialMetadata(
                             /*is_client=*/false, otel_plugin_));
   }
   if (otel_plugin_->tracer_ != nullptr) {
-    GrpcTextMapCarrier carrier(recv_initial_metadata);
-    opentelemetry::context::Context context;
-    context = otel_plugin_->text_map_propagator_->Extract(carrier, context);
     opentelemetry::trace::StartSpanOptions options;
-    options.parent = context;
+    if (otel_plugin_->text_map_propagator_ != nullptr) {
+      GrpcTextMapCarrier carrier(recv_initial_metadata);
+      opentelemetry::context::Context context;
+      context = otel_plugin_->text_map_propagator_->Extract(carrier, context);
+      options.parent = context;
+    }
     span_ = otel_plugin_->tracer_->StartSpan(
         absl::StrCat("Recv.", GetMethodFromPath(path_)), options);
     // We are intentionally reusing census_context to save opentelemetry's Span
@@ -157,7 +160,7 @@ void OpenTelemetryPluginImpl::ServerCallTracer::RecordReceivedInitialMetadata(
   }
 }
 
-void OpenTelemetryPluginImpl::ServerCallTracer::RecordReceivedMessage(
+void OpenTelemetryPluginImpl::ServerCallTracerInterface::RecordReceivedMessage(
     const grpc_core::Message& recv_message) {
   if (span_ != nullptr) {
     std::array<std::pair<opentelemetry::nostd::string_view,
@@ -178,7 +181,7 @@ void OpenTelemetryPluginImpl::ServerCallTracer::RecordReceivedMessage(
   }
 }
 
-void OpenTelemetryPluginImpl::ServerCallTracer::
+void OpenTelemetryPluginImpl::ServerCallTracerInterface::
     RecordReceivedDecompressedMessage(
         const grpc_core::Message& recv_decompressed_message) {
   if (span_ != nullptr) {
@@ -195,8 +198,8 @@ void OpenTelemetryPluginImpl::ServerCallTracer::
   }
 }
 
-void OpenTelemetryPluginImpl::ServerCallTracer::RecordSendInitialMetadata(
-    grpc_metadata_batch* send_initial_metadata) {
+void OpenTelemetryPluginImpl::ServerCallTracerInterface::
+    RecordSendInitialMetadata(grpc_metadata_batch* send_initial_metadata) {
   scope_config_->active_plugin_options_view().ForEach(
       [&](const InternalOpenTelemetryPluginOption& plugin_option,
           size_t index) {
@@ -211,7 +214,7 @@ void OpenTelemetryPluginImpl::ServerCallTracer::RecordSendInitialMetadata(
       otel_plugin_);
 }
 
-void OpenTelemetryPluginImpl::ServerCallTracer::RecordSendMessage(
+void OpenTelemetryPluginImpl::ServerCallTracerInterface::RecordSendMessage(
     const grpc_core::Message& send_message) {
   if (span_ != nullptr) {
     std::array<std::pair<opentelemetry::nostd::string_view,
@@ -224,8 +227,9 @@ void OpenTelemetryPluginImpl::ServerCallTracer::RecordSendMessage(
   }
 }
 
-void OpenTelemetryPluginImpl::ServerCallTracer::RecordSendCompressedMessage(
-    const grpc_core::Message& send_compressed_message) {
+void OpenTelemetryPluginImpl::ServerCallTracerInterface::
+    RecordSendCompressedMessage(
+        const grpc_core::Message& send_compressed_message) {
   if (span_ != nullptr) {
     std::array<std::pair<opentelemetry::nostd::string_view,
                          opentelemetry::common::AttributeValue>,
@@ -240,14 +244,15 @@ void OpenTelemetryPluginImpl::ServerCallTracer::RecordSendCompressedMessage(
   }
 }
 
-void OpenTelemetryPluginImpl::ServerCallTracer::RecordSendTrailingMetadata(
-    grpc_metadata_batch* /*send_trailing_metadata*/) {
+void OpenTelemetryPluginImpl::ServerCallTracerInterface::
+    RecordSendTrailingMetadata(
+        grpc_metadata_batch* /*send_trailing_metadata*/) {
   // We need to record the time when the trailing metadata was sent to
   // mark the completeness of the request.
   elapsed_time_ = absl::Now() - start_time_;
 }
 
-void OpenTelemetryPluginImpl::ServerCallTracer::RecordEnd(
+void OpenTelemetryPluginImpl::ServerCallTracerInterface::RecordEnd(
     const grpc_call_final_info* final_info) {
   std::array<std::pair<absl::string_view, absl::string_view>, 2>
       additional_labels = {
@@ -294,24 +299,24 @@ void OpenTelemetryPluginImpl::ServerCallTracer::RecordEnd(
   Unref(DEBUG_LOCATION, "RecordEnd");
 }
 
-void OpenTelemetryPluginImpl::ServerCallTracer::RecordIncomingBytes(
+void OpenTelemetryPluginImpl::ServerCallTracerInterface::RecordIncomingBytes(
     const TransportByteSize& transport_byte_size) {
   incoming_bytes_.fetch_add(transport_byte_size.data_bytes);
 }
 
-void OpenTelemetryPluginImpl::ServerCallTracer::RecordOutgoingBytes(
+void OpenTelemetryPluginImpl::ServerCallTracerInterface::RecordOutgoingBytes(
     const TransportByteSize& transport_byte_size) {
   outgoing_bytes_.fetch_add(transport_byte_size.data_bytes);
 }
 
-void OpenTelemetryPluginImpl::ServerCallTracer::RecordAnnotation(
+void OpenTelemetryPluginImpl::ServerCallTracerInterface::RecordAnnotation(
     absl::string_view annotation) {
   if (span_ != nullptr) {
     span_->AddEvent(AbslStringViewToNoStdStringView(annotation));
   }
 }
 
-void OpenTelemetryPluginImpl::ServerCallTracer::RecordAnnotation(
+void OpenTelemetryPluginImpl::ServerCallTracerInterface::RecordAnnotation(
     absl::string_view annotation, absl::Time time) {
   if (span_ != nullptr) {
     span_->AddEvent(AbslStringViewToNoStdStringView(annotation),
@@ -320,7 +325,7 @@ void OpenTelemetryPluginImpl::ServerCallTracer::RecordAnnotation(
 }
 
 std::shared_ptr<grpc_core::TcpCallTracer>
-OpenTelemetryPluginImpl::ServerCallTracer::StartNewTcpTrace() {
+OpenTelemetryPluginImpl::ServerCallTracerInterface::StartNewTcpTrace() {
   if (span_ != nullptr) {
     return std::make_shared<TcpCallTracer>(
         Ref(DEBUG_LOCATION, "StartNewTcpTrace"));
diff --git a/deps/grpc/src/cpp/ext/otel/otel_server_call_tracer.h b/deps/grpc/src/cpp/ext/otel/otel_server_call_tracer.h
index f1da90c6998..d80945920ad 100644
--- a/deps/grpc/src/cpp/ext/otel/otel_server_call_tracer.h
+++ b/deps/grpc/src/cpp/ext/otel/otel_server_call_tracer.h
@@ -29,18 +29,18 @@
 namespace grpc {
 namespace internal {
 
-// OpenTelemetryPluginImpl::ServerCallTracer implementation
-class OpenTelemetryPluginImpl::ServerCallTracer
-    : public grpc_core::ServerCallTracer,
-      public grpc_core::RefCounted<ServerCallTracer,
+// OpenTelemetryPluginImpl::ServerCallTracerInterface implementation
+class OpenTelemetryPluginImpl::ServerCallTracerInterface
+    : public grpc_core::ServerCallTracerInterface,
+      public grpc_core::RefCounted<ServerCallTracerInterface,
                                    grpc_core::NonPolymorphicRefCount,
                                    grpc_core::UnrefCallDtor> {
  public:
-  ServerCallTracer(
+  ServerCallTracerInterface(
       OpenTelemetryPluginImpl* otel_plugin, grpc_core::Arena* arena,
       std::shared_ptr<OpenTelemetryPluginImpl::ServerScopeConfig> scope_config);
 
-  ~ServerCallTracer() override;
+  ~ServerCallTracerInterface() override;
 
   std::string TraceId() override {
     return OTelSpanTraceIdToString(span_.get());
diff --git a/deps/grpc/src/cpp/latent_see/latent_see_client.cc b/deps/grpc/src/cpp/latent_see/latent_see_client.cc
new file mode 100644
index 00000000000..a2e85d3e1f1
--- /dev/null
+++ b/deps/grpc/src/cpp/latent_see/latent_see_client.cc
@@ -0,0 +1,59 @@
+// Copyright 2025 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/cpp/latent_see/latent_see_client.h"
+
+#include <grpc/support/time.h>
+
+#include <chrono>
+
+namespace grpc {
+
+Status FetchLatentSee(channelz::v2::LatentSee::Stub* stub, double sample_time,
+                      grpc_core::latent_see::Output* output) {
+  channelz::v2::GetTraceRequest request;
+  request.set_sample_time(sample_time);
+  ClientContext context;
+  context.set_deadline(
+      std::chrono::system_clock::now() +
+      std::chrono::duration_cast<std::chrono::system_clock::duration>(
+          sample_time * std::chrono::seconds(1) + std::chrono::seconds(30)));
+  auto reader = stub->GetTrace(&context, request);
+  channelz::v2::LatentSeeTrace trace;
+  while (reader->Read(&trace)) {
+    switch (trace.kind_case()) {
+      case channelz::v2::LatentSeeTrace::KIND_NOT_SET:
+        continue;
+      case channelz::v2::LatentSeeTrace::kMark:
+        output->Mark(trace.name(), trace.tid(), trace.timestamp_ns());
+        break;
+      case channelz::v2::LatentSeeTrace::kFlowBegin:
+        output->FlowBegin(trace.name(), trace.tid(), trace.timestamp_ns(),
+                          trace.flow_begin().id());
+        break;
+      case channelz::v2::LatentSeeTrace::kFlowEnd:
+        output->FlowEnd(trace.name(), trace.tid(), trace.timestamp_ns(),
+                        trace.flow_end().id());
+        break;
+      case channelz::v2::LatentSeeTrace::kSpan:
+        output->Span(trace.name(), trace.tid(), trace.timestamp_ns(),
+                     trace.span().duration_ns());
+        break;
+    }
+  }
+  output->Finish();
+  return reader->Finish();
+}
+
+}  // namespace grpc
diff --git a/deps/grpc/src/cpp/latent_see/latent_see_client.h b/deps/grpc/src/cpp/latent_see/latent_see_client.h
new file mode 100644
index 00000000000..301bd38106e
--- /dev/null
+++ b/deps/grpc/src/cpp/latent_see/latent_see_client.h
@@ -0,0 +1,27 @@
+// Copyright 2025 The gRPC Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CPP_LATENT_SEE_LATENT_SEE_CLIENT_H
+#define GRPC_SRC_CPP_LATENT_SEE_LATENT_SEE_CLIENT_H
+
+#include "src/core/util/latent_see.h"
+#include "src/proto/grpc/channelz/v2/latent_see.grpc.pb.h"
+
+namespace grpc {
+
+Status FetchLatentSee(channelz::v2::LatentSee::Stub* stub, double sample_time,
+                      grpc_core::latent_see::Output* output);
+}
+
+#endif  // GRPC_SRC_CPP_LATENT_SEE_LATENT_SEE_CLIENT_H
diff --git a/deps/grpc/src/cpp/latent_see/latent_see_service.cc b/deps/grpc/src/cpp/latent_see/latent_see_service.cc
new file mode 100644
index 00000000000..1584f9ed77d
--- /dev/null
+++ b/deps/grpc/src/cpp/latent_see/latent_see_service.cc
@@ -0,0 +1,82 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#include "src/cpp/latent_see/latent_see_service.h"
+
+#include "src/core/util/latent_see.h"
+
+namespace grpc {
+
+namespace {
+
+class StreamingOutput final : public grpc_core::latent_see::Output {
+ public:
+  explicit StreamingOutput(ServerWriter<channelz::v2::LatentSeeTrace>* response)
+      : response_(response) {}
+
+  void Mark(absl::string_view name, int64_t tid, int64_t timestamp) override {
+    channelz::v2::LatentSeeTrace trace;
+    trace.set_name(name);
+    trace.set_tid(tid);
+    trace.set_timestamp_ns(timestamp);
+    trace.mutable_mark();
+    response_->Write(trace);
+  }
+  void FlowBegin(absl::string_view name, int64_t tid, int64_t timestamp,
+                 int64_t flow_id) override {
+    channelz::v2::LatentSeeTrace trace;
+    trace.set_name(name);
+    trace.set_tid(tid);
+    trace.set_timestamp_ns(timestamp);
+    trace.mutable_flow_begin()->set_id(flow_id);
+    response_->Write(trace);
+  }
+  void FlowEnd(absl::string_view name, int64_t tid, int64_t timestamp,
+               int64_t flow_id) override {
+    channelz::v2::LatentSeeTrace trace;
+    trace.set_name(name);
+    trace.set_tid(tid);
+    trace.set_timestamp_ns(timestamp);
+    trace.mutable_flow_end()->set_id(flow_id);
+    response_->Write(trace);
+  }
+  void Span(absl::string_view name, int64_t tid, int64_t timestamp_begin,
+            int64_t duration) override {
+    channelz::v2::LatentSeeTrace trace;
+    trace.set_name(name);
+    trace.set_tid(tid);
+    trace.set_timestamp_ns(timestamp_begin);
+    trace.mutable_span()->set_duration_ns(duration);
+    response_->Write(trace);
+  }
+  void Finish() override {}
+
+ private:
+  ServerWriter<channelz::v2::LatentSeeTrace>* response_;
+};
+
+}  // namespace
+
+Status LatentSeeService::GetTrace(
+    ServerContext*, const channelz::v2::GetTraceRequest* request,
+    ServerWriter<channelz::v2::LatentSeeTrace>* response) {
+  StreamingOutput output(response);
+  grpc_core::latent_see::Collect(
+      nullptr,
+      absl::Seconds(std::min(options_.max_query_time, request->sample_time())),
+      options_.max_memory, &output);
+  return Status::OK;
+}
+
+}  // namespace grpc
diff --git a/deps/grpc/src/cpp/latent_see/latent_see_service.h b/deps/grpc/src/cpp/latent_see/latent_see_service.h
new file mode 100644
index 00000000000..169921074bb
--- /dev/null
+++ b/deps/grpc/src/cpp/latent_see/latent_see_service.h
@@ -0,0 +1,50 @@
+// Copyright 2025 gRPC authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+#ifndef GRPC_SRC_CPP_LATENT_SEE_LATENT_SEE_SERVICE_H
+#define GRPC_SRC_CPP_LATENT_SEE_LATENT_SEE_SERVICE_H
+
+#include "src/proto/grpc/channelz/v2/latent_see.grpc.pb.h"
+
+namespace grpc {
+
+class LatentSeeService final : public channelz::v2::LatentSee::Service {
+ public:
+  struct Options {
+    double max_query_time = 1.0;
+    size_t max_memory = 1024 * 1024;
+
+    Options& set_max_query_time(double max_query_time) {
+      this->max_query_time = max_query_time;
+      return *this;
+    }
+    Options& set_max_memory(size_t max_memory) {
+      this->max_memory = max_memory;
+      return *this;
+    }
+  };
+
+  explicit LatentSeeService(const Options& options) : options_(options) {}
+
+  Status GetTrace(
+      ServerContext*, const channelz::v2::GetTraceRequest* request,
+      ServerWriter<channelz::v2::LatentSeeTrace>* response) override;
+
+ private:
+  Options options_;
+};
+
+}  // namespace grpc
+
+#endif  // GRPC_SRC_CPP_LATENT_SEE_LATENT_SEE_SERVICE_H
diff --git a/deps/grpc/src/cpp/server/channelz/channelz_service.cc b/deps/grpc/src/cpp/server/channelz/channelz_service.cc
index a731bd1a995..2ec6cf8bd89 100644
--- a/deps/grpc/src/cpp/server/channelz/channelz_service.cc
+++ b/deps/grpc/src/cpp/server/channelz/channelz_service.cc
@@ -18,28 +18,56 @@
 
 #include "src/cpp/server/channelz/channelz_service.h"
 
-#include <grpc/support/alloc.h>
 #include <grpc/support/port_platform.h>
 #include <grpcpp/impl/codegen/config_protobuf.h>
 
+#include <algorithm>
 #include <memory>
+#include <vector>
 
-#include "absl/log/log.h"
+#include "absl/strings/str_cat.h"
 #include "src/core/channelz/channelz_registry.h"
+#include "src/core/channelz/v2tov1/convert.h"
+#include "src/core/lib/experiments/experiments.h"
 
 using grpc_core::channelz::BaseNode;
 
-// IWYU pragma: no_include "google/protobuf/json/json.h"
-// IWYU pragma: no_include "google/protobuf/util/json_util.h"
-
-// IWYU pragma: no_include <google/protobuf/util/json_util.h>
-
 namespace grpc {
 
 namespace {
 
 constexpr size_t kMaxResults = 100;
 
+class RegistryEntityFetcher
+    : public grpc_core::channelz::v2tov1::EntityFetcher {
+ public:
+  absl::StatusOr<std::string> GetEntity(int64_t id) override {
+    auto node = grpc_core::channelz::ChannelzRegistry::GetNode(id);
+    if (node == nullptr) {
+      return absl::NotFoundError(absl::StrCat("Entity not found: ", id));
+    }
+    return node->SerializeEntityToString();
+  }
+
+  absl::StatusOr<std::vector<std::string>> GetEntitiesWithParent(
+      int64_t parent_id) override {
+    auto node = grpc_core::channelz::ChannelzRegistry::GetNode(parent_id);
+    if (node == nullptr) {
+      return absl::NotFoundError(
+          absl::StrCat("Parent entity not found: ", parent_id));
+    }
+    auto [nodes, end] = grpc_core::channelz::ChannelzRegistry::GetChildren(
+        node.get(), 0, std::numeric_limits<size_t>::max());
+    DCHECK(end);
+    std::vector<std::string> children_str;
+    for (const auto& node : nodes) {
+      if (node == nullptr) continue;
+      children_str.push_back(node->SerializeEntityToString());
+    }
+    return children_str;
+  }
+};
+
 grpc::protobuf::util::Status ParseJson(const char* json_str,
                                        grpc::protobuf::Message* message) {
   grpc::protobuf::json::JsonParseOptions options;
@@ -60,15 +88,38 @@ Status ChannelzService::GetTopChannels(
     ServerContext* /*unused*/,
     const channelz::v1::GetTopChannelsRequest* request,
     channelz::v1::GetTopChannelsResponse* response) {
-  char* json_str = grpc_channelz_get_top_channels(request->start_channel_id());
-  if (json_str == nullptr) {
-    return Status(StatusCode::INTERNAL,
-                  "grpc_channelz_get_top_channels returned null");
-  }
-  grpc::protobuf::util::Status s = ParseJson(json_str, response);
-  gpr_free(json_str);
-  if (!s.ok()) {
-    return Status(StatusCode::INTERNAL, s.ToString());
+  if (grpc_core::IsChannelzUseV2ForV1ServiceEnabled()) {
+    auto [channels, end] =
+        grpc_core::channelz::ChannelzRegistry::GetTopChannels(
+            request->start_channel_id());
+    RegistryEntityFetcher fetcher;
+    for (const auto& channel_node : channels) {
+      if (channel_node == nullptr) continue;
+      auto serialized_v2 = channel_node->SerializeEntityToString();
+      auto serialized_v1 = grpc_core::channelz::v2tov1::ConvertChannel(
+          serialized_v2, fetcher, false);
+      if (!serialized_v1.ok()) {
+        return Status(StatusCode::INTERNAL,
+                      std::string(serialized_v1.status().message()));
+      }
+      if (!response->add_channel()->ParseFromString(*serialized_v1)) {
+        return Status(StatusCode::INTERNAL,
+                      "Failed to parse converted channel");
+      }
+    }
+    response->set_end(end);
+  } else {
+    char* json_str =
+        grpc_channelz_get_top_channels(request->start_channel_id());
+    if (json_str == nullptr) {
+      return Status(StatusCode::INTERNAL,
+                    "grpc_channelz_get_top_channels returned null");
+    }
+    grpc::protobuf::util::Status s = ParseJson(json_str, response);
+    gpr_free(json_str);
+    if (!s.ok()) {
+      return Status(StatusCode::INTERNAL, s.ToString());
+    }
   }
   return Status::OK;
 }
@@ -76,15 +127,35 @@ Status ChannelzService::GetTopChannels(
 Status ChannelzService::GetServers(
     ServerContext* /*unused*/, const channelz::v1::GetServersRequest* request,
     channelz::v1::GetServersResponse* response) {
-  char* json_str = grpc_channelz_get_servers(request->start_server_id());
-  if (json_str == nullptr) {
-    return Status(StatusCode::INTERNAL,
-                  "grpc_channelz_get_servers returned null");
-  }
-  grpc::protobuf::util::Status s = ParseJson(json_str, response);
-  gpr_free(json_str);
-  if (!s.ok()) {
-    return Status(StatusCode::INTERNAL, s.ToString());
+  if (grpc_core::IsChannelzUseV2ForV1ServiceEnabled()) {
+    auto [servers, end] = grpc_core::channelz::ChannelzRegistry::GetServers(
+        request->start_server_id());
+    RegistryEntityFetcher fetcher;
+    for (const auto& server_node : servers) {
+      if (server_node == nullptr) continue;
+      auto serialized_v2 = server_node->SerializeEntityToString();
+      auto serialized_v1 = grpc_core::channelz::v2tov1::ConvertServer(
+          serialized_v2, fetcher, false);
+      if (!serialized_v1.ok()) {
+        return Status(StatusCode::INTERNAL,
+                      std::string(serialized_v1.status().message()));
+      }
+      if (!response->add_server()->ParseFromString(*serialized_v1)) {
+        return Status(StatusCode::INTERNAL, "Failed to parse converted server");
+      }
+    }
+    response->set_end(end);
+  } else {
+    char* json_str = grpc_channelz_get_servers(request->start_server_id());
+    if (json_str == nullptr) {
+      return Status(StatusCode::INTERNAL,
+                    "grpc_channelz_get_servers returned null");
+    }
+    grpc::protobuf::util::Status s = ParseJson(json_str, response);
+    gpr_free(json_str);
+    if (!s.ok()) {
+      return Status(StatusCode::INTERNAL, s.ToString());
+    }
   }
   return Status::OK;
 }
@@ -92,15 +163,34 @@ Status ChannelzService::GetServers(
 Status ChannelzService::GetServer(ServerContext* /*unused*/,
                                   const channelz::v1::GetServerRequest* request,
                                   channelz::v1::GetServerResponse* response) {
-  char* json_str = grpc_channelz_get_server(request->server_id());
-  if (json_str == nullptr) {
-    return Status(StatusCode::INTERNAL,
-                  "grpc_channelz_get_server returned null");
-  }
-  grpc::protobuf::util::Status s = ParseJson(json_str, response);
-  gpr_free(json_str);
-  if (!s.ok()) {
-    return Status(StatusCode::INTERNAL, s.ToString());
+  if (grpc_core::IsChannelzUseV2ForV1ServiceEnabled()) {
+    auto server_node =
+        grpc_core::channelz::ChannelzRegistry::GetServer(request->server_id());
+    if (server_node == nullptr) {
+      return Status(StatusCode::NOT_FOUND, "No object found for that ServerId");
+    }
+    RegistryEntityFetcher fetcher;
+    auto serialized_v2 = server_node->SerializeEntityToString();
+    auto serialized_v1 = grpc_core::channelz::v2tov1::ConvertServer(
+        serialized_v2, fetcher, false);
+    if (!serialized_v1.ok()) {
+      return Status(StatusCode::INTERNAL,
+                    std::string(serialized_v1.status().message()));
+    }
+    if (!response->mutable_server()->ParseFromString(*serialized_v1)) {
+      return Status(StatusCode::INTERNAL, "Failed to parse converted server");
+    }
+  } else {
+    char* json_str = grpc_channelz_get_server(request->server_id());
+    if (json_str == nullptr) {
+      return Status(StatusCode::INTERNAL,
+                    "grpc_channelz_get_server returned null");
+    }
+    grpc::protobuf::util::Status s = ParseJson(json_str, response);
+    gpr_free(json_str);
+    if (!s.ok()) {
+      return Status(StatusCode::INTERNAL, s.ToString());
+    }
   }
   return Status::OK;
 }
@@ -109,16 +199,49 @@ Status ChannelzService::GetServerSockets(
     ServerContext* /*unused*/,
     const channelz::v1::GetServerSocketsRequest* request,
     channelz::v1::GetServerSocketsResponse* response) {
-  char* json_str = grpc_channelz_get_server_sockets(
-      request->server_id(), request->start_socket_id(), request->max_results());
-  if (json_str == nullptr) {
-    return Status(StatusCode::INTERNAL,
-                  "grpc_channelz_get_server_sockets returned null");
-  }
-  grpc::protobuf::util::Status s = ParseJson(json_str, response);
-  gpr_free(json_str);
-  if (!s.ok()) {
-    return Status(StatusCode::INTERNAL, s.ToString());
+  if (grpc_core::IsChannelzUseV2ForV1ServiceEnabled()) {
+    auto server_node =
+        grpc_core::channelz::ChannelzRegistry::GetServer(request->server_id());
+    if (server_node == nullptr) {
+      return Status(StatusCode::NOT_FOUND, "No object found for that ServerId");
+    }
+    size_t max_results = request->max_results() == 0
+                             ? kMaxResults
+                             : static_cast<size_t>(request->max_results());
+    RegistryEntityFetcher fetcher;
+    auto [sockets, end] =
+        grpc_core::channelz::ChannelzRegistry::GetChildrenOfType(
+            request->start_socket_id(), server_node.get(),
+            grpc_core::channelz::BaseNode::EntityType::kSocket, max_results);
+    for (const auto& socket_node : sockets) {
+      if (socket_node == nullptr) continue;
+      auto serialized_v2 = socket_node->SerializeEntityToString();
+      auto converted = grpc_core::channelz::v2tov1::ConvertSocket(
+          serialized_v2, fetcher, false);
+      if (!converted.ok()) {
+        return Status(StatusCode::INTERNAL,
+                      std::string(converted.status().message()));
+      }
+      grpc::channelz::v1::Socket socket;
+      if (!socket.ParseFromString(*converted)) {
+        return Status(StatusCode::INTERNAL, "Failed to parse converted socket");
+      }
+      response->add_socket_ref()->CopyFrom(socket.ref());
+    }
+    response->set_end(end);
+  } else {
+    char* json_str = grpc_channelz_get_server_sockets(
+        request->server_id(), request->start_socket_id(),
+        request->max_results());
+    if (json_str == nullptr) {
+      return Status(StatusCode::INTERNAL,
+                    "grpc_channelz_get_server_sockets returned null");
+    }
+    grpc::protobuf::util::Status s = ParseJson(json_str, response);
+    gpr_free(json_str);
+    if (!s.ok()) {
+      return Status(StatusCode::INTERNAL, s.ToString());
+    }
   }
   return Status::OK;
 }
@@ -126,14 +249,35 @@ Status ChannelzService::GetServerSockets(
 Status ChannelzService::GetChannel(
     ServerContext* /*unused*/, const channelz::v1::GetChannelRequest* request,
     channelz::v1::GetChannelResponse* response) {
-  char* json_str = grpc_channelz_get_channel(request->channel_id());
-  if (json_str == nullptr) {
-    return Status(StatusCode::NOT_FOUND, "No object found for that ChannelId");
-  }
-  grpc::protobuf::util::Status s = ParseJson(json_str, response);
-  gpr_free(json_str);
-  if (!s.ok()) {
-    return Status(StatusCode::INTERNAL, s.ToString());
+  if (grpc_core::IsChannelzUseV2ForV1ServiceEnabled()) {
+    auto channel_node = grpc_core::channelz::ChannelzRegistry::GetChannel(
+        request->channel_id());
+    if (channel_node == nullptr) {
+      return Status(StatusCode::NOT_FOUND,
+                    "No object found for that ChannelId");
+    }
+    RegistryEntityFetcher fetcher;
+    auto serialized_v2 = channel_node->SerializeEntityToString();
+    auto serialized_v1 = grpc_core::channelz::v2tov1::ConvertChannel(
+        serialized_v2, fetcher, false);
+    if (!serialized_v1.ok()) {
+      return Status(StatusCode::INTERNAL,
+                    std::string(serialized_v1.status().message()));
+    }
+    if (!response->mutable_channel()->ParseFromString(*serialized_v1)) {
+      return Status(StatusCode::INTERNAL, "Failed to parse converted channel");
+    }
+  } else {
+    char* json_str = grpc_channelz_get_channel(request->channel_id());
+    if (json_str == nullptr) {
+      return Status(StatusCode::NOT_FOUND,
+                    "No object found for that ChannelId");
+    }
+    grpc::protobuf::util::Status s = ParseJson(json_str, response);
+    gpr_free(json_str);
+    if (!s.ok()) {
+      return Status(StatusCode::INTERNAL, s.ToString());
+    }
   }
   return Status::OK;
 }
@@ -142,15 +286,36 @@ Status ChannelzService::GetSubchannel(
     ServerContext* /*unused*/,
     const channelz::v1::GetSubchannelRequest* request,
     channelz::v1::GetSubchannelResponse* response) {
-  char* json_str = grpc_channelz_get_subchannel(request->subchannel_id());
-  if (json_str == nullptr) {
-    return Status(StatusCode::NOT_FOUND,
-                  "No object found for that SubchannelId");
-  }
-  grpc::protobuf::util::Status s = ParseJson(json_str, response);
-  gpr_free(json_str);
-  if (!s.ok()) {
-    return Status(StatusCode::INTERNAL, s.ToString());
+  if (grpc_core::IsChannelzUseV2ForV1ServiceEnabled()) {
+    auto subchannel_node = grpc_core::channelz::ChannelzRegistry::GetSubchannel(
+        request->subchannel_id());
+    if (subchannel_node == nullptr) {
+      return Status(StatusCode::NOT_FOUND,
+                    "No object found for that SubchannelId");
+    }
+    RegistryEntityFetcher fetcher;
+    auto serialized_v2 = subchannel_node->SerializeEntityToString();
+    auto serialized_v1 = grpc_core::channelz::v2tov1::ConvertSubchannel(
+        serialized_v2, fetcher, false);
+    if (!serialized_v1.ok()) {
+      return Status(StatusCode::INTERNAL,
+                    std::string(serialized_v1.status().message()));
+    }
+    if (!response->mutable_subchannel()->ParseFromString(*serialized_v1)) {
+      return Status(StatusCode::INTERNAL,
+                    "Failed to parse converted subchannel");
+    }
+  } else {
+    char* json_str = grpc_channelz_get_subchannel(request->subchannel_id());
+    if (json_str == nullptr) {
+      return Status(StatusCode::NOT_FOUND,
+                    "No object found for that SubchannelId");
+    }
+    grpc::protobuf::util::Status s = ParseJson(json_str, response);
+    gpr_free(json_str);
+    if (!s.ok()) {
+      return Status(StatusCode::INTERNAL, s.ToString());
+    }
   }
   return Status::OK;
 }
@@ -158,14 +323,51 @@ Status ChannelzService::GetSubchannel(
 Status ChannelzService::GetSocket(ServerContext* /*unused*/,
                                   const channelz::v1::GetSocketRequest* request,
                                   channelz::v1::GetSocketResponse* response) {
-  char* json_str = grpc_channelz_get_socket(request->socket_id());
-  if (json_str == nullptr) {
-    return Status(StatusCode::NOT_FOUND, "No object found for that SocketId");
-  }
-  grpc::protobuf::util::Status s = ParseJson(json_str, response);
-  gpr_free(json_str);
-  if (!s.ok()) {
-    return Status(StatusCode::INTERNAL, s.ToString());
+  if (grpc_core::IsChannelzUseV2ForV1ServiceEnabled()) {
+    auto node =
+        grpc_core::channelz::ChannelzRegistry::GetNode(request->socket_id());
+    if (node == nullptr) {
+      return Status(StatusCode::NOT_FOUND, "No object found for that SocketId");
+    }
+    RegistryEntityFetcher fetcher;
+    if (node->type() == grpc_core::channelz::BaseNode::EntityType::kSocket) {
+      auto serialized_v2 = node->SerializeEntityToString();
+      auto serialized_v1 = grpc_core::channelz::v2tov1::ConvertSocket(
+          serialized_v2, fetcher, false);
+      if (!serialized_v1.ok()) {
+        return Status(StatusCode::INTERNAL,
+                      std::string(serialized_v1.status().message()));
+      }
+      if (!response->mutable_socket()->ParseFromString(*serialized_v1)) {
+        return Status(StatusCode::INTERNAL, "Failed to parse converted socket");
+      }
+    } else if (node->type() ==
+               grpc_core::channelz::BaseNode::EntityType::kListenSocket) {
+      auto serialized_v2 = node->SerializeEntityToString();
+      auto serialized_v1 = grpc_core::channelz::v2tov1::ConvertListenSocket(
+          serialized_v2, fetcher, false);
+      if (!serialized_v1.ok()) {
+        return Status(StatusCode::INTERNAL,
+                      std::string(serialized_v1.status().message()));
+      }
+      if (!response->mutable_socket()->mutable_ref()->ParseFromString(
+              *serialized_v1)) {
+        return Status(StatusCode::INTERNAL,
+                      "Failed to parse converted listen socket");
+      }
+    } else {
+      return Status(StatusCode::NOT_FOUND, "No object found for that SocketId");
+    }
+  } else {
+    char* json_str = grpc_channelz_get_socket(request->socket_id());
+    if (json_str == nullptr) {
+      return Status(StatusCode::NOT_FOUND, "No object found for that SocketId");
+    }
+    grpc::protobuf::util::Status s = ParseJson(json_str, response);
+    gpr_free(json_str);
+    if (!s.ok()) {
+      return Status(StatusCode::INTERNAL, s.ToString());
+    }
   }
   return Status::OK;
 }
diff --git a/deps/grpc/src/cpp/server/load_reporter/get_cpu_stats_windows.cc b/deps/grpc/src/cpp/server/load_reporter/get_cpu_stats_windows.cc
index 054b0a817e4..8297a5650a8 100644
--- a/deps/grpc/src/cpp/server/load_reporter/get_cpu_stats_windows.cc
+++ b/deps/grpc/src/cpp/server/load_reporter/get_cpu_stats_windows.cc
@@ -23,6 +23,7 @@
 #include <windows.h>
 
 #include <cstdint>
+#include <memory>
 
 #include "src/cpp/server/load_reporter/get_cpu_stats.h"
 
diff --git a/deps/grpc/third_party/BUILD b/deps/grpc/third_party/BUILD
index 460360ad136..13a4714d4b7 100644
--- a/deps/grpc/third_party/BUILD
+++ b/deps/grpc/third_party/BUILD
@@ -10,6 +10,7 @@ exports_files([
     "constantly.BUILD",
     "cython.BUILD",
     "six.BUILD",
+    "typing_extensions.BUILD",
     "enum34.BUILD",
     "futures.BUILD",
     "opencensus-cpp.patch",
diff --git a/deps/grpc/third_party/README.md b/deps/grpc/third_party/README.md
index 0c162fcbcfd..64a86932921 100644
--- a/deps/grpc/third_party/README.md
+++ b/deps/grpc/third_party/README.md
@@ -3,14 +3,19 @@
 gRPC depends on several third-party libraries, their source code is available
 (usually as a git submodule) in this directory.
 
-## Guidelines on updating submodules
+## Guidelines on updating dependencies
 
 - IMPORTANT: whenever possible, try to only update to a stable release of a library (= not to master / random commit). Depending on unreleased revisions
   makes gRPC installation harder for users, as it forces them to always build the dependency from source and prevents them from using more
   convenient installation channels (linux packages, package managers etc.)
 
-- bazel BUILD uses a different dependency model - whenever updating a submodule, also update the revision in `grpc_deps.bzl` so that bazel and
-  non-bazel builds stay in sync (this is actually enforced by a sanity check in some cases)
+- To update the dependencies of gRPC, you need to modify the following three key areas.
+  - First, for non-Bazel build, update the Git submodule under the `third_party` directory to point to the new commit.
+  - Next, for the legacy Bazel WORKSPACE, update the `grpc_deps.bzl` with the new version's URL, prefix, and checksum.
+    (This step will be removed once Bazel module migration is complete.)
+  - Finally, for modern Bazel, update the `MODULE.bazel` file to have new version.
+
+- Note that all versions used in three area should point to the same commit. There are CI tests enforcing this.
 
 ## Considerations when adding a new third-party dependency
 
@@ -23,10 +28,10 @@ gRPC depends on several third-party libraries, their source code is available
   We currently support multiple build systems (BAZEL, cmake, make, ...) so adding a new dependency usually requires updates in multiple build systems
   (often not trivial). The installation process also needs to continue to work (we do have distrib tests to test many of the possible installation scenarios,
   but they are not perfect). Adding a new dependency also usually affects the installation instructions that need to be updated.
-  Also keep in mind that adding a new dependency can be quite disruptive 
-  for the users and community - it means that all users will need to update their projects accordingly (for C++ projects often non-trivial) and 
+  Also keep in mind that adding a new dependency can be quite disruptive
+  for the users and community - it means that all users will need to update their projects accordingly (for C++ projects often non-trivial) and
   the community-provided C++ packages (e.g. vcpkg) will need to be updated as well.
-  
+
 ## Checklist for adding a new third-party dependency
 
 **READ THIS BEFORE YOU ADD A NEW DEPENDENCY**
@@ -43,9 +48,17 @@ Usually the process is
 
 1. update the submodule to selected commit (see guidance above)
 2. update the dependency in `grpc_deps.bzl` to the same commit
-3. update `tools/run_tests/sanity/check_submodules.sh` to make the sanity test pass
-4. (when needed) run `tools/buildgen/generate_projects.sh` to regenerate the generated files 
-5. populate the bazel download mirror by running `bazel/update_mirror.sh`
+3. update the dependency in `MODULE.bazel` (generated from `templates/MODULE.bazel.inja`) to the same version.
+   - Bazel modules are versioned by release, not by commit hash. If a specific commit is needed but lacks a corresponding release, you have three options:
+     1. Ask the project's maintainer to create a new release.
+     2. Request a BCR volunteer to add a new release by filing an issue at [Github](https://github.com/bazelbuild/bazel-central-registry/issues).
+        (See [example](https://github.com/bazelbuild/bazel-central-registry/issues/3702))
+     3. Do it yourself. This can often be done by copying the configuration from an existing release.
+        (See [example](https://github.com/bazelbuild/bazel-central-registry/pull/3683))
+
+4. update `tools/run_tests/sanity/check_submodules.sh` to make the sanity test pass
+5. (when needed) run `tools/buildgen/generate_projects.sh` to regenerate the generated files
+6. populate the bazel download mirror by running `bazel/update_mirror.sh`
 
 Updating some dependencies requires extra care.
 
@@ -53,7 +66,7 @@ Updating some dependencies requires extra care.
 
 - Two additional steps should be done before running `generate_projects.sh` above.
   - Running `src/abseil-cpp/preprocessed_builds.yaml.gen.py`.
-  - Updating `abseil_version =` scripts in `templates/gRPC-C++.podspec.template` and 
+  - Updating `abseil_version =` scripts in `templates/gRPC-C++.podspec.template` and
     `templates/gRPC-Core.podspec.template`.
 - You can see an example of previous [upgrade](https://github.com/grpc/grpc/pull/24270).
 
@@ -94,7 +107,7 @@ git commit -m "update submodule boringssl-with-bazel with origin/master-with-baz
 - Run `tools/distrib/generate_boringssl_prefix_header.sh`
     - Commit again `git commit -m "generate boringssl prefix headers"`
 
-- Increment the boringssl podspec version number in 
+- Increment the boringssl podspec version number in
   `templates/src/objective-c/BoringSSL-GRPC.podspec.template` and `templates/gRPC-Core.podspec.template`.
   [example](https://github.com/grpc/grpc/pull/21527/commits/9d4411842f02f167209887f1f3d2b9ab5d14931a)
     - Commit again `git commit -m "Increment podspec version"`
@@ -108,37 +121,42 @@ git commit -m "update submodule boringssl-with-bazel with origin/master-with-baz
 
 ### Updating third_party/protobuf
 
-Updating the protobuf dependency is now part of the internal release process (see [go/grpc-release](http://go/grpc-release)).
+Before running `generate_projects`, you need to complete the following preparations.
 
-### Updating third_party/envoy-api
+1. Update the Protobuf Version
+  - Modify `third_party/protobuf.patch` with the current version.
+  - Update the `protobuf_version` field in `build_handwritten.yaml`.
 
-Apart from the above steps, please run `tools/codegen/core/gen_upb_api.sh` to regenerate upb files.
+2. Run Build Scripts
+
+```
+tools/distrib/python/make_grpcio_tools.py --cleanup_third_party
+tools/bazel build @com_google_protobuf//:protoc //src/compiler:all
+src/ruby/pb/generate_proto_ruby.sh
+src/php/bin/generate_proto_php.sh
+```
 
-### Updating third_party/upb
+After `generate_projects` has finished, run the following updates.
 
-Since upb is vendored in the gRPC repo, you cannot use submodule to update it. Please follow the steps below;
-1. Update third_party/upb directory by running
-   - `export GRPC_ROOT=~/git/grpc`
-   - `wget https://github.com/protocolbuffers/protobuf/releases/download/v25.1/protobuf-25.1.zip`
-   - `rm -rf $GRPC_ROOT/third_party/upb`
-   - `unzip protobuf-25.1.zip -d /tmp/protobuf`
-   - `cp -r /tmp/protobuf/protobuf-25.1/upb $GRPC_ROOT/third_party/upb`
-2. Update the dependency in `grpc_deps.bzl` to the same commit
-3. Populate the bazel download mirror by running `bazel/update_mirror.sh`
-4. Run `tools/buildgen/generate_projects.sh` to regenerate the generated files
-5. Run `tools/codegen/core/gen_upb_api.sh` to regenerate upb files.
+1. Update `third_party/upb`
 
-### Updating third_party/utf8_range
+```
+rm -rf third_party/upb/upb
+cp -r third_party/protobuf/upb third_party/upb
+tools/codegen/core/gen_upb_api.sh
+```
+
+2. Update `third_party/utf8_range`
 
 ```
-# set to wherever your grpc repo lives
-export GRPC_ROOT=~/git/grpc
-wget https://github.com/protocolbuffers/utf8_range/archive/refs/heads/main.zip
-rm -rf $GRPC_ROOT/third_party/utf8_range
-unzip main.zip -d $GRPC_ROOT/third_party
-mv $GRPC_ROOT/third_party/utf8_range-main $GRPC_ROOT/third_party/utf8_range
+rm -rf third_party/utf8_range
+cp -r third_party/protobuf/third_party/utf8_range third_party/utf8_range/
 ```
 
+### Updating third_party/envoy-api
+
+Apart from the above steps, please run `tools/codegen/core/gen_upb_api.sh` to regenerate upb files.
+
 ### Updating third_party/xxhash
 
 TODO(https://github.com/Cyan4973/xxHash/issues/548): revisit LICENSE
diff --git a/deps/grpc/third_party/cares/cares.BUILD b/deps/grpc/third_party/cares/cares.BUILD
index 784daed1b6f..b0bae3cdee2 100644
--- a/deps/grpc/third_party/cares/cares.BUILD
+++ b/deps/grpc/third_party/cares/cares.BUILD
@@ -133,95 +133,142 @@ copy_file(
 cc_library(
     name = "ares",
     srcs = [
-        "src/lib/ares__read_line.c",
-        "src/lib/ares__get_hostent.c",
-        "src/lib/ares__close_sockets.c",
-        "src/lib/ares__timeval.c",
+        "src/lib/inet_ntop.c",
+        "src/lib/event/ares_event_configchg.c",
+        "src/lib/event/ares_event_poll.c",
+        "src/lib/event/ares_event_epoll.c",
+        "src/lib/event/ares_event_wake_pipe.c",
+        "src/lib/event/ares_event_select.c",
+        "src/lib/event/ares_event_kqueue.c",
+        "src/lib/event/ares_event_win32.c",
+        "src/lib/event/ares_event_thread.c",
         "src/lib/ares_gethostbyaddr.c",
+        "src/lib/ares_set_socket_functions.c",
+        "src/lib/ares_options.c",
+        "src/lib/ares_getaddrinfo.c",
+        "src/lib/ares_init.c",
+        "src/lib/ares_android.c",
+        "src/lib/ares_destroy.c",
         "src/lib/ares_getenv.c",
-        "src/lib/ares_free_string.c",
+        "src/lib/ares_addrinfo_localhost.c",
+        "src/lib/ares_send.c",
         "src/lib/ares_free_hostent.c",
-        "src/lib/ares_fds.c",
-        "src/lib/ares_expand_string.c",
-        "src/lib/ares_create_query.c",
+        "src/lib/ares_data.c",
+        "src/lib/ares_parse_into_addrinfo.c",
         "src/lib/ares_cancel.c",
-        "src/lib/ares_android.c",
-        "src/lib/ares_parse_txt_reply.c",
-        "src/lib/ares_parse_srv_reply.c",
-        "src/lib/ares_parse_soa_reply.c",
-        "src/lib/ares_parse_ptr_reply.c",
-        "src/lib/ares_parse_ns_reply.c",
-        "src/lib/ares_parse_naptr_reply.c",
-        "src/lib/ares_parse_mx_reply.c",
-        "src/lib/ares_parse_caa_reply.c",
-        "src/lib/ares_options.c",
-        "src/lib/ares_nowarn.c",
-        "src/lib/ares_mkquery.c",
-        "src/lib/ares_llist.c",
-        "src/lib/ares_getsock.c",
-        "src/lib/ares_getnameinfo.c",
-        "src/lib/bitncmp.c",
-        "src/lib/ares_writev.c",
-        "src/lib/ares_version.c",
-        "src/lib/ares_timeout.c",
-        "src/lib/ares_strerror.c",
-        "src/lib/ares_strcasecmp.c",
         "src/lib/ares_search.c",
-        "src/lib/ares_platform.c",
-        "src/lib/windows_port.c",
-        "src/lib/inet_ntop.c",
-        "src/lib/ares__sortaddrinfo.c",
-        "src/lib/ares__readaddrinfo.c",
-        "src/lib/ares_parse_uri_reply.c",
-        "src/lib/ares__parse_into_addrinfo.c",
-        "src/lib/ares_parse_a_reply.c",
-        "src/lib/ares_parse_aaaa_reply.c",
-        "src/lib/ares_library_init.c",
-        "src/lib/ares_init.c",
+        "src/lib/ares_sysconfig_win.c",
         "src/lib/ares_gethostbyname.c",
-        "src/lib/ares_getaddrinfo.c",
+        "src/lib/ares_addrinfo2hostent.c",
         "src/lib/ares_freeaddrinfo.c",
-        "src/lib/ares_expand_name.c",
-        "src/lib/ares_destroy.c",
-        "src/lib/ares_data.c",
-        "src/lib/ares__addrinfo_localhost.c",
-        "src/lib/ares__addrinfo2hostent.c",
-        "src/lib/inet_net_pton.c",
-        "src/lib/ares_strsplit.c",
-        "src/lib/ares_strdup.c",
-        "src/lib/ares_send.c",
-        "src/lib/ares_rand.c",
-        "src/lib/ares_query.c",
+        "src/lib/ares_sysconfig.c",
+        "src/lib/ares_hosts_file.c",
+        "src/lib/ares_sortaddrinfo.c",
+        "src/lib/ares_free_string.c",
+        "src/lib/ares_qcache.c",
+        "src/lib/str/ares_str.c",
+        "src/lib/str/ares_strsplit.c",
+        "src/lib/str/ares_buf.c",
+        "src/lib/windows_port.c",
+        "src/lib/ares_socket.c",
+        "src/lib/ares_timeout.c",
+        "src/lib/ares_cookie.c",
+        "src/lib/dsa/ares_htable_vpstr.c",
+        "src/lib/dsa/ares_htable_strvp.c",
+        "src/lib/dsa/ares_htable_dict.c",
+        "src/lib/dsa/ares_htable_szvp.c",
+        "src/lib/dsa/ares_htable_vpvp.c",
+        "src/lib/dsa/ares_llist.c",
+        "src/lib/dsa/ares_htable.c",
+        "src/lib/dsa/ares_htable_asvp.c",
+        "src/lib/dsa/ares_array.c",
+        "src/lib/dsa/ares_slist.c",
+        "src/lib/ares_sysconfig_mac.c",
         "src/lib/ares_process.c",
+        "src/lib/ares_close_sockets.c",
+        "src/lib/legacy/ares_create_query.c",
+        "src/lib/legacy/ares_parse_txt_reply.c",
+        "src/lib/legacy/ares_parse_ptr_reply.c",
+        "src/lib/legacy/ares_fds.c",
+        "src/lib/legacy/ares_expand_string.c",
+        "src/lib/legacy/ares_parse_uri_reply.c",
+        "src/lib/legacy/ares_parse_naptr_reply.c",
+        "src/lib/legacy/ares_parse_aaaa_reply.c",
+        "src/lib/legacy/ares_parse_srv_reply.c",
+        "src/lib/legacy/ares_parse_soa_reply.c",
+        "src/lib/legacy/ares_parse_mx_reply.c",
+        "src/lib/legacy/ares_parse_caa_reply.c",
+        "src/lib/legacy/ares_expand_name.c",
+        "src/lib/legacy/ares_getsock.c",
+        "src/lib/legacy/ares_parse_ns_reply.c",
+        "src/lib/legacy/ares_parse_a_reply.c",
+        "src/lib/ares_strerror.c",
+        "src/lib/ares_getnameinfo.c",
+        "src/lib/ares_version.c",
+        "src/lib/ares_library_init.c",
+        "src/lib/ares_sysconfig_files.c",
+        "src/lib/ares_metrics.c",
+        "src/lib/ares_conn.c",
+        "src/lib/ares_query.c",
+        "src/lib/inet_net_pton.c",
+        "src/lib/util/ares_rand.c",
+        "src/lib/util/ares_iface_ips.c",
+        "src/lib/util/ares_timeval.c",
+        "src/lib/util/ares_uri.c",
+        "src/lib/util/ares_threads.c",
+        "src/lib/util/ares_math.c",
+        "src/lib/ares_update_servers.c",
+        "src/lib/record/ares_dns_write.c",
+        "src/lib/record/ares_dns_record.c",
+        "src/lib/record/ares_dns_multistring.c",
+        "src/lib/record/ares_dns_mapping.c",
+        "src/lib/record/ares_dns_name.c",
+        "src/lib/record/ares_dns_parse.c",
     ],
     hdrs = [
         "ares_build.h",
         "ares_config.h",
-        "include/ares_version.h",
+        "include/ares_nameser.h",
+        "include/ares_dns_record.h",
         "include/ares.h",
-        "include/ares_rules.h",
+        "include/ares_version.h",
         "include/ares_dns.h",
-        "include/ares_nameser.h",
-        "src/tools/ares_getopt.h",
-        "src/lib/ares_strsplit.h",
+        "src/lib/event/ares_event_win32.h",
+        "src/lib/event/ares_event.h",
+        "src/lib/include/ares_htable_asvp.h",
+        "src/lib/include/ares_llist.h",
+        "src/lib/include/ares_htable_vpstr.h",
+        "src/lib/include/ares_htable_strvp.h",
+        "src/lib/include/ares_htable_vpvp.h",
+        "src/lib/include/ares_htable_szvp.h",
+        "src/lib/include/ares_mem.h",
+        "src/lib/include/ares_htable_dict.h",
+        "src/lib/include/ares_array.h",
+        "src/lib/include/ares_buf.h",
+        "src/lib/include/ares_str.h",
         "src/lib/ares_android.h",
         "src/lib/ares_private.h",
-        "src/lib/ares_llist.h",
-        "src/lib/ares_platform.h",
+        "src/lib/ares_socket.h",
         "src/lib/ares_ipv6.h",
         "src/lib/config-dos.h",
-        "src/lib/bitncmp.h",
-        "src/lib/ares_strcasecmp.h",
-        "src/lib/setup_once.h",
         "src/lib/ares_inet_net_pton.h",
+        "src/lib/str/ares_strsplit.h",
+        "src/lib/dsa/ares_slist.h",
+        "src/lib/dsa/ares_htable.h",
         "src/lib/ares_data.h",
         "src/lib/ares_getenv.h",
         "src/lib/config-win32.h",
-        "src/lib/ares_strdup.h",
-        "src/lib/ares_iphlpapi.h",
+        "src/lib/ares_conn.h",
         "src/lib/ares_setup.h",
-        "src/lib/ares_writev.h",
-        "src/lib/ares_nowarn.h",
+        "src/lib/thirdparty/apple/dnsinfo.h",
+        "src/lib/util/ares_threads.h",
+        "src/lib/util/ares_time.h",
+        "src/lib/util/ares_iface_ips.h",
+        "src/lib/util/ares_math.h",
+        "src/lib/util/ares_rand.h",
+        "src/lib/util/ares_uri.h",
+        "src/lib/record/ares_dns_multistring.h",
+        "src/lib/record/ares_dns_private.h",
     ],
     copts = [
         "-D_GNU_SOURCE",
@@ -237,9 +284,12 @@ cc_library(
         "//conditions:default": [],
     }),
     defines = ["CARES_STATICLIB"],
-    includes = ["include", "."],
+    includes = ["include", "src/lib/include", ".", "src/lib"],
     linkopts = select({
-        ":windows": ["-defaultlib:ws2_32.lib"],
+        ":windows": [
+            "-defaultlib:ws2_32.lib",
+            "-defaultlib:iphlpapi.lib",
+        ],
         "//conditions:default": [],
     }),
     linkstatic = 1,
diff --git a/deps/grpc/third_party/cares/config_windows/ares_config.h b/deps/grpc/third_party/cares/config_windows/ares_config.h
index e984c6e4ad1..1fa32767701 100644
--- a/deps/grpc/third_party/cares/config_windows/ares_config.h
+++ b/deps/grpc/third_party/cares/config_windows/ares_config.h
@@ -424,3 +424,6 @@
 /* Type to use in place of in_addr_t when system does not provide it. */
 #undef in_addr_t
 
+/* gRPC manual edits here! */
+#define HAVE_IPHLPAPI_H
+#define HAVE_NETIOAPI_H
diff --git a/deps/grpc/third_party/typing_extensions.BUILD b/deps/grpc/third_party/typing_extensions.BUILD
new file mode 100644
index 00000000000..9d8c77f0cb7
--- /dev/null
+++ b/deps/grpc/third_party/typing_extensions.BUILD
@@ -0,0 +1,12 @@
+genrule(
+    name = "copy_typing_extensions",
+    srcs = ["src/typing_extensions.py"],
+    outs = ["__init__.py"],
+    cmd = "cp $< $(@)",
+)
+
+py_library(
+    name = "typing_extensions",
+    srcs = ["__init__.py"],
+    visibility = ["//visibility:public"],
+)
diff --git a/deps/llhttp/CMakeLists.txt b/deps/llhttp/CMakeLists.txt
index 87a66929dbe..56f0098c2c5 100644
--- a/deps/llhttp/CMakeLists.txt
+++ b/deps/llhttp/CMakeLists.txt
@@ -1,7 +1,7 @@
-cmake_minimum_required(VERSION 3.5.1)
+cmake_minimum_required(VERSION 3.25.0)
 cmake_policy(SET CMP0069 NEW)
 
-project(llhttp VERSION 9.2.1)
+project(llhttp VERSION 9.3.0)
 include(GNUInstallDirs)
 
 set(CMAKE_C_STANDARD 99)
@@ -49,7 +49,7 @@ function(config_library target)
 
   target_include_directories(${target} PUBLIC
     $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
-    $<INSTALL_INTERFACE:include>
+    $<INSTALL_INTERFACE:${CMAKE_INSTALL_INCLUDEDIR}>
   )
 
   set_target_properties(${target} PROPERTIES
@@ -61,6 +61,7 @@ function(config_library target)
 
   install(TARGETS ${target}
     EXPORT llhttp
+    RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
     LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
     ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
     PUBLIC_HEADER DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}
diff --git a/deps/llhttp/LICENSE b/deps/llhttp/LICENSE
new file mode 100644
index 00000000000..6c1512dd6bc
--- /dev/null
+++ b/deps/llhttp/LICENSE
@@ -0,0 +1,22 @@
+This software is licensed under the MIT License.
+
+Copyright Fedor Indutny, 2018.
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the
+"Software"), to deal in the Software without restriction, including
+without limitation the rights to use, copy, modify, merge, publish,
+distribute, sublicense, and/or sell copies of the Software, and to permit
+persons to whom the Software is furnished to do so, subject to the
+following conditions:
+
+The above copyright notice and this permission notice shall be included
+in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
+OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN
+NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,
+DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR
+OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE
+USE OR OTHER DEALINGS IN THE SOFTWARE.
diff --git a/deps/llhttp/README.md b/deps/llhttp/README.md
index 28653aa0358..70af44ff0f5 100644
--- a/deps/llhttp/README.md
+++ b/deps/llhttp/README.md
@@ -94,7 +94,7 @@ int main() {
 	if (err == HPE_OK) {
 		fprintf(stdout, "Successfully parsed!\n");
 	} else {
-		fprintf(stderr, "Parse error: %s %s\n", llhttp_errno_name(err), parser.reason);
+		fprintf(stderr, "Parse error: %s %s\n", llhttp_errno_name(err), llhttp_get_error_reason(&parser));
 	}
 }
 ```
@@ -112,6 +112,7 @@ The following callbacks can return `0` (proceed normally), `-1` (error) or `HPE_
 * `on_message_complete`: Invoked when a request/response has been completedly parsed.
 * `on_url_complete`: Invoked after the URL has been parsed.
 * `on_method_complete`: Invoked after the HTTP method has been parsed.
+* `on_protocol_complete`: Invoked after the HTTP version has been parsed.
 * `on_version_complete`: Invoked after the HTTP version has been parsed.
 * `on_status_complete`: Invoked after the status code has been parsed.
 * `on_header_field_complete`: Invoked after a header name has been parsed.
@@ -130,6 +131,7 @@ The following callbacks can return `0` (proceed normally), `-1` (error) or `HPE_
 * `on_method`: Invoked when another character of the method is received. 
    When parser is created with `HTTP_BOTH` and the input is a response, this also invoked for the sequence `HTTP/`
    of the first message.
+* `on_protocol`: Invoked when another character of the protocol is received.
 * `on_version`: Invoked when another character of the version is received.
 * `on_header_field`: Invoked when another character of a header name is received.
 * `on_header_value`: Invoked when another character of a header value is received.
@@ -187,7 +189,8 @@ Parse full or partial request/response, invoking user callbacks along the way.
 
 If any of `llhttp_data_cb` returns errno not equal to `HPE_OK` - the parsing interrupts, 
 and such errno is returned from `llhttp_execute()`. If `HPE_PAUSED` was used as a errno, 
-the execution can be resumed with `llhttp_resume()` call.
+the execution can be resumed with `llhttp_resume()` call. In that case the input should be advanced 
+to the last processed byte from the parser, which can be obtained via `llhttp_get_error_pos()`.
 
 In a special case of CONNECT/Upgrade request/response `HPE_PAUSED_UPGRADE` is returned 
 after fully parsing the request/response. If the user wishes to continue parsing, 
@@ -196,6 +199,8 @@ they need to invoke `llhttp_resume_after_upgrade()`.
 **if this function ever returns a non-pause type error, it will continue to return 
 the same error upon each successive call up until `llhttp_init()` is called.**
 
+If this function returns `HPE_OK`, it means all the input has been consumed and parsed.
+
 ### `llhttp_errno_t llhttp_finish(llhttp_t* parser)`
 
 This method should be called when the other side has no further bytes to
diff --git a/deps/llhttp/include/llhttp.h b/deps/llhttp/include/llhttp.h
index 37b7934d2ee..60544596a99 100644
--- a/deps/llhttp/include/llhttp.h
+++ b/deps/llhttp/include/llhttp.h
@@ -3,8 +3,8 @@
 #define INCLUDE_LLHTTP_H_
 
 #define LLHTTP_VERSION_MAJOR 9
-#define LLHTTP_VERSION_MINOR 2
-#define LLHTTP_VERSION_PATCH 1
+#define LLHTTP_VERSION_MINOR 3
+#define LLHTTP_VERSION_PATCH 0
 
 #ifndef INCLUDE_LLHTTP_ITSELF_H_
 #define INCLUDE_LLHTTP_ITSELF_H_
@@ -90,7 +90,8 @@ enum llhttp_errno {
   HPE_CB_HEADER_VALUE_COMPLETE = 29,
   HPE_CB_CHUNK_EXTENSION_NAME_COMPLETE = 34,
   HPE_CB_CHUNK_EXTENSION_VALUE_COMPLETE = 35,
-  HPE_CB_RESET = 31
+  HPE_CB_RESET = 31,
+  HPE_CB_PROTOCOL_COMPLETE = 38
 };
 typedef enum llhttp_errno llhttp_errno_t;
 
@@ -326,6 +327,7 @@ typedef enum llhttp_status llhttp_status_t;
   XX(34, CB_CHUNK_EXTENSION_NAME_COMPLETE, CB_CHUNK_EXTENSION_NAME_COMPLETE) \
   XX(35, CB_CHUNK_EXTENSION_VALUE_COMPLETE, CB_CHUNK_EXTENSION_VALUE_COMPLETE) \
   XX(31, CB_RESET, CB_RESET) \
+  XX(38, CB_PROTOCOL_COMPLETE, CB_PROTOCOL_COMPLETE) \
 
 
 #define HTTP_METHOD_MAP(XX) \
@@ -567,6 +569,7 @@ struct llhttp_settings_s {
   llhttp_cb      on_message_begin;
 
   /* Possible return values 0, -1, HPE_USER */
+  llhttp_data_cb on_protocol;
   llhttp_data_cb on_url;
   llhttp_data_cb on_status;
   llhttp_data_cb on_method;
@@ -592,6 +595,7 @@ struct llhttp_settings_s {
 
   /* Possible return values 0, -1, `HPE_PAUSED` */
   llhttp_cb      on_message_complete;
+  llhttp_cb      on_protocol_complete;
   llhttp_cb      on_url_complete;
   llhttp_cb      on_status_complete;
   llhttp_cb      on_method_complete;
diff --git a/deps/llhttp/libllhttp.pc.in b/deps/llhttp/libllhttp.pc.in
index 67d280a830d..4ad300b7409 100644
--- a/deps/llhttp/libllhttp.pc.in
+++ b/deps/llhttp/libllhttp.pc.in
@@ -1,10 +1,10 @@
 prefix=@CMAKE_INSTALL_PREFIX@
-exec_prefix=@CMAKE_INSTALL_PREFIX@
-libdir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_LIBDIR@
-includedir=@CMAKE_INSTALL_PREFIX@/@CMAKE_INSTALL_INCLUDEDIR@
+exec_prefix=@CMAKE_INSTALL_FULL_BINDIR@
+libdir=@CMAKE_INSTALL_FULL_LIBDIR@
+includedir=@CMAKE_INSTALL_FULL_INCLUDEDIR@
 
 Name: libllhttp
 Description: Node.js llhttp Library
 Version: @PROJECT_VERSION@
 Libs: -L${libdir} -lllhttp
-Cflags: -I${includedir}
\ No newline at end of file
+Cflags: -I${includedir}
diff --git a/deps/llhttp/src/api.c b/deps/llhttp/src/api.c
index 8c2ce3dc5c4..0245254177a 100644
--- a/deps/llhttp/src/api.c
+++ b/deps/llhttp/src/api.c
@@ -57,29 +57,14 @@ static int wasm_on_headers_complete_wrap(llhttp_t* p) {
 }
 
 const llhttp_settings_t wasm_settings = {
-  wasm_on_message_begin,
-  wasm_on_url,
-  wasm_on_status,
-  NULL,
-  NULL,
-  wasm_on_header_field,
-  wasm_on_header_value,
-  NULL,
-  NULL,
-  wasm_on_headers_complete_wrap,
-  wasm_on_body,
-  wasm_on_message_complete,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
-  NULL,
+  .on_message_begin = wasm_on_message_begin,
+  .on_url = wasm_on_url,
+  .on_status = wasm_on_status,
+  .on_header_field = wasm_on_header_field,
+  .on_header_value = wasm_on_header_value,
+  .on_headers_complete = wasm_on_headers_complete_wrap,
+  .on_body = wasm_on_body,
+  .on_message_complete = wasm_on_message_complete,
 };
 
 
@@ -341,6 +326,20 @@ int llhttp__on_message_begin(llhttp_t* s, const char* p, const char* endp) {
 }
 
 
+int llhttp__on_protocol(llhttp_t* s, const char* p, const char* endp) {
+  int err;
+  SPAN_CALLBACK_MAYBE(s, on_protocol, p, endp - p);
+  return err;
+}
+
+
+int llhttp__on_protocol_complete(llhttp_t* s, const char* p, const char* endp) {
+  int err;
+  CALLBACK_MAYBE(s, on_protocol_complete);
+  return err;
+}
+
+
 int llhttp__on_url(llhttp_t* s, const char* p, const char* endp) {
   int err;
   SPAN_CALLBACK_MAYBE(s, on_url, p, endp - p);
diff --git a/deps/llhttp/src/llhttp.c b/deps/llhttp/src/llhttp.c
index 3ef3b817f3d..aa4c4682097 100644
--- a/deps/llhttp/src/llhttp.c
+++ b/deps/llhttp/src/llhttp.c
@@ -10,10 +10,20 @@
  #endif  /* _MSC_VER */
 #endif  /* __SSE4_2__ */
 
+#ifdef __ARM_NEON__
+ #include <arm_neon.h>
+#endif  /* __ARM_NEON__ */
+
+#ifdef __wasm__
+ #include <wasm_simd128.h>
+#endif  /* __wasm__ */
+
 #ifdef _MSC_VER
  #define ALIGN(n) _declspec(align(n))
+ #define UNREACHABLE __assume(0)
 #else  /* !_MSC_VER */
  #define ALIGN(n) __attribute__((aligned(n)))
+ #define UNREACHABLE __builtin_unreachable()
 #endif  /* _MSC_VER */
 
 #include "llhttp.h"
@@ -72,16 +82,16 @@ static const unsigned char llparse_blob12[] = {
   'p', 'g', 'r', 'a', 'd', 'e'
 };
 static const unsigned char llparse_blob13[] = {
-  'T', 'T', 'P', '/'
+  'T', 'T', 'P'
 };
 static const unsigned char llparse_blob14[] = {
   0xd, 0xa, 0xd, 0xa, 'S', 'M', 0xd, 0xa, 0xd, 0xa
 };
 static const unsigned char llparse_blob15[] = {
-  'C', 'E', '/'
+  'C', 'E'
 };
 static const unsigned char llparse_blob16[] = {
-  'T', 'S', 'P', '/'
+  'T', 'S', 'P'
 };
 static const unsigned char llparse_blob17[] = {
   'N', 'O', 'U', 'N', 'C', 'E'
@@ -207,12 +217,18 @@ static const unsigned char llparse_blob57[] = {
   'U', 'B', 'S', 'C', 'R', 'I', 'B', 'E'
 };
 static const unsigned char llparse_blob58[] = {
-  'H', 'T', 'T', 'P', '/'
+  'T', 'T', 'P'
 };
 static const unsigned char llparse_blob59[] = {
-  'A', 'D'
+  'C', 'E'
 };
 static const unsigned char llparse_blob60[] = {
+  'T', 'S', 'P'
+};
+static const unsigned char llparse_blob61[] = {
+  'A', 'D'
+};
+static const unsigned char llparse_blob62[] = {
   'T', 'P', '/'
 };
 
@@ -425,17 +441,27 @@ enum llparse_state_e {
   s_n_llhttp__internal__n_req_http_complete,
   s_n_llhttp__internal__n_invoke_load_method_1,
   s_n_llhttp__internal__n_invoke_llhttp__on_version_complete,
-  s_n_llhttp__internal__n_error_66,
-  s_n_llhttp__internal__n_error_73,
-  s_n_llhttp__internal__n_req_http_minor,
+  s_n_llhttp__internal__n_error_67,
   s_n_llhttp__internal__n_error_74,
-  s_n_llhttp__internal__n_req_http_dot,
+  s_n_llhttp__internal__n_req_http_minor,
   s_n_llhttp__internal__n_error_75,
+  s_n_llhttp__internal__n_req_http_dot,
+  s_n_llhttp__internal__n_error_76,
   s_n_llhttp__internal__n_req_http_major,
   s_n_llhttp__internal__n_span_start_llhttp__on_version,
-  s_n_llhttp__internal__n_req_http_start_1,
-  s_n_llhttp__internal__n_req_http_start_2,
-  s_n_llhttp__internal__n_req_http_start_3,
+  s_n_llhttp__internal__n_req_after_protocol,
+  s_n_llhttp__internal__n_invoke_load_method,
+  s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete,
+  s_n_llhttp__internal__n_error_82,
+  s_n_llhttp__internal__n_req_after_http_start_1,
+  s_n_llhttp__internal__n_invoke_load_method_2,
+  s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_1,
+  s_n_llhttp__internal__n_req_after_http_start_2,
+  s_n_llhttp__internal__n_invoke_load_method_3,
+  s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_2,
+  s_n_llhttp__internal__n_req_after_http_start_3,
+  s_n_llhttp__internal__n_req_after_http_start,
+  s_n_llhttp__internal__n_span_start_llhttp__on_protocol,
   s_n_llhttp__internal__n_req_http_start,
   s_n_llhttp__internal__n_url_to_http,
   s_n_llhttp__internal__n_url_skip_to_http,
@@ -543,15 +569,22 @@ enum llparse_state_e {
   s_n_llhttp__internal__n_res_status_code_digit_1,
   s_n_llhttp__internal__n_res_after_version,
   s_n_llhttp__internal__n_invoke_llhttp__on_version_complete_1,
-  s_n_llhttp__internal__n_error_89,
-  s_n_llhttp__internal__n_error_103,
+  s_n_llhttp__internal__n_error_93,
+  s_n_llhttp__internal__n_error_107,
   s_n_llhttp__internal__n_res_http_minor,
-  s_n_llhttp__internal__n_error_104,
+  s_n_llhttp__internal__n_error_108,
   s_n_llhttp__internal__n_res_http_dot,
-  s_n_llhttp__internal__n_error_105,
+  s_n_llhttp__internal__n_error_109,
   s_n_llhttp__internal__n_res_http_major,
   s_n_llhttp__internal__n_span_start_llhttp__on_version_1,
-  s_n_llhttp__internal__n_start_res,
+  s_n_llhttp__internal__n_res_after_protocol,
+  s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_3,
+  s_n_llhttp__internal__n_error_115,
+  s_n_llhttp__internal__n_res_after_start_1,
+  s_n_llhttp__internal__n_res_after_start_2,
+  s_n_llhttp__internal__n_res_after_start_3,
+  s_n_llhttp__internal__n_res_after_start,
+  s_n_llhttp__internal__n_span_start_llhttp__on_protocol_1,
   s_n_llhttp__internal__n_invoke_llhttp__on_method_complete,
   s_n_llhttp__internal__n_req_or_res_method_2,
   s_n_llhttp__internal__n_invoke_update_type_1,
@@ -574,6 +607,10 @@ int llhttp__on_url(
     llhttp__internal_t* s, const unsigned char* p,
     const unsigned char* endp);
 
+int llhttp__on_protocol(
+    llhttp__internal_t* s, const unsigned char* p,
+    const unsigned char* endp);
+
 int llhttp__on_version(
     llhttp__internal_t* s, const unsigned char* p,
     const unsigned char* endp);
@@ -1057,6 +1094,10 @@ int llhttp__internal__c_or_flags_20(
   return 0;
 }
 
+int llhttp__on_protocol_complete(
+    llhttp__internal_t* s, const unsigned char* p,
+    const unsigned char* endp);
+
 int llhttp__internal__c_load_method(
     llhttp__internal_t* state,
     const unsigned char* p,
@@ -1192,8 +1233,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_test_lenient_flags_3;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__after_message_complete:
     s_n_llhttp__internal__n_invoke_llhttp__after_message_complete: {
@@ -1203,8 +1243,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_invoke_update_finish_1;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_pause_1:
     s_n_llhttp__internal__n_pause_1: {
@@ -1213,8 +1252,7 @@ static llparse_state_t llhttp__internal__run(
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_llhttp__after_message_complete;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_is_equal_upgrade:
     s_n_llhttp__internal__n_invoke_is_equal_upgrade: {
@@ -1224,8 +1262,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_pause_1;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_message_complete_2:
     s_n_llhttp__internal__n_invoke_llhttp__on_message_complete_2: {
@@ -1237,8 +1274,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_error_38;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_chunk_data_almost_done_1:
     s_n_llhttp__internal__n_chunk_data_almost_done_1: {
@@ -1254,8 +1290,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_test_lenient_flags_7;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_chunk_data_almost_done:
     s_n_llhttp__internal__n_chunk_data_almost_done: {
@@ -1275,8 +1310,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_test_lenient_flags_7;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_consume_content_length:
     s_n_llhttp__internal__n_consume_content_length: {
@@ -1293,8 +1327,7 @@ static llparse_state_t llhttp__internal__run(
       
       state->content_length -= avail;
       return s_n_llhttp__internal__n_consume_content_length;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_body:
     s_n_llhttp__internal__n_span_start_llhttp__on_body: {
@@ -1304,8 +1337,7 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_body;
       goto s_n_llhttp__internal__n_consume_content_length;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_is_equal_content_length:
     s_n_llhttp__internal__n_invoke_is_equal_content_length: {
@@ -1315,8 +1347,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_invoke_or_flags;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_chunk_size_almost_done:
     s_n_llhttp__internal__n_chunk_size_almost_done: {
@@ -1332,8 +1363,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_test_lenient_flags_8;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_test_lenient_flags_9:
     s_n_llhttp__internal__n_invoke_test_lenient_flags_9: {
@@ -1343,8 +1373,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_error_20;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_name_complete:
     s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_name_complete: {
@@ -1356,8 +1385,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_error_19;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_name_complete_1:
     s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_name_complete_1: {
@@ -1369,8 +1397,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_error_21;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_name_complete_2:
     s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_name_complete_2: {
@@ -1382,8 +1409,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_error_22;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_test_lenient_flags_10:
     s_n_llhttp__internal__n_invoke_test_lenient_flags_10: {
@@ -1393,8 +1419,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_error_25;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_value_complete:
     s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_value_complete: {
@@ -1406,8 +1431,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_error_24;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_value_complete_1:
     s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_value_complete_1: {
@@ -1419,8 +1443,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_error_26;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_chunk_extension_quoted_value_done:
     s_n_llhttp__internal__n_chunk_extension_quoted_value_done: {
@@ -1443,8 +1466,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_error_29;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_value_complete_2:
     s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_value_complete_2: {
@@ -1456,8 +1478,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_error_27;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_error_30:
     s_n_llhttp__internal__n_error_30: {
@@ -1466,8 +1487,7 @@ static llparse_state_t llhttp__internal__run(
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_chunk_extension_quoted_value_quoted_pair:
     s_n_llhttp__internal__n_chunk_extension_quoted_value_quoted_pair: {
@@ -1501,8 +1521,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_value_3;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_error_31:
     s_n_llhttp__internal__n_error_31: {
@@ -1511,8 +1530,7 @@ static llparse_state_t llhttp__internal__run(
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_chunk_extension_quoted_value:
     s_n_llhttp__internal__n_chunk_extension_quoted_value: {
@@ -1554,8 +1572,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_value_4;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_value_complete_3:
     s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_value_complete_3: {
@@ -1567,8 +1584,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_error_32;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_error_33:
     s_n_llhttp__internal__n_error_33: {
@@ -1577,8 +1593,7 @@ static llparse_state_t llhttp__internal__run(
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_chunk_extension_value:
     s_n_llhttp__internal__n_chunk_extension_value: {
@@ -1625,8 +1640,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_value_6;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_chunk_extension_value:
     s_n_llhttp__internal__n_span_start_llhttp__on_chunk_extension_value: {
@@ -1636,8 +1650,7 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_chunk_extension_value;
       goto s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_name_complete_3;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_error_34:
     s_n_llhttp__internal__n_error_34: {
@@ -1646,8 +1659,7 @@ static llparse_state_t llhttp__internal__run(
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_chunk_extension_name:
     s_n_llhttp__internal__n_chunk_extension_name: {
@@ -1693,8 +1705,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_name_4;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_chunk_extension_name:
     s_n_llhttp__internal__n_span_start_llhttp__on_chunk_extension_name: {
@@ -1704,8 +1715,7 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_chunk_extension_name;
       goto s_n_llhttp__internal__n_chunk_extension_name;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_chunk_extensions:
     s_n_llhttp__internal__n_chunk_extensions: {
@@ -1725,8 +1735,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_start_llhttp__on_chunk_extension_name;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_chunk_size_otherwise:
     s_n_llhttp__internal__n_chunk_size_otherwise: {
@@ -1758,8 +1767,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_error_35;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_chunk_size:
     s_n_llhttp__internal__n_chunk_size: {
@@ -1881,8 +1889,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_chunk_size_otherwise;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_chunk_size_digit:
     s_n_llhttp__internal__n_chunk_size_digit: {
@@ -2004,8 +2011,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_error_37;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_update_content_length_1:
     s_n_llhttp__internal__n_invoke_update_content_length_1: {
@@ -2013,8 +2019,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_chunk_size_digit;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_consume_content_length_1:
     s_n_llhttp__internal__n_consume_content_length_1: {
@@ -2031,8 +2036,7 @@ static llparse_state_t llhttp__internal__run(
       
       state->content_length -= avail;
       return s_n_llhttp__internal__n_consume_content_length_1;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_body_1:
     s_n_llhttp__internal__n_span_start_llhttp__on_body_1: {
@@ -2042,8 +2046,7 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_body;
       goto s_n_llhttp__internal__n_consume_content_length_1;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_eof:
     s_n_llhttp__internal__n_eof: {
@@ -2052,8 +2055,7 @@ static llparse_state_t llhttp__internal__run(
       }
       p++;
       goto s_n_llhttp__internal__n_eof;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_body_2:
     s_n_llhttp__internal__n_span_start_llhttp__on_body_2: {
@@ -2063,8 +2065,7 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_body;
       goto s_n_llhttp__internal__n_eof;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__after_headers_complete:
     s_n_llhttp__internal__n_invoke_llhttp__after_headers_complete: {
@@ -2082,8 +2083,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_invoke_llhttp__on_message_complete;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_error_5:
     s_n_llhttp__internal__n_error_5: {
@@ -2092,8 +2092,7 @@ static llparse_state_t llhttp__internal__run(
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_headers_almost_done:
     s_n_llhttp__internal__n_headers_almost_done: {
@@ -2109,8 +2108,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_test_lenient_flags_12;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_field_colon_discard_ws:
     s_n_llhttp__internal__n_header_field_colon_discard_ws: {
@@ -2126,8 +2124,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_field_colon;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_header_value_complete:
     s_n_llhttp__internal__n_invoke_llhttp__on_header_value_complete: {
@@ -2139,8 +2136,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_error_48;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_header_value:
     s_n_llhttp__internal__n_span_start_llhttp__on_header_value: {
@@ -2150,8 +2146,7 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_header_value;
       goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_discard_lws:
     s_n_llhttp__internal__n_header_value_discard_lws: {
@@ -2171,8 +2166,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_load_header_state_1;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_discard_ws_almost_done:
     s_n_llhttp__internal__n_header_value_discard_ws_almost_done: {
@@ -2188,8 +2182,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_test_lenient_flags_16;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_lws:
     s_n_llhttp__internal__n_header_value_lws: {
@@ -2207,8 +2200,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_load_header_state_5;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_almost_done:
     s_n_llhttp__internal__n_header_value_almost_done: {
@@ -2224,8 +2216,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_error_53;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_test_lenient_flags_17:
     s_n_llhttp__internal__n_invoke_test_lenient_flags_17: {
@@ -2235,8 +2226,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_error_51;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_lenient:
     s_n_llhttp__internal__n_header_value_lenient: {
@@ -2255,8 +2245,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_value_lenient;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_error_54:
     s_n_llhttp__internal__n_error_54: {
@@ -2265,8 +2254,7 @@ static llparse_state_t llhttp__internal__run(
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_otherwise:
     s_n_llhttp__internal__n_header_value_otherwise: {
@@ -2284,8 +2272,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_test_lenient_flags_19;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_connection_token:
     s_n_llhttp__internal__n_header_value_connection_token: {
@@ -2323,8 +2310,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_value_otherwise;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_connection_ws:
     s_n_llhttp__internal__n_header_value_connection_ws: {
@@ -2350,8 +2336,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_header_state_5;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_connection_1:
     s_n_llhttp__internal__n_header_value_connection_1: {
@@ -2374,8 +2359,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_value_connection_token;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_connection_2:
     s_n_llhttp__internal__n_header_value_connection_2: {
@@ -2398,8 +2382,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_value_connection_token;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_connection_3:
     s_n_llhttp__internal__n_header_value_connection_3: {
@@ -2422,8 +2405,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_value_connection_token;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_connection:
     s_n_llhttp__internal__n_header_value_connection: {
@@ -2455,8 +2437,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_value_connection_token;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_error_56:
     s_n_llhttp__internal__n_error_56: {
@@ -2465,8 +2446,7 @@ static llparse_state_t llhttp__internal__run(
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_error_57:
     s_n_llhttp__internal__n_error_57: {
@@ -2475,8 +2455,7 @@ static llparse_state_t llhttp__internal__run(
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_content_length_ws:
     s_n_llhttp__internal__n_header_value_content_length_ws: {
@@ -2498,8 +2477,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_7;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_content_length:
     s_n_llhttp__internal__n_header_value_content_length: {
@@ -2561,8 +2539,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_value_content_length_ws;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_error_59:
     s_n_llhttp__internal__n_error_59: {
@@ -2571,8 +2548,7 @@ static llparse_state_t llhttp__internal__run(
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_error_58:
     s_n_llhttp__internal__n_error_58: {
@@ -2581,8 +2557,7 @@ static llparse_state_t llhttp__internal__run(
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_te_token_ows:
     s_n_llhttp__internal__n_header_value_te_token_ows: {
@@ -2602,8 +2577,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_value_te_chunked;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value:
     s_n_llhttp__internal__n_header_value: {
@@ -2632,7 +2606,6 @@ static llparse_state_t llhttp__internal__run(
       if (endp - p >= 16) {
         __m128i ranges;
         __m128i input;
-        int avail;
         int match_len;
       
         /* Load input */
@@ -2652,6 +2625,78 @@ static llparse_state_t llhttp__internal__run(
         goto s_n_llhttp__internal__n_header_value_otherwise;
       }
       #endif  /* __SSE4_2__ */
+      #ifdef __ARM_NEON__
+      while (endp - p >= 16) {
+        uint8x16_t input;
+        uint8x16_t single;
+        uint8x16_t mask;
+        uint8x8_t narrow;
+        uint64_t match_mask;
+        int match_len;
+      
+        /* Load input */
+        input = vld1q_u8(p);
+        /* Find first character that does not match `ranges` */
+        single = vceqq_u8(input, vdupq_n_u8(0x9));
+        mask = single;
+        single = vandq_u16(
+          vcgeq_u8(input, vdupq_n_u8(' ')),
+          vcleq_u8(input, vdupq_n_u8('~'))
+        );
+        mask = vorrq_u16(mask, single);
+        single = vandq_u16(
+          vcgeq_u8(input, vdupq_n_u8(0x80)),
+          vcleq_u8(input, vdupq_n_u8(0xff))
+        );
+        mask = vorrq_u16(mask, single);
+        narrow = vshrn_n_u16(mask, 4);
+        match_mask = ~vget_lane_u64(vreinterpret_u64_u8(narrow), 0);
+        match_len = __builtin_ctzll(match_mask) >> 2;
+        if (match_len != 16) {
+          p += match_len;
+          goto s_n_llhttp__internal__n_header_value_otherwise;
+        }
+        p += 16;
+      }
+      if (p == endp) {
+        return s_n_llhttp__internal__n_header_value;
+      }
+      #endif  /* __ARM_NEON__ */
+      #ifdef __wasm_simd128__
+      while (endp - p >= 16) {
+        v128_t input;
+        v128_t mask;
+        v128_t single;
+        int match_len;
+      
+        /* Load input */
+        input = wasm_v128_load(p);
+        /* Find first character that does not match `ranges` */
+        single = wasm_i8x16_eq(input, wasm_u8x16_const_splat(0x9));
+        mask = single;
+        single = wasm_v128_and(
+          wasm_i8x16_ge(input, wasm_u8x16_const_splat(' ')),
+          wasm_i8x16_le(input, wasm_u8x16_const_splat('~'))
+        );
+        mask = wasm_v128_or(mask, single);
+        single = wasm_v128_and(
+          wasm_i8x16_ge(input, wasm_u8x16_const_splat(0x80)),
+          wasm_i8x16_le(input, wasm_u8x16_const_splat(0xff))
+        );
+        mask = wasm_v128_or(mask, single);
+        match_len = __builtin_ctz(
+          ~wasm_i8x16_bitmask(mask)
+        );
+        if (match_len != 16) {
+          p += match_len;
+          goto s_n_llhttp__internal__n_header_value_otherwise;
+        }
+        p += 16;
+      }
+      if (p == endp) {
+        return s_n_llhttp__internal__n_header_value;
+      }
+      #endif  /* __wasm_simd128__ */
       switch (lookup_table[(uint8_t) *p]) {
         case 1: {
           p++;
@@ -2661,8 +2706,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_value_otherwise;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_te_token:
     s_n_llhttp__internal__n_header_value_te_token: {
@@ -2700,8 +2744,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_header_state_9;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_te_chunked_last:
     s_n_llhttp__internal__n_header_value_te_chunked_last: {
@@ -2726,8 +2769,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_value_te_token;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_te_chunked:
     s_n_llhttp__internal__n_header_value_te_chunked: {
@@ -2750,8 +2792,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_value_te_token;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1:
     s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1: {
@@ -2761,8 +2802,7 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_header_value;
       goto s_n_llhttp__internal__n_invoke_load_header_state_3;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_value_discard_ws:
     s_n_llhttp__internal__n_header_value_discard_ws: {
@@ -2790,8 +2830,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_load_header_state:
     s_n_llhttp__internal__n_invoke_load_header_state: {
@@ -2803,8 +2842,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_header_value_discard_ws;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_header_field_complete:
     s_n_llhttp__internal__n_invoke_llhttp__on_header_field_complete: {
@@ -2816,8 +2854,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_error_45;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_field_general_otherwise:
     s_n_llhttp__internal__n_header_field_general_otherwise: {
@@ -2832,8 +2869,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_error_62;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_field_general:
     s_n_llhttp__internal__n_header_field_general: {
@@ -2862,7 +2898,6 @@ static llparse_state_t llhttp__internal__run(
       if (endp - p >= 16) {
         __m128i ranges;
         __m128i input;
-        int avail;
         int match_len;
       
         /* Load input */
@@ -2903,8 +2938,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_field_general_otherwise;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_field_colon:
     s_n_llhttp__internal__n_header_field_colon: {
@@ -2922,8 +2956,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_header_state_10;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_field_3:
     s_n_llhttp__internal__n_header_field_3: {
@@ -2947,8 +2980,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_header_state_11;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_field_4:
     s_n_llhttp__internal__n_header_field_4: {
@@ -2972,8 +3004,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_header_state_11;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_field_2:
     s_n_llhttp__internal__n_header_field_2: {
@@ -2993,8 +3024,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_header_state_11;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_field_1:
     s_n_llhttp__internal__n_header_field_1: {
@@ -3017,8 +3047,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_header_state_11;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_field_5:
     s_n_llhttp__internal__n_header_field_5: {
@@ -3042,8 +3071,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_header_state_11;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_field_6:
     s_n_llhttp__internal__n_header_field_6: {
@@ -3067,8 +3095,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_header_state_11;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_field_7:
     s_n_llhttp__internal__n_header_field_7: {
@@ -3092,8 +3119,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_header_state_11;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_field:
     s_n_llhttp__internal__n_header_field: {
@@ -3121,8 +3147,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_header_state_11;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_header_field:
     s_n_llhttp__internal__n_span_start_llhttp__on_header_field: {
@@ -3132,8 +3157,7 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_header_field;
       goto s_n_llhttp__internal__n_header_field;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_header_field_start:
     s_n_llhttp__internal__n_header_field_start: {
@@ -3156,8 +3180,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_start_llhttp__on_header_field;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_headers_start:
     s_n_llhttp__internal__n_headers_start: {
@@ -3173,8 +3196,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_header_field_start;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_to_http_09:
     s_n_llhttp__internal__n_url_to_http_09: {
@@ -3194,8 +3216,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_http_major;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_skip_to_http09:
     s_n_llhttp__internal__n_url_skip_to_http09: {
@@ -3216,8 +3237,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_url_to_http_09;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_skip_lf_to_http09_1:
     s_n_llhttp__internal__n_url_skip_lf_to_http09_1: {
@@ -3233,8 +3253,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_error_63;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_skip_lf_to_http09:
     s_n_llhttp__internal__n_url_skip_lf_to_http09: {
@@ -3258,8 +3277,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_error_63;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_req_pri_upgrade:
     s_n_llhttp__internal__n_req_pri_upgrade: {
@@ -3273,17 +3291,16 @@ static llparse_state_t llhttp__internal__run(
       switch (match_seq.status) {
         case kMatchComplete: {
           p++;
-          goto s_n_llhttp__internal__n_error_71;
+          goto s_n_llhttp__internal__n_error_72;
         }
         case kMatchPause: {
           return s_n_llhttp__internal__n_req_pri_upgrade;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_72;
+          goto s_n_llhttp__internal__n_error_73;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_req_http_complete_crlf:
     s_n_llhttp__internal__n_req_http_complete_crlf: {
@@ -3299,8 +3316,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_test_lenient_flags_26;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_req_http_complete:
     s_n_llhttp__internal__n_req_http_complete: {
@@ -3317,11 +3333,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_req_http_complete_crlf;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_70;
+          goto s_n_llhttp__internal__n_error_71;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_load_method_1:
     s_n_llhttp__internal__n_invoke_load_method_1: {
@@ -3331,8 +3346,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_req_http_complete;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_version_complete:
     s_n_llhttp__internal__n_invoke_llhttp__on_version_complete: {
@@ -3342,30 +3356,27 @@ static llparse_state_t llhttp__internal__run(
         case 21:
           goto s_n_llhttp__internal__n_pause_21;
         default:
-          goto s_n_llhttp__internal__n_error_67;
+          goto s_n_llhttp__internal__n_error_68;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
-    case s_n_llhttp__internal__n_error_66:
-    s_n_llhttp__internal__n_error_66: {
+    case s_n_llhttp__internal__n_error_67:
+    s_n_llhttp__internal__n_error_67: {
       state->error = 0x9;
       state->reason = "Invalid HTTP version";
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
-    case s_n_llhttp__internal__n_error_73:
-    s_n_llhttp__internal__n_error_73: {
+    case s_n_llhttp__internal__n_error_74:
+    s_n_llhttp__internal__n_error_74: {
       state->error = 0x9;
       state->reason = "Invalid minor version";
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_req_http_minor:
     s_n_llhttp__internal__n_req_http_minor: {
@@ -3427,18 +3438,16 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_end_llhttp__on_version_2;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
-    case s_n_llhttp__internal__n_error_74:
-    s_n_llhttp__internal__n_error_74: {
+    case s_n_llhttp__internal__n_error_75:
+    s_n_llhttp__internal__n_error_75: {
       state->error = 0x9;
       state->reason = "Expected dot";
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_req_http_dot:
     s_n_llhttp__internal__n_req_http_dot: {
@@ -3454,18 +3463,16 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_end_llhttp__on_version_3;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
-    case s_n_llhttp__internal__n_error_75:
-    s_n_llhttp__internal__n_error_75: {
+    case s_n_llhttp__internal__n_error_76:
+    s_n_llhttp__internal__n_error_76: {
       state->error = 0x9;
       state->reason = "Invalid major version";
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_req_http_major:
     s_n_llhttp__internal__n_req_http_major: {
@@ -3527,8 +3534,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_end_llhttp__on_version_4;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_version:
     s_n_llhttp__internal__n_span_start_llhttp__on_version: {
@@ -3538,109 +3544,313 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_version;
       goto s_n_llhttp__internal__n_req_http_major;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_req_after_protocol:
+    s_n_llhttp__internal__n_req_after_protocol: {
+      if (p == endp) {
+        return s_n_llhttp__internal__n_req_after_protocol;
+      }
+      switch (*p) {
+        case '/': {
+          p++;
+          goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
+        }
+        default: {
+          goto s_n_llhttp__internal__n_error_77;
+        }
+      }
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_invoke_load_method:
+    s_n_llhttp__internal__n_invoke_load_method: {
+      switch (llhttp__internal__c_load_method(state, p, endp)) {
+        case 0:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 1:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 2:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 3:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 4:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 5:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 6:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 7:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 8:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 9:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 10:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 11:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 12:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 13:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 14:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 15:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 16:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 17:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 18:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 19:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 20:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 21:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 22:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 23:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 24:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 25:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 26:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 27:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 28:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 29:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 30:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 31:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 32:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 33:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 34:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 46:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        default:
+          goto s_n_llhttp__internal__n_error_66;
+      }
+      UNREACHABLE;
     }
-    case s_n_llhttp__internal__n_req_http_start_1:
-    s_n_llhttp__internal__n_req_http_start_1: {
+    case s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete:
+    s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete: {
+      switch (llhttp__on_protocol_complete(state, p, endp)) {
+        case 0:
+          goto s_n_llhttp__internal__n_invoke_load_method;
+        case 21:
+          goto s_n_llhttp__internal__n_pause_22;
+        default:
+          goto s_n_llhttp__internal__n_error_65;
+      }
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_error_82:
+    s_n_llhttp__internal__n_error_82: {
+      state->error = 0x8;
+      state->reason = "Expected HTTP/, RTSP/ or ICE/";
+      state->error_pos = (const char*) p;
+      state->_current = (void*) (intptr_t) s_error;
+      return s_error;
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_req_after_http_start_1:
+    s_n_llhttp__internal__n_req_after_http_start_1: {
       llparse_match_t match_seq;
       
       if (p == endp) {
-        return s_n_llhttp__internal__n_req_http_start_1;
+        return s_n_llhttp__internal__n_req_after_http_start_1;
       }
-      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob13, 4);
+      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob13, 3);
       p = match_seq.current;
       switch (match_seq.status) {
         case kMatchComplete: {
           p++;
-          goto s_n_llhttp__internal__n_invoke_load_method;
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol;
         }
         case kMatchPause: {
-          return s_n_llhttp__internal__n_req_http_start_1;
+          return s_n_llhttp__internal__n_req_after_http_start_1;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_78;
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol_3;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
-    case s_n_llhttp__internal__n_req_http_start_2:
-    s_n_llhttp__internal__n_req_http_start_2: {
+    case s_n_llhttp__internal__n_invoke_load_method_2:
+    s_n_llhttp__internal__n_invoke_load_method_2: {
+      switch (llhttp__internal__c_load_method(state, p, endp)) {
+        case 33:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        default:
+          goto s_n_llhttp__internal__n_error_79;
+      }
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_1:
+    s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_1: {
+      switch (llhttp__on_protocol_complete(state, p, endp)) {
+        case 0:
+          goto s_n_llhttp__internal__n_invoke_load_method_2;
+        case 21:
+          goto s_n_llhttp__internal__n_pause_23;
+        default:
+          goto s_n_llhttp__internal__n_error_78;
+      }
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_req_after_http_start_2:
+    s_n_llhttp__internal__n_req_after_http_start_2: {
       llparse_match_t match_seq;
       
       if (p == endp) {
-        return s_n_llhttp__internal__n_req_http_start_2;
+        return s_n_llhttp__internal__n_req_after_http_start_2;
       }
-      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob15, 3);
+      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob15, 2);
       p = match_seq.current;
       switch (match_seq.status) {
         case kMatchComplete: {
           p++;
-          goto s_n_llhttp__internal__n_invoke_load_method_2;
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol_1;
         }
         case kMatchPause: {
-          return s_n_llhttp__internal__n_req_http_start_2;
+          return s_n_llhttp__internal__n_req_after_http_start_2;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_78;
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol_3;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_invoke_load_method_3:
+    s_n_llhttp__internal__n_invoke_load_method_3: {
+      switch (llhttp__internal__c_load_method(state, p, endp)) {
+        case 1:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 3:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 6:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 35:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 36:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 37:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 38:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 39:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 40:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 41:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 42:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 43:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 44:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        case 45:
+          goto s_n_llhttp__internal__n_req_after_protocol;
+        default:
+          goto s_n_llhttp__internal__n_error_81;
+      }
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_2:
+    s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_2: {
+      switch (llhttp__on_protocol_complete(state, p, endp)) {
+        case 0:
+          goto s_n_llhttp__internal__n_invoke_load_method_3;
+        case 21:
+          goto s_n_llhttp__internal__n_pause_24;
+        default:
+          goto s_n_llhttp__internal__n_error_80;
+      }
+      UNREACHABLE;
     }
-    case s_n_llhttp__internal__n_req_http_start_3:
-    s_n_llhttp__internal__n_req_http_start_3: {
+    case s_n_llhttp__internal__n_req_after_http_start_3:
+    s_n_llhttp__internal__n_req_after_http_start_3: {
       llparse_match_t match_seq;
       
       if (p == endp) {
-        return s_n_llhttp__internal__n_req_http_start_3;
+        return s_n_llhttp__internal__n_req_after_http_start_3;
       }
-      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob16, 4);
+      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob16, 3);
       p = match_seq.current;
       switch (match_seq.status) {
         case kMatchComplete: {
           p++;
-          goto s_n_llhttp__internal__n_invoke_load_method_3;
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol_2;
         }
         case kMatchPause: {
-          return s_n_llhttp__internal__n_req_http_start_3;
+          return s_n_llhttp__internal__n_req_after_http_start_3;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_78;
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol_3;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
-    case s_n_llhttp__internal__n_req_http_start:
-    s_n_llhttp__internal__n_req_http_start: {
+    case s_n_llhttp__internal__n_req_after_http_start:
+    s_n_llhttp__internal__n_req_after_http_start: {
       if (p == endp) {
-        return s_n_llhttp__internal__n_req_http_start;
+        return s_n_llhttp__internal__n_req_after_http_start;
       }
       switch (*p) {
-        case ' ': {
-          p++;
-          goto s_n_llhttp__internal__n_req_http_start;
-        }
         case 'H': {
           p++;
-          goto s_n_llhttp__internal__n_req_http_start_1;
+          goto s_n_llhttp__internal__n_req_after_http_start_1;
         }
         case 'I': {
           p++;
-          goto s_n_llhttp__internal__n_req_http_start_2;
+          goto s_n_llhttp__internal__n_req_after_http_start_2;
         }
         case 'R': {
           p++;
-          goto s_n_llhttp__internal__n_req_http_start_3;
+          goto s_n_llhttp__internal__n_req_after_http_start_3;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_78;
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol_3;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_span_start_llhttp__on_protocol:
+    s_n_llhttp__internal__n_span_start_llhttp__on_protocol: {
+      if (p == endp) {
+        return s_n_llhttp__internal__n_span_start_llhttp__on_protocol;
+      }
+      state->_span_pos0 = (void*) p;
+      state->_span_cb0 = llhttp__on_protocol;
+      goto s_n_llhttp__internal__n_req_after_http_start;
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_req_http_start:
+    s_n_llhttp__internal__n_req_http_start: {
+      if (p == endp) {
+        return s_n_llhttp__internal__n_req_http_start;
+      }
+      switch (*p) {
+        case ' ': {
+          p++;
+          goto s_n_llhttp__internal__n_req_http_start;
+        }
+        default: {
+          goto s_n_llhttp__internal__n_span_start_llhttp__on_protocol;
+        }
+      }
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_to_http:
     s_n_llhttp__internal__n_url_to_http: {
@@ -3660,8 +3870,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_llhttp__on_url_complete_1;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_skip_to_http:
     s_n_llhttp__internal__n_url_skip_to_http: {
@@ -3682,8 +3891,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_url_to_http;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_fragment:
     s_n_llhttp__internal__n_url_fragment: {
@@ -3727,11 +3935,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_url_fragment;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_79;
+          goto s_n_llhttp__internal__n_error_83;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_end_stub_query_3:
     s_n_llhttp__internal__n_span_end_stub_query_3: {
@@ -3740,8 +3947,7 @@ static llparse_state_t llhttp__internal__run(
       }
       p++;
       goto s_n_llhttp__internal__n_url_fragment;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_query:
     s_n_llhttp__internal__n_url_query: {
@@ -3788,11 +3994,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_end_stub_query_3;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_80;
+          goto s_n_llhttp__internal__n_error_84;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_query_or_fragment:
     s_n_llhttp__internal__n_url_query_or_fragment: {
@@ -3826,11 +4031,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_url_query;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_81;
+          goto s_n_llhttp__internal__n_error_85;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_path:
     s_n_llhttp__internal__n_url_path: {
@@ -3868,8 +4072,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_url_query_or_fragment;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_stub_path_2:
     s_n_llhttp__internal__n_span_start_stub_path_2: {
@@ -3878,8 +4081,7 @@ static llparse_state_t llhttp__internal__run(
       }
       p++;
       goto s_n_llhttp__internal__n_url_path;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_stub_path:
     s_n_llhttp__internal__n_span_start_stub_path: {
@@ -3888,8 +4090,7 @@ static llparse_state_t llhttp__internal__run(
       }
       p++;
       goto s_n_llhttp__internal__n_url_path;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_stub_path_1:
     s_n_llhttp__internal__n_span_start_stub_path_1: {
@@ -3898,8 +4099,7 @@ static llparse_state_t llhttp__internal__run(
       }
       p++;
       goto s_n_llhttp__internal__n_url_path;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_server_with_at:
     s_n_llhttp__internal__n_url_server_with_at: {
@@ -3951,14 +4151,13 @@ static llparse_state_t llhttp__internal__run(
         }
         case 8: {
           p++;
-          goto s_n_llhttp__internal__n_error_82;
+          goto s_n_llhttp__internal__n_error_86;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_83;
+          goto s_n_llhttp__internal__n_error_87;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_server:
     s_n_llhttp__internal__n_url_server: {
@@ -4013,11 +4212,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_url_server_with_at;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_84;
+          goto s_n_llhttp__internal__n_error_88;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_schema_delim_1:
     s_n_llhttp__internal__n_url_schema_delim_1: {
@@ -4030,11 +4228,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_url_server;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_85;
+          goto s_n_llhttp__internal__n_error_89;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_schema_delim:
     s_n_llhttp__internal__n_url_schema_delim: {
@@ -4067,11 +4264,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_url_schema_delim_1;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_85;
+          goto s_n_llhttp__internal__n_error_89;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_end_stub_schema:
     s_n_llhttp__internal__n_span_end_stub_schema: {
@@ -4080,8 +4276,7 @@ static llparse_state_t llhttp__internal__run(
       }
       p++;
       goto s_n_llhttp__internal__n_url_schema_delim;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_schema:
     s_n_llhttp__internal__n_url_schema: {
@@ -4119,11 +4314,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_url_schema;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_86;
+          goto s_n_llhttp__internal__n_error_90;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_start:
     s_n_llhttp__internal__n_url_start: {
@@ -4160,11 +4354,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_url_schema;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_87;
+          goto s_n_llhttp__internal__n_error_91;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_url_1:
     s_n_llhttp__internal__n_span_start_llhttp__on_url_1: {
@@ -4174,8 +4367,7 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_url;
       goto s_n_llhttp__internal__n_url_start;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_entry_normal:
     s_n_llhttp__internal__n_url_entry_normal: {
@@ -4195,8 +4387,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_start_llhttp__on_url_1;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_url:
     s_n_llhttp__internal__n_span_start_llhttp__on_url: {
@@ -4206,8 +4397,7 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_url;
       goto s_n_llhttp__internal__n_url_server;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_url_entry_connect:
     s_n_llhttp__internal__n_url_entry_connect: {
@@ -4227,8 +4417,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_start_llhttp__on_url;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_req_spaces_before_url:
     s_n_llhttp__internal__n_req_spaces_before_url: {
@@ -4244,8 +4433,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_is_equal_method;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_req_first_space_before_url:
     s_n_llhttp__internal__n_req_first_space_before_url: {
@@ -4258,11 +4446,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_req_spaces_before_url;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_88;
+          goto s_n_llhttp__internal__n_error_92;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_method_complete_1:
     s_n_llhttp__internal__n_invoke_llhttp__on_method_complete_1: {
@@ -4270,12 +4457,11 @@ static llparse_state_t llhttp__internal__run(
         case 0:
           goto s_n_llhttp__internal__n_req_first_space_before_url;
         case 21:
-          goto s_n_llhttp__internal__n_pause_26;
+          goto s_n_llhttp__internal__n_pause_29;
         default:
-          goto s_n_llhttp__internal__n_error_107;
+          goto s_n_llhttp__internal__n_error_111;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_2:
     s_n_llhttp__internal__n_after_start_req_2: {
@@ -4289,11 +4475,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_store_method_1;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_3:
     s_n_llhttp__internal__n_after_start_req_3: {
@@ -4314,11 +4499,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_3;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_1:
     s_n_llhttp__internal__n_after_start_req_1: {
@@ -4335,11 +4519,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_3;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_4:
     s_n_llhttp__internal__n_after_start_req_4: {
@@ -4360,11 +4543,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_4;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_6:
     s_n_llhttp__internal__n_after_start_req_6: {
@@ -4385,11 +4567,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_6;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_8:
     s_n_llhttp__internal__n_after_start_req_8: {
@@ -4410,11 +4591,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_8;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_9:
     s_n_llhttp__internal__n_after_start_req_9: {
@@ -4428,11 +4608,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_store_method_1;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_7:
     s_n_llhttp__internal__n_after_start_req_7: {
@@ -4449,11 +4628,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_9;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_5:
     s_n_llhttp__internal__n_after_start_req_5: {
@@ -4470,11 +4648,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_7;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_12:
     s_n_llhttp__internal__n_after_start_req_12: {
@@ -4495,11 +4672,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_12;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_13:
     s_n_llhttp__internal__n_after_start_req_13: {
@@ -4520,11 +4696,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_13;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_11:
     s_n_llhttp__internal__n_after_start_req_11: {
@@ -4541,11 +4716,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_13;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_10:
     s_n_llhttp__internal__n_after_start_req_10: {
@@ -4558,11 +4732,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_11;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_14:
     s_n_llhttp__internal__n_after_start_req_14: {
@@ -4583,11 +4756,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_14;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_17:
     s_n_llhttp__internal__n_after_start_req_17: {
@@ -4608,11 +4780,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_17;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_16:
     s_n_llhttp__internal__n_after_start_req_16: {
@@ -4629,8 +4800,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_store_method_1;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_15:
     s_n_llhttp__internal__n_after_start_req_15: {
@@ -4650,11 +4820,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_15;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_18:
     s_n_llhttp__internal__n_after_start_req_18: {
@@ -4675,11 +4844,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_18;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_20:
     s_n_llhttp__internal__n_after_start_req_20: {
@@ -4700,11 +4868,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_20;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_21:
     s_n_llhttp__internal__n_after_start_req_21: {
@@ -4725,11 +4892,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_21;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_19:
     s_n_llhttp__internal__n_after_start_req_19: {
@@ -4746,11 +4912,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_21;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_23:
     s_n_llhttp__internal__n_after_start_req_23: {
@@ -4771,11 +4936,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_23;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_24:
     s_n_llhttp__internal__n_after_start_req_24: {
@@ -4796,11 +4960,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_24;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_26:
     s_n_llhttp__internal__n_after_start_req_26: {
@@ -4821,11 +4984,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_26;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_28:
     s_n_llhttp__internal__n_after_start_req_28: {
@@ -4846,11 +5008,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_28;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_29:
     s_n_llhttp__internal__n_after_start_req_29: {
@@ -4864,11 +5025,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_store_method_1;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_27:
     s_n_llhttp__internal__n_after_start_req_27: {
@@ -4885,11 +5045,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_29;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_25:
     s_n_llhttp__internal__n_after_start_req_25: {
@@ -4906,11 +5065,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_27;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_30:
     s_n_llhttp__internal__n_after_start_req_30: {
@@ -4931,11 +5089,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_30;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_22:
     s_n_llhttp__internal__n_after_start_req_22: {
@@ -4960,11 +5117,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_30;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_31:
     s_n_llhttp__internal__n_after_start_req_31: {
@@ -4985,11 +5141,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_31;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_32:
     s_n_llhttp__internal__n_after_start_req_32: {
@@ -5010,11 +5165,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_32;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_35:
     s_n_llhttp__internal__n_after_start_req_35: {
@@ -5035,11 +5189,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_35;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_36:
     s_n_llhttp__internal__n_after_start_req_36: {
@@ -5060,11 +5213,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_36;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_34:
     s_n_llhttp__internal__n_after_start_req_34: {
@@ -5081,11 +5233,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_36;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_37:
     s_n_llhttp__internal__n_after_start_req_37: {
@@ -5106,11 +5257,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_37;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_38:
     s_n_llhttp__internal__n_after_start_req_38: {
@@ -5131,11 +5281,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_38;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_42:
     s_n_llhttp__internal__n_after_start_req_42: {
@@ -5156,11 +5305,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_42;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_43:
     s_n_llhttp__internal__n_after_start_req_43: {
@@ -5181,11 +5329,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_43;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_41:
     s_n_llhttp__internal__n_after_start_req_41: {
@@ -5202,11 +5349,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_43;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_40:
     s_n_llhttp__internal__n_after_start_req_40: {
@@ -5219,11 +5365,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_41;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_39:
     s_n_llhttp__internal__n_after_start_req_39: {
@@ -5241,11 +5386,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_40;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_45:
     s_n_llhttp__internal__n_after_start_req_45: {
@@ -5266,11 +5410,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_45;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_44:
     s_n_llhttp__internal__n_after_start_req_44: {
@@ -5288,11 +5431,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_store_method_1;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_33:
     s_n_llhttp__internal__n_after_start_req_33: {
@@ -5321,11 +5463,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_44;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_46:
     s_n_llhttp__internal__n_after_start_req_46: {
@@ -5346,11 +5487,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_46;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_49:
     s_n_llhttp__internal__n_after_start_req_49: {
@@ -5371,11 +5511,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_49;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_50:
     s_n_llhttp__internal__n_after_start_req_50: {
@@ -5396,11 +5535,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_50;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_51:
     s_n_llhttp__internal__n_after_start_req_51: {
@@ -5421,11 +5559,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_51;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_52:
     s_n_llhttp__internal__n_after_start_req_52: {
@@ -5446,11 +5583,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_52;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_48:
     s_n_llhttp__internal__n_after_start_req_48: {
@@ -5475,11 +5611,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_52;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_47:
     s_n_llhttp__internal__n_after_start_req_47: {
@@ -5492,11 +5627,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_48;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_55:
     s_n_llhttp__internal__n_after_start_req_55: {
@@ -5517,11 +5651,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_55;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_57:
     s_n_llhttp__internal__n_after_start_req_57: {
@@ -5535,11 +5668,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_store_method_1;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_58:
     s_n_llhttp__internal__n_after_start_req_58: {
@@ -5560,11 +5692,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_58;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_56:
     s_n_llhttp__internal__n_after_start_req_56: {
@@ -5581,11 +5712,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_58;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_54:
     s_n_llhttp__internal__n_after_start_req_54: {
@@ -5602,11 +5732,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_56;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_59:
     s_n_llhttp__internal__n_after_start_req_59: {
@@ -5627,11 +5756,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_59;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_60:
     s_n_llhttp__internal__n_after_start_req_60: {
@@ -5652,11 +5780,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_60;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_53:
     s_n_llhttp__internal__n_after_start_req_53: {
@@ -5677,11 +5804,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_60;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_62:
     s_n_llhttp__internal__n_after_start_req_62: {
@@ -5702,11 +5828,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_62;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_63:
     s_n_llhttp__internal__n_after_start_req_63: {
@@ -5727,11 +5852,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_63;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_61:
     s_n_llhttp__internal__n_after_start_req_61: {
@@ -5748,11 +5872,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_63;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_66:
     s_n_llhttp__internal__n_after_start_req_66: {
@@ -5773,11 +5896,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_66;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_68:
     s_n_llhttp__internal__n_after_start_req_68: {
@@ -5798,11 +5920,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_68;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_69:
     s_n_llhttp__internal__n_after_start_req_69: {
@@ -5823,11 +5944,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_69;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_67:
     s_n_llhttp__internal__n_after_start_req_67: {
@@ -5844,11 +5964,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_69;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_70:
     s_n_llhttp__internal__n_after_start_req_70: {
@@ -5869,11 +5988,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_after_start_req_70;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_65:
     s_n_llhttp__internal__n_after_start_req_65: {
@@ -5894,11 +6012,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_70;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req_64:
     s_n_llhttp__internal__n_after_start_req_64: {
@@ -5911,11 +6028,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_65;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_after_start_req:
     s_n_llhttp__internal__n_after_start_req: {
@@ -5992,11 +6108,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_after_start_req_64;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_108;
+          goto s_n_llhttp__internal__n_error_112;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_method_1:
     s_n_llhttp__internal__n_span_start_llhttp__on_method_1: {
@@ -6006,8 +6121,7 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_method;
       goto s_n_llhttp__internal__n_after_start_req;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_res_line_almost_done:
     s_n_llhttp__internal__n_res_line_almost_done: {
@@ -6027,8 +6141,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_test_lenient_flags_29;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_test_lenient_flags_30:
     s_n_llhttp__internal__n_invoke_test_lenient_flags_30: {
@@ -6036,10 +6149,9 @@ static llparse_state_t llhttp__internal__run(
         case 1:
           goto s_n_llhttp__internal__n_invoke_llhttp__on_status_complete;
         default:
-          goto s_n_llhttp__internal__n_error_94;
+          goto s_n_llhttp__internal__n_error_98;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_res_status:
     s_n_llhttp__internal__n_res_status: {
@@ -6058,8 +6170,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_res_status;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_status:
     s_n_llhttp__internal__n_span_start_llhttp__on_status: {
@@ -6069,8 +6180,7 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_status;
       goto s_n_llhttp__internal__n_res_status;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_res_status_code_otherwise:
     s_n_llhttp__internal__n_res_status_code_otherwise: {
@@ -6091,11 +6201,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_start_llhttp__on_status;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_95;
+          goto s_n_llhttp__internal__n_error_99;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_res_status_code_digit_3:
     s_n_llhttp__internal__n_res_status_code_digit_3: {
@@ -6154,11 +6263,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_mul_add_status_code_2;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_97;
+          goto s_n_llhttp__internal__n_error_101;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_res_status_code_digit_2:
     s_n_llhttp__internal__n_res_status_code_digit_2: {
@@ -6217,11 +6325,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_mul_add_status_code_1;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_99;
+          goto s_n_llhttp__internal__n_error_103;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_res_status_code_digit_1:
     s_n_llhttp__internal__n_res_status_code_digit_1: {
@@ -6280,11 +6387,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_mul_add_status_code;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_101;
+          goto s_n_llhttp__internal__n_error_105;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_res_after_version:
     s_n_llhttp__internal__n_res_after_version: {
@@ -6297,11 +6403,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_status_code;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_102;
+          goto s_n_llhttp__internal__n_error_106;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_version_complete_1:
     s_n_llhttp__internal__n_invoke_llhttp__on_version_complete_1: {
@@ -6309,32 +6414,29 @@ static llparse_state_t llhttp__internal__run(
         case 0:
           goto s_n_llhttp__internal__n_res_after_version;
         case 21:
-          goto s_n_llhttp__internal__n_pause_25;
+          goto s_n_llhttp__internal__n_pause_28;
         default:
-          goto s_n_llhttp__internal__n_error_90;
+          goto s_n_llhttp__internal__n_error_94;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
-    case s_n_llhttp__internal__n_error_89:
-    s_n_llhttp__internal__n_error_89: {
+    case s_n_llhttp__internal__n_error_93:
+    s_n_llhttp__internal__n_error_93: {
       state->error = 0x9;
       state->reason = "Invalid HTTP version";
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
-    case s_n_llhttp__internal__n_error_103:
-    s_n_llhttp__internal__n_error_103: {
+    case s_n_llhttp__internal__n_error_107:
+    s_n_llhttp__internal__n_error_107: {
       state->error = 0x9;
       state->reason = "Invalid minor version";
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_res_http_minor:
     s_n_llhttp__internal__n_res_http_minor: {
@@ -6396,18 +6498,16 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_end_llhttp__on_version_7;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
-    case s_n_llhttp__internal__n_error_104:
-    s_n_llhttp__internal__n_error_104: {
+    case s_n_llhttp__internal__n_error_108:
+    s_n_llhttp__internal__n_error_108: {
       state->error = 0x9;
       state->reason = "Expected dot";
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_res_http_dot:
     s_n_llhttp__internal__n_res_http_dot: {
@@ -6423,18 +6523,16 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_end_llhttp__on_version_8;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
-    case s_n_llhttp__internal__n_error_105:
-    s_n_llhttp__internal__n_error_105: {
+    case s_n_llhttp__internal__n_error_109:
+    s_n_llhttp__internal__n_error_109: {
       state->error = 0x9;
       state->reason = "Invalid major version";
       state->error_pos = (const char*) p;
       state->_current = (void*) (intptr_t) s_error;
       return s_error;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_res_http_major:
     s_n_llhttp__internal__n_res_http_major: {
@@ -6496,8 +6594,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_span_end_llhttp__on_version_9;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_version_1:
     s_n_llhttp__internal__n_span_start_llhttp__on_version_1: {
@@ -6507,32 +6604,147 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_version;
       goto s_n_llhttp__internal__n_res_http_major;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
-    case s_n_llhttp__internal__n_start_res:
-    s_n_llhttp__internal__n_start_res: {
+    case s_n_llhttp__internal__n_res_after_protocol:
+    s_n_llhttp__internal__n_res_after_protocol: {
+      if (p == endp) {
+        return s_n_llhttp__internal__n_res_after_protocol;
+      }
+      switch (*p) {
+        case '/': {
+          p++;
+          goto s_n_llhttp__internal__n_span_start_llhttp__on_version_1;
+        }
+        default: {
+          goto s_n_llhttp__internal__n_error_114;
+        }
+      }
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_3:
+    s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_3: {
+      switch (llhttp__on_protocol_complete(state, p, endp)) {
+        case 0:
+          goto s_n_llhttp__internal__n_res_after_protocol;
+        case 21:
+          goto s_n_llhttp__internal__n_pause_30;
+        default:
+          goto s_n_llhttp__internal__n_error_113;
+      }
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_error_115:
+    s_n_llhttp__internal__n_error_115: {
+      state->error = 0x8;
+      state->reason = "Expected HTTP/, RTSP/ or ICE/";
+      state->error_pos = (const char*) p;
+      state->_current = (void*) (intptr_t) s_error;
+      return s_error;
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_res_after_start_1:
+    s_n_llhttp__internal__n_res_after_start_1: {
       llparse_match_t match_seq;
       
       if (p == endp) {
-        return s_n_llhttp__internal__n_start_res;
+        return s_n_llhttp__internal__n_res_after_start_1;
       }
-      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob58, 5);
+      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob58, 3);
       p = match_seq.current;
       switch (match_seq.status) {
         case kMatchComplete: {
           p++;
-          goto s_n_llhttp__internal__n_span_start_llhttp__on_version_1;
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol_4;
+        }
+        case kMatchPause: {
+          return s_n_llhttp__internal__n_res_after_start_1;
+        }
+        case kMatchMismatch: {
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol_5;
+        }
+      }
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_res_after_start_2:
+    s_n_llhttp__internal__n_res_after_start_2: {
+      llparse_match_t match_seq;
+      
+      if (p == endp) {
+        return s_n_llhttp__internal__n_res_after_start_2;
+      }
+      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob59, 2);
+      p = match_seq.current;
+      switch (match_seq.status) {
+        case kMatchComplete: {
+          p++;
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol_4;
+        }
+        case kMatchPause: {
+          return s_n_llhttp__internal__n_res_after_start_2;
+        }
+        case kMatchMismatch: {
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol_5;
+        }
+      }
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_res_after_start_3:
+    s_n_llhttp__internal__n_res_after_start_3: {
+      llparse_match_t match_seq;
+      
+      if (p == endp) {
+        return s_n_llhttp__internal__n_res_after_start_3;
+      }
+      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob60, 3);
+      p = match_seq.current;
+      switch (match_seq.status) {
+        case kMatchComplete: {
+          p++;
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol_4;
         }
         case kMatchPause: {
-          return s_n_llhttp__internal__n_start_res;
+          return s_n_llhttp__internal__n_res_after_start_3;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_109;
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol_5;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_res_after_start:
+    s_n_llhttp__internal__n_res_after_start: {
+      if (p == endp) {
+        return s_n_llhttp__internal__n_res_after_start;
+      }
+      switch (*p) {
+        case 'H': {
+          p++;
+          goto s_n_llhttp__internal__n_res_after_start_1;
+        }
+        case 'I': {
+          p++;
+          goto s_n_llhttp__internal__n_res_after_start_2;
+        }
+        case 'R': {
+          p++;
+          goto s_n_llhttp__internal__n_res_after_start_3;
+        }
+        default: {
+          goto s_n_llhttp__internal__n_span_end_llhttp__on_protocol_5;
+        }
+      }
+      UNREACHABLE;
+    }
+    case s_n_llhttp__internal__n_span_start_llhttp__on_protocol_1:
+    s_n_llhttp__internal__n_span_start_llhttp__on_protocol_1: {
+      if (p == endp) {
+        return s_n_llhttp__internal__n_span_start_llhttp__on_protocol_1;
+      }
+      state->_span_pos0 = (void*) p;
+      state->_span_cb0 = llhttp__on_protocol;
+      goto s_n_llhttp__internal__n_res_after_start;
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_llhttp__on_method_complete:
     s_n_llhttp__internal__n_invoke_llhttp__on_method_complete: {
@@ -6540,12 +6752,11 @@ static llparse_state_t llhttp__internal__run(
         case 0:
           goto s_n_llhttp__internal__n_req_first_space_before_url;
         case 21:
-          goto s_n_llhttp__internal__n_pause_23;
+          goto s_n_llhttp__internal__n_pause_26;
         default:
           goto s_n_llhttp__internal__n_error_1;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_req_or_res_method_2:
     s_n_llhttp__internal__n_req_or_res_method_2: {
@@ -6554,7 +6765,7 @@ static llparse_state_t llhttp__internal__run(
       if (p == endp) {
         return s_n_llhttp__internal__n_req_or_res_method_2;
       }
-      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob59, 2);
+      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob61, 2);
       p = match_seq.current;
       switch (match_seq.status) {
         case kMatchComplete: {
@@ -6566,11 +6777,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_req_or_res_method_2;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_106;
+          goto s_n_llhttp__internal__n_error_110;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_update_type_1:
     s_n_llhttp__internal__n_invoke_update_type_1: {
@@ -6578,8 +6788,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_span_start_llhttp__on_version_1;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_req_or_res_method_3:
     s_n_llhttp__internal__n_req_or_res_method_3: {
@@ -6588,7 +6797,7 @@ static llparse_state_t llhttp__internal__run(
       if (p == endp) {
         return s_n_llhttp__internal__n_req_or_res_method_3;
       }
-      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob60, 3);
+      match_seq = llparse__match_sequence_id(state, p, endp, llparse_blob62, 3);
       p = match_seq.current;
       switch (match_seq.status) {
         case kMatchComplete: {
@@ -6599,11 +6808,10 @@ static llparse_state_t llhttp__internal__run(
           return s_n_llhttp__internal__n_req_or_res_method_3;
         }
         case kMatchMismatch: {
-          goto s_n_llhttp__internal__n_error_106;
+          goto s_n_llhttp__internal__n_error_110;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_req_or_res_method_1:
     s_n_llhttp__internal__n_req_or_res_method_1: {
@@ -6620,11 +6828,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_req_or_res_method_3;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_106;
+          goto s_n_llhttp__internal__n_error_110;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_req_or_res_method:
     s_n_llhttp__internal__n_req_or_res_method: {
@@ -6637,11 +6844,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_req_or_res_method_1;
         }
         default: {
-          goto s_n_llhttp__internal__n_error_106;
+          goto s_n_llhttp__internal__n_error_110;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_span_start_llhttp__on_method:
     s_n_llhttp__internal__n_span_start_llhttp__on_method: {
@@ -6651,8 +6857,7 @@ static llparse_state_t llhttp__internal__run(
       state->_span_pos0 = (void*) p;
       state->_span_cb0 = llhttp__on_method;
       goto s_n_llhttp__internal__n_req_or_res_method;
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_start_req_or_res:
     s_n_llhttp__internal__n_start_req_or_res: {
@@ -6667,8 +6872,7 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_update_type_2;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_load_type:
     s_n_llhttp__internal__n_invoke_load_type: {
@@ -6676,12 +6880,11 @@ static llparse_state_t llhttp__internal__run(
         case 1:
           goto s_n_llhttp__internal__n_span_start_llhttp__on_method_1;
         case 2:
-          goto s_n_llhttp__internal__n_start_res;
+          goto s_n_llhttp__internal__n_span_start_llhttp__on_protocol_1;
         default:
           goto s_n_llhttp__internal__n_start_req_or_res;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_invoke_update_finish:
     s_n_llhttp__internal__n_invoke_update_finish: {
@@ -6689,8 +6892,7 @@ static llparse_state_t llhttp__internal__run(
         default:
           goto s_n_llhttp__internal__n_invoke_llhttp__on_message_begin;
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     case s_n_llhttp__internal__n_start:
     s_n_llhttp__internal__n_start: {
@@ -6710,12 +6912,10 @@ static llparse_state_t llhttp__internal__run(
           goto s_n_llhttp__internal__n_invoke_load_initial_message_completed;
         }
       }
-      /* UNREACHABLE */;
-      abort();
+      UNREACHABLE;
     }
     default:
-      /* UNREACHABLE */
-      abort();
+      UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_2: {
     state->error = 0x7;
@@ -6723,32 +6923,28 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_finish_2: {
     switch (llhttp__internal__c_update_finish_1(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_start;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_initial_message_completed: {
     switch (llhttp__internal__c_update_initial_message_completed(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_finish_2;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_content_length: {
     switch (llhttp__internal__c_update_content_length(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_initial_message_completed;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_8: {
     state->error = 0x5;
@@ -6756,8 +6952,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_3: {
     switch (llhttp__internal__c_test_lenient_flags_3(state, p, endp)) {
@@ -6766,8 +6961,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_8;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_2: {
     switch (llhttp__internal__c_test_lenient_flags_2(state, p, endp)) {
@@ -6776,16 +6970,14 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_closed;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_finish_1: {
     switch (llhttp__internal__c_update_finish_1(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_test_lenient_flags_2;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_13: {
     state->error = 0x15;
@@ -6793,8 +6985,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_is_equal_upgrade;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_38: {
     state->error = 0x12;
@@ -6802,8 +6993,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_15: {
     state->error = 0x15;
@@ -6811,8 +7001,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_llhttp__on_message_complete_2;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_40: {
     state->error = 0x14;
@@ -6820,8 +7009,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_chunk_complete_1: {
     switch (llhttp__on_chunk_complete(state, p, endp)) {
@@ -6832,8 +7020,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_40;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_2: {
     state->error = 0x15;
@@ -6841,8 +7028,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_pause_1;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_9: {
     state->error = 0x12;
@@ -6850,8 +7036,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_message_complete_1: {
     switch (llhttp__on_message_complete(state, p, endp)) {
@@ -6862,8 +7047,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_9;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_36: {
     state->error = 0xc;
@@ -6871,8 +7055,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_10: {
     state->error = 0xc;
@@ -6880,8 +7063,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_4: {
     switch (llhttp__internal__c_test_lenient_flags_4(state, p, endp)) {
@@ -6890,8 +7072,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_10;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_3: {
     state->error = 0x15;
@@ -6899,8 +7080,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_update_content_length_1;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_14: {
     state->error = 0x14;
@@ -6908,8 +7088,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_chunk_complete: {
     switch (llhttp__on_chunk_complete(state, p, endp)) {
@@ -6920,8 +7099,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_14;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_13: {
     state->error = 0x19;
@@ -6929,8 +7107,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_6: {
     switch (llhttp__internal__c_test_lenient_flags_1(state, p, endp)) {
@@ -6939,8 +7116,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_13;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_15: {
     state->error = 0x2;
@@ -6948,8 +7124,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_7: {
     switch (llhttp__internal__c_test_lenient_flags_7(state, p, endp)) {
@@ -6958,8 +7133,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_15;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_body: {
     const unsigned char* start;
@@ -6975,16 +7149,14 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_chunk_data_almost_done;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags: {
     switch (llhttp__internal__c_or_flags(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_header_field_start;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_4: {
     state->error = 0x15;
@@ -6992,8 +7164,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_is_equal_content_length;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_12: {
     state->error = 0x13;
@@ -7001,8 +7172,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_chunk_header: {
     switch (llhttp__on_chunk_header(state, p, endp)) {
@@ -7013,8 +7183,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_12;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_16: {
     state->error = 0x2;
@@ -7022,8 +7191,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_8: {
     switch (llhttp__internal__c_test_lenient_flags_8(state, p, endp)) {
@@ -7032,8 +7200,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_16;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_11: {
     state->error = 0x19;
@@ -7041,8 +7208,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_5: {
     switch (llhttp__internal__c_test_lenient_flags_1(state, p, endp)) {
@@ -7051,8 +7217,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_11;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_17: {
     state->error = 0x2;
@@ -7060,8 +7225,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_18: {
     state->error = 0x2;
@@ -7069,8 +7233,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_20: {
     state->error = 0x19;
@@ -7078,8 +7241,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_5: {
     state->error = 0x15;
@@ -7087,8 +7249,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_test_lenient_flags_9;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_19: {
     state->error = 0x22;
@@ -7096,8 +7257,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_name: {
     const unsigned char* start;
@@ -7113,8 +7273,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_name_complete;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_6: {
     state->error = 0x15;
@@ -7122,8 +7281,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_chunk_size_almost_done;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_21: {
     state->error = 0x22;
@@ -7131,8 +7289,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_name_1: {
     const unsigned char* start;
@@ -7149,8 +7306,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_name_complete_1;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_7: {
     state->error = 0x15;
@@ -7158,8 +7314,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_chunk_extensions;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_22: {
     state->error = 0x22;
@@ -7167,8 +7322,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_name_2: {
     const unsigned char* start;
@@ -7185,8 +7339,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_name_complete_2;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_25: {
     state->error = 0x19;
@@ -7194,8 +7347,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_8: {
     state->error = 0x15;
@@ -7203,8 +7355,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_test_lenient_flags_10;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_24: {
     state->error = 0x23;
@@ -7212,8 +7363,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_value: {
     const unsigned char* start;
@@ -7229,8 +7379,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_value_complete;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_9: {
     state->error = 0x15;
@@ -7238,8 +7387,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_chunk_size_almost_done;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_26: {
     state->error = 0x23;
@@ -7247,8 +7395,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_value_1: {
     const unsigned char* start;
@@ -7265,8 +7412,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_value_complete_1;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_28: {
     state->error = 0x19;
@@ -7274,8 +7420,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_11: {
     switch (llhttp__internal__c_test_lenient_flags_1(state, p, endp)) {
@@ -7284,8 +7429,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_28;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_29: {
     state->error = 0x2;
@@ -7293,8 +7437,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_10: {
     state->error = 0x15;
@@ -7302,8 +7445,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_chunk_extension_quoted_value_done;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_27: {
     state->error = 0x23;
@@ -7311,8 +7453,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_value_2: {
     const unsigned char* start;
@@ -7328,8 +7469,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_value_complete_2;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_value_3: {
     const unsigned char* start;
@@ -7346,8 +7486,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_error_30;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_value_4: {
     const unsigned char* start;
@@ -7364,8 +7503,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_error_31;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_11: {
     state->error = 0x15;
@@ -7373,8 +7511,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_chunk_extensions;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_32: {
     state->error = 0x23;
@@ -7382,8 +7519,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_value_5: {
     const unsigned char* start;
@@ -7400,8 +7536,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_value_complete_3;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_value_6: {
     const unsigned char* start;
@@ -7418,8 +7553,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_error_33;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_12: {
     state->error = 0x15;
@@ -7427,8 +7561,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_chunk_extension_value;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_23: {
     state->error = 0x22;
@@ -7436,8 +7569,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_chunk_extension_name_complete_3: {
     switch (llhttp__on_chunk_extension_name_complete(state, p, endp)) {
@@ -7448,8 +7580,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_23;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_name_3: {
     const unsigned char* start;
@@ -7466,8 +7597,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_span_start_llhttp__on_chunk_extension_value;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_chunk_extension_name_4: {
     const unsigned char* start;
@@ -7484,8 +7614,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_error_34;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_35: {
     state->error = 0xc;
@@ -7493,8 +7622,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_mul_add_content_length: {
     switch (llhttp__internal__c_mul_add_content_length(state, p, endp, match)) {
@@ -7503,8 +7631,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_chunk_size;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_37: {
     state->error = 0xc;
@@ -7512,8 +7639,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_body_1: {
     const unsigned char* start;
@@ -7529,16 +7655,14 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_invoke_llhttp__on_message_complete_2;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_finish_3: {
     switch (llhttp__internal__c_update_finish_3(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_span_start_llhttp__on_body_2;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_39: {
     state->error = 0xf;
@@ -7546,8 +7670,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause: {
     state->error = 0x15;
@@ -7555,8 +7678,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_llhttp__after_message_complete;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_7: {
     state->error = 0x12;
@@ -7564,8 +7686,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_message_complete: {
     switch (llhttp__on_message_complete(state, p, endp)) {
@@ -7576,32 +7697,28 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_7;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_1: {
     switch (llhttp__internal__c_or_flags_1(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_llhttp__after_headers_complete;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_2: {
     switch (llhttp__internal__c_or_flags_1(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_llhttp__after_headers_complete;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_upgrade: {
     switch (llhttp__internal__c_update_upgrade(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_or_flags_2;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_14: {
     state->error = 0x15;
@@ -7609,8 +7726,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_llhttp__after_headers_complete;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_6: {
     state->error = 0x11;
@@ -7618,8 +7734,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_headers_complete: {
     switch (llhttp__on_headers_complete(state, p, endp)) {
@@ -7634,16 +7749,14 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_6;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__before_headers_complete: {
     switch (llhttp__before_headers_complete(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_llhttp__on_headers_complete;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_flags: {
     switch (llhttp__internal__c_test_flags(state, p, endp)) {
@@ -7652,8 +7765,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_invoke_llhttp__before_headers_complete;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_1: {
     switch (llhttp__internal__c_test_lenient_flags_1(state, p, endp)) {
@@ -7662,8 +7774,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_5;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_17: {
     state->error = 0x15;
@@ -7671,8 +7782,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_llhttp__on_message_complete_2;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_42: {
     state->error = 0x14;
@@ -7680,8 +7790,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_chunk_complete_2: {
     switch (llhttp__on_chunk_complete(state, p, endp)) {
@@ -7692,32 +7801,28 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_42;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_3: {
     switch (llhttp__internal__c_or_flags_1(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_llhttp__after_headers_complete;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_4: {
     switch (llhttp__internal__c_or_flags_1(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_llhttp__after_headers_complete;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_upgrade_1: {
     switch (llhttp__internal__c_update_upgrade(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_or_flags_4;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_16: {
     state->error = 0x15;
@@ -7725,8 +7830,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_llhttp__after_headers_complete;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_41: {
     state->error = 0x11;
@@ -7734,8 +7838,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_headers_complete_1: {
     switch (llhttp__on_headers_complete(state, p, endp)) {
@@ -7750,16 +7853,14 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_41;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__before_headers_complete_1: {
     switch (llhttp__before_headers_complete(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_llhttp__on_headers_complete_1;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_flags_1: {
     switch (llhttp__internal__c_test_flags(state, p, endp)) {
@@ -7768,8 +7869,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_invoke_llhttp__before_headers_complete_1;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_43: {
     state->error = 0x2;
@@ -7777,8 +7877,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_12: {
     switch (llhttp__internal__c_test_lenient_flags_8(state, p, endp)) {
@@ -7787,8 +7886,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_43;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_44: {
     state->error = 0xa;
@@ -7796,8 +7894,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_header_field: {
     const unsigned char* start;
@@ -7814,8 +7911,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_error_5;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_13: {
     switch (llhttp__internal__c_test_lenient_flags(state, p, endp)) {
@@ -7824,8 +7920,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_span_end_llhttp__on_header_field;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_60: {
     state->error = 0xb;
@@ -7833,8 +7928,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_47: {
     state->error = 0xa;
@@ -7842,8 +7936,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_15: {
     switch (llhttp__internal__c_test_lenient_flags(state, p, endp)) {
@@ -7852,8 +7945,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_47;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_49: {
     state->error = 0xb;
@@ -7861,8 +7953,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_18: {
     state->error = 0x15;
@@ -7870,8 +7961,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_header_field_start;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_48: {
     state->error = 0x1d;
@@ -7879,8 +7969,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_header_value: {
     const unsigned char* start;
@@ -7896,48 +7985,42 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_invoke_llhttp__on_header_value_complete;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_header_state: {
     switch (llhttp__internal__c_update_header_state(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_5: {
     switch (llhttp__internal__c_or_flags_5(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_header_state;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_6: {
     switch (llhttp__internal__c_or_flags_6(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_header_state;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_7: {
     switch (llhttp__internal__c_or_flags_7(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_header_state;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_8: {
     switch (llhttp__internal__c_or_flags_8(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_header_state_2: {
     switch (llhttp__internal__c_load_header_state(state, p, endp)) {
@@ -7952,8 +8035,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_header_state_1: {
     switch (llhttp__internal__c_load_header_state(state, p, endp)) {
@@ -7962,8 +8044,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_invoke_load_header_state_2;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_46: {
     state->error = 0xa;
@@ -7971,8 +8052,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_14: {
     switch (llhttp__internal__c_test_lenient_flags_1(state, p, endp)) {
@@ -7981,8 +8061,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_46;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_50: {
     state->error = 0x2;
@@ -7990,8 +8069,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_16: {
     switch (llhttp__internal__c_test_lenient_flags(state, p, endp)) {
@@ -8000,16 +8078,14 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_50;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_header_state_1: {
     switch (llhttp__internal__c_update_header_state_1(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_header_state_4: {
     switch (llhttp__internal__c_load_header_state(state, p, endp)) {
@@ -8018,8 +8094,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_span_start_llhttp__on_header_value_1;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_52: {
     state->error = 0xa;
@@ -8027,8 +8102,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_18: {
     switch (llhttp__internal__c_test_lenient_flags(state, p, endp)) {
@@ -8037,48 +8111,42 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_52;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_header_state_2: {
     switch (llhttp__internal__c_update_header_state(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_llhttp__on_header_value_complete;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_9: {
     switch (llhttp__internal__c_or_flags_5(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_header_state_2;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_10: {
     switch (llhttp__internal__c_or_flags_6(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_header_state_2;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_11: {
     switch (llhttp__internal__c_or_flags_7(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_header_state_2;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_12: {
     switch (llhttp__internal__c_or_flags_8(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_llhttp__on_header_value_complete;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_header_state_5: {
     switch (llhttp__internal__c_load_header_state(state, p, endp)) {
@@ -8093,8 +8161,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_invoke_llhttp__on_header_value_complete;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_53: {
     state->error = 0x3;
@@ -8102,8 +8169,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_51: {
     state->error = 0x19;
@@ -8111,8 +8177,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_header_value_1: {
     const unsigned char* start;
@@ -8128,8 +8193,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_invoke_test_lenient_flags_17;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_header_value_2: {
     const unsigned char* start;
@@ -8146,8 +8210,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_header_value_almost_done;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_header_value_4: {
     const unsigned char* start;
@@ -8163,8 +8226,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_header_value_almost_done;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_header_value_5: {
     const unsigned char* start;
@@ -8181,8 +8243,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_header_value_almost_done;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_header_value_3: {
     const unsigned char* start;
@@ -8198,8 +8259,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_error_54;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_19: {
     switch (llhttp__internal__c_test_lenient_flags(state, p, endp)) {
@@ -8208,48 +8268,42 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_span_end_llhttp__on_header_value_3;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_header_state_4: {
     switch (llhttp__internal__c_update_header_state(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_header_value_connection;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_13: {
     switch (llhttp__internal__c_or_flags_5(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_header_state_4;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_14: {
     switch (llhttp__internal__c_or_flags_6(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_header_state_4;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_15: {
     switch (llhttp__internal__c_or_flags_7(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_header_state_4;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_16: {
     switch (llhttp__internal__c_or_flags_8(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_header_value_connection;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_header_state_6: {
     switch (llhttp__internal__c_load_header_state(state, p, endp)) {
@@ -8264,40 +8318,35 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_header_value_connection;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_header_state_5: {
     switch (llhttp__internal__c_update_header_state_1(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_header_value_connection_token;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_header_state_3: {
     switch (llhttp__internal__c_update_header_state_3(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_header_value_connection_ws;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_header_state_6: {
     switch (llhttp__internal__c_update_header_state_6(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_header_value_connection_ws;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_header_state_7: {
     switch (llhttp__internal__c_update_header_state_7(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_header_value_connection_ws;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_header_value_6: {
     const unsigned char* start;
@@ -8313,8 +8362,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_error_56;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_mul_add_content_length_1: {
     switch (llhttp__internal__c_mul_add_content_length_1(state, p, endp, match)) {
@@ -8323,16 +8371,14 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_header_value_content_length;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_17: {
     switch (llhttp__internal__c_or_flags_17(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_header_value_otherwise;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_header_value_7: {
     const unsigned char* start;
@@ -8348,8 +8394,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_error_57;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_55: {
     state->error = 0x4;
@@ -8357,8 +8402,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_flags_2: {
     switch (llhttp__internal__c_test_flags_2(state, p, endp)) {
@@ -8367,8 +8411,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_55;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_header_value_9: {
     const unsigned char* start;
@@ -8385,16 +8428,14 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_error_59;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_header_state_8: {
     switch (llhttp__internal__c_update_header_state_8(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_header_value_otherwise;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_header_value_8: {
     const unsigned char* start;
@@ -8411,8 +8452,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_error_58;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_20: {
     switch (llhttp__internal__c_test_lenient_flags_20(state, p, endp)) {
@@ -8421,8 +8461,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_header_value_te_chunked;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_type_1: {
     switch (llhttp__internal__c_load_type(state, p, endp)) {
@@ -8431,32 +8470,28 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_header_value_te_chunked;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_header_state_9: {
     switch (llhttp__internal__c_update_header_state_1(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_header_value;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_and_flags: {
     switch (llhttp__internal__c_and_flags(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_header_value_te_chunked;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_19: {
     switch (llhttp__internal__c_or_flags_18(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_and_flags;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_21: {
     switch (llhttp__internal__c_test_lenient_flags_20(state, p, endp)) {
@@ -8465,8 +8500,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_invoke_or_flags_19;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_type_2: {
     switch (llhttp__internal__c_load_type(state, p, endp)) {
@@ -8475,16 +8509,14 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_invoke_or_flags_19;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_18: {
     switch (llhttp__internal__c_or_flags_18(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_and_flags;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_flags_3: {
     switch (llhttp__internal__c_test_flags_3(state, p, endp)) {
@@ -8493,16 +8525,14 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_invoke_or_flags_18;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_or_flags_20: {
     switch (llhttp__internal__c_or_flags_20(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_header_state_9;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_header_state_3: {
     switch (llhttp__internal__c_load_header_state(state, p, endp)) {
@@ -8517,8 +8547,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_header_value;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_22: {
     switch (llhttp__internal__c_test_lenient_flags_22(state, p, endp)) {
@@ -8527,8 +8556,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_header_value_discard_ws;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_flags_4: {
     switch (llhttp__internal__c_test_flags_4(state, p, endp)) {
@@ -8537,8 +8565,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_header_value_discard_ws;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_61: {
     state->error = 0xf;
@@ -8546,8 +8573,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_23: {
     switch (llhttp__internal__c_test_lenient_flags_22(state, p, endp)) {
@@ -8556,8 +8582,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_header_value_discard_ws;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_flags_5: {
     switch (llhttp__internal__c_test_flags_2(state, p, endp)) {
@@ -8566,8 +8591,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_header_value_discard_ws;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_19: {
     state->error = 0x15;
@@ -8575,8 +8599,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_load_header_state;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_45: {
     state->error = 0x1c;
@@ -8584,8 +8607,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_header_field_1: {
     const unsigned char* start;
@@ -8602,8 +8624,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_invoke_llhttp__on_header_field_complete;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_header_field_2: {
     const unsigned char* start;
@@ -8620,8 +8641,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_invoke_llhttp__on_header_field_complete;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_62: {
     state->error = 0xa;
@@ -8629,32 +8649,28 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_header_state_10: {
     switch (llhttp__internal__c_update_header_state_1(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_header_field_general;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_store_header_state: {
     switch (llhttp__internal__c_store_header_state(state, p, endp, match)) {
       default:
         goto s_n_llhttp__internal__n_header_field_colon;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_header_state_11: {
     switch (llhttp__internal__c_update_header_state_1(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_header_field_general;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_4: {
     state->error = 0x1e;
@@ -8662,8 +8678,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags: {
     switch (llhttp__internal__c_test_lenient_flags(state, p, endp)) {
@@ -8672,8 +8687,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_4;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_20: {
     state->error = 0x15;
@@ -8681,8 +8695,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_headers_start;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_3: {
     state->error = 0x1a;
@@ -8690,8 +8703,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_url_complete: {
     switch (llhttp__on_url_complete(state, p, endp)) {
@@ -8702,24 +8714,21 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_error_3;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_http_minor: {
     switch (llhttp__internal__c_update_http_minor(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_llhttp__on_url_complete;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_http_major: {
     switch (llhttp__internal__c_update_http_major(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_http_minor;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_3: {
     const unsigned char* start;
@@ -8735,8 +8744,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_to_http09;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_63: {
     state->error = 0x7;
@@ -8744,8 +8752,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_4: {
     const unsigned char* start;
@@ -8761,73 +8768,65 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_lf_to_http09;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_71: {
+  s_n_llhttp__internal__n_error_72: {
     state->error = 0x17;
     state->reason = "Pause on PRI/Upgrade";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_72: {
+  s_n_llhttp__internal__n_error_73: {
     state->error = 0x9;
     state->reason = "Expected HTTP/2 Connection Preface";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_69: {
+  s_n_llhttp__internal__n_error_70: {
     state->error = 0x2;
     state->reason = "Expected CRLF after version";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_26: {
     switch (llhttp__internal__c_test_lenient_flags_8(state, p, endp)) {
       case 1:
         goto s_n_llhttp__internal__n_headers_start;
       default:
-        goto s_n_llhttp__internal__n_error_69;
+        goto s_n_llhttp__internal__n_error_70;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_68: {
+  s_n_llhttp__internal__n_error_69: {
     state->error = 0x9;
     state->reason = "Expected CRLF after version";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_25: {
     switch (llhttp__internal__c_test_lenient_flags_1(state, p, endp)) {
       case 1:
         goto s_n_llhttp__internal__n_req_http_complete_crlf;
       default:
-        goto s_n_llhttp__internal__n_error_68;
+        goto s_n_llhttp__internal__n_error_69;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_70: {
+  s_n_llhttp__internal__n_error_71: {
     state->error = 0x9;
     state->reason = "Expected CRLF after version";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_pause_21: {
     state->error = 0x15;
@@ -8835,17 +8834,15 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_load_method_1;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_67: {
+  s_n_llhttp__internal__n_error_68: {
     state->error = 0x21;
     state->reason = "`on_version_complete` callback error";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_version_1: {
     const unsigned char* start;
@@ -8861,8 +8858,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_invoke_llhttp__on_version_complete;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_version: {
     const unsigned char* start;
@@ -8874,12 +8870,11 @@ static llparse_state_t llhttp__internal__run(
     if (err != 0) {
       state->error = err;
       state->error_pos = (const char*) p;
-      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_66;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_67;
       return s_error;
     }
-    goto s_n_llhttp__internal__n_error_66;
-    /* UNREACHABLE */;
-    abort();
+    goto s_n_llhttp__internal__n_error_67;
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_http_minor: {
     switch (llhttp__internal__c_load_http_minor(state, p, endp)) {
@@ -8888,8 +8883,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_span_end_llhttp__on_version;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_http_minor_1: {
     switch (llhttp__internal__c_load_http_minor(state, p, endp)) {
@@ -8900,8 +8894,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_span_end_llhttp__on_version;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_http_minor_2: {
     switch (llhttp__internal__c_load_http_minor(state, p, endp)) {
@@ -8910,8 +8903,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_span_end_llhttp__on_version;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_http_major: {
     switch (llhttp__internal__c_load_http_major(state, p, endp)) {
@@ -8924,8 +8916,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_span_end_llhttp__on_version;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_24: {
     switch (llhttp__internal__c_test_lenient_flags_24(state, p, endp)) {
@@ -8934,16 +8925,14 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_invoke_load_http_major;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_store_http_minor: {
     switch (llhttp__internal__c_store_http_minor(state, p, endp, match)) {
       default:
         goto s_n_llhttp__internal__n_invoke_test_lenient_flags_24;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_version_2: {
     const unsigned char* start;
@@ -8955,12 +8944,11 @@ static llparse_state_t llhttp__internal__run(
     if (err != 0) {
       state->error = err;
       state->error_pos = (const char*) p;
-      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_73;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_74;
       return s_error;
     }
-    goto s_n_llhttp__internal__n_error_73;
-    /* UNREACHABLE */;
-    abort();
+    goto s_n_llhttp__internal__n_error_74;
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_version_3: {
     const unsigned char* start;
@@ -8972,20 +8960,18 @@ static llparse_state_t llhttp__internal__run(
     if (err != 0) {
       state->error = err;
       state->error_pos = (const char*) p;
-      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_74;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_75;
       return s_error;
     }
-    goto s_n_llhttp__internal__n_error_74;
-    /* UNREACHABLE */;
-    abort();
+    goto s_n_llhttp__internal__n_error_75;
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_store_http_major: {
     switch (llhttp__internal__c_store_http_major(state, p, endp, match)) {
       default:
         goto s_n_llhttp__internal__n_req_http_dot;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_version_4: {
     const unsigned char* start;
@@ -8997,183 +8983,163 @@ static llparse_state_t llhttp__internal__run(
     if (err != 0) {
       state->error = err;
       state->error_pos = (const char*) p;
-      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_75;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_76;
       return s_error;
     }
-    goto s_n_llhttp__internal__n_error_75;
-    /* UNREACHABLE */;
-    abort();
+    goto s_n_llhttp__internal__n_error_76;
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_65: {
+  s_n_llhttp__internal__n_error_77: {
+    state->error = 0x8;
+    state->reason = "Expected HTTP/, RTSP/ or ICE/";
+    state->error_pos = (const char*) p;
+    state->_current = (void*) (intptr_t) s_error;
+    return s_error;
+    UNREACHABLE;
+  }
+  s_n_llhttp__internal__n_error_66: {
     state->error = 0x8;
     state->reason = "Invalid method for HTTP/x.x request";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_invoke_load_method: {
-    switch (llhttp__internal__c_load_method(state, p, endp)) {
-      case 0:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 1:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 2:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 3:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 4:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 5:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 6:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 7:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 8:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 9:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 10:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 11:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 12:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 13:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 14:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 15:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 16:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 17:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 18:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 19:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 20:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 21:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 22:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 23:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 24:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 25:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 26:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 27:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 28:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 29:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 30:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 31:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 32:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 33:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 34:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 46:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      default:
-        goto s_n_llhttp__internal__n_error_65;
-    }
-    /* UNREACHABLE */;
-    abort();
+  s_n_llhttp__internal__n_pause_22: {
+    state->error = 0x15;
+    state->reason = "on_protocol_complete pause";
+    state->error_pos = (const char*) p;
+    state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_load_method;
+    return s_error;
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_78: {
-    state->error = 0x8;
-    state->reason = "Expected HTTP/";
+  s_n_llhttp__internal__n_error_65: {
+    state->error = 0x26;
+    state->reason = "`on_protocol_complete` callback error";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
+  }
+  s_n_llhttp__internal__n_span_end_llhttp__on_protocol: {
+    const unsigned char* start;
+    int err;
+    
+    start = state->_span_pos0;
+    state->_span_pos0 = NULL;
+    err = llhttp__on_protocol(state, start, p);
+    if (err != 0) {
+      state->error = err;
+      state->error_pos = (const char*) p;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete;
+      return s_error;
+    }
+    goto s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete;
+    UNREACHABLE;
+  }
+  s_n_llhttp__internal__n_span_end_llhttp__on_protocol_3: {
+    const unsigned char* start;
+    int err;
+    
+    start = state->_span_pos0;
+    state->_span_pos0 = NULL;
+    err = llhttp__on_protocol(state, start, p);
+    if (err != 0) {
+      state->error = err;
+      state->error_pos = (const char*) p;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_82;
+      return s_error;
+    }
+    goto s_n_llhttp__internal__n_error_82;
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_76: {
+  s_n_llhttp__internal__n_error_79: {
     state->error = 0x8;
     state->reason = "Expected SOURCE method for ICE/x.x request";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_invoke_load_method_2: {
-    switch (llhttp__internal__c_load_method(state, p, endp)) {
-      case 33:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      default:
-        goto s_n_llhttp__internal__n_error_76;
+  s_n_llhttp__internal__n_pause_23: {
+    state->error = 0x15;
+    state->reason = "on_protocol_complete pause";
+    state->error_pos = (const char*) p;
+    state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_load_method_2;
+    return s_error;
+    UNREACHABLE;
+  }
+  s_n_llhttp__internal__n_error_78: {
+    state->error = 0x26;
+    state->reason = "`on_protocol_complete` callback error";
+    state->error_pos = (const char*) p;
+    state->_current = (void*) (intptr_t) s_error;
+    return s_error;
+    UNREACHABLE;
+  }
+  s_n_llhttp__internal__n_span_end_llhttp__on_protocol_1: {
+    const unsigned char* start;
+    int err;
+    
+    start = state->_span_pos0;
+    state->_span_pos0 = NULL;
+    err = llhttp__on_protocol(state, start, p);
+    if (err != 0) {
+      state->error = err;
+      state->error_pos = (const char*) p;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_1;
+      return s_error;
     }
-    /* UNREACHABLE */;
-    abort();
+    goto s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_1;
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_77: {
+  s_n_llhttp__internal__n_error_81: {
     state->error = 0x8;
     state->reason = "Invalid method for RTSP/x.x request";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_invoke_load_method_3: {
-    switch (llhttp__internal__c_load_method(state, p, endp)) {
-      case 1:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 3:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 6:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 35:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 36:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 37:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 38:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 39:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 40:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 41:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 42:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 43:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 44:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      case 45:
-        goto s_n_llhttp__internal__n_span_start_llhttp__on_version;
-      default:
-        goto s_n_llhttp__internal__n_error_77;
+  s_n_llhttp__internal__n_pause_24: {
+    state->error = 0x15;
+    state->reason = "on_protocol_complete pause";
+    state->error_pos = (const char*) p;
+    state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_load_method_3;
+    return s_error;
+    UNREACHABLE;
+  }
+  s_n_llhttp__internal__n_error_80: {
+    state->error = 0x26;
+    state->reason = "`on_protocol_complete` callback error";
+    state->error_pos = (const char*) p;
+    state->_current = (void*) (intptr_t) s_error;
+    return s_error;
+    UNREACHABLE;
+  }
+  s_n_llhttp__internal__n_span_end_llhttp__on_protocol_2: {
+    const unsigned char* start;
+    int err;
+    
+    start = state->_span_pos0;
+    state->_span_pos0 = NULL;
+    err = llhttp__on_protocol(state, start, p);
+    if (err != 0) {
+      state->error = err;
+      state->error_pos = (const char*) p;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_2;
+      return s_error;
     }
-    /* UNREACHABLE */;
-    abort();
+    goto s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_2;
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_pause_22: {
+  s_n_llhttp__internal__n_pause_25: {
     state->error = 0x15;
     state->reason = "on_url_complete pause";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_req_http_start;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_64: {
     state->error = 0x1a;
@@ -9181,20 +9147,18 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_url_complete_1: {
     switch (llhttp__on_url_complete(state, p, endp)) {
       case 0:
         goto s_n_llhttp__internal__n_req_http_start;
       case 21:
-        goto s_n_llhttp__internal__n_pause_22;
+        goto s_n_llhttp__internal__n_pause_25;
       default:
         goto s_n_llhttp__internal__n_error_64;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_5: {
     const unsigned char* start;
@@ -9210,8 +9174,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_to_http;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_6: {
     const unsigned char* start;
@@ -9227,8 +9190,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_to_http09;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_7: {
     const unsigned char* start;
@@ -9244,8 +9206,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_lf_to_http09;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_8: {
     const unsigned char* start;
@@ -9261,17 +9222,15 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_to_http;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_79: {
+  s_n_llhttp__internal__n_error_83: {
     state->error = 0x7;
     state->reason = "Invalid char in url fragment start";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_9: {
     const unsigned char* start;
@@ -9287,8 +9246,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_to_http09;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_10: {
     const unsigned char* start;
@@ -9304,8 +9262,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_lf_to_http09;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_11: {
     const unsigned char* start;
@@ -9321,26 +9278,23 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_to_http;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_80: {
+  s_n_llhttp__internal__n_error_84: {
     state->error = 0x7;
     state->reason = "Invalid char in url query";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_81: {
+  s_n_llhttp__internal__n_error_85: {
     state->error = 0x7;
     state->reason = "Invalid char in url path";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url: {
     const unsigned char* start;
@@ -9356,8 +9310,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_to_http09;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_1: {
     const unsigned char* start;
@@ -9373,8 +9326,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_lf_to_http09;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_2: {
     const unsigned char* start;
@@ -9390,8 +9342,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_to_http;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_12: {
     const unsigned char* start;
@@ -9407,8 +9358,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_to_http09;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_13: {
     const unsigned char* start;
@@ -9424,8 +9374,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_lf_to_http09;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_url_14: {
     const unsigned char* start;
@@ -9441,62 +9390,55 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_url_skip_to_http;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_82: {
+  s_n_llhttp__internal__n_error_86: {
     state->error = 0x7;
     state->reason = "Double @ in url";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_83: {
+  s_n_llhttp__internal__n_error_87: {
     state->error = 0x7;
     state->reason = "Unexpected char in url server";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_84: {
+  s_n_llhttp__internal__n_error_88: {
     state->error = 0x7;
     state->reason = "Unexpected char in url server";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_85: {
+  s_n_llhttp__internal__n_error_89: {
     state->error = 0x7;
     state->reason = "Unexpected char in url schema";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_86: {
+  s_n_llhttp__internal__n_error_90: {
     state->error = 0x7;
     state->reason = "Unexpected char in url schema";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_87: {
+  s_n_llhttp__internal__n_error_91: {
     state->error = 0x7;
     state->reason = "Unexpected start char in url";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_is_equal_method: {
     switch (llhttp__internal__c_is_equal_method(state, p, endp)) {
@@ -9505,35 +9447,31 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_url_entry_connect;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_88: {
+  s_n_llhttp__internal__n_error_92: {
     state->error = 0x6;
     state->reason = "Expected space after method";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_pause_26: {
+  s_n_llhttp__internal__n_pause_29: {
     state->error = 0x15;
     state->reason = "on_method_complete pause";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_req_first_space_before_url;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_107: {
+  s_n_llhttp__internal__n_error_111: {
     state->error = 0x20;
     state->reason = "`on_method_complete` callback error";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_method_2: {
     const unsigned char* start;
@@ -9549,129 +9487,115 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_invoke_llhttp__on_method_complete_1;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_store_method_1: {
     switch (llhttp__internal__c_store_method(state, p, endp, match)) {
       default:
         goto s_n_llhttp__internal__n_span_end_llhttp__on_method_2;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_108: {
+  s_n_llhttp__internal__n_error_112: {
     state->error = 0x6;
     state->reason = "Invalid method encountered";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_100: {
+  s_n_llhttp__internal__n_error_104: {
     state->error = 0xd;
     state->reason = "Invalid status code";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_98: {
+  s_n_llhttp__internal__n_error_102: {
     state->error = 0xd;
     state->reason = "Invalid status code";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_96: {
+  s_n_llhttp__internal__n_error_100: {
     state->error = 0xd;
     state->reason = "Invalid status code";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_pause_24: {
+  s_n_llhttp__internal__n_pause_27: {
     state->error = 0x15;
     state->reason = "on_status_complete pause";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_headers_start;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_92: {
+  s_n_llhttp__internal__n_error_96: {
     state->error = 0x1b;
     state->reason = "`on_status_complete` callback error";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_status_complete: {
     switch (llhttp__on_status_complete(state, p, endp)) {
       case 0:
         goto s_n_llhttp__internal__n_headers_start;
       case 21:
-        goto s_n_llhttp__internal__n_pause_24;
+        goto s_n_llhttp__internal__n_pause_27;
       default:
-        goto s_n_llhttp__internal__n_error_92;
+        goto s_n_llhttp__internal__n_error_96;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_91: {
+  s_n_llhttp__internal__n_error_95: {
     state->error = 0xd;
     state->reason = "Invalid response status";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_28: {
     switch (llhttp__internal__c_test_lenient_flags_1(state, p, endp)) {
       case 1:
         goto s_n_llhttp__internal__n_invoke_llhttp__on_status_complete;
       default:
-        goto s_n_llhttp__internal__n_error_91;
+        goto s_n_llhttp__internal__n_error_95;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_93: {
+  s_n_llhttp__internal__n_error_97: {
     state->error = 0x2;
     state->reason = "Expected LF after CR";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_29: {
     switch (llhttp__internal__c_test_lenient_flags_8(state, p, endp)) {
       case 1:
         goto s_n_llhttp__internal__n_invoke_llhttp__on_status_complete;
       default:
-        goto s_n_llhttp__internal__n_error_93;
+        goto s_n_llhttp__internal__n_error_97;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_94: {
+  s_n_llhttp__internal__n_error_98: {
     state->error = 0x19;
     state->reason = "Missing expected CR after response line";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_status: {
     const unsigned char* start;
@@ -9688,8 +9612,7 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_invoke_test_lenient_flags_30;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_status_1: {
     const unsigned char* start;
@@ -9706,109 +9629,97 @@ static llparse_state_t llhttp__internal__run(
     }
     p++;
     goto s_n_llhttp__internal__n_res_line_almost_done;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_95: {
+  s_n_llhttp__internal__n_error_99: {
     state->error = 0xd;
     state->reason = "Invalid response status";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_mul_add_status_code_2: {
     switch (llhttp__internal__c_mul_add_status_code(state, p, endp, match)) {
       case 1:
-        goto s_n_llhttp__internal__n_error_96;
+        goto s_n_llhttp__internal__n_error_100;
       default:
         goto s_n_llhttp__internal__n_res_status_code_otherwise;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_97: {
+  s_n_llhttp__internal__n_error_101: {
     state->error = 0xd;
     state->reason = "Invalid status code";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_mul_add_status_code_1: {
     switch (llhttp__internal__c_mul_add_status_code(state, p, endp, match)) {
       case 1:
-        goto s_n_llhttp__internal__n_error_98;
+        goto s_n_llhttp__internal__n_error_102;
       default:
         goto s_n_llhttp__internal__n_res_status_code_digit_3;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_99: {
+  s_n_llhttp__internal__n_error_103: {
     state->error = 0xd;
     state->reason = "Invalid status code";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_mul_add_status_code: {
     switch (llhttp__internal__c_mul_add_status_code(state, p, endp, match)) {
       case 1:
-        goto s_n_llhttp__internal__n_error_100;
+        goto s_n_llhttp__internal__n_error_104;
       default:
         goto s_n_llhttp__internal__n_res_status_code_digit_2;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_101: {
+  s_n_llhttp__internal__n_error_105: {
     state->error = 0xd;
     state->reason = "Invalid status code";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_status_code: {
     switch (llhttp__internal__c_update_status_code(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_res_status_code_digit_1;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_102: {
+  s_n_llhttp__internal__n_error_106: {
     state->error = 0x9;
     state->reason = "Expected space after version";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_pause_25: {
+  s_n_llhttp__internal__n_pause_28: {
     state->error = 0x15;
     state->reason = "on_version_complete pause";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_res_after_version;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_90: {
+  s_n_llhttp__internal__n_error_94: {
     state->error = 0x21;
     state->reason = "`on_version_complete` callback error";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_version_6: {
     const unsigned char* start;
@@ -9824,8 +9735,7 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_invoke_llhttp__on_version_complete_1;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_version_5: {
     const unsigned char* start;
@@ -9837,12 +9747,11 @@ static llparse_state_t llhttp__internal__run(
     if (err != 0) {
       state->error = err;
       state->error_pos = (const char*) p;
-      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_89;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_93;
       return s_error;
     }
-    goto s_n_llhttp__internal__n_error_89;
-    /* UNREACHABLE */;
-    abort();
+    goto s_n_llhttp__internal__n_error_93;
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_http_minor_3: {
     switch (llhttp__internal__c_load_http_minor(state, p, endp)) {
@@ -9851,8 +9760,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_span_end_llhttp__on_version_5;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_http_minor_4: {
     switch (llhttp__internal__c_load_http_minor(state, p, endp)) {
@@ -9863,8 +9771,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_span_end_llhttp__on_version_5;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_http_minor_5: {
     switch (llhttp__internal__c_load_http_minor(state, p, endp)) {
@@ -9873,8 +9780,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_span_end_llhttp__on_version_5;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_http_major_1: {
     switch (llhttp__internal__c_load_http_major(state, p, endp)) {
@@ -9887,8 +9793,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_span_end_llhttp__on_version_5;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_test_lenient_flags_27: {
     switch (llhttp__internal__c_test_lenient_flags_24(state, p, endp)) {
@@ -9897,16 +9802,14 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_invoke_load_http_major_1;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_store_http_minor_1: {
     switch (llhttp__internal__c_store_http_minor(state, p, endp, match)) {
       default:
         goto s_n_llhttp__internal__n_invoke_test_lenient_flags_27;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_version_7: {
     const unsigned char* start;
@@ -9918,12 +9821,11 @@ static llparse_state_t llhttp__internal__run(
     if (err != 0) {
       state->error = err;
       state->error_pos = (const char*) p;
-      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_103;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_107;
       return s_error;
     }
-    goto s_n_llhttp__internal__n_error_103;
-    /* UNREACHABLE */;
-    abort();
+    goto s_n_llhttp__internal__n_error_107;
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_version_8: {
     const unsigned char* start;
@@ -9935,20 +9837,18 @@ static llparse_state_t llhttp__internal__run(
     if (err != 0) {
       state->error = err;
       state->error_pos = (const char*) p;
-      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_104;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_108;
       return s_error;
     }
-    goto s_n_llhttp__internal__n_error_104;
-    /* UNREACHABLE */;
-    abort();
+    goto s_n_llhttp__internal__n_error_108;
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_store_http_major_1: {
     switch (llhttp__internal__c_store_http_major(state, p, endp, match)) {
       default:
         goto s_n_llhttp__internal__n_res_http_dot;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_version_9: {
     const unsigned char* start;
@@ -9960,30 +9860,75 @@ static llparse_state_t llhttp__internal__run(
     if (err != 0) {
       state->error = err;
       state->error_pos = (const char*) p;
-      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_105;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_109;
       return s_error;
     }
-    goto s_n_llhttp__internal__n_error_105;
-    /* UNREACHABLE */;
-    abort();
+    goto s_n_llhttp__internal__n_error_109;
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_109: {
+  s_n_llhttp__internal__n_error_114: {
     state->error = 0x8;
-    state->reason = "Expected HTTP/";
+    state->reason = "Expected HTTP/, RTSP/ or ICE/";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_pause_23: {
+  s_n_llhttp__internal__n_pause_30: {
+    state->error = 0x15;
+    state->reason = "on_protocol_complete pause";
+    state->error_pos = (const char*) p;
+    state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_res_after_protocol;
+    return s_error;
+    UNREACHABLE;
+  }
+  s_n_llhttp__internal__n_error_113: {
+    state->error = 0x26;
+    state->reason = "`on_protocol_complete` callback error";
+    state->error_pos = (const char*) p;
+    state->_current = (void*) (intptr_t) s_error;
+    return s_error;
+    UNREACHABLE;
+  }
+  s_n_llhttp__internal__n_span_end_llhttp__on_protocol_4: {
+    const unsigned char* start;
+    int err;
+    
+    start = state->_span_pos0;
+    state->_span_pos0 = NULL;
+    err = llhttp__on_protocol(state, start, p);
+    if (err != 0) {
+      state->error = err;
+      state->error_pos = (const char*) p;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_3;
+      return s_error;
+    }
+    goto s_n_llhttp__internal__n_invoke_llhttp__on_protocol_complete_3;
+    UNREACHABLE;
+  }
+  s_n_llhttp__internal__n_span_end_llhttp__on_protocol_5: {
+    const unsigned char* start;
+    int err;
+    
+    start = state->_span_pos0;
+    state->_span_pos0 = NULL;
+    err = llhttp__on_protocol(state, start, p);
+    if (err != 0) {
+      state->error = err;
+      state->error_pos = (const char*) p;
+      state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_error_115;
+      return s_error;
+    }
+    goto s_n_llhttp__internal__n_error_115;
+    UNREACHABLE;
+  }
+  s_n_llhttp__internal__n_pause_26: {
     state->error = 0x15;
     state->reason = "on_method_complete pause";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_req_first_space_before_url;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error_1: {
     state->error = 0x20;
@@ -9991,8 +9936,7 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_method: {
     const unsigned char* start;
@@ -10008,33 +9952,29 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_invoke_llhttp__on_method_complete;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_type: {
     switch (llhttp__internal__c_update_type(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_span_end_llhttp__on_method;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_store_method: {
     switch (llhttp__internal__c_store_method(state, p, endp, match)) {
       default:
         goto s_n_llhttp__internal__n_invoke_update_type;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_106: {
+  s_n_llhttp__internal__n_error_110: {
     state->error = 0x8;
     state->reason = "Invalid word encountered";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_span_end_llhttp__on_method_1: {
     const unsigned char* start;
@@ -10050,25 +9990,22 @@ static llparse_state_t llhttp__internal__run(
       return s_error;
     }
     goto s_n_llhttp__internal__n_invoke_update_type_1;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_update_type_2: {
     switch (llhttp__internal__c_update_type(state, p, endp)) {
       default:
         goto s_n_llhttp__internal__n_span_start_llhttp__on_method_1;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_pause_27: {
+  s_n_llhttp__internal__n_pause_31: {
     state->error = 0x15;
     state->reason = "on_message_begin pause";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_load_type;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_error: {
     state->error = 0x10;
@@ -10076,50 +10013,45 @@ static llparse_state_t llhttp__internal__run(
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_message_begin: {
     switch (llhttp__on_message_begin(state, p, endp)) {
       case 0:
         goto s_n_llhttp__internal__n_invoke_load_type;
       case 21:
-        goto s_n_llhttp__internal__n_pause_27;
+        goto s_n_llhttp__internal__n_pause_31;
       default:
         goto s_n_llhttp__internal__n_error;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_pause_28: {
+  s_n_llhttp__internal__n_pause_32: {
     state->error = 0x15;
     state->reason = "on_reset pause";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_n_llhttp__internal__n_invoke_update_finish;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
-  s_n_llhttp__internal__n_error_110: {
+  s_n_llhttp__internal__n_error_116: {
     state->error = 0x1f;
     state->reason = "`on_reset` callback error";
     state->error_pos = (const char*) p;
     state->_current = (void*) (intptr_t) s_error;
     return s_error;
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_llhttp__on_reset: {
     switch (llhttp__on_reset(state, p, endp)) {
       case 0:
         goto s_n_llhttp__internal__n_invoke_update_finish;
       case 21:
-        goto s_n_llhttp__internal__n_pause_28;
+        goto s_n_llhttp__internal__n_pause_32;
       default:
-        goto s_n_llhttp__internal__n_error_110;
+        goto s_n_llhttp__internal__n_error_116;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
   s_n_llhttp__internal__n_invoke_load_initial_message_completed: {
     switch (llhttp__internal__c_load_initial_message_completed(state, p, endp)) {
@@ -10128,8 +10060,7 @@ static llparse_state_t llhttp__internal__run(
       default:
         goto s_n_llhttp__internal__n_invoke_update_finish;
     }
-    /* UNREACHABLE */;
-    abort();
+    UNREACHABLE;
   }
 }
 
diff --git a/deps/openssl/config/archs/BSD-x86/asm/apps/progs.c b/deps/openssl/config/archs/BSD-x86/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/BSD-x86/asm/apps/progs.c
+++ b/deps/openssl/config/archs/BSD-x86/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/BSD-x86/asm/configdata.pm b/deps/openssl/config/archs/BSD-x86/asm/configdata.pm
index b4ff88112bd..39e95e30234 100644
--- a/deps/openssl/config/archs/BSD-x86/asm/configdata.pm
+++ b/deps/openssl/config/archs/BSD-x86/asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -203,10 +203,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -255,11 +255,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "BSD-x86",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -387,7 +387,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -889,6 +888,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1045,9 +1047,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3484,9 +3483,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5878,9 +5874,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7263,6 +7256,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7471,10 +7468,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10279,7 +10272,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10330,7 +10322,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12533,9 +12524,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14927,9 +14915,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16294,10 +16279,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16899,7 +16880,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18358,6 +18338,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18520,9 +18504,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19895,7 +19876,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20229,6 +20209,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20281,7 +20262,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24489,7 +24469,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24516,7 +24495,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25767,9 +25745,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25851,9 +25826,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25984,6 +25956,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26296,12 +26274,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27751,7 +27723,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27773,7 +27745,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/BSD-x86/asm/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86/asm/crypto/buildinf.h
index af438f4f0fa..b746f98ac21 100644
--- a/deps/openssl/config/archs/BSD-x86/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/BSD-x86/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86"
-#define DATE "built on: Mon Sep 30 17:05:30 2024 UTC"
+#define DATE "built on: Wed Mar  5 20:59:02 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/BSD-x86/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/BSD-x86/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/BSD-x86/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/BSD-x86/asm/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/BSD-x86/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/BSD-x86/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/BSD-x86/asm/include/progs.h b/deps/openssl/config/archs/BSD-x86/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/BSD-x86/asm/include/progs.h
+++ b/deps/openssl/config/archs/BSD-x86/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/BSD-x86/asm/openssl.gypi b/deps/openssl/config/archs/BSD-x86/asm/openssl.gypi
index c984f3e0f75..dbe90343117 100644
--- a/deps/openssl/config/archs/BSD-x86/asm/openssl.gypi
+++ b/deps/openssl/config/archs/BSD-x86/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/apps/progs.c b/deps/openssl/config/archs/BSD-x86/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/BSD-x86/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/configdata.pm b/deps/openssl/config/archs/BSD-x86/asm_avx2/configdata.pm
index 058d8def744..83d433e4553 100644
--- a/deps/openssl/config/archs/BSD-x86/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -203,10 +203,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -255,11 +255,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "BSD-x86",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -387,7 +387,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -889,6 +888,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1045,9 +1047,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3484,9 +3483,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5878,9 +5874,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7263,6 +7256,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7471,10 +7468,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10279,7 +10272,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10330,7 +10322,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12533,9 +12524,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14927,9 +14915,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16294,10 +16279,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16899,7 +16880,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18358,6 +18338,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18520,9 +18504,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19895,7 +19876,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20229,6 +20209,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20281,7 +20262,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24489,7 +24469,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24516,7 +24495,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25767,9 +25745,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25851,9 +25826,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25984,6 +25956,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26296,12 +26274,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27751,7 +27723,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27773,7 +27745,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86/asm_avx2/crypto/buildinf.h
index fce54a74f65..27f03cc9d77 100644
--- a/deps/openssl/config/archs/BSD-x86/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86"
-#define DATE "built on: Mon Sep 30 17:05:44 2024 UTC"
+#define DATE "built on: Wed Mar  5 20:59:15 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/progs.h b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/BSD-x86/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/BSD-x86/asm_avx2/openssl.gypi b/deps/openssl/config/archs/BSD-x86/asm_avx2/openssl.gypi
index 60512e2b588..7d73b1d0fed 100644
--- a/deps/openssl/config/archs/BSD-x86/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/BSD-x86/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/apps/progs.c b/deps/openssl/config/archs/BSD-x86/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/BSD-x86/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/BSD-x86/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/configdata.pm b/deps/openssl/config/archs/BSD-x86/no-asm/configdata.pm
index 6b5d662fd77..770a3a3326a 100644
--- a/deps/openssl/config/archs/BSD-x86/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/BSD-x86/no-asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -154,7 +154,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -202,10 +202,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -255,11 +255,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "BSD-x86",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -387,7 +387,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -890,6 +889,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1046,9 +1048,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3426,9 +3425,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5820,9 +5816,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7205,6 +7198,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7413,10 +7410,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10199,7 +10192,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10250,7 +10242,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12453,9 +12444,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14847,9 +14835,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16214,10 +16199,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16819,7 +16800,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18278,6 +18258,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18440,9 +18424,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19815,7 +19796,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20149,6 +20129,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20201,7 +20182,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24331,7 +24311,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24358,7 +24337,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25599,9 +25577,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25683,9 +25658,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25816,6 +25788,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26128,12 +26106,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27586,7 +27558,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27608,7 +27580,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86/no-asm/crypto/buildinf.h
index 14d772edccc..4c40b7b8913 100644
--- a/deps/openssl/config/archs/BSD-x86/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/BSD-x86/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86"
-#define DATE "built on: Mon Sep 30 17:05:57 2024 UTC"
+#define DATE "built on: Wed Mar  5 20:59:28 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/BSD-x86/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/include/progs.h b/deps/openssl/config/archs/BSD-x86/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/BSD-x86/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/BSD-x86/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/BSD-x86/no-asm/openssl.gypi b/deps/openssl/config/archs/BSD-x86/no-asm/openssl.gypi
index 12fdb1843c6..2031f41d630 100644
--- a/deps/openssl/config/archs/BSD-x86/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/BSD-x86/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/apps/progs.c b/deps/openssl/config/archs/BSD-x86_64/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm/apps/progs.c
+++ b/deps/openssl/config/archs/BSD-x86_64/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/configdata.pm b/deps/openssl/config/archs/BSD-x86_64/asm/configdata.pm
index f7cc1b97611..c57089f221c 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm/configdata.pm
+++ b/deps/openssl/config/archs/BSD-x86_64/asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -203,10 +203,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -255,11 +255,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "BSD-x86_64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -890,6 +889,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1046,9 +1048,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3490,9 +3489,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5884,9 +5880,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7269,6 +7262,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7477,10 +7474,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10321,7 +10314,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10372,7 +10364,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12575,9 +12566,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14969,9 +14957,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16336,10 +16321,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16941,7 +16922,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18400,6 +18380,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18562,9 +18546,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19937,7 +19918,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20271,6 +20251,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20323,7 +20304,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24622,7 +24602,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24649,7 +24628,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25913,9 +25891,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25997,9 +25972,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26130,6 +26102,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26442,12 +26420,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27897,7 +27869,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27919,7 +27891,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86_64/asm/crypto/buildinf.h
index 9d75e25aa5f..ec4aaf9a16f 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86_64"
-#define DATE "built on: Mon Sep 30 17:06:08 2024 UTC"
+#define DATE "built on: Wed Mar  5 20:59:39 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/include/progs.h b/deps/openssl/config/archs/BSD-x86_64/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm/include/progs.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm/openssl.gypi b/deps/openssl/config/archs/BSD-x86_64/asm/openssl.gypi
index 7a468bd82ec..f64b1e5b3bf 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm/openssl.gypi
+++ b/deps/openssl/config/archs/BSD-x86_64/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/apps/progs.c b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/configdata.pm b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/configdata.pm
index a9ff7c2027b..e918957e5c4 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -203,10 +203,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -255,11 +255,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "BSD-x86_64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -890,6 +889,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1046,9 +1048,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3490,9 +3489,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5884,9 +5880,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7269,6 +7262,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7477,10 +7474,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10321,7 +10314,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10372,7 +10364,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12575,9 +12566,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14969,9 +14957,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16336,10 +16321,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16941,7 +16922,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18400,6 +18380,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18562,9 +18546,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19937,7 +19918,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20271,6 +20251,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20323,7 +20304,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24622,7 +24602,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24649,7 +24628,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25913,9 +25891,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25997,9 +25972,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26130,6 +26102,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26442,12 +26420,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27897,7 +27869,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27919,7 +27891,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h
index f1b735d8043..04524de22c1 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86_64"
-#define DATE "built on: Mon Sep 30 17:06:24 2024 UTC"
+#define DATE "built on: Wed Mar  5 20:59:54 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/progs.h b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/openssl.gypi b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/openssl.gypi
index 6de0252f466..9dc83c8bbb1 100644
--- a/deps/openssl/config/archs/BSD-x86_64/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/BSD-x86_64/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/apps/progs.c b/deps/openssl/config/archs/BSD-x86_64/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/BSD-x86_64/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/configdata.pm b/deps/openssl/config/archs/BSD-x86_64/no-asm/configdata.pm
index 1ab302ff9a2..559f9276be9 100644
--- a/deps/openssl/config/archs/BSD-x86_64/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -154,7 +154,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -202,10 +202,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -255,11 +255,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "BSD-x86_64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -891,6 +890,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1047,9 +1049,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3427,9 +3426,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5821,9 +5817,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7206,6 +7199,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7414,10 +7411,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10200,7 +10193,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10251,7 +10243,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12454,9 +12445,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14848,9 +14836,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16215,10 +16200,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16820,7 +16801,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18279,6 +18259,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18441,9 +18425,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19816,7 +19797,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20150,6 +20130,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20202,7 +20183,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24332,7 +24312,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24359,7 +24338,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25600,9 +25578,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25684,9 +25659,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25817,6 +25789,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26129,12 +26107,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27587,7 +27559,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27609,7 +27581,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/BSD-x86_64/no-asm/crypto/buildinf.h
index c2bae3d778b..be71bd3c561 100644
--- a/deps/openssl/config/archs/BSD-x86_64/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: BSD-x86_64"
-#define DATE "built on: Mon Sep 30 17:06:40 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:00:10 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/progs.h b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/BSD-x86_64/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/BSD-x86_64/no-asm/openssl.gypi b/deps/openssl/config/archs/BSD-x86_64/no-asm/openssl.gypi
index d1d45e83d02..bb080a96ff6 100644
--- a/deps/openssl/config/archs/BSD-x86_64/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/BSD-x86_64/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/VC-WIN32/asm/apps/progs.c b/deps/openssl/config/archs/VC-WIN32/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm/apps/progs.c
+++ b/deps/openssl/config/archs/VC-WIN32/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN32/asm/configdata.pm b/deps/openssl/config/archs/VC-WIN32/asm/configdata.pm
index 3c9cf488d33..ed4f789fd2d 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN32/asm/configdata.pm
@@ -148,7 +148,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -165,7 +165,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -216,10 +216,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -268,11 +268,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN32",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "lib",
@@ -287,7 +287,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x55c413c34420)",
+    "RANLIB" => "CODE(0x5565b669dcb0)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -437,7 +437,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -940,6 +939,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1096,9 +1098,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3532,9 +3531,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5926,9 +5922,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7317,6 +7310,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7525,10 +7522,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10334,7 +10327,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10385,7 +10377,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12591,9 +12582,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14985,9 +14973,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16368,10 +16353,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16973,7 +16954,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18438,6 +18418,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18600,9 +18584,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19975,7 +19956,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20309,6 +20289,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20361,7 +20342,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24575,7 +24555,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24602,7 +24581,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25861,9 +25839,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25945,9 +25920,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26078,6 +26050,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26390,12 +26368,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27846,7 +27818,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27868,7 +27840,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/VC-WIN32/asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN32/asm/crypto/buildinf.h
index ddbc0c9135b..48ff5ac1c5a 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: "
-#define DATE "built on: Mon Sep 30 17:15:56 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:09:10 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/opensslv.h
index 50c2dce1470..c0590cffa99 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/ssl.h
index 9712ae165a5..7e9ca09bbf3 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/VC-WIN32/asm/include/progs.h b/deps/openssl/config/archs/VC-WIN32/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm/include/progs.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN32/asm/openssl.gypi b/deps/openssl/config/archs/VC-WIN32/asm/openssl.gypi
index 7a415cb3da0..0fb4d6ad1a8 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm/openssl.gypi
+++ b/deps/openssl/config/archs/VC-WIN32/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/apps/progs.c b/deps/openssl/config/archs/VC-WIN32/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/configdata.pm b/deps/openssl/config/archs/VC-WIN32/asm_avx2/configdata.pm
index a9d9e2fe575..815f2a5d15e 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/configdata.pm
@@ -148,7 +148,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -165,7 +165,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -216,10 +216,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -268,11 +268,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN32",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "lib",
@@ -287,7 +287,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x55fa4e900730)",
+    "RANLIB" => "CODE(0x55faeca92fa0)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -437,7 +437,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -940,6 +939,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1096,9 +1098,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3532,9 +3531,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5926,9 +5922,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7317,6 +7310,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7525,10 +7522,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10334,7 +10327,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10385,7 +10377,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12591,9 +12582,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14985,9 +14973,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16368,10 +16353,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16973,7 +16954,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18438,6 +18418,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18600,9 +18584,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19975,7 +19956,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20309,6 +20289,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20361,7 +20342,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24575,7 +24555,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24602,7 +24581,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25861,9 +25839,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25945,9 +25920,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26078,6 +26050,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26390,12 +26368,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27846,7 +27818,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27868,7 +27840,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN32/asm_avx2/crypto/buildinf.h
index 25257dbe4cd..4072d827907 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: "
-#define DATE "built on: Mon Sep 30 17:16:08 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:09:22 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/opensslv.h
index 50c2dce1470..c0590cffa99 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/ssl.h
index 9712ae165a5..7e9ca09bbf3 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/progs.h b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN32/asm_avx2/openssl.gypi b/deps/openssl/config/archs/VC-WIN32/asm_avx2/openssl.gypi
index 0eb291c5b04..6771de85fc0 100644
--- a/deps/openssl/config/archs/VC-WIN32/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/VC-WIN32/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/apps/progs.c b/deps/openssl/config/archs/VC-WIN32/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/VC-WIN32/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/VC-WIN32/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/configdata.pm b/deps/openssl/config/archs/VC-WIN32/no-asm/configdata.pm
index 242b585006b..2b33a586730 100644
--- a/deps/openssl/config/archs/VC-WIN32/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN32/no-asm/configdata.pm
@@ -148,7 +148,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -163,7 +163,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -215,10 +215,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -268,11 +268,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN32",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "lib",
@@ -287,7 +287,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x556017cde7e0)",
+    "RANLIB" => "CODE(0x555d90669138)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -437,7 +437,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -941,6 +940,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1097,9 +1099,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3474,9 +3473,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5868,9 +5864,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7259,6 +7252,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7467,10 +7464,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10254,7 +10247,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10305,7 +10297,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12511,9 +12502,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14905,9 +14893,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16288,10 +16273,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16893,7 +16874,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18358,6 +18338,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18520,9 +18504,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19895,7 +19876,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20229,6 +20209,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20281,7 +20262,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24417,7 +24397,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24444,7 +24423,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25693,9 +25671,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25777,9 +25752,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25910,6 +25882,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26222,12 +26200,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27681,7 +27653,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27703,7 +27675,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN32/no-asm/crypto/buildinf.h
index f3494c62b7f..602c9cefde7 100644
--- a/deps/openssl/config/archs/VC-WIN32/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN32/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: "
-#define DATE "built on: Mon Sep 30 17:16:20 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:09:33 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/opensslv.h
index 50c2dce1470..c0590cffa99 100644
--- a/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/ssl.h
index 9712ae165a5..7e9ca09bbf3 100644
--- a/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN32/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/include/progs.h b/deps/openssl/config/archs/VC-WIN32/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/VC-WIN32/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/VC-WIN32/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN32/no-asm/openssl.gypi b/deps/openssl/config/archs/VC-WIN32/no-asm/openssl.gypi
index c4e4b169a04..72b9b35f5e1 100644
--- a/deps/openssl/config/archs/VC-WIN32/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/VC-WIN32/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/apps/progs.c b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/configdata.pm b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/configdata.pm
index 51e48deaccd..8a29ae7726d 100644
--- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/configdata.pm
@@ -147,7 +147,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -163,7 +163,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -213,10 +213,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -266,11 +266,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN64-ARM",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "lib",
@@ -283,7 +283,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x563ab4010d40)",
+    "RANLIB" => "CODE(0x560478385a28)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -429,7 +429,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -933,6 +932,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1089,9 +1091,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3466,9 +3465,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5860,9 +5856,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7251,6 +7244,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7459,10 +7456,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10246,7 +10239,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10297,7 +10289,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12503,9 +12494,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14897,9 +14885,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16280,10 +16265,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16885,7 +16866,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18350,6 +18330,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18512,9 +18496,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19887,7 +19868,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20221,6 +20201,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20273,7 +20254,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24409,7 +24389,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24436,7 +24415,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25685,9 +25663,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25769,9 +25744,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25902,6 +25874,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26214,12 +26192,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27673,7 +27645,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27695,7 +27667,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/crypto/buildinf.h
index 9e7f66c628b..dfdc92098de 100644
--- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: VC-WIN64-ARM"
-#define DATE "built on: Mon Sep 30 17:16:31 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:09:44 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/opensslv.h
index 50c2dce1470..c0590cffa99 100644
--- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/ssl.h
index 9712ae165a5..7e9ca09bbf3 100644
--- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/progs.h b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/openssl.gypi b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/openssl.gypi
index 81eb195afa9..f144e4b5793 100644
--- a/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/VC-WIN64-ARM/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/apps/progs.c b/deps/openssl/config/archs/VC-WIN64A/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm/apps/progs.c
+++ b/deps/openssl/config/archs/VC-WIN64A/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/configdata.pm b/deps/openssl/config/archs/VC-WIN64A/asm/configdata.pm
index a58ae5c555f..61c50ea51d0 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN64A/asm/configdata.pm
@@ -151,7 +151,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -168,7 +168,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -219,10 +219,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -271,11 +271,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN64A",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "lib",
@@ -290,7 +290,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x5567a098ee80)",
+    "RANLIB" => "CODE(0x55fdfa62e9a0)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -441,7 +441,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -944,6 +943,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1100,9 +1102,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3541,9 +3540,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5935,9 +5931,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7326,6 +7319,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7534,10 +7531,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10369,7 +10362,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10420,7 +10412,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12626,9 +12617,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -15020,9 +15008,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16403,10 +16388,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -17008,7 +16989,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18473,6 +18453,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18635,9 +18619,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -20010,7 +19991,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20344,6 +20324,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20396,7 +20377,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24701,7 +24681,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24728,7 +24707,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -26000,9 +25978,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -26084,9 +26059,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26217,6 +26189,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26529,12 +26507,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27985,7 +27957,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -28007,7 +27979,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN64A/asm/crypto/buildinf.h
index af6d41b18a9..5e4f9fa85b7 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: "
-#define DATE "built on: Mon Sep 30 17:15:14 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:08:30 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/opensslv.h
index 50c2dce1470..c0590cffa99 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/ssl.h
index 9712ae165a5..7e9ca09bbf3 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/include/progs.h b/deps/openssl/config/archs/VC-WIN64A/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm/include/progs.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm/openssl.gypi b/deps/openssl/config/archs/VC-WIN64A/asm/openssl.gypi
index 5afa3d75411..56214992653 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm/openssl.gypi
+++ b/deps/openssl/config/archs/VC-WIN64A/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/apps/progs.c b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/configdata.pm b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/configdata.pm
index b6476912c55..cdd5aa9852d 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/configdata.pm
@@ -151,7 +151,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -168,7 +168,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -219,10 +219,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -271,11 +271,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN64A",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "lib",
@@ -290,7 +290,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x563a6722d330)",
+    "RANLIB" => "CODE(0x55884154b690)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -441,7 +441,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -944,6 +943,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1100,9 +1102,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3541,9 +3540,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5935,9 +5931,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7326,6 +7319,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7534,10 +7531,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10369,7 +10362,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10420,7 +10412,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12626,9 +12617,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -15020,9 +15008,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16403,10 +16388,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -17008,7 +16989,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18473,6 +18453,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18635,9 +18619,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -20010,7 +19991,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20344,6 +20324,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20396,7 +20377,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24701,7 +24681,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24728,7 +24707,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -26000,9 +25978,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -26084,9 +26059,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26217,6 +26189,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26529,12 +26507,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27985,7 +27957,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -28007,7 +27979,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/crypto/buildinf.h
index 8e51d88ba4b..9757142ff5f 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: "
-#define DATE "built on: Mon Sep 30 17:15:29 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:08:44 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/opensslv.h
index 50c2dce1470..c0590cffa99 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/ssl.h
index 9712ae165a5..7e9ca09bbf3 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/progs.h b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/openssl.gypi b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/openssl.gypi
index 582f8c93a5b..89b4bcd47f1 100644
--- a/deps/openssl/config/archs/VC-WIN64A/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/VC-WIN64A/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/apps/progs.c b/deps/openssl/config/archs/VC-WIN64A/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/VC-WIN64A/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/configdata.pm b/deps/openssl/config/archs/VC-WIN64A/no-asm/configdata.pm
index 08e8c7dc590..193001b8aae 100644
--- a/deps/openssl/config/archs/VC-WIN64A/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/configdata.pm
@@ -151,7 +151,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -166,7 +166,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -218,10 +218,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -271,11 +271,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "VC-WIN64A",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "lib",
@@ -290,7 +290,7 @@ our %target = (
     "LDFLAGS" => "/nologo /debug",
     "MT" => "mt",
     "MTFLAGS" => "-nologo",
-    "RANLIB" => "CODE(0x55f18ff2a220)",
+    "RANLIB" => "CODE(0x55b60e60bac8)",
     "RC" => "rc",
     "_conf_fname_int" => [
         "Configurations/00-base-templates.conf",
@@ -441,7 +441,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -945,6 +944,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1101,9 +1103,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3478,9 +3477,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5872,9 +5868,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7263,6 +7256,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7471,10 +7468,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10258,7 +10251,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10309,7 +10301,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12515,9 +12506,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14909,9 +14897,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16292,10 +16277,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16897,7 +16878,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18362,6 +18342,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18524,9 +18508,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19899,7 +19880,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20233,6 +20213,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20285,7 +20266,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24421,7 +24401,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24448,7 +24427,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25697,9 +25675,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25781,9 +25756,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25914,6 +25886,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26226,12 +26204,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27685,7 +27657,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27707,7 +27679,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/VC-WIN64A/no-asm/crypto/buildinf.h
index 50896740e94..f0be853b966 100644
--- a/deps/openssl/config/archs/VC-WIN64A/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: "
-#define DATE "built on: Mon Sep 30 17:15:44 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:08:59 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/opensslv.h
index 50c2dce1470..c0590cffa99 100644
--- a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/ssl.h
index 9712ae165a5..7e9ca09bbf3 100644
--- a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/progs.h b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/VC-WIN64A/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/VC-WIN64A/no-asm/openssl.gypi b/deps/openssl/config/archs/VC-WIN64A/no-asm/openssl.gypi
index af84bdff856..3cdefe6bdde 100644
--- a/deps/openssl/config/archs/VC-WIN64A/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/VC-WIN64A/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/apps/progs.c b/deps/openssl/config/archs/aix64-gcc-as/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm/apps/progs.c
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/configdata.pm b/deps/openssl/config/archs/aix64-gcc-as/asm/configdata.pm
index 77e00d35a9d..3e480f50048 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm/configdata.pm
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -258,11 +258,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "aix64-gcc-as",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar -X64",
@@ -390,7 +390,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -893,6 +892,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1049,9 +1051,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3467,9 +3466,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5861,9 +5857,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7246,6 +7239,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7454,10 +7451,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10277,7 +10270,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10328,7 +10320,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12531,9 +12522,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14925,9 +14913,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16292,10 +16277,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16897,7 +16878,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18356,6 +18336,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18518,9 +18502,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19893,7 +19874,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20227,6 +20207,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20279,7 +20260,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24540,7 +24520,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24567,7 +24546,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25825,9 +25803,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25909,9 +25884,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26042,6 +26014,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26354,12 +26332,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27812,7 +27784,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27834,7 +27806,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/crypto/buildinf.h b/deps/openssl/config/archs/aix64-gcc-as/asm/crypto/buildinf.h
index 99d30076120..7428cb5cab8 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: aix64-gcc-as"
-#define DATE "built on: Mon Sep 30 17:04:53 2024 UTC"
+#define DATE "built on: Wed Mar  5 20:58:26 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/ssl.h b/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/include/progs.h b/deps/openssl/config/archs/aix64-gcc-as/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm/include/progs.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm/openssl.gypi b/deps/openssl/config/archs/aix64-gcc-as/asm/openssl.gypi
index 8a048cba01e..93acbf01f53 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm/openssl.gypi
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/apps/progs.c b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/configdata.pm b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/configdata.pm
index 34862e4d370..b98107d8f67 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -258,11 +258,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "aix64-gcc-as",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar -X64",
@@ -390,7 +390,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -893,6 +892,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1049,9 +1051,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3467,9 +3466,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5861,9 +5857,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7246,6 +7239,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7454,10 +7451,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10277,7 +10270,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10328,7 +10320,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12531,9 +12522,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14925,9 +14913,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16292,10 +16277,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16897,7 +16878,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18356,6 +18336,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18518,9 +18502,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19893,7 +19874,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20227,6 +20207,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20279,7 +20260,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24540,7 +24520,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24567,7 +24546,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25825,9 +25803,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25909,9 +25884,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26042,6 +26014,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26354,12 +26332,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27812,7 +27784,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27834,7 +27806,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/crypto/buildinf.h
index 69dd90a6c66..6b0cc03405c 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: aix64-gcc-as"
-#define DATE "built on: Mon Sep 30 17:05:06 2024 UTC"
+#define DATE "built on: Wed Mar  5 20:58:38 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/progs.h b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/openssl.gypi b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/openssl.gypi
index ab4157db96a..912a5ae1d06 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/aix64-gcc-as/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/apps/progs.c b/deps/openssl/config/archs/aix64-gcc-as/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/configdata.pm b/deps/openssl/config/archs/aix64-gcc-as/no-asm/configdata.pm
index 3012083af82..2e8a240a986 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -154,7 +154,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -205,10 +205,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -258,11 +258,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "aix64-gcc-as",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar -X64",
@@ -390,7 +390,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -894,6 +893,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1050,9 +1052,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3430,9 +3429,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5824,9 +5820,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7209,6 +7202,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7417,10 +7414,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10202,7 +10195,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10253,7 +10245,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12456,9 +12447,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14850,9 +14838,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16217,10 +16202,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16822,7 +16803,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18281,6 +18261,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18443,9 +18427,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19818,7 +19799,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20152,6 +20132,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20204,7 +20185,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24330,7 +24310,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24357,7 +24336,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25598,9 +25576,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25682,9 +25657,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25815,6 +25787,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26127,12 +26105,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27588,7 +27560,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27610,7 +27582,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/aix64-gcc-as/no-asm/crypto/buildinf.h
index c1c41584528..d00971063b8 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: aix64-gcc-as"
-#define DATE "built on: Mon Sep 30 17:05:19 2024 UTC"
+#define DATE "built on: Wed Mar  5 20:58:51 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/progs.h b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/aix64-gcc-as/no-asm/openssl.gypi b/deps/openssl/config/archs/aix64-gcc-as/no-asm/openssl.gypi
index 150635d1cfc..9cc4582197f 100644
--- a/deps/openssl/config/archs/aix64-gcc-as/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/aix64-gcc-as/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/apps/progs.c b/deps/openssl/config/archs/darwin-i386-cc/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm/apps/progs.c
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/configdata.pm b/deps/openssl/config/archs/darwin-i386-cc/asm/configdata.pm
index c48853b80e4..fa10bed6fd6 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm/configdata.pm
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -258,11 +258,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin-i386-cc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -891,6 +890,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1047,9 +1049,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3486,9 +3485,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5880,9 +5876,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7257,6 +7250,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7465,10 +7462,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10271,7 +10264,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10322,7 +10314,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12525,9 +12516,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14919,9 +14907,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16272,10 +16257,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16871,7 +16852,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18322,6 +18302,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18484,9 +18468,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19859,7 +19840,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20193,6 +20173,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20245,7 +20226,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24449,7 +24429,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24476,7 +24455,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25725,9 +25703,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25809,9 +25784,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25942,6 +25914,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26254,12 +26232,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27710,7 +27682,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27732,7 +27704,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin-i386-cc/asm/crypto/buildinf.h
index 9e690dbea0a..810053f7be5 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin-i386-cc"
-#define DATE "built on: Mon Sep 30 17:07:34 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:01:02 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/include/progs.h b/deps/openssl/config/archs/darwin-i386-cc/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm/include/progs.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm/openssl.gypi b/deps/openssl/config/archs/darwin-i386-cc/asm/openssl.gypi
index 1fac0808070..49b8dd0ee2b 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm/openssl.gypi
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/apps/progs.c b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/configdata.pm b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/configdata.pm
index 0b7a603aa08..9bf997165c3 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -258,11 +258,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin-i386-cc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -891,6 +890,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1047,9 +1049,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3486,9 +3485,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5880,9 +5876,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7257,6 +7250,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7465,10 +7462,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10271,7 +10264,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10322,7 +10314,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12525,9 +12516,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14919,9 +14907,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16272,10 +16257,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16871,7 +16852,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18322,6 +18302,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18484,9 +18468,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19859,7 +19840,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20193,6 +20173,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20245,7 +20226,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24449,7 +24429,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24476,7 +24455,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25725,9 +25703,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25809,9 +25784,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25942,6 +25914,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26254,12 +26232,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27710,7 +27682,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27732,7 +27704,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/crypto/buildinf.h
index f0fc131a0ac..dfe6f4feb00 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin-i386-cc"
-#define DATE "built on: Mon Sep 30 17:07:47 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:01:15 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/progs.h b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/openssl.gypi b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/openssl.gypi
index 0f428fdfbb5..1611dce927f 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/darwin-i386-cc/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/apps/progs.c b/deps/openssl/config/archs/darwin-i386-cc/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/configdata.pm b/deps/openssl/config/archs/darwin-i386-cc/no-asm/configdata.pm
index 4eafb602153..639b55a717b 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -154,7 +154,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -205,10 +205,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -258,11 +258,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin-i386-cc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -892,6 +891,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1048,9 +1050,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3428,9 +3427,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5822,9 +5818,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7199,6 +7192,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7407,10 +7404,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10191,7 +10184,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10242,7 +10234,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12445,9 +12436,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14839,9 +14827,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16192,10 +16177,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16791,7 +16772,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18242,6 +18222,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18404,9 +18388,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19779,7 +19760,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20113,6 +20093,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20165,7 +20146,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24291,7 +24271,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24318,7 +24297,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25557,9 +25535,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25641,9 +25616,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25774,6 +25746,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26086,12 +26064,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27545,7 +27517,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27567,7 +27539,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin-i386-cc/no-asm/crypto/buildinf.h
index 7c35bb03c23..b7162945595 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin-i386-cc"
-#define DATE "built on: Mon Sep 30 17:08:00 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:01:27 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/progs.h b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin-i386-cc/no-asm/openssl.gypi b/deps/openssl/config/archs/darwin-i386-cc/no-asm/openssl.gypi
index 7469c552c64..fb2e7f750ac 100644
--- a/deps/openssl/config/archs/darwin-i386-cc/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/darwin-i386-cc/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/apps/progs.c b/deps/openssl/config/archs/darwin64-arm64-cc/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/apps/progs.c
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/configdata.pm b/deps/openssl/config/archs/darwin64-arm64-cc/asm/configdata.pm
index 877a6b8a253..ae8c62971c1 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/configdata.pm
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -258,11 +258,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin64-arm64-cc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -891,6 +890,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1047,9 +1049,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3459,9 +3458,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5853,9 +5849,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7230,6 +7223,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7438,10 +7435,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10245,7 +10238,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10296,7 +10288,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12499,9 +12490,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14893,9 +14881,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16246,10 +16231,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16845,7 +16826,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18356,6 +18336,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18518,9 +18502,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19893,7 +19874,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20227,6 +20207,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20279,7 +20260,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24486,7 +24466,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24513,7 +24492,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25763,9 +25741,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25847,9 +25822,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25980,6 +25952,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26292,12 +26270,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27748,7 +27720,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27770,7 +27742,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/bn/armv8-mont.S b/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/bn/armv8-mont.S
index 6fca712c475..adb12afdb1a 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/bn/armv8-mont.S
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/bn/armv8-mont.S
@@ -15,10 +15,12 @@ Lbn_mul_mont:
 	cmp	x5,#32
 	b.le	Lscalar_impl
 #ifndef	__KERNEL__
+#ifndef	__AARCH64EB__
 	adrp	x17,_OPENSSL_armv8_rsa_neonized@PAGE
 	ldr	w17,[x17,_OPENSSL_armv8_rsa_neonized@PAGEOFF]
 	cbnz	w17, bn_mul8x_mont_neon
 #endif
+#endif
 
 Lscalar_impl:
 	tst	x5,#7
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/buildinf.h
index 53600343288..95c41f05765 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin64-arm64-cc"
-#define DATE "built on: Mon Sep 30 17:08:11 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:01:39 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/progs.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/progs.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm/openssl.gypi b/deps/openssl/config/archs/darwin64-arm64-cc/asm/openssl.gypi
index 91173eeb093..5028c50d6ab 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm/openssl.gypi
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/apps/progs.c b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/configdata.pm b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/configdata.pm
index 3deb53b0966..125bb77e2f8 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -258,11 +258,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin64-arm64-cc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -891,6 +890,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1047,9 +1049,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3459,9 +3458,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5853,9 +5849,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7230,6 +7223,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7438,10 +7435,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10245,7 +10238,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10296,7 +10288,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12499,9 +12490,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14893,9 +14881,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16246,10 +16231,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16845,7 +16826,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18356,6 +18336,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18518,9 +18502,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19893,7 +19874,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20227,6 +20207,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20279,7 +20260,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24486,7 +24466,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24513,7 +24492,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25763,9 +25741,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25847,9 +25822,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25980,6 +25952,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26292,12 +26270,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27748,7 +27720,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27770,7 +27742,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/bn/armv8-mont.S b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/bn/armv8-mont.S
index 6fca712c475..adb12afdb1a 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/bn/armv8-mont.S
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/bn/armv8-mont.S
@@ -15,10 +15,12 @@ Lbn_mul_mont:
 	cmp	x5,#32
 	b.le	Lscalar_impl
 #ifndef	__KERNEL__
+#ifndef	__AARCH64EB__
 	adrp	x17,_OPENSSL_armv8_rsa_neonized@PAGE
 	ldr	w17,[x17,_OPENSSL_armv8_rsa_neonized@PAGEOFF]
 	cbnz	w17, bn_mul8x_mont_neon
 #endif
+#endif
 
 Lscalar_impl:
 	tst	x5,#7
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/buildinf.h
index 74f8be4cef5..8aa804c510f 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin64-arm64-cc"
-#define DATE "built on: Mon Sep 30 17:08:24 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:01:51 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/progs.h b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/openssl.gypi b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/openssl.gypi
index 61a8836a9dd..edd82ba510c 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/apps/progs.c b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/configdata.pm b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/configdata.pm
index 7698c6b4a8d..aeb47e095d8 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -154,7 +154,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -205,10 +205,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -258,11 +258,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin64-arm64-cc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -892,6 +891,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1048,9 +1050,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3428,9 +3427,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5822,9 +5818,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7199,6 +7192,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7407,10 +7404,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10191,7 +10184,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10242,7 +10234,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12445,9 +12436,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14839,9 +14827,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16192,10 +16177,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16791,7 +16772,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18242,6 +18222,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18404,9 +18388,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19779,7 +19760,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20113,6 +20093,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20165,7 +20146,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24291,7 +24271,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24318,7 +24297,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25557,9 +25535,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25641,9 +25616,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25774,6 +25746,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26086,12 +26064,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27545,7 +27517,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27567,7 +27539,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/crypto/buildinf.h
index 16436bc0b17..d8139bf78a0 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin64-arm64-cc"
-#define DATE "built on: Mon Sep 30 17:08:36 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:02:03 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/progs.h b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/openssl.gypi b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/openssl.gypi
index 835387a25b2..67fd4d4b74b 100644
--- a/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/darwin64-arm64-cc/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/apps/progs.c b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/apps/progs.c
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/configdata.pm b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/configdata.pm
index 4d3767f4232..d30d5f53267 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/configdata.pm
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -258,11 +258,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin64-x86_64-cc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -891,6 +890,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1047,9 +1049,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3491,9 +3490,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5885,9 +5881,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7262,6 +7255,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7470,10 +7467,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10312,7 +10305,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10363,7 +10355,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12566,9 +12557,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14960,9 +14948,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16313,10 +16298,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16912,7 +16893,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18363,6 +18343,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18525,9 +18509,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19900,7 +19881,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20234,6 +20214,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20286,7 +20267,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24581,7 +24561,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24608,7 +24587,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25870,9 +25848,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25954,9 +25929,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26087,6 +26059,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26399,12 +26377,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27855,7 +27827,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27877,7 +27849,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/crypto/buildinf.h
index 8c788f6d59a..99175da0e9b 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin64-x86_64-cc"
-#define DATE "built on: Mon Sep 30 17:06:51 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:00:21 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/progs.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/progs.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/openssl.gypi b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/openssl.gypi
index 454a35a31ec..10a92888817 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm/openssl.gypi
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/apps/progs.c b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/configdata.pm b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/configdata.pm
index 1f75fe7575c..f504cbca94b 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -258,11 +258,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin64-x86_64-cc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -891,6 +890,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1047,9 +1049,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3491,9 +3490,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5885,9 +5881,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7262,6 +7255,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7470,10 +7467,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10312,7 +10305,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10363,7 +10355,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12566,9 +12557,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14960,9 +14948,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16313,10 +16298,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16912,7 +16893,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18363,6 +18343,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18525,9 +18509,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19900,7 +19881,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20234,6 +20214,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20286,7 +20267,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24581,7 +24561,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24608,7 +24587,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25870,9 +25848,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25954,9 +25929,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26087,6 +26059,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26399,12 +26377,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27855,7 +27827,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27877,7 +27849,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/crypto/buildinf.h
index 7fc043860e9..f21ee48fccc 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin64-x86_64-cc"
-#define DATE "built on: Mon Sep 30 17:07:07 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:00:36 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/progs.h b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/openssl.gypi b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/openssl.gypi
index b6218392f74..d1c3557a62e 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/apps/progs.c b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/configdata.pm b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/configdata.pm
index 10e32f3d13b..853874fcaa3 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -154,7 +154,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -205,10 +205,10 @@ our %config = (
     ],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -258,11 +258,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "darwin64-x86_64-cc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -892,6 +891,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1048,9 +1050,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3428,9 +3427,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5822,9 +5818,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7199,6 +7192,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7407,10 +7404,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10191,7 +10184,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10242,7 +10234,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12445,9 +12436,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14839,9 +14827,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16192,10 +16177,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16791,7 +16772,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18242,6 +18222,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18404,9 +18388,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19779,7 +19760,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20113,6 +20093,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20165,7 +20146,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24291,7 +24271,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24318,7 +24297,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25557,9 +25535,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25641,9 +25616,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25774,6 +25746,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26086,12 +26064,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27545,7 +27517,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27567,7 +27539,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/crypto/buildinf.h
index ecf1d141ca8..061a0193d55 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: darwin64-x86_64-cc"
-#define DATE "built on: Mon Sep 30 17:07:22 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:00:51 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/progs.h b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/openssl.gypi b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/openssl.gypi
index d2f0708edf9..cd8cb60dca7 100644
--- a/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/darwin64-x86_64-cc/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux-aarch64/asm/apps/progs.c b/deps/openssl/config/archs/linux-aarch64/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux-aarch64/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-aarch64/asm/configdata.pm b/deps/openssl/config/archs/linux-aarch64/asm/configdata.pm
index b9637a41bbe..e7dd562dcf9 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-aarch64/asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-aarch64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -395,7 +395,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -898,6 +897,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1054,9 +1056,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3466,9 +3465,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5860,9 +5856,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7245,6 +7238,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7453,10 +7450,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10261,7 +10254,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10312,7 +10304,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12515,9 +12506,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14909,9 +14897,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16276,10 +16261,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16881,7 +16862,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18400,6 +18380,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18562,9 +18546,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19937,7 +19918,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20271,6 +20251,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20323,7 +20304,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24530,7 +24510,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24557,7 +24536,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25809,9 +25787,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25893,9 +25868,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26026,6 +25998,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26338,12 +26316,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27796,7 +27768,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27818,7 +27790,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-aarch64/asm/crypto/bn/armv8-mont.S b/deps/openssl/config/archs/linux-aarch64/asm/crypto/bn/armv8-mont.S
index 98d06f934a9..397c83e8638 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm/crypto/bn/armv8-mont.S
+++ b/deps/openssl/config/archs/linux-aarch64/asm/crypto/bn/armv8-mont.S
@@ -15,10 +15,12 @@ bn_mul_mont:
 	cmp	x5,#32
 	b.le	.Lscalar_impl
 #ifndef	__KERNEL__
+#ifndef	__AARCH64EB__
 	adrp	x17,OPENSSL_armv8_rsa_neonized
 	ldr	w17,[x17,#:lo12:OPENSSL_armv8_rsa_neonized]
 	cbnz	w17, bn_mul8x_mont_neon
 #endif
+#endif
 
 .Lscalar_impl:
 	tst	x5,#7
diff --git a/deps/openssl/config/archs/linux-aarch64/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-aarch64/asm/crypto/buildinf.h
index eba7c744efb..9b5fa460089 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-aarch64"
-#define DATE "built on: Mon Sep 30 17:08:48 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:02:14 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-aarch64/asm/include/progs.h b/deps/openssl/config/archs/linux-aarch64/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm/include/progs.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-aarch64/asm/openssl.gypi b/deps/openssl/config/archs/linux-aarch64/asm/openssl.gypi
index 5990887c029..4e0923be89c 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux-aarch64/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/apps/progs.c b/deps/openssl/config/archs/linux-aarch64/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-aarch64/asm_avx2/configdata.pm
index 988b82a6794..0e7998767e7 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-aarch64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -395,7 +395,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -898,6 +897,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1054,9 +1056,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3466,9 +3465,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5860,9 +5856,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7245,6 +7238,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7453,10 +7450,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10261,7 +10254,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10312,7 +10304,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12515,9 +12506,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14909,9 +14897,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16276,10 +16261,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16881,7 +16862,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18400,6 +18380,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18562,9 +18546,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19937,7 +19918,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20271,6 +20251,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20323,7 +20304,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24530,7 +24510,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24557,7 +24536,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25809,9 +25787,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25893,9 +25868,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26026,6 +25998,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26338,12 +26316,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27796,7 +27768,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27818,7 +27790,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/bn/armv8-mont.S b/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/bn/armv8-mont.S
index 98d06f934a9..397c83e8638 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/bn/armv8-mont.S
+++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/bn/armv8-mont.S
@@ -15,10 +15,12 @@ bn_mul_mont:
 	cmp	x5,#32
 	b.le	.Lscalar_impl
 #ifndef	__KERNEL__
+#ifndef	__AARCH64EB__
 	adrp	x17,OPENSSL_armv8_rsa_neonized
 	ldr	w17,[x17,#:lo12:OPENSSL_armv8_rsa_neonized]
 	cbnz	w17, bn_mul8x_mont_neon
 #endif
+#endif
 
 .Lscalar_impl:
 	tst	x5,#7
diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/buildinf.h
index 33cbe794886..e4f6099c6f7 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-aarch64"
-#define DATE "built on: Mon Sep 30 17:09:00 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:02:26 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/progs.h b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-aarch64/asm_avx2/openssl.gypi b/deps/openssl/config/archs/linux-aarch64/asm_avx2/openssl.gypi
index c7cb2091b5a..b9d76aee0d0 100644
--- a/deps/openssl/config/archs/linux-aarch64/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/linux-aarch64/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/apps/progs.c b/deps/openssl/config/archs/linux-aarch64/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-aarch64/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux-aarch64/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/configdata.pm b/deps/openssl/config/archs/linux-aarch64/no-asm/configdata.pm
index 9ff6e315a7f..dee85d62d78 100644
--- a/deps/openssl/config/archs/linux-aarch64/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-aarch64/no-asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -157,7 +157,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-aarch64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -395,7 +395,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -899,6 +898,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1055,9 +1057,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3435,9 +3434,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5829,9 +5825,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7214,6 +7207,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7422,10 +7419,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10207,7 +10200,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10258,7 +10250,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12461,9 +12452,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14855,9 +14843,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16222,10 +16207,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16827,7 +16808,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18286,6 +18266,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18448,9 +18432,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19823,7 +19804,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20157,6 +20137,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20209,7 +20190,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24335,7 +24315,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24362,7 +24341,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25603,9 +25581,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25687,9 +25662,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25820,6 +25792,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26132,12 +26110,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27593,7 +27565,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27615,7 +27587,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-aarch64/no-asm/crypto/buildinf.h
index 82407322b96..f011f915e4e 100644
--- a/deps/openssl/config/archs/linux-aarch64/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-aarch64/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-aarch64"
-#define DATE "built on: Mon Sep 30 17:09:13 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:02:39 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-aarch64/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/include/progs.h b/deps/openssl/config/archs/linux-aarch64/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-aarch64/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/linux-aarch64/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-aarch64/no-asm/openssl.gypi b/deps/openssl/config/archs/linux-aarch64/no-asm/openssl.gypi
index f20a2ba245d..387362a4757 100644
--- a/deps/openssl/config/archs/linux-aarch64/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux-aarch64/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux-armv4/asm/apps/progs.c b/deps/openssl/config/archs/linux-armv4/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-armv4/asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux-armv4/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-armv4/asm/configdata.pm b/deps/openssl/config/archs/linux-armv4/asm/configdata.pm
index 4ac06388d75..301b8298786 100644
--- a/deps/openssl/config/archs/linux-armv4/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-armv4/asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-armv4",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -395,7 +395,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -898,6 +897,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1054,9 +1056,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3474,9 +3473,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5868,9 +5864,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7253,6 +7246,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7461,10 +7458,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10271,7 +10264,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10322,7 +10314,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12525,9 +12516,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14919,9 +14907,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16286,10 +16271,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16891,7 +16872,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18434,6 +18414,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18596,9 +18580,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19971,7 +19952,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20305,6 +20285,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20357,7 +20338,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24571,7 +24551,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24598,7 +24577,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25851,9 +25829,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25935,9 +25910,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26068,6 +26040,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26380,12 +26358,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27838,7 +27810,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27860,7 +27832,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-armv4/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-armv4/asm/crypto/buildinf.h
index c2f243c0696..9fbe102da05 100644
--- a/deps/openssl/config/archs/linux-armv4/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-armv4/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-armv4"
-#define DATE "built on: Mon Sep 30 17:09:25 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:02:50 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-armv4/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-armv4/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-armv4/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-armv4/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-armv4/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-armv4/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-armv4/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-armv4/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-armv4/asm/include/progs.h b/deps/openssl/config/archs/linux-armv4/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-armv4/asm/include/progs.h
+++ b/deps/openssl/config/archs/linux-armv4/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-armv4/asm/openssl.gypi b/deps/openssl/config/archs/linux-armv4/asm/openssl.gypi
index 8fd7c43c4db..849f58d4bdb 100644
--- a/deps/openssl/config/archs/linux-armv4/asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux-armv4/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/apps/progs.c b/deps/openssl/config/archs/linux-armv4/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-armv4/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-armv4/asm_avx2/configdata.pm
index f5715110100..c6045ab640a 100644
--- a/deps/openssl/config/archs/linux-armv4/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-armv4",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -395,7 +395,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -898,6 +897,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1054,9 +1056,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3474,9 +3473,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5868,9 +5864,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7253,6 +7246,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7461,10 +7458,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10271,7 +10264,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10322,7 +10314,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12525,9 +12516,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14919,9 +14907,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16286,10 +16271,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16891,7 +16872,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18434,6 +18414,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18596,9 +18580,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19971,7 +19952,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20305,6 +20285,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20357,7 +20338,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24571,7 +24551,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24598,7 +24577,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25851,9 +25829,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25935,9 +25910,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26068,6 +26040,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26380,12 +26358,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27838,7 +27810,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27860,7 +27832,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-armv4/asm_avx2/crypto/buildinf.h
index e5f76f6ad71..65593d5b139 100644
--- a/deps/openssl/config/archs/linux-armv4/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-armv4"
-#define DATE "built on: Mon Sep 30 17:09:38 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:03:03 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/progs.h b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-armv4/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-armv4/asm_avx2/openssl.gypi b/deps/openssl/config/archs/linux-armv4/asm_avx2/openssl.gypi
index 9b594145412..76181e218d8 100644
--- a/deps/openssl/config/archs/linux-armv4/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/linux-armv4/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/apps/progs.c b/deps/openssl/config/archs/linux-armv4/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-armv4/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux-armv4/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/configdata.pm b/deps/openssl/config/archs/linux-armv4/no-asm/configdata.pm
index 2254a71143d..3783c4b8d52 100644
--- a/deps/openssl/config/archs/linux-armv4/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-armv4/no-asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -157,7 +157,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-armv4",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -395,7 +395,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -899,6 +898,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1055,9 +1057,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3435,9 +3434,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5829,9 +5825,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7214,6 +7207,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7422,10 +7419,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10207,7 +10200,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10258,7 +10250,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12461,9 +12452,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14855,9 +14843,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16222,10 +16207,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16827,7 +16808,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18286,6 +18266,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18448,9 +18432,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19823,7 +19804,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20157,6 +20137,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20209,7 +20190,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24335,7 +24315,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24362,7 +24341,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25603,9 +25581,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25687,9 +25662,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25820,6 +25792,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26132,12 +26110,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27593,7 +27565,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27615,7 +27587,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-armv4/no-asm/crypto/buildinf.h
index 9b3d97b6291..f317b588f51 100644
--- a/deps/openssl/config/archs/linux-armv4/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-armv4/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-armv4"
-#define DATE "built on: Mon Sep 30 17:09:50 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:03:15 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-armv4/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/include/progs.h b/deps/openssl/config/archs/linux-armv4/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-armv4/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/linux-armv4/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-armv4/no-asm/openssl.gypi b/deps/openssl/config/archs/linux-armv4/no-asm/openssl.gypi
index cc4efdf7d59..6ad73f4142d 100644
--- a/deps/openssl/config/archs/linux-armv4/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux-armv4/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux-elf/asm/apps/progs.c b/deps/openssl/config/archs/linux-elf/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-elf/asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux-elf/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-elf/asm/configdata.pm b/deps/openssl/config/archs/linux-elf/asm/configdata.pm
index f134e72ba60..4230adf831e 100644
--- a/deps/openssl/config/archs/linux-elf/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-elf/asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-elf",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -394,7 +394,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -897,6 +896,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1053,9 +1055,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3492,9 +3491,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5886,9 +5882,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7271,6 +7264,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7479,10 +7476,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10286,7 +10279,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10337,7 +10329,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12540,9 +12531,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14934,9 +14922,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16301,10 +16286,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16906,7 +16887,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18365,6 +18345,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18527,9 +18511,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19902,7 +19883,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20236,6 +20216,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20288,7 +20269,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24492,7 +24472,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24519,7 +24498,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25770,9 +25748,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25854,9 +25829,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25987,6 +25959,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26299,12 +26277,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27757,7 +27729,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27779,7 +27751,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-elf/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-elf/asm/crypto/buildinf.h
index 939d8f553cc..b0d1da6fd25 100644
--- a/deps/openssl/config/archs/linux-elf/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-elf/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-elf"
-#define DATE "built on: Mon Sep 30 17:10:02 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:03:26 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-elf/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-elf/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-elf/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-elf/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-elf/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-elf/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-elf/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-elf/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-elf/asm/include/progs.h b/deps/openssl/config/archs/linux-elf/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-elf/asm/include/progs.h
+++ b/deps/openssl/config/archs/linux-elf/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-elf/asm/openssl.gypi b/deps/openssl/config/archs/linux-elf/asm/openssl.gypi
index 0cf7d926c47..c782453da24 100644
--- a/deps/openssl/config/archs/linux-elf/asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux-elf/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/apps/progs.c b/deps/openssl/config/archs/linux-elf/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-elf/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/linux-elf/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-elf/asm_avx2/configdata.pm
index 90aff138cbc..f2e251ddbc0 100644
--- a/deps/openssl/config/archs/linux-elf/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux-elf/asm_avx2/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-elf",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -394,7 +394,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -897,6 +896,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1053,9 +1055,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3492,9 +3491,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5886,9 +5882,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7271,6 +7264,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7479,10 +7476,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10286,7 +10279,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10337,7 +10329,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12540,9 +12531,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14934,9 +14922,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16301,10 +16286,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16906,7 +16887,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18365,6 +18345,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18527,9 +18511,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19902,7 +19883,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20236,6 +20216,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20288,7 +20269,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24492,7 +24472,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24519,7 +24498,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25770,9 +25748,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25854,9 +25829,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25987,6 +25959,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26299,12 +26277,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27757,7 +27729,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27779,7 +27751,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-elf/asm_avx2/crypto/buildinf.h
index 3a655350497..1113f7c9c54 100644
--- a/deps/openssl/config/archs/linux-elf/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-elf/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-elf"
-#define DATE "built on: Mon Sep 30 17:10:15 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:03:39 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-elf/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/include/progs.h b/deps/openssl/config/archs/linux-elf/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-elf/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/linux-elf/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-elf/asm_avx2/openssl.gypi b/deps/openssl/config/archs/linux-elf/asm_avx2/openssl.gypi
index 4ca065ef163..a0ce9ab8dca 100644
--- a/deps/openssl/config/archs/linux-elf/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/linux-elf/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/linux-elf/no-asm/apps/progs.c b/deps/openssl/config/archs/linux-elf/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-elf/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux-elf/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-elf/no-asm/configdata.pm b/deps/openssl/config/archs/linux-elf/no-asm/configdata.pm
index 479b266eb3e..33c8a7298c2 100644
--- a/deps/openssl/config/archs/linux-elf/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-elf/no-asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -157,7 +157,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-elf",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -394,7 +394,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -898,6 +897,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1054,9 +1056,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3434,9 +3433,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5828,9 +5824,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7213,6 +7206,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7421,10 +7418,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10206,7 +10199,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10257,7 +10249,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12460,9 +12451,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14854,9 +14842,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16221,10 +16206,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16826,7 +16807,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18285,6 +18265,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18447,9 +18431,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19822,7 +19803,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20156,6 +20136,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20208,7 +20189,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24334,7 +24314,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24361,7 +24340,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25602,9 +25580,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25686,9 +25661,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25819,6 +25791,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26131,12 +26109,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27592,7 +27564,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27614,7 +27586,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-elf/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-elf/no-asm/crypto/buildinf.h
index cea8ea6ace9..732212bb3ef 100644
--- a/deps/openssl/config/archs/linux-elf/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-elf/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-elf"
-#define DATE "built on: Mon Sep 30 17:10:28 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:03:52 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-elf/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-elf/no-asm/include/progs.h b/deps/openssl/config/archs/linux-elf/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-elf/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/linux-elf/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-elf/no-asm/openssl.gypi b/deps/openssl/config/archs/linux-elf/no-asm/openssl.gypi
index 3b06ffbeef4..8bc730460cf 100644
--- a/deps/openssl/config/archs/linux-elf/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux-elf/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/apps/progs.c b/deps/openssl/config/archs/linux-ppc64le/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux-ppc64le/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/configdata.pm b/deps/openssl/config/archs/linux-ppc64le/asm/configdata.pm
index be8ddf1031a..f2225dbc54e 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-ppc64le/asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-ppc64le",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -395,7 +395,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -898,6 +897,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1054,9 +1056,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3472,9 +3471,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5866,9 +5862,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7251,6 +7244,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7459,10 +7456,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10282,7 +10275,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10333,7 +10325,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12536,9 +12527,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14930,9 +14918,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16297,10 +16282,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16902,7 +16883,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18361,6 +18341,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18523,9 +18507,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19898,7 +19879,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20232,6 +20212,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20284,7 +20265,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24545,7 +24525,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24572,7 +24551,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25830,9 +25808,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25914,9 +25889,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26047,6 +26019,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26359,12 +26337,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27817,7 +27789,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27839,7 +27811,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-ppc64le/asm/crypto/buildinf.h
index a1d53486daf..42c87911659 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-ppc64le"
-#define DATE "built on: Mon Sep 30 17:11:23 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:04:45 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/include/progs.h b/deps/openssl/config/archs/linux-ppc64le/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm/include/progs.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm/openssl.gypi b/deps/openssl/config/archs/linux-ppc64le/asm/openssl.gypi
index a7479e90fbe..391c727e3ca 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux-ppc64le/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/apps/progs.c b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/configdata.pm
index 4693b1e2ca6..d56fa2d54c7 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-ppc64le",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -395,7 +395,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -898,6 +897,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1054,9 +1056,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3472,9 +3471,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5866,9 +5862,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7251,6 +7244,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7459,10 +7456,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10282,7 +10275,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10333,7 +10325,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12536,9 +12527,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14930,9 +14918,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16297,10 +16282,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16902,7 +16883,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18361,6 +18341,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18523,9 +18507,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19898,7 +19879,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20232,6 +20212,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20284,7 +20265,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24545,7 +24525,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24572,7 +24551,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25830,9 +25808,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25914,9 +25889,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26047,6 +26019,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26359,12 +26337,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27817,7 +27789,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27839,7 +27811,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/crypto/buildinf.h
index 62ae301563c..d689af3d037 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-ppc64le"
-#define DATE "built on: Mon Sep 30 17:11:36 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:04:58 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/progs.h b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/openssl.gypi b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/openssl.gypi
index f07a1c9c6a4..df4018f9641 100644
--- a/deps/openssl/config/archs/linux-ppc64le/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/linux-ppc64le/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/apps/progs.c b/deps/openssl/config/archs/linux-ppc64le/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-ppc64le/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/configdata.pm b/deps/openssl/config/archs/linux-ppc64le/no-asm/configdata.pm
index 4ea93196205..254be4364f3 100644
--- a/deps/openssl/config/archs/linux-ppc64le/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -157,7 +157,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-ppc64le",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -395,7 +395,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -899,6 +898,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1055,9 +1057,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3435,9 +3434,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5829,9 +5825,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7214,6 +7207,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7422,10 +7419,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10207,7 +10200,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10258,7 +10250,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12461,9 +12452,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14855,9 +14843,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16222,10 +16207,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16827,7 +16808,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18286,6 +18266,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18448,9 +18432,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19823,7 +19804,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20157,6 +20137,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20209,7 +20190,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24335,7 +24315,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24362,7 +24341,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25603,9 +25581,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25687,9 +25662,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25820,6 +25792,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26132,12 +26110,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27593,7 +27565,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27615,7 +27587,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-ppc64le/no-asm/crypto/buildinf.h
index 813a758dbb8..e4ba8ad0604 100644
--- a/deps/openssl/config/archs/linux-ppc64le/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-ppc64le"
-#define DATE "built on: Mon Sep 30 17:11:49 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:05:10 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/progs.h b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-ppc64le/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-ppc64le/no-asm/openssl.gypi b/deps/openssl/config/archs/linux-ppc64le/no-asm/openssl.gypi
index 046ec44ce8e..59a593c03ce 100644
--- a/deps/openssl/config/archs/linux-ppc64le/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux-ppc64le/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux-x86_64/asm/apps/progs.c b/deps/openssl/config/archs/linux-x86_64/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux-x86_64/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-x86_64/asm/configdata.pm b/deps/openssl/config/archs/linux-x86_64/asm/configdata.pm
index 0a7527c74f6..a84203c4b5b 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-x86_64/asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-x86_64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -396,7 +396,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -899,6 +898,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1055,9 +1057,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3499,9 +3498,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5893,9 +5889,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7278,6 +7271,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7486,10 +7483,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10329,7 +10322,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10380,7 +10372,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12583,9 +12574,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14977,9 +14965,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16344,10 +16329,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16949,7 +16930,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18408,6 +18388,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18570,9 +18554,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19945,7 +19926,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20279,6 +20259,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20331,7 +20312,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24626,7 +24606,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24653,7 +24632,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25917,9 +25895,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -26001,9 +25976,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26134,6 +26106,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26446,12 +26424,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27904,7 +27876,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27926,7 +27898,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-x86_64/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-x86_64/asm/crypto/buildinf.h
index 56ff0a9f0ce..98989e9a320 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-x86_64"
-#define DATE "built on: Mon Sep 30 17:10:40 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:04:03 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-x86_64/asm/include/progs.h b/deps/openssl/config/archs/linux-x86_64/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm/include/progs.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-x86_64/asm/openssl.gypi b/deps/openssl/config/archs/linux-x86_64/asm/openssl.gypi
index 14bcd8e7f8f..a2861e7edd1 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux-x86_64/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/apps/progs.c b/deps/openssl/config/archs/linux-x86_64/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux-x86_64/asm_avx2/configdata.pm
index 8de9a59e88a..9cb66bbfb1d 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-x86_64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -396,7 +396,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -899,6 +898,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1055,9 +1057,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3499,9 +3498,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5893,9 +5889,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7278,6 +7271,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7486,10 +7483,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10329,7 +10322,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10380,7 +10372,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12583,9 +12574,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14977,9 +14965,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16344,10 +16329,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16949,7 +16930,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18408,6 +18388,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18570,9 +18554,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19945,7 +19926,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20279,6 +20259,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20331,7 +20312,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24626,7 +24606,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24653,7 +24632,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25917,9 +25895,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -26001,9 +25976,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26134,6 +26106,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26446,12 +26424,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27904,7 +27876,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27926,7 +27898,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux-x86_64/asm_avx2/crypto/buildinf.h
index 75117a04bb1..109d6e9a86b 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-x86_64"
-#define DATE "built on: Mon Sep 30 17:10:56 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:04:19 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/progs.h b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-x86_64/asm_avx2/openssl.gypi b/deps/openssl/config/archs/linux-x86_64/asm_avx2/openssl.gypi
index 20c248d53cc..5be120b7db1 100644
--- a/deps/openssl/config/archs/linux-x86_64/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/linux-x86_64/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/apps/progs.c b/deps/openssl/config/archs/linux-x86_64/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux-x86_64/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux-x86_64/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/configdata.pm b/deps/openssl/config/archs/linux-x86_64/no-asm/configdata.pm
index d520c3b33b8..b4bbde59a65 100644
--- a/deps/openssl/config/archs/linux-x86_64/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux-x86_64/no-asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -157,7 +157,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux-x86_64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -396,7 +396,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -900,6 +899,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1056,9 +1058,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3436,9 +3435,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5830,9 +5826,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7215,6 +7208,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7423,10 +7420,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10208,7 +10201,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10259,7 +10251,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12462,9 +12453,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14856,9 +14844,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16223,10 +16208,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16828,7 +16809,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18287,6 +18267,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18449,9 +18433,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19824,7 +19805,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20158,6 +20138,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20210,7 +20191,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24336,7 +24316,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24363,7 +24342,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25604,9 +25582,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25688,9 +25663,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25821,6 +25793,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26133,12 +26111,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27594,7 +27566,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27616,7 +27588,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux-x86_64/no-asm/crypto/buildinf.h
index 8062b751473..0c2e3865967 100644
--- a/deps/openssl/config/archs/linux-x86_64/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux-x86_64/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux-x86_64"
-#define DATE "built on: Mon Sep 30 17:11:12 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:04:34 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux-x86_64/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/include/progs.h b/deps/openssl/config/archs/linux-x86_64/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux-x86_64/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/linux-x86_64/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux-x86_64/no-asm/openssl.gypi b/deps/openssl/config/archs/linux-x86_64/no-asm/openssl.gypi
index f9ab8cd8ad2..0eae103bf39 100644
--- a/deps/openssl/config/archs/linux-x86_64/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux-x86_64/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux32-s390x/asm/apps/progs.c b/deps/openssl/config/archs/linux32-s390x/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux32-s390x/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux32-s390x/asm/configdata.pm b/deps/openssl/config/archs/linux32-s390x/asm/configdata.pm
index 25d7152a503..2aed4d40439 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux32-s390x/asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux32-s390x",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -395,7 +395,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -898,6 +897,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1054,9 +1056,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3481,9 +3480,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5875,9 +5871,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7260,6 +7253,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7468,10 +7465,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10269,7 +10262,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10320,7 +10312,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12523,9 +12514,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14917,9 +14905,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16284,10 +16269,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16889,7 +16870,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18402,6 +18382,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18564,9 +18548,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19939,7 +19920,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20273,6 +20253,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20325,7 +20306,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24507,7 +24487,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24534,7 +24513,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25783,9 +25761,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25867,9 +25842,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26000,6 +25972,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26312,12 +26290,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27770,7 +27742,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27792,7 +27764,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux32-s390x/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux32-s390x/asm/crypto/buildinf.h
index a1815adcb47..746e7a850bd 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux32-s390x"
-#define DATE "built on: Mon Sep 30 17:12:01 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:05:22 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux32-s390x/asm/include/progs.h b/deps/openssl/config/archs/linux32-s390x/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm/include/progs.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux32-s390x/asm/openssl.gypi b/deps/openssl/config/archs/linux32-s390x/asm/openssl.gypi
index 5815f28914d..d2ec66abc20 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux32-s390x/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/apps/progs.c b/deps/openssl/config/archs/linux32-s390x/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux32-s390x/asm_avx2/configdata.pm
index bfdea24dd5e..4ba3fdb2ce6 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux32-s390x",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -395,7 +395,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -898,6 +897,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1054,9 +1056,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3481,9 +3480,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5875,9 +5871,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7260,6 +7253,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7468,10 +7465,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10269,7 +10262,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10320,7 +10312,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12523,9 +12514,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14917,9 +14905,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16284,10 +16269,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16889,7 +16870,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18402,6 +18382,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18564,9 +18548,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19939,7 +19920,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20273,6 +20253,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20325,7 +20306,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24507,7 +24487,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24534,7 +24513,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25783,9 +25761,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25867,9 +25842,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26000,6 +25972,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26312,12 +26290,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27770,7 +27742,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27792,7 +27764,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux32-s390x/asm_avx2/crypto/buildinf.h
index e6b3e00f5c7..8520b0b6871 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux32-s390x"
-#define DATE "built on: Mon Sep 30 17:12:14 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:05:34 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/progs.h b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux32-s390x/asm_avx2/openssl.gypi b/deps/openssl/config/archs/linux32-s390x/asm_avx2/openssl.gypi
index 9cebf7a2e77..9a9cb1df312 100644
--- a/deps/openssl/config/archs/linux32-s390x/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/linux32-s390x/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/apps/progs.c b/deps/openssl/config/archs/linux32-s390x/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux32-s390x/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux32-s390x/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/configdata.pm b/deps/openssl/config/archs/linux32-s390x/no-asm/configdata.pm
index 36af8f54cc6..3203fac4e66 100644
--- a/deps/openssl/config/archs/linux32-s390x/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux32-s390x/no-asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -157,7 +157,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux32-s390x",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -395,7 +395,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -899,6 +898,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1055,9 +1057,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3435,9 +3434,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5829,9 +5825,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7214,6 +7207,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7422,10 +7419,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10207,7 +10200,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10258,7 +10250,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12461,9 +12452,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14855,9 +14843,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16222,10 +16207,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16827,7 +16808,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18286,6 +18266,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18448,9 +18432,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19823,7 +19804,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20157,6 +20137,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20209,7 +20190,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24335,7 +24315,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24362,7 +24341,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25603,9 +25581,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25687,9 +25662,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25820,6 +25792,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26132,12 +26110,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27593,7 +27565,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27615,7 +27587,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux32-s390x/no-asm/crypto/buildinf.h
index 2e191c2e484..cfbf11db75c 100644
--- a/deps/openssl/config/archs/linux32-s390x/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux32-s390x/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux32-s390x"
-#define DATE "built on: Mon Sep 30 17:12:26 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:05:47 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux32-s390x/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/include/progs.h b/deps/openssl/config/archs/linux32-s390x/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux32-s390x/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/linux32-s390x/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux32-s390x/no-asm/openssl.gypi b/deps/openssl/config/archs/linux32-s390x/no-asm/openssl.gypi
index 1b3c2428a59..7dc0d96b51c 100644
--- a/deps/openssl/config/archs/linux32-s390x/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux32-s390x/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/apps/progs.c b/deps/openssl/config/archs/linux64-loongarch64/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/configdata.pm b/deps/openssl/config/archs/linux64-loongarch64/no-asm/configdata.pm
index 4ba193f4bf3..9356c6d20f9 100644
--- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -157,7 +157,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-loongarch64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -394,7 +394,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -898,6 +897,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1054,9 +1056,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3434,9 +3433,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5828,9 +5824,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7213,6 +7206,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7421,10 +7418,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10206,7 +10199,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10257,7 +10249,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12460,9 +12451,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14854,9 +14842,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16221,10 +16206,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16826,7 +16807,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18285,6 +18265,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18447,9 +18431,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19822,7 +19803,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20156,6 +20136,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20208,7 +20189,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24334,7 +24314,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24361,7 +24340,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25602,9 +25580,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25686,9 +25661,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25819,6 +25791,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26131,12 +26109,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27592,7 +27564,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27614,7 +27586,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-loongarch64/no-asm/crypto/buildinf.h
index 8b0b4c9de87..35f4088f697 100644
--- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-loongarch64"
-#define DATE "built on: Mon Sep 30 17:16:54 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:10:06 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/progs.h b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-loongarch64/no-asm/openssl.gypi b/deps/openssl/config/archs/linux64-loongarch64/no-asm/openssl.gypi
index 7646500a7b4..530fb2b9972 100644
--- a/deps/openssl/config/archs/linux64-loongarch64/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux64-loongarch64/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux64-mips64/asm/apps/progs.c b/deps/openssl/config/archs/linux64-mips64/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux64-mips64/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-mips64/asm/configdata.pm b/deps/openssl/config/archs/linux64-mips64/asm/configdata.pm
index 751dc619e08..3791b477028 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux64-mips64/asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -162,7 +162,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -210,10 +210,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -262,11 +262,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-mips64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -399,7 +399,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -902,6 +901,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1058,9 +1060,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3460,9 +3459,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5854,9 +5850,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7239,6 +7232,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7447,10 +7444,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10241,7 +10234,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10292,7 +10284,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12495,9 +12486,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14889,9 +14877,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16256,10 +16241,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16861,7 +16842,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18359,6 +18339,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18521,9 +18505,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19896,7 +19877,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20230,6 +20210,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20282,7 +20263,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24440,7 +24420,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24467,7 +24446,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25712,9 +25690,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25796,9 +25771,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25929,6 +25901,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26241,12 +26219,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27699,7 +27671,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27721,7 +27693,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux64-mips64/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-mips64/asm/crypto/buildinf.h
index 5bcb19f0038..7bbf51db1e9 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-mips64"
-#define DATE "built on: Mon Sep 30 17:13:16 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:06:35 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux64-mips64/asm/include/progs.h b/deps/openssl/config/archs/linux64-mips64/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm/include/progs.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-mips64/asm/openssl.gypi b/deps/openssl/config/archs/linux64-mips64/asm/openssl.gypi
index 530cea8a707..2766034c0f4 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux64-mips64/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/apps/progs.c b/deps/openssl/config/archs/linux64-mips64/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux64-mips64/asm_avx2/configdata.pm
index c861a6aa75d..64118999c0d 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -162,7 +162,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -210,10 +210,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -262,11 +262,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-mips64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -399,7 +399,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -902,6 +901,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1058,9 +1060,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3460,9 +3459,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5854,9 +5850,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7239,6 +7232,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7447,10 +7444,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10241,7 +10234,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10292,7 +10284,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12495,9 +12486,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14889,9 +14877,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16256,10 +16241,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16861,7 +16842,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18359,6 +18339,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18521,9 +18505,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19896,7 +19877,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20230,6 +20210,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20282,7 +20263,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24440,7 +24420,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24467,7 +24446,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25712,9 +25690,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25796,9 +25771,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25929,6 +25901,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26241,12 +26219,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27699,7 +27671,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27721,7 +27693,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux64-mips64/asm_avx2/crypto/buildinf.h
index 9969f7fbe48..e9c4ce02098 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-mips64"
-#define DATE "built on: Mon Sep 30 17:13:28 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:06:47 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/progs.h b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-mips64/asm_avx2/openssl.gypi b/deps/openssl/config/archs/linux64-mips64/asm_avx2/openssl.gypi
index 04841c76521..94f3c87ec84 100644
--- a/deps/openssl/config/archs/linux64-mips64/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/linux64-mips64/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/apps/progs.c b/deps/openssl/config/archs/linux64-mips64/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux64-mips64/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux64-mips64/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/configdata.pm b/deps/openssl/config/archs/linux64-mips64/no-asm/configdata.pm
index 0aa374d19d5..620cce510e5 100644
--- a/deps/openssl/config/archs/linux64-mips64/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux64-mips64/no-asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -157,7 +157,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-mips64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -396,7 +396,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -900,6 +899,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1056,9 +1058,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3436,9 +3435,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5830,9 +5826,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7215,6 +7208,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7423,10 +7420,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10208,7 +10201,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10259,7 +10251,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12462,9 +12453,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14856,9 +14844,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16223,10 +16208,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16828,7 +16809,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18287,6 +18267,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18449,9 +18433,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19824,7 +19805,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20158,6 +20138,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20210,7 +20191,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24336,7 +24316,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24363,7 +24342,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25604,9 +25582,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25688,9 +25663,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25821,6 +25793,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26133,12 +26111,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27594,7 +27566,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27616,7 +27588,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-mips64/no-asm/crypto/buildinf.h
index 135ced7215d..37ff606b896 100644
--- a/deps/openssl/config/archs/linux64-mips64/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-mips64/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-mips64"
-#define DATE "built on: Mon Sep 30 17:13:40 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:06:59 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-mips64/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/include/progs.h b/deps/openssl/config/archs/linux64-mips64/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux64-mips64/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/linux64-mips64/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-mips64/no-asm/openssl.gypi b/deps/openssl/config/archs/linux64-mips64/no-asm/openssl.gypi
index 0051a07280e..d668c560816 100644
--- a/deps/openssl/config/archs/linux64-mips64/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux64-mips64/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/apps/progs.c b/deps/openssl/config/archs/linux64-riscv64/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux64-riscv64/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/configdata.pm b/deps/openssl/config/archs/linux64-riscv64/no-asm/configdata.pm
index ce13ea66723..965841bcbfc 100644
--- a/deps/openssl/config/archs/linux64-riscv64/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -157,7 +157,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-riscv64",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -394,7 +394,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -898,6 +897,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1054,9 +1056,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3434,9 +3433,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5828,9 +5824,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7213,6 +7206,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7421,10 +7418,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10206,7 +10199,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10257,7 +10249,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12460,9 +12451,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14854,9 +14842,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16221,10 +16206,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16826,7 +16807,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18285,6 +18265,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18447,9 +18431,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19822,7 +19803,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20156,6 +20136,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20208,7 +20189,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24334,7 +24314,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24361,7 +24340,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25602,9 +25580,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25686,9 +25661,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25819,6 +25791,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26131,12 +26109,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27592,7 +27564,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27614,7 +27586,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-riscv64/no-asm/crypto/buildinf.h
index f5d77a05993..e2572b49a0d 100644
--- a/deps/openssl/config/archs/linux64-riscv64/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-riscv64"
-#define DATE "built on: Mon Sep 30 17:16:42 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:09:54 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/progs.h b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux64-riscv64/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-riscv64/no-asm/openssl.gypi b/deps/openssl/config/archs/linux64-riscv64/no-asm/openssl.gypi
index b4549cc91f5..28788f4b84b 100644
--- a/deps/openssl/config/archs/linux64-riscv64/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux64-riscv64/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/linux64-s390x/asm/apps/progs.c b/deps/openssl/config/archs/linux64-s390x/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux64-s390x/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-s390x/asm/configdata.pm b/deps/openssl/config/archs/linux64-s390x/asm/configdata.pm
index df0ce5c951f..abc3528c063 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm/configdata.pm
+++ b/deps/openssl/config/archs/linux64-s390x/asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-s390x",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -396,7 +396,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -899,6 +898,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1055,9 +1057,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3482,9 +3481,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5876,9 +5872,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7261,6 +7254,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7469,10 +7466,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10280,7 +10273,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10331,7 +10323,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12534,9 +12525,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14928,9 +14916,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16295,10 +16280,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16900,7 +16881,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18413,6 +18393,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18575,9 +18559,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19950,7 +19931,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20284,6 +20264,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20336,7 +20317,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24518,7 +24498,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24545,7 +24524,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25794,9 +25772,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25878,9 +25853,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26011,6 +25983,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26323,12 +26301,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27781,7 +27753,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27803,7 +27775,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux64-s390x/asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-s390x/asm/crypto/buildinf.h
index d7922fa6537..d2d018bb826 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-s390x"
-#define DATE "built on: Mon Sep 30 17:12:38 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:05:58 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux64-s390x/asm/include/progs.h b/deps/openssl/config/archs/linux64-s390x/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm/include/progs.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-s390x/asm/openssl.gypi b/deps/openssl/config/archs/linux64-s390x/asm/openssl.gypi
index 0e033968bf8..3f54c7665d7 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux64-s390x/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/apps/progs.c b/deps/openssl/config/archs/linux64-s390x/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/configdata.pm b/deps/openssl/config/archs/linux64-s390x/asm_avx2/configdata.pm
index b106196b63a..ce5beb94026 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -159,7 +159,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -207,10 +207,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-s390x",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -396,7 +396,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -899,6 +898,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1055,9 +1057,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3482,9 +3481,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5876,9 +5872,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7261,6 +7254,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7469,10 +7466,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10280,7 +10273,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10331,7 +10323,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12534,9 +12525,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14928,9 +14916,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16295,10 +16280,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16900,7 +16881,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18413,6 +18393,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18575,9 +18559,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19950,7 +19931,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20284,6 +20264,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20336,7 +20317,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24518,7 +24498,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24545,7 +24524,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25794,9 +25772,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25878,9 +25853,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26011,6 +25983,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26323,12 +26301,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27781,7 +27753,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27803,7 +27775,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/linux64-s390x/asm_avx2/crypto/buildinf.h
index 2c9106ca3ca..a4caeb83b31 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-s390x"
-#define DATE "built on: Mon Sep 30 17:12:51 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:06:11 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/progs.h b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-s390x/asm_avx2/openssl.gypi b/deps/openssl/config/archs/linux64-s390x/asm_avx2/openssl.gypi
index d3994ecfaeb..2624be71174 100644
--- a/deps/openssl/config/archs/linux64-s390x/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/linux64-s390x/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/apps/progs.c b/deps/openssl/config/archs/linux64-s390x/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/linux64-s390x/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/linux64-s390x/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/configdata.pm b/deps/openssl/config/archs/linux64-s390x/no-asm/configdata.pm
index 1462cc41fae..600b00670d4 100644
--- a/deps/openssl/config/archs/linux64-s390x/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/linux64-s390x/no-asm/configdata.pm
@@ -142,7 +142,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -157,7 +157,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -206,10 +206,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -259,11 +259,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned char",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "linux64-s390x",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -396,7 +396,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -900,6 +899,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1056,9 +1058,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3436,9 +3435,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5830,9 +5826,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7215,6 +7208,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7423,10 +7420,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10208,7 +10201,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10259,7 +10251,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12462,9 +12453,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14856,9 +14844,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16223,10 +16208,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16828,7 +16809,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18287,6 +18267,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18449,9 +18433,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19824,7 +19805,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20158,6 +20138,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20210,7 +20191,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24336,7 +24316,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24363,7 +24342,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25604,9 +25582,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25688,9 +25663,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25821,6 +25793,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26133,12 +26111,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27594,7 +27566,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27616,7 +27588,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/linux64-s390x/no-asm/crypto/buildinf.h
index 65fd9d291b3..1a15fe8b54d 100644
--- a/deps/openssl/config/archs/linux64-s390x/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/linux64-s390x/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: linux64-s390x"
-#define DATE "built on: Mon Sep 30 17:13:04 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:06:24 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/linux64-s390x/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/include/progs.h b/deps/openssl/config/archs/linux64-s390x/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/linux64-s390x/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/linux64-s390x/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/linux64-s390x/no-asm/openssl.gypi b/deps/openssl/config/archs/linux64-s390x/no-asm/openssl.gypi
index c1c132a136e..1fdc4dfb040 100644
--- a/deps/openssl/config/archs/linux64-s390x/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/linux64-s390x/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/apps/progs.c b/deps/openssl/config/archs/solaris-x86-gcc/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm/apps/progs.c
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/configdata.pm b/deps/openssl/config/archs/solaris-x86-gcc/asm/configdata.pm
index 15732afc060..29bb1851e3f 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm/configdata.pm
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -204,10 +204,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -256,11 +256,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "solaris-x86-gcc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -387,7 +387,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -890,6 +889,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1046,9 +1048,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3485,9 +3484,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5879,9 +5875,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7264,6 +7257,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7472,10 +7469,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10279,7 +10272,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10330,7 +10322,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12533,9 +12524,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14927,9 +14915,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16294,10 +16279,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16899,7 +16880,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18358,6 +18338,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18520,9 +18504,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19895,7 +19876,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20229,6 +20209,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20281,7 +20262,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24485,7 +24465,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24512,7 +24491,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25763,9 +25741,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25847,9 +25822,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25980,6 +25952,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26292,12 +26270,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27750,7 +27722,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27772,7 +27744,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/crypto/buildinf.h b/deps/openssl/config/archs/solaris-x86-gcc/asm/crypto/buildinf.h
index fcd321c8835..a447f23eeb1 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: solaris-x86-gcc"
-#define DATE "built on: Mon Sep 30 17:13:52 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:07:10 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/progs.h b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm/include/progs.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm/openssl.gypi b/deps/openssl/config/archs/solaris-x86-gcc/asm/openssl.gypi
index 2037cbe79e9..1c98866c3f4 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm/openssl.gypi
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/apps/progs.c b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/configdata.pm b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/configdata.pm
index 67a1475d1dd..b596850adb7 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -204,10 +204,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -256,11 +256,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "solaris-x86-gcc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -387,7 +387,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -890,6 +889,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1046,9 +1048,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3485,9 +3484,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5879,9 +5875,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7264,6 +7257,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7472,10 +7469,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10279,7 +10272,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10330,7 +10322,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12533,9 +12524,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14927,9 +14915,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16294,10 +16279,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16899,7 +16880,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18358,6 +18338,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18520,9 +18504,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19895,7 +19876,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20229,6 +20209,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20281,7 +20262,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24485,7 +24465,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24512,7 +24491,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25763,9 +25741,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25847,9 +25822,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25980,6 +25952,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26292,12 +26270,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27750,7 +27722,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27772,7 +27744,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/crypto/buildinf.h
index 6e6e28436ec..23cce74e295 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: solaris-x86-gcc"
-#define DATE "built on: Mon Sep 30 17:14:05 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:07:23 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/progs.h b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/openssl.gypi b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/openssl.gypi
index 2f0dea41efd..675580f4af2 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/solaris-x86-gcc/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/apps/progs.c b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/configdata.pm b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/configdata.pm
index 6210b1d2a3a..3861ddf22ae 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -154,7 +154,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -203,10 +203,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -256,11 +256,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "solaris-x86-gcc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -387,7 +387,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -891,6 +890,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1047,9 +1049,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3427,9 +3426,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5821,9 +5817,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7206,6 +7199,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7414,10 +7411,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10199,7 +10192,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10250,7 +10242,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12453,9 +12444,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14847,9 +14835,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16214,10 +16199,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16819,7 +16800,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18278,6 +18258,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18440,9 +18424,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19815,7 +19796,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20149,6 +20129,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20201,7 +20182,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24327,7 +24307,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24354,7 +24333,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25595,9 +25573,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25679,9 +25654,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25812,6 +25784,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26124,12 +26102,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27585,7 +27557,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27607,7 +27579,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/crypto/buildinf.h
index 4c9d7e40a9a..53c0d8b1a08 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: solaris-x86-gcc"
-#define DATE "built on: Mon Sep 30 17:14:18 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:07:35 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/progs.h b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/openssl.gypi b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/openssl.gypi
index 5af311edc16..65b9565d3df 100644
--- a/deps/openssl/config/archs/solaris-x86-gcc/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/solaris-x86-gcc/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/apps/progs.c b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/apps/progs.c
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/configdata.pm b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/configdata.pm
index b0a159b0cc7..9c48df85f8f 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/configdata.pm
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -204,10 +204,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -256,11 +256,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "solaris64-x86_64-gcc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -891,6 +890,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1047,9 +1049,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3491,9 +3490,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5885,9 +5881,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7270,6 +7263,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7478,10 +7475,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10321,7 +10314,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10372,7 +10364,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12575,9 +12566,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14969,9 +14957,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16336,10 +16321,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16941,7 +16922,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18400,6 +18380,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18562,9 +18546,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19937,7 +19918,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20271,6 +20251,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20323,7 +20304,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24618,7 +24598,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24645,7 +24624,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25909,9 +25887,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25993,9 +25968,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26126,6 +26098,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26438,12 +26416,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27896,7 +27868,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27918,7 +27890,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/crypto/buildinf.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/crypto/buildinf.h
index d4ff152f987..419598dbfc3 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: solaris64-x86_64-gcc"
-#define DATE "built on: Mon Sep 30 17:14:30 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:07:47 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/ssl.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/progs.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/progs.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/openssl.gypi b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/openssl.gypi
index 24d9ad0e5c0..d9001667578 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/openssl.gypi
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/apps/progs.c b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/apps/progs.c
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/configdata.pm b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/configdata.pm
index fe2ce273e36..78ff7abbcfc 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/configdata.pm
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [
@@ -156,7 +156,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -204,10 +204,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -256,11 +256,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "solaris64-x86_64-gcc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -891,6 +890,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1047,9 +1049,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3491,9 +3490,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5885,9 +5881,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7270,6 +7263,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7478,10 +7475,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10321,7 +10314,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10372,7 +10364,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12575,9 +12566,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14969,9 +14957,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16336,10 +16321,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16941,7 +16922,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18400,6 +18380,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18562,9 +18546,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19937,7 +19918,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20271,6 +20251,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20323,7 +20304,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24618,7 +24598,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24645,7 +24624,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25909,9 +25887,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25993,9 +25968,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -26126,6 +26098,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26438,12 +26416,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27896,7 +27868,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27918,7 +27890,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/crypto/buildinf.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/crypto/buildinf.h
index 8d026664c28..d10909b5f3a 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/crypto/buildinf.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: solaris64-x86_64-gcc"
-#define DATE "built on: Mon Sep 30 17:14:46 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:08:02 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/ssl.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/progs.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/progs.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/openssl.gypi b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/openssl.gypi
index 5bab94f70bb..d48b3cba951 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/openssl.gypi
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/asm_avx2/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cfb.c',
       'openssl/crypto/aes/aes_ecb.c',
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/apps/progs.c b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/apps/progs.c
index 6f240203d77..43cef00799b 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/apps/progs.c
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/apps/progs.c
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/configdata.pm b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/configdata.pm
index 350e5fdcdfd..21482b04250 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/configdata.pm
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/configdata.pm
@@ -139,7 +139,7 @@ our %config = (
         "providers/implementations/kem/build.info",
         "providers/implementations/rands/seeding/build.info"
     ],
-    "build_metadata" => "+quic",
+    "build_metadata" => "",
     "build_type" => "release",
     "builddir" => ".",
     "cflags" => [],
@@ -154,7 +154,7 @@ our %config = (
     ],
     "dynamic_engines" => "0",
     "ex_libs" => [],
-    "full_version" => "3.0.15+quic",
+    "full_version" => "3.0.16",
     "includes" => [],
     "lflags" => [],
     "lib_defines" => [
@@ -203,10 +203,10 @@ our %config = (
     "openssl_sys_defines" => [],
     "openssldir" => "",
     "options" => "enable-ssl-trace enable-fips no-afalgeng no-asan no-asm no-buildtest-c++ no-comp no-crypto-mdebug no-crypto-mdebug-backtrace no-devcryptoeng no-dynamic-engine no-ec_nistp_64_gcc_128 no-egd no-external-tests no-fuzz-afl no-fuzz-libfuzzer no-ktls no-loadereng no-md2 no-msan no-rc5 no-sctp no-shared no-ssl3 no-ssl3-method no-trace no-ubsan no-unit-test no-uplink no-weak-ssl-ciphers no-zlib no-zlib-dynamic",
-    "patch" => "15",
+    "patch" => "16",
     "perl_archname" => "x86_64-linux-gnu-thread-multi",
     "perl_cmd" => "/usr/bin/perl",
-    "perl_version" => "5.34.0",
+    "perl_version" => "5.38.2",
     "perlargv" => [
         "no-comp",
         "no-shared",
@@ -256,11 +256,11 @@ our %config = (
     "prerelease" => "",
     "processor" => "",
     "rc4_int" => "unsigned int",
-    "release_date" => "3 Sep 2024",
-    "shlib_version" => "81.3",
+    "release_date" => "11 Feb 2025",
+    "shlib_version" => "3",
     "sourcedir" => ".",
     "target" => "solaris64-x86_64-gcc",
-    "version" => "3.0.15"
+    "version" => "3.0.16"
 );
 our %target = (
     "AR" => "ar",
@@ -388,7 +388,6 @@ our @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -892,6 +891,9 @@ our %unified_info = (
             "test/bio_prefix_text" => {
                 "noinst" => "1"
             },
+            "test/bio_pw_callback_test" => {
+                "noinst" => "1"
+            },
             "test/bio_readbuffer_test" => {
                 "noinst" => "1"
             },
@@ -1048,9 +1050,6 @@ our %unified_info = (
             "test/buildtest_c_provider" => {
                 "noinst" => "1"
             },
-            "test/buildtest_c_quic" => {
-                "noinst" => "1"
-            },
             "test/buildtest_c_rand" => {
                 "noinst" => "1"
             },
@@ -3428,9 +3427,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -5822,9 +5818,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -7207,6 +7200,10 @@ our %unified_info = (
             "libcrypto",
             "test/libtestutil.a"
         ],
+        "test/bio_pw_callback_test" => [
+            "libcrypto",
+            "test/libtestutil.a"
+        ],
         "test/bio_readbuffer_test" => [
             "libcrypto",
             "test/libtestutil.a"
@@ -7415,10 +7412,6 @@ our %unified_info = (
             "libcrypto",
             "libssl"
         ],
-        "test/buildtest_c_quic" => [
-            "libcrypto",
-            "libssl"
-        ],
         "test/buildtest_c_rand" => [
             "libcrypto",
             "libssl"
@@ -10200,7 +10193,6 @@ our %unified_info = (
                 "ssl/libssl-lib-ssl_init.o",
                 "ssl/libssl-lib-ssl_lib.o",
                 "ssl/libssl-lib-ssl_mcnf.o",
-                "ssl/libssl-lib-ssl_quic.o",
                 "ssl/libssl-lib-ssl_rsa.o",
                 "ssl/libssl-lib-ssl_rsa_legacy.o",
                 "ssl/libssl-lib-ssl_sess.o",
@@ -10251,7 +10243,6 @@ our %unified_info = (
                 "ssl/statem/libssl-lib-statem_clnt.o",
                 "ssl/statem/libssl-lib-statem_dtls.o",
                 "ssl/statem/libssl-lib-statem_lib.o",
-                "ssl/statem/libssl-lib-statem_quic.o",
                 "ssl/statem/libssl-lib-statem_srvr.o"
             ],
             "products" => {
@@ -12454,9 +12445,6 @@ our %unified_info = (
         "doc/html/man3/SSL_CTX_set_psk_client_callback.html" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/html/man3/SSL_CTX_set_quic_method.html" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/html/man3/SSL_CTX_set_quiet_shutdown.html" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -14848,9 +14836,6 @@ our %unified_info = (
         "doc/man/man3/SSL_CTX_set_psk_client_callback.3" => [
             "doc/man3/SSL_CTX_set_psk_client_callback.pod"
         ],
-        "doc/man/man3/SSL_CTX_set_quic_method.3" => [
-            "doc/man3/SSL_CTX_set_quic_method.pod"
-        ],
         "doc/man/man3/SSL_CTX_set_quiet_shutdown.3" => [
             "doc/man3/SSL_CTX_set_quiet_shutdown.pod"
         ],
@@ -16215,10 +16200,6 @@ our %unified_info = (
             "test/generate_buildtest.pl",
             "provider"
         ],
-        "test/buildtest_quic.c" => [
-            "test/generate_buildtest.pl",
-            "quic"
-        ],
         "test/buildtest_rand.c" => [
             "test/generate_buildtest.pl",
             "rand"
@@ -16820,7 +16801,6 @@ our %unified_info = (
             "doc/html/man3/SSL_CTX_set_num_tickets.html",
             "doc/html/man3/SSL_CTX_set_options.html",
             "doc/html/man3/SSL_CTX_set_psk_client_callback.html",
-            "doc/html/man3/SSL_CTX_set_quic_method.html",
             "doc/html/man3/SSL_CTX_set_quiet_shutdown.html",
             "doc/html/man3/SSL_CTX_set_read_ahead.html",
             "doc/html/man3/SSL_CTX_set_record_padding_callback.html",
@@ -18279,6 +18259,10 @@ our %unified_info = (
             "include",
             "apps/include"
         ],
+        "test/bio_pw_callback_test" => [
+            "include",
+            "apps/include"
+        ],
         "test/bio_readbuffer_test" => [
             "include",
             "apps/include"
@@ -18441,9 +18425,6 @@ our %unified_info = (
         "test/buildtest_c_provider" => [
             "include"
         ],
-        "test/buildtest_c_quic" => [
-            "include"
-        ],
         "test/buildtest_c_rand" => [
             "include"
         ],
@@ -19816,7 +19797,6 @@ our %unified_info = (
             "doc/man/man3/SSL_CTX_set_num_tickets.3",
             "doc/man/man3/SSL_CTX_set_options.3",
             "doc/man/man3/SSL_CTX_set_psk_client_callback.3",
-            "doc/man/man3/SSL_CTX_set_quic_method.3",
             "doc/man/man3/SSL_CTX_set_quiet_shutdown.3",
             "doc/man/man3/SSL_CTX_set_read_ahead.3",
             "doc/man/man3/SSL_CTX_set_record_padding_callback.3",
@@ -20150,6 +20130,7 @@ our %unified_info = (
         "test/bio_enc_test",
         "test/bio_memleak_test",
         "test/bio_prefix_text",
+        "test/bio_pw_callback_test",
         "test/bio_readbuffer_test",
         "test/bioprinttest",
         "test/bn_internal_test",
@@ -20202,7 +20183,6 @@ our %unified_info = (
         "test/buildtest_c_pem2",
         "test/buildtest_c_prov_ssl",
         "test/buildtest_c_provider",
-        "test/buildtest_c_quic",
         "test/buildtest_c_rand",
         "test/buildtest_c_rc2",
         "test/buildtest_c_rc4",
@@ -24328,7 +24308,6 @@ our %unified_info = (
             "ssl/libssl-lib-ssl_init.o",
             "ssl/libssl-lib-ssl_lib.o",
             "ssl/libssl-lib-ssl_mcnf.o",
-            "ssl/libssl-lib-ssl_quic.o",
             "ssl/libssl-lib-ssl_rsa.o",
             "ssl/libssl-lib-ssl_rsa_legacy.o",
             "ssl/libssl-lib-ssl_sess.o",
@@ -24355,7 +24334,6 @@ our %unified_info = (
             "ssl/statem/libssl-lib-statem_clnt.o",
             "ssl/statem/libssl-lib-statem_dtls.o",
             "ssl/statem/libssl-lib-statem_lib.o",
-            "ssl/statem/libssl-lib-statem_quic.o",
             "ssl/statem/libssl-lib-statem_srvr.o"
         ],
         "providers/common/der/libcommon-lib-der_digests_gen.o" => [
@@ -25596,9 +25574,6 @@ our %unified_info = (
         "ssl/libssl-lib-ssl_mcnf.o" => [
             "ssl/ssl_mcnf.c"
         ],
-        "ssl/libssl-lib-ssl_quic.o" => [
-            "ssl/ssl_quic.c"
-        ],
         "ssl/libssl-lib-ssl_rsa.o" => [
             "ssl/ssl_rsa.c"
         ],
@@ -25680,9 +25655,6 @@ our %unified_info = (
         "ssl/statem/libssl-lib-statem_lib.o" => [
             "ssl/statem/statem_lib.c"
         ],
-        "ssl/statem/libssl-lib-statem_quic.o" => [
-            "ssl/statem/statem_quic.c"
-        ],
         "ssl/statem/libssl-lib-statem_srvr.o" => [
             "ssl/statem/statem_srvr.c"
         ],
@@ -25813,6 +25785,12 @@ our %unified_info = (
         "test/bio_prefix_text-bin-bio_prefix_text.o" => [
             "test/bio_prefix_text.c"
         ],
+        "test/bio_pw_callback_test" => [
+            "test/bio_pw_callback_test-bin-bio_pw_callback_test.o"
+        ],
+        "test/bio_pw_callback_test-bin-bio_pw_callback_test.o" => [
+            "test/bio_pw_callback_test.c"
+        ],
         "test/bio_readbuffer_test" => [
             "test/bio_readbuffer_test-bin-bio_readbuffer_test.o"
         ],
@@ -26125,12 +26103,6 @@ our %unified_info = (
         "test/buildtest_c_provider-bin-buildtest_provider.o" => [
             "test/buildtest_provider.c"
         ],
-        "test/buildtest_c_quic" => [
-            "test/buildtest_c_quic-bin-buildtest_quic.o"
-        ],
-        "test/buildtest_c_quic-bin-buildtest_quic.o" => [
-            "test/buildtest_quic.c"
-        ],
         "test/buildtest_c_rand" => [
             "test/buildtest_c_rand-bin-buildtest_rand.o"
         ],
@@ -27586,7 +27558,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -27608,7 +27580,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/crypto/buildinf.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/crypto/buildinf.h
index f750c629cde..cb9544336c4 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/crypto/buildinf.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/crypto/buildinf.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -11,7 +11,7 @@
  */
 
 #define PLATFORM "platform: solaris64-x86_64-gcc"
-#define DATE "built on: Mon Sep 30 17:15:02 2024 UTC"
+#define DATE "built on: Wed Mar  5 21:08:18 2025 UTC"
 
 /*
  * Generate compiler_flags as an array of individual characters. This is a
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/opensslv.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/opensslv.h
index 819878c21bf..8e11963343e 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/opensslv.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/opensslv.h
@@ -29,7 +29,7 @@ extern "C" {
  */
 # define OPENSSL_VERSION_MAJOR  3
 # define OPENSSL_VERSION_MINOR  0
-# define OPENSSL_VERSION_PATCH  15
+# define OPENSSL_VERSION_PATCH  16
 
 /*
  * Additional version information
@@ -42,7 +42,7 @@ extern "C" {
 # define OPENSSL_VERSION_PRE_RELEASE ""
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+fips" */
 /* Could be: #define OPENSSL_VERSION_BUILD_METADATA "+vendor.1" */
-# define OPENSSL_VERSION_BUILD_METADATA "+quic"
+# define OPENSSL_VERSION_BUILD_METADATA ""
 
 /*
  * Note: The OpenSSL Project will never define OPENSSL_VERSION_BUILD_METADATA
@@ -57,7 +57,7 @@ extern "C" {
  * be related to the API version expressed with the macros above.
  * This is defined in free form.
  */
-# define OPENSSL_SHLIB_VERSION 81.3
+# define OPENSSL_SHLIB_VERSION 3
 
 /*
  * SECTION 2: USEFUL MACROS
@@ -74,21 +74,21 @@ extern "C" {
  * longer variant with OPENSSL_VERSION_PRE_RELEASE_STR and
  * OPENSSL_VERSION_BUILD_METADATA_STR appended.
  */
-# define OPENSSL_VERSION_STR "3.0.15"
-# define OPENSSL_FULL_VERSION_STR "3.0.15+quic"
+# define OPENSSL_VERSION_STR "3.0.16"
+# define OPENSSL_FULL_VERSION_STR "3.0.16"
 
 /*
  * SECTION 3: ADDITIONAL METADATA
  *
  * These strings are defined separately to allow them to be parsable.
  */
-# define OPENSSL_RELEASE_DATE "3 Sep 2024"
+# define OPENSSL_RELEASE_DATE "11 Feb 2025"
 
 /*
  * SECTION 4: BACKWARD COMPATIBILITY
  */
 
-# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.15+quic 3 Sep 2024"
+# define OPENSSL_VERSION_TEXT "OpenSSL 3.0.16 11 Feb 2025"
 
 /* Synthesize OPENSSL_VERSION_NUMBER with the layout 0xMNN00PPSL */
 # ifdef OPENSSL_VERSION_PRE_RELEASE
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/ssl.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/ssl.h
index 0f1915755ae..3df725c56d6 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/ssl.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/openssl/ssl.h
@@ -2593,75 +2593,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/progs.h b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/progs.h
index f1d15624839..be55f61503d 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/progs.h
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/include/progs.h
@@ -2,7 +2,7 @@
  * WARNING: do not edit!
  * Generated by apps/progs.pl
  *
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/openssl.gypi b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/openssl.gypi
index 18879acfa19..44ff54ede30 100644
--- a/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/openssl.gypi
+++ b/deps/openssl/config/archs/solaris64-x86_64-gcc/no-asm/openssl.gypi
@@ -19,7 +19,6 @@
       'openssl/ssl/ssl_init.c',
       'openssl/ssl/ssl_lib.c',
       'openssl/ssl/ssl_mcnf.c',
-      'openssl/ssl/ssl_quic.c',
       'openssl/ssl/ssl_rsa.c',
       'openssl/ssl/ssl_rsa_legacy.c',
       'openssl/ssl/ssl_sess.c',
@@ -46,7 +45,6 @@
       'openssl/ssl/statem/statem_clnt.c',
       'openssl/ssl/statem/statem_dtls.c',
       'openssl/ssl/statem/statem_lib.c',
-      'openssl/ssl/statem/statem_quic.c',
       'openssl/ssl/statem/statem_srvr.c',
       'openssl/crypto/aes/aes_cbc.c',
       'openssl/crypto/aes/aes_cfb.c',
diff --git a/deps/openssl/openssl/CHANGES.md b/deps/openssl/openssl/CHANGES.md
index be359160542..5b0193bc395 100644
--- a/deps/openssl/openssl/CHANGES.md
+++ b/deps/openssl/openssl/CHANGES.md
@@ -28,11 +28,36 @@ breaking changes, and mappings for the large list of deprecated functions.
 
 [Migration guide]: https://github.com/openssl/openssl/tree/master/doc/man7/migration_guide.pod
 
-### Changes between 3.0.15 and 3.0.15+quic [3 Sep 2024]
+### Changes between 3.0.15 and 3.0.16 [11 Feb 2025]
 
-* Add QUIC API support from BoringSSL
+ * Fixed timing side-channel in ECDSA signature computation.
 
-   *Todd Short*
+   There is a timing signal of around 300 nanoseconds when the top word of
+   the inverted ECDSA nonce value is zero. This can happen with significant
+   probability only for some of the supported elliptic curves. In particular
+   the NIST P-521 curve is affected. To be able to measure this leak, the
+   attacker process must either be located in the same physical computer or
+   must have a very fast network connection with low latency.
+
+   ([CVE-2024-13176])
+
+   *Tomáš Mráz*
+
+ * Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
+   curve parameters.
+
+   Use of the low-level GF(2^m) elliptic curve APIs with untrusted
+   explicit values for the field polynomial can lead to out-of-bounds memory
+   reads or writes.
+   Applications working with "exotic" explicit binary (GF(2^m)) curve
+   parameters, that make it possible to represent invalid field polynomials
+   with a zero constant term, via the above or similar APIs, may terminate
+   abruptly as a result of reading or writing outside of array bounds. Remote
+   code execution cannot easily be ruled out.
+
+   ([CVE-2024-9143])
+
+   *Viktor Dukhovni*
 
 ### Changes between 3.0.14 and 3.0.15 [3 Sep 2024]
 
@@ -19928,6 +19953,8 @@ ndif
 
 <!-- Links -->
 
+[CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
+[CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
 [CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
 [CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
 [CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
diff --git a/deps/openssl/openssl/Configurations/unix-Makefile.tmpl b/deps/openssl/openssl/Configurations/unix-Makefile.tmpl
index 644540397de..d2b0797a7ed 100644
--- a/deps/openssl/openssl/Configurations/unix-Makefile.tmpl
+++ b/deps/openssl/openssl/Configurations/unix-Makefile.tmpl
@@ -1688,7 +1688,7 @@ EOF
       } elsif ($makedep_scheme eq 'gcc' && !grep /\.rc$/, @srcs) {
           $recipe .= <<"EOF";
 $obj: $deps
-	$cmd $incs $defs $cmdflags -MMD -MF $dep.tmp -MT \$\@ -c -o \$\@ $srcs
+	$cmd $incs $defs $cmdflags -MMD -MF $dep.tmp -c -o \$\@ $srcs
 	\@touch $dep.tmp
 	\@if cmp $dep.tmp $dep > /dev/null 2> /dev/null; then \\
 		rm -f $dep.tmp; \\
diff --git a/deps/openssl/openssl/Configure b/deps/openssl/openssl/Configure
index 1aa660a46c4..0c60d1da165 100755
--- a/deps/openssl/openssl/Configure
+++ b/deps/openssl/openssl/Configure
@@ -467,7 +467,6 @@ my @disablables = (
     "poly1305",
     "posix-io",
     "psk",
-    "quic",
     "rc2",
     "rc4",
     "rc5",
@@ -578,7 +577,6 @@ my @disable_cascades = (
                              "sm3", "sm4", "srp",
                              "srtp", "ssl3-method", "ssl-trace",
                              "ts", "ui-console", "whirlpool",
-                             "quic",
                              "fips-securitychecks" ],
     sub { $config{processor} eq "386" }
                         => [ "sse2" ],
@@ -586,7 +584,7 @@ my @disable_cascades = (
     "ssl3-method"       => [ "ssl3" ],
     "zlib"              => [ "zlib-dynamic" ],
     "des"               => [ "mdc2" ],
-    "ec"                => [ "ec2m", "ecdsa", "ecdh", "sm2", "gost", "quic" ],
+    "ec"                => [ "ec2m", "ecdsa", "ecdh", "sm2", "gost" ],
     "dgram"             => [ "dtls", "sctp" ],
     "sock"              => [ "dgram" ],
     "dtls"              => [ @dtls ],
@@ -637,7 +635,6 @@ my @disable_cascades = (
     "legacy"            => [ "md2" ],
 
     "cmp"               => [ "crmf" ],
-    "tls1_3"            => [ "quic" ],
 
     "fips"              => [ "fips-securitychecks", "acvp-tests" ],
 
diff --git a/deps/openssl/openssl/INSTALL.md b/deps/openssl/openssl/INSTALL.md
index 107a9b56e4c..47d64b1a39d 100644
--- a/deps/openssl/openssl/INSTALL.md
+++ b/deps/openssl/openssl/INSTALL.md
@@ -829,10 +829,6 @@ Don't use POSIX IO capabilities.
 
 Don't build support for Pre-Shared Key based ciphersuites.
 
-### no-quic
-
-Don't build support for QUIC API from BoringSSL.
-
 ### no-rdrand
 
 Don't use hardware RDRAND capabilities.
diff --git a/deps/openssl/openssl/NEWS.md b/deps/openssl/openssl/NEWS.md
index e0a81703ee8..007fc9786ef 100644
--- a/deps/openssl/openssl/NEWS.md
+++ b/deps/openssl/openssl/NEWS.md
@@ -18,6 +18,20 @@ OpenSSL Releases
 OpenSSL 3.0
 -----------
 
+### Major changes between OpenSSL 3.0.15 and OpenSSL 3.0.16 [11 Feb 2025]
+
+OpenSSL 3.0.16 is a security patch release. The most severe CVE fixed in this
+release is Low.
+
+This release incorporates the following bug fixes and mitigations:
+
+  * Fixed timing side-channel in ECDSA signature computation.
+    ([CVE-2024-13176])
+
+  * Fixed possible OOB memory access with invalid low-level GF(2^m) elliptic
+    curve parameters.
+    ([CVE-2024-9143])
+
 ### Major changes between OpenSSL 3.0.14 and OpenSSL 3.0.15 [3 Sep 2024]
 
 OpenSSL 3.0.15 is a security patch release. The most severe CVE fixed in this
@@ -1495,6 +1509,8 @@ OpenSSL 0.9.x
 
 <!-- Links -->
 
+[CVE-2024-13176]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-13176
+[CVE-2024-9143]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-9143
 [CVE-2024-6119]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-6119
 [CVE-2024-5535]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-5535
 [CVE-2024-4741]: https://www.openssl.org/news/vulnerabilities.html#CVE-2024-4741
diff --git a/deps/openssl/openssl/NOTES-NONSTOP.md b/deps/openssl/openssl/NOTES-NONSTOP.md
index ab13de7d3a7..9441647604c 100644
--- a/deps/openssl/openssl/NOTES-NONSTOP.md
+++ b/deps/openssl/openssl/NOTES-NONSTOP.md
@@ -119,12 +119,9 @@ correctly, you also need the `COMP_ROOT` set, as in:
 
 `COMP_ROOT` needs to be in Windows form.
 
-`Configure` must specify the `no-makedepend` option otherwise errors will
-result when running the build because the c99 cross-compiler does not support
-the `gcc -MT` option. An example of a `Configure` command to be run from the
-OpenSSL directory is:
+An example of a `Configure` command to be run from the OpenSSL directory is:
 
-    ./Configure nonstop-nsx_64 no-makedepend --with-rand-seed=rdcpu
+    ./Configure nonstop-nsx_64 --with-rand-seed=rdcpu
 
 Do not forget to include any OpenSSL cross-compiling prefix and certificate
 options when creating your libraries.
diff --git a/deps/openssl/openssl/README-OpenSSL.md b/deps/openssl/openssl/README-OpenSSL.md
deleted file mode 100644
index 5184a461bb1..00000000000
--- a/deps/openssl/openssl/README-OpenSSL.md
+++ /dev/null
@@ -1,224 +0,0 @@
-Welcome to the OpenSSL Project
-==============================
-
-[![openssl logo]][www.openssl.org]
-
-[![github actions ci badge]][github actions ci]
-[![appveyor badge]][appveyor jobs]
-
-OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit
-for the Transport Layer Security (TLS) protocol formerly known as the
-Secure Sockets Layer (SSL) protocol. The protocol implementation is based
-on a full-strength general purpose cryptographic library, which can also
-be used stand-alone.
-
-OpenSSL is descended from the SSLeay library developed by Eric A. Young
-and Tim J. Hudson.
-
-The official Home Page of the OpenSSL Project is [www.openssl.org].
-
-Table of Contents
-=================
-
- - [Overview](#overview)
- - [Download](#download)
- - [Build and Install](#build-and-install)
- - [Documentation](#documentation)
- - [License](#license)
- - [Support](#support)
- - [Contributing](#contributing)
- - [Legalities](#legalities)
-
-Overview
-========
-
-The OpenSSL toolkit includes:
-
-- **libssl**
-  an implementation of all TLS protocol versions up to TLSv1.3 ([RFC 8446]).
-
-- **libcrypto**
-  a full-strength general purpose cryptographic library. It constitutes the
-  basis of the TLS implementation, but can also be used independently.
-
-- **openssl**
-  the OpenSSL command line tool, a swiss army knife for cryptographic tasks,
-  testing and analyzing. It can be used for
-  - creation of key parameters
-  - creation of X.509 certificates, CSRs and CRLs
-  - calculation of message digests
-  - encryption and decryption
-  - SSL/TLS client and server tests
-  - handling of S/MIME signed or encrypted mail
-  - and more...
-
-Download
-========
-
-For Production Use
-------------------
-
-Source code tarballs of the official releases can be downloaded from
-[www.openssl.org/source](https://www.openssl.org/source).
-The OpenSSL project does not distribute the toolkit in binary form.
-
-However, for a large variety of operating systems precompiled versions
-of the OpenSSL toolkit are available. In particular on Linux and other
-Unix operating systems it is normally recommended to link against the
-precompiled shared libraries provided by the distributor or vendor.
-
-For Testing and Development
----------------------------
-
-Although testing and development could in theory also be done using
-the source tarballs, having a local copy of the git repository with
-the entire project history gives you much more insight into the
-code base.
-
-The official OpenSSL Git Repository is located at [git.openssl.org].
-There is a GitHub mirror of the repository at [github.com/openssl/openssl],
-which is updated automatically from the former on every commit.
-
-A local copy of the Git Repository can be obtained by cloning it from
-the original OpenSSL repository using
-
-    git clone git://git.openssl.org/openssl.git
-
-or from the GitHub mirror using
-
-    git clone https://github.com/openssl/openssl.git
-
-If you intend to contribute to OpenSSL, either to fix bugs or contribute
-new features, you need to fork the OpenSSL repository openssl/openssl on
-GitHub and clone your public fork instead.
-
-    git clone https://github.com/yourname/openssl.git
-
-This is necessary, because all development of OpenSSL nowadays is done via
-GitHub pull requests. For more details, see [Contributing](#contributing).
-
-Build and Install
-=================
-
-After obtaining the Source, have a look at the [INSTALL](INSTALL.md) file for
-detailed instructions about building and installing OpenSSL. For some
-platforms, the installation instructions are amended by a platform specific
-document.
-
- * [Notes for UNIX-like platforms](NOTES-UNIX.md)
- * [Notes for Android platforms](NOTES-ANDROID.md)
- * [Notes for Windows platforms](NOTES-WINDOWS.md)
- * [Notes for the DOS platform with DJGPP](NOTES-DJGPP.md)
- * [Notes for the OpenVMS platform](NOTES-VMS.md)
- * [Notes on Perl](NOTES-PERL.md)
- * [Notes on Valgrind](NOTES-VALGRIND.md)
-
-Specific notes on upgrading to OpenSSL 3.0 from previous versions can be found
-in the [migration_guide(7ossl)] manual page.
-
-Documentation
-=============
-
-Manual Pages
-------------
-
-The manual pages for the master branch and all current stable releases are
-available online.
-
-- [OpenSSL master](https://www.openssl.org/docs/manmaster)
-- [OpenSSL 3.0](https://www.openssl.org/docs/man3.0)
-- [OpenSSL 1.1.1](https://www.openssl.org/docs/man1.1.1)
-
-Wiki
-----
-
-There is a Wiki at [wiki.openssl.org] which is currently not very active.
-It contains a lot of useful information, not all of which is up to date.
-
-License
-=======
-
-OpenSSL is licensed under the Apache License 2.0, which means that
-you are free to get and use it for commercial and non-commercial
-purposes as long as you fulfill its conditions.
-
-See the [LICENSE.txt](LICENSE.txt) file for more details.
-
-Support
-=======
-
-There are various ways to get in touch. The correct channel depends on
-your requirement. see the [SUPPORT](SUPPORT.md) file for more details.
-
-Contributing
-============
-
-If you are interested and willing to contribute to the OpenSSL project,
-please take a look at the [CONTRIBUTING](CONTRIBUTING.md) file.
-
-Legalities
-==========
-
-A number of nations restrict the use or export of cryptography. If you are
-potentially subject to such restrictions you should seek legal advice before
-attempting to develop or distribute cryptographic code.
-
-Copyright
-=========
-
-Copyright (c) 1998-2024 The OpenSSL Project
-
-Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
-
-All rights reserved.
-
-<!-- Links  -->
-
-[www.openssl.org]:
-    <https://www.openssl.org>
-    "OpenSSL Homepage"
-
-[git.openssl.org]:
-    <https://git.openssl.org>
-    "OpenSSL Git Repository"
-
-[git.openssl.org]:
-    <https://git.openssl.org>
-    "OpenSSL Git Repository"
-
-[github.com/openssl/openssl]:
-    <https://github.com/openssl/openssl>
-    "OpenSSL GitHub Mirror"
-
-[wiki.openssl.org]:
-    <https://wiki.openssl.org>
-    "OpenSSL Wiki"
-
-[migration_guide(7ossl)]:
-    <https://www.openssl.org/docs/man3.0/man7/migration_guide.html>
-    "OpenSSL Migration Guide"
-
-[RFC 8446]:
-     <https://tools.ietf.org/html/rfc8446>
-
-<!-- Logos and Badges -->
-
-[openssl logo]:
-    doc/images/openssl.svg
-    "OpenSSL Logo"
-
-[github actions ci badge]:
-    <https://github.com/openssl/openssl/workflows/GitHub%20CI/badge.svg>
-    "GitHub Actions CI Status"
-
-[github actions ci]:
-    <https://github.com/openssl/openssl/actions?query=workflow%3A%22GitHub+CI%22>
-    "GitHub Actions CI"
-
-[appveyor badge]:
-    <https://ci.appveyor.com/api/projects/status/8e10o7xfrg73v98f/branch/master?svg=true>
-    "AppVeyor Build Status"
-
-[appveyor jobs]:
-    <https://ci.appveyor.com/project/openssl/openssl/branch/master>
-    "AppVeyor Jobs"
diff --git a/deps/openssl/openssl/README.md b/deps/openssl/openssl/README.md
index 702cc3979a1..477f5cbb7d1 100644
--- a/deps/openssl/openssl/README.md
+++ b/deps/openssl/openssl/README.md
@@ -1,113 +1,212 @@
-What This Is
-============
+Welcome to the OpenSSL Project
+==============================
 
-This is a fork of [OpenSSL](https://www.openssl.org) to enable QUIC. In addition
-to the website, the official source distribution is at
-<https://github.com/openssl/openssl>. The OpenSSL `README` can be found at
-[README-OpenSSL.md](https://github.com/quictls/openssl/blob/openssl-3.0.15%2Bquic/README-OpenSSL.md)
+[![openssl logo]][www.openssl.org]
 
-This fork adds APIs that can be used by QUIC implementations for connection
-handshakes. Quoting the IETF Working group
-[charter](https://datatracker.ietf.org/wg/quic/about/), QUIC is a "UDP-based,
-stream-multiplexing, encrypted transport protocol." If you don't need QUIC, you
-should use the official OpenSSL distributions.
+[![github actions ci badge]][github actions ci]
+[![appveyor badge]][appveyor jobs]
 
-The APIs here are used by Microsoft's
-[MsQuic](https://github.com/microsoft/msquic) and Google's
-[Chromium QUIC](https://chromium.googlesource.com/chromium/src/+/master/net/quic/)
+OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit
+for the Transport Layer Security (TLS) protocol formerly known as the
+Secure Sockets Layer (SSL) protocol. The protocol implementation is based
+on a full-strength general purpose cryptographic library, which can also
+be used stand-alone.
 
-We are not in competition with OpenSSL project. We informed them of
-our plans to fork the code before we went public. We do not speak for the
-OpenSSL project, and can only point to a
-[blog post](https://www.openssl.org/blog/blog/2020/02/17/QUIC-and-OpenSSL/) and
-[openssl-project email](https://github.com/quictls/openssl/discussions/54)
-that provides their view of QUIC support.
+OpenSSL is descended from the SSLeay library developed by Eric A. Young
+and Tim J. Hudson.
 
-As stated in their blog post, the OpenSSL team is focused on their 3.0 release
-(released 2021-09-07), and does not intend to add QUIC functionality to 1.1.x.
-There is a community need for a QUIC-capable TLS library. This fork is intended
-as stopgap solution to enable higher level frameworks and runtimes to use QUIC
-with the proven and reliable TLS functionality from OpenSSL. This fork will be
-maintained until OpenSSL officially provides reasonable support for QUIC
-implementations.
+The official Home Page of the OpenSSL Project is [www.openssl.org].
 
-This fork can be considered a supported version of
-[OpenSSL PR 8797](https://github.com/openssl/openssl/pull/8797).
-We will endeavor to track OpenSSL releases within a day or so, and there is an
-item below about how we'll follow their tagging.
+Table of Contents
+=================
 
-On to the questions and answers.
+ - [Overview](#overview)
+ - [Download](#download)
+ - [Build and Install](#build-and-install)
+ - [Documentation](#documentation)
+ - [License](#license)
+ - [Support](#support)
+ - [Contributing](#contributing)
+ - [Legalities](#legalities)
 
-What about branches?
---------------------
+Overview
+========
 
-We don't want to conflict with OpenSSL branch names. Our current plan is to append
-`+quic`. Release tags are likely to be the QUIC branch with `-releaseX` appended.
-For example, the OpenSSL tag `openssl-3.0.0` would have a branch named
-`openssl-3.0.0+quic` and a release tag of `openssl-3.0.0+quic-release1`.
+The OpenSSL toolkit includes:
 
-How are you keeping current with OpenSSL?
------------------------------------------
+- **libssl**
+  an implementation of all TLS protocol versions up to TLSv1.3 ([RFC 8446]).
 
-(In other words, "What about rebasing?")
+- **libcrypto**
+  a full-strength general purpose cryptographic library. It constitutes the
+  basis of the TLS implementation, but can also be used independently.
 
-Our plan is to always rebase on top of an upstream release tag. In particular:
+- **openssl**
+  the OpenSSL command line tool, a swiss army knife for cryptographic tasks,
+  testing and analyzing. It can be used for
+  - creation of key parameters
+  - creation of X.509 certificates, CSRs and CRLs
+  - calculation of message digests
+  - encryption and decryption
+  - SSL/TLS client and server tests
+  - handling of S/MIME signed or encrypted mail
+  - and more...
 
-- The changes for QUIC will always be at the tip of the branch -- you will know what
-  is from the original OpenSSL and what is for QUIC.
-- New versions are quickly created once upstream creates a new tag.
-- The use of git commands (such as `cherry`) can be used to ensure that all changes
-  have moved forward with minimal or no changes. You will be able to see
-  "QUIC: Add X" on all branches and the commit itself will be nearly identical on
-  all branches, and any changes to that can be easily identified.
+Download
+========
 
-What about library names?
--------------------------
+For Production Use
+------------------
 
-Library names will be the same, but will use a different version number. The version
-numbers for the current OpenSSL libraries are `1.1` (for the 1.1.0 and 1.1.1 branches)
-and `3` (for the 3.0 branch). We will be prefixing `81` (ASCII for 'Q') to
-the version numbers to generate a unique version number.
+Source code tarballs of the official releases can be downloaded from
+[openssl-library.org/source/](https://openssl-library.org/source/).
+The OpenSSL project does not distribute the toolkit in binary form.
 
-- `libcrypto.so.81.3` vs `libcrypto.so.3`
-- `libcrypto.so.81.1.1` vs `libcrypto.so.1.1`
-- `libssl.so.81.3` vs `libssl.so.3`
-- `libssl.so.81.1.1` vs `libssl.so.1.1`
+However, for a large variety of operating systems precompiled versions
+of the OpenSSL toolkit are available. In particular on Linux and other
+Unix operating systems it is normally recommended to link against the
+precompiled shared libraries provided by the distributor or vendor.
 
-The SONAME of these libraries are all different, guaranteeing the correct library
-will be used.
+For Testing and Development
+---------------------------
 
-...and the executable?
-----------------------
+Although testing and development could in theory also be done using
+the source tarballs, having a local copy of the git repository with
+the entire project history gives you much more insight into the
+code base.
 
-We currently do not have any plans to change the name, mainly because we
-haven't made any changes there. If you see a need, please open an issue.
+The main OpenSSL Git repository is private.
+There is a public GitHub mirror of it at [github.com/openssl/openssl],
+which is updated automatically from the former on every commit.
 
-The `openssl version` command will report that it is `+quic` enabled.
+A local copy of the Git repository can be obtained by cloning it from
+the GitHub mirror using
 
-...and FIPS?
-------------
+    git clone https://github.com/openssl/openssl.git
+
+If you intend to contribute to OpenSSL, either to fix bugs or contribute
+new features, you need to fork the GitHub mirror and clone your public fork
+instead.
+
+    git clone https://github.com/yourname/openssl.git
+
+This is necessary, because all development of OpenSSL nowadays is done via
+GitHub pull requests. For more details, see [Contributing](#contributing).
+
+Build and Install
+=================
+
+After obtaining the Source, have a look at the [INSTALL](INSTALL.md) file for
+detailed instructions about building and installing OpenSSL. For some
+platforms, the installation instructions are amended by a platform specific
+document.
+
+ * [Notes for UNIX-like platforms](NOTES-UNIX.md)
+ * [Notes for Android platforms](NOTES-ANDROID.md)
+ * [Notes for Windows platforms](NOTES-WINDOWS.md)
+ * [Notes for the DOS platform with DJGPP](NOTES-DJGPP.md)
+ * [Notes for the OpenVMS platform](NOTES-VMS.md)
+ * [Notes on Perl](NOTES-PERL.md)
+ * [Notes on Valgrind](NOTES-VALGRIND.md)
+
+Specific notes on upgrading to OpenSSL 3.0 from previous versions can be found
+in the [migration_guide(7ossl)] manual page.
+
+Documentation
+=============
 
-We are not doing anything with FIPS. This is actually good news: you should
-be able to load the OpenSSL 3.0 FIPS module into an application built against
-this fork and everything should Just Work&#8482;.
-
-How can I contribute?
----------------------
-
-We want any code here to be acceptable to OpenSSL. This means that all contributors
-must have signed the appropriate
-[contributor license agreements](https://www.openssl.org/policies/cla.html). We
-will not ask for copies of any paperwork, you just need to tell us that you've
-done so (and we might verify with OpenSSL). We are only interested in making it
-easier and better for at least the mentioned QUIC implementations to use a variant
-of OpenSSL. If you have a pull request that changes the TLS protocol, or adds
-assembly support for a new CPU, or otherwise is not specific to enabling QUIC,
-please contribute that to OpenSSL. This fork is intended to be a clean extension
-to OpenSSL, with the deltas being specific to QUIC.
-
-Who are you?
+Manual Pages
 ------------
 
-This is a collaborative effort between [Akamai](https://www.akamai.com) and
-[Microsoft](https://www.microsoft.com). We welcome anyone to contribute!
+The manual pages for the master branch and all current stable releases are
+available online.
+
+- [OpenSSL master](https://www.openssl.org/docs/manmaster)
+- [OpenSSL 3.0](https://www.openssl.org/docs/man3.0)
+- [OpenSSL 1.1.1](https://www.openssl.org/docs/man1.1.1)
+
+Wiki
+----
+
+There is a Wiki at [wiki.openssl.org] which is currently not very active.
+It contains a lot of useful information, not all of which is up to date.
+
+License
+=======
+
+OpenSSL is licensed under the Apache License 2.0, which means that
+you are free to get and use it for commercial and non-commercial
+purposes as long as you fulfill its conditions.
+
+See the [LICENSE.txt](LICENSE.txt) file for more details.
+
+Support
+=======
+
+There are various ways to get in touch. The correct channel depends on
+your requirement. see the [SUPPORT](SUPPORT.md) file for more details.
+
+Contributing
+============
+
+If you are interested and willing to contribute to the OpenSSL project,
+please take a look at the [CONTRIBUTING](CONTRIBUTING.md) file.
+
+Legalities
+==========
+
+A number of nations restrict the use or export of cryptography. If you are
+potentially subject to such restrictions you should seek legal advice before
+attempting to develop or distribute cryptographic code.
+
+Copyright
+=========
+
+Copyright (c) 1998-2025 The OpenSSL Project
+
+Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson
+
+All rights reserved.
+
+<!-- Links  -->
+
+[www.openssl.org]:
+    <https://www.openssl.org>
+    "OpenSSL Homepage"
+
+[github.com/openssl/openssl]:
+    <https://github.com/openssl/openssl>
+    "OpenSSL GitHub Mirror"
+
+[wiki.openssl.org]:
+    <https://wiki.openssl.org>
+    "OpenSSL Wiki"
+
+[migration_guide(7ossl)]:
+    <https://www.openssl.org/docs/man3.0/man7/migration_guide.html>
+    "OpenSSL Migration Guide"
+
+[RFC 8446]:
+     <https://tools.ietf.org/html/rfc8446>
+
+<!-- Logos and Badges -->
+
+[openssl logo]:
+    doc/images/openssl.svg
+    "OpenSSL Logo"
+
+[github actions ci badge]:
+    <https://github.com/openssl/openssl/workflows/GitHub%20CI/badge.svg>
+    "GitHub Actions CI Status"
+
+[github actions ci]:
+    <https://github.com/openssl/openssl/actions?query=workflow%3A%22GitHub+CI%22>
+    "GitHub Actions CI"
+
+[appveyor badge]:
+    <https://ci.appveyor.com/api/projects/status/8e10o7xfrg73v98f/branch/master?svg=true>
+    "AppVeyor Build Status"
+
+[appveyor jobs]:
+    <https://ci.appveyor.com/project/openssl/openssl/branch/master>
+    "AppVeyor Jobs"
diff --git a/deps/openssl/openssl/VERSION.dat b/deps/openssl/openssl/VERSION.dat
index 9f3b18e8899..4b7eb91a451 100644
--- a/deps/openssl/openssl/VERSION.dat
+++ b/deps/openssl/openssl/VERSION.dat
@@ -1,7 +1,7 @@
 MAJOR=3
 MINOR=0
-PATCH=15
+PATCH=16
 PRE_RELEASE_TAG=
-BUILD_METADATA=quic
-RELEASE_DATE="3 Sep 2024"
-SHLIB_VERSION=81.3
+BUILD_METADATA=
+RELEASE_DATE="11 Feb 2025"
+SHLIB_VERSION=3
diff --git a/deps/openssl/openssl/apps/asn1parse.c b/deps/openssl/openssl/apps/asn1parse.c
index f0bfd1d45fc..129b867c8cc 100644
--- a/deps/openssl/openssl/apps/asn1parse.c
+++ b/deps/openssl/openssl/apps/asn1parse.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -127,7 +127,8 @@ int asn1parse_main(int argc, char **argv)
             dump = strtol(opt_arg(), NULL, 0);
             break;
         case OPT_STRPARSE:
-            sk_OPENSSL_STRING_push(osk, opt_arg());
+            if (sk_OPENSSL_STRING_push(osk, opt_arg()) <= 0)
+                goto end;
             break;
         case OPT_GENSTR:
             genstr = opt_arg();
diff --git a/deps/openssl/openssl/apps/cms.c b/deps/openssl/openssl/apps/cms.c
index abb9f196a76..dce227ef2db 100644
--- a/deps/openssl/openssl/apps/cms.c
+++ b/deps/openssl/openssl/apps/cms.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2008-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2008-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -494,13 +494,15 @@ int cms_main(int argc, char **argv)
             if (rr_from == NULL
                 && (rr_from = sk_OPENSSL_STRING_new_null()) == NULL)
                 goto end;
-            sk_OPENSSL_STRING_push(rr_from, opt_arg());
+            if (sk_OPENSSL_STRING_push(rr_from, opt_arg()) <= 0)
+                goto end;
             break;
         case OPT_RR_TO:
             if (rr_to == NULL
                 && (rr_to = sk_OPENSSL_STRING_new_null()) == NULL)
                 goto end;
-            sk_OPENSSL_STRING_push(rr_to, opt_arg());
+            if (sk_OPENSSL_STRING_push(rr_to, opt_arg()) <= 0)
+                goto end;
             break;
         case OPT_PRINT:
             noout = print = 1;
@@ -577,13 +579,15 @@ int cms_main(int argc, char **argv)
                 if (sksigners == NULL
                     && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
                     goto end;
-                sk_OPENSSL_STRING_push(sksigners, signerfile);
+                if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
+                    goto end;
                 if (keyfile == NULL)
                     keyfile = signerfile;
                 if (skkeys == NULL
                     && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
                     goto end;
-                sk_OPENSSL_STRING_push(skkeys, keyfile);
+                if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
+                    goto end;
                 keyfile = NULL;
             }
             signerfile = opt_arg();
@@ -601,12 +605,14 @@ int cms_main(int argc, char **argv)
                 if (sksigners == NULL
                     && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
                     goto end;
-                sk_OPENSSL_STRING_push(sksigners, signerfile);
+                if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
+                    goto end;
                 signerfile = NULL;
                 if (skkeys == NULL
                     && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
                     goto end;
-                sk_OPENSSL_STRING_push(skkeys, keyfile);
+                if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
+                    goto end;
             }
             keyfile = opt_arg();
             break;
@@ -660,7 +666,8 @@ int cms_main(int argc, char **argv)
                     key_param->next = nparam;
                 key_param = nparam;
             }
-            sk_OPENSSL_STRING_push(key_param->param, opt_arg());
+            if (sk_OPENSSL_STRING_push(key_param->param, opt_arg()) <= 0)
+                goto end;
             break;
         case OPT_V_CASES:
             if (!opt_verify(o, vpm))
@@ -749,12 +756,14 @@ int cms_main(int argc, char **argv)
             if (sksigners == NULL
                 && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
                 goto end;
-            sk_OPENSSL_STRING_push(sksigners, signerfile);
+            if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
+                goto end;
             if (skkeys == NULL && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
                 goto end;
             if (keyfile == NULL)
                 keyfile = signerfile;
-            sk_OPENSSL_STRING_push(skkeys, keyfile);
+            if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
+                goto end;
         }
         if (sksigners == NULL) {
             BIO_printf(bio_err, "No signer certificate specified\n");
@@ -1014,8 +1023,15 @@ int cms_main(int argc, char **argv)
             pwri_tmp = NULL;
         }
         if (!(flags & CMS_STREAM)) {
-            if (!CMS_final(cms, in, NULL, flags))
+            if (!CMS_final(cms, in, NULL, flags)) {
+                if (originator != NULL
+                    && ERR_GET_REASON(ERR_peek_error())
+                    == CMS_R_ERROR_UNSUPPORTED_STATIC_KEY_AGREEMENT) {
+                    BIO_printf(bio_err, "Cannot use originator for encryption\n");
+                    goto end;
+                }
                 goto end;
+            }
         }
     } else if (operation == SMIME_ENCRYPTED_ENCRYPT) {
         cms = CMS_EncryptedData_encrypt_ex(in, cipher, secret_key,
@@ -1261,6 +1277,7 @@ int cms_main(int argc, char **argv)
     X509_free(cert);
     X509_free(recip);
     X509_free(signer);
+    X509_free(originator);
     EVP_PKEY_free(key);
     EVP_CIPHER_free(cipher);
     EVP_CIPHER_free(wrap_cipher);
diff --git a/deps/openssl/openssl/apps/engine.c b/deps/openssl/openssl/apps/engine.c
index 1b0f64309c6..c83bdfc150c 100644
--- a/deps/openssl/openssl/apps/engine.c
+++ b/deps/openssl/openssl/apps/engine.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2000-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -352,10 +352,12 @@ int engine_main(int argc, char **argv)
             test_avail++;
             break;
         case OPT_PRE:
-            sk_OPENSSL_STRING_push(pre_cmds, opt_arg());
+            if (sk_OPENSSL_STRING_push(pre_cmds, opt_arg()) <= 0)
+                goto end;
             break;
         case OPT_POST:
-            sk_OPENSSL_STRING_push(post_cmds, opt_arg());
+            if (sk_OPENSSL_STRING_push(post_cmds, opt_arg()) <= 0)
+                goto end;
             break;
         }
     }
diff --git a/deps/openssl/openssl/apps/info.c b/deps/openssl/openssl/apps/info.c
index 66f3ef2587e..c68603652f2 100644
--- a/deps/openssl/openssl/apps/info.c
+++ b/deps/openssl/openssl/apps/info.c
@@ -10,15 +10,11 @@
 #include <openssl/crypto.h>
 #include "apps.h"
 #include "progs.h"
-#include <openssl/quic.h>
 
 typedef enum OPTION_choice {
     OPT_COMMON,
     OPT_CONFIGDIR, OPT_ENGINESDIR, OPT_MODULESDIR, OPT_DSOEXT, OPT_DIRNAMESEP,
     OPT_LISTSEP, OPT_SEEDS, OPT_CPUSETTINGS
-#ifndef OPENSSL_NO_QUIC
-    , OPT_QUIC
-#endif
 } OPTION_CHOICE;
 
 const OPTIONS info_options[] = {
@@ -36,9 +32,6 @@ const OPTIONS info_options[] = {
     {"listsep", OPT_LISTSEP, '-', "List separator character"},
     {"seeds", OPT_SEEDS, '-', "Seed sources"},
     {"cpusettings", OPT_CPUSETTINGS, '-', "CPU settings info"},
-#ifndef OPENSSL_NO_QUIC
-    {"quic", OPT_QUIC, '-', "QUIC info"},
-#endif
     {NULL}
 };
 
@@ -91,12 +84,6 @@ int info_main(int argc, char **argv)
             type = OPENSSL_INFO_CPU_SETTINGS;
             dirty++;
             break;
-#ifndef OPENSSL_NO_QUIC
-        case OPT_QUIC:
-            type = OPENSSL_INFO_QUIC;
-            dirty++;
-            break;
-#endif
         }
     }
     if (opt_num_rest() != 0)
diff --git a/deps/openssl/openssl/apps/lib/http_server.c b/deps/openssl/openssl/apps/lib/http_server.c
index a7fe5e1a58b..33ae886d4a1 100644
--- a/deps/openssl/openssl/apps/lib/http_server.c
+++ b/deps/openssl/openssl/apps/lib/http_server.c
@@ -220,14 +220,17 @@ BIO *http_server_init_bio(const char *prog, const char *port)
 {
     BIO *acbio = NULL, *bufbio;
     int asock;
+    char name[40];
 
+    snprintf(name, sizeof(name), "[::]:%s", port); /* port may be "0" */
     bufbio = BIO_new(BIO_f_buffer());
     if (bufbio == NULL)
         goto err;
     acbio = BIO_new(BIO_s_accept());
     if (acbio == NULL
-        || BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) < 0
-        || BIO_set_accept_port(acbio, port) < 0) {
+        || BIO_set_accept_ip_family(acbio, BIO_FAMILY_IPANY) <= 0 /* IPv4/6 */
+        || BIO_set_bind_mode(acbio, BIO_BIND_REUSEADDR) <= 0
+        || BIO_set_accept_name(acbio, name) <= 0) {
         log_message(prog, LOG_ERR, "Error setting up accept BIO");
         goto err;
     }
diff --git a/deps/openssl/openssl/apps/lib/s_cb.c b/deps/openssl/openssl/apps/lib/s_cb.c
index 6440b496099..9f33c24c4e3 100644
--- a/deps/openssl/openssl/apps/lib/s_cb.c
+++ b/deps/openssl/openssl/apps/lib/s_cb.c
@@ -240,10 +240,10 @@ static const char *get_sigtype(int nid)
         return "ECDSA";
 
     case NID_ED25519:
-        return "Ed25519";
+        return "ed25519";
 
     case NID_ED448:
-        return "Ed448";
+        return "ed448";
 
     case NID_id_GostR3410_2001:
         return "gost2001";
@@ -288,6 +288,26 @@ static int do_print_sigalgs(BIO *out, SSL *s, int shared)
             SSL_get_sigalgs(s, i, &sign_nid, &hash_nid, NULL, &rsign, &rhash);
         if (i)
             BIO_puts(out, ":");
+        switch (rsign | rhash << 8) {
+        case 0x0809:
+            BIO_puts(out, "rsa_pss_pss_sha256");
+            continue;
+        case 0x080a:
+            BIO_puts(out, "rsa_pss_pss_sha384");
+            continue;
+        case 0x080b:
+            BIO_puts(out, "rsa_pss_pss_sha512");
+            continue;
+        case 0x081a:
+            BIO_puts(out, "ecdsa_brainpoolP256r1_sha256");
+            continue;
+        case 0x081b:
+            BIO_puts(out, "ecdsa_brainpoolP384r1_sha384");
+            continue;
+        case 0x081c:
+            BIO_puts(out, "ecdsa_brainpoolP512r1_sha512");
+            continue;
+        }
         sstr = get_sigtype(sign_nid);
         if (sstr)
             BIO_printf(out, "%s", sstr);
diff --git a/deps/openssl/openssl/apps/lib/s_socket.c b/deps/openssl/openssl/apps/lib/s_socket.c
index 059afe47b90..8c6020d0169 100644
--- a/deps/openssl/openssl/apps/lib/s_socket.c
+++ b/deps/openssl/openssl/apps/lib/s_socket.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2022 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -380,6 +380,12 @@ int do_server(int *accept_sock, const char *host, const char *port,
                 BIO_closesocket(asock);
                 break;
             }
+
+            if (naccept != -1)
+                naccept--;
+            if (naccept == 0)
+                BIO_closesocket(asock);
+
             BIO_set_tcp_ndelay(sock, 1);
             i = (*cb)(sock, type, protocol, context);
 
@@ -410,11 +416,12 @@ int do_server(int *accept_sock, const char *host, const char *port,
 
             BIO_closesocket(sock);
         } else {
+            if (naccept != -1)
+                naccept--;
+
             i = (*cb)(asock, type, protocol, context);
         }
 
-        if (naccept != -1)
-            naccept--;
         if (i < 0 || naccept == 0) {
             BIO_closesocket(asock);
             ret = i;
diff --git a/deps/openssl/openssl/apps/lib/vms_term_sock.c b/deps/openssl/openssl/apps/lib/vms_term_sock.c
index 97fb3943265..1a413376b20 100644
--- a/deps/openssl/openssl/apps/lib/vms_term_sock.c
+++ b/deps/openssl/openssl/apps/lib/vms_term_sock.c
@@ -353,7 +353,7 @@ static int CreateSocketPair (int SocketFamily,
     /*
     ** Get the binary (64-bit) time of the specified timeout value
     */
-    sprintf (AscTimeBuff, "0 0:0:%02d.00", SOCKET_PAIR_TIMEOUT_VALUE);
+    BIO_snprintf(AscTimeBuff, sizeof(AscTimeBuff), "0 0:0:%02d.00", SOCKET_PAIR_TIMEOUT_VALUE);
     AscTimeDesc.dsc$w_length = strlen (AscTimeBuff);
     AscTimeDesc.dsc$a_pointer = AscTimeBuff;
     status = sys$bintim (&AscTimeDesc, BinTimeBuff);
@@ -567,10 +567,10 @@ static void LogMessage (char *msg, ...)
     /*
     ** Format the message buffer
     */
-    sprintf (MsgBuff, "%02d-%s-%04d %02d:%02d:%02d [%08X] %s\n",
-             LocTime->tm_mday, Month[LocTime->tm_mon],
-             (LocTime->tm_year + 1900), LocTime->tm_hour, LocTime->tm_min,
-             LocTime->tm_sec, pid, msg);
+    BIO_snprintf(MsgBuff, sizeof(MsgBuff), "%02d-%s-%04d %02d:%02d:%02d [%08X] %s\n",
+                 LocTime->tm_mday, Month[LocTime->tm_mon],
+                 (LocTime->tm_year + 1900), LocTime->tm_hour, LocTime->tm_min,
+                 LocTime->tm_sec, pid, msg);
 
     /*
     ** Get any variable arguments and add them to the print of the message
diff --git a/deps/openssl/openssl/apps/passwd.c b/deps/openssl/openssl/apps/passwd.c
index 64b2e76c147..31d8bdd87cb 100644
--- a/deps/openssl/openssl/apps/passwd.c
+++ b/deps/openssl/openssl/apps/passwd.c
@@ -589,7 +589,8 @@ static char *shacrypt(const char *passwd, const char *magic, const char *salt)
     OPENSSL_strlcat(out_buf, ascii_dollar, sizeof(out_buf));
     if (rounds_custom) {
         char tmp_buf[80]; /* "rounds=999999999" */
-        sprintf(tmp_buf, "rounds=%u", rounds);
+
+        BIO_snprintf(tmp_buf, sizeof(tmp_buf), "rounds=%u", rounds);
 #ifdef CHARSET_EBCDIC
         /* In case we're really on a ASCII based platform and just pretend */
         if (tmp_buf[0] != 0x72)  /* ASCII 'r' */
diff --git a/deps/openssl/openssl/apps/pkcs12.c b/deps/openssl/openssl/apps/pkcs12.c
index ab78903ee9c..5146699f167 100644
--- a/deps/openssl/openssl/apps/pkcs12.c
+++ b/deps/openssl/openssl/apps/pkcs12.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -305,7 +305,8 @@ int pkcs12_main(int argc, char **argv)
             if (canames == NULL
                 && (canames = sk_OPENSSL_STRING_new_null()) == NULL)
                 goto end;
-            sk_OPENSSL_STRING_push(canames, opt_arg());
+            if (sk_OPENSSL_STRING_push(canames, opt_arg()) <= 0)
+                goto end;
             break;
         case OPT_IN:
             infile = opt_arg();
diff --git a/deps/openssl/openssl/apps/pkeyutl.c b/deps/openssl/openssl/apps/pkeyutl.c
index 3c9f9025a16..5e504713763 100644
--- a/deps/openssl/openssl/apps/pkeyutl.c
+++ b/deps/openssl/openssl/apps/pkeyutl.c
@@ -81,10 +81,11 @@ const OPTIONS pkeyutl_options[] = {
 
     OPT_SECTION("Output"),
     {"out", OPT_OUT, '>', "Output file - default stdout"},
-    {"asn1parse", OPT_ASN1PARSE, '-', "asn1parse the output data"},
+    {"asn1parse", OPT_ASN1PARSE, '-',
+     "parse the output as ASN.1 data to check its DER encoding and print errors"},
     {"hexdump", OPT_HEXDUMP, '-', "Hex dump output"},
     {"verifyrecover", OPT_VERIFYRECOVER, '-',
-     "Verify with public key, recover original data"},
+     "Verify RSA signature, recovering original signature input data"},
 
     OPT_SECTION("Signing/Derivation"),
     {"digest", OPT_DIGEST, 's',
diff --git a/deps/openssl/openssl/apps/rehash.c b/deps/openssl/openssl/apps/rehash.c
index 85eee385794..6e0ca3642c4 100644
--- a/deps/openssl/openssl/apps/rehash.c
+++ b/deps/openssl/openssl/apps/rehash.c
@@ -559,6 +559,11 @@ int rehash_main(int argc, char **argv)
     } else if ((env = getenv(X509_get_default_cert_dir_env())) != NULL) {
         char lsc[2] = { LIST_SEPARATOR_CHAR, '\0' };
         m = OPENSSL_strdup(env);
+        if (m == NULL) {
+            BIO_puts(bio_err, "out of memory\n");
+            errs = 1;
+            goto end;
+        }
         for (e = strtok(m, lsc); e != NULL; e = strtok(NULL, lsc))
             errs += do_dir(e, h);
         OPENSSL_free(m);
diff --git a/deps/openssl/openssl/apps/smime.c b/deps/openssl/openssl/apps/smime.c
index 651294e46da..790a8d06ad0 100644
--- a/deps/openssl/openssl/apps/smime.c
+++ b/deps/openssl/openssl/apps/smime.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -279,13 +279,15 @@ int smime_main(int argc, char **argv)
                 if (sksigners == NULL
                     && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
                     goto end;
-                sk_OPENSSL_STRING_push(sksigners, signerfile);
+                if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
+                    goto end;
                 if (keyfile == NULL)
                     keyfile = signerfile;
                 if (skkeys == NULL
                     && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
                     goto end;
-                sk_OPENSSL_STRING_push(skkeys, keyfile);
+                if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
+                    goto end;
                 keyfile = NULL;
             }
             signerfile = opt_arg();
@@ -310,12 +312,14 @@ int smime_main(int argc, char **argv)
                 if (sksigners == NULL
                     && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
                     goto end;
-                sk_OPENSSL_STRING_push(sksigners, signerfile);
+                if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
+                    goto end;
                 signerfile = NULL;
                 if (skkeys == NULL
                     && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
                     goto end;
-                sk_OPENSSL_STRING_push(skkeys, keyfile);
+                if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
+                    goto end;
             }
             keyfile = opt_arg();
             break;
@@ -390,12 +394,14 @@ int smime_main(int argc, char **argv)
             if (sksigners == NULL
                 && (sksigners = sk_OPENSSL_STRING_new_null()) == NULL)
                 goto end;
-            sk_OPENSSL_STRING_push(sksigners, signerfile);
+            if (sk_OPENSSL_STRING_push(sksigners, signerfile) <= 0)
+                goto end;
             if (!skkeys && (skkeys = sk_OPENSSL_STRING_new_null()) == NULL)
                 goto end;
             if (!keyfile)
                 keyfile = signerfile;
-            sk_OPENSSL_STRING_push(skkeys, keyfile);
+            if (sk_OPENSSL_STRING_push(skkeys, keyfile) <= 0)
+                goto end;
         }
         if (sksigners == NULL) {
             BIO_printf(bio_err, "No signer certificate specified\n");
diff --git a/deps/openssl/openssl/apps/speed.c b/deps/openssl/openssl/apps/speed.c
index d8e2c70e612..bafcacf7775 100644
--- a/deps/openssl/openssl/apps/speed.c
+++ b/deps/openssl/openssl/apps/speed.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -456,6 +456,14 @@ static double sm2_results[SM2_NUM][2];    /* 2 ops: sign then verify */
 #define COND(unused_cond) (run && count < INT_MAX)
 #define COUNT(d) (count)
 
+#define TAG_LEN 16
+
+static unsigned int mode_op; /* AE Mode of operation */
+static unsigned int aead = 0; /* AEAD flag */
+static unsigned char aead_iv[12]; /* For AEAD modes */
+static unsigned char aad[EVP_AEAD_TLS1_AAD_LEN] = { 0xcc };
+static int aead_ivlen = sizeof(aead_iv);
+
 typedef struct loopargs_st {
     ASYNC_JOB *inprogress_job;
     ASYNC_WAIT_CTX *wait_ctx;
@@ -464,6 +472,7 @@ typedef struct loopargs_st {
     unsigned char *buf_malloc;
     unsigned char *buf2_malloc;
     unsigned char *key;
+    unsigned char tag[TAG_LEN];
     size_t buflen;
     size_t sigsize;
     EVP_PKEY_CTX *rsa_sign_ctx[RSA_NUM];
@@ -727,12 +736,8 @@ static int EVP_Update_loop(void *args)
     unsigned char *buf = tempargs->buf;
     EVP_CIPHER_CTX *ctx = tempargs->ctx;
     int outl, count, rc;
-    unsigned char faketag[16] = { 0xcc };
 
     if (decrypt) {
-        if (EVP_CIPHER_get_flags(EVP_CIPHER_CTX_get0_cipher(ctx)) & EVP_CIPH_FLAG_AEAD_CIPHER) {
-            (void)EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, sizeof(faketag), faketag);
-        }
         for (count = 0; COND(c[D_EVP][testnum]); count++) {
             rc = EVP_DecryptUpdate(ctx, buf, &outl, buf, lengths[testnum]);
             if (rc != 1) {
@@ -757,74 +762,159 @@ static int EVP_Update_loop(void *args)
 }
 
 /*
+ * To make AEAD benchmarking more relevant perform TLS-like operations,
+ * 13-byte AAD followed by payload. But don't use TLS-formatted AAD, as
+ * payload length is not actually limited by 16KB...
  * CCM does not support streaming. For the purpose of performance measurement,
  * each message is encrypted using the same (key,iv)-pair. Do not use this
  * code in your application.
  */
-static int EVP_Update_loop_ccm(void *args)
+static int EVP_Update_loop_aead_enc(void *args)
 {
     loopargs_t *tempargs = *(loopargs_t **) args;
     unsigned char *buf = tempargs->buf;
+    unsigned char *key = tempargs->key;
     EVP_CIPHER_CTX *ctx = tempargs->ctx;
-    int outl, count;
-    unsigned char tag[12];
-
-    if (decrypt) {
-        for (count = 0; COND(c[D_EVP][testnum]); count++) {
-            (void)EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG, sizeof(tag),
-                                      tag);
-            /* reset iv */
-            (void)EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, iv);
-            /* counter is reset on every update */
-            (void)EVP_DecryptUpdate(ctx, buf, &outl, buf, lengths[testnum]);
+    int outl, count, realcount = 0;
+
+    for (count = 0; COND(c[D_EVP][testnum]); count++) {
+        /* Set length of iv (Doesn't apply to SIV mode) */
+        if (mode_op != EVP_CIPH_SIV_MODE) {
+            if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
+                                     aead_ivlen, NULL)) {
+                BIO_printf(bio_err, "\nFailed to set iv length\n");
+                ERR_print_errors(bio_err);
+                exit(1);
+            }
         }
-    } else {
-        for (count = 0; COND(c[D_EVP][testnum]); count++) {
-            /* restore iv length field */
-            (void)EVP_EncryptUpdate(ctx, NULL, &outl, NULL, lengths[testnum]);
-            /* counter is reset on every update */
-            (void)EVP_EncryptUpdate(ctx, buf, &outl, buf, lengths[testnum]);
+        /* Set tag_len (Not for GCM/SIV at encryption stage) */
+        if (mode_op != EVP_CIPH_GCM_MODE
+            && mode_op != EVP_CIPH_SIV_MODE) {
+            if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
+                                     TAG_LEN, NULL)) {
+                BIO_printf(bio_err, "\nFailed to set tag length\n");
+                ERR_print_errors(bio_err);
+                exit(1);
+            }
+        }
+        if (!EVP_CipherInit_ex(ctx, NULL, NULL, key, aead_iv, -1)) {
+            BIO_printf(bio_err, "\nFailed to set key and iv\n");
+            ERR_print_errors(bio_err);
+            exit(1);
+        }
+        /* Set total length of input. Only required for CCM */
+        if (mode_op == EVP_CIPH_CCM_MODE) {
+            if (!EVP_EncryptUpdate(ctx, NULL, &outl,
+                                   NULL, lengths[testnum])) {
+                BIO_printf(bio_err, "\nCouldn't set input text length\n");
+                ERR_print_errors(bio_err);
+                exit(1);
+            }
         }
+        if (aead) {
+            if (!EVP_EncryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) {
+                BIO_printf(bio_err, "\nCouldn't insert AAD when encrypting\n");
+                ERR_print_errors(bio_err);
+                exit(1);
+            }
+        }
+        if (!EVP_EncryptUpdate(ctx, buf, &outl, buf, lengths[testnum])) {
+            BIO_printf(bio_err, "\nFailed to encrypt the data\n");
+            ERR_print_errors(bio_err);
+            exit(1);
+        }
+        if (EVP_EncryptFinal_ex(ctx, buf, &outl))
+            realcount++;
     }
-    if (decrypt)
-        (void)EVP_DecryptFinal_ex(ctx, buf, &outl);
-    else
-        (void)EVP_EncryptFinal_ex(ctx, buf, &outl);
-    return count;
+    return realcount;
 }
 
 /*
  * To make AEAD benchmarking more relevant perform TLS-like operations,
  * 13-byte AAD followed by payload. But don't use TLS-formatted AAD, as
  * payload length is not actually limited by 16KB...
+ * CCM does not support streaming. For the purpose of performance measurement,
+ * each message is decrypted using the same (key,iv)-pair. Do not use this
+ * code in your application.
+ * For decryption, we will use buf2 to preserve the input text in buf.
  */
-static int EVP_Update_loop_aead(void *args)
+static int EVP_Update_loop_aead_dec(void *args)
 {
     loopargs_t *tempargs = *(loopargs_t **) args;
     unsigned char *buf = tempargs->buf;
+    unsigned char *outbuf = tempargs->buf2;
+    unsigned char *key = tempargs->key;
+    unsigned char tag[TAG_LEN];
     EVP_CIPHER_CTX *ctx = tempargs->ctx;
-    int outl, count;
-    unsigned char aad[13] = { 0xcc };
-    unsigned char faketag[16] = { 0xcc };
+    int outl, count, realcount = 0;
+
+    for (count = 0; COND(c[D_EVP][testnum]); count++) {
+        /* Set the length of iv (Doesn't apply to SIV mode) */
+        if (mode_op != EVP_CIPH_SIV_MODE) {
+            if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_IVLEN,
+                                     aead_ivlen, NULL)) {
+                BIO_printf(bio_err, "\nFailed to set iv length\n");
+                ERR_print_errors(bio_err);
+                exit(1);
+            }
+        }
 
-    if (decrypt) {
-        for (count = 0; COND(c[D_EVP][testnum]); count++) {
-            (void)EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, iv);
-            (void)EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
-                                      sizeof(faketag), faketag);
-            (void)EVP_DecryptUpdate(ctx, NULL, &outl, aad, sizeof(aad));
-            (void)EVP_DecryptUpdate(ctx, buf, &outl, buf, lengths[testnum]);
-            (void)EVP_DecryptFinal_ex(ctx, buf + outl, &outl);
+        /* Set the tag length (Doesn't apply to SIV mode) */
+        if (mode_op != EVP_CIPH_SIV_MODE
+            && mode_op != EVP_CIPH_GCM_MODE) {
+            if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
+                                     TAG_LEN, NULL)) {
+                BIO_printf(bio_err, "\nFailed to set tag length\n");
+                ERR_print_errors(bio_err);
+                exit(1);
+            }
         }
-    } else {
-        for (count = 0; COND(c[D_EVP][testnum]); count++) {
-            (void)EVP_EncryptInit_ex(ctx, NULL, NULL, NULL, iv);
-            (void)EVP_EncryptUpdate(ctx, NULL, &outl, aad, sizeof(aad));
-            (void)EVP_EncryptUpdate(ctx, buf, &outl, buf, lengths[testnum]);
-            (void)EVP_EncryptFinal_ex(ctx, buf + outl, &outl);
+        if (!EVP_CipherInit_ex(ctx, NULL, NULL, key, aead_iv, -1)) {
+            BIO_printf(bio_err, "\nFailed to set key and iv\n");
+            ERR_print_errors(bio_err);
+            exit(1);
+        }
+        /* Set iv before decryption (Doesn't apply to SIV mode) */
+        if (mode_op != EVP_CIPH_SIV_MODE) {
+            if (!EVP_DecryptInit_ex(ctx, NULL, NULL, NULL, aead_iv)) {
+                BIO_printf(bio_err, "\nFailed to set iv\n");
+                ERR_print_errors(bio_err);
+                exit(1);
+            }
+        }
+        memcpy(tag, tempargs->tag, TAG_LEN);
+
+        if (!EVP_CIPHER_CTX_ctrl(ctx, EVP_CTRL_AEAD_SET_TAG,
+                                 TAG_LEN, tag)) {
+            BIO_printf(bio_err, "\nFailed to set tag\n");
+            ERR_print_errors(bio_err);
+            exit(1);
+        }
+        /* Set the total length of cipher text. Only required for CCM */
+        if (mode_op == EVP_CIPH_CCM_MODE) {
+            if (!EVP_DecryptUpdate(ctx, NULL, &outl,
+                                   NULL, lengths[testnum])) {
+                BIO_printf(bio_err, "\nCouldn't set cipher text length\n");
+                ERR_print_errors(bio_err);
+                exit(1);
+            }
+        }
+        if (aead) {
+            if (!EVP_DecryptUpdate(ctx, NULL, &outl, aad, sizeof(aad))) {
+                BIO_printf(bio_err, "\nCouldn't insert AAD when decrypting\n");
+                ERR_print_errors(bio_err);
+                exit(1);
+            }
+        }
+        if (!EVP_DecryptUpdate(ctx, outbuf, &outl, buf, lengths[testnum])) {
+            BIO_printf(bio_err, "\nFailed to decrypt the data\n");
+            ERR_print_errors(bio_err);
+            exit(1);
         }
+        if (EVP_DecryptFinal_ex(ctx, outbuf, &outl))
+            realcount++;
     }
-    return count;
+    return realcount;
 }
 
 static long rsa_c[RSA_NUM][2];  /* # RSA iteration test */
@@ -1370,11 +1460,11 @@ int speed_main(int argc, char **argv)
     OPTION_CHOICE o;
     int async_init = 0, multiblock = 0, pr_header = 0;
     uint8_t doit[ALGOR_NUM] = { 0 };
-    int ret = 1, misalign = 0, lengths_single = 0, aead = 0;
+    int ret = 1, misalign = 0, lengths_single = 0;
     long count = 0;
     unsigned int size_num = SIZE_NUM;
     unsigned int i, k, loopargs_len = 0, async_jobs = 0;
-    int keylen;
+    int keylen = 0;
     int buflen;
     BIGNUM *bn = NULL;
     EVP_PKEY_CTX *genctx = NULL;
@@ -2001,15 +2091,14 @@ int speed_main(int argc, char **argv)
     if (doit[D_HMAC]) {
         static const char hmac_key[] = "This is a key...";
         int len = strlen(hmac_key);
+        size_t hmac_name_len = sizeof("hmac()") + strlen(evp_mac_mdname);
         OSSL_PARAM params[3];
 
         mac = EVP_MAC_fetch(app_get0_libctx(), "HMAC", app_get0_propq());
         if (mac == NULL || evp_mac_mdname == NULL)
             goto end;
-
-        evp_hmac_name = app_malloc(sizeof("hmac()") + strlen(evp_mac_mdname),
-                                   "HMAC name");
-        sprintf(evp_hmac_name, "hmac(%s)", evp_mac_mdname);
+        evp_hmac_name = app_malloc(hmac_name_len, "HMAC name");
+        BIO_snprintf(evp_hmac_name, hmac_name_len, "hmac(%s)", evp_mac_mdname);
         names[D_HMAC] = evp_hmac_name;
 
         params[0] =
@@ -2213,12 +2302,20 @@ int speed_main(int argc, char **argv)
         }
     }
 
+    /*-
+     * There are three scenarios for D_EVP:
+     * 1- Using authenticated encryption (AE) e.g. CCM, GCM, OCB etc.
+     * 2- Using AE + associated data (AD) i.e. AEAD using CCM, GCM, OCB etc.
+     * 3- Not using AE or AD e.g. ECB, CBC, CFB etc.
+     */
     if (doit[D_EVP]) {
         if (evp_cipher != NULL) {
-            int (*loopfunc) (void *) = EVP_Update_loop;
+            int (*loopfunc) (void *);
+            int outlen = 0;
+            unsigned int ae_mode = 0;
 
-            if (multiblock && (EVP_CIPHER_get_flags(evp_cipher) &
-                               EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK)) {
+            if (multiblock && (EVP_CIPHER_get_flags(evp_cipher)
+                               & EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK)) {
                 multiblock_speed(evp_cipher, lengths_single, &seconds);
                 ret = 0;
                 goto end;
@@ -2226,16 +2323,26 @@ int speed_main(int argc, char **argv)
 
             names[D_EVP] = EVP_CIPHER_get0_name(evp_cipher);
 
-            if (EVP_CIPHER_get_mode(evp_cipher) == EVP_CIPH_CCM_MODE) {
-                loopfunc = EVP_Update_loop_ccm;
-            } else if (aead && (EVP_CIPHER_get_flags(evp_cipher) &
-                                EVP_CIPH_FLAG_AEAD_CIPHER)) {
-                loopfunc = EVP_Update_loop_aead;
+            mode_op = EVP_CIPHER_get_mode(evp_cipher);
+
+            if (aead) {
                 if (lengths == lengths_list) {
                     lengths = aead_lengths_list;
                     size_num = OSSL_NELEM(aead_lengths_list);
                 }
             }
+            if (mode_op == EVP_CIPH_GCM_MODE
+                || mode_op == EVP_CIPH_CCM_MODE
+                || mode_op == EVP_CIPH_OCB_MODE
+                || mode_op == EVP_CIPH_SIV_MODE) {
+                ae_mode = 1;
+                if (decrypt)
+                    loopfunc = EVP_Update_loop_aead_dec;
+                else
+                    loopfunc = EVP_Update_loop_aead_enc;
+            } else {
+                loopfunc = EVP_Update_loop;
+            }
 
             for (testnum = 0; testnum < size_num; testnum++) {
                 print_message(names[D_EVP], c[D_EVP][testnum], lengths[testnum],
@@ -2247,37 +2354,144 @@ int speed_main(int argc, char **argv)
                         BIO_printf(bio_err, "\nEVP_CIPHER_CTX_new failure\n");
                         exit(1);
                     }
-                    if (!EVP_CipherInit_ex(loopargs[k].ctx, evp_cipher, NULL,
-                                           NULL, iv, decrypt ? 0 : 1)) {
-                        BIO_printf(bio_err, "\nEVP_CipherInit_ex failure\n");
+
+                    /*
+                     * For AE modes, we must first encrypt the data to get
+                     * a valid tag that enables us to decrypt. If we don't
+                     * encrypt first, we won't have a valid tag that enables
+                     * authenticity and hence decryption will fail.
+                     */
+                    if (!EVP_CipherInit_ex(loopargs[k].ctx,
+                                           evp_cipher, NULL, NULL, NULL,
+                                           ae_mode ? 1 : !decrypt)) {
+                        BIO_printf(bio_err, "\nCouldn't init the context\n");
                         ERR_print_errors(bio_err);
                         exit(1);
                     }
 
+                    /* Padding isn't needed */
                     EVP_CIPHER_CTX_set_padding(loopargs[k].ctx, 0);
 
                     keylen = EVP_CIPHER_CTX_get_key_length(loopargs[k].ctx);
                     loopargs[k].key = app_malloc(keylen, "evp_cipher key");
                     EVP_CIPHER_CTX_rand_key(loopargs[k].ctx, loopargs[k].key);
-                    if (!EVP_CipherInit_ex(loopargs[k].ctx, NULL, NULL,
-                                           loopargs[k].key, NULL, -1)) {
-                        BIO_printf(bio_err, "\nEVP_CipherInit_ex failure\n");
-                        ERR_print_errors(bio_err);
-                        exit(1);
-                    }
-                    OPENSSL_clear_free(loopargs[k].key, keylen);
 
-                    /* SIV mode only allows for a single Update operation */
-                    if (EVP_CIPHER_get_mode(evp_cipher) == EVP_CIPH_SIV_MODE)
-                        (void)EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
-                                                  EVP_CTRL_SET_SPEED, 1, NULL);
+                    if (!ae_mode) {
+                        if (!EVP_CipherInit_ex(loopargs[k].ctx, NULL, NULL,
+                                               loopargs[k].key, iv, -1)) {
+                            BIO_printf(bio_err, "\nFailed to set the key\n");
+                            ERR_print_errors(bio_err);
+                            exit(1);
+                        }
+                    } else if (mode_op == EVP_CIPH_SIV_MODE) {
+                        EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
+                                            EVP_CTRL_SET_SPEED, 1, NULL);
+                    }
+                    if (ae_mode && decrypt) {
+                        /* Set length of iv (Doesn't apply to SIV mode) */
+                        if (mode_op != EVP_CIPH_SIV_MODE) {
+                            if (!EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
+                                                     EVP_CTRL_AEAD_SET_IVLEN,
+                                                     aead_ivlen, NULL)) {
+                                BIO_printf(bio_err, "\nFailed to set iv length\n");
+                                ERR_print_errors(bio_err);
+                                exit(1);
+                            }
+                        }
+                        /* Set tag_len (Not for SIV at encryption stage) */
+                        if (mode_op != EVP_CIPH_GCM_MODE
+                            && mode_op != EVP_CIPH_SIV_MODE) {
+                            if (!EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
+                                                     EVP_CTRL_AEAD_SET_TAG,
+                                                     TAG_LEN, NULL)) {
+                                BIO_printf(bio_err,
+                                           "\nFailed to set tag length\n");
+                                ERR_print_errors(bio_err);
+                                exit(1);
+                            }
+                        }
+                        if (!EVP_CipherInit_ex(loopargs[k].ctx, NULL, NULL,
+                                               loopargs[k].key, aead_iv, -1)) {
+                            BIO_printf(bio_err, "\nFailed to set the key\n");
+                            ERR_print_errors(bio_err);
+                            exit(1);
+                        }
+                        /* Set total length of input. Only required for CCM */
+                        if (mode_op == EVP_CIPH_CCM_MODE) {
+                            if (!EVP_EncryptUpdate(loopargs[k].ctx, NULL,
+                                                   &outlen, NULL,
+                                                   lengths[testnum])) {
+                                BIO_printf(bio_err,
+                                           "\nCouldn't set input text length\n");
+                                ERR_print_errors(bio_err);
+                                exit(1);
+                            }
+                        }
+                        if (aead) {
+                            if (!EVP_EncryptUpdate(loopargs[k].ctx, NULL,
+                                                   &outlen, aad, sizeof(aad))) {
+                                BIO_printf(bio_err,
+                                           "\nCouldn't insert AAD when encrypting\n");
+                                ERR_print_errors(bio_err);
+                                exit(1);
+                            }
+                        }
+                        if (!EVP_EncryptUpdate(loopargs[k].ctx, loopargs[k].buf,
+                                               &outlen, loopargs[k].buf,
+                                               lengths[testnum])) {
+                            BIO_printf(bio_err,
+                                       "\nFailed to to encrypt the data\n");
+                            ERR_print_errors(bio_err);
+                            exit(1);
+                        }
+
+                        if (!EVP_EncryptFinal_ex(loopargs[k].ctx,
+                                                 loopargs[k].buf, &outlen)) {
+                            BIO_printf(bio_err,
+                                       "\nFailed finalize the encryption\n");
+                            ERR_print_errors(bio_err);
+                            exit(1);
+                        }
+
+                        if (!EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
+                                                 EVP_CTRL_AEAD_GET_TAG,
+                                                 TAG_LEN, &loopargs[k].tag)) {
+                            BIO_printf(bio_err, "\nFailed to get the tag\n");
+                            ERR_print_errors(bio_err);
+                            exit(1);
+                        }
+
+                        EVP_CIPHER_CTX_free(loopargs[k].ctx);
+                        loopargs[k].ctx = EVP_CIPHER_CTX_new();
+                        if (loopargs[k].ctx == NULL) {
+                            BIO_printf(bio_err,
+                                       "\nEVP_CIPHER_CTX_new failure\n");
+                            exit(1);
+                        }
+                        if (!EVP_CipherInit_ex(loopargs[k].ctx, evp_cipher,
+                                               NULL, NULL, NULL, 0)) {
+                            BIO_printf(bio_err,
+                                       "\nFailed initializing the context\n");
+                            ERR_print_errors(bio_err);
+                            exit(1);
+                        }
+
+                        EVP_CIPHER_CTX_set_padding(loopargs[k].ctx, 0);
+
+                        /* SIV only allows for one Update operation */
+                        if (mode_op == EVP_CIPH_SIV_MODE)
+                            EVP_CIPHER_CTX_ctrl(loopargs[k].ctx,
+                                                EVP_CTRL_SET_SPEED, 1, NULL);
+                    }
                 }
 
                 Time_F(START);
                 count = run_benchmark(async_jobs, loopfunc, loopargs);
                 d = Time_F(STOP);
-                for (k = 0; k < loopargs_len; k++)
+                for (k = 0; k < loopargs_len; k++) {
+                    OPENSSL_clear_free(loopargs[k].key, keylen);
                     EVP_CIPHER_CTX_free(loopargs[k].ctx);
+                }
                 print_result(D_EVP, testnum, count, d);
             }
         } else if (evp_md_name != NULL) {
@@ -2297,6 +2511,7 @@ int speed_main(int argc, char **argv)
     }
 
     if (doit[D_EVP_CMAC]) {
+        size_t len = sizeof("cmac()") + strlen(evp_mac_ciphername);
         OSSL_PARAM params[3];
         EVP_CIPHER *cipher = NULL;
 
@@ -2312,9 +2527,8 @@ int speed_main(int argc, char **argv)
             BIO_printf(bio_err, "\nRequested CMAC cipher with unsupported key length.\n");
             goto end;
         }
-        evp_cmac_name = app_malloc(sizeof("cmac()")
-                                   + strlen(evp_mac_ciphername), "CMAC name");
-        sprintf(evp_cmac_name, "cmac(%s)", evp_mac_ciphername);
+        evp_cmac_name = app_malloc(len, "CMAC name");
+        BIO_snprintf(evp_cmac_name, len, "cmac(%s)", evp_mac_ciphername);
         names[D_EVP_CMAC] = evp_cmac_name;
 
         params[0] = OSSL_PARAM_construct_utf8_string(OSSL_ALG_PARAM_CIPHER,
@@ -3675,7 +3889,6 @@ static void multiblock_speed(const EVP_CIPHER *evp_cipher, int lengths_single,
         print_message(alg_name, 0, mblengths[j], seconds->sym);
         Time_F(START);
         for (count = 0; run && count < INT_MAX; count++) {
-            unsigned char aad[EVP_AEAD_TLS1_AAD_LEN];
             EVP_CTRL_TLS1_1_MULTIBLOCK_PARAM mb_param;
             size_t len = mblengths[j];
             int packlen;
diff --git a/deps/openssl/openssl/configdata.pm.in b/deps/openssl/openssl/configdata.pm.in
index 04b901144f4..a4ae9072999 100644
--- a/deps/openssl/openssl/configdata.pm.in
+++ b/deps/openssl/openssl/configdata.pm.in
@@ -145,7 +145,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close BUILDFILE;
         rename("$buildfile.new", $buildfile)
             or die "Trying to rename $buildfile.new to $buildfile: $!";
@@ -167,7 +167,7 @@ _____
                        # defined in one template stick around for the
                        # next, making them combinable
                        PACKAGE => 'OpenSSL::safe')
-            or die $Text::Template::ERROR;
+            or die $OpenSSL::Template::ERROR;
         close CONFIGURATION_H;
 
         # When using stat() on Windows, we can get it to perform better by
diff --git a/deps/openssl/openssl/crypto/asn1/a_bitstr.c b/deps/openssl/openssl/crypto/asn1/a_bitstr.c
index 4930d5022ee..549c0e88554 100644
--- a/deps/openssl/openssl/crypto/asn1/a_bitstr.c
+++ b/deps/openssl/openssl/crypto/asn1/a_bitstr.c
@@ -36,25 +36,30 @@ int ossl_i2c_ASN1_BIT_STRING(ASN1_BIT_STRING *a, unsigned char **pp)
                 if (a->data[len - 1])
                     break;
             }
-            j = a->data[len - 1];
-            if (j & 0x01)
+
+            if (len == 0) {
                 bits = 0;
-            else if (j & 0x02)
-                bits = 1;
-            else if (j & 0x04)
-                bits = 2;
-            else if (j & 0x08)
-                bits = 3;
-            else if (j & 0x10)
-                bits = 4;
-            else if (j & 0x20)
-                bits = 5;
-            else if (j & 0x40)
-                bits = 6;
-            else if (j & 0x80)
-                bits = 7;
-            else
-                bits = 0;       /* should not happen */
+            } else {
+                j = a->data[len - 1];
+                if (j & 0x01)
+                    bits = 0;
+                else if (j & 0x02)
+                    bits = 1;
+                else if (j & 0x04)
+                    bits = 2;
+                else if (j & 0x08)
+                    bits = 3;
+                else if (j & 0x10)
+                    bits = 4;
+                else if (j & 0x20)
+                    bits = 5;
+                else if (j & 0x40)
+                    bits = 6;
+                else if (j & 0x80)
+                    bits = 7;
+                else
+                    bits = 0;       /* should not happen */
+            }
         }
     } else
         bits = 0;
diff --git a/deps/openssl/openssl/crypto/asn1/a_strnid.c b/deps/openssl/openssl/crypto/asn1/a_strnid.c
index d052935661d..20cfabc8a7a 100644
--- a/deps/openssl/openssl/crypto/asn1/a_strnid.c
+++ b/deps/openssl/openssl/crypto/asn1/a_strnid.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1999-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -39,10 +39,10 @@ unsigned long ASN1_STRING_get_default_mask(void)
  * This function sets the default to various "flavours" of configuration.
  * based on an ASCII string. Currently this is:
  * MASK:XXXX : a numerical mask value.
- * nobmp : Don't use BMPStrings (just Printable, T61).
- * pkix : PKIX recommendation in RFC2459.
- * utf8only : only use UTF8Strings (RFC2459 recommendation for 2004).
- * default:   the default value, Printable, T61, BMP.
+ * default   : use Printable, IA5, T61, BMP, and UTF8 string types
+ * nombstr   : any string type except variable-sized BMPStrings or UTF8Strings
+ * pkix      : PKIX recommendation in RFC2459
+ * utf8only  : this is the default, use UTF8Strings
  */
 
 int ASN1_STRING_set_default_mask_asc(const char *p)
diff --git a/deps/openssl/openssl/crypto/asn1/a_time.c b/deps/openssl/openssl/crypto/asn1/a_time.c
index 9b3074e47e8..5ef6d0d1cd1 100644
--- a/deps/openssl/openssl/crypto/asn1/a_time.c
+++ b/deps/openssl/openssl/crypto/asn1/a_time.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1999-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -488,9 +488,9 @@ int ASN1_TIME_print_ex(BIO *bp, const ASN1_TIME *tm, unsigned long flags)
 int ossl_asn1_time_print_ex(BIO *bp, const ASN1_TIME *tm, unsigned long flags)
 {
     char *v;
-    int gmt = 0, l;
+    int l;
     struct tm stm;
-    const char upper_z = 0x5A, period = 0x2E;
+    const char period = 0x2E;
 
     /* ossl_asn1_time_to_tm will check the time type */
     if (!ossl_asn1_time_to_tm(&stm, tm))
@@ -498,8 +498,6 @@ int ossl_asn1_time_print_ex(BIO *bp, const ASN1_TIME *tm, unsigned long flags)
 
     l = tm->length;
     v = (char *)tm->data;
-    if (v[l - 1] == upper_z)
-        gmt = 1;
 
     if (tm->type == V_ASN1_GENERALIZEDTIME) {
         char *f = NULL;
@@ -510,39 +508,36 @@ int ossl_asn1_time_print_ex(BIO *bp, const ASN1_TIME *tm, unsigned long flags)
          * 'fraction point' in a GeneralizedTime string.
          */
         if (tm->length > 15 && v[14] == period) {
-            f = &v[14];
-            f_len = 1;
-            while (14 + f_len < l && ossl_ascii_isdigit(f[f_len]))
+            /* exclude the . itself */
+            f = &v[15];
+            f_len = 0;
+            while (15 + f_len < l && ossl_ascii_isdigit(f[f_len]))
                 ++f_len;
         }
 
-        if ((flags & ASN1_DTFLGS_TYPE_MASK) == ASN1_DTFLGS_ISO8601) {
-            return BIO_printf(bp, "%4d-%02d-%02d %02d:%02d:%02d%.*s%s",
-                          stm.tm_year + 1900, stm.tm_mon + 1,
-                          stm.tm_mday, stm.tm_hour,
-                          stm.tm_min, stm.tm_sec, f_len, f,
-                          (gmt ? "Z" : "")) > 0;
-        }
-        else {
-            return BIO_printf(bp, "%s %2d %02d:%02d:%02d%.*s %d%s",
-                          _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,
-                          stm.tm_min, stm.tm_sec, f_len, f, stm.tm_year + 1900,
-                          (gmt ? " GMT" : "")) > 0;
+        if (f_len > 0) {
+            if ((flags & ASN1_DTFLGS_TYPE_MASK) == ASN1_DTFLGS_ISO8601) {
+                return BIO_printf(bp, "%4d-%02d-%02d %02d:%02d:%02d.%.*sZ",
+                                  stm.tm_year + 1900, stm.tm_mon + 1,
+                                  stm.tm_mday, stm.tm_hour,
+                                  stm.tm_min, stm.tm_sec, f_len, f) > 0;
+            } else {
+                return BIO_printf(bp, "%s %2d %02d:%02d:%02d.%.*s %d GMT",
+                                  _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,
+                                  stm.tm_min, stm.tm_sec, f_len, f,
+                                  stm.tm_year + 1900) > 0;
+            }
         }
-    } else {
-        if ((flags & ASN1_DTFLGS_TYPE_MASK) == ASN1_DTFLGS_ISO8601) {
-            return BIO_printf(bp, "%4d-%02d-%02d %02d:%02d:%02d%s",
+    }
+    if ((flags & ASN1_DTFLGS_TYPE_MASK) == ASN1_DTFLGS_ISO8601) {
+        return BIO_printf(bp, "%4d-%02d-%02d %02d:%02d:%02dZ",
                           stm.tm_year + 1900, stm.tm_mon + 1,
                           stm.tm_mday, stm.tm_hour,
-                          stm.tm_min, stm.tm_sec,
-                          (gmt ? "Z" : "")) > 0;
-        }
-        else {
-            return BIO_printf(bp, "%s %2d %02d:%02d:%02d %d%s",
+                          stm.tm_min, stm.tm_sec) > 0;
+    } else {
+        return BIO_printf(bp, "%s %2d %02d:%02d:%02d %d GMT",
                           _asn1_mon[stm.tm_mon], stm.tm_mday, stm.tm_hour,
-                          stm.tm_min, stm.tm_sec, stm.tm_year + 1900,
-                          (gmt ? " GMT" : "")) > 0;
-        }
+                          stm.tm_min, stm.tm_sec, stm.tm_year + 1900) > 0;
     }
 }
 
diff --git a/deps/openssl/openssl/crypto/asn1/asn1_gen.c b/deps/openssl/openssl/crypto/asn1/asn1_gen.c
index 402ab34e6a4..152dc870a55 100644
--- a/deps/openssl/openssl/crypto/asn1/asn1_gen.c
+++ b/deps/openssl/openssl/crypto/asn1/asn1_gen.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2002-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -498,7 +498,8 @@ static int append_exp(tag_exp_arg *arg, int exp_tag, int exp_class,
 static int asn1_str2tag(const char *tagstr, int len)
 {
     unsigned int i;
-    static const struct tag_name_st *tntmp, tnst[] = {
+    const struct tag_name_st *tntmp;
+    static const struct tag_name_st tnst[] = {
         ASN1_GEN_STR("BOOL", V_ASN1_BOOLEAN),
         ASN1_GEN_STR("BOOLEAN", V_ASN1_BOOLEAN),
         ASN1_GEN_STR("NULL", V_ASN1_NULL),
diff --git a/deps/openssl/openssl/crypto/asn1/asn_mime.c b/deps/openssl/openssl/crypto/asn1/asn_mime.c
index 9fc52d04762..8bb7089292d 100644
--- a/deps/openssl/openssl/crypto/asn1/asn_mime.c
+++ b/deps/openssl/openssl/crypto/asn1/asn_mime.c
@@ -300,6 +300,8 @@ int SMIME_write_ASN1_ex(BIO *bio, ASN1_VALUE *val, BIO *data, int flags,
 
     if (ctype_nid == NID_pkcs7_enveloped) {
         msg_type = "enveloped-data";
+    } else if (ctype_nid == NID_id_smime_ct_authEnvelopedData) {
+        msg_type = "authEnveloped-data";
     } else if (ctype_nid == NID_pkcs7_signed) {
         if (econt_nid == NID_id_smime_ct_receipt)
             msg_type = "signed-receipt";
diff --git a/deps/openssl/openssl/crypto/bio/bio_addr.c b/deps/openssl/openssl/crypto/bio/bio_addr.c
index 04d62f45b19..d462f424d3a 100644
--- a/deps/openssl/openssl/crypto/bio/bio_addr.c
+++ b/deps/openssl/openssl/crypto/bio/bio_addr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -547,8 +547,13 @@ int BIO_parse_hostserv(const char *hostserv, char **host, char **service,
             *service = NULL;
         } else {
             *service = OPENSSL_strndup(p, pl);
-            if (*service == NULL)
+            if (*service == NULL) {
+                if (h != NULL && host != NULL) {
+                    OPENSSL_free(*host);
+                    *host = NULL;
+                }
                 goto memerr;
+            }
         }
     }
 
diff --git a/deps/openssl/openssl/crypto/bio/bio_sock.c b/deps/openssl/openssl/crypto/bio/bio_sock.c
index 12e6a68e3a2..84496de6f6b 100644
--- a/deps/openssl/openssl/crypto/bio/bio_sock.c
+++ b/deps/openssl/openssl/crypto/bio/bio_sock.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -222,7 +222,7 @@ int BIO_get_accept_socket(char *host, int bind_mode)
         return INVALID_SOCKET;
 
     if (BIO_sock_init() != 1)
-        return INVALID_SOCKET;
+        goto err;
 
     if (BIO_lookup(h, p, BIO_LOOKUP_SERVER, AF_UNSPEC, SOCK_STREAM, &res) != 0)
         goto err;
diff --git a/deps/openssl/openssl/crypto/bio/bss_log.c b/deps/openssl/openssl/crypto/bio/bss_log.c
index 82abfd5cec6..63b30e300fe 100644
--- a/deps/openssl/openssl/crypto/bio/bss_log.c
+++ b/deps/openssl/openssl/crypto/bio/bss_log.c
@@ -281,7 +281,7 @@ static void xsyslog(BIO *bp, int priority, const char *string)
         break;
     }
 
-    sprintf(pidbuf, "[%lu] ", GetCurrentProcessId());
+    BIO_snprintf(pidbuf, sizeof(pidbuf), "[%lu] ", GetCurrentProcessId());
     lpszStrings[0] = pidbuf;
     lpszStrings[1] = string;
 
diff --git a/deps/openssl/openssl/crypto/bn/asm/armv8-mont.pl b/deps/openssl/openssl/crypto/bn/asm/armv8-mont.pl
index 54d2e8245f1..3192eab3092 100755
--- a/deps/openssl/openssl/crypto/bn/asm/armv8-mont.pl
+++ b/deps/openssl/openssl/crypto/bn/asm/armv8-mont.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2015-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -84,10 +84,12 @@
 	cmp	$num,#32
 	b.le	.Lscalar_impl
 #ifndef	__KERNEL__
+#ifndef	__AARCH64EB__
 	adrp	x17,OPENSSL_armv8_rsa_neonized
 	ldr	w17,[x17,#:lo12:OPENSSL_armv8_rsa_neonized]
 	cbnz	w17, bn_mul8x_mont_neon
 #endif
+#endif
 
 .Lscalar_impl:
 	tst	$num,#7
diff --git a/deps/openssl/openssl/crypto/bn/bn_exp.c b/deps/openssl/openssl/crypto/bn/bn_exp.c
index 598a592ca13..0e563ad823c 100644
--- a/deps/openssl/openssl/crypto/bn/bn_exp.c
+++ b/deps/openssl/openssl/crypto/bn/bn_exp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -606,7 +606,7 @@ static int MOD_EXP_CTIME_COPY_FROM_PREBUF(BIGNUM *b, int top,
  * out by Colin Percival,
  * http://www.daemonology.net/hyperthreading-considered-harmful/)
  */
-int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
+int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
                               const BIGNUM *m, BN_CTX *ctx,
                               BN_MONT_CTX *in_mont)
 {
@@ -623,10 +623,6 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
     unsigned int t4 = 0;
 #endif
 
-    bn_check_top(a);
-    bn_check_top(p);
-    bn_check_top(m);
-
     if (!BN_is_odd(m)) {
         ERR_raise(ERR_LIB_BN, BN_R_CALLED_WITH_EVEN_MODULUS);
         return 0;
@@ -1146,7 +1142,7 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
             goto err;
     } else
 #endif
-    if (!BN_from_montgomery(rr, &tmp, mont, ctx))
+    if (!bn_from_mont_fixed_top(rr, &tmp, mont, ctx))
         goto err;
     ret = 1;
  err:
@@ -1160,6 +1156,19 @@ int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
     return ret;
 }
 
+int BN_mod_exp_mont_consttime(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
+                              const BIGNUM *m, BN_CTX *ctx,
+                              BN_MONT_CTX *in_mont)
+{
+    bn_check_top(a);
+    bn_check_top(p);
+    bn_check_top(m);
+    if (!bn_mod_exp_mont_fixed_top(rr, a, p, m, ctx, in_mont))
+        return 0;
+    bn_correct_top(rr);
+    return 1;
+}
+
 int BN_mod_exp_mont_word(BIGNUM *rr, BN_ULONG a, const BIGNUM *p,
                          const BIGNUM *m, BN_CTX *ctx, BN_MONT_CTX *in_mont)
 {
diff --git a/deps/openssl/openssl/crypto/bn/bn_gf2m.c b/deps/openssl/openssl/crypto/bn/bn_gf2m.c
index c811ae82d6b..bcc66613cc1 100644
--- a/deps/openssl/openssl/crypto/bn/bn_gf2m.c
+++ b/deps/openssl/openssl/crypto/bn/bn_gf2m.c
@@ -15,6 +15,7 @@
 #include "bn_local.h"
 
 #ifndef OPENSSL_NO_EC2M
+# include <openssl/ec.h>
 
 /*
  * Maximum number of iterations before BN_GF2m_mod_solve_quad_arr should
@@ -1140,16 +1141,26 @@ int BN_GF2m_mod_solve_quad(BIGNUM *r, const BIGNUM *a, const BIGNUM *p,
 /*
  * Convert the bit-string representation of a polynomial ( \sum_{i=0}^n a_i *
  * x^i) into an array of integers corresponding to the bits with non-zero
- * coefficient.  Array is terminated with -1. Up to max elements of the array
- * will be filled.  Return value is total number of array elements that would
- * be filled if array was large enough.
+ * coefficient.  The array is intended to be suitable for use with
+ * `BN_GF2m_mod_arr()`, and so the constant term of the polynomial must not be
+ * zero.  This translates to a requirement that the input BIGNUM `a` is odd.
+ *
+ * Given sufficient room, the array is terminated with -1.  Up to max elements
+ * of the array will be filled.
+ *
+ * The return value is total number of array elements that would be filled if
+ * array was large enough, including the terminating `-1`.  It is `0` when `a`
+ * is not odd or the constant term is zero contrary to requirement.
+ *
+ * The return value is also `0` when the leading exponent exceeds
+ * `OPENSSL_ECC_MAX_FIELD_BITS`, this guards against CPU exhaustion attacks,
  */
 int BN_GF2m_poly2arr(const BIGNUM *a, int p[], int max)
 {
     int i, j, k = 0;
     BN_ULONG mask;
 
-    if (BN_is_zero(a))
+    if (!BN_is_odd(a))
         return 0;
 
     for (i = a->top - 1; i >= 0; i--) {
@@ -1167,12 +1178,13 @@ int BN_GF2m_poly2arr(const BIGNUM *a, int p[], int max)
         }
     }
 
-    if (k < max) {
+    if (k > 0 && p[0] > OPENSSL_ECC_MAX_FIELD_BITS)
+        return 0;
+
+    if (k < max)
         p[k] = -1;
-        k++;
-    }
 
-    return k;
+    return k + 1;
 }
 
 /*
diff --git a/deps/openssl/openssl/crypto/bn/rsaz_exp_x2.c b/deps/openssl/openssl/crypto/bn/rsaz_exp_x2.c
index b19050dfee8..4a2a6752f67 100644
--- a/deps/openssl/openssl/crypto/bn/rsaz_exp_x2.c
+++ b/deps/openssl/openssl/crypto/bn/rsaz_exp_x2.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2020, Intel Corporation. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -495,11 +495,7 @@ static void to_words52(BN_ULONG *out, int out_len,
         out_len--;
     }
 
-    while (out_len > 0) {
-        *out = 0;
-        out_len--;
-        out++;
-    }
+    memset(out, 0, out_len * sizeof(BN_ULONG));
 }
 
 static ossl_inline void put_digit52(uint8_t *pStr, int strLen, uint64_t digit)
diff --git a/deps/openssl/openssl/crypto/cmp/cmp_client.c b/deps/openssl/openssl/crypto/cmp/cmp_client.c
index df334cc0019..4c8dbfdcd73 100644
--- a/deps/openssl/openssl/crypto/cmp/cmp_client.c
+++ b/deps/openssl/openssl/crypto/cmp/cmp_client.c
@@ -107,9 +107,12 @@ static int save_statusInfo(OSSL_CMP_CTX *ctx, OSSL_CMP_PKISI *si)
     ss = si->statusString; /* may be NULL */
     for (i = 0; i < sk_ASN1_UTF8STRING_num(ss); i++) {
         ASN1_UTF8STRING *str = sk_ASN1_UTF8STRING_value(ss, i);
+        ASN1_UTF8STRING *dup = ASN1_STRING_dup(str);
 
-        if (!sk_ASN1_UTF8STRING_push(ctx->statusString, ASN1_STRING_dup(str)))
+        if (dup == NULL || !sk_ASN1_UTF8STRING_push(ctx->statusString, dup)) {
+            ASN1_UTF8STRING_free(dup);
             return 0;
+        }
     }
     return 1;
 }
diff --git a/deps/openssl/openssl/crypto/cms/cms_asn1.c b/deps/openssl/openssl/crypto/cms/cms_asn1.c
index 72cd14317d4..95095201592 100644
--- a/deps/openssl/openssl/crypto/cms/cms_asn1.c
+++ b/deps/openssl/openssl/crypto/cms/cms_asn1.c
@@ -51,6 +51,7 @@ static int cms_si_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
         EVP_PKEY_free(si->pkey);
         X509_free(si->signer);
         EVP_MD_CTX_free(si->mctx);
+        EVP_PKEY_CTX_free(si->pctx);
     }
     return 1;
 }
@@ -89,11 +90,21 @@ ASN1_SEQUENCE(CMS_OriginatorInfo) = {
         ASN1_IMP_SET_OF_OPT(CMS_OriginatorInfo, crls, CMS_RevocationInfoChoice, 1)
 } static_ASN1_SEQUENCE_END(CMS_OriginatorInfo)
 
-ASN1_NDEF_SEQUENCE(CMS_EncryptedContentInfo) = {
+static int cms_ec_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
+                     void *exarg)
+{
+    CMS_EncryptedContentInfo *ec = (CMS_EncryptedContentInfo *)*pval;
+
+    if (operation == ASN1_OP_FREE_POST)
+        OPENSSL_clear_free(ec->key, ec->keylen);
+    return 1;
+}
+
+ASN1_NDEF_SEQUENCE_cb(CMS_EncryptedContentInfo, cms_ec_cb) = {
         ASN1_SIMPLE(CMS_EncryptedContentInfo, contentType, ASN1_OBJECT),
         ASN1_SIMPLE(CMS_EncryptedContentInfo, contentEncryptionAlgorithm, X509_ALGOR),
         ASN1_IMP_OPT(CMS_EncryptedContentInfo, encryptedContent, ASN1_OCTET_STRING_NDEF, 0)
-} static_ASN1_NDEF_SEQUENCE_END(CMS_EncryptedContentInfo)
+} ASN1_NDEF_SEQUENCE_END_cb(CMS_EncryptedContentInfo, CMS_EncryptedContentInfo)
 
 ASN1_SEQUENCE(CMS_KeyTransRecipientInfo) = {
         ASN1_EMBED(CMS_KeyTransRecipientInfo, version, INT32),
@@ -317,6 +328,10 @@ static int cms_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it,
             return 0;
         break;
 
+    case ASN1_OP_FREE_POST:
+        OPENSSL_free(cms->ctx.propq);
+        break;
+
     }
     return 1;
 }
diff --git a/deps/openssl/openssl/crypto/cms/cms_dh.c b/deps/openssl/openssl/crypto/cms/cms_dh.c
index 2f54ed2673a..3f931d6e6fe 100644
--- a/deps/openssl/openssl/crypto/cms/cms_dh.c
+++ b/deps/openssl/openssl/crypto/cms/cms_dh.c
@@ -34,7 +34,7 @@ static int dh_cms_set_peerkey(EVP_PKEY_CTX *pctx,
     if (OBJ_obj2nid(aoid) != NID_dhpublicnumber)
         goto err;
     /* Only absent parameters allowed in RFC XXXX */
-    if (atype != V_ASN1_UNDEF && atype == V_ASN1_NULL)
+    if (atype != V_ASN1_UNDEF && atype != V_ASN1_NULL)
         goto err;
 
     pk = EVP_PKEY_CTX_get0_pkey(pctx);
diff --git a/deps/openssl/openssl/crypto/cms/cms_env.c b/deps/openssl/openssl/crypto/cms/cms_env.c
index 99cf1dcb396..445a16fb771 100644
--- a/deps/openssl/openssl/crypto/cms/cms_env.c
+++ b/deps/openssl/openssl/crypto/cms/cms_env.c
@@ -51,15 +51,6 @@ static int cms_get_enveloped_type(const CMS_ContentInfo *cms)
     return ret;
 }
 
-void ossl_cms_env_enc_content_free(const CMS_ContentInfo *cinf)
-{
-    if (cms_get_enveloped_type_simple(cinf) != 0) {
-        CMS_EncryptedContentInfo *ec = ossl_cms_get0_env_enc_content(cinf);
-        if (ec != NULL)
-            OPENSSL_clear_free(ec->key, ec->keylen);
-    }
-}
-
 CMS_EnvelopedData *ossl_cms_get0_enveloped(CMS_ContentInfo *cms)
 {
     if (OBJ_obj2nid(cms->contentType) != NID_pkcs7_enveloped) {
diff --git a/deps/openssl/openssl/crypto/cms/cms_err.c b/deps/openssl/openssl/crypto/cms/cms_err.c
index 4bd6a0dc1bf..e67d783be29 100644
--- a/deps/openssl/openssl/crypto/cms/cms_err.c
+++ b/deps/openssl/openssl/crypto/cms/cms_err.c
@@ -1,6 +1,6 @@
 /*
  * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -20,77 +20,79 @@ static const ERR_STRING_DATA CMS_str_reasons[] = {
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_ADD_SIGNER_ERROR), "add signer error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_ATTRIBUTE_ERROR), "attribute error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CERTIFICATE_ALREADY_PRESENT),
-    "certificate already present"},
+     "certificate already present"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CERTIFICATE_HAS_NO_KEYID),
-    "certificate has no keyid"},
+     "certificate has no keyid"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CERTIFICATE_VERIFY_ERROR),
-    "certificate verify error"},
+     "certificate verify error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CIPHER_AEAD_SET_TAG_ERROR),
-    "cipher aead set tag error"},
+     "cipher aead set tag error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CIPHER_GET_TAG), "cipher get tag"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CIPHER_INITIALISATION_ERROR),
-    "cipher initialisation error"},
+     "cipher initialisation error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR),
-    "cipher parameter initialisation error"},
+     "cipher parameter initialisation error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CMS_DATAFINAL_ERROR),
-    "cms datafinal error"},
+     "cms datafinal error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CMS_LIB), "cms lib"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CONTENTIDENTIFIER_MISMATCH),
-    "contentidentifier mismatch"},
+     "contentidentifier mismatch"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CONTENT_NOT_FOUND), "content not found"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CONTENT_TYPE_MISMATCH),
-    "content type mismatch"},
+     "content type mismatch"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CONTENT_TYPE_NOT_COMPRESSED_DATA),
-    "content type not compressed data"},
+     "content type not compressed data"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA),
-    "content type not enveloped data"},
+     "content type not enveloped data"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CONTENT_TYPE_NOT_SIGNED_DATA),
-    "content type not signed data"},
+     "content type not signed data"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CONTENT_VERIFY_ERROR),
-    "content verify error"},
+     "content verify error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CTRL_ERROR), "ctrl error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_CTRL_FAILURE), "ctrl failure"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_DECODE_ERROR), "decode error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_DECRYPT_ERROR), "decrypt error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_ERROR_GETTING_PUBLIC_KEY),
-    "error getting public key"},
+     "error getting public key"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE),
-    "error reading messagedigest attribute"},
+     "error reading messagedigest attribute"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_ERROR_SETTING_KEY), "error setting key"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_ERROR_SETTING_RECIPIENTINFO),
-    "error setting recipientinfo"},
+     "error setting recipientinfo"},
+    {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_ERROR_UNSUPPORTED_STATIC_KEY_AGREEMENT),
+     "error unsupported static key agreement"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_ESS_SIGNING_CERTID_MISMATCH_ERROR),
-    "ess signing certid mismatch error"},
+     "ess signing certid mismatch error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_INVALID_ENCRYPTED_KEY_LENGTH),
-    "invalid encrypted key length"},
+     "invalid encrypted key length"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER),
-    "invalid key encryption parameter"},
+     "invalid key encryption parameter"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_INVALID_KEY_LENGTH), "invalid key length"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_INVALID_LABEL), "invalid label"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_INVALID_OAEP_PARAMETERS),
-    "invalid oaep parameters"},
+     "invalid oaep parameters"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_KDF_PARAMETER_ERROR),
-    "kdf parameter error"},
+     "kdf parameter error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_MD_BIO_INIT_ERROR), "md bio init error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH),
-    "messagedigest attribute wrong length"},
+     "messagedigest attribute wrong length"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_MESSAGEDIGEST_WRONG_LENGTH),
-    "messagedigest wrong length"},
+     "messagedigest wrong length"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_MSGSIGDIGEST_ERROR), "msgsigdigest error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_MSGSIGDIGEST_VERIFICATION_FAILURE),
-    "msgsigdigest verification failure"},
+     "msgsigdigest verification failure"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_MSGSIGDIGEST_WRONG_LENGTH),
-    "msgsigdigest wrong length"},
+     "msgsigdigest wrong length"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NEED_ONE_SIGNER), "need one signer"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NOT_A_SIGNED_RECEIPT),
-    "not a signed receipt"},
+     "not a signed receipt"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NOT_ENCRYPTED_DATA), "not encrypted data"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NOT_KEK), "not kek"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NOT_KEY_AGREEMENT), "not key agreement"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NOT_KEY_TRANSPORT), "not key transport"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NOT_PWRI), "not pwri"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE),
-    "not supported for this key type"},
+     "not supported for this key type"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NO_CIPHER), "no cipher"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NO_CONTENT), "no content"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NO_CONTENT_TYPE), "no content type"},
@@ -100,9 +102,9 @@ static const ERR_STRING_DATA CMS_str_reasons[] = {
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NO_KEY_OR_CERT), "no key or cert"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NO_MATCHING_DIGEST), "no matching digest"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NO_MATCHING_RECIPIENT),
-    "no matching recipient"},
+     "no matching recipient"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NO_MATCHING_SIGNATURE),
-    "no matching signature"},
+     "no matching signature"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NO_MSGSIGDIGEST), "no msgsigdigest"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NO_PASSWORD), "no password"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NO_PRIVATE_KEY), "no private key"},
@@ -111,56 +113,56 @@ static const ERR_STRING_DATA CMS_str_reasons[] = {
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_NO_SIGNERS), "no signers"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_PEER_KEY_ERROR), "peer key error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE),
-    "private key does not match certificate"},
+     "private key does not match certificate"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_RECEIPT_DECODE_ERROR),
-    "receipt decode error"},
+     "receipt decode error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_RECIPIENT_ERROR), "recipient error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_SHARED_INFO_ERROR), "shared info error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_SIGNER_CERTIFICATE_NOT_FOUND),
-    "signer certificate not found"},
+     "signer certificate not found"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_SIGNFINAL_ERROR), "signfinal error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_SMIME_TEXT_ERROR), "smime text error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_STORE_INIT_ERROR), "store init error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_TYPE_NOT_COMPRESSED_DATA),
-    "type not compressed data"},
+     "type not compressed data"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_TYPE_NOT_DATA), "type not data"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_TYPE_NOT_DIGESTED_DATA),
-    "type not digested data"},
+     "type not digested data"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_TYPE_NOT_ENCRYPTED_DATA),
-    "type not encrypted data"},
+     "type not encrypted data"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_TYPE_NOT_ENVELOPED_DATA),
-    "type not enveloped data"},
+     "type not enveloped data"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNABLE_TO_FINALIZE_CONTEXT),
-    "unable to finalize context"},
+     "unable to finalize context"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNKNOWN_CIPHER), "unknown cipher"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNKNOWN_DIGEST_ALGORITHM),
-    "unknown digest algorithm"},
+     "unknown digest algorithm"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNKNOWN_ID), "unknown id"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM),
-    "unsupported compression algorithm"},
+     "unsupported compression algorithm"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM),
-    "unsupported content encryption algorithm"},
+     "unsupported content encryption algorithm"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNSUPPORTED_CONTENT_TYPE),
-    "unsupported content type"},
+     "unsupported content type"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNSUPPORTED_ENCRYPTION_TYPE),
-    "unsupported encryption type"},
+     "unsupported encryption type"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNSUPPORTED_KEK_ALGORITHM),
-    "unsupported kek algorithm"},
+     "unsupported kek algorithm"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM),
-    "unsupported key encryption algorithm"},
+     "unsupported key encryption algorithm"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNSUPPORTED_LABEL_SOURCE),
-    "unsupported label source"},
+     "unsupported label source"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNSUPPORTED_RECIPIENTINFO_TYPE),
-    "unsupported recipientinfo type"},
+     "unsupported recipientinfo type"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNSUPPORTED_RECIPIENT_TYPE),
-    "unsupported recipient type"},
+     "unsupported recipient type"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNSUPPORTED_SIGNATURE_ALGORITHM),
-    "unsupported signature algorithm"},
+     "unsupported signature algorithm"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNSUPPORTED_TYPE), "unsupported type"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNWRAP_ERROR), "unwrap error"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_UNWRAP_FAILURE), "unwrap failure"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_VERIFICATION_FAILURE),
-    "verification failure"},
+     "verification failure"},
     {ERR_PACK(ERR_LIB_CMS, 0, CMS_R_WRAP_ERROR), "wrap error"},
     {0, NULL}
 };
diff --git a/deps/openssl/openssl/crypto/cms/cms_kari.c b/deps/openssl/openssl/crypto/cms/cms_kari.c
index a2f422a78d8..8e9e6a5d148 100644
--- a/deps/openssl/openssl/crypto/cms/cms_kari.c
+++ b/deps/openssl/openssl/crypto/cms/cms_kari.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2013-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2013-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -502,6 +502,13 @@ int ossl_cms_RecipientInfo_kari_encrypt(const CMS_ContentInfo *cms,
         oik->d.originatorKey = M_ASN1_new_of(CMS_OriginatorPublicKey);
         if (!oik->d.originatorKey)
             return 0;
+    } else {
+        /*
+         * Currently it is not possible to get public key as it is not stored
+         * during kari initialization.
+         */
+        ERR_raise(ERR_LIB_CMS, CMS_R_ERROR_UNSUPPORTED_STATIC_KEY_AGREEMENT);
+        return 0;
     }
     /* Initialise KDF algorithm */
     if (!ossl_cms_env_asn1_ctrl(ri, 0))
diff --git a/deps/openssl/openssl/crypto/cms/cms_lib.c b/deps/openssl/openssl/crypto/cms/cms_lib.c
index 8b135e95aac..67b35627ba5 100644
--- a/deps/openssl/openssl/crypto/cms/cms_lib.c
+++ b/deps/openssl/openssl/crypto/cms/cms_lib.c
@@ -22,6 +22,7 @@
 static STACK_OF(CMS_CertificateChoices)
 **cms_get0_certificate_choices(CMS_ContentInfo *cms);
 
+IMPLEMENT_ASN1_ALLOC_FUNCTIONS(CMS_ContentInfo)
 IMPLEMENT_ASN1_PRINT_FUNCTION(CMS_ContentInfo)
 
 CMS_ContentInfo *d2i_CMS_ContentInfo(CMS_ContentInfo **a,
@@ -68,20 +69,6 @@ CMS_ContentInfo *CMS_ContentInfo_new_ex(OSSL_LIB_CTX *libctx, const char *propq)
     return ci;
 }
 
-CMS_ContentInfo *CMS_ContentInfo_new(void)
-{
-    return CMS_ContentInfo_new_ex(NULL, NULL);
-}
-
-void CMS_ContentInfo_free(CMS_ContentInfo *cms)
-{
-    if (cms != NULL) {
-        ossl_cms_env_enc_content_free(cms);
-        OPENSSL_free(cms->ctx.propq);
-        ASN1_item_free((ASN1_VALUE *)cms, ASN1_ITEM_rptr(CMS_ContentInfo));
-    }
-}
-
 const CMS_CTX *ossl_cms_get0_cmsctx(const CMS_ContentInfo *cms)
 {
     return cms != NULL ? &cms->ctx : NULL;
diff --git a/deps/openssl/openssl/crypto/cms/cms_local.h b/deps/openssl/openssl/crypto/cms/cms_local.h
index 253f6819e43..1e0e0910d1d 100644
--- a/deps/openssl/openssl/crypto/cms/cms_local.h
+++ b/deps/openssl/openssl/crypto/cms/cms_local.h
@@ -368,6 +368,7 @@ struct CMS_Receipt_st {
 
 DECLARE_ASN1_FUNCTIONS(CMS_ContentInfo)
 DECLARE_ASN1_ITEM(CMS_SignerInfo)
+DECLARE_ASN1_ITEM(CMS_EncryptedContentInfo)
 DECLARE_ASN1_ITEM(CMS_IssuerAndSerialNumber)
 DECLARE_ASN1_ITEM(CMS_Attributes_Sign)
 DECLARE_ASN1_ITEM(CMS_Attributes_Verify)
@@ -444,7 +445,6 @@ BIO *ossl_cms_EnvelopedData_init_bio(CMS_ContentInfo *cms);
 int ossl_cms_EnvelopedData_final(CMS_ContentInfo *cms, BIO *chain);
 BIO *ossl_cms_AuthEnvelopedData_init_bio(CMS_ContentInfo *cms);
 int ossl_cms_AuthEnvelopedData_final(CMS_ContentInfo *cms, BIO *cmsbio);
-void ossl_cms_env_enc_content_free(const CMS_ContentInfo *cinf);
 CMS_EnvelopedData *ossl_cms_get0_enveloped(CMS_ContentInfo *cms);
 CMS_AuthEnvelopedData *ossl_cms_get0_auth_enveloped(CMS_ContentInfo *cms);
 CMS_EncryptedContentInfo *ossl_cms_get0_env_enc_content(const CMS_ContentInfo *cms);
diff --git a/deps/openssl/openssl/crypto/cms/cms_rsa.c b/deps/openssl/openssl/crypto/cms/cms_rsa.c
index 12bc8184389..5e26e89d501 100644
--- a/deps/openssl/openssl/crypto/cms/cms_rsa.c
+++ b/deps/openssl/openssl/crypto/cms/cms_rsa.c
@@ -223,7 +223,10 @@ static int rsa_cms_sign(CMS_SignerInfo *si)
         os = ossl_rsa_ctx_to_pss_string(pkctx);
         if (os == NULL)
             return 0;
-        return X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_PKEY_RSA_PSS), V_ASN1_SEQUENCE, os);
+        if (X509_ALGOR_set0(alg, OBJ_nid2obj(EVP_PKEY_RSA_PSS), V_ASN1_SEQUENCE, os))
+            return 1;
+        ASN1_STRING_free(os);
+        return 0;
     }
 
     params[0] = OSSL_PARAM_construct_octet_string(
diff --git a/deps/openssl/openssl/crypto/cms/cms_sd.c b/deps/openssl/openssl/crypto/cms/cms_sd.c
index 3a21664e9da..4758d048386 100644
--- a/deps/openssl/openssl/crypto/cms/cms_sd.c
+++ b/deps/openssl/openssl/crypto/cms/cms_sd.c
@@ -482,8 +482,12 @@ CMS_SignerInfo *CMS_add1_signer(CMS_ContentInfo *cms,
                                          ossl_cms_ctx_get0_libctx(ctx),
                                          ossl_cms_ctx_get0_propq(ctx),
                                          pk, NULL) <= 0) {
+            si->pctx = NULL;
             goto err;
         }
+        else {
+            EVP_MD_CTX_set_flags(si->mctx, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX);
+        }
     }
 
     if (!sd->signerInfos)
@@ -725,6 +729,7 @@ static int cms_SignerInfo_content_sign(CMS_ContentInfo *cms,
         unsigned int mdlen;
 
         pctx = si->pctx;
+        si->pctx = NULL;
         if (!EVP_DigestFinal_ex(mctx, md, &mdlen))
             goto err;
         siglen = EVP_PKEY_get_size(si->pkey);
@@ -813,6 +818,7 @@ int CMS_SignerInfo_sign(CMS_SignerInfo *si)
                                   ossl_cms_ctx_get0_propq(ctx), si->pkey,
                                   NULL) <= 0)
             goto err;
+        EVP_MD_CTX_set_flags(mctx, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX);
         si->pctx = pctx;
     }
 
@@ -884,9 +890,16 @@ int CMS_SignerInfo_verify(CMS_SignerInfo *si)
         goto err;
     }
     mctx = si->mctx;
+    if (si->pctx != NULL) {
+        EVP_PKEY_CTX_free(si->pctx);
+        si->pctx = NULL;
+    }
     if (EVP_DigestVerifyInit_ex(mctx, &si->pctx, EVP_MD_get0_name(md), libctx,
-                                propq, si->pkey, NULL) <= 0)
+                                propq, si->pkey, NULL) <= 0) {
+        si->pctx = NULL;
         goto err;
+    }
+    EVP_MD_CTX_set_flags(mctx, EVP_MD_CTX_FLAG_KEEP_PKEY_CTX);
 
     if (!cms_sd_asn1_ctrl(si, 1))
         goto err;
@@ -1003,8 +1016,11 @@ int CMS_SignerInfo_verify_content(CMS_SignerInfo *si, BIO *chain)
         if (EVP_PKEY_CTX_set_signature_md(pkctx, md) <= 0)
             goto err;
         si->pctx = pkctx;
-        if (!cms_sd_asn1_ctrl(si, 1))
+        if (!cms_sd_asn1_ctrl(si, 1)) {
+            si->pctx = NULL;
             goto err;
+        }
+        si->pctx = NULL;
         r = EVP_PKEY_verify(pkctx, si->signature->data,
                             si->signature->length, mval, mlen);
         if (r <= 0) {
diff --git a/deps/openssl/openssl/crypto/cms/cms_smime.c b/deps/openssl/openssl/crypto/cms/cms_smime.c
index d7719267c8c..65da2452fce 100644
--- a/deps/openssl/openssl/crypto/cms/cms_smime.c
+++ b/deps/openssl/openssl/crypto/cms/cms_smime.c
@@ -236,7 +236,7 @@ CMS_ContentInfo *CMS_EncryptedData_encrypt_ex(BIO *in, const EVP_CIPHER *cipher,
     if (cms == NULL)
         return NULL;
     if (!CMS_EncryptedData_set1_key(cms, cipher, key, keylen))
-        return NULL;
+        goto err;
 
     if (!(flags & CMS_DETACHED))
         CMS_set_detached(cms, 0);
@@ -245,6 +245,7 @@ CMS_ContentInfo *CMS_EncryptedData_encrypt_ex(BIO *in, const EVP_CIPHER *cipher,
         || CMS_final(cms, in, NULL, flags))
         return cms;
 
+ err:
     CMS_ContentInfo_free(cms);
     return NULL;
 }
diff --git a/deps/openssl/openssl/crypto/core_fetch.c b/deps/openssl/openssl/crypto/core_fetch.c
index 38db36ee1f7..c063515fc04 100644
--- a/deps/openssl/openssl/crypto/core_fetch.c
+++ b/deps/openssl/openssl/crypto/core_fetch.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -120,7 +120,8 @@ static void ossl_method_construct_this(OSSL_PROVIDER *provider,
      * It is *expected* that the put function increments the refcnt
      * of the passed method.
      */
-    data->mcm->put(data->store, method, provider, algo->algorithm_names,
+    data->mcm->put(no_store ? data->store : NULL,
+                   method, provider, algo->algorithm_names,
                    algo->property_definition, data->mcm_data);
 
     /* refcnt-- because we're dropping the reference */
diff --git a/deps/openssl/openssl/crypto/dso/dso_dl.c b/deps/openssl/openssl/crypto/dso/dso_dl.c
index f4e6e5f4573..05b63cf1d9c 100644
--- a/deps/openssl/openssl/crypto/dso/dso_dl.c
+++ b/deps/openssl/openssl/crypto/dso/dso_dl.c
@@ -235,13 +235,12 @@ static char *dl_name_converter(DSO *dso, const char *filename)
         ERR_raise(ERR_LIB_DSO, DSO_R_NAME_TRANSLATION_FAILED);
         return NULL;
     }
-    if (transform) {
-        if ((DSO_flags(dso) & DSO_FLAG_NAME_TRANSLATION_EXT_ONLY) == 0)
-            sprintf(translated, "lib%s%s", filename, DSO_EXTENSION);
-        else
-            sprintf(translated, "%s%s", filename, DSO_EXTENSION);
-    } else
-        sprintf(translated, "%s", filename);
+    if (transform)
+        BIO_snprintf(translated, rsize,
+                     (DSO_flags(dso) & DSO_FLAG_NAME_TRANSLATION_EXT_ONLY) == 0
+                     ? "lib%s%s" : "%s%s", filename, DSO_EXTENSION);
+    else
+        BIO_snprintf(translated, rsize, "%s", filename);
     return translated;
 }
 
diff --git a/deps/openssl/openssl/crypto/dso/dso_dlfcn.c b/deps/openssl/openssl/crypto/dso/dso_dlfcn.c
index 6a988cc7279..1107da5fe65 100644
--- a/deps/openssl/openssl/crypto/dso/dso_dlfcn.c
+++ b/deps/openssl/openssl/crypto/dso/dso_dlfcn.c
@@ -271,11 +271,12 @@ static char *dlfcn_name_converter(DSO *dso, const char *filename)
     }
     if (transform) {
         if ((DSO_flags(dso) & DSO_FLAG_NAME_TRANSLATION_EXT_ONLY) == 0)
-            sprintf(translated, "lib%s" DSO_EXTENSION, filename);
+            BIO_snprintf(translated, rsize, "lib%s" DSO_EXTENSION, filename);
         else
-            sprintf(translated, "%s" DSO_EXTENSION, filename);
-    } else
-        sprintf(translated, "%s", filename);
+            BIO_snprintf(translated, rsize, "%s" DSO_EXTENSION, filename);
+    } else {
+        BIO_snprintf(translated, rsize, "%s", filename);
+    }
     return translated;
 }
 
diff --git a/deps/openssl/openssl/crypto/dso/dso_win32.c b/deps/openssl/openssl/crypto/dso/dso_win32.c
index 4d3059d4387..91a1a9d9aeb 100644
--- a/deps/openssl/openssl/crypto/dso/dso_win32.c
+++ b/deps/openssl/openssl/crypto/dso/dso_win32.c
@@ -454,24 +454,20 @@ static char *win32_name_converter(DSO *dso, const char *filename)
     char *translated;
     int len, transform;
 
-    len = strlen(filename);
     transform = ((strstr(filename, "/") == NULL) &&
                  (strstr(filename, "\\") == NULL) &&
                  (strstr(filename, ":") == NULL));
+    /* If transform != 0, then we convert to %s.dll, else just dupe filename */
+
+    len = strlen(filename) + 1;
     if (transform)
-        /* We will convert this to "%s.dll" */
-        translated = OPENSSL_malloc(len + 5);
-    else
-        /* We will simply duplicate filename */
-        translated = OPENSSL_malloc(len + 1);
+        len += strlen(".dll");
+    translated = OPENSSL_malloc(len);
     if (translated == NULL) {
         ERR_raise(ERR_LIB_DSO, DSO_R_NAME_TRANSLATION_FAILED);
         return NULL;
     }
-    if (transform)
-        sprintf(translated, "%s.dll", filename);
-    else
-        sprintf(translated, "%s", filename);
+    BIO_snprintf(translated, len, "%s%s", filename, transform ? ".dll" : "");
     return translated;
 }
 
diff --git a/deps/openssl/openssl/crypto/ec/ec_asn1.c b/deps/openssl/openssl/crypto/ec/ec_asn1.c
index 7a0b35a5943..c018f392894 100644
--- a/deps/openssl/openssl/crypto/ec/ec_asn1.c
+++ b/deps/openssl/openssl/crypto/ec/ec_asn1.c
@@ -1161,7 +1161,7 @@ int i2o_ECPublicKey(const EC_KEY *a, unsigned char **out)
     size_t buf_len = 0;
     int new_buffer = 0;
 
-    if (a == NULL) {
+    if (a == NULL || a->pub_key == NULL) {
         ERR_raise(ERR_LIB_EC, ERR_R_PASSED_NULL_PARAMETER);
         return 0;
     }
diff --git a/deps/openssl/openssl/crypto/ec/ec_backend.c b/deps/openssl/openssl/crypto/ec/ec_backend.c
index 98e2c418e41..cad576fc48a 100644
--- a/deps/openssl/openssl/crypto/ec/ec_backend.c
+++ b/deps/openssl/openssl/crypto/ec/ec_backend.c
@@ -616,14 +616,8 @@ EC_KEY *ossl_ec_key_dup(const EC_KEY *src, int selection)
             || !EC_GROUP_copy(ret->group, src->group))
             goto err;
 
-        if (src->meth != NULL) {
-#if !defined(OPENSSL_NO_ENGINE) && !defined(FIPS_MODULE)
-            if (src->engine != NULL && ENGINE_init(src->engine) == 0)
-                goto err;
-            ret->engine = src->engine;
-#endif
+        if (src->meth != NULL)
             ret->meth = src->meth;
-        }
     }
 
     /*  copy the public key */
diff --git a/deps/openssl/openssl/crypto/ec/ec_lib.c b/deps/openssl/openssl/crypto/ec/ec_lib.c
index b1696d93bd6..a082876fb47 100644
--- a/deps/openssl/openssl/crypto/ec/ec_lib.c
+++ b/deps/openssl/openssl/crypto/ec/ec_lib.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2001-2022 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2001-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -20,6 +20,7 @@
 #include <openssl/err.h>
 #include <openssl/opensslv.h>
 #include "crypto/ec.h"
+#include "crypto/bn.h"
 #include "internal/nelem.h"
 #include "ec_local.h"
 
@@ -1262,10 +1263,10 @@ static int ec_field_inverse_mod_ord(const EC_GROUP *group, BIGNUM *r,
     if (!BN_sub(e, group->order, e))
         goto err;
     /*-
-     * Exponent e is public.
-     * No need for scatter-gather or BN_FLG_CONSTTIME.
+     * Although the exponent is public we want the result to be
+     * fixed top.
      */
-    if (!BN_mod_exp_mont(r, x, e, group->order, ctx, group->mont_data))
+    if (!bn_mod_exp_mont_fixed_top(r, x, e, group->order, ctx, group->mont_data))
         goto err;
 
     ret = 1;
diff --git a/deps/openssl/openssl/crypto/ec/ec_oct.c b/deps/openssl/openssl/crypto/ec/ec_oct.c
index 790a0b29077..2b77e973888 100644
--- a/deps/openssl/openssl/crypto/ec/ec_oct.c
+++ b/deps/openssl/openssl/crypto/ec/ec_oct.c
@@ -74,6 +74,10 @@ size_t EC_POINT_point2oct(const EC_GROUP *group, const EC_POINT *point,
                           point_conversion_form_t form, unsigned char *buf,
                           size_t len, BN_CTX *ctx)
 {
+    if (point == NULL) {
+        ERR_raise(ERR_LIB_EC, ERR_R_PASSED_NULL_PARAMETER);
+        return 0;
+    }
     if (group->meth->point2oct == 0
         && !(group->meth->flags & EC_FLAGS_DEFAULT_OCT)) {
         ERR_raise(ERR_LIB_EC, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
diff --git a/deps/openssl/openssl/crypto/encode_decode/encoder_pkey.c b/deps/openssl/openssl/crypto/encode_decode/encoder_pkey.c
index 3a24317cf4d..39266a95309 100644
--- a/deps/openssl/openssl/crypto/encode_decode/encoder_pkey.c
+++ b/deps/openssl/openssl/crypto/encode_decode/encoder_pkey.c
@@ -186,9 +186,13 @@ encoder_construct_pkey(OSSL_ENCODER_INSTANCE *encoder_inst, void *arg)
         const OSSL_PROVIDER *e_prov = OSSL_ENCODER_get0_provider(encoder);
 
         if (k_prov != e_prov) {
+            int selection = data->selection;
+
+            if ((selection & OSSL_KEYMGMT_SELECT_PRIVATE_KEY) != 0)
+                selection |= OSSL_KEYMGMT_SELECT_PUBLIC_KEY;
             data->encoder_inst = encoder_inst;
 
-            if (!evp_keymgmt_export(pk->keymgmt, pk->keydata, data->selection,
+            if (!evp_keymgmt_export(pk->keymgmt, pk->keydata, selection,
                                     &encoder_import_cb, data))
                 return NULL;
             data->obj = data->constructed_obj;
diff --git a/deps/openssl/openssl/crypto/err/openssl.txt b/deps/openssl/openssl/crypto/err/openssl.txt
index 003e2981095..756fafdfa24 100644
--- a/deps/openssl/openssl/crypto/err/openssl.txt
+++ b/deps/openssl/openssl/crypto/err/openssl.txt
@@ -1,4 +1,4 @@
-# Copyright 1999-2023 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -307,6 +307,8 @@ CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE:114:\
 	error reading messagedigest attribute
 CMS_R_ERROR_SETTING_KEY:115:error setting key
 CMS_R_ERROR_SETTING_RECIPIENTINFO:116:error setting recipientinfo
+CMS_R_ERROR_UNSUPPORTED_STATIC_KEY_AGREEMENT:196:\
+	error unsupported static key agreement
 CMS_R_ESS_SIGNING_CERTID_MISMATCH_ERROR:183:ess signing certid mismatch error
 CMS_R_INVALID_ENCRYPTED_KEY_LENGTH:117:invalid encrypted key length
 CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER:176:invalid key encryption parameter
@@ -1388,8 +1390,6 @@ SSL_R_MISSING_ECDSA_SIGNING_CERT:381:missing ecdsa signing cert
 SSL_R_MISSING_FATAL:256:missing fatal
 SSL_R_MISSING_PARAMETERS:290:missing parameters
 SSL_R_MISSING_PSK_KEX_MODES_EXTENSION:310:missing psk kex modes extension
-SSL_R_MISSING_QUIC_TRANSPORT_PARAMETERS_EXTENSION:801:\
-	missing quic transport parameters extension
 SSL_R_MISSING_RSA_CERTIFICATE:168:missing rsa certificate
 SSL_R_MISSING_RSA_ENCRYPTING_CERT:169:missing rsa encrypting cert
 SSL_R_MISSING_RSA_SIGNING_CERT:170:missing rsa signing cert
@@ -1540,7 +1540,6 @@ SSL_R_VERSION_TOO_LOW:396:version too low
 SSL_R_WRONG_CERTIFICATE_TYPE:383:wrong certificate type
 SSL_R_WRONG_CIPHER_RETURNED:261:wrong cipher returned
 SSL_R_WRONG_CURVE:378:wrong curve
-SSL_R_WRONG_ENCRYPTION_LEVEL_RECEIVED:800:wrong encryption level received
 SSL_R_WRONG_SIGNATURE_LENGTH:264:wrong signature length
 SSL_R_WRONG_SIGNATURE_SIZE:265:wrong signature size
 SSL_R_WRONG_SIGNATURE_TYPE:370:wrong signature type
diff --git a/deps/openssl/openssl/crypto/evp/ctrl_params_translate.c b/deps/openssl/openssl/crypto/evp/ctrl_params_translate.c
index de6c215e205..44d0895bcf1 100644
--- a/deps/openssl/openssl/crypto/evp/ctrl_params_translate.c
+++ b/deps/openssl/openssl/crypto/evp/ctrl_params_translate.c
@@ -1210,6 +1210,8 @@ static int fix_ecdh_cofactor(enum state state,
         /* The initial value for |ctx->action_type| must not be zero. */
         if (!ossl_assert(ctx->action_type != NONE))
             return 0;
+    } else if (state == POST_PARAMS_TO_CTRL && ctx->action_type == NONE) {
+        ctx->action_type = GET;
     }
 
     if ((ret = default_check(state, translation, ctx)) <= 0)
@@ -1235,6 +1237,8 @@ static int fix_ecdh_cofactor(enum state state,
         }
     } else if (state == PRE_PARAMS_TO_CTRL && ctx->action_type == GET) {
         ctx->p1 = -2;
+    } else if (state == POST_PARAMS_TO_CTRL && ctx->action_type == GET) {
+        ctx->p1 = ret;
     }
 
     return ret;
@@ -2800,8 +2804,14 @@ static int evp_pkey_ctx_setget_params_to_ctrl(EVP_PKEY_CTX *pctx,
         /*
          * In POST, we pass the return value as p1, allowing the fixup_args
          * function to put it to good use, or maybe affect it.
+         *
+         * NOTE: even though EVP_PKEY_CTX_ctrl return value is documented
+         * as return positive on Success and 0 or negative on falure. There
+         * maybe parameters (e.g. ecdh_cofactor), which actually return 0
+         * as success value. That is why we do POST_PARAMS_TO_CTRL for 0
+         * value as well
          */
-        if (ret > 0) {
+        if (ret >= 0) {
             ctx.p1 = ret;
             fixup(POST_PARAMS_TO_CTRL, translation, &ctx);
             ret = ctx.p1;
diff --git a/deps/openssl/openssl/crypto/evp/m_sigver.c b/deps/openssl/openssl/crypto/evp/m_sigver.c
index 76a6814b424..efd2c05c85c 100644
--- a/deps/openssl/openssl/crypto/evp/m_sigver.c
+++ b/deps/openssl/openssl/crypto/evp/m_sigver.c
@@ -662,8 +662,12 @@ int EVP_DigestVerify(EVP_MD_CTX *ctx, const unsigned char *sigret,
 {
     EVP_PKEY_CTX *pctx = ctx->pctx;
 
-    if (pctx != NULL
-            && pctx->operation == EVP_PKEY_OP_VERIFYCTX
+    if (pctx == NULL) {
+        ERR_raise(ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR);
+        return -1;
+    }
+
+    if (pctx->operation == EVP_PKEY_OP_VERIFYCTX
             && pctx->op.sig.algctx != NULL
             && pctx->op.sig.signature != NULL) {
         if (pctx->op.sig.signature->digest_verify != NULL)
@@ -672,8 +676,8 @@ int EVP_DigestVerify(EVP_MD_CTX *ctx, const unsigned char *sigret,
                                                          tbs, tbslen);
     } else {
         /* legacy */
-        if (ctx->pctx->pmeth != NULL && ctx->pctx->pmeth->digestverify != NULL)
-            return ctx->pctx->pmeth->digestverify(ctx, sigret, siglen, tbs, tbslen);
+        if (pctx->pmeth != NULL && pctx->pmeth->digestverify != NULL)
+            return pctx->pmeth->digestverify(ctx, sigret, siglen, tbs, tbslen);
     }
 
     if (EVP_DigestVerifyUpdate(ctx, tbs, tbslen) <= 0)
diff --git a/deps/openssl/openssl/crypto/http/http_client.c b/deps/openssl/openssl/crypto/http/http_client.c
index 4b96a6b9e9e..c86db4405b8 100644
--- a/deps/openssl/openssl/crypto/http/http_client.c
+++ b/deps/openssl/openssl/crypto/http/http_client.c
@@ -851,6 +851,20 @@ int OSSL_HTTP_REQ_CTX_nbio_d2i(OSSL_HTTP_REQ_CTX *rctx,
 
 #ifndef OPENSSL_NO_SOCK
 
+static const char *explict_or_default_port(const char *hostserv, const char *port, int use_ssl)
+{
+    if (port == NULL) {
+        char *service = NULL;
+
+        if (!BIO_parse_hostserv(hostserv, NULL, &service, BIO_PARSE_PRIO_HOST))
+            return NULL;
+        if (service == NULL) /* implicit port */
+            port = use_ssl ? OSSL_HTTPS_PORT : OSSL_HTTP_PORT;
+        OPENSSL_free(service);
+    } /* otherwise take the explicitly given port */
+    return port;
+}
+
 /* set up a new connection BIO, to HTTP server or to HTTP(S) proxy if given */
 static BIO *http_new_bio(const char *server /* optionally includes ":port" */,
                          const char *server_port /* explicit server port */,
@@ -870,8 +884,7 @@ static BIO *http_new_bio(const char *server /* optionally includes ":port" */,
         port = proxy_port;
     }
 
-    if (port == NULL && strchr(host, ':') == NULL)
-        port = use_ssl ? OSSL_HTTPS_PORT : OSSL_HTTP_PORT;
+    port = explict_or_default_port(host, port, use_ssl);
 
     cbio = BIO_new_connect(host /* optionally includes ":port" */);
     if (cbio == NULL)
@@ -958,8 +971,6 @@ OSSL_HTTP_REQ_CTX *OSSL_HTTP_open(const char *server, const char *port,
         }
         if (port != NULL && *port == '\0')
             port = NULL;
-        if (port == NULL && strchr(server, ':') == NULL)
-            port = use_ssl ? OSSL_HTTPS_PORT : OSSL_HTTP_PORT;
         proxy = OSSL_HTTP_adapt_proxy(proxy, no_proxy, server, use_ssl);
         if (proxy != NULL
             && !OSSL_HTTP_parse_url(proxy, NULL /* use_ssl */, NULL /* user */,
diff --git a/deps/openssl/openssl/crypto/http/http_lib.c b/deps/openssl/openssl/crypto/http/http_lib.c
index 30c1cd04fc0..9c41f57541d 100644
--- a/deps/openssl/openssl/crypto/http/http_lib.c
+++ b/deps/openssl/openssl/crypto/http/http_lib.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2001-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2001-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -9,11 +9,18 @@
 
 #include <stdio.h>       /* for sscanf() */
 #include <string.h>
+#ifndef OPENSSL_NO_SOCK
+# include "../bio/bio_local.h" /* for NI_MAXHOST */
+#endif
 #include <openssl/http.h>
 #include <openssl/httperr.h>
 #include <openssl/bio.h> /* for BIO_snprintf() */
 #include <openssl/err.h>
 #include "internal/cryptlib.h" /* for ossl_assert() */
+#ifndef NI_MAXHOST
+# define NI_MAXHOST 255
+#endif
+#include "crypto/ctype.h" /* for ossl_isspace() */
 
 static void init_pstring(char **pstr)
 {
@@ -251,10 +258,17 @@ static int use_proxy(const char *no_proxy, const char *server)
 {
     size_t sl;
     const char *found = NULL;
+    char host[NI_MAXHOST];
 
     if (!ossl_assert(server != NULL))
         return 0;
     sl = strlen(server);
+    if (sl >= 2 && sl < sizeof(host) + 2 && server[0] == '[' && server[sl - 1] == ']') {
+        /* strip leading '[' and trailing ']' from escaped IPv6 address */
+        sl -= 2;
+        strncpy(host, server + 1, sl);
+        server = host;
+    }
 
     /*
      * using environment variable names, both lowercase and uppercase variants,
@@ -268,8 +282,8 @@ static int use_proxy(const char *no_proxy, const char *server)
     if (no_proxy != NULL)
         found = strstr(no_proxy, server);
     while (found != NULL
-           && ((found != no_proxy && found[-1] != ' ' && found[-1] != ',')
-               || (found[sl] != '\0' && found[sl] != ' ' && found[sl] != ',')))
+           && ((found != no_proxy && !ossl_isspace(found[-1]) && found[-1] != ',')
+               || (found[sl] != '\0' && !ossl_isspace(found[sl]) && found[sl] != ',')))
         found = strstr(found + 1, server);
     return found == NULL;
 }
@@ -285,7 +299,7 @@ const char *OSSL_HTTP_adapt_proxy(const char *proxy, const char *no_proxy,
     if (proxy == NULL)
         proxy = ossl_safe_getenv(use_ssl ? "https_proxy" : "http_proxy");
     if (proxy == NULL)
-        proxy = ossl_safe_getenv(use_ssl ? OPENSSL_HTTP_PROXY : OPENSSL_HTTPS_PROXY);
+        proxy = ossl_safe_getenv(use_ssl ? OPENSSL_HTTPS_PROXY : OPENSSL_HTTP_PROXY);
 
     if (proxy == NULL || *proxy == '\0' || !use_proxy(no_proxy, server))
         return NULL;
diff --git a/deps/openssl/openssl/crypto/info.c b/deps/openssl/openssl/crypto/info.c
index f5fa92e1580..a0dc2e80136 100644
--- a/deps/openssl/openssl/crypto/info.c
+++ b/deps/openssl/openssl/crypto/info.c
@@ -14,7 +14,6 @@
 #include "internal/cryptlib.h"
 #include "e_os.h"
 #include "buildinf.h"
-#include <openssl/quic.h>
 
 #if defined(__arm__) || defined(__arm) || defined(__aarch64__)
 # include "arm_arch.h"
@@ -200,10 +199,6 @@ const char *OPENSSL_info(int t)
         if (ossl_cpu_info_str[0] != '\0')
             return ossl_cpu_info_str + strlen(CPUINFO_PREFIX);
         break;
-#ifndef OPENSSL_NO_QUIC
-    case OPENSSL_INFO_QUIC:
-        return "QUIC";
-#endif
     default:
         break;
     }
diff --git a/deps/openssl/openssl/crypto/pem/pem_pk8.c b/deps/openssl/openssl/crypto/pem/pem_pk8.c
index 1592e351ede..6e84f0afd05 100644
--- a/deps/openssl/openssl/crypto/pem/pem_pk8.c
+++ b/deps/openssl/openssl/crypto/pem/pem_pk8.c
@@ -173,7 +173,7 @@ EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
     X509_SIG *p8 = NULL;
     int klen;
     EVP_PKEY *ret;
-    char psbuf[PEM_BUFSIZE];
+    char psbuf[PEM_BUFSIZE + 1]; /* reserve one byte at the end */
 
     p8 = d2i_PKCS8_bio(bp, NULL);
     if (p8 == NULL)
@@ -182,7 +182,7 @@ EVP_PKEY *d2i_PKCS8PrivateKey_bio(BIO *bp, EVP_PKEY **x, pem_password_cb *cb,
         klen = cb(psbuf, PEM_BUFSIZE, 0, u);
     else
         klen = PEM_def_callback(psbuf, PEM_BUFSIZE, 0, u);
-    if (klen < 0) {
+    if (klen < 0 || klen > PEM_BUFSIZE) {
         ERR_raise(ERR_LIB_PEM, PEM_R_BAD_PASSWORD_READ);
         X509_SIG_free(p8);
         return NULL;
diff --git a/deps/openssl/openssl/crypto/pkcs12/p12_crt.c b/deps/openssl/openssl/crypto/pkcs12/p12_crt.c
index 1a48e5c611d..3c7d5ff97c5 100644
--- a/deps/openssl/openssl/crypto/pkcs12/p12_crt.c
+++ b/deps/openssl/openssl/crypto/pkcs12/p12_crt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1999-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1999-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -210,8 +210,10 @@ PKCS12_SAFEBAG *PKCS12_add_key_ex(STACK_OF(PKCS12_SAFEBAG) **pbags,
     /* Make a PKCS#8 structure */
     if ((p8 = EVP_PKEY2PKCS8(key)) == NULL)
         goto err;
-    if (key_usage && !PKCS8_add_keyusage(p8, key_usage))
+    if (key_usage && !PKCS8_add_keyusage(p8, key_usage)) {
+        PKCS8_PRIV_KEY_INFO_free(p8);
         goto err;
+    }
     if (nid_key != -1) {
         /* This call does not take ownership of p8 */
         bag = PKCS12_SAFEBAG_create_pkcs8_encrypt_ex(nid_key, pass, -1, NULL, 0,
diff --git a/deps/openssl/openssl/crypto/pkcs7/pk7_doit.c b/deps/openssl/openssl/crypto/pkcs7/pk7_doit.c
index d7791e5c4f4..e9de097da18 100644
--- a/deps/openssl/openssl/crypto/pkcs7/pk7_doit.c
+++ b/deps/openssl/openssl/crypto/pkcs7/pk7_doit.c
@@ -1023,6 +1023,7 @@ int PKCS7_signatureVerify(BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si,
     STACK_OF(X509_ATTRIBUTE) *sk;
     BIO *btmp;
     EVP_PKEY *pkey;
+    unsigned char *abuf = NULL;
     const PKCS7_CTX *ctx = ossl_pkcs7_get0_ctx(p7);
     OSSL_LIB_CTX *libctx = ossl_pkcs7_ctx_get0_libctx(ctx);
     const char *propq = ossl_pkcs7_ctx_get0_propq(ctx);
@@ -1072,7 +1073,7 @@ int PKCS7_signatureVerify(BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si,
 
     sk = si->auth_attr;
     if ((sk != NULL) && (sk_X509_ATTRIBUTE_num(sk) != 0)) {
-        unsigned char md_dat[EVP_MAX_MD_SIZE], *abuf = NULL;
+        unsigned char md_dat[EVP_MAX_MD_SIZE];
         unsigned int md_len;
         int alen;
         ASN1_OCTET_STRING *message_digest;
@@ -1114,8 +1115,6 @@ int PKCS7_signatureVerify(BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si,
         }
         if (!EVP_VerifyUpdate(mdc_tmp, abuf, alen))
             goto err;
-
-        OPENSSL_free(abuf);
     }
 
     os = si->enc_digest;
@@ -1133,6 +1132,7 @@ int PKCS7_signatureVerify(BIO *bio, PKCS7 *p7, PKCS7_SIGNER_INFO *si,
     }
     ret = 1;
  err:
+    OPENSSL_free(abuf);
     EVP_MD_CTX_free(mdc_tmp);
     EVP_MD_free(fetched_md);
     return ret;
diff --git a/deps/openssl/openssl/crypto/pkcs7/pk7_lib.c b/deps/openssl/openssl/crypto/pkcs7/pk7_lib.c
index 5ce591f758f..bdd62052696 100644
--- a/deps/openssl/openssl/crypto/pkcs7/pk7_lib.c
+++ b/deps/openssl/openssl/crypto/pkcs7/pk7_lib.c
@@ -28,6 +28,11 @@ long PKCS7_ctrl(PKCS7 *p7, int cmd, long larg, char *parg)
     /* NOTE(emilia): does not support detached digested data. */
     case PKCS7_OP_SET_DETACHED_SIGNATURE:
         if (nid == NID_pkcs7_signed) {
+            if (p7->d.sign == NULL) {
+                ERR_raise(ERR_LIB_PKCS7, PKCS7_R_NO_CONTENT);
+                ret = 0;
+                break;
+            }
             ret = p7->detached = (int)larg;
             if (ret && PKCS7_type_is_data(p7->d.sign->contents)) {
                 ASN1_OCTET_STRING *os;
diff --git a/deps/openssl/openssl/crypto/sm2/sm2_sign.c b/deps/openssl/openssl/crypto/sm2/sm2_sign.c
index 71ccfcfc4c3..2097cd2fca8 100644
--- a/deps/openssl/openssl/crypto/sm2/sm2_sign.c
+++ b/deps/openssl/openssl/crypto/sm2/sm2_sign.c
@@ -331,12 +331,10 @@ static int sm2_sig_verify(const EC_KEY *key, const ECDSA_SIG *sig,
     OSSL_LIB_CTX *libctx = ossl_ec_key_get_libctx(key);
 
     ctx = BN_CTX_new_ex(libctx);
-    pt = EC_POINT_new(group);
-    if (ctx == NULL || pt == NULL) {
+    if (ctx == NULL) {
         ERR_raise(ERR_LIB_SM2, ERR_R_MALLOC_FAILURE);
         goto done;
     }
-
     BN_CTX_start(ctx);
     t = BN_CTX_get(ctx);
     x1 = BN_CTX_get(ctx);
@@ -345,6 +343,12 @@ static int sm2_sig_verify(const EC_KEY *key, const ECDSA_SIG *sig,
         goto done;
     }
 
+    pt = EC_POINT_new(group);
+    if (pt == NULL) {
+        ERR_raise(ERR_LIB_SM2, ERR_R_MALLOC_FAILURE);
+        goto done;
+    }
+
     /*
      * B1: verify whether r' in [1,n-1], verification failed if not
      * B2: verify whether s' in [1,n-1], verification failed if not
diff --git a/deps/openssl/openssl/crypto/srp/srp_vfy.c b/deps/openssl/openssl/crypto/srp/srp_vfy.c
index 96d511ffe63..4b842dfd912 100644
--- a/deps/openssl/openssl/crypto/srp/srp_vfy.c
+++ b/deps/openssl/openssl/crypto/srp/srp_vfy.c
@@ -216,6 +216,8 @@ int SRP_user_pwd_set1_ids(SRP_user_pwd *vinfo, const char *id,
 {
     OPENSSL_free(vinfo->id);
     OPENSSL_free(vinfo->info);
+    vinfo->id = NULL;
+    vinfo->info = NULL;
     if (id != NULL && NULL == (vinfo->id = OPENSSL_strdup(id)))
         return 0;
     return (info == NULL || NULL != (vinfo->info = OPENSSL_strdup(info)));
diff --git a/deps/openssl/openssl/crypto/threads_win.c b/deps/openssl/openssl/crypto/threads_win.c
index dbeda74d73a..43f36ee6a33 100644
--- a/deps/openssl/openssl/crypto/threads_win.c
+++ b/deps/openssl/openssl/crypto/threads_win.c
@@ -212,7 +212,8 @@ int CRYPTO_THREAD_compare_id(CRYPTO_THREAD_ID a, CRYPTO_THREAD_ID b)
 
 int CRYPTO_atomic_add(int *val, int amount, int *ret, CRYPTO_RWLOCK *lock)
 {
-    *ret = (int)InterlockedExchangeAdd((long volatile *)val, (long)amount) + amount;
+    *ret = (int)InterlockedExchangeAdd((LONG volatile *)val, (LONG)amount)
+        + amount;
     return 1;
 }
 
diff --git a/deps/openssl/openssl/crypto/trace.c b/deps/openssl/openssl/crypto/trace.c
index 3df9b5a51e9..90a6350beba 100644
--- a/deps/openssl/openssl/crypto/trace.c
+++ b/deps/openssl/openssl/crypto/trace.c
@@ -473,7 +473,7 @@ BIO *OSSL_trace_begin(int category)
     char *prefix = NULL;
 
     category = ossl_trace_get_category(category);
-    if (category < 0)
+    if (category < 0 || !OSSL_trace_enabled(category))
         return NULL;
 
     channel = trace_channels[category].bio;
diff --git a/deps/openssl/openssl/crypto/ui/ui_util.c b/deps/openssl/openssl/crypto/ui/ui_util.c
index 59b00b225ad..554bf798565 100644
--- a/deps/openssl/openssl/crypto/ui/ui_util.c
+++ b/deps/openssl/openssl/crypto/ui/ui_util.c
@@ -105,14 +105,18 @@ static int ui_read(UI *ui, UI_STRING *uis)
     switch (UI_get_string_type(uis)) {
     case UIT_PROMPT:
         {
-            char result[PEM_BUFSIZE + 1];
+            int len;
+            char result[PEM_BUFSIZE + 1]; /* reserve one byte at the end */
             const struct pem_password_cb_data *data =
                 UI_method_get_ex_data(UI_get_method(ui), ui_method_data_index);
             int maxsize = UI_get_result_maxsize(uis);
-            int len = data->cb(result,
-                               maxsize > PEM_BUFSIZE ? PEM_BUFSIZE : maxsize,
-                               data->rwflag, UI_get0_user_data(ui));
 
+            if (maxsize > PEM_BUFSIZE)
+                maxsize = PEM_BUFSIZE;
+            len = data->cb(result, maxsize, data->rwflag,
+                           UI_get0_user_data(ui));
+            if (len > maxsize)
+                return -1;
             if (len >= 0)
                 result[len] = '\0';
             if (len < 0)
diff --git a/deps/openssl/openssl/crypto/x509/v3_admis.c b/deps/openssl/openssl/crypto/x509/v3_admis.c
index 3bce232ed2f..53259c29f56 100644
--- a/deps/openssl/openssl/crypto/x509/v3_admis.c
+++ b/deps/openssl/openssl/crypto/x509/v3_admis.c
@@ -67,11 +67,10 @@ const X509V3_EXT_METHOD ossl_v3_ext_admission = {
     NULL                    /* extension-specific data */
 };
 
-
 static int i2r_NAMING_AUTHORITY(const struct v3_ext_method *method, void *in,
                                 BIO *bp, int ind)
 {
-    NAMING_AUTHORITY * namingAuthority = (NAMING_AUTHORITY*) in;
+    NAMING_AUTHORITY *namingAuthority = (NAMING_AUTHORITY *) in;
 
     if (namingAuthority == NULL)
         return 0;
@@ -81,14 +80,14 @@ static int i2r_NAMING_AUTHORITY(const struct v3_ext_method *method, void *in,
         && namingAuthority->namingAuthorityUrl == NULL)
         return 0;
 
-    if (BIO_printf(bp, "%*snamingAuthority: ", ind, "") <= 0)
+    if (BIO_printf(bp, "%*snamingAuthority:\n", ind, "") <= 0)
         goto err;
 
     if (namingAuthority->namingAuthorityId != NULL) {
         char objbuf[128];
         const char *ln = OBJ_nid2ln(OBJ_obj2nid(namingAuthority->namingAuthorityId));
 
-        if (BIO_printf(bp, "%*s  admissionAuthorityId: ", ind, "") <= 0)
+        if (BIO_printf(bp, "%*s  namingAuthorityId: ", ind, "") <= 0)
             goto err;
 
         OBJ_obj2txt(objbuf, sizeof(objbuf), namingAuthority->namingAuthorityId, 1);
@@ -130,9 +129,10 @@ static int i2r_ADMISSION_SYNTAX(const struct v3_ext_method *method, void *in,
     }
 
     for (i = 0; i < sk_ADMISSIONS_num(admission->contentsOfAdmissions); i++) {
-        ADMISSIONS* entry = sk_ADMISSIONS_value(admission->contentsOfAdmissions, i);
+        ADMISSIONS *entry = sk_ADMISSIONS_value(admission->contentsOfAdmissions, i);
 
-        if (BIO_printf(bp, "%*sEntry %0d:\n", ind, "", 1 + i) <= 0) goto err;
+        if (BIO_printf(bp, "%*sEntry %0d:\n", ind, "", 1 + i) <= 0)
+            goto err;
 
         if (entry->admissionAuthority != NULL) {
             if (BIO_printf(bp, "%*s  admissionAuthority:\n", ind, "") <= 0
@@ -143,12 +143,12 @@ static int i2r_ADMISSION_SYNTAX(const struct v3_ext_method *method, void *in,
         }
 
         if (entry->namingAuthority != NULL) {
-            if (i2r_NAMING_AUTHORITY(method, entry->namingAuthority, bp, ind) <= 0)
+            if (i2r_NAMING_AUTHORITY(method, entry->namingAuthority, bp, ind + 2) <= 0)
                 goto err;
         }
 
         for (j = 0; j < sk_PROFESSION_INFO_num(entry->professionInfos); j++) {
-            PROFESSION_INFO* pinfo = sk_PROFESSION_INFO_value(entry->professionInfos, j);
+            PROFESSION_INFO *pinfo = sk_PROFESSION_INFO_value(entry->professionInfos, j);
 
             if (BIO_printf(bp, "%*s  Profession Info Entry %0d:\n", ind, "", 1 + j) <= 0)
                 goto err;
@@ -161,7 +161,7 @@ static int i2r_ADMISSION_SYNTAX(const struct v3_ext_method *method, void *in,
             }
 
             if (pinfo->namingAuthority != NULL) {
-                if (i2r_NAMING_AUTHORITY(method, pinfo->namingAuthority, bp, ind + 2) <= 0)
+                if (i2r_NAMING_AUTHORITY(method, pinfo->namingAuthority, bp, ind + 4) <= 0)
                     goto err;
             }
 
@@ -170,7 +170,7 @@ static int i2r_ADMISSION_SYNTAX(const struct v3_ext_method *method, void *in,
                 if (BIO_printf(bp, "%*s    Info Entries:\n", ind, "") <= 0)
                     goto err;
                 for (k = 0; k < sk_ASN1_STRING_num(pinfo->professionItems); k++) {
-                    ASN1_STRING* val = sk_ASN1_STRING_value(pinfo->professionItems, k);
+                    ASN1_STRING *val = sk_ASN1_STRING_value(pinfo->professionItems, k);
 
                     if (BIO_printf(bp, "%*s      ", ind, "") <= 0
                         || ASN1_STRING_print(bp, val) <= 0
@@ -183,7 +183,7 @@ static int i2r_ADMISSION_SYNTAX(const struct v3_ext_method *method, void *in,
                 if (BIO_printf(bp, "%*s    Profession OIDs:\n", ind, "") <= 0)
                     goto err;
                 for (k = 0; k < sk_ASN1_OBJECT_num(pinfo->professionOIDs); k++) {
-                    ASN1_OBJECT* obj = sk_ASN1_OBJECT_value(pinfo->professionOIDs, k);
+                    ASN1_OBJECT *obj = sk_ASN1_OBJECT_value(pinfo->professionOIDs, k);
                     const char *ln = OBJ_nid2ln(OBJ_obj2nid(obj));
                     char objbuf[128];
 
@@ -207,31 +207,29 @@ const ASN1_OBJECT *NAMING_AUTHORITY_get0_authorityId(const NAMING_AUTHORITY *n)
     return n->namingAuthorityId;
 }
 
-void NAMING_AUTHORITY_set0_authorityId(NAMING_AUTHORITY *n, ASN1_OBJECT* id)
+void NAMING_AUTHORITY_set0_authorityId(NAMING_AUTHORITY *n, ASN1_OBJECT *id)
 {
     ASN1_OBJECT_free(n->namingAuthorityId);
     n->namingAuthorityId = id;
 }
 
-const ASN1_IA5STRING *NAMING_AUTHORITY_get0_authorityURL(
-    const NAMING_AUTHORITY *n)
+const ASN1_IA5STRING *NAMING_AUTHORITY_get0_authorityURL(const NAMING_AUTHORITY *n)
 {
     return n->namingAuthorityUrl;
 }
 
-void NAMING_AUTHORITY_set0_authorityURL(NAMING_AUTHORITY *n, ASN1_IA5STRING* u)
+void NAMING_AUTHORITY_set0_authorityURL(NAMING_AUTHORITY *n, ASN1_IA5STRING *u)
 {
     ASN1_IA5STRING_free(n->namingAuthorityUrl);
     n->namingAuthorityUrl = u;
 }
 
-const ASN1_STRING *NAMING_AUTHORITY_get0_authorityText(
-    const NAMING_AUTHORITY *n)
+const ASN1_STRING *NAMING_AUTHORITY_get0_authorityText(const NAMING_AUTHORITY *n)
 {
     return n->namingAuthorityText;
 }
 
-void NAMING_AUTHORITY_set0_authorityText(NAMING_AUTHORITY *n, ASN1_STRING* t)
+void NAMING_AUTHORITY_set0_authorityText(NAMING_AUTHORITY *n, ASN1_STRING *t)
 {
     ASN1_IA5STRING_free(n->namingAuthorityText);
     n->namingAuthorityText = t;
diff --git a/deps/openssl/openssl/crypto/x509/v3_san.c b/deps/openssl/openssl/crypto/x509/v3_san.c
index 34ca16a6d72..d4999f1fc6c 100644
--- a/deps/openssl/openssl/crypto/x509/v3_san.c
+++ b/deps/openssl/openssl/crypto/x509/v3_san.c
@@ -336,7 +336,7 @@ static GENERAL_NAMES *v2i_issuer_alt(X509V3_EXT_METHOD *method,
 
 static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens)
 {
-    GENERAL_NAMES *ialt;
+    GENERAL_NAMES *ialt = NULL;
     GENERAL_NAME *gen;
     X509_EXTENSION *ext;
     int i, num;
@@ -371,6 +371,7 @@ static int copy_issuer(X509V3_CTX *ctx, GENERAL_NAMES *gens)
     return 1;
 
  err:
+    sk_GENERAL_NAME_free(ialt);
     return 0;
 
 }
diff --git a/deps/openssl/openssl/crypto/x509/x509_cmp.c b/deps/openssl/openssl/crypto/x509/x509_cmp.c
index 989fb8faa9f..f2c3a568198 100644
--- a/deps/openssl/openssl/crypto/x509/x509_cmp.c
+++ b/deps/openssl/openssl/crypto/x509/x509_cmp.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -196,6 +196,8 @@ int X509_add_cert(STACK_OF(X509) *sk, X509 *cert, int flags)
         ERR_raise(ERR_LIB_X509, ERR_R_PASSED_NULL_PARAMETER);
         return 0;
     }
+    if (cert == NULL)
+        return 0;
     if ((flags & X509_ADD_FLAG_NO_DUP) != 0) {
         /*
          * not using sk_X509_set_cmp_func() and sk_X509_find()
diff --git a/deps/openssl/openssl/crypto/x509/x_all.c b/deps/openssl/openssl/crypto/x509/x_all.c
index e58c9ab1c11..158e11a8649 100644
--- a/deps/openssl/openssl/crypto/x509/x_all.c
+++ b/deps/openssl/openssl/crypto/x509/x_all.c
@@ -92,11 +92,13 @@ int X509_sign_ctx(X509 *x, EVP_MD_CTX *ctx)
 static ASN1_VALUE *simple_get_asn1(const char *url, BIO *bio, BIO *rbio,
                                    int timeout, const ASN1_ITEM *it)
 {
+    size_t max_resp_len = (it == ASN1_ITEM_rptr(X509_CRL)) ?
+        OSSL_HTTP_DEFAULT_MAX_CRL_LEN : OSSL_HTTP_DEFAULT_MAX_RESP_LEN;
     BIO *mem = OSSL_HTTP_get(url, NULL /* proxy */, NULL /* no_proxy */,
                              bio, rbio, NULL /* cb */, NULL /* arg */,
                              1024 /* buf_size */, NULL /* headers */,
                              NULL /* expected_ct */, 1 /* expect_asn1 */,
-                             OSSL_HTTP_DEFAULT_MAX_RESP_LEN, timeout);
+                             max_resp_len, timeout);
     ASN1_VALUE *res = ASN1_item_d2i_bio(it, mem, NULL);
 
     BIO_free(mem);
diff --git a/deps/openssl/openssl/demos/cipher/aesccm.c b/deps/openssl/openssl/demos/cipher/aesccm.c
index 5a2d4281506..f4430e727b2 100644
--- a/deps/openssl/openssl/demos/cipher/aesccm.c
+++ b/deps/openssl/openssl/demos/cipher/aesccm.c
@@ -94,7 +94,7 @@ int aes_ccm_encrypt(void)
     if ((cipher = EVP_CIPHER_fetch(libctx, "AES-192-CCM", propq)) == NULL)
         goto err;
 
-    /* Set nonce length if default 96 bits is not appropriate */
+    /* Default nonce length for AES-CCM is 7 bytes (56 bits). */
     params[0] = OSSL_PARAM_construct_size_t(OSSL_CIPHER_PARAM_AEAD_IVLEN,
                                             &ccm_nonce_len);
     /* Set tag length */
diff --git a/deps/openssl/openssl/doc/build.info b/deps/openssl/openssl/doc/build.info
index f7791462739..0279e2390a3 100644
--- a/deps/openssl/openssl/doc/build.info
+++ b/deps/openssl/openssl/doc/build.info
@@ -2271,10 +2271,6 @@ DEPEND[html/man3/SSL_CTX_set_psk_client_callback.html]=man3/SSL_CTX_set_psk_clie
 GENERATE[html/man3/SSL_CTX_set_psk_client_callback.html]=man3/SSL_CTX_set_psk_client_callback.pod
 DEPEND[man/man3/SSL_CTX_set_psk_client_callback.3]=man3/SSL_CTX_set_psk_client_callback.pod
 GENERATE[man/man3/SSL_CTX_set_psk_client_callback.3]=man3/SSL_CTX_set_psk_client_callback.pod
-DEPEND[html/man3/SSL_CTX_set_quic_method.html]=man3/SSL_CTX_set_quic_method.pod
-GENERATE[html/man3/SSL_CTX_set_quic_method.html]=man3/SSL_CTX_set_quic_method.pod
-DEPEND[man/man3/SSL_CTX_set_quic_method.3]=man3/SSL_CTX_set_quic_method.pod
-GENERATE[man/man3/SSL_CTX_set_quic_method.3]=man3/SSL_CTX_set_quic_method.pod
 DEPEND[html/man3/SSL_CTX_set_quiet_shutdown.html]=man3/SSL_CTX_set_quiet_shutdown.pod
 GENERATE[html/man3/SSL_CTX_set_quiet_shutdown.html]=man3/SSL_CTX_set_quiet_shutdown.pod
 DEPEND[man/man3/SSL_CTX_set_quiet_shutdown.3]=man3/SSL_CTX_set_quiet_shutdown.pod
@@ -3355,7 +3351,6 @@ html/man3/SSL_CTX_set_msg_callback.html \
 html/man3/SSL_CTX_set_num_tickets.html \
 html/man3/SSL_CTX_set_options.html \
 html/man3/SSL_CTX_set_psk_client_callback.html \
-html/man3/SSL_CTX_set_quic_method.html \
 html/man3/SSL_CTX_set_quiet_shutdown.html \
 html/man3/SSL_CTX_set_read_ahead.html \
 html/man3/SSL_CTX_set_record_padding_callback.html \
@@ -3964,7 +3959,6 @@ man/man3/SSL_CTX_set_msg_callback.3 \
 man/man3/SSL_CTX_set_num_tickets.3 \
 man/man3/SSL_CTX_set_options.3 \
 man/man3/SSL_CTX_set_psk_client_callback.3 \
-man/man3/SSL_CTX_set_quic_method.3 \
 man/man3/SSL_CTX_set_quiet_shutdown.3 \
 man/man3/SSL_CTX_set_read_ahead.3 \
 man/man3/SSL_CTX_set_record_padding_callback.3 \
diff --git a/deps/openssl/openssl/doc/man1/openssl-ca.pod.in b/deps/openssl/openssl/doc/man1/openssl-ca.pod.in
index 1d497e848e7..1c07db3c8ef 100644
--- a/deps/openssl/openssl/doc/man1/openssl-ca.pod.in
+++ b/deps/openssl/openssl/doc/man1/openssl-ca.pod.in
@@ -701,7 +701,7 @@ A sample configuration file with the relevant sections for this command:
 
  default_days   = 365                   # how long to certify for
  default_crl_days= 30                   # how long before next CRL
- default_md     = md5                   # md to use
+ default_md     = sha256                # md to use
 
  policy         = policy_any            # default policy
  email_in_dn    = no                    # Don't add the email into cert DN
diff --git a/deps/openssl/openssl/doc/man1/openssl-cmp.pod.in b/deps/openssl/openssl/doc/man1/openssl-cmp.pod.in
index 9240916fce4..889a59cd497 100644
--- a/deps/openssl/openssl/doc/man1/openssl-cmp.pod.in
+++ b/deps/openssl/openssl/doc/man1/openssl-cmp.pod.in
@@ -453,8 +453,11 @@ Reason numbers defined in RFC 5280 are:
 
 =item B<-server> I<[http[s]://][userinfo@]host[:port][/path][?query][#fragment]>
 
-The DNS hostname or IP address and optionally port
+The I<host> domain name or IP address and optionally I<port>
 of the CMP server to connect to using HTTP(S).
+IP address may be for v4 or v6, such as C<127.0.0.1> or C<[::1]> for localhost.
+If the host string is an IPv6 address, it must be enclosed in C<[> and C<]>.
+
 This option excludes I<-port> and I<-use_mock_srv>.
 It is ignored if I<-rspin> is given with enough filename arguments.
 
@@ -468,6 +471,7 @@ If a path is included it provides the default value for the B<-path> option.
 
 The HTTP(S) proxy server to use for reaching the CMP server unless B<-no_proxy>
 applies, see below.
+If the host string is an IPv6 address, it must be enclosed in C<[> and C<]>.
 The proxy port defaults to 80 or 443 if the scheme is C<https>; apart from that
 the optional C<http://> or C<https://> prefix is ignored (note that TLS may be
 selected by B<-tls_used>), as well as any path, userinfo, and query, and fragment
@@ -969,8 +973,9 @@ This excludes the B<-server> and B<-port> options.
 
 =item B<-port> I<number>
 
-Act as HTTP-based CMP server mock-up listening on the given port.
-This excludes the B<-server> and B<-use_mock_srv> options.
+Act as HTTP-based CMP server mock-up listening on the given local port.
+The client may address the server via, e.g., C<127.0.0.1> or C<[::1]>.
+This option excludes the B<-server> and B<-use_mock_srv> options.
 The B<-rspin>, B<-rspout>, B<-reqin>, and B<-reqout> options
 so far are not supported in this mode.
 
diff --git a/deps/openssl/openssl/doc/man1/openssl-cms.pod.in b/deps/openssl/openssl/doc/man1/openssl-cms.pod.in
index 65a61ee97f1..f4d12312b7c 100644
--- a/deps/openssl/openssl/doc/man1/openssl-cms.pod.in
+++ b/deps/openssl/openssl/doc/man1/openssl-cms.pod.in
@@ -191,6 +191,10 @@ to the output file.
 Verify signed data. Expects a signed data on input and outputs
 the signed data. Both clear text and opaque signing is supported.
 
+By default, validation of signer certificates and their chain
+is done w.r.t. the S/MIME signing (C<smimesign>) purpose.
+For details see L<openssl-verification-options(1)/Certificate Extensions>.
+
 =item B<-resign>
 
 Resign a message: take an existing message and one or more new signers.
@@ -374,7 +378,8 @@ See L<openssl-format-options(1)> for details.
 =item B<-originator> I<file>
 
 A certificate of the originator of the encrypted message. Necessary for
-decryption when Key Agreement is in use for a shared key.
+decryption when Key Agreement is in use for a shared key. Currently, not
+allowed for encryption.
 
 =item B<-recip> I<file>
 
@@ -902,7 +907,7 @@ The B<-engine> option was deprecated in OpenSSL 3.0.
 
 =head1 COPYRIGHT
 
-Copyright 2008-2023 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2008-2025 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/openssl/doc/man1/openssl-fipsinstall.pod.in b/deps/openssl/openssl/doc/man1/openssl-fipsinstall.pod.in
index 97e2ae910c1..57758597cda 100644
--- a/deps/openssl/openssl/doc/man1/openssl-fipsinstall.pod.in
+++ b/deps/openssl/openssl/doc/man1/openssl-fipsinstall.pod.in
@@ -239,6 +239,10 @@ L<fips_config(5)>,
 L<OSSL_PROVIDER-FIPS(7)>,
 L<EVP_MAC(3)>
 
+=head1 HISTORY
+
+The B<openssl-fipsinstall> application was added in OpenSSL 3.0.
+
 =head1 COPYRIGHT
 
 Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
diff --git a/deps/openssl/openssl/doc/man1/openssl-info.pod.in b/deps/openssl/openssl/doc/man1/openssl-info.pod.in
index fe7abee4867..0e91bb28ee1 100644
--- a/deps/openssl/openssl/doc/man1/openssl-info.pod.in
+++ b/deps/openssl/openssl/doc/man1/openssl-info.pod.in
@@ -17,7 +17,6 @@ B<openssl info>
 [B<-listsep>]
 [B<-seeds>]
 [B<-cpusettings>]
-[B<-quic>]
 
 =head1 DESCRIPTION
 
@@ -74,10 +73,6 @@ Outputs the randomness seed sources.
 
 Outputs the OpenSSL CPU settings info.
 
-=item B<-quic>
-
-Outputs the OpenSSL QUIC info.
-
 =back
 
 =head1 HISTORY
diff --git a/deps/openssl/openssl/doc/man1/openssl-ocsp.pod.in b/deps/openssl/openssl/doc/man1/openssl-ocsp.pod.in
index fbad5079af6..fd23a44df06 100644
--- a/deps/openssl/openssl/doc/man1/openssl-ocsp.pod.in
+++ b/deps/openssl/openssl/doc/man1/openssl-ocsp.pod.in
@@ -30,8 +30,8 @@ B<openssl> B<ocsp>
 [B<-respin> I<file>]
 [B<-url> I<URL>]
 [B<-host> I<host>:I<port>]
-[B<-path>]
-[B<-proxy> I<[http[s]://][userinfo@]host[:port][/path]>]
+[B<-path> I<pathname>]
+[B<-proxy> I<[http[s]://][userinfo@]host[:port][/path][?query][#fragment]>]
 [B<-no_proxy> I<addresses>]
 [B<-header>]
 [B<-timeout> I<seconds>]
@@ -160,24 +160,32 @@ with B<-serial>, B<-cert> and B<-host> options).
 
 =item B<-url> I<responder_url>
 
-Specify the responder URL. Both HTTP and HTTPS (SSL/TLS) URLs can be specified.
+Specify the responder host and optionally port and path via a URL.
+Both HTTP and HTTPS (SSL/TLS) URLs can be specified.
 The optional userinfo and fragment components are ignored.
 Any given query component is handled as part of the path component.
+For details, see the B<-host> and B<-path> options described next.
 
-=item B<-host> I<hostname>:I<port>, B<-path> I<pathname>
+=item B<-host> I<host>:I<port>, B<-path> I<pathname>
 
 If the B<-host> option is present then the OCSP request is sent to the host
-I<hostname> on port I<port>. The B<-path> option specifies the HTTP pathname
-to use or "/" by default.  This is equivalent to specifying B<-url> with scheme
-http:// and the given hostname, port, and pathname.
+I<host> on port I<port>.
+The I<host> may be a domain name or an IP (v4 or v6) address,
+such as C<127.0.0.1> or C<[::1]> for localhost.
+If it is an IPv6 address, it must be enclosed in C<[> and C<]>.
 
-=item B<-proxy> I<[http[s]://][userinfo@]host[:port][/path]>
+The B<-path> option specifies the HTTP pathname to use or "/" by default.
+This is equivalent to specifying B<-url> with scheme
+http:// and the given I<host>, I<port>, and optional I<pathname>.
+
+=item B<-proxy> I<[http[s]://][userinfo@]host[:port][/path][?query][#fragment]>
 
 The HTTP(S) proxy server to use for reaching the OCSP server unless B<-no_proxy>
 applies, see below.
+If the host string is an IPv6 address, it must be enclosed in C<[> and C<]>.
 The proxy port defaults to 80 or 443 if the scheme is C<https>; apart from that
 the optional C<http://> or C<https://> prefix is ignored,
-as well as any userinfo and path components.
+as well as any userinfo, path, query, and fragment components.
 Defaults to the environment variable C<http_proxy> if set, else C<HTTP_PROXY>
 in case no TLS is used, otherwise C<https_proxy> if set, else C<HTTPS_PROXY>.
 
@@ -369,8 +377,8 @@ subject name.
 
 =item B<-port> I<portnum>
 
-Port to listen for OCSP requests on. The port may also be specified
-using the B<url> option.
+Port to listen for OCSP requests on. Both IPv4 and IPv6 are possible.
+The port may also be specified using the B<-url> option.
 A C<0> argument indicates that any available port shall be chosen automatically.
 
 =item B<-ignore_err>
diff --git a/deps/openssl/openssl/doc/man1/openssl-pkeyutl.pod.in b/deps/openssl/openssl/doc/man1/openssl-pkeyutl.pod.in
index cf3427a35c0..2f6ef0021d1 100644
--- a/deps/openssl/openssl/doc/man1/openssl-pkeyutl.pod.in
+++ b/deps/openssl/openssl/doc/man1/openssl-pkeyutl.pod.in
@@ -44,6 +44,8 @@ B<openssl> B<pkeyutl>
 This command can be used to perform low-level public key
 operations using any supported algorithm.
 
+By default the signing operation (see B<-sign> option) is assumed.
+
 =head1 OPTIONS
 
 =over 4
@@ -59,20 +61,29 @@ if this option is not specified.
 
 =item B<-rawin>
 
-This indicates that the input data is raw data, which is not hashed by any
-message digest algorithm. The user can specify a digest algorithm by using
-the B<-digest> option. This option can only be used with B<-sign> and
-B<-verify> and must be used with the Ed25519 and Ed448 algorithms.
+This indicates that the signature or verification input data is raw data,
+which is not hashed by any message digest algorithm.
+Except with EdDSA,
+the user can specify a digest algorithm by using the B<-digest> option.
+For signature algorithms like RSA, DSA and ECDSA,
+the default digest algorithm is SHA-256. For SM2, it is SM3.
+
+This option can only be used with B<-sign> and B<-verify>.
+For EdDSA (the Ed25519 and Ed448 algorithms) this option is required.
 
 =item B<-digest> I<algorithm>
 
-This specifies the digest algorithm which is used to hash the input data before
-signing or verifying it with the input key. This option could be omitted if the
-signature algorithm does not require one (for instance, EdDSA). If this option
-is omitted but the signature algorithm requires one, a default value will be
-used. For signature algorithms like RSA, DSA and ECDSA, SHA-256 will be the
-default digest algorithm. For SM2, it will be SM3. If this option is present,
-then the B<-rawin> option must be also specified.
+This option can only be used with B<-sign> and B<-verify>.
+It specifies the digest algorithm that is used to hash the input data
+before signing or verifying it with the input key. This option could be omitted
+if the signature algorithm does not require preprocessing the input through
+a pluggable hash function before signing (for instance, EdDSA). If this option
+is omitted but the signature algorithm requires one and the B<-rawin> option
+is given, a default value will be used (see B<-rawin> for details).
+If this option is present, then the B<-rawin> option is required.
+
+At this time, HashEdDSA (the ph or "prehash" variant of EdDSA) is not supported,
+so the B<-digest> option cannot be used with EdDSA.
 
 =item B<-out> I<filename>
 
@@ -81,7 +92,7 @@ default.
 
 =item B<-sigfile> I<file>
 
-Signature file, required for B<-verify> operations only
+Signature file, required and allowed for B<-verify> operations only
 
 =item B<-inkey> I<filename>|I<uri>
 
@@ -117,21 +128,42 @@ The input is a certificate containing a public key.
 =item B<-rev>
 
 Reverse the order of the input buffer. This is useful for some libraries
-(such as CryptoAPI) which represent the buffer in little endian format.
+(such as CryptoAPI) which represent the buffer in little-endian format.
+This cannot be used in conjunction with B<-rawin>.
 
 =item B<-sign>
 
-Sign the input data (which must be a hash) and output the signed result. This
-requires a private key.
+Sign the input data and output the signed result. This requires a private key.
+Using a message digest operation along with this is recommended,
+when applicable, see the B<-rawin> and B<-digest> options for details.
+Otherwise, the input data given with the B<-in> option is assumed to already
+be a digest, but this may then require an additional B<-pkeyopt> C<digest:>I<md>
+in some cases (e.g., RSA with the default PKCS#1 padding mode).
+Even for other algorithms like ECDSA, where the additional B<-pkeyopt> option
+does not affect signature output, it is recommended, as it enables
+checking that the input length is consistent with the intended digest.
 
 =item B<-verify>
 
-Verify the input data (which must be a hash) against the signature file and
-indicate if the verification succeeded or failed.
+Verify the input data against the signature given with the B<-sigfile> option
+and indicate if the verification succeeded or failed.
+The input data given with the B<-in> option is assumed to be a hash value
+unless the B<-rawin> option is specified or implied.
+With raw data, when a digest algorithm is applicable, though it may be inferred
+from the signature or take a default value, it should also be specified.
 
 =item B<-verifyrecover>
 
-Verify the input data (which must be a hash) and output the recovered data.
+Verify the given signature and output the recovered data (signature payload).
+For example, in case of RSA PKCS#1 the recovered data is the B<EMSA-PKCS-v1_5>
+DER encoding of the digest algorithm OID and value as specified in
+L<RFC8017 Section 9.2|https://datatracker.ietf.org/doc/html/rfc8017#section-9.2>.
+
+Note that here the input given with the B<-in> option is not a signature input
+(as with the B<-sign> and B<-verify> options) but a signature output value,
+typically produced using the B<-sign> option.
+
+This option is available only for use with RSA keys.
 
 =item B<-encrypt>
 
@@ -175,8 +207,9 @@ hex dump the output data.
 
 =item B<-asn1parse>
 
-Parse the ASN.1 output data, this is useful when combined with the
-B<-verifyrecover> option when an ASN1 structure is signed.
+Parse the ASN.1 output data to check its DER encoding and print any errors.
+When combined with the B<-verifyrecover> option, this may be useful only in case
+an ASN.1 DER-encoded structure had been signed directly (without hashing it).
 
 {- $OpenSSL::safe::opt_engine_item -}
 
@@ -200,8 +233,8 @@ engine I<id> for crypto operations.
 The operations and options supported vary according to the key algorithm
 and its implementation. The OpenSSL operations and options are indicated below.
 
-Unless otherwise mentioned all algorithms support the B<digest:>I<alg> option
-which specifies the digest in use for sign, verify and verifyrecover operations.
+Unless otherwise mentioned, all algorithms support the B<digest:>I<alg> option,
+which specifies the digest in use for the signing and verification operations.
 The value I<alg> should represent a digest name as used in the
 EVP_get_digestbyname() function for example B<sha1>. This value is not used to
 hash the input data. It is used (by some algorithms) for sanity-checking the
diff --git a/deps/openssl/openssl/doc/man1/openssl-req.pod.in b/deps/openssl/openssl/doc/man1/openssl-req.pod.in
index a56f548de8e..7ba599b54a0 100644
--- a/deps/openssl/openssl/doc/man1/openssl-req.pod.in
+++ b/deps/openssl/openssl/doc/man1/openssl-req.pod.in
@@ -638,7 +638,7 @@ Sample configuration file prompting for field values:
  attributes             = req_attributes
  req_extensions         = v3_ca
 
- dirstring_type = nobmp
+ dirstring_type = nombstr
 
  [ req_distinguished_name ]
  countryName                    = Country Name (2 letter code)
@@ -778,7 +778,7 @@ The <-nodes> option was deprecated in OpenSSL 3.0, too; use B<-noenc> instead.
 
 =head1 COPYRIGHT
 
-Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2000-2025 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/openssl/doc/man1/openssl-s_client.pod.in b/deps/openssl/openssl/doc/man1/openssl-s_client.pod.in
index bd6171aa265..caebe10bffb 100644
--- a/deps/openssl/openssl/doc/man1/openssl-s_client.pod.in
+++ b/deps/openssl/openssl/doc/man1/openssl-s_client.pod.in
@@ -10,11 +10,11 @@ openssl-s_client - SSL/TLS client program
 B<openssl> B<s_client>
 [B<-help>]
 [B<-ssl_config> I<section>]
-[B<-connect> I<host:port>]
+[B<-connect> I<host>:I<port>]
 [B<-host> I<hostname>]
 [B<-port> I<port>]
-[B<-bind> I<host:port>]
-[B<-proxy> I<host:port>]
+[B<-bind> I<host>:I<port>]
+[B<-proxy> I<host>:I<port>]
 [B<-proxy_user> I<userid>]
 [B<-proxy_pass> I<arg>]
 [B<-unix> I<path>]
@@ -157,6 +157,7 @@ This specifies the host and optional port to connect to. It is possible to
 select the host and port using the optional target positional argument instead.
 If neither this nor the target positional argument are specified then an attempt
 is made to connect to the local host on port 4433.
+If the host string is an IPv6 address, it must be enclosed in C<[> and C<]>.
 
 =item B<-host> I<hostname>
 
@@ -166,17 +167,19 @@ Host to connect to; use B<-connect> instead.
 
 Connect to the specified port; use B<-connect> instead.
 
-=item B<-bind> I<host:port>
+=item B<-bind> I<host>:I<port>
 
 This specifies the host address and or port to bind as the source for the
 connection.  For Unix-domain sockets the port is ignored and the host is
 used as the source socket address.
+If the host string is an IPv6 address, it must be enclosed in C<[> and C<]>.
 
-=item B<-proxy> I<host:port>
+=item B<-proxy> I<host>:I<port>
 
 When used with the B<-connect> flag, the program uses the host and port
 specified with this flag and issues an HTTP CONNECT command to connect
 to the desired server.
+If the host string is an IPv6 address, it must be enclosed in C<[> and C<]>.
 
 =item B<-proxy_user> I<userid>
 
@@ -260,7 +263,9 @@ See L<openssl-format-options(1)> for details.
 
 =item B<-crl_download>
 
-Download CRL from distribution points in the certificate.
+Download CRL from distribution points in the certificate. Note that this option
+is ignored if B<-crl_check> option is not provided. Note that the maximum size
+of CRL is limited by L<X509_CRL_load_http(3)> function.
 
 =item B<-key> I<filename>|I<uri>
 
@@ -282,14 +287,20 @@ see L<openssl-passphrase-options(1)>.
 
 The verify depth to use. This specifies the maximum length of the
 server certificate chain and turns on server certificate verification.
-Currently the verify operation continues after errors so all the problems
+Unless the B<-verify_return_error> option is given,
+the verify operation continues after errors so all the problems
 with a certificate chain can be seen. As a side effect the connection
 will never fail due to a server certificate verify failure.
 
+By default, validation of server certificates and their chain
+is done w.r.t. the (D)TLS Server (C<sslserver>) purpose.
+For details see L<openssl-verification-options(1)/Certificate Extensions>.
+
 =item B<-verify_return_error>
 
-Return verification errors instead of continuing. This will typically
-abort the handshake with a fatal error.
+Turns on server certificate verification, like with B<-verify>,
+but returns verification errors instead of continuing.
+This will typically abort the handshake with a fatal error.
 
 =item B<-verify_quiet>
 
@@ -799,10 +810,11 @@ proceed unless the B<-verify_return_error> option is used.
 
 =item I<host>:I<port>
 
-Rather than providing B<-connect>, the target hostname and optional port may
+Rather than providing B<-connect>, the target host and optional port may
 be provided as a single positional argument after all options. If neither this
 nor B<-connect> are provided, falls back to attempting to connect to
 I<localhost> on port I<4433>.
+If the host string is an IPv6 address, it must be enclosed in C<[> and C<]>.
 
 =back
 
@@ -881,6 +893,51 @@ option: any verify errors are then returned aborting the handshake.
 The B<-bind> option may be useful if the server or a firewall requires
 connections to come from some particular address and or port.
 
+=head2 Note on Non-Interactive Use
+
+When B<s_client> is run in a non-interactive environment (e.g., a cron job or
+a script without a valid I<stdin>), it may close the connection prematurely,
+especially with TLS 1.3. To prevent this, you can use the B<-ign_eof> flag,
+which keeps B<s_client> running even after reaching EOF from I<stdin>.
+
+For example:
+
+ openssl s_client -connect <server address>:443 -tls1_3
+                  -sess_out /path/to/tls_session_params_file
+                  -ign_eof </dev/null
+
+However, relying solely on B<-ign_eof> can lead to issues if the server keeps
+the connection open, expecting the client to close first. In such cases, the
+client may hang indefinitely. This behavior is not uncommon, particularly with
+protocols where the server waits for a graceful disconnect from the client.
+
+For example, when connecting to an SMTP server, the session may pause if the
+server expects a QUIT command before closing:
+
+ $ openssl s_client -brief -ign_eof -starttls smtp
+                    -connect <server address>:25 </dev/null
+ CONNECTION ESTABLISHED
+ Protocol version: TLSv1.3
+ Ciphersuite: TLS_AES_256_GCM_SHA384
+ ...
+ 250 CHUNKING
+ [long pause]
+
+To avoid such hangs, it's better to use an application-level command to
+initiate a clean disconnect. For SMTP, you can send a QUIT command:
+
+ printf 'QUIT\r\n' | openssl s_client -connect <server address>:25
+                                      -starttls smtp -brief -ign_eof
+
+Similarly, for HTTP/1.1 connections, including a `Connection: close` header
+ensures the server closes the connection after responding:
+
+ printf 'GET / HTTP/1.1\r\nHost: <server address>\r\nConnection: close\r\n\r\n'
+     | openssl s_client -connect <server address>:443 -brief
+
+These approaches help manage the connection closure gracefully and prevent
+hangs caused by the server waiting for the client to initiate the disconnect.
+
 =head1 BUGS
 
 Because this program has a lot of options and also because some of the
diff --git a/deps/openssl/openssl/doc/man1/openssl-s_server.pod.in b/deps/openssl/openssl/doc/man1/openssl-s_server.pod.in
index 99a252a8225..f0825ad33d1 100644
--- a/deps/openssl/openssl/doc/man1/openssl-s_server.pod.in
+++ b/deps/openssl/openssl/doc/man1/openssl-s_server.pod.in
@@ -74,7 +74,7 @@ B<openssl> B<s_server>
 [B<-status>]
 [B<-status_verbose>]
 [B<-status_timeout> I<int>]
-[B<-proxy> I<[http[s]://][userinfo@]host[:port][/path]>]
+[B<-proxy> I<[http[s]://][userinfo@]host[:port][/path][?query][#fragment]>]
 [B<-no_proxy> I<addresses>]
 [B<-status_url> I<val>]
 [B<-status_file> I<infile>]
@@ -202,6 +202,10 @@ must supply a certificate or an error occurs.
 If the cipher suite cannot request a client certificate (for example an
 anonymous cipher suite or PSK) this option has no effect.
 
+By default, validation of any supplied client certificate and its chain
+is done w.r.t. the (D)TLS Client (C<sslclient>) purpose.
+For details see L<openssl-verification-options(1)/Certificate Extensions>.
+
 =item B<-cert> I<infile>
 
 The certificate to use, most servers cipher suites require the use of a
@@ -504,13 +508,14 @@ a verbose printout of the OCSP response.
 
 Sets the timeout for OCSP response to I<int> seconds.
 
-=item B<-proxy> I<[http[s]://][userinfo@]host[:port][/path]>
+=item B<-proxy> I<[http[s]://][userinfo@]host[:port][/path][?query][#fragment]>
 
 The HTTP(S) proxy server to use for reaching the OCSP server unless B<-no_proxy>
 applies, see below.
+If the host string is an IPv6 address, it must be enclosed in C<[> and C<]>.
 The proxy port defaults to 80 or 443 if the scheme is C<https>; apart from that
 the optional C<http://> or C<https://> prefix is ignored,
-as well as any userinfo and path components.
+as well as any userinfo, path, query, and fragment components.
 Defaults to the environment variable C<http_proxy> if set, else C<HTTP_PROXY>
 in case no TLS is used, otherwise C<https_proxy> if set, else C<HTTPS_PROXY>.
 
diff --git a/deps/openssl/openssl/doc/man1/openssl-s_time.pod.in b/deps/openssl/openssl/doc/man1/openssl-s_time.pod.in
index 2b82cf1e983..ca41f59362f 100644
--- a/deps/openssl/openssl/doc/man1/openssl-s_time.pod.in
+++ b/deps/openssl/openssl/doc/man1/openssl-s_time.pod.in
@@ -50,6 +50,7 @@ Print out a usage message.
 =item B<-connect> I<host>:I<port>
 
 This specifies the host and optional port to connect to.
+If the host string is an IPv6 address, it must be enclosed in C<[> and C<]>.
 
 =item B<-www> I<page>
 
diff --git a/deps/openssl/openssl/doc/man1/openssl-smime.pod.in b/deps/openssl/openssl/doc/man1/openssl-smime.pod.in
index 0b5dbb5df8f..ffd09704f83 100644
--- a/deps/openssl/openssl/doc/man1/openssl-smime.pod.in
+++ b/deps/openssl/openssl/doc/man1/openssl-smime.pod.in
@@ -394,9 +394,9 @@ Verify a message and extract the signer's certificate if successful:
 
 Send encrypted mail using triple DES:
 
- openssl smime -encrypt -in in.txt -from steve@openssl.org \
+ openssl smime -encrypt -in in.txt -out mail.msg -from steve@openssl.org \
         -to someone@somewhere -subject "Encrypted message" \
-        -des3 user.pem -out mail.msg
+        -des3 user.pem
 
 Sign and encrypt mail:
 
diff --git a/deps/openssl/openssl/doc/man1/openssl-ts.pod.in b/deps/openssl/openssl/doc/man1/openssl-ts.pod.in
index 5f4895b34d6..cd6dfd5305f 100644
--- a/deps/openssl/openssl/doc/man1/openssl-ts.pod.in
+++ b/deps/openssl/openssl/doc/man1/openssl-ts.pod.in
@@ -584,10 +584,12 @@ To verify a timestamp reply that includes the certificate chain:
         -CAfile cacert.pem
 
 To verify a timestamp token against the original data file:
+
   openssl ts -verify -data design2.txt -in design2.tsr \
         -CAfile cacert.pem
 
 To verify a timestamp token against a message imprint:
+
   openssl ts -verify -digest b7e5d3f93198b38379852f2c04e78d73abdd0f4b \
          -in design2.tsr -CAfile cacert.pem
 
diff --git a/deps/openssl/openssl/doc/man1/openssl-verification-options.pod b/deps/openssl/openssl/doc/man1/openssl-verification-options.pod
index bf9ed9c1a62..17fcd4eb79f 100644
--- a/deps/openssl/openssl/doc/man1/openssl-verification-options.pod
+++ b/deps/openssl/openssl/doc/man1/openssl-verification-options.pod
@@ -24,8 +24,9 @@ The most important of them are detailed in the following sections.
 In a nutshell, a valid chain of certificates needs to be built up and verified
 starting from the I<target certificate> that is to be verified
 and ending in a certificate that due to some policy is trusted.
-Verification is done relative to the given I<purpose>, which is the intended use
-of the target certificate, such as SSL server, or by default for any purpose.
+Certificate validation can be performed in the context of a I<purpose>, which
+is a high-level specification of the intended use of the target certificate,
+such as C<sslserver> for TLS servers, or (by default) for any purpose.
 
 The details of how each OpenSSL command handles errors
 are documented on the specific command page.
@@ -150,16 +151,17 @@ the chain components and their links are checked thoroughly.
 The first step is to check that each certificate is well-formed.
 Part of these checks are enabled only if the B<-x509_strict> option is given.
 
-The second step is to check the extensions of every untrusted certificate
-for consistency with the supplied purpose.
-If the B<-purpose> option is not given then no such checks are done
-except for SSL/TLS connection setup,
-where by default C<sslserver> or C<sslclient>, are checked.
-The target or "leaf" certificate, as well as any other untrusted certificates,
-must have extensions compatible with the specified purpose.
-All certificates except the target or "leaf" must also be valid CA certificates.
-The precise extensions required are described in more detail in
-L<openssl-x509(1)/CERTIFICATE EXTENSIONS>.
+The second step is to check the X.509v3 extensions of every certificate
+for consistency with the intended specific purpose, if any.
+If the B<-purpose> option is not given then no such checks are done except for
+CMS signature checking, where by default C<smimesign> is checked, and SSL/(D)TLS
+connection setup, where by default C<sslserver> or C<sslclient> are checked.
+The X.509v3 extensions of the target or "leaf" certificate
+must be compatible with the specified purpose.
+All other certificates down the chain are checked to be valid CA certificates,
+and possibly also further non-standard checks are performed.
+The precise extensions required are described in detail
+in the L</Certificate Extensions> section below.
 
 The third step is to check the trust settings on the last certificate
 (which typically is a self-signed root CA certificate).
@@ -455,13 +457,16 @@ Set policy variable inhibit-policy-mapping (see RFC5280).
 
 =item B<-purpose> I<purpose>
 
-The intended use for the certificate.
-Currently defined purposes are C<sslclient>, C<sslserver>, C<nssslserver>,
+A high-level specification of the intended use of the target certificate.
+Currently predefined purposes are C<sslclient>, C<sslserver>, C<nssslserver>,
 C<smimesign>, C<smimeencrypt>, C<crlsign>, C<ocsphelper>, C<timestampsign>,
 and C<any>.
 If peer certificate verification is enabled, by default the TLS implementation
-as well as the commands B<s_client> and B<s_server> check for consistency
-with TLS server or TLS client use, respectively.
+and thus the commands L<openssl-s_client(1)> and L<openssl-s_server(1)>
+check for consistency with
+TLS server (C<sslserver>) or TLS client use (C<sslclient>), respectively.
+By default, CMS signature validation, which can be done via L<openssl-cms(1)>,
+checks for consistency with S/MIME signing use (C<smimesign>).
 
 While IETF RFC 5280 says that B<id-kp-serverAuth> and B<id-kp-clientAuth>
 are only for WWW use, in practice they are used for all kinds of TLS clients
@@ -491,19 +496,20 @@ the subject certificate.
 
 =item B<-verify_name> I<name>
 
-Use default verification policies like trust model and required certificate
-policies identified by I<name>.
+Use a set of verification parameters, also known as verification method,
+identified by I<name>. The currently predefined methods are named C<ssl_client>,
+C<ssl_server>, C<smime_sign> with alias C<pkcs7>, and C<default>.
+These mimic the combinations of purpose and trust settings used in SSL/(D)TLS,
+and CMS/PKCS7 (including S/MIME).
+
+The verification parameters include the trust model, various flags that can
+partly be set also via other command-line options, and the verification purpose,
+which in turn implies certificate key usage and extended key usage requirements.
+
 The trust model determines which auxiliary trust or reject OIDs are applicable
 to verifying the given certificate chain.
 They can be given using the B<-addtrust> and B<-addreject> options
 for L<openssl-x509(1)>.
-Supported policy names include: B<default>, B<pkcs7>, B<smime_sign>,
-B<ssl_client>, B<ssl_server>.
-These mimics the combinations of purpose and trust settings used in SSL, CMS
-and S/MIME.
-As of OpenSSL 1.1.0, the trust model is inferred from the purpose when not
-specified, so the B<-verify_name> options are functionally equivalent to the
-corresponding B<-purpose> settings.
 
 =back
 
@@ -548,9 +554,8 @@ This option has no effect and is retained for backward compatibility only.
 
 =head2 Certificate Extensions
 
-Options like B<-purpose> lead to checking the certificate extensions,
-which determine what the target certificate and intermediate CA certificates
-can be used for.
+Options like B<-purpose> and B<-verify_name> trigger the processing of specific
+certificate extensions, which determine what certificates can be used for.
 
 =head3 Basic Constraints
 
@@ -574,87 +579,117 @@ keyCertSign bit set if the keyUsage extension is present.
 
 =head3 Extended Key Usage
 
-The extKeyUsage (EKU) extension places additional restrictions on the
-certificate uses. If this extension is present (whether critical or not)
-the key can only be used for the purposes specified.
-
-A complete description of each check is given below. The comments about
+The extKeyUsage (EKU) extension places additional restrictions on
+certificate use. If this extension is present (whether critical or not)
+in an end-entity certficiate, the key is allowed only for the uses specified,
+while the special EKU B<anyExtendedKeyUsage> allows for all uses.
+
+Note that according to RFC 5280 section 4.2.1.12,
+the Extended Key Usage extension will appear only in end-entity certificates,
+and consequently the standard certification path validation described
+in its section 6 does not include EKU checks for CA certificates.
+The CA/Browser Forum requires for TLS server, S/MIME, and code signing use
+the presence of respective EKUs in subordinate CA certificates (while excluding
+them for root CA certificates), while taking over from RFC 5280
+the certificate validity concept and certificate path validation.
+
+For historic reasons, OpenSSL has its own way of interpreting and checking
+EKU extensions on CA certificates, which may change in the future.
+It does not require the presence of EKU extensions in CA certificates,
+but in case the verification purpose is
+C<sslclient>, C<nssslserver>, C<sslserver>, C<smimesign>, or C<smimeencrypt>,
+it checks that any present EKU extension (that does not contain
+B<anyExtendedKeyUsage>) contains the respective EKU as detailed below.
+Moreover, it does these checks even for trust anchor certificates.
+
+=head3 Checks Implied by Specific Predefined Policies
+
+A specific description of each check is given below. The comments about
 basicConstraints and keyUsage and X.509v1 certificates above apply to B<all>
 CA certificates.
 
-
 =over 4
 
-=item B<SSL Client>
+=item B<(D)TLS Client> (C<sslclient>)
 
-The extended key usage extension must be absent or include the "web client
-authentication" OID.  The keyUsage extension must be absent or it must have the
-digitalSignature bit set.  The Netscape certificate type must be absent
-or it must have the SSL client bit set.
+Any given extended key usage extension must allow for C<clientAuth>
+("TLS WWW client authentication").
 
-=item B<SSL Client CA>
+For target certificates,
+the key usage must allow for C<digitalSignature> and/or C<keyAgreement>.
+The Netscape certificate type must be absent or have the SSL client bit set.
 
-The extended key usage extension must be absent or include the "web client
-authentication" OID.
-The Netscape certificate type must be absent or it must have the SSL CA bit set.
-This is used as a work around if the basicConstraints extension is absent.
+For all other certificates the normal CA checks apply. In addition,
+the Netscape certificate type must be absent or have the SSL CA bit set.
+This is used as a workaround if the basicConstraints extension is absent.
 
-=item B<SSL Server>
+=item B<(D)TLS Server> (C<sslserver>)
 
-The extended key usage extension must be absent or include the "web server
-authentication" and/or one of the SGC OIDs.  The keyUsage extension must be
-absent or it
-must have the digitalSignature, the keyEncipherment set or both bits set.
-The Netscape certificate type must be absent or have the SSL server bit set.
+Any given extended key usage extension must allow for C<serverAuth>
+("TLS WWW server authentication") and/or include one of the SGC OIDs.
 
-=item B<SSL Server CA>
+For target certificates, the key usage must
+allow for C<digitalSignature>, C<keyEncipherment>, and/or C<keyAgreement>.
+The Netscape certificate type must be absent or have the SSL server bit set.
 
-The extended key usage extension must be absent or include the "web server
-authentication" and/or one of the SGC OIDs.  The Netscape certificate type must
-be absent or the SSL CA bit must be set.
-This is used as a work around if the basicConstraints extension is absent.
+For all other certificates the normal CA checks apply. In addition,
+the Netscape certificate type must be absent or have the SSL CA bit set.
+This is used as a workaround if the basicConstraints extension is absent.
 
-=item B<Netscape SSL Server>
+=item B<Netscape SSL Server> (C<nssslserver>)
 
-For Netscape SSL clients to connect to an SSL server it must have the
-keyEncipherment bit set if the keyUsage extension is present. This isn't
+In addition to what has been described for B<sslserver>, for a Netscape
+SSL client to connect to an SSL server, its EE certficate must have the
+B<keyEncipherment> bit set if the keyUsage extension is present. This isn't
 always valid because some cipher suites use the key for digital signing.
 Otherwise it is the same as a normal SSL server.
 
-=item B<Common S/MIME Client Tests>
+=item B<Common S/MIME Checks>
 
-The extended key usage extension must be absent or include the "email
-protection" OID.  The Netscape certificate type must be absent or should have the
-S/MIME bit set. If the S/MIME bit is not set in the Netscape certificate type
+Any given extended key usage extension must allow for C<emailProtection>.
+
+For target certificates,
+the Netscape certificate type must be absent or should have the S/MIME bit set.
+If the S/MIME bit is not set in the Netscape certificate type
 then the SSL client bit is tolerated as an alternative but a warning is shown.
 This is because some Verisign certificates don't set the S/MIME bit.
 
-=item B<S/MIME Signing>
+For all other certificates the normal CA checks apply. In addition,
+the Netscape certificate type must be absent or have the S/MIME CA bit set.
+This is used as a workaround if the basicConstraints extension is absent.
+
+=item B<S/MIME Signing> (C<smimesign>)
+
+In addition to the common S/MIME checks, for target certficiates
+the key usage must allow for C<digitalSignature> and/or B<nonRepudiation>.
+
+=item B<S/MIME Encryption> (C<smimeencrypt>)
+
+In addition to the common S/MIME checks, for target certficiates
+the key usage must allow for C<keyEncipherment>.
 
-In addition to the common S/MIME client tests the digitalSignature bit or
-the nonRepudiation bit must be set if the keyUsage extension is present.
+=item B<CRL Signing> (C<crlsign>)
 
-=item B<S/MIME Encryption>
+For target certificates, the key usage must allow for C<cRLSign>.
 
-In addition to the common S/MIME tests the keyEncipherment bit must be set
-if the keyUsage extension is present.
+For all other certifcates the normal CA checks apply.
+Except in this case the basicConstraints extension must be present.
 
-=item B<S/MIME CA>
+=item B<OCSP Helper> (C<ocsphelper>)
 
-The extended key usage extension must be absent or include the "email
-protection" OID.  The Netscape certificate type must be absent or must have the
-S/MIME CA bit set.
-This is used as a work around if the basicConstraints extension is absent.
+For target certificates, no checks are performed at this stage,
+but special checks apply; see L<OCSP_basic_verify(3)>.
 
-=item B<CRL Signing>
+For all other certifcates the normal CA checks apply.
 
-The keyUsage extension must be absent or it must have the CRL signing bit
-set.
+=item B<Timestamp Signing> (C<timestampsign>)
 
-=item B<CRL Signing CA>
+For target certificates, if the key usage extension is present, it must include
+C<digitalSignature> and/or C<nonRepudiation> and must not include other bits.
+The EKU extension must be present and contain C<timeStamping> only.
+Moreover, it must be marked as critical.
 
-The normal CA tests apply. Except in this case the basicConstraints extension
-must be present.
+For all other certifcates the normal CA checks apply.
 
 =back
 
@@ -671,6 +706,7 @@ only the first one (in the mentioned order of locations) is recognised.
 =head1 SEE ALSO
 
 L<X509_verify_cert(3)>,
+L<OCSP_basic_verify(3)>,
 L<openssl-verify(1)>,
 L<openssl-ocsp(1)>,
 L<openssl-ts(1)>,
diff --git a/deps/openssl/openssl/doc/man1/openssl.pod b/deps/openssl/openssl/doc/man1/openssl.pod
index 201428e8700..4865e5c33e6 100644
--- a/deps/openssl/openssl/doc/man1/openssl.pod
+++ b/deps/openssl/openssl/doc/man1/openssl.pod
@@ -653,111 +653,22 @@ See L<property(7)> for a more detailed description.
 
 =head1 ENVIRONMENT
 
-The OpenSSL library can be take some configuration parameters from the
-environment.  Some of these variables are listed below.  For information
-about specific commands, see L<openssl-engine(1)>,
-L<openssl-rehash(1)>, and L<tsget(1)>.
-
-For information about the use of environment variables in configuration,
-see L<config(5)/ENVIRONMENT>.
-
-For information about querying or specifying CPU architecture flags, see
-L<OPENSSL_ia32cap(3)>, and L<OPENSSL_s390xcap(3)>.
+The OpenSSL libraries can take some configuration parameters from the
+environment.
 
 For information about all environment variables used by the OpenSSL libraries,
+such as B<OPENSSL_CONF>, B<OPENSSL_MODULES>, and B<OPENSSL_TRACE>,
 see L<openssl-env(7)>.
 
-=over 4
-
-=item B<OPENSSL_TRACE=>I<name>[,...]
-
-Enable tracing output of OpenSSL library, by name.
-This output will only make sense if you know OpenSSL internals well.
-Also, it might not give you any output at all, depending on how
-OpenSSL was built.
-
-The value is a comma separated list of names, with the following
-available:
-
-=over 4
-
-=item B<TRACE>
-
-Traces the OpenSSL trace API itself.
-
-=item B<INIT>
-
-Traces OpenSSL library initialization and cleanup.
-
-=item B<TLS>
-
-Traces the TLS/SSL protocol.
-
-=item B<TLS_CIPHER>
-
-Traces the ciphers used by the TLS/SSL protocol.
-
-=item B<CONF>
-
-Show details about provider and engine configuration.
-
-=item B<ENGINE_TABLE>
-
-The function that is used by RSA, DSA (etc) code to select registered
-ENGINEs, cache defaults and functional references (etc), will generate
-debugging summaries.
-
-=item B<ENGINE_REF_COUNT>
-
-Reference counts in the ENGINE structure will be monitored with a line
-of generated for each change.
-
-=item B<PKCS5V2>
-
-Traces PKCS#5 v2 key generation.
-
-=item B<PKCS12_KEYGEN>
-
-Traces PKCS#12 key generation.
-
-=item B<PKCS12_DECRYPT>
-
-Traces PKCS#12 decryption.
-
-=item B<X509V3_POLICY>
-
-Generates the complete policy tree at various points during X.509 v3
-policy evaluation.
-
-=item B<BN_CTX>
-
-Traces BIGNUM context operations.
-
-=item B<CMP>
-
-Traces CMP client and server activity.
-
-=item B<STORE>
-
-Traces STORE operations.
-
-=item B<DECODER>
-
-Traces decoder operations.
-
-=item B<ENCODER>
-
-Traces encoder operations.
-
-=item B<REF_COUNT>
-
-Traces decrementing certain ASN.1 structure references.
+For information about the use of environment variables in configuration,
+see L<config(5)/ENVIRONMENT>.
 
-=back
+For information about specific commands, see L<openssl-engine(1)>,
+L<openssl-rehash(1)>, and L<tsget(1)>.
 
-=back
+For information about querying or specifying CPU architecture flags, see
+L<OPENSSL_ia32cap(3)>, and L<OPENSSL_s390xcap(3)>.
 
-=head1 SEE ALSO
 
 L<openssl-asn1parse(1)>,
 L<openssl-ca(1)>,
diff --git a/deps/openssl/openssl/doc/man3/ASN1_TIME_set.pod b/deps/openssl/openssl/doc/man3/ASN1_TIME_set.pod
index 66d9fefe1af..bdef3fdbb15 100644
--- a/deps/openssl/openssl/doc/man3/ASN1_TIME_set.pod
+++ b/deps/openssl/openssl/doc/man3/ASN1_TIME_set.pod
@@ -102,8 +102,8 @@ functions check the syntax of the time structure I<s>.
 
 The ASN1_TIME_print(), ASN1_UTCTIME_print() and ASN1_GENERALIZEDTIME_print()
 functions print the time structure I<s> to BIO I<b> in human readable
-format. It will be of the format MMM DD HH:MM:SS YYYY [GMT], for example
-"Feb  3 00:55:52 2015 GMT", which does not include a newline.
+format. It will be of the format MMM DD HH:MM:SS[.s*] YYYY GMT, for example
+"Feb E<32>3 00:55:52 2015 GMT", which does not include a newline.
 If the time structure has invalid format it prints out "Bad time value" and
 returns an error. The output for generalized time may include a fractional part
 following the second.
@@ -179,6 +179,10 @@ starting with B<ASN1_UTCTIME> and B<ASN1_GENERALIZEDTIME> act only on that
 specific time format. The functions starting with B<ASN1_TIME> will operate on
 either format.
 
+Users familiar with RFC822 should note that when specifying the flag
+B<ASN1_DTFLGS_RFC822> the year will be formatted as documented above,
+i.e., using 4 digits, not 2 as specified in RFC822.
+
 =head1 BUGS
 
 ASN1_TIME_print(), ASN1_UTCTIME_print() and ASN1_GENERALIZEDTIME_print() do
@@ -272,7 +276,7 @@ The ASN1_TIME_compare() function was added in OpenSSL 1.1.1.
 
 =head1 COPYRIGHT
 
-Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2015-2025 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/openssl/doc/man3/ASN1_aux_cb.pod b/deps/openssl/openssl/doc/man3/ASN1_aux_cb.pod
index f87b51d5efa..9963ea13502 100644
--- a/deps/openssl/openssl/doc/man3/ASN1_aux_cb.pod
+++ b/deps/openssl/openssl/doc/man3/ASN1_aux_cb.pod
@@ -87,7 +87,7 @@ found for the purposes of reference counting.
 =item I<asn1_cb>
 
 A callback that will be invoked at various points during the processing of
-the the B<ASN1_VALLUE>. See below for further details.
+the B<ASN1_VALUE>. See below for further details.
 
 =item I<enc_offset>
 
@@ -97,7 +97,7 @@ will be saved if the B<ASN1_AFLG_ENCODING> flag has been set.
 =item I<asn1_const_cb>
 
 A callback that will be invoked at various points during the processing of
-the the B<ASN1_VALLUE>. This is used in preference to the I<asn1_cb> callback if
+the B<ASN1_VALUE>. This is used in preference to the I<asn1_cb> callback if
 the B<ASN1_AFLG_CONST_CB> flag is set. See below for further details.
 
 =back
@@ -274,7 +274,7 @@ B<ASN1_OP_GET0_PROPQ> operation types were added in OpenSSL 3.0.
 
 =head1 COPYRIGHT
 
-Copyright 2021-2023 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2021-2025 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/openssl/doc/man3/BIO_s_accept.pod b/deps/openssl/openssl/doc/man3/BIO_s_accept.pod
index 25a752998ca..22b3d35b737 100644
--- a/deps/openssl/openssl/doc/man3/BIO_s_accept.pod
+++ b/deps/openssl/openssl/doc/man3/BIO_s_accept.pod
@@ -169,16 +169,16 @@ BIO_set_bind_mode(), BIO_get_bind_mode() and BIO_do_accept() are macros.
 BIO_do_accept(),
 BIO_set_accept_name(), BIO_set_accept_port(), BIO_set_nbio_accept(),
 BIO_set_accept_bios(), BIO_set_accept_ip_family(), and BIO_set_bind_mode()
-return 1 for success and <=0 for failure.
+return 1 for success and <= 0 for failure.
 
 BIO_get_accept_name() returns the accept name or NULL on error.
 BIO_get_peer_name() returns the peer name or NULL on error.
 
 BIO_get_accept_port() returns the accept port as a string or NULL on error.
 BIO_get_peer_port() returns the peer port as a string or NULL on error.
-BIO_get_accept_ip_family() returns the IP family or <=0 on error.
+BIO_get_accept_ip_family() returns the IP family or <= 0 on error.
 
-BIO_get_bind_mode() returns the set of B<BIO_BIND> flags, or <=0 on failure.
+BIO_get_bind_mode() returns the set of B<BIO_BIND> flags, or <= 0 on failure.
 
 BIO_new_accept() returns a BIO or NULL on error.
 
diff --git a/deps/openssl/openssl/doc/man3/BIO_s_connect.pod b/deps/openssl/openssl/doc/man3/BIO_s_connect.pod
index ab813b32d03..a3c9e6428e4 100644
--- a/deps/openssl/openssl/doc/man3/BIO_s_connect.pod
+++ b/deps/openssl/openssl/doc/man3/BIO_s_connect.pod
@@ -59,7 +59,7 @@ a single call: that is it creates a new connect BIO with hostname B<name>.
 
 BIO_set_conn_hostname() uses the string B<name> to set the hostname.
 The hostname can be an IP address; if the address is an IPv6 one, it
-must be enclosed with brackets C<[> and C<]>.
+must be enclosed in brackets C<[> and C<]>.
 The hostname can also include the port in the form hostname:port;
 see L<BIO_parse_hostserv(3)> and BIO_set_conn_port() for details.
 
diff --git a/deps/openssl/openssl/doc/man3/ECDSA_sign.pod b/deps/openssl/openssl/doc/man3/ECDSA_sign.pod
index 7e564666533..88e851885a0 100644
--- a/deps/openssl/openssl/doc/man3/ECDSA_sign.pod
+++ b/deps/openssl/openssl/doc/man3/ECDSA_sign.pod
@@ -52,7 +52,7 @@ size use L<EVP_PKEY_sign(3)> with a NULL I<sig> parameter.
 
 ECDSA_sign() computes a digital signature of the I<dgstlen> bytes hash value
 I<dgst> using the private EC key I<eckey>. The DER encoded signatures is
-stored in I<sig> and its length is returned in I<sig_len>. Note: I<sig> must
+stored in I<sig> and its length is returned in I<siglen>. Note: I<sig> must
 point to ECDSA_size(eckey) bytes of memory. The parameter I<type> is currently
 ignored. ECDSA_sign() is wrapper function for ECDSA_sign_ex() with I<kinv>
 and I<rp> set to NULL.
@@ -82,7 +82,7 @@ used in a later call to ECDSA_sign_ex() or ECDSA_do_sign_ex().
 ECDSA_sign_ex() computes a digital signature of the I<dgstlen> bytes hash value
 I<dgst> using the private EC key I<eckey> and the optional pre-computed values
 I<kinv> and I<rp>. The DER encoded signature is stored in I<sig> and its
-length is returned in I<sig_len>. Note: I<sig> must point to ECDSA_size(eckey)
+length is returned in I<siglen>. Note: I<sig> must point to ECDSA_size(eckey)
 bytes of memory. The parameter I<type> is ignored.
 
 ECDSA_do_sign_ex() is similar to ECDSA_sign_ex() except the signature is
diff --git a/deps/openssl/openssl/doc/man3/EVP_EncryptInit.pod b/deps/openssl/openssl/doc/man3/EVP_EncryptInit.pod
index f037d135c9d..a4635f994c2 100644
--- a/deps/openssl/openssl/doc/man3/EVP_EncryptInit.pod
+++ b/deps/openssl/openssl/doc/man3/EVP_EncryptInit.pod
@@ -1284,6 +1284,15 @@ indicates whether the operation was successful. If it does not indicate success,
 the authentication operation has failed and any output data B<MUST NOT> be used
 as it is corrupted.
 
+Please note that the number of authenticated bytes returned by
+EVP_CipherUpdate() depends on the cipher used. Stream ciphers, such as ChaCha20
+or ciphers in GCM mode, can handle 1 byte at a time, resulting in an effective
+"block" size of 1. Conversely, ciphers in OCB mode must process data one block
+at a time, and the block size is returned.
+
+Regardless of the returned size, it is safe to pass unpadded data to an
+EVP_CipherUpdate() call in a single operation.
+
 =head2 GCM and OCB Modes
 
 The following I<ctrl>s are supported in GCM and OCB modes.
@@ -1319,10 +1328,9 @@ For GCM, this call is only valid when decrypting data.
 For OCB, this call is valid when decrypting data to set the expected tag,
 and when encrypting to set the desired tag length.
 
-In OCB mode, calling this when encrypting with C<tag> set to C<NULL> sets the
-tag length. The tag length can only be set before specifying an IV. If this is
-not called prior to setting the IV during encryption, then a default tag length
-is used.
+In OCB mode, calling this with C<tag> set to C<NULL> sets the tag length.
+The tag length can only be set before specifying an IV. If this is not called
+prior to setting the IV, then a default tag length is used.
 
 For OCB AES, the default tag length is 16 (i.e. 128 bits).  It is also the
 maximum tag length for OCB.
diff --git a/deps/openssl/openssl/doc/man3/EVP_PKEY_decapsulate.pod b/deps/openssl/openssl/doc/man3/EVP_PKEY_decapsulate.pod
index 819291627bb..cd6f5f0221a 100644
--- a/deps/openssl/openssl/doc/man3/EVP_PKEY_decapsulate.pod
+++ b/deps/openssl/openssl/doc/man3/EVP_PKEY_decapsulate.pod
@@ -25,10 +25,13 @@ specifying the private key to use.
 The EVP_PKEY_decapsulate() function performs a private key decapsulation
 operation using I<ctx>. The data to be decapsulated is specified using the
 I<wrapped> and I<wrappedlen> parameters.
-If I<unwrapped> is NULL then the maximum size of the output secret buffer
+If I<unwrapped> is NULL then the size of the output secret buffer
 is written to I<*unwrappedlen>. If I<unwrapped> is not NULL and the
 call is successful then the decapsulated secret data is written to I<unwrapped>
-and the amount of data written to I<*unwrappedlen>.
+and the amount of data written to I<*unwrappedlen>.  Note that, if I<unwrappedlen>
+is not NULL in this call, the value it points to must be initialised to the length of
+I<unwrapped>, so that the call can validate it is of sufficient size to hold the
+result of the operation.
 
 =head1 NOTES
 
@@ -57,7 +60,7 @@ Decapsulate data using RSA:
  unsigned char *secret = NULL;;
 
  ctx = EVP_PKEY_CTX_new_from_pkey(libctx, rsa_priv_key, NULL);
- if (ctx = NULL)
+ if (ctx == NULL)
      /* Error */
  if (EVP_PKEY_decapsulate_init(ctx, NULL) <= 0)
      /* Error */
diff --git a/deps/openssl/openssl/doc/man3/EVP_PKEY_encapsulate.pod b/deps/openssl/openssl/doc/man3/EVP_PKEY_encapsulate.pod
index 0ee7d627904..eb51836d795 100644
--- a/deps/openssl/openssl/doc/man3/EVP_PKEY_encapsulate.pod
+++ b/deps/openssl/openssl/doc/man3/EVP_PKEY_encapsulate.pod
@@ -35,7 +35,10 @@ unless I<genkeylen> is NULL.
 If I<wrappedkey> is not NULL and the call is successful then the
 internally generated key is written to I<genkey> and its size is written to
 I<*genkeylen>. The encapsulated version of the generated key is written to
-I<wrappedkey> and its size is written to I<*wrappedkeylen>.
+I<wrappedkey> and its size is written to I<*wrappedkeylen>.  Note that if
+I<wrappedlen> is not NULL, then the value it points to must initially hold the size of
+the  I<unwrapped> buffer so that its size can be validated by the call, ensuring
+it is large enough to hold the result written to I<wrapped>.
 
 =head1 NOTES
 
@@ -63,7 +66,7 @@ Encapsulate an RSASVE key (for RSA keys).
  unsigned char *out = NULL, *secret = NULL;
 
  ctx = EVP_PKEY_CTX_new_from_pkey(libctx, rsa_pub_key, NULL);
- if (ctx = NULL)
+ if (ctx == NULL)
      /* Error */
  if (EVP_PKEY_encapsulate_init(ctx, NULL) <= 0)
      /* Error */
diff --git a/deps/openssl/openssl/doc/man3/OSSL_CMP_CTX_new.pod b/deps/openssl/openssl/doc/man3/OSSL_CMP_CTX_new.pod
index cab88ae88c9..f2a38b0adef 100644
--- a/deps/openssl/openssl/doc/man3/OSSL_CMP_CTX_new.pod
+++ b/deps/openssl/openssl/doc/man3/OSSL_CMP_CTX_new.pod
@@ -355,8 +355,10 @@ If TLS is not used this defaults to the value of
 the environment variable C<http_proxy> if set, else C<HTTP_PROXY>.
 Otherwise defaults to the value of C<https_proxy> if set, else C<HTTPS_PROXY>.
 An empty proxy string specifies not to use a proxy.
-Else the format is C<[http[s]://]address[:port][/path]>,
-where any path given is ignored.
+Otherwise the format is
+C<[http[s]://][userinfo@]host[:port][/path][?query][#fragment]>,
+where any given userinfo, path, query, and fragment is ignored.
+If the host string is an IPv6 address, it must be enclosed in C<[> and C<]>.
 The default port number is 80, or 443 in case C<https:> is given.
 
 OSSL_CMP_CTX_set1_no_proxy() sets the list of server hostnames not to use
diff --git a/deps/openssl/openssl/doc/man3/OSSL_CMP_validate_msg.pod b/deps/openssl/openssl/doc/man3/OSSL_CMP_validate_msg.pod
index 555624a4035..c5e68065bef 100644
--- a/deps/openssl/openssl/doc/man3/OSSL_CMP_validate_msg.pod
+++ b/deps/openssl/openssl/doc/man3/OSSL_CMP_validate_msg.pod
@@ -44,7 +44,7 @@ any self-issued certificate from the I<msg> extraCerts field may be used
 as a trust anchor for the path verification of an 'acceptable' cert if it can be
 used also to validate the issued certificate returned in the IP message. This is
 according to TS 33.310 [Network Domain Security (NDS); Authentication Framework
-(AF)] document specified by the The 3rd Generation Partnership Project (3GPP).
+(AF)] document specified by The 3rd Generation Partnership Project (3GPP).
 Note that using this option is dangerous as the certificate obtained this way
 has not been authenticated (at least not at CMP level).
 Taking it over as a trust anchor implements trust-on-first-use (TOFU).
@@ -77,7 +77,7 @@ The OpenSSL CMP support was added in OpenSSL 3.0.
 
 =head1 COPYRIGHT
 
-Copyright 2007-2024 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2007-2025 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/openssl/doc/man3/OSSL_HTTP_parse_url.pod b/deps/openssl/openssl/doc/man3/OSSL_HTTP_parse_url.pod
index 768f0acdb14..4379c122d66 100644
--- a/deps/openssl/openssl/doc/man3/OSSL_HTTP_parse_url.pod
+++ b/deps/openssl/openssl/doc/man3/OSSL_HTTP_parse_url.pod
@@ -42,20 +42,25 @@ take any further default value from the C<HTTP_PROXY>
 environment variable, or from C<HTTPS_PROXY> if I<use_ssl> is nonzero.
 If I<no_proxy> is NULL, take any default exclusion value from the C<no_proxy>
 environment variable, or else from C<NO_PROXY>.
-Return the determined proxy hostname unless the exclusion contains I<server>.
+Return the determined proxy host unless the exclusion value,
+which is a list of proxy hosts separated by C<,> and/or whitespace,
+contains I<server>.
 Otherwise return NULL.
+When I<server> is a string delimited by C<[> and C<]>, which are used for IPv6
+addresses, the enclosing C<[> and C<]> are stripped prior to comparison.
 
 OSSL_parse_url() parses its input string I<url> as a URL of the form
 C<[scheme://][userinfo@]host[:port][/path][?query][#fragment]> and splits it up
 into scheme, userinfo, host, port, path, query, and fragment components.
 The host (or server) component may be a DNS name or an IP address
-where IPv6 addresses should be enclosed in square brackets C<[> and C<]>.
+where IPv6 addresses must be enclosed in square brackets C<[> and C<]>.
 The port component is optional and defaults to C<0>.
 If given, it must be in decimal form.  If the I<pport_num> argument is not NULL
 the integer value of the port number is assigned to I<*pport_num> on success.
 The path component is also optional and defaults to C</>.
 Each non-NULL result pointer argument I<pscheme>, I<puser>, I<phost>, I<pport>,
 I<ppath>, I<pquery>, and I<pfrag>, is assigned the respective url component.
+Any IPv6 address in I<*phost> is enclosed in C<[> and C<]>.
 On success, they are guaranteed to contain non-NULL string pointers, else NULL.
 It is the responsibility of the caller to free them using L<OPENSSL_free(3)>.
 If I<pquery> is NULL, any given query component is handled as part of the path.
@@ -70,7 +75,7 @@ and the scheme is C<https>, else 0.
 The port component is optional and defaults to C<443> if the scheme is C<https>,
 else C<80>.
 Note that relative paths must be given with a leading C</>,
-otherwise the first path element is interpreted as the hostname.
+otherwise the first path element is interpreted as the host.
 
 Calling the deprecated function OCSP_parse_url(url, host, port, path, ssl)
 is equivalent to
diff --git a/deps/openssl/openssl/doc/man3/OSSL_HTTP_transfer.pod b/deps/openssl/openssl/doc/man3/OSSL_HTTP_transfer.pod
index 716e365ef50..6da1d91b9f3 100644
--- a/deps/openssl/openssl/doc/man3/OSSL_HTTP_transfer.pod
+++ b/deps/openssl/openssl/doc/man3/OSSL_HTTP_transfer.pod
@@ -77,12 +77,14 @@ If TLS is not used this defaults to the environment variable C<http_proxy>
 if set, else C<HTTP_PROXY>.
 If I<use_ssl> != 0 it defaults to C<https_proxy> if set, else C<HTTPS_PROXY>.
 An empty proxy string C<""> forbids using a proxy.
-Else the format is
+Otherwise, the format is
 C<[http[s]://][userinfo@]host[:port][/path][?query][#fragment]>,
 where any userinfo, path, query, and fragment given is ignored.
+If the host string is an IPv6 address, it must be enclosed in C<[> and C<]>.
 The default proxy port number is 80, or 443 in case "https:" is given.
 The HTTP client functions connect via the given proxy unless the I<server>
-is found in the optional list I<no_proxy> of proxy hostnames (if not NULL;
+is found in the optional list I<no_proxy> of proxy hostnames or IP addresses
+separated by C<,> and/or whitespace (if not NULL;
 default is the environment variable C<no_proxy> if set, else C<NO_PROXY>).
 Proxying plain HTTP is supported directly,
 while using a proxy for HTTPS connections requires a suitable callback function
diff --git a/deps/openssl/openssl/doc/man3/OSSL_PARAM.pod b/deps/openssl/openssl/doc/man3/OSSL_PARAM.pod
index 1e5bf06cf76..22fd0f0d7dd 100644
--- a/deps/openssl/openssl/doc/man3/OSSL_PARAM.pod
+++ b/deps/openssl/openssl/doc/man3/OSSL_PARAM.pod
@@ -11,7 +11,7 @@ OSSL_PARAM - a structure to pass or request object parameters
  typedef struct ossl_param_st OSSL_PARAM;
  struct ossl_param_st {
      const char *key;             /* the name of the parameter */
-     unsigned char data_type;     /* declare what kind of content is in data */
+     unsigned int data_type;      /* declare what kind of content is in data */
      void *data;                  /* value being passed in or out */
      size_t data_size;            /* data size */
      size_t return_size;          /* returned size */
diff --git a/deps/openssl/openssl/doc/man3/OSSL_trace_enabled.pod b/deps/openssl/openssl/doc/man3/OSSL_trace_enabled.pod
index f9c9dffd8c6..bad5b151535 100644
--- a/deps/openssl/openssl/doc/man3/OSSL_trace_enabled.pod
+++ b/deps/openssl/openssl/doc/man3/OSSL_trace_enabled.pod
@@ -88,9 +88,10 @@ but rather uses a set of convenience macros, see the L</Macros> section below.
 OSSL_trace_enabled() can be used to check if tracing for the given
 I<category> is enabled.
 
-OSSL_trace_begin() is used to starts a tracing section, and get the
-channel for the given I<category> in form of a BIO.
+OSSL_trace_begin() is used to start a tracing section,
+and get the channel for the given I<category> in form of a BIO.
 This BIO can only be used for output.
+The pointer returned is NULL if the category is invalid or not enabled.
 
 OSSL_trace_end() is used to end a tracing section.
 
@@ -187,6 +188,9 @@ expands to
 
 =head1 NOTES
 
+It is not needed to guard trace output function calls like
+I<OSSL_TRACE(category, ...)> by I<OSSL_TRACE_ENABLED(category)>.
+
 If producing the trace output requires carrying out auxiliary calculations,
 this auxiliary code should be placed inside a conditional block which is
 executed only if the trace category is enabled.
diff --git a/deps/openssl/openssl/doc/man3/OpenSSL_version.pod b/deps/openssl/openssl/doc/man3/OpenSSL_version.pod
index 946bb151baf..e1cf16e2a10 100644
--- a/deps/openssl/openssl/doc/man3/OpenSSL_version.pod
+++ b/deps/openssl/openssl/doc/man3/OpenSSL_version.pod
@@ -211,14 +211,6 @@ automatically configured but may be set via an environment variable.
 The value has the same syntax as the environment variable.
 For x86 the string looks like C<OPENSSL_ia32cap=0x123:0x456>.
 
-=item OPENSSL_INFO_QUIC
-
-This is only defined when compiling with a QUIC-enabled version of
-OpenSSL. At run time, this will return "QUIC" if QUIC is supported.
-
-This can be used as a build time flag to determine if OpenSSL has
-QUIC enabled.
-
 =back
 
 For an unknown I<t>, NULL is returned.
diff --git a/deps/openssl/openssl/doc/man3/SSL_CIPHER_get_name.pod b/deps/openssl/openssl/doc/man3/SSL_CIPHER_get_name.pod
index a55ad4d980f..09b7280bdd5 100644
--- a/deps/openssl/openssl/doc/man3/SSL_CIPHER_get_name.pod
+++ b/deps/openssl/openssl/doc/man3/SSL_CIPHER_get_name.pod
@@ -13,7 +13,6 @@ SSL_CIPHER_get_digest_nid,
 SSL_CIPHER_get_handshake_digest,
 SSL_CIPHER_get_kx_nid,
 SSL_CIPHER_get_auth_nid,
-SSL_CIPHER_get_prf_nid,
 SSL_CIPHER_is_aead,
 SSL_CIPHER_find,
 SSL_CIPHER_get_id,
@@ -35,7 +34,6 @@ SSL_CIPHER_get_protocol_id
  const EVP_MD *SSL_CIPHER_get_handshake_digest(const SSL_CIPHER *c);
  int SSL_CIPHER_get_kx_nid(const SSL_CIPHER *c);
  int SSL_CIPHER_get_auth_nid(const SSL_CIPHER *c);
- int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
  int SSL_CIPHER_is_aead(const SSL_CIPHER *c);
  const SSL_CIPHER *SSL_CIPHER_find(SSL *ssl, const unsigned char *ptr);
  uint32_t SSL_CIPHER_get_id(const SSL_CIPHER *c);
@@ -93,15 +91,6 @@ TLS 1.3 cipher suites) B<NID_auth_any> is returned. Examples (not comprehensive)
  NID_auth_ecdsa
  NID_auth_psk
 
-SSL_CIPHER_get_prf_nid() retuns the pseudo-random function NID for B<c>. If B<c> is
-a pre-TLS-1.2 cipher, it returns B<NID_md5_sha1> but note these ciphers use
-SHA-256 in TLS 1.2. Other return values may be treated uniformly in all
-applicable versions. Examples (not comprehensive):
-
- NID_md5_sha1
- NID_sha256
- NID_sha384
-
 SSL_CIPHER_is_aead() returns 1 if the cipher B<c> is AEAD (e.g. GCM or
 ChaCha20/Poly1305), and 0 if it is not AEAD.
 
@@ -212,8 +201,6 @@ required to enable this function.
 
 The OPENSSL_cipher_name() function was added in OpenSSL 1.1.1.
 
-The SSL_CIPHER_get_prf_nid() function was added in OpenSSL 3.0.0.
-
 =head1 COPYRIGHT
 
 Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.
diff --git a/deps/openssl/openssl/doc/man3/SSL_CTX_new.pod b/deps/openssl/openssl/doc/man3/SSL_CTX_new.pod
index f467f93659b..627d9e7f0dc 100644
--- a/deps/openssl/openssl/doc/man3/SSL_CTX_new.pod
+++ b/deps/openssl/openssl/doc/man3/SSL_CTX_new.pod
@@ -104,10 +104,12 @@ On session establishment, by default, no peer credentials verification is done.
 This must be explicitly requested, typically using L<SSL_CTX_set_verify(3)>.
 For verifying peer certificates many options can be set using various functions
 such as L<SSL_CTX_load_verify_locations(3)> and L<SSL_CTX_set1_param(3)>.
-The L<X509_VERIFY_PARAM_set_purpose(3)> function can be used, also in conjunction
-with L<SSL_CTX_get0_param(3)>, to set the intended purpose of the session.
-The default is B<X509_PURPOSE_SSL_SERVER> on the client side
+
+The SSL/(D)TLS implementation uses the L<X509_STORE_CTX_set_default(3)>
+function to prepare checks for B<X509_PURPOSE_SSL_SERVER> on the client side
 and B<X509_PURPOSE_SSL_CLIENT> on the server side.
+The L<X509_VERIFY_PARAM_set_purpose(3)> function can be used, also in conjunction
+with L<SSL_CTX_get0_param(3)>, to override the default purpose of the session.
 
 The SSL_CTX object uses I<method> as the connection method.
 Three method variants are available: a generic method (for either client or
@@ -228,7 +230,7 @@ SSL_CTX_up_ref() returns 1 for success and 0 for failure.
 
 =head1 SEE ALSO
 
-L<SSL_CTX_set_options(3)>, L<SSL_CTX_free(3)>,
+L<SSL_CTX_set_options(3)>, L<SSL_CTX_free(3)>, L<X509_STORE_CTX_set_default(3)>,
 SSL_CTX_set_verify(3), L<SSL_CTX_set1_param(3)>, L<SSL_CTX_get0_param(3)>,
 L<SSL_connect(3)>, L<SSL_accept(3)>,
 L<SSL_CTX_set_min_proto_version(3)>, L<ssl(7)>, L<SSL_set_connect_state(3)>
diff --git a/deps/openssl/openssl/doc/man3/SSL_CTX_set_quic_method.pod b/deps/openssl/openssl/doc/man3/SSL_CTX_set_quic_method.pod
deleted file mode 100644
index aab5e38889b..00000000000
--- a/deps/openssl/openssl/doc/man3/SSL_CTX_set_quic_method.pod
+++ /dev/null
@@ -1,262 +0,0 @@
-=pod
-
-=head1 NAME
-
-SSL_QUIC_METHOD,
-OSSL_ENCRYPTION_LEVEL,
-SSL_CTX_set_quic_method,
-SSL_set_quic_method,
-SSL_set_quic_transport_params,
-SSL_get_peer_quic_transport_params,
-SSL_quic_max_handshake_flight_len,
-SSL_quic_read_level,
-SSL_quic_write_level,
-SSL_provide_quic_data,
-SSL_process_quic_post_handshake,
-SSL_is_quic,
-SSL_get_peer_quic_transport_version,
-SSL_get_quic_transport_version,
-SSL_set_quic_transport_version,
-SSL_set_quic_use_legacy_codepoint,
-SSL_set_quic_early_data_enabled
-- QUIC support
-
-=head1 SYNOPSIS
-
- #include <openssl/ssl.h>
-
- typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
- typedef enum ssl_encryption_level_t OSSL_ENCRYPTION_LEVEL;
-
- int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
- int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
- int SSL_set_quic_transport_params(SSL *ssl,
-                                   const uint8_t *params,
-                                   size_t params_len);
- void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                         const uint8_t **out_params,
-                                         size_t *out_params_len);
- size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
- OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
- OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
- int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                           const uint8_t *data, size_t len);
- int SSL_process_quic_post_handshake(SSL *ssl);
- int SSL_is_quic(SSL *ssl);
-
- void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
- void SSL_set_quic_transport_version(SSL *ssl, int version);
- int SSL_get_quic_transport_version(const SSL *ssl);
- int SSL_get_peer_quic_transport_version(const SSL *ssl);
- void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-=head1 DESCRIPTION
-
-SSL_CTX_set_quic_method() and SSL_set_quic_method() configures the QUIC methods.
-This should only be configured with a minimum version of TLS 1.3. B<quic_method>
-must remain valid for the lifetime of B<ctx> or B<ssl>. Calling this disables
-the SSL_OP_ENABLE_MIDDLEBOX_COMPAT option, which is not required for QUIC.
-
-SSL_set_quic_transport_params() configures B<ssl> to send B<params> (of length
-B<params_len>) in the quic_transport_parameters extension in either the
-ClientHello or EncryptedExtensions handshake message. This extension will
-only be sent if the TLS version is at least 1.3, and for a server, only if
-the client sent the extension. The buffer pointed to by B<params> only need be
-valid for the duration of the call to this function.
-
-SSL_get_peer_quic_transport_params() provides the caller with the value of the
-quic_transport_parameters extension sent by the peer. A pointer to the buffer
-containing the TransportParameters will be put in B<*out_params>, and its
-length in B<*out_params_len>. This buffer will be valid for the lifetime of the
-B<ssl>. If no params were received from the peer, B<*out_params_len> will be 0.
-
-SSL_quic_max_handshake_flight_len() returns the maximum number of bytes
-that may be received at the given encryption level. This function should be
-used to limit buffering in the QUIC implementation.
-
-See L<https://tools.ietf.org/html/RFC9000#section-4>.
-
-SSL_quic_read_level() returns the current read encryption level.
-
-SSL_quic_write_level() returns the current write encryption level.
-
-SSL_provide_quic_data() is used to provide data from QUIC CRYPTO frames to the
-state machine, at a particular encryption level B<level>. It is an error to
-call this function with an encryption level less than the current read level.
-It returns one on success and zero on error.
-
-SSL_process_quic_post_handshake() processes any data that QUIC has provided
-after the handshake has completed. This includes NewSessionTicket messages
-sent by the server.
-
-SSL_is_quic() indicates whether a connection uses QUIC.  A given B<SSL>
-or B<SSL_CTX> can only be used with QUIC or TLS, but not both.
-
-SSL_set_quic_use_legacy_codepoint() specifies the legacy extension codepoint
-in manner compatible with some versions of BoringSSL.
-
-SSL_set_quic_transport_version() specifies the quic transport version that
-allows for backwards and forwards compatibility. If set to 0 (default) the
-server will use the highest version the client sent. If set to 0 (default)
-the client will send both extensions.
-
-SSL_get_quic_transport_version() returns the value set by
-SSL_set_quic_transport_version().
-
-SSL_get_peer_quic_transport_version() returns the version the that was
-negotiated.
-
-SSL_set_quic_early_data_enabled() enables QUIC early data if a nonzero
-value is passed.  Clients must set a resumed session before calling this
-function.  Servers must additionally call SSL_CTX_set_max_early_data() or
-SSL_set_max_early_data() with 0xffffffffu as the argument, so that any
-issued session tickets indicate that server is able to accept early data.
-
-=head1 NOTES
-
-These APIs are implementations of BoringSSL's QUIC APIs.
-
-QUIC acts as an underlying transport for the TLS 1.3 handshake. The following
-functions allow a QUIC implementation to serve as the underlying transport as
-described in RFC9001.
-
-When configured for QUIC, SSL_do_handshake() will drive the handshake as
-before, but it will not use the configured B<BIO>. It will call functions from
-the configured B<SSL_QUIC_METHOD> to configure secrets and send data. If data
-is needed from the peer, it will return B<SSL_ERROR_WANT_READ>. When received,
-the caller should call SSL_provide_quic_data() and then SSL_do_handshake() to
-continue the handshake. After the handshake is complete, the caller should call
-SSL_provide_quic_data() for any post-handshake data, followed by
-SSL_process_quic_post_handshake() to process it. It is an error to call
-SSL_read()/SSL_read_ex() and SSL_write()/SSL_write_ex() in QUIC.
-
-Note that secrets for an encryption level may be available to QUIC before the
-level is active in TLS. Callers should use SSL_quic_read_level() to determine
-the active read level for SSL_provide_quic_data(). SSL_do_handshake() will
-pass the active write level to add_handshake_data() when writing data. Callers
-can use SSL_quic_write_level() to query the active write level when
-generating their own errors.
-
-See L<https://tools.ietf.org/html/RFC9001#section-4.1> for more details.
-
-To avoid amplifying DoS attacks, the QUIC implementation must limit the amount
-of data being queued up. The implementation can call
-SSL_quic_max_handshake_flight_len() to get the maximum buffer length at each
-encryption level.
-
-RFC9001 defines a new TLS extension "quic_transport_parameters"
-used by QUIC for each endpoint to unilaterally declare its supported
-transport parameters. The contents of the extension are specified in
-L<https://tools.ietf.org/html/RFC9000#section-18> (as
-a sequence of tag/length/value parameters) along with the interpretation of the
-various parameters and the rules for their processing.
-
-OpenSSL handles this extension as an opaque byte string. The caller is
-responsible for serializing and parsing it.
-
-=head2 OSSL_ENCRYPTION_LEVEL
-
-B<OSSL_ENCRYPTION_LEVEL> (B<enum ssl_encryption_level_t>) represents the
-encryption levels:
-
-=over 4
-
-=item ssl_encryption_initial
-
-The initial encryption level that is used for client and server hellos.
-
-=item ssl_encryption_early_data
-
-The encryption level for early data. This is a write-level for the client
-and a read-level for the server.
-
-=item ssl_encryption_handshake
-
-The encryption level for the remainder of the handshake.
-
-=item ssl_encryption_application
-
-The encryption level for the application data.
-
-=back
-
-=head2 SSL_QUIC_METHOD
-
-The B<SSL_QUIC_METHOD> (B<struct ssl_quic_method_st>) describes the
-QUIC methods.
-
- struct ssl_quic_method_st {
-     int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                   const uint8_t *read_secret,
-                                   const uint8_t *write_secret, size_t secret_len);
-     int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                               const uint8_t *data, size_t len);
-     int (*flush_flight)(SSL *ssl);
-     int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
- };
- typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-set_encryption_secrets() configures the read and write secrets for the given
-encryption level. This function will always be called before an encryption
-level other than B<ssl_encryption_initial> is used. Note, however, that
-secrets for a level may be configured before TLS is ready to send or accept
-data at that level.
-
-When reading packets at a given level, the QUIC implementation must send
-ACKs at the same level, so this function provides read and write secrets
-together. The exception is B<ssl_encryption_early_data>, where secrets are
-only available in the client to server direction. The other secret will be
-NULL. The server acknowledges such data at B<ssl_encryption_application>,
-which will be configured in the same SSL_do_handshake() call.
-
-add_handshake_data() adds handshake data to the current flight at the given
-encryption level. It returns one on success and zero on error.
-
-OpenSSL will pack data from a single encryption level together, but a
-single handshake flight may include multiple encryption levels. Callers
-should defer writing data to the network until flush_flight() to better
-pack QUIC packets into transport datagrams.
-
-flush_flight() is called when the current flight is complete and should be
-written to the transport. Note a flight may contain data at several
-encryption levels.
-
-send_alert() sends a fatal alert at the specified encryption level.
-
-All QUIC methods return 1 on success and 0 on error.
-
-=head1 RETURN VALUES
-
-SSL_CTX_set_quic_method(),
-SSL_set_quic_method(),
-SSL_set_quic_transport_params(), and
-SSL_process_quic_post_handshake()
-return 1 on success, and 0 on error.
-
-SSL_quic_read_level() and SSL_quic_write_level() return the current
-encryption level as an B<OSSL_ENCRYPTION_LEVEL>
-(B<enum ssl_encryption_level_t>).
-
-SSL_quic_max_handshake_flight_len() returns the maximum length in bytes of a
-flight for a given encryption level.
-
-SSL_is_quic() returns 1 if QUIC is being used, 0 if not.
-
-=head1 SEE ALSO
-
-L<ssl(7)>, L<SSL_CIPHER_get_prf_nid(3)>, L<SSL_do_handshake(3)>
-
-=head1 HISTORY
-
-These functions were added in OpenSSL 3.0.0.
-
-=head1 COPYRIGHT
-
-Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
-
-Licensed under the Apache License 2.0 (the "License").  You may not use
-this file except in compliance with the License.  You can obtain a copy
-in the file LICENSE in the source distribution or at
-L<https://www.openssl.org/source/license.html>.
-
-=cut
diff --git a/deps/openssl/openssl/doc/man3/SSL_get_shared_sigalgs.pod b/deps/openssl/openssl/doc/man3/SSL_get_shared_sigalgs.pod
index c18114cdf47..cb9ce025002 100644
--- a/deps/openssl/openssl/doc/man3/SSL_get_shared_sigalgs.pod
+++ b/deps/openssl/openssl/doc/man3/SSL_get_shared_sigalgs.pod
@@ -64,7 +64,7 @@ ordered according to configuration and peer preferences.
 The raw values correspond to the on the wire form as defined by RFC5246 et al.
 The NIDs are OpenSSL equivalents. For example if the peer sent sha256(4) and
 rsa(1) then B<*rhash> would be 4, B<*rsign> 1, B<*phash> NID_sha256, B<*psig>
-NID_rsaEncryption and B<*psighash> NID_sha256WithRSAEncryption.
+NID_rsaEncryption and B<*psignhash> NID_sha256WithRSAEncryption.
 
 If a signature algorithm is not recognised the corresponding NIDs
 will be set to B<NID_undef>. This may be because the value is not supported,
diff --git a/deps/openssl/openssl/doc/man3/SSL_set_bio.pod b/deps/openssl/openssl/doc/man3/SSL_set_bio.pod
index c666dc466ec..aaffeedf779 100644
--- a/deps/openssl/openssl/doc/man3/SSL_set_bio.pod
+++ b/deps/openssl/openssl/doc/man3/SSL_set_bio.pod
@@ -23,6 +23,9 @@ function, any existing B<rbio> that was previously set will also be freed via a
 call to L<BIO_free_all(3)> (this includes the case where the B<rbio> is set to
 the same value as previously).
 
+If using a custom BIO, B<rbio> must implement either
+L<BIO_meth_set_read_ex(3)> or L<BIO_meth_set_read(3)>.
+
 SSL_set0_wbio() works in the same as SSL_set0_rbio() except that it connects
 the BIO B<wbio> for the write operations of the B<ssl> object. Note that if the
 rbio and wbio are the same then SSL_set0_rbio() and SSL_set0_wbio() each take
@@ -30,6 +33,12 @@ ownership of one reference. Therefore, it may be necessary to increment the
 number of references available using L<BIO_up_ref(3)> before calling the set0
 functions.
 
+If using a custom BIO, B<wbio> must implement
+L<BIO_meth_set_write_ex(3)> or L<BIO_meth_set_write(3)>. It additionally must
+implement L<BIO_flush(3)> using B<BIO_CTRL_FLUSH> and L<BIO_meth_set_ctrl(3)>.
+If flushing is unnecessary with B<wbio>, L<BIO_flush(3)> should return one and
+do nothing.
+
 SSL_set_bio() is similar to SSL_set0_rbio() and SSL_set0_wbio() except
 that it connects both the B<rbio> and the B<wbio> at the same time, and
 transfers the ownership of B<rbio> and B<wbio> to B<ssl> according to
diff --git a/deps/openssl/openssl/doc/man3/X509V3_set_ctx.pod b/deps/openssl/openssl/doc/man3/X509V3_set_ctx.pod
index 8287802e41b..7819c344f75 100644
--- a/deps/openssl/openssl/doc/man3/X509V3_set_ctx.pod
+++ b/deps/openssl/openssl/doc/man3/X509V3_set_ctx.pod
@@ -42,8 +42,7 @@ or not) to provide fallback data for the authority key identifier extension.
 
 =head1 RETURN VALUES
 
-X509V3_set_ctx() and X509V3_set_issuer_pkey()
-return 1 on success and 0 on error.
+X509V3_set_issuer_pkey() returns 1 on success and 0 on error.
 
 =head1 SEE ALSO
 
@@ -57,7 +56,7 @@ CTX_TEST was deprecated in OpenSSL 3.0; use X509V3_CTX_TEST instead.
 
 =head1 COPYRIGHT
 
-Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2015-2025 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/openssl/doc/man3/X509_STORE_CTX_new.pod b/deps/openssl/openssl/doc/man3/X509_STORE_CTX_new.pod
index c508a1d3fc1..9929a98e0cf 100644
--- a/deps/openssl/openssl/doc/man3/X509_STORE_CTX_new.pod
+++ b/deps/openssl/openssl/doc/man3/X509_STORE_CTX_new.pod
@@ -74,6 +74,12 @@ X509_STORE_CTX_free() completely frees up I<ctx>. After this call I<ctx>
 is no longer valid.
 If I<ctx> is NULL nothing is done.
 
+X509_STORE_CTX_init() sets up I<ctx> for a subsequent verification operation.
+
+X509_STORE_CTX_init() initializes the internal state and resources of the
+given I<ctx>. Among others, it sets the verification parameters associcated
+with the method name C<default>, which includes the C<any> purpose,
+and takes over callback function pointers from I<trust_store> (unless NULL).
 It must be called before each call to L<X509_verify_cert(3)> or
 L<X509_STORE_CTX_verify(3)>, i.e., a context is only good for one verification.
 If you want to verify a further certificate or chain with the same I<ctx>
@@ -144,12 +150,13 @@ by I<ctx> to be I<chain>.
 Ownership of the chain is transferred to I<ctx>,
 and so it should not be free'd by the caller.
 
-X509_STORE_CTX_set_default() looks up and sets the default verification
-method to I<name>. This uses the function X509_VERIFY_PARAM_lookup() to
-find an appropriate set of parameters from the purpose identifier I<name>.
-Currently defined purposes are C<sslclient>, C<sslserver>, C<nssslserver>,
-C<smimesign>, C<smimeencrypt>, C<crlsign>, C<ocsphelper>, C<timestampsign>,
-and C<any>.
+X509_STORE_CTX_set_default() looks up and sets the default verification method.
+This uses the function X509_VERIFY_PARAM_lookup() to find
+the set of parameters associated with the given verification method I<name>.
+Among others, the parameters determine the trust model and verification purpose.
+More detail, including the list of currently predefined methods,
+is described for the B<-verify_name> command-line option
+in L<openssl-verification-options(1)/Verification Options>.
 
 X509_STORE_CTX_set_verify() provides the capability for overriding the default
 verify function. This function is responsible for verifying chain signatures and
diff --git a/deps/openssl/openssl/doc/man3/X509_add_cert.pod b/deps/openssl/openssl/doc/man3/X509_add_cert.pod
index 907164e9710..f59b93ba54d 100644
--- a/deps/openssl/openssl/doc/man3/X509_add_cert.pod
+++ b/deps/openssl/openssl/doc/man3/X509_add_cert.pod
@@ -16,6 +16,7 @@ X509 certificate list addition functions
 =head1 DESCRIPTION
 
 X509_add_cert() adds a certificate I<cert> to the given list I<sk>.
+It is an error for the I<cert> argument to be NULL.
 
 X509_add_certs() adds a list of certificate I<certs> to the given list I<sk>.
 The I<certs> argument may be NULL, which implies no effect.
@@ -66,7 +67,7 @@ were added in OpenSSL 3.0.
 
 =head1 COPYRIGHT
 
-Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
+Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
 
 Licensed under the Apache License 2.0 (the "License").  You may not use
 this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/openssl/doc/man3/X509_load_http.pod b/deps/openssl/openssl/doc/man3/X509_load_http.pod
index a147c43caa3..e17330b0558 100644
--- a/deps/openssl/openssl/doc/man3/X509_load_http.pod
+++ b/deps/openssl/openssl/doc/man3/X509_load_http.pod
@@ -27,6 +27,9 @@ see L<openssl_user_macros(7)>:
 X509_load_http() and X509_CRL_load_http() loads a certificate or a CRL,
 respectively, in ASN.1 format using HTTP from the given B<url>.
 
+Maximum size of the HTTP response is 100 kB for certificates and 32 MB for CRLs
+and hard coded in the functions.
+
 If B<bio> is given and B<rbio> is NULL then this BIO is used instead of an
 internal one for connecting, writing the request, and reading the response.
 If both B<bio> and B<rbio> are given (which may be memory BIOs, for instance)
diff --git a/deps/openssl/openssl/doc/man7/EVP_KDF-HKDF.pod b/deps/openssl/openssl/doc/man7/EVP_KDF-HKDF.pod
index 5fc0a73241c..b563efa5f5d 100644
--- a/deps/openssl/openssl/doc/man7/EVP_KDF-HKDF.pod
+++ b/deps/openssl/openssl/doc/man7/EVP_KDF-HKDF.pod
@@ -15,6 +15,8 @@ and "extracts" from it a fixed-length pseudorandom key K. The second stage
 "expands" the key K into several additional pseudorandom keys (the output
 of the KDF).
 
+The output is considered to be keying material.
+
 =head2 Identity
 
 "HKDF" is the name for this implementation; it
diff --git a/deps/openssl/openssl/doc/man7/EVP_KDF-KB.pod b/deps/openssl/openssl/doc/man7/EVP_KDF-KB.pod
index 6e25882d674..78b81673a5b 100644
--- a/deps/openssl/openssl/doc/man7/EVP_KDF-KB.pod
+++ b/deps/openssl/openssl/doc/man7/EVP_KDF-KB.pod
@@ -10,6 +10,8 @@ The EVP_KDF-KB algorithm implements the Key-Based key derivation function
 (KBKDF).  KBKDF derives a key from repeated application of a keyed MAC to an
 input secret (and other optional values).
 
+The output is considered to be keying material.
+
 =head2 Identity
 
 "KBKDF" is the name for this implementation; it can be used with the
diff --git a/deps/openssl/openssl/doc/man7/EVP_KDF-PBKDF2.pod b/deps/openssl/openssl/doc/man7/EVP_KDF-PBKDF2.pod
index e6cadc8b826..9a90f7583ab 100644
--- a/deps/openssl/openssl/doc/man7/EVP_KDF-PBKDF2.pod
+++ b/deps/openssl/openssl/doc/man7/EVP_KDF-PBKDF2.pod
@@ -13,6 +13,8 @@ The EVP_KDF-PBKDF2 algorithm implements the PBKDF2 password-based key
 derivation function, as described in SP800-132; it derives a key from a password
 using a salt and iteration count.
 
+The output is considered to be a cryptographic key.
+
 =head2 Identity
 
 "PBKDF2" is the name for this implementation; it
diff --git a/deps/openssl/openssl/doc/man7/EVP_KDF-SS.pod b/deps/openssl/openssl/doc/man7/EVP_KDF-SS.pod
index c8d19691a79..6640703eef1 100644
--- a/deps/openssl/openssl/doc/man7/EVP_KDF-SS.pod
+++ b/deps/openssl/openssl/doc/man7/EVP_KDF-SS.pod
@@ -11,6 +11,8 @@ SSKDF derives a key using input such as a shared secret key (that was generated
 during the execution of a key establishment scheme) and fixedinfo.
 SSKDF is also informally referred to as 'Concat KDF'.
 
+The output is considered to be keying material.
+
 =head2 Auxiliary function
 
 The implementation uses a selectable auxiliary function H, which can be one of:
diff --git a/deps/openssl/openssl/doc/man7/EVP_KDF-SSHKDF.pod b/deps/openssl/openssl/doc/man7/EVP_KDF-SSHKDF.pod
index c7a3263f455..a5b15394755 100644
--- a/deps/openssl/openssl/doc/man7/EVP_KDF-SSHKDF.pod
+++ b/deps/openssl/openssl/doc/man7/EVP_KDF-SSHKDF.pod
@@ -15,6 +15,8 @@ Five inputs are required to perform key derivation: The hashing function
 (for example SHA256), the Initial Key, the Exchange Hash, the Session ID,
 and the derivation key type.
 
+The output is considered to be keying material.
+
 =head2 Identity
 
 "SSHKDF" is the name for this implementation; it
diff --git a/deps/openssl/openssl/doc/man7/EVP_KDF-TLS13_KDF.pod b/deps/openssl/openssl/doc/man7/EVP_KDF-TLS13_KDF.pod
index d588b121faf..7fad55ca61f 100644
--- a/deps/openssl/openssl/doc/man7/EVP_KDF-TLS13_KDF.pod
+++ b/deps/openssl/openssl/doc/man7/EVP_KDF-TLS13_KDF.pod
@@ -12,6 +12,8 @@ the B<EVP_KDF> API.
 The EVP_KDF-TLS13_KDF algorithm implements the HKDF key derivation function
 as used by TLS 1.3.
 
+The output is considered to be keying material.
+
 =head2 Identity
 
 "TLS13-KDF" is the name for this implementation; it
diff --git a/deps/openssl/openssl/doc/man7/EVP_KDF-TLS1_PRF.pod b/deps/openssl/openssl/doc/man7/EVP_KDF-TLS1_PRF.pod
index 8a60e973155..90b357e70f0 100644
--- a/deps/openssl/openssl/doc/man7/EVP_KDF-TLS1_PRF.pod
+++ b/deps/openssl/openssl/doc/man7/EVP_KDF-TLS1_PRF.pod
@@ -11,6 +11,8 @@ Support for computing the B<TLS1> PRF through the B<EVP_KDF> API.
 The EVP_KDF-TLS1_PRF algorithm implements the PRF used by TLS versions up to
 and including TLS 1.2.
 
+The output is considered to be keying material.
+
 =head2 Identity
 
 "TLS1-PRF" is the name for this implementation; it
diff --git a/deps/openssl/openssl/doc/man7/EVP_KDF-X942-ASN1.pod b/deps/openssl/openssl/doc/man7/EVP_KDF-X942-ASN1.pod
index a5786ab83fa..17464738b51 100644
--- a/deps/openssl/openssl/doc/man7/EVP_KDF-X942-ASN1.pod
+++ b/deps/openssl/openssl/doc/man7/EVP_KDF-X942-ASN1.pod
@@ -13,6 +13,8 @@ contains a 32 bit counter as well as optional fields for "partyu-info",
 "partyv-info", "supp-pubinfo" and "supp-privinfo".
 This kdf is used by Cryptographic Message Syntax (CMS).
 
+The output is considered to be keying material.
+
 =head2 Identity
 
 "X942KDF-ASN1" or "X942KDF" is the name for this implementation; it
diff --git a/deps/openssl/openssl/doc/man7/EVP_KDF-X963.pod b/deps/openssl/openssl/doc/man7/EVP_KDF-X963.pod
index 3d6f4372cf3..ca2f7c1df0e 100644
--- a/deps/openssl/openssl/doc/man7/EVP_KDF-X963.pod
+++ b/deps/openssl/openssl/doc/man7/EVP_KDF-X963.pod
@@ -10,6 +10,8 @@ The EVP_KDF-X963 algorithm implements the key derivation function (X963KDF).
 X963KDF is used by Cryptographic Message Syntax (CMS) for EC KeyAgreement, to
 derive a key using input such as a shared secret key and shared info.
 
+The output is considered to be keying material.
+
 =head2 Identity
 
 "X963KDF" is the name for this implementation; it
diff --git a/deps/openssl/openssl/doc/man7/EVP_SIGNATURE-DSA.pod b/deps/openssl/openssl/doc/man7/EVP_SIGNATURE-DSA.pod
index 5a42d6b1cd2..326a86ee0b4 100644
--- a/deps/openssl/openssl/doc/man7/EVP_SIGNATURE-DSA.pod
+++ b/deps/openssl/openssl/doc/man7/EVP_SIGNATURE-DSA.pod
@@ -7,7 +7,9 @@ EVP_SIGNATURE-DSA
 
 =head1 DESCRIPTION
 
-Support for computing DSA signatures.
+Support for computing DSA signatures. The signature produced with
+L<EVP_PKEY_sign(3)> is DER encoded ASN.1 in the form described in
+RFC 3279, section 2.2.2.
 See L<EVP_PKEY-DSA(7)> for information related to DSA keys.
 
 =head2 Signature Parameters
diff --git a/deps/openssl/openssl/doc/man7/openssl-env.pod b/deps/openssl/openssl/doc/man7/openssl-env.pod
index a2443d54d82..c7dbd2277dc 100644
--- a/deps/openssl/openssl/doc/man7/openssl-env.pod
+++ b/deps/openssl/openssl/doc/man7/openssl-env.pod
@@ -51,6 +51,99 @@ See L<OPENSSL_malloc(3)>.
 Specifies the directory from which cryptographic providers are loaded.
 Equivalently, the generic B<-provider-path> command-line option may be used.
 
+=item B<OPENSSL_TRACE>
+
+By default the OpenSSL trace feature is disabled statically.
+To enable it, OpenSSL must be built with tracing support,
+which may be configured like this: C<./config enable-trace>
+
+Unless OpenSSL tracing support is generally disabled,
+enable trace output of specific parts of OpenSSL libraries, by name.
+This output usually makes sense only if you know OpenSSL internals well.
+
+The value of this environment varialble is a comma-separated list of names,
+with the following available:
+
+=over 4
+
+=item B<TRACE>
+
+Traces the OpenSSL trace API itself.
+
+=item B<INIT>
+
+Traces OpenSSL library initialization and cleanup.
+
+=item B<TLS>
+
+Traces the TLS/SSL protocol.
+
+=item B<TLS_CIPHER>
+
+Traces the ciphers used by the TLS/SSL protocol.
+
+=item B<CONF>
+
+Show details about provider and engine configuration.
+
+=item B<ENGINE_TABLE>
+
+The function that is used by RSA, DSA (etc) code to select registered
+ENGINEs, cache defaults and functional references (etc), will generate
+debugging summaries.
+
+=item B<ENGINE_REF_COUNT>
+
+Reference counts in the ENGINE structure will be monitored with a line
+of generated for each change.
+
+=item B<PKCS5V2>
+
+Traces PKCS#5 v2 key generation.
+
+=item B<PKCS12_KEYGEN>
+
+Traces PKCS#12 key generation.
+
+=item B<PKCS12_DECRYPT>
+
+Traces PKCS#12 decryption.
+
+=item B<X509V3_POLICY>
+
+Generates the complete policy tree at various points during X.509 v3
+policy evaluation.
+
+=item B<BN_CTX>
+
+Traces BIGNUM context operations.
+
+=item B<CMP>
+
+Traces CMP client and server activity.
+
+=item B<STORE>
+
+Traces STORE operations.
+
+=item B<DECODER>
+
+Traces decoder operations.
+
+=item B<ENCODER>
+
+Traces encoder operations.
+
+=item B<REF_COUNT>
+
+Traces decrementing certain ASN.1 structure references.
+
+=item B<HTTP>
+
+Traces the HTTP client and server, such as messages being sent and received.
+
+=back
+
 =item B<OPENSSL_WIN32_UTF8>
 
 If set, then L<UI_OpenSSL(3)> returns UTF-8 encoded strings, rather than
diff --git a/deps/openssl/openssl/doc/man7/provider.pod b/deps/openssl/openssl/doc/man7/provider.pod
index a061fc4709d..08ac1d02907 100644
--- a/deps/openssl/openssl/doc/man7/provider.pod
+++ b/deps/openssl/openssl/doc/man7/provider.pod
@@ -227,6 +227,18 @@ MODE is only present where applicable.
 Other aliases may exist for example where standards bodies or common practice
 use alternative names or names that OpenSSL has used historically.
 
+=head3 Provider dependencies
+
+Providers may depend for their proper operation on the availability of
+(functionality implemented in) other providers. As there is no mechanism to
+express such dependencies towards the OpenSSL core, provider authors must
+take care that such dependencies are either completely avoided or made visible
+to users, e.g., by documentation and/or defensive programming, e.g.,
+outputting error messages if required external dependencies are not available,
+e.g., when no provider implementing the required functionality has been
+activated. In particular, provider initialization should not depend on other
+providers already having been initialized.
+
 =head1 OPENSSL PROVIDERS
 
 OpenSSL provides a number of its own providers. These are the default, base,
diff --git a/deps/openssl/openssl/engines/e_afalg.c b/deps/openssl/openssl/engines/e_afalg.c
index ec4e21c582c..58d58ef24ec 100644
--- a/deps/openssl/openssl/engines/e_afalg.c
+++ b/deps/openssl/openssl/engines/e_afalg.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -165,7 +165,7 @@ static ossl_inline int io_getevents(aio_context_t ctx, long min, long max,
             ts32.tv_sec = (__kernel_long_t) timeout->tv_sec;
             ts32.tv_nsec = (__kernel_long_t) timeout->tv_nsec;
 
-            return syscall(__NR_io_getevents, ctx, min, max, events, ts32);
+            return syscall(__NR_io_getevents, ctx, min, max, events, &ts32);
         } else {
             return syscall(__NR_io_getevents, ctx, min, max, events, NULL);
         }
diff --git a/deps/openssl/openssl/engines/e_loader_attic.c b/deps/openssl/openssl/engines/e_loader_attic.c
index a20e04da1a5..08c9c16cbbf 100644
--- a/deps/openssl/openssl/engines/e_loader_attic.c
+++ b/deps/openssl/openssl/engines/e_loader_attic.c
@@ -988,7 +988,7 @@ static OSSL_STORE_LOADER_CTX *file_open_ex
 #ifdef _WIN32
         /* Windows file: URIs with a drive letter start with a / */
         if (p[0] == '/' && p[2] == ':' && p[3] == '/') {
-            char c = tolower(p[1]);
+            char c = tolower((unsigned char)p[1]);
 
             if (c >= 'a' && c <= 'z') {
                 p++;
diff --git a/deps/openssl/openssl/include/crypto/bn.h b/deps/openssl/openssl/include/crypto/bn.h
index c5f328156d3..0b8489bb755 100644
--- a/deps/openssl/openssl/include/crypto/bn.h
+++ b/deps/openssl/openssl/include/crypto/bn.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2014-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -73,6 +73,9 @@ int bn_set_words(BIGNUM *a, const BN_ULONG *words, int num_words);
  */
 int bn_mul_mont_fixed_top(BIGNUM *r, const BIGNUM *a, const BIGNUM *b,
                           BN_MONT_CTX *mont, BN_CTX *ctx);
+int bn_mod_exp_mont_fixed_top(BIGNUM *rr, const BIGNUM *a, const BIGNUM *p,
+                              const BIGNUM *m, BN_CTX *ctx,
+                              BN_MONT_CTX *in_mont);
 int bn_to_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,
                          BN_CTX *ctx);
 int bn_from_mont_fixed_top(BIGNUM *r, const BIGNUM *a, BN_MONT_CTX *mont,
diff --git a/deps/openssl/openssl/include/crypto/cmserr.h b/deps/openssl/openssl/include/crypto/cmserr.h
index 1de2f9c7d51..f53530ae235 100644
--- a/deps/openssl/openssl/include/crypto/cmserr.h
+++ b/deps/openssl/openssl/include/crypto/cmserr.h
@@ -1,6 +1,6 @@
 /*
  * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 2020-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/openssl/include/openssl/cmserr.h b/deps/openssl/openssl/include/openssl/cmserr.h
index f2d7708f10c..52a186520fe 100644
--- a/deps/openssl/openssl/include/openssl/cmserr.h
+++ b/deps/openssl/openssl/include/openssl/cmserr.h
@@ -1,6 +1,6 @@
 /*
  * Generated by util/mkerr.pl DO NOT EDIT
- * Copyright 1995-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -49,6 +49,7 @@
 #  define CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE      114
 #  define CMS_R_ERROR_SETTING_KEY                          115
 #  define CMS_R_ERROR_SETTING_RECIPIENTINFO                116
+#  define CMS_R_ERROR_UNSUPPORTED_STATIC_KEY_AGREEMENT     196
 #  define CMS_R_ESS_SIGNING_CERTID_MISMATCH_ERROR          183
 #  define CMS_R_INVALID_ENCRYPTED_KEY_LENGTH               117
 #  define CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER           176
diff --git a/deps/openssl/openssl/include/openssl/http.h b/deps/openssl/openssl/include/openssl/http.h
index f7ab214265e..c63762b70de 100644
--- a/deps/openssl/openssl/include/openssl/http.h
+++ b/deps/openssl/openssl/include/openssl/http.h
@@ -33,8 +33,9 @@ extern "C" {
 # define OPENSSL_HTTP_PROXY "HTTP_PROXY"
 # define OPENSSL_HTTPS_PROXY "HTTPS_PROXY"
 
-#define OSSL_HTTP_DEFAULT_MAX_LINE_LEN (4 * 1024)
-#define OSSL_HTTP_DEFAULT_MAX_RESP_LEN (100 * 1024)
+# define OSSL_HTTP_DEFAULT_MAX_LINE_LEN (4 * 1024)
+# define OSSL_HTTP_DEFAULT_MAX_RESP_LEN (100 * 1024)
+# define OSSL_HTTP_DEFAULT_MAX_CRL_LEN (32 * 1024 * 1024)
 
 /* Low-level HTTP API */
 OSSL_HTTP_REQ_CTX *OSSL_HTTP_REQ_CTX_new(BIO *wbio, BIO *rbio, int buf_size);
diff --git a/deps/openssl/openssl/include/openssl/quic.h b/deps/openssl/openssl/include/openssl/quic.h
deleted file mode 100644
index f95e9e8819e..00000000000
--- a/deps/openssl/openssl/include/openssl/quic.h
+++ /dev/null
@@ -1,19 +0,0 @@
-/*
- * Copyright 2018-2021 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#ifndef OPENSSL_QUIC_H
-# define OPENSSL_QUIC_H
-# pragma once
-# ifndef OPENSSL_NO_QUIC
-
-/* moved from crypto.h.in to avoid breaking FIPS checksums */
-# define OPENSSL_INFO_QUIC                     2000
-
-# endif /* OPENSSL_NO_QUIC */
-#endif /* OPENSSL_QUIC_H */
diff --git a/deps/openssl/openssl/include/openssl/ssl.h.in b/deps/openssl/openssl/include/openssl/ssl.h.in
index 677a20be15d..105b4a4a3c8 100644
--- a/deps/openssl/openssl/include/openssl/ssl.h.in
+++ b/deps/openssl/openssl/include/openssl/ssl.h.in
@@ -2521,75 +2521,6 @@ void SSL_set_allow_early_data_cb(SSL *s,
 const char *OSSL_default_cipher_list(void);
 const char *OSSL_default_ciphersuites(void);
 
-#  ifndef OPENSSL_NO_QUIC
-/*
- * QUIC integration - The QUIC interface matches BoringSSL
- *
- * ssl_encryption_level_t represents a specific QUIC encryption level used to
- * transmit handshake messages. BoringSSL has this as an 'enum'.
- */
-#include <openssl/quic.h>
-
-/* Used by Chromium/QUIC - moved from evp.h to avoid breaking FIPS checksums */
-# define X25519_PRIVATE_KEY_LEN          32
-# define X25519_PUBLIC_VALUE_LEN         32
-
-/* moved from types.h to avoid breaking FIPS checksums */
-typedef struct ssl_quic_method_st SSL_QUIC_METHOD;
-
-typedef enum ssl_encryption_level_t {
-    ssl_encryption_initial = 0,
-    ssl_encryption_early_data,
-    ssl_encryption_handshake,
-    ssl_encryption_application
-} OSSL_ENCRYPTION_LEVEL;
-
-struct ssl_quic_method_st {
-    int (*set_encryption_secrets)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                  const uint8_t *read_secret,
-                                  const uint8_t *write_secret, size_t secret_len);
-    int (*add_handshake_data)(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                              const uint8_t *data, size_t len);
-    int (*flush_flight)(SSL *ssl);
-    int (*send_alert)(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert);
-};
-
-__owur int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method);
-__owur int SSL_set_quic_transport_params(SSL *ssl,
-                                         const uint8_t *params,
-                                         size_t params_len);
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len);
-__owur size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl);
-__owur OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl);
-__owur int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                 const uint8_t *data, size_t len);
-__owur int SSL_process_quic_post_handshake(SSL *ssl);
-
-__owur int SSL_is_quic(SSL *ssl);
-
-/* BoringSSL API */
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy);
-
-/*
- * Set an explicit value that you want to use
- * If 0 (default) the server will use the highest extenstion the client sent
- * If 0 (default) the client will send both extensions
- */
-void SSL_set_quic_transport_version(SSL *ssl, int version);
-__owur int SSL_get_quic_transport_version(const SSL *ssl);
-/* Returns the negotiated version, or -1 on error */
-__owur int SSL_get_peer_quic_transport_version(const SSL *ssl);
-
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c);
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled);
-
-#  endif
-
 # ifdef  __cplusplus
 }
 # endif
diff --git a/deps/openssl/openssl/include/openssl/sslerr.h b/deps/openssl/openssl/include/openssl/sslerr.h
index b159ef8127c..1e36405e32c 100644
--- a/deps/openssl/openssl/include/openssl/sslerr.h
+++ b/deps/openssl/openssl/include/openssl/sslerr.h
@@ -161,7 +161,6 @@
 # define SSL_R_MISSING_FATAL                              256
 # define SSL_R_MISSING_PARAMETERS                         290
 # define SSL_R_MISSING_PSK_KEX_MODES_EXTENSION            310
-# define SSL_R_MISSING_QUIC_TRANSPORT_PARAMETERS_EXTENSION 801
 # define SSL_R_MISSING_RSA_CERTIFICATE                    168
 # define SSL_R_MISSING_RSA_ENCRYPTING_CERT                169
 # define SSL_R_MISSING_RSA_SIGNING_CERT                   170
@@ -336,7 +335,6 @@
 # define SSL_R_WRONG_CERTIFICATE_TYPE                     383
 # define SSL_R_WRONG_CIPHER_RETURNED                      261
 # define SSL_R_WRONG_CURVE                                378
-# define SSL_R_WRONG_ENCRYPTION_LEVEL_RECEIVED            800
 # define SSL_R_WRONG_SIGNATURE_LENGTH                     264
 # define SSL_R_WRONG_SIGNATURE_SIZE                       265
 # define SSL_R_WRONG_SIGNATURE_TYPE                       370
diff --git a/deps/openssl/openssl/include/openssl/tls1.h b/deps/openssl/openssl/include/openssl/tls1.h
index d005d3c16df..91558fa8d1a 100644
--- a/deps/openssl/openssl/include/openssl/tls1.h
+++ b/deps/openssl/openssl/include/openssl/tls1.h
@@ -151,10 +151,6 @@ extern "C" {
 /* Temporary extension type */
 # define TLSEXT_TYPE_renegotiate                 0xff01
 
-    /* ExtensionType value from RFC9001 */
-# define TLSEXT_TYPE_quic_transport_parameters_draft   0xffa5
-# define TLSEXT_TYPE_quic_transport_parameters         0x0039
-
 # ifndef OPENSSL_NO_NEXTPROTONEG
 /* This is not an IANA defined extension number */
 #  define TLSEXT_TYPE_next_proto_neg              13172
diff --git a/deps/openssl/openssl/providers/fips-sources.checksums b/deps/openssl/openssl/providers/fips-sources.checksums
index 2075eca274d..1ab5d0348c6 100644
--- a/deps/openssl/openssl/providers/fips-sources.checksums
+++ b/deps/openssl/openssl/providers/fips-sources.checksums
@@ -4,71 +4,71 @@ c049a936d74100fcced225f575d46662792a6a0039777d2d4df0cf61eff90a68  crypto/aes/aes
 c1e674d08683a25bc053f6233f73a0d0b3a90aafe591ff57b702c7da1582e4a5  crypto/aes/aes_local.h
 a2466f18da5847c7d9fbced17524633c10ce024671a72f53f9c9c55b9b9923dd  crypto/aes/aes_misc.c
 6979c133f76f4623e62e6e970deae70fa025e713a72b71aead5a048d49e47f6f  crypto/aes/asm/aes-586.pl
-2eef5f20f1410b48bdaaafa24ded24f56f34c4ca79db1d38fa6bf1b3b19535bf  crypto/aes/asm/aes-armv4.pl
-38c2cf8ed3910efd89d8721e1b0763a8fde073b91f6529d251165a0496ef9555  crypto/aes/asm/aes-c64xplus.pl
+92be9ff608331a432e95247a8f4fb9e46897d0cb76f2b6db809b61d44287964a  crypto/aes/asm/aes-armv4.pl
+953897f86e2de9fa27ef411155ab3aed133af94885f1507e76449c142da78656  crypto/aes/asm/aes-c64xplus.pl
 00196f01f5218ad731e6a058d406078f7228a9756d9d73f51c0d0c2a68f885af  crypto/aes/asm/aes-ia64.S
-b4ef595194fe1692e1ab2b561f385da01b277cf004902e8fc99e8ac5389bbd35  crypto/aes/asm/aes-mips.pl
-123c4498c94040b70708fdd911cb08c6411b020b4cf3eb761d6fa22c583c3e6f  crypto/aes/asm/aes-parisc.pl
-7a7f2f90791415ef4ffc1ba2a6f6b6fe994bfe0e03d3bf9dab6e428e6874695c  crypto/aes/asm/aes-ppc.pl
-d139e5ad69560fd0ffd8aa2e72304e463650cea4c657be7a90e0d1eb782d580a  crypto/aes/asm/aes-s390x.pl
-133ba35d77002abcd430414749c4e98c4a319630da898e45ff8dbc5800176df1  crypto/aes/asm/aes-sparcv9.pl
-c98690249d490d23e6fee84f672f1463ffc029427110a4329244a59e4e4aaed8  crypto/aes/asm/aes-x86_64.pl
-7ec99947b47e56595f0b085b8bda0b3113112f694e78b1f71b63ecd1f0fa2c67  crypto/aes/asm/aesfx-sparcv9.pl
-ab94a27e533e164bcf09898a6f6019f43609d51a3b374cf75482dcf2914d464e  crypto/aes/asm/aesni-mb-x86_64.pl
-74939261340a0056eb9333fff1c843c8758b9f93de3d94650cd6d2899c6790d8  crypto/aes/asm/aesni-sha1-x86_64.pl
-ce91f0893a2a35fdf4c024ccb0fd8329b30fdbd955f0ae011ab948101ee14951  crypto/aes/asm/aesni-sha256-x86_64.pl
+88b6f8396cd9d86004743d5c3b0f72b7b8c3d5a2b00b0bbb761ba91ae5a7cdc8  crypto/aes/asm/aes-mips.pl
+7ff9c96ef3d591d45d776fa4b244601ea0d9328e289aeab1e1b92436ce7d02ad  crypto/aes/asm/aes-parisc.pl
+f1244cdeadcb4e48f35bc5df19d4cfaf07e0086ad951b84f07ff6966501faa5b  crypto/aes/asm/aes-ppc.pl
+ecbfe826f4c514810c3ee20e265f4f621149694c298554b2682e5de4f029f14f  crypto/aes/asm/aes-s390x.pl
+ee4e8cacef972942d2a89c1a83c984df9cad87c61a54383403c5c4864c403ba1  crypto/aes/asm/aes-sparcv9.pl
+2b3b9ac56bf54334d053857a24bdb08592151e8a7a60b89b8195846b7f8ee7b5  crypto/aes/asm/aes-x86_64.pl
+c56c324667b67d726e040d70379efba5b270e2937f403c1b5979018b836903c7  crypto/aes/asm/aesfx-sparcv9.pl
+14359dc32b7f4e5c08227fb9ac8f9232c1287399463b233fec4a2ab0c19f68d1  crypto/aes/asm/aesni-mb-x86_64.pl
+2fe016e8098d1c959b6199ce98e91dfed9a3a543d6b068daf88d4c4c402701ec  crypto/aes/asm/aesni-sha1-x86_64.pl
+1d3acabadedb88d1327eeb76201ea9b3f4814f44898018ffae6c73e3f400b89b  crypto/aes/asm/aesni-sha256-x86_64.pl
 4ff74d4e629a88ef5a9e3d3f5b340fc0a4793d16d7cc7f1b70da62512a856248  crypto/aes/asm/aesni-x86.pl
-30103cfe3b29d06b34feff48a927e0fa649e9109d35a3db64b09cfeb15426fa2  crypto/aes/asm/aesni-x86_64.pl
-f3490c936a80e012c49e577ec6e1d4d36df324dfef6264e788e6225e20b5fd52  crypto/aes/asm/aesp8-ppc.pl
-a5807ed92ec8a16d123061487c385bf1f65e50878cee95c8e8096844454129f8  crypto/aes/asm/aest4-sparcv9.pl
-d34cf129a8c63e2b77a74117ed4440a4f35408dabd90e21e70eae92d208fa516  crypto/aes/asm/aesv8-armx.pl
-a0b578b7d2787c91013547df07dfa73d8d7a420446dd624c66f7c55159817eb2  crypto/aes/asm/bsaes-armv7.pl
-34accd08242a6bf4a751105f89b0c4de2cd7e54320753587815647abff7124de  crypto/aes/asm/bsaes-x86_64.pl
-d9bc047db9b2f54f27fe0d6e2ede9239b4a1f57a14bf89fa3cfba6b836599386  crypto/aes/asm/vpaes-armv8.pl
-516421b1a321b842f879ad69e7b82ae3e1f3efc8288c83bb34d6577996e85787  crypto/aes/asm/vpaes-ppc.pl
+c7c6694480bb5319690f94826139a93f5c460ebea6dba101b520a76cb956ec93  crypto/aes/asm/aesni-x86_64.pl
+0489a10fbb1a8ca3652848d5c1e14e519501e189bad3e5827a573c26df359691  crypto/aes/asm/aesp8-ppc.pl
+e397a5781893e97dd90a5a52049633be12a43f379ec5751bca2a6350c39444c8  crypto/aes/asm/aest4-sparcv9.pl
+e3955352a92d56905d63e68937e4758f13190a14a10a3dcb1e5c641c49913c0c  crypto/aes/asm/aesv8-armx.pl
+5e8005fdb6641df465bdda20c3476f7176e6bcd63d5073044a0c02a327c7f172  crypto/aes/asm/bsaes-armv7.pl
+0726a2c4c15c27a12b2f7d5e16863df4a1b1daa7b7d9b728f621b2b224d290e6  crypto/aes/asm/bsaes-x86_64.pl
+1ff94d6bf6c8ae4809f64657eb89260fe3cb22137f649d3c73f72cb190258196  crypto/aes/asm/vpaes-armv8.pl
+c3541865cd02d81101cdbab4877ed82772e6980d2c677b9008b38fa1b26d36d4  crypto/aes/asm/vpaes-ppc.pl
 3ec24185750a995377516bc2fb2eae8b1c52094c6fff093bff591837fc12d6c3  crypto/aes/asm/vpaes-x86.pl
-47bedbe6a04254eede121e71f11a657b1f1940aee1916bbfc04fa9fb8454f9b8  crypto/aes/asm/vpaes-x86_64.pl
-1c9a2a0e8cee4a1283c74b2e306f46f79890f6d236394de2a80d1994fd411d1d  crypto/alphacpuid.pl
-7a37cadacdbecb50304228dfcb087ad7fbb6e31f6ab69c52dd161e79afb2f9ca  crypto/arm64cpuid.pl
+060bb6620f50af9afecdf97df051b45b9a50be9daf343dfec1cbb29693ce00a4  crypto/aes/asm/vpaes-x86_64.pl
+2bc67270155e2d6c7da87d9070e005ee79cea18311004907edfd6a078003532a  crypto/alphacpuid.pl
+0255a480b78bdcc71f76676f496962a9828eb900f53b7be13be96ae3f67fe6db  crypto/arm64cpuid.pl
 e0daf54f72dd8fd1bc537d93f34e2a6a887a9ed6027bb33e15a327ef5ff37a42  crypto/armcap.c
-24cc7611225df0e20e414c14e80516c36d48bf99659946e85a876d8757356686  crypto/armv4cpuid.pl
+a43f2c1eef16146943745f684f2add7d186924932a47abf7fb0760cba02804e6  crypto/armv4cpuid.pl
 16739d54200fb81ca7835b5814f965022a2ab41589c7787e2697e3ea72d4fafa  crypto/asn1_dsa.c
-155eff9d747eed808398cfa2af4b276dfc1f9aac8a0f9d801b314ab3f2bf5b56  crypto/bn/asm/alpha-mont.pl
-894cc71b2d783e4e1b54dbef45e9e9280165a2c43981ebdd03282f0e90914928  crypto/bn/asm/armv4-gf2m.pl
-0d2e31dc9cdce02c619adfc9ac720ccf7171384e76a84cdf0e686a805dd7006e  crypto/bn/asm/armv4-mont.pl
-d7df31176f725c1ae7241fee8f681fdcf2ab9eb4d3cc6c80d49c2248ae40a56a  crypto/bn/asm/armv8-mont.pl
+819c9fd2b0cae9aab81c3cbd1815c2e22949d75f132f649b5883812d0bbaa39a  crypto/bn/asm/alpha-mont.pl
+0070595128b250b9ebdebe48ce53d2d27ca16ec4f7c6c8bd169ab2e4a913b2d1  crypto/bn/asm/armv4-gf2m.pl
+8c1c53a725b8a4f92b8a353bfeeb393be94198df41c912e3270f9e654417b250  crypto/bn/asm/armv4-mont.pl
+a0d926004bddb4613552ffa325fac57ab64b085255f2e72881d8478f55890f5a  crypto/bn/asm/armv8-mont.pl
 cb4ad7b7461fcb8e2a0d52881158d0211b79544842d4eae36fc566869a2d62c8  crypto/bn/asm/bn-586.pl
-10fb73a6cc1bc064ebdcf6d7fe3c7407ea1c28b0d65ad0123046f8b1518fa75a  crypto/bn/asm/c64xplus-gf2m.pl
+636da7e2a66272a81f9c99e90b36c6f132ad6236c739e8b9f2e7315f30b72edd  crypto/bn/asm/c64xplus-gf2m.pl
 c86664fb974362ee52a454c83c2c4b23fd5b7d64b3c9e23ef1e0dfd130a46ee5  crypto/bn/asm/co-586.pl
-b88190d748056e6a64988bf1a3d19efc4c292e3d338a65f4505cf769a2041077  crypto/bn/asm/ia64-mont.pl
+199b9b100f194a2a128c14f2a71be5a04d50d069666d90ca5b69baee1318ccb7  crypto/bn/asm/ia64-mont.pl
 a511aafbf76647a0c83705d4491c898a5584d300aa449fa6166c8803372946eb  crypto/bn/asm/ia64.S
-fee42cabeeb87cdf0fa0a6ff3698b2fe98a8a47d10a756052df572097161a8b9  crypto/bn/asm/mips-mont.pl
-b197a8e1be79b8c21f8d26b34b9a282ca42ec4bcd1f3212fde3889747082a1f7  crypto/bn/asm/mips.pl
-13df09cee06a21669137294f92e5c31b4bf05a8035be6800c1cb4403d7cd8290  crypto/bn/asm/parisc-mont.pl
-25c96e545b4981d45557eb14ea5c83aa2d6375ae0df806cb6e6ded2f59ddfed3  crypto/bn/asm/ppc-mont.pl
-1c057083546fa1a3bb1b9819dc5110f5a3b11b7bf5a2fb275012323bd7412403  crypto/bn/asm/ppc.pl
+687c5d6606fdfd0e242005972d15db74a9cbac2b8a9a54a56fcb1e99d3880ff3  crypto/bn/asm/mips-mont.pl
+8aca83d2ec45a40af15e59cff1ac2dc33737a3d25f0a0b74d401fa778a5c5eb8  crypto/bn/asm/mips.pl
+b27ec5181e387e812925bb26823b830f49d7a6e4971b6d11ea583f5632a1504b  crypto/bn/asm/parisc-mont.pl
+9973523b361db963eea4938a7a8a3adc692e1a4e1aec4fa1f1e57dc93da37921  crypto/bn/asm/ppc-mont.pl
+59cd27e1e10c4984b7fb684b27f491e7634473b1bcff197a07e0ca653124aa9a  crypto/bn/asm/ppc.pl
 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855  crypto/bn/asm/ppc64-mont-fixed.pl
-fe9278a2504fb40257637a4718081775c29c4eb81f87a8528e5c85f8d0c6281a  crypto/bn/asm/ppc64-mont.pl
-94b2d5cf0faf2efddeb5fb7c575dabc35c1791715cc9299d59a01d9f96cb2d6f  crypto/bn/asm/rsaz-avx2.pl
-cd0861a565231f67252e172420f6914fe47a324b35916c29f6304491447fe84c  crypto/bn/asm/rsaz-avx512.pl
-c19c717d87dd1ba74f138af05c044c05f5d025e26323637f46ba54a8c871a378  crypto/bn/asm/rsaz-x86_64.pl
-ae26becda9f6d30e9edde8bb89c251a0c40a9a6c879c4cdaec273d8c09af9cd6  crypto/bn/asm/s390x-gf2m.pl
-2700337ef133d6688047a1a8e1c671db06016aae777679923ce2b301896762cf  crypto/bn/asm/s390x-mont.pl
+a25be64867ab837d93855af232e2bfa71b85b2c6f00e35e620fdc5618187fb6f  crypto/bn/asm/ppc64-mont.pl
+231579e532443665020d4d522d9f11713d9c5d5c814b95b434b0f65452e16de4  crypto/bn/asm/rsaz-avx2.pl
+1657600d320ea549b527b2d878a7658533d60d26eeb38f42ea470fc612f9bb53  crypto/bn/asm/rsaz-avx512.pl
+31e84dc905b13e38850071528d3abbfcaf8910bbc8b46f38d19c2b386a5f838e  crypto/bn/asm/rsaz-x86_64.pl
+30fedf48dfc5fec1c2044b6c226dd9fc42a92522cc589797a23a79d452bdd2cf  crypto/bn/asm/s390x-gf2m.pl
+590388d69d7ac3a0e9af4014792f4f0fdb9552719e8fb48ebc7e5dfca2a491d4  crypto/bn/asm/s390x-mont.pl
 aa02597f3dc09cfbc190aedb75711859ba0f3efff87067ebfba1ec78ebee40d7  crypto/bn/asm/s390x.S
-87d49e83a7df467097fdfc577aa206be9ee622c40fcbbbe5133b35d9783b7816  crypto/bn/asm/sparct4-mont.pl
+2f7cbc2c3d93b1bbc4953dda38b9ae0ab3a0a8331a0418d94d9b286183736c9e  crypto/bn/asm/sparct4-mont.pl
 ca21a9ccbc54e19fb7c2e6cdf286ce7cb08b0fba960c777c6edce5c57ccc2101  crypto/bn/asm/sparcv8.S
 fbc93c8dbbecefe66086f58fe9719ed87b13b2cdc61454a10e841228296fecef  crypto/bn/asm/sparcv8plus.S
-2ec1497fa06826f7bc574239e425dd8dda0d4a2743e1fe87669ede900291fcb6  crypto/bn/asm/sparcv9-gf2m.pl
-1f490fe184c7a51b2d0646a59e69aa659bfe51270ad21594951b8d7b785bac38  crypto/bn/asm/sparcv9-mont.pl
-277dcb7faa1913b25fd43946c50039bcdd45cb643fd9ddeedd6c207cefa4dd50  crypto/bn/asm/sparcv9a-mont.pl
+127832c1e3d298aad805236776488f5f8836b6a0fdbce3f6b42678163df3909f  crypto/bn/asm/sparcv9-gf2m.pl
+1622f04a8918724ac0e8804baf285fdafa0eeaaecc36c7facd459d0ff13a8cac  crypto/bn/asm/sparcv9-mont.pl
+b69083f78b4b4f7097de4462d16649532fb82c453a82cdd9cc1393122661d6e2  crypto/bn/asm/sparcv9a-mont.pl
 d404375a21d33396824a3da212d6646d4f3150dd141ee4b4a250aefae3482efb  crypto/bn/asm/via-mont.pl
-d632edf9b9bab7d2cd2d616512a98d15cf4b3ebba7a8e7b83650d654ceb52ecb  crypto/bn/asm/vis3-mont.pl
+d24f3e97239c8eed5efc721521b025b7256c15e67a54ea6b5c4cf8f7cd0f89ea  crypto/bn/asm/vis3-mont.pl
 89278854f44d95be916516609ce6f79dcd346bab52574b9b6336a9952aa94bee  crypto/bn/asm/x86-gf2m.pl
 90d4ae234c08267adce9ed38d56e0edc223f7480cb9605f5d7399d0b3914c6be  crypto/bn/asm/x86-mont.pl
 d444ca73875e97e0ea88b20e4c02f2fcf3850e8b9311e3b67a2d04fe2796d543  crypto/bn/asm/x86_64-gcc.c
-a5481ca55d94dc7ebdc93173610d38ae2569cea1fe9b5180debe0ab94e455ce1  crypto/bn/asm/x86_64-gf2m.pl
-d8cc080824a72774cb3343a3d50ddf8f41a5b8321203d4c9a764762b62498b96  crypto/bn/asm/x86_64-mont.pl
-03788cb685268e6a50ddfa742ea1fe937570c9b86f2ebc88ee35f3304f67c045  crypto/bn/asm/x86_64-mont5.pl
+709ddee92e9222ee0ed27bfb90db556e85e2d302e4a9131afa25fdc14c4d858f  crypto/bn/asm/x86_64-gf2m.pl
+da7f7780d27eed164797e5334cd45b35d9c113e86afaca051463aef9a8fd787c  crypto/bn/asm/x86_64-mont.pl
+259fb8d7f40c0dba46920b1f169d5b37de03b0fda645463d19e3ae2b56de851d  crypto/bn/asm/x86_64-mont5.pl
 0ea8185a037a2951bb3d1e590bbbdeac305176d5e618f3e43a04c09733a9de34  crypto/bn/bn_add.c
 759c2b9df808b3562fe8b0c7778dbadbf35f261e14fc2d5090d18c35b4181760  crypto/bn/bn_asm.c
 14bd5a35c05fcf454854b92fb30b356d7ac618c1eb699dd798f6ad2936d1f5ee  crypto/bn/bn_blind.c
@@ -77,10 +77,10 @@ d8cc080824a72774cb3343a3d50ddf8f41a5b8321203d4c9a764762b62498b96  crypto/bn/asm/
 2893b6d03d4850d09c15959941b0759bbb50d8c20e873bed088e7cde4e15a65a  crypto/bn/bn_ctx.c
 d94295953ab91469fe2b9da2a542b8ea11ac38551ecde8f8202b7f645c2dea16  crypto/bn/bn_dh.c
 74b63a4515894592b7241fb30b91b21510beaa3d397809e3d74bc9a73e879d18  crypto/bn/bn_div.c
-49e59eac540db304ab0ca7bee3ba9d45f89548fff98155561bbdb6602d0aab1d  crypto/bn/bn_exp.c
+46357d2d30109ae59482332adf604a5ef1bd64c7de08cc808db028c45190ba93  crypto/bn/bn_exp.c
 ec2b6e3af6df473a23e7f1a8522f2554cb0eb5d34e3282458c4a66d242278434  crypto/bn/bn_exp2.c
 baba7c8ae95af6aa36bc9f4be3a2eed33d500451e568ca4bfc6bc7cb48d4f7ea  crypto/bn/bn_gcd.c
-5fbb1ab8463cd5544a1d95cf7996b6387ae634984a42256b7a21482ce3ac30a2  crypto/bn/bn_gf2m.c
+99325cf50bf72b5d77048c20d7fa4f80a179dc6357023745f9a58c8e914ae136  crypto/bn/bn_gf2m.c
 081e8a6abc23599307dab3b1a92113a65e0bf8717cbc40c970c7469350bc4581  crypto/bn/bn_intern.c
 602ed46fbfe12c899dfb7d9d99ff0dbfff96b454fce3cd02817f3e2488dd9192  crypto/bn/bn_kron.c
 81a4afc27dd1e90c4bfa81c8d385214ce8a2b5884537752944a71ebebd91f4b0  crypto/bn/bn_lib.c
@@ -101,14 +101,14 @@ a5c5c9f99961a5a7f22a3dcdce964c8a330f822be17f08652223a20fed747d0a  crypto/bn/bn_r
 24e62baa56e02f2db6454e10168b7c7fa7638db9221b9acda1803d43f38f36e0  crypto/bn/bn_word.c
 be27115efd36f0077a3ec26b1ff1f586b0b8969ba05d8ffa34b2ff4badf227bf  crypto/bn/rsaz_exp.c
 c4d64da1cdc732ea918fccd6a7bb2746b03365dd26f7ba1e74e08c307ca4c58e  crypto/bn/rsaz_exp.h
-5b82cb8dbf3087c2e671871cb0a92e4039223a51af533a2ee996f3bfd47453a7  crypto/bn/rsaz_exp_x2.c
+9bc3bf8965f98915f9019d2f516345e73c435c5bd8ad94bb4b7057809a7d1383  crypto/bn/rsaz_exp_x2.c
 834db8ff36006e5cb53e09ca6c44290124bd23692f4341ea6563b66fcade4cea  crypto/bsearch.c
 c39334b70e1394e43f378ae8d31b6e6dc125e4d9181e6536d38e649c4eaadb75  crypto/buffer/buffer.c
-d2bfdfd96b182741d2d51f91478ffcc48491b0da44662bc1c32bc506b3eef1ba  crypto/c64xpluscpuid.pl
+5f43844b5d8665de9ab895f93599150a327d73ec2674bbf7d7c512d30163022d  crypto/c64xpluscpuid.pl
 0e1a41a2d81b5765bca3df448f60bf1fad91e485fe89dd65a7300ffc419e316d  crypto/cmac/cmac.c
 5113d8d12d884f845cad3d35d92f0a1ee20ebafd7a169273642f4e8178711de9  crypto/context.c
 c309d81ea991ddf5be4337afad2fd132169f7443c76f863349d3f3c82f3374e4  crypto/core_algorithm.c
-f0fd9eb38bf7f196bbb4d26ce8fdf86d0a4f9db219157e66b2c0ffefb4f42005  crypto/core_fetch.c
+65ba41169f8fec7cb8466c3458721e3150057fb587db087a70752e5e08201381  crypto/core_fetch.c
 799c84d224639c6760c5c28e0e287500a973ca6d0c3d7c1bdcd61b0da4018b3c  crypto/core_namemap.c
 469e2f53b5f76cd487a60d3d4c44c8fc3a6c4d08405597ba664661ba485508d3  crypto/cpuid.c
 71f0fff881eb4c5505fb17662f0ea4bbff24c6858c045a013ad8f786b07da5c4  crypto/cryptlib.c
@@ -138,15 +138,15 @@ f4d52d3897219786c6046bf76abb2f174655c584caa50272bf5d281720df5022  crypto/dsa/dsa
 196dc024873e413d92672c3a9b6c062ed6269250b0da6d41c0da1c03cfec9ef8  crypto/dsa/dsa_ossl.c
 9f501a59c09fc3cb3caafaff25abd44397a94d1062950a4d62e855d2c8986b5a  crypto/dsa/dsa_sign.c
 53fa10cc87ac63e35df661882852dc46ae68e6fee83b842f1aeefe00b8900ee1  crypto/dsa/dsa_vrf.c
-786779d7014bc04846832f80638743784a3850c7ee36e4a8062fe8eb7ac31c9b  crypto/ec/asm/ecp_nistp521-ppc64.pl
-2e3056ea14fab8b306b0281d6a6f4317a6e86dbf652a79ade726e716cd79bb1e  crypto/ec/asm/ecp_nistz256-armv4.pl
-a02edef19d22c5aba196080942111ab0172fc2ebe6d6c40db2beb6a1a2d885c6  crypto/ec/asm/ecp_nistz256-armv8.pl
-729729f8233c95138158f4647b33a36cf175e707ce29563db0eedc811f324ec0  crypto/ec/asm/ecp_nistz256-ppc64.pl
-78a5b172f7c13ae8ac622439ffb9d99b240dbb4bbda3f5c88d1533ae74a445ad  crypto/ec/asm/ecp_nistz256-sparcv9.pl
+d9722ad8c6b6e209865a921f3cda831d09bf54a55cacd1edd9802edb6559190a  crypto/ec/asm/ecp_nistp521-ppc64.pl
+78ad06b88fcc8689a3a846b82f9ee01546e5734acd1bccf2494e523b71dc74d1  crypto/ec/asm/ecp_nistz256-armv4.pl
+4617351d2de4d0b2abfd358c58050cee00702d0b4c1acca09312ec870e351c7d  crypto/ec/asm/ecp_nistz256-armv8.pl
+3715ddd921425f3018741037f01455ed26a840ace08691a800708170a66cf4d2  crypto/ec/asm/ecp_nistz256-ppc64.pl
+cfe7e75a2fddc87a7251684469a8808b9da82b2f5725eafad5806920f89932bd  crypto/ec/asm/ecp_nistz256-sparcv9.pl
 922725c4761cfa567af6ed9ecab04f2c7729ae2595f2fc0fa46dc67879dc87b0  crypto/ec/asm/ecp_nistz256-x86.pl
-19ba01af58788e2873ebc1d5b503a76604bec0b9b6296fa794946e141fc945a4  crypto/ec/asm/ecp_nistz256-x86_64.pl
-e806141073aa3792e2748f6feeee6d3017124b3bc6059a9eca0d53a2f5785346  crypto/ec/asm/x25519-ppc64.pl
-a397592dc9fdb13016311db6184b4a3a4f2e198aacb03528f770f30ea4966cc4  crypto/ec/asm/x25519-x86_64.pl
+ac327475c7ec828d11aa05628b4e3b81ec3b1400f30fe7bec01daf3cf71f2dc9  crypto/ec/asm/ecp_nistz256-x86_64.pl
+cc727533130f5f1a29229929b3d4e8454585d647be25d6344f3c6a0240998368  crypto/ec/asm/x25519-ppc64.pl
+ee897e230964511baa0d1bf95fb938312407a40a88ebe01476879c2763e5f732  crypto/ec/asm/x25519-x86_64.pl
 340336e01aa04fcde9bfd56536f90c9bc0ad56a002b6cfa321a1e421f1e93ceb  crypto/ec/curve25519.c
 9a95ec8366154bb20aeb24f4767a8cbb9953ca0380708eb2f39caca6078cd59e  crypto/ec/curve448/arch_32/f_impl32.c
 063dac1e4a9573c47532123e9e03e3532a7473cc3e146521ba9ec6f486ddf3b1  crypto/ec/curve448/arch_64/arch_intrinsics.h
@@ -166,16 +166,16 @@ f6447921a0031fa5beddedd298e82096fb3fdb189b712fab328b61f6beae0c23  crypto/ec/curv
 ae1637d89287c9d22a34bdc0d67f6e01262a2f8dcef9b61369dba8c334f5a80d  crypto/ec/ec2_oct.c
 6bbbf570ce31f5b579f7e03ec9f8a774663c7c1eb5e475bd31f8fee94a021ffc  crypto/ec/ec2_smpl.c
 2a71bd8dbe4f427c117d990581709a4ddce07fa8e530794b5a9574fef7c48a0c  crypto/ec/ec_asn1.c
-69b1b3acb4295f5fff961b339e8ace913176ca63fcedf4af0da4c27171f24f94  crypto/ec/ec_backend.c
+e959960fe9a78ea67346048c9c02428203819d5b443d18fe7bb26cd1ca28fcdc  crypto/ec/ec_backend.c
 86e2becf9b3870979e2abefa1bd318e1a31820d275e2b50e03b17fc287abb20a  crypto/ec/ec_check.c
 265f911b9d4aada326a2d52cd8a589b556935c8b641598dcd36c6f85d29ce655  crypto/ec/ec_curve.c
 8cfd0dcfb5acbf6105691a2d5e2826dba1ff3906707bc9dd6ff9bffcc306468f  crypto/ec/ec_cvt.c
 95ce53663ab8a1d05bd6f4999f30113e1edce771fb6d218a772fe02de7bdaf4d  crypto/ec/ec_key.c
 7e40fc646863e0675bbb90f075b809f61bdf0600d8095c8366858d9533ab7700  crypto/ec/ec_kmeth.c
-bbd6f618c3dfe425ce0ba1c6710fe59418130e06351881162a590475e6438c44  crypto/ec/ec_lib.c
+fea5cd863cd94b4e543b72942ed8c23175359cfab99ca65203af4ebecb001a15  crypto/ec/ec_lib.c
 a8a4690e42b4af60aad822aa8b16196df337906af53ea4db926707f7b596ff27  crypto/ec/ec_local.h
 fa901b996eb0e460359cd470843bdb03af7a77a2f1136c5e1d30daef70f3e4d2  crypto/ec/ec_mult.c
-129c6b42417bfcf582f4a959cfd65433e6f85b158274f4fa38f9c62615ac9166  crypto/ec/ec_oct.c
+205b17b41e6678f40ec2a92e7856e87904e57121e7dc3120d14a4c4eeafb15b0  crypto/ec/ec_oct.c
 c7fba2f2c33f67dafa23caef8c3abd12f5336274a9a07d412b83be0366969ee6  crypto/ec/ecdh_kdf.c
 b2cf8f052a5716137da7b0e857ed7a5df5fb513b6d14534199a05e32f2b5a866  crypto/ec/ecdh_ossl.c
 2e00c2e0e6f6d58b81fc23fe500f59e98793dc828ca87d64eba10cc0fddd0dc1  crypto/ec/ecdsa_ossl.c
@@ -228,19 +228,19 @@ f897493b50f4e9dd4cacb2a7accda6683c10ece602641874cdff1dac7128a751  crypto/initthr
 7290d8d7ec31a98b17618f218d4f27b393501c7606c814a43db8af1975ad1d10  crypto/lhash/lhash.c
 5d49ce00fc06df1b64cbc139ef45c71e0faf08a33f966bc608c82d574521a49e  crypto/lhash/lhash_local.h
 f866aafae928db1b439ac950dc90744a2397dfe222672fe68b3798396190c8b0  crypto/mem_clr.c
-78a20112586dbce2b8b6e509a0f46f6a36f2a4acf53c3f3511daf7932a71c391  crypto/modes/asm/aes-gcm-armv8_64.pl
-e482f02932d77d61142548ca4f3c8d5709d88ec14ab84723d82331444c0f57da  crypto/modes/asm/aesni-gcm-x86_64.pl
-8fdcb4313fa3a6e541a697525856b9527a06ddf4c794f9393e843f86d67f543c  crypto/modes/asm/ghash-alpha.pl
-ace8c376b394439301cecaf468d2a9a8adae21eff1d43191cefbf6765023452d  crypto/modes/asm/ghash-armv4.pl
-c22f4945e7de3bd7bfef73447f09983e40a3e4dd0938244d902a1c44c98a8467  crypto/modes/asm/ghash-c64xplus.pl
-315a76491cdba48c88df6549c9efd96b50515400810b185a568b7a871681e03d  crypto/modes/asm/ghash-ia64.pl
-25e9f494fcb6eb636c04af2f322736fae8aa339037e199332c96b8c9c3a50afa  crypto/modes/asm/ghash-parisc.pl
-f22d5fa646b4fc2db008b6b05ec07c8790d3ad5485d2b10218fd11d0e81030ba  crypto/modes/asm/ghash-s390x.pl
-de97107e0c19ff9dd4069f0761eccb00e0b3ced345e1f119ab3b918dd2f9c5f6  crypto/modes/asm/ghash-sparcv9.pl
+e14f48d4112c0efe3826b4aa390cc24045a85298cc551ec7f3f36ac4236d7d81  crypto/modes/asm/aes-gcm-armv8_64.pl
+1d686af304f94743038f916125effcb51790c025f3165d8d37b526bbeee781f0  crypto/modes/asm/aesni-gcm-x86_64.pl
+c2e874a8deb418b5d8c935b2e256370566a5150e040c9fa008cdb5b463c26904  crypto/modes/asm/ghash-alpha.pl
+6bc7d63569c73d7020ede481f2de05221ac92403c7cc11e7263ada7644f6aa9b  crypto/modes/asm/ghash-armv4.pl
+097975df63370de7ebea012d17de14fc1f361fb83acf03b432a99ae7d5bceb24  crypto/modes/asm/ghash-c64xplus.pl
+fdde3bc48b37790c6e0006014da71e7a831bbb4fdbfcda2d01dbe0ceb0ba88fa  crypto/modes/asm/ghash-ia64.pl
+e472d73d06933667a51a0af973479993eed333c71b43af03095450acb36dbeb4  crypto/modes/asm/ghash-parisc.pl
+6fb4332ac88113a20915ad4de1931ef88b0114b5379b16e1d967820e1229fbb0  crypto/modes/asm/ghash-s390x.pl
+6af1a05981e1d41e4dea51e58938360e3abc4a4f58e179908242466d032b1a8a  crypto/modes/asm/ghash-sparcv9.pl
 26f55a57e77f774d17dfba93d757f78edfa3a03f68a71ffa37ccf3bfc468b1e2  crypto/modes/asm/ghash-x86.pl
-2a0d23a644083e46745c7cb1ca79de393af9336a2e8eab7c85ffeb3b7b1a286f  crypto/modes/asm/ghash-x86_64.pl
-b407d9fc6ea65fe1a05edc2d139298d78391f3c165314fa6d56dd375b8e453cd  crypto/modes/asm/ghashp8-ppc.pl
-d8436f6dc43a18d49b1a16999ecb513ccf4483f418f75edc01ce68e777c614a9  crypto/modes/asm/ghashv8-armx.pl
+72744131007d2389c09665a59a862f5f6bb61b64bd3456e9b400985cb56586b8  crypto/modes/asm/ghash-x86_64.pl
+a4e9f2e496bd9362b17a1b5989aa4682647cefcff6117f0607122a9e11a9dfd9  crypto/modes/asm/ghashp8-ppc.pl
+69a13f423ca74c22543900c14aef4a848e3bc75504b65d2f51c6903aebcc17a7  crypto/modes/asm/ghashv8-armx.pl
 65112dfe63cd59487e7bdb1706b44acfcf48ecede12cc3ae51daa5b661f41f06  crypto/modes/cbc128.c
 1611e73dc1e01b5c2201f51756a7405b7673aa0bb872e2957d1ec80c3530486f  crypto/modes/ccm128.c
 d8c2f256532a4b94db6d03aea5cb609cccc938069f644b2fc77c5015648d148d  crypto/modes/cfb128.c
@@ -257,7 +257,7 @@ c698d5166d091d6bb6e9df3c211fe1cc916fd43a26ec844f28f547cd708f9c55  crypto/param_b
 4fda13f6af05d80b0ab89ec4f5813c274a21a9b4565be958a02d006236cef05c  crypto/params_dup.c
 b6cbfc8791b31587f32a3f9e4c117549793528ebddc34a361bad1ad8cf8d4c42  crypto/params_from_text.c
 97cb7414dc2f165d5849ee3b46cdfff0afb067729435d9c01a747e0ca41e230c  crypto/ppccap.c
-826a78afb376cbf1e87f12a2a67eef2ee47059a0fd3f9cba7ce7f035e34f8052  crypto/ppccpuid.pl
+3ca43596a7528dec8ff9d1a3cd0d68b62640f84b1d6a8b5e4842cfd0be1133ad  crypto/ppccpuid.pl
 b4d34272a0bd1fbe6562022bf7ea6259b6a5a021a48222d415be47ef5ef2a905  crypto/property/defn_cache.c
 c3709986fd2ab18f3c6136d8dd7705a4538986aa789ceafe770c3a376db3c569  crypto/property/property.c
 66da4f28d408133fb544b14aeb9ad4913e7c5c67e2826e53f0dc5bf4d8fada26  crypto/property/property_local.h
@@ -288,50 +288,50 @@ f01af62704dbf9457e2669c3e7c1d4d740f0388faa49df93611b987a8aa2bf11  crypto/rsa/rsa
 3aba73dacebb046faf8d09dc279149b52c629004b524ec33e6d81c8ad0bc31a8  crypto/rsa/rsa_sp800_56b_gen.c
 1c1c2aeeb18bf1d69e8f134315b7e50d8f43d30eb1aa5bf42983eec9136a2fdc  crypto/rsa/rsa_x931.c
 0acbebed48f6242d595c21e3c1ad69da0daa960d62062e8970209deda144f337  crypto/s390xcap.c
-370d98549d4d98e04b60677b319b85904259359bd9401dd5385aa728278e6626  crypto/s390xcpuid.pl
+22205848cfb55116ebf999dced8331b575886a609ce29e6886e6267b2310c337  crypto/s390xcpuid.pl
 5fa59240ca885cbc0c1cd026934b226d44fc9c3fdf0c2e7e3a7bd7f4963ca2e5  crypto/self_test_core.c
-58a1a8aeb45421954fa0e4bc87157addb96d086ac4e6aade47da96523cecaa74  crypto/sha/asm/keccak1600-armv4.pl
-d6df6cfdd4e2fee52dc16fd31c91768c45c48c22700c486406d70ecb37e8a8bb  crypto/sha/asm/keccak1600-armv8.pl
-81bfb4484d68a3a3e1d704855f76356090867fe10a75db7707b6f7364e8ee8da  crypto/sha/asm/keccak1600-avx2.pl
-b7bb35d51d439abbf3810454ccb9bfb5a51e2111eaf389fb95796ad6220a61a0  crypto/sha/asm/keccak1600-avx512.pl
-37365dcc576f99006132271968bab990e2bebdab7f4168c726bd449a2fa51c6a  crypto/sha/asm/keccak1600-avx512vl.pl
-2767ae2f379a7a3d0c6dd1471d4d90dd896545b456cb6efd6c230df29e511d70  crypto/sha/asm/keccak1600-c64x.pl
+05c533fde7fdba0c76103e97d881b7224c8427451b453e2f6413552996063e31  crypto/sha/asm/keccak1600-armv4.pl
+ca3b2b654f9a8c4bc2fa2538c1f19d17acd4a6b9e0df6a4b81df04efa697e67e  crypto/sha/asm/keccak1600-armv8.pl
+12b7acce2fba0bc0e1ca07842ec84be6a022f141c86e077abb42c864af1d8d9c  crypto/sha/asm/keccak1600-avx2.pl
+faf0cccb685d5abc807e08db194f847c67b940da2fc3c235c210dc31d73a5334  crypto/sha/asm/keccak1600-avx512.pl
+be1e7dd9998e3f31cfa6e1b17bc198aeec584a8b76820e38f71d51b05f8a9f2a  crypto/sha/asm/keccak1600-avx512vl.pl
+33bdcc6f7668460c3bdf779633e43bfad62b937042a73acb007b462fc5b0a034  crypto/sha/asm/keccak1600-c64x.pl
 09fc831dd39bd90a701e9b16d9e9987cc215252a22e1e0355f5da6c495fca35a  crypto/sha/asm/keccak1600-mmx.pl
-485dcc50a51705b86c6dc47e6f58d092fec05dfbfcdf4f2785e4235c67cfe742  crypto/sha/asm/keccak1600-ppc64.pl
-49535b60a1a981059a2a9636fdeeab22942d2a15e775b1ec9b5af8937a46aa76  crypto/sha/asm/keccak1600-s390x.pl
-093751655b460d33b2fa6aa4d63a86e902f7f20b2d2a02ed948b78e5698c0dd5  crypto/sha/asm/keccak1600-x86_64.pl
-e0a4a1df82716053a3f01ec0b096c735a0e3c4f6c9d9ec6b2006b37aaac64448  crypto/sha/asm/keccak1600p8-ppc.pl
+ce4a58129e5ee3ac4c9dfec5ecc010440570ebf7bf869e3e9977f2121a64b27a  crypto/sha/asm/keccak1600-ppc64.pl
+a859fc8cb073b2d0012a93f3155a75fb6eb677441462b0de4f8cf8df1445e970  crypto/sha/asm/keccak1600-s390x.pl
+618dcd4891b4064d3b8aa6dcd74bea7ef55f4962a64957b05a05448f6e3e0f17  crypto/sha/asm/keccak1600-x86_64.pl
+831b8b02ab25d78ba6300ce960d96c13439bfba5844e13061e19c4e25cbacc3d  crypto/sha/asm/keccak1600p8-ppc.pl
 75d832db9bf0e98e7a5c522169060a6dd276c5118cfb297fc3f1111f55cd4007  crypto/sha/asm/sha1-586.pl
-8d937771993f04407f5fdcca8ca8565f9f8a4d9c9a8f7bfd4e9f9121dd0450bb  crypto/sha/asm/sha1-alpha.pl
-ab7ecd62896324393b1fd9020515b9c0d2b9cc34d559f2efafa35affc9a1485d  crypto/sha/asm/sha1-armv4-large.pl
-0acc4e40f793d4d2b960af2baaecc91176ba6742ddd62dca0c33ddc838c58772  crypto/sha/asm/sha1-armv8.pl
-c36f51761e7f59bdd0f61230297fb802542ac5d2d1c6d2b1096ed937131bd583  crypto/sha/asm/sha1-c64xplus.pl
-4ab7c9153b085274a579b388ddff97a4ac7e11585e01811ca95b93a3ec786605  crypto/sha/asm/sha1-ia64.pl
-7a392c5ef7dc19c39d67c7080e0c5214e7a80572c85c022be7e7d4378a5f740d  crypto/sha/asm/sha1-mb-x86_64.pl
-c0fea5a0d32001263c8bcf7fc0757aa68c6a7377f20fef8d28708e1b81de5dec  crypto/sha/asm/sha1-mips.pl
-f11b75a54c5f42aa3a052de8091bfba47d7cac01920b2fe0ddcb637d4c9d0eb9  crypto/sha/asm/sha1-parisc.pl
-d46ef3fc166271a83144d90985034e2c514bd1020b84ec0fe5427ad593bfeb74  crypto/sha/asm/sha1-ppc.pl
-a48c7d9403fe99fbd4daec60e96eb22058da766ab9e606d084a63613962851a2  crypto/sha/asm/sha1-s390x.pl
-0e2951e0574c64ee055ffddf16ceefdec00823107d60362976605f139ad8ae68  crypto/sha/asm/sha1-sparcv9.pl
-5da48400d4fae85e205e95a2fa368e7bf525e51e274b1dd680dfb48645426c85  crypto/sha/asm/sha1-sparcv9a.pl
-04b73c902d36c28b5a7eab47cb85f743eb9c648ed5936f64f655524a1010a1b5  crypto/sha/asm/sha1-thumb.pl
-f36d7ec7464c932230585a754b91f13cea4cde5a381fc9f798d959256d07910e  crypto/sha/asm/sha1-x86_64.pl
+c96e87d4f5311cd73bbdf499acc03418588be12426d878e157dd67e0099e0219  crypto/sha/asm/sha1-alpha.pl
+4ba6d1c7f12fe76bf39babea966f0a4b7f8769e0c0510cbfc2c46a65dd62d45c  crypto/sha/asm/sha1-armv4-large.pl
+efc69cb0d867b7fac6b3fa8985c343d1f984d552bc8e75bbbbace0adf9ee5f15  crypto/sha/asm/sha1-armv8.pl
+11d332b4e058e9fa418d6633316d2e9f9bf520a08b2d933e877bdf38b2edefcf  crypto/sha/asm/sha1-c64xplus.pl
+32ff0e701a7b8f25bcfe8477b20795de54f536527bd87d3ce694fd9aaae356d4  crypto/sha/asm/sha1-ia64.pl
+471c27efca685b2a82ad7fefe329ca54172df9f49b9785da6d706b913b75e693  crypto/sha/asm/sha1-mb-x86_64.pl
+0f5c63cf09e950d1b488935ab3b5562e3e9d5cd1a563fb88a41e3dae90a35e6d  crypto/sha/asm/sha1-mips.pl
+b5ffd7b6dbb04c05de7efa2945adb67ea845e7e61a3bf163a532f7b6acdf4267  crypto/sha/asm/sha1-parisc.pl
+482cd23ca6ec38d6f62b90c68f9f20643579c50f2c0fbb0dab1c10a0e35efe77  crypto/sha/asm/sha1-ppc.pl
+28cf69efd53d7a5a8c32e0f8db32c193f41b91faf44f5f59944334bc3f5aa337  crypto/sha/asm/sha1-s390x.pl
+7fd355b412ddfa1c510e0ba3284f75b1c0d621b6db2ecb1d2a935d5cdb706628  crypto/sha/asm/sha1-sparcv9.pl
+24554e68b0e7b7db7b635ff149549015f623ca0bcd9ae90439586a2076f6ae80  crypto/sha/asm/sha1-sparcv9a.pl
+74d197cdd72400cabbff7e173f72c8976723081508b095dc995e8cd1abf3daa6  crypto/sha/asm/sha1-thumb.pl
+a59a86293e28f5600609dc8af2b39c5285580ae8636520990b000eeeb67bb889  crypto/sha/asm/sha1-x86_64.pl
 c099059ef107f548ea2c2bab64a4eb8c277070ce6d74c4d32bb9808dc19c5fa3  crypto/sha/asm/sha256-586.pl
-3a8cf38dd398a7ab1d9c6701fa61c428b07c4431a0041ed3a2ddf937897825c1  crypto/sha/asm/sha256-armv4.pl
-c394bb5b0ff05595a9e6848b6602a0f29f73a79fc006593740f3ca645ad9d316  crypto/sha/asm/sha256-c64xplus.pl
-f33af8e2e2f57b7b63b8c8b35722d7d11ca6ef1f73fb6c4ccebdd3e86912f4b1  crypto/sha/asm/sha256-mb-x86_64.pl
+b9cee5c5a283f61f601d2dba68a7a76e7aba10bfafffc1a5c4987f9c0aa6f87d  crypto/sha/asm/sha256-armv4.pl
+93ddc97651ee3e779144a3c6b3e46a1bc4aa81e75cd7b9df068a2aef8743d25f  crypto/sha/asm/sha256-c64xplus.pl
+8be5c5d69733ecb16774aa8410b4bcb3623a9f060d2be103d8aa67bf6e4c5843  crypto/sha/asm/sha256-mb-x86_64.pl
 dd82e1311703abb019975fc7b61fb87d67e1ed916dddd065aced051e851114b9  crypto/sha/asm/sha512-586.pl
-1f9ba79b1d591b7aa37b62382422cb025f5b45784d26cc5790c05cf4eb52b792  crypto/sha/asm/sha512-armv4.pl
-8136196fce18b736f671a4b4945cd4aa4ab25a28c90c6fc9ab31ff771e8e0d9f  crypto/sha/asm/sha512-armv8.pl
-5b6796a9978b69fd78ee2ff1adc5cf35d44cad8194a38d1c2aba2023012cf252  crypto/sha/asm/sha512-c64xplus.pl
-e8df660671ba61aa2e8f51358baf5d8ca913093e2ee1a40c9cb46d9c2c0851f6  crypto/sha/asm/sha512-ia64.pl
-525f253ef8051bfb0e344ac2e40688ce359a42707fe360d23a03f522cc88c81a  crypto/sha/asm/sha512-mips.pl
-3c3e03529d8514467f8d77c01978348636bb339315feb8041fbde7640565001e  crypto/sha/asm/sha512-parisc.pl
-952ef1b10e8bbe3f638cc798b91ab9c5b47b66ed8fe94647b1beec9874f2e71e  crypto/sha/asm/sha512-ppc.pl
-193a0ea240264b29dd68a425f604a6da4b18e28838dcf909dd7e711af880f782  crypto/sha/asm/sha512-s390x.pl
-dcb466a1e5938fb64ecb38b0533602192d61334da864ee8dfdcfa12d3cdfa273  crypto/sha/asm/sha512-sparcv9.pl
-bb6503967a58b767a3e73441cfabc77f15c8ac747f377e276d4aa63d05f2c3c4  crypto/sha/asm/sha512-x86_64.pl
-68d2f3b2dccb978ee42640f4fb4d2eae6b74d071017a3eedd9e7cb77762817dc  crypto/sha/asm/sha512p8-ppc.pl
+8d84164f3cfd53290c0c14bb5655510b7a9238857866328c0604d64b4e76fe21  crypto/sha/asm/sha512-armv4.pl
+dadacb6d66b160913bffb4e1a6c3e5f7be6509b26e2c099701d8d3fdb92c1be0  crypto/sha/asm/sha512-armv8.pl
+6f548a088feae3b6faa179653ba449df9d3f5cda1e0561e5b5f120b32274d1eb  crypto/sha/asm/sha512-c64xplus.pl
+9fa54fbc34fd881f4b344374b9b4f8fb15b641424be7af9a31c71af89ae5d577  crypto/sha/asm/sha512-ia64.pl
+fb06844e7c3b014a58dccc8ec6020c71843cfdc5be08288bc7d204f0a840c474  crypto/sha/asm/sha512-mips.pl
+11548f06d213947104a80898e000218ec0d6ff3f6913f6582de498476482ce9f  crypto/sha/asm/sha512-parisc.pl
+7c0c490ce6bb11a228853aecad5e164ce84e5bdabb8a6658ae7184782076c7d3  crypto/sha/asm/sha512-ppc.pl
+38e0455fd6a2b93a7a5385379ca92bc6526585ca1eb4af365fac4c78f7285c72  crypto/sha/asm/sha512-s390x.pl
+0611845c52091b0208dd41f22ddef9dd1e68d3d92fa4c4360738b840a6314de6  crypto/sha/asm/sha512-sparcv9.pl
+f64d16c1e5c3fa4a7969de494a8372127502171a517c14be7a1e3a43a7308699  crypto/sha/asm/sha512-x86_64.pl
+8725cabb8d695c576619f19283b034074a3fa0f1c0be952a9dbe9793be15b907  crypto/sha/asm/sha512p8-ppc.pl
 57f6cf54b1b5d2cac7a8f622b7b6bd1878f360fff3fa0f02352061c24162ebbb  crypto/sha/keccak1600.c
 306cacd3f86e5cacaca74c58ef862516515e5c0cafaff48636d537fd84f1c2fb  crypto/sha/sha1dgst.c
 4d8cf04f5806611e7586aab47fb28165ec1afb00168e2c9876bb36cb5c29bf8b  crypto/sha/sha256.c
@@ -345,13 +345,13 @@ c50c584c55e56347bb43aca4b796b5344d70daece3061f586b79c871c21f5d1a  crypto/sparse_
 7b4efa594d8d1f3ecbf4605cf54f72fb296a3b1d951bdc69e415aaa08f34e5c8  crypto/threads_lib.c
 a41ae93a755e2ec89b3cb5b4932e2b508fdda92ace2e025a2650a6da0e9e972c  crypto/threads_none.c
 3729e2bd36f945808b578e0d89fac0fcb3114e4fc9381614bcbd8a9869991716  crypto/threads_pthread.c
-88423960f0414f6fd41fba4f4c67f9f7260c2741e4788adcd52493e895ec8027  crypto/threads_win.c
-af0af59fe2cb8668a96751f343232d7faa3e7a937beb2bda09ed74fe60b9cb5f  crypto/x86_64cpuid.pl
+f82715745b668297d71b66d05e6bfc3c817bf80bd967c0f33ca7ffbb6e347645  crypto/threads_win.c
+fd6c27cf7c6b5449b17f2b725f4203c4c10207f1973db09fd41571efe5de08fd  crypto/x86_64cpuid.pl
 bbec287bb9bf35379885f8f8998b7fd9e8fc22efee9e1b299109af0f33a7ee16  crypto/x86cpuid.pl
 acbb841170d4d3eb91d969be1c0e4973b1babfd5fcd76440b0628f509f82fd76  e_os.h
 249a0e58e9692920eddc1ada2ac772a0cfd749cfbf618f2f5da08280df545d8f  include/crypto/aes_platform.h
 8c6f308c1ca774e6127e325c3b80511dbcdc99631f032694d8db53a5c02364ee  include/crypto/asn1_dsa.h
-2e8c284672c4e8e395b3da56a3abf3e65bb4346313fb6f7358e925d077a2e1e2  include/crypto/bn.h
+3bded0eaa7ccdebd0b4217b7fdb82676d5c0762a88aca462dbceaef851fafa99  include/crypto/bn.h
 1c46818354d42bd1b1c4e5fdae9e019814936e775fd8c918ca49959c2a6416df  include/crypto/bn_conf.h.in
 7a43a4898fcc8446065e6c99249bcc14e475716e8c1d40d50408c0ab179520e6  include/crypto/bn_dh.h
 e69b2b20fb415e24b970941c84a62b752b5d0175bc68126e467f7cc970495504  include/crypto/cryptlib.h
@@ -518,7 +518,7 @@ ab298c5f89f3165fa11093fad8063b7bcbff0924b43fb3107148ae66d54adcb5  providers/impl
 8ed4a100e4756c31c56147b4b0fab76a4c6e5292aa2f079045f37b5502fd41b9  providers/implementations/ciphers/cipher_aes_gcm_hw_aesni.inc
 4c6f3a2818754a5aa7b6db36dae53e248504f9e82cc5af2ed68c723903d4f9d5  providers/implementations/ciphers/cipher_aes_hw.c
 89de794c090192459d99d95bc4a422e7782e62192cd0fdb3bdef4128cfedee68  providers/implementations/ciphers/cipher_aes_hw_aesni.inc
-fac3a1878dc9c0c363d0ecdd9f74926157df54ca4f40adf8c479927395082008  providers/implementations/ciphers/cipher_aes_ocb.c
+0d77239f0cc1a9e1ecdeb45b6fae12cac2637771d29842199be08699e59f87fc  providers/implementations/ciphers/cipher_aes_ocb.c
 88138a1aff9705e608c0557653be92eb4de65b152555a2b79ec8b2a8fae73e8f  providers/implementations/ciphers/cipher_aes_ocb.h
 855869ab5a8d7a61a11674cfe5d503dfa67f59e7e393730835d1d8cf0ab85c70  providers/implementations/ciphers/cipher_aes_ocb_hw.c
 6a8782c728575d69c86b735c9f47acda5c0daa04e17f1e0faef2c963f23fab20  providers/implementations/ciphers/cipher_aes_wrp.c
@@ -557,7 +557,7 @@ b9a61ce951c1904d8315b1bb26c0ab0aaadb47e71d4ead5df0a891608c728c4b  providers/impl
 c95ce5498e724b9b3d58e3c2f4723e7e3e4beb07f9bea9422e43182cbadb43af  providers/implementations/include/prov/macsignature.h
 29d1a112b799e1f45fdf8bcee8361c2ed67428c250c1cdf408a9fbb7ebf4cce1  providers/implementations/include/prov/names.h
 2187713b446d8b6d24ee986748b941ac3e24292c71e07ff9fb53a33021decdda  providers/implementations/include/prov/seeding.h
-d376c58489ae36fbece94bb88939845ced04a2a0bdd55d6a3562e45a56577ae1  providers/implementations/kdfs/hkdf.c
+6091dd22e716fbe6c7c94524cdee6ad4432a572f2d3c4d360dcafafa3902d692  providers/implementations/kdfs/hkdf.c
 a62e3af09f5af84dcf36f951ba4ac90ca1694adaf3747126186020b155f94186  providers/implementations/kdfs/kbkdf.c
 e0644e727aacfea4da3cf2c4d2602d7ef0626ebb760b6467432ffd54d5fbb24d  providers/implementations/kdfs/pbkdf2.c
 c0778565abff112c0c5257329a7750ec4605e62f26cc36851fa1fbee6e03c70c  providers/implementations/kdfs/pbkdf2.h
@@ -566,14 +566,14 @@ abe2b0f3711eaa34846e155cffc9242e4051c45de896f747afd5ac9d87f637dc  providers/impl
 8571556d77d10e8edc98212473a38f09632e3f19e9995dde89ee6c95f2e84ccf  providers/implementations/kdfs/sskdf.c
 589f6133799da80760e8bc3ab0191a341ab6d4d2706e92e6eb4a24b0250fefa6  providers/implementations/kdfs/tls1_prf.c
 4d4a6d9a562d2dcfec941d3f113a544663b5ac2fbe4accd89ec70c1cc11751d0  providers/implementations/kdfs/x942kdf.c
-6b6c776b12664164f3cb54c21df61e1c4477c7855d89431a16fb338cdae58d43  providers/implementations/kem/rsa_kem.c
+58acb0ff36bf7e463ba714b347b714eccab9fda77c4ca6bacc3a55e6d2ce5ad9  providers/implementations/kem/rsa_kem.c
 11a0d0fb88ed88e965f10b3a0ef6c880f60341df995128f57ad943053aaf15b2  providers/implementations/keymgmt/dh_kmgmt.c
-a329f57cb041cd03907e9d996fbc2f378ee116c7f8d7fbf1ea08b7a5df7e0304  providers/implementations/keymgmt/dsa_kmgmt.c
+9316fc619e8d8a1d841aa0936fc62c28eb2b4c60cc6c9b2d64b72f8641f28abb  providers/implementations/keymgmt/dsa_kmgmt.c
 9bc88451d3ae110c7a108ee73d3b3b6bda801ec3494d2dfb9c9970b85c2d34fe  providers/implementations/keymgmt/ec_kmgmt.c
 258ae17bb2dd87ed1511a8eb3fe99eed9b77f5c2f757215ff6b3d0e8791fc251  providers/implementations/keymgmt/ec_kmgmt_imexport.inc
-011c36aad6834729043f23eacab417732541ee23916d9afa5bb9164862be00bb  providers/implementations/keymgmt/ecx_kmgmt.c
+d0c67b7fbddd51dcfebd96bf99794ca3bc437d50974ebcd56968fb8dd3627b0f  providers/implementations/keymgmt/ecx_kmgmt.c
 053a2be39a87f50b877ebdbbf799cf5faf8b2de33b04311d819d212ee1ea329b  providers/implementations/keymgmt/kdf_legacy_kmgmt.c
-1646b477fa231dd0f6c22444c99098f9b447cab0d39ff69b811262469d4dbe09  providers/implementations/keymgmt/mac_legacy_kmgmt.c
+37e2f9f904eeabf94b1e4152b67ac236f872aa78dd7e47bf0de1b8f50ac19b6c  providers/implementations/keymgmt/mac_legacy_kmgmt.c
 19f22fc70a6321441e56d5bd4aab3d01d52d17069d4e4b5cefce0f411ecece75  providers/implementations/keymgmt/rsa_kmgmt.c
 5eb96ea2df635cf79c5aeccae270fbe896b5e6384a5b3e4b187ce8c10fe8dfc7  providers/implementations/macs/cmac_prov.c
 e69aa06f8f3c6f5a26702b9f44a844b8589b99dc0ee590953a29e8b9ef10acbe  providers/implementations/macs/gmac_prov.c
@@ -588,7 +588,7 @@ f9457255fc57ef5739aa2584e535195e38cc947e31fd044d28d64c28c8a946ce  providers/impl
 04339b66c10017229ef368cb48077f58a252ebfda9ab12b9f919e4149b1036ed  providers/implementations/rands/test_rng.c
 cafb9e6f54ad15889fcebddac6df61336bff7d78936f7de3bb5aab8aee5728d2  providers/implementations/signature/dsa_sig.c
 a30dc6308de0ca33406e7ce909f3bcf7580fb84d863b0976b275839f866258df  providers/implementations/signature/ecdsa_sig.c
-02e833a767afbe98247d6f09dfb1eb5a5cf7304a93f2c5427a9f6af9c8a3b549  providers/implementations/signature/eddsa_sig.c
+09647b736980ac3c762f1e7c10cbfee78e2c6ab327ac62e5039968cea034ff3b  providers/implementations/signature/eddsa_sig.c
 3bb0f342b4cc1b4594ed0986adc47791c0a7b5c1ae7b1888c1fb5edb268a78d9  providers/implementations/signature/mac_legacy_sig.c
 166d7e3a049b28ae2c6f94415070720d176a82e46af1613511c4b073ea705476  providers/implementations/signature/rsa_sig.c
 a14e901b02fe095713624db4080b3aa3ca685d43f9ebec03041f992240973346  ssl/record/tls_pad.c
diff --git a/deps/openssl/openssl/providers/fips.checksum b/deps/openssl/openssl/providers/fips.checksum
index cbd9c095117..0904f6a1029 100644
--- a/deps/openssl/openssl/providers/fips.checksum
+++ b/deps/openssl/openssl/providers/fips.checksum
@@ -1 +1 @@
-101807560af8f62c064ad796dfa1e4c269d45aaf5303b47ad0b25fdd6cc92466  providers/fips-sources.checksums
+01b31117f96429fe4c8efbf7f4f10ef32efa2b11c69851fd227e4194db116b6f  providers/fips-sources.checksums
diff --git a/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_ocb.c b/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_ocb.c
index eab315453ef..891e73f6726 100644
--- a/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_ocb.c
+++ b/deps/openssl/openssl/providers/implementations/ciphers/cipher_aes_ocb.c
@@ -369,12 +369,20 @@ static int aes_ocb_set_ctx_params(void *vctx, const OSSL_PARAM params[])
         }
         if (p->data == NULL) {
             /* Tag len must be 0 to 16 */
-            if (p->data_size > OCB_MAX_TAG_LEN)
+            if (p->data_size > OCB_MAX_TAG_LEN) {
+                ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAG_LENGTH);
                 return 0;
+            }
             ctx->taglen = p->data_size;
         } else {
-            if (p->data_size != ctx->taglen || ctx->base.enc)
+            if (ctx->base.enc) {
+                ERR_raise(ERR_LIB_PROV, ERR_R_PASSED_INVALID_ARGUMENT);
+                return 0;
+            }
+            if (p->data_size != ctx->taglen) {
+                ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_TAG_LENGTH);
                 return 0;
+            }
             memcpy(ctx->tag, p->data, p->data_size);
         }
      }
diff --git a/deps/openssl/openssl/providers/implementations/encode_decode/encode_key2text.c b/deps/openssl/openssl/providers/implementations/encode_decode/encode_key2text.c
index 3e75a9afb37..637fcf6a121 100644
--- a/deps/openssl/openssl/providers/implementations/encode_decode/encode_key2text.c
+++ b/deps/openssl/openssl/providers/implementations/encode_decode/encode_key2text.c
@@ -112,7 +112,8 @@ static int print_labeled_bignum(BIO *out, const char *label, const BIGNUM *bn)
             use_sep = 0; /* The first byte on the next line doesnt have a : */
         }
         if (BIO_printf(out, "%s%c%c", use_sep ? ":" : "",
-                       tolower(p[0]), tolower(p[1])) <= 0)
+                       tolower((unsigned char)p[0]),
+                       tolower((unsigned char)p[1])) <= 0)
             goto err;
         ++bytes;
         p += 2;
diff --git a/deps/openssl/openssl/providers/implementations/kdfs/hkdf.c b/deps/openssl/openssl/providers/implementations/kdfs/hkdf.c
index 3db8b43891a..69ef565d04f 100644
--- a/deps/openssl/openssl/providers/implementations/kdfs/hkdf.c
+++ b/deps/openssl/openssl/providers/implementations/kdfs/hkdf.c
@@ -669,7 +669,7 @@ static int prov_tls13_hkdf_generate_secret(OSSL_LIB_CTX *libctx,
         EVP_MD_CTX_free(mctx);
 
         /* Generate the pre-extract secret */
-        if (!prov_tls13_hkdf_expand(md, prevsecret, mdlen,
+        if (!prov_tls13_hkdf_expand(md, prevsecret, prevsecretlen,
                                     prefix, prefixlen, label, labellen,
                                     hash, mdlen, preextractsec, mdlen))
             return 0;
diff --git a/deps/openssl/openssl/providers/implementations/kdfs/scrypt.c b/deps/openssl/openssl/providers/implementations/kdfs/scrypt.c
index a7072f785f0..6fa4192600f 100644
--- a/deps/openssl/openssl/providers/implementations/kdfs/scrypt.c
+++ b/deps/openssl/openssl/providers/implementations/kdfs/scrypt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2017-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -88,7 +88,9 @@ static void kdf_scrypt_reset(void *vctx)
     KDF_SCRYPT *ctx = (KDF_SCRYPT *)vctx;
 
     OPENSSL_free(ctx->salt);
+    ctx->salt = NULL;
     OPENSSL_clear_free(ctx->pass, ctx->pass_len);
+    ctx->pass = NULL;
     kdf_scrypt_init(ctx);
 }
 
@@ -128,7 +130,6 @@ static int set_digest(KDF_SCRYPT *ctx)
     EVP_MD_free(ctx->sha256);
     ctx->sha256 = EVP_MD_fetch(ctx->libctx, "sha256", ctx->propq);
     if (ctx->sha256 == NULL) {
-        OPENSSL_free(ctx);
         ERR_raise(ERR_LIB_PROV, PROV_R_UNABLE_TO_LOAD_SHA256);
         return 0;
     }
diff --git a/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c b/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c
index 882cf161258..94c5bceea59 100644
--- a/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c
+++ b/deps/openssl/openssl/providers/implementations/kem/rsa_kem.c
@@ -264,6 +264,17 @@ static int rsasve_generate(PROV_RSA_CTX *prsactx,
             *secretlen = nlen;
         return 1;
     }
+
+    /*
+     * If outlen is specified, then it must report the length
+     * of the out buffer on input so that we can confirm
+     * its size is sufficent for encapsulation
+     */
+    if (outlen != NULL && *outlen < nlen) {
+        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH);
+        return 0;
+    }
+
     /*
      * Step (2): Generate a random byte string z of nlen bytes where
      *            1 < z < n - 1
@@ -285,15 +296,33 @@ static int rsasve_generate(PROV_RSA_CTX *prsactx,
     return ret;
 }
 
-/*
- * NIST.SP.800-56Br2
+/**
+ * rsasve_recover - Recovers a secret value from ciphertext using an RSA
+ * private key.  Once, recovered, the secret value is considered to be a
+ * shared secret.  Algorithm is preformed as per
+ * NIST SP 800-56B Rev 2
  * 7.2.1.3 RSASVE Recovery Operation (RSASVE.RECOVER).
+ *
+ * This function performs RSA decryption using the private key from the
+ * provided RSA context (`prsactx`). It takes the input ciphertext, decrypts
+ * it, and writes the decrypted message to the output buffer.
+ *
+ * @prsactx:      The RSA context containing the private key.
+ * @out:          The output buffer to store the decrypted message.
+ * @outlen:       On input, the size of the output buffer. On successful
+ *                completion, the actual length of the decrypted message.
+ * @in:           The input buffer containing the ciphertext to be decrypted.
+ * @inlen:        The length of the input ciphertext in bytes.
+ *
+ * Returns 1 on success, or 0 on error. In case of error, appropriate
+ * error messages are raised using the ERR_raise function.
  */
 static int rsasve_recover(PROV_RSA_CTX *prsactx,
                           unsigned char *out, size_t *outlen,
                           const unsigned char *in, size_t inlen)
 {
     size_t nlen;
+    int ret;
 
     /* Step (1): get the byte length of n */
     nlen = RSA_size(prsactx->rsa);
@@ -307,13 +336,30 @@ static int rsasve_recover(PROV_RSA_CTX *prsactx,
         return 1;
     }
 
-    /* Step (2): check the input ciphertext 'inlen' matches the nlen */
+    /*
+     * Step (2): check the input ciphertext 'inlen' matches the nlen
+     * and that outlen is at least nlen bytes
+     */
     if (inlen != nlen) {
         ERR_raise(ERR_LIB_PROV, PROV_R_BAD_LENGTH);
         return 0;
     }
+
+    /*
+     * If outlen is specified, then it must report the length
+     * of the out buffer, so that we can confirm that it is of
+     * sufficient size to hold the output of decapsulation
+     */
+    if (outlen != NULL && *outlen < nlen) {
+        ERR_raise(ERR_LIB_PROV, PROV_R_INVALID_OUTPUT_LENGTH);
+        return 0;
+    }
+
     /* Step (3): out = RSADP((n,d), in) */
-    return (RSA_private_decrypt(inlen, in, out, prsactx->rsa, RSA_NO_PADDING) > 0);
+    ret = RSA_private_decrypt(inlen, in, out, prsactx->rsa, RSA_NO_PADDING);
+    if (ret > 0 && outlen != NULL)
+        *outlen = ret;
+    return ret > 0;
 }
 
 static int rsakem_generate(void *vprsactx, unsigned char *out, size_t *outlen,
diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/dsa_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/dsa_kmgmt.c
index 2f5742cfcc0..e3c3fd6916e 100644
--- a/deps/openssl/openssl/providers/implementations/keymgmt/dsa_kmgmt.c
+++ b/deps/openssl/openssl/providers/implementations/keymgmt/dsa_kmgmt.c
@@ -426,7 +426,7 @@ static void *dsa_gen_init(void *provctx, int selection,
         gctx->hindex = 0;
     }
     if (!dsa_gen_set_params(gctx, params)) {
-        OPENSSL_free(gctx);
+        dsa_gen_cleanup(gctx);
         gctx = NULL;
     }
     return gctx;
diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c
index 987d38456fb..94e62f755c2 100644
--- a/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c
+++ b/deps/openssl/openssl/providers/implementations/keymgmt/ecx_kmgmt.c
@@ -487,7 +487,7 @@ static void *ecx_gen_init(void *provctx, int selection,
         gctx->selection = selection;
     }
     if (!ecx_gen_set_params(gctx, params)) {
-        OPENSSL_free(gctx);
+        ecx_gen_cleanup(gctx);
         gctx = NULL;
     }
     return gctx;
diff --git a/deps/openssl/openssl/providers/implementations/keymgmt/mac_legacy_kmgmt.c b/deps/openssl/openssl/providers/implementations/keymgmt/mac_legacy_kmgmt.c
index 1fae4407fca..b02a0a91c6f 100644
--- a/deps/openssl/openssl/providers/implementations/keymgmt/mac_legacy_kmgmt.c
+++ b/deps/openssl/openssl/providers/implementations/keymgmt/mac_legacy_kmgmt.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -399,7 +399,7 @@ static void *mac_gen_init(void *provctx, int selection,
     struct mac_gen_ctx *gctx = mac_gen_init_common(provctx, selection);
 
     if (gctx != NULL && !mac_gen_set_params(gctx, params)) {
-        OPENSSL_free(gctx);
+        mac_gen_cleanup(gctx);
         gctx = NULL;
     }
     return gctx;
@@ -411,7 +411,7 @@ static void *cmac_gen_init(void *provctx, int selection,
     struct mac_gen_ctx *gctx = mac_gen_init_common(provctx, selection);
 
     if (gctx != NULL && !cmac_gen_set_params(gctx, params)) {
-        OPENSSL_free(gctx);
+        mac_gen_cleanup(gctx);
         gctx = NULL;
     }
     return gctx;
diff --git a/deps/openssl/openssl/providers/implementations/signature/eddsa_sig.c b/deps/openssl/openssl/providers/implementations/signature/eddsa_sig.c
index c78f1fbb5fa..9ec910af252 100644
--- a/deps/openssl/openssl/providers/implementations/signature/eddsa_sig.c
+++ b/deps/openssl/openssl/providers/implementations/signature/eddsa_sig.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2022 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -133,6 +133,7 @@ static int eddsa_digest_signverify_init(void *vpeddsactx, const char *mdname,
         /* Should never happen */
         ERR_raise(ERR_LIB_PROV, ERR_R_INTERNAL_ERROR);
         ossl_ecx_key_free(edkey);
+        WPACKET_cleanup(&pkt);
         return 0;
     }
     if (ret && WPACKET_finish(&pkt)) {
diff --git a/deps/openssl/openssl/providers/implementations/storemgmt/file_store.c b/deps/openssl/openssl/providers/implementations/storemgmt/file_store.c
index bb8b2ab8625..3049a9c8113 100644
--- a/deps/openssl/openssl/providers/implementations/storemgmt/file_store.c
+++ b/deps/openssl/openssl/providers/implementations/storemgmt/file_store.c
@@ -238,7 +238,7 @@ static void *file_open(void *provctx, const char *uri)
 #ifdef _WIN32
         /* Windows file: URIs with a drive letter start with a / */
         if (p[0] == '/' && p[2] == ':' && p[3] == '/') {
-            char c = tolower(p[1]);
+            char c = tolower((unsigned char)p[1]);
 
             if (c >= 'a' && c <= 'z') {
                 p++;
diff --git a/deps/openssl/openssl/ssl/build.info b/deps/openssl/openssl/ssl/build.info
index d99835c9a0d..0851357f81e 100644
--- a/deps/openssl/openssl/ssl/build.info
+++ b/deps/openssl/openssl/ssl/build.info
@@ -37,11 +37,8 @@ IF[{- !$disabled{'deprecated-3.0'} -}]
   SHARED_SOURCE[../libssl]=s3_cbc.c
   SOURCE[../libssl]=ssl_rsa_legacy.c
 ENDIF
-DEFINE[../libssl]=$AESDEF
 
-IF[{- !$disabled{quic} -}]
-  SOURCE[../libssl]=ssl_quic.c statem/statem_quic.c
-ENDIF
+DEFINE[../libssl]=$AESDEF
 
 SOURCE[../providers/libcommon.a]=record/tls_pad.c
 SOURCE[../providers/libdefault.a ../providers/libfips.a]=s3_cbc.c
diff --git a/deps/openssl/openssl/ssl/s3_msg.c b/deps/openssl/openssl/ssl/s3_msg.c
index dd2fe040e04..c0f0dbc17dc 100644
--- a/deps/openssl/openssl/ssl/s3_msg.c
+++ b/deps/openssl/openssl/ssl/s3_msg.c
@@ -81,16 +81,6 @@ int ssl3_dispatch_alert(SSL *s)
 
     s->s3.alert_dispatch = 0;
     alertlen = 2;
-#ifndef OPENSSL_NO_QUIC
-    if (SSL_IS_QUIC(s)) {
-        if (!s->quic_method->send_alert(s, s->quic_write_level,
-                                        s->s3.send_alert[1])) {
-            ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
-            return 0;
-        }
-        i = 1;
-    } else
-#endif
     i = do_ssl3_write(s, SSL3_RT_ALERT, &s->s3.send_alert[0], &alertlen, 1, 0,
                       &written);
     if (i <= 0) {
diff --git a/deps/openssl/openssl/ssl/ssl_ciph.c b/deps/openssl/openssl/ssl/ssl_ciph.c
index 76a1a8c967e..9e32417e75d 100644
--- a/deps/openssl/openssl/ssl/ssl_ciph.c
+++ b/deps/openssl/openssl/ssl/ssl_ciph.c
@@ -2240,37 +2240,3 @@ const char *OSSL_default_ciphersuites(void)
            "TLS_CHACHA20_POLY1305_SHA256:"
            "TLS_AES_128_GCM_SHA256";
 }
-
-#ifndef OPENSSL_NO_QUIC
-int SSL_CIPHER_get_prf_nid(const SSL_CIPHER *c)
-{
-    switch (c->algorithm2 & (0xFF << TLS1_PRF_DGST_SHIFT)) {
-    default:
-        break;
-    case TLS1_PRF_SHA1_MD5: /* TLS1_PRF */
-        return NID_md5_sha1;
-    case TLS1_PRF_SHA256:
-        return NID_sha256;
-    case TLS1_PRF_SHA384:
-        return NID_sha384;
-    case TLS1_PRF_GOST94:
-        return NID_id_GostR3411_94_prf;
-    case TLS1_PRF_GOST12_256:
-        return NID_id_GostR3411_2012_256;
-    case TLS1_PRF_GOST12_512:
-        return NID_id_GostR3411_2012_512;
-    }
-    /* TLSv1.3 ciphers don't specify separate PRF */
-    switch (c->algorithm2 & SSL_HANDSHAKE_MAC_MASK) {
-    default:
-        break;
-    case SSL_HANDSHAKE_MAC_MD5_SHA1: /* SSL_HANDSHAKE_MAC_DEFAULT */
-        return NID_md5_sha1;
-    case SSL_HANDSHAKE_MAC_SHA256:
-        return NID_sha256;
-    case SSL_HANDSHAKE_MAC_SHA384:
-        return NID_sha384;
-    }
-    return NID_undef;
-}
-#endif
diff --git a/deps/openssl/openssl/ssl/ssl_err.c b/deps/openssl/openssl/ssl/ssl_err.c
index fe0d9c280f7..75be692e000 100644
--- a/deps/openssl/openssl/ssl/ssl_err.c
+++ b/deps/openssl/openssl/ssl/ssl_err.c
@@ -241,8 +241,6 @@ static const ERR_STRING_DATA SSL_str_reasons[] = {
     {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_MISSING_PARAMETERS), "missing parameters"},
     {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_MISSING_PSK_KEX_MODES_EXTENSION),
     "missing psk kex modes extension"},
-    {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_MISSING_QUIC_TRANSPORT_PARAMETERS_EXTENSION),
-    "missing quic transport parameters extension"},
     {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_MISSING_RSA_CERTIFICATE),
     "missing rsa certificate"},
     {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_MISSING_RSA_ENCRYPTING_CERT),
@@ -550,8 +548,6 @@ static const ERR_STRING_DATA SSL_str_reasons[] = {
     {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_WRONG_CIPHER_RETURNED),
     "wrong cipher returned"},
     {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_WRONG_CURVE), "wrong curve"},
-    {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_WRONG_ENCRYPTION_LEVEL_RECEIVED),
-    "wrong encryption level received"},
     {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_WRONG_SIGNATURE_LENGTH),
     "wrong signature length"},
     {ERR_PACK(ERR_LIB_SSL, 0, SSL_R_WRONG_SIGNATURE_SIZE),
diff --git a/deps/openssl/openssl/ssl/ssl_lib.c b/deps/openssl/openssl/ssl/ssl_lib.c
index 2619636df88..e628140dfae 100644
--- a/deps/openssl/openssl/ssl/ssl_lib.c
+++ b/deps/openssl/openssl/ssl/ssl_lib.c
@@ -581,56 +581,7 @@ static void clear_ciphers(SSL *s)
     ssl_clear_hash_ctx(&s->write_hash);
 }
 
-#ifndef OPENSSL_NO_QUIC
 int SSL_clear(SSL *s)
-{
-    if (!SSL_clear_not_quic(s))
-        return 0;
-    return SSL_clear_quic(s);
-}
-
-int SSL_clear_quic(SSL *s)
-{
-    OPENSSL_free(s->ext.peer_quic_transport_params_draft);
-    s->ext.peer_quic_transport_params_draft = NULL;
-    s->ext.peer_quic_transport_params_draft_len = 0;
-    OPENSSL_free(s->ext.peer_quic_transport_params);
-    s->ext.peer_quic_transport_params = NULL;
-    s->ext.peer_quic_transport_params_len = 0;
-    s->quic_read_level = ssl_encryption_initial;
-    s->quic_write_level = ssl_encryption_initial;
-    s->quic_latest_level_received = ssl_encryption_initial;
-    while (s->quic_input_data_head != NULL) {
-        QUIC_DATA *qd;
-
-        qd = s->quic_input_data_head;
-        s->quic_input_data_head = qd->next;
-        OPENSSL_free(qd);
-    }
-    s->quic_input_data_tail = NULL;
-    BUF_MEM_free(s->quic_buf);
-    s->quic_buf = NULL;
-    s->quic_next_record_start = 0;
-    memset(s->client_hand_traffic_secret, 0, EVP_MAX_MD_SIZE);
-    memset(s->server_hand_traffic_secret, 0, EVP_MAX_MD_SIZE);
-    memset(s->client_early_traffic_secret, 0, EVP_MAX_MD_SIZE);
-    /*
-     * CONFIG - DON'T CLEAR
-     * s->ext.quic_transport_params
-     * s->ext.quic_transport_params_len
-     * s->quic_transport_version
-     * s->quic_method = NULL;
-     */
-    return 1;
-}
-#endif
-
-/* Keep this conditional very local */
-#ifndef OPENSSL_NO_QUIC
-int SSL_clear_not_quic(SSL *s)
-#else
-int SSL_clear(SSL *s)
-#endif
 {
     if (s->method == NULL) {
         ERR_raise(ERR_LIB_SSL, SSL_R_NO_METHOD_SPECIFIED);
@@ -905,10 +856,6 @@ SSL *SSL_new(SSL_CTX *ctx)
 
     s->job = NULL;
 
-#ifndef OPENSSL_NO_QUIC
-    s->quic_method = ctx->quic_method;
-#endif
-
 #ifndef OPENSSL_NO_CT
     if (!SSL_set_ct_validation_callback(s, ctx->ct_validation_callback,
                                         ctx->ct_validation_callback_arg))
@@ -1306,20 +1253,6 @@ void SSL_free(SSL *s)
     OPENSSL_free(s->pha_context);
     EVP_MD_CTX_free(s->pha_dgst);
 
-#ifndef OPENSSL_NO_QUIC
-    OPENSSL_free(s->ext.quic_transport_params);
-    OPENSSL_free(s->ext.peer_quic_transport_params_draft);
-    OPENSSL_free(s->ext.peer_quic_transport_params);
-    BUF_MEM_free(s->quic_buf);
-    while (s->quic_input_data_head != NULL) {
-        QUIC_DATA *qd;
-
-        qd = s->quic_input_data_head;
-        s->quic_input_data_head = qd->next;
-        OPENSSL_free(qd);
-    }
-#endif
-
     sk_X509_NAME_pop_free(s->ca_names, X509_NAME_free);
     sk_X509_NAME_pop_free(s->client_ca_names, X509_NAME_free);
 
@@ -1919,12 +1852,6 @@ static int ssl_io_intern(void *vargs)
 
 int ssl_read_internal(SSL *s, void *buf, size_t num, size_t *readbytes)
 {
-#ifndef OPENSSL_NO_QUIC
-    if (SSL_IS_QUIC(s)) {
-        ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-        return -1;
-    }
-#endif
     if (s->handshake_func == NULL) {
         ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
         return -1;
@@ -2056,12 +1983,6 @@ int SSL_get_early_data_status(const SSL *s)
 
 static int ssl_peek_internal(SSL *s, void *buf, size_t num, size_t *readbytes)
 {
-#ifndef OPENSSL_NO_QUIC
-    if (SSL_IS_QUIC(s)) {
-        ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-        return -1;
-    }
-#endif
     if (s->handshake_func == NULL) {
         ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
         return -1;
@@ -2122,12 +2043,6 @@ int SSL_peek_ex(SSL *s, void *buf, size_t num, size_t *readbytes)
 
 int ssl_write_internal(SSL *s, const void *buf, size_t num, size_t *written)
 {
-#ifndef OPENSSL_NO_QUIC
-    if (SSL_IS_QUIC(s)) {
-        ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-        return -1;
-    }
-#endif
     if (s->handshake_func == NULL) {
         ERR_raise(ERR_LIB_SSL, SSL_R_UNINITIALIZED);
         return -1;
@@ -3960,11 +3875,6 @@ int SSL_get_error(const SSL *s, int i)
     }
 
     if (SSL_want_read(s)) {
-#ifndef OPENSSL_NO_QUIC
-        if (SSL_IS_QUIC(s)) {
-            return SSL_ERROR_WANT_READ;
-        }
-#endif
         bio = SSL_get_rbio(s);
         if (BIO_should_read(bio))
             return SSL_ERROR_WANT_READ;
@@ -4064,21 +3974,6 @@ int SSL_do_handshake(SSL *s)
             ret = s->handshake_func(s);
         }
     }
-#ifndef OPENSSL_NO_QUIC
-    if (SSL_IS_QUIC(s) && ret == 1) {
-        if (s->server) {
-            if (s->early_data_state == SSL_EARLY_DATA_ACCEPTING) {
-                s->early_data_state = SSL_EARLY_DATA_FINISHED_READING;
-                s->rwstate = SSL_READING;
-                ret = 0;
-            }
-        } else if (s->early_data_state == SSL_EARLY_DATA_CONNECTING) {
-            s->early_data_state = SSL_EARLY_DATA_WRITE_RETRY;
-            s->rwstate = SSL_READING;
-            ret = 0;
-        }
-    }
-#endif
     return ret;
 }
 
diff --git a/deps/openssl/openssl/ssl/ssl_local.h b/deps/openssl/openssl/ssl/ssl_local.h
index 51c4a77a9ed..5fb1feb8016 100644
--- a/deps/openssl/openssl/ssl/ssl_local.h
+++ b/deps/openssl/openssl/ssl/ssl_local.h
@@ -337,13 +337,6 @@
 /* Flag used on OpenSSL ciphersuite ids to indicate they are for SSLv3+ */
 # define SSL3_CK_CIPHERSUITE_FLAG                0x03000000
 
-/* Check if an SSL structure is using QUIC (which uses TLSv1.3) */
-# ifndef OPENSSL_NO_QUIC
-#  define SSL_IS_QUIC(s)  (s->quic_method != NULL)
-# else
-#  define SSL_IS_QUIC(s) 0
-# endif
-
 /* Check if an SSL structure is using DTLS */
 # define SSL_IS_DTLS(s)  (s->method->ssl3_enc->enc_flags & SSL_ENC_FLAG_DTLS)
 
@@ -773,8 +766,6 @@ typedef enum tlsext_index_en {
     TLSEXT_IDX_cryptopro_bug,
     TLSEXT_IDX_early_data,
     TLSEXT_IDX_certificate_authorities,
-    TLSEXT_IDX_quic_transport_parameters_draft,
-    TLSEXT_IDX_quic_transport_parameters,
     TLSEXT_IDX_padding,
     TLSEXT_IDX_psk,
     /* Dummy index - must always be the last entry */
@@ -1214,25 +1205,10 @@ struct ssl_ctx_st {
     uint32_t disabled_mac_mask;
     uint32_t disabled_mkey_mask;
     uint32_t disabled_auth_mask;
-
-#ifndef OPENSSL_NO_QUIC
-    const SSL_QUIC_METHOD *quic_method;
-#endif
 };
 
 typedef struct cert_pkey_st CERT_PKEY;
 
-#ifndef OPENSSL_NO_QUIC
-struct quic_data_st {
-    struct quic_data_st *next;
-    OSSL_ENCRYPTION_LEVEL level;
-    size_t start;       /* offset into quic_buf->data */
-    size_t length;
-};
-typedef struct quic_data_st QUIC_DATA;
-int quic_set_encryption_secrets(SSL *ssl, OSSL_ENCRYPTION_LEVEL level);
-#endif
-
 struct ssl_st {
     /*
      * protocol version (one of SSL2_VERSION, SSL3_VERSION, TLS1_VERSION,
@@ -1492,11 +1468,6 @@ struct ssl_st {
     unsigned char handshake_traffic_hash[EVP_MAX_MD_SIZE];
     unsigned char client_app_traffic_secret[EVP_MAX_MD_SIZE];
     unsigned char server_app_traffic_secret[EVP_MAX_MD_SIZE];
-# ifndef OPENSSL_NO_QUIC
-    unsigned char client_hand_traffic_secret[EVP_MAX_MD_SIZE];
-    unsigned char server_hand_traffic_secret[EVP_MAX_MD_SIZE];
-    unsigned char client_early_traffic_secret[EVP_MAX_MD_SIZE];
-# endif
     unsigned char exporter_master_secret[EVP_MAX_MD_SIZE];
     unsigned char early_exporter_master_secret[EVP_MAX_MD_SIZE];
     EVP_CIPHER_CTX *enc_read_ctx; /* cryptographic state */
@@ -1709,35 +1680,8 @@ struct ssl_st {
          * selected.
          */
         int tick_identity;
-
-#ifndef OPENSSL_NO_QUIC
-        uint8_t *quic_transport_params;
-        size_t quic_transport_params_len;
-        uint8_t *peer_quic_transport_params_draft;
-        size_t peer_quic_transport_params_draft_len;
-        uint8_t *peer_quic_transport_params;
-        size_t peer_quic_transport_params_len;
-#endif
     } ext;
 
-#ifndef OPENSSL_NO_QUIC
-    OSSL_ENCRYPTION_LEVEL quic_read_level;
-    OSSL_ENCRYPTION_LEVEL quic_write_level;
-    OSSL_ENCRYPTION_LEVEL quic_latest_level_received;
-    BUF_MEM *quic_buf;          /* buffer incoming handshake messages */
-    /*
-     * defaults to 0, but can be set to:
-     * - TLSEXT_TYPE_quic_transport_parameters_draft
-     * - TLSEXT_TYPE_quic_transport_parameters
-     * Client: if 0, send both
-     * Server: if 0, use same version as client sent
-     */
-    int quic_transport_version;
-    QUIC_DATA *quic_input_data_head;
-    QUIC_DATA *quic_input_data_tail;
-    size_t quic_next_record_start;
-    const SSL_QUIC_METHOD *quic_method;
-#endif
     /*
      * Parsed form of the ClientHello, kept around across client_hello_cb
      * calls.
@@ -2867,11 +2811,6 @@ void custom_exts_free(custom_ext_methods *exts);
 
 void ssl_comp_free_compression_methods_int(void);
 
-#ifndef OPENSSL_NO_QUIC
-__owur int SSL_clear_not_quic(SSL *s);
-__owur int SSL_clear_quic(SSL *s);
-#endif
-
 /* ssl_mcnf.c */
 void ssl_ctx_system_config(SSL_CTX *ctx);
 
diff --git a/deps/openssl/openssl/ssl/ssl_quic.c b/deps/openssl/openssl/ssl/ssl_quic.c
deleted file mode 100644
index 987c1e740ca..00000000000
--- a/deps/openssl/openssl/ssl/ssl_quic.c
+++ /dev/null
@@ -1,378 +0,0 @@
-/*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#include "ssl_local.h"
-#include "internal/cryptlib.h"
-#include "internal/refcount.h"
-
-int SSL_set_quic_transport_params(SSL *ssl, const uint8_t *params,
-                                  size_t params_len)
-{
-    uint8_t *tmp;
-
-    if (params == NULL || params_len == 0) {
-        tmp = NULL;
-        params_len = 0;
-    } else {
-        tmp = OPENSSL_memdup(params, params_len);
-        if (tmp == NULL)
-            return 0;
-    }
-
-    OPENSSL_free(ssl->ext.quic_transport_params);
-    ssl->ext.quic_transport_params = tmp;
-    ssl->ext.quic_transport_params_len = params_len;
-    return 1;
-}
-
-void SSL_get_peer_quic_transport_params(const SSL *ssl,
-                                        const uint8_t **out_params,
-                                        size_t *out_params_len)
-{
-    if (ssl->ext.peer_quic_transport_params_len) {
-        *out_params = ssl->ext.peer_quic_transport_params;
-        *out_params_len = ssl->ext.peer_quic_transport_params_len;
-    } else {
-        *out_params = ssl->ext.peer_quic_transport_params_draft;
-        *out_params_len = ssl->ext.peer_quic_transport_params_draft_len;
-    }
-}
-
-/* Returns the negotiated version, or -1 on error */
-int SSL_get_peer_quic_transport_version(const SSL *ssl)
-{
-    if (ssl->ext.peer_quic_transport_params_len != 0
-            && ssl->ext.peer_quic_transport_params_draft_len != 0)
-        return -1;
-    if (ssl->ext.peer_quic_transport_params_len != 0)
-        return TLSEXT_TYPE_quic_transport_parameters;
-    if (ssl->ext.peer_quic_transport_params_draft_len != 0)
-        return TLSEXT_TYPE_quic_transport_parameters_draft;
-
-    return -1;
-}
-
-void SSL_set_quic_use_legacy_codepoint(SSL *ssl, int use_legacy)
-{
-    if (use_legacy)
-        ssl->quic_transport_version = TLSEXT_TYPE_quic_transport_parameters_draft;
-    else
-        ssl->quic_transport_version = TLSEXT_TYPE_quic_transport_parameters;
-}
-
-void SSL_set_quic_transport_version(SSL *ssl, int version)
-{
-    ssl->quic_transport_version = version;
-}
-
-int SSL_get_quic_transport_version(const SSL *ssl)
-{
-    return ssl->quic_transport_version;
-}
-
-size_t SSL_quic_max_handshake_flight_len(const SSL *ssl, OSSL_ENCRYPTION_LEVEL level)
-{
-    /*
-     * Limits flights to 16K by default when there are no large
-     * (certificate-carrying) messages.
-     */
-    static const size_t DEFAULT_FLIGHT_LIMIT = 16384;
-
-    switch (level) {
-    case ssl_encryption_initial:
-        return DEFAULT_FLIGHT_LIMIT;
-    case ssl_encryption_early_data:
-        /* QUIC does not send EndOfEarlyData. */
-        return 0;
-    case ssl_encryption_handshake:
-        if (ssl->server) {
-            /*
-             * Servers may receive Certificate message if configured to request
-             * client certificates.
-             */
-            if ((ssl->verify_mode & SSL_VERIFY_PEER)
-                    && ssl->max_cert_list > DEFAULT_FLIGHT_LIMIT)
-                return ssl->max_cert_list;
-        } else {
-            /*
-             * Clients may receive both Certificate message and a CertificateRequest
-             * message.
-             */
-            if (2*ssl->max_cert_list > DEFAULT_FLIGHT_LIMIT)
-                return 2 * ssl->max_cert_list;
-        }
-        return DEFAULT_FLIGHT_LIMIT;
-    case ssl_encryption_application:
-        return DEFAULT_FLIGHT_LIMIT;
-    }
-
-    return 0;
-}
-
-OSSL_ENCRYPTION_LEVEL SSL_quic_read_level(const SSL *ssl)
-{
-    return ssl->quic_read_level;
-}
-
-OSSL_ENCRYPTION_LEVEL SSL_quic_write_level(const SSL *ssl)
-{
-    return ssl->quic_write_level;
-}
-
-int SSL_provide_quic_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                          const uint8_t *data, size_t len)
-{
-    size_t l, offset;
-
-    if (!SSL_IS_QUIC(ssl)) {
-        ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-        return 0;
-    }
-
-    /* Level can be different than the current read, but not less */
-    if (level < ssl->quic_read_level
-            || (ssl->quic_input_data_tail != NULL && level < ssl->quic_input_data_tail->level)
-            || level < ssl->quic_latest_level_received) {
-        ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_ENCRYPTION_LEVEL_RECEIVED);
-        return 0;
-    }
-
-    if (len == 0)
-        return 1;
-
-    if (ssl->quic_buf == NULL) {
-        BUF_MEM *buf;
-        if ((buf = BUF_MEM_new()) == NULL) {
-            ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
-            return 0;
-        }
-        if (!BUF_MEM_grow(buf, SSL3_RT_MAX_PLAIN_LENGTH)) {
-            ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
-            BUF_MEM_free(buf);
-            return 0;
-        }
-        ssl->quic_buf = buf;
-        /* We preallocated storage, but there's still no *data*. */
-        ssl->quic_buf->length = 0;
-        buf = NULL;
-    }
-
-    /* A TLS message must not cross an encryption level boundary */
-    if (ssl->quic_buf->length != ssl->quic_next_record_start
-            && level != ssl->quic_latest_level_received) {
-        ERR_raise(ERR_LIB_SSL, SSL_R_WRONG_ENCRYPTION_LEVEL_RECEIVED);
-        return 0;
-    }
-    ssl->quic_latest_level_received = level;
-
-    offset = ssl->quic_buf->length;
-    if (!BUF_MEM_grow(ssl->quic_buf, offset + len)) {
-        ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
-        return 0;
-    }
-    memcpy(ssl->quic_buf->data + offset, data, len);
-
-    /* Split on handshake message boundaries */
-    while (ssl->quic_buf->length > ssl->quic_next_record_start
-                                   + SSL3_HM_HEADER_LENGTH) {
-        QUIC_DATA *qd;
-        const uint8_t *p;
-
-        /* TLS Handshake message header has 1-byte type and 3-byte length */
-        p = (const uint8_t *)ssl->quic_buf->data
-            + ssl->quic_next_record_start + 1;
-        n2l3(p, l);
-        l += SSL3_HM_HEADER_LENGTH;
-        /* Don't allocate a QUIC_DATA if we don't have a full record */
-        if (l > ssl->quic_buf->length - ssl->quic_next_record_start)
-            break;
-
-        qd = OPENSSL_zalloc(sizeof(*qd));
-        if (qd == NULL) {
-            ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
-            return 0;
-        }
-
-        qd->next = NULL;
-        qd->length = l;
-        qd->start = ssl->quic_next_record_start;
-        qd->level = level;
-
-        if (ssl->quic_input_data_tail != NULL)
-            ssl->quic_input_data_tail->next = qd;
-        else
-            ssl->quic_input_data_head = qd;
-        ssl->quic_input_data_tail = qd;
-        ssl->quic_next_record_start += l;
-    }
-
-    return 1;
-}
-
-int SSL_CTX_set_quic_method(SSL_CTX *ctx, const SSL_QUIC_METHOD *quic_method)
-{
-    if (ctx->method->version != TLS_ANY_VERSION)
-        return 0;
-    ctx->quic_method = quic_method;
-    ctx->options &= ~SSL_OP_ENABLE_MIDDLEBOX_COMPAT;
-    return 1;
-}
-
-int SSL_set_quic_method(SSL *ssl, const SSL_QUIC_METHOD *quic_method)
-{
-    if (ssl->method->version != TLS_ANY_VERSION)
-        return 0;
-    ssl->quic_method = quic_method;
-    ssl->options &= ~SSL_OP_ENABLE_MIDDLEBOX_COMPAT;
-    return 1;
-}
-
-int quic_set_encryption_secrets(SSL *ssl, OSSL_ENCRYPTION_LEVEL level)
-{
-    uint8_t *c2s_secret = NULL;
-    uint8_t *s2c_secret = NULL;
-    size_t len;
-    const EVP_MD *md;
-
-    if (!SSL_IS_QUIC(ssl))
-        return 1;
-
-    /* secrets from the POV of the client */
-    switch (level) {
-    case ssl_encryption_early_data:
-        c2s_secret = ssl->client_early_traffic_secret;
-        break;
-    case ssl_encryption_handshake:
-        c2s_secret = ssl->client_hand_traffic_secret;
-        s2c_secret = ssl->server_hand_traffic_secret;
-        break;
-    case ssl_encryption_application:
-        c2s_secret = ssl->client_app_traffic_secret;
-        s2c_secret = ssl->server_app_traffic_secret;
-        break;
-    default:
-        return 1;
-    }
-
-    if (level == ssl_encryption_early_data) {
-        const SSL_CIPHER *c = SSL_SESSION_get0_cipher(ssl->session);
-        if (ssl->early_data_state == SSL_EARLY_DATA_CONNECTING
-                && ssl->max_early_data > 0
-                && ssl->session->ext.max_early_data == 0) {
-            if (!ossl_assert(ssl->psksession != NULL
-                    && ssl->max_early_data ==
-                       ssl->psksession->ext.max_early_data)) {
-                SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-                return 0;
-            }
-            c = SSL_SESSION_get0_cipher(ssl->psksession);
-        }
-
-        if (c == NULL) {
-            SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-            return 0;
-        }
-
-        md = ssl_md(ssl->ctx, c->algorithm2);
-    } else {
-        md = ssl_handshake_md(ssl);
-        if (md == NULL) {
-            /* May not have selected cipher, yet */
-            const SSL_CIPHER *c = NULL;
-
-            /*
-             * It probably doesn't make sense to use an (external) PSK session,
-             * but in theory some kinds of external session caches could be
-             * implemented using it, so allow psksession to be used as well as
-             * the regular session.
-             */
-            if (ssl->session != NULL)
-                c = SSL_SESSION_get0_cipher(ssl->session);
-            else if (ssl->psksession != NULL)
-                c = SSL_SESSION_get0_cipher(ssl->psksession);
-
-            if (c != NULL)
-                md = SSL_CIPHER_get_handshake_digest(c);
-        }
-    }
-
-    if ((len = EVP_MD_size(md)) <= 0) {
-        SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-        return 0;
-    }
-
-    if (ssl->server) {
-        if (!ssl->quic_method->set_encryption_secrets(ssl, level, c2s_secret,
-                                                      s2c_secret, len)) {
-            SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-            return 0;
-        }
-    } else {
-        if (!ssl->quic_method->set_encryption_secrets(ssl, level, s2c_secret,
-                                                      c2s_secret, len)) {
-            SSLfatal(ssl, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-            return 0;
-        }
-    }
-
-    return 1;
-}
-
-int SSL_process_quic_post_handshake(SSL *ssl)
-{
-    int ret;
-
-    if (SSL_in_init(ssl) || !SSL_IS_QUIC(ssl)) {
-        ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-        return 0;
-    }
-
-    /* if there is no data, return success as BoringSSL */
-    while (ssl->quic_input_data_head != NULL) {
-        /*
-         * This is always safe (we are sure to be at a record boundary) because
-         * SSL_read()/SSL_write() are never used for QUIC connections -- the
-         * application data is handled at the QUIC layer instead.
-         */
-        ossl_statem_set_in_init(ssl, 1);
-        ret = ssl->handshake_func(ssl);
-        ossl_statem_set_in_init(ssl, 0);
-
-        if (ret <= 0)
-            return 0;
-    }
-    return 1;
-}
-
-int SSL_is_quic(SSL* ssl)
-{
-    return SSL_IS_QUIC(ssl);
-}
-
-void SSL_set_quic_early_data_enabled(SSL *ssl, int enabled)
-{
-    if (!SSL_is_quic(ssl) || !SSL_in_before(ssl))
-        return;
-
-    if (!enabled) {
-      ssl->early_data_state = SSL_EARLY_DATA_NONE;
-      return;
-    }
-
-    if (ssl->server) {
-        ssl->early_data_state = SSL_EARLY_DATA_ACCEPTING;
-        return;
-    }
-
-    if ((ssl->session == NULL || ssl->session->ext.max_early_data == 0)
-            && ssl->psk_use_session_cb == NULL)
-        return;
-
-    ssl->early_data_state = SSL_EARLY_DATA_CONNECTING;
-}
diff --git a/deps/openssl/openssl/ssl/statem/extensions.c b/deps/openssl/openssl/ssl/statem/extensions.c
index ed78744119e..f8157389b7f 100644
--- a/deps/openssl/openssl/ssl/statem/extensions.c
+++ b/deps/openssl/openssl/ssl/statem/extensions.c
@@ -59,11 +59,6 @@ static int final_early_data(SSL *s, unsigned int context, int sent);
 static int final_maxfragmentlen(SSL *s, unsigned int context, int sent);
 static int init_post_handshake_auth(SSL *s, unsigned int context);
 static int final_psk(SSL *s, unsigned int context, int sent);
-#ifndef OPENSSL_NO_QUIC
-static int init_quic_transport_params(SSL *s, unsigned int context);
-static int final_quic_transport_params_draft(SSL *s, unsigned int context, int sent);
-static int final_quic_transport_params(SSL *s, unsigned int context, int sent);
-#endif
 
 /* Structure to define a built-in extension */
 typedef struct extensions_definition_st {
@@ -375,29 +370,6 @@ static const EXTENSION_DEFINITION ext_defs[] = {
         tls_construct_certificate_authorities,
         tls_construct_certificate_authorities, NULL,
     },
-#ifndef OPENSSL_NO_QUIC
-    {
-        TLSEXT_TYPE_quic_transport_parameters_draft,
-        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
-        | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY,
-        init_quic_transport_params,
-        tls_parse_ctos_quic_transport_params_draft, tls_parse_stoc_quic_transport_params_draft,
-        tls_construct_stoc_quic_transport_params_draft, tls_construct_ctos_quic_transport_params_draft,
-        final_quic_transport_params_draft,
-    },
-    {
-        TLSEXT_TYPE_quic_transport_parameters,
-        SSL_EXT_CLIENT_HELLO | SSL_EXT_TLS1_3_ENCRYPTED_EXTENSIONS
-        | SSL_EXT_TLS_IMPLEMENTATION_ONLY | SSL_EXT_TLS1_3_ONLY,
-        init_quic_transport_params,
-        tls_parse_ctos_quic_transport_params, tls_parse_stoc_quic_transport_params,
-        tls_construct_stoc_quic_transport_params, tls_construct_ctos_quic_transport_params,
-        final_quic_transport_params,
-    },
-#else
-    INVALID_EXTENSION,
-    INVALID_EXTENSION,
-#endif
     {
         /* Must be immediately before pre_shared_key */
         TLSEXT_TYPE_padding,
@@ -1750,44 +1722,3 @@ static int final_psk(SSL *s, unsigned int context, int sent)
 
     return 1;
 }
-
-#ifndef OPENSSL_NO_QUIC
-static int init_quic_transport_params(SSL *s, unsigned int context)
-{
-    return 1;
-}
-
-static int final_quic_transport_params_draft(SSL *s, unsigned int context,
-                                             int sent)
-{
-    return 1;
-}
-
-static int final_quic_transport_params(SSL *s, unsigned int context, int sent)
-{
-    /* called after final_quic_transport_params_draft */
-    if (SSL_IS_QUIC(s)) {
-        if (s->ext.peer_quic_transport_params_len == 0
-                && s->ext.peer_quic_transport_params_draft_len == 0) {
-            SSLfatal(s, SSL_AD_MISSING_EXTENSION,
-                     SSL_R_MISSING_QUIC_TRANSPORT_PARAMETERS_EXTENSION);
-            return 0;
-        }
-        /* if we got both, discard the one we can't use */
-        if (s->ext.peer_quic_transport_params_len != 0
-                && s->ext.peer_quic_transport_params_draft_len != 0) {
-            if (s->quic_transport_version == TLSEXT_TYPE_quic_transport_parameters_draft) {
-                OPENSSL_free(s->ext.peer_quic_transport_params);
-                s->ext.peer_quic_transport_params = NULL;
-                s->ext.peer_quic_transport_params_len = 0;
-            } else {
-                OPENSSL_free(s->ext.peer_quic_transport_params_draft);
-                s->ext.peer_quic_transport_params_draft = NULL;
-                s->ext.peer_quic_transport_params_draft_len = 0;
-            }
-        }
-    }
-
-    return 1;
-}
-#endif
diff --git a/deps/openssl/openssl/ssl/statem/extensions_clnt.c b/deps/openssl/openssl/ssl/statem/extensions_clnt.c
index 3b0781fc71c..ced88f77ba3 100644
--- a/deps/openssl/openssl/ssl/statem/extensions_clnt.c
+++ b/deps/openssl/openssl/ssl/statem/extensions_clnt.c
@@ -1196,47 +1196,7 @@ EXT_RETURN tls_construct_ctos_post_handshake_auth(SSL *s, WPACKET *pkt,
 #endif
 }
 
-#ifndef OPENSSL_NO_QUIC
-EXT_RETURN tls_construct_ctos_quic_transport_params_draft(SSL *s, WPACKET *pkt,
-                                                          unsigned int context, X509 *x,
-                                                          size_t chainidx)
-{
-    if (s->quic_transport_version == TLSEXT_TYPE_quic_transport_parameters
-            || s->ext.quic_transport_params == NULL
-            || s->ext.quic_transport_params_len == 0) {
-        return EXT_RETURN_NOT_SENT;
-    }
-
-    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_quic_transport_parameters_draft)
-        || !WPACKET_sub_memcpy_u16(pkt, s->ext.quic_transport_params,
-                                   s->ext.quic_transport_params_len)) {
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-        return EXT_RETURN_FAIL;
-    }
-
-    return EXT_RETURN_SENT;
-}
 
-EXT_RETURN tls_construct_ctos_quic_transport_params(SSL *s, WPACKET *pkt,
-                                                    unsigned int context, X509 *x,
-                                                    size_t chainidx)
-{
-    if (s->quic_transport_version == TLSEXT_TYPE_quic_transport_parameters_draft
-            || s->ext.quic_transport_params == NULL
-            || s->ext.quic_transport_params_len == 0) {
-        return EXT_RETURN_NOT_SENT;
-    }
-
-    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_quic_transport_parameters)
-        || !WPACKET_sub_memcpy_u16(pkt, s->ext.quic_transport_params,
-                                   s->ext.quic_transport_params_len)) {
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-        return EXT_RETURN_FAIL;
-    }
-
-    return EXT_RETURN_SENT;
-}
-#endif
 /*
  * Parse the server's renegotiation binding and abort if it's not right
  */
@@ -1964,17 +1924,6 @@ int tls_parse_stoc_early_data(SSL *s, PACKET *pkt, unsigned int context,
             return 0;
         }
 
-#ifndef OPENSSL_NO_QUIC
-        /*
-         * QUIC server must send 0xFFFFFFFF or it's a PROTOCOL_VIOLATION
-         * per RFC9001 S4.6.1
-         */
-        if (SSL_IS_QUIC(s) && max_early_data != 0xFFFFFFFF) {
-            SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_INVALID_MAX_EARLY_DATA);
-            return 0;
-        }
-#endif
-
         s->session->ext.max_early_data = max_early_data;
 
         return 1;
@@ -2057,37 +2006,3 @@ int tls_parse_stoc_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
 
     return 1;
 }
-#ifndef OPENSSL_NO_QUIC
-int tls_parse_stoc_quic_transport_params_draft(SSL *s, PACKET *pkt,
-                                               unsigned int context, X509 *x,
-                                               size_t chainidx)
-{
-    OPENSSL_free(s->ext.peer_quic_transport_params_draft);
-    s->ext.peer_quic_transport_params_draft = NULL;
-    s->ext.peer_quic_transport_params_draft_len = 0;
-
-    if (!PACKET_memdup(pkt,
-                       &s->ext.peer_quic_transport_params_draft,
-                       &s->ext.peer_quic_transport_params_draft_len)) {
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-        return 0;
-    }
-    return 1;
-}
-
-int tls_parse_stoc_quic_transport_params(SSL *s, PACKET *pkt, unsigned int context,
-                                         X509 *x, size_t chainidx)
-{
-    OPENSSL_free(s->ext.peer_quic_transport_params);
-    s->ext.peer_quic_transport_params = NULL;
-    s->ext.peer_quic_transport_params_len = 0;
-
-    if (!PACKET_memdup(pkt,
-                       &s->ext.peer_quic_transport_params,
-                       &s->ext.peer_quic_transport_params_len)) {
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-        return 0;
-    }
-    return 1;
-}
-#endif
diff --git a/deps/openssl/openssl/ssl/statem/extensions_srvr.c b/deps/openssl/openssl/ssl/statem/extensions_srvr.c
index 546d11dd1f7..72c00574be6 100644
--- a/deps/openssl/openssl/ssl/statem/extensions_srvr.c
+++ b/deps/openssl/openssl/ssl/statem/extensions_srvr.c
@@ -1083,7 +1083,7 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
 
             if (sesstmp == NULL) {
                 SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-                return 0;
+                goto err;
             }
             SSL_SESSION_free(sess);
             sess = sesstmp;
@@ -1237,40 +1237,6 @@ int tls_parse_ctos_post_handshake_auth(SSL *s, PACKET *pkt,
     return 1;
 }
 
-#ifndef OPENSSL_NO_QUIC
-int tls_parse_ctos_quic_transport_params_draft(SSL *s, PACKET *pkt, unsigned int context,
-                                               X509 *x, size_t chainidx)
-{
-    OPENSSL_free(s->ext.peer_quic_transport_params_draft);
-    s->ext.peer_quic_transport_params_draft = NULL;
-    s->ext.peer_quic_transport_params_draft_len = 0;
-
-    if (!PACKET_memdup(pkt,
-                       &s->ext.peer_quic_transport_params_draft,
-                       &s->ext.peer_quic_transport_params_draft_len)) {
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-        return 0;
-    }
-    return 1;
-}
-
-int tls_parse_ctos_quic_transport_params(SSL *s, PACKET *pkt, unsigned int context,
-                                         X509 *x, size_t chainidx)
-{
-    OPENSSL_free(s->ext.peer_quic_transport_params);
-    s->ext.peer_quic_transport_params = NULL;
-    s->ext.peer_quic_transport_params_len = 0;
-
-    if (!PACKET_memdup(pkt,
-                       &s->ext.peer_quic_transport_params,
-                       &s->ext.peer_quic_transport_params_len)) {
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-        return 0;
-    }
-    return 1;
-}
-#endif
-
 /*
  * Add the server's renegotiation binding
  */
@@ -1911,20 +1877,12 @@ EXT_RETURN tls_construct_stoc_early_data(SSL *s, WPACKET *pkt,
                                          size_t chainidx)
 {
     if (context == SSL_EXT_TLS1_3_NEW_SESSION_TICKET) {
-        uint32_t max_early_data = s->max_early_data;
-
-        if (max_early_data == 0)
+        if (s->max_early_data == 0)
             return EXT_RETURN_NOT_SENT;
 
-#ifndef OPENSSL_NO_QUIC
-        /* QUIC server must always send 0xFFFFFFFF, per RFC9001 S4.6.1 */
-        if (SSL_IS_QUIC(s))
-            max_early_data = 0xFFFFFFFF;
-#endif
-
         if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_early_data)
                 || !WPACKET_start_sub_packet_u16(pkt)
-                || !WPACKET_put_bytes_u32(pkt, max_early_data)
+                || !WPACKET_put_bytes_u32(pkt, s->max_early_data)
                 || !WPACKET_close(pkt)) {
             SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
             return EXT_RETURN_FAIL;
@@ -1962,48 +1920,3 @@ EXT_RETURN tls_construct_stoc_psk(SSL *s, WPACKET *pkt, unsigned int context,
 
     return EXT_RETURN_SENT;
 }
-
-#ifndef OPENSSL_NO_QUIC
-EXT_RETURN tls_construct_stoc_quic_transport_params_draft(SSL *s, WPACKET *pkt,
-                                                          unsigned int context,
-                                                          X509 *x,
-                                                          size_t chainidx)
-{
-    if (s->quic_transport_version == TLSEXT_TYPE_quic_transport_parameters
-            || s->ext.peer_quic_transport_params_draft_len == 0
-            || s->ext.quic_transport_params == NULL
-            || s->ext.quic_transport_params_len == 0) {
-        return EXT_RETURN_NOT_SENT;
-    }
-
-    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_quic_transport_parameters_draft)
-        || !WPACKET_sub_memcpy_u16(pkt, s->ext.quic_transport_params,
-                                   s->ext.quic_transport_params_len)) {
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-        return EXT_RETURN_FAIL;
-    }
-
-    return EXT_RETURN_SENT;
-}
-
-EXT_RETURN tls_construct_stoc_quic_transport_params(SSL *s, WPACKET *pkt,
-                                                    unsigned int context, X509 *x,
-                                                    size_t chainidx)
-{
-    if (s->quic_transport_version == TLSEXT_TYPE_quic_transport_parameters_draft
-            || s->ext.peer_quic_transport_params_len == 0
-            || s->ext.quic_transport_params == NULL
-            || s->ext.quic_transport_params_len == 0) {
-        return EXT_RETURN_NOT_SENT;
-    }
-
-    if (!WPACKET_put_bytes_u16(pkt, TLSEXT_TYPE_quic_transport_parameters)
-        || !WPACKET_sub_memcpy_u16(pkt, s->ext.quic_transport_params,
-                                   s->ext.quic_transport_params_len)) {
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-        return EXT_RETURN_FAIL;
-    }
-
-    return EXT_RETURN_SENT;
-}
-#endif
diff --git a/deps/openssl/openssl/ssl/statem/statem.c b/deps/openssl/openssl/ssl/statem/statem.c
index d80d4da2038..553546d93a4 100644
--- a/deps/openssl/openssl/ssl/statem/statem.c
+++ b/deps/openssl/openssl/ssl/statem/statem.c
@@ -334,13 +334,8 @@ static int state_machine(SSL *s, int server)
          * If we are stateless then we already called SSL_clear() - don't do
          * it again and clear the STATELESS flag itself.
          */
-#ifndef OPENSSL_NO_QUIC
-        if ((s->s3.flags & TLS1_FLAGS_STATELESS) == 0 && !SSL_clear_not_quic(s))
-            return -1;
-#else
         if ((s->s3.flags & TLS1_FLAGS_STATELESS) == 0 && !SSL_clear(s))
             return -1;
-#endif
     }
 #ifndef OPENSSL_NO_SCTP
     if (SSL_IS_DTLS(s) && BIO_dgram_is_sctp(SSL_get_wbio(s))) {
@@ -588,11 +583,6 @@ static SUB_STATE_RETURN read_state_machine(SSL *s)
                  * In DTLS we get the whole message in one go - header and body
                  */
                 ret = dtls_get_message(s, &mt);
-#ifndef OPENSSL_NO_QUIC
-            } else if (SSL_IS_QUIC(s)) {
-                /* QUIC behaves like DTLS -- all in one go. */
-                ret = quic_get_message(s, &mt);
-#endif
             } else {
                 ret = tls_get_message_header(s, &mt);
             }
@@ -622,8 +612,8 @@ static SUB_STATE_RETURN read_state_machine(SSL *s)
                 return SUB_STATE_ERROR;
             }
 
-            /* dtls_get_message/quic_get_message already did this */
-            if (!SSL_IS_DTLS(s) && !SSL_IS_QUIC(s)
+            /* dtls_get_message already did this */
+            if (!SSL_IS_DTLS(s)
                     && s->s3.tmp.message_size > 0
                     && !grow_init_buf(s, s->s3.tmp.message_size
                                          + SSL3_HM_HEADER_LENGTH)) {
@@ -641,10 +631,6 @@ static SUB_STATE_RETURN read_state_machine(SSL *s)
                  * opportunity to do any further processing.
                  */
                 ret = dtls_get_message_body(s, &len);
-#ifndef OPENSSL_NO_QUIC
-            } else if (SSL_IS_QUIC(s)) {
-                ret = quic_get_message_body(s, &len);
-#endif
             } else {
                 ret = tls_get_message_body(s, &len);
             }
@@ -935,14 +921,6 @@ static SUB_STATE_RETURN write_state_machine(SSL *s)
 int statem_flush(SSL *s)
 {
     s->rwstate = SSL_WRITING;
-#ifndef OPENSSL_NO_QUIC
-    if (SSL_IS_QUIC(s)) {
-        if (!s->quic_method->flush_flight(s)) {
-            ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
-            return 0;
-        }
-    } else
-#endif
     if (BIO_flush(s->wbio) <= 0) {
         return 0;
     }
diff --git a/deps/openssl/openssl/ssl/statem/statem_clnt.c b/deps/openssl/openssl/ssl/statem/statem_clnt.c
index 9d925091b6c..3cd1ee2d3df 100644
--- a/deps/openssl/openssl/ssl/statem/statem_clnt.c
+++ b/deps/openssl/openssl/ssl/statem/statem_clnt.c
@@ -904,14 +904,6 @@ int ossl_statem_client_construct_message(SSL *s, WPACKET *pkt,
         break;
 
     case TLS_ST_CW_END_OF_EARLY_DATA:
-#ifndef OPENSSL_NO_QUIC
-        /* QUIC does not send EndOfEarlyData, RFC9001 S8.3 */
-        if (SSL_IS_QUIC(s)) {
-            *confunc = NULL;
-            *mt = SSL3_MT_DUMMY;
-            break;
-        }
-#endif
         *confunc = tls_construct_end_of_early_data;
         *mt = SSL3_MT_END_OF_EARLY_DATA;
         break;
diff --git a/deps/openssl/openssl/ssl/statem/statem_lib.c b/deps/openssl/openssl/ssl/statem/statem_lib.c
index 121929b06f4..6f0eaa5d6c0 100644
--- a/deps/openssl/openssl/ssl/statem/statem_lib.c
+++ b/deps/openssl/openssl/ssl/statem/statem_lib.c
@@ -45,29 +45,8 @@ int ssl3_do_write(SSL *s, int type)
     int ret;
     size_t written = 0;
 
-#ifndef OPENSSL_NO_QUIC
-    if (SSL_IS_QUIC(s)) {
-        if (type == SSL3_RT_HANDSHAKE) {
-            ret = s->quic_method->add_handshake_data(s, s->quic_write_level,
-                                                     (const uint8_t*)&s->init_buf->data[s->init_off],
-                                                     s->init_num);
-            if (!ret) {
-                ret = -1;
-                /* QUIC can't sent anything out sice the above failed */
-                ERR_raise(ERR_LIB_SSL, ERR_R_INTERNAL_ERROR);
-            } else {
-                written = s->init_num;
-            }
-        } else {
-            /* QUIC doesn't use ChangeCipherSpec */
-            ret = -1;
-            ERR_raise(ERR_LIB_SSL, ERR_R_SHOULD_NOT_HAVE_BEEN_CALLED);
-        }
-    } else
-#endif
-        ret = ssl3_write_bytes(s, type, &s->init_buf->data[s->init_off],
-                               s->init_num, &written);
-
+    ret = ssl3_write_bytes(s, type, &s->init_buf->data[s->init_off],
+                           s->init_num, &written);
     if (ret <= 0)
         return -1;
     if (type == SSL3_RT_HANDSHAKE)
@@ -666,13 +645,6 @@ int tls_construct_finished(SSL *s, WPACKET *pkt)
 
 int tls_construct_key_update(SSL *s, WPACKET *pkt)
 {
-#ifndef OPENSSL_NO_QUIC
-    if (SSL_is_quic(s)) {
-        /* TLS KeyUpdate is not used for QUIC, so this is an error. */
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-        return 0;
-    }
-#endif
     if (!WPACKET_put_bytes_u8(pkt, s->key_update)) {
         SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
         return 0;
@@ -695,13 +667,6 @@ MSG_PROCESS_RETURN tls_process_key_update(SSL *s, PACKET *pkt)
         return MSG_PROCESS_ERROR;
     }
 
-#ifndef OPENSSL_NO_QUIC
-    if (SSL_is_quic(s)) {
-        SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
-        return MSG_PROCESS_ERROR;
-    }
-#endif
-
     if (!PACKET_get_1(pkt, &updatetype)
             || PACKET_remaining(pkt) != 0) {
         SSLfatal(s, SSL_AD_DECODE_ERROR, SSL_R_BAD_KEY_UPDATE);
diff --git a/deps/openssl/openssl/ssl/statem/statem_local.h b/deps/openssl/openssl/ssl/statem/statem_local.h
index 4203c084e87..ad4d93b1e27 100644
--- a/deps/openssl/openssl/ssl/statem/statem_local.h
+++ b/deps/openssl/openssl/ssl/statem/statem_local.h
@@ -104,10 +104,6 @@ __owur int tls_get_message_header(SSL *s, int *mt);
 __owur int tls_get_message_body(SSL *s, size_t *len);
 __owur int dtls_get_message(SSL *s, int *mt);
 __owur int dtls_get_message_body(SSL *s, size_t *len);
-#ifndef OPENSSL_NO_QUIC
-__owur int quic_get_message(SSL *s, int *mt);
-__owur int quic_get_message_body(SSL *s, size_t *len);
-#endif
 
 /* Message construction and processing functions */
 __owur int tls_process_initial_server_flight(SSL *s);
@@ -255,14 +251,6 @@ int tls_parse_ctos_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                        size_t chainidx);
 int tls_parse_ctos_post_handshake_auth(SSL *, PACKET *pkt, unsigned int context,
                                        X509 *x, size_t chainidx);
-#ifndef OPENSSL_NO_QUIC
-int tls_parse_ctos_quic_transport_params_draft(SSL *s, PACKET *pkt,
-                                               unsigned int context, X509 *x,
-                                               size_t chainidx);
-
-int tls_parse_ctos_quic_transport_params(SSL *s, PACKET *pkt, unsigned int context,
-                                         X509 *x, size_t chainidx);
-#endif
 
 EXT_RETURN tls_construct_stoc_renegotiate(SSL *s, WPACKET *pkt,
                                           unsigned int context, X509 *x,
@@ -323,16 +311,6 @@ EXT_RETURN tls_construct_stoc_cryptopro_bug(SSL *s, WPACKET *pkt,
                                             size_t chainidx);
 EXT_RETURN tls_construct_stoc_psk(SSL *s, WPACKET *pkt, unsigned int context,
                                   X509 *x, size_t chainidx);
-#ifndef OPENSSL_NO_QUIC
-EXT_RETURN tls_construct_stoc_quic_transport_params_draft(SSL *s, WPACKET *pkt,
-                                                          unsigned int context,
-                                                          X509 *x,
-                                                          size_t chainidx);
-
-EXT_RETURN tls_construct_stoc_quic_transport_params(SSL *s, WPACKET *pkt,
-                                                    unsigned int context, X509 *x,
-                                                    size_t chainidx);
-#endif
 
 /* Client Extension processing */
 EXT_RETURN tls_construct_ctos_renegotiate(SSL *s, WPACKET *pkt, unsigned int context,
@@ -402,15 +380,6 @@ EXT_RETURN tls_construct_ctos_psk(SSL *s, WPACKET *pkt, unsigned int context,
                                   X509 *x, size_t chainidx);
 EXT_RETURN tls_construct_ctos_post_handshake_auth(SSL *s, WPACKET *pkt, unsigned int context,
                                                   X509 *x, size_t chainidx);
-#ifndef OPENSSL_NO_QUIC
-EXT_RETURN tls_construct_ctos_quic_transport_params_draft(SSL *s, WPACKET *pkt,
-                                                          unsigned int context, X509 *x,
-                                                          size_t chainidx);
-
-EXT_RETURN tls_construct_ctos_quic_transport_params(SSL *s, WPACKET *pkt,
-                                                    unsigned int context, X509 *x,
-                                                    size_t chainidx);
-#endif
 
 int tls_parse_stoc_renegotiate(SSL *s, PACKET *pkt, unsigned int context,
                                X509 *x, size_t chainidx);
@@ -454,14 +423,6 @@ int tls_parse_stoc_cookie(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                        size_t chainidx);
 int tls_parse_stoc_psk(SSL *s, PACKET *pkt, unsigned int context, X509 *x,
                        size_t chainidx);
-#ifndef OPENSSL_NO_QUIC
-int tls_parse_stoc_quic_transport_params_draft(SSL *s, PACKET *pkt,
-                                               unsigned int context, X509 *x,
-                                               size_t chainidx);
-
-int tls_parse_stoc_quic_transport_params(SSL *s, PACKET *pkt, unsigned int context,
-                                         X509 *x, size_t chainidx);
-#endif
 
 int tls_handle_alpn(SSL *s);
 
diff --git a/deps/openssl/openssl/ssl/statem/statem_quic.c b/deps/openssl/openssl/ssl/statem/statem_quic.c
deleted file mode 100644
index 7bd329c2421..00000000000
--- a/deps/openssl/openssl/ssl/statem/statem_quic.c
+++ /dev/null
@@ -1,117 +0,0 @@
-/*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
- *
- * Licensed under the Apache License 2.0 (the "License").  You may not use
- * this file except in compliance with the License.  You can obtain a copy
- * in the file LICENSE in the source distribution or at
- * https://www.openssl.org/source/license.html
- */
-
-#include "../ssl_local.h"
-#include "statem_local.h"
-#include "internal/cryptlib.h"
-
-int quic_get_message(SSL *s, int *mt)
-{
-    size_t l;
-    QUIC_DATA *qd = s->quic_input_data_head;
-    uint8_t *p;
-
-    if (qd == NULL) {
-        s->rwstate = SSL_READING;
-        *mt = 0;
-        return 0;
-    }
-
-    if (!ossl_assert(qd->length >= SSL3_HM_HEADER_LENGTH)) {
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_LENGTH);
-        *mt = 0;
-        return 0;
-    }
-
-    /* This is where we check for the proper level, not when data is given */
-    if (qd->level != s->quic_read_level) {
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_WRONG_ENCRYPTION_LEVEL_RECEIVED);
-        *mt = 0;
-        return 0;
-    }
-
-    if (!BUF_MEM_grow_clean(s->init_buf, (int)qd->length)) {
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_BUF_LIB);
-        *mt = 0;
-        return 0;
-    }
-
-    /* Copy buffered data */
-    memcpy(s->init_buf->data, s->quic_buf->data + qd->start, qd->length);
-    s->init_buf->length = qd->length;
-    s->quic_input_data_head = qd->next;
-    if (s->quic_input_data_head == NULL)
-        s->quic_input_data_tail = NULL;
-    OPENSSL_free(qd);
-
-    s->s3.tmp.message_type = *mt = *(s->init_buf->data);
-    p = (uint8_t*)s->init_buf->data + 1;
-    n2l3(p, l);
-    s->init_num = s->s3.tmp.message_size = l;
-    s->init_msg = s->init_buf->data + SSL3_HM_HEADER_LENGTH;
-
-    return 1;
-}
-
-int quic_get_message_body(SSL *s, size_t *len)
-{
-    /* No CCS in QUIC/TLSv1.3? */
-    if (s->s3.tmp.message_type == SSL3_MT_CHANGE_CIPHER_SPEC) {
-        SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_CCS_RECEIVED_EARLY);
-        *len = 0;
-        return 0;
-    }
-    /* No KeyUpdate in QUIC */
-    if (s->s3.tmp.message_type == SSL3_MT_KEY_UPDATE) {
-        SSLfatal(s, SSL_AD_UNEXPECTED_MESSAGE, SSL_R_UNEXPECTED_MESSAGE);
-        *len = 0;
-        return 0;
-    }
-
-    /*
-     * If receiving Finished, record MAC of prior handshake messages for
-     * Finished verification.
-     */
-    if (s->s3.tmp.message_type == SSL3_MT_FINISHED && !ssl3_take_mac(s)) {
-        /* SSLfatal() already called */
-        *len = 0;
-        return 0;
-    }
-
-    /*
-     * We defer feeding in the HRR until later. We'll do it as part of
-     * processing the message
-     * The TLsv1.3 handshake transcript stops at the ClientFinished
-     * message.
-     */
-#define SERVER_HELLO_RANDOM_OFFSET  (SSL3_HM_HEADER_LENGTH + 2)
-    /* KeyUpdate and NewSessionTicket do not need to be added */
-    if (s->s3.tmp.message_type != SSL3_MT_NEWSESSION_TICKET
-            && s->s3.tmp.message_type != SSL3_MT_KEY_UPDATE) {
-        if (s->s3.tmp.message_type != SSL3_MT_SERVER_HELLO
-            || s->init_num < SERVER_HELLO_RANDOM_OFFSET + SSL3_RANDOM_SIZE
-            || memcmp(hrrrandom,
-                      s->init_buf->data + SERVER_HELLO_RANDOM_OFFSET,
-                      SSL3_RANDOM_SIZE) != 0) {
-            if (!ssl3_finish_mac(s, (unsigned char *)s->init_buf->data,
-                                 s->init_num + SSL3_HM_HEADER_LENGTH)) {
-                /* SSLfatal() already called */
-                *len = 0;
-                return 0;
-            }
-        }
-    }
-    if (s->msg_callback)
-        s->msg_callback(0, s->version, SSL3_RT_HANDSHAKE, s->init_buf->data,
-                        (size_t)s->init_num + SSL3_HM_HEADER_LENGTH, s,
-                        s->msg_callback_arg);
-
-    *len = s->init_num;
-    return 1;
-}
diff --git a/deps/openssl/openssl/ssl/statem/statem_srvr.c b/deps/openssl/openssl/ssl/statem/statem_srvr.c
index 92e4f793ab2..7d7c198bd63 100644
--- a/deps/openssl/openssl/ssl/statem/statem_srvr.c
+++ b/deps/openssl/openssl/ssl/statem/statem_srvr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 1995-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 1995-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2002, Oracle and/or its affiliates. All rights reserved
  * Copyright 2005 Nokia. All rights reserved.
  *
@@ -74,8 +74,7 @@ static int ossl_statem_server13_read_transition(SSL *s, int mt)
                 return 1;
             }
             break;
-        } else if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED
-                   && !SSL_IS_QUIC(s)) {
+        } else if (s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) {
             if (mt == SSL3_MT_END_OF_EARLY_DATA) {
                 st->hand_state = TLS_ST_SR_END_OF_EARLY_DATA;
                 return 1;
@@ -964,16 +963,6 @@ WORK_STATE ossl_statem_server_post_work(SSL *s, WORK_STATE wst)
                         SSL3_CC_APPLICATION | SSL3_CHANGE_CIPHER_SERVER_WRITE))
             /* SSLfatal() already called */
             return WORK_ERROR;
-
-#ifndef OPENSSL_NO_QUIC
-            if (SSL_IS_QUIC(s) && s->ext.early_data == SSL_EARLY_DATA_ACCEPTED) {
-                s->early_data_state = SSL_EARLY_DATA_FINISHED_READING;
-                if (!s->method->ssl3_enc->change_cipher_state(
-                        s, SSL3_CC_HANDSHAKE | SSL3_CHANGE_CIPHER_SERVER_READ))
-                    /* SSLfatal() already called */
-                    return WORK_ERROR;
-            }
-#endif
         }
         break;
 
@@ -1566,15 +1555,6 @@ MSG_PROCESS_RETURN tls_process_client_hello(SSL *s, PACKET *pkt)
                 goto err;
             }
         }
-#ifndef OPENSSL_NO_QUIC
-        if (SSL_IS_QUIC(s)) {
-            /* Any other QUIC checks on ClientHello here */
-            if (clienthello->session_id_len > 0) {
-                SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_LENGTH_MISMATCH);
-                goto err;
-            }
-        }
-#endif
     }
 
     if (!PACKET_copy_all(&compression, clienthello->compressions,
@@ -3005,7 +2985,7 @@ static int tls_process_cke_dhe(SSL *s, PACKET *pkt)
     }
 
     if (!EVP_PKEY_set1_encoded_public_key(ckey, data, i)) {
-        SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
+        SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
         goto err;
     }
 
@@ -3059,7 +3039,7 @@ static int tls_process_cke_ecdhe(SSL *s, PACKET *pkt)
         }
 
         if (EVP_PKEY_set1_encoded_public_key(ckey, data, i) <= 0) {
-            SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EC_LIB);
+            SSLfatal(s, SSL_AD_ILLEGAL_PARAMETER, SSL_R_BAD_KEY_SHARE);
             goto err;
         }
     }
diff --git a/deps/openssl/openssl/ssl/tls13_enc.c b/deps/openssl/openssl/ssl/tls13_enc.c
index 33cf79199fe..ddcff5eb891 100644
--- a/deps/openssl/openssl/ssl/tls13_enc.c
+++ b/deps/openssl/openssl/ssl/tls13_enc.c
@@ -400,231 +400,27 @@ static int derive_secret_key_and_iv(SSL *s, int sending, const EVP_MD *md,
     return 1;
 }
 
+int tls13_change_cipher_state(SSL *s, int which)
+{
 #ifdef CHARSET_EBCDIC
-static const unsigned char client_early_traffic[]       = {0x63, 0x20, 0x65, 0x20,       /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
-static const unsigned char client_handshake_traffic[]   = {0x63, 0x20, 0x68, 0x73, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
-static const unsigned char client_application_traffic[] = {0x63, 0x20, 0x61, 0x70, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
-static const unsigned char server_handshake_traffic[]   = {0x73, 0x20, 0x68, 0x73, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
-static const unsigned char server_application_traffic[] = {0x73, 0x20, 0x61, 0x70, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
-static const unsigned char exporter_master_secret[] = {0x65, 0x78, 0x70, 0x20,                    /* master*/  0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
-static const unsigned char resumption_master_secret[] = {0x72, 0x65, 0x73, 0x20,                  /* master*/  0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
-static const unsigned char early_exporter_master_secret[] = {0x65, 0x20, 0x65, 0x78, 0x70, 0x20,  /* master*/  0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
+  static const unsigned char client_early_traffic[]       = {0x63, 0x20, 0x65, 0x20,       /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
+  static const unsigned char client_handshake_traffic[]   = {0x63, 0x20, 0x68, 0x73, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
+  static const unsigned char client_application_traffic[] = {0x63, 0x20, 0x61, 0x70, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
+  static const unsigned char server_handshake_traffic[]   = {0x73, 0x20, 0x68, 0x73, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
+  static const unsigned char server_application_traffic[] = {0x73, 0x20, 0x61, 0x70, 0x20, /*traffic*/0x74, 0x72, 0x61, 0x66, 0x66, 0x69, 0x63, 0x00};
+  static const unsigned char exporter_master_secret[] = {0x65, 0x78, 0x70, 0x20,                    /* master*/  0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
+  static const unsigned char resumption_master_secret[] = {0x72, 0x65, 0x73, 0x20,                  /* master*/  0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
+  static const unsigned char early_exporter_master_secret[] = {0x65, 0x20, 0x65, 0x78, 0x70, 0x20,  /* master*/  0x6D, 0x61, 0x73, 0x74, 0x65, 0x72, 0x00};
 #else
-static const unsigned char client_early_traffic[] = "c e traffic";
-static const unsigned char client_handshake_traffic[] = "c hs traffic";
-static const unsigned char client_application_traffic[] = "c ap traffic";
-static const unsigned char server_handshake_traffic[] = "s hs traffic";
-static const unsigned char server_application_traffic[] = "s ap traffic";
-static const unsigned char exporter_master_secret[] = "exp master";
-static const unsigned char resumption_master_secret[] = "res master";
-static const unsigned char early_exporter_master_secret[] = "e exp master";
+    static const unsigned char client_early_traffic[] = "c e traffic";
+    static const unsigned char client_handshake_traffic[] = "c hs traffic";
+    static const unsigned char client_application_traffic[] = "c ap traffic";
+    static const unsigned char server_handshake_traffic[] = "s hs traffic";
+    static const unsigned char server_application_traffic[] = "s ap traffic";
+    static const unsigned char exporter_master_secret[] = "exp master";
+    static const unsigned char resumption_master_secret[] = "res master";
+    static const unsigned char early_exporter_master_secret[] = "e exp master";
 #endif
-
-#ifndef OPENSSL_NO_QUIC
-static int quic_change_cipher_state(SSL *s, int which)
-{
-    unsigned char hash[EVP_MAX_MD_SIZE];
-    size_t hashlen = 0;
-    int hashleni;
-    int ret = 0;
-    const EVP_MD *md = NULL;
-    OSSL_ENCRYPTION_LEVEL level;
-    int is_handshake = ((which & SSL3_CC_HANDSHAKE) == SSL3_CC_HANDSHAKE);
-    int is_client_read = ((which & SSL3_CHANGE_CIPHER_CLIENT_READ) == SSL3_CHANGE_CIPHER_CLIENT_READ);
-    int is_server_write = ((which & SSL3_CHANGE_CIPHER_SERVER_WRITE) == SSL3_CHANGE_CIPHER_SERVER_WRITE);
-    int is_early = (which & SSL3_CC_EARLY);
-
-    if (is_early) {
-        EVP_MD_CTX *mdctx = NULL;
-        long handlen;
-        void *hdata;
-        unsigned int hashlenui;
-        const SSL_CIPHER *sslcipher = SSL_SESSION_get0_cipher(s->session);
-
-        handlen = BIO_get_mem_data(s->s3.handshake_buffer, &hdata);
-        if (handlen <= 0) {
-            SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_HANDSHAKE_LENGTH);
-            goto err;
-        }
-
-        if (s->early_data_state == SSL_EARLY_DATA_CONNECTING
-                && s->max_early_data > 0
-                && s->session->ext.max_early_data == 0) {
-            /*
-             * If we are attempting to send early data, and we've decided to
-             * actually do it but max_early_data in s->session is 0 then we
-             * must be using an external PSK.
-             */
-            if (!ossl_assert(s->psksession != NULL
-                    && s->max_early_data ==
-                       s->psksession->ext.max_early_data)) {
-                SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-                goto err;
-            }
-            sslcipher = SSL_SESSION_get0_cipher(s->psksession);
-        }
-        if (sslcipher == NULL) {
-            SSLfatal(s, SSL_AD_INTERNAL_ERROR, SSL_R_BAD_PSK);
-            goto err;
-        }
-
-        /*
-         * We need to calculate the handshake digest using the digest from
-         * the session. We haven't yet selected our ciphersuite so we can't
-         * use ssl_handshake_md().
-         */
-        mdctx = EVP_MD_CTX_new();
-        if (mdctx == NULL) {
-            SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_MALLOC_FAILURE);
-            goto err;
-        }
-        md = ssl_md(s->ctx, sslcipher->algorithm2);
-        if (md == NULL || !EVP_DigestInit_ex(mdctx, md, NULL)
-                || !EVP_DigestUpdate(mdctx, hdata, handlen)
-                || !EVP_DigestFinal_ex(mdctx, hash, &hashlenui)) {
-            SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_INTERNAL_ERROR);
-            EVP_MD_CTX_free(mdctx);
-            goto err;
-        }
-        hashlen = hashlenui;
-        EVP_MD_CTX_free(mdctx);
-    } else {
-        md = ssl_handshake_md(s);
-        if (!ssl3_digest_cached_records(s, 1)
-                || !ssl_handshake_hash(s, hash, sizeof(hash), &hashlen)) {
-            /* SSLfatal() already called */;
-            goto err;
-        }
-
-        /* Ensure cast to size_t is safe */
-        hashleni = EVP_MD_size(md);
-        if (!ossl_assert(hashleni >= 0)) {
-            SSLfatal(s, SSL_AD_INTERNAL_ERROR, ERR_R_EVP_LIB);
-            goto err;
-        }
-        hashlen = (size_t)hashleni;
-    }
-
-    if (is_client_read || is_server_write) {
-        if (is_handshake) {
-            /*
-             * This looks a bit weird, since the condition is basically "the
-             * server is writing" but we set both the server *and* client
-             * handshake traffic keys here.  That's because there's only a fixed
-             * number of change-cipher-state events in the TLS 1.3 handshake,
-             * and in particular there's not an event in between when the server
-             * writes encrypted handshake messages and when the client writes
-             * encrypted handshake messages, so we generate both here.
-             */
-            level = ssl_encryption_handshake;
-
-            if (!tls13_hkdf_expand(s, md, s->handshake_secret,
-                                   client_handshake_traffic,
-                                   sizeof(client_handshake_traffic)-1, hash,
-                                   hashlen, s->client_hand_traffic_secret,
-                                   hashlen, 1)
-                || !ssl_log_secret(s, CLIENT_HANDSHAKE_LABEL,
-                                   s->client_hand_traffic_secret, hashlen)
-                || !tls13_derive_finishedkey(s, md,
-                                             s->client_hand_traffic_secret,
-                                             s->client_finished_secret, hashlen)
-                || !tls13_hkdf_expand(s, md, s->handshake_secret,
-                                      server_handshake_traffic,
-                                      sizeof(server_handshake_traffic)-1, hash,
-                                      hashlen, s->server_hand_traffic_secret,
-                                      hashlen, 1)
-                || !ssl_log_secret(s, SERVER_HANDSHAKE_LABEL,
-                                   s->server_hand_traffic_secret, hashlen)
-                || !tls13_derive_finishedkey(s, md,
-                                             s->server_hand_traffic_secret,
-                                             s->server_finished_secret,
-                                             hashlen)) {
-                /* SSLfatal() already called */
-                goto err;
-            }
-        } else {
-            /*
-             * As above, we generate both sets of application traffic keys at
-             * the same time.
-             */
-            level = ssl_encryption_application;
-
-            if (!tls13_hkdf_expand(s, md, s->master_secret,
-                                   client_application_traffic,
-                                   sizeof(client_application_traffic)-1, hash,
-                                   hashlen, s->client_app_traffic_secret,
-                                   hashlen, 1)
-                || !ssl_log_secret(s, CLIENT_APPLICATION_LABEL,
-                                   s->client_app_traffic_secret, hashlen)
-                || !tls13_hkdf_expand(s, md, s->master_secret,
-                                      server_application_traffic,
-                                      sizeof(server_application_traffic)-1,
-                                      hash, hashlen,
-                                      s->server_app_traffic_secret, hashlen, 1)
-                || !ssl_log_secret(s, SERVER_APPLICATION_LABEL,
-                                   s->server_app_traffic_secret, hashlen)) {
-                /* SSLfatal() already called */
-                goto err;
-            }
-        }
-        if (!quic_set_encryption_secrets(s, level)) {
-            /* SSLfatal() already called */
-            goto err;
-        }
-        if (s->server)
-            s->quic_write_level = level;
-        else
-            s->quic_read_level = level;
-    } else {
-        /* is_client_write || is_server_read */
-
-        if (is_early) {
-            level = ssl_encryption_early_data;
-
-            if (!tls13_hkdf_expand(s, md, s->early_secret, client_early_traffic,
-                                   sizeof(client_early_traffic)-1, hash,
-                                   hashlen, s->client_early_traffic_secret,
-                                   hashlen, 1)
-                || !ssl_log_secret(s, CLIENT_EARLY_LABEL,
-                                   s->client_early_traffic_secret, hashlen)
-                || !quic_set_encryption_secrets(s, level)) {
-                /* SSLfatal() already called */
-                goto err;
-            }
-        } else if (is_handshake) {
-            level = ssl_encryption_handshake;
-        } else {
-            level = ssl_encryption_application;
-            /*
-             * We also create the resumption master secret, but this time use the
-             * hash for the whole handshake including the Client Finished
-             */
-            if (!tls13_hkdf_expand(s, md, s->master_secret,
-                                   resumption_master_secret,
-                                   sizeof(resumption_master_secret)-1, hash,
-                                   hashlen, s->resumption_master_secret,
-                                   hashlen, 1)) {
-                /* SSLfatal() already called */
-                goto err;
-            }
-        }
-
-        if (level != ssl_encryption_early_data) {
-            if (s->server)
-                s->quic_read_level = level;
-            else
-                s->quic_write_level = level;
-        }
-    }
-
-    ret = 1;
- err:
-    return ret;
-}
-#endif /* OPENSSL_NO_QUIC */
-
-int tls13_change_cipher_state(SSL *s, int which)
-{
     unsigned char *iv;
     unsigned char key[EVP_MAX_KEY_LENGTH];
     unsigned char secret[EVP_MAX_MD_SIZE];
@@ -645,11 +441,6 @@ int tls13_change_cipher_state(SSL *s, int which)
     BIO *bio;
 #endif
 
-#ifndef OPENSSL_NO_QUIC
-    if (SSL_IS_QUIC(s))
-        return quic_change_cipher_state(s, which);
-#endif
-
     if (which & SSL3_CC_READ) {
         if (s->enc_read_ctx != NULL) {
             EVP_CIPHER_CTX_reset(s->enc_read_ctx);
@@ -941,7 +732,6 @@ int tls13_change_cipher_state(SSL *s, int which)
 skip_ktls:
 # endif
 #endif
-
     ret = 1;
  err:
     if ((which & SSL3_CC_EARLY) != 0) {
diff --git a/deps/openssl/openssl/test/acvp_test.c b/deps/openssl/openssl/test/acvp_test.c
index fee880d441b..eccf9d90a02 100644
--- a/deps/openssl/openssl/test/acvp_test.c
+++ b/deps/openssl/openssl/test/acvp_test.c
@@ -1251,7 +1251,7 @@ static int rsa_decryption_primitive_test(int id)
     BN_CTX *bn_ctx = NULL;
     const struct rsa_decrypt_prim_st *tst  = &rsa_decrypt_prim_data[id];
 
-    if (!TEST_ptr(pkey = EVP_PKEY_Q_keygen(libctx, NULL, "RSA", 2048))
+    if (!TEST_ptr(pkey = EVP_PKEY_Q_keygen(libctx, NULL, "RSA", (size_t)2048))
         || !TEST_true(pkey_get_bn_bytes(pkey, OSSL_PKEY_PARAM_RSA_N, &n, &n_len))
         || !TEST_true(pkey_get_bn_bytes(pkey, OSSL_PKEY_PARAM_RSA_E, &e, &e_len))
         || !TEST_ptr(ctx = EVP_PKEY_CTX_new_from_pkey(libctx, pkey, ""))
diff --git a/deps/openssl/openssl/test/bio_pw_callback_test.c b/deps/openssl/openssl/test/bio_pw_callback_test.c
new file mode 100644
index 00000000000..e11368454a8
--- /dev/null
+++ b/deps/openssl/openssl/test/bio_pw_callback_test.c
@@ -0,0 +1,402 @@
+/*
+ * Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.
+ *
+ * Licensed under the Apache License 2.0 (the "License").  You may not use
+ * this file except in compliance with the License.  You can obtain a copy
+ * in the file LICENSE in the source distribution or at
+ * https://www.openssl.org/source/license.html
+ */
+
+#include "testutil.h"
+
+#include <openssl/bio.h>
+#include <openssl/pem.h>
+
+/* dummy data that needs to be passed to the callback */
+typedef struct CallbackData {
+    char magic;
+    int result;
+} CALLBACK_DATA;
+
+/* constants */
+static const char weak_password[] = "weak_password";
+static const char a0a_password[] = "aaaaaaaa\0aaaaaaaa";
+static const char a0b_password[] = "aaaaaaaa\0bbbbbbbb";
+static const char cb_magic = 'p';
+
+/* shared working data for all tests */
+static char *key_file = NULL;
+static EVP_PKEY *original_pkey = NULL;
+
+/* the test performed by the callback */
+typedef enum CallbackTest {
+    CB_TEST_NEGATIVE = 0,
+    CB_TEST_ZERO_LENGTH,
+    CB_TEST_WEAK,
+    CB_TEST_16ZERO,
+    CB_TEST_A0A,
+    CB_TEST_A0B,
+    CB_TEST_MATCH_SIZE,
+    CB_TEST_EXCEED_SIZE
+} CALLBACK_TEST;
+static CALLBACK_TEST callback_test = CB_TEST_NEGATIVE;
+
+typedef enum KeyEncoding {
+    KE_PEM = 0,
+    KE_PKCS8
+} KEY_ENCODING;
+
+typedef enum ExpectedResult {
+    ER_FAILURE = 0,
+    ER_SUCCESS
+} EXPECTED_RESULT;
+
+typedef enum OPTION_choice {
+    OPT_ERR = -1,
+    OPT_EOF = 0,
+    OPT_KEY_FILE,
+    OPT_TEST_ENUM
+} OPTION_CHOICE;
+
+const OPTIONS *test_get_options(void)
+{
+    static const OPTIONS test_options[] = {
+        OPT_TEST_OPTIONS_DEFAULT_USAGE,
+        { "keyfile", OPT_KEY_FILE, '<',
+          "The PEM file with the encrypted key to load" },
+        { NULL }
+    };
+    return test_options;
+}
+
+static int callback_copy_password(char *buf, int size)
+{
+    int ret = -1;
+
+    switch (callback_test) {
+    case CB_TEST_NEGATIVE:
+        break;
+    case CB_TEST_ZERO_LENGTH:
+        ret = 0;
+        break;
+    case CB_TEST_WEAK:
+        ret = sizeof(weak_password) - 1;
+        memcpy(buf, weak_password, ret);
+        break;
+    case CB_TEST_16ZERO:
+        memset(buf, 0, 16);
+        ret = 16;
+        break;
+    case CB_TEST_A0A:
+        ret = sizeof(a0a_password) - 1;
+        memcpy(buf, a0a_password, ret);
+        break;
+    case CB_TEST_A0B:
+        ret = sizeof(a0b_password) - 1;
+        memcpy(buf, a0b_password, ret);
+        break;
+    case CB_TEST_MATCH_SIZE:
+        memset(buf, 'e', size);
+        ret = size;
+        break;
+    case CB_TEST_EXCEED_SIZE:
+        memset(buf, 'e', size);
+        ret = 1000000;
+        break;
+    }
+    return ret;
+}
+
+static int read_callback(char *buf, int size, int rwflag, void *u)
+{
+    CALLBACK_DATA *cb_data = (CALLBACK_DATA *)u;
+    int ret = -1;
+
+    /* basic verification of the received data */
+    if (!TEST_ptr(cb_data))
+        goto err;
+    if (!TEST_char_eq(cb_data->magic, cb_magic))
+        goto err;
+    if (!TEST_ptr(buf))
+        goto err;
+    if (!TEST_int_gt(size, 0))
+        goto err;
+    if (!TEST_int_eq(rwflag, 0))
+        goto err;
+    ret = callback_copy_password(buf, size);
+    cb_data->result = 1;
+err:
+    return ret;
+}
+
+static int write_callback(char *buf, int size, int rwflag, void *u)
+{
+    CALLBACK_DATA *cb_data = (CALLBACK_DATA *)u;
+    int ret = -1;
+
+    /* basic verification of the received data */
+    if (!TEST_ptr(cb_data))
+        goto err;
+    if (!TEST_char_eq(cb_data->magic, cb_magic))
+        goto err;
+    if (!TEST_ptr(buf))
+        goto err;
+    if (!TEST_int_gt(size, 0))
+        goto err;
+    if (!TEST_int_eq(rwflag, 1))
+        goto err;
+    ret = callback_copy_password(buf, size);
+    cb_data->result = 1;
+err:
+    return ret;
+}
+
+static int re_encrypt_key(char **enc_data, int *enc_data_size,
+                          KEY_ENCODING key_encoding)
+{
+    CALLBACK_DATA cb_data;
+    int w_ret = 0;
+    BUF_MEM *bptr = NULL;
+    BIO *bio = NULL;
+    int ret = 0;
+
+    if (!TEST_ptr(enc_data))
+        goto err;
+    if (!TEST_ptr(enc_data_size))
+        goto err;
+    if (!TEST_ptr(bio = BIO_new(BIO_s_mem())))
+        goto err;
+    cb_data.magic = cb_magic;
+    cb_data.result = 0;
+    switch (key_encoding) {
+    case KE_PEM:
+        w_ret = PEM_write_bio_PrivateKey(bio, original_pkey, EVP_aes_256_cbc(),
+                                         NULL, 0, write_callback, &cb_data);
+        break;
+    case KE_PKCS8:
+        w_ret = i2d_PKCS8PrivateKey_bio(bio, original_pkey, EVP_aes_256_cbc(),
+                                        NULL, 0, write_callback, &cb_data);
+        break;
+    }
+    if (!TEST_int_ne(w_ret, 0))
+        goto err;
+    if (!TEST_char_eq(cb_data.magic, cb_magic))
+        goto err;
+    if (!TEST_int_eq(cb_data.result, 1))
+        goto err;
+    *enc_data_size = BIO_get_mem_data(bio, enc_data);
+    BIO_get_mem_ptr(bio, &bptr);
+    if (!BIO_set_close(bio, BIO_NOCLOSE))
+        goto err;
+    bptr->data = NULL;
+    ret = 1;
+err:
+    BUF_MEM_free(bptr);
+    BIO_free(bio);
+    return ret;
+}
+
+static int decrypt_key(char *enc_data, int enc_data_size,
+                       KEY_ENCODING key_encoding,
+                       EXPECTED_RESULT expected_result)
+{
+    CALLBACK_DATA cb_data;
+    EVP_PKEY *r_ret = NULL;
+    BIO *bio = NULL;
+    EVP_PKEY *pkey = NULL;
+    int ret = 0;
+
+    if (!TEST_ptr(bio = BIO_new_mem_buf(enc_data, enc_data_size)))
+        goto err;
+    cb_data.magic = cb_magic;
+    cb_data.result = 0;
+    switch (key_encoding) {
+    case KE_PEM:
+        r_ret = PEM_read_bio_PrivateKey(bio, &pkey, read_callback, &cb_data);
+        break;
+    case KE_PKCS8:
+        r_ret = d2i_PKCS8PrivateKey_bio(bio, &pkey, read_callback, &cb_data);
+        break;
+    }
+    if (expected_result == ER_SUCCESS) {
+        if (!TEST_ptr(r_ret))
+            goto err;
+    } else {
+        if (!TEST_ptr_null(r_ret))
+            goto err;
+    }
+    if (!TEST_char_eq(cb_data.magic, cb_magic))
+        goto err;
+    if (!TEST_int_eq(cb_data.result, 1))
+        goto err;
+    ret = 1;
+err:
+    EVP_PKEY_free(pkey);
+    BIO_free(bio);
+    return ret;
+}
+
+static int full_cycle_test(KEY_ENCODING key_encoding, CALLBACK_TEST write_test,
+                           CALLBACK_TEST read_test,
+                           EXPECTED_RESULT expected_read_result)
+{
+    char *enc_data = NULL;
+    int enc_data_size = 0;
+    int ret = 0;
+
+    callback_test = write_test;
+    if (!re_encrypt_key(&enc_data, &enc_data_size, key_encoding))
+        goto err;
+    callback_test = read_test;
+    if (!decrypt_key(enc_data, enc_data_size, key_encoding,
+                     expected_read_result))
+        goto err;
+    ret = 1;
+err:
+    OPENSSL_free(enc_data);
+    return ret;
+}
+
+static int test_pem_negative(void)
+{
+    return full_cycle_test(KE_PEM, CB_TEST_WEAK, CB_TEST_NEGATIVE, ER_FAILURE);
+}
+
+static int test_pem_zero_length(void)
+{
+    return full_cycle_test(KE_PEM, CB_TEST_ZERO_LENGTH, CB_TEST_ZERO_LENGTH,
+                           ER_SUCCESS);
+}
+
+static int test_pem_weak(void)
+{
+    return full_cycle_test(KE_PEM, CB_TEST_WEAK, CB_TEST_WEAK, ER_SUCCESS);
+}
+
+static int test_pem_16zero(void)
+{
+    return full_cycle_test(KE_PEM, CB_TEST_16ZERO, CB_TEST_16ZERO, ER_SUCCESS);
+}
+
+static int test_pem_a0a(void)
+{
+    return full_cycle_test(KE_PEM, CB_TEST_A0A, CB_TEST_A0A, ER_SUCCESS);
+}
+
+static int test_pem_a0a_a0b(void)
+{
+    return full_cycle_test(KE_PEM, CB_TEST_A0A, CB_TEST_A0B, ER_FAILURE);
+}
+
+static int test_pem_match_size(void)
+{
+    return full_cycle_test(KE_PEM, CB_TEST_MATCH_SIZE, CB_TEST_MATCH_SIZE,
+                           ER_SUCCESS);
+}
+
+static int test_pem_exceed_size(void)
+{
+    return full_cycle_test(KE_PEM, CB_TEST_MATCH_SIZE, CB_TEST_EXCEED_SIZE,
+                           ER_FAILURE);
+}
+
+static int test_pkcs8_negative(void)
+{
+    return full_cycle_test(KE_PKCS8, CB_TEST_WEAK, CB_TEST_NEGATIVE, ER_FAILURE);
+}
+
+static int test_pkcs8_zero_length(void)
+{
+    return full_cycle_test(KE_PKCS8, CB_TEST_ZERO_LENGTH, CB_TEST_ZERO_LENGTH,
+                           ER_SUCCESS);
+}
+
+static int test_pkcs8_weak(void)
+{
+    return full_cycle_test(KE_PKCS8, CB_TEST_WEAK, CB_TEST_WEAK, ER_SUCCESS);
+}
+
+static int test_pkcs8_16zero(void)
+{
+    return full_cycle_test(KE_PKCS8, CB_TEST_16ZERO, CB_TEST_16ZERO,
+                           ER_SUCCESS);
+}
+
+static int test_pkcs8_a0a(void)
+{
+    return full_cycle_test(KE_PKCS8, CB_TEST_A0A, CB_TEST_A0A, ER_SUCCESS);
+}
+
+static int test_pkcs8_a0a_a0b(void)
+{
+    return full_cycle_test(KE_PKCS8, CB_TEST_A0A, CB_TEST_A0B, ER_FAILURE);
+}
+
+static int test_pkcs8_match_size(void)
+{
+    return full_cycle_test(KE_PKCS8, CB_TEST_MATCH_SIZE, CB_TEST_MATCH_SIZE,
+                           ER_SUCCESS);
+}
+
+static int test_pkcs8_exceed_size(void)
+{
+    return full_cycle_test(KE_PKCS8, CB_TEST_MATCH_SIZE, CB_TEST_EXCEED_SIZE,
+                           ER_FAILURE);
+}
+
+static int callback_original_pw(char *buf, int size, int rwflag, void *u)
+{
+    memcpy(buf, weak_password, sizeof(weak_password) - 1);
+    return sizeof(weak_password) - 1;
+}
+
+int setup_tests(void)
+{
+    OPTION_CHOICE o;
+    BIO *bio = NULL;
+
+    while ((o = opt_next()) != OPT_EOF) {
+        switch (o) {
+        case OPT_KEY_FILE:
+            key_file = opt_arg();
+            break;
+        case OPT_TEST_CASES:
+            break;
+        default:
+        case OPT_ERR:
+            return 0;
+        }
+    }
+
+    /* read the original key */
+    if (!TEST_ptr(bio = BIO_new_file(key_file, "r")))
+        return 0;
+    if (!TEST_ptr(PEM_read_bio_PrivateKey(bio, &original_pkey,
+                                          callback_original_pw, NULL)))
+        return 0;
+    BIO_free(bio);
+
+    /* add all tests */
+    ADD_TEST(test_pem_negative);
+    ADD_TEST(test_pem_zero_length);
+    ADD_TEST(test_pem_weak);
+    ADD_TEST(test_pem_16zero);
+    ADD_TEST(test_pem_a0a);
+    ADD_TEST(test_pem_a0a_a0b);
+    ADD_TEST(test_pem_match_size);
+    ADD_TEST(test_pem_exceed_size);
+    ADD_TEST(test_pkcs8_negative);
+    ADD_TEST(test_pkcs8_zero_length);
+    ADD_TEST(test_pkcs8_weak);
+    ADD_TEST(test_pkcs8_16zero);
+    ADD_TEST(test_pkcs8_a0a);
+    ADD_TEST(test_pkcs8_a0a_a0b);
+    ADD_TEST(test_pkcs8_match_size);
+    ADD_TEST(test_pkcs8_exceed_size);
+    return 1;
+}
+
+void cleanup_tests(void)
+{
+    EVP_PKEY_free(original_pkey);
+}
diff --git a/deps/openssl/openssl/test/build.info b/deps/openssl/openssl/test/build.info
index 76ff945ab8b..6089b8c97cf 100644
--- a/deps/openssl/openssl/test/build.info
+++ b/deps/openssl/openssl/test/build.info
@@ -61,7 +61,7 @@ IF[{- !$disabled{tests} -}]
           keymgmt_internal_test hexstr_test provider_status_test defltfips_test \
           bio_readbuffer_test user_property_test pkcs7_test upcallstest \
           provfetchtest prov_config_test rand_test fips_version_test \
-          nodefltctxtest
+          nodefltctxtest bio_pw_callback_test
 
   IF[{- !$disabled{'deprecated-3.0'} -}]
     PROGRAMS{noinst}=enginetest
@@ -943,6 +943,10 @@ ENDIF
   INCLUDE[ssl_ctx_test]=../include ../apps/include
   DEPEND[ssl_ctx_test]=../libcrypto ../libssl libtestutil.a
 
+  SOURCE[bio_pw_callback_test]=bio_pw_callback_test.c
+  INCLUDE[bio_pw_callback_test]=../include ../apps/include
+  DEPEND[bio_pw_callback_test]=../libcrypto libtestutil.a
+
 {-
    use File::Spec::Functions;
    use File::Basename;
diff --git a/deps/openssl/openssl/test/cmactest.c b/deps/openssl/openssl/test/cmactest.c
index cb2b273b0f4..72f7a0d9366 100644
--- a/deps/openssl/openssl/test/cmactest.c
+++ b/deps/openssl/openssl/test/cmactest.c
@@ -196,13 +196,15 @@ static int test_cmac_copy(void)
     return ret;
 }
 
+#define OSSL_HEX_CHARS_PER_BYTE 2
 static char *pt(unsigned char *md, unsigned int len)
 {
     unsigned int i;
-    static char buf[80];
+    static char buf[81];
 
-    for (i = 0; i < len; i++)
-        sprintf(&(buf[i * 2]), "%02x", md[i]);
+    for (i = 0; i < len && (i + 1) * OSSL_HEX_CHARS_PER_BYTE < sizeof(buf); i++)
+        BIO_snprintf(buf + i * OSSL_HEX_CHARS_PER_BYTE,
+                     OSSL_HEX_CHARS_PER_BYTE + 1, "%02x", md[i]);
     return buf;
 }
 
diff --git a/deps/openssl/openssl/test/conf_include_test.c b/deps/openssl/openssl/test/conf_include_test.c
index 2481a2380b7..f6835d59e79 100644
--- a/deps/openssl/openssl/test/conf_include_test.c
+++ b/deps/openssl/openssl/test/conf_include_test.c
@@ -158,7 +158,7 @@ static int test_check_overflow(void)
     char max[(sizeof(long) * 8) / 3 + 3];
     char *p;
 
-    p = max + sprintf(max, "0%ld", LONG_MAX) - 1;
+    p = max + BIO_snprintf(max, sizeof(max), "0%ld", LONG_MAX) - 1;
     setenv("FNORD", max, 1);
     if (!TEST_true(NCONF_get_number(NULL, "missing", "FNORD", &val))
             || !TEST_long_eq(val, LONG_MAX))
diff --git a/deps/openssl/openssl/test/drbgtest.c b/deps/openssl/openssl/test/drbgtest.c
index b5122b60bdd..afbc5511252 100644
--- a/deps/openssl/openssl/test/drbgtest.c
+++ b/deps/openssl/openssl/test/drbgtest.c
@@ -423,7 +423,7 @@ static int test_rand_reseed_on_fork(EVP_RAND_CTX *primary,
 
         presult[0].pindex = presult[1].pindex = i;
 
-        sprintf(presult[0].name, "child %d", i);
+        BIO_snprintf(presult[0].name, sizeof(presult[0].name), "child %d", i);
         strcpy(presult[1].name, presult[0].name);
 
         /* collect the random output of the children */
diff --git a/deps/openssl/openssl/test/ec_internal_test.c b/deps/openssl/openssl/test/ec_internal_test.c
index 8c2cd056316..02cfd4e9d88 100644
--- a/deps/openssl/openssl/test/ec_internal_test.c
+++ b/deps/openssl/openssl/test/ec_internal_test.c
@@ -155,6 +155,56 @@ static int field_tests_ecp_mont(void)
 }
 
 #ifndef OPENSSL_NO_EC2M
+/* Test that decoding of invalid GF2m field parameters fails. */
+static int ec2m_field_sanity(void)
+{
+    int ret = 0;
+    BN_CTX *ctx = BN_CTX_new();
+    BIGNUM *p, *a, *b;
+    EC_GROUP *group1 = NULL, *group2 = NULL, *group3 = NULL;
+
+    TEST_info("Testing GF2m hardening\n");
+
+    BN_CTX_start(ctx);
+    p = BN_CTX_get(ctx);
+    a = BN_CTX_get(ctx);
+    if (!TEST_ptr(b = BN_CTX_get(ctx))
+        || !TEST_true(BN_one(a))
+        || !TEST_true(BN_one(b)))
+        goto out;
+
+    /* Even pentanomial value should be rejected */
+    if (!TEST_true(BN_set_word(p, 0xf2)))
+        goto out;
+    if (!TEST_ptr_null(group1 = EC_GROUP_new_curve_GF2m(p, a, b, ctx)))
+        TEST_error("Zero constant term accepted in GF2m polynomial");
+
+    /* Odd hexanomial should also be rejected */
+    if (!TEST_true(BN_set_word(p, 0xf3)))
+        goto out;
+    if (!TEST_ptr_null(group2 = EC_GROUP_new_curve_GF2m(p, a, b, ctx)))
+        TEST_error("Hexanomial accepted as GF2m polynomial");
+
+    /* Excessive polynomial degree should also be rejected */
+    if (!TEST_true(BN_set_word(p, 0x71))
+        || !TEST_true(BN_set_bit(p, OPENSSL_ECC_MAX_FIELD_BITS + 1)))
+        goto out;
+    if (!TEST_ptr_null(group3 = EC_GROUP_new_curve_GF2m(p, a, b, ctx)))
+        TEST_error("GF2m polynomial degree > %d accepted",
+                   OPENSSL_ECC_MAX_FIELD_BITS);
+
+    ret = group1 == NULL && group2 == NULL && group3 == NULL;
+
+ out:
+    EC_GROUP_free(group1);
+    EC_GROUP_free(group2);
+    EC_GROUP_free(group3);
+    BN_CTX_end(ctx);
+    BN_CTX_free(ctx);
+
+    return ret;
+}
+
 /* test EC_GF2m_simple_method directly */
 static int field_tests_ec2_simple(void)
 {
@@ -443,6 +493,7 @@ int setup_tests(void)
     ADD_TEST(field_tests_ecp_simple);
     ADD_TEST(field_tests_ecp_mont);
 #ifndef OPENSSL_NO_EC2M
+    ADD_TEST(ec2m_field_sanity);
     ADD_TEST(field_tests_ec2_simple);
 #endif
     ADD_ALL_TESTS(field_tests_default, crv_len);
diff --git a/deps/openssl/openssl/test/enginetest.c b/deps/openssl/openssl/test/enginetest.c
index 8ba999b0176..79ffb230548 100644
--- a/deps/openssl/openssl/test/enginetest.c
+++ b/deps/openssl/openssl/test/enginetest.c
@@ -147,9 +147,9 @@ static int test_engines(void)
 
     TEST_info("About to beef up the engine-type list");
     for (loop = 0; loop < NUMTOADD; loop++) {
-        sprintf(buf, "id%d", loop);
+        BIO_snprintf(buf, sizeof(buf), "id%d", loop);
         eid[loop] = OPENSSL_strdup(buf);
-        sprintf(buf, "Fake engine type %d", loop);
+        BIO_snprintf(buf, sizeof(buf), "Fake engine type %d", loop);
         ename[loop] = OPENSSL_strdup(buf);
         if (!TEST_ptr(block[loop] = ENGINE_new())
                 || !TEST_true(ENGINE_set_id(block[loop], eid[loop]))
diff --git a/deps/openssl/openssl/test/evp_kdf_test.c b/deps/openssl/openssl/test/evp_kdf_test.c
index 8f35900bdd8..0ee1aaea6f3 100644
--- a/deps/openssl/openssl/test/evp_kdf_test.c
+++ b/deps/openssl/openssl/test/evp_kdf_test.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2018-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2018-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2018-2020, Oracle and/or its affiliates.  All rights reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -857,7 +857,7 @@ static int test_kdf_pbkdf2_invalid_digest(void)
 #ifndef OPENSSL_NO_SCRYPT
 static int test_kdf_scrypt(void)
 {
-    int ret;
+    int i, ret;
     EVP_KDF_CTX *kctx;
     OSSL_PARAM params[7], *p = params;
     unsigned char out[64];
@@ -883,15 +883,21 @@ static int test_kdf_scrypt(void)
     *p++ = OSSL_PARAM_construct_uint(OSSL_KDF_PARAM_SCRYPT_MAXMEM, &maxmem);
     *p = OSSL_PARAM_construct_end();
 
-    ret =
-        TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SCRYPT))
-        && TEST_true(EVP_KDF_CTX_set_params(kctx, params))
-        /* failure test *//*
-        && TEST_int_le(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)*/
-        && TEST_true(OSSL_PARAM_set_uint(p - 1, 10 * 1024 * 1024))
-        && TEST_true(EVP_KDF_CTX_set_params(kctx, p - 1))
-        && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
-        && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
+    ret = TEST_ptr(kctx = get_kdfbyname(OSSL_KDF_NAME_SCRYPT));
+    for (i = 0; ret && i < 2; ++i) {
+        ret = ret
+            && TEST_true(EVP_KDF_CTX_set_params(kctx, params));
+        if (i == 0)
+            ret = ret
+                && TEST_int_le(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
+                && TEST_true(OSSL_PARAM_set_uint(p - 1, 10 * 1024 * 1024))
+                && TEST_true(EVP_KDF_CTX_set_params(kctx, p - 1));
+        ret = ret
+            && TEST_int_gt(EVP_KDF_derive(kctx, out, sizeof(out), NULL), 0)
+            && TEST_mem_eq(out, sizeof(out), expected, sizeof(expected));
+        if (i == 0)
+            EVP_KDF_CTX_reset(kctx);
+    }
 
     EVP_KDF_CTX_free(kctx);
     return ret;
diff --git a/deps/openssl/openssl/test/evp_libctx_test.c b/deps/openssl/openssl/test/evp_libctx_test.c
index 2448c35a149..fd114a118cb 100644
--- a/deps/openssl/openssl/test/evp_libctx_test.c
+++ b/deps/openssl/openssl/test/evp_libctx_test.c
@@ -501,7 +501,7 @@ static int rsa_keygen(int bits, EVP_PKEY **pub, EVP_PKEY **priv)
     size_t len = 0;
     OSSL_ENCODER_CTX *ectx = NULL;
 
-    if (!TEST_ptr(*priv = EVP_PKEY_Q_keygen(libctx, NULL, "RSA", bits))
+    if (!TEST_ptr(*priv = EVP_PKEY_Q_keygen(libctx, NULL, "RSA", (size_t)bits))
         || !TEST_ptr(ectx =
                      OSSL_ENCODER_CTX_new_for_pkey(*priv,
                                                    EVP_PKEY_PUBLIC_KEY,
@@ -536,6 +536,8 @@ static int kem_rsa_gen_recover(void)
           && TEST_int_eq(EVP_PKEY_encapsulate_init(sctx, NULL), 1)
           && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(sctx, "RSASVE"), 1)
           && TEST_ptr(dctx = EVP_PKEY_CTX_dup(sctx))
+          /* Test that providing a NULL wrappedlen fails */
+          && TEST_int_eq(EVP_PKEY_encapsulate(dctx, NULL, NULL, NULL, NULL), 0)
           && TEST_int_eq(EVP_PKEY_encapsulate(dctx, NULL, &ctlen, NULL,
                                               &secretlen), 1)
           && TEST_int_eq(ctlen, secretlen)
@@ -545,11 +547,26 @@ static int kem_rsa_gen_recover(void)
           && TEST_ptr(rctx = EVP_PKEY_CTX_new_from_pkey(libctx, priv, NULL))
           && TEST_int_eq(EVP_PKEY_decapsulate_init(rctx, NULL), 1)
           && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(rctx, "RSASVE"), 1)
+          /* Test that providing a NULL unwrappedlen fails */
+          && TEST_int_eq(EVP_PKEY_decapsulate(rctx, NULL, NULL, ct, ctlen), 0)
           && TEST_int_eq(EVP_PKEY_decapsulate(rctx, NULL, &unwraplen,
                                               ct, ctlen), 1)
           && TEST_int_eq(EVP_PKEY_decapsulate(rctx, unwrap, &unwraplen,
                                               ct, ctlen), 1)
           && TEST_mem_eq(unwrap, unwraplen, secret, secretlen);
+
+    /* Test that providing a too short unwrapped/ctlen fails */
+    if (fips_provider_version_match(libctx, ">=3.4.0")) {
+        ctlen = 1;
+        if (!TEST_int_eq(EVP_PKEY_encapsulate(dctx, ct, &ctlen, secret,
+                                              &secretlen), 0))
+            ret = 0;
+        unwraplen = 1;
+        if (!TEST_int_eq(EVP_PKEY_decapsulate(rctx, unwrap, &unwraplen, ct,
+                                              ctlen), 0))
+            ret = 0;
+    }
+
     EVP_PKEY_free(pub);
     EVP_PKEY_free(priv);
     EVP_PKEY_CTX_free(rctx);
@@ -596,59 +613,60 @@ static int kem_rsa_params(void)
     size_t ctlen = 0, secretlen = 0;
 
     ret = TEST_true(rsa_keygen(2048, &pub, &priv))
-          && TEST_ptr(pubctx = EVP_PKEY_CTX_new_from_pkey(libctx, pub, NULL))
-          && TEST_ptr(privctx = EVP_PKEY_CTX_new_from_pkey(libctx, priv, NULL))
-          /* Test setting kem op before the init fails */
-          && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, "RSASVE"), -2)
-          /* Test NULL ctx passed */
-          && TEST_int_eq(EVP_PKEY_encapsulate_init(NULL, NULL), 0)
-          && TEST_int_eq(EVP_PKEY_encapsulate(NULL, NULL, NULL, NULL, NULL), 0)
-          && TEST_int_eq(EVP_PKEY_decapsulate_init(NULL, NULL), 0)
-          && TEST_int_eq(EVP_PKEY_decapsulate(NULL, NULL, NULL, NULL, 0), 0)
-          /* Test Invalid operation */
-          && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, NULL, NULL, NULL), -1)
-          && TEST_int_eq(EVP_PKEY_decapsulate(privctx, NULL, NULL, NULL, 0), 0)
-          /* Wrong key component - no secret should be returned on failure */
-          && TEST_int_eq(EVP_PKEY_decapsulate_init(pubctx, NULL), 1)
-          && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, "RSASVE"), 1)
-          && TEST_int_eq(EVP_PKEY_decapsulate(pubctx, secret, &secretlen, ct,
-                                              sizeof(ct)), 0)
-          && TEST_uchar_eq(secret[0], 0)
-          /* Test encapsulate fails if the mode is not set */
-          && TEST_int_eq(EVP_PKEY_encapsulate_init(pubctx, NULL), 1)
-          && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, &ctlen, secret, &secretlen), -2)
-          /* Test setting a bad kem ops fail */
-          && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, "RSA"), 0)
-          && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx,  NULL), 0)
-          && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(NULL,  "RSASVE"), 0)
-          && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(NULL,  NULL), 0)
-          /* Test secretlen is optional */
-          && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, "RSASVE"), 1)
-          && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, &ctlen, secret, NULL), 1)
-          && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, &ctlen, NULL, NULL), 1)
-          /* Test outlen is optional */
-          && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, NULL, NULL, &secretlen), 1)
-          && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, NULL, secret, &secretlen), 1)
-          /* test that either len must be set if out is NULL */
-          && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, NULL, NULL, NULL), 0)
-          && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, &ctlen, NULL, NULL), 1)
-          && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, NULL, NULL, &secretlen), 1)
-          && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, &ctlen, NULL, &secretlen), 1)
-          /* Secret buffer should be set if there is an output buffer */
-          && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, &ctlen, NULL, NULL), 0)
-          /* Test that lengths are optional if ct is not NULL */
-          && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, NULL, secret, NULL), 1)
-          /* Pass if secret or secret length are not NULL */
-          && TEST_int_eq(EVP_PKEY_decapsulate_init(privctx, NULL), 1)
-          && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(privctx, "RSASVE"), 1)
-          && TEST_int_eq(EVP_PKEY_decapsulate(privctx, secret, NULL, ct, sizeof(ct)), 1)
-          && TEST_int_eq(EVP_PKEY_decapsulate(privctx, NULL, &secretlen, ct, sizeof(ct)), 1)
-          && TEST_int_eq(secretlen, 256)
-          /* Fail if passed NULL arguments */
-          && TEST_int_eq(EVP_PKEY_decapsulate(privctx, NULL, NULL, ct, sizeof(ct)), 0)
-          && TEST_int_eq(EVP_PKEY_decapsulate(privctx, secret, &secretlen, NULL, 0), 0)
-          && TEST_int_eq(EVP_PKEY_decapsulate(privctx, secret, &secretlen, NULL, sizeof(ct)), 0)
-          && TEST_int_eq(EVP_PKEY_decapsulate(privctx, secret, &secretlen, ct, 0), 0);
+        && TEST_ptr(pubctx = EVP_PKEY_CTX_new_from_pkey(libctx, pub, NULL))
+        && TEST_ptr(privctx = EVP_PKEY_CTX_new_from_pkey(libctx, priv, NULL))
+        /* Test setting kem op before the init fails */
+        && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, "RSASVE"), -2)
+        /* Test NULL ctx passed */
+        && TEST_int_eq(EVP_PKEY_encapsulate_init(NULL, NULL), 0)
+        && TEST_int_eq(EVP_PKEY_encapsulate(NULL, NULL, NULL, NULL, NULL), 0)
+        && TEST_int_eq(EVP_PKEY_decapsulate_init(NULL, NULL), 0)
+        && TEST_int_eq(EVP_PKEY_decapsulate(NULL, NULL, NULL, NULL, 0), 0)
+        /* Test Invalid operation */
+        && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, NULL, NULL, NULL), -1)
+        && TEST_int_eq(EVP_PKEY_decapsulate(privctx, NULL, NULL, NULL, 0), 0)
+        /* Wrong key component - no secret should be returned on failure */
+        && TEST_int_eq(EVP_PKEY_decapsulate_init(pubctx, NULL), 1)
+        && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, "RSASVE"), 1)
+        && TEST_int_eq(EVP_PKEY_decapsulate(pubctx, secret, &secretlen, ct,
+                                            sizeof(ct)), 0)
+        && TEST_uchar_eq(secret[0], 0)
+        /* Test encapsulate fails if the mode is not set */
+        && TEST_int_eq(EVP_PKEY_encapsulate_init(pubctx, NULL), 1)
+        && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, &ctlen, secret, &secretlen), -2)
+        /* Test setting a bad kem ops fail */
+        && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, "RSA"), 0)
+        && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, NULL), 0)
+        && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(NULL,  "RSASVE"), 0)
+        && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(NULL,  NULL), 0)
+        /* Test secretlen is optional */
+        && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(pubctx, "RSASVE"), 1)
+        && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, &ctlen, NULL, NULL), 1)
+        && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, &ctlen, secret, NULL), 1)
+        && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, &ctlen, NULL, NULL), 1)
+        /* Test outlen is optional */
+        && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, NULL, NULL, &secretlen), 1)
+        && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, NULL, secret, &secretlen), 1)
+        /* test that either len must be set if out is NULL */
+        && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, NULL, NULL, NULL), 0)
+        && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, &ctlen, NULL, NULL), 1)
+        && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, NULL, NULL, &secretlen), 1)
+        && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, NULL, &ctlen, NULL, &secretlen), 1)
+        /* Secret buffer should be set if there is an output buffer */
+        && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, &ctlen, NULL, NULL), 0)
+        /* Test that lengths are optional if ct is not NULL */
+        && TEST_int_eq(EVP_PKEY_encapsulate(pubctx, ct, NULL, secret, NULL), 1)
+        /* Pass if secret or secret length are not NULL */
+        && TEST_int_eq(EVP_PKEY_decapsulate_init(privctx, NULL), 1)
+        && TEST_int_eq(EVP_PKEY_CTX_set_kem_op(privctx, "RSASVE"), 1)
+        && TEST_int_eq(EVP_PKEY_decapsulate(privctx, secret, NULL, ct, sizeof(ct)), 1)
+        && TEST_int_eq(EVP_PKEY_decapsulate(privctx, NULL, &secretlen, ct, sizeof(ct)), 1)
+        && TEST_int_eq(secretlen, 256)
+        /* Fail if passed NULL arguments */
+        && TEST_int_eq(EVP_PKEY_decapsulate(privctx, NULL, NULL, ct, sizeof(ct)), 0)
+        && TEST_int_eq(EVP_PKEY_decapsulate(privctx, secret, &secretlen, NULL, 0), 0)
+        && TEST_int_eq(EVP_PKEY_decapsulate(privctx, secret, &secretlen, NULL, sizeof(ct)), 0)
+        && TEST_int_eq(EVP_PKEY_decapsulate(privctx, secret, &secretlen, ct, 0), 0);
 
     EVP_PKEY_free(pub);
     EVP_PKEY_free(priv);
diff --git a/deps/openssl/openssl/test/ext_internal_test.c b/deps/openssl/openssl/test/ext_internal_test.c
index 769b25391d5..dec6ee61efb 100644
--- a/deps/openssl/openssl/test/ext_internal_test.c
+++ b/deps/openssl/openssl/test/ext_internal_test.c
@@ -69,13 +69,6 @@ static EXT_LIST ext_list[] = {
     EXT_ENTRY(cryptopro_bug),
     EXT_ENTRY(early_data),
     EXT_ENTRY(certificate_authorities),
-#ifndef OPENSSL_NO_QUIC
-    EXT_ENTRY(quic_transport_parameters_draft),
-    EXT_ENTRY(quic_transport_parameters),
-#else
-    EXT_EXCEPTION(quic_transport_parameters_draft),
-    EXT_EXCEPTION(quic_transport_parameters),
-#endif
     EXT_ENTRY(padding),
     EXT_ENTRY(psk),
     EXT_END(num_builtins)
diff --git a/deps/openssl/openssl/test/hmactest.c b/deps/openssl/openssl/test/hmactest.c
index 8f5bf32f870..0a29c58731f 100644
--- a/deps/openssl/openssl/test/hmactest.c
+++ b/deps/openssl/openssl/test/hmactest.c
@@ -275,19 +275,21 @@ static int test_hmac_copy_uninited(void)
     return res;
 }
 
-# ifndef OPENSSL_NO_MD5
+#ifndef OPENSSL_NO_MD5
+# define OSSL_HEX_CHARS_PER_BYTE 2
 static char *pt(unsigned char *md, unsigned int len)
 {
     unsigned int i;
-    static char buf[80];
+    static char buf[201];
 
     if (md == NULL)
         return NULL;
-    for (i = 0; i < len; i++)
-        sprintf(&(buf[i * 2]), "%02x", md[i]);
+    for (i = 0; i < len && (i + 1) * OSSL_HEX_CHARS_PER_BYTE < sizeof(buf); i++)
+        BIO_snprintf(buf + i * OSSL_HEX_CHARS_PER_BYTE,
+                     OSSL_HEX_CHARS_PER_BYTE + 1, "%02x", md[i]);
     return buf;
 }
-# endif
+#endif
 
 int setup_tests(void)
 {
diff --git a/deps/openssl/openssl/test/memleaktest.c b/deps/openssl/openssl/test/memleaktest.c
index 97827b8e9cd..87616867739 100644
--- a/deps/openssl/openssl/test/memleaktest.c
+++ b/deps/openssl/openssl/test/memleaktest.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -44,7 +44,7 @@ int main(int argc, char *argv[])
      */
     int exitcode = EXIT_FAILURE;
 #endif
-    char *lost;
+    char *volatile lost;
 
     lost = OPENSSL_malloc(3);
     if (!TEST_ptr(lost))
diff --git a/deps/openssl/openssl/test/nocache-and-default.cnf b/deps/openssl/openssl/test/nocache-and-default.cnf
new file mode 100644
index 00000000000..cf5ca8d1141
--- /dev/null
+++ b/deps/openssl/openssl/test/nocache-and-default.cnf
@@ -0,0 +1,18 @@
+openssl_conf = openssl_init
+
+# Comment out the next line to ignore configuration errors
+config_diagnostics = 1
+
+[openssl_init]
+providers = provider_sect
+
+[provider_sect]
+test    = test_sect
+default = default_sect
+
+[test_sect]
+module = ../test/p_test.so
+activate = true
+
+[default_sect]
+activate = true
diff --git a/deps/openssl/openssl/test/p_test.c b/deps/openssl/openssl/test/p_test.c
index 80f0784dd9d..46f990113fb 100644
--- a/deps/openssl/openssl/test/p_test.c
+++ b/deps/openssl/openssl/test/p_test.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -16,6 +16,8 @@
 #include <string.h>
 #include <stdio.h>
 
+#include <stdarg.h>
+
 /*
  * When built as an object file to link the application with, we get the
  * init function name through the macro PROVIDER_INIT_FUNCTION_NAME.  If
@@ -46,6 +48,7 @@ static OSSL_FUNC_core_get_params_fn *c_get_params = NULL;
 static OSSL_FUNC_core_new_error_fn *c_new_error;
 static OSSL_FUNC_core_set_error_debug_fn *c_set_error_debug;
 static OSSL_FUNC_core_vset_error_fn *c_vset_error;
+static OSSL_FUNC_BIO_vsnprintf_fn *c_BIO_vsnprintf;
 
 /* Tell the core what params we provide and what type they are */
 static const OSSL_PARAM p_param_types[] = {
@@ -60,6 +63,17 @@ static OSSL_FUNC_provider_get_params_fn p_get_params;
 static OSSL_FUNC_provider_get_reason_strings_fn p_get_reason_strings;
 static OSSL_FUNC_provider_teardown_fn p_teardown;
 
+static int local_snprintf(char *buf, size_t n, const char *format, ...)
+{
+    va_list args;
+    int ret;
+
+    va_start(args, format);
+    ret = (*c_BIO_vsnprintf)(buf, n, format, args);
+    va_end(args);
+    return ret;
+}
+
 static void p_set_error(int lib, int reason, const char *file, int line,
                         const char *func, const char *fmt, ...)
 {
@@ -114,11 +128,11 @@ static int p_get_params(void *provctx, OSSL_PARAM params[])
                     const char *versionp = *(void **)counter_request[0].data;
                     const char *namep = *(void **)counter_request[1].data;
 
-                    sprintf(buf, "Hello OpenSSL %.20s, greetings from %s!",
-                            versionp, namep);
+                    local_snprintf(buf, sizeof(buf), "Hello OpenSSL %.20s, greetings from %s!",
+                                   versionp, namep);
                 }
             } else {
-                sprintf(buf, "Howdy stranger...");
+                local_snprintf(buf, sizeof(buf), "Howdy stranger...");
             }
 
             p->return_size = buf_l = strlen(buf) + 1;
@@ -216,12 +230,21 @@ static const OSSL_ITEM *p_get_reason_strings(void *_)
     return reason_strings;
 }
 
+static const OSSL_ALGORITHM *p_query(OSSL_PROVIDER *prov,
+                                     int operation_id,
+                                     int *no_cache)
+{
+    *no_cache = 1;
+    return NULL;
+}
+
 static const OSSL_DISPATCH p_test_table[] = {
     { OSSL_FUNC_PROVIDER_GETTABLE_PARAMS, (void (*)(void))p_gettable_params },
     { OSSL_FUNC_PROVIDER_GET_PARAMS, (void (*)(void))p_get_params },
     { OSSL_FUNC_PROVIDER_GET_REASON_STRINGS,
         (void (*)(void))p_get_reason_strings},
     { OSSL_FUNC_PROVIDER_TEARDOWN, (void (*)(void))p_teardown },
+    { OSSL_FUNC_PROVIDER_QUERY_OPERATION, (void (*)(void))p_query },
     { 0, NULL }
 };
 
@@ -250,6 +273,9 @@ int OSSL_provider_init(const OSSL_CORE_HANDLE *handle,
         case OSSL_FUNC_CORE_VSET_ERROR:
             c_vset_error = OSSL_FUNC_core_vset_error(in);
             break;
+        case OSSL_FUNC_BIO_VSNPRINTF:
+            c_BIO_vsnprintf = OSSL_FUNC_BIO_vsnprintf(in);
+            break;
         default:
             /* Just ignore anything we don't understand */
             break;
diff --git a/deps/openssl/openssl/test/pkcs12_format_test.c b/deps/openssl/openssl/test/pkcs12_format_test.c
index c142093f72b..f7ecd7c1e63 100644
--- a/deps/openssl/openssl/test/pkcs12_format_test.c
+++ b/deps/openssl/openssl/test/pkcs12_format_test.c
@@ -358,7 +358,8 @@ static int test_single_key(PKCS12_ENC *enc)
     char fname[80];
     PKCS12_BUILDER *pb;
 
-    sprintf(fname, "1key_ciph-%s_iter-%d.p12", OBJ_nid2sn(enc->nid), enc->iter);
+    BIO_snprintf(fname, sizeof(fname), "1key_ciph-%s_iter-%d.p12",
+                 OBJ_nid2sn(enc->nid), enc->iter);
 
     pb = new_pkcs12_builder(fname);
 
@@ -457,7 +458,8 @@ static int test_single_cert_mac(PKCS12_ENC *mac)
     char fname[80];
     PKCS12_BUILDER *pb;
 
-    sprintf(fname, "1cert_mac-%s_iter-%d.p12", OBJ_nid2sn(mac->nid), mac->iter);
+    BIO_snprintf(fname, sizeof(fname), "1cert_mac-%s_iter-%d.p12",
+                 OBJ_nid2sn(mac->nid), mac->iter);
 
     pb = new_pkcs12_builder(fname);
 
@@ -617,7 +619,8 @@ static int test_single_secret(PKCS12_ENC *enc)
     char fname[80];
     PKCS12_BUILDER *pb;
 
-    sprintf(fname, "1secret_ciph-%s_iter-%d.p12", OBJ_nid2sn(enc->nid), enc->iter);
+    BIO_snprintf(fname, sizeof(fname), "1secret_ciph-%s_iter-%d.p12",
+                 OBJ_nid2sn(enc->nid), enc->iter);
     pb = new_pkcs12_builder(fname);
     custom_nid = get_custom_oid();
 
diff --git a/deps/openssl/openssl/test/property_test.c b/deps/openssl/openssl/test/property_test.c
index 88c5342c538..1f1171ad90a 100644
--- a/deps/openssl/openssl/test/property_test.c
+++ b/deps/openssl/openssl/test/property_test.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2019-2025 The OpenSSL Project Authors. All Rights Reserved.
  * Copyright (c) 2019, Oracle and/or its affiliates.  All rights reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
@@ -50,30 +50,37 @@ static void down_ref(void *p)
 
 static int test_property_string(void)
 {
-    OSSL_METHOD_STORE *store;
+    OSSL_LIB_CTX *ctx;
+    OSSL_METHOD_STORE *store = NULL;
     int res = 0;
     OSSL_PROPERTY_IDX i, j;
 
-    if (TEST_ptr(store = ossl_method_store_new(NULL))
-        && TEST_int_eq(ossl_property_name(NULL, "fnord", 0), 0)
-        && TEST_int_ne(ossl_property_name(NULL, "fnord", 1), 0)
-        && TEST_int_ne(ossl_property_name(NULL, "name", 1), 0)
+    /*-
+     * Use our own library context because we depend on ordering from a
+     * pristine state.
+     */
+    if (TEST_ptr(ctx = OSSL_LIB_CTX_new())
+        && TEST_ptr(store = ossl_method_store_new(ctx))
+        && TEST_int_eq(ossl_property_name(ctx, "fnord", 0), 0)
+        && TEST_int_ne(ossl_property_name(ctx, "fnord", 1), 0)
+        && TEST_int_ne(ossl_property_name(ctx, "name", 1), 0)
         /* Property value checks */
-        && TEST_int_eq(ossl_property_value(NULL, "fnord", 0), 0)
-        && TEST_int_ne(i = ossl_property_value(NULL, "no", 0), 0)
-        && TEST_int_ne(j = ossl_property_value(NULL, "yes", 0), 0)
+        && TEST_int_eq(ossl_property_value(ctx, "fnord", 0), 0)
+        && TEST_int_ne(i = ossl_property_value(ctx, "no", 0), 0)
+        && TEST_int_ne(j = ossl_property_value(ctx, "yes", 0), 0)
         && TEST_int_ne(i, j)
-        && TEST_int_eq(ossl_property_value(NULL, "yes", 1), j)
-        && TEST_int_eq(ossl_property_value(NULL, "no", 1), i)
-        && TEST_int_ne(i = ossl_property_value(NULL, "illuminati", 1), 0)
-        && TEST_int_eq(j = ossl_property_value(NULL, "fnord", 1), i + 1)
-        && TEST_int_eq(ossl_property_value(NULL, "fnord", 1), j)
+        && TEST_int_eq(ossl_property_value(ctx, "yes", 1), j)
+        && TEST_int_eq(ossl_property_value(ctx, "no", 1), i)
+        && TEST_int_ne(i = ossl_property_value(ctx, "illuminati", 1), 0)
+        && TEST_int_eq(j = ossl_property_value(ctx, "fnord", 1), i + 1)
+        && TEST_int_eq(ossl_property_value(ctx, "fnord", 1), j)
         /* Check name and values are distinct */
-        && TEST_int_eq(ossl_property_value(NULL, "cold", 0), 0)
-        && TEST_int_ne(ossl_property_name(NULL, "fnord", 0),
-                       ossl_property_value(NULL, "fnord", 0)))
+        && TEST_int_eq(ossl_property_value(ctx, "cold", 0), 0)
+        && TEST_int_ne(ossl_property_name(ctx, "fnord", 0),
+                       ossl_property_value(ctx, "fnord", 0)))
         res = 1;
     ossl_method_store_free(store);
+    OSSL_LIB_CTX_free(ctx);
     return res;
 }
 
diff --git a/deps/openssl/openssl/test/recipes/03-test_fipsinstall.t b/deps/openssl/openssl/test/recipes/03-test_fipsinstall.t
index 5f514e231b5..c243b5646d3 100644
--- a/deps/openssl/openssl/test/recipes/03-test_fipsinstall.t
+++ b/deps/openssl/openssl/test/recipes/03-test_fipsinstall.t
@@ -253,6 +253,10 @@ SKIP: {
 SKIP: {
     skip "Skipping Asymmetric RSA corruption test because of no rsa in this build", 1
         if disabled("rsa");
+    run(test(["fips_version_test", "-config", $provconf, "<3.5.0"]),
+             capture => 1, statusvar => \my $exit);
+    skip "FIPS provider version is too new for Asymmetric RSA corruption test", 1
+        if !$exit;
     ok(!run(app(['openssl', 'fipsinstall', '-out', 'fips.cnf', '-module', $infile,
                 '-corrupt_desc', 'RSA_Encrypt',
                 '-corrupt_type', 'KAT_AsymmetricCipher'])),
diff --git a/deps/openssl/openssl/test/recipes/04-test_encoder_decoder.t b/deps/openssl/openssl/test/recipes/04-test_encoder_decoder.t
index 19541610a9a..d5d79f3a575 100644
--- a/deps/openssl/openssl/test/recipes/04-test_encoder_decoder.t
+++ b/deps/openssl/openssl/test/recipes/04-test_encoder_decoder.t
@@ -25,9 +25,26 @@ my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
 my $rsa_key = srctop_file("test", "certs", "ee-key.pem");
 my $pss_key = srctop_file("test", "certs", "ca-pss-key.pem");
 
-plan tests => ($no_fips ? 0 : 1) + 2;     # FIPS install test + test
+plan tests => ($no_fips ? 0 : 3) + 2;     # FIPS install test + test
 
 my $conf = srctop_file("test", "default.cnf");
+
+# Check if the specified pattern occurs in the given file
+# Returns 1 if the pattern is found and 0 if not
+sub find_line_file {
+    my ($key, $file) = @_;
+
+    open(my $in, $file) or return -1;
+    while (my $line = <$in>) {
+        if ($line =~ /$key/) {
+            close($in);
+            return 1;
+        }
+    }
+    close($in);
+    return 0;
+}
+
 ok(run(test(["endecode_test", "-rsa", $rsa_key,
                               "-pss", $pss_key,
                               "-config", $conf,
@@ -47,5 +64,13 @@ unless ($no_fips) {
                                   "-pss", $pss_key,
                                   "-config", $conf,
                                   "-provider", "fips"])));
+SKIP: {
+    skip "EC disabled", 2 if disabled("ec");
+    ok(run(app([ 'openssl', 'genpkey', '-algorithm', 'EC',
+                 '-pkeyopt', 'group:P-256', '-text',
+                 '-config', $conf, '-provider', 'fips', '-out', 'ec.txt' ])),
+       'Print a FIPS provider EC private key');
+    ok(find_line_file('NIST CURVE: P-256', 'ec.txt') == 1,
+       'Printing an FIPS provider EC private key');
+}
 }
-
diff --git a/deps/openssl/openssl/test/recipes/20-test_nocache.t b/deps/openssl/openssl/test/recipes/20-test_nocache.t
new file mode 100644
index 00000000000..f7a956ee05e
--- /dev/null
+++ b/deps/openssl/openssl/test/recipes/20-test_nocache.t
@@ -0,0 +1,34 @@
+#! /usr/bin/env perl
+# Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the Apache License 2.0 (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+use strict;
+use warnings;
+
+use OpenSSL::Test qw/:DEFAULT bldtop_file srctop_file bldtop_dir with/;
+use OpenSSL::Test::Utils;
+
+setup("test_nocache");
+
+plan tests => 4;
+
+ok(run(app(["openssl", "list", "-mac-algorithms"],
+        stdout => "listout.txt")),
+"List mac algorithms - default configuration");
+open DATA, "listout.txt";
+my @match = grep /MAC/, <DATA>;
+close DATA;
+ok(scalar @match > 1 ? 1 : 0, "Several algorithms are listed - default configuration");
+
+$ENV{OPENSSL_CONF} = bldtop_file("test", "nocache-and-default.cnf");
+ok(run(app(["openssl", "list", "-mac-algorithms"],
+        stdout => "listout.txt")),
+"List mac algorithms");
+open DATA, "listout.txt";
+my @match = grep /MAC/, <DATA>;
+close DATA;
+ok(scalar @match > 1 ? 1 : 0, "Several algorithms are listed - nocache-and-default");
diff --git a/deps/openssl/openssl/test/recipes/25-test_verify.t b/deps/openssl/openssl/test/recipes/25-test_verify.t
index 818c9ac50dd..7fa14d9daa8 100644
--- a/deps/openssl/openssl/test/recipes/25-test_verify.t
+++ b/deps/openssl/openssl/test/recipes/25-test_verify.t
@@ -61,7 +61,7 @@ ok(verify("ee-cert-ocsp-nocheck", "", ["root-cert"], ["ca-cert"]),
 ok(verify("ee-cert", "sslserver", [qw(sroot-cert)], [qw(ca-cert)]),
    "accept server purpose");
 ok(!verify("ee-cert", "sslserver", [qw(croot-cert)], [qw(ca-cert)]),
-   "fail client purpose");
+   "fail client purpose"); # beware, questionable non-standard EKU check on trust anchor
 ok(verify("ee-cert", "sslserver", [qw(root+serverAuth)], [qw(ca-cert)]),
    "accept server trust");
 ok(verify("ee-cert", "sslserver", [qw(sroot+serverAuth)], [qw(ca-cert)]),
@@ -81,7 +81,7 @@ ok(verify("ee-cert", "sslserver", [qw(root-clientAuth)], [qw(ca-cert)]),
 ok(verify("ee-cert", "sslserver", [qw(sroot-clientAuth)], [qw(ca-cert)]),
    "accept client mistrust with server purpose");
 ok(!verify("ee-cert", "sslserver", [qw(croot-clientAuth)], [qw(ca-cert)]),
-   "fail client mistrust with client purpose");
+   "fail client mistrust with client purpose"); # beware, questionable non-standard EKU check on trust anchor
 # Inapplicable trust
 ok(!verify("ee-cert", "sslserver", [qw(root+clientAuth)], [qw(ca-cert)]),
    "fail client trust");
@@ -150,7 +150,7 @@ ok(!verify("ee-cert", "sslserver", [qw(root-expired)], [qw(ca-cert)]),
 ok(verify("ee-cert", "sslserver", [qw(sca-cert)], [], "-partial_chain"),
    "accept partial chain with server purpose");
 ok(!verify("ee-cert", "sslserver", [qw(cca-cert)], [], "-partial_chain"),
-   "fail partial chain with client purpose");
+   "fail partial chain with client purpose"); # beware, questionable non-standard EKU check on trust anchor
 ok(verify("ee-cert", "sslserver", [qw(ca+serverAuth)], [], "-partial_chain"),
    "accept server trust partial chain");
 ok(verify("ee-cert", "sslserver", [qw(cca+serverAuth)], [], "-partial_chain"),
@@ -188,7 +188,7 @@ ok(verify("ee-cert", "sslserver", [qw(root-cert cca+serverAuth)], [qw(ca-cert)])
 ok(verify("ee-cert", "sslserver", [qw(root-cert cca+anyEKU)], [qw(ca-cert)]),
    "accept wildcard trust and client purpose");
 ok(!verify("ee-cert", "sslserver", [qw(root-cert cca-cert)], [qw(ca-cert)]),
-   "fail client purpose");
+   "fail client purpose intermediate trusted"); # beware, questionable non-standard EKU check on trust anchor
 ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-anyEKU)], [qw(ca-cert)]),
    "fail wildcard mistrust");
 ok(!verify("ee-cert", "sslserver", [qw(root-cert ca-serverAuth)], [qw(ca-cert)]),
diff --git a/deps/openssl/openssl/test/recipes/30-test_evp_data/evpkdf_tls13_kdf.txt b/deps/openssl/openssl/test/recipes/30-test_evp_data/evpkdf_tls13_kdf.txt
index 9ad8b9fbd2d..c7e7b4b5bf9 100644
--- a/deps/openssl/openssl/test/recipes/30-test_evp_data/evpkdf_tls13_kdf.txt
+++ b/deps/openssl/openssl/test/recipes/30-test_evp_data/evpkdf_tls13_kdf.txt
@@ -4935,3 +4935,13 @@ Ctrl.mode = mode:EXTRACT_AND_EXPAND
 Ctrl.digest = digest:SHA256
 Result = KDF_CTRL_ERROR
 
+# Test that salt of arbitrary length works
+FIPSversion = >=3.4.0
+KDF = TLS13-KDF
+Ctrl.mode = mode:EXTRACT_ONLY
+Ctrl.digest = digest:SHA2-256
+Ctrl.key = hexkey:f8af6aea2d397baf2948a25b2834200692cff17eee9165e4e27babee9edefd05
+Ctrl.salt = hexsalt:00010203040506070809000102030405060708090001020304050607080900010203040506070809
+Ctrl.prefix = hexprefix:746c73313320
+Ctrl.label = hexlabel:64657269766564
+Output = ef0aa4925ab6f4588759e15dfadcf7602ca7aa39ebb092bd7ab48f6a68c54449
diff --git a/deps/openssl/openssl/test/recipes/61-test_bio_pw_callback.t b/deps/openssl/openssl/test/recipes/61-test_bio_pw_callback.t
new file mode 100644
index 00000000000..4cb1db1f589
--- /dev/null
+++ b/deps/openssl/openssl/test/recipes/61-test_bio_pw_callback.t
@@ -0,0 +1,20 @@
+#! /usr/bin/env perl
+# Copyright 2024 The OpenSSL Project Authors. All Rights Reserved.
+#
+# Licensed under the Apache License 2.0 (the "License").  You may not use
+# this file except in compliance with the License.  You can obtain a copy
+# in the file LICENSE in the source distribution or at
+# https://www.openssl.org/source/license.html
+
+use strict;
+use warnings;
+
+use OpenSSL::Test qw(:DEFAULT data_file);
+
+setup('test_bio_pw_callback');
+
+plan tests => 1;
+
+my $private_key_path = data_file("private_key.pem");
+ok(run(test(["bio_pw_callback_test", "-keyfile", $private_key_path])),
+   "Running bio_pw_callback_test");
diff --git a/deps/openssl/openssl/test/recipes/61-test_bio_pw_callback_data/private_key.pem b/deps/openssl/openssl/test/recipes/61-test_bio_pw_callback_data/private_key.pem
new file mode 100644
index 00000000000..f9c9ae5dbc4
--- /dev/null
+++ b/deps/openssl/openssl/test/recipes/61-test_bio_pw_callback_data/private_key.pem
@@ -0,0 +1,30 @@
+-----BEGIN ENCRYPTED PRIVATE KEY-----
+MIIFNTBfBgkqhkiG9w0BBQ0wUjAxBgkqhkiG9w0BBQwwJAQQmftpln/ZNiEznncq
++u0FuwICCAAwDAYIKoZIhvcNAgkFADAdBglghkgBZQMEASoEEBO5TGcD0mGTfRS8
+HgafEXYEggTQOasEXPm4ChGPzfXACYhaAtMFnfL9qpI1S30bHMUHsWuXLZDFPNty
+7KNKWr35woaq3XFEeul7onszcBBRrRwPkTqOifuv/J01s7oS0uC6jwbvSkAFNjHe
+jkgvMMQA3y7nwZ2wSwVjO2K91qasTjNivus3ZaCvGqGpgNckEXILPZJEdWteWP+1
+SN9zLxxeHwgt5SrMfylrTghLB8b119/uq4GnOYHZdhMbp4YmneuGqvlZ7nle7qLY
+33tuM5deajk9hINLfbYWGwURaOZ+r++Rvrz4OxISfe70uXT+2fcSZPVkNT5a6B5T
+9rCwdF69W/+3au50gfc2VEF/xZBajxLI0PBpMSpxNE3a5/3YLKXAs+z0YJdQKNhN
+U+SpOUv8D2GraJVfP7MddO2JvETh8w7tGN/a8qSw07Z91SE3Vfuq0l5PheC/vXJq
+/xxU3YSbZC7LCSZn1aXBlj9KbTh2o1ARzdJsVYo1xY2OIFtFpncOjQDuaAmsNcZE
+CuB9FUcBwwO/bjooIkv4lJU+DWDxrCR7Si8PZ4hHgXCXXKiXA20SBccUYm0Z4HR3
+i2tm9UTwAuCy1BF7hRmPLIyvlgtlKh2V9Cre5j86GoKTmPh/q5DHdSmNAM8Aakct
+GdQgscOXRmHq7/1nec28wEhlbqVyYJ45MZbWhBTrycMru/ch9+ZnsIgPXLfbBA+P
+6GHK1DF+onKZtMkH0SNMU3X1arlJKRreVQsvkbgL7aw3mI0veYa4/tJUf7hbkPpA
+LArQU5wQ+A9mzC+tYMfz3mrIE05FrpYkHRxiB/odeNvCTMR7DhGoghhnYUN/gSSN
+qH5EBG2hQ/pJ5ZSawE+P9+vCLlvcc4n00zgi0s3rMN2AntPZoI3sWKZcbbgJoOIH
+cbAmBAKCIiwmlPmI0hjEAIXRBixJzHVGNowuSc3jy5pIiSjmDESnARl+n5imqI3D
+po9OuCHpo4nRLcAX0GrJqqKxUG+R1A8g/AooIGEPQgkXk/4v9gwd4aBvwT4YxR44
+onAXdyBMM0T8C+8dUmT6OPvU5w6JHFidJfhBgJhDIdj9JM+wWdr1CW94todjEyKY
+Xe3NRG1bGbcN6HBVwbe4UZ39A9p4kKGyiXexlsD+DvFxwaGvSy2rp0lLabz19Kkr
+fnLU1Ugb38AnEYTGYJMB9nO19lHW62Mk6+9ky42x8X9vBn81Nif/c0kmvEKsZEfw
+UM7m0fIWTZOWSH01DGIXqCoCk7vJ1CSm0wUsAvyKFLm1qnM5eJJNMlBbayDDBsnU
+Jj9hx7GWjujVKFwFngUOoFpmFWB72bqeBWenaQJhIVydQa1rolny0TECJIkFOsUK
+Wa0y52V4h68Ig5G5p2WHG0RlEVtmcgzSoL1mLE5UdOYaH5oB7nTVM+Z0b8HJFrYc
+7Xhym8uNq6UHc4Ae6TT8EA3lA3fDttedKzWxlBFXqX9behl2uBnPzCl3cS2G2Uek
+xtexjecZINP8L5i6eIL7bPoVMF5CUsUhIWFA0gzIovRBRvVS91HnTrIDLvqF8YgQ
+ToctUU/vS8r3x2/TIR60UBvW0vkoFa+lfzHtsxBnT1nMBZNeeHOCM8QtboyI9Ir9
+UkJbTO+QpJQ5A3ELharpcqr7iywDOnLSV9LZSUZr934zOrRl2oAXx/0=
+-----END ENCRYPTED PRIVATE KEY-----
diff --git a/deps/openssl/openssl/test/recipes/80-test_cmp_http.t b/deps/openssl/openssl/test/recipes/80-test_cmp_http.t
index 0ca547354fc..c704cc758e9 100644
--- a/deps/openssl/openssl/test/recipes/80-test_cmp_http.t
+++ b/deps/openssl/openssl/test/recipes/80-test_cmp_http.t
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2007-2022 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2007-2025 The OpenSSL Project Authors. All Rights Reserved.
 # Copyright Nokia 2007-2019
 # Copyright Siemens AG 2015-2019
 #
@@ -270,7 +270,7 @@ sub start_mock_server {
     print "Current directory is ".getcwd()."\n";
     print "Launching mock server: $cmd\n";
     die "Invalid port: $server_port" unless $server_port =~ m/^\d+$/;
-    my $pid = open($server_fh, "$cmd|") or die "Trying to $cmd";
+    my $pid = open($server_fh, "$cmd 2>".result_dir()."/error.txt |") or die "Trying to $cmd";
     print "Pid is: $pid\n";
     if ($server_port == 0) {
         # Find out the actual server port
diff --git a/deps/openssl/openssl/test/recipes/80-test_cmp_http_data/test_connection.csv b/deps/openssl/openssl/test/recipes/80-test_cmp_http_data/test_connection.csv
index 33a572a29da..cc012411ea5 100644
--- a/deps/openssl/openssl/test/recipes/80-test_cmp_http_data/test_connection.csv
+++ b/deps/openssl/openssl/test/recipes/80-test_cmp_http_data/test_connection.csv
@@ -2,8 +2,8 @@ expected,description, -section,val, -server,val, -proxy,val, -no_proxy,val, -tls
 ,Message transfer options:,,,,,,,,,,,,,,,,,,
 ,,,,,,,,,,,,,,,,,,,
 1,default config, -section,,,,,,,,BLANK,,,,BLANK,,BLANK,,BLANK,
-TBD,Domain name, -section,, -server,_SERVER_CN:_SERVER_PORT,,,,,,,,,,,,,,
-TBD,IP address, -section,, -server,_SERVER_IP:_SERVER_PORT,,,,,,,,,,,,,,
+1,disabled as not supported by some host IP configurations: server domain name, -section,, -server,localhost:_SERVER_PORT,,,,,,,,,,,,,,
+1,disabled as not supported by some host IP configurations: server IPv6 address, -section,, -server,[::1]:_SERVER_PORT,,,,,,,,,,,,,,
 ,,,,,,,,,,,,,,,,,,,
 0,wrong server, -section,, -server,xn--rksmrgs-5wao1o.example.com:_SERVER_PORT,,,,,BLANK,,,, -msg_timeout,1,BLANK,,BLANK,
 0,wrong server port, -section,, -server,_SERVER_HOST:99,,,,,BLANK,,,, -msg_timeout,1,BLANK,,BLANK,
diff --git a/deps/openssl/openssl/test/recipes/80-test_cms.t b/deps/openssl/openssl/test/recipes/80-test_cms.t
index 31f9fbd1280..0e8b0259f1c 100644
--- a/deps/openssl/openssl/test/recipes/80-test_cms.t
+++ b/deps/openssl/openssl/test/recipes/80-test_cms.t
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2015-2023 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2015-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -25,6 +25,7 @@ use lib srctop_dir('Configurations');
 use lib bldtop_dir('.');
 
 my $no_fips = disabled('fips') || ($ENV{NO_FIPS} // 0);
+my $old_fips = 0;
 
 plan skip_all => "CMS is not supported by this OpenSSL build"
     if disabled("cms");
@@ -50,13 +51,17 @@ my ($no_des, $no_dh, $no_dsa, $no_ec, $no_ec2m, $no_rc2, $no_zlib)
 
 $no_rc2 = 1 if disabled("legacy");
 
-plan tests => 19;
+plan tests => 20;
 
 ok(run(test(["pkcs7_test"])), "test pkcs7");
 
 unless ($no_fips) {
-    @config = ( "-config", srctop_file("test", "fips-and-base.cnf") );
+    my $provconf = srctop_file("test", "fips-and-base.cnf");
+    @config = ( "-config", $provconf );
     $provname = 'fips';
+
+    run(test(["fips_version_test", "-config", $provconf, "<3.4.0"]),
+    capture => 1, statusvar => $old_fips);
 }
 
 $ENV{OPENSSL_TEST_LIBCTX} = "1";
@@ -394,6 +399,13 @@ my @smime_cms_tests = (
         "-out", "{output}.txt" ],
       \&final_compare
     ],
+
+    [ "encrypted content test streaming PEM format -noout, 128 bit AES key",
+      [ "{cmd1}", @prov, "-EncryptedData_encrypt", "-in", $smcont, "-outform", "PEM",
+	"-aes128", "-secretkey", "000102030405060708090A0B0C0D0E0F",
+	"-stream", "-noout" ],
+      [ "{cmd2}", @prov, "-help" ]
+    ],
 );
 
 my @smime_cms_cades_tests = (
@@ -604,6 +616,7 @@ my @smime_cms_param_tests = (
         "-stream", "-out", "{output}.cms",
         "-recip", catfile($smdir, "smec1.pem"), "-aes128",
         "-keyopt", "ecdh_kdf_md:sha256" ],
+      sub { my %opts = @_; smimeType_matches("$opts{output}.cms", "enveloped-data"); },
       [ "{cmd2}", @prov, "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
         "-in", "{output}.cms", "-out", "{output}.txt" ],
       \&final_compare
@@ -613,6 +626,7 @@ my @smime_cms_param_tests = (
       [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
         "-stream", "-out", "{output}.cms",
         "-recip", catfile($smdir, "smec1.pem"), "-aes-128-gcm", "-keyopt", "ecdh_kdf_md:sha256" ],
+      sub { my %opts = @_; smimeType_matches("$opts{output}.cms", "authEnveloped-data"); },
       [ "{cmd2}", "-decrypt", "-recip", catfile($smdir, "smec1.pem"),
         "-in", "{output}.cms", "-out", "{output}.txt" ],
       \&final_compare
@@ -626,18 +640,23 @@ my @smime_cms_param_tests = (
       [ "{cmd2}", @prov, "-decrypt", "-recip", catfile($smdir, "smec2.pem"),
         "-in", "{output}.cms", "-out", "{output}.txt" ],
       \&final_compare
-    ],
-
-    [ "enveloped content test streaming S/MIME format, X9.42 DH",
-      [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
-        "-stream", "-out", "{output}.cms",
-        "-recip", catfile($smdir, "smdh.pem"), "-aes128" ],
-      [ "{cmd2}", @prov, "-decrypt", "-recip", catfile($smdir, "smdh.pem"),
-        "-in", "{output}.cms", "-out", "{output}.txt" ],
-      \&final_compare
     ]
 );
 
+if ($no_fips || $old_fips) {
+    # Only SHA1 supported in dh_cms_encrypt()
+    push(@smime_cms_param_tests,
+         [ "enveloped content test streaming S/MIME format, X9.42 DH",
+           [ "{cmd1}", @prov, "-encrypt", "-in", $smcont,
+             "-stream", "-out", "{output}.cms",
+             "-recip", catfile($smdir, "smdh.pem"), "-aes128" ],
+           [ "{cmd2}", @prov, "-decrypt", "-recip", catfile($smdir, "smdh.pem"),
+             "-in", "{output}.cms", "-out", "{output}.txt" ],
+           \&final_compare
+         ]
+    );
+}
+
 my @contenttype_cms_test = (
     [ "signed content test - check that content type is added to additional signerinfo, RSA keys",
       [ "{cmd1}", @prov, "-sign", "-binary", "-nodetach", "-stream", "-in", $smcont,
@@ -765,6 +784,28 @@ sub contentType_matches {
   return scalar(@c);
 }
 
+# Returns 1 if the smime-type matches the passed parameter, otherwise 0.
+sub smimeType_matches {
+  my ($in, $expected_smime_type) = @_;
+
+  # Read the text file
+  open(my $fh, '<', $in) or die("open failed for $in : $!");
+  local $/;
+  my $content = <$fh>;
+  close($fh);
+
+  # Extract the Content-Type line with the smime-type attribute
+  if ($content =~ /Content-Type:\s*application\/pkcs7-mime.*smime-type=([^\s;]+)/) {
+    my $smime_type = $1;
+
+    # Compare the extracted smime-type with the expected value
+    return ($smime_type eq $expected_smime_type) ? 1 : 0;
+  }
+
+  # If no smime-type is found, return 0
+  return 0;
+}
+
 sub rsapssSaltlen {
   my ($in) = @_;
   my $exit = 0;
@@ -986,6 +1027,22 @@ ok(!run(app(['openssl', 'cms', '-verify',
             ])),
    "issue#19643");
 
+# Check that kari encryption with originator does not segfault
+with({ exit_checker => sub { return shift == 3; } },
+  sub {
+    SKIP: {
+      skip "EC is not supported in this build", 1 if $no_ec;
+
+      ok(run(app(['openssl', 'cms', '-encrypt',
+                  '-in', srctop_file("test", "smcont.txt"), '-aes128',
+                  '-recip', catfile($smdir, "smec1.pem"),
+                  '-originator', catfile($smdir, "smec3.pem"),
+                  '-inkey', catfile($smdir, "smec3.pem")
+                ])),
+          "Check failure for currently not supported kari encryption with static originator");
+    }
+  });
+
 # Check that we get the expected failure return code
 with({ exit_checker => sub { return shift == 6; } },
     sub {
diff --git a/deps/openssl/openssl/test/sslapitest.c b/deps/openssl/openssl/test/sslapitest.c
index b0544d4942f..368b15f22b7 100644
--- a/deps/openssl/openssl/test/sslapitest.c
+++ b/deps/openssl/openssl/test/sslapitest.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2024 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -190,7 +190,7 @@ static int compare_hex_encoded_buffer(const char *hex_encoded,
         return 1;
 
     for (i = j = 0; i < raw_length && j + 1 < hex_length; i++, j += 2) {
-        sprintf(hexed, "%02x", raw[i]);
+        BIO_snprintf(hexed, sizeof(hexed), "%02x", raw[i]);
         if (!TEST_int_eq(hexed[0], hex_encoded[j])
                 || !TEST_int_eq(hexed[1], hex_encoded[j + 1]))
             return 1;
@@ -10764,364 +10764,6 @@ static int test_multi_resume(int idx)
     SSL_SESSION_free(sess);
     return testresult;
 }
-#ifndef OPENSSL_NO_QUIC
-static int test_quic_set_encryption_secrets(SSL *ssl,
-                                            OSSL_ENCRYPTION_LEVEL level,
-                                            const uint8_t *read_secret,
-                                            const uint8_t *write_secret,
-                                            size_t secret_len)
-{
-    test_printf_stderr("quic_set_encryption_secrets() %s, lvl=%d, len=%zd\n",
-                       ssl->server ? "server" : "client", level, secret_len);
-    return 1;
-}
-
-static int test_quic_add_handshake_data(SSL *ssl, OSSL_ENCRYPTION_LEVEL level,
-                                        const uint8_t *data, size_t len)
-{
-    SSL *peer = (SSL*)SSL_get_app_data(ssl);
-
-    TEST_info("quic_add_handshake_data() %s, lvl=%d, *data=0x%02X, len=%zd\n",
-              ssl->server ? "server" : "client", level, (int)*data, len);
-    if (!TEST_ptr(peer))
-        return 0;
-
-    /* We're called with what is locally written; this gives it to the peer */
-    if (!TEST_true(SSL_provide_quic_data(peer, level, data, len))) {
-        ERR_print_errors_fp(stderr);
-        return 0;
-    }
-
-    return 1;
-}
-
-static int test_quic_flush_flight(SSL *ssl)
-{
-    test_printf_stderr("quic_flush_flight() %s\n", ssl->server ? "server" : "client");
-    return 1;
-}
-
-static int test_quic_send_alert(SSL *ssl, enum ssl_encryption_level_t level, uint8_t alert)
-{
-    test_printf_stderr("quic_send_alert() %s, lvl=%d, alert=%d\n",
-                       ssl->server ? "server" : "client", level, alert);
-    return 1;
-}
-
-static SSL_QUIC_METHOD quic_method = {
-    test_quic_set_encryption_secrets,
-    test_quic_add_handshake_data,
-    test_quic_flush_flight,
-    test_quic_send_alert,
-};
-
-static int test_quic_api_set_versions(SSL *ssl, int ver)
-{
-    SSL_set_quic_transport_version(ssl, ver);
-    return 1;
-}
-
-static int test_quic_api_version(int clnt, int srvr)
-{
-    SSL_CTX *cctx = NULL, *sctx = NULL;
-    SSL *clientssl = NULL, *serverssl = NULL;
-    int testresult = 0;
-
-    static const char *server_str = "SERVER";
-    static const char *client_str = "CLIENT";
-    const uint8_t *peer_str;
-    size_t peer_str_len;
-
-    TEST_info("original clnt=0x%X, srvr=0x%X\n", clnt, srvr);
-
-    if (!TEST_true(create_ssl_ctx_pair(libctx,
-                                       TLS_server_method(),
-                                       TLS_client_method(),
-                                       TLS1_3_VERSION, 0,
-                                       &sctx, &cctx, cert, privkey))
-            || !TEST_true(SSL_CTX_set_quic_method(sctx, &quic_method))
-            || !TEST_true(SSL_CTX_set_quic_method(cctx, &quic_method))
-            || !TEST_true(create_ssl_objects(sctx, cctx, &serverssl,
-                                             &clientssl, NULL, NULL))
-            || !TEST_true(SSL_set_quic_transport_params(serverssl,
-                                                        (unsigned char*)server_str,
-                                                        strlen(server_str)+1))
-            || !TEST_true(SSL_set_quic_transport_params(clientssl,
-                                                        (unsigned char*)client_str,
-                                                        strlen(client_str)+1))
-            || !TEST_true(SSL_set_app_data(serverssl, clientssl))
-            || !TEST_true(SSL_set_app_data(clientssl, serverssl))
-            || !TEST_true(test_quic_api_set_versions(clientssl, clnt))
-            || !TEST_true(test_quic_api_set_versions(serverssl, srvr))
-            || !TEST_true(create_bare_ssl_connection(serverssl, clientssl,
-                                                     SSL_ERROR_NONE, 0))
-            || !TEST_true(SSL_version(serverssl) == TLS1_3_VERSION)
-            || !TEST_true(SSL_version(clientssl) == TLS1_3_VERSION)
-            || !(TEST_int_eq(SSL_quic_read_level(clientssl), ssl_encryption_application))
-            || !(TEST_int_eq(SSL_quic_read_level(serverssl), ssl_encryption_application))
-            || !(TEST_int_eq(SSL_quic_write_level(clientssl), ssl_encryption_application))
-            || !(TEST_int_eq(SSL_quic_write_level(serverssl), ssl_encryption_application)))
-        goto end;
-
-    SSL_get_peer_quic_transport_params(serverssl, &peer_str, &peer_str_len);
-    if (!TEST_mem_eq(peer_str, peer_str_len, client_str, strlen(client_str)+1))
-        goto end;
-    SSL_get_peer_quic_transport_params(clientssl, &peer_str, &peer_str_len);
-    if (!TEST_mem_eq(peer_str, peer_str_len, server_str, strlen(server_str)+1))
-        goto end;
-
-    /* Deal with two NewSessionTickets */
-    if (!TEST_true(SSL_process_quic_post_handshake(clientssl)))
-        goto end;
-
-    /* Dummy handshake call should succeed */
-    if (!TEST_true(SSL_do_handshake(clientssl)))
-        goto end;
-    /* Test that we (correctly) fail to send KeyUpdate */
-    if (!TEST_true(SSL_key_update(clientssl, SSL_KEY_UPDATE_NOT_REQUESTED))
-            || !TEST_int_le(SSL_do_handshake(clientssl), 0))
-        goto end;
-    if (!TEST_true(SSL_key_update(serverssl, SSL_KEY_UPDATE_NOT_REQUESTED))
-            || !TEST_int_le(SSL_do_handshake(serverssl), 0))
-        goto end;
-
-    TEST_info("original clnt=0x%X, srvr=0x%X\n", clnt, srvr);
-    if (srvr == 0 && clnt == 0)
-        srvr = clnt = TLSEXT_TYPE_quic_transport_parameters;
-    else if (srvr == 0)
-        srvr = clnt;
-    else if (clnt == 0)
-        clnt = srvr;
-    TEST_info("expected clnt=0x%X, srvr=0x%X\n", clnt, srvr);
-    if (!TEST_int_eq(SSL_get_peer_quic_transport_version(serverssl), clnt))
-        goto end;
-    if (!TEST_int_eq(SSL_get_peer_quic_transport_version(clientssl), srvr))
-        goto end;
-
-    testresult = 1;
-
- end:
-    SSL_free(serverssl);
-    SSL_free(clientssl);
-    SSL_CTX_free(sctx);
-    SSL_CTX_free(cctx);
-
-    return testresult;
-}
-
-static int test_quic_api(int tst)
-{
-    SSL_CTX *sctx = NULL;
-    SSL *serverssl = NULL;
-    int testresult = 0;
-    static int clnt_params[] = { 0,
-                                 TLSEXT_TYPE_quic_transport_parameters_draft,
-                                 TLSEXT_TYPE_quic_transport_parameters,
-                                 0,
-                                 TLSEXT_TYPE_quic_transport_parameters_draft,
-                                 TLSEXT_TYPE_quic_transport_parameters,
-                                 0,
-                                 TLSEXT_TYPE_quic_transport_parameters_draft,
-                                 TLSEXT_TYPE_quic_transport_parameters };
-    static int srvr_params[] = { 0,
-                                 0,
-                                 0,
-                                 TLSEXT_TYPE_quic_transport_parameters_draft,
-                                 TLSEXT_TYPE_quic_transport_parameters_draft,
-                                 TLSEXT_TYPE_quic_transport_parameters_draft,
-                                 TLSEXT_TYPE_quic_transport_parameters,
-                                 TLSEXT_TYPE_quic_transport_parameters,
-                                 TLSEXT_TYPE_quic_transport_parameters };
-    static int results[] = { 1, 1, 1, 1, 1, 0, 1, 0, 1 };
-
-    /* Failure cases:
-     * test 6/[5] clnt = parameters, srvr = draft
-     * test 8/[7] clnt = draft, srvr = parameters
-     */
-
-    /* Clean up logging space */
-    memset(client_log_buffer, 0, sizeof(client_log_buffer));
-    memset(server_log_buffer, 0, sizeof(server_log_buffer));
-    client_log_buffer_index = 0;
-    server_log_buffer_index = 0;
-    error_writing_log = 0;
-
-    if (!TEST_ptr(sctx = SSL_CTX_new_ex(libctx, NULL, TLS_server_method()))
-            || !TEST_true(SSL_CTX_set_quic_method(sctx, &quic_method))
-            || !TEST_ptr(sctx->quic_method)
-            || !TEST_ptr(serverssl = SSL_new(sctx))
-            || !TEST_true(SSL_IS_QUIC(serverssl))
-            || !TEST_true(SSL_set_quic_method(serverssl, NULL))
-            || !TEST_false(SSL_IS_QUIC(serverssl))
-            || !TEST_true(SSL_set_quic_method(serverssl, &quic_method))
-            || !TEST_true(SSL_IS_QUIC(serverssl)))
-        goto end;
-
-    if (!TEST_int_eq(test_quic_api_version(clnt_params[tst], srvr_params[tst]), results[tst]))
-        goto end;
-
-    testresult = 1;
-
-end:
-    SSL_CTX_free(sctx);
-    sctx = NULL;
-    SSL_free(serverssl);
-    serverssl = NULL;
-    return testresult;
-}
-
-# ifndef OSSL_NO_USABLE_TLS1_3
-/*
- * Helper method to setup objects for QUIC early data test. Caller
- * frees objects on error.
- */
-static int quic_setupearly_data_test(SSL_CTX **cctx, SSL_CTX **sctx,
-                                     SSL **clientssl, SSL **serverssl,
-                                     SSL_SESSION **sess, int idx)
-{
-    static const char *server_str = "SERVER";
-    static const char *client_str = "CLIENT";
-
-    if (*sctx == NULL
-            && (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
-                                               TLS_client_method(),
-                                               TLS1_3_VERSION, 0,
-                                               sctx, cctx, cert, privkey))
-                || !TEST_true(SSL_CTX_set_quic_method(*sctx, &quic_method))
-                || !TEST_true(SSL_CTX_set_quic_method(*cctx, &quic_method))
-                || !TEST_true(SSL_CTX_set_max_early_data(*sctx, 0xffffffffu))))
-        return 0;
-
-    if (idx == 1) {
-        /* When idx == 1 we repeat the tests with read_ahead set */
-        SSL_CTX_set_read_ahead(*cctx, 1);
-        SSL_CTX_set_read_ahead(*sctx, 1);
-    } else if (idx == 2) {
-        /* When idx == 2 we are doing early_data with a PSK. Set up callbacks */
-        SSL_CTX_set_psk_use_session_callback(*cctx, use_session_cb);
-        SSL_CTX_set_psk_find_session_callback(*sctx, find_session_cb);
-        use_session_cb_cnt = 0;
-        find_session_cb_cnt = 0;
-        srvid = pskid;
-    }
-
-    if (!TEST_true(create_ssl_objects(*sctx, *cctx, serverssl, clientssl,
-                                      NULL, NULL))
-            || !TEST_true(SSL_set_quic_transport_params(*serverssl,
-                                                        (unsigned char*)server_str,
-                                                        strlen(server_str)+1))
-            || !TEST_true(SSL_set_quic_transport_params(*clientssl,
-                                                        (unsigned char*)client_str,
-                                                        strlen(client_str)+1))
-            || !TEST_true(SSL_set_app_data(*serverssl, *clientssl))
-            || !TEST_true(SSL_set_app_data(*clientssl, *serverssl)))
-        return 0;
-
-    /*
-     * For one of the run throughs (doesn't matter which one), we'll try sending
-     * some SNI data in the initial ClientHello. This will be ignored (because
-     * there is no SNI cb set up by the server), so it should not impact
-     * early_data.
-     */
-    if (idx == 1
-            && !TEST_true(SSL_set_tlsext_host_name(*clientssl, "localhost")))
-        return 0;
-
-    if (idx == 2) {
-        clientpsk = create_a_psk(*clientssl, SHA256_DIGEST_LENGTH);
-        if (!TEST_ptr(clientpsk)
-                || !TEST_true(SSL_SESSION_set_max_early_data(clientpsk,
-                                                             0xffffffffu))
-                || !TEST_true(SSL_SESSION_up_ref(clientpsk))) {
-            SSL_SESSION_free(clientpsk);
-            clientpsk = NULL;
-            return 0;
-        }
-        serverpsk = clientpsk;
-
-        if (sess != NULL) {
-            if (!TEST_true(SSL_SESSION_up_ref(clientpsk))) {
-                SSL_SESSION_free(clientpsk);
-                SSL_SESSION_free(serverpsk);
-                clientpsk = serverpsk = NULL;
-                return 0;
-            }
-            *sess = clientpsk;
-        }
-
-        SSL_set_quic_early_data_enabled(*serverssl, 1);
-        SSL_set_quic_early_data_enabled(*clientssl, 1);
-
-        return 1;
-    }
-
-    if (sess == NULL)
-        return 1;
-
-    if (!TEST_true(create_bare_ssl_connection(*serverssl, *clientssl,
-                                              SSL_ERROR_NONE, 0)))
-        return 0;
-
-    /* Deal with two NewSessionTickets */
-    if (!TEST_true(SSL_process_quic_post_handshake(*clientssl)))
-        return 0;
-
-    *sess = SSL_get1_session(*clientssl);
-    SSL_shutdown(*clientssl);
-    SSL_shutdown(*serverssl);
-    SSL_free(*serverssl);
-    SSL_free(*clientssl);
-    *serverssl = *clientssl = NULL;
-
-    if (!TEST_true(create_ssl_objects(*sctx, *cctx, serverssl,
-                                      clientssl, NULL, NULL))
-            || !TEST_true(SSL_set_session(*clientssl, *sess))
-            || !TEST_true(SSL_set_quic_transport_params(*serverssl,
-                                                        (unsigned char*)server_str,
-                                                        strlen(server_str)+1))
-            || !TEST_true(SSL_set_quic_transport_params(*clientssl,
-                                                        (unsigned char*)client_str,
-                                                        strlen(client_str)+1))
-            || !TEST_true(SSL_set_app_data(*serverssl, *clientssl))
-            || !TEST_true(SSL_set_app_data(*clientssl, *serverssl)))
-        return 0;
-
-    SSL_set_quic_early_data_enabled(*serverssl, 1);
-    SSL_set_quic_early_data_enabled(*clientssl, 1);
-
-    return 1;
-}
-
-static int test_quic_early_data(int tst)
-{
-    SSL_CTX *cctx = NULL, *sctx = NULL;
-    SSL *clientssl = NULL, *serverssl = NULL;
-    int testresult = 0;
-    SSL_SESSION *sess = NULL;
-
-    if (!TEST_true(quic_setupearly_data_test(&cctx, &sctx, &clientssl,
-                                             &serverssl, &sess, tst)))
-        goto end;
-
-    if (!TEST_true(create_bare_ssl_connection(serverssl, clientssl, SSL_ERROR_NONE, 0))
-            || !TEST_true(SSL_get_early_data_status(serverssl)))
-        goto end;
-
-    testresult = 1;
-
- end:
-    SSL_SESSION_free(sess);
-    SSL_SESSION_free(clientpsk);
-    SSL_SESSION_free(serverpsk);
-    clientpsk = serverpsk = NULL;
-    SSL_free(serverssl);
-    SSL_free(clientssl);
-    SSL_CTX_free(sctx);
-    SSL_CTX_free(cctx);
-    return testresult;
-}
-# endif /* OSSL_NO_USABLE_TLS1_3 */
-#endif /* OPENSSL_NO_QUIC */
 
 static struct next_proto_st {
     int serverlen;
@@ -11276,6 +10918,7 @@ static int npn_advert_cb(SSL *ssl, const unsigned char **out,
         return SSL_TLSEXT_ERR_OK;
 
     case 1:
+        *out = NULL;
         *outlen = 0;
         return SSL_TLSEXT_ERR_OK;
 
@@ -11765,12 +11408,6 @@ int setup_tests(void)
     ADD_ALL_TESTS(test_npn, 5);
 #endif
     ADD_ALL_TESTS(test_alpn, 4);
-#ifndef OPENSSL_NO_QUIC
-    ADD_ALL_TESTS(test_quic_api, 9);
-# ifndef OSSL_NO_USABLE_TLS1_3
-    ADD_ALL_TESTS(test_quic_early_data, 3);
-# endif
-#endif
     return 1;
 
  err:
diff --git a/deps/openssl/openssl/test/testutil/tests.c b/deps/openssl/openssl/test/testutil/tests.c
index ef7e224cd11..05526870acd 100644
--- a/deps/openssl/openssl/test/testutil/tests.c
+++ b/deps/openssl/openssl/test/testutil/tests.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2017-2021 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2017-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -146,6 +146,7 @@ void test_perror(const char *s)
 
 void test_note(const char *fmt, ...)
 {
+    test_flush_stdout();
     if (fmt != NULL) {
         va_list ap;
 
diff --git a/deps/openssl/openssl/test/threadstest.c b/deps/openssl/openssl/test/threadstest.c
index 289565c14b5..046a9eb8023 100644
--- a/deps/openssl/openssl/test/threadstest.c
+++ b/deps/openssl/openssl/test/threadstest.c
@@ -358,7 +358,7 @@ static void thread_general_worker(void)
      * Therefore we use an insecure bit length where we can (512).
      * In the FIPS module though we must use a longer length.
      */
-    pkey = EVP_PKEY_Q_keygen(multi_libctx, NULL, "RSA", isfips ? 2048 : 512);
+    pkey = EVP_PKEY_Q_keygen(multi_libctx, NULL, "RSA", (size_t)(isfips ? 2048 : 512));
     if (!TEST_ptr(pkey))
         goto err;
 
diff --git a/deps/openssl/openssl/test/tls13secretstest.c b/deps/openssl/openssl/test/tls13secretstest.c
index 8323b237787..bf214d3d5ba 100644
--- a/deps/openssl/openssl/test/tls13secretstest.c
+++ b/deps/openssl/openssl/test/tls13secretstest.c
@@ -224,13 +224,6 @@ void ssl_evp_md_free(const EVP_MD *md)
 {
 }
 
-#ifndef OPENSSL_NO_QUIC
-int quic_set_encryption_secrets(SSL *ssl, OSSL_ENCRYPTION_LEVEL level)
-{
-    return 1;
-}
-#endif
-
 /* End of mocked out code */
 
 static int test_secret(SSL *s, unsigned char *prk,
diff --git a/deps/openssl/openssl/util/check-format-commit.sh b/deps/openssl/openssl/util/check-format-commit.sh
index 7e712dc48cf..206827dd866 100755
--- a/deps/openssl/openssl/util/check-format-commit.sh
+++ b/deps/openssl/openssl/util/check-format-commit.sh
@@ -6,24 +6,21 @@
 # You can obtain a copy in the file LICENSE in the source distribution
 # or at https://www.openssl.org/source/license.html
 #
-# This script is a wrapper around check-format.pl.  It accepts a commit sha
-# value as input, and uses it to identify the files and ranges that were
-# changed in that commit, filtering check-format.pl output only to lines that
-# fall into the commits change ranges.
-#
-
-
-# List of Regexes to use when running check-format.pl.
-# Style checks don't apply to any of these
-EXCLUDED_FILE_REGEX=("\.pod" \
-                     "\.pl"  \
-                     "\.pm"  \
-                     "\.t"   \
-                     "\.yml" \
-                     "\.sh")
-
-# Exit code for the script
-EXIT_CODE=0
+# This script is a wrapper around check-format.pl.
+# It accepts the same commit revision range as 'git diff' as arguments,
+# or just a single commit id, and uses it to identify the files and line ranges
+# that were changed in that commit range, filtering check-format.pl output
+# only to lines that fall into the change ranges of the changed files.
+# examples:
+# check-format-commit.sh       # check unstaged changes
+# check-format-commit.sh HEAD
+# check-format-commit.sh @~3..
+# check-format-commit.sh f5981c9629667a5a5d6
+# check-format-commit.sh f5981c9629667a5a5d6..ee0bf38e8709bf71888
+
+# Allowlist of files to scan
+# Currently this is any .c or .h file (with an optional .in suffix)
+FILE_NAME_END_ALLOWLIST=("\.[ch]\(.in\)\?")
 
 # Global vars
 
@@ -45,94 +42,107 @@ cleanup() {
 
 trap cleanup EXIT
 
-# Get the canonical sha256 sum for the commit we are checking
+# Get the list of ids of the commits we are checking,
+# or empty for unstaged changes.
 # This lets us pass in symbolic ref names like master/etc and 
-# resolve them to sha256 sums easily
-COMMIT=$(git rev-parse $1)
+# resolve them to commit ids easily
+COMMIT_RANGE="$@"
+[ -n $COMMIT_RANGE ] && COMMIT_LAST=$(git rev-parse $COMMIT_RANGE)
 
-# Fail gracefully if git rev-parse doesn't produce a valid
-# commit
+# Fail gracefully if git rev-parse doesn't produce a valid commit
 if [ $? -ne 0 ]
 then
-    echo "$1 is not a valid revision"
+    echo "$1 is not a valid commit range or commit id"
     exit 1
 fi
 
-# Create a iteratable list of files to check for a
-# given commit. It produces output of the format
-# <commit id> <file name> <change start line>, <change line count>
-touch $TEMPDIR/ranges.txt
-git show $COMMIT | awk -v mycmt=$COMMIT '
+# If the commit range is exactly one revision,
+# git rev-parse will output just the commit id of that one alone.
+# In that case, we must manipulate a little to get a desirable result,
+# as 'git diff' has a slightly different interpretation of a single commit id:
+# it takes that to mean all commits up to HEAD, plus any unstaged changes.
+if [ $(echo -n "$COMMIT_LAST" | wc -w) -ne 1 ]; then
+    COMMIT_LAST=$(echo "$COMMIT_LAST" | head -1)
+else
+    # $COMMIT_RANGE is just one commit, make it an actual range
+    COMMIT_RANGE=$COMMIT_RANGE^..$COMMIT_RANGE
+fi
+
+# Create an iterable list of files to check formatting on,
+# including the line ranges that are changed by the commits
+# It produces output of this format:
+# <file name> <change start line>, <change line count>
+git diff -U0 $COMMIT_RANGE | awk '
     BEGIN {myfile=""} 
-    /+{3}/ {
-        gsub(/b\//,"",$2);
-        myfile=$2
-    }
-    /@@/ {
-        gsub(/+/,"",$3);
-        printf mycmt " " myfile " " $3 "\n"
-    }' >> $TEMPDIR/ranges.txt || true
-
-# filter out anything that matches on a filter regex
-for i in ${EXCLUDED_FILE_REGEX[@]}
-do
-    touch $TEMPDIR/ranges.filter
-    grep -v "$i" $TEMPDIR/ranges.txt >> $TEMPDIR/ranges.filter || true
-    REMAINING_FILES=$(wc -l $TEMPDIR/ranges.filter | awk '{print $1}')
-    if [ $REMAINING_FILES -eq 0 ]
-    then
-        echo "This commit has no files that require checking"
-        exit 0
-    fi
-    mv $TEMPDIR/ranges.filter $TEMPDIR/ranges.txt
-done
+    /^\+\+\+/ { sub(/^b./,"",$2); file=$2 }
+    /^@@/     { sub(/^\+/,"",$3); range=$3; printf file " " range "\n" }
+    ' > $TEMPDIR/ranges.txt
 
-# check out the files from the commit level.
-# For each file name in ranges, we show that file at the commit
-# level we are checking, and redirect it to the same path, relative
-# to $TEMPDIR/check-format.  This give us the full file to run
-# check-format.pl on with line numbers matching the ranges in the
-# $TEMPDIR/ranges.txt file
-for j in $(grep $COMMIT $TEMPDIR/ranges.txt | awk '{print $2}')
+# filter in anything that matches on a filter regex
+for i in ${FILE_NAME_END_ALLOWLIST[@]}
 do
-    FDIR=$(dirname $j)
-    mkdir -p $TEMPDIR/check-format/$FDIR
-    git show $COMMIT:$j > $TEMPDIR/check-format/$j
+    # Note the space after the $i below.  This is done because we want
+    # to match on file name suffixes, but the input file is of the form
+    # <commit> <file path> <range start>, <range length>
+    # So we can't just match on end of line.  The additional space
+    # here lets us match on suffixes followed by the expected space
+    # in the input file
+    grep "$i " $TEMPDIR/ranges.txt >> $TEMPDIR/ranges.filter || true
 done
 
-# Now for each file in $TEMPDIR/check-format run check-format.pl
-# Note that we use the %P formatter in the find utilty.  This strips
-# off the $TEMPDIR/check-format path prefix, leaving $j with the
-# path to the file relative to the root of the source dir, so that 
-# output from check-format.pl looks correct, relative to the root
-# of the git tree.
-for j in $(find $TEMPDIR/check-format -type f -printf "%P\n")
+REMAINING_FILES=$(wc -l <$TEMPDIR/ranges.filter)
+if [ $REMAINING_FILES -eq 0 ]
+then
+    echo "The given commit range has no C source file changes that require checking"
+    exit 0
+fi
+
+# unless checking the format of unstaged changes,
+# check out the files from the commit range.
+if [ -n "$COMMIT_RANGE" ]
+then
+    # For each file name in ranges, we show that file at the commit range
+    # we are checking, and redirect it to the same path,
+    # relative to $TEMPDIR/check-format.
+    # This give us the full file path to run check-format.pl on
+    # with line numbers matching the ranges in the $TEMPDIR/ranges.filter file
+    for j in $(awk '{print $1}' $TEMPDIR/ranges.filter | sort -u)
+    do
+        FDIR=$(dirname $j)
+        mkdir -p $TEMPDIR/check-format/$FDIR
+        git show $COMMIT_LAST:$j > $TEMPDIR/check-format/$j
+    done
+fi
+
+# Now for each file in $TEMPDIR/ranges.filter, run check-format.pl
+for j in $(awk '{print $1}' $TEMPDIR/ranges.filter | sort -u)
 do
     range_start=()
     range_end=()
 
     # Get the ranges for this file. Create 2 arrays.  range_start contains
     # the start lines for valid ranges from the commit.  the range_end array
-    # contains the corresponding end line (note, since diff output gives us
+    # contains the corresponding end line.  Note, since diff output gives us
     # a line count for a change, the range_end[k] entry is actually
     # range_start[k]+line count
-    for k in $(grep $COMMIT $TEMPDIR/ranges.txt | grep $j | awk '{print $3}')
+    for k in $(grep ^$j $TEMPDIR/ranges.filter | awk '{print $2}')
     do
-        RANGE=$k
-        RSTART=$(echo $RANGE | awk -F',' '{print $1}')
-        RLEN=$(echo $RANGE | awk -F',' '{print $2}')
+        RSTART=$(echo $k | awk -F',' '{print $1}')
+        RLEN=$(echo $k | awk -F',' '{print $2}')
+        # when the hunk is just one line, its length is implied
+        if [ -z "$RLEN" ]; then RLEN=1; fi
         let REND=$RSTART+$RLEN
         range_start+=($RSTART)
         range_end+=($REND)
     done
 
-    # Go to our checked out tree
-    cd $TEMPDIR/check-format
+    # Go to our checked out tree, unless checking unstaged changes
+    [ -n "$COMMIT_RANGE" ] && cd $TEMPDIR/check-format
 
     # Actually run check-format.pl on the file, capturing the output
-    # in a temporary file.  Note the format of check-patch.pl output is
-    # <file name>:<line number>:<error text>:<offending line contents>
-    $TOPDIR/util/check-format.pl $j > $TEMPDIR/format-results.txt
+    # in a temporary file.  Note the format of check-format.pl output is
+    # <file path>:<line number>:<error text>:<offending line contents>
+    $TOPDIR/util/check-format.pl $j > $TEMPDIR/results.txt
 
     # Now we filter the check-format.pl output based on the changed lines
     # captured in the range_start/end arrays
@@ -146,26 +156,15 @@ do
         # Check here if any line in that output falls between any of the 
         # start/end ranges defined in the range_start/range_end array.
         # If it does fall in that range, print the entire line to stdout
-        # If anything is printed, have awk exit with a non-zero exit code
         awk -v rstart=$RSTART -v rend=$REND -F':' '
-                BEGIN {rc=0}
-                /:/ {
-                    if (($2 >= rstart) && ($2 <= rend)) {
-                        print $0;
-                        rc=1
-                    }
-                }
-                END {exit rc;}
-            ' $TEMPDIR/format-results.txt
-
-        # If awk exited with a non-zero code, this script will also exit
-        # with a non-zero code
-        if [ $? -ne 0 ]
-        then
-            EXIT_CODE=1
-        fi
+                /:/ { if (rstart <= $2 && $2 <= rend) print $0 }
+            ' $TEMPDIR/results.txt >>$TEMPDIR/results-filtered.txt
     done
 done
+cat $TEMPDIR/results-filtered.txt
 
-# Exit with the recorded exit code above
-exit $EXIT_CODE
+# If any findings were in range, exit with a different error code
+if [ -s $TEMPDIR/results-filtered.txt ]
+then
+    exit 2
+fi
diff --git a/deps/openssl/openssl/util/check-format.pl b/deps/openssl/openssl/util/check-format.pl
index ef2c1920e72..559b9023d08 100755
--- a/deps/openssl/openssl/util/check-format.pl
+++ b/deps/openssl/openssl/util/check-format.pl
@@ -791,7 +791,7 @@ sub check_nested_nonblock_indents {
         # treat remaining blinded comments and string literal contents as (single) space during matching below
         $intra_line =~ s/@+/ /g;                     # note that extra SPC has already been handled above
         $intra_line =~ s/\s+$//;                     # strip any (resulting) space at EOL
-        # replace ';;' or '; ;' by ';' in "for(;;)" and in "for (...)" unless "..." contains just SPC and ';' characters:
+        # replace ';;' or '; ;' by ';' in "for (;;)" and in "for (...)" unless "..." contains just SPC and ';' characters:
         $intra_line =~ s/((^|\W)for\s*\()([^;]*?)(\s*)(;\s?);(\s*)([^;]*)(\))/
           "$1$3$4".("$3$4$5$6$7" eq ";" || $3 ne "" || $7 ne "" ? "" : $5).";$6$7$8"/eg;
         # strip trailing ';' or '; ' in "for (...)" except in "for (;;)" or "for (;; )":
@@ -904,7 +904,7 @@ sub check_nested_nonblock_indents {
         # handle opening brace '{' after if/else/while/for/switch/do on line before
         if ($hanging_offset > 0 && m/^[\s@]*{/ && # leading opening '{'
             $line_before > 0 &&
-            $contents_before_ =~ m/(^|^.*\W)(if|else|while|for|switch|do)(\W.*$|$)/) {
+            $contents_before_ =~ m/(^|^.*\W)(if|else|while|for|(OSSL_)?LIST_FOREACH(_\w+)?|switch|do)(\W.*$|$)/) {
             $keyword_opening_brace = $1;
             $hanging_offset -= INDENT_LEVEL; # cancel newly hanging_offset
         }
@@ -966,7 +966,7 @@ sub check_nested_nonblock_indents {
 
     my $outermost_level = $block_indent - $preproc_offset == 0;
 
-    report("more than one stmt") if !m/(^|\W)for(\W.*|$)/ && # no 'for' - TODO improve matching
+    report("more than one stmt") if !m/(^|\W)(for|(OSSL_)?LIST_FOREACH(_\w+)?)(\W.*|$)/ && # no 'for' - TODO improve matching
         m/;.*;/; # two or more terminators ';', so more than one statement
 
     # check for code block containing a single line/statement
@@ -1004,7 +1004,7 @@ sub check_nested_nonblock_indents {
     my $assignment_start = 0;
     my $tmp = $_;
     $tmp =~ s/[\!<>=]=/@@/g; # blind (in-)equality symbols like '<=' as '@@' to prevent matching them as '=' below
-    if      (m/^((^|.*\W)(if|while|for|switch))(\W.*|$)$/) { # (last) if/for/while/switch
+    if      (m/^((^|.*\W)(if|while|for|(OSSL_)?LIST_FOREACH(_\w+)?|switch))(\W.*|$)$/) { # (last) if/for/while/switch
         $paren_expr_start = 1;
     } elsif (m/^((^|.*\W)(return|enum))(\W.*|$)/             # (last) return/enum
         && !$in_expr && @nested_indents == 0 && parens_balance($1) == 0) { # not nested enum
@@ -1135,7 +1135,7 @@ sub check_nested_nonblock_indents {
                     $line_body_start = $contents =~ m/LONG BODY/ ? 0 : $line if $line_function_start != 0;
                 }
             } else {
-                $line_opening_brace = $line if $keyword_opening_brace =~ m/if|do|while|for/;
+                $line_opening_brace = $line if $keyword_opening_brace =~ m/if|do|while|for|(OSSL_)?LIST_FOREACH(_\w+)?/;
                 # using, not assigning, $keyword_opening_brace here because it could be on an earlier line
                 $line_opening_brace = $line if $keyword_opening_brace eq "else" && $extended_1_stmt &&
                 # TODO prevent false positives for if/else where braces around single-statement branches
@@ -1148,11 +1148,11 @@ sub check_nested_nonblock_indents {
         }
     }
 
-    # check for opening brace after if/while/for/switch/do not on same line
+    # check for opening brace after if/while/for/switch/do missing on same line
     # note that "missing '{' on same line after '} else'" is handled further below
     if (/^[\s@]*{/ && # leading '{'
         $line_before > 0 && !($contents_before_ =~ m/^\s*#/) && # not preprocessor directive '#if
-        (my ($head, $mid, $tail) = ($contents_before_ =~ m/(^|^.*\W)(if|while|for|switch|do)(\W.*$|$)/))) {
+        (my ($head, $mid, $tail) = ($contents_before_ =~ m/(^|^.*\W)(if|while|for|(OSSL_)?LIST_FOREACH(_\w+)?|switch|do)(\W.*$|$)/))) {
         my $brace_after  = $tail =~ /^[\s@]*{/; # any whitespace or comments then '{'
         report("'{' not on same line as preceding '$mid'") if !$brace_after;
     }
diff --git a/deps/openssl/openssl/util/libssl.num b/deps/openssl/openssl/util/libssl.num
index 4a9d5b20074..f055c967bf1 100644
--- a/deps/openssl/openssl/util/libssl.num
+++ b/deps/openssl/openssl/util/libssl.num
@@ -520,19 +520,3 @@ SSL_load_client_CA_file_ex              520	3_0_0	EXIST::FUNCTION:
 SSL_set0_tmp_dh_pkey                    521	3_0_0	EXIST::FUNCTION:
 SSL_CTX_set0_tmp_dh_pkey                522	3_0_0	EXIST::FUNCTION:
 SSL_group_to_name                       523	3_0_0	EXIST::FUNCTION:
-SSL_quic_read_level                     20000	3_0_0	EXIST::FUNCTION:QUIC
-SSL_set_quic_transport_params           20001	3_0_0	EXIST::FUNCTION:QUIC
-SSL_CIPHER_get_prf_nid                  20002	3_0_0	EXIST::FUNCTION:QUIC
-SSL_is_quic                             20003	3_0_0	EXIST::FUNCTION:QUIC
-SSL_get_peer_quic_transport_params      20004	3_0_0	EXIST::FUNCTION:QUIC
-SSL_quic_write_level                    20005	3_0_0	EXIST::FUNCTION:QUIC
-SSL_CTX_set_quic_method                 20006	3_0_0	EXIST::FUNCTION:QUIC
-SSL_set_quic_method                     20007	3_0_0	EXIST::FUNCTION:QUIC
-SSL_quic_max_handshake_flight_len       20008	3_0_0	EXIST::FUNCTION:QUIC
-SSL_process_quic_post_handshake         20009	3_0_0	EXIST::FUNCTION:QUIC
-SSL_provide_quic_data                   20010	3_0_0	EXIST::FUNCTION:QUIC
-SSL_set_quic_use_legacy_codepoint       20011	3_0_0	EXIST::FUNCTION:QUIC
-SSL_set_quic_transport_version          20012	3_0_0	EXIST::FUNCTION:QUIC
-SSL_get_peer_quic_transport_version     20013	3_0_0	EXIST::FUNCTION:QUIC
-SSL_get_quic_transport_version          20014	3_0_0	EXIST::FUNCTION:QUIC
-SSL_set_quic_early_data_enabled         20015	3_0_0	EXIST::FUNCTION:QUIC
diff --git a/deps/openssl/openssl/util/mkbuildinf.pl b/deps/openssl/openssl/util/mkbuildinf.pl
index 1c273872be1..799ed3cdcd0 100755
--- a/deps/openssl/openssl/util/mkbuildinf.pl
+++ b/deps/openssl/openssl/util/mkbuildinf.pl
@@ -1,5 +1,5 @@
 #! /usr/bin/env perl
-# Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+# Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
 #
 # Licensed under the Apache License 2.0 (the "License").  You may not use
 # this file except in compliance with the License.  You can obtain a copy
@@ -9,17 +9,21 @@
 use strict;
 use warnings;
 
-my ($cflags, $platform) = @ARGV;
+my $platform = pop @ARGV;
+my $cflags = join(' ', @ARGV);
+$cflags =~ s(\\)(\\\\)g;
 $cflags = "compiler: $cflags";
 
-my $date = gmtime($ENV{'SOURCE_DATE_EPOCH'} || time()) . " UTC";
+# Use the value of the envvar SOURCE_DATE_EPOCH, even if it's
+# zero or the empty string.
+my $date = gmtime($ENV{'SOURCE_DATE_EPOCH'} // time()) . " UTC";
 
 print <<"END_OUTPUT";
 /*
  * WARNING: do not edit!
  * Generated by util/mkbuildinf.pl
  *
- * Copyright 2014-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2014-2025 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the Apache License 2.0 (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
diff --git a/deps/openssl/openssl/util/other.syms b/deps/openssl/openssl/util/other.syms
index 839d0d2c08c..ea0a8caac43 100644
--- a/deps/openssl/openssl/util/other.syms
+++ b/deps/openssl/openssl/util/other.syms
@@ -143,8 +143,6 @@ custom_ext_free_cb                      datatype
 custom_ext_parse_cb                     datatype
 pem_password_cb                         datatype
 ssl_ct_validation_cb                    datatype
-OSSL_ENCRYPTION_LEVEL                   datatype
-SSL_QUIC_METHOD                         datatype
 #
 ASN1_BIT_STRING_digest                  define
 BIO_append_filename                     define
diff --git a/deps/openssl/openssl/util/perl/OpenSSL/Template.pm b/deps/openssl/openssl/util/perl/OpenSSL/Template.pm
index 7411dd8ae8d..ad93278ca76 100644
--- a/deps/openssl/openssl/util/perl/OpenSSL/Template.pm
+++ b/deps/openssl/openssl/util/perl/OpenSSL/Template.pm
@@ -42,6 +42,14 @@ use Text::Template 1.46;
 
 our @ISA = qw(Text::Template);  # parent
 
+sub tmpl_error {
+    my (%err_dict) = @_;
+
+    $ERROR = $err_dict{"error"};
+
+    return undef;
+}
+
 sub new {
     my $class = shift;
 
@@ -66,6 +74,7 @@ sub fill_in {
                                     output_on => sub { $self->output_on() },
                                     output_off => sub { $self->output_off() },
                                     %hash },
+                          BROKEN => \&tmpl_error,
                           %opts);
 }
 
diff --git a/deps/opentelemetry-cpp/MODULE.bazel b/deps/opentelemetry-cpp/MODULE.bazel
index f0597b59e0a..d147305b137 100644
--- a/deps/opentelemetry-cpp/MODULE.bazel
+++ b/deps/opentelemetry-cpp/MODULE.bazel
@@ -3,23 +3,23 @@
 
 module(
     name = "opentelemetry-cpp",
-    version = "1.22.0",
+    version = "1.23.0",
     compatibility_level = 0,
     repo_name = "io_opentelemetry_cpp",
 )
 
 bazel_dep(name = "abseil-cpp", version = "20240116.1", repo_name = "com_google_absl")
-bazel_dep(name = "bazel_skylib", version = "1.5.0")
+bazel_dep(name = "bazel_skylib", version = "1.7.1")
 bazel_dep(name = "curl", version = "8.8.0")
-bazel_dep(name = "grpc", version = "1.63.1.bcr.1", repo_name = "com_github_grpc_grpc")
+bazel_dep(name = "grpc", version = "1.66.0.bcr.2", repo_name = "com_github_grpc_grpc")
 bazel_dep(name = "nlohmann_json", version = "3.12.0", repo_name = "github_nlohmann_json")
 bazel_dep(name = "opentelemetry-proto", version = "1.7.0", repo_name = "com_github_opentelemetry_proto")
 bazel_dep(name = "opentracing-cpp", version = "1.6.0", repo_name = "com_github_opentracing")
-bazel_dep(name = "platforms", version = "0.0.8")
+bazel_dep(name = "platforms", version = "0.0.11")
 bazel_dep(name = "prometheus-cpp", version = "1.3.0", repo_name = "com_github_jupp0r_prometheus_cpp")
-bazel_dep(name = "protobuf", version = "26.0", repo_name = "com_google_protobuf")
-bazel_dep(name = "rules_proto", version = "5.3.0-21.7")
-bazel_dep(name = "zlib", version = "1.3.1.bcr.1")
+bazel_dep(name = "protobuf", version = "29.0", repo_name = "com_google_protobuf")
+bazel_dep(name = "rules_proto", version = "7.0.2")
+bazel_dep(name = "zlib", version = "1.3.1.bcr.5")
 
-bazel_dep(name = "google_benchmark", version = "1.8.3", dev_dependency = True, repo_name = "com_github_google_benchmark")
+bazel_dep(name = "google_benchmark", version = "1.8.4", dev_dependency = True, repo_name = "com_github_google_benchmark")
 bazel_dep(name = "googletest", version = "1.14.0.bcr.1", dev_dependency = True, repo_name = "com_google_googletest")
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/common/string_util.h b/deps/opentelemetry-cpp/api/include/opentelemetry/common/string_util.h
index 273a65272ba..5108f186e72 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/common/string_util.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/common/string_util.h
@@ -3,6 +3,8 @@
 
 #pragma once
 
+#include <ctype.h>
+
 #include "opentelemetry/nostd/string_view.h"
 #include "opentelemetry/version.h"
 
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/logs/noop.h b/deps/opentelemetry-cpp/api/include/opentelemetry/logs/noop.h
index 24312f061c5..5e7654ae750 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/logs/noop.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/logs/noop.h
@@ -112,9 +112,28 @@ class NoopEventLogger final : public EventLogger
 class NoopEventLoggerProvider final : public EventLoggerProvider
 {
 public:
+#  if defined(_MSC_VER)
+#    pragma warning(push)
+#    pragma warning(disable : 4996)
+#  elif defined(__GNUC__) && !defined(__clang__) && !defined(__apple_build_version__)
+#    pragma GCC diagnostic push
+#    pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#  elif defined(__clang__) || defined(__apple_build_version__)
+#    pragma clang diagnostic push
+#    pragma clang diagnostic ignored "-Wdeprecated-declarations"
+#  endif
+
   NoopEventLoggerProvider() : event_logger_{nostd::shared_ptr<EventLogger>(new NoopEventLogger())}
   {}
 
+#  if defined(_MSC_VER)
+#    pragma warning(pop)
+#  elif defined(__GNUC__) && !defined(__clang__) && !defined(__apple_build_version__)
+#    pragma GCC diagnostic pop
+#  elif defined(__clang__) || defined(__apple_build_version__)
+#    pragma clang diagnostic pop
+#  endif
+
   nostd::shared_ptr<EventLogger> CreateEventLogger(
       nostd::shared_ptr<Logger> /*delegate_logger*/,
       nostd::string_view /*event_domain*/) noexcept override
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/logs/provider.h b/deps/opentelemetry-cpp/api/include/opentelemetry/logs/provider.h
index 0c1b4deea8a..58f668e0419 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/logs/provider.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/logs/provider.h
@@ -84,8 +84,27 @@ class OPENTELEMETRY_EXPORT Provider
   OPENTELEMETRY_API_SINGLETON static nostd::shared_ptr<EventLoggerProvider> &
   GetEventProvider() noexcept
   {
+#  if defined(_MSC_VER)
+#    pragma warning(push)
+#    pragma warning(disable : 4996)
+#  elif defined(__GNUC__) && !defined(__clang__) && !defined(__apple_build_version__)
+#    pragma GCC diagnostic push
+#    pragma GCC diagnostic ignored "-Wdeprecated-declarations"
+#  elif defined(__clang__) || defined(__apple_build_version__)
+#    pragma clang diagnostic push
+#    pragma clang diagnostic ignored "-Wdeprecated-declarations"
+#  endif
+
     static nostd::shared_ptr<EventLoggerProvider> provider(new NoopEventLoggerProvider);
     return provider;
+
+#  if defined(_MSC_VER)
+#    pragma warning(pop)
+#  elif defined(__GNUC__) && !defined(__clang__) && !defined(__apple_build_version__)
+#    pragma GCC diagnostic pop
+#  elif defined(__clang__) || defined(__apple_build_version__)
+#    pragma clang diagnostic pop
+#  endif
   }
 #endif
 
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/app_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/app_attributes.h
index fdbad251b1f..b8477ee3bba 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/app_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/app_attributes.h
@@ -19,6 +19,11 @@ namespace semconv
 namespace app
 {
 
+/**
+  Unique identifier for a particular build or compilation of the application.
+ */
+static constexpr const char *kAppBuildId = "app.build_id";
+
 /**
   A unique identifier representing the installation of an application on a specific device
   <p>
@@ -42,11 +47,29 @@ namespace app
   Settings.getString(Settings.Secure.ANDROID_ID) @endcode</a>.</li>
   </ul>
   <p>
-  More information about Android identifier best practices can be found <a
-  href="https://developer.android.com/training/articles/user-data-ids">here</a>.
+  More information about Android identifier best practices can be found in the <a
+  href="https://developer.android.com/training/articles/user-data-ids">Android user data IDs
+  guide</a>.
  */
 static constexpr const char *kAppInstallationId = "app.installation.id";
 
+/**
+  A number of frame renders that experienced jank.
+  <p>
+  Depending on platform limitations, the value provided MAY be approximation.
+ */
+static constexpr const char *kAppJankFrameCount = "app.jank.frame_count";
+
+/**
+  The time period, in seconds, for which this jank is being reported.
+ */
+static constexpr const char *kAppJankPeriod = "app.jank.period";
+
+/**
+  The minimum rendering threshold for this jank, in seconds.
+ */
+static constexpr const char *kAppJankThreshold = "app.jank.threshold";
+
 /**
   The x (horizontal) coordinate of a screen coordinate, in screen pixels.
  */
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/aws_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/aws_attributes.h
index 2abf1b762d4..d5922558029 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/aws_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/aws_attributes.h
@@ -409,12 +409,12 @@ static constexpr const char *kAwsStepFunctionsStateMachineArn =
 namespace AwsEcsLaunchtypeValues
 {
 /**
-  none
+  Amazon EC2
  */
 static constexpr const char *kEc2 = "ec2";
 
 /**
-  none
+  Amazon Fargate
  */
 static constexpr const char *kFargate = "fargate";
 
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/azure_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/azure_attributes.h
index 0c62bad288f..1618050f9d9 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/azure_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/azure_attributes.h
@@ -92,27 +92,27 @@ static constexpr const char *kDirect = "direct";
 namespace AzureCosmosdbConsistencyLevelValues
 {
 /**
-  none
+  Strong
  */
 static constexpr const char *kStrong = "Strong";
 
 /**
-  none
+  Bounded Staleness
  */
 static constexpr const char *kBoundedStaleness = "BoundedStaleness";
 
 /**
-  none
+  Session
  */
 static constexpr const char *kSession = "Session";
 
 /**
-  none
+  Eventual
  */
 static constexpr const char *kEventual = "Eventual";
 
 /**
-  none
+  Consistent Prefix
  */
 static constexpr const char *kConsistentPrefix = "ConsistentPrefix";
 
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/azure_metrics.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/azure_metrics.h
index fb60c3ce530..98f265f5e16 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/azure_metrics.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/azure_metrics.h
@@ -21,14 +21,14 @@ namespace azure
 {
 
 /**
-  Number of active client instances
+  Number of active client instances.
   <p>
   updowncounter
  */
 static constexpr const char *kMetricAzureCosmosdbClientActiveInstanceCount =
     "azure.cosmosdb.client.active_instance.count";
 static constexpr const char *descrMetricAzureCosmosdbClientActiveInstanceCount =
-    "Number of active client instances";
+    "Number of active client instances.";
 static constexpr const char *unitMetricAzureCosmosdbClientActiveInstanceCount = "{instance}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -67,13 +67,13 @@ CreateAsyncDoubleMetricAzureCosmosdbClientActiveInstanceCount(metrics::Meter *me
 
 /**
   <a href="https://learn.microsoft.com/azure/cosmos-db/request-units">Request units</a> consumed by
-  the operation <p> histogram
+  the operation. <p> histogram
  */
 static constexpr const char *kMetricAzureCosmosdbClientOperationRequestCharge =
     "azure.cosmosdb.client.operation.request_charge";
 static constexpr const char *descrMetricAzureCosmosdbClientOperationRequestCharge =
     "[Request units](https://learn.microsoft.com/azure/cosmos-db/request-units) consumed by the "
-    "operation";
+    "operation.";
 static constexpr const char *unitMetricAzureCosmosdbClientOperationRequestCharge = "{request_unit}";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>>
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/cassandra_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/cassandra_attributes.h
index 88a71ba5ddb..c8db7380899 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/cassandra_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/cassandra_attributes.h
@@ -55,57 +55,57 @@ static constexpr const char *kCassandraSpeculativeExecutionCount =
 namespace CassandraConsistencyLevelValues
 {
 /**
-  none
+  All
  */
 static constexpr const char *kAll = "all";
 
 /**
-  none
+  Each Quorum
  */
 static constexpr const char *kEachQuorum = "each_quorum";
 
 /**
-  none
+  Quorum
  */
 static constexpr const char *kQuorum = "quorum";
 
 /**
-  none
+  Local Quorum
  */
 static constexpr const char *kLocalQuorum = "local_quorum";
 
 /**
-  none
+  One
  */
 static constexpr const char *kOne = "one";
 
 /**
-  none
+  Two
  */
 static constexpr const char *kTwo = "two";
 
 /**
-  none
+  Three
  */
 static constexpr const char *kThree = "three";
 
 /**
-  none
+  Local One
  */
 static constexpr const char *kLocalOne = "local_one";
 
 /**
-  none
+  Any
  */
 static constexpr const char *kAny = "any";
 
 /**
-  none
+  Serial
  */
 static constexpr const char *kSerial = "serial";
 
 /**
-  none
+  Local Serial
  */
 static constexpr const char *kLocalSerial = "local_serial";
 
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/container_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/container_attributes.h
index 92213a1e6b7..e0678618e28 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/container_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/container_attributes.h
@@ -130,8 +130,28 @@ static constexpr const char *kContainerName = "container.name";
 
 /**
   The container runtime managing this container.
+
+  @deprecated
+  {"note": "Replaced by @code container.runtime.name @endcode.", "reason": "renamed", "renamed_to":
+  "container.runtime.name"}
+ */
+OPENTELEMETRY_DEPRECATED static constexpr const char *kContainerRuntime = "container.runtime";
+
+/**
+  A description about the runtime which could include, for example details about the CRI/API version
+  being used or other customisations.
+ */
+static constexpr const char *kContainerRuntimeDescription = "container.runtime.description";
+
+/**
+  The container runtime managing this container.
+ */
+static constexpr const char *kContainerRuntimeName = "container.runtime.name";
+
+/**
+  The version of the runtime of this process, as returned by the runtime without modification.
  */
-static constexpr const char *kContainerRuntime = "container.runtime";
+static constexpr const char *kContainerRuntimeVersion = "container.runtime.version";
 
 namespace ContainerCpuStateValues
 {
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/container_metrics.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/container_metrics.h
index 69853e77718..1b867442243 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/container_metrics.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/container_metrics.h
@@ -21,14 +21,14 @@ namespace container
 {
 
 /**
-  Total CPU time consumed
+  Total CPU time consumed.
   <p>
   Total CPU time consumed by the specific container on all available CPU cores
   <p>
   counter
  */
 static constexpr const char *kMetricContainerCpuTime     = "container.cpu.time";
-static constexpr const char *descrMetricContainerCpuTime = "Total CPU time consumed";
+static constexpr const char *descrMetricContainerCpuTime = "Total CPU time consumed.";
 static constexpr const char *unitMetricContainerCpuTime  = "s";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricContainerCpuTime(
@@ -60,7 +60,7 @@ CreateAsyncDoubleMetricContainerCpuTime(metrics::Meter *meter)
 }
 
 /**
-  Container's CPU usage, measured in cpus. Range from 0 to the number of allocatable CPUs
+  Container's CPU usage, measured in cpus. Range from 0 to the number of allocatable CPUs.
   <p>
   CPU usage of the specific container on all available CPU cores, averaged over the sample window
   <p>
@@ -68,7 +68,7 @@ CreateAsyncDoubleMetricContainerCpuTime(metrics::Meter *meter)
  */
 static constexpr const char *kMetricContainerCpuUsage = "container.cpu.usage";
 static constexpr const char *descrMetricContainerCpuUsage =
-    "Container's CPU usage, measured in cpus. Range from 0 to the number of allocatable CPUs";
+    "Container's CPU usage, measured in cpus. Range from 0 to the number of allocatable CPUs.";
 static constexpr const char *unitMetricContainerCpuUsage = "{cpu}";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
@@ -141,6 +141,154 @@ CreateAsyncDoubleMetricContainerDiskIo(metrics::Meter *meter)
                                               unitMetricContainerDiskIo);
 }
 
+/**
+  Container filesystem available bytes.
+  <p>
+  In K8s, this metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#FsStats">FsStats.AvailableBytes</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#ContainerStats">ContainerStats.Rootfs</a>
+  of the Kubelet's stats API.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricContainerFilesystemAvailable = "container.filesystem.available";
+static constexpr const char *descrMetricContainerFilesystemAvailable =
+    "Container filesystem available bytes.";
+static constexpr const char *unitMetricContainerFilesystemAvailable = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricContainerFilesystemAvailable(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricContainerFilesystemAvailable,
+                                         descrMetricContainerFilesystemAvailable,
+                                         unitMetricContainerFilesystemAvailable);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricContainerFilesystemAvailable(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricContainerFilesystemAvailable,
+                                          descrMetricContainerFilesystemAvailable,
+                                          unitMetricContainerFilesystemAvailable);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricContainerFilesystemAvailable(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricContainerFilesystemAvailable,
+                                                   descrMetricContainerFilesystemAvailable,
+                                                   unitMetricContainerFilesystemAvailable);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricContainerFilesystemAvailable(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricContainerFilesystemAvailable,
+                                                    descrMetricContainerFilesystemAvailable,
+                                                    unitMetricContainerFilesystemAvailable);
+}
+
+/**
+  Container filesystem capacity.
+  <p>
+  In K8s, this metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#FsStats">FsStats.CapacityBytes</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#ContainerStats">ContainerStats.Rootfs</a>
+  of the Kubelet's stats API.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricContainerFilesystemCapacity = "container.filesystem.capacity";
+static constexpr const char *descrMetricContainerFilesystemCapacity =
+    "Container filesystem capacity.";
+static constexpr const char *unitMetricContainerFilesystemCapacity = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricContainerFilesystemCapacity(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricContainerFilesystemCapacity,
+                                         descrMetricContainerFilesystemCapacity,
+                                         unitMetricContainerFilesystemCapacity);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricContainerFilesystemCapacity(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricContainerFilesystemCapacity,
+                                          descrMetricContainerFilesystemCapacity,
+                                          unitMetricContainerFilesystemCapacity);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricContainerFilesystemCapacity(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricContainerFilesystemCapacity,
+                                                   descrMetricContainerFilesystemCapacity,
+                                                   unitMetricContainerFilesystemCapacity);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricContainerFilesystemCapacity(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricContainerFilesystemCapacity,
+                                                    descrMetricContainerFilesystemCapacity,
+                                                    unitMetricContainerFilesystemCapacity);
+}
+
+/**
+  Container filesystem usage.
+  <p>
+  This may not equal capacity - available.
+  <p>
+  In K8s, this metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#FsStats">FsStats.UsedBytes</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#ContainerStats">ContainerStats.Rootfs</a>
+  of the Kubelet's stats API.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricContainerFilesystemUsage     = "container.filesystem.usage";
+static constexpr const char *descrMetricContainerFilesystemUsage = "Container filesystem usage.";
+static constexpr const char *unitMetricContainerFilesystemUsage  = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricContainerFilesystemUsage(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricContainerFilesystemUsage,
+                                         descrMetricContainerFilesystemUsage,
+                                         unitMetricContainerFilesystemUsage);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricContainerFilesystemUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricContainerFilesystemUsage,
+                                          descrMetricContainerFilesystemUsage,
+                                          unitMetricContainerFilesystemUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricContainerFilesystemUsage(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricContainerFilesystemUsage,
+                                                   descrMetricContainerFilesystemUsage,
+                                                   unitMetricContainerFilesystemUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricContainerFilesystemUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricContainerFilesystemUsage,
+                                                    descrMetricContainerFilesystemUsage,
+                                                    unitMetricContainerFilesystemUsage);
+}
+
 /**
   Memory usage of the container.
   <p>
@@ -220,15 +368,16 @@ CreateAsyncDoubleMetricContainerNetworkIo(metrics::Meter *meter)
 }
 
 /**
-  The time the container has been running
+  The time the container has been running.
   <p>
   Instrumentations SHOULD use a gauge with type @code double @endcode and measure uptime in seconds
   as a floating point number with the highest precision available. The actual accuracy would depend
   on the instrumentation and operating system. <p> gauge
  */
-static constexpr const char *kMetricContainerUptime     = "container.uptime";
-static constexpr const char *descrMetricContainerUptime = "The time the container has been running";
-static constexpr const char *unitMetricContainerUptime  = "s";
+static constexpr const char *kMetricContainerUptime = "container.uptime";
+static constexpr const char *descrMetricContainerUptime =
+    "The time the container has been running.";
+static constexpr const char *unitMetricContainerUptime = "s";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
 
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/cpu_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/cpu_attributes.h
index c3c3ef58a56..f3b24e6950d 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/cpu_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/cpu_attributes.h
@@ -32,42 +32,42 @@ static constexpr const char *kCpuMode = "cpu.mode";
 namespace CpuModeValues
 {
 /**
-  none
+  User
  */
 static constexpr const char *kUser = "user";
 
 /**
-  none
+  System
  */
 static constexpr const char *kSystem = "system";
 
 /**
-  none
+  Nice
  */
 static constexpr const char *kNice = "nice";
 
 /**
-  none
+  Idle
  */
 static constexpr const char *kIdle = "idle";
 
 /**
-  none
+  IO Wait
  */
 static constexpr const char *kIowait = "iowait";
 
 /**
-  none
+  Interrupt
  */
 static constexpr const char *kInterrupt = "interrupt";
 
 /**
-  none
+  Steal
  */
 static constexpr const char *kSteal = "steal";
 
 /**
-  none
+  Kernel
  */
 static constexpr const char *kKernel = "kernel";
 
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/db_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/db_attributes.h
index c0c44276bc9..31b8f2b74e3 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/db_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/db_attributes.h
@@ -517,87 +517,45 @@ OPENTELEMETRY_DEPRECATED static constexpr const char *kDbUser = "db.user";
 
 namespace DbCassandraConsistencyLevelValues
 {
-/**
-  none
- */
+
 static constexpr const char *kAll = "all";
 
-/**
-  none
- */
 static constexpr const char *kEachQuorum = "each_quorum";
 
-/**
-  none
- */
 static constexpr const char *kQuorum = "quorum";
 
-/**
-  none
- */
 static constexpr const char *kLocalQuorum = "local_quorum";
 
-/**
-  none
- */
 static constexpr const char *kOne = "one";
 
-/**
-  none
- */
 static constexpr const char *kTwo = "two";
 
-/**
-  none
- */
 static constexpr const char *kThree = "three";
 
-/**
-  none
- */
 static constexpr const char *kLocalOne = "local_one";
 
-/**
-  none
- */
 static constexpr const char *kAny = "any";
 
-/**
-  none
- */
 static constexpr const char *kSerial = "serial";
 
-/**
-  none
- */
 static constexpr const char *kLocalSerial = "local_serial";
 
 }  // namespace DbCassandraConsistencyLevelValues
 
 namespace DbClientConnectionStateValues
 {
-/**
-  none
- */
+
 static constexpr const char *kIdle = "idle";
 
-/**
-  none
- */
 static constexpr const char *kUsed = "used";
 
 }  // namespace DbClientConnectionStateValues
 
 namespace DbClientConnectionsStateValues
 {
-/**
-  none
- */
+
 static constexpr const char *kIdle = "idle";
 
-/**
-  none
- */
 static constexpr const char *kUsed = "used";
 
 }  // namespace DbClientConnectionsStateValues
@@ -618,108 +576,50 @@ static constexpr const char *kDirect = "direct";
 
 namespace DbCosmosdbConsistencyLevelValues
 {
-/**
-  none
- */
+
 static constexpr const char *kStrong = "Strong";
 
-/**
-  none
- */
 static constexpr const char *kBoundedStaleness = "BoundedStaleness";
 
-/**
-  none
- */
 static constexpr const char *kSession = "Session";
 
-/**
-  none
- */
 static constexpr const char *kEventual = "Eventual";
 
-/**
-  none
- */
 static constexpr const char *kConsistentPrefix = "ConsistentPrefix";
 
 }  // namespace DbCosmosdbConsistencyLevelValues
 
 namespace DbCosmosdbOperationTypeValues
 {
-/**
-  none
- */
+
 static constexpr const char *kBatch = "batch";
 
-/**
-  none
- */
 static constexpr const char *kCreate = "create";
 
-/**
-  none
- */
 static constexpr const char *kDelete = "delete";
 
-/**
-  none
- */
 static constexpr const char *kExecute = "execute";
 
-/**
-  none
- */
 static constexpr const char *kExecuteJavascript = "execute_javascript";
 
-/**
-  none
- */
 static constexpr const char *kInvalid = "invalid";
 
-/**
-  none
- */
 static constexpr const char *kHead = "head";
 
-/**
-  none
- */
 static constexpr const char *kHeadFeed = "head_feed";
 
-/**
-  none
- */
 static constexpr const char *kPatch = "patch";
 
-/**
-  none
- */
 static constexpr const char *kQuery = "query";
 
-/**
-  none
- */
 static constexpr const char *kQueryPlan = "query_plan";
 
-/**
-  none
- */
 static constexpr const char *kRead = "read";
 
-/**
-  none
- */
 static constexpr const char *kReadFeed = "read_feed";
 
-/**
-  none
- */
 static constexpr const char *kReplace = "replace";
 
-/**
-  none
- */
 static constexpr const char *kUpsert = "upsert";
 
 }  // namespace DbCosmosdbOperationTypeValues
@@ -738,8 +638,12 @@ static constexpr const char *kAdabas = "adabas";
 
 /**
   Deprecated, use @code intersystems_cache @endcode instead.
+
+  @deprecated
+  {"note": "Replaced by @code intersystems_cache @endcode.", "reason": "renamed", "renamed_to":
+  "intersystems_cache"}
  */
-static constexpr const char *kCache = "cache";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kCache = "cache";
 
 /**
   InterSystems Caché
@@ -758,8 +662,11 @@ static constexpr const char *kClickhouse = "clickhouse";
 
 /**
   Deprecated, use @code other_sql @endcode instead.
+
+  @deprecated
+  {"note": "Replaced by @code other_sql @endcode.", "reason": "renamed", "renamed_to": "other_sql"}
  */
-static constexpr const char *kCloudscape = "cloudscape";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kCloudscape = "cloudscape";
 
 /**
   CockroachDB
@@ -768,8 +675,11 @@ static constexpr const char *kCockroachdb = "cockroachdb";
 
 /**
   Deprecated, no replacement at this time.
+
+  @deprecated
+  {"note": "Obsoleted.", "reason": "obsoleted"}
  */
-static constexpr const char *kColdfusion = "coldfusion";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kColdfusion = "coldfusion";
 
 /**
   Microsoft Azure Cosmos DB
@@ -823,8 +733,11 @@ static constexpr const char *kFirebird = "firebird";
 
 /**
   Deprecated, use @code other_sql @endcode instead.
+
+  @deprecated
+  {"note": "Replaced by @code other_sql @endcode.", "reason": "renamed", "renamed_to": "other_sql"}
  */
-static constexpr const char *kFirstsql = "firstsql";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kFirstsql = "firstsql";
 
 /**
   Apache Geode
@@ -908,8 +821,11 @@ static constexpr const char *kMssql = "mssql";
 
 /**
   Deprecated, Microsoft SQL Server Compact is discontinued.
+
+  @deprecated
+  {"note": "Replaced by @code other_sql @endcode.", "reason": "renamed", "renamed_to": "other_sql"}
  */
-static constexpr const char *kMssqlcompact = "mssqlcompact";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kMssqlcompact = "mssqlcompact";
 
 /**
   MySQL
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/db_metrics.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/db_metrics.h
index 8b74c62bcf2..935bad9d698 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/db_metrics.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/db_metrics.h
@@ -22,11 +22,11 @@ namespace db
 
 /**
   The number of connections that are currently in state described by the @code state @endcode
-  attribute <p> updowncounter
+  attribute. <p> updowncounter
  */
 static constexpr const char *kMetricDbClientConnectionCount = "db.client.connection.count";
 static constexpr const char *descrMetricDbClientConnectionCount =
-    "The number of connections that are currently in state described by the `state` attribute";
+    "The number of connections that are currently in state described by the `state` attribute.";
 static constexpr const char *unitMetricDbClientConnectionCount = "{connection}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -62,14 +62,14 @@ CreateAsyncDoubleMetricDbClientConnectionCount(metrics::Meter *meter)
 }
 
 /**
-  The time it took to create a new connection
+  The time it took to create a new connection.
   <p>
   histogram
  */
 static constexpr const char *kMetricDbClientConnectionCreateTime =
     "db.client.connection.create_time";
 static constexpr const char *descrMetricDbClientConnectionCreateTime =
-    "The time it took to create a new connection";
+    "The time it took to create a new connection.";
 static constexpr const char *unitMetricDbClientConnectionCreateTime = "s";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>>
@@ -89,13 +89,13 @@ CreateSyncDoubleMetricDbClientConnectionCreateTime(metrics::Meter *meter)
 }
 
 /**
-  The maximum number of idle open connections allowed
+  The maximum number of idle open connections allowed.
   <p>
   updowncounter
  */
 static constexpr const char *kMetricDbClientConnectionIdleMax = "db.client.connection.idle.max";
 static constexpr const char *descrMetricDbClientConnectionIdleMax =
-    "The maximum number of idle open connections allowed";
+    "The maximum number of idle open connections allowed.";
 static constexpr const char *unitMetricDbClientConnectionIdleMax = "{connection}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -131,13 +131,13 @@ CreateAsyncDoubleMetricDbClientConnectionIdleMax(metrics::Meter *meter)
 }
 
 /**
-  The minimum number of idle open connections allowed
+  The minimum number of idle open connections allowed.
   <p>
   updowncounter
  */
 static constexpr const char *kMetricDbClientConnectionIdleMin = "db.client.connection.idle.min";
 static constexpr const char *descrMetricDbClientConnectionIdleMin =
-    "The minimum number of idle open connections allowed";
+    "The minimum number of idle open connections allowed.";
 static constexpr const char *unitMetricDbClientConnectionIdleMin = "{connection}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -173,13 +173,13 @@ CreateAsyncDoubleMetricDbClientConnectionIdleMin(metrics::Meter *meter)
 }
 
 /**
-  The maximum number of open connections allowed
+  The maximum number of open connections allowed.
   <p>
   updowncounter
  */
 static constexpr const char *kMetricDbClientConnectionMax = "db.client.connection.max";
 static constexpr const char *descrMetricDbClientConnectionMax =
-    "The maximum number of open connections allowed";
+    "The maximum number of open connections allowed.";
 static constexpr const char *unitMetricDbClientConnectionMax = "{connection}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -215,14 +215,14 @@ CreateAsyncDoubleMetricDbClientConnectionMax(metrics::Meter *meter)
 }
 
 /**
-  The number of current pending requests for an open connection
+  The number of current pending requests for an open connection.
   <p>
   updowncounter
  */
 static constexpr const char *kMetricDbClientConnectionPendingRequests =
     "db.client.connection.pending_requests";
 static constexpr const char *descrMetricDbClientConnectionPendingRequests =
-    "The number of current pending requests for an open connection";
+    "The number of current pending requests for an open connection.";
 static constexpr const char *unitMetricDbClientConnectionPendingRequests = "{request}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -258,14 +258,14 @@ CreateAsyncDoubleMetricDbClientConnectionPendingRequests(metrics::Meter *meter)
 }
 
 /**
-  The number of connection timeouts that have occurred trying to obtain a connection from the pool
+  The number of connection timeouts that have occurred trying to obtain a connection from the pool.
   <p>
   counter
  */
 static constexpr const char *kMetricDbClientConnectionTimeouts = "db.client.connection.timeouts";
 static constexpr const char *descrMetricDbClientConnectionTimeouts =
     "The number of connection timeouts that have occurred trying to obtain a connection from the "
-    "pool";
+    "pool.";
 static constexpr const char *unitMetricDbClientConnectionTimeouts = "{timeout}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
@@ -301,13 +301,13 @@ CreateAsyncDoubleMetricDbClientConnectionTimeouts(metrics::Meter *meter)
 }
 
 /**
-  The time between borrowing a connection and returning it to the pool
+  The time between borrowing a connection and returning it to the pool.
   <p>
   histogram
  */
 static constexpr const char *kMetricDbClientConnectionUseTime = "db.client.connection.use_time";
 static constexpr const char *descrMetricDbClientConnectionUseTime =
-    "The time between borrowing a connection and returning it to the pool";
+    "The time between borrowing a connection and returning it to the pool.";
 static constexpr const char *unitMetricDbClientConnectionUseTime = "s";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>>
@@ -327,13 +327,13 @@ CreateSyncDoubleMetricDbClientConnectionUseTime(metrics::Meter *meter)
 }
 
 /**
-  The time it took to obtain an open connection from the pool
+  The time it took to obtain an open connection from the pool.
   <p>
   histogram
  */
 static constexpr const char *kMetricDbClientConnectionWaitTime = "db.client.connection.wait_time";
 static constexpr const char *descrMetricDbClientConnectionWaitTime =
-    "The time it took to obtain an open connection from the pool";
+    "The time it took to obtain an open connection from the pool.";
 static constexpr const char *unitMetricDbClientConnectionWaitTime = "s";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>>
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/deployment_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/deployment_attributes.h
index 33209ebbf0c..80f240663cc 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/deployment_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/deployment_attributes.h
@@ -20,7 +20,7 @@ namespace deployment
 {
 
 /**
-  'Deprecated, use @code deployment.environment.name @endcode instead.'
+  Deprecated, use @code deployment.environment.name @endcode instead.
 
   @deprecated
   {"note": "Replaced by @code deployment.environment.name @endcode.", "reason": "renamed",
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/device_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/device_attributes.h
index f69856ee4fb..e801686f410 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/device_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/device_attributes.h
@@ -25,8 +25,9 @@ namespace device
   Its value SHOULD be identical for all apps on a device and it SHOULD NOT change if an app is
   uninstalled and re-installed. However, it might be resettable by the user for all apps on a
   device. Hardware IDs (e.g. vendor-specific serial number, IMEI or MAC address) MAY be used as
-  values. <p> More information about Android identifier best practices can be found <a
-  href="https://developer.android.com/training/articles/user-data-ids">here</a>. <blockquote>
+  values. <p> More information about Android identifier best practices can be found in the <a
+  href="https://developer.android.com/training/articles/user-data-ids">Android user data IDs
+  guide</a>. <blockquote>
   [!WARNING]
   <p>
   This attribute may contain sensitive (PII) information. Caution should be taken when storing
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/disk_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/disk_attributes.h
index c2504d75ff5..3e3e209b8f4 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/disk_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/disk_attributes.h
@@ -26,14 +26,9 @@ static constexpr const char *kDiskIoDirection = "disk.io.direction";
 
 namespace DiskIoDirectionValues
 {
-/**
-  none
- */
+
 static constexpr const char *kRead = "read";
 
-/**
-  none
- */
 static constexpr const char *kWrite = "write";
 
 }  // namespace DiskIoDirectionValues
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/enduser_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/enduser_attributes.h
index 9120aa2c05a..d117dd268e1 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/enduser_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/enduser_attributes.h
@@ -40,7 +40,8 @@ static constexpr const char *kEnduserPseudoId = "enduser.pseudo.id";
   Deprecated, use @code user.roles @endcode instead.
 
   @deprecated
-  {"note": "Use @code user.roles @endcode attribute instead.", "reason": "uncategorized"}
+  {"note": "Replaced by @code user.roles @endcode.", "reason": "renamed", "renamed_to":
+  "user.roles"}
  */
 OPENTELEMETRY_DEPRECATED static constexpr const char *kEnduserRole = "enduser.role";
 
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/faas_metrics.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/faas_metrics.h
index 99888cde9de..868eac024e0 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/faas_metrics.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/faas_metrics.h
@@ -21,12 +21,12 @@ namespace faas
 {
 
 /**
-  Number of invocation cold starts
+  Number of invocation cold starts.
   <p>
   counter
  */
 static constexpr const char *kMetricFaasColdstarts     = "faas.coldstarts";
-static constexpr const char *descrMetricFaasColdstarts = "Number of invocation cold starts";
+static constexpr const char *descrMetricFaasColdstarts = "Number of invocation cold starts.";
 static constexpr const char *unitMetricFaasColdstarts  = "{coldstart}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricFaasColdstarts(
@@ -58,12 +58,12 @@ CreateAsyncDoubleMetricFaasColdstarts(metrics::Meter *meter)
 }
 
 /**
-  Distribution of CPU usage per invocation
+  Distribution of CPU usage per invocation.
   <p>
   histogram
  */
 static constexpr const char *kMetricFaasCpuUsage     = "faas.cpu_usage";
-static constexpr const char *descrMetricFaasCpuUsage = "Distribution of CPU usage per invocation";
+static constexpr const char *descrMetricFaasCpuUsage = "Distribution of CPU usage per invocation.";
 static constexpr const char *unitMetricFaasCpuUsage  = "s";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>> CreateSyncInt64MetricFaasCpuUsage(
@@ -81,12 +81,12 @@ static inline nostd::unique_ptr<metrics::Histogram<double>> CreateSyncDoubleMetr
 }
 
 /**
-  Number of invocation errors
+  Number of invocation errors.
   <p>
   counter
  */
 static constexpr const char *kMetricFaasErrors     = "faas.errors";
-static constexpr const char *descrMetricFaasErrors = "Number of invocation errors";
+static constexpr const char *descrMetricFaasErrors = "Number of invocation errors.";
 static constexpr const char *unitMetricFaasErrors  = "{error}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricFaasErrors(
@@ -116,13 +116,13 @@ static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDouble
 }
 
 /**
-  Measures the duration of the function's initialization, such as a cold start
+  Measures the duration of the function's initialization, such as a cold start.
   <p>
   histogram
  */
 static constexpr const char *kMetricFaasInitDuration = "faas.init_duration";
 static constexpr const char *descrMetricFaasInitDuration =
-    "Measures the duration of the function's initialization, such as a cold start";
+    "Measures the duration of the function's initialization, such as a cold start.";
 static constexpr const char *unitMetricFaasInitDuration = "s";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>> CreateSyncInt64MetricFaasInitDuration(
@@ -140,12 +140,12 @@ static inline nostd::unique_ptr<metrics::Histogram<double>> CreateSyncDoubleMetr
 }
 
 /**
-  Number of successful invocations
+  Number of successful invocations.
   <p>
   counter
  */
 static constexpr const char *kMetricFaasInvocations     = "faas.invocations";
-static constexpr const char *descrMetricFaasInvocations = "Number of successful invocations";
+static constexpr const char *descrMetricFaasInvocations = "Number of successful invocations.";
 static constexpr const char *unitMetricFaasInvocations  = "{invocation}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricFaasInvocations(
@@ -177,13 +177,13 @@ CreateAsyncDoubleMetricFaasInvocations(metrics::Meter *meter)
 }
 
 /**
-  Measures the duration of the function's logic execution
+  Measures the duration of the function's logic execution.
   <p>
   histogram
  */
 static constexpr const char *kMetricFaasInvokeDuration = "faas.invoke_duration";
 static constexpr const char *descrMetricFaasInvokeDuration =
-    "Measures the duration of the function's logic execution";
+    "Measures the duration of the function's logic execution.";
 static constexpr const char *unitMetricFaasInvokeDuration = "s";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>>
@@ -201,13 +201,13 @@ CreateSyncDoubleMetricFaasInvokeDuration(metrics::Meter *meter)
 }
 
 /**
-  Distribution of max memory usage per invocation
+  Distribution of max memory usage per invocation.
   <p>
   histogram
  */
 static constexpr const char *kMetricFaasMemUsage = "faas.mem_usage";
 static constexpr const char *descrMetricFaasMemUsage =
-    "Distribution of max memory usage per invocation";
+    "Distribution of max memory usage per invocation.";
 static constexpr const char *unitMetricFaasMemUsage = "By";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>> CreateSyncInt64MetricFaasMemUsage(
@@ -225,12 +225,12 @@ static inline nostd::unique_ptr<metrics::Histogram<double>> CreateSyncDoubleMetr
 }
 
 /**
-  Distribution of net I/O usage per invocation
+  Distribution of net I/O usage per invocation.
   <p>
   histogram
  */
 static constexpr const char *kMetricFaasNetIo     = "faas.net_io";
-static constexpr const char *descrMetricFaasNetIo = "Distribution of net I/O usage per invocation";
+static constexpr const char *descrMetricFaasNetIo = "Distribution of net I/O usage per invocation.";
 static constexpr const char *unitMetricFaasNetIo  = "By";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>> CreateSyncInt64MetricFaasNetIo(
@@ -246,12 +246,12 @@ static inline nostd::unique_ptr<metrics::Histogram<double>> CreateSyncDoubleMetr
 }
 
 /**
-  Number of invocation timeouts
+  Number of invocation timeouts.
   <p>
   counter
  */
 static constexpr const char *kMetricFaasTimeouts     = "faas.timeouts";
-static constexpr const char *descrMetricFaasTimeouts = "Number of invocation timeouts";
+static constexpr const char *descrMetricFaasTimeouts = "Number of invocation timeouts.";
 static constexpr const char *unitMetricFaasTimeouts  = "{timeout}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricFaasTimeouts(
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/gen_ai_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/gen_ai_attributes.h
index 95f11c7fc4c..50bfff5317f 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/gen_ai_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/gen_ai_attributes.h
@@ -61,6 +61,23 @@ static constexpr const char *kGenAiConversationId = "gen_ai.conversation.id";
  */
 static constexpr const char *kGenAiDataSourceId = "gen_ai.data_source.id";
 
+/**
+  The chat history provided to the model as an input.
+  <p>
+  Instrumentations MUST follow <a href="/docs/gen-ai/gen-ai-input-messages.json">Input messages JSON
+  schema</a>. When the attribute is recorded on events, it MUST be recorded in structured form. When
+  recorded on spans, it MAY be recorded as a JSON string if structured format is not supported and
+  SHOULD be recorded in structured form otherwise. <p> Messages MUST be provided in the order they
+  were sent to the model. Instrumentations MAY provide a way for users to filter or truncate input
+  messages. <blockquote>
+  [!Warning]
+  This attribute is likely to contain sensitive information including user/PII data.</blockquote>
+  <p>
+  See <a href="/docs/gen-ai/gen-ai-spans.md#recording-content-on-attributes">Recording content on
+  attributes</a> section for more details.
+ */
+static constexpr const char *kGenAiInputMessages = "gen_ai.input.messages";
+
 /**
   Deprecated, use @code gen_ai.output.type @endcode.
 
@@ -82,20 +99,33 @@ OPENTELEMETRY_DEPRECATED static constexpr const char *kGenAiOpenaiRequestSeed =
     "gen_ai.openai.request.seed";
 
 /**
-  The service tier requested. May be a specific tier, default, or auto.
+  Deprecated, use @code openai.request.service_tier @endcode.
+
+  @deprecated
+  {"note": "Replaced by @code openai.request.service_tier @endcode.", "reason": "renamed",
+  "renamed_to": "openai.request.service_tier"}
  */
-static constexpr const char *kGenAiOpenaiRequestServiceTier = "gen_ai.openai.request.service_tier";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kGenAiOpenaiRequestServiceTier =
+    "gen_ai.openai.request.service_tier";
 
 /**
-  The service tier used for the response.
+  Deprecated, use @code openai.response.service_tier @endcode.
+
+  @deprecated
+  {"note": "Replaced by @code openai.response.service_tier @endcode.", "reason": "renamed",
+  "renamed_to": "openai.response.service_tier"}
  */
-static constexpr const char *kGenAiOpenaiResponseServiceTier =
+OPENTELEMETRY_DEPRECATED static constexpr const char *kGenAiOpenaiResponseServiceTier =
     "gen_ai.openai.response.service_tier";
 
 /**
-  A fingerprint to track any eventual change in the Generative AI environment.
+  Deprecated, use @code openai.response.system_fingerprint @endcode.
+
+  @deprecated
+  {"note": "Replaced by @code openai.response.system_fingerprint @endcode.", "reason": "renamed",
+  "renamed_to": "openai.response.system_fingerprint"}
  */
-static constexpr const char *kGenAiOpenaiResponseSystemFingerprint =
+OPENTELEMETRY_DEPRECATED static constexpr const char *kGenAiOpenaiResponseSystemFingerprint =
     "gen_ai.openai.response.system_fingerprint";
 
 /**
@@ -108,6 +138,29 @@ static constexpr const char *kGenAiOpenaiResponseSystemFingerprint =
  */
 static constexpr const char *kGenAiOperationName = "gen_ai.operation.name";
 
+/**
+  Messages returned by the model where each message represents a specific model response (choice,
+  candidate). <p> Instrumentations MUST follow <a
+  href="/docs/gen-ai/gen-ai-output-messages.json">Output messages JSON schema</a> <p> Each message
+  represents a single output choice/candidate generated by the model. Each message corresponds to
+  exactly one generation (choice/candidate) and vice versa - one choice cannot be split across
+  multiple messages or one message cannot contain parts from multiple choices.
+  <p>
+  When the attribute is recorded on events, it MUST be recorded in structured
+  form. When recorded on spans, it MAY be recorded as a JSON string if structured
+  format is not supported and SHOULD be recorded in structured form otherwise.
+  <p>
+  Instrumentations MAY provide a way for users to filter or truncate
+  output messages.
+  <blockquote>
+  [!Warning]
+  This attribute is likely to contain sensitive information including user/PII data.</blockquote>
+  <p>
+  See <a href="/docs/gen-ai/gen-ai-spans.md#recording-content-on-attributes">Recording content on
+  attributes</a> section for more details.
+ */
+static constexpr const char *kGenAiOutputMessages = "gen_ai.output.messages";
+
 /**
   Represents the content type requested by the client.
   <p>
@@ -127,6 +180,28 @@ static constexpr const char *kGenAiOutputType = "gen_ai.output.type";
  */
 OPENTELEMETRY_DEPRECATED static constexpr const char *kGenAiPrompt = "gen_ai.prompt";
 
+/**
+  The Generative AI provider as identified by the client or server instrumentation.
+  <p>
+  The attribute SHOULD be set based on the instrumentation's best
+  knowledge and may differ from the actual model provider.
+  <p>
+  Multiple providers, including Azure OpenAI, Gemini, and AI hosting platforms
+  are accessible using the OpenAI REST API and corresponding client libraries,
+  but may proxy or host models from different providers.
+  <p>
+  The @code gen_ai.request.model @endcode, @code gen_ai.response.model @endcode, and @code
+  server.address @endcode attributes may help identify the actual system in use. <p> The @code
+  gen_ai.provider.name @endcode attribute acts as a discriminator that identifies the GenAI
+  telemetry format flavor specific to that provider within GenAI semantic conventions. It SHOULD be
+  set consistently with provider-specific attributes and signals. For example, GenAI spans, metrics,
+  and events related to AWS Bedrock should have the @code gen_ai.provider.name @endcode set to @code
+  aws.bedrock @endcode and include applicable @code aws.bedrock.* @endcode attributes and are not
+  expected to include
+  @code openai.* @endcode attributes.
+ */
+static constexpr const char *kGenAiProviderName = "gen_ai.provider.name";
+
 /**
   The target number of candidate completions to return.
  */
@@ -201,20 +276,37 @@ static constexpr const char *kGenAiResponseId = "gen_ai.response.id";
 static constexpr const char *kGenAiResponseModel = "gen_ai.response.model";
 
 /**
-  The Generative AI product as identified by the client or server instrumentation.
+  Deprecated, use @code gen_ai.provider.name @endcode instead.
+
+  @deprecated
+  {"note": "Replaced by @code gen_ai.provider.name @endcode.", "reason": "renamed", "renamed_to":
+  "gen_ai.provider.name"}
+ */
+OPENTELEMETRY_DEPRECATED static constexpr const char *kGenAiSystem = "gen_ai.system";
+
+/**
+  The system message or instructions provided to the GenAI model separately from the chat history.
+  <p>
+  This attribute SHOULD be used when the corresponding provider or API
+  allows to provide system instructions or messages separately from the
+  chat history.
   <p>
-  The @code gen_ai.system @endcode describes a family of GenAI models with specific model identified
-  by @code gen_ai.request.model @endcode and @code gen_ai.response.model @endcode attributes.
+  Instructions that are part of the chat history SHOULD be recorded in
+  @code gen_ai.input.messages @endcode attribute instead.
   <p>
-  The actual GenAI product may differ from the one identified by the client.
-  Multiple systems, including Azure OpenAI and Gemini, are accessible by OpenAI client
-  libraries. In such cases, the @code gen_ai.system @endcode is set to @code openai @endcode based
-  on the instrumentation's best knowledge, instead of the actual system. The @code server.address
-  @endcode attribute may help identify the actual system in use for @code openai @endcode. <p> For
-  custom model, a custom friendly name SHOULD be used. If none of these options apply, the @code
-  gen_ai.system @endcode SHOULD be set to @code _OTHER @endcode.
+  Instrumentations MUST follow <a href="/docs/gen-ai/gen-ai-system-instructions.json">System
+  instructions JSON schema</a>. <p> When recorded on spans, it MAY be recorded as a JSON string if
+  structured format is not supported and SHOULD be recorded in structured form otherwise. <p>
+  Instrumentations MAY provide a way for users to filter or truncate
+  system instructions.
+  <blockquote>
+  [!Warning]
+  This attribute may contain sensitive information.</blockquote>
+  <p>
+  See <a href="/docs/gen-ai/gen-ai-spans.md#recording-content-on-attributes">Recording content on
+  attributes</a> section for more details.
  */
-static constexpr const char *kGenAiSystem = "gen_ai.system";
+static constexpr const char *kGenAiSystemInstructions = "gen_ai.system_instructions";
 
 /**
   The type of token being counted.
@@ -381,6 +473,85 @@ static constexpr const char *kSpeech = "speech";
 
 }  // namespace GenAiOutputTypeValues
 
+namespace GenAiProviderNameValues
+{
+/**
+  <a href="https://openai.com/">OpenAI</a>
+ */
+static constexpr const char *kOpenai = "openai";
+
+/**
+  Any Google generative AI endpoint
+ */
+static constexpr const char *kGcpGenAi = "gcp.gen_ai";
+
+/**
+  <a href="https://cloud.google.com/vertex-ai">Vertex AI</a>
+ */
+static constexpr const char *kGcpVertexAi = "gcp.vertex_ai";
+
+/**
+  <a href="https://cloud.google.com/products/gemini">Gemini</a>
+ */
+static constexpr const char *kGcpGemini = "gcp.gemini";
+
+/**
+  <a href="https://www.anthropic.com/">Anthropic</a>
+ */
+static constexpr const char *kAnthropic = "anthropic";
+
+/**
+  <a href="https://cohere.com/">Cohere</a>
+ */
+static constexpr const char *kCohere = "cohere";
+
+/**
+  Azure AI Inference
+ */
+static constexpr const char *kAzureAiInference = "azure.ai.inference";
+
+/**
+  <a href="https://azure.microsoft.com/products/ai-services/openai-service/">Azure OpenAI</a>
+ */
+static constexpr const char *kAzureAiOpenai = "azure.ai.openai";
+
+/**
+  <a href="https://www.ibm.com/products/watsonx-ai">IBM Watsonx AI</a>
+ */
+static constexpr const char *kIbmWatsonxAi = "ibm.watsonx.ai";
+
+/**
+  <a href="https://aws.amazon.com/bedrock">AWS Bedrock</a>
+ */
+static constexpr const char *kAwsBedrock = "aws.bedrock";
+
+/**
+  <a href="https://www.perplexity.ai/">Perplexity</a>
+ */
+static constexpr const char *kPerplexity = "perplexity";
+
+/**
+  <a href="https://x.ai/">xAI</a>
+ */
+static constexpr const char *kXAi = "x_ai";
+
+/**
+  <a href="https://www.deepseek.com/">DeepSeek</a>
+ */
+static constexpr const char *kDeepseek = "deepseek";
+
+/**
+  <a href="https://groq.com/">Groq</a>
+ */
+static constexpr const char *kGroq = "groq";
+
+/**
+  <a href="https://mistral.ai/">Mistral AI</a>
+ */
+static constexpr const char *kMistralAi = "mistral_ai";
+
+}  // namespace GenAiProviderNameValues
+
 namespace GenAiSystemValues
 {
 /**
@@ -405,13 +576,21 @@ static constexpr const char *kGcpGemini = "gcp.gemini";
 
 /**
   Vertex AI
+
+  @deprecated
+  {"note": "Replaced by @code gcp.vertex_ai @endcode.", "reason": "renamed", "renamed_to":
+  "gcp.vertex_ai"}
  */
-static constexpr const char *kVertexAi = "vertex_ai";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kVertexAi = "vertex_ai";
 
 /**
   Gemini
+
+  @deprecated
+  {"note": "Replaced by @code gcp.gemini @endcode.", "reason": "renamed", "renamed_to":
+  "gcp.gemini"}
  */
-static constexpr const char *kGemini = "gemini";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kGemini = "gemini";
 
 /**
   Anthropic
@@ -426,22 +605,22 @@ static constexpr const char *kCohere = "cohere";
 /**
   Azure AI Inference
  */
-static constexpr const char *kAzureAiInference = "azure.ai.inference";
+static constexpr const char *kAzAiInference = "az.ai.inference";
 
 /**
   Azure OpenAI
  */
-static constexpr const char *kAzureAiOpenai = "azure.ai.openai";
+static constexpr const char *kAzAiOpenai = "az.ai.openai";
 
 /**
   Azure AI Inference
  */
-static constexpr const char *kAzAiInference = "az.ai.inference";
+static constexpr const char *kAzureAiInference = "azure.ai.inference";
 
 /**
   Azure OpenAI
  */
-static constexpr const char *kAzAiOpenai = "azure.ai.openai";
+static constexpr const char *kAzureAiOpenai = "azure.ai.openai";
 
 /**
   IBM Watsonx AI
@@ -460,8 +639,11 @@ static constexpr const char *kPerplexity = "perplexity";
 
 /**
   xAI
+
+  @deprecated
+  {"note": "Replaced by @code x_ai @endcode.", "reason": "renamed", "renamed_to": "x_ai"}
  */
-static constexpr const char *kXai = "xai";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kXai = "xai";
 
 /**
   DeepSeek
@@ -489,8 +671,11 @@ static constexpr const char *kInput = "input";
 
 /**
   Output tokens (completion, response, etc.)
+
+  @deprecated
+  {"note": "Replaced by @code output @endcode.", "reason": "renamed", "renamed_to": "output"}
  */
-static constexpr const char *kCompletion = "output";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kCompletion = "output";
 
 /**
   Output tokens (completion, response, etc.)
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/gen_ai_metrics.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/gen_ai_metrics.h
index 2cd11bd546f..a5798f9dbcf 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/gen_ai_metrics.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/gen_ai_metrics.h
@@ -21,13 +21,13 @@ namespace gen_ai
 {
 
 /**
-  GenAI operation duration
+  GenAI operation duration.
   <p>
   histogram
  */
 static constexpr const char *kMetricGenAiClientOperationDuration =
     "gen_ai.client.operation.duration";
-static constexpr const char *descrMetricGenAiClientOperationDuration = "GenAI operation duration";
+static constexpr const char *descrMetricGenAiClientOperationDuration = "GenAI operation duration.";
 static constexpr const char *unitMetricGenAiClientOperationDuration  = "s";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>>
@@ -47,13 +47,13 @@ CreateSyncDoubleMetricGenAiClientOperationDuration(metrics::Meter *meter)
 }
 
 /**
-  Measures number of input and output tokens used
+  Number of input and output tokens used.
   <p>
   histogram
  */
 static constexpr const char *kMetricGenAiClientTokenUsage = "gen_ai.client.token.usage";
 static constexpr const char *descrMetricGenAiClientTokenUsage =
-    "Measures number of input and output tokens used";
+    "Number of input and output tokens used.";
 static constexpr const char *unitMetricGenAiClientTokenUsage = "{token}";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>>
@@ -73,13 +73,13 @@ CreateSyncDoubleMetricGenAiClientTokenUsage(metrics::Meter *meter)
 }
 
 /**
-  Generative AI server request duration such as time-to-last byte or last output token
+  Generative AI server request duration such as time-to-last byte or last output token.
   <p>
   histogram
  */
 static constexpr const char *kMetricGenAiServerRequestDuration = "gen_ai.server.request.duration";
 static constexpr const char *descrMetricGenAiServerRequestDuration =
-    "Generative AI server request duration such as time-to-last byte or last output token";
+    "Generative AI server request duration such as time-to-last byte or last output token.";
 static constexpr const char *unitMetricGenAiServerRequestDuration = "s";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>>
@@ -99,14 +99,14 @@ CreateSyncDoubleMetricGenAiServerRequestDuration(metrics::Meter *meter)
 }
 
 /**
-  Time per output token generated after the first token for successful responses
+  Time per output token generated after the first token for successful responses.
   <p>
   histogram
  */
 static constexpr const char *kMetricGenAiServerTimePerOutputToken =
     "gen_ai.server.time_per_output_token";
 static constexpr const char *descrMetricGenAiServerTimePerOutputToken =
-    "Time per output token generated after the first token for successful responses";
+    "Time per output token generated after the first token for successful responses.";
 static constexpr const char *unitMetricGenAiServerTimePerOutputToken = "s";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>>
@@ -126,14 +126,14 @@ CreateSyncDoubleMetricGenAiServerTimePerOutputToken(metrics::Meter *meter)
 }
 
 /**
-  Time to generate first token for successful responses
+  Time to generate first token for successful responses.
   <p>
   histogram
  */
 static constexpr const char *kMetricGenAiServerTimeToFirstToken =
     "gen_ai.server.time_to_first_token";
 static constexpr const char *descrMetricGenAiServerTimeToFirstToken =
-    "Time to generate first token for successful responses";
+    "Time to generate first token for successful responses.";
 static constexpr const char *unitMetricGenAiServerTimeToFirstToken = "s";
 
 static inline nostd::unique_ptr<metrics::Histogram<uint64_t>>
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/hw_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/hw_attributes.h
index 04c8a7638b2..2ffcfd16f0d 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/hw_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/hw_attributes.h
@@ -19,27 +19,134 @@ namespace semconv
 namespace hw
 {
 
+/**
+  Design capacity in Watts-hours or Amper-hours
+ */
+static constexpr const char *kHwBatteryCapacity = "hw.battery.capacity";
+
+/**
+  Battery <a href="https://schemas.dmtf.org/wbem/cim-html/2.31.0/CIM_Battery.html">chemistry</a>,
+  e.g. Lithium-Ion, Nickel-Cadmium, etc.
+ */
+static constexpr const char *kHwBatteryChemistry = "hw.battery.chemistry";
+
+/**
+  The current state of the battery
+ */
+static constexpr const char *kHwBatteryState = "hw.battery.state";
+
+/**
+  BIOS version of the hardware component
+ */
+static constexpr const char *kHwBiosVersion = "hw.bios_version";
+
+/**
+  Driver version for the hardware component
+ */
+static constexpr const char *kHwDriverVersion = "hw.driver_version";
+
+/**
+  Type of the enclosure (useful for modular systems)
+ */
+static constexpr const char *kHwEnclosureType = "hw.enclosure.type";
+
+/**
+  Firmware version of the hardware component
+ */
+static constexpr const char *kHwFirmwareVersion = "hw.firmware_version";
+
+/**
+  Type of task the GPU is performing
+ */
+static constexpr const char *kHwGpuTask = "hw.gpu.task";
+
 /**
   An identifier for the hardware component, unique within the monitored host
  */
 static constexpr const char *kHwId = "hw.id";
 
+/**
+  Type of limit for hardware components
+ */
+static constexpr const char *kHwLimitType = "hw.limit_type";
+
+/**
+  RAID Level of the logical disk
+ */
+static constexpr const char *kHwLogicalDiskRaidLevel = "hw.logical_disk.raid_level";
+
+/**
+  State of the logical disk space usage
+ */
+static constexpr const char *kHwLogicalDiskState = "hw.logical_disk.state";
+
+/**
+  Type of the memory module
+ */
+static constexpr const char *kHwMemoryType = "hw.memory.type";
+
+/**
+  Descriptive model name of the hardware component
+ */
+static constexpr const char *kHwModel = "hw.model";
+
 /**
   An easily-recognizable name for the hardware component
  */
 static constexpr const char *kHwName = "hw.name";
 
+/**
+  Logical addresses of the adapter (e.g. IP address, or WWPN)
+ */
+static constexpr const char *kHwNetworkLogicalAddresses = "hw.network.logical_addresses";
+
+/**
+  Physical address of the adapter (e.g. MAC address, or WWNN)
+ */
+static constexpr const char *kHwNetworkPhysicalAddress = "hw.network.physical_address";
+
 /**
   Unique identifier of the parent component (typically the @code hw.id @endcode attribute of the
   enclosure, or disk controller)
  */
 static constexpr const char *kHwParent = "hw.parent";
 
+/**
+  <a href="https://wikipedia.org/wiki/S.M.A.R.T.">S.M.A.R.T.</a> (Self-Monitoring, Analysis, and
+  Reporting Technology) attribute of the physical disk
+ */
+static constexpr const char *kHwPhysicalDiskSmartAttribute = "hw.physical_disk.smart_attribute";
+
+/**
+  State of the physical disk endurance utilization
+ */
+static constexpr const char *kHwPhysicalDiskState = "hw.physical_disk.state";
+
+/**
+  Type of the physical disk
+ */
+static constexpr const char *kHwPhysicalDiskType = "hw.physical_disk.type";
+
+/**
+  Location of the sensor
+ */
+static constexpr const char *kHwSensorLocation = "hw.sensor_location";
+
+/**
+  Serial number of the hardware component
+ */
+static constexpr const char *kHwSerialNumber = "hw.serial_number";
+
 /**
   The current state of the component
  */
 static constexpr const char *kHwState = "hw.state";
 
+/**
+  Type of tape drive operation
+ */
+static constexpr const char *kHwTapeDriveOperationType = "hw.tape_drive.operation_type";
+
 /**
   Type of the component
   <p>
@@ -50,25 +157,164 @@ static constexpr const char *kHwState = "hw.state";
  */
 static constexpr const char *kHwType = "hw.type";
 
-namespace HwStateValues
+/**
+  Vendor name of the hardware component
+ */
+static constexpr const char *kHwVendor = "hw.vendor";
+
+namespace HwBatteryStateValues
 {
 /**
-  Ok
+  Charging
  */
-static constexpr const char *kOk = "ok";
+static constexpr const char *kCharging = "charging";
+
+/**
+  Discharging
+ */
+static constexpr const char *kDischarging = "discharging";
+
+}  // namespace HwBatteryStateValues
+
+namespace HwGpuTaskValues
+{
+/**
+  Decoder
+ */
+static constexpr const char *kDecoder = "decoder";
+
+/**
+  Encoder
+ */
+static constexpr const char *kEncoder = "encoder";
+
+/**
+  General
+ */
+static constexpr const char *kGeneral = "general";
+
+}  // namespace HwGpuTaskValues
+
+namespace HwLimitTypeValues
+{
+/**
+  Critical
+ */
+static constexpr const char *kCritical = "critical";
 
 /**
   Degraded
  */
 static constexpr const char *kDegraded = "degraded";
 
+/**
+  High Critical
+ */
+static constexpr const char *kHighCritical = "high.critical";
+
+/**
+  High Degraded
+ */
+static constexpr const char *kHighDegraded = "high.degraded";
+
+/**
+  Low Critical
+ */
+static constexpr const char *kLowCritical = "low.critical";
+
+/**
+  Low Degraded
+ */
+static constexpr const char *kLowDegraded = "low.degraded";
+
+/**
+  Maximum
+ */
+static constexpr const char *kMax = "max";
+
+/**
+  Throttled
+ */
+static constexpr const char *kThrottled = "throttled";
+
+/**
+  Turbo
+ */
+static constexpr const char *kTurbo = "turbo";
+
+}  // namespace HwLimitTypeValues
+
+namespace HwLogicalDiskStateValues
+{
+/**
+  Used
+ */
+static constexpr const char *kUsed = "used";
+
+/**
+  Free
+ */
+static constexpr const char *kFree = "free";
+
+}  // namespace HwLogicalDiskStateValues
+
+namespace HwPhysicalDiskStateValues
+{
+/**
+  Remaining
+ */
+static constexpr const char *kRemaining = "remaining";
+
+}  // namespace HwPhysicalDiskStateValues
+
+namespace HwStateValues
+{
+/**
+  Degraded
+ */
+static constexpr const char *kDegraded = "degraded";
+
 /**
   Failed
  */
 static constexpr const char *kFailed = "failed";
 
+/**
+  Needs Cleaning
+ */
+static constexpr const char *kNeedsCleaning = "needs_cleaning";
+
+/**
+  OK
+ */
+static constexpr const char *kOk = "ok";
+
+/**
+  Predicted Failure
+ */
+static constexpr const char *kPredictedFailure = "predicted_failure";
+
 }  // namespace HwStateValues
 
+namespace HwTapeDriveOperationTypeValues
+{
+/**
+  Mount
+ */
+static constexpr const char *kMount = "mount";
+
+/**
+  Unmount
+ */
+static constexpr const char *kUnmount = "unmount";
+
+/**
+  Clean
+ */
+static constexpr const char *kClean = "clean";
+
+}  // namespace HwTapeDriveOperationTypeValues
+
 namespace HwTypeValues
 {
 /**
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/hw_metrics.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/hw_metrics.h
index e73e9edeb89..fe391112659 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/hw_metrics.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/hw_metrics.h
@@ -21,12 +21,212 @@ namespace hw
 {
 
 /**
-  Energy consumed by the component
+  Remaining fraction of battery charge.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwBatteryCharge     = "hw.battery.charge";
+static constexpr const char *descrMetricHwBatteryCharge = "Remaining fraction of battery charge.";
+static constexpr const char *unitMetricHwBatteryCharge  = "1";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwBatteryCharge(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwBatteryCharge, descrMetricHwBatteryCharge,
+                                 unitMetricHwBatteryCharge);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwBatteryCharge(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwBatteryCharge, descrMetricHwBatteryCharge,
+                                  unitMetricHwBatteryCharge);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwBatteryCharge(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwBatteryCharge, descrMetricHwBatteryCharge,
+                                           unitMetricHwBatteryCharge);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwBatteryCharge(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwBatteryCharge, descrMetricHwBatteryCharge,
+                                            unitMetricHwBatteryCharge);
+}
+
+/**
+  Lower limit of battery charge fraction to ensure proper operation.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwBatteryChargeLimit = "hw.battery.charge.limit";
+static constexpr const char *descrMetricHwBatteryChargeLimit =
+    "Lower limit of battery charge fraction to ensure proper operation.";
+static constexpr const char *unitMetricHwBatteryChargeLimit = "1";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwBatteryChargeLimit(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwBatteryChargeLimit, descrMetricHwBatteryChargeLimit,
+                                 unitMetricHwBatteryChargeLimit);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwBatteryChargeLimit(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwBatteryChargeLimit, descrMetricHwBatteryChargeLimit,
+                                  unitMetricHwBatteryChargeLimit);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwBatteryChargeLimit(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(
+      kMetricHwBatteryChargeLimit, descrMetricHwBatteryChargeLimit, unitMetricHwBatteryChargeLimit);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwBatteryChargeLimit(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(
+      kMetricHwBatteryChargeLimit, descrMetricHwBatteryChargeLimit, unitMetricHwBatteryChargeLimit);
+}
+
+/**
+  Time left before battery is completely charged or discharged.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwBatteryTimeLeft = "hw.battery.time_left";
+static constexpr const char *descrMetricHwBatteryTimeLeft =
+    "Time left before battery is completely charged or discharged.";
+static constexpr const char *unitMetricHwBatteryTimeLeft = "s";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwBatteryTimeLeft(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwBatteryTimeLeft, descrMetricHwBatteryTimeLeft,
+                                 unitMetricHwBatteryTimeLeft);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwBatteryTimeLeft(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwBatteryTimeLeft, descrMetricHwBatteryTimeLeft,
+                                  unitMetricHwBatteryTimeLeft);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwBatteryTimeLeft(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwBatteryTimeLeft, descrMetricHwBatteryTimeLeft,
+                                           unitMetricHwBatteryTimeLeft);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwBatteryTimeLeft(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwBatteryTimeLeft, descrMetricHwBatteryTimeLeft,
+                                            unitMetricHwBatteryTimeLeft);
+}
+
+/**
+  CPU current frequency.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwCpuSpeed     = "hw.cpu.speed";
+static constexpr const char *descrMetricHwCpuSpeed = "CPU current frequency.";
+static constexpr const char *unitMetricHwCpuSpeed  = "Hz";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwCpuSpeed(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwCpuSpeed, descrMetricHwCpuSpeed, unitMetricHwCpuSpeed);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwCpuSpeed(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwCpuSpeed, descrMetricHwCpuSpeed, unitMetricHwCpuSpeed);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwCpuSpeed(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwCpuSpeed, descrMetricHwCpuSpeed,
+                                           unitMetricHwCpuSpeed);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwCpuSpeed(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwCpuSpeed, descrMetricHwCpuSpeed,
+                                            unitMetricHwCpuSpeed);
+}
+
+/**
+  CPU maximum frequency.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwCpuSpeedLimit     = "hw.cpu.speed.limit";
+static constexpr const char *descrMetricHwCpuSpeedLimit = "CPU maximum frequency.";
+static constexpr const char *unitMetricHwCpuSpeedLimit  = "Hz";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwCpuSpeedLimit(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwCpuSpeedLimit, descrMetricHwCpuSpeedLimit,
+                                 unitMetricHwCpuSpeedLimit);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwCpuSpeedLimit(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwCpuSpeedLimit, descrMetricHwCpuSpeedLimit,
+                                  unitMetricHwCpuSpeedLimit);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwCpuSpeedLimit(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwCpuSpeedLimit, descrMetricHwCpuSpeedLimit,
+                                           unitMetricHwCpuSpeedLimit);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwCpuSpeedLimit(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwCpuSpeedLimit, descrMetricHwCpuSpeedLimit,
+                                            unitMetricHwCpuSpeedLimit);
+}
+
+/**
+  Energy consumed by the component.
   <p>
   counter
  */
 static constexpr const char *kMetricHwEnergy     = "hw.energy";
-static constexpr const char *descrMetricHwEnergy = "Energy consumed by the component";
+static constexpr const char *descrMetricHwEnergy = "Energy consumed by the component.";
 static constexpr const char *unitMetricHwEnergy  = "J";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricHwEnergy(
@@ -56,12 +256,12 @@ static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDouble
 }
 
 /**
-  Number of errors encountered by the component
+  Number of errors encountered by the component.
   <p>
   counter
  */
 static constexpr const char *kMetricHwErrors     = "hw.errors";
-static constexpr const char *descrMetricHwErrors = "Number of errors encountered by the component";
+static constexpr const char *descrMetricHwErrors = "Number of errors encountered by the component.";
 static constexpr const char *unitMetricHwErrors  = "{error}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricHwErrors(
@@ -91,237 +291,1148 @@ static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDouble
 }
 
 /**
-  Ambient (external) temperature of the physical host
+  Fan speed in revolutions per minute.
   <p>
   gauge
  */
-static constexpr const char *kMetricHwHostAmbientTemperature = "hw.host.ambient_temperature";
-static constexpr const char *descrMetricHwHostAmbientTemperature =
-    "Ambient (external) temperature of the physical host";
-static constexpr const char *unitMetricHwHostAmbientTemperature = "Cel";
+static constexpr const char *kMetricHwFanSpeed     = "hw.fan.speed";
+static constexpr const char *descrMetricHwFanSpeed = "Fan speed in revolutions per minute.";
+static constexpr const char *unitMetricHwFanSpeed  = "rpm";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
 
-static inline nostd::unique_ptr<metrics::Gauge<int64_t>>
-CreateSyncInt64MetricHwHostAmbientTemperature(metrics::Meter *meter)
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwFanSpeed(
+    metrics::Meter *meter)
 {
-  return meter->CreateInt64Gauge(kMetricHwHostAmbientTemperature,
-                                 descrMetricHwHostAmbientTemperature,
-                                 unitMetricHwHostAmbientTemperature);
+  return meter->CreateInt64Gauge(kMetricHwFanSpeed, descrMetricHwFanSpeed, unitMetricHwFanSpeed);
 }
 
-static inline nostd::unique_ptr<metrics::Gauge<double>>
-CreateSyncDoubleMetricHwHostAmbientTemperature(metrics::Meter *meter)
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwFanSpeed(
+    metrics::Meter *meter)
 {
-  return meter->CreateDoubleGauge(kMetricHwHostAmbientTemperature,
-                                  descrMetricHwHostAmbientTemperature,
-                                  unitMetricHwHostAmbientTemperature);
+  return meter->CreateDoubleGauge(kMetricHwFanSpeed, descrMetricHwFanSpeed, unitMetricHwFanSpeed);
 }
 #endif /* OPENTELEMETRY_ABI_VERSION_NO */
 
-static inline nostd::shared_ptr<metrics::ObservableInstrument>
-CreateAsyncInt64MetricHwHostAmbientTemperature(metrics::Meter *meter)
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwFanSpeed(
+    metrics::Meter *meter)
 {
-  return meter->CreateInt64ObservableGauge(kMetricHwHostAmbientTemperature,
-                                           descrMetricHwHostAmbientTemperature,
-                                           unitMetricHwHostAmbientTemperature);
+  return meter->CreateInt64ObservableGauge(kMetricHwFanSpeed, descrMetricHwFanSpeed,
+                                           unitMetricHwFanSpeed);
 }
 
-static inline nostd::shared_ptr<metrics::ObservableInstrument>
-CreateAsyncDoubleMetricHwHostAmbientTemperature(metrics::Meter *meter)
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwFanSpeed(
+    metrics::Meter *meter)
 {
-  return meter->CreateDoubleObservableGauge(kMetricHwHostAmbientTemperature,
-                                            descrMetricHwHostAmbientTemperature,
-                                            unitMetricHwHostAmbientTemperature);
+  return meter->CreateDoubleObservableGauge(kMetricHwFanSpeed, descrMetricHwFanSpeed,
+                                            unitMetricHwFanSpeed);
 }
 
 /**
-  Total energy consumed by the entire physical host, in joules
+  Speed limit in rpm.
   <p>
-  The overall energy usage of a host MUST be reported using the specific @code hw.host.energy
-  @endcode and @code hw.host.power @endcode metrics <strong>only</strong>, instead of the generic
-  @code hw.energy @endcode and @code hw.power @endcode described in the previous section, to prevent
-  summing up overlapping values. <p> counter
+  gauge
  */
-static constexpr const char *kMetricHwHostEnergy = "hw.host.energy";
-static constexpr const char *descrMetricHwHostEnergy =
-    "Total energy consumed by the entire physical host, in joules";
-static constexpr const char *unitMetricHwHostEnergy = "J";
+static constexpr const char *kMetricHwFanSpeedLimit     = "hw.fan.speed.limit";
+static constexpr const char *descrMetricHwFanSpeedLimit = "Speed limit in rpm.";
+static constexpr const char *unitMetricHwFanSpeedLimit  = "rpm";
 
-static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricHwHostEnergy(
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwFanSpeedLimit(
     metrics::Meter *meter)
 {
-  return meter->CreateUInt64Counter(kMetricHwHostEnergy, descrMetricHwHostEnergy,
-                                    unitMetricHwHostEnergy);
+  return meter->CreateInt64Gauge(kMetricHwFanSpeedLimit, descrMetricHwFanSpeedLimit,
+                                 unitMetricHwFanSpeedLimit);
 }
 
-static inline nostd::unique_ptr<metrics::Counter<double>> CreateSyncDoubleMetricHwHostEnergy(
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwFanSpeedLimit(
     metrics::Meter *meter)
 {
-  return meter->CreateDoubleCounter(kMetricHwHostEnergy, descrMetricHwHostEnergy,
-                                    unitMetricHwHostEnergy);
+  return meter->CreateDoubleGauge(kMetricHwFanSpeedLimit, descrMetricHwFanSpeedLimit,
+                                  unitMetricHwFanSpeedLimit);
 }
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
 
-static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwHostEnergy(
-    metrics::Meter *meter)
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwFanSpeedLimit(metrics::Meter *meter)
 {
-  return meter->CreateInt64ObservableCounter(kMetricHwHostEnergy, descrMetricHwHostEnergy,
-                                             unitMetricHwHostEnergy);
+  return meter->CreateInt64ObservableGauge(kMetricHwFanSpeedLimit, descrMetricHwFanSpeedLimit,
+                                           unitMetricHwFanSpeedLimit);
 }
 
-static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwHostEnergy(
-    metrics::Meter *meter)
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwFanSpeedLimit(metrics::Meter *meter)
 {
-  return meter->CreateDoubleObservableCounter(kMetricHwHostEnergy, descrMetricHwHostEnergy,
-                                              unitMetricHwHostEnergy);
+  return meter->CreateDoubleObservableGauge(kMetricHwFanSpeedLimit, descrMetricHwFanSpeedLimit,
+                                            unitMetricHwFanSpeedLimit);
 }
 
 /**
-  By how many degrees Celsius the temperature of the physical host can be increased, before reaching
-  a warning threshold on one of the internal sensors <p> gauge
+  Fan speed expressed as a fraction of its maximum speed.
+  <p>
+  gauge
  */
-static constexpr const char *kMetricHwHostHeatingMargin = "hw.host.heating_margin";
-static constexpr const char *descrMetricHwHostHeatingMargin =
-    "By how many degrees Celsius the temperature of the physical host can be increased, before reaching a warning threshold on one of the internal sensors
-    ";
-    static constexpr const char *unitMetricHwHostHeatingMargin = "Cel";
+static constexpr const char *kMetricHwFanSpeedRatio = "hw.fan.speed_ratio";
+static constexpr const char *descrMetricHwFanSpeedRatio =
+    "Fan speed expressed as a fraction of its maximum speed.";
+static constexpr const char *unitMetricHwFanSpeedRatio = "1";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
 
-static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwHostHeatingMargin(
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwFanSpeedRatio(
     metrics::Meter *meter)
 {
-  return meter->CreateInt64Gauge(kMetricHwHostHeatingMargin, descrMetricHwHostHeatingMargin,
-                                 unitMetricHwHostHeatingMargin);
+  return meter->CreateInt64Gauge(kMetricHwFanSpeedRatio, descrMetricHwFanSpeedRatio,
+                                 unitMetricHwFanSpeedRatio);
 }
 
-static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwHostHeatingMargin(
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwFanSpeedRatio(
     metrics::Meter *meter)
 {
-  return meter->CreateDoubleGauge(kMetricHwHostHeatingMargin, descrMetricHwHostHeatingMargin,
-                                  unitMetricHwHostHeatingMargin);
+  return meter->CreateDoubleGauge(kMetricHwFanSpeedRatio, descrMetricHwFanSpeedRatio,
+                                  unitMetricHwFanSpeedRatio);
 }
 #endif /* OPENTELEMETRY_ABI_VERSION_NO */
 
 static inline nostd::shared_ptr<metrics::ObservableInstrument>
-CreateAsyncInt64MetricHwHostHeatingMargin(metrics::Meter *meter)
+CreateAsyncInt64MetricHwFanSpeedRatio(metrics::Meter *meter)
 {
-  return meter->CreateInt64ObservableGauge(
-      kMetricHwHostHeatingMargin, descrMetricHwHostHeatingMargin, unitMetricHwHostHeatingMargin);
+  return meter->CreateInt64ObservableGauge(kMetricHwFanSpeedRatio, descrMetricHwFanSpeedRatio,
+                                           unitMetricHwFanSpeedRatio);
 }
 
 static inline nostd::shared_ptr<metrics::ObservableInstrument>
-CreateAsyncDoubleMetricHwHostHeatingMargin(metrics::Meter *meter)
+CreateAsyncDoubleMetricHwFanSpeedRatio(metrics::Meter *meter)
 {
-  return meter->CreateDoubleObservableGauge(
-      kMetricHwHostHeatingMargin, descrMetricHwHostHeatingMargin, unitMetricHwHostHeatingMargin);
+  return meter->CreateDoubleObservableGauge(kMetricHwFanSpeedRatio, descrMetricHwFanSpeedRatio,
+                                            unitMetricHwFanSpeedRatio);
 }
 
 /**
-  Instantaneous power consumed by the entire physical host in Watts (@code hw.host.energy @endcode
-  is preferred) <p> The overall energy usage of a host MUST be reported using the specific @code
-  hw.host.energy @endcode and @code hw.host.power @endcode metrics <strong>only</strong>, instead of
-  the generic @code hw.energy @endcode and @code hw.power @endcode described in the previous
-  section, to prevent summing up overlapping values. <p> gauge
+  Received and transmitted bytes by the GPU.
+  <p>
+  counter
  */
-static constexpr const char *kMetricHwHostPower = "hw.host.power";
-static constexpr const char *descrMetricHwHostPower =
-    "Instantaneous power consumed by the entire physical host in Watts (`hw.host.energy` is preferred)
-    ";
-    static constexpr const char *unitMetricHwHostPower = "W";
-
-#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+static constexpr const char *kMetricHwGpuIo     = "hw.gpu.io";
+static constexpr const char *descrMetricHwGpuIo = "Received and transmitted bytes by the GPU.";
+static constexpr const char *unitMetricHwGpuIo  = "By";
 
-static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwHostPower(
+static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricHwGpuIo(
     metrics::Meter *meter)
 {
-  return meter->CreateInt64Gauge(kMetricHwHostPower, descrMetricHwHostPower, unitMetricHwHostPower);
+  return meter->CreateUInt64Counter(kMetricHwGpuIo, descrMetricHwGpuIo, unitMetricHwGpuIo);
 }
 
-static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwHostPower(
+static inline nostd::unique_ptr<metrics::Counter<double>> CreateSyncDoubleMetricHwGpuIo(
     metrics::Meter *meter)
 {
-  return meter->CreateDoubleGauge(kMetricHwHostPower, descrMetricHwHostPower,
-                                  unitMetricHwHostPower);
+  return meter->CreateDoubleCounter(kMetricHwGpuIo, descrMetricHwGpuIo, unitMetricHwGpuIo);
 }
-#endif /* OPENTELEMETRY_ABI_VERSION_NO */
 
-static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwHostPower(
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwGpuIo(
     metrics::Meter *meter)
 {
-  return meter->CreateInt64ObservableGauge(kMetricHwHostPower, descrMetricHwHostPower,
-                                           unitMetricHwHostPower);
+  return meter->CreateInt64ObservableCounter(kMetricHwGpuIo, descrMetricHwGpuIo, unitMetricHwGpuIo);
 }
 
-static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwHostPower(
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwGpuIo(
     metrics::Meter *meter)
 {
-  return meter->CreateDoubleObservableGauge(kMetricHwHostPower, descrMetricHwHostPower,
-                                            unitMetricHwHostPower);
+  return meter->CreateDoubleObservableCounter(kMetricHwGpuIo, descrMetricHwGpuIo,
+                                              unitMetricHwGpuIo);
 }
 
 /**
-  Instantaneous power consumed by the component
+  Size of the GPU memory.
   <p>
-  It is recommended to report @code hw.energy @endcode instead of @code hw.power @endcode when
-  possible. <p> gauge
+  updowncounter
  */
-static constexpr const char *kMetricHwPower     = "hw.power";
-static constexpr const char *descrMetricHwPower = "Instantaneous power consumed by the component";
-static constexpr const char *unitMetricHwPower  = "W";
+static constexpr const char *kMetricHwGpuMemoryLimit     = "hw.gpu.memory.limit";
+static constexpr const char *descrMetricHwGpuMemoryLimit = "Size of the GPU memory.";
+static constexpr const char *unitMetricHwGpuMemoryLimit  = "By";
 
-#if OPENTELEMETRY_ABI_VERSION_NO >= 2
-
-static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwPower(
-    metrics::Meter *meter)
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricHwGpuMemoryLimit(metrics::Meter *meter)
 {
-  return meter->CreateInt64Gauge(kMetricHwPower, descrMetricHwPower, unitMetricHwPower);
+  return meter->CreateInt64UpDownCounter(kMetricHwGpuMemoryLimit, descrMetricHwGpuMemoryLimit,
+                                         unitMetricHwGpuMemoryLimit);
 }
 
-static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwPower(
-    metrics::Meter *meter)
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricHwGpuMemoryLimit(metrics::Meter *meter)
 {
-  return meter->CreateDoubleGauge(kMetricHwPower, descrMetricHwPower, unitMetricHwPower);
+  return meter->CreateDoubleUpDownCounter(kMetricHwGpuMemoryLimit, descrMetricHwGpuMemoryLimit,
+                                          unitMetricHwGpuMemoryLimit);
 }
-#endif /* OPENTELEMETRY_ABI_VERSION_NO */
 
-static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwPower(
-    metrics::Meter *meter)
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwGpuMemoryLimit(metrics::Meter *meter)
 {
-  return meter->CreateInt64ObservableGauge(kMetricHwPower, descrMetricHwPower, unitMetricHwPower);
+  return meter->CreateInt64ObservableUpDownCounter(
+      kMetricHwGpuMemoryLimit, descrMetricHwGpuMemoryLimit, unitMetricHwGpuMemoryLimit);
 }
 
-static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwPower(
-    metrics::Meter *meter)
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwGpuMemoryLimit(metrics::Meter *meter)
 {
-  return meter->CreateDoubleObservableGauge(kMetricHwPower, descrMetricHwPower, unitMetricHwPower);
+  return meter->CreateDoubleObservableUpDownCounter(
+      kMetricHwGpuMemoryLimit, descrMetricHwGpuMemoryLimit, unitMetricHwGpuMemoryLimit);
 }
 
 /**
-  Operational status: @code 1 @endcode (true) or @code 0 @endcode (false) for each of the possible
-  states <p>
-  @code hw.status @endcode is currently specified as an <em>UpDownCounter</em> but would ideally be
-  represented using a <a
-  href="https://github.com/prometheus/OpenMetrics/blob/v1.0.0/specification/OpenMetrics.md#stateset"><em>StateSet</em>
-  as defined in OpenMetrics</a>. This semantic convention will be updated once <em>StateSet</em> is
-  specified in OpenTelemetry. This planned change is not expected to have any consequence on the way
-  users query their timeseries backend to retrieve the values of @code hw.status @endcode over time.
+  GPU memory used.
   <p>
   updowncounter
  */
-static constexpr const char *kMetricHwStatus = "hw.status";
-static constexpr const char *descrMetricHwStatus =
-    "Operational status: `1` (true) or `0` (false) for each of the possible states";
-static constexpr const char *unitMetricHwStatus = "1";
+static constexpr const char *kMetricHwGpuMemoryUsage     = "hw.gpu.memory.usage";
+static constexpr const char *descrMetricHwGpuMemoryUsage = "GPU memory used.";
+static constexpr const char *unitMetricHwGpuMemoryUsage  = "By";
 
-static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>> CreateSyncInt64MetricHwStatus(
-    metrics::Meter *meter)
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricHwGpuMemoryUsage(metrics::Meter *meter)
 {
-  return meter->CreateInt64UpDownCounter(kMetricHwStatus, descrMetricHwStatus, unitMetricHwStatus);
+  return meter->CreateInt64UpDownCounter(kMetricHwGpuMemoryUsage, descrMetricHwGpuMemoryUsage,
+                                         unitMetricHwGpuMemoryUsage);
 }
 
-static inline nostd::unique_ptr<metrics::UpDownCounter<double>> CreateSyncDoubleMetricHwStatus(
-    metrics::Meter *meter)
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricHwGpuMemoryUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricHwGpuMemoryUsage, descrMetricHwGpuMemoryUsage,
+                                          unitMetricHwGpuMemoryUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwGpuMemoryUsage(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(
+      kMetricHwGpuMemoryUsage, descrMetricHwGpuMemoryUsage, unitMetricHwGpuMemoryUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwGpuMemoryUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(
+      kMetricHwGpuMemoryUsage, descrMetricHwGpuMemoryUsage, unitMetricHwGpuMemoryUsage);
+}
+
+/**
+  Fraction of GPU memory used.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwGpuMemoryUtilization     = "hw.gpu.memory.utilization";
+static constexpr const char *descrMetricHwGpuMemoryUtilization = "Fraction of GPU memory used.";
+static constexpr const char *unitMetricHwGpuMemoryUtilization  = "1";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>>
+CreateSyncInt64MetricHwGpuMemoryUtilization(metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwGpuMemoryUtilization, descrMetricHwGpuMemoryUtilization,
+                                 unitMetricHwGpuMemoryUtilization);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>>
+CreateSyncDoubleMetricHwGpuMemoryUtilization(metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwGpuMemoryUtilization, descrMetricHwGpuMemoryUtilization,
+                                  unitMetricHwGpuMemoryUtilization);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwGpuMemoryUtilization(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwGpuMemoryUtilization,
+                                           descrMetricHwGpuMemoryUtilization,
+                                           unitMetricHwGpuMemoryUtilization);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwGpuMemoryUtilization(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwGpuMemoryUtilization,
+                                            descrMetricHwGpuMemoryUtilization,
+                                            unitMetricHwGpuMemoryUtilization);
+}
+
+/**
+  Fraction of time spent in a specific task.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwGpuUtilization = "hw.gpu.utilization";
+static constexpr const char *descrMetricHwGpuUtilization =
+    "Fraction of time spent in a specific task.";
+static constexpr const char *unitMetricHwGpuUtilization = "1";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwGpuUtilization(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwGpuUtilization, descrMetricHwGpuUtilization,
+                                 unitMetricHwGpuUtilization);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwGpuUtilization(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwGpuUtilization, descrMetricHwGpuUtilization,
+                                  unitMetricHwGpuUtilization);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwGpuUtilization(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwGpuUtilization, descrMetricHwGpuUtilization,
+                                           unitMetricHwGpuUtilization);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwGpuUtilization(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwGpuUtilization, descrMetricHwGpuUtilization,
+                                            unitMetricHwGpuUtilization);
+}
+
+/**
+  Ambient (external) temperature of the physical host.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwHostAmbientTemperature = "hw.host.ambient_temperature";
+static constexpr const char *descrMetricHwHostAmbientTemperature =
+    "Ambient (external) temperature of the physical host.";
+static constexpr const char *unitMetricHwHostAmbientTemperature = "Cel";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>>
+CreateSyncInt64MetricHwHostAmbientTemperature(metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwHostAmbientTemperature,
+                                 descrMetricHwHostAmbientTemperature,
+                                 unitMetricHwHostAmbientTemperature);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>>
+CreateSyncDoubleMetricHwHostAmbientTemperature(metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwHostAmbientTemperature,
+                                  descrMetricHwHostAmbientTemperature,
+                                  unitMetricHwHostAmbientTemperature);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwHostAmbientTemperature(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwHostAmbientTemperature,
+                                           descrMetricHwHostAmbientTemperature,
+                                           unitMetricHwHostAmbientTemperature);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwHostAmbientTemperature(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwHostAmbientTemperature,
+                                            descrMetricHwHostAmbientTemperature,
+                                            unitMetricHwHostAmbientTemperature);
+}
+
+/**
+  Total energy consumed by the entire physical host, in joules.
+  <p>
+  The overall energy usage of a host MUST be reported using the specific @code hw.host.energy
+  @endcode and @code hw.host.power @endcode metrics <strong>only</strong>, instead of the generic
+  @code hw.energy @endcode and @code hw.power @endcode described in the previous section, to prevent
+  summing up overlapping values. <p> counter
+ */
+static constexpr const char *kMetricHwHostEnergy = "hw.host.energy";
+static constexpr const char *descrMetricHwHostEnergy =
+    "Total energy consumed by the entire physical host, in joules.";
+static constexpr const char *unitMetricHwHostEnergy = "J";
+
+static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricHwHostEnergy(
+    metrics::Meter *meter)
+{
+  return meter->CreateUInt64Counter(kMetricHwHostEnergy, descrMetricHwHostEnergy,
+                                    unitMetricHwHostEnergy);
+}
+
+static inline nostd::unique_ptr<metrics::Counter<double>> CreateSyncDoubleMetricHwHostEnergy(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleCounter(kMetricHwHostEnergy, descrMetricHwHostEnergy,
+                                    unitMetricHwHostEnergy);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwHostEnergy(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableCounter(kMetricHwHostEnergy, descrMetricHwHostEnergy,
+                                             unitMetricHwHostEnergy);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwHostEnergy(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableCounter(kMetricHwHostEnergy, descrMetricHwHostEnergy,
+                                              unitMetricHwHostEnergy);
+}
+
+/**
+  By how many degrees Celsius the temperature of the physical host can be increased, before reaching
+  a warning threshold on one of the internal sensors. <p> gauge
+ */
+static constexpr const char *kMetricHwHostHeatingMargin = "hw.host.heating_margin";
+static constexpr const char *descrMetricHwHostHeatingMargin =
+    "By how many degrees Celsius the temperature of the physical host can be increased, before reaching a warning threshold on one of the internal sensors.
+    ";
+    static constexpr const char *unitMetricHwHostHeatingMargin = "Cel";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwHostHeatingMargin(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwHostHeatingMargin, descrMetricHwHostHeatingMargin,
+                                 unitMetricHwHostHeatingMargin);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwHostHeatingMargin(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwHostHeatingMargin, descrMetricHwHostHeatingMargin,
+                                  unitMetricHwHostHeatingMargin);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwHostHeatingMargin(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(
+      kMetricHwHostHeatingMargin, descrMetricHwHostHeatingMargin, unitMetricHwHostHeatingMargin);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwHostHeatingMargin(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(
+      kMetricHwHostHeatingMargin, descrMetricHwHostHeatingMargin, unitMetricHwHostHeatingMargin);
+}
+
+/**
+  Instantaneous power consumed by the entire physical host in Watts (@code hw.host.energy @endcode
+  is preferred). <p> The overall energy usage of a host MUST be reported using the specific @code
+  hw.host.energy @endcode and @code hw.host.power @endcode metrics <strong>only</strong>, instead of
+  the generic @code hw.energy @endcode and @code hw.power @endcode described in the previous
+  section, to prevent summing up overlapping values. <p> gauge
+ */
+static constexpr const char *kMetricHwHostPower = "hw.host.power";
+static constexpr const char *descrMetricHwHostPower =
+    "Instantaneous power consumed by the entire physical host in Watts (`hw.host.energy` is preferred).
+    ";
+    static constexpr const char *unitMetricHwHostPower = "W";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwHostPower(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwHostPower, descrMetricHwHostPower, unitMetricHwHostPower);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwHostPower(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwHostPower, descrMetricHwHostPower,
+                                  unitMetricHwHostPower);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwHostPower(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwHostPower, descrMetricHwHostPower,
+                                           unitMetricHwHostPower);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwHostPower(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwHostPower, descrMetricHwHostPower,
+                                            unitMetricHwHostPower);
+}
+
+/**
+  Size of the logical disk.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricHwLogicalDiskLimit     = "hw.logical_disk.limit";
+static constexpr const char *descrMetricHwLogicalDiskLimit = "Size of the logical disk.";
+static constexpr const char *unitMetricHwLogicalDiskLimit  = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricHwLogicalDiskLimit(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricHwLogicalDiskLimit, descrMetricHwLogicalDiskLimit,
+                                         unitMetricHwLogicalDiskLimit);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricHwLogicalDiskLimit(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricHwLogicalDiskLimit, descrMetricHwLogicalDiskLimit,
+                                          unitMetricHwLogicalDiskLimit);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwLogicalDiskLimit(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(
+      kMetricHwLogicalDiskLimit, descrMetricHwLogicalDiskLimit, unitMetricHwLogicalDiskLimit);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwLogicalDiskLimit(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(
+      kMetricHwLogicalDiskLimit, descrMetricHwLogicalDiskLimit, unitMetricHwLogicalDiskLimit);
+}
+
+/**
+  Logical disk space usage.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricHwLogicalDiskUsage     = "hw.logical_disk.usage";
+static constexpr const char *descrMetricHwLogicalDiskUsage = "Logical disk space usage.";
+static constexpr const char *unitMetricHwLogicalDiskUsage  = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricHwLogicalDiskUsage(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricHwLogicalDiskUsage, descrMetricHwLogicalDiskUsage,
+                                         unitMetricHwLogicalDiskUsage);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricHwLogicalDiskUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricHwLogicalDiskUsage, descrMetricHwLogicalDiskUsage,
+                                          unitMetricHwLogicalDiskUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwLogicalDiskUsage(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(
+      kMetricHwLogicalDiskUsage, descrMetricHwLogicalDiskUsage, unitMetricHwLogicalDiskUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwLogicalDiskUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(
+      kMetricHwLogicalDiskUsage, descrMetricHwLogicalDiskUsage, unitMetricHwLogicalDiskUsage);
+}
+
+/**
+  Logical disk space utilization as a fraction.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwLogicalDiskUtilization = "hw.logical_disk.utilization";
+static constexpr const char *descrMetricHwLogicalDiskUtilization =
+    "Logical disk space utilization as a fraction.";
+static constexpr const char *unitMetricHwLogicalDiskUtilization = "1";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>>
+CreateSyncInt64MetricHwLogicalDiskUtilization(metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwLogicalDiskUtilization,
+                                 descrMetricHwLogicalDiskUtilization,
+                                 unitMetricHwLogicalDiskUtilization);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>>
+CreateSyncDoubleMetricHwLogicalDiskUtilization(metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwLogicalDiskUtilization,
+                                  descrMetricHwLogicalDiskUtilization,
+                                  unitMetricHwLogicalDiskUtilization);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwLogicalDiskUtilization(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwLogicalDiskUtilization,
+                                           descrMetricHwLogicalDiskUtilization,
+                                           unitMetricHwLogicalDiskUtilization);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwLogicalDiskUtilization(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwLogicalDiskUtilization,
+                                            descrMetricHwLogicalDiskUtilization,
+                                            unitMetricHwLogicalDiskUtilization);
+}
+
+/**
+  Size of the memory module.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricHwMemorySize     = "hw.memory.size";
+static constexpr const char *descrMetricHwMemorySize = "Size of the memory module.";
+static constexpr const char *unitMetricHwMemorySize  = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>> CreateSyncInt64MetricHwMemorySize(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricHwMemorySize, descrMetricHwMemorySize,
+                                         unitMetricHwMemorySize);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>> CreateSyncDoubleMetricHwMemorySize(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricHwMemorySize, descrMetricHwMemorySize,
+                                          unitMetricHwMemorySize);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwMemorySize(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricHwMemorySize, descrMetricHwMemorySize,
+                                                   unitMetricHwMemorySize);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwMemorySize(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricHwMemorySize, descrMetricHwMemorySize,
+                                                    unitMetricHwMemorySize);
+}
+
+/**
+  Link speed.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricHwNetworkBandwidthLimit     = "hw.network.bandwidth.limit";
+static constexpr const char *descrMetricHwNetworkBandwidthLimit = "Link speed.";
+static constexpr const char *unitMetricHwNetworkBandwidthLimit  = "By/s";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricHwNetworkBandwidthLimit(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricHwNetworkBandwidthLimit,
+                                         descrMetricHwNetworkBandwidthLimit,
+                                         unitMetricHwNetworkBandwidthLimit);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricHwNetworkBandwidthLimit(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricHwNetworkBandwidthLimit,
+                                          descrMetricHwNetworkBandwidthLimit,
+                                          unitMetricHwNetworkBandwidthLimit);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwNetworkBandwidthLimit(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricHwNetworkBandwidthLimit,
+                                                   descrMetricHwNetworkBandwidthLimit,
+                                                   unitMetricHwNetworkBandwidthLimit);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwNetworkBandwidthLimit(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricHwNetworkBandwidthLimit,
+                                                    descrMetricHwNetworkBandwidthLimit,
+                                                    unitMetricHwNetworkBandwidthLimit);
+}
+
+/**
+  Utilization of the network bandwidth as a fraction.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwNetworkBandwidthUtilization =
+    "hw.network.bandwidth.utilization";
+static constexpr const char *descrMetricHwNetworkBandwidthUtilization =
+    "Utilization of the network bandwidth as a fraction.";
+static constexpr const char *unitMetricHwNetworkBandwidthUtilization = "1";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>>
+CreateSyncInt64MetricHwNetworkBandwidthUtilization(metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwNetworkBandwidthUtilization,
+                                 descrMetricHwNetworkBandwidthUtilization,
+                                 unitMetricHwNetworkBandwidthUtilization);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>>
+CreateSyncDoubleMetricHwNetworkBandwidthUtilization(metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwNetworkBandwidthUtilization,
+                                  descrMetricHwNetworkBandwidthUtilization,
+                                  unitMetricHwNetworkBandwidthUtilization);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwNetworkBandwidthUtilization(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwNetworkBandwidthUtilization,
+                                           descrMetricHwNetworkBandwidthUtilization,
+                                           unitMetricHwNetworkBandwidthUtilization);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwNetworkBandwidthUtilization(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwNetworkBandwidthUtilization,
+                                            descrMetricHwNetworkBandwidthUtilization,
+                                            unitMetricHwNetworkBandwidthUtilization);
+}
+
+/**
+  Received and transmitted network traffic in bytes.
+  <p>
+  counter
+ */
+static constexpr const char *kMetricHwNetworkIo = "hw.network.io";
+static constexpr const char *descrMetricHwNetworkIo =
+    "Received and transmitted network traffic in bytes.";
+static constexpr const char *unitMetricHwNetworkIo = "By";
+
+static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricHwNetworkIo(
+    metrics::Meter *meter)
+{
+  return meter->CreateUInt64Counter(kMetricHwNetworkIo, descrMetricHwNetworkIo,
+                                    unitMetricHwNetworkIo);
+}
+
+static inline nostd::unique_ptr<metrics::Counter<double>> CreateSyncDoubleMetricHwNetworkIo(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleCounter(kMetricHwNetworkIo, descrMetricHwNetworkIo,
+                                    unitMetricHwNetworkIo);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwNetworkIo(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableCounter(kMetricHwNetworkIo, descrMetricHwNetworkIo,
+                                             unitMetricHwNetworkIo);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwNetworkIo(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableCounter(kMetricHwNetworkIo, descrMetricHwNetworkIo,
+                                              unitMetricHwNetworkIo);
+}
+
+/**
+  Received and transmitted network traffic in packets (or frames).
+  <p>
+  counter
+ */
+static constexpr const char *kMetricHwNetworkPackets = "hw.network.packets";
+static constexpr const char *descrMetricHwNetworkPackets =
+    "Received and transmitted network traffic in packets (or frames).";
+static constexpr const char *unitMetricHwNetworkPackets = "{packet}";
+
+static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricHwNetworkPackets(
+    metrics::Meter *meter)
+{
+  return meter->CreateUInt64Counter(kMetricHwNetworkPackets, descrMetricHwNetworkPackets,
+                                    unitMetricHwNetworkPackets);
+}
+
+static inline nostd::unique_ptr<metrics::Counter<double>> CreateSyncDoubleMetricHwNetworkPackets(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleCounter(kMetricHwNetworkPackets, descrMetricHwNetworkPackets,
+                                    unitMetricHwNetworkPackets);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwNetworkPackets(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableCounter(kMetricHwNetworkPackets, descrMetricHwNetworkPackets,
+                                             unitMetricHwNetworkPackets);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwNetworkPackets(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableCounter(kMetricHwNetworkPackets, descrMetricHwNetworkPackets,
+                                              unitMetricHwNetworkPackets);
+}
+
+/**
+  Link status: @code 1 @endcode (up) or @code 0 @endcode (down).
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricHwNetworkUp     = "hw.network.up";
+static constexpr const char *descrMetricHwNetworkUp = "Link status: `1` (up) or `0` (down).";
+static constexpr const char *unitMetricHwNetworkUp  = "1";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>> CreateSyncInt64MetricHwNetworkUp(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricHwNetworkUp, descrMetricHwNetworkUp,
+                                         unitMetricHwNetworkUp);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>> CreateSyncDoubleMetricHwNetworkUp(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricHwNetworkUp, descrMetricHwNetworkUp,
+                                          unitMetricHwNetworkUp);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwNetworkUp(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricHwNetworkUp, descrMetricHwNetworkUp,
+                                                   unitMetricHwNetworkUp);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwNetworkUp(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricHwNetworkUp, descrMetricHwNetworkUp,
+                                                    unitMetricHwNetworkUp);
+}
+
+/**
+  Endurance remaining for this SSD disk.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwPhysicalDiskEnduranceUtilization =
+    "hw.physical_disk.endurance_utilization";
+static constexpr const char *descrMetricHwPhysicalDiskEnduranceUtilization =
+    "Endurance remaining for this SSD disk.";
+static constexpr const char *unitMetricHwPhysicalDiskEnduranceUtilization = "1";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>>
+CreateSyncInt64MetricHwPhysicalDiskEnduranceUtilization(metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwPhysicalDiskEnduranceUtilization,
+                                 descrMetricHwPhysicalDiskEnduranceUtilization,
+                                 unitMetricHwPhysicalDiskEnduranceUtilization);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>>
+CreateSyncDoubleMetricHwPhysicalDiskEnduranceUtilization(metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwPhysicalDiskEnduranceUtilization,
+                                  descrMetricHwPhysicalDiskEnduranceUtilization,
+                                  unitMetricHwPhysicalDiskEnduranceUtilization);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwPhysicalDiskEnduranceUtilization(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwPhysicalDiskEnduranceUtilization,
+                                           descrMetricHwPhysicalDiskEnduranceUtilization,
+                                           unitMetricHwPhysicalDiskEnduranceUtilization);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwPhysicalDiskEnduranceUtilization(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwPhysicalDiskEnduranceUtilization,
+                                            descrMetricHwPhysicalDiskEnduranceUtilization,
+                                            unitMetricHwPhysicalDiskEnduranceUtilization);
+}
+
+/**
+  Size of the disk.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricHwPhysicalDiskSize     = "hw.physical_disk.size";
+static constexpr const char *descrMetricHwPhysicalDiskSize = "Size of the disk.";
+static constexpr const char *unitMetricHwPhysicalDiskSize  = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricHwPhysicalDiskSize(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricHwPhysicalDiskSize, descrMetricHwPhysicalDiskSize,
+                                         unitMetricHwPhysicalDiskSize);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricHwPhysicalDiskSize(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricHwPhysicalDiskSize, descrMetricHwPhysicalDiskSize,
+                                          unitMetricHwPhysicalDiskSize);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwPhysicalDiskSize(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(
+      kMetricHwPhysicalDiskSize, descrMetricHwPhysicalDiskSize, unitMetricHwPhysicalDiskSize);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwPhysicalDiskSize(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(
+      kMetricHwPhysicalDiskSize, descrMetricHwPhysicalDiskSize, unitMetricHwPhysicalDiskSize);
+}
+
+/**
+  Value of the corresponding <a href="https://wikipedia.org/wiki/S.M.A.R.T.">S.M.A.R.T.</a>
+  (Self-Monitoring, Analysis, and Reporting Technology) attribute. <p> gauge
+ */
+static constexpr const char *kMetricHwPhysicalDiskSmart = "hw.physical_disk.smart";
+static constexpr const char *descrMetricHwPhysicalDiskSmart =
+    "Value of the corresponding [S.M.A.R.T.](https://wikipedia.org/wiki/S.M.A.R.T.) "
+    "(Self-Monitoring, Analysis, and Reporting Technology) attribute.";
+static constexpr const char *unitMetricHwPhysicalDiskSmart = "1";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwPhysicalDiskSmart(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwPhysicalDiskSmart, descrMetricHwPhysicalDiskSmart,
+                                 unitMetricHwPhysicalDiskSmart);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwPhysicalDiskSmart(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwPhysicalDiskSmart, descrMetricHwPhysicalDiskSmart,
+                                  unitMetricHwPhysicalDiskSmart);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwPhysicalDiskSmart(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(
+      kMetricHwPhysicalDiskSmart, descrMetricHwPhysicalDiskSmart, unitMetricHwPhysicalDiskSmart);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwPhysicalDiskSmart(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(
+      kMetricHwPhysicalDiskSmart, descrMetricHwPhysicalDiskSmart, unitMetricHwPhysicalDiskSmart);
+}
+
+/**
+  Instantaneous power consumed by the component.
+  <p>
+  It is recommended to report @code hw.energy @endcode instead of @code hw.power @endcode when
+  possible. <p> gauge
+ */
+static constexpr const char *kMetricHwPower     = "hw.power";
+static constexpr const char *descrMetricHwPower = "Instantaneous power consumed by the component.";
+static constexpr const char *unitMetricHwPower  = "W";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwPower(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwPower, descrMetricHwPower, unitMetricHwPower);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwPower(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwPower, descrMetricHwPower, unitMetricHwPower);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwPower(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwPower, descrMetricHwPower, unitMetricHwPower);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwPower(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwPower, descrMetricHwPower, unitMetricHwPower);
+}
+
+/**
+  Maximum power output of the power supply.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricHwPowerSupplyLimit = "hw.power_supply.limit";
+static constexpr const char *descrMetricHwPowerSupplyLimit =
+    "Maximum power output of the power supply.";
+static constexpr const char *unitMetricHwPowerSupplyLimit = "W";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricHwPowerSupplyLimit(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricHwPowerSupplyLimit, descrMetricHwPowerSupplyLimit,
+                                         unitMetricHwPowerSupplyLimit);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricHwPowerSupplyLimit(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricHwPowerSupplyLimit, descrMetricHwPowerSupplyLimit,
+                                          unitMetricHwPowerSupplyLimit);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwPowerSupplyLimit(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(
+      kMetricHwPowerSupplyLimit, descrMetricHwPowerSupplyLimit, unitMetricHwPowerSupplyLimit);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwPowerSupplyLimit(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(
+      kMetricHwPowerSupplyLimit, descrMetricHwPowerSupplyLimit, unitMetricHwPowerSupplyLimit);
+}
+
+/**
+  Current power output of the power supply.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricHwPowerSupplyUsage = "hw.power_supply.usage";
+static constexpr const char *descrMetricHwPowerSupplyUsage =
+    "Current power output of the power supply.";
+static constexpr const char *unitMetricHwPowerSupplyUsage = "W";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricHwPowerSupplyUsage(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricHwPowerSupplyUsage, descrMetricHwPowerSupplyUsage,
+                                         unitMetricHwPowerSupplyUsage);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricHwPowerSupplyUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricHwPowerSupplyUsage, descrMetricHwPowerSupplyUsage,
+                                          unitMetricHwPowerSupplyUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwPowerSupplyUsage(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(
+      kMetricHwPowerSupplyUsage, descrMetricHwPowerSupplyUsage, unitMetricHwPowerSupplyUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwPowerSupplyUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(
+      kMetricHwPowerSupplyUsage, descrMetricHwPowerSupplyUsage, unitMetricHwPowerSupplyUsage);
+}
+
+/**
+  Utilization of the power supply as a fraction of its maximum output.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwPowerSupplyUtilization = "hw.power_supply.utilization";
+static constexpr const char *descrMetricHwPowerSupplyUtilization =
+    "Utilization of the power supply as a fraction of its maximum output.";
+static constexpr const char *unitMetricHwPowerSupplyUtilization = "1";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>>
+CreateSyncInt64MetricHwPowerSupplyUtilization(metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwPowerSupplyUtilization,
+                                 descrMetricHwPowerSupplyUtilization,
+                                 unitMetricHwPowerSupplyUtilization);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>>
+CreateSyncDoubleMetricHwPowerSupplyUtilization(metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwPowerSupplyUtilization,
+                                  descrMetricHwPowerSupplyUtilization,
+                                  unitMetricHwPowerSupplyUtilization);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwPowerSupplyUtilization(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwPowerSupplyUtilization,
+                                           descrMetricHwPowerSupplyUtilization,
+                                           unitMetricHwPowerSupplyUtilization);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwPowerSupplyUtilization(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwPowerSupplyUtilization,
+                                            descrMetricHwPowerSupplyUtilization,
+                                            unitMetricHwPowerSupplyUtilization);
+}
+
+/**
+  Operational status: @code 1 @endcode (true) or @code 0 @endcode (false) for each of the possible
+  states. <p>
+  @code hw.status @endcode is currently specified as an <em>UpDownCounter</em> but would ideally be
+  represented using a <a
+  href="https://github.com/prometheus/OpenMetrics/blob/v1.0.0/specification/OpenMetrics.md#stateset"><em>StateSet</em>
+  as defined in OpenMetrics</a>. This semantic convention will be updated once <em>StateSet</em> is
+  specified in OpenTelemetry. This planned change is not expected to have any consequence on the way
+  users query their timeseries backend to retrieve the values of @code hw.status @endcode over time.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricHwStatus = "hw.status";
+static constexpr const char *descrMetricHwStatus =
+    "Operational status: `1` (true) or `0` (false) for each of the possible states.";
+static constexpr const char *unitMetricHwStatus = "1";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>> CreateSyncInt64MetricHwStatus(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricHwStatus, descrMetricHwStatus, unitMetricHwStatus);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>> CreateSyncDoubleMetricHwStatus(
+    metrics::Meter *meter)
 {
   return meter->CreateDoubleUpDownCounter(kMetricHwStatus, descrMetricHwStatus, unitMetricHwStatus);
 }
@@ -340,6 +1451,245 @@ static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDouble
                                                     unitMetricHwStatus);
 }
 
+/**
+  Operations performed by the tape drive.
+  <p>
+  counter
+ */
+static constexpr const char *kMetricHwTapeDriveOperations = "hw.tape_drive.operations";
+static constexpr const char *descrMetricHwTapeDriveOperations =
+    "Operations performed by the tape drive.";
+static constexpr const char *unitMetricHwTapeDriveOperations = "{operation}";
+
+static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
+CreateSyncInt64MetricHwTapeDriveOperations(metrics::Meter *meter)
+{
+  return meter->CreateUInt64Counter(kMetricHwTapeDriveOperations, descrMetricHwTapeDriveOperations,
+                                    unitMetricHwTapeDriveOperations);
+}
+
+static inline nostd::unique_ptr<metrics::Counter<double>>
+CreateSyncDoubleMetricHwTapeDriveOperations(metrics::Meter *meter)
+{
+  return meter->CreateDoubleCounter(kMetricHwTapeDriveOperations, descrMetricHwTapeDriveOperations,
+                                    unitMetricHwTapeDriveOperations);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwTapeDriveOperations(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableCounter(kMetricHwTapeDriveOperations,
+                                             descrMetricHwTapeDriveOperations,
+                                             unitMetricHwTapeDriveOperations);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwTapeDriveOperations(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableCounter(kMetricHwTapeDriveOperations,
+                                              descrMetricHwTapeDriveOperations,
+                                              unitMetricHwTapeDriveOperations);
+}
+
+/**
+  Temperature in degrees Celsius.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwTemperature     = "hw.temperature";
+static constexpr const char *descrMetricHwTemperature = "Temperature in degrees Celsius.";
+static constexpr const char *unitMetricHwTemperature  = "Cel";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwTemperature(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwTemperature, descrMetricHwTemperature,
+                                 unitMetricHwTemperature);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwTemperature(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwTemperature, descrMetricHwTemperature,
+                                  unitMetricHwTemperature);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwTemperature(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwTemperature, descrMetricHwTemperature,
+                                           unitMetricHwTemperature);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwTemperature(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwTemperature, descrMetricHwTemperature,
+                                            unitMetricHwTemperature);
+}
+
+/**
+  Temperature limit in degrees Celsius.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwTemperatureLimit = "hw.temperature.limit";
+static constexpr const char *descrMetricHwTemperatureLimit =
+    "Temperature limit in degrees Celsius.";
+static constexpr const char *unitMetricHwTemperatureLimit = "Cel";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwTemperatureLimit(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwTemperatureLimit, descrMetricHwTemperatureLimit,
+                                 unitMetricHwTemperatureLimit);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwTemperatureLimit(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwTemperatureLimit, descrMetricHwTemperatureLimit,
+                                  unitMetricHwTemperatureLimit);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwTemperatureLimit(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwTemperatureLimit, descrMetricHwTemperatureLimit,
+                                           unitMetricHwTemperatureLimit);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwTemperatureLimit(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(
+      kMetricHwTemperatureLimit, descrMetricHwTemperatureLimit, unitMetricHwTemperatureLimit);
+}
+
+/**
+  Voltage measured by the sensor.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwVoltage     = "hw.voltage";
+static constexpr const char *descrMetricHwVoltage = "Voltage measured by the sensor.";
+static constexpr const char *unitMetricHwVoltage  = "V";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwVoltage(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwVoltage, descrMetricHwVoltage, unitMetricHwVoltage);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwVoltage(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwVoltage, descrMetricHwVoltage, unitMetricHwVoltage);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwVoltage(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwVoltage, descrMetricHwVoltage,
+                                           unitMetricHwVoltage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDoubleMetricHwVoltage(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwVoltage, descrMetricHwVoltage,
+                                            unitMetricHwVoltage);
+}
+
+/**
+  Voltage limit in Volts.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwVoltageLimit     = "hw.voltage.limit";
+static constexpr const char *descrMetricHwVoltageLimit = "Voltage limit in Volts.";
+static constexpr const char *unitMetricHwVoltageLimit  = "V";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwVoltageLimit(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwVoltageLimit, descrMetricHwVoltageLimit,
+                                 unitMetricHwVoltageLimit);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwVoltageLimit(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwVoltageLimit, descrMetricHwVoltageLimit,
+                                  unitMetricHwVoltageLimit);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncInt64MetricHwVoltageLimit(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwVoltageLimit, descrMetricHwVoltageLimit,
+                                           unitMetricHwVoltageLimit);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwVoltageLimit(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwVoltageLimit, descrMetricHwVoltageLimit,
+                                            unitMetricHwVoltageLimit);
+}
+
+/**
+  Nominal (expected) voltage.
+  <p>
+  gauge
+ */
+static constexpr const char *kMetricHwVoltageNominal     = "hw.voltage.nominal";
+static constexpr const char *descrMetricHwVoltageNominal = "Nominal (expected) voltage.";
+static constexpr const char *unitMetricHwVoltageNominal  = "V";
+
+#if OPENTELEMETRY_ABI_VERSION_NO >= 2
+
+static inline nostd::unique_ptr<metrics::Gauge<int64_t>> CreateSyncInt64MetricHwVoltageNominal(
+    metrics::Meter *meter)
+{
+  return meter->CreateInt64Gauge(kMetricHwVoltageNominal, descrMetricHwVoltageNominal,
+                                 unitMetricHwVoltageNominal);
+}
+
+static inline nostd::unique_ptr<metrics::Gauge<double>> CreateSyncDoubleMetricHwVoltageNominal(
+    metrics::Meter *meter)
+{
+  return meter->CreateDoubleGauge(kMetricHwVoltageNominal, descrMetricHwVoltageNominal,
+                                  unitMetricHwVoltageNominal);
+}
+#endif /* OPENTELEMETRY_ABI_VERSION_NO */
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricHwVoltageNominal(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableGauge(kMetricHwVoltageNominal, descrMetricHwVoltageNominal,
+                                           unitMetricHwVoltageNominal);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricHwVoltageNominal(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableGauge(kMetricHwVoltageNominal, descrMetricHwVoltageNominal,
+                                            unitMetricHwVoltageNominal);
+}
+
 }  // namespace hw
 }  // namespace semconv
 OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/k8s_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/k8s_attributes.h
index 29f08e7793f..80ef2a964ba 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/k8s_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/k8s_attributes.h
@@ -595,19 +595,11 @@ static constexpr const char *kTerminating = "terminating";
 
 namespace K8sNodeConditionStatusValues
 {
-/**
-  none
- */
+
 static constexpr const char *kConditionTrue = "true";
 
-/**
-  none
- */
 static constexpr const char *kConditionFalse = "false";
 
-/**
-  none
- */
 static constexpr const char *kConditionUnknown = "unknown";
 
 }  // namespace K8sNodeConditionStatusValues
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/k8s_metrics.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/k8s_metrics.h
index d37bd12741d..678b24ff85d 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/k8s_metrics.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/k8s_metrics.h
@@ -21,7 +21,7 @@ namespace k8s
 {
 
 /**
-  Maximum CPU resource limit set for the container
+  Maximum CPU resource limit set for the container.
   <p>
   See
   https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#resourcerequirements-v1-core
@@ -29,7 +29,7 @@ namespace k8s
  */
 static constexpr const char *kMetricK8sContainerCpuLimit = "k8s.container.cpu.limit";
 static constexpr const char *descrMetricK8sContainerCpuLimit =
-    "Maximum CPU resource limit set for the container";
+    "Maximum CPU resource limit set for the container.";
 static constexpr const char *unitMetricK8sContainerCpuLimit = "{cpu}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -61,7 +61,7 @@ CreateAsyncDoubleMetricK8sContainerCpuLimit(metrics::Meter *meter)
 }
 
 /**
-  CPU resource requested for the container
+  CPU resource requested for the container.
   <p>
   See
   https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#resourcerequirements-v1-core
@@ -69,7 +69,7 @@ CreateAsyncDoubleMetricK8sContainerCpuLimit(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sContainerCpuRequest = "k8s.container.cpu.request";
 static constexpr const char *descrMetricK8sContainerCpuRequest =
-    "CPU resource requested for the container";
+    "CPU resource requested for the container.";
 static constexpr const char *unitMetricK8sContainerCpuRequest = "{cpu}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -105,7 +105,7 @@ CreateAsyncDoubleMetricK8sContainerCpuRequest(metrics::Meter *meter)
 }
 
 /**
-  Maximum ephemeral storage resource limit set for the container
+  Maximum ephemeral storage resource limit set for the container.
   <p>
   See
   https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#resourcerequirements-v1-core
@@ -114,7 +114,7 @@ CreateAsyncDoubleMetricK8sContainerCpuRequest(metrics::Meter *meter)
 static constexpr const char *kMetricK8sContainerEphemeralStorageLimit =
     "k8s.container.ephemeral_storage.limit";
 static constexpr const char *descrMetricK8sContainerEphemeralStorageLimit =
-    "Maximum ephemeral storage resource limit set for the container";
+    "Maximum ephemeral storage resource limit set for the container.";
 static constexpr const char *unitMetricK8sContainerEphemeralStorageLimit = "By";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -150,7 +150,7 @@ CreateAsyncDoubleMetricK8sContainerEphemeralStorageLimit(metrics::Meter *meter)
 }
 
 /**
-  Ephemeral storage resource requested for the container
+  Ephemeral storage resource requested for the container.
   <p>
   See
   https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#resourcerequirements-v1-core
@@ -159,7 +159,7 @@ CreateAsyncDoubleMetricK8sContainerEphemeralStorageLimit(metrics::Meter *meter)
 static constexpr const char *kMetricK8sContainerEphemeralStorageRequest =
     "k8s.container.ephemeral_storage.request";
 static constexpr const char *descrMetricK8sContainerEphemeralStorageRequest =
-    "Ephemeral storage resource requested for the container";
+    "Ephemeral storage resource requested for the container.";
 static constexpr const char *unitMetricK8sContainerEphemeralStorageRequest = "By";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -195,7 +195,7 @@ CreateAsyncDoubleMetricK8sContainerEphemeralStorageRequest(metrics::Meter *meter
 }
 
 /**
-  Maximum memory resource limit set for the container
+  Maximum memory resource limit set for the container.
   <p>
   See
   https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#resourcerequirements-v1-core
@@ -203,7 +203,7 @@ CreateAsyncDoubleMetricK8sContainerEphemeralStorageRequest(metrics::Meter *meter
  */
 static constexpr const char *kMetricK8sContainerMemoryLimit = "k8s.container.memory.limit";
 static constexpr const char *descrMetricK8sContainerMemoryLimit =
-    "Maximum memory resource limit set for the container";
+    "Maximum memory resource limit set for the container.";
 static constexpr const char *unitMetricK8sContainerMemoryLimit = "By";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -239,7 +239,7 @@ CreateAsyncDoubleMetricK8sContainerMemoryLimit(metrics::Meter *meter)
 }
 
 /**
-  Memory resource requested for the container
+  Memory resource requested for the container.
   <p>
   See
   https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#resourcerequirements-v1-core
@@ -247,7 +247,7 @@ CreateAsyncDoubleMetricK8sContainerMemoryLimit(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sContainerMemoryRequest = "k8s.container.memory.request";
 static constexpr const char *descrMetricK8sContainerMemoryRequest =
-    "Memory resource requested for the container";
+    "Memory resource requested for the container.";
 static constexpr const char *unitMetricK8sContainerMemoryRequest = "By";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -284,14 +284,14 @@ CreateAsyncDoubleMetricK8sContainerMemoryRequest(metrics::Meter *meter)
 
 /**
   Indicates whether the container is currently marked as ready to accept traffic, based on its
-  readiness probe (1 = ready, 0 = not ready) <p> This metric SHOULD reflect the value of the @code
+  readiness probe (1 = ready, 0 = not ready). <p> This metric SHOULD reflect the value of the @code
   ready @endcode field in the <a
   href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#containerstatus-v1-core">K8s
   ContainerStatus</a>. <p> updowncounter
  */
 static constexpr const char *kMetricK8sContainerReady = "k8s.container.ready";
 static constexpr const char *descrMetricK8sContainerReady =
-    "Indicates whether the container is currently marked as ready to accept traffic, based on its readiness probe (1 = ready, 0 = not ready)
+    "Indicates whether the container is currently marked as ready to accept traffic, based on its readiness probe (1 = ready, 0 = not ready).
     ";
     static constexpr const char *unitMetricK8sContainerReady = "{container}";
 
@@ -324,7 +324,7 @@ CreateAsyncDoubleMetricK8sContainerReady(metrics::Meter *meter)
 }
 
 /**
-  Describes how many times the container has restarted (since the last counter reset)
+  Describes how many times the container has restarted (since the last counter reset).
   <p>
   This value is pulled directly from the K8s API and the value can go indefinitely high and be reset
   to 0 at any time depending on how your kubelet is configured to prune dead containers. It is best
@@ -335,7 +335,7 @@ CreateAsyncDoubleMetricK8sContainerReady(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sContainerRestartCount = "k8s.container.restart.count";
 static constexpr const char *descrMetricK8sContainerRestartCount =
-    "Describes how many times the container has restarted (since the last counter reset)";
+    "Describes how many times the container has restarted (since the last counter reset).";
 static constexpr const char *unitMetricK8sContainerRestartCount = "{restart}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -371,7 +371,7 @@ CreateAsyncDoubleMetricK8sContainerRestartCount(metrics::Meter *meter)
 }
 
 /**
-  Describes the number of K8s containers that are currently in a state for a given reason
+  Describes the number of K8s containers that are currently in a state for a given reason.
   <p>
   All possible container state reasons will be reported at each time interval to avoid missing
   metrics. Only the value corresponding to the current state reason will be non-zero. <p>
@@ -379,7 +379,7 @@ CreateAsyncDoubleMetricK8sContainerRestartCount(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sContainerStatusReason = "k8s.container.status.reason";
 static constexpr const char *descrMetricK8sContainerStatusReason =
-    "Describes the number of K8s containers that are currently in a state for a given reason";
+    "Describes the number of K8s containers that are currently in a state for a given reason.";
 static constexpr const char *unitMetricK8sContainerStatusReason = "{container}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -415,7 +415,7 @@ CreateAsyncDoubleMetricK8sContainerStatusReason(metrics::Meter *meter)
 }
 
 /**
-  Describes the number of K8s containers that are currently in a given state
+  Describes the number of K8s containers that are currently in a given state.
   <p>
   All possible container states will be reported at each time interval to avoid missing metrics.
   Only the value corresponding to the current state will be non-zero.
@@ -424,7 +424,7 @@ CreateAsyncDoubleMetricK8sContainerStatusReason(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sContainerStatusState = "k8s.container.status.state";
 static constexpr const char *descrMetricK8sContainerStatusState =
-    "Describes the number of K8s containers that are currently in a given state";
+    "Describes the number of K8s containers that are currently in a given state.";
 static constexpr const char *unitMetricK8sContainerStatusState = "{container}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -460,7 +460,7 @@ CreateAsyncDoubleMetricK8sContainerStatusState(metrics::Meter *meter)
 }
 
 /**
-  Maximum storage resource limit set for the container
+  Maximum storage resource limit set for the container.
   <p>
   See
   https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#resourcerequirements-v1-core
@@ -468,7 +468,7 @@ CreateAsyncDoubleMetricK8sContainerStatusState(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sContainerStorageLimit = "k8s.container.storage.limit";
 static constexpr const char *descrMetricK8sContainerStorageLimit =
-    "Maximum storage resource limit set for the container";
+    "Maximum storage resource limit set for the container.";
 static constexpr const char *unitMetricK8sContainerStorageLimit = "By";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -504,7 +504,7 @@ CreateAsyncDoubleMetricK8sContainerStorageLimit(metrics::Meter *meter)
 }
 
 /**
-  Storage resource requested for the container
+  Storage resource requested for the container.
   <p>
   See
   https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#resourcerequirements-v1-core
@@ -512,7 +512,7 @@ CreateAsyncDoubleMetricK8sContainerStorageLimit(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sContainerStorageRequest = "k8s.container.storage.request";
 static constexpr const char *descrMetricK8sContainerStorageRequest =
-    "Storage resource requested for the container";
+    "Storage resource requested for the container.";
 static constexpr const char *unitMetricK8sContainerStorageRequest = "By";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -548,7 +548,7 @@ CreateAsyncDoubleMetricK8sContainerStorageRequest(metrics::Meter *meter)
 }
 
 /**
-  The number of actively running jobs for a cronjob
+  The number of actively running jobs for a cronjob.
   <p>
   This metric aligns with the @code active @endcode field of the
   <a
@@ -557,7 +557,7 @@ CreateAsyncDoubleMetricK8sContainerStorageRequest(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sCronjobActiveJobs = "k8s.cronjob.active_jobs";
 static constexpr const char *descrMetricK8sCronjobActiveJobs =
-    "The number of actively running jobs for a cronjob";
+    "The number of actively running jobs for a cronjob.";
 static constexpr const char *unitMetricK8sCronjobActiveJobs = "{job}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -589,7 +589,7 @@ CreateAsyncDoubleMetricK8sCronjobActiveJobs(metrics::Meter *meter)
 }
 
 /**
-  Number of nodes that are running at least 1 daemon pod and are supposed to run the daemon pod
+  Number of nodes that are running at least 1 daemon pod and are supposed to run the daemon pod.
   <p>
   This metric aligns with the @code currentNumberScheduled @endcode field of the
   <a
@@ -599,7 +599,8 @@ CreateAsyncDoubleMetricK8sCronjobActiveJobs(metrics::Meter *meter)
 static constexpr const char *kMetricK8sDaemonsetCurrentScheduledNodes =
     "k8s.daemonset.current_scheduled_nodes";
 static constexpr const char *descrMetricK8sDaemonsetCurrentScheduledNodes =
-    "Number of nodes that are running at least 1 daemon pod and are supposed to run the daemon pod";
+    "Number of nodes that are running at least 1 daemon pod and are supposed to run the daemon "
+    "pod.";
 static constexpr const char *unitMetricK8sDaemonsetCurrentScheduledNodes = "{node}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -636,7 +637,7 @@ CreateAsyncDoubleMetricK8sDaemonsetCurrentScheduledNodes(metrics::Meter *meter)
 
 /**
   Number of nodes that should be running the daemon pod (including nodes currently running the
-  daemon pod) <p> This metric aligns with the @code desiredNumberScheduled @endcode field of the <a
+  daemon pod). <p> This metric aligns with the @code desiredNumberScheduled @endcode field of the <a
   href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#daemonsetstatus-v1-apps">K8s
   DaemonSetStatus</a>. <p> updowncounter
  */
@@ -644,7 +645,7 @@ static constexpr const char *kMetricK8sDaemonsetDesiredScheduledNodes =
     "k8s.daemonset.desired_scheduled_nodes";
 static constexpr const char *descrMetricK8sDaemonsetDesiredScheduledNodes =
     "Number of nodes that should be running the daemon pod (including nodes currently running the "
-    "daemon pod)";
+    "daemon pod).";
 static constexpr const char *unitMetricK8sDaemonsetDesiredScheduledNodes = "{node}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -680,7 +681,7 @@ CreateAsyncDoubleMetricK8sDaemonsetDesiredScheduledNodes(metrics::Meter *meter)
 }
 
 /**
-  Number of nodes that are running the daemon pod, but are not supposed to run the daemon pod
+  Number of nodes that are running the daemon pod, but are not supposed to run the daemon pod.
   <p>
   This metric aligns with the @code numberMisscheduled @endcode field of the
   <a
@@ -690,7 +691,7 @@ CreateAsyncDoubleMetricK8sDaemonsetDesiredScheduledNodes(metrics::Meter *meter)
 static constexpr const char *kMetricK8sDaemonsetMisscheduledNodes =
     "k8s.daemonset.misscheduled_nodes";
 static constexpr const char *descrMetricK8sDaemonsetMisscheduledNodes =
-    "Number of nodes that are running the daemon pod, but are not supposed to run the daemon pod";
+    "Number of nodes that are running the daemon pod, but are not supposed to run the daemon pod.";
 static constexpr const char *unitMetricK8sDaemonsetMisscheduledNodes = "{node}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -727,14 +728,14 @@ CreateAsyncDoubleMetricK8sDaemonsetMisscheduledNodes(metrics::Meter *meter)
 
 /**
   Number of nodes that should be running the daemon pod and have one or more of the daemon pod
-  running and ready <p> This metric aligns with the @code numberReady @endcode field of the <a
+  running and ready. <p> This metric aligns with the @code numberReady @endcode field of the <a
   href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#daemonsetstatus-v1-apps">K8s
   DaemonSetStatus</a>. <p> updowncounter
  */
 static constexpr const char *kMetricK8sDaemonsetReadyNodes = "k8s.daemonset.ready_nodes";
 static constexpr const char *descrMetricK8sDaemonsetReadyNodes =
     "Number of nodes that should be running the daemon pod and have one or more of the daemon pod "
-    "running and ready";
+    "running and ready.";
 static constexpr const char *unitMetricK8sDaemonsetReadyNodes = "{node}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -771,14 +772,14 @@ CreateAsyncDoubleMetricK8sDaemonsetReadyNodes(metrics::Meter *meter)
 
 /**
   Total number of available replica pods (ready for at least minReadySeconds) targeted by this
-  deployment <p> This metric aligns with the @code availableReplicas @endcode field of the <a
+  deployment. <p> This metric aligns with the @code availableReplicas @endcode field of the <a
   href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#deploymentstatus-v1-apps">K8s
   DeploymentStatus</a>. <p> updowncounter
  */
 static constexpr const char *kMetricK8sDeploymentAvailablePods = "k8s.deployment.available_pods";
 static constexpr const char *descrMetricK8sDeploymentAvailablePods =
     "Total number of available replica pods (ready for at least minReadySeconds) targeted by this "
-    "deployment";
+    "deployment.";
 static constexpr const char *unitMetricK8sDeploymentAvailablePods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -814,7 +815,7 @@ CreateAsyncDoubleMetricK8sDeploymentAvailablePods(metrics::Meter *meter)
 }
 
 /**
-  Number of desired replica pods in this deployment
+  Number of desired replica pods in this deployment.
   <p>
   This metric aligns with the @code replicas @endcode field of the
   <a
@@ -823,7 +824,7 @@ CreateAsyncDoubleMetricK8sDeploymentAvailablePods(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sDeploymentDesiredPods = "k8s.deployment.desired_pods";
 static constexpr const char *descrMetricK8sDeploymentDesiredPods =
-    "Number of desired replica pods in this deployment";
+    "Number of desired replica pods in this deployment.";
 static constexpr const char *unitMetricK8sDeploymentDesiredPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -860,14 +861,14 @@ CreateAsyncDoubleMetricK8sDeploymentDesiredPods(metrics::Meter *meter)
 
 /**
   Current number of replica pods managed by this horizontal pod autoscaler, as last seen by the
-  autoscaler <p> This metric aligns with the @code currentReplicas @endcode field of the <a
+  autoscaler. <p> This metric aligns with the @code currentReplicas @endcode field of the <a
   href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#horizontalpodautoscalerstatus-v2-autoscaling">K8s
   HorizontalPodAutoscalerStatus</a> <p> updowncounter
  */
 static constexpr const char *kMetricK8sHpaCurrentPods = "k8s.hpa.current_pods";
 static constexpr const char *descrMetricK8sHpaCurrentPods =
     "Current number of replica pods managed by this horizontal pod autoscaler, as last seen by the "
-    "autoscaler";
+    "autoscaler.";
 static constexpr const char *unitMetricK8sHpaCurrentPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -900,14 +901,14 @@ CreateAsyncDoubleMetricK8sHpaCurrentPods(metrics::Meter *meter)
 
 /**
   Desired number of replica pods managed by this horizontal pod autoscaler, as last calculated by
-  the autoscaler <p> This metric aligns with the @code desiredReplicas @endcode field of the <a
+  the autoscaler. <p> This metric aligns with the @code desiredReplicas @endcode field of the <a
   href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#horizontalpodautoscalerstatus-v2-autoscaling">K8s
   HorizontalPodAutoscalerStatus</a> <p> updowncounter
  */
 static constexpr const char *kMetricK8sHpaDesiredPods = "k8s.hpa.desired_pods";
 static constexpr const char *descrMetricK8sHpaDesiredPods =
     "Desired number of replica pods managed by this horizontal pod autoscaler, as last calculated "
-    "by the autoscaler";
+    "by the autoscaler.";
 static constexpr const char *unitMetricK8sHpaDesiredPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -939,7 +940,7 @@ CreateAsyncDoubleMetricK8sHpaDesiredPods(metrics::Meter *meter)
 }
 
 /**
-  The upper limit for the number of replica pods to which the autoscaler can scale up
+  The upper limit for the number of replica pods to which the autoscaler can scale up.
   <p>
   This metric aligns with the @code maxReplicas @endcode field of the
   <a
@@ -948,7 +949,7 @@ CreateAsyncDoubleMetricK8sHpaDesiredPods(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sHpaMaxPods = "k8s.hpa.max_pods";
 static constexpr const char *descrMetricK8sHpaMaxPods =
-    "The upper limit for the number of replica pods to which the autoscaler can scale up";
+    "The upper limit for the number of replica pods to which the autoscaler can scale up.";
 static constexpr const char *unitMetricK8sHpaMaxPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>> CreateSyncInt64MetricK8sHpaMaxPods(
@@ -1135,7 +1136,7 @@ CreateAsyncDoubleMetricK8sHpaMetricTargetCpuValue(metrics::Meter *meter)
 }
 
 /**
-  The lower limit for the number of replica pods to which the autoscaler can scale down
+  The lower limit for the number of replica pods to which the autoscaler can scale down.
   <p>
   This metric aligns with the @code minReplicas @endcode field of the
   <a
@@ -1144,7 +1145,7 @@ CreateAsyncDoubleMetricK8sHpaMetricTargetCpuValue(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sHpaMinPods = "k8s.hpa.min_pods";
 static constexpr const char *descrMetricK8sHpaMinPods =
-    "The lower limit for the number of replica pods to which the autoscaler can scale down";
+    "The lower limit for the number of replica pods to which the autoscaler can scale down.";
 static constexpr const char *unitMetricK8sHpaMinPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>> CreateSyncInt64MetricK8sHpaMinPods(
@@ -1176,7 +1177,7 @@ static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDouble
 }
 
 /**
-  The number of pending and actively running pods for a job
+  The number of pending and actively running pods for a job.
   <p>
   This metric aligns with the @code active @endcode field of the
   <a
@@ -1185,7 +1186,7 @@ static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDouble
  */
 static constexpr const char *kMetricK8sJobActivePods = "k8s.job.active_pods";
 static constexpr const char *descrMetricK8sJobActivePods =
-    "The number of pending and actively running pods for a job";
+    "The number of pending and actively running pods for a job.";
 static constexpr const char *unitMetricK8sJobActivePods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -1217,7 +1218,7 @@ CreateAsyncDoubleMetricK8sJobActivePods(metrics::Meter *meter)
 }
 
 /**
-  The desired number of successfully finished pods the job should be run with
+  The desired number of successfully finished pods the job should be run with.
   <p>
   This metric aligns with the @code completions @endcode field of the
   <a
@@ -1226,7 +1227,7 @@ CreateAsyncDoubleMetricK8sJobActivePods(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sJobDesiredSuccessfulPods = "k8s.job.desired_successful_pods";
 static constexpr const char *descrMetricK8sJobDesiredSuccessfulPods =
-    "The desired number of successfully finished pods the job should be run with";
+    "The desired number of successfully finished pods the job should be run with.";
 static constexpr const char *unitMetricK8sJobDesiredSuccessfulPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -1262,7 +1263,7 @@ CreateAsyncDoubleMetricK8sJobDesiredSuccessfulPods(metrics::Meter *meter)
 }
 
 /**
-  The number of pods which reached phase Failed for a job
+  The number of pods which reached phase Failed for a job.
   <p>
   This metric aligns with the @code failed @endcode field of the
   <a
@@ -1271,7 +1272,7 @@ CreateAsyncDoubleMetricK8sJobDesiredSuccessfulPods(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sJobFailedPods = "k8s.job.failed_pods";
 static constexpr const char *descrMetricK8sJobFailedPods =
-    "The number of pods which reached phase Failed for a job";
+    "The number of pods which reached phase Failed for a job.";
 static constexpr const char *unitMetricK8sJobFailedPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -1303,7 +1304,7 @@ CreateAsyncDoubleMetricK8sJobFailedPods(metrics::Meter *meter)
 }
 
 /**
-  The max desired number of pods the job should run at any given time
+  The max desired number of pods the job should run at any given time.
   <p>
   This metric aligns with the @code parallelism @endcode field of the
   <a
@@ -1312,7 +1313,7 @@ CreateAsyncDoubleMetricK8sJobFailedPods(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sJobMaxParallelPods = "k8s.job.max_parallel_pods";
 static constexpr const char *descrMetricK8sJobMaxParallelPods =
-    "The max desired number of pods the job should run at any given time";
+    "The max desired number of pods the job should run at any given time.";
 static constexpr const char *unitMetricK8sJobMaxParallelPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -1348,7 +1349,7 @@ CreateAsyncDoubleMetricK8sJobMaxParallelPods(metrics::Meter *meter)
 }
 
 /**
-  The number of pods which reached phase Succeeded for a job
+  The number of pods which reached phase Succeeded for a job.
   <p>
   This metric aligns with the @code succeeded @endcode field of the
   <a
@@ -1357,7 +1358,7 @@ CreateAsyncDoubleMetricK8sJobMaxParallelPods(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sJobSuccessfulPods = "k8s.job.successful_pods";
 static constexpr const char *descrMetricK8sJobSuccessfulPods =
-    "The number of pods which reached phase Succeeded for a job";
+    "The number of pods which reached phase Succeeded for a job.";
 static constexpr const char *unitMetricK8sJobSuccessfulPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -1427,13 +1428,13 @@ CreateAsyncDoubleMetricK8sNamespacePhase(metrics::Meter *meter)
 }
 
 /**
-  Amount of cpu allocatable on the node
+  Amount of cpu allocatable on the node.
   <p>
   updowncounter
  */
 static constexpr const char *kMetricK8sNodeAllocatableCpu = "k8s.node.allocatable.cpu";
 static constexpr const char *descrMetricK8sNodeAllocatableCpu =
-    "Amount of cpu allocatable on the node";
+    "Amount of cpu allocatable on the node.";
 static constexpr const char *unitMetricK8sNodeAllocatableCpu = "{cpu}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -1469,14 +1470,14 @@ CreateAsyncDoubleMetricK8sNodeAllocatableCpu(metrics::Meter *meter)
 }
 
 /**
-  Amount of ephemeral-storage allocatable on the node
+  Amount of ephemeral-storage allocatable on the node.
   <p>
   updowncounter
  */
 static constexpr const char *kMetricK8sNodeAllocatableEphemeralStorage =
     "k8s.node.allocatable.ephemeral_storage";
 static constexpr const char *descrMetricK8sNodeAllocatableEphemeralStorage =
-    "Amount of ephemeral-storage allocatable on the node";
+    "Amount of ephemeral-storage allocatable on the node.";
 static constexpr const char *unitMetricK8sNodeAllocatableEphemeralStorage = "By";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -1512,13 +1513,13 @@ CreateAsyncDoubleMetricK8sNodeAllocatableEphemeralStorage(metrics::Meter *meter)
 }
 
 /**
-  Amount of memory allocatable on the node
+  Amount of memory allocatable on the node.
   <p>
   updowncounter
  */
 static constexpr const char *kMetricK8sNodeAllocatableMemory = "k8s.node.allocatable.memory";
 static constexpr const char *descrMetricK8sNodeAllocatableMemory =
-    "Amount of memory allocatable on the node";
+    "Amount of memory allocatable on the node.";
 static constexpr const char *unitMetricK8sNodeAllocatableMemory = "By";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -1554,13 +1555,13 @@ CreateAsyncDoubleMetricK8sNodeAllocatableMemory(metrics::Meter *meter)
 }
 
 /**
-  Amount of pods allocatable on the node
+  Amount of pods allocatable on the node.
   <p>
   updowncounter
  */
 static constexpr const char *kMetricK8sNodeAllocatablePods = "k8s.node.allocatable.pods";
 static constexpr const char *descrMetricK8sNodeAllocatablePods =
-    "Amount of pods allocatable on the node";
+    "Amount of pods allocatable on the node.";
 static constexpr const char *unitMetricK8sNodeAllocatablePods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -1640,14 +1641,14 @@ CreateAsyncDoubleMetricK8sNodeConditionStatus(metrics::Meter *meter)
 }
 
 /**
-  Total CPU time consumed
+  Total CPU time consumed.
   <p>
   Total CPU time consumed by the specific Node on all available CPU cores
   <p>
   counter
  */
 static constexpr const char *kMetricK8sNodeCpuTime     = "k8s.node.cpu.time";
-static constexpr const char *descrMetricK8sNodeCpuTime = "Total CPU time consumed";
+static constexpr const char *descrMetricK8sNodeCpuTime = "Total CPU time consumed.";
 static constexpr const char *unitMetricK8sNodeCpuTime  = "s";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricK8sNodeCpuTime(
@@ -1679,7 +1680,7 @@ CreateAsyncDoubleMetricK8sNodeCpuTime(metrics::Meter *meter)
 }
 
 /**
-  Node's CPU usage, measured in cpus. Range from 0 to the number of allocatable CPUs
+  Node's CPU usage, measured in cpus. Range from 0 to the number of allocatable CPUs.
   <p>
   CPU usage of the specific Node on all available CPU cores, averaged over the sample window
   <p>
@@ -1687,7 +1688,7 @@ CreateAsyncDoubleMetricK8sNodeCpuTime(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sNodeCpuUsage = "k8s.node.cpu.usage";
 static constexpr const char *descrMetricK8sNodeCpuUsage =
-    "Node's CPU usage, measured in cpus. Range from 0 to the number of allocatable CPUs";
+    "Node's CPU usage, measured in cpus. Range from 0 to the number of allocatable CPUs.";
 static constexpr const char *unitMetricK8sNodeCpuUsage = "{cpu}";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
@@ -1722,14 +1723,161 @@ CreateAsyncDoubleMetricK8sNodeCpuUsage(metrics::Meter *meter)
 }
 
 /**
-  Memory usage of the Node
+  Node filesystem available bytes.
+  <p>
+  This metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#FsStats">FsStats.AvailableBytes</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#NodeStats">NodeStats.Fs</a>
+  of the Kubelet's stats API.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricK8sNodeFilesystemAvailable = "k8s.node.filesystem.available";
+static constexpr const char *descrMetricK8sNodeFilesystemAvailable =
+    "Node filesystem available bytes.";
+static constexpr const char *unitMetricK8sNodeFilesystemAvailable = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricK8sNodeFilesystemAvailable(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricK8sNodeFilesystemAvailable,
+                                         descrMetricK8sNodeFilesystemAvailable,
+                                         unitMetricK8sNodeFilesystemAvailable);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricK8sNodeFilesystemAvailable(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricK8sNodeFilesystemAvailable,
+                                          descrMetricK8sNodeFilesystemAvailable,
+                                          unitMetricK8sNodeFilesystemAvailable);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricK8sNodeFilesystemAvailable(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricK8sNodeFilesystemAvailable,
+                                                   descrMetricK8sNodeFilesystemAvailable,
+                                                   unitMetricK8sNodeFilesystemAvailable);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricK8sNodeFilesystemAvailable(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricK8sNodeFilesystemAvailable,
+                                                    descrMetricK8sNodeFilesystemAvailable,
+                                                    unitMetricK8sNodeFilesystemAvailable);
+}
+
+/**
+  Node filesystem capacity.
+  <p>
+  This metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#FsStats">FsStats.CapacityBytes</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#NodeStats">NodeStats.Fs</a>
+  of the Kubelet's stats API.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricK8sNodeFilesystemCapacity     = "k8s.node.filesystem.capacity";
+static constexpr const char *descrMetricK8sNodeFilesystemCapacity = "Node filesystem capacity.";
+static constexpr const char *unitMetricK8sNodeFilesystemCapacity  = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricK8sNodeFilesystemCapacity(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricK8sNodeFilesystemCapacity,
+                                         descrMetricK8sNodeFilesystemCapacity,
+                                         unitMetricK8sNodeFilesystemCapacity);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricK8sNodeFilesystemCapacity(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricK8sNodeFilesystemCapacity,
+                                          descrMetricK8sNodeFilesystemCapacity,
+                                          unitMetricK8sNodeFilesystemCapacity);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricK8sNodeFilesystemCapacity(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricK8sNodeFilesystemCapacity,
+                                                   descrMetricK8sNodeFilesystemCapacity,
+                                                   unitMetricK8sNodeFilesystemCapacity);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricK8sNodeFilesystemCapacity(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricK8sNodeFilesystemCapacity,
+                                                    descrMetricK8sNodeFilesystemCapacity,
+                                                    unitMetricK8sNodeFilesystemCapacity);
+}
+
+/**
+  Node filesystem usage.
+  <p>
+  This may not equal capacity - available.
+  <p>
+  This metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#FsStats">FsStats.UsedBytes</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#NodeStats">NodeStats.Fs</a>
+  of the Kubelet's stats API.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricK8sNodeFilesystemUsage     = "k8s.node.filesystem.usage";
+static constexpr const char *descrMetricK8sNodeFilesystemUsage = "Node filesystem usage.";
+static constexpr const char *unitMetricK8sNodeFilesystemUsage  = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricK8sNodeFilesystemUsage(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricK8sNodeFilesystemUsage,
+                                         descrMetricK8sNodeFilesystemUsage,
+                                         unitMetricK8sNodeFilesystemUsage);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricK8sNodeFilesystemUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricK8sNodeFilesystemUsage,
+                                          descrMetricK8sNodeFilesystemUsage,
+                                          unitMetricK8sNodeFilesystemUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricK8sNodeFilesystemUsage(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricK8sNodeFilesystemUsage,
+                                                   descrMetricK8sNodeFilesystemUsage,
+                                                   unitMetricK8sNodeFilesystemUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricK8sNodeFilesystemUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricK8sNodeFilesystemUsage,
+                                                    descrMetricK8sNodeFilesystemUsage,
+                                                    unitMetricK8sNodeFilesystemUsage);
+}
+
+/**
+  Memory usage of the Node.
   <p>
   Total memory usage of the Node
   <p>
   gauge
  */
 static constexpr const char *kMetricK8sNodeMemoryUsage     = "k8s.node.memory.usage";
-static constexpr const char *descrMetricK8sNodeMemoryUsage = "Memory usage of the Node";
+static constexpr const char *descrMetricK8sNodeMemoryUsage = "Memory usage of the Node.";
 static constexpr const char *unitMetricK8sNodeMemoryUsage  = "By";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
@@ -1764,12 +1912,12 @@ CreateAsyncDoubleMetricK8sNodeMemoryUsage(metrics::Meter *meter)
 }
 
 /**
-  Node network errors
+  Node network errors.
   <p>
   counter
  */
 static constexpr const char *kMetricK8sNodeNetworkErrors     = "k8s.node.network.errors";
-static constexpr const char *descrMetricK8sNodeNetworkErrors = "Node network errors";
+static constexpr const char *descrMetricK8sNodeNetworkErrors = "Node network errors.";
 static constexpr const char *unitMetricK8sNodeNetworkErrors  = "{error}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
@@ -1801,12 +1949,12 @@ CreateAsyncDoubleMetricK8sNodeNetworkErrors(metrics::Meter *meter)
 }
 
 /**
-  Network bytes for the Node
+  Network bytes for the Node.
   <p>
   counter
  */
 static constexpr const char *kMetricK8sNodeNetworkIo     = "k8s.node.network.io";
-static constexpr const char *descrMetricK8sNodeNetworkIo = "Network bytes for the Node";
+static constexpr const char *descrMetricK8sNodeNetworkIo = "Network bytes for the Node.";
 static constexpr const char *unitMetricK8sNodeNetworkIo  = "By";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricK8sNodeNetworkIo(
@@ -1838,14 +1986,14 @@ CreateAsyncDoubleMetricK8sNodeNetworkIo(metrics::Meter *meter)
 }
 
 /**
-  The time the Node has been running
+  The time the Node has been running.
   <p>
   Instrumentations SHOULD use a gauge with type @code double @endcode and measure uptime in seconds
   as a floating point number with the highest precision available. The actual accuracy would depend
   on the instrumentation and operating system. <p> gauge
  */
 static constexpr const char *kMetricK8sNodeUptime     = "k8s.node.uptime";
-static constexpr const char *descrMetricK8sNodeUptime = "The time the Node has been running";
+static constexpr const char *descrMetricK8sNodeUptime = "The time the Node has been running.";
 static constexpr const char *unitMetricK8sNodeUptime  = "s";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
@@ -1880,14 +2028,14 @@ static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDouble
 }
 
 /**
-  Total CPU time consumed
+  Total CPU time consumed.
   <p>
   Total CPU time consumed by the specific Pod on all available CPU cores
   <p>
   counter
  */
 static constexpr const char *kMetricK8sPodCpuTime     = "k8s.pod.cpu.time";
-static constexpr const char *descrMetricK8sPodCpuTime = "Total CPU time consumed";
+static constexpr const char *descrMetricK8sPodCpuTime = "Total CPU time consumed.";
 static constexpr const char *unitMetricK8sPodCpuTime  = "s";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricK8sPodCpuTime(
@@ -1919,7 +2067,7 @@ static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDouble
 }
 
 /**
-  Pod's CPU usage, measured in cpus. Range from 0 to the number of allocatable CPUs
+  Pod's CPU usage, measured in cpus. Range from 0 to the number of allocatable CPUs.
   <p>
   CPU usage of the specific Pod on all available CPU cores, averaged over the sample window
   <p>
@@ -1927,7 +2075,7 @@ static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDouble
  */
 static constexpr const char *kMetricK8sPodCpuUsage = "k8s.pod.cpu.usage";
 static constexpr const char *descrMetricK8sPodCpuUsage =
-    "Pod's CPU usage, measured in cpus. Range from 0 to the number of allocatable CPUs";
+    "Pod's CPU usage, measured in cpus. Range from 0 to the number of allocatable CPUs.";
 static constexpr const char *unitMetricK8sPodCpuUsage = "{cpu}";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
@@ -1962,14 +2110,161 @@ CreateAsyncDoubleMetricK8sPodCpuUsage(metrics::Meter *meter)
 }
 
 /**
-  Memory usage of the Pod
+  Pod filesystem available bytes.
+  <p>
+  This metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#FsStats">FsStats.AvailableBytes</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#PodStats">PodStats.EphemeralStorage</a>
+  of the Kubelet's stats API.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricK8sPodFilesystemAvailable = "k8s.pod.filesystem.available";
+static constexpr const char *descrMetricK8sPodFilesystemAvailable =
+    "Pod filesystem available bytes.";
+static constexpr const char *unitMetricK8sPodFilesystemAvailable = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricK8sPodFilesystemAvailable(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricK8sPodFilesystemAvailable,
+                                         descrMetricK8sPodFilesystemAvailable,
+                                         unitMetricK8sPodFilesystemAvailable);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricK8sPodFilesystemAvailable(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricK8sPodFilesystemAvailable,
+                                          descrMetricK8sPodFilesystemAvailable,
+                                          unitMetricK8sPodFilesystemAvailable);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricK8sPodFilesystemAvailable(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricK8sPodFilesystemAvailable,
+                                                   descrMetricK8sPodFilesystemAvailable,
+                                                   unitMetricK8sPodFilesystemAvailable);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricK8sPodFilesystemAvailable(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricK8sPodFilesystemAvailable,
+                                                    descrMetricK8sPodFilesystemAvailable,
+                                                    unitMetricK8sPodFilesystemAvailable);
+}
+
+/**
+  Pod filesystem capacity.
+  <p>
+  This metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#FsStats">FsStats.CapacityBytes</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#PodStats">PodStats.EphemeralStorage</a>
+  of the Kubelet's stats API.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricK8sPodFilesystemCapacity     = "k8s.pod.filesystem.capacity";
+static constexpr const char *descrMetricK8sPodFilesystemCapacity = "Pod filesystem capacity.";
+static constexpr const char *unitMetricK8sPodFilesystemCapacity  = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricK8sPodFilesystemCapacity(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricK8sPodFilesystemCapacity,
+                                         descrMetricK8sPodFilesystemCapacity,
+                                         unitMetricK8sPodFilesystemCapacity);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricK8sPodFilesystemCapacity(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricK8sPodFilesystemCapacity,
+                                          descrMetricK8sPodFilesystemCapacity,
+                                          unitMetricK8sPodFilesystemCapacity);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricK8sPodFilesystemCapacity(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricK8sPodFilesystemCapacity,
+                                                   descrMetricK8sPodFilesystemCapacity,
+                                                   unitMetricK8sPodFilesystemCapacity);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricK8sPodFilesystemCapacity(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricK8sPodFilesystemCapacity,
+                                                    descrMetricK8sPodFilesystemCapacity,
+                                                    unitMetricK8sPodFilesystemCapacity);
+}
+
+/**
+  Pod filesystem usage.
+  <p>
+  This may not equal capacity - available.
+  <p>
+  This metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#FsStats">FsStats.UsedBytes</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#PodStats">PodStats.EphemeralStorage</a>
+  of the Kubelet's stats API.
+  <p>
+  updowncounter
+ */
+static constexpr const char *kMetricK8sPodFilesystemUsage     = "k8s.pod.filesystem.usage";
+static constexpr const char *descrMetricK8sPodFilesystemUsage = "Pod filesystem usage.";
+static constexpr const char *unitMetricK8sPodFilesystemUsage  = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricK8sPodFilesystemUsage(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricK8sPodFilesystemUsage,
+                                         descrMetricK8sPodFilesystemUsage,
+                                         unitMetricK8sPodFilesystemUsage);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricK8sPodFilesystemUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricK8sPodFilesystemUsage,
+                                          descrMetricK8sPodFilesystemUsage,
+                                          unitMetricK8sPodFilesystemUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricK8sPodFilesystemUsage(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricK8sPodFilesystemUsage,
+                                                   descrMetricK8sPodFilesystemUsage,
+                                                   unitMetricK8sPodFilesystemUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricK8sPodFilesystemUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricK8sPodFilesystemUsage,
+                                                    descrMetricK8sPodFilesystemUsage,
+                                                    unitMetricK8sPodFilesystemUsage);
+}
+
+/**
+  Memory usage of the Pod.
   <p>
   Total memory usage of the Pod
   <p>
   gauge
  */
 static constexpr const char *kMetricK8sPodMemoryUsage     = "k8s.pod.memory.usage";
-static constexpr const char *descrMetricK8sPodMemoryUsage = "Memory usage of the Pod";
+static constexpr const char *descrMetricK8sPodMemoryUsage = "Memory usage of the Pod.";
 static constexpr const char *unitMetricK8sPodMemoryUsage  = "By";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
@@ -2004,12 +2299,12 @@ CreateAsyncDoubleMetricK8sPodMemoryUsage(metrics::Meter *meter)
 }
 
 /**
-  Pod network errors
+  Pod network errors.
   <p>
   counter
  */
 static constexpr const char *kMetricK8sPodNetworkErrors     = "k8s.pod.network.errors";
-static constexpr const char *descrMetricK8sPodNetworkErrors = "Pod network errors";
+static constexpr const char *descrMetricK8sPodNetworkErrors = "Pod network errors.";
 static constexpr const char *unitMetricK8sPodNetworkErrors  = "{error}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
@@ -2041,12 +2336,12 @@ CreateAsyncDoubleMetricK8sPodNetworkErrors(metrics::Meter *meter)
 }
 
 /**
-  Network bytes for the Pod
+  Network bytes for the Pod.
   <p>
   counter
  */
 static constexpr const char *kMetricK8sPodNetworkIo     = "k8s.pod.network.io";
-static constexpr const char *descrMetricK8sPodNetworkIo = "Network bytes for the Pod";
+static constexpr const char *descrMetricK8sPodNetworkIo = "Network bytes for the Pod.";
 static constexpr const char *unitMetricK8sPodNetworkIo  = "By";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricK8sPodNetworkIo(
@@ -2078,14 +2373,14 @@ CreateAsyncDoubleMetricK8sPodNetworkIo(metrics::Meter *meter)
 }
 
 /**
-  The time the Pod has been running
+  The time the Pod has been running.
   <p>
   Instrumentations SHOULD use a gauge with type @code double @endcode and measure uptime in seconds
   as a floating point number with the highest precision available. The actual accuracy would depend
   on the instrumentation and operating system. <p> gauge
  */
 static constexpr const char *kMetricK8sPodUptime     = "k8s.pod.uptime";
-static constexpr const char *descrMetricK8sPodUptime = "The time the Pod has been running";
+static constexpr const char *descrMetricK8sPodUptime = "The time the Pod has been running.";
 static constexpr const char *unitMetricK8sPodUptime  = "s";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
@@ -2119,16 +2414,291 @@ static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDouble
                                             unitMetricK8sPodUptime);
 }
 
+/**
+  Pod volume storage space available.
+  <p>
+  This metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#VolumeStats">VolumeStats.AvailableBytes</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#PodStats">PodStats</a> of
+  the Kubelet's stats API. <p> updowncounter
+ */
+static constexpr const char *kMetricK8sPodVolumeAvailable = "k8s.pod.volume.available";
+static constexpr const char *descrMetricK8sPodVolumeAvailable =
+    "Pod volume storage space available.";
+static constexpr const char *unitMetricK8sPodVolumeAvailable = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricK8sPodVolumeAvailable(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricK8sPodVolumeAvailable,
+                                         descrMetricK8sPodVolumeAvailable,
+                                         unitMetricK8sPodVolumeAvailable);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricK8sPodVolumeAvailable(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricK8sPodVolumeAvailable,
+                                          descrMetricK8sPodVolumeAvailable,
+                                          unitMetricK8sPodVolumeAvailable);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricK8sPodVolumeAvailable(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricK8sPodVolumeAvailable,
+                                                   descrMetricK8sPodVolumeAvailable,
+                                                   unitMetricK8sPodVolumeAvailable);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricK8sPodVolumeAvailable(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricK8sPodVolumeAvailable,
+                                                    descrMetricK8sPodVolumeAvailable,
+                                                    unitMetricK8sPodVolumeAvailable);
+}
+
+/**
+  Pod volume total capacity.
+  <p>
+  This metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#VolumeStats">VolumeStats.CapacityBytes</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#PodStats">PodStats</a> of
+  the Kubelet's stats API. <p> updowncounter
+ */
+static constexpr const char *kMetricK8sPodVolumeCapacity     = "k8s.pod.volume.capacity";
+static constexpr const char *descrMetricK8sPodVolumeCapacity = "Pod volume total capacity.";
+static constexpr const char *unitMetricK8sPodVolumeCapacity  = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricK8sPodVolumeCapacity(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(
+      kMetricK8sPodVolumeCapacity, descrMetricK8sPodVolumeCapacity, unitMetricK8sPodVolumeCapacity);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricK8sPodVolumeCapacity(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(
+      kMetricK8sPodVolumeCapacity, descrMetricK8sPodVolumeCapacity, unitMetricK8sPodVolumeCapacity);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricK8sPodVolumeCapacity(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(
+      kMetricK8sPodVolumeCapacity, descrMetricK8sPodVolumeCapacity, unitMetricK8sPodVolumeCapacity);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricK8sPodVolumeCapacity(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(
+      kMetricK8sPodVolumeCapacity, descrMetricK8sPodVolumeCapacity, unitMetricK8sPodVolumeCapacity);
+}
+
+/**
+  The total inodes in the filesystem of the Pod's volume.
+  <p>
+  This metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#VolumeStats">VolumeStats.Inodes</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#PodStats">PodStats</a> of
+  the Kubelet's stats API. <p> updowncounter
+ */
+static constexpr const char *kMetricK8sPodVolumeInodeCount = "k8s.pod.volume.inode.count";
+static constexpr const char *descrMetricK8sPodVolumeInodeCount =
+    "The total inodes in the filesystem of the Pod's volume.";
+static constexpr const char *unitMetricK8sPodVolumeInodeCount = "{inode}";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricK8sPodVolumeInodeCount(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricK8sPodVolumeInodeCount,
+                                         descrMetricK8sPodVolumeInodeCount,
+                                         unitMetricK8sPodVolumeInodeCount);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricK8sPodVolumeInodeCount(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricK8sPodVolumeInodeCount,
+                                          descrMetricK8sPodVolumeInodeCount,
+                                          unitMetricK8sPodVolumeInodeCount);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricK8sPodVolumeInodeCount(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricK8sPodVolumeInodeCount,
+                                                   descrMetricK8sPodVolumeInodeCount,
+                                                   unitMetricK8sPodVolumeInodeCount);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricK8sPodVolumeInodeCount(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricK8sPodVolumeInodeCount,
+                                                    descrMetricK8sPodVolumeInodeCount,
+                                                    unitMetricK8sPodVolumeInodeCount);
+}
+
+/**
+  The free inodes in the filesystem of the Pod's volume.
+  <p>
+  This metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#VolumeStats">VolumeStats.InodesFree</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#PodStats">PodStats</a> of
+  the Kubelet's stats API. <p> updowncounter
+ */
+static constexpr const char *kMetricK8sPodVolumeInodeFree = "k8s.pod.volume.inode.free";
+static constexpr const char *descrMetricK8sPodVolumeInodeFree =
+    "The free inodes in the filesystem of the Pod's volume.";
+static constexpr const char *unitMetricK8sPodVolumeInodeFree = "{inode}";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricK8sPodVolumeInodeFree(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricK8sPodVolumeInodeFree,
+                                         descrMetricK8sPodVolumeInodeFree,
+                                         unitMetricK8sPodVolumeInodeFree);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricK8sPodVolumeInodeFree(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricK8sPodVolumeInodeFree,
+                                          descrMetricK8sPodVolumeInodeFree,
+                                          unitMetricK8sPodVolumeInodeFree);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricK8sPodVolumeInodeFree(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricK8sPodVolumeInodeFree,
+                                                   descrMetricK8sPodVolumeInodeFree,
+                                                   unitMetricK8sPodVolumeInodeFree);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricK8sPodVolumeInodeFree(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricK8sPodVolumeInodeFree,
+                                                    descrMetricK8sPodVolumeInodeFree,
+                                                    unitMetricK8sPodVolumeInodeFree);
+}
+
+/**
+  The inodes used by the filesystem of the Pod's volume.
+  <p>
+  This metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#VolumeStats">VolumeStats.InodesUsed</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#PodStats">PodStats</a> of
+  the Kubelet's stats API. <p> This may not be equal to @code inodes - free @endcode because
+  filesystem may share inodes with other filesystems. <p> updowncounter
+ */
+static constexpr const char *kMetricK8sPodVolumeInodeUsed = "k8s.pod.volume.inode.used";
+static constexpr const char *descrMetricK8sPodVolumeInodeUsed =
+    "The inodes used by the filesystem of the Pod's volume.";
+static constexpr const char *unitMetricK8sPodVolumeInodeUsed = "{inode}";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricK8sPodVolumeInodeUsed(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricK8sPodVolumeInodeUsed,
+                                         descrMetricK8sPodVolumeInodeUsed,
+                                         unitMetricK8sPodVolumeInodeUsed);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricK8sPodVolumeInodeUsed(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricK8sPodVolumeInodeUsed,
+                                          descrMetricK8sPodVolumeInodeUsed,
+                                          unitMetricK8sPodVolumeInodeUsed);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricK8sPodVolumeInodeUsed(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(kMetricK8sPodVolumeInodeUsed,
+                                                   descrMetricK8sPodVolumeInodeUsed,
+                                                   unitMetricK8sPodVolumeInodeUsed);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricK8sPodVolumeInodeUsed(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(kMetricK8sPodVolumeInodeUsed,
+                                                    descrMetricK8sPodVolumeInodeUsed,
+                                                    unitMetricK8sPodVolumeInodeUsed);
+}
+
+/**
+  Pod volume usage.
+  <p>
+  This may not equal capacity - available.
+  <p>
+  This metric is derived from the
+  <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#VolumeStats">VolumeStats.UsedBytes</a>
+  field of the <a
+  href="https://pkg.go.dev/k8s.io/kubelet@v0.33.0/pkg/apis/stats/v1alpha1#PodStats">PodStats</a> of
+  the Kubelet's stats API. <p> updowncounter
+ */
+static constexpr const char *kMetricK8sPodVolumeUsage     = "k8s.pod.volume.usage";
+static constexpr const char *descrMetricK8sPodVolumeUsage = "Pod volume usage.";
+static constexpr const char *unitMetricK8sPodVolumeUsage  = "By";
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
+CreateSyncInt64MetricK8sPodVolumeUsage(metrics::Meter *meter)
+{
+  return meter->CreateInt64UpDownCounter(kMetricK8sPodVolumeUsage, descrMetricK8sPodVolumeUsage,
+                                         unitMetricK8sPodVolumeUsage);
+}
+
+static inline nostd::unique_ptr<metrics::UpDownCounter<double>>
+CreateSyncDoubleMetricK8sPodVolumeUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleUpDownCounter(kMetricK8sPodVolumeUsage, descrMetricK8sPodVolumeUsage,
+                                          unitMetricK8sPodVolumeUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricK8sPodVolumeUsage(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableUpDownCounter(
+      kMetricK8sPodVolumeUsage, descrMetricK8sPodVolumeUsage, unitMetricK8sPodVolumeUsage);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricK8sPodVolumeUsage(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableUpDownCounter(
+      kMetricK8sPodVolumeUsage, descrMetricK8sPodVolumeUsage, unitMetricK8sPodVolumeUsage);
+}
+
 /**
   Total number of available replica pods (ready for at least minReadySeconds) targeted by this
-  replicaset <p> This metric aligns with the @code availableReplicas @endcode field of the <a
+  replicaset. <p> This metric aligns with the @code availableReplicas @endcode field of the <a
   href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#replicasetstatus-v1-apps">K8s
   ReplicaSetStatus</a>. <p> updowncounter
  */
 static constexpr const char *kMetricK8sReplicasetAvailablePods = "k8s.replicaset.available_pods";
 static constexpr const char *descrMetricK8sReplicasetAvailablePods =
     "Total number of available replica pods (ready for at least minReadySeconds) targeted by this "
-    "replicaset";
+    "replicaset.";
 static constexpr const char *unitMetricK8sReplicasetAvailablePods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -2164,7 +2734,7 @@ CreateAsyncDoubleMetricK8sReplicasetAvailablePods(metrics::Meter *meter)
 }
 
 /**
-  Number of desired replica pods in this replicaset
+  Number of desired replica pods in this replicaset.
   <p>
   This metric aligns with the @code replicas @endcode field of the
   <a
@@ -2173,7 +2743,7 @@ CreateAsyncDoubleMetricK8sReplicasetAvailablePods(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sReplicasetDesiredPods = "k8s.replicaset.desired_pods";
 static constexpr const char *descrMetricK8sReplicasetDesiredPods =
-    "Number of desired replica pods in this replicaset";
+    "Number of desired replica pods in this replicaset.";
 static constexpr const char *unitMetricK8sReplicasetDesiredPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -2305,7 +2875,7 @@ CreateAsyncDoubleMetricK8sReplicationControllerDesiredPods(metrics::Meter *meter
 
 /**
   Total number of available replica pods (ready for at least minReadySeconds) targeted by this
-  replication controller <p> This metric aligns with the @code availableReplicas @endcode field of
+  replication controller. <p> This metric aligns with the @code availableReplicas @endcode field of
   the <a
   href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#replicationcontrollerstatus-v1-core">K8s
   ReplicationControllerStatus</a> <p> updowncounter
@@ -2314,7 +2884,7 @@ static constexpr const char *kMetricK8sReplicationcontrollerAvailablePods =
     "k8s.replicationcontroller.available_pods";
 static constexpr const char *descrMetricK8sReplicationcontrollerAvailablePods =
     "Total number of available replica pods (ready for at least minReadySeconds) targeted by this "
-    "replication controller";
+    "replication controller.";
 static constexpr const char *unitMetricK8sReplicationcontrollerAvailablePods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -2351,7 +2921,7 @@ CreateAsyncDoubleMetricK8sReplicationcontrollerAvailablePods(metrics::Meter *met
 }
 
 /**
-  Number of desired replica pods in this replication controller
+  Number of desired replica pods in this replication controller.
   <p>
   This metric aligns with the @code replicas @endcode field of the
   <a
@@ -2361,7 +2931,7 @@ CreateAsyncDoubleMetricK8sReplicationcontrollerAvailablePods(metrics::Meter *met
 static constexpr const char *kMetricK8sReplicationcontrollerDesiredPods =
     "k8s.replicationcontroller.desired_pods";
 static constexpr const char *descrMetricK8sReplicationcontrollerDesiredPods =
-    "Number of desired replica pods in this replication controller";
+    "Number of desired replica pods in this replication controller.";
 static constexpr const char *unitMetricK8sReplicationcontrollerDesiredPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -3380,7 +3950,7 @@ CreateAsyncDoubleMetricK8sResourcequotaStorageRequestUsed(metrics::Meter *meter)
 
 /**
   The number of replica pods created by the statefulset controller from the statefulset version
-  indicated by currentRevision <p> This metric aligns with the @code currentReplicas @endcode field
+  indicated by currentRevision. <p> This metric aligns with the @code currentReplicas @endcode field
   of the <a
   href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#statefulsetstatus-v1-apps">K8s
   StatefulSetStatus</a>. <p> updowncounter
@@ -3388,7 +3958,7 @@ CreateAsyncDoubleMetricK8sResourcequotaStorageRequestUsed(metrics::Meter *meter)
 static constexpr const char *kMetricK8sStatefulsetCurrentPods = "k8s.statefulset.current_pods";
 static constexpr const char *descrMetricK8sStatefulsetCurrentPods =
     "The number of replica pods created by the statefulset controller from the statefulset version "
-    "indicated by currentRevision";
+    "indicated by currentRevision.";
 static constexpr const char *unitMetricK8sStatefulsetCurrentPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -3424,7 +3994,7 @@ CreateAsyncDoubleMetricK8sStatefulsetCurrentPods(metrics::Meter *meter)
 }
 
 /**
-  Number of desired replica pods in this statefulset
+  Number of desired replica pods in this statefulset.
   <p>
   This metric aligns with the @code replicas @endcode field of the
   <a
@@ -3433,7 +4003,7 @@ CreateAsyncDoubleMetricK8sStatefulsetCurrentPods(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sStatefulsetDesiredPods = "k8s.statefulset.desired_pods";
 static constexpr const char *descrMetricK8sStatefulsetDesiredPods =
-    "Number of desired replica pods in this statefulset";
+    "Number of desired replica pods in this statefulset.";
 static constexpr const char *unitMetricK8sStatefulsetDesiredPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -3469,7 +4039,7 @@ CreateAsyncDoubleMetricK8sStatefulsetDesiredPods(metrics::Meter *meter)
 }
 
 /**
-  The number of replica pods created for this statefulset with a Ready Condition
+  The number of replica pods created for this statefulset with a Ready Condition.
   <p>
   This metric aligns with the @code readyReplicas @endcode field of the
   <a
@@ -3478,7 +4048,7 @@ CreateAsyncDoubleMetricK8sStatefulsetDesiredPods(metrics::Meter *meter)
  */
 static constexpr const char *kMetricK8sStatefulsetReadyPods = "k8s.statefulset.ready_pods";
 static constexpr const char *descrMetricK8sStatefulsetReadyPods =
-    "The number of replica pods created for this statefulset with a Ready Condition";
+    "The number of replica pods created for this statefulset with a Ready Condition.";
 static constexpr const char *unitMetricK8sStatefulsetReadyPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -3515,7 +4085,7 @@ CreateAsyncDoubleMetricK8sStatefulsetReadyPods(metrics::Meter *meter)
 
 /**
   Number of replica pods created by the statefulset controller from the statefulset version
-  indicated by updateRevision <p> This metric aligns with the @code updatedReplicas @endcode field
+  indicated by updateRevision. <p> This metric aligns with the @code updatedReplicas @endcode field
   of the <a
   href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.30/#statefulsetstatus-v1-apps">K8s
   StatefulSetStatus</a>. <p> updowncounter
@@ -3523,7 +4093,7 @@ CreateAsyncDoubleMetricK8sStatefulsetReadyPods(metrics::Meter *meter)
 static constexpr const char *kMetricK8sStatefulsetUpdatedPods = "k8s.statefulset.updated_pods";
 static constexpr const char *descrMetricK8sStatefulsetUpdatedPods =
     "Number of replica pods created by the statefulset controller from the statefulset version "
-    "indicated by updateRevision";
+    "indicated by updateRevision.";
 static constexpr const char *unitMetricK8sStatefulsetUpdatedPods = "{pod}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/linux_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/linux_attributes.h
index c3f90337a4e..18e77516bc6 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/linux_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/linux_attributes.h
@@ -26,14 +26,9 @@ static constexpr const char *kLinuxMemorySlabState = "linux.memory.slab.state";
 
 namespace LinuxMemorySlabStateValues
 {
-/**
-  none
- */
+
 static constexpr const char *kReclaimable = "reclaimable";
 
-/**
-  none
- */
 static constexpr const char *kUnreclaimable = "unreclaimable";
 
 }  // namespace LinuxMemorySlabStateValues
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/message_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/message_attributes.h
index 05941248c97..0643e94ed5c 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/message_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/message_attributes.h
@@ -59,14 +59,9 @@ OPENTELEMETRY_DEPRECATED static constexpr const char *kMessageUncompressedSize =
 
 namespace MessageTypeValues
 {
-/**
-  none
- */
+
 static constexpr const char *kSent = "SENT";
 
-/**
-  none
- */
 static constexpr const char *kReceived = "RECEIVED";
 
 }  // namespace MessageTypeValues
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/messaging_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/messaging_attributes.h
index f036c3654ab..4a3e48eac16 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/messaging_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/messaging_attributes.h
@@ -386,13 +386,19 @@ static constexpr const char *kSettle = "settle";
 
 /**
   Deprecated. Use @code process @endcode instead.
+
+  @deprecated
+  {"note": "Replaced by @code process @endcode.", "reason": "renamed", "renamed_to": "process"}
  */
-static constexpr const char *kDeliver = "deliver";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kDeliver = "deliver";
 
 /**
   Deprecated. Use @code send @endcode instead.
+
+  @deprecated
+  {"note": "Replaced by @code send @endcode.", "reason": "renamed", "renamed_to": "send"}
  */
-static constexpr const char *kPublish = "publish";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kPublish = "publish";
 
 }  // namespace MessagingOperationTypeValues
 
@@ -465,6 +471,11 @@ namespace MessagingSystemValues
  */
 static constexpr const char *kActivemq = "activemq";
 
+/**
+  Amazon Simple Notification Service (SNS)
+ */
+static constexpr const char *kAwsSns = "aws.sns";
+
 /**
   Amazon Simple Queue Service (SQS)
  */
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/net_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/net_attributes.h
index 951217616ad..266982691fd 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/net_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/net_attributes.h
@@ -176,14 +176,9 @@ static constexpr const char *kUnix = "unix";
 
 namespace NetTransportValues
 {
-/**
-  none
- */
+
 static constexpr const char *kIpTcp = "ip_tcp";
 
-/**
-  none
- */
 static constexpr const char *kIpUdp = "ip_udp";
 
 /**
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/network_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/network_attributes.h
index 7b8404b2c9c..34c6a880e13 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/network_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/network_attributes.h
@@ -122,59 +122,27 @@ static constexpr const char *kNetworkType = "network.type";
 
 namespace NetworkConnectionStateValues
 {
-/**
-  none
- */
+
 static constexpr const char *kClosed = "closed";
 
-/**
-  none
- */
 static constexpr const char *kCloseWait = "close_wait";
 
-/**
-  none
- */
 static constexpr const char *kClosing = "closing";
 
-/**
-  none
- */
 static constexpr const char *kEstablished = "established";
 
-/**
-  none
- */
 static constexpr const char *kFinWait1 = "fin_wait_1";
 
-/**
-  none
- */
 static constexpr const char *kFinWait2 = "fin_wait_2";
 
-/**
-  none
- */
 static constexpr const char *kLastAck = "last_ack";
 
-/**
-  none
- */
 static constexpr const char *kListen = "listen";
 
-/**
-  none
- */
 static constexpr const char *kSynReceived = "syn_received";
 
-/**
-  none
- */
 static constexpr const char *kSynSent = "syn_sent";
 
-/**
-  none
- */
 static constexpr const char *kTimeWait = "time_wait";
 
 }  // namespace NetworkConnectionStateValues
@@ -290,43 +258,24 @@ static constexpr const char *kLteCa = "lte_ca";
 
 namespace NetworkConnectionTypeValues
 {
-/**
-  none
- */
+
 static constexpr const char *kWifi = "wifi";
 
-/**
-  none
- */
 static constexpr const char *kWired = "wired";
 
-/**
-  none
- */
 static constexpr const char *kCell = "cell";
 
-/**
-  none
- */
 static constexpr const char *kUnavailable = "unavailable";
 
-/**
-  none
- */
 static constexpr const char *kUnknown = "unknown";
 
 }  // namespace NetworkConnectionTypeValues
 
 namespace NetworkIoDirectionValues
 {
-/**
-  none
- */
+
 static constexpr const char *kTransmit = "transmit";
 
-/**
-  none
- */
 static constexpr const char *kReceive = "receive";
 
 }  // namespace NetworkIoDirectionValues
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/openai_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/openai_attributes.h
new file mode 100644
index 00000000000..83cbd44e8c7
--- /dev/null
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/openai_attributes.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright The OpenTelemetry Authors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/*
+ * DO NOT EDIT, this is an Auto-generated file from:
+ * buildscripts/semantic-convention/templates/registry/semantic_attributes-h.j2
+ */
+
+#pragma once
+
+#include "opentelemetry/common/macros.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace semconv
+{
+namespace openai
+{
+
+/**
+  The service tier requested. May be a specific tier, default, or auto.
+ */
+static constexpr const char *kOpenaiRequestServiceTier = "openai.request.service_tier";
+
+/**
+  The service tier used for the response.
+ */
+static constexpr const char *kOpenaiResponseServiceTier = "openai.response.service_tier";
+
+/**
+  A fingerprint to track any eventual change in the Generative AI environment.
+ */
+static constexpr const char *kOpenaiResponseSystemFingerprint =
+    "openai.response.system_fingerprint";
+
+namespace OpenaiRequestServiceTierValues
+{
+/**
+  The system will utilize scale tier credits until they are exhausted.
+ */
+static constexpr const char *kAuto = "auto";
+
+/**
+  The system will utilize the default scale tier.
+ */
+static constexpr const char *kDefault = "default";
+
+}  // namespace OpenaiRequestServiceTierValues
+
+}  // namespace openai
+}  // namespace semconv
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/os_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/os_attributes.h
index 1c12402c613..90ca8e5aa17 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/os_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/os_attributes.h
@@ -100,8 +100,11 @@ static constexpr const char *kSolaris = "solaris";
 
 /**
   Deprecated. Use @code zos @endcode instead.
+
+  @deprecated
+  {"note": "Replaced by @code zos @endcode.", "reason": "renamed", "renamed_to": "zos"}
  */
-static constexpr const char *kZOs = "z_os";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kZOs = "z_os";
 
 /**
   IBM z/OS
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/otel_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/otel_attributes.h
index ddf04b9406f..20f7bd7786c 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/otel_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/otel_attributes.h
@@ -69,6 +69,11 @@ OPENTELEMETRY_DEPRECATED static constexpr const char *kOtelLibraryVersion = "ote
  */
 static constexpr const char *kOtelScopeName = "otel.scope.name";
 
+/**
+  The schema URL of the instrumentation scope.
+ */
+static constexpr const char *kOtelScopeSchemaUrl = "otel.scope.schema_url";
+
 /**
   The version of the instrumentation scope - (@code InstrumentationScope.Version @endcode in OTLP).
  */
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/otel_metrics.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/otel_metrics.h
index 2f4d9cd2fc2..607939122da 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/otel_metrics.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/otel_metrics.h
@@ -21,7 +21,7 @@ namespace otel
 {
 
 /**
-  The number of log records for which the export has finished, either successful or failed
+  The number of log records for which the export has finished, either successful or failed.
   <p>
   For successful exports, @code error.type @endcode MUST NOT be set. For failed exports, @code
   error.type @endcode MUST contain the failure cause. For exporters with partial success semantics
@@ -31,7 +31,7 @@ namespace otel
  */
 static constexpr const char *kMetricOtelSdkExporterLogExported = "otel.sdk.exporter.log.exported";
 static constexpr const char *descrMetricOtelSdkExporterLogExported =
-    "The number of log records for which the export has finished, either successful or failed";
+    "The number of log records for which the export has finished, either successful or failed.";
 static constexpr const char *unitMetricOtelSdkExporterLogExported = "{log_record}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
@@ -68,14 +68,14 @@ CreateAsyncDoubleMetricOtelSdkExporterLogExported(metrics::Meter *meter)
 
 /**
   The number of log records which were passed to the exporter, but that have not been exported yet
-  (neither successful, nor failed) <p> For successful exports, @code error.type @endcode MUST NOT be
-  set. For failed exports, @code error.type @endcode MUST contain the failure cause. <p>
+  (neither successful, nor failed). <p> For successful exports, @code error.type @endcode MUST NOT
+  be set. For failed exports, @code error.type @endcode MUST contain the failure cause. <p>
   updowncounter
  */
 static constexpr const char *kMetricOtelSdkExporterLogInflight = "otel.sdk.exporter.log.inflight";
 static constexpr const char *descrMetricOtelSdkExporterLogInflight =
     "The number of log records which were passed to the exporter, but that have not been exported "
-    "yet (neither successful, nor failed)";
+    "yet (neither successful, nor failed).";
 static constexpr const char *unitMetricOtelSdkExporterLogInflight = "{log_record}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -111,7 +111,7 @@ CreateAsyncDoubleMetricOtelSdkExporterLogInflight(metrics::Meter *meter)
 }
 
 /**
-  The number of metric data points for which the export has finished, either successful or failed
+  The number of metric data points for which the export has finished, either successful or failed.
   <p>
   For successful exports, @code error.type @endcode MUST NOT be set. For failed exports, @code
   error.type @endcode MUST contain the failure cause. For exporters with partial success semantics
@@ -123,7 +123,7 @@ static constexpr const char *kMetricOtelSdkExporterMetricDataPointExported =
     "otel.sdk.exporter.metric_data_point.exported";
 static constexpr const char *descrMetricOtelSdkExporterMetricDataPointExported =
     "The number of metric data points for which the export has finished, either successful or "
-    "failed";
+    "failed.";
 static constexpr const char *unitMetricOtelSdkExporterMetricDataPointExported = "{data_point}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
@@ -160,7 +160,7 @@ CreateAsyncDoubleMetricOtelSdkExporterMetricDataPointExported(metrics::Meter *me
 
 /**
   The number of metric data points which were passed to the exporter, but that have not been
-  exported yet (neither successful, nor failed) <p> For successful exports, @code error.type
+  exported yet (neither successful, nor failed). <p> For successful exports, @code error.type
   @endcode MUST NOT be set. For failed exports, @code error.type @endcode MUST contain the failure
   cause. <p> updowncounter
  */
@@ -168,7 +168,7 @@ static constexpr const char *kMetricOtelSdkExporterMetricDataPointInflight =
     "otel.sdk.exporter.metric_data_point.inflight";
 static constexpr const char *descrMetricOtelSdkExporterMetricDataPointInflight =
     "The number of metric data points which were passed to the exporter, but that have not been "
-    "exported yet (neither successful, nor failed)";
+    "exported yet (neither successful, nor failed).";
 static constexpr const char *unitMetricOtelSdkExporterMetricDataPointInflight = "{data_point}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -239,7 +239,7 @@ CreateSyncDoubleMetricOtelSdkExporterOperationDuration(metrics::Meter *meter)
 }
 
 /**
-  The number of spans for which the export has finished, either successful or failed
+  The number of spans for which the export has finished, either successful or failed.
   <p>
   For successful exports, @code error.type @endcode MUST NOT be set. For failed exports, @code
   error.type @endcode MUST contain the failure cause. For exporters with partial success semantics
@@ -249,7 +249,7 @@ CreateSyncDoubleMetricOtelSdkExporterOperationDuration(metrics::Meter *meter)
  */
 static constexpr const char *kMetricOtelSdkExporterSpanExported = "otel.sdk.exporter.span.exported";
 static constexpr const char *descrMetricOtelSdkExporterSpanExported =
-    "The number of spans for which the export has finished, either successful or failed";
+    "The number of spans for which the export has finished, either successful or failed.";
 static constexpr const char *unitMetricOtelSdkExporterSpanExported = "{span}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
@@ -332,14 +332,14 @@ CreateAsyncDoubleMetricOtelSdkExporterSpanExportedCount(metrics::Meter *meter)
 
 /**
   The number of spans which were passed to the exporter, but that have not been exported yet
-  (neither successful, nor failed) <p> For successful exports, @code error.type @endcode MUST NOT be
-  set. For failed exports, @code error.type @endcode MUST contain the failure cause. <p>
+  (neither successful, nor failed). <p> For successful exports, @code error.type @endcode MUST NOT
+  be set. For failed exports, @code error.type @endcode MUST contain the failure cause. <p>
   updowncounter
  */
 static constexpr const char *kMetricOtelSdkExporterSpanInflight = "otel.sdk.exporter.span.inflight";
 static constexpr const char *descrMetricOtelSdkExporterSpanInflight =
     "The number of spans which were passed to the exporter, but that have not been exported yet "
-    "(neither successful, nor failed)";
+    "(neither successful, nor failed).";
 static constexpr const char *unitMetricOtelSdkExporterSpanInflight = "{span}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -421,13 +421,13 @@ CreateAsyncDoubleMetricOtelSdkExporterSpanInflightCount(metrics::Meter *meter)
 }
 
 /**
-  The number of logs submitted to enabled SDK Loggers
+  The number of logs submitted to enabled SDK Loggers.
   <p>
   counter
  */
 static constexpr const char *kMetricOtelSdkLogCreated = "otel.sdk.log.created";
 static constexpr const char *descrMetricOtelSdkLogCreated =
-    "The number of logs submitted to enabled SDK Loggers";
+    "The number of logs submitted to enabled SDK Loggers.";
 static constexpr const char *unitMetricOtelSdkLogCreated = "{log_record}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricOtelSdkLogCreated(
@@ -489,7 +489,7 @@ CreateSyncDoubleMetricOtelSdkMetricReaderCollectionDuration(metrics::Meter *mete
 }
 
 /**
-  The number of log records for which the processing has finished, either successful or failed
+  The number of log records for which the processing has finished, either successful or failed.
   <p>
   For successful processing, @code error.type @endcode MUST NOT be set. For failed processing, @code
   error.type @endcode MUST contain the failure cause. For the SDK Simple and Batching Log Record
@@ -499,7 +499,7 @@ CreateSyncDoubleMetricOtelSdkMetricReaderCollectionDuration(metrics::Meter *mete
 static constexpr const char *kMetricOtelSdkProcessorLogProcessed =
     "otel.sdk.processor.log.processed";
 static constexpr const char *descrMetricOtelSdkProcessorLogProcessed =
-    "The number of log records for which the processing has finished, either successful or failed";
+    "The number of log records for which the processing has finished, either successful or failed.";
 static constexpr const char *unitMetricOtelSdkProcessorLogProcessed = "{log_record}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
@@ -536,14 +536,14 @@ CreateAsyncDoubleMetricOtelSdkProcessorLogProcessed(metrics::Meter *meter)
 
 /**
   The maximum number of log records the queue of a given instance of an SDK Log Record processor can
-  hold <p> Only applies to Log Record processors which use a queue, e.g. the SDK Batching Log Record
-  Processor. <p> updowncounter
+  hold. <p> Only applies to Log Record processors which use a queue, e.g. the SDK Batching Log
+  Record Processor. <p> updowncounter
  */
 static constexpr const char *kMetricOtelSdkProcessorLogQueueCapacity =
     "otel.sdk.processor.log.queue.capacity";
 static constexpr const char *descrMetricOtelSdkProcessorLogQueueCapacity =
     "The maximum number of log records the queue of a given instance of an SDK Log Record "
-    "processor can hold";
+    "processor can hold.";
 static constexpr const char *unitMetricOtelSdkProcessorLogQueueCapacity = "{log_record}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -579,7 +579,7 @@ CreateAsyncDoubleMetricOtelSdkProcessorLogQueueCapacity(metrics::Meter *meter)
 }
 
 /**
-  The number of log records in the queue of a given instance of an SDK log processor
+  The number of log records in the queue of a given instance of an SDK log processor.
   <p>
   Only applies to log record processors which use a queue, e.g. the SDK Batching Log Record
   Processor. <p> updowncounter
@@ -587,7 +587,7 @@ CreateAsyncDoubleMetricOtelSdkProcessorLogQueueCapacity(metrics::Meter *meter)
 static constexpr const char *kMetricOtelSdkProcessorLogQueueSize =
     "otel.sdk.processor.log.queue.size";
 static constexpr const char *descrMetricOtelSdkProcessorLogQueueSize =
-    "The number of log records in the queue of a given instance of an SDK log processor";
+    "The number of log records in the queue of a given instance of an SDK log processor.";
 static constexpr const char *unitMetricOtelSdkProcessorLogQueueSize = "{log_record}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -623,7 +623,7 @@ CreateAsyncDoubleMetricOtelSdkProcessorLogQueueSize(metrics::Meter *meter)
 }
 
 /**
-  The number of spans for which the processing has finished, either successful or failed
+  The number of spans for which the processing has finished, either successful or failed.
   <p>
   For successful processing, @code error.type @endcode MUST NOT be set. For failed processing, @code
   error.type @endcode MUST contain the failure cause. For the SDK Simple and Batching Span Processor
@@ -633,7 +633,7 @@ CreateAsyncDoubleMetricOtelSdkProcessorLogQueueSize(metrics::Meter *meter)
 static constexpr const char *kMetricOtelSdkProcessorSpanProcessed =
     "otel.sdk.processor.span.processed";
 static constexpr const char *descrMetricOtelSdkProcessorSpanProcessed =
-    "The number of spans for which the processing has finished, either successful or failed";
+    "The number of spans for which the processing has finished, either successful or failed.";
 static constexpr const char *unitMetricOtelSdkProcessorSpanProcessed = "{span}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
@@ -716,7 +716,7 @@ CreateAsyncDoubleMetricOtelSdkProcessorSpanProcessedCount(metrics::Meter *meter)
 }
 
 /**
-  The maximum number of spans the queue of a given instance of an SDK span processor can hold
+  The maximum number of spans the queue of a given instance of an SDK span processor can hold.
   <p>
   Only applies to span processors which use a queue, e.g. the SDK Batching Span Processor.
   <p>
@@ -725,7 +725,7 @@ CreateAsyncDoubleMetricOtelSdkProcessorSpanProcessedCount(metrics::Meter *meter)
 static constexpr const char *kMetricOtelSdkProcessorSpanQueueCapacity =
     "otel.sdk.processor.span.queue.capacity";
 static constexpr const char *descrMetricOtelSdkProcessorSpanQueueCapacity =
-    "The maximum number of spans the queue of a given instance of an SDK span processor can hold";
+    "The maximum number of spans the queue of a given instance of an SDK span processor can hold.";
 static constexpr const char *unitMetricOtelSdkProcessorSpanQueueCapacity = "{span}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -761,7 +761,7 @@ CreateAsyncDoubleMetricOtelSdkProcessorSpanQueueCapacity(metrics::Meter *meter)
 }
 
 /**
-  The number of spans in the queue of a given instance of an SDK span processor
+  The number of spans in the queue of a given instance of an SDK span processor.
   <p>
   Only applies to span processors which use a queue, e.g. the SDK Batching Span Processor.
   <p>
@@ -770,7 +770,7 @@ CreateAsyncDoubleMetricOtelSdkProcessorSpanQueueCapacity(metrics::Meter *meter)
 static constexpr const char *kMetricOtelSdkProcessorSpanQueueSize =
     "otel.sdk.processor.span.queue.size";
 static constexpr const char *descrMetricOtelSdkProcessorSpanQueueSize =
-    "The number of spans in the queue of a given instance of an SDK span processor";
+    "The number of spans in the queue of a given instance of an SDK span processor.";
 static constexpr const char *unitMetricOtelSdkProcessorSpanQueueSize = "{span}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -895,12 +895,12 @@ CreateAsyncDoubleMetricOtelSdkSpanEndedCount(metrics::Meter *meter)
 
 /**
   The number of created spans with @code recording=true @endcode for which the end operation has not
-  been called yet <p> updowncounter
+  been called yet. <p> updowncounter
  */
 static constexpr const char *kMetricOtelSdkSpanLive = "otel.sdk.span.live";
 static constexpr const char *descrMetricOtelSdkSpanLive =
     "The number of created spans with `recording=true` for which the end operation has not been "
-    "called yet";
+    "called yet.";
 static constexpr const char *unitMetricOtelSdkSpanLive = "{span}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -973,14 +973,14 @@ CreateAsyncDoubleMetricOtelSdkSpanLiveCount(metrics::Meter *meter)
 }
 
 /**
-  The number of created spans
+  The number of created spans.
   <p>
   Implementations MUST record this metric for all spans, even for non-recording ones.
   <p>
   counter
  */
 static constexpr const char *kMetricOtelSdkSpanStarted     = "otel.sdk.span.started";
-static constexpr const char *descrMetricOtelSdkSpanStarted = "The number of created spans";
+static constexpr const char *descrMetricOtelSdkSpanStarted = "The number of created spans.";
 static constexpr const char *unitMetricOtelSdkSpanStarted  = "{span}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricOtelSdkSpanStarted(
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/other_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/other_attributes.h
index ab0939606f4..c8feb59b622 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/other_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/other_attributes.h
@@ -30,14 +30,9 @@ OPENTELEMETRY_DEPRECATED static constexpr const char *kState = "state";
 
 namespace StateValues
 {
-/**
-  none
- */
+
 static constexpr const char *kIdle = "idle";
 
-/**
-  none
- */
 static constexpr const char *kUsed = "used";
 
 }  // namespace StateValues
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/process_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/process_attributes.h
index e6f32fbc084..b6a8bd1d024 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/process_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/process_attributes.h
@@ -247,47 +247,29 @@ static constexpr const char *kProcessWorkingDirectory = "process.working_directo
 
 namespace ProcessContextSwitchTypeValues
 {
-/**
-  none
- */
+
 static constexpr const char *kVoluntary = "voluntary";
 
-/**
-  none
- */
 static constexpr const char *kInvoluntary = "involuntary";
 
 }  // namespace ProcessContextSwitchTypeValues
 
 namespace ProcessCpuStateValues
 {
-/**
-  none
- */
+
 static constexpr const char *kSystem = "system";
 
-/**
-  none
- */
 static constexpr const char *kUser = "user";
 
-/**
-  none
- */
 static constexpr const char *kWait = "wait";
 
 }  // namespace ProcessCpuStateValues
 
 namespace ProcessPagingFaultTypeValues
 {
-/**
-  none
- */
+
 static constexpr const char *kMajor = "major";
 
-/**
-  none
- */
 static constexpr const char *kMinor = "minor";
 
 }  // namespace ProcessPagingFaultTypeValues
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/rpc_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/rpc_attributes.h
index daf36ce67bb..8a85fe46970 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/rpc_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/rpc_attributes.h
@@ -149,84 +149,37 @@ static constexpr const char *kRpcSystem = "rpc.system";
 
 namespace RpcConnectRpcErrorCodeValues
 {
-/**
-  none
- */
+
 static constexpr const char *kCancelled = "cancelled";
 
-/**
-  none
- */
 static constexpr const char *kUnknown = "unknown";
 
-/**
-  none
- */
 static constexpr const char *kInvalidArgument = "invalid_argument";
 
-/**
-  none
- */
 static constexpr const char *kDeadlineExceeded = "deadline_exceeded";
 
-/**
-  none
- */
 static constexpr const char *kNotFound = "not_found";
 
-/**
-  none
- */
 static constexpr const char *kAlreadyExists = "already_exists";
 
-/**
-  none
- */
 static constexpr const char *kPermissionDenied = "permission_denied";
 
-/**
-  none
- */
 static constexpr const char *kResourceExhausted = "resource_exhausted";
 
-/**
-  none
- */
 static constexpr const char *kFailedPrecondition = "failed_precondition";
 
-/**
-  none
- */
 static constexpr const char *kAborted = "aborted";
 
-/**
-  none
- */
 static constexpr const char *kOutOfRange = "out_of_range";
 
-/**
-  none
- */
 static constexpr const char *kUnimplemented = "unimplemented";
 
-/**
-  none
- */
 static constexpr const char *kInternal = "internal";
 
-/**
-  none
- */
 static constexpr const char *kUnavailable = "unavailable";
 
-/**
-  none
- */
 static constexpr const char *kDataLoss = "data_loss";
 
-/**
-  none
- */
 static constexpr const char *kUnauthenticated = "unauthenticated";
 
 }  // namespace RpcConnectRpcErrorCodeValues
@@ -322,14 +275,9 @@ static constexpr int kUnauthenticated = 16;
 
 namespace RpcMessageTypeValues
 {
-/**
-  none
- */
+
 static constexpr const char *kSent = "SENT";
 
-/**
-  none
- */
 static constexpr const char *kReceived = "RECEIVED";
 
 }  // namespace RpcMessageTypeValues
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/system_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/system_attributes.h
index 917d507b364..70001903511 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/system_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/system_attributes.h
@@ -105,92 +105,47 @@ OPENTELEMETRY_DEPRECATED static constexpr const char *kSystemProcessesStatus =
 
 namespace SystemCpuStateValues
 {
-/**
-  none
- */
+
 static constexpr const char *kUser = "user";
 
-/**
-  none
- */
 static constexpr const char *kSystem = "system";
 
-/**
-  none
- */
 static constexpr const char *kNice = "nice";
 
-/**
-  none
- */
 static constexpr const char *kIdle = "idle";
 
-/**
-  none
- */
 static constexpr const char *kIowait = "iowait";
 
-/**
-  none
- */
 static constexpr const char *kInterrupt = "interrupt";
 
-/**
-  none
- */
 static constexpr const char *kSteal = "steal";
 
 }  // namespace SystemCpuStateValues
 
 namespace SystemFilesystemStateValues
 {
-/**
-  none
- */
+
 static constexpr const char *kUsed = "used";
 
-/**
-  none
- */
 static constexpr const char *kFree = "free";
 
-/**
-  none
- */
 static constexpr const char *kReserved = "reserved";
 
 }  // namespace SystemFilesystemStateValues
 
 namespace SystemFilesystemTypeValues
 {
-/**
-  none
- */
+
 static constexpr const char *kFat32 = "fat32";
 
-/**
-  none
- */
 static constexpr const char *kExfat = "exfat";
 
-/**
-  none
- */
 static constexpr const char *kNtfs = "ntfs";
 
-/**
-  none
- */
 static constexpr const char *kRefs = "refs";
 
-/**
-  none
- */
 static constexpr const char *kHfsplus = "hfsplus";
 
-/**
-  none
- */
 static constexpr const char *kExt4 = "ext4";
 
 }  // namespace SystemFilesystemTypeValues
@@ -198,182 +153,103 @@ static constexpr const char *kExt4 = "ext4";
 namespace SystemMemoryStateValues
 {
 /**
-  none
+  Actual used virtual memory in bytes.
  */
 static constexpr const char *kUsed = "used";
 
-/**
-  none
- */
 static constexpr const char *kFree = "free";
 
 /**
-  none
+  @deprecated
+  {"note": "Removed, report shared memory usage with @code metric.system.memory.shared @endcode
+  metric", "reason": "uncategorized"}
  */
-static constexpr const char *kShared = "shared";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kShared = "shared";
 
-/**
-  none
- */
 static constexpr const char *kBuffers = "buffers";
 
-/**
-  none
- */
 static constexpr const char *kCached = "cached";
 
 }  // namespace SystemMemoryStateValues
 
 namespace SystemNetworkStateValues
 {
-/**
-  none
- */
+
 static constexpr const char *kClose = "close";
 
-/**
-  none
- */
 static constexpr const char *kCloseWait = "close_wait";
 
-/**
-  none
- */
 static constexpr const char *kClosing = "closing";
 
-/**
-  none
- */
 static constexpr const char *kDelete = "delete";
 
-/**
-  none
- */
 static constexpr const char *kEstablished = "established";
 
-/**
-  none
- */
 static constexpr const char *kFinWait1 = "fin_wait_1";
 
-/**
-  none
- */
 static constexpr const char *kFinWait2 = "fin_wait_2";
 
-/**
-  none
- */
 static constexpr const char *kLastAck = "last_ack";
 
-/**
-  none
- */
 static constexpr const char *kListen = "listen";
 
-/**
-  none
- */
 static constexpr const char *kSynRecv = "syn_recv";
 
-/**
-  none
- */
 static constexpr const char *kSynSent = "syn_sent";
 
-/**
-  none
- */
 static constexpr const char *kTimeWait = "time_wait";
 
 }  // namespace SystemNetworkStateValues
 
 namespace SystemPagingDirectionValues
 {
-/**
-  none
- */
+
 static constexpr const char *kIn = "in";
 
-/**
-  none
- */
 static constexpr const char *kOut = "out";
 
 }  // namespace SystemPagingDirectionValues
 
 namespace SystemPagingStateValues
 {
-/**
-  none
- */
+
 static constexpr const char *kUsed = "used";
 
-/**
-  none
- */
 static constexpr const char *kFree = "free";
 
 }  // namespace SystemPagingStateValues
 
 namespace SystemPagingTypeValues
 {
-/**
-  none
- */
+
 static constexpr const char *kMajor = "major";
 
-/**
-  none
- */
 static constexpr const char *kMinor = "minor";
 
 }  // namespace SystemPagingTypeValues
 
 namespace SystemProcessStatusValues
 {
-/**
-  none
- */
+
 static constexpr const char *kRunning = "running";
 
-/**
-  none
- */
 static constexpr const char *kSleeping = "sleeping";
 
-/**
-  none
- */
 static constexpr const char *kStopped = "stopped";
 
-/**
-  none
- */
 static constexpr const char *kDefunct = "defunct";
 
 }  // namespace SystemProcessStatusValues
 
 namespace SystemProcessesStatusValues
 {
-/**
-  none
- */
+
 static constexpr const char *kRunning = "running";
 
-/**
-  none
- */
 static constexpr const char *kSleeping = "sleeping";
 
-/**
-  none
- */
 static constexpr const char *kStopped = "stopped";
 
-/**
-  none
- */
 static constexpr const char *kDefunct = "defunct";
 
 }  // namespace SystemProcessesStatusValues
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/system_metrics.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/system_metrics.h
index f905b73b6ff..d0767b51a60 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/system_metrics.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/system_metrics.h
@@ -63,13 +63,13 @@ CreateAsyncDoubleMetricSystemCpuFrequency(metrics::Meter *meter)
 
 /**
   Reports the number of logical (virtual) processor cores created by the operating system to manage
-  multitasking <p> Calculated by multiplying the number of sockets by the number of cores per
+  multitasking. <p> Calculated by multiplying the number of sockets by the number of cores per
   socket, and then by the number of threads per core <p> updowncounter
  */
 static constexpr const char *kMetricSystemCpuLogicalCount = "system.cpu.logical.count";
 static constexpr const char *descrMetricSystemCpuLogicalCount =
     "Reports the number of logical (virtual) processor cores created by the operating system to "
-    "manage multitasking";
+    "manage multitasking.";
 static constexpr const char *unitMetricSystemCpuLogicalCount = "{cpu}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -105,7 +105,7 @@ CreateAsyncDoubleMetricSystemCpuLogicalCount(metrics::Meter *meter)
 }
 
 /**
-  Reports the number of actual physical processor cores on the hardware
+  Reports the number of actual physical processor cores on the hardware.
   <p>
   Calculated by multiplying the number of sockets by the number of cores per socket
   <p>
@@ -113,7 +113,7 @@ CreateAsyncDoubleMetricSystemCpuLogicalCount(metrics::Meter *meter)
  */
 static constexpr const char *kMetricSystemCpuPhysicalCount = "system.cpu.physical.count";
 static constexpr const char *descrMetricSystemCpuPhysicalCount =
-    "Reports the number of actual physical processor cores on the hardware";
+    "Reports the number of actual physical processor cores on the hardware.";
 static constexpr const char *unitMetricSystemCpuPhysicalCount = "{cpu}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -149,13 +149,13 @@ CreateAsyncDoubleMetricSystemCpuPhysicalCount(metrics::Meter *meter)
 }
 
 /**
-  Seconds each logical CPU spent on each mode
+  Seconds each logical CPU spent on each mode.
   <p>
   counter
  */
 static constexpr const char *kMetricSystemCpuTime = "system.cpu.time";
 static constexpr const char *descrMetricSystemCpuTime =
-    "Seconds each logical CPU spent on each mode";
+    "Seconds each logical CPU spent on each mode.";
 static constexpr const char *unitMetricSystemCpuTime = "s";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricSystemCpuTime(
@@ -228,10 +228,12 @@ CreateAsyncDoubleMetricSystemCpuUtilization(metrics::Meter *meter)
 }
 
 /**
+  TODO.
+  <p>
   counter
  */
 static constexpr const char *kMetricSystemDiskIo     = "system.disk.io";
-static constexpr const char *descrMetricSystemDiskIo = "";
+static constexpr const char *descrMetricSystemDiskIo = "TODO.";
 static constexpr const char *unitMetricSystemDiskIo  = "By";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricSystemDiskIo(
@@ -263,7 +265,7 @@ static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDouble
 }
 
 /**
-  Time disk spent activated
+  Time disk spent activated.
   <p>
   The real elapsed time ("wall clock") used in the I/O path (time from operations running in
   parallel are not counted). Measured as: <ul> <li>Linux: Field 13 from <a
@@ -277,7 +279,7 @@ static inline nostd::shared_ptr<metrics::ObservableInstrument> CreateAsyncDouble
   counter
  */
 static constexpr const char *kMetricSystemDiskIoTime     = "system.disk.io_time";
-static constexpr const char *descrMetricSystemDiskIoTime = "Time disk spent activated";
+static constexpr const char *descrMetricSystemDiskIoTime = "Time disk spent activated.";
 static constexpr const char *unitMetricSystemDiskIoTime  = "s";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricSystemDiskIoTime(
@@ -309,12 +311,12 @@ CreateAsyncDoubleMetricSystemDiskIoTime(metrics::Meter *meter)
 }
 
 /**
-  The total storage capacity of the disk
+  The total storage capacity of the disk.
   <p>
   updowncounter
  */
 static constexpr const char *kMetricSystemDiskLimit     = "system.disk.limit";
-static constexpr const char *descrMetricSystemDiskLimit = "The total storage capacity of the disk";
+static constexpr const char *descrMetricSystemDiskLimit = "The total storage capacity of the disk.";
 static constexpr const char *unitMetricSystemDiskLimit  = "By";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -346,10 +348,12 @@ CreateAsyncDoubleMetricSystemDiskLimit(metrics::Meter *meter)
 }
 
 /**
+  TODO.
+  <p>
   counter
  */
 static constexpr const char *kMetricSystemDiskMerged     = "system.disk.merged";
-static constexpr const char *descrMetricSystemDiskMerged = "";
+static constexpr const char *descrMetricSystemDiskMerged = "TODO.";
 static constexpr const char *unitMetricSystemDiskMerged  = "{operation}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricSystemDiskMerged(
@@ -381,7 +385,7 @@ CreateAsyncDoubleMetricSystemDiskMerged(metrics::Meter *meter)
 }
 
 /**
-  Sum of the time each operation took to complete
+  Sum of the time each operation took to complete.
   <p>
   Because it is the sum of time each request took, parallel-issued requests each contribute to make
   the count grow. Measured as: <ul> <li>Linux: Fields 7 & 11 from <a
@@ -394,7 +398,7 @@ CreateAsyncDoubleMetricSystemDiskMerged(metrics::Meter *meter)
  */
 static constexpr const char *kMetricSystemDiskOperationTime = "system.disk.operation_time";
 static constexpr const char *descrMetricSystemDiskOperationTime =
-    "Sum of the time each operation took to complete";
+    "Sum of the time each operation took to complete.";
 static constexpr const char *unitMetricSystemDiskOperationTime = "s";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
@@ -430,10 +434,12 @@ CreateAsyncDoubleMetricSystemDiskOperationTime(metrics::Meter *meter)
 }
 
 /**
+  TODO.
+  <p>
   counter
  */
 static constexpr const char *kMetricSystemDiskOperations     = "system.disk.operations";
-static constexpr const char *descrMetricSystemDiskOperations = "";
+static constexpr const char *descrMetricSystemDiskOperations = "TODO.";
 static constexpr const char *unitMetricSystemDiskOperations  = "{operation}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
@@ -465,13 +471,13 @@ CreateAsyncDoubleMetricSystemDiskOperations(metrics::Meter *meter)
 }
 
 /**
-  The total storage capacity of the filesystem
+  The total storage capacity of the filesystem.
   <p>
   updowncounter
  */
 static constexpr const char *kMetricSystemFilesystemLimit = "system.filesystem.limit";
 static constexpr const char *descrMetricSystemFilesystemLimit =
-    "The total storage capacity of the filesystem";
+    "The total storage capacity of the filesystem.";
 static constexpr const char *unitMetricSystemFilesystemLimit = "By";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -551,10 +557,12 @@ CreateAsyncDoubleMetricSystemFilesystemUsage(metrics::Meter *meter)
 }
 
 /**
+  TODO.
+  <p>
   gauge
  */
 static constexpr const char *kMetricSystemFilesystemUtilization = "system.filesystem.utilization";
-static constexpr const char *descrMetricSystemFilesystemUtilization = "";
+static constexpr const char *descrMetricSystemFilesystemUtilization = "TODO.";
 static constexpr const char *unitMetricSystemFilesystemUtilization  = "1";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
@@ -594,7 +602,7 @@ CreateAsyncDoubleMetricSystemFilesystemUtilization(metrics::Meter *meter)
 
 /**
   An estimate of how much memory is available for starting new applications, without causing
-  swapping <p> This is an alternative to @code system.memory.usage @endcode metric with @code
+  swapping. <p> This is an alternative to @code system.memory.usage @endcode metric with @code
   state=free @endcode. Linux starting from 3.14 exports "available" memory. It takes "free" memory
   as a baseline, and then factors in kernel-specific values. This is supposed to be more accurate
   than just "free" memory. For reference, see the calculations <a
@@ -604,7 +612,7 @@ CreateAsyncDoubleMetricSystemFilesystemUtilization(metrics::Meter *meter)
 static constexpr const char *kMetricSystemLinuxMemoryAvailable = "system.linux.memory.available";
 static constexpr const char *descrMetricSystemLinuxMemoryAvailable =
     "An estimate of how much memory is available for starting new applications, without causing "
-    "swapping";
+    "swapping.";
 static constexpr const char *unitMetricSystemLinuxMemoryAvailable = "By";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -688,15 +696,14 @@ CreateAsyncDoubleMetricSystemLinuxMemorySlabUsage(metrics::Meter *meter)
 }
 
 /**
-  Total memory available in the system.
-  <p>
-  Its value SHOULD equal the sum of @code system.memory.state @endcode over all states.
+  Total virtual memory available in the system.
   <p>
   updowncounter
  */
-static constexpr const char *kMetricSystemMemoryLimit     = "system.memory.limit";
-static constexpr const char *descrMetricSystemMemoryLimit = "Total memory available in the system.";
-static constexpr const char *unitMetricSystemMemoryLimit  = "By";
+static constexpr const char *kMetricSystemMemoryLimit = "system.memory.limit";
+static constexpr const char *descrMetricSystemMemoryLimit =
+    "Total virtual memory available in the system.";
+static constexpr const char *unitMetricSystemMemoryLimit = "By";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
 CreateSyncInt64MetricSystemMemoryLimit(metrics::Meter *meter)
@@ -770,9 +777,6 @@ CreateAsyncDoubleMetricSystemMemoryShared(metrics::Meter *meter)
 /**
   Reports memory in use by state.
   <p>
-  The sum over all @code system.memory.state @endcode values SHOULD equal the total memory
-  available on the system, that is @code system.memory.limit @endcode.
-  <p>
   updowncounter
  */
 static constexpr const char *kMetricSystemMemoryUsage     = "system.memory.usage";
@@ -808,10 +812,12 @@ CreateAsyncDoubleMetricSystemMemoryUsage(metrics::Meter *meter)
 }
 
 /**
+  TODO.
+  <p>
   gauge
  */
 static constexpr const char *kMetricSystemMemoryUtilization     = "system.memory.utilization";
-static constexpr const char *descrMetricSystemMemoryUtilization = "";
+static constexpr const char *descrMetricSystemMemoryUtilization = "TODO.";
 static constexpr const char *unitMetricSystemMemoryUtilization  = "1";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
@@ -849,11 +855,13 @@ CreateAsyncDoubleMetricSystemMemoryUtilization(metrics::Meter *meter)
 }
 
 /**
+  TODO.
+  <p>
   updowncounter
  */
 static constexpr const char *kMetricSystemNetworkConnectionCount =
     "system.network.connection.count";
-static constexpr const char *descrMetricSystemNetworkConnectionCount = "";
+static constexpr const char *descrMetricSystemNetworkConnectionCount = "TODO.";
 static constexpr const char *unitMetricSystemNetworkConnectionCount  = "{connection}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -889,7 +897,7 @@ CreateAsyncDoubleMetricSystemNetworkConnectionCount(metrics::Meter *meter)
 }
 
 /**
-  Deprecated, use @code system.network.connection.count @endcode instead
+  Deprecated, use @code system.network.connection.count @endcode instead.
 
   @deprecated
   {"note": "Replaced by @code system.network.connection.count @endcode.", "reason": "renamed",
@@ -898,7 +906,7 @@ CreateAsyncDoubleMetricSystemNetworkConnectionCount(metrics::Meter *meter)
 OPENTELEMETRY_DEPRECATED static constexpr const char *kMetricSystemNetworkConnections =
     "system.network.connections";
 OPENTELEMETRY_DEPRECATED static constexpr const char *descrMetricSystemNetworkConnections =
-    "Deprecated, use `system.network.connection.count` instead";
+    "Deprecated, use `system.network.connection.count` instead.";
 OPENTELEMETRY_DEPRECATED static constexpr const char *unitMetricSystemNetworkConnections =
     "{connection}";
 
@@ -935,60 +943,11 @@ CreateAsyncDoubleMetricSystemNetworkConnections(metrics::Meter *meter)
 }
 
 /**
-  Count of packets that are dropped or discarded even though there was no error
+  Count of network errors detected.
   <p>
   Measured as:
   <ul>
-    <li>Linux: the @code drop @endcode column in @code /proc/dev/net @endcode (<a
-  href="https://web.archive.org/web/20180321091318/http://www.onlamp.com/pub/a/linux/2000/11/16/LinuxAdmin.html">source</a>)</li>
-    <li>Windows: <a
-  href="https://docs.microsoft.com/windows/win32/api/netioapi/ns-netioapi-mib_if_row2">@code
-  InDiscards @endcode/@code OutDiscards @endcode</a> from <a
-  href="https://docs.microsoft.com/windows/win32/api/netioapi/nf-netioapi-getifentry2">@code
-  GetIfEntry2 @endcode</a></li>
-  </ul>
-  <p>
-  counter
- */
-static constexpr const char *kMetricSystemNetworkDropped = "system.network.dropped";
-static constexpr const char *descrMetricSystemNetworkDropped =
-    "Count of packets that are dropped or discarded even though there was no error";
-static constexpr const char *unitMetricSystemNetworkDropped = "{packet}";
-
-static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
-CreateSyncInt64MetricSystemNetworkDropped(metrics::Meter *meter)
-{
-  return meter->CreateUInt64Counter(kMetricSystemNetworkDropped, descrMetricSystemNetworkDropped,
-                                    unitMetricSystemNetworkDropped);
-}
-
-static inline nostd::unique_ptr<metrics::Counter<double>>
-CreateSyncDoubleMetricSystemNetworkDropped(metrics::Meter *meter)
-{
-  return meter->CreateDoubleCounter(kMetricSystemNetworkDropped, descrMetricSystemNetworkDropped,
-                                    unitMetricSystemNetworkDropped);
-}
-
-static inline nostd::shared_ptr<metrics::ObservableInstrument>
-CreateAsyncInt64MetricSystemNetworkDropped(metrics::Meter *meter)
-{
-  return meter->CreateInt64ObservableCounter(
-      kMetricSystemNetworkDropped, descrMetricSystemNetworkDropped, unitMetricSystemNetworkDropped);
-}
-
-static inline nostd::shared_ptr<metrics::ObservableInstrument>
-CreateAsyncDoubleMetricSystemNetworkDropped(metrics::Meter *meter)
-{
-  return meter->CreateDoubleObservableCounter(
-      kMetricSystemNetworkDropped, descrMetricSystemNetworkDropped, unitMetricSystemNetworkDropped);
-}
-
-/**
-  Count of network errors detected
-  <p>
-  Measured as:
-  <ul>
-    <li>Linux: the @code errs @endcode column in @code /proc/dev/net @endcode (<a
+    <li>Linux: the @code errs @endcode column in @code /proc/net/dev @endcode (<a
   href="https://web.archive.org/web/20180321091318/http://www.onlamp.com/pub/a/linux/2000/11/16/LinuxAdmin.html">source</a>).</li>
     <li>Windows: <a
   href="https://docs.microsoft.com/windows/win32/api/netioapi/ns-netioapi-mib_if_row2">@code
@@ -1000,7 +959,7 @@ CreateAsyncDoubleMetricSystemNetworkDropped(metrics::Meter *meter)
   counter
  */
 static constexpr const char *kMetricSystemNetworkErrors     = "system.network.errors";
-static constexpr const char *descrMetricSystemNetworkErrors = "Count of network errors detected";
+static constexpr const char *descrMetricSystemNetworkErrors = "Count of network errors detected.";
 static constexpr const char *unitMetricSystemNetworkErrors  = "{error}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
@@ -1032,10 +991,12 @@ CreateAsyncDoubleMetricSystemNetworkErrors(metrics::Meter *meter)
 }
 
 /**
+  TODO.
+  <p>
   counter
  */
 static constexpr const char *kMetricSystemNetworkIo     = "system.network.io";
-static constexpr const char *descrMetricSystemNetworkIo = "";
+static constexpr const char *descrMetricSystemNetworkIo = "TODO.";
 static constexpr const char *unitMetricSystemNetworkIo  = "By";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricSystemNetworkIo(
@@ -1067,45 +1028,106 @@ CreateAsyncDoubleMetricSystemNetworkIo(metrics::Meter *meter)
 }
 
 /**
+  TODO.
+  <p>
   counter
  */
-static constexpr const char *kMetricSystemNetworkPackets     = "system.network.packets";
-static constexpr const char *descrMetricSystemNetworkPackets = "";
-static constexpr const char *unitMetricSystemNetworkPackets  = "{packet}";
+static constexpr const char *kMetricSystemNetworkPacketCount     = "system.network.packet.count";
+static constexpr const char *descrMetricSystemNetworkPacketCount = "TODO.";
+static constexpr const char *unitMetricSystemNetworkPacketCount  = "{packet}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
-CreateSyncInt64MetricSystemNetworkPackets(metrics::Meter *meter)
+CreateSyncInt64MetricSystemNetworkPacketCount(metrics::Meter *meter)
 {
-  return meter->CreateUInt64Counter(kMetricSystemNetworkPackets, descrMetricSystemNetworkPackets,
-                                    unitMetricSystemNetworkPackets);
+  return meter->CreateUInt64Counter(kMetricSystemNetworkPacketCount,
+                                    descrMetricSystemNetworkPacketCount,
+                                    unitMetricSystemNetworkPacketCount);
 }
 
 static inline nostd::unique_ptr<metrics::Counter<double>>
-CreateSyncDoubleMetricSystemNetworkPackets(metrics::Meter *meter)
+CreateSyncDoubleMetricSystemNetworkPacketCount(metrics::Meter *meter)
 {
-  return meter->CreateDoubleCounter(kMetricSystemNetworkPackets, descrMetricSystemNetworkPackets,
-                                    unitMetricSystemNetworkPackets);
+  return meter->CreateDoubleCounter(kMetricSystemNetworkPacketCount,
+                                    descrMetricSystemNetworkPacketCount,
+                                    unitMetricSystemNetworkPacketCount);
 }
 
 static inline nostd::shared_ptr<metrics::ObservableInstrument>
-CreateAsyncInt64MetricSystemNetworkPackets(metrics::Meter *meter)
+CreateAsyncInt64MetricSystemNetworkPacketCount(metrics::Meter *meter)
 {
-  return meter->CreateInt64ObservableCounter(
-      kMetricSystemNetworkPackets, descrMetricSystemNetworkPackets, unitMetricSystemNetworkPackets);
+  return meter->CreateInt64ObservableCounter(kMetricSystemNetworkPacketCount,
+                                             descrMetricSystemNetworkPacketCount,
+                                             unitMetricSystemNetworkPacketCount);
 }
 
 static inline nostd::shared_ptr<metrics::ObservableInstrument>
-CreateAsyncDoubleMetricSystemNetworkPackets(metrics::Meter *meter)
+CreateAsyncDoubleMetricSystemNetworkPacketCount(metrics::Meter *meter)
 {
-  return meter->CreateDoubleObservableCounter(
-      kMetricSystemNetworkPackets, descrMetricSystemNetworkPackets, unitMetricSystemNetworkPackets);
+  return meter->CreateDoubleObservableCounter(kMetricSystemNetworkPacketCount,
+                                              descrMetricSystemNetworkPacketCount,
+                                              unitMetricSystemNetworkPacketCount);
 }
 
 /**
+  Count of packets that are dropped or discarded even though there was no error.
+  <p>
+  Measured as:
+  <ul>
+    <li>Linux: the @code drop @endcode column in @code /proc/net/dev @endcode (<a
+  href="https://web.archive.org/web/20180321091318/http://www.onlamp.com/pub/a/linux/2000/11/16/LinuxAdmin.html">source</a>)</li>
+    <li>Windows: <a
+  href="https://docs.microsoft.com/windows/win32/api/netioapi/ns-netioapi-mib_if_row2">@code
+  InDiscards @endcode/@code OutDiscards @endcode</a> from <a
+  href="https://docs.microsoft.com/windows/win32/api/netioapi/nf-netioapi-getifentry2">@code
+  GetIfEntry2 @endcode</a></li>
+  </ul>
+  <p>
+  counter
+ */
+static constexpr const char *kMetricSystemNetworkPacketDropped = "system.network.packet.dropped";
+static constexpr const char *descrMetricSystemNetworkPacketDropped =
+    "Count of packets that are dropped or discarded even though there was no error.";
+static constexpr const char *unitMetricSystemNetworkPacketDropped = "{packet}";
+
+static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
+CreateSyncInt64MetricSystemNetworkPacketDropped(metrics::Meter *meter)
+{
+  return meter->CreateUInt64Counter(kMetricSystemNetworkPacketDropped,
+                                    descrMetricSystemNetworkPacketDropped,
+                                    unitMetricSystemNetworkPacketDropped);
+}
+
+static inline nostd::unique_ptr<metrics::Counter<double>>
+CreateSyncDoubleMetricSystemNetworkPacketDropped(metrics::Meter *meter)
+{
+  return meter->CreateDoubleCounter(kMetricSystemNetworkPacketDropped,
+                                    descrMetricSystemNetworkPacketDropped,
+                                    unitMetricSystemNetworkPacketDropped);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncInt64MetricSystemNetworkPacketDropped(metrics::Meter *meter)
+{
+  return meter->CreateInt64ObservableCounter(kMetricSystemNetworkPacketDropped,
+                                             descrMetricSystemNetworkPacketDropped,
+                                             unitMetricSystemNetworkPacketDropped);
+}
+
+static inline nostd::shared_ptr<metrics::ObservableInstrument>
+CreateAsyncDoubleMetricSystemNetworkPacketDropped(metrics::Meter *meter)
+{
+  return meter->CreateDoubleObservableCounter(kMetricSystemNetworkPacketDropped,
+                                              descrMetricSystemNetworkPacketDropped,
+                                              unitMetricSystemNetworkPacketDropped);
+}
+
+/**
+  TODO.
+  <p>
   counter
  */
 static constexpr const char *kMetricSystemPagingFaults     = "system.paging.faults";
-static constexpr const char *descrMetricSystemPagingFaults = "";
+static constexpr const char *descrMetricSystemPagingFaults = "TODO.";
 static constexpr const char *unitMetricSystemPagingFaults  = "{fault}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>> CreateSyncInt64MetricSystemPagingFaults(
@@ -1137,10 +1159,12 @@ CreateAsyncDoubleMetricSystemPagingFaults(metrics::Meter *meter)
 }
 
 /**
+  TODO.
+  <p>
   counter
  */
 static constexpr const char *kMetricSystemPagingOperations     = "system.paging.operations";
-static constexpr const char *descrMetricSystemPagingOperations = "";
+static constexpr const char *descrMetricSystemPagingOperations = "TODO.";
 static constexpr const char *unitMetricSystemPagingOperations  = "{operation}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
@@ -1176,12 +1200,12 @@ CreateAsyncDoubleMetricSystemPagingOperations(metrics::Meter *meter)
 }
 
 /**
-  Unix swap or windows pagefile usage
+  Unix swap or windows pagefile usage.
   <p>
   updowncounter
  */
 static constexpr const char *kMetricSystemPagingUsage     = "system.paging.usage";
-static constexpr const char *descrMetricSystemPagingUsage = "Unix swap or windows pagefile usage";
+static constexpr const char *descrMetricSystemPagingUsage = "Unix swap or windows pagefile usage.";
 static constexpr const char *unitMetricSystemPagingUsage  = "By";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -1213,10 +1237,12 @@ CreateAsyncDoubleMetricSystemPagingUsage(metrics::Meter *meter)
 }
 
 /**
+  TODO.
+  <p>
   gauge
  */
 static constexpr const char *kMetricSystemPagingUtilization     = "system.paging.utilization";
-static constexpr const char *descrMetricSystemPagingUtilization = "";
+static constexpr const char *descrMetricSystemPagingUtilization = "TODO.";
 static constexpr const char *unitMetricSystemPagingUtilization  = "1";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
@@ -1254,13 +1280,13 @@ CreateAsyncDoubleMetricSystemPagingUtilization(metrics::Meter *meter)
 }
 
 /**
-  Total number of processes in each state
+  Total number of processes in each state.
   <p>
   updowncounter
  */
 static constexpr const char *kMetricSystemProcessCount = "system.process.count";
 static constexpr const char *descrMetricSystemProcessCount =
-    "Total number of processes in each state";
+    "Total number of processes in each state.";
 static constexpr const char *unitMetricSystemProcessCount = "{process}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -1292,13 +1318,13 @@ CreateAsyncDoubleMetricSystemProcessCount(metrics::Meter *meter)
 }
 
 /**
-  Total number of processes created over uptime of the host
+  Total number of processes created over uptime of the host.
   <p>
   counter
  */
 static constexpr const char *kMetricSystemProcessCreated = "system.process.created";
 static constexpr const char *descrMetricSystemProcessCreated =
-    "Total number of processes created over uptime of the host";
+    "Total number of processes created over uptime of the host.";
 static constexpr const char *unitMetricSystemProcessCreated = "{process}";
 
 static inline nostd::unique_ptr<metrics::Counter<uint64_t>>
@@ -1330,14 +1356,14 @@ CreateAsyncDoubleMetricSystemProcessCreated(metrics::Meter *meter)
 }
 
 /**
-  The time the system has been running
+  The time the system has been running.
   <p>
   Instrumentations SHOULD use a gauge with type @code double @endcode and measure uptime in seconds
   as a floating point number with the highest precision available. The actual accuracy would depend
   on the instrumentation and operating system. <p> gauge
  */
 static constexpr const char *kMetricSystemUptime     = "system.uptime";
-static constexpr const char *descrMetricSystemUptime = "The time the system has been running";
+static constexpr const char *descrMetricSystemUptime = "The time the system has been running.";
 static constexpr const char *unitMetricSystemUptime  = "s";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/telemetry_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/telemetry_attributes.h
index 7a34acefe23..05ef72558a1 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/telemetry_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/telemetry_attributes.h
@@ -58,64 +58,29 @@ static constexpr const char *kTelemetrySdkVersion = "telemetry.sdk.version";
 
 namespace TelemetrySdkLanguageValues
 {
-/**
-  none
- */
+
 static constexpr const char *kCpp = "cpp";
 
-/**
-  none
- */
 static constexpr const char *kDotnet = "dotnet";
 
-/**
-  none
- */
 static constexpr const char *kErlang = "erlang";
 
-/**
-  none
- */
 static constexpr const char *kGo = "go";
 
-/**
-  none
- */
 static constexpr const char *kJava = "java";
 
-/**
-  none
- */
 static constexpr const char *kNodejs = "nodejs";
 
-/**
-  none
- */
 static constexpr const char *kPhp = "php";
 
-/**
-  none
- */
 static constexpr const char *kPython = "python";
 
-/**
-  none
- */
 static constexpr const char *kRuby = "ruby";
 
-/**
-  none
- */
 static constexpr const char *kRust = "rust";
 
-/**
-  none
- */
 static constexpr const char *kSwift = "swift";
 
-/**
-  none
- */
 static constexpr const char *kWebjs = "webjs";
 
 }  // namespace TelemetrySdkLanguageValues
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/tls_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/tls_attributes.h
index 0deee289d07..7f2db4afeac 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/tls_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/tls_attributes.h
@@ -205,14 +205,9 @@ static constexpr const char *kTlsServerSubject = "tls.server.subject";
 
 namespace TlsProtocolNameValues
 {
-/**
-  none
- */
+
 static constexpr const char *kSsl = "ssl";
 
-/**
-  none
- */
 static constexpr const char *kTls = "tls";
 
 }  // namespace TlsProtocolNameValues
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/vcs_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/vcs_attributes.h
index 5a0f31952fe..16227fe4b4d 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/vcs_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/vcs_attributes.h
@@ -254,8 +254,11 @@ static constexpr const char *kGitlab = "gitlab";
 
 /**
   Deprecated, use @code gitea @endcode instead.
+
+  @deprecated
+  {"note": "Replaced by @code gitea @endcode.", "reason": "renamed", "renamed_to": "gitea"}
  */
-static constexpr const char *kGittea = "gittea";
+OPENTELEMETRY_DEPRECATED static constexpr const char *kGittea = "gittea";
 
 /**
   <a href="https://gitea.io">Gitea</a>
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/vcs_metrics.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/vcs_metrics.h
index c38dce26ae0..07722c7d59a 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/vcs_metrics.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/incubating/vcs_metrics.h
@@ -22,12 +22,12 @@ namespace vcs
 
 /**
   The number of changes (pull requests/merge requests/changelists) in a repository, categorized by
-  their state (e.g. open or merged) <p> updowncounter
+  their state (e.g. open or merged). <p> updowncounter
  */
 static constexpr const char *kMetricVcsChangeCount = "vcs.change.count";
 static constexpr const char *descrMetricVcsChangeCount =
     "The number of changes (pull requests/merge requests/changelists) in a repository, categorized "
-    "by their state (e.g. open or merged)";
+    "by their state (e.g. open or merged).";
 static constexpr const char *unitMetricVcsChangeCount = "{change}";
 
 static inline nostd::unique_ptr<metrics::UpDownCounter<int64_t>>
@@ -185,13 +185,13 @@ CreateAsyncDoubleMetricVcsChangeTimeToMerge(metrics::Meter *meter)
 }
 
 /**
-  The number of unique contributors to a repository
+  The number of unique contributors to a repository.
   <p>
   gauge
  */
 static constexpr const char *kMetricVcsContributorCount = "vcs.contributor.count";
 static constexpr const char *descrMetricVcsContributorCount =
-    "The number of unique contributors to a repository";
+    "The number of unique contributors to a repository.";
 static constexpr const char *unitMetricVcsContributorCount = "{contributor}";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
@@ -310,7 +310,7 @@ CreateAsyncDoubleMetricVcsRefLinesDelta(metrics::Meter *meter)
 
 /**
   The number of revisions (commits) a ref (branch) is ahead/behind the branch from the @code
-  vcs.ref.base.name @endcode attribute <p> This metric should be reported for each @code
+  vcs.ref.base.name @endcode attribute. <p> This metric should be reported for each @code
   vcs.revision_delta.direction @endcode value. For example if branch @code a @endcode is 3 commits
   behind and 2 commits ahead of @code trunk @endcode, instrumentation SHOULD report two
   measurements: 3 and 2 (both positive numbers) and @code vcs.ref.base.name @endcode is set to @code
@@ -319,7 +319,7 @@ CreateAsyncDoubleMetricVcsRefLinesDelta(metrics::Meter *meter)
 static constexpr const char *kMetricVcsRefRevisionsDelta = "vcs.ref.revisions_delta";
 static constexpr const char *descrMetricVcsRefRevisionsDelta =
     "The number of revisions (commits) a ref (branch) is ahead/behind the branch from the "
-    "`vcs.ref.base.name` attribute";
+    "`vcs.ref.base.name` attribute.";
 static constexpr const char *unitMetricVcsRefRevisionsDelta = "{revision}";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
@@ -355,12 +355,12 @@ CreateAsyncDoubleMetricVcsRefRevisionsDelta(metrics::Meter *meter)
 
 /**
   Time a ref (branch) created from the default branch (trunk) has existed. The @code ref.type
-  @endcode attribute will always be @code branch @endcode <p> gauge
+  @endcode attribute will always be @code branch @endcode. <p> gauge
  */
 static constexpr const char *kMetricVcsRefTime = "vcs.ref.time";
 static constexpr const char *descrMetricVcsRefTime =
     "Time a ref (branch) created from the default branch (trunk) has existed. The `ref.type` "
-    "attribute will always be `branch`";
+    "attribute will always be `branch`.";
 static constexpr const char *unitMetricVcsRefTime = "s";
 
 #if OPENTELEMETRY_ABI_VERSION_NO >= 2
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/schema_url.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/schema_url.h
index 7b46b52e93f..6d5fc0e48dd 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/schema_url.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/schema_url.h
@@ -19,6 +19,6 @@ namespace semconv
 /**
  * The URL of the OpenTelemetry schema for these keys and values.
  */
-static constexpr const char *kSchemaUrl = "https://opentelemetry.io/schemas/1.36.0";
+static constexpr const char *kSchemaUrl = "https://opentelemetry.io/schemas/1.37.0";
 }  // namespace semconv
 OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/telemetry_attributes.h b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/telemetry_attributes.h
index 1722398ddb3..946f80de071 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/telemetry_attributes.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/semconv/telemetry_attributes.h
@@ -44,64 +44,29 @@ static constexpr const char *kTelemetrySdkVersion = "telemetry.sdk.version";
 
 namespace TelemetrySdkLanguageValues
 {
-/**
-  none
- */
+
 static constexpr const char *kCpp = "cpp";
 
-/**
-  none
- */
 static constexpr const char *kDotnet = "dotnet";
 
-/**
-  none
- */
 static constexpr const char *kErlang = "erlang";
 
-/**
-  none
- */
 static constexpr const char *kGo = "go";
 
-/**
-  none
- */
 static constexpr const char *kJava = "java";
 
-/**
-  none
- */
 static constexpr const char *kNodejs = "nodejs";
 
-/**
-  none
- */
 static constexpr const char *kPhp = "php";
 
-/**
-  none
- */
 static constexpr const char *kPython = "python";
 
-/**
-  none
- */
 static constexpr const char *kRuby = "ruby";
 
-/**
-  none
- */
 static constexpr const char *kRust = "rust";
 
-/**
-  none
- */
 static constexpr const char *kSwift = "swift";
 
-/**
-  none
- */
 static constexpr const char *kWebjs = "webjs";
 
 }  // namespace TelemetrySdkLanguageValues
diff --git a/deps/opentelemetry-cpp/api/include/opentelemetry/version.h b/deps/opentelemetry-cpp/api/include/opentelemetry/version.h
index ab69ca02f27..e8747af9a18 100644
--- a/deps/opentelemetry-cpp/api/include/opentelemetry/version.h
+++ b/deps/opentelemetry-cpp/api/include/opentelemetry/version.h
@@ -10,9 +10,9 @@
 #  define OPENTELEMETRY_ABI_VERSION_NO 1
 #endif
 
-#define OPENTELEMETRY_VERSION "1.22.0"
+#define OPENTELEMETRY_VERSION "1.23.0"
 #define OPENTELEMETRY_VERSION_MAJOR 1
-#define OPENTELEMETRY_VERSION_MINOR 22
+#define OPENTELEMETRY_VERSION_MINOR 23
 #define OPENTELEMETRY_VERSION_PATCH 0
 
 #define OPENTELEMETRY_ABI_VERSION OPENTELEMETRY_STRINGIFY(OPENTELEMETRY_ABI_VERSION_NO)
diff --git a/deps/opentelemetry-cpp/api/test/core/version_test.cc b/deps/opentelemetry-cpp/api/test/core/version_test.cc
index 1ceb68602b7..9d9e06eb9b7 100644
--- a/deps/opentelemetry-cpp/api/test/core/version_test.cc
+++ b/deps/opentelemetry-cpp/api/test/core/version_test.cc
@@ -3,6 +3,7 @@
 
 #include <gtest/gtest.h>
 #include <stdio.h>
+#include <string.h>
 #include <string>
 
 #include "opentelemetry/version.h"
@@ -14,5 +15,7 @@ TEST(VersionTest, Consistency)
            OPENTELEMETRY_VERSION_MINOR, OPENTELEMETRY_VERSION_PATCH);
 
   std::string actual = OPENTELEMETRY_VERSION;
-  EXPECT_EQ(actual, expected);
+  /* OPENTELEMETRY_VERSION may contain a -dev suffix */
+  std::string prefix = actual.substr(0, strlen(expected));
+  EXPECT_EQ(prefix, expected);
 }
diff --git a/deps/opentelemetry-cpp/exporters/ostream/include/opentelemetry/exporters/ostream/console_log_record_builder.h b/deps/opentelemetry-cpp/exporters/ostream/include/opentelemetry/exporters/ostream/console_log_record_builder.h
new file mode 100644
index 00000000000..16822d92bb7
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/ostream/include/opentelemetry/exporters/ostream/console_log_record_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/console_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/console_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace logs
+{
+
+class OPENTELEMETRY_EXPORT ConsoleLogRecordBuilder
+    : public opentelemetry::sdk::configuration::ConsoleLogRecordExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> Build(
+      const opentelemetry::sdk::configuration::ConsoleLogRecordExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace logs
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/ostream/include/opentelemetry/exporters/ostream/console_push_metric_builder.h b/deps/opentelemetry-cpp/exporters/ostream/include/opentelemetry/exporters/ostream/console_push_metric_builder.h
new file mode 100644
index 00000000000..3b1bd7f224e
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/ostream/include/opentelemetry/exporters/ostream/console_push_metric_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/console_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/console_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace metrics
+{
+
+class OPENTELEMETRY_EXPORT ConsolePushMetricBuilder
+    : public opentelemetry::sdk::configuration::ConsolePushMetricExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> Build(
+      const opentelemetry::sdk::configuration::ConsolePushMetricExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace metrics
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/ostream/include/opentelemetry/exporters/ostream/console_span_builder.h b/deps/opentelemetry-cpp/exporters/ostream/include/opentelemetry/exporters/ostream/console_span_builder.h
new file mode 100644
index 00000000000..03a7b615c20
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/ostream/include/opentelemetry/exporters/ostream/console_span_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/console_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/console_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace trace
+{
+
+class OPENTELEMETRY_EXPORT ConsoleSpanBuilder
+    : public opentelemetry::sdk::configuration::ConsoleSpanExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> Build(
+      const opentelemetry::sdk::configuration::ConsoleSpanExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace trace
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/ostream/src/console_log_record_builder.cc b/deps/opentelemetry-cpp/exporters/ostream/src/console_log_record_builder.cc
new file mode 100644
index 00000000000..a3849a41c32
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/ostream/src/console_log_record_builder.cc
@@ -0,0 +1,36 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <memory>
+#include <utility>
+
+#include "opentelemetry/exporters/ostream/console_log_record_builder.h"
+#include "opentelemetry/exporters/ostream/log_record_exporter_factory.h"
+#include "opentelemetry/sdk/configuration/console_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/console_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace logs
+{
+
+void ConsoleLogRecordBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<ConsoleLogRecordBuilder>();
+  registry->SetConsoleLogRecordBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> ConsoleLogRecordBuilder::Build(
+    const opentelemetry::sdk::configuration::ConsoleLogRecordExporterConfiguration * /* model */)
+    const
+{
+  return OStreamLogRecordExporterFactory::Create();
+}
+
+}  // namespace logs
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/ostream/src/console_push_metric_builder.cc b/deps/opentelemetry-cpp/exporters/ostream/src/console_push_metric_builder.cc
new file mode 100644
index 00000000000..ca875617551
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/ostream/src/console_push_metric_builder.cc
@@ -0,0 +1,36 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <memory>
+#include <utility>
+
+#include "opentelemetry/exporters/ostream/console_push_metric_builder.h"
+#include "opentelemetry/exporters/ostream/metric_exporter_factory.h"
+#include "opentelemetry/sdk/configuration/console_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/console_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace metrics
+{
+
+void ConsolePushMetricBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<ConsolePushMetricBuilder>();
+  registry->SetConsolePushMetricExporterBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> ConsolePushMetricBuilder::Build(
+    const opentelemetry::sdk::configuration::ConsolePushMetricExporterConfiguration * /* model */)
+    const
+{
+  return OStreamMetricExporterFactory::Create();
+}
+
+}  // namespace metrics
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/ostream/src/console_span_builder.cc b/deps/opentelemetry-cpp/exporters/ostream/src/console_span_builder.cc
new file mode 100644
index 00000000000..e55190bda92
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/ostream/src/console_span_builder.cc
@@ -0,0 +1,35 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <memory>
+#include <utility>
+
+#include "opentelemetry/exporters/ostream/console_span_builder.h"
+#include "opentelemetry/exporters/ostream/span_exporter_factory.h"
+#include "opentelemetry/sdk/configuration/console_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/console_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace trace
+{
+
+void ConsoleSpanBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<ConsoleSpanBuilder>();
+  registry->SetConsoleSpanBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> ConsoleSpanBuilder::Build(
+    const opentelemetry::sdk::configuration::ConsoleSpanExporterConfiguration * /* model */) const
+{
+  return OStreamSpanExporterFactory::Create();
+}
+
+}  // namespace trace
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/ostream/test/ostream_log_test.cc b/deps/opentelemetry-cpp/exporters/ostream/test/ostream_log_test.cc
index 6c7028ed165..8b8063f6d44 100644
--- a/deps/opentelemetry-cpp/exporters/ostream/test/ostream_log_test.cc
+++ b/deps/opentelemetry-cpp/exporters/ostream/test/ostream_log_test.cc
@@ -125,7 +125,7 @@ TEST(OstreamLogExporter, DefaultLogRecordToCout)
       "  severity_text      : INVALID\n",
       "  body               : \n",
       "  resource           : \n",
-      std::string{"    telemetry.sdk.version: "} + OPENTELEMETRY_VERSION + "\n",
+      std::string{"    telemetry.sdk.version: "} + OPENTELEMETRY_SDK_VERSION + "\n",
       "    telemetry.sdk.name: opentelemetry\n",
       "    telemetry.sdk.language: cpp\n",
       "  attributes         : \n",
@@ -199,7 +199,7 @@ TEST(OStreamLogRecordExporter, SimpleLogToCout)
           "  severity_text      : TRACE\n"
           "  body               : Message\n",
       "  resource           : \n",
-      std::string{"    telemetry.sdk.version: "} + OPENTELEMETRY_VERSION + "\n",
+      std::string{"    telemetry.sdk.version: "} + OPENTELEMETRY_SDK_VERSION + "\n",
       "    telemetry.sdk.name: opentelemetry\n",
       "    telemetry.sdk.language: cpp\n",
       "  attributes         : \n",
@@ -270,7 +270,7 @@ TEST(OStreamLogRecordExporter, LogWithStringAttributesToCerr)
       "  severity_text      : INVALID\n",
       "  body               : \n",
       "  resource           : \n",
-      std::string{"    telemetry.sdk.version: "} + OPENTELEMETRY_VERSION + "\n",
+      std::string{"    telemetry.sdk.version: "} + OPENTELEMETRY_SDK_VERSION + "\n",
       "    telemetry.sdk.name: opentelemetry\n",
       "    telemetry.sdk.language: cpp\n",
       "    service.name: unknown_service\n",
@@ -352,7 +352,7 @@ TEST(OStreamLogRecordExporter, LogWithVariantTypesToClog)
       "  body               : \n",
       "  resource           : \n",
       "    service.name: unknown_service\n",
-      std::string{"    telemetry.sdk.version: "} + OPENTELEMETRY_VERSION + "\n",
+      std::string{"    telemetry.sdk.version: "} + OPENTELEMETRY_SDK_VERSION + "\n",
       "    telemetry.sdk.name: opentelemetry\n",
       "    telemetry.sdk.language: cpp\n",
       "    res1: [1,2,3]\n",
@@ -425,7 +425,7 @@ TEST(OStreamLogRecordExporter, IntegrationTest)
       "  severity_text      : DEBUG\n",
       "  body               : Hello\n",
       "  resource           : \n",
-      std::string{"    telemetry.sdk.version: "} + OPENTELEMETRY_VERSION + "\n",
+      std::string{"    telemetry.sdk.version: "} + OPENTELEMETRY_SDK_VERSION + "\n",
       "    service.name: unknown_service\n",
       "    telemetry.sdk.name: opentelemetry\n",
       "    telemetry.sdk.language: cpp\n",
@@ -496,7 +496,7 @@ TEST(OStreamLogRecordExporter, IntegrationTestWithEventId)
       "  severity_text      : DEBUG\n",
       "  body               : Hello {key1} {key2}\n",
       "  resource           : \n",
-      std::string{"    telemetry.sdk.version: "} + OPENTELEMETRY_VERSION + "\n",
+      std::string{"    telemetry.sdk.version: "} + OPENTELEMETRY_SDK_VERSION + "\n",
       "    service.name: unknown_service\n",
       "    telemetry.sdk.name: opentelemetry\n",
       "    telemetry.sdk.language: cpp\n",
diff --git a/deps/opentelemetry-cpp/exporters/otlp/CMakeLists.txt b/deps/opentelemetry-cpp/exporters/otlp/CMakeLists.txt
index def5a025515..9ad6d7922d7 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/CMakeLists.txt
+++ b/deps/opentelemetry-cpp/exporters/otlp/CMakeLists.txt
@@ -32,7 +32,6 @@ target_link_libraries(opentelemetry_otlp_recordable
                       PUBLIC opentelemetry_metrics)
 
 if(WITH_OTLP_GRPC)
-  find_package(gRPC REQUIRED)
   if(NOT DEFINED grpc_lib_type)
     message(
       FATAL_ERROR "cmake/opentelemetry-proto.cmake should be included first")
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_builder_utils.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_builder_utils.h
new file mode 100644
index 00000000000..029e73b78e8
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_builder_utils.h
@@ -0,0 +1,38 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <string>
+
+#include "opentelemetry/exporters/otlp/otlp_environment.h"  // For OtlpHeaders
+#include "opentelemetry/exporters/otlp/otlp_http.h"
+#include "opentelemetry/exporters/otlp/otlp_preferred_temporality.h"
+#include "opentelemetry/sdk/configuration/headers_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_http_encoding.h"
+#include "opentelemetry/sdk/configuration/temporality_preference.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+class OtlpBuilderUtils
+{
+public:
+  static HttpRequestContentType ConvertOtlpHttpEncoding(
+      opentelemetry::sdk::configuration::OtlpHttpEncoding model);
+
+  static OtlpHeaders ConvertHeadersConfigurationModel(
+      const opentelemetry::sdk::configuration::HeadersConfiguration *model,
+      const std::string &headers_list);
+
+  static PreferredAggregationTemporality ConvertTemporalityPreference(
+      opentelemetry::sdk::configuration::TemporalityPreference model);
+};
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_exporter_options.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_exporter_options.h
index 1dd2ebfd7f4..b4c4f36c015 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_exporter_options.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_exporter_options.h
@@ -22,6 +22,11 @@ namespace otlp
 struct OPENTELEMETRY_EXPORT OtlpFileExporterOptions : public OtlpFileClientOptions
 {
   OtlpFileExporterOptions();
+  OtlpFileExporterOptions(const OtlpFileExporterOptions &)            = default;
+  OtlpFileExporterOptions(OtlpFileExporterOptions &&)                 = default;
+  OtlpFileExporterOptions &operator=(const OtlpFileExporterOptions &) = default;
+  OtlpFileExporterOptions &operator=(OtlpFileExporterOptions &&)      = default;
+  ~OtlpFileExporterOptions() override;
 };
 
 }  // namespace otlp
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_log_record_builder.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_log_record_builder.h
new file mode 100644
index 00000000000..3ace85c1f93
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_log_record_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_file_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+class OPENTELEMETRY_EXPORT OtlpFileLogRecordBuilder
+    : public opentelemetry::sdk::configuration::OtlpFileLogRecordExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpFileLogRecordExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_log_record_exporter_options.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_log_record_exporter_options.h
index caeb3daaf4e..cca6fc8e10b 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_log_record_exporter_options.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_log_record_exporter_options.h
@@ -22,6 +22,11 @@ namespace otlp
 struct OPENTELEMETRY_EXPORT OtlpFileLogRecordExporterOptions : public OtlpFileClientOptions
 {
   OtlpFileLogRecordExporterOptions();
+  OtlpFileLogRecordExporterOptions(const OtlpFileLogRecordExporterOptions &)            = default;
+  OtlpFileLogRecordExporterOptions(OtlpFileLogRecordExporterOptions &&)                 = default;
+  OtlpFileLogRecordExporterOptions &operator=(const OtlpFileLogRecordExporterOptions &) = default;
+  OtlpFileLogRecordExporterOptions &operator=(OtlpFileLogRecordExporterOptions &&)      = default;
+  ~OtlpFileLogRecordExporterOptions() override;
 };
 
 }  // namespace otlp
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_metric_exporter_options.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_metric_exporter_options.h
index 3e946e482bb..d89dcbd3cf6 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_metric_exporter_options.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_metric_exporter_options.h
@@ -23,6 +23,11 @@ namespace otlp
 struct OPENTELEMETRY_EXPORT OtlpFileMetricExporterOptions : public OtlpFileClientOptions
 {
   OtlpFileMetricExporterOptions();
+  OtlpFileMetricExporterOptions(const OtlpFileMetricExporterOptions &)            = default;
+  OtlpFileMetricExporterOptions(OtlpFileMetricExporterOptions &&)                 = default;
+  OtlpFileMetricExporterOptions &operator=(const OtlpFileMetricExporterOptions &) = default;
+  OtlpFileMetricExporterOptions &operator=(OtlpFileMetricExporterOptions &&)      = default;
+  ~OtlpFileMetricExporterOptions() override;
 
   PreferredAggregationTemporality aggregation_temporality;
 };
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_push_metric_builder.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_push_metric_builder.h
new file mode 100644
index 00000000000..6fb830d75b5
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_push_metric_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_file_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+class OPENTELEMETRY_EXPORT OtlpFilePushMetricBuilder
+    : public opentelemetry::sdk::configuration::OtlpFilePushMetricExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpFilePushMetricExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_span_builder.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_span_builder.h
new file mode 100644
index 00000000000..b96c9411a4a
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_file_span_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_file_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+class OPENTELEMETRY_EXPORT OtlpFileSpanBuilder
+    : public opentelemetry::sdk::configuration::OtlpFileSpanExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpFileSpanExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_client.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_client.h
index 159ac0227d5..2a60a28a21c 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_client.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_client.h
@@ -106,8 +106,11 @@ class OtlpGrpcClient
 {
 public:
   OtlpGrpcClient(const OtlpGrpcClientOptions &options);
-
   ~OtlpGrpcClient();
+  OtlpGrpcClient(const OtlpGrpcClient &)            = delete;
+  OtlpGrpcClient(OtlpGrpcClient &&)                 = delete;
+  OtlpGrpcClient &operator=(const OtlpGrpcClient &) = delete;
+  OtlpGrpcClient &operator=(OtlpGrpcClient &&)      = delete;
 
   static std::string GetGrpcTarget(const std::string &endpoint);
 
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_client_options.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_client_options.h
index 0ffe5ba72e3..f377ef7d098 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_client_options.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_client_options.h
@@ -23,11 +23,18 @@ namespace otlp
 
 struct OtlpGrpcClientOptions
 {
+  virtual ~OtlpGrpcClientOptions()                                = default;
+  OtlpGrpcClientOptions()                                         = default;
+  OtlpGrpcClientOptions(const OtlpGrpcClientOptions &)            = default;
+  OtlpGrpcClientOptions(OtlpGrpcClientOptions &&)                 = default;
+  OtlpGrpcClientOptions &operator=(const OtlpGrpcClientOptions &) = default;
+  OtlpGrpcClientOptions &operator=(OtlpGrpcClientOptions &&)      = default;
+
   /** The endpoint to export to. */
   std::string endpoint;
 
   /** Use SSL. */
-  bool use_ssl_credentials;
+  bool use_ssl_credentials{};
 
   /** CA CERT, path to a file. */
   std::string ssl_credentials_cacert_path;
@@ -64,14 +71,14 @@ struct OtlpGrpcClientOptions
   std::string user_agent;
 
   /** max number of threads that can be allocated from this */
-  std::size_t max_threads;
+  std::size_t max_threads{};
 
   /** Compression type. */
   std::string compression;
 
 #ifdef ENABLE_ASYNC_EXPORT
   // Concurrent requests
-  std::size_t max_concurrent_requests;
+  std::size_t max_concurrent_requests{};
 #endif
 
   /** The maximum number of call attempts, including the original attempt. */
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_exporter.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_exporter.h
index 1022b0dc8fc..f698b8fb5d7 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_exporter.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_exporter.h
@@ -58,6 +58,10 @@ class OtlpGrpcExporter final : public opentelemetry::sdk::trace::SpanExporter
   explicit OtlpGrpcExporter(const OtlpGrpcExporterOptions &options);
 
   ~OtlpGrpcExporter() override;
+  OtlpGrpcExporter(const OtlpGrpcExporter &)            = delete;
+  OtlpGrpcExporter(OtlpGrpcExporter &&)                 = delete;
+  OtlpGrpcExporter &operator=(const OtlpGrpcExporter &) = delete;
+  OtlpGrpcExporter &operator=(OtlpGrpcExporter &&)      = delete;
 
   /**
    * Create a span recordable.
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_exporter_options.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_exporter_options.h
index b2556f1f767..4fceaa91518 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_exporter_options.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_exporter_options.h
@@ -23,8 +23,15 @@ namespace otlp
  */
 struct OPENTELEMETRY_EXPORT OtlpGrpcExporterOptions : public OtlpGrpcClientOptions
 {
+  /** Lookup environment variables. */
   OtlpGrpcExporterOptions();
-  ~OtlpGrpcExporterOptions();
+  /** No defaults. */
+  OtlpGrpcExporterOptions(void *);
+  OtlpGrpcExporterOptions(const OtlpGrpcExporterOptions &)            = default;
+  OtlpGrpcExporterOptions(OtlpGrpcExporterOptions &&)                 = default;
+  OtlpGrpcExporterOptions &operator=(const OtlpGrpcExporterOptions &) = default;
+  OtlpGrpcExporterOptions &operator=(OtlpGrpcExporterOptions &&)      = default;
+  ~OtlpGrpcExporterOptions() override;
 };
 
 }  // namespace otlp
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_log_record_builder.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_log_record_builder.h
new file mode 100644
index 00000000000..642f7cf3175
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_log_record_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_grpc_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+class OPENTELEMETRY_EXPORT OtlpGrpcLogRecordBuilder
+    : public opentelemetry::sdk::configuration::OtlpGrpcLogRecordExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpGrpcLogRecordExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_log_record_exporter.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_log_record_exporter.h
index da278ccd282..888c368b282 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_log_record_exporter.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_log_record_exporter.h
@@ -57,6 +57,10 @@ class OtlpGrpcLogRecordExporter : public opentelemetry::sdk::logs::LogRecordExpo
   OtlpGrpcLogRecordExporter(const OtlpGrpcLogRecordExporterOptions &options);
 
   ~OtlpGrpcLogRecordExporter() override;
+  OtlpGrpcLogRecordExporter(const OtlpGrpcLogRecordExporter &)            = delete;
+  OtlpGrpcLogRecordExporter(OtlpGrpcLogRecordExporter &&)                 = delete;
+  OtlpGrpcLogRecordExporter &operator=(const OtlpGrpcLogRecordExporter &) = delete;
+  OtlpGrpcLogRecordExporter &operator=(OtlpGrpcLogRecordExporter &&)      = delete;
 
   /**
    * Creates a recordable that stores the data in protobuf.
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_log_record_exporter_options.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_log_record_exporter_options.h
index 8438bb080d2..8e6f53644d4 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_log_record_exporter_options.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_log_record_exporter_options.h
@@ -23,8 +23,15 @@ namespace otlp
  */
 struct OPENTELEMETRY_EXPORT OtlpGrpcLogRecordExporterOptions : public OtlpGrpcClientOptions
 {
+  /** Lookup environment variables. */
   OtlpGrpcLogRecordExporterOptions();
-  ~OtlpGrpcLogRecordExporterOptions();
+  /** No defaults. */
+  OtlpGrpcLogRecordExporterOptions(void *);
+  OtlpGrpcLogRecordExporterOptions(const OtlpGrpcLogRecordExporterOptions &)            = default;
+  OtlpGrpcLogRecordExporterOptions(OtlpGrpcLogRecordExporterOptions &&)                 = default;
+  OtlpGrpcLogRecordExporterOptions &operator=(const OtlpGrpcLogRecordExporterOptions &) = default;
+  OtlpGrpcLogRecordExporterOptions &operator=(OtlpGrpcLogRecordExporterOptions &&)      = default;
+  ~OtlpGrpcLogRecordExporterOptions() override;
 };
 
 }  // namespace otlp
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_metric_exporter.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_metric_exporter.h
index d3d857b3f08..4272bf2126a 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_metric_exporter.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_metric_exporter.h
@@ -55,6 +55,10 @@ class OtlpGrpcMetricExporter : public opentelemetry::sdk::metrics::PushMetricExp
   explicit OtlpGrpcMetricExporter(const OtlpGrpcMetricExporterOptions &options);
 
   ~OtlpGrpcMetricExporter() override;
+  OtlpGrpcMetricExporter(const OtlpGrpcMetricExporter &)            = delete;
+  OtlpGrpcMetricExporter(OtlpGrpcMetricExporter &&)                 = delete;
+  OtlpGrpcMetricExporter &operator=(const OtlpGrpcMetricExporter &) = delete;
+  OtlpGrpcMetricExporter &operator=(OtlpGrpcMetricExporter &&)      = delete;
 
   /**
    * Get the AggregationTemporality for exporter
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_metric_exporter_options.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_metric_exporter_options.h
index 22be5809722..ab6c8795f7d 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_metric_exporter_options.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_metric_exporter_options.h
@@ -24,8 +24,15 @@ namespace otlp
  */
 struct OPENTELEMETRY_EXPORT OtlpGrpcMetricExporterOptions : public OtlpGrpcClientOptions
 {
+  /** Lookup environment variables. */
   OtlpGrpcMetricExporterOptions();
-  ~OtlpGrpcMetricExporterOptions();
+  /** No defaults. */
+  OtlpGrpcMetricExporterOptions(void *);
+  OtlpGrpcMetricExporterOptions(const OtlpGrpcMetricExporterOptions &)            = default;
+  OtlpGrpcMetricExporterOptions(OtlpGrpcMetricExporterOptions &&)                 = default;
+  OtlpGrpcMetricExporterOptions &operator=(const OtlpGrpcMetricExporterOptions &) = default;
+  OtlpGrpcMetricExporterOptions &operator=(OtlpGrpcMetricExporterOptions &&)      = default;
+  ~OtlpGrpcMetricExporterOptions() override;
 
   /** Preferred Aggregation Temporality. */
   PreferredAggregationTemporality aggregation_temporality;
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_push_metric_builder.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_push_metric_builder.h
new file mode 100644
index 00000000000..8ab6c3022c8
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_push_metric_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_grpc_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+class OPENTELEMETRY_EXPORT OtlpGrpcPushMetricBuilder
+    : public opentelemetry::sdk::configuration::OtlpGrpcPushMetricExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpGrpcPushMetricExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_span_builder.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_span_builder.h
new file mode 100644
index 00000000000..86c588c4d5f
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_grpc_span_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_grpc_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+class OPENTELEMETRY_EXPORT OtlpGrpcSpanBuilder
+    : public opentelemetry::sdk::configuration::OtlpGrpcSpanExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpGrpcSpanExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_client.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_client.h
index 5cb5fdfbc6c..dff27d92f2b 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_client.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_client.h
@@ -159,6 +159,10 @@ class OtlpHttpClient
   explicit OtlpHttpClient(OtlpHttpClientOptions &&options);
 
   ~OtlpHttpClient();
+  OtlpHttpClient(const OtlpHttpClient &)            = delete;
+  OtlpHttpClient &operator=(const OtlpHttpClient &) = delete;
+  OtlpHttpClient(OtlpHttpClient &&)                 = delete;
+  OtlpHttpClient &operator=(OtlpHttpClient &&)      = delete;
 
   /**
    * Sync export
@@ -230,28 +234,13 @@ class OtlpHttpClient
     std::shared_ptr<opentelemetry::ext::http::client::Session> session;
     std::shared_ptr<opentelemetry::ext::http::client::EventHandler> event_handle;
 
-    inline HttpSessionData() = default;
+    HttpSessionData() = default;
 
-    inline explicit HttpSessionData(
+    explicit HttpSessionData(
         std::shared_ptr<opentelemetry::ext::http::client::Session> &&input_session,
         std::shared_ptr<opentelemetry::ext::http::client::EventHandler> &&input_handle)
-    {
-      session.swap(input_session);
-      event_handle.swap(input_handle);
-    }
-
-    inline HttpSessionData(HttpSessionData &&other)
-    {
-      session.swap(other.session);
-      event_handle.swap(other.event_handle);
-    }
-
-    inline HttpSessionData &operator=(HttpSessionData &&other) noexcept
-    {
-      session.swap(other.session);
-      event_handle.swap(other.event_handle);
-      return *this;
-    }
+        : session(std::move(input_session)), event_handle(std::move(input_handle))
+    {}
   };
 
   /**
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_exporter_options.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_exporter_options.h
index 52f2208575b..93e15ed887b 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_exporter_options.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_exporter_options.h
@@ -32,7 +32,14 @@ namespace otlp
  */
 struct OPENTELEMETRY_EXPORT OtlpHttpExporterOptions
 {
+  /** Lookup environment variables. */
   OtlpHttpExporterOptions();
+  /** No defaults. */
+  OtlpHttpExporterOptions(void *);
+  OtlpHttpExporterOptions(const OtlpHttpExporterOptions &)            = default;
+  OtlpHttpExporterOptions(OtlpHttpExporterOptions &&)                 = default;
+  OtlpHttpExporterOptions &operator=(const OtlpHttpExporterOptions &) = default;
+  OtlpHttpExporterOptions &operator=(OtlpHttpExporterOptions &&)      = default;
   ~OtlpHttpExporterOptions();
 
   /** The endpoint to export to. */
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_exporter_runtime_options.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_exporter_runtime_options.h
index 02ec76acf97..b5e11b377eb 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_exporter_runtime_options.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_exporter_runtime_options.h
@@ -19,8 +19,7 @@ namespace otlp
  */
 struct OPENTELEMETRY_EXPORT OtlpHttpExporterRuntimeOptions
 {
-  OtlpHttpExporterRuntimeOptions()  = default;
-  ~OtlpHttpExporterRuntimeOptions() = default;
+  OtlpHttpExporterRuntimeOptions() = default;
 
   std::shared_ptr<sdk::common::ThreadInstrumentation> thread_instrumentation =
       std::shared_ptr<sdk::common::ThreadInstrumentation>(nullptr);
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_log_record_builder.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_log_record_builder.h
new file mode 100644
index 00000000000..48c916d2689
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_log_record_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_http_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+class OPENTELEMETRY_EXPORT OtlpHttpLogRecordBuilder
+    : public opentelemetry::sdk::configuration::OtlpHttpLogRecordExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpHttpLogRecordExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_log_record_exporter_options.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_log_record_exporter_options.h
index 78160deeb06..60785ed9f86 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_log_record_exporter_options.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_log_record_exporter_options.h
@@ -32,7 +32,14 @@ namespace otlp
  */
 struct OPENTELEMETRY_EXPORT OtlpHttpLogRecordExporterOptions
 {
+  /** Lookup environment variables. */
   OtlpHttpLogRecordExporterOptions();
+  /** No defaults. */
+  OtlpHttpLogRecordExporterOptions(void *);
+  OtlpHttpLogRecordExporterOptions(const OtlpHttpLogRecordExporterOptions &)            = default;
+  OtlpHttpLogRecordExporterOptions(OtlpHttpLogRecordExporterOptions &&)                 = default;
+  OtlpHttpLogRecordExporterOptions &operator=(const OtlpHttpLogRecordExporterOptions &) = default;
+  OtlpHttpLogRecordExporterOptions &operator=(OtlpHttpLogRecordExporterOptions &&)      = default;
   ~OtlpHttpLogRecordExporterOptions();
 
   /** The endpoint to export to. */
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_log_record_exporter_runtime_options.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_log_record_exporter_runtime_options.h
index b5ef2ed967d..09213731af7 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_log_record_exporter_runtime_options.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_log_record_exporter_runtime_options.h
@@ -19,8 +19,7 @@ namespace otlp
  */
 struct OPENTELEMETRY_EXPORT OtlpHttpLogRecordExporterRuntimeOptions
 {
-  OtlpHttpLogRecordExporterRuntimeOptions()  = default;
-  ~OtlpHttpLogRecordExporterRuntimeOptions() = default;
+  OtlpHttpLogRecordExporterRuntimeOptions() = default;
 
   std::shared_ptr<sdk::common::ThreadInstrumentation> thread_instrumentation =
       std::shared_ptr<sdk::common::ThreadInstrumentation>(nullptr);
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_metric_exporter.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_metric_exporter.h
index 8733a740a95..72774f36060 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_metric_exporter.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_metric_exporter.h
@@ -72,7 +72,7 @@ class OtlpHttpMetricExporter final : public opentelemetry::sdk::metrics::PushMet
   OtlpHttpMetricExporterRuntimeOptions runtime_options_;
 
   // Aggregation Temporality Selector
-  const sdk::metrics::AggregationTemporalitySelector aggregation_temporality_selector_;
+  sdk::metrics::AggregationTemporalitySelector aggregation_temporality_selector_;
 
   // Object that stores the HTTP sessions that have been created
   std::unique_ptr<OtlpHttpClient> http_client_;
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_metric_exporter_options.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_metric_exporter_options.h
index 255491a39f4..76f2e9a5136 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_metric_exporter_options.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_metric_exporter_options.h
@@ -33,7 +33,14 @@ namespace otlp
  */
 struct OPENTELEMETRY_EXPORT OtlpHttpMetricExporterOptions
 {
+  /** Lookup environment variables. */
   OtlpHttpMetricExporterOptions();
+  /** No defaults. */
+  OtlpHttpMetricExporterOptions(void *);
+  OtlpHttpMetricExporterOptions(const OtlpHttpMetricExporterOptions &)            = default;
+  OtlpHttpMetricExporterOptions(OtlpHttpMetricExporterOptions &&)                 = default;
+  OtlpHttpMetricExporterOptions &operator=(const OtlpHttpMetricExporterOptions &) = default;
+  OtlpHttpMetricExporterOptions &operator=(OtlpHttpMetricExporterOptions &&)      = default;
   ~OtlpHttpMetricExporterOptions();
 
   /** The endpoint to export to. */
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_metric_exporter_runtime_options.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_metric_exporter_runtime_options.h
index c0e91a342c4..a26d54b9ff1 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_metric_exporter_runtime_options.h
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_metric_exporter_runtime_options.h
@@ -19,8 +19,7 @@ namespace otlp
  */
 struct OPENTELEMETRY_EXPORT OtlpHttpMetricExporterRuntimeOptions
 {
-  OtlpHttpMetricExporterRuntimeOptions()  = default;
-  ~OtlpHttpMetricExporterRuntimeOptions() = default;
+  OtlpHttpMetricExporterRuntimeOptions() = default;
 
   std::shared_ptr<sdk::common::ThreadInstrumentation> thread_instrumentation =
       std::shared_ptr<sdk::common::ThreadInstrumentation>(nullptr);
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_push_metric_builder.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_push_metric_builder.h
new file mode 100644
index 00000000000..795dcb2a166
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_push_metric_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_http_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+class OPENTELEMETRY_EXPORT OtlpHttpPushMetricBuilder
+    : public opentelemetry::sdk::configuration::OtlpHttpPushMetricExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpHttpPushMetricExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_span_builder.h b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_span_builder.h
new file mode 100644
index 00000000000..b1e9342d95c
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/include/opentelemetry/exporters/otlp/otlp_http_span_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_http_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+class OPENTELEMETRY_EXPORT OtlpHttpSpanBuilder
+    : public opentelemetry::sdk::configuration::OtlpHttpSpanExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpHttpSpanExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_builder_utils.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_builder_utils.cc
new file mode 100644
index 00000000000..cac5efcbad5
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_builder_utils.cc
@@ -0,0 +1,120 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <map>
+#include <string>
+#include <utility>
+
+#include "opentelemetry/common/kv_properties.h"
+#include "opentelemetry/exporters/otlp/otlp_builder_utils.h"
+#include "opentelemetry/exporters/otlp/otlp_environment.h"
+#include "opentelemetry/exporters/otlp/otlp_http.h"
+#include "opentelemetry/exporters/otlp/otlp_preferred_temporality.h"
+#include "opentelemetry/nostd/string_view.h"
+#include "opentelemetry/sdk/common/global_log_handler.h"
+#include "opentelemetry/sdk/configuration/headers_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_http_encoding.h"
+#include "opentelemetry/sdk/configuration/temporality_preference.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+HttpRequestContentType OtlpBuilderUtils::ConvertOtlpHttpEncoding(
+    opentelemetry::sdk::configuration::OtlpHttpEncoding model)
+{
+  auto result = exporter::otlp::HttpRequestContentType::kBinary;
+
+  switch (model)
+  {
+    case opentelemetry::sdk::configuration::OtlpHttpEncoding::protobuf:
+      result = exporter::otlp::HttpRequestContentType::kBinary;
+      break;
+    case opentelemetry::sdk::configuration::OtlpHttpEncoding::json:
+      result = exporter::otlp::HttpRequestContentType::kJson;
+      break;
+  }
+
+  return result;
+}
+
+OtlpHeaders OtlpBuilderUtils::ConvertHeadersConfigurationModel(
+    const opentelemetry::sdk::configuration::HeadersConfiguration *model,
+    const std::string &headers_list)
+{
+  OtlpHeaders headers;
+
+  // First, scan headers_list, which has low priority.
+  if (headers_list.size() > 0)
+  {
+    opentelemetry::common::KeyValueStringTokenizer tokenizer{headers_list};
+
+    opentelemetry::nostd::string_view header_key;
+    opentelemetry::nostd::string_view header_value;
+    bool header_valid = true;
+
+    while (tokenizer.next(header_valid, header_key, header_value))
+    {
+      if (header_valid)
+      {
+        std::string key(header_key);
+        std::string value(header_value);
+
+        if (headers.find(key) == headers.end())
+        {
+          headers.emplace(std::make_pair(std::move(key), std::move(value)));
+        }
+        else
+        {
+          OTEL_INTERNAL_LOG_WARN("Found duplicate key in headers_list");
+        }
+      }
+      else
+      {
+        OTEL_INTERNAL_LOG_WARN("Found invalid key/value pair in headers_list");
+      }
+    }
+  }
+
+  // Second, scan headers, which has high priority.
+  for (const auto &kv : model->kv_map)
+  {
+    const auto &search = headers.find(kv.first);
+    if (search != headers.end())
+    {
+      headers.erase(search);
+    }
+
+    headers.emplace(std::make_pair(kv.first, kv.second));
+  }
+
+  return headers;
+}
+
+PreferredAggregationTemporality OtlpBuilderUtils::ConvertTemporalityPreference(
+    opentelemetry::sdk::configuration::TemporalityPreference model)
+{
+  auto result = exporter::otlp::PreferredAggregationTemporality::kCumulative;
+
+  switch (model)
+  {
+    case opentelemetry::sdk::configuration::TemporalityPreference::cumulative:
+      result = exporter::otlp::PreferredAggregationTemporality::kCumulative;
+      break;
+    case opentelemetry::sdk::configuration::TemporalityPreference::delta:
+      result = exporter::otlp::PreferredAggregationTemporality::kDelta;
+      break;
+    case opentelemetry::sdk::configuration::TemporalityPreference::low_memory:
+      result = exporter::otlp::PreferredAggregationTemporality::kLowMemory;
+      break;
+  }
+
+  return result;
+}
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_exporter_options.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_exporter_options.cc
index ddc371fdda2..b5e9fa725f4 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_exporter_options.cc
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_exporter_options.cc
@@ -27,6 +27,8 @@ OtlpFileExporterOptions::OtlpFileExporterOptions()
   backend_options = fs_options;
 }
 
+OtlpFileExporterOptions::~OtlpFileExporterOptions() {}
+
 }  // namespace otlp
 }  // namespace exporter
 OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_log_record_builder.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_log_record_builder.cc
new file mode 100644
index 00000000000..c09c7f2f307
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_log_record_builder.cc
@@ -0,0 +1,41 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <memory>
+#include <utility>
+
+#include "opentelemetry/exporters/otlp/otlp_file_log_record_builder.h"
+#include "opentelemetry/exporters/otlp/otlp_file_log_record_exporter_factory.h"
+#include "opentelemetry/exporters/otlp/otlp_file_log_record_exporter_options.h"
+#include "opentelemetry/sdk/configuration/otlp_file_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+void OtlpFileLogRecordBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<OtlpFileLogRecordBuilder>();
+  registry->SetOtlpFileLogRecordBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> OtlpFileLogRecordBuilder::Build(
+    const opentelemetry::sdk::configuration::OtlpFileLogRecordExporterConfiguration * /* model */)
+    const
+{
+  OtlpFileLogRecordExporterOptions options;
+
+  // FIXME: unclear how to map model->output_stream to a OtlpFileClientBackendOptions
+
+  return OtlpFileLogRecordExporterFactory::Create(options);
+}
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_log_record_exporter_options.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_log_record_exporter_options.cc
index abc628dc025..be794b28726 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_log_record_exporter_options.cc
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_log_record_exporter_options.cc
@@ -27,6 +27,8 @@ OtlpFileLogRecordExporterOptions::OtlpFileLogRecordExporterOptions()
   backend_options = fs_options;
 }
 
+OtlpFileLogRecordExporterOptions::~OtlpFileLogRecordExporterOptions() {}
+
 }  // namespace otlp
 }  // namespace exporter
 OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_metric_exporter_options.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_metric_exporter_options.cc
index 22d2cc7c499..e1b1f5ca7a5 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_metric_exporter_options.cc
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_metric_exporter_options.cc
@@ -28,6 +28,8 @@ OtlpFileMetricExporterOptions::OtlpFileMetricExporterOptions()
   backend_options = fs_options;
 }
 
+OtlpFileMetricExporterOptions::~OtlpFileMetricExporterOptions() {}
+
 }  // namespace otlp
 }  // namespace exporter
 OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_push_metric_builder.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_push_metric_builder.cc
new file mode 100644
index 00000000000..cdf3a6fe39f
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_push_metric_builder.cc
@@ -0,0 +1,44 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <memory>
+#include <utility>
+
+#include "opentelemetry/exporters/otlp/otlp_builder_utils.h"
+#include "opentelemetry/exporters/otlp/otlp_file_metric_exporter_factory.h"
+#include "opentelemetry/exporters/otlp/otlp_file_metric_exporter_options.h"
+#include "opentelemetry/exporters/otlp/otlp_file_push_metric_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+void OtlpFilePushMetricBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<OtlpFilePushMetricBuilder>();
+  registry->SetOtlpFilePushMetricExporterBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> OtlpFilePushMetricBuilder::Build(
+    const opentelemetry::sdk::configuration::OtlpFilePushMetricExporterConfiguration *model) const
+{
+  OtlpFileMetricExporterOptions options;
+
+  // FIXME: unclear how to map model->output_stream to a OtlpFileClientBackendOptions
+
+  options.aggregation_temporality =
+      OtlpBuilderUtils::ConvertTemporalityPreference(model->temporality_preference);
+
+  return OtlpFileMetricExporterFactory::Create(options);
+}
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_span_builder.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_span_builder.cc
new file mode 100644
index 00000000000..8fbbc335b32
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_file_span_builder.cc
@@ -0,0 +1,40 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <memory>
+#include <utility>
+
+#include "opentelemetry/exporters/otlp/otlp_file_exporter_factory.h"
+#include "opentelemetry/exporters/otlp/otlp_file_exporter_options.h"
+#include "opentelemetry/exporters/otlp/otlp_file_span_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+void OtlpFileSpanBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<OtlpFileSpanBuilder>();
+  registry->SetOtlpFileSpanBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> OtlpFileSpanBuilder::Build(
+    const opentelemetry::sdk::configuration::OtlpFileSpanExporterConfiguration * /* model */) const
+{
+  OtlpFileExporterOptions options;
+
+  // FIXME: unclear how to map model->output_stream to a OtlpFileClientBackendOptions
+
+  return OtlpFileExporterFactory::Create(options);
+}
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_client.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_client.cc
index 2bc66aa7391..a51740404f9 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_client.cc
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_client.cc
@@ -238,7 +238,7 @@ static sdk::common::ExportResult InternalDelegateAsyncExport(
   stub->experimental_async()
 #  endif
       ->Export(call_data->grpc_context.get(), call_data->request, call_data->response,
-               [call_data, async_data, export_data_name](::grpc::Status grpc_status) {
+               [call_data, async_data, export_data_name](const ::grpc::Status &grpc_status) {
                  {
                    std::lock_guard<std::mutex> lock{async_data->running_calls_lock};
                    async_data->running_calls.erase(
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_exporter_options.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_exporter_options.cc
index 1f921abdbc7..482a5193ec5 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_exporter_options.cc
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_exporter_options.cc
@@ -45,6 +45,16 @@ OtlpGrpcExporterOptions::OtlpGrpcExporterOptions()
   retry_policy_backoff_multiplier = GetOtlpDefaultTracesRetryBackoffMultiplier();
 }
 
+OtlpGrpcExporterOptions::OtlpGrpcExporterOptions(void *)
+{
+  use_ssl_credentials = true;
+  max_threads         = 0;
+
+#ifdef ENABLE_ASYNC_EXPORT
+  max_concurrent_requests = 64;
+#endif
+}
+
 OtlpGrpcExporterOptions::~OtlpGrpcExporterOptions() {}
 
 }  // namespace otlp
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_log_record_builder.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_log_record_builder.cc
new file mode 100644
index 00000000000..e65b5848387
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_log_record_builder.cc
@@ -0,0 +1,56 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <chrono>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "opentelemetry/exporters/otlp/otlp_builder_utils.h"
+#include "opentelemetry/exporters/otlp/otlp_grpc_log_record_builder.h"
+#include "opentelemetry/exporters/otlp/otlp_grpc_log_record_exporter_factory.h"
+#include "opentelemetry/exporters/otlp/otlp_grpc_log_record_exporter_options.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+void OtlpGrpcLogRecordBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<OtlpGrpcLogRecordBuilder>();
+  registry->SetOtlpGrpcLogRecordBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> OtlpGrpcLogRecordBuilder::Build(
+    const opentelemetry::sdk::configuration::OtlpGrpcLogRecordExporterConfiguration *model) const
+{
+  OtlpGrpcLogRecordExporterOptions options(nullptr);
+
+  options.endpoint            = model->endpoint;
+  options.use_ssl_credentials = !model->insecure;
+
+  options.ssl_credentials_cacert_path = model->certificate_file;
+#ifdef ENABLE_OTLP_GRPC_SSL_MTLS_PREVIEW
+  options.ssl_client_key_path  = model->client_key_file;
+  options.ssl_client_cert_path = model->client_certificate_file;
+#endif
+
+  options.timeout = std::chrono::duration_cast<std::chrono::system_clock::duration>(
+      std::chrono::seconds{model->timeout});
+  options.metadata =
+      OtlpBuilderUtils::ConvertHeadersConfigurationModel(model->headers.get(), model->headers_list);
+  options.compression = model->compression;
+
+  return OtlpGrpcLogRecordExporterFactory::Create(options);
+}
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_log_record_exporter_options.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_log_record_exporter_options.cc
index 6bdf8fb98f0..55c108c03d6 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_log_record_exporter_options.cc
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_log_record_exporter_options.cc
@@ -45,6 +45,16 @@ OtlpGrpcLogRecordExporterOptions::OtlpGrpcLogRecordExporterOptions()
   retry_policy_backoff_multiplier = GetOtlpDefaultLogsRetryBackoffMultiplier();
 }
 
+OtlpGrpcLogRecordExporterOptions::OtlpGrpcLogRecordExporterOptions(void *)
+{
+  use_ssl_credentials = true;
+  max_threads         = 0;
+
+#ifdef ENABLE_ASYNC_EXPORT
+  max_concurrent_requests = 64;
+#endif
+}
+
 OtlpGrpcLogRecordExporterOptions::~OtlpGrpcLogRecordExporterOptions() {}
 
 }  // namespace otlp
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_metric_exporter_options.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_metric_exporter_options.cc
index a75b95b11f1..540357ff9c3 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_metric_exporter_options.cc
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_metric_exporter_options.cc
@@ -47,6 +47,17 @@ OtlpGrpcMetricExporterOptions::OtlpGrpcMetricExporterOptions()
   retry_policy_backoff_multiplier = GetOtlpDefaultMetricsRetryBackoffMultiplier();
 }
 
+OtlpGrpcMetricExporterOptions::OtlpGrpcMetricExporterOptions(void *)
+    : aggregation_temporality(PreferredAggregationTemporality::kCumulative)
+{
+  use_ssl_credentials = true;
+  max_threads         = 0;
+
+#ifdef ENABLE_ASYNC_EXPORT
+  max_concurrent_requests = 64;
+#endif
+}
+
 OtlpGrpcMetricExporterOptions::~OtlpGrpcMetricExporterOptions() {}
 
 }  // namespace otlp
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_push_metric_builder.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_push_metric_builder.cc
new file mode 100644
index 00000000000..6f0acd3e783
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_push_metric_builder.cc
@@ -0,0 +1,59 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <chrono>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "opentelemetry/exporters/otlp/otlp_builder_utils.h"
+#include "opentelemetry/exporters/otlp/otlp_grpc_metric_exporter_factory.h"
+#include "opentelemetry/exporters/otlp/otlp_grpc_metric_exporter_options.h"
+#include "opentelemetry/exporters/otlp/otlp_grpc_push_metric_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+void OtlpGrpcPushMetricBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<OtlpGrpcPushMetricBuilder>();
+  registry->SetOtlpGrpcPushMetricExporterBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> OtlpGrpcPushMetricBuilder::Build(
+    const opentelemetry::sdk::configuration::OtlpGrpcPushMetricExporterConfiguration *model) const
+{
+  OtlpGrpcMetricExporterOptions options(nullptr);
+
+  options.endpoint            = model->endpoint;
+  options.use_ssl_credentials = !model->insecure;
+
+  options.ssl_credentials_cacert_path = model->certificate_file;
+#ifdef ENABLE_OTLP_GRPC_SSL_MTLS_PREVIEW
+  options.ssl_client_key_path  = model->client_key_file;
+  options.ssl_client_cert_path = model->client_certificate_file;
+#endif
+
+  options.timeout = std::chrono::duration_cast<std::chrono::system_clock::duration>(
+      std::chrono::seconds{model->timeout});
+  options.metadata =
+      OtlpBuilderUtils::ConvertHeadersConfigurationModel(model->headers.get(), model->headers_list);
+  options.compression = model->compression;
+
+  options.aggregation_temporality =
+      OtlpBuilderUtils::ConvertTemporalityPreference(model->temporality_preference);
+
+  return OtlpGrpcMetricExporterFactory::Create(options);
+}
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_span_builder.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_span_builder.cc
new file mode 100644
index 00000000000..42aeeb56f50
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_grpc_span_builder.cc
@@ -0,0 +1,56 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <chrono>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "opentelemetry/exporters/otlp/otlp_builder_utils.h"
+#include "opentelemetry/exporters/otlp/otlp_grpc_exporter_factory.h"
+#include "opentelemetry/exporters/otlp/otlp_grpc_exporter_options.h"
+#include "opentelemetry/exporters/otlp/otlp_grpc_span_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+void OtlpGrpcSpanBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<OtlpGrpcSpanBuilder>();
+  registry->SetOtlpGrpcSpanBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> OtlpGrpcSpanBuilder::Build(
+    const opentelemetry::sdk::configuration::OtlpGrpcSpanExporterConfiguration *model) const
+{
+  OtlpGrpcExporterOptions options(nullptr);
+
+  options.endpoint            = model->endpoint;
+  options.use_ssl_credentials = !model->insecure;
+
+  options.ssl_credentials_cacert_path = model->certificate_file;
+#ifdef ENABLE_OTLP_GRPC_SSL_MTLS_PREVIEW
+  options.ssl_client_key_path  = model->client_key_file;
+  options.ssl_client_cert_path = model->client_certificate_file;
+#endif
+
+  options.timeout = std::chrono::duration_cast<std::chrono::system_clock::duration>(
+      std::chrono::seconds{model->timeout});
+  options.metadata =
+      OtlpBuilderUtils::ConvertHeadersConfigurationModel(model->headers.get(), model->headers_list);
+  options.compression = model->compression;
+
+  return OtlpGrpcExporterFactory::Create(options);
+}
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_exporter_options.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_exporter_options.cc
index 7a75018e137..f50e3e1bfd5 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_exporter_options.cc
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_exporter_options.cc
@@ -43,6 +43,19 @@ OtlpHttpExporterOptions::OtlpHttpExporterOptions()
       retry_policy_backoff_multiplier(GetOtlpDefaultTracesRetryBackoffMultiplier())
 {}
 
+OtlpHttpExporterOptions::OtlpHttpExporterOptions(void *)
+    : url(),
+      content_type(HttpRequestContentType::kBinary),
+      json_bytes_mapping(JsonBytesMappingKind::kHexId),
+      use_json_name(false),
+      console_debug(false),
+#ifdef ENABLE_ASYNC_EXPORT
+      max_concurrent_requests{64},
+      max_requests_per_connection{8},
+#endif
+      ssl_insecure_skip_verify(false)
+{}
+
 OtlpHttpExporterOptions::~OtlpHttpExporterOptions() {}
 
 }  // namespace otlp
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_log_record_builder.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_log_record_builder.cc
new file mode 100644
index 00000000000..ad72b918689
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_log_record_builder.cc
@@ -0,0 +1,57 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <chrono>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "opentelemetry/exporters/otlp/otlp_builder_utils.h"
+#include "opentelemetry/exporters/otlp/otlp_http.h"
+#include "opentelemetry/exporters/otlp/otlp_http_log_record_builder.h"
+#include "opentelemetry/exporters/otlp/otlp_http_log_record_exporter_factory.h"
+#include "opentelemetry/exporters/otlp/otlp_http_log_record_exporter_options.h"
+#include "opentelemetry/sdk/configuration/otlp_http_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+void OtlpHttpLogRecordBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<OtlpHttpLogRecordBuilder>();
+  registry->SetOtlpHttpLogRecordBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> OtlpHttpLogRecordBuilder::Build(
+    const opentelemetry::sdk::configuration::OtlpHttpLogRecordExporterConfiguration *model) const
+{
+  OtlpHttpLogRecordExporterOptions options(nullptr);
+
+  options.url                = model->endpoint;
+  options.content_type       = OtlpBuilderUtils::ConvertOtlpHttpEncoding(model->encoding);
+  options.json_bytes_mapping = JsonBytesMappingKind::kHexId;
+  options.use_json_name      = false;
+  options.console_debug      = false;
+  options.timeout            = std::chrono::duration_cast<std::chrono::system_clock::duration>(
+      std::chrono::seconds{model->timeout});
+  options.http_headers =
+      OtlpBuilderUtils::ConvertHeadersConfigurationModel(model->headers.get(), model->headers_list);
+  options.ssl_insecure_skip_verify = false;
+  options.ssl_ca_cert_path         = model->certificate_file;
+  options.ssl_client_key_path      = model->client_key_file;
+  options.ssl_client_cert_path     = model->client_certificate_file;
+  options.compression              = model->compression;
+
+  return OtlpHttpLogRecordExporterFactory::Create(options);
+}
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_log_record_exporter_options.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_log_record_exporter_options.cc
index 212bc3f6cd7..32c42940da1 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_log_record_exporter_options.cc
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_log_record_exporter_options.cc
@@ -43,6 +43,19 @@ OtlpHttpLogRecordExporterOptions::OtlpHttpLogRecordExporterOptions()
       retry_policy_backoff_multiplier(GetOtlpDefaultLogsRetryBackoffMultiplier())
 {}
 
+OtlpHttpLogRecordExporterOptions::OtlpHttpLogRecordExporterOptions(void *)
+    : url(),
+      content_type(exporter::otlp::HttpRequestContentType::kBinary),
+      json_bytes_mapping(JsonBytesMappingKind::kHexId),
+      use_json_name(false),
+      console_debug(false),
+#ifdef ENABLE_ASYNC_EXPORT
+      max_concurrent_requests{64},
+      max_requests_per_connection{8},
+#endif
+      ssl_insecure_skip_verify(false)
+{}
+
 OtlpHttpLogRecordExporterOptions::~OtlpHttpLogRecordExporterOptions() {}
 
 }  // namespace otlp
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_metric_exporter_options.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_metric_exporter_options.cc
index 0ccdc0ab942..f78ed4f0873 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_metric_exporter_options.cc
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_metric_exporter_options.cc
@@ -45,6 +45,20 @@ OtlpHttpMetricExporterOptions::OtlpHttpMetricExporterOptions()
       retry_policy_backoff_multiplier(GetOtlpDefaultMetricsRetryBackoffMultiplier())
 {}
 
+OtlpHttpMetricExporterOptions::OtlpHttpMetricExporterOptions(void *)
+    : url(),
+      content_type(exporter::otlp::HttpRequestContentType::kBinary),
+      json_bytes_mapping(JsonBytesMappingKind::kHexId),
+      use_json_name(false),
+      console_debug(false),
+      aggregation_temporality(PreferredAggregationTemporality::kCumulative),
+#ifdef ENABLE_ASYNC_EXPORT
+      max_concurrent_requests{64},
+      max_requests_per_connection{8},
+#endif
+      ssl_insecure_skip_verify(false)
+{}
+
 OtlpHttpMetricExporterOptions::~OtlpHttpMetricExporterOptions() {}
 
 }  // namespace otlp
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_push_metric_builder.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_push_metric_builder.cc
new file mode 100644
index 00000000000..afc59adabe6
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_push_metric_builder.cc
@@ -0,0 +1,59 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <chrono>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "opentelemetry/exporters/otlp/otlp_builder_utils.h"
+#include "opentelemetry/exporters/otlp/otlp_http.h"
+#include "opentelemetry/exporters/otlp/otlp_http_metric_exporter_factory.h"
+#include "opentelemetry/exporters/otlp/otlp_http_metric_exporter_options.h"
+#include "opentelemetry/exporters/otlp/otlp_http_push_metric_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+void OtlpHttpPushMetricBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<OtlpHttpPushMetricBuilder>();
+  registry->SetOtlpHttpPushMetricExporterBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> OtlpHttpPushMetricBuilder::Build(
+    const opentelemetry::sdk::configuration::OtlpHttpPushMetricExporterConfiguration *model) const
+{
+  OtlpHttpMetricExporterOptions options(nullptr);
+
+  options.url                = model->endpoint;
+  options.content_type       = OtlpBuilderUtils::ConvertOtlpHttpEncoding(model->encoding);
+  options.json_bytes_mapping = JsonBytesMappingKind::kHexId;
+  options.use_json_name      = false;
+  options.console_debug      = false;
+  options.timeout            = std::chrono::duration_cast<std::chrono::system_clock::duration>(
+      std::chrono::seconds{model->timeout});
+  options.http_headers =
+      OtlpBuilderUtils::ConvertHeadersConfigurationModel(model->headers.get(), model->headers_list);
+  options.aggregation_temporality =
+      OtlpBuilderUtils::ConvertTemporalityPreference(model->temporality_preference);
+  options.ssl_insecure_skip_verify = false;
+  options.ssl_ca_cert_path         = model->certificate_file;
+  options.ssl_client_key_path      = model->client_key_file;
+  options.ssl_client_cert_path     = model->client_certificate_file;
+  options.compression              = model->compression;
+
+  return OtlpHttpMetricExporterFactory::Create(options);
+}
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_span_builder.cc b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_span_builder.cc
new file mode 100644
index 00000000000..98b79c6a58d
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/otlp/src/otlp_http_span_builder.cc
@@ -0,0 +1,57 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <chrono>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "opentelemetry/exporters/otlp/otlp_builder_utils.h"
+#include "opentelemetry/exporters/otlp/otlp_http.h"
+#include "opentelemetry/exporters/otlp/otlp_http_exporter_factory.h"
+#include "opentelemetry/exporters/otlp/otlp_http_exporter_options.h"
+#include "opentelemetry/exporters/otlp/otlp_http_span_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace otlp
+{
+
+void OtlpHttpSpanBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<OtlpHttpSpanBuilder>();
+  registry->SetOtlpHttpSpanBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> OtlpHttpSpanBuilder::Build(
+    const opentelemetry::sdk::configuration::OtlpHttpSpanExporterConfiguration *model) const
+{
+  OtlpHttpExporterOptions options(nullptr);
+
+  options.url                = model->endpoint;
+  options.content_type       = OtlpBuilderUtils::ConvertOtlpHttpEncoding(model->encoding);
+  options.json_bytes_mapping = JsonBytesMappingKind::kHexId;
+  options.use_json_name      = false;
+  options.console_debug      = false;
+  options.timeout            = std::chrono::duration_cast<std::chrono::system_clock::duration>(
+      std::chrono::seconds{model->timeout});
+  options.http_headers =
+      OtlpBuilderUtils::ConvertHeadersConfigurationModel(model->headers.get(), model->headers_list);
+  options.ssl_insecure_skip_verify = false;
+  options.ssl_ca_cert_path         = model->certificate_file;
+  options.ssl_client_key_path      = model->client_key_file;
+  options.ssl_client_cert_path     = model->client_certificate_file;
+  options.compression              = model->compression;
+
+  return OtlpHttpExporterFactory::Create(options);
+}
+
+}  // namespace otlp
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/otlp/test/otlp_file_metric_exporter_test.cc b/deps/opentelemetry-cpp/exporters/otlp/test/otlp_file_metric_exporter_test.cc
index 965da942ae0..fb388f316ed 100644
--- a/deps/opentelemetry-cpp/exporters/otlp/test/otlp_file_metric_exporter_test.cc
+++ b/deps/opentelemetry-cpp/exporters/otlp/test/otlp_file_metric_exporter_test.cc
@@ -95,8 +95,9 @@ class OtlpFileMetricExporterTestPeer : public ::testing::Test
         opentelemetry::sdk::resource::ResourceAttributes{}, "resource_url");
     data.resource_ = &resource;
 
-    auto scope = opentelemetry::sdk::instrumentationscope::InstrumentationScope::Create(
-        "library_name", "1.5.0", "scope_url", {{"scope_key", "scope_value"}});
+    auto instrumentation_scope =
+        opentelemetry::sdk::instrumentationscope::InstrumentationScope::Create(
+            "library_name", "1.5.0", "scope_url", {{"scope_key", "scope_value"}});
 
     opentelemetry::sdk::metrics::MetricData metric_data{
         opentelemetry::sdk::metrics::InstrumentDescriptor{
@@ -110,7 +111,8 @@ class OtlpFileMetricExporterTestPeer : public ::testing::Test
             {opentelemetry::sdk::metrics::PointAttributes{{"a2", "b2"}}, sum_point_data2}}};
 
     data.scope_metric_data_ = std::vector<opentelemetry::sdk::metrics::ScopeMetrics>{
-        {scope.get(), std::vector<opentelemetry::sdk::metrics::MetricData>{metric_data}}};
+        {instrumentation_scope.get(),
+         std::vector<opentelemetry::sdk::metrics::MetricData>{metric_data}}};
 
     auto result = exporter->Export(data);
     EXPECT_EQ(result, opentelemetry::sdk::common::ExportResult::kSuccess);
@@ -180,10 +182,12 @@ class OtlpFileMetricExporterTestPeer : public ::testing::Test
     auto resource = opentelemetry::sdk::resource::Resource::Create(
         opentelemetry::sdk::resource::ResourceAttributes{});
     data.resource_ = &resource;
-    auto scope     = opentelemetry::sdk::instrumentationscope::InstrumentationScope::Create(
-        "library_name", "1.5.0");
+    auto instrumentation_scope =
+        opentelemetry::sdk::instrumentationscope::InstrumentationScope::Create("library_name",
+                                                                               "1.5.0");
     data.scope_metric_data_ = std::vector<opentelemetry::sdk::metrics::ScopeMetrics>{
-        {scope.get(), std::vector<opentelemetry::sdk::metrics::MetricData>{metric_data}}};
+        {instrumentation_scope.get(),
+         std::vector<opentelemetry::sdk::metrics::MetricData>{metric_data}}};
 
     auto result = exporter->Export(data);
     EXPECT_EQ(result, opentelemetry::sdk::common::ExportResult::kSuccess);
@@ -250,10 +254,12 @@ class OtlpFileMetricExporterTestPeer : public ::testing::Test
     auto resource = opentelemetry::sdk::resource::Resource::Create(
         opentelemetry::sdk::resource::ResourceAttributes{});
     data.resource_ = &resource;
-    auto scope     = opentelemetry::sdk::instrumentationscope::InstrumentationScope::Create(
-        "library_name", "1.5.0");
+    auto instrumentation_scope =
+        opentelemetry::sdk::instrumentationscope::InstrumentationScope::Create("library_name",
+                                                                               "1.5.0");
     data.scope_metric_data_ = std::vector<opentelemetry::sdk::metrics::ScopeMetrics>{
-        {scope.get(), std::vector<opentelemetry::sdk::metrics::MetricData>{metric_data}}};
+        {instrumentation_scope.get(),
+         std::vector<opentelemetry::sdk::metrics::MetricData>{metric_data}}};
 
     auto result = exporter->Export(data);
     EXPECT_EQ(result, opentelemetry::sdk::common::ExportResult::kSuccess);
diff --git a/deps/opentelemetry-cpp/exporters/prometheus/include/opentelemetry/exporters/prometheus/exporter_options.h b/deps/opentelemetry-cpp/exporters/prometheus/include/opentelemetry/exporters/prometheus/exporter_options.h
index da9d124029e..9d41d268e81 100644
--- a/deps/opentelemetry-cpp/exporters/prometheus/include/opentelemetry/exporters/prometheus/exporter_options.h
+++ b/deps/opentelemetry-cpp/exporters/prometheus/include/opentelemetry/exporters/prometheus/exporter_options.h
@@ -18,8 +18,12 @@ namespace metrics
  */
 struct PrometheusExporterOptions
 {
+  // Lookup environment variables
   PrometheusExporterOptions();
 
+  // No defaults
+  PrometheusExporterOptions(void *);
+
   // The endpoint the Prometheus backend can collect metrics from
   std::string url;
 
diff --git a/deps/opentelemetry-cpp/exporters/prometheus/include/opentelemetry/exporters/prometheus/prometheus_pull_builder.h b/deps/opentelemetry-cpp/exporters/prometheus/include/opentelemetry/exporters/prometheus/prometheus_pull_builder.h
new file mode 100644
index 00000000000..621643b08fc
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/prometheus/include/opentelemetry/exporters/prometheus/prometheus_pull_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/prometheus_pull_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/prometheus_pull_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/metrics/metric_reader.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace metrics
+{
+
+class OPENTELEMETRY_EXPORT PrometheusPullBuilder
+    : public opentelemetry::sdk::configuration::PrometheusPullMetricExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> Build(
+      const opentelemetry::sdk::configuration::PrometheusPullMetricExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace metrics
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/prometheus/src/exporter_options.cc b/deps/opentelemetry-cpp/exporters/prometheus/src/exporter_options.cc
index 2ac24b635da..122baf5198f 100644
--- a/deps/opentelemetry-cpp/exporters/prometheus/src/exporter_options.cc
+++ b/deps/opentelemetry-cpp/exporters/prometheus/src/exporter_options.cc
@@ -77,6 +77,8 @@ PrometheusExporterOptions::PrometheusExporterOptions()
       without_type_suffix(GetPrometheusWithoutTypeSuffix())
 {}
 
+PrometheusExporterOptions::PrometheusExporterOptions(void *) : url("") {}
+
 }  // namespace metrics
 }  // namespace exporter
 OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/prometheus/src/prometheus_pull_builder.cc b/deps/opentelemetry-cpp/exporters/prometheus/src/prometheus_pull_builder.cc
new file mode 100644
index 00000000000..18cf814051e
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/prometheus/src/prometheus_pull_builder.cc
@@ -0,0 +1,49 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "opentelemetry/exporters/prometheus/exporter_factory.h"
+#include "opentelemetry/exporters/prometheus/exporter_options.h"
+#include "opentelemetry/exporters/prometheus/prometheus_pull_builder.h"
+#include "opentelemetry/sdk/configuration/prometheus_pull_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/prometheus_pull_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/metrics/metric_reader.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace metrics
+{
+
+void PrometheusPullBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<PrometheusPullBuilder>();
+  registry->SetPrometheusPullMetricExporterBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> PrometheusPullBuilder::Build(
+    const opentelemetry::sdk::configuration::PrometheusPullMetricExporterConfiguration *model) const
+{
+  opentelemetry::exporter::metrics::PrometheusExporterOptions options(nullptr);
+
+  std::string url(model->host);
+  url.append(":");
+  url.append(std::to_string(model->port));
+
+  options.url                  = url;
+  options.populate_target_info = true;
+  options.without_otel_scope   = model->without_scope_info;
+  options.without_units        = model->without_units;
+  options.without_type_suffix  = model->without_type_suffix;
+
+  return PrometheusExporterFactory::Create(options);
+}
+
+}  // namespace metrics
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/prometheus/test/exporter_utils_test.cc b/deps/opentelemetry-cpp/exporters/prometheus/test/exporter_utils_test.cc
index c8a6254f3b8..4ad329f0ec0 100644
--- a/deps/opentelemetry-cpp/exporters/prometheus/test/exporter_utils_test.cc
+++ b/deps/opentelemetry-cpp/exporters/prometheus/test/exporter_utils_test.cc
@@ -102,18 +102,21 @@ void assert_basic(prometheus_client::MetricFamily &metric,
   switch (type)
   {
     case prometheus_client::MetricType::Counter: {
-      ASSERT_DOUBLE_EQ(metric_data.counter.value, vals[0]);
+      ASSERT_DOUBLE_EQ(static_cast<double>(metric_data.counter.value),
+                       static_cast<double>(vals[0]));
       break;
     }
     case prometheus_client::MetricType::Histogram: {
-      ASSERT_DOUBLE_EQ(metric_data.histogram.sample_count, vals[0]);
-      ASSERT_DOUBLE_EQ(metric_data.histogram.sample_sum, vals[1]);
+      ASSERT_DOUBLE_EQ(static_cast<double>(metric_data.histogram.sample_count),
+                       static_cast<double>(vals[0]));
+      ASSERT_DOUBLE_EQ(static_cast<double>(metric_data.histogram.sample_sum),
+                       static_cast<double>(vals[1]));
       auto buckets = metric_data.histogram.bucket;
       ASSERT_EQ(buckets.size(), vals[2]);
       break;
     }
     case prometheus_client::MetricType::Gauge: {
-      ASSERT_DOUBLE_EQ(metric_data.gauge.value, vals[0]);
+      ASSERT_DOUBLE_EQ(static_cast<double>(metric_data.gauge.value), static_cast<double>(vals[0]));
       break;
     }
     break;
diff --git a/deps/opentelemetry-cpp/exporters/zipkin/CMakeLists.txt b/deps/opentelemetry-cpp/exporters/zipkin/CMakeLists.txt
index 548a9fd44d2..9fc92ba7a52 100644
--- a/deps/opentelemetry-cpp/exporters/zipkin/CMakeLists.txt
+++ b/deps/opentelemetry-cpp/exporters/zipkin/CMakeLists.txt
@@ -59,7 +59,7 @@ if(BUILD_TESTING)
     ${GMOCK_LIB}
     opentelemetry_exporter_zipkin_trace
     opentelemetry_resources
-    ${CURL_LIBRARIES})
+    CURL::libcurl)
 
   gtest_add_tests(
     TARGET zipkin_exporter_test
diff --git a/deps/opentelemetry-cpp/exporters/zipkin/include/opentelemetry/exporters/zipkin/zipkin_builder.h b/deps/opentelemetry-cpp/exporters/zipkin/include/opentelemetry/exporters/zipkin/zipkin_builder.h
new file mode 100644
index 00000000000..c5d28d09cea
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/zipkin/include/opentelemetry/exporters/zipkin/zipkin_builder.h
@@ -0,0 +1,33 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/configuration/zipkin_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/zipkin_span_exporter_configuration.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace zipkin
+{
+
+class OPENTELEMETRY_EXPORT ZipkinBuilder
+    : public opentelemetry::sdk::configuration::ZipkinSpanExporterBuilder
+{
+public:
+  static void Register(opentelemetry::sdk::configuration::Registry *registry);
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> Build(
+      const opentelemetry::sdk::configuration::ZipkinSpanExporterConfiguration *model)
+      const override;
+};
+
+}  // namespace zipkin
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/exporters/zipkin/include/opentelemetry/exporters/zipkin/zipkin_exporter_options.h b/deps/opentelemetry-cpp/exporters/zipkin/include/opentelemetry/exporters/zipkin/zipkin_exporter_options.h
index f5ee941d225..45cfef45dca 100644
--- a/deps/opentelemetry-cpp/exporters/zipkin/include/opentelemetry/exporters/zipkin/zipkin_exporter_options.h
+++ b/deps/opentelemetry-cpp/exporters/zipkin/include/opentelemetry/exporters/zipkin/zipkin_exporter_options.h
@@ -13,6 +13,7 @@ namespace exporter
 namespace zipkin
 {
 
+// The endpoint to export to. By default the OpenTelemetry Collector's default endpoint.
 inline const std::string GetDefaultZipkinEndpoint()
 {
   const char *otel_exporter_zipkin_endpoint_env = "OTEL_EXPORTER_ZIPKIN_ENDPOINT";
@@ -36,8 +37,13 @@ enum class TransportFormat
  */
 struct ZipkinExporterOptions
 {
-  // The endpoint to export to. By default the OpenTelemetry Collector's default endpoint.
-  std::string endpoint     = GetDefaultZipkinEndpoint();
+  // Lookup environment variables
+  ZipkinExporterOptions() : endpoint(GetDefaultZipkinEndpoint()) {}
+
+  // No defaults
+  ZipkinExporterOptions(void *) : endpoint("") {}
+
+  std::string endpoint;
   TransportFormat format   = TransportFormat::kJson;
   std::string service_name = "default-service";
   std::string ipv4;
diff --git a/deps/opentelemetry-cpp/exporters/zipkin/src/zipkin_builder.cc b/deps/opentelemetry-cpp/exporters/zipkin/src/zipkin_builder.cc
new file mode 100644
index 00000000000..a7bdc770d4c
--- /dev/null
+++ b/deps/opentelemetry-cpp/exporters/zipkin/src/zipkin_builder.cc
@@ -0,0 +1,41 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "opentelemetry/exporters/zipkin/zipkin_builder.h"
+#include "opentelemetry/exporters/zipkin/zipkin_exporter_factory.h"
+#include "opentelemetry/exporters/zipkin/zipkin_exporter_options.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/configuration/zipkin_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/zipkin_span_exporter_configuration.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace exporter
+{
+namespace zipkin
+{
+
+void ZipkinBuilder::Register(opentelemetry::sdk::configuration::Registry *registry)
+{
+  auto builder = std::make_unique<ZipkinBuilder>();
+  registry->SetZipkinSpanBuilder(std::move(builder));
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> ZipkinBuilder::Build(
+    const opentelemetry::sdk::configuration::ZipkinSpanExporterConfiguration *model) const
+{
+  ZipkinExporterOptions options(nullptr);
+
+  options.endpoint = model->endpoint;
+
+  return ZipkinExporterFactory::Create(options);
+}
+
+}  // namespace zipkin
+}  // namespace exporter
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/ext/include/opentelemetry/ext/http/client/curl/http_client_curl.h b/deps/opentelemetry-cpp/ext/include/opentelemetry/ext/http/client/curl/http_client_curl.h
index 77bd6bf89c4..1dc4e6a9050 100644
--- a/deps/opentelemetry-cpp/ext/include/opentelemetry/ext/http/client/curl/http_client_curl.h
+++ b/deps/opentelemetry-cpp/ext/include/opentelemetry/ext/http/client/curl/http_client_curl.h
@@ -323,6 +323,8 @@ class HttpClient : public opentelemetry::ext::http::client::HttpClient
 
   void SetMaxSessionsPerConnection(std::size_t max_requests_per_connection) noexcept override;
 
+  bool InternalCancelAllSessions() noexcept;
+
   inline uint64_t GetMaxSessionsPerConnection() const noexcept
   {
     return max_sessions_per_connection_;
diff --git a/deps/opentelemetry-cpp/ext/include/opentelemetry/ext/http/client/curl/http_operation_curl.h b/deps/opentelemetry-cpp/ext/include/opentelemetry/ext/http/client/curl/http_operation_curl.h
index d180134cae6..76879fc1df9 100644
--- a/deps/opentelemetry-cpp/ext/include/opentelemetry/ext/http/client/curl/http_operation_curl.h
+++ b/deps/opentelemetry-cpp/ext/include/opentelemetry/ext/http/client/curl/http_operation_curl.h
@@ -338,6 +338,7 @@ class HttpOperation
     std::promise<CURLcode> result_promise;
     std::future<CURLcode> result_future;
   };
+  friend class HttpOperationAccessor;
   std::unique_ptr<AsyncData> async_data_;
 };
 }  // namespace curl
diff --git a/deps/opentelemetry-cpp/ext/src/dll/input.src b/deps/opentelemetry-cpp/ext/src/dll/input.src
index 661e01c1a73..9d6a529c5c8 100644
--- a/deps/opentelemetry-cpp/ext/src/dll/input.src
+++ b/deps/opentelemetry-cpp/ext/src/dll/input.src
@@ -16,6 +16,7 @@ ForceFlush@LoggerProvider@logs@sdk@v1@opentelemetry
 OStreamLogRecordExporter@logs@exporter@v1@opentelemetry
 Create@OStreamMetricExporterFactory@metrics@exporter@v1@opentelemetry
 Create@PeriodicExportingMetricReaderFactory@metrics@sdk@v1@opentelemetry
+PeriodicExportingMetricReaderOptions@metrics@sdk@v1@opentelemetry
 Create@MeterProviderFactory@metrics@sdk@v1@opentelemetry
 Create@MeterContextFactory@metrics@sdk@v1@opentelemetry
 Create@ViewFactory@metrics@sdk@v1@opentelemetry
diff --git a/deps/opentelemetry-cpp/ext/src/http/client/curl/CMakeLists.txt b/deps/opentelemetry-cpp/ext/src/http/client/curl/CMakeLists.txt
index 0c1d8c61950..d238a1c4dd0 100644
--- a/deps/opentelemetry-cpp/ext/src/http/client/curl/CMakeLists.txt
+++ b/deps/opentelemetry-cpp/ext/src/http/client/curl/CMakeLists.txt
@@ -11,40 +11,10 @@ set_target_version(opentelemetry_http_client_curl)
 target_link_libraries(opentelemetry_http_client_curl
                       PUBLIC opentelemetry_common)
 
-unset(CURL_IMPORTED_TARGET_NAME)
-
-foreach(FIND_CURL_IMPORTED_TARGET CURL::libcurl CURL::libcurl_shared
-                                  CURL::libcurl_static)
-  if(TARGET ${FIND_CURL_IMPORTED_TARGET})
-    set(CURL_IMPORTED_TARGET_NAME ${FIND_CURL_IMPORTED_TARGET})
-    break()
-  endif()
-endforeach()
-
-if(TARGET ${CURL_IMPORTED_TARGET_NAME})
-  target_link_libraries(
-    opentelemetry_http_client_curl
-    PUBLIC opentelemetry_ext
-    PRIVATE ${CURL_IMPORTED_TARGET_NAME})
-
-  # Some versions of libcurl do not export the link directories, which may cause
-  # link errors
-  project_build_tools_get_imported_location(CURL_LIB_FILE_PATH
-                                            ${CURL_IMPORTED_TARGET_NAME})
-  get_filename_component(CURL_LIB_DIR_PATH "${CURL_LIB_FILE_PATH}" DIRECTORY)
-
-  if(CURL_LIB_DIR_PATH)
-    target_link_directories(opentelemetry_http_client_curl PUBLIC
-                            "$<BUILD_INTERFACE:${CURL_LIB_DIR_PATH}>")
-  endif()
-else()
-  target_include_directories(opentelemetry_http_client_curl
-                             INTERFACE "${CURL_INCLUDE_DIRS}")
-  target_link_libraries(
-    opentelemetry_http_client_curl
-    PUBLIC opentelemetry_ext
-    PRIVATE ${CURL_LIBRARIES})
-endif()
+target_link_libraries(
+  opentelemetry_http_client_curl
+  PUBLIC opentelemetry_ext
+  PRIVATE CURL::libcurl)
 
 if(WITH_CURL_LOGGING)
   target_compile_definitions(opentelemetry_http_client_curl
@@ -52,19 +22,10 @@ if(WITH_CURL_LOGGING)
 endif()
 
 if(WITH_OTLP_HTTP_COMPRESSION)
-  if(TARGET ZLIB::ZLIB)
-    target_link_libraries(
-      opentelemetry_http_client_curl
-      PUBLIC opentelemetry_ext
-      PRIVATE ZLIB::ZLIB)
-  else()
-    target_include_directories(opentelemetry_http_client_curl
-                               INTERFACE "${ZLIB_INCLUDE_DIRS}")
-    target_link_libraries(
-      opentelemetry_http_client_curl
-      PUBLIC opentelemetry_ext
-      PRIVATE ${ZLIB_LIBRARIES})
-  endif()
+  target_link_libraries(
+    opentelemetry_http_client_curl
+    PUBLIC opentelemetry_ext
+    PRIVATE ZLIB::ZLIB)
 endif()
 
 otel_add_component(COMPONENT ext_http_curl TARGETS
diff --git a/deps/opentelemetry-cpp/ext/src/http/client/curl/http_client_curl.cc b/deps/opentelemetry-cpp/ext/src/http/client/curl/http_client_curl.cc
index 71f5454d33a..77105398d37 100644
--- a/deps/opentelemetry-cpp/ext/src/http/client/curl/http_client_curl.cc
+++ b/deps/opentelemetry-cpp/ext/src/http/client/curl/http_client_curl.cc
@@ -101,13 +101,13 @@ int deflateInPlace(z_stream *strm, unsigned char *buf, uint32_t len, uint32_t *m
     have           = 0;
     while (ret == Z_OK)
     {
-      strm->avail_out =
-          strm->avail_in ? strm->next_in - strm->next_out : (buf + *max_len) - strm->next_out;
+      strm->avail_out = static_cast<decltype(z_stream::avail_out)>(
+          strm->avail_in ? strm->next_in - strm->next_out : (buf + *max_len) - strm->next_out);
       ret = deflate(strm, Z_FINISH);
     }
     if (ret != Z_BUF_ERROR || strm->avail_in == 0)
     {
-      *max_len = strm->next_out - buf;
+      *max_len = static_cast<uint32_t>(strm->next_out - buf);
       return ret == Z_STREAM_END ? Z_OK : ret;
     }
   }
@@ -130,10 +130,10 @@ int deflateInPlace(z_stream *strm, unsigned char *buf, uint32_t len, uint32_t *m
     std::memcpy(buf, temp.data(), have);
     strm->next_out = buf + have;
   }
-  strm->avail_out = (buf + *max_len) - strm->next_out;
+  strm->avail_out = static_cast<decltype(z_stream::avail_out)>((buf + *max_len) - strm->next_out);
   ret             = deflate(strm, Z_FINISH);
   strm->zfree(strm->opaque, hold);
-  *max_len = strm->next_out - buf;
+  *max_len = static_cast<uint32_t>(strm->next_out - buf);
   return ret == Z_OK ? Z_BUF_ERROR : (ret == Z_STREAM_END ? Z_OK : ret);
 }
 #endif  // ENABLE_OTLP_COMPRESSION_PREVIEW
@@ -302,7 +302,7 @@ HttpClient::~HttpClient()
     }
 
     // Force to abort all sessions
-    CancelAllSessions();
+    InternalCancelAllSessions();
 
     if (!background_thread)
     {
@@ -342,27 +342,7 @@ std::shared_ptr<opentelemetry::ext::http::client::Session> HttpClient::CreateSes
 
 bool HttpClient::CancelAllSessions() noexcept
 {
-  // CancelSession may change sessions_, we can not change a container while iterating it.
-  while (true)
-  {
-    std::unordered_map<uint64_t, std::shared_ptr<Session>> sessions;
-    {
-      // We can only cleanup session and curl handles in the IO thread.
-      std::lock_guard<std::mutex> lock_guard{sessions_m_};
-      sessions = sessions_;
-    }
-
-    if (sessions.empty())
-    {
-      break;
-    }
-
-    for (auto &session : sessions)
-    {
-      session.second->CancelSession();
-    }
-  }
-  return true;
+  return InternalCancelAllSessions();
 }
 
 bool HttpClient::FinishAllSessions() noexcept
@@ -435,6 +415,31 @@ void HttpClient::CleanupSession(uint64_t session_id)
   }
 }
 
+bool HttpClient::InternalCancelAllSessions() noexcept
+{
+  // CancelSession may change sessions_, we can not change a container while iterating it.
+  while (true)
+  {
+    std::unordered_map<uint64_t, std::shared_ptr<Session>> sessions;
+    {
+      // We can only cleanup session and curl handles in the IO thread.
+      std::lock_guard<std::mutex> lock_guard{sessions_m_};
+      sessions = sessions_;
+    }
+
+    if (sessions.empty())
+    {
+      break;
+    }
+
+    for (auto &session : sessions)
+    {
+      session.second->CancelSession();
+    }
+  }
+  return true;
+}
+
 bool HttpClient::MaybeSpawnBackgroundThread()
 {
   std::lock_guard<std::mutex> lock_guard{background_thread_m_};
diff --git a/deps/opentelemetry-cpp/ext/src/http/client/curl/http_operation_curl.cc b/deps/opentelemetry-cpp/ext/src/http/client/curl/http_operation_curl.cc
index 042ae4fe631..3fd27c96342 100644
--- a/deps/opentelemetry-cpp/ext/src/http/client/curl/http_operation_curl.cc
+++ b/deps/opentelemetry-cpp/ext/src/http/client/curl/http_operation_curl.cc
@@ -47,6 +47,28 @@ namespace client
 namespace curl
 {
 
+class HttpOperationAccessor
+{
+public:
+  OPENTELEMETRY_SANITIZER_NO_THREAD static std::thread::id GetThreadId(
+      const HttpOperation::AsyncData &async_data)
+  {
+#if !(defined(OPENTELEMETRY_HAVE_THREAD_SANITIZER) && OPENTELEMETRY_HAVE_THREAD_SANITIZER)
+    std::atomic_thread_fence(std::memory_order_acquire);
+#endif
+    return async_data.callback_thread;
+  }
+
+  OPENTELEMETRY_SANITIZER_NO_THREAD static void SetThreadId(HttpOperation::AsyncData &async_data,
+                                                            std::thread::id thread_id)
+  {
+    async_data.callback_thread = thread_id;
+#if !(defined(OPENTELEMETRY_HAVE_THREAD_SANITIZER) && OPENTELEMETRY_HAVE_THREAD_SANITIZER)
+    std::atomic_thread_fence(std::memory_order_release);
+#endif
+  }
+};
+
 size_t HttpOperation::WriteMemoryCallback(void *contents, size_t size, size_t nmemb, void *userp)
 {
   HttpOperation *self = reinterpret_cast<HttpOperation *>(userp);
@@ -335,7 +357,7 @@ HttpOperation::~HttpOperation()
     case opentelemetry::ext::http::client::SessionState::Sending: {
       if (async_data_ && async_data_->result_future.valid())
       {
-        if (async_data_->callback_thread != std::this_thread::get_id())
+        if (HttpOperationAccessor::GetThreadId(*async_data_) != std::this_thread::get_id())
         {
           async_data_->result_future.wait();
           last_curl_result_ = async_data_->result_future.get();
@@ -360,7 +382,7 @@ void HttpOperation::Finish()
   if (async_data_ && async_data_->result_future.valid())
   {
     // We should not wait in callback from Cleanup()
-    if (async_data_->callback_thread != std::this_thread::get_id())
+    if (HttpOperationAccessor::GetThreadId(*async_data_) != std::this_thread::get_id())
     {
       async_data_->result_future.wait();
       last_curl_result_ = async_data_->result_future.get();
@@ -412,9 +434,9 @@ void HttpOperation::Cleanup()
     callback.swap(async_data_->callback);
     if (callback)
     {
-      async_data_->callback_thread = std::this_thread::get_id();
+      HttpOperationAccessor::SetThreadId(*async_data_, std::this_thread::get_id());
       callback(*this);
-      async_data_->callback_thread = std::thread::id();
+      HttpOperationAccessor::SetThreadId(*async_data_, std::thread::id());
     }
 
     // Set value to promise to continue Finish()
diff --git a/deps/opentelemetry-cpp/ext/test/http/CMakeLists.txt b/deps/opentelemetry-cpp/ext/test/http/CMakeLists.txt
index f4d3774735e..b7707bd8c20 100644
--- a/deps/opentelemetry-cpp/ext/test/http/CMakeLists.txt
+++ b/deps/opentelemetry-cpp/ext/test/http/CMakeLists.txt
@@ -4,28 +4,10 @@
 if(WITH_HTTP_CLIENT_CURL)
   set(FILENAME curl_http_test)
   add_executable(${FILENAME} ${FILENAME}.cc)
-  target_link_libraries(${FILENAME} ${GMOCK_LIB} ${GTEST_BOTH_LIBRARIES}
-                        ${CMAKE_THREAD_LIBS_INIT})
-
-  unset(CURL_IMPORTED_TARGET_NAME)
-
-  foreach(FIND_CURL_IMPORTED_TARGET CURL::libcurl CURL::libcurl_shared
-                                    CURL::libcurl_static)
-    if(TARGET ${FIND_CURL_IMPORTED_TARGET})
-      set(CURL_IMPORTED_TARGET_NAME ${FIND_CURL_IMPORTED_TARGET})
-      break()
-    endif()
-  endforeach()
-
-  if(TARGET ${CURL_IMPORTED_TARGET_NAME})
-    target_link_libraries(${FILENAME} opentelemetry_http_client_curl
-                          opentelemetry_common ${CURL_IMPORTED_TARGET_NAME})
-  else()
-    target_include_directories(${FILENAME} PRIVATE ${CURL_INCLUDE_DIRS})
-    target_link_libraries(${FILENAME} ${CURL_LIBRARIES}
-                          opentelemetry_http_client_curl opentelemetry_common)
-  endif()
-
+  target_link_libraries(
+    ${FILENAME}
+    PRIVATE ${GMOCK_LIB} ${GTEST_BOTH_LIBRARIES} opentelemetry_http_client_curl
+            opentelemetry_common CURL::libcurl)
   gtest_add_tests(
     TARGET ${FILENAME}
     TEST_PREFIX ext.http.curl.
diff --git a/deps/opentelemetry-cpp/ext/test/w3c_tracecontext_http_test_server/CMakeLists.txt b/deps/opentelemetry-cpp/ext/test/w3c_tracecontext_http_test_server/CMakeLists.txt
index 53e7a27ccf8..095da7ad80e 100644
--- a/deps/opentelemetry-cpp/ext/test/w3c_tracecontext_http_test_server/CMakeLists.txt
+++ b/deps/opentelemetry-cpp/ext/test/w3c_tracecontext_http_test_server/CMakeLists.txt
@@ -6,4 +6,4 @@ target_link_libraries(
   w3c_tracecontext_http_test_server
   PRIVATE ${CMAKE_THREAD_LIBS_INIT} opentelemetry_trace
           opentelemetry_http_client_curl opentelemetry_exporter_ostream_span
-          ${CURL_LIBRARIES} nlohmann_json::nlohmann_json)
+          CURL::libcurl nlohmann_json::nlohmann_json)
diff --git a/deps/opentelemetry-cpp/ext/test/w3c_tracecontext_http_test_server/main.cc b/deps/opentelemetry-cpp/ext/test/w3c_tracecontext_http_test_server/main.cc
index cb07ca84600..1ee3a2d5116 100644
--- a/deps/opentelemetry-cpp/ext/test/w3c_tracecontext_http_test_server/main.cc
+++ b/deps/opentelemetry-cpp/ext/test/w3c_tracecontext_http_test_server/main.cc
@@ -119,7 +119,7 @@ struct Uri
     size_t port_end = uri.substr(host_end + 1, std::string::npos).find('/');
 
     host = uri.substr(0, host_end + 7);
-    port = std::stoi(uri.substr(7 + host_end + 1, port_end));
+    port = static_cast<uint16_t>(std::stoi(uri.substr(7 + host_end + 1, port_end)));
     path = uri.substr(host_end + port_end + 2, std::string::npos);
   }
 };
@@ -185,7 +185,7 @@ int main(int argc, char *argv[])
   // The port the validation service listens to can be specified via the command line.
   if (argc > 1)
   {
-    port = atoi(argv[1]);
+    port = static_cast<uint16_t>(atoi(argv[1]));
   }
   else
   {
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/common/circular_buffer.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/common/circular_buffer.h
index a35498ecea0..943b250b1cf 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/common/circular_buffer.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/common/circular_buffer.h
@@ -181,7 +181,7 @@ class CircularBuffer
     {
       return {};
     }
-    auto data = data_.get();
+    AtomicUniquePtr<T> *data = data_.get();
     if (tail_index < head_index)
     {
       return CircularBufferRange<AtomicUniquePtr<T>>{nostd::span<AtomicUniquePtr<T>>{
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/common/custom_hash_equality.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/common/custom_hash_equality.h
new file mode 100644
index 00000000000..d1b5555b3a4
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/common/custom_hash_equality.h
@@ -0,0 +1,157 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <cstddef>
+#include <cstring>
+#include <string>
+
+#include "opentelemetry/nostd/string_view.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace common
+{
+/**
+ *
+ * FNV Hashing Utilities
+ *
+ * Implements FNV-1a hashing algorithm for 32-bit and 64-bit types.
+ *
+ * - FNV (Fowler–Noll–Vo) is a simple, fast, and widely used non-cryptographic hash.
+ * - FNV-1a is the recommended variant because it mixes input bits better.
+ * - We parameterize by type size (4 = 32-bit, 8 = 64-bit).
+ */
+
+// Forward declaration for FNV prime constants
+template <typename Ty, size_t Size>
+struct FnvPrime;
+
+// Specialization for 32-bit
+template <typename Ty>
+struct FnvPrime<Ty, 4>
+{
+  static constexpr Ty value = static_cast<Ty>(0x01000193U);
+};
+
+// Specialization for 64-bit
+template <typename Ty>
+struct FnvPrime<Ty, 8>
+{
+  static constexpr Ty value = static_cast<Ty>(0x100000001b3ULL);
+};
+
+// Forward declaration for FNV offset basis constants
+template <typename Ty, size_t Size>
+struct FnvOffset;
+
+// Specialization for 32-bit
+template <typename Ty>
+struct FnvOffset<Ty, 4>
+{
+  // 32-bit offset basis
+  static constexpr Ty value = static_cast<Ty>(0x811C9DC5U);
+
+  static constexpr Ty Fix(Ty hval) noexcept { return hval; }
+};
+
+// Specialization for 64-bit
+template <typename Ty>
+struct FnvOffset<Ty, 8>
+{
+  // 64-bit offset basis
+  static constexpr Ty value = static_cast<Ty>(0xCBF29CE484222325ULL);
+
+  // Fix function: mix upper and lower bits for better distribution
+  static constexpr Ty Fix(Ty hval) noexcept { return hval ^ (hval >> 32); }
+};
+
+/**
+ * FNV-1a hash function
+ *
+ * @tparam Ty  Hash integer type (std::size_t, uint32_t, uint64_t, etc.)
+ * @param buf  Pointer to the input buffer
+ * @param len  Length of the buffer
+ * @param hval Starting hash value (defaults to offset basis)
+ * @return     Computed hash
+ */
+template <typename Ty>
+inline Ty Fnv1a(const void *buf, size_t len, Ty hval = FnvOffset<Ty, sizeof(Ty)>::value) noexcept
+{
+  const unsigned char *bp = reinterpret_cast<const unsigned char *>(buf);
+  const unsigned char *be = bp + len;
+  Ty prime                = FnvPrime<Ty, sizeof(Ty)>::value;
+
+  while (bp < be)
+  {
+    hval ^= static_cast<Ty>(*bp++);
+    hval *= prime;
+  }
+  return FnvOffset<Ty, sizeof(Ty)>::Fix(hval);
+}
+
+/**
+ * Hash and equality for nostd::string_view, enabling safe use in unordered_map
+ * without requiring null termination.
+ */
+
+struct StringViewHash
+{
+#if defined(OPENTELEMETRY_STL_VERSION)
+#  if OPENTELEMETRY_STL_VERSION >= 2020
+  using is_transparent = void;
+#  endif
+#endif
+
+  std::size_t operator()(const std::string &s) const noexcept
+  {
+    return Fnv1a<std::size_t>(s.data(), s.size());
+  }
+
+  std::size_t operator()(opentelemetry::nostd::string_view sv) const noexcept
+  {
+    return Fnv1a<std::size_t>(sv.data(), sv.size());
+  }
+};
+
+struct StringViewEqual
+{
+#if defined(OPENTELEMETRY_STL_VERSION)
+#  if OPENTELEMETRY_STL_VERSION >= 2020
+  using is_transparent = void;
+#  endif
+#endif
+
+  template <typename Lhs, typename Rhs>
+  bool operator()(const Lhs &lhs, const Rhs &rhs) const noexcept
+  {
+    opentelemetry::nostd::string_view lsv(lhs);
+    opentelemetry::nostd::string_view rsv(rhs);
+
+    return lsv.size() == rsv.size() && std::memcmp(lsv.data(), rsv.data(), lsv.size()) == 0;
+  }
+};
+
+/**
+ * Cross-platform heterogeneous lookup wrapper.
+ * Falls back to std::string construction on libc++ (macOS) and pre-c++20,
+ * but uses direct lookup on libstdc++ (Linux).
+ */
+
+template <typename MapType>
+inline auto find_heterogeneous(MapType &&map, opentelemetry::nostd::string_view key)
+{
+#if defined(_LIBCPP_VERSION) || \
+    (!defined(OPENTELEMETRY_STL_VERSION) || OPENTELEMETRY_STL_VERSION < 2020)
+  return map.find(std::string(key));
+#else
+  // libstdc++ + C++20: heterogeneous lookup works
+  return map.find(key);
+#endif
+}
+}  // namespace common
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/configured_sdk.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/configured_sdk.h
new file mode 100644
index 00000000000..c2205a8be31
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/configured_sdk.h
@@ -0,0 +1,60 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/context/propagation/text_map_propagator.h"
+#include "opentelemetry/sdk/configuration/configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/logs/logger_provider.h"
+#include "opentelemetry/sdk/metrics/meter_provider.h"
+#include "opentelemetry/sdk/resource/resource.h"
+#include "opentelemetry/sdk/trace/tracer_provider.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+/**
+ * This class represents a fully configured SDK.
+ * A SDK contains various objects, like propagators and providers for each
+ * signals, that collectively describe the opentelemetry configuration.
+ */
+class ConfiguredSdk
+{
+public:
+  static std::unique_ptr<ConfiguredSdk> Create(
+      std::shared_ptr<Registry> registry,
+      const std::unique_ptr<opentelemetry::sdk::configuration::Configuration> &model);
+
+  ConfiguredSdk() : resource(opentelemetry::sdk::resource::Resource::GetEmpty()) {}
+
+  /**
+   * Install the SDK, so that an instrumented application can make calls
+   * to it.
+   * This methods sets the global provider singletons to point to the SDK.
+   */
+  void Install();
+
+  /**
+   * Uninstall the SDK, so that an instrumented application no longer makes
+   * calls to it.
+   * This method clears the global provider singletons.
+   */
+  void UnInstall();
+
+  opentelemetry::sdk::resource::Resource resource;
+  std::shared_ptr<opentelemetry::sdk::trace::TracerProvider> tracer_provider;
+  std::shared_ptr<opentelemetry::context::propagation::TextMapPropagator> propagator;
+  std::shared_ptr<opentelemetry::sdk::metrics::MeterProvider> meter_provider;
+  std::shared_ptr<opentelemetry::sdk::logs::LoggerProvider> logger_provider;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/console_log_record_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/console_log_record_exporter_builder.h
new file mode 100644
index 00000000000..29d99bec5c4
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/console_log_record_exporter_builder.h
@@ -0,0 +1,36 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/console_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class ConsoleLogRecordExporterBuilder
+{
+public:
+  ConsoleLogRecordExporterBuilder()                                              = default;
+  ConsoleLogRecordExporterBuilder(ConsoleLogRecordExporterBuilder &&)            = default;
+  ConsoleLogRecordExporterBuilder(const ConsoleLogRecordExporterBuilder &)       = default;
+  ConsoleLogRecordExporterBuilder &operator=(ConsoleLogRecordExporterBuilder &&) = default;
+  ConsoleLogRecordExporterBuilder &operator=(const ConsoleLogRecordExporterBuilder &other) =
+      default;
+  virtual ~ConsoleLogRecordExporterBuilder() = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> Build(
+      const opentelemetry::sdk::configuration::ConsoleLogRecordExporterConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/console_push_metric_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/console_push_metric_exporter_builder.h
new file mode 100644
index 00000000000..0fe0725aa72
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/console_push_metric_exporter_builder.h
@@ -0,0 +1,36 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/console_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class ConsolePushMetricExporterBuilder
+{
+public:
+  ConsolePushMetricExporterBuilder()                                               = default;
+  ConsolePushMetricExporterBuilder(ConsolePushMetricExporterBuilder &&)            = default;
+  ConsolePushMetricExporterBuilder(const ConsolePushMetricExporterBuilder &)       = default;
+  ConsolePushMetricExporterBuilder &operator=(ConsolePushMetricExporterBuilder &&) = default;
+  ConsolePushMetricExporterBuilder &operator=(const ConsolePushMetricExporterBuilder &other) =
+      default;
+  virtual ~ConsolePushMetricExporterBuilder() = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> Build(
+      const opentelemetry::sdk::configuration::ConsolePushMetricExporterConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/console_span_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/console_span_exporter_builder.h
new file mode 100644
index 00000000000..0db9ba9e5b9
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/console_span_exporter_builder.h
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/console_span_exporter_configuration.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class ConsoleSpanExporterBuilder
+{
+public:
+  ConsoleSpanExporterBuilder()                                                   = default;
+  ConsoleSpanExporterBuilder(ConsoleSpanExporterBuilder &&)                      = default;
+  ConsoleSpanExporterBuilder(const ConsoleSpanExporterBuilder &)                 = default;
+  ConsoleSpanExporterBuilder &operator=(ConsoleSpanExporterBuilder &&)           = default;
+  ConsoleSpanExporterBuilder &operator=(const ConsoleSpanExporterBuilder &other) = default;
+  virtual ~ConsoleSpanExporterBuilder()                                          = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> Build(
+      const opentelemetry::sdk::configuration::ConsoleSpanExporterConfiguration *model) const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_log_record_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_log_record_exporter_builder.h
new file mode 100644
index 00000000000..e9a7c102cb8
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_log_record_exporter_builder.h
@@ -0,0 +1,36 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/extension_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class ExtensionLogRecordExporterBuilder
+{
+public:
+  ExtensionLogRecordExporterBuilder()                                                = default;
+  ExtensionLogRecordExporterBuilder(ExtensionLogRecordExporterBuilder &&)            = default;
+  ExtensionLogRecordExporterBuilder(const ExtensionLogRecordExporterBuilder &)       = default;
+  ExtensionLogRecordExporterBuilder &operator=(ExtensionLogRecordExporterBuilder &&) = default;
+  ExtensionLogRecordExporterBuilder &operator=(const ExtensionLogRecordExporterBuilder &other) =
+      default;
+  virtual ~ExtensionLogRecordExporterBuilder() = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> Build(
+      const opentelemetry::sdk::configuration::ExtensionLogRecordExporterConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_log_record_processor_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_log_record_processor_builder.h
new file mode 100644
index 00000000000..51d21fd0107
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_log_record_processor_builder.h
@@ -0,0 +1,36 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/extension_log_record_processor_configuration.h"
+#include "opentelemetry/sdk/logs/processor.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class ExtensionLogRecordProcessorBuilder
+{
+public:
+  ExtensionLogRecordProcessorBuilder()                                                 = default;
+  ExtensionLogRecordProcessorBuilder(ExtensionLogRecordProcessorBuilder &&)            = default;
+  ExtensionLogRecordProcessorBuilder(const ExtensionLogRecordProcessorBuilder &)       = default;
+  ExtensionLogRecordProcessorBuilder &operator=(ExtensionLogRecordProcessorBuilder &&) = default;
+  ExtensionLogRecordProcessorBuilder &operator=(const ExtensionLogRecordProcessorBuilder &other) =
+      default;
+  virtual ~ExtensionLogRecordProcessorBuilder() = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor> Build(
+      const opentelemetry::sdk::configuration::ExtensionLogRecordProcessorConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_metric_producer_configuration.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_metric_producer_configuration.h
new file mode 100644
index 00000000000..f715e12f065
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_metric_producer_configuration.h
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+#include <string>
+
+#include "opentelemetry/sdk/configuration/document_node.h"
+#include "opentelemetry/sdk/configuration/metric_producer_configuration.h"
+#include "opentelemetry/sdk/configuration/metric_producer_configuration_visitor.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class ExtensionMetricProducerConfiguration : public MetricProducerConfiguration
+{
+public:
+  void Accept(MetricProducerConfigurationVisitor *visitor) const override
+  {
+    visitor->VisitExtension(this);
+  }
+
+  std::string name;
+  std::unique_ptr<DocumentNode> node;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_pull_metric_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_pull_metric_exporter_builder.h
new file mode 100644
index 00000000000..fc621c2b780
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_pull_metric_exporter_builder.h
@@ -0,0 +1,36 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/extension_pull_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/metrics/metric_reader.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class ExtensionPullMetricExporterBuilder
+{
+public:
+  ExtensionPullMetricExporterBuilder()                                                 = default;
+  ExtensionPullMetricExporterBuilder(ExtensionPullMetricExporterBuilder &&)            = default;
+  ExtensionPullMetricExporterBuilder(const ExtensionPullMetricExporterBuilder &)       = default;
+  ExtensionPullMetricExporterBuilder &operator=(ExtensionPullMetricExporterBuilder &&) = default;
+  ExtensionPullMetricExporterBuilder &operator=(const ExtensionPullMetricExporterBuilder &other) =
+      default;
+  virtual ~ExtensionPullMetricExporterBuilder() = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> Build(
+      const opentelemetry::sdk::configuration::ExtensionPullMetricExporterConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_push_metric_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_push_metric_exporter_builder.h
new file mode 100644
index 00000000000..b3eacfc770c
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_push_metric_exporter_builder.h
@@ -0,0 +1,36 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/extension_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class ExtensionPushMetricExporterBuilder
+{
+public:
+  ExtensionPushMetricExporterBuilder()                                                 = default;
+  ExtensionPushMetricExporterBuilder(ExtensionPushMetricExporterBuilder &&)            = default;
+  ExtensionPushMetricExporterBuilder(const ExtensionPushMetricExporterBuilder &)       = default;
+  ExtensionPushMetricExporterBuilder &operator=(ExtensionPushMetricExporterBuilder &&) = default;
+  ExtensionPushMetricExporterBuilder &operator=(const ExtensionPushMetricExporterBuilder &other) =
+      default;
+  virtual ~ExtensionPushMetricExporterBuilder() = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> Build(
+      const opentelemetry::sdk::configuration::ExtensionPushMetricExporterConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_sampler_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_sampler_builder.h
new file mode 100644
index 00000000000..3ac5d7263b2
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_sampler_builder.h
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/extension_sampler_configuration.h"
+#include "opentelemetry/sdk/trace/sampler.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class ExtensionSamplerBuilder
+{
+public:
+  ExtensionSamplerBuilder()                                                = default;
+  ExtensionSamplerBuilder(ExtensionSamplerBuilder &&)                      = default;
+  ExtensionSamplerBuilder(const ExtensionSamplerBuilder &)                 = default;
+  ExtensionSamplerBuilder &operator=(ExtensionSamplerBuilder &&)           = default;
+  ExtensionSamplerBuilder &operator=(const ExtensionSamplerBuilder &other) = default;
+  virtual ~ExtensionSamplerBuilder()                                       = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::trace::Sampler> Build(
+      const opentelemetry::sdk::configuration::ExtensionSamplerConfiguration *model) const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_span_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_span_exporter_builder.h
new file mode 100644
index 00000000000..50a5ac12d7a
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_span_exporter_builder.h
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/extension_span_exporter_configuration.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class ExtensionSpanExporterBuilder
+{
+public:
+  ExtensionSpanExporterBuilder()                                                     = default;
+  ExtensionSpanExporterBuilder(ExtensionSpanExporterBuilder &&)                      = default;
+  ExtensionSpanExporterBuilder(const ExtensionSpanExporterBuilder &)                 = default;
+  ExtensionSpanExporterBuilder &operator=(ExtensionSpanExporterBuilder &&)           = default;
+  ExtensionSpanExporterBuilder &operator=(const ExtensionSpanExporterBuilder &other) = default;
+  virtual ~ExtensionSpanExporterBuilder()                                            = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> Build(
+      const opentelemetry::sdk::configuration::ExtensionSpanExporterConfiguration *model) const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_span_processor_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_span_processor_builder.h
new file mode 100644
index 00000000000..86732e78171
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/extension_span_processor_builder.h
@@ -0,0 +1,35 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/extension_span_processor_configuration.h"
+#include "opentelemetry/sdk/trace/processor.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class ExtensionSpanProcessorBuilder
+{
+public:
+  ExtensionSpanProcessorBuilder()                                                      = default;
+  ExtensionSpanProcessorBuilder(ExtensionSpanProcessorBuilder &&)                      = default;
+  ExtensionSpanProcessorBuilder(const ExtensionSpanProcessorBuilder &)                 = default;
+  ExtensionSpanProcessorBuilder &operator=(ExtensionSpanProcessorBuilder &&)           = default;
+  ExtensionSpanProcessorBuilder &operator=(const ExtensionSpanProcessorBuilder &other) = default;
+  virtual ~ExtensionSpanProcessorBuilder()                                             = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> Build(
+      const opentelemetry::sdk::configuration::ExtensionSpanProcessorConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/metric_producer_configuration_visitor.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/metric_producer_configuration_visitor.h
new file mode 100644
index 00000000000..73340f31664
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/metric_producer_configuration_visitor.h
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class OpenCensusMetricProducerConfiguration;
+class ExtensionMetricProducerConfiguration;
+
+class MetricProducerConfigurationVisitor
+{
+public:
+  MetricProducerConfigurationVisitor()                                                 = default;
+  MetricProducerConfigurationVisitor(MetricProducerConfigurationVisitor &&)            = default;
+  MetricProducerConfigurationVisitor(const MetricProducerConfigurationVisitor &)       = default;
+  MetricProducerConfigurationVisitor &operator=(MetricProducerConfigurationVisitor &&) = default;
+  MetricProducerConfigurationVisitor &operator=(const MetricProducerConfigurationVisitor &other) =
+      default;
+  virtual ~MetricProducerConfigurationVisitor() = default;
+
+  virtual void VisitOpenCensus(const OpenCensusMetricProducerConfiguration *model) = 0;
+  virtual void VisitExtension(const ExtensionMetricProducerConfiguration *model)   = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/open_census_metric_producer_configuration.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/open_census_metric_producer_configuration.h
new file mode 100644
index 00000000000..b8b7eb6b663
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/open_census_metric_producer_configuration.h
@@ -0,0 +1,31 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <string>
+
+#include "opentelemetry/sdk/configuration/metric_producer_configuration.h"
+#include "opentelemetry/sdk/configuration/metric_producer_configuration_visitor.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+// YAML-SCHEMA: schema/meter_provider.json
+// YAML-NODE: OpenCensusMetricProducer
+class OpenCensusMetricProducerConfiguration : public MetricProducerConfiguration
+{
+public:
+  void Accept(MetricProducerConfigurationVisitor *visitor) const override
+  {
+    visitor->VisitOpenCensus(this);
+  }
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_file_log_record_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_file_log_record_exporter_builder.h
new file mode 100644
index 00000000000..c7be2657ccf
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_file_log_record_exporter_builder.h
@@ -0,0 +1,36 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_file_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class OtlpFileLogRecordExporterBuilder
+{
+public:
+  OtlpFileLogRecordExporterBuilder()                                               = default;
+  OtlpFileLogRecordExporterBuilder(OtlpFileLogRecordExporterBuilder &&)            = default;
+  OtlpFileLogRecordExporterBuilder(const OtlpFileLogRecordExporterBuilder &)       = default;
+  OtlpFileLogRecordExporterBuilder &operator=(OtlpFileLogRecordExporterBuilder &&) = default;
+  OtlpFileLogRecordExporterBuilder &operator=(const OtlpFileLogRecordExporterBuilder &other) =
+      default;
+  virtual ~OtlpFileLogRecordExporterBuilder() = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpFileLogRecordExporterConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_file_push_metric_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_file_push_metric_exporter_builder.h
new file mode 100644
index 00000000000..79d60f1ca48
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_file_push_metric_exporter_builder.h
@@ -0,0 +1,37 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_file_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class OtlpFilePushMetricExporterBuilder
+{
+public:
+  OtlpFilePushMetricExporterBuilder()                                                = default;
+  OtlpFilePushMetricExporterBuilder(OtlpFilePushMetricExporterBuilder &&)            = default;
+  OtlpFilePushMetricExporterBuilder(const OtlpFilePushMetricExporterBuilder &)       = default;
+  OtlpFilePushMetricExporterBuilder &operator=(OtlpFilePushMetricExporterBuilder &&) = default;
+  OtlpFilePushMetricExporterBuilder &operator=(const OtlpFilePushMetricExporterBuilder &other) =
+      default;
+  virtual ~OtlpFilePushMetricExporterBuilder() = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpFilePushMetricExporterConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_file_span_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_file_span_exporter_builder.h
new file mode 100644
index 00000000000..c2bec566dfe
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_file_span_exporter_builder.h
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_file_span_exporter_configuration.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class OtlpFileSpanExporterBuilder
+{
+public:
+  OtlpFileSpanExporterBuilder()                                                    = default;
+  OtlpFileSpanExporterBuilder(OtlpFileSpanExporterBuilder &&)                      = default;
+  OtlpFileSpanExporterBuilder(const OtlpFileSpanExporterBuilder &)                 = default;
+  OtlpFileSpanExporterBuilder &operator=(OtlpFileSpanExporterBuilder &&)           = default;
+  OtlpFileSpanExporterBuilder &operator=(const OtlpFileSpanExporterBuilder &other) = default;
+  virtual ~OtlpFileSpanExporterBuilder()                                           = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpFileSpanExporterConfiguration *model) const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_grpc_log_record_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_grpc_log_record_exporter_builder.h
new file mode 100644
index 00000000000..e560e6bc7da
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_grpc_log_record_exporter_builder.h
@@ -0,0 +1,36 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_grpc_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class OtlpGrpcLogRecordExporterBuilder
+{
+public:
+  OtlpGrpcLogRecordExporterBuilder()                                               = default;
+  OtlpGrpcLogRecordExporterBuilder(OtlpGrpcLogRecordExporterBuilder &&)            = default;
+  OtlpGrpcLogRecordExporterBuilder(const OtlpGrpcLogRecordExporterBuilder &)       = default;
+  OtlpGrpcLogRecordExporterBuilder &operator=(OtlpGrpcLogRecordExporterBuilder &&) = default;
+  OtlpGrpcLogRecordExporterBuilder &operator=(const OtlpGrpcLogRecordExporterBuilder &other) =
+      default;
+  virtual ~OtlpGrpcLogRecordExporterBuilder() = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpGrpcLogRecordExporterConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_grpc_push_metric_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_grpc_push_metric_exporter_builder.h
new file mode 100644
index 00000000000..61adf7c0892
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_grpc_push_metric_exporter_builder.h
@@ -0,0 +1,37 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_grpc_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class OtlpGrpcPushMetricExporterBuilder
+{
+public:
+  OtlpGrpcPushMetricExporterBuilder()                                                = default;
+  OtlpGrpcPushMetricExporterBuilder(OtlpGrpcPushMetricExporterBuilder &&)            = default;
+  OtlpGrpcPushMetricExporterBuilder(const OtlpGrpcPushMetricExporterBuilder &)       = default;
+  OtlpGrpcPushMetricExporterBuilder &operator=(OtlpGrpcPushMetricExporterBuilder &&) = default;
+  OtlpGrpcPushMetricExporterBuilder &operator=(const OtlpGrpcPushMetricExporterBuilder &other) =
+      default;
+  virtual ~OtlpGrpcPushMetricExporterBuilder() = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpGrpcPushMetricExporterConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_grpc_span_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_grpc_span_exporter_builder.h
new file mode 100644
index 00000000000..79550ee830f
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_grpc_span_exporter_builder.h
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_grpc_span_exporter_configuration.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class OtlpGrpcSpanExporterBuilder
+{
+public:
+  OtlpGrpcSpanExporterBuilder()                                                    = default;
+  OtlpGrpcSpanExporterBuilder(OtlpGrpcSpanExporterBuilder &&)                      = default;
+  OtlpGrpcSpanExporterBuilder(const OtlpGrpcSpanExporterBuilder &)                 = default;
+  OtlpGrpcSpanExporterBuilder &operator=(OtlpGrpcSpanExporterBuilder &&)           = default;
+  OtlpGrpcSpanExporterBuilder &operator=(const OtlpGrpcSpanExporterBuilder &other) = default;
+  virtual ~OtlpGrpcSpanExporterBuilder()                                           = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpGrpcSpanExporterConfiguration *model) const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_http_log_record_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_http_log_record_exporter_builder.h
new file mode 100644
index 00000000000..a8d1313da42
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_http_log_record_exporter_builder.h
@@ -0,0 +1,36 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_http_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class OtlpHttpLogRecordExporterBuilder
+{
+public:
+  OtlpHttpLogRecordExporterBuilder()                                               = default;
+  OtlpHttpLogRecordExporterBuilder(OtlpHttpLogRecordExporterBuilder &&)            = default;
+  OtlpHttpLogRecordExporterBuilder(const OtlpHttpLogRecordExporterBuilder &)       = default;
+  OtlpHttpLogRecordExporterBuilder &operator=(OtlpHttpLogRecordExporterBuilder &&) = default;
+  OtlpHttpLogRecordExporterBuilder &operator=(const OtlpHttpLogRecordExporterBuilder &other) =
+      default;
+  virtual ~OtlpHttpLogRecordExporterBuilder() = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpHttpLogRecordExporterConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_http_push_metric_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_http_push_metric_exporter_builder.h
new file mode 100644
index 00000000000..c407eca52c1
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_http_push_metric_exporter_builder.h
@@ -0,0 +1,37 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_http_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class OtlpHttpPushMetricExporterBuilder
+{
+public:
+  OtlpHttpPushMetricExporterBuilder()                                                = default;
+  OtlpHttpPushMetricExporterBuilder(OtlpHttpPushMetricExporterBuilder &&)            = default;
+  OtlpHttpPushMetricExporterBuilder(const OtlpHttpPushMetricExporterBuilder &)       = default;
+  OtlpHttpPushMetricExporterBuilder &operator=(OtlpHttpPushMetricExporterBuilder &&) = default;
+  OtlpHttpPushMetricExporterBuilder &operator=(const OtlpHttpPushMetricExporterBuilder &other) =
+      default;
+  virtual ~OtlpHttpPushMetricExporterBuilder() = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpHttpPushMetricExporterConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_http_span_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_http_span_exporter_builder.h
new file mode 100644
index 00000000000..8dda6f2b9e7
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/otlp_http_span_exporter_builder.h
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/otlp_http_span_exporter_configuration.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class OtlpHttpSpanExporterBuilder
+{
+public:
+  OtlpHttpSpanExporterBuilder()                                                    = default;
+  OtlpHttpSpanExporterBuilder(OtlpHttpSpanExporterBuilder &&)                      = default;
+  OtlpHttpSpanExporterBuilder(const OtlpHttpSpanExporterBuilder &)                 = default;
+  OtlpHttpSpanExporterBuilder &operator=(OtlpHttpSpanExporterBuilder &&)           = default;
+  OtlpHttpSpanExporterBuilder &operator=(const OtlpHttpSpanExporterBuilder &other) = default;
+  virtual ~OtlpHttpSpanExporterBuilder()                                           = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> Build(
+      const opentelemetry::sdk::configuration::OtlpHttpSpanExporterConfiguration *model) const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/prometheus_pull_metric_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/prometheus_pull_metric_exporter_builder.h
new file mode 100644
index 00000000000..4a4496dc490
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/prometheus_pull_metric_exporter_builder.h
@@ -0,0 +1,36 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/prometheus_pull_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/metrics/metric_reader.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class PrometheusPullMetricExporterBuilder
+{
+public:
+  PrometheusPullMetricExporterBuilder()                                                  = default;
+  PrometheusPullMetricExporterBuilder(PrometheusPullMetricExporterBuilder &&)            = default;
+  PrometheusPullMetricExporterBuilder(const PrometheusPullMetricExporterBuilder &)       = default;
+  PrometheusPullMetricExporterBuilder &operator=(PrometheusPullMetricExporterBuilder &&) = default;
+  PrometheusPullMetricExporterBuilder &operator=(const PrometheusPullMetricExporterBuilder &other) =
+      default;
+  virtual ~PrometheusPullMetricExporterBuilder() = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> Build(
+      const opentelemetry::sdk::configuration::PrometheusPullMetricExporterConfiguration *model)
+      const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/propagator_configuration.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/propagator_configuration.h
index cd1f7693d07..b2f6e476aed 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/propagator_configuration.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/propagator_configuration.h
@@ -20,6 +20,7 @@ class PropagatorConfiguration
 {
 public:
   std::vector<std::string> composite;
+  std::string composite_list;
 };
 
 }  // namespace configuration
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/registry.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/registry.h
new file mode 100644
index 00000000000..81d38d2ef65
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/registry.h
@@ -0,0 +1,283 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <map>
+#include <string>
+
+#include "opentelemetry/sdk/configuration/console_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/console_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/console_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/extension_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/extension_log_record_processor_builder.h"
+#include "opentelemetry/sdk/configuration/extension_pull_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/extension_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/extension_sampler_builder.h"
+#include "opentelemetry/sdk/configuration/extension_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/extension_span_processor_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/prometheus_pull_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/text_map_propagator_builder.h"
+#include "opentelemetry/sdk/configuration/zipkin_span_exporter_builder.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class Registry
+{
+public:
+  Registry();
+  Registry(Registry &&)                      = delete;
+  Registry(const Registry &)                 = delete;
+  Registry &operator=(Registry &&)           = delete;
+  Registry &operator=(const Registry &other) = delete;
+
+  ~Registry() = default;
+
+  /* Core optional components. */
+
+  const OtlpHttpSpanExporterBuilder *GetOtlpHttpSpanBuilder() const
+  {
+    return otlp_http_span_builder_.get();
+  }
+
+  void SetOtlpHttpSpanBuilder(std::unique_ptr<OtlpHttpSpanExporterBuilder> &&builder)
+  {
+    otlp_http_span_builder_ = std::move(builder);
+  }
+
+  const OtlpGrpcSpanExporterBuilder *GetOtlpGrpcSpanBuilder() const
+  {
+    return otlp_grpc_span_builder_.get();
+  }
+
+  void SetOtlpGrpcSpanBuilder(std::unique_ptr<OtlpGrpcSpanExporterBuilder> &&builder)
+  {
+    otlp_grpc_span_builder_ = std::move(builder);
+  }
+
+  const OtlpFileSpanExporterBuilder *GetOtlpFileSpanBuilder() const
+  {
+    return otlp_file_span_builder_.get();
+  }
+
+  void SetOtlpFileSpanBuilder(std::unique_ptr<OtlpFileSpanExporterBuilder> &&builder)
+  {
+    otlp_file_span_builder_ = std::move(builder);
+  }
+
+  const ConsoleSpanExporterBuilder *GetConsoleSpanBuilder() const
+  {
+    return console_span_builder_.get();
+  }
+
+  void SetConsoleSpanBuilder(std::unique_ptr<ConsoleSpanExporterBuilder> &&builder)
+  {
+    console_span_builder_ = std::move(builder);
+  }
+
+  const ZipkinSpanExporterBuilder *GetZipkinSpanBuilder() const
+  {
+    return zipkin_span_builder_.get();
+  }
+
+  void SetZipkinSpanBuilder(std::unique_ptr<ZipkinSpanExporterBuilder> &&builder)
+  {
+    zipkin_span_builder_ = std::move(builder);
+  }
+
+  const OtlpHttpPushMetricExporterBuilder *GetOtlpHttpPushMetricExporterBuilder() const
+  {
+    return otlp_http_push_metric_builder_.get();
+  }
+
+  void SetOtlpHttpPushMetricExporterBuilder(
+      std::unique_ptr<OtlpHttpPushMetricExporterBuilder> &&builder)
+  {
+    otlp_http_push_metric_builder_ = std::move(builder);
+  }
+
+  const OtlpGrpcPushMetricExporterBuilder *GetOtlpGrpcPushMetricExporterBuilder() const
+  {
+    return otlp_grpc_push_metric_builder_.get();
+  }
+
+  void SetOtlpGrpcPushMetricExporterBuilder(
+      std::unique_ptr<OtlpGrpcPushMetricExporterBuilder> &&builder)
+  {
+    otlp_grpc_push_metric_builder_ = std::move(builder);
+  }
+
+  const OtlpFilePushMetricExporterBuilder *GetOtlpFilePushMetricExporterBuilder() const
+  {
+    return otlp_file_push_metric_builder_.get();
+  }
+
+  void SetOtlpFilePushMetricExporterBuilder(
+      std::unique_ptr<OtlpFilePushMetricExporterBuilder> &&builder)
+  {
+    otlp_file_push_metric_builder_ = std::move(builder);
+  }
+
+  const ConsolePushMetricExporterBuilder *GetConsolePushMetricExporterBuilder() const
+  {
+    return console_metric_builder_.get();
+  }
+
+  void SetConsolePushMetricExporterBuilder(
+      std::unique_ptr<ConsolePushMetricExporterBuilder> &&builder)
+  {
+    console_metric_builder_ = std::move(builder);
+  }
+
+  const PrometheusPullMetricExporterBuilder *GetPrometheusPullMetricExporterBuilder() const
+  {
+    return prometheus_metric_builder_.get();
+  }
+
+  void SetPrometheusPullMetricExporterBuilder(
+      std::unique_ptr<PrometheusPullMetricExporterBuilder> &&builder)
+  {
+    prometheus_metric_builder_ = std::move(builder);
+  }
+
+  const OtlpHttpLogRecordExporterBuilder *GetOtlpHttpLogRecordBuilder() const
+  {
+    return otlp_http_log_record_builder_.get();
+  }
+
+  void SetOtlpHttpLogRecordBuilder(std::unique_ptr<OtlpHttpLogRecordExporterBuilder> &&builder)
+  {
+    otlp_http_log_record_builder_ = std::move(builder);
+  }
+
+  const OtlpGrpcLogRecordExporterBuilder *GetOtlpGrpcLogRecordBuilder() const
+  {
+    return otlp_grpc_log_record_builder_.get();
+  }
+
+  void SetOtlpGrpcLogRecordBuilder(std::unique_ptr<OtlpGrpcLogRecordExporterBuilder> &&builder)
+  {
+    otlp_grpc_log_record_builder_ = std::move(builder);
+  }
+
+  const OtlpFileLogRecordExporterBuilder *GetOtlpFileLogRecordBuilder() const
+  {
+    return otlp_file_log_record_builder_.get();
+  }
+
+  void SetOtlpFileLogRecordBuilder(std::unique_ptr<OtlpFileLogRecordExporterBuilder> &&builder)
+  {
+    otlp_file_log_record_builder_ = std::move(builder);
+  }
+
+  const ConsoleLogRecordExporterBuilder *GetConsoleLogRecordBuilder() const
+  {
+    return console_log_record_builder_.get();
+  }
+
+  void SetConsoleLogRecordBuilder(std::unique_ptr<ConsoleLogRecordExporterBuilder> &&builder)
+  {
+    console_log_record_builder_ = std::move(builder);
+  }
+
+  /* Extension points */
+
+  const TextMapPropagatorBuilder *GetTextMapPropagatorBuilder(const std::string &name) const;
+
+  void SetTextMapPropagatorBuilder(const std::string &name,
+                                   std::unique_ptr<TextMapPropagatorBuilder> &&builder);
+
+  const ExtensionSamplerBuilder *GetExtensionSamplerBuilder(const std::string &name) const;
+
+  void SetExtensionSamplerBuilder(const std::string &name,
+                                  std::unique_ptr<ExtensionSamplerBuilder> &&builder);
+
+  const ExtensionSpanExporterBuilder *GetExtensionSpanExporterBuilder(
+      const std::string &name) const;
+
+  void SetExtensionSpanExporterBuilder(const std::string &name,
+                                       std::unique_ptr<ExtensionSpanExporterBuilder> &&builder);
+
+  const ExtensionSpanProcessorBuilder *GetExtensionSpanProcessorBuilder(
+      const std::string &name) const;
+
+  void SetExtensionSpanProcessorBuilder(const std::string &name,
+                                        std::unique_ptr<ExtensionSpanProcessorBuilder> &&builder);
+
+  const ExtensionPushMetricExporterBuilder *GetExtensionPushMetricExporterBuilder(
+      const std::string &name) const;
+
+  void SetExtensionPushMetricExporterBuilder(
+      const std::string &name,
+      std::unique_ptr<ExtensionPushMetricExporterBuilder> &&builder);
+
+  const ExtensionPullMetricExporterBuilder *GetExtensionPullMetricExporterBuilder(
+      const std::string &name) const;
+
+  void SetExtensionPullMetricExporterBuilder(
+      const std::string &name,
+      std::unique_ptr<ExtensionPullMetricExporterBuilder> &&builder);
+
+  const ExtensionLogRecordExporterBuilder *GetExtensionLogRecordExporterBuilder(
+      const std::string &name) const;
+
+  void SetExtensionLogRecordExporterBuilder(
+      const std::string &name,
+      std::unique_ptr<ExtensionLogRecordExporterBuilder> &&builder);
+
+  const ExtensionLogRecordProcessorBuilder *GetExtensionLogRecordProcessorBuilder(
+      const std::string &name) const;
+
+  void SetExtensionLogRecordProcessorBuilder(
+      const std::string &name,
+      std::unique_ptr<ExtensionLogRecordProcessorBuilder> &&builder);
+
+private:
+  std::unique_ptr<OtlpHttpSpanExporterBuilder> otlp_http_span_builder_;
+  std::unique_ptr<OtlpGrpcSpanExporterBuilder> otlp_grpc_span_builder_;
+  std::unique_ptr<OtlpFileSpanExporterBuilder> otlp_file_span_builder_;
+  std::unique_ptr<ConsoleSpanExporterBuilder> console_span_builder_;
+  std::unique_ptr<ZipkinSpanExporterBuilder> zipkin_span_builder_;
+
+  std::unique_ptr<OtlpHttpPushMetricExporterBuilder> otlp_http_push_metric_builder_;
+  std::unique_ptr<OtlpGrpcPushMetricExporterBuilder> otlp_grpc_push_metric_builder_;
+  std::unique_ptr<OtlpFilePushMetricExporterBuilder> otlp_file_push_metric_builder_;
+  std::unique_ptr<ConsolePushMetricExporterBuilder> console_metric_builder_;
+  std::unique_ptr<PrometheusPullMetricExporterBuilder> prometheus_metric_builder_;
+
+  std::unique_ptr<OtlpHttpLogRecordExporterBuilder> otlp_http_log_record_builder_;
+  std::unique_ptr<OtlpGrpcLogRecordExporterBuilder> otlp_grpc_log_record_builder_;
+  std::unique_ptr<OtlpFileLogRecordExporterBuilder> otlp_file_log_record_builder_;
+  std::unique_ptr<ConsoleLogRecordExporterBuilder> console_log_record_builder_;
+
+  std::map<std::string, std::unique_ptr<TextMapPropagatorBuilder>> propagator_builders_;
+  std::map<std::string, std::unique_ptr<ExtensionSamplerBuilder>> sampler_builders_;
+  std::map<std::string, std::unique_ptr<ExtensionSpanExporterBuilder>> span_exporter_builders_;
+  std::map<std::string, std::unique_ptr<ExtensionSpanProcessorBuilder>> span_processor_builders_;
+  std::map<std::string, std::unique_ptr<ExtensionPushMetricExporterBuilder>>
+      push_metric_exporter_builders_;
+  std::map<std::string, std::unique_ptr<ExtensionPullMetricExporterBuilder>>
+      pull_metric_exporter_builders_;
+  std::map<std::string, std::unique_ptr<ExtensionLogRecordExporterBuilder>>
+      log_record_exporter_builders_;
+  std::map<std::string, std::unique_ptr<ExtensionLogRecordProcessorBuilder>>
+      log_record_processor_builders_;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/sdk_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/sdk_builder.h
new file mode 100644
index 00000000000..9f31ba68e01
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/sdk_builder.h
@@ -0,0 +1,271 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/always_off_sampler_configuration.h"
+#include "opentelemetry/sdk/configuration/base2_exponential_bucket_histogram_aggregation_configuration.h"
+#include "opentelemetry/sdk/configuration/batch_log_record_processor_configuration.h"
+#include "opentelemetry/sdk/configuration/batch_span_processor_configuration.h"
+#include "opentelemetry/sdk/configuration/boolean_array_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/boolean_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/configuration.h"
+#include "opentelemetry/sdk/configuration/configured_sdk.h"
+#include "opentelemetry/sdk/configuration/console_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/console_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/double_array_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/double_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/explicit_bucket_histogram_aggregation_configuration.h"
+#include "opentelemetry/sdk/configuration/extension_pull_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/extension_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/extension_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/extension_span_processor_configuration.h"
+#include "opentelemetry/sdk/configuration/integer_array_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/integer_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/metric_reader_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_file_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_file_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_file_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_http_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_http_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_http_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/periodic_metric_reader_configuration.h"
+#include "opentelemetry/sdk/configuration/prometheus_pull_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/pull_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/pull_metric_reader_configuration.h"
+#include "opentelemetry/sdk/configuration/push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/configuration/simple_span_processor_configuration.h"
+#include "opentelemetry/sdk/configuration/span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/string_array_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/string_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/zipkin_span_exporter_configuration.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/sdk/logs/logger_provider.h"
+#include "opentelemetry/sdk/metrics/export/periodic_exporting_metric_reader.h"
+#include "opentelemetry/sdk/metrics/meter_provider.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/sdk/trace/processor.h"
+#include "opentelemetry/sdk/trace/sampler.h"
+#include "opentelemetry/sdk/trace/tracer_provider.h"
+#include "opentelemetry/trace/tracer_provider.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class SdkBuilder
+{
+public:
+  SdkBuilder(std::shared_ptr<Registry> registry) : registry_(std::move(registry)) {}
+  SdkBuilder(SdkBuilder &&)                      = default;
+  SdkBuilder(const SdkBuilder &)                 = default;
+  SdkBuilder &operator=(SdkBuilder &&)           = default;
+  SdkBuilder &operator=(const SdkBuilder &other) = default;
+  ~SdkBuilder()                                  = default;
+
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> CreateAlwaysOffSampler(
+      const opentelemetry::sdk::configuration::AlwaysOffSamplerConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> CreateAlwaysOnSampler(
+      const opentelemetry::sdk::configuration::AlwaysOnSamplerConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> CreateJaegerRemoteSampler(
+      const opentelemetry::sdk::configuration::JaegerRemoteSamplerConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> CreateParentBasedSampler(
+      const opentelemetry::sdk::configuration::ParentBasedSamplerConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> CreateTraceIdRatioBasedSampler(
+      const opentelemetry::sdk::configuration::TraceIdRatioBasedSamplerConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> CreateExtensionSampler(
+      const opentelemetry::sdk::configuration::ExtensionSamplerConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> CreateSampler(
+      const std::unique_ptr<opentelemetry::sdk::configuration::SamplerConfiguration> &model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> CreateOtlpHttpSpanExporter(
+      const opentelemetry::sdk::configuration::OtlpHttpSpanExporterConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> CreateOtlpGrpcSpanExporter(
+      const opentelemetry::sdk::configuration::OtlpGrpcSpanExporterConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> CreateOtlpFileSpanExporter(
+      const opentelemetry::sdk::configuration::OtlpFileSpanExporterConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> CreateConsoleSpanExporter(
+      const opentelemetry::sdk::configuration::ConsoleSpanExporterConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> CreateZipkinSpanExporter(
+      const opentelemetry::sdk::configuration::ZipkinSpanExporterConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> CreateExtensionSpanExporter(
+      const opentelemetry::sdk::configuration::ExtensionSpanExporterConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> CreateSpanExporter(
+      const std::unique_ptr<opentelemetry::sdk::configuration::SpanExporterConfiguration> &model)
+      const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> CreateBatchSpanProcessor(
+      const opentelemetry::sdk::configuration::BatchSpanProcessorConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> CreateSimpleSpanProcessor(
+      const opentelemetry::sdk::configuration::SimpleSpanProcessorConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> CreateExtensionSpanProcessor(
+      const opentelemetry::sdk::configuration::ExtensionSpanProcessorConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> CreateSpanProcessor(
+      const std::unique_ptr<opentelemetry::sdk::configuration::SpanProcessorConfiguration> &model)
+      const;
+
+  std::unique_ptr<opentelemetry::sdk::trace::TracerProvider> CreateTracerProvider(
+      const std::unique_ptr<opentelemetry::sdk::configuration::TracerProviderConfiguration> &model,
+      const opentelemetry::sdk::resource::Resource &resource) const;
+
+  std::unique_ptr<opentelemetry::context::propagation::TextMapPropagator> CreateTextMapPropagator(
+      const std::string &name) const;
+
+  std::unique_ptr<opentelemetry::context::propagation::TextMapPropagator> CreatePropagator(
+      const std::unique_ptr<opentelemetry::sdk::configuration::PropagatorConfiguration> &model)
+      const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> CreateOtlpHttpPushMetricExporter(
+      const opentelemetry::sdk::configuration::OtlpHttpPushMetricExporterConfiguration *model)
+      const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> CreateOtlpGrpcPushMetricExporter(
+      const opentelemetry::sdk::configuration::OtlpGrpcPushMetricExporterConfiguration *model)
+      const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> CreateOtlpFilePushMetricExporter(
+      const opentelemetry::sdk::configuration::OtlpFilePushMetricExporterConfiguration *model)
+      const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> CreateConsolePushMetricExporter(
+      const opentelemetry::sdk::configuration::ConsolePushMetricExporterConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter>
+  CreateExtensionPushMetricExporter(
+      const opentelemetry::sdk::configuration::ExtensionPushMetricExporterConfiguration *model)
+      const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> CreatePrometheusPullMetricExporter(
+      const opentelemetry::sdk::configuration::PrometheusPullMetricExporterConfiguration *model)
+      const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> CreateExtensionPullMetricExporter(
+      const opentelemetry::sdk::configuration::ExtensionPullMetricExporterConfiguration *model)
+      const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> CreatePushMetricExporter(
+      const std::unique_ptr<opentelemetry::sdk::configuration::PushMetricExporterConfiguration>
+          &model) const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> CreatePullMetricExporter(
+      const std::unique_ptr<opentelemetry::sdk::configuration::PullMetricExporterConfiguration>
+          &model) const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> CreatePeriodicMetricReader(
+      const opentelemetry::sdk::configuration::PeriodicMetricReaderConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> CreatePullMetricReader(
+      const opentelemetry::sdk::configuration::PullMetricReaderConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> CreateMetricReader(
+      const std::unique_ptr<opentelemetry::sdk::configuration::MetricReaderConfiguration> &model)
+      const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::Base2ExponentialHistogramAggregationConfig>
+  CreateBase2ExponentialBucketHistogramAggregation(
+      const opentelemetry::sdk::configuration::
+          Base2ExponentialBucketHistogramAggregationConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::HistogramAggregationConfig>
+  CreateExplicitBucketHistogramAggregation(
+      const opentelemetry::sdk::configuration::ExplicitBucketHistogramAggregationConfiguration
+          *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::AggregationConfig> CreateAggregationConfig(
+      const std::unique_ptr<opentelemetry::sdk::configuration::AggregationConfiguration> &model,
+      opentelemetry::sdk::metrics::AggregationType &aggregation_type) const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::AttributesProcessor> CreateAttributesProcessor(
+      const std::unique_ptr<opentelemetry::sdk::configuration::IncludeExcludeConfiguration> &model)
+      const;
+
+  void AddView(
+      opentelemetry::sdk::metrics::ViewRegistry *view_registry,
+      const std::unique_ptr<opentelemetry::sdk::configuration::ViewConfiguration> &model) const;
+
+  std::unique_ptr<opentelemetry::sdk::metrics::MeterProvider> CreateMeterProvider(
+      const std::unique_ptr<opentelemetry::sdk::configuration::MeterProviderConfiguration> &model,
+      const opentelemetry::sdk::resource::Resource &resource) const;
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> CreateOtlpHttpLogRecordExporter(
+      const opentelemetry::sdk::configuration::OtlpHttpLogRecordExporterConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> CreateOtlpGrpcLogRecordExporter(
+      const opentelemetry::sdk::configuration::OtlpGrpcLogRecordExporterConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> CreateOtlpFileLogRecordExporter(
+      const opentelemetry::sdk::configuration::OtlpFileLogRecordExporterConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> CreateConsoleLogRecordExporter(
+      const opentelemetry::sdk::configuration::ConsoleLogRecordExporterConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> CreateExtensionLogRecordExporter(
+      const opentelemetry::sdk::configuration::ExtensionLogRecordExporterConfiguration *model)
+      const;
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> CreateLogRecordExporter(
+      const std::unique_ptr<opentelemetry::sdk::configuration::LogRecordExporterConfiguration>
+          &model) const;
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor> CreateBatchLogRecordProcessor(
+      const opentelemetry::sdk::configuration::BatchLogRecordProcessorConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor> CreateSimpleLogRecordProcessor(
+      const opentelemetry::sdk::configuration::SimpleLogRecordProcessorConfiguration *model) const;
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor> CreateExtensionLogRecordProcessor(
+      const opentelemetry::sdk::configuration::ExtensionLogRecordProcessorConfiguration *model)
+      const;
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor> CreateLogRecordProcessor(
+      const std::unique_ptr<opentelemetry::sdk::configuration::LogRecordProcessorConfiguration>
+          &model) const;
+
+  std::unique_ptr<opentelemetry::sdk::logs::LoggerProvider> CreateLoggerProvider(
+      const std::unique_ptr<opentelemetry::sdk::configuration::LoggerProviderConfiguration> &model,
+      const opentelemetry::sdk::resource::Resource &resource) const;
+
+  void SetResourceAttribute(
+      opentelemetry::sdk::resource::ResourceAttributes &resource_attributes,
+      const std::string &name,
+      const opentelemetry::sdk::configuration::AttributeValueConfiguration *model) const;
+
+  void SetResource(opentelemetry::sdk::resource::Resource &resource,
+                   const std::unique_ptr<opentelemetry::sdk::configuration::ResourceConfiguration>
+                       &opt_model) const;
+
+  std::unique_ptr<ConfiguredSdk> CreateConfiguredSdk(
+      const std::unique_ptr<opentelemetry::sdk::configuration::Configuration> &model) const;
+
+private:
+  std::shared_ptr<Registry> registry_;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/text_map_propagator_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/text_map_propagator_builder.h
new file mode 100644
index 00000000000..76ec51ed4d3
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/text_map_propagator_builder.h
@@ -0,0 +1,32 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/context/propagation/text_map_propagator.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class TextMapPropagatorBuilder
+{
+public:
+  TextMapPropagatorBuilder()                                                 = default;
+  TextMapPropagatorBuilder(TextMapPropagatorBuilder &&)                      = default;
+  TextMapPropagatorBuilder(const TextMapPropagatorBuilder &)                 = default;
+  TextMapPropagatorBuilder &operator=(TextMapPropagatorBuilder &&)           = default;
+  TextMapPropagatorBuilder &operator=(const TextMapPropagatorBuilder &other) = default;
+  virtual ~TextMapPropagatorBuilder()                                        = default;
+
+  virtual std::unique_ptr<opentelemetry::context::propagation::TextMapPropagator> Build() const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/unsupported_exception.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/unsupported_exception.h
new file mode 100644
index 00000000000..95da867b997
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/unsupported_exception.h
@@ -0,0 +1,30 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <stdexcept>
+#include <string>
+
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class UnsupportedException : public std::runtime_error
+{
+public:
+  UnsupportedException(const std::string &msg) : std::runtime_error(msg) {}
+  UnsupportedException(UnsupportedException &&)                      = default;
+  UnsupportedException(const UnsupportedException &)                 = default;
+  UnsupportedException &operator=(UnsupportedException &&)           = default;
+  UnsupportedException &operator=(const UnsupportedException &other) = default;
+  ~UnsupportedException() override                                   = default;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/view_selector_configuration.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/view_selector_configuration.h
index 7c47bdd1d38..248ff775787 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/view_selector_configuration.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/view_selector_configuration.h
@@ -4,7 +4,6 @@
 #pragma once
 
 #include <cstdint>
-#include <memory>
 #include <string>
 
 #include "opentelemetry/sdk/configuration/instrument_type.h"
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/zipkin_span_exporter_builder.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/zipkin_span_exporter_builder.h
new file mode 100644
index 00000000000..2b140e4c485
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/configuration/zipkin_span_exporter_builder.h
@@ -0,0 +1,34 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#pragma once
+
+#include <memory>
+
+#include "opentelemetry/sdk/configuration/zipkin_span_exporter_configuration.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class ZipkinSpanExporterBuilder
+{
+public:
+  ZipkinSpanExporterBuilder()                                                  = default;
+  ZipkinSpanExporterBuilder(ZipkinSpanExporterBuilder &&)                      = default;
+  ZipkinSpanExporterBuilder(const ZipkinSpanExporterBuilder &)                 = default;
+  ZipkinSpanExporterBuilder &operator=(ZipkinSpanExporterBuilder &&)           = default;
+  ZipkinSpanExporterBuilder &operator=(const ZipkinSpanExporterBuilder &other) = default;
+  virtual ~ZipkinSpanExporterBuilder()                                         = default;
+
+  virtual std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> Build(
+      const opentelemetry::sdk::configuration::ZipkinSpanExporterConfiguration *model) const = 0;
+};
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/logs/batch_log_record_processor.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/logs/batch_log_record_processor.h
index 9f36b18fcae..49398a14547 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/logs/batch_log_record_processor.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/logs/batch_log_record_processor.h
@@ -93,10 +93,11 @@ class BatchLogRecordProcessor : public LogRecordProcessor
 
   /**
    * Shuts down the processor and does any cleanup required. Completely drains the buffer/queue of
-   * all its logs and passes them to the exporter. Any subsequent calls to
-   * ForceFlush or Shutdown will return immediately without doing anything.
+   * all its logs and passes them to the exporter.
    *
-   * NOTE: Timeout functionality not supported yet.
+   * @param timeout minimum amount of microseconds to wait for shutdown before giving up and
+   * returning failure.
+   * @return true if the shutdown succeeded, false otherwise
    */
   bool Shutdown(
       std::chrono::microseconds timeout = (std::chrono::microseconds::max)()) noexcept override;
@@ -107,6 +108,13 @@ class BatchLogRecordProcessor : public LogRecordProcessor
   ~BatchLogRecordProcessor() override;
 
 protected:
+  /**
+   * Shuts down the processor and does any cleanup required. Completely drains the buffer/queue of
+   * all its logs and passes them to the exporter.
+   */
+  bool InternalShutdown(
+      std::chrono::microseconds timeout = (std::chrono::microseconds::max)()) noexcept;
+
   /**
    * The background routine performed by the worker thread.
    */
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/logs/batch_log_record_processor_options.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/logs/batch_log_record_processor_options.h
index b130f947af1..84e03bcf37f 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/logs/batch_log_record_processor_options.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/logs/batch_log_record_processor_options.h
@@ -16,7 +16,7 @@ namespace logs
 {
 
 /**
- * Struct to hold batch SpanProcessor options.
+ * Struct to hold batch LogRecordProcessor options.
  */
 struct BatchLogRecordProcessorOptions
 {
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/logs/multi_log_record_processor.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/logs/multi_log_record_processor.h
index 46432ef22eb..4db2b3497a2 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/logs/multi_log_record_processor.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/logs/multi_log_record_processor.h
@@ -49,13 +49,32 @@ class MultiLogRecordProcessor : public LogRecordProcessor
   /**
    * Shuts down the processor and does any cleanup required.
    * ShutDown should only be called once for each processor.
-   * @param timeout minimum amount of microseconds to wait for
-   * shutdown before giving up and returning failure.
+   * @param timeout minimum amount of microseconds to wait for shutdown before giving up and
+   * returning failure.
    * @return true if the shutdown succeeded, false otherwise
    */
   bool Shutdown(
       std::chrono::microseconds timeout = (std::chrono::microseconds::max)()) noexcept override;
 
+protected:
+  /**
+   * Exports all log records that have not yet been exported to the configured Exporter.
+   * @param timeout that the forceflush is required to finish within.
+   * @return a result code indicating whether it succeeded, failed or timed out
+   */
+  bool InternalForceFlush(
+      std::chrono::microseconds timeout = (std::chrono::microseconds::max)()) noexcept;
+
+  /**
+   * Shuts down the processor and does any cleanup required.
+   * ShutDown should only be called once for each processor.
+   * @param timeout minimum amount of microseconds to wait for shutdown before giving up and
+   * returning failure.
+   * @return true if the shutdown succeeded, false otherwise
+   */
+  bool InternalShutdown(
+      std::chrono::microseconds timeout = (std::chrono::microseconds::max)()) noexcept;
+
 private:
   std::vector<std::unique_ptr<LogRecordProcessor>> processors_;
 };
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/aggregation/aggregation_config.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/aggregation/aggregation_config.h
index 0cae37f39e5..2effa4933cc 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/aggregation/aggregation_config.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/aggregation/aggregation_config.h
@@ -5,6 +5,7 @@
 
 #include <vector>
 
+#include "opentelemetry/sdk/metrics/state/attributes_hashmap.h"
 #include "opentelemetry/version.h"
 
 OPENTELEMETRY_BEGIN_NAMESPACE
@@ -15,6 +16,21 @@ namespace metrics
 class AggregationConfig
 {
 public:
+  AggregationConfig(size_t cardinality_limit = kAggregationCardinalityLimit)
+      : cardinality_limit_(cardinality_limit)
+  {}
+
+  static const AggregationConfig *GetOrDefault(const AggregationConfig *config)
+  {
+    if (config)
+    {
+      return config;
+    }
+    static const AggregationConfig default_config{};
+    return &default_config;
+  }
+
+  size_t cardinality_limit_;
   virtual ~AggregationConfig() = default;
 };
 
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/exemplar/reservoir_utils.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/exemplar/reservoir_utils.h
index dfd10995a47..6ca88411af8 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/exemplar/reservoir_utils.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/exemplar/reservoir_utils.h
@@ -5,6 +5,8 @@
 
 #ifdef ENABLE_METRICS_EXEMPLAR_PREVIEW
 
+#  include <algorithm>
+
 #  include "opentelemetry/common/macros.h"
 #  include "opentelemetry/sdk/metrics/aggregation/aggregation_config.h"
 #  include "opentelemetry/sdk/metrics/exemplar/aligned_histogram_bucket_exemplar_reservoir.h"
@@ -27,6 +29,23 @@ static inline MapAndResetCellType GetMapAndResetCellMethod(
   return &ReservoirCell::GetAndResetDouble;
 }
 
+static inline size_t GetSimpleFixedReservoirDefaultSize(const AggregationType agg_type,
+                                                        const AggregationConfig *const agg_config)
+
+{
+  constexpr size_t kMaxBase2ExponentialHistogramReservoirSize = 20;
+
+  if (agg_type == AggregationType::kBase2ExponentialHistogram)
+  {
+    const auto *histogram_agg_config =
+        static_cast<const Base2ExponentialHistogramAggregationConfig *>(agg_config);
+    return (std::min)(kMaxBase2ExponentialHistogramReservoirSize,
+                      histogram_agg_config->max_buckets_);
+  }
+
+  return SimpleFixedSizeExemplarReservoir::kDefaultSimpleReservoirSize;
+}
+
 static inline nostd::shared_ptr<ExemplarReservoir> GetExemplarReservoir(
     const AggregationType agg_type,
     const AggregationConfig *agg_config,
@@ -52,7 +71,7 @@ static inline nostd::shared_ptr<ExemplarReservoir> GetExemplarReservoir(
   }
 
   return nostd::shared_ptr<ExemplarReservoir>(new SimpleFixedSizeExemplarReservoir(
-      SimpleFixedSizeExemplarReservoir::kDefaultSimpleReservoirSize,
+      GetSimpleFixedReservoirDefaultSize(agg_type, agg_config),
       SimpleFixedSizeExemplarReservoir::GetSimpleFixedSizeCellSelector(),
       GetMapAndResetCellMethod(instrument_descriptor)));
 }
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/export/periodic_exporting_metric_reader_options.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/export/periodic_exporting_metric_reader_options.h
index 80514f96d89..d4bda975ab0 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/export/periodic_exporting_metric_reader_options.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/export/periodic_exporting_metric_reader_options.h
@@ -3,10 +3,10 @@
 
 #pragma once
 
-#include "opentelemetry/version.h"
-
 #include <chrono>
 
+#include "opentelemetry/version.h"
+
 OPENTELEMETRY_BEGIN_NAMESPACE
 namespace sdk
 {
@@ -20,14 +20,15 @@ constexpr std::chrono::milliseconds kExportTimeOutMillis  = std::chrono::millise
  * Struct to hold PeriodicExortingMetricReader options.
  */
 
-struct PeriodicExportingMetricReaderOptions
+struct OPENTELEMETRY_EXPORT PeriodicExportingMetricReaderOptions
 {
   /* The time interval between two consecutive exports. */
-  std::chrono::milliseconds export_interval_millis =
-      std::chrono::milliseconds(kExportIntervalMillis);
+  std::chrono::milliseconds export_interval_millis;
 
   /*  how long the export can run before it is cancelled. */
-  std::chrono::milliseconds export_timeout_millis = std::chrono::milliseconds(kExportTimeOutMillis);
+  std::chrono::milliseconds export_timeout_millis;
+
+  PeriodicExportingMetricReaderOptions();
 };
 
 }  // namespace metrics
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/state/async_metric_storage.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/state/async_metric_storage.h
index 93ffccc48c1..968de7aa82d 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/state/async_metric_storage.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/state/async_metric_storage.h
@@ -9,6 +9,7 @@
 
 #include "opentelemetry/nostd/shared_ptr.h"
 #include "opentelemetry/sdk/common/attributemap_hash.h"
+#include "opentelemetry/sdk/metrics/aggregation/aggregation_config.h"
 #include "opentelemetry/sdk/metrics/aggregation/default_aggregation.h"
 
 #ifdef ENABLE_METRICS_EXEMPLAR_PREVIEW
@@ -42,8 +43,11 @@ class AsyncMetricStorage : public MetricStorage, public AsyncWritableMetricStora
                      const AggregationConfig *aggregation_config)
       : instrument_descriptor_(instrument_descriptor),
         aggregation_type_{aggregation_type},
-        cumulative_hash_map_(new AttributesHashMap()),
-        delta_hash_map_(new AttributesHashMap()),
+        aggregation_config_{AggregationConfig::GetOrDefault(aggregation_config)},
+        cumulative_hash_map_(
+            std::make_unique<AttributesHashMap>(aggregation_config_->cardinality_limit_)),
+        delta_hash_map_(
+            std::make_unique<AttributesHashMap>(aggregation_config_->cardinality_limit_)),
 #ifdef ENABLE_METRICS_EXEMPLAR_PREVIEW
         exemplar_filter_type_(exempler_filter_type),
         exemplar_reservoir_(exemplar_reservoir),
@@ -124,7 +128,8 @@ class AsyncMetricStorage : public MetricStorage, public AsyncWritableMetricStora
     {
       std::lock_guard<opentelemetry::common::SpinLockMutex> guard(hashmap_lock_);
       delta_metrics = std::move(delta_hash_map_);
-      delta_hash_map_.reset(new AttributesHashMap);
+      delta_hash_map_ =
+          std::make_unique<AttributesHashMap>(aggregation_config_->cardinality_limit_);
     }
 
     auto status =
@@ -136,6 +141,7 @@ class AsyncMetricStorage : public MetricStorage, public AsyncWritableMetricStora
 private:
   InstrumentDescriptor instrument_descriptor_;
   AggregationType aggregation_type_;
+  const AggregationConfig *aggregation_config_;
   std::unique_ptr<AttributesHashMap> cumulative_hash_map_;
   std::unique_ptr<AttributesHashMap> delta_hash_map_;
   opentelemetry::common::SpinLockMutex hashmap_lock_;
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/state/attributes_hashmap.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/state/attributes_hashmap.h
index f1ab55ed616..2dd82a99918 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/state/attributes_hashmap.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/state/attributes_hashmap.h
@@ -49,7 +49,13 @@ class AttributesHashMapWithCustomHash
 public:
   AttributesHashMapWithCustomHash(size_t attributes_limit = kAggregationCardinalityLimit)
       : attributes_limit_(attributes_limit)
-  {}
+  {
+    if (attributes_limit_ > kAggregationCardinalityLimit)
+    {
+      hash_map_.reserve(attributes_limit_);
+    }
+  }
+
   Aggregation *Get(const MetricAttributes &attributes) const
   {
     auto it = hash_map_.find(attributes);
@@ -89,7 +95,7 @@ class AttributesHashMapWithCustomHash
       return it->second.get();
     }
 
-    if (IsOverflowAttributes())
+    if (IsOverflowAttributes(attr))
     {
       return GetOrSetOveflowAttributes(aggregation_callback);
     }
@@ -108,7 +114,7 @@ class AttributesHashMapWithCustomHash
       return it->second.get();
     }
 
-    if (IsOverflowAttributes())
+    if (IsOverflowAttributes(attributes))
     {
       return GetOrSetOveflowAttributes(aggregation_callback);
     }
@@ -127,7 +133,7 @@ class AttributesHashMapWithCustomHash
       return it->second.get();
     }
 
-    if (IsOverflowAttributes())
+    if (IsOverflowAttributes(attributes))
     {
       return GetOrSetOveflowAttributes(aggregation_callback);
     }
@@ -152,7 +158,7 @@ class AttributesHashMapWithCustomHash
     {
       it->second = std::move(aggr);
     }
-    else if (IsOverflowAttributes())
+    else if (IsOverflowAttributes(attributes))
     {
       hash_map_[kOverflowAttributes] = std::move(aggr);
     }
@@ -169,7 +175,7 @@ class AttributesHashMapWithCustomHash
     {
       it->second = std::move(aggr);
     }
-    else if (IsOverflowAttributes())
+    else if (IsOverflowAttributes(attributes))
     {
       hash_map_[kOverflowAttributes] = std::move(aggr);
     }
@@ -228,7 +234,27 @@ class AttributesHashMapWithCustomHash
     return result.first->second.get();
   }
 
-  bool IsOverflowAttributes() const { return (hash_map_.size() + 1 >= attributes_limit_); }
+  bool IsOverflowAttributes(const MetricAttributes &attributes) const
+  {
+    // If the incoming attributes are exactly the overflow sentinel, route
+    // directly to the overflow entry.
+    if (attributes == kOverflowAttributes)
+    {
+      return true;
+    }
+    // Determine if overflow entry already exists.
+    bool has_overflow = (hash_map_.find(kOverflowAttributes) != hash_map_.end());
+    // If overflow already present, total size already includes it; trigger overflow
+    // when current size (including overflow) is >= limit.
+    if (has_overflow)
+    {
+      return hash_map_.size() >= attributes_limit_;
+    }
+    // If overflow not present yet, simulate adding a new distinct key. If that
+    // would exceed the limit, we redirect to overflow instead of creating a
+    // new real attribute entry.
+    return (hash_map_.size() + 1) >= attributes_limit_;
+  }
 };
 
 using AttributesHashMap = AttributesHashMapWithCustomHash<>;
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/state/sync_metric_storage.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/state/sync_metric_storage.h
index ded2be1820e..f517375fd8d 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/state/sync_metric_storage.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/state/sync_metric_storage.h
@@ -18,6 +18,7 @@
 #include "opentelemetry/nostd/string_view.h"
 #include "opentelemetry/sdk/common/attributemap_hash.h"
 #include "opentelemetry/sdk/metrics/aggregation/aggregation.h"
+#include "opentelemetry/sdk/metrics/aggregation/aggregation_config.h"
 #include "opentelemetry/sdk/metrics/aggregation/default_aggregation.h"
 #include "opentelemetry/sdk/metrics/aggregation/histogram_aggregation.h"
 #include "opentelemetry/sdk/metrics/data/metric_data.h"
@@ -63,10 +64,11 @@ class SyncMetricStorage : public MetricStorage, public SyncWritableMetricStorage
                     ExemplarFilterType exempler_filter_type,
                     nostd::shared_ptr<ExemplarReservoir> &&exemplar_reservoir,
 #endif
-                    const AggregationConfig *aggregation_config,
-                    size_t attributes_limit = kAggregationCardinalityLimit)
+                    const AggregationConfig *aggregation_config)
       : instrument_descriptor_(instrument_descriptor),
-        attributes_hashmap_(new AttributesHashMap(attributes_limit)),
+        aggregation_config_(AggregationConfig::GetOrDefault(aggregation_config)),
+        attributes_hashmap_(
+            std::make_unique<AttributesHashMap>(aggregation_config_->cardinality_limit_)),
         attributes_processor_(std::move(attributes_processor)),
 #ifdef ENABLE_METRICS_EXEMPLAR_PREVIEW
         exemplar_filter_type_(exempler_filter_type),
@@ -173,6 +175,7 @@ class SyncMetricStorage : public MetricStorage, public SyncWritableMetricStorage
 private:
   InstrumentDescriptor instrument_descriptor_;
   // hashmap to maintain the metrics for delta collection (i.e, collection since last Collect call)
+  const AggregationConfig *aggregation_config_;
   std::unique_ptr<AttributesHashMap> attributes_hashmap_;
   std::function<std::unique_ptr<Aggregation>()> create_default_aggregation_;
   std::shared_ptr<const AttributesProcessor> attributes_processor_;
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/view/attributes_processor.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/view/attributes_processor.h
index 7ab8cafb139..b00687a5c13 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/view/attributes_processor.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/view/attributes_processor.h
@@ -3,6 +3,7 @@
 
 #pragma once
 
+#include <cstring>
 #include <string>
 #include <unordered_map>
 #include <utility>
@@ -10,6 +11,7 @@
 #include "opentelemetry/common/attribute_value.h"
 #include "opentelemetry/common/key_value_iterable.h"
 #include "opentelemetry/nostd/string_view.h"
+#include "opentelemetry/sdk/common/custom_hash_equality.h"
 #include "opentelemetry/sdk/metrics/state/filtered_ordered_attribute_map.h"
 #include "opentelemetry/version.h"
 
@@ -18,8 +20,15 @@ namespace sdk
 {
 namespace metrics
 {
+
 using MetricAttributes = opentelemetry::sdk::metrics::FilteredOrderedAttributeMap;
 
+typedef std::unordered_map<std::string,
+                           bool,
+                           opentelemetry::sdk::common::StringViewHash,
+                           opentelemetry::sdk::common::StringViewEqual>
+    FilterAttributeMap;
+
 /**
  * The AttributesProcessor is responsible for customizing which
  * attribute(s) are to be reported as metrics dimension(s).
@@ -65,12 +74,11 @@ class DefaultAttributesProcessor : public AttributesProcessor
 class FilteringAttributesProcessor : public AttributesProcessor
 {
 public:
-  FilteringAttributesProcessor(std::unordered_map<std::string, bool> &&allowed_attribute_keys = {})
+  FilteringAttributesProcessor(FilterAttributeMap &&allowed_attribute_keys = {})
       : allowed_attribute_keys_(std::move(allowed_attribute_keys))
   {}
 
-  FilteringAttributesProcessor(
-      const std::unordered_map<std::string, bool> &allowed_attribute_keys = {})
+  FilteringAttributesProcessor(const FilterAttributeMap &allowed_attribute_keys = {})
       : allowed_attribute_keys_(allowed_attribute_keys)
   {}
 
@@ -80,7 +88,8 @@ class FilteringAttributesProcessor : public AttributesProcessor
     MetricAttributes result;
     attributes.ForEachKeyValue(
         [&](nostd::string_view key, opentelemetry::common::AttributeValue value) noexcept {
-          if (allowed_attribute_keys_.find(key.data()) != allowed_attribute_keys_.end())
+          if (opentelemetry::sdk::common::find_heterogeneous(allowed_attribute_keys_, key) !=
+              allowed_attribute_keys_.end())
           {
             result.SetAttribute(key, value);
             return true;
@@ -94,11 +103,56 @@ class FilteringAttributesProcessor : public AttributesProcessor
 
   bool isPresent(nostd::string_view key) const noexcept override
   {
-    return (allowed_attribute_keys_.find(key.data()) != allowed_attribute_keys_.end());
+    return (opentelemetry::sdk::common::find_heterogeneous(allowed_attribute_keys_, key) !=
+            allowed_attribute_keys_.end());
+  }
+
+private:
+  FilterAttributeMap allowed_attribute_keys_;
+};
+
+/**
+ * FilteringExcludeAttributeProcessor filters by exclude attribute list and drops names if they are
+ * present in the exclude list
+ */
+
+class FilteringExcludeAttributesProcessor : public AttributesProcessor
+{
+public:
+  FilteringExcludeAttributesProcessor(FilterAttributeMap &&exclude_list = {})
+      : exclude_list_(std::move(exclude_list))
+  {}
+
+  FilteringExcludeAttributesProcessor(const FilterAttributeMap &exclude_list = {})
+      : exclude_list_(exclude_list)
+  {}
+
+  MetricAttributes process(
+      const opentelemetry::common::KeyValueIterable &attributes) const noexcept override
+  {
+    MetricAttributes result;
+    attributes.ForEachKeyValue([&](nostd::string_view key,
+                                   opentelemetry::common::AttributeValue value) noexcept {
+      if (opentelemetry::sdk::common::find_heterogeneous(exclude_list_, key) == exclude_list_.end())
+      {
+        result.SetAttribute(key, value);
+        return true;
+      }
+      return true;
+    });
+
+    result.UpdateHash();
+    return result;
+  }
+
+  bool isPresent(nostd::string_view key) const noexcept override
+  {
+    return (opentelemetry::sdk::common::find_heterogeneous(exclude_list_, key) ==
+            exclude_list_.end());
   }
 
 private:
-  std::unordered_map<std::string, bool> allowed_attribute_keys_;
+  FilterAttributeMap exclude_list_;
 };
 
 }  // namespace metrics
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/view/view.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/view/view.h
index e1c6237b368..49c52ff5d34 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/view/view.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/view/view.h
@@ -26,7 +26,6 @@ class View
 public:
   View(const std::string &name,
        const std::string &description                        = "",
-       const std::string &unit                               = "",
        AggregationType aggregation_type                      = AggregationType::kDefault,
        std::shared_ptr<AggregationConfig> aggregation_config = nullptr,
        std::unique_ptr<opentelemetry::sdk::metrics::AttributesProcessor> attributes_processor =
@@ -34,7 +33,6 @@ class View
                new opentelemetry::sdk::metrics::DefaultAttributesProcessor()))
       : name_(name),
         description_(description),
-        unit_(unit),
         aggregation_type_{aggregation_type},
         aggregation_config_{aggregation_config},
         attributes_processor_{std::move(attributes_processor)}
@@ -62,7 +60,6 @@ class View
 private:
   std::string name_;
   std::string description_;
-  std::string unit_;
   AggregationType aggregation_type_;
   std::shared_ptr<AggregationConfig> aggregation_config_;
   std::shared_ptr<AttributesProcessor> attributes_processor_;
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/view/view_factory.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/view/view_factory.h
index 2fa1733f92b..df3c9665710 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/view/view_factory.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/metrics/view/view_factory.h
@@ -30,22 +30,15 @@ class OPENTELEMETRY_EXPORT ViewFactory
 
   static std::unique_ptr<View> Create(const std::string &name,
                                       const std::string &description,
-                                      const std::string &unit);
-
-  static std::unique_ptr<View> Create(const std::string &name,
-                                      const std::string &description,
-                                      const std::string &unit,
                                       AggregationType aggregation_type);
 
   static std::unique_ptr<View> Create(const std::string &name,
                                       const std::string &description,
-                                      const std::string &unit,
                                       AggregationType aggregation_type,
                                       std::shared_ptr<AggregationConfig> aggregation_config);
 
   static std::unique_ptr<View> Create(const std::string &name,
                                       const std::string &description,
-                                      const std::string &unit,
                                       AggregationType aggregation_type,
                                       std::shared_ptr<AggregationConfig> aggregation_config,
                                       std::unique_ptr<AttributesProcessor> attributes_processor);
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/resource/resource.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/resource/resource.h
index 5260b7c3f56..b89e84649e6 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/resource/resource.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/resource/resource.h
@@ -19,7 +19,14 @@ using ResourceAttributes = opentelemetry::sdk::common::AttributeMap;
 class Resource
 {
 public:
-  Resource(const Resource &) = default;
+  Resource() noexcept;
+
+  Resource(const ResourceAttributes &attributes) noexcept;
+
+  Resource(const ResourceAttributes &attributes, const std::string &schema_url) noexcept;
+
+  Resource(const Resource &)            = default;
+  Resource &operator=(const Resource &) = default;
 
   const ResourceAttributes &GetAttributes() const noexcept;
   const std::string &GetSchemaURL() const noexcept;
@@ -61,21 +68,9 @@ class Resource
 
   static Resource &GetDefault();
 
-protected:
-  /**
-   * The constructor is protected and only for use internally by the class and
-   * inside ResourceDetector class.
-   * Users should use the Create factory method to obtain a Resource
-   * instance.
-   */
-  Resource(const ResourceAttributes &attributes = ResourceAttributes(),
-           const std::string &schema_url        = std::string{}) noexcept;
-
 private:
   ResourceAttributes attributes_;
   std::string schema_url_;
-
-  friend class ResourceDetector;
 };
 
 }  // namespace resource
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/batch_span_processor.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/batch_span_processor.h
index 3a78d6f33cf..333c01df8ab 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/batch_span_processor.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/batch_span_processor.h
@@ -91,10 +91,11 @@ class BatchSpanProcessor : public SpanProcessor
 
   /**
    * Shuts down the processor and does any cleanup required. Completely drains the buffer/queue of
-   * all its ended spans and passes them to the exporter. Any subsequent calls to OnStart, OnEnd,
-   * ForceFlush or Shutdown will return immediately without doing anything.
+   * all its ended spans and passes them to the exporter.
    *
-   * NOTE: Timeout functionality not supported yet.
+   * @param timeout minimum amount of microseconds to wait for shutdown before giving up and
+   * returning failure.
+   * @return true if the shutdown succeeded, false otherwise
    */
   bool Shutdown(
       std::chrono::microseconds timeout = (std::chrono::microseconds::max)()) noexcept override;
@@ -108,6 +109,17 @@ class BatchSpanProcessor : public SpanProcessor
   ~BatchSpanProcessor() override;
 
 protected:
+  /**
+   * Shuts down the processor and does any cleanup required. Completely drains the buffer/queue of
+   * all its ended spans and passes them to the exporter.
+   *
+   * @param timeout minimum amount of microseconds to wait for shutdown before giving up and
+   * returning failure.
+   * @return true if the shutdown succeeded, false otherwise
+   */
+  bool InternalShutdown(
+      std::chrono::microseconds timeout = (std::chrono::microseconds::max)()) noexcept;
+
   /**
    * The background routine performed by the worker thread.
    */
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/multi_span_processor.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/multi_span_processor.h
index 094c5b3e24c..4f732df5a4c 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/multi_span_processor.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/multi_span_processor.h
@@ -123,6 +123,19 @@ class MultiSpanProcessor : public SpanProcessor
 
   bool Shutdown(
       std::chrono::microseconds timeout = (std::chrono::microseconds::max)()) noexcept override
+  {
+    return InternalShutdown(timeout);
+  }
+
+  ~MultiSpanProcessor() override
+  {
+    InternalShutdown();
+    Cleanup();
+  }
+
+protected:
+  bool InternalShutdown(
+      std::chrono::microseconds timeout = (std::chrono::microseconds::max)()) noexcept
   {
     bool result         = true;
     ProcessorNode *node = head_;
@@ -135,12 +148,6 @@ class MultiSpanProcessor : public SpanProcessor
     return result;
   }
 
-  ~MultiSpanProcessor() override
-  {
-    Shutdown();
-    Cleanup();
-  }
-
 private:
   struct ProcessorNode
   {
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/samplers/parent.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/samplers/parent.h
index e44e9fa320b..5917273df62 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/samplers/parent.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/samplers/parent.h
@@ -9,6 +9,8 @@
 #include "opentelemetry/common/key_value_iterable.h"
 #include "opentelemetry/nostd/string_view.h"
 #include "opentelemetry/sdk/trace/sampler.h"
+#include "opentelemetry/sdk/trace/samplers/always_off.h"
+#include "opentelemetry/sdk/trace/samplers/always_on.h"
 #include "opentelemetry/trace/span_context.h"
 #include "opentelemetry/trace/span_metadata.h"
 #include "opentelemetry/trace/trace_id.h"
@@ -21,16 +23,36 @@ namespace trace
 {
 
 /**
- * The ParentBased sampler is a composite sampler. ParentBased(delegateSampler) either respects
- * the parent span's sampling decision or delegates to delegateSampler for root spans.
+ * The ParentBased sampler is a composite sampler that delegates sampling decisions based on the
+ * parent span's context.
+ *
+ * The decision is delegated to one of five configurable samplers:
+ * - No parent exists (root span): delegates to `root sampler`.
+ * - A remote parent exists and was sampled: delegates to `remote_parent_sampled_sampler` (default
+ * to AlwaysOnSampler).
+ * - A remote parent exists and was not sampled: delegates to `remote_parent_nonsampled_sampler`
+ * (default to AlwaysOffSampler).
+ * - A local parent exists and was sampled: delegates to `local_parent_sampled_sampler` (default to
+ * AlwaysOnSampler).
+ * - A local parent exists and was not sampled: delegates to `local_parent_nonsampled_sampler`
+ * (default to AlwaysOffSampler).
  */
 class ParentBasedSampler : public Sampler
 {
 public:
-  explicit ParentBasedSampler(const std::shared_ptr<Sampler> &delegate_sampler) noexcept;
-  /** The decision either respects the parent span's sampling decision or delegates to
-   * delegateSampler for root spans
-   * @return Returns DROP always
+  explicit ParentBasedSampler(const std::shared_ptr<Sampler> &root_sampler,
+                              const std::shared_ptr<Sampler> &remote_parent_sampled_sampler =
+                                  std::make_shared<AlwaysOnSampler>(),
+                              const std::shared_ptr<Sampler> &remote_parent_nonsampled_sampler =
+                                  std::make_shared<AlwaysOffSampler>(),
+                              const std::shared_ptr<Sampler> &local_parent_sampled_sampler =
+                                  std::make_shared<AlwaysOnSampler>(),
+                              const std::shared_ptr<Sampler> &local_parent_nonsampled_sampler =
+                                  std::make_shared<AlwaysOffSampler>()) noexcept;
+
+  /** Implements the decision logic by checking the parent context and delegating to the appropriate
+   * configured sampler
+   * @return The SamplingResult from the delegated sampler
    */
   SamplingResult ShouldSample(
       const opentelemetry::trace::SpanContext &parent_context,
@@ -46,9 +68,14 @@ class ParentBasedSampler : public Sampler
   nostd::string_view GetDescription() const noexcept override;
 
 private:
-  const std::shared_ptr<Sampler> delegate_sampler_;
+  const std::shared_ptr<Sampler> root_sampler_;
+  const std::shared_ptr<Sampler> remote_parent_sampled_sampler_;
+  const std::shared_ptr<Sampler> remote_parent_nonsampled_sampler_;
+  const std::shared_ptr<Sampler> local_parent_sampled_sampler_;
+  const std::shared_ptr<Sampler> local_parent_nonsampled_sampler_;
   const std::string description_;
 };
+
 }  // namespace trace
 }  // namespace sdk
 OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/samplers/parent_factory.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/samplers/parent_factory.h
index d5cf598311d..d07e4c1c0cb 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/samplers/parent_factory.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/samplers/parent_factory.h
@@ -23,7 +23,17 @@ class ParentBasedSamplerFactory
   /**
    * Create a ParentBasedSampler.
    */
-  static std::unique_ptr<Sampler> Create(const std::shared_ptr<Sampler> &delegate_sampler);
+  static std::unique_ptr<Sampler> Create(const std::shared_ptr<Sampler> &root_sampler);
+
+  /**
+   * Create a ParentBasedSampler.
+   */
+  static std::unique_ptr<Sampler> Create(
+      const std::shared_ptr<Sampler> &root_sampler,
+      const std::shared_ptr<Sampler> &remote_parent_sampled_sampler,
+      const std::shared_ptr<Sampler> &remote_parent_nonsampled_sampler,
+      const std::shared_ptr<Sampler> &local_parent_sampled_sampler,
+      const std::shared_ptr<Sampler> &local_parent_nonsampled_sampler);
 };
 
 }  // namespace trace
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/simple_processor.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/simple_processor.h
index ce6d378b794..6a562a8f0ab 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/simple_processor.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/trace/simple_processor.h
@@ -76,6 +76,15 @@ class SimpleSpanProcessor : public SpanProcessor
 
   bool Shutdown(
       std::chrono::microseconds timeout = (std::chrono::microseconds::max)()) noexcept override
+  {
+    return InternalShutdown(timeout);
+  }
+
+  ~SimpleSpanProcessor() override { InternalShutdown(); }
+
+protected:
+  bool InternalShutdown(
+      std::chrono::microseconds timeout = (std::chrono::microseconds::max)()) noexcept
   {
     // We only call shutdown ONCE.
     if (exporter_ != nullptr && !shutdown_latch_.test_and_set(std::memory_order_acquire))
@@ -85,8 +94,6 @@ class SimpleSpanProcessor : public SpanProcessor
     return true;
   }
 
-  ~SimpleSpanProcessor() override { Shutdown(); }
-
 private:
   std::unique_ptr<SpanExporter> exporter_;
   opentelemetry::common::SpinLockMutex lock_;
diff --git a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/version/version.h b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/version/version.h
index 1b31852ca26..a5045807a55 100644
--- a/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/version/version.h
+++ b/deps/opentelemetry-cpp/sdk/include/opentelemetry/sdk/version/version.h
@@ -3,7 +3,7 @@
 
 #pragma once
 
-#define OPENTELEMETRY_SDK_VERSION "1.22.0"
+#define OPENTELEMETRY_SDK_VERSION "1.23.0"
 
 #include "opentelemetry/version.h"
 
diff --git a/deps/opentelemetry-cpp/sdk/src/configuration/configuration_parser.cc b/deps/opentelemetry-cpp/sdk/src/configuration/configuration_parser.cc
index 000b9356626..7b0abcbca72 100644
--- a/deps/opentelemetry-cpp/sdk/src/configuration/configuration_parser.cc
+++ b/deps/opentelemetry-cpp/sdk/src/configuration/configuration_parser.cc
@@ -37,6 +37,7 @@
 #include "opentelemetry/sdk/configuration/explicit_bucket_histogram_aggregation_configuration.h"
 #include "opentelemetry/sdk/configuration/extension_log_record_exporter_configuration.h"
 #include "opentelemetry/sdk/configuration/extension_log_record_processor_configuration.h"
+#include "opentelemetry/sdk/configuration/extension_metric_producer_configuration.h"
 #include "opentelemetry/sdk/configuration/extension_pull_metric_exporter_configuration.h"
 #include "opentelemetry/sdk/configuration/extension_push_metric_exporter_configuration.h"
 #include "opentelemetry/sdk/configuration/extension_sampler_configuration.h"
@@ -55,7 +56,9 @@
 #include "opentelemetry/sdk/configuration/log_record_processor_configuration.h"
 #include "opentelemetry/sdk/configuration/logger_provider_configuration.h"
 #include "opentelemetry/sdk/configuration/meter_provider_configuration.h"
+#include "opentelemetry/sdk/configuration/metric_producer_configuration.h"
 #include "opentelemetry/sdk/configuration/metric_reader_configuration.h"
+#include "opentelemetry/sdk/configuration/open_census_metric_producer_configuration.h"
 #include "opentelemetry/sdk/configuration/otlp_file_log_record_exporter_configuration.h"
 #include "opentelemetry/sdk/configuration/otlp_file_push_metric_exporter_configuration.h"
 #include "opentelemetry/sdk/configuration/otlp_file_span_exporter_configuration.h"
@@ -691,7 +694,7 @@ static std::unique_ptr<PullMetricExporterConfiguration> ParsePullMetricExporterC
     throw InvalidSchemaException(message);
   }
 
-  if (name == "prometheus")
+  if (name == "prometheus/development")
   {
     model = ParsePrometheusPullMetricExporterConfiguration(child);
   }
@@ -703,6 +706,61 @@ static std::unique_ptr<PullMetricExporterConfiguration> ParsePullMetricExporterC
   return model;
 }
 
+static std::unique_ptr<OpenCensusMetricProducerConfiguration>
+ParseOpenCensusMetricProducerConfiguration(const std::unique_ptr<DocumentNode> & /* node */)
+{
+  auto model = std::make_unique<OpenCensusMetricProducerConfiguration>();
+
+  return model;
+}
+
+static std::unique_ptr<ExtensionMetricProducerConfiguration>
+ParseExtensionMetricProducerConfiguration(const std::string &name,
+                                          std::unique_ptr<DocumentNode> node)
+{
+  auto model = std::make_unique<ExtensionMetricProducerConfiguration>();
+
+  model->name = name;
+  model->node = std::move(node);
+
+  return model;
+}
+
+static std::unique_ptr<MetricProducerConfiguration> ParseMetricProducerConfiguration(
+    const std::unique_ptr<DocumentNode> &node)
+{
+  std::unique_ptr<MetricProducerConfiguration> model;
+
+  std::string name;
+  std::unique_ptr<DocumentNode> child;
+  size_t count = 0;
+
+  for (auto it = node->begin_properties(); it != node->end_properties(); ++it)
+  {
+    name  = it.Name();
+    child = it.Value();
+    count++;
+  }
+
+  if (count != 1)
+  {
+    std::string message("Illegal metric producer, properties count: ");
+    message.append(std::to_string(count));
+    throw InvalidSchemaException(message);
+  }
+
+  if (name == "opencensus")
+  {
+    model = ParseOpenCensusMetricProducerConfiguration(child);
+  }
+  else
+  {
+    model = ParseExtensionMetricProducerConfiguration(name, std::move(child));
+  }
+
+  return model;
+}
+
 static std::unique_ptr<PeriodicMetricReaderConfiguration> ParsePeriodicMetricReaderConfiguration(
     const std::unique_ptr<DocumentNode> &node)
 {
@@ -715,6 +773,16 @@ static std::unique_ptr<PeriodicMetricReaderConfiguration> ParsePeriodicMetricRea
   child           = node->GetRequiredChildNode("exporter");
   model->exporter = ParsePushMetricExporterConfiguration(child);
 
+  child = node->GetChildNode("producers");
+
+  if (child)
+  {
+    for (auto it = child->begin(); it != child->end(); ++it)
+    {
+      model->producers.push_back(ParseMetricProducerConfiguration(*it));
+    }
+  }
+
   return model;
 }
 
@@ -727,6 +795,16 @@ static std::unique_ptr<PullMetricReaderConfiguration> ParsePullMetricReaderConfi
   child           = node->GetRequiredChildNode("exporter");
   model->exporter = ParsePullMetricExporterConfiguration(child);
 
+  child = node->GetChildNode("producers");
+
+  if (child)
+  {
+    for (auto it = child->begin(); it != child->end(); ++it)
+    {
+      model->producers.push_back(ParseMetricProducerConfiguration(*it));
+    }
+  }
+
   return model;
 }
 
@@ -1031,17 +1109,41 @@ static std::unique_ptr<PropagatorConfiguration> ParsePropagatorConfiguration(
   auto model = std::make_unique<PropagatorConfiguration>();
 
   std::unique_ptr<DocumentNode> child;
-  child = node->GetRequiredChildNode("composite");
+  child = node->GetChildNode("composite");
+  std::string name;
+  int num_child = 0;
 
-  for (auto it = child->begin(); it != child->end(); ++it)
+  if (child)
   {
-    std::unique_ptr<DocumentNode> element(*it);
-
-    std::string name = element->AsString();
-
-    model->composite.push_back(name);
+    for (auto it = child->begin(); it != child->end(); ++it)
+    {
+      // This is an entry in the composite array
+      std::unique_ptr<DocumentNode> element(*it);
+      num_child++;
+      int count = 0;
+
+      // Find out its name, we expect an object with a unique property.
+      for (auto it2 = element->begin_properties(); it2 != element->end_properties(); ++it2)
+      {
+        name = it2.Name();
+        count++;
+      }
+
+      if (count != 1)
+      {
+        std::string message("Illegal composite child ");
+        message.append(std::to_string(num_child));
+        message.append(", properties count: ");
+        message.append(std::to_string(count));
+        throw InvalidSchemaException(message);
+      }
+
+      model->composite.push_back(name);
+    }
   }
 
+  model->composite_list = node->GetString("composite_list", "");
+
   return model;
 }
 
diff --git a/deps/opentelemetry-cpp/sdk/src/configuration/configured_sdk.cc b/deps/opentelemetry-cpp/sdk/src/configuration/configured_sdk.cc
new file mode 100644
index 00000000000..3eb81c9e488
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/src/configuration/configured_sdk.cc
@@ -0,0 +1,114 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <exception>
+#include <memory>
+#include <ostream>
+#include <utility>
+
+#include "opentelemetry/context/propagation/global_propagator.h"
+#include "opentelemetry/context/propagation/text_map_propagator.h"
+#include "opentelemetry/logs/logger_provider.h"
+#include "opentelemetry/logs/provider.h"
+#include "opentelemetry/metrics/meter_provider.h"
+#include "opentelemetry/metrics/provider.h"
+#include "opentelemetry/sdk/common/global_log_handler.h"
+#include "opentelemetry/sdk/configuration/configuration.h"
+#include "opentelemetry/sdk/configuration/configured_sdk.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/configuration/sdk_builder.h"
+#include "opentelemetry/sdk/logs/logger_provider.h"
+#include "opentelemetry/sdk/metrics/meter_provider.h"
+#include "opentelemetry/sdk/trace/tracer_provider.h"
+#include "opentelemetry/trace/provider.h"
+#include "opentelemetry/trace/tracer_provider.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+std::unique_ptr<ConfiguredSdk> ConfiguredSdk::Create(
+    std::shared_ptr<Registry> registry,
+    const std::unique_ptr<opentelemetry::sdk::configuration::Configuration> &model)
+{
+  std::unique_ptr<ConfiguredSdk> sdk;
+
+  if (model)
+  {
+    try
+    {
+      SdkBuilder builder(std::move(registry));
+      sdk = builder.CreateConfiguredSdk(model);
+    }
+    catch (const std::exception &e)
+    {
+      OTEL_INTERNAL_LOG_ERROR("[Configured Sdk] builder failed with exception: " << e.what());
+    }
+    catch (...)
+    {
+      OTEL_INTERNAL_LOG_ERROR("[Configured Sdk] builder failed with unknown exception.");
+    }
+  }
+
+  return sdk;
+}
+
+void ConfiguredSdk::Install()
+{
+  if (propagator)
+  {
+    opentelemetry::context::propagation::GlobalTextMapPropagator::SetGlobalPropagator(propagator);
+  }
+
+  if (tracer_provider)
+  {
+    std::shared_ptr<opentelemetry::trace::TracerProvider> api_tracer_provider = tracer_provider;
+    opentelemetry::trace::Provider::SetTracerProvider(api_tracer_provider);
+  }
+
+  if (meter_provider)
+  {
+    std::shared_ptr<opentelemetry::metrics::MeterProvider> api_meter_provider = meter_provider;
+    opentelemetry::metrics::Provider::SetMeterProvider(api_meter_provider);
+  }
+
+  if (logger_provider)
+  {
+    std::shared_ptr<opentelemetry::logs::LoggerProvider> api_logger_provider = logger_provider;
+    opentelemetry::logs::Provider::SetLoggerProvider(api_logger_provider);
+  }
+}
+
+void ConfiguredSdk::UnInstall()
+{
+  if (propagator)
+  {
+    std::shared_ptr<opentelemetry::context::propagation::TextMapPropagator> none;
+    opentelemetry::context::propagation::GlobalTextMapPropagator::SetGlobalPropagator(none);
+  }
+
+  if (tracer_provider)
+  {
+    std::shared_ptr<opentelemetry::trace::TracerProvider> none;
+    opentelemetry::trace::Provider::SetTracerProvider(none);
+  }
+
+  if (meter_provider)
+  {
+    std::shared_ptr<opentelemetry::metrics::MeterProvider> none;
+    opentelemetry::metrics::Provider::SetMeterProvider(none);
+  }
+
+  if (logger_provider)
+  {
+    std::shared_ptr<opentelemetry::logs::LoggerProvider> none;
+    opentelemetry::logs::Provider::SetLoggerProvider(none);
+  }
+}
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/src/configuration/registry.cc b/deps/opentelemetry-cpp/sdk/src/configuration/registry.cc
new file mode 100644
index 00000000000..804faf38fa6
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/src/configuration/registry.cc
@@ -0,0 +1,248 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <map>
+#include <memory>
+#include <string>
+#include <utility>
+
+#include "opentelemetry/baggage/propagation/baggage_propagator.h"
+#include "opentelemetry/context/propagation/text_map_propagator.h"
+#include "opentelemetry/sdk/configuration/extension_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/extension_log_record_processor_builder.h"
+#include "opentelemetry/sdk/configuration/extension_pull_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/extension_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/extension_sampler_builder.h"
+#include "opentelemetry/sdk/configuration/extension_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/extension_span_processor_builder.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/configuration/text_map_propagator_builder.h"
+#include "opentelemetry/trace/propagation/b3_propagator.h"
+#include "opentelemetry/trace/propagation/http_trace_context.h"
+#include "opentelemetry/trace/propagation/jaeger.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class TraceContextBuilder : public TextMapPropagatorBuilder
+{
+public:
+  std::unique_ptr<opentelemetry::context::propagation::TextMapPropagator> Build() const override
+  {
+    auto result = std::make_unique<opentelemetry::trace::propagation::HttpTraceContext>();
+    return result;
+  }
+};
+
+class BaggageBuilder : public TextMapPropagatorBuilder
+{
+public:
+  std::unique_ptr<opentelemetry::context::propagation::TextMapPropagator> Build() const override
+  {
+    auto result = std::make_unique<opentelemetry::baggage::propagation::BaggagePropagator>();
+    return result;
+  }
+};
+
+class B3Builder : public TextMapPropagatorBuilder
+{
+public:
+  std::unique_ptr<opentelemetry::context::propagation::TextMapPropagator> Build() const override
+  {
+    auto result = std::make_unique<opentelemetry::trace::propagation::B3Propagator>();
+    return result;
+  }
+};
+
+class B3MultiBuilder : public TextMapPropagatorBuilder
+{
+public:
+  std::unique_ptr<opentelemetry::context::propagation::TextMapPropagator> Build() const override
+  {
+    auto result = std::make_unique<opentelemetry::trace::propagation::B3PropagatorMultiHeader>();
+    return result;
+  }
+};
+
+class JaegerBuilder : public TextMapPropagatorBuilder
+{
+public:
+  std::unique_ptr<opentelemetry::context::propagation::TextMapPropagator> Build() const override
+  {
+    auto result = std::make_unique<opentelemetry::trace::propagation::JaegerPropagator>();
+    return result;
+  }
+};
+
+Registry::Registry()
+{
+  SetTextMapPropagatorBuilder("tracecontext", std::make_unique<TraceContextBuilder>());
+  SetTextMapPropagatorBuilder("baggage", std::make_unique<BaggageBuilder>());
+  SetTextMapPropagatorBuilder("b3", std::make_unique<B3Builder>());
+  SetTextMapPropagatorBuilder("b3multi", std::make_unique<B3MultiBuilder>());
+  SetTextMapPropagatorBuilder("jaeger", std::make_unique<JaegerBuilder>());
+}
+
+const TextMapPropagatorBuilder *Registry::GetTextMapPropagatorBuilder(const std::string &name) const
+{
+  TextMapPropagatorBuilder *builder = nullptr;
+  auto search                       = propagator_builders_.find(name);
+  if (search != propagator_builders_.end())
+  {
+    builder = search->second.get();
+  }
+  return builder;
+}
+
+void Registry::SetTextMapPropagatorBuilder(const std::string &name,
+                                           std::unique_ptr<TextMapPropagatorBuilder> &&builder)
+{
+  propagator_builders_.erase(name);
+  propagator_builders_.insert({name, std::move(builder)});
+}
+
+const ExtensionSamplerBuilder *Registry::GetExtensionSamplerBuilder(const std::string &name) const
+{
+  ExtensionSamplerBuilder *builder = nullptr;
+  auto search                      = sampler_builders_.find(name);
+  if (search != sampler_builders_.end())
+  {
+    builder = search->second.get();
+  }
+  return builder;
+}
+
+void Registry::SetExtensionSamplerBuilder(const std::string &name,
+                                          std::unique_ptr<ExtensionSamplerBuilder> &&builder)
+{
+  sampler_builders_.erase(name);
+  sampler_builders_.insert({name, std::move(builder)});
+}
+
+const ExtensionSpanExporterBuilder *Registry::GetExtensionSpanExporterBuilder(
+    const std::string &name) const
+{
+  ExtensionSpanExporterBuilder *builder = nullptr;
+  auto search                           = span_exporter_builders_.find(name);
+  if (search != span_exporter_builders_.end())
+  {
+    builder = search->second.get();
+  }
+  return builder;
+}
+
+void Registry::SetExtensionSpanExporterBuilder(
+    const std::string &name,
+    std::unique_ptr<ExtensionSpanExporterBuilder> &&builder)
+{
+  span_exporter_builders_.erase(name);
+  span_exporter_builders_.insert({name, std::move(builder)});
+}
+
+const ExtensionSpanProcessorBuilder *Registry::GetExtensionSpanProcessorBuilder(
+    const std::string &name) const
+{
+  ExtensionSpanProcessorBuilder *builder = nullptr;
+  auto search                            = span_processor_builders_.find(name);
+  if (search != span_processor_builders_.end())
+  {
+    builder = search->second.get();
+  }
+  return builder;
+}
+
+void Registry::SetExtensionSpanProcessorBuilder(
+    const std::string &name,
+    std::unique_ptr<ExtensionSpanProcessorBuilder> &&builder)
+{
+  span_processor_builders_.erase(name);
+  span_processor_builders_.insert({name, std::move(builder)});
+}
+
+const ExtensionPushMetricExporterBuilder *Registry::GetExtensionPushMetricExporterBuilder(
+    const std::string &name) const
+{
+  ExtensionPushMetricExporterBuilder *builder = nullptr;
+  auto search                                 = push_metric_exporter_builders_.find(name);
+  if (search != push_metric_exporter_builders_.end())
+  {
+    builder = search->second.get();
+  }
+  return builder;
+}
+
+void Registry::SetExtensionPushMetricExporterBuilder(
+    const std::string &name,
+    std::unique_ptr<ExtensionPushMetricExporterBuilder> &&builder)
+{
+  push_metric_exporter_builders_.erase(name);
+  push_metric_exporter_builders_.insert({name, std::move(builder)});
+}
+
+const ExtensionPullMetricExporterBuilder *Registry::GetExtensionPullMetricExporterBuilder(
+    const std::string &name) const
+{
+  ExtensionPullMetricExporterBuilder *builder = nullptr;
+  auto search                                 = pull_metric_exporter_builders_.find(name);
+  if (search != pull_metric_exporter_builders_.end())
+  {
+    builder = search->second.get();
+  }
+  return builder;
+}
+
+void Registry::SetExtensionPullMetricExporterBuilder(
+    const std::string &name,
+    std::unique_ptr<ExtensionPullMetricExporterBuilder> &&builder)
+{
+  pull_metric_exporter_builders_.erase(name);
+  pull_metric_exporter_builders_.insert({name, std::move(builder)});
+}
+
+const ExtensionLogRecordExporterBuilder *Registry::GetExtensionLogRecordExporterBuilder(
+    const std::string &name) const
+{
+  ExtensionLogRecordExporterBuilder *builder = nullptr;
+  auto search                                = log_record_exporter_builders_.find(name);
+  if (search != log_record_exporter_builders_.end())
+  {
+    builder = search->second.get();
+  }
+  return builder;
+}
+
+void Registry::SetExtensionLogRecordExporterBuilder(
+    const std::string &name,
+    std::unique_ptr<ExtensionLogRecordExporterBuilder> &&builder)
+{
+  log_record_exporter_builders_.erase(name);
+  log_record_exporter_builders_.insert({name, std::move(builder)});
+}
+
+const ExtensionLogRecordProcessorBuilder *Registry::GetExtensionLogRecordProcessorBuilder(
+    const std::string &name) const
+{
+  ExtensionLogRecordProcessorBuilder *builder = nullptr;
+  auto search                                 = log_record_processor_builders_.find(name);
+  if (search != log_record_processor_builders_.end())
+  {
+    builder = search->second.get();
+  }
+  return builder;
+}
+
+void Registry::SetExtensionLogRecordProcessorBuilder(
+    const std::string &name,
+    std::unique_ptr<ExtensionLogRecordProcessorBuilder> &&builder)
+{
+  log_record_processor_builders_.erase(name);
+  log_record_processor_builders_.insert({name, std::move(builder)});
+}
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/src/configuration/sdk_builder.cc b/deps/opentelemetry-cpp/sdk/src/configuration/sdk_builder.cc
new file mode 100644
index 00000000000..0da1af86dce
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/src/configuration/sdk_builder.cc
@@ -0,0 +1,1838 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <stddef.h>
+#include <stdint.h>
+#include <chrono>
+#include <map>
+#include <memory>
+#include <ostream>
+#include <string>
+#include <utility>
+#include <vector>
+
+#include "opentelemetry/common/attribute_value.h"
+#include "opentelemetry/common/kv_properties.h"
+#include "opentelemetry/context/propagation/composite_propagator.h"
+#include "opentelemetry/context/propagation/text_map_propagator.h"
+#include "opentelemetry/nostd/span.h"
+#include "opentelemetry/nostd/string_view.h"
+#include "opentelemetry/sdk/common/global_log_handler.h"
+#include "opentelemetry/sdk/configuration/aggregation_configuration.h"
+#include "opentelemetry/sdk/configuration/aggregation_configuration_visitor.h"
+#include "opentelemetry/sdk/configuration/always_off_sampler_configuration.h"
+#include "opentelemetry/sdk/configuration/always_on_sampler_configuration.h"
+#include "opentelemetry/sdk/configuration/attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/attribute_value_configuration_visitor.h"
+#include "opentelemetry/sdk/configuration/attributes_configuration.h"
+#include "opentelemetry/sdk/configuration/base2_exponential_bucket_histogram_aggregation_configuration.h"
+#include "opentelemetry/sdk/configuration/batch_log_record_processor_configuration.h"
+#include "opentelemetry/sdk/configuration/batch_span_processor_configuration.h"
+#include "opentelemetry/sdk/configuration/boolean_array_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/boolean_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/configuration.h"
+#include "opentelemetry/sdk/configuration/configured_sdk.h"
+#include "opentelemetry/sdk/configuration/console_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/console_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/console_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/console_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/console_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/console_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/double_array_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/double_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/explicit_bucket_histogram_aggregation_configuration.h"
+#include "opentelemetry/sdk/configuration/extension_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/extension_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/extension_log_record_processor_builder.h"
+#include "opentelemetry/sdk/configuration/extension_log_record_processor_configuration.h"
+#include "opentelemetry/sdk/configuration/extension_pull_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/extension_pull_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/extension_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/extension_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/extension_sampler_builder.h"
+#include "opentelemetry/sdk/configuration/extension_sampler_configuration.h"
+#include "opentelemetry/sdk/configuration/extension_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/extension_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/extension_span_processor_builder.h"
+#include "opentelemetry/sdk/configuration/extension_span_processor_configuration.h"
+#include "opentelemetry/sdk/configuration/include_exclude_configuration.h"
+#include "opentelemetry/sdk/configuration/instrument_type.h"
+#include "opentelemetry/sdk/configuration/integer_array_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/integer_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/jaeger_remote_sampler_configuration.h"
+#include "opentelemetry/sdk/configuration/log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/log_record_exporter_configuration_visitor.h"
+#include "opentelemetry/sdk/configuration/log_record_processor_configuration.h"
+#include "opentelemetry/sdk/configuration/log_record_processor_configuration_visitor.h"
+#include "opentelemetry/sdk/configuration/logger_provider_configuration.h"
+#include "opentelemetry/sdk/configuration/meter_provider_configuration.h"
+#include "opentelemetry/sdk/configuration/metric_reader_configuration.h"
+#include "opentelemetry/sdk/configuration/metric_reader_configuration_visitor.h"
+#include "opentelemetry/sdk/configuration/otlp_file_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_file_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_file_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_file_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_grpc_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_http_log_record_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_log_record_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_http_push_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/otlp_http_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/otlp_http_span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/parent_based_sampler_configuration.h"
+#include "opentelemetry/sdk/configuration/periodic_metric_reader_configuration.h"
+#include "opentelemetry/sdk/configuration/prometheus_pull_metric_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/prometheus_pull_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/propagator_configuration.h"
+#include "opentelemetry/sdk/configuration/pull_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/pull_metric_exporter_configuration_visitor.h"
+#include "opentelemetry/sdk/configuration/pull_metric_reader_configuration.h"
+#include "opentelemetry/sdk/configuration/push_metric_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/push_metric_exporter_configuration_visitor.h"
+#include "opentelemetry/sdk/configuration/registry.h"
+#include "opentelemetry/sdk/configuration/resource_configuration.h"
+#include "opentelemetry/sdk/configuration/sampler_configuration.h"
+#include "opentelemetry/sdk/configuration/sampler_configuration_visitor.h"
+#include "opentelemetry/sdk/configuration/sdk_builder.h"
+#include "opentelemetry/sdk/configuration/simple_log_record_processor_configuration.h"
+#include "opentelemetry/sdk/configuration/simple_span_processor_configuration.h"
+#include "opentelemetry/sdk/configuration/span_exporter_configuration.h"
+#include "opentelemetry/sdk/configuration/span_exporter_configuration_visitor.h"
+#include "opentelemetry/sdk/configuration/span_processor_configuration.h"
+#include "opentelemetry/sdk/configuration/span_processor_configuration_visitor.h"
+#include "opentelemetry/sdk/configuration/string_array_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/string_attribute_value_configuration.h"
+#include "opentelemetry/sdk/configuration/text_map_propagator_builder.h"
+#include "opentelemetry/sdk/configuration/trace_id_ratio_based_sampler_configuration.h"
+#include "opentelemetry/sdk/configuration/tracer_provider_configuration.h"
+#include "opentelemetry/sdk/configuration/unsupported_exception.h"
+#include "opentelemetry/sdk/configuration/view_configuration.h"
+#include "opentelemetry/sdk/configuration/view_selector_configuration.h"
+#include "opentelemetry/sdk/configuration/view_stream_configuration.h"
+#include "opentelemetry/sdk/configuration/zipkin_span_exporter_builder.h"
+#include "opentelemetry/sdk/configuration/zipkin_span_exporter_configuration.h"
+#include "opentelemetry/sdk/logs/batch_log_record_processor_factory.h"
+#include "opentelemetry/sdk/logs/batch_log_record_processor_options.h"
+#include "opentelemetry/sdk/logs/exporter.h"
+#include "opentelemetry/sdk/logs/logger_provider.h"
+#include "opentelemetry/sdk/logs/logger_provider_factory.h"
+#include "opentelemetry/sdk/logs/processor.h"
+#include "opentelemetry/sdk/logs/simple_log_record_processor_factory.h"
+#include "opentelemetry/sdk/metrics/aggregation/aggregation_config.h"
+#include "opentelemetry/sdk/metrics/export/periodic_exporting_metric_reader_factory.h"
+#include "opentelemetry/sdk/metrics/export/periodic_exporting_metric_reader_options.h"
+#include "opentelemetry/sdk/metrics/instruments.h"
+#include "opentelemetry/sdk/metrics/meter_context.h"
+#include "opentelemetry/sdk/metrics/meter_context_factory.h"
+#include "opentelemetry/sdk/metrics/meter_provider.h"
+#include "opentelemetry/sdk/metrics/meter_provider_factory.h"
+#include "opentelemetry/sdk/metrics/metric_reader.h"
+#include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/sdk/metrics/view/attributes_processor.h"
+#include "opentelemetry/sdk/metrics/view/instrument_selector.h"
+#include "opentelemetry/sdk/metrics/view/meter_selector.h"
+#include "opentelemetry/sdk/metrics/view/view.h"
+#include "opentelemetry/sdk/metrics/view/view_registry.h"
+#include "opentelemetry/sdk/metrics/view/view_registry_factory.h"
+#include "opentelemetry/sdk/resource/resource.h"
+#include "opentelemetry/sdk/trace/batch_span_processor_factory.h"
+#include "opentelemetry/sdk/trace/batch_span_processor_options.h"
+#include "opentelemetry/sdk/trace/exporter.h"
+#include "opentelemetry/sdk/trace/processor.h"
+#include "opentelemetry/sdk/trace/sampler.h"
+#include "opentelemetry/sdk/trace/samplers/always_off_factory.h"
+#include "opentelemetry/sdk/trace/samplers/always_on_factory.h"
+#include "opentelemetry/sdk/trace/samplers/parent_factory.h"
+#include "opentelemetry/sdk/trace/samplers/trace_id_ratio_factory.h"
+#include "opentelemetry/sdk/trace/simple_processor_factory.h"
+#include "opentelemetry/sdk/trace/tracer_provider.h"
+#include "opentelemetry/sdk/trace/tracer_provider_factory.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace configuration
+{
+
+class ResourceAttributeValueSetter
+    : public opentelemetry::sdk::configuration::AttributeValueConfigurationVisitor
+{
+public:
+  ResourceAttributeValueSetter(
+      opentelemetry::sdk::resource::ResourceAttributes &resource_attributes,
+      const std::string &name)
+      : resource_attributes_(resource_attributes), name_(name)
+  {}
+  ResourceAttributeValueSetter(ResourceAttributeValueSetter &&)                      = delete;
+  ResourceAttributeValueSetter(const ResourceAttributeValueSetter &)                 = delete;
+  ResourceAttributeValueSetter &operator=(ResourceAttributeValueSetter &&)           = delete;
+  ResourceAttributeValueSetter &operator=(const ResourceAttributeValueSetter &other) = delete;
+  ~ResourceAttributeValueSetter() override                                           = default;
+
+  void VisitString(
+      const opentelemetry::sdk::configuration::StringAttributeValueConfiguration *model) override
+  {
+    opentelemetry::common::AttributeValue attribute_value(model->value);
+    resource_attributes_.SetAttribute(name_, attribute_value);
+  }
+
+  void VisitInteger(
+      const opentelemetry::sdk::configuration::IntegerAttributeValueConfiguration *model) override
+  {
+    opentelemetry::common::AttributeValue attribute_value(model->value);
+    resource_attributes_.SetAttribute(name_, attribute_value);
+  }
+
+  void VisitDouble(
+      const opentelemetry::sdk::configuration::DoubleAttributeValueConfiguration *model) override
+  {
+    opentelemetry::common::AttributeValue attribute_value(model->value);
+    resource_attributes_.SetAttribute(name_, attribute_value);
+  }
+
+  void VisitBoolean(
+      const opentelemetry::sdk::configuration::BooleanAttributeValueConfiguration *model) override
+  {
+    opentelemetry::common::AttributeValue attribute_value(model->value);
+    resource_attributes_.SetAttribute(name_, attribute_value);
+  }
+
+  void VisitStringArray(
+      const opentelemetry::sdk::configuration::StringArrayAttributeValueConfiguration *model)
+      override
+  {
+    size_t length = model->value.size();
+    std::vector<nostd::string_view> string_view_array(length);
+
+    // We have: std::vector<std::string>
+    // We need: nostd::span<const nostd::string_view>
+
+    for (size_t i = 0; i < length; i++)
+    {
+      string_view_array[i] = model->value[i];
+    }
+
+    nostd::span<const nostd::string_view> span(string_view_array.data(), string_view_array.size());
+
+    opentelemetry::common::AttributeValue attribute_value(span);
+    resource_attributes_.SetAttribute(name_, attribute_value);
+  }
+
+  void VisitIntegerArray(
+      const opentelemetry::sdk::configuration::IntegerArrayAttributeValueConfiguration *model)
+      override
+  {
+    size_t length = model->value.size();
+    std::vector<int64_t> int_array(length);
+
+    // We have: std::vector<size_t>
+    // We need: nostd::span<const int64_t>
+
+    for (size_t i = 0; i < length; i++)
+    {
+      int_array[i] = model->value[i];
+    }
+
+    nostd::span<const int64_t> span(int_array.data(), int_array.size());
+
+    opentelemetry::common::AttributeValue attribute_value(span);
+    resource_attributes_.SetAttribute(name_, attribute_value);
+  }
+
+  void VisitDoubleArray(
+      const opentelemetry::sdk::configuration::DoubleArrayAttributeValueConfiguration *model)
+      override
+  {
+    // We have: std::vector<double>
+    // We need: nostd::span<const double>
+    // so no data conversion needed
+
+    nostd::span<const double> span(model->value.data(), model->value.size());
+
+    opentelemetry::common::AttributeValue attribute_value(span);
+    resource_attributes_.SetAttribute(name_, attribute_value);
+  }
+
+  void VisitBooleanArray(
+      const opentelemetry::sdk::configuration::BooleanArrayAttributeValueConfiguration *model)
+      override
+  {
+    size_t length = model->value.size();
+
+    // Can not use std::vector<bool>,
+    // it has no data() to convert it to a span
+    std::unique_ptr<bool[]> bool_array(new bool[length]);
+
+    // We have: std::vector<bool>
+    // We need: nostd::span<const bool>
+
+    for (size_t i = 0; i < length; i++)
+    {
+      bool_array[i] = model->value[i];
+    }
+
+    nostd::span<const bool> span(&bool_array[0], length);
+
+    opentelemetry::common::AttributeValue attribute_value(span);
+    resource_attributes_.SetAttribute(name_, attribute_value);
+  }
+
+  opentelemetry::common::AttributeValue attribute_value;
+
+private:
+  opentelemetry::sdk::resource::ResourceAttributes &resource_attributes_;
+  std::string name_;
+};
+
+class SamplerBuilder : public opentelemetry::sdk::configuration::SamplerConfigurationVisitor
+{
+public:
+  SamplerBuilder(const SdkBuilder *b) : sdk_builder_(b) {}
+  SamplerBuilder(SamplerBuilder &&)                      = delete;
+  SamplerBuilder(const SamplerBuilder &)                 = delete;
+  SamplerBuilder &operator=(SamplerBuilder &&)           = delete;
+  SamplerBuilder &operator=(const SamplerBuilder &other) = delete;
+  ~SamplerBuilder() override                             = default;
+
+  void VisitAlwaysOff(
+      const opentelemetry::sdk::configuration::AlwaysOffSamplerConfiguration *model) override
+  {
+    sampler = sdk_builder_->CreateAlwaysOffSampler(model);
+  }
+
+  void VisitAlwaysOn(
+      const opentelemetry::sdk::configuration::AlwaysOnSamplerConfiguration *model) override
+  {
+    sampler = sdk_builder_->CreateAlwaysOnSampler(model);
+  }
+
+  void VisitJaegerRemote(
+      const opentelemetry::sdk::configuration::JaegerRemoteSamplerConfiguration *model) override
+  {
+    sampler = sdk_builder_->CreateJaegerRemoteSampler(model);
+  }
+
+  void VisitParentBased(
+      const opentelemetry::sdk::configuration::ParentBasedSamplerConfiguration *model) override
+  {
+    sampler = sdk_builder_->CreateParentBasedSampler(model);
+  }
+
+  void VisitTraceIdRatioBased(
+      const opentelemetry::sdk::configuration::TraceIdRatioBasedSamplerConfiguration *model)
+      override
+  {
+    sampler = sdk_builder_->CreateTraceIdRatioBasedSampler(model);
+  }
+
+  void VisitExtension(
+      const opentelemetry::sdk::configuration::ExtensionSamplerConfiguration *model) override
+  {
+    sampler = sdk_builder_->CreateExtensionSampler(model);
+  }
+
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> sampler;
+
+private:
+  const SdkBuilder *sdk_builder_;
+};
+
+class SpanProcessorBuilder
+    : public opentelemetry::sdk::configuration::SpanProcessorConfigurationVisitor
+{
+public:
+  SpanProcessorBuilder(const SdkBuilder *b) : sdk_builder_(b) {}
+  SpanProcessorBuilder(SpanProcessorBuilder &&)                      = delete;
+  SpanProcessorBuilder(const SpanProcessorBuilder &)                 = delete;
+  SpanProcessorBuilder &operator=(SpanProcessorBuilder &&)           = delete;
+  SpanProcessorBuilder &operator=(const SpanProcessorBuilder &other) = delete;
+  ~SpanProcessorBuilder() override                                   = default;
+
+  void VisitBatch(
+      const opentelemetry::sdk::configuration::BatchSpanProcessorConfiguration *model) override
+  {
+    processor = sdk_builder_->CreateBatchSpanProcessor(model);
+  }
+
+  void VisitSimple(
+      const opentelemetry::sdk::configuration::SimpleSpanProcessorConfiguration *model) override
+  {
+    processor = sdk_builder_->CreateSimpleSpanProcessor(model);
+  }
+
+  void VisitExtension(
+      const opentelemetry::sdk::configuration::ExtensionSpanProcessorConfiguration *model) override
+  {
+    processor = sdk_builder_->CreateExtensionSpanProcessor(model);
+  }
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> processor;
+
+private:
+  const SdkBuilder *sdk_builder_;
+};
+
+class SpanExporterBuilder
+    : public opentelemetry::sdk::configuration::SpanExporterConfigurationVisitor
+{
+public:
+  SpanExporterBuilder(const SdkBuilder *b) : sdk_builder_(b) {}
+  SpanExporterBuilder(SpanExporterBuilder &&)                      = delete;
+  SpanExporterBuilder(const SpanExporterBuilder &)                 = delete;
+  SpanExporterBuilder &operator=(SpanExporterBuilder &&)           = delete;
+  SpanExporterBuilder &operator=(const SpanExporterBuilder &other) = delete;
+  ~SpanExporterBuilder() override                                  = default;
+
+  void VisitOtlpHttp(
+      const opentelemetry::sdk::configuration::OtlpHttpSpanExporterConfiguration *model) override
+  {
+    exporter = sdk_builder_->CreateOtlpHttpSpanExporter(model);
+  }
+
+  void VisitOtlpGrpc(
+      const opentelemetry::sdk::configuration::OtlpGrpcSpanExporterConfiguration *model) override
+  {
+    exporter = sdk_builder_->CreateOtlpGrpcSpanExporter(model);
+  }
+
+  void VisitOtlpFile(
+      const opentelemetry::sdk::configuration::OtlpFileSpanExporterConfiguration *model) override
+  {
+    exporter = sdk_builder_->CreateOtlpFileSpanExporter(model);
+  }
+
+  void VisitConsole(
+      const opentelemetry::sdk::configuration::ConsoleSpanExporterConfiguration *model) override
+  {
+    exporter = sdk_builder_->CreateConsoleSpanExporter(model);
+  }
+
+  void VisitZipkin(
+      const opentelemetry::sdk::configuration::ZipkinSpanExporterConfiguration *model) override
+  {
+    exporter = sdk_builder_->CreateZipkinSpanExporter(model);
+  }
+
+  void VisitExtension(
+      const opentelemetry::sdk::configuration::ExtensionSpanExporterConfiguration *model) override
+  {
+    exporter = sdk_builder_->CreateExtensionSpanExporter(model);
+  }
+
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> exporter;
+
+private:
+  const SdkBuilder *sdk_builder_;
+};
+
+class MetricReaderBuilder
+    : public opentelemetry::sdk::configuration::MetricReaderConfigurationVisitor
+{
+public:
+  MetricReaderBuilder(const SdkBuilder *b) : sdk_builder_(b) {}
+  MetricReaderBuilder(MetricReaderBuilder &&)                      = delete;
+  MetricReaderBuilder(const MetricReaderBuilder &)                 = delete;
+  MetricReaderBuilder &operator=(MetricReaderBuilder &&)           = delete;
+  MetricReaderBuilder &operator=(const MetricReaderBuilder &other) = delete;
+  ~MetricReaderBuilder() override                                  = default;
+
+  void VisitPeriodic(
+      const opentelemetry::sdk::configuration::PeriodicMetricReaderConfiguration *model) override
+  {
+    metric_reader = sdk_builder_->CreatePeriodicMetricReader(model);
+  }
+
+  void VisitPull(
+      const opentelemetry::sdk::configuration::PullMetricReaderConfiguration *model) override
+  {
+    metric_reader = sdk_builder_->CreatePullMetricReader(model);
+  }
+
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> metric_reader;
+
+private:
+  const SdkBuilder *sdk_builder_;
+};
+
+class PushMetricExporterBuilder
+    : public opentelemetry::sdk::configuration::PushMetricExporterConfigurationVisitor
+{
+public:
+  PushMetricExporterBuilder(const SdkBuilder *b) : sdk_builder_(b) {}
+  PushMetricExporterBuilder(PushMetricExporterBuilder &&)                      = delete;
+  PushMetricExporterBuilder(const PushMetricExporterBuilder &)                 = delete;
+  PushMetricExporterBuilder &operator=(PushMetricExporterBuilder &&)           = delete;
+  PushMetricExporterBuilder &operator=(const PushMetricExporterBuilder &other) = delete;
+  ~PushMetricExporterBuilder() override                                        = default;
+
+  void VisitOtlpHttp(
+      const opentelemetry::sdk::configuration::OtlpHttpPushMetricExporterConfiguration *model)
+      override
+  {
+    exporter = sdk_builder_->CreateOtlpHttpPushMetricExporter(model);
+  }
+
+  void VisitOtlpGrpc(
+      const opentelemetry::sdk::configuration::OtlpGrpcPushMetricExporterConfiguration *model)
+      override
+  {
+    exporter = sdk_builder_->CreateOtlpGrpcPushMetricExporter(model);
+  }
+
+  void VisitOtlpFile(
+      const opentelemetry::sdk::configuration::OtlpFilePushMetricExporterConfiguration *model)
+      override
+  {
+    exporter = sdk_builder_->CreateOtlpFilePushMetricExporter(model);
+  }
+
+  void VisitConsole(const opentelemetry::sdk::configuration::ConsolePushMetricExporterConfiguration
+                        *model) override
+  {
+    exporter = sdk_builder_->CreateConsolePushMetricExporter(model);
+  }
+
+  void VisitExtension(
+      const opentelemetry::sdk::configuration::ExtensionPushMetricExporterConfiguration *model)
+      override
+  {
+    exporter = sdk_builder_->CreateExtensionPushMetricExporter(model);
+  }
+
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> exporter;
+
+private:
+  const SdkBuilder *sdk_builder_;
+};
+
+class PullMetricExporterBuilder
+    : public opentelemetry::sdk::configuration::PullMetricExporterConfigurationVisitor
+{
+public:
+  PullMetricExporterBuilder(const SdkBuilder *b) : sdk_builder_(b) {}
+  PullMetricExporterBuilder(PullMetricExporterBuilder &&)                      = delete;
+  PullMetricExporterBuilder(const PullMetricExporterBuilder &)                 = delete;
+  PullMetricExporterBuilder &operator=(PullMetricExporterBuilder &&)           = delete;
+  PullMetricExporterBuilder &operator=(const PullMetricExporterBuilder &other) = delete;
+  ~PullMetricExporterBuilder() override                                        = default;
+
+  void VisitPrometheus(
+      const opentelemetry::sdk::configuration::PrometheusPullMetricExporterConfiguration *model)
+      override
+  {
+    exporter = sdk_builder_->CreatePrometheusPullMetricExporter(model);
+  }
+
+  void VisitExtension(
+      const opentelemetry::sdk::configuration::ExtensionPullMetricExporterConfiguration *model)
+      override
+  {
+    exporter = sdk_builder_->CreateExtensionPullMetricExporter(model);
+  }
+
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> exporter;
+
+private:
+  const SdkBuilder *sdk_builder_;
+};
+
+class AggregationConfigBuilder
+    : public opentelemetry::sdk::configuration::AggregationConfigurationVisitor
+{
+public:
+  AggregationConfigBuilder(const SdkBuilder *b) : sdk_builder_(b) {}
+  AggregationConfigBuilder(AggregationConfigBuilder &&)                      = delete;
+  AggregationConfigBuilder(const AggregationConfigBuilder &)                 = delete;
+  AggregationConfigBuilder &operator=(AggregationConfigBuilder &&)           = delete;
+  AggregationConfigBuilder &operator=(const AggregationConfigBuilder &other) = delete;
+  ~AggregationConfigBuilder() override                                       = default;
+
+  void VisitBase2ExponentialBucketHistogram(
+      const opentelemetry::sdk::configuration::
+          Base2ExponentialBucketHistogramAggregationConfiguration *model) override
+  {
+    aggregation_type   = opentelemetry::sdk::metrics::AggregationType::kBase2ExponentialHistogram;
+    aggregation_config = sdk_builder_->CreateBase2ExponentialBucketHistogramAggregation(model);
+  }
+
+  void VisitDefault(const opentelemetry::sdk::configuration::DefaultAggregationConfiguration
+                        * /* model */) override
+  {
+    aggregation_type = opentelemetry::sdk::metrics::AggregationType::kDefault;
+  }
+
+  void VisitDrop(
+      const opentelemetry::sdk::configuration::DropAggregationConfiguration * /* model */) override
+  {
+    aggregation_type = opentelemetry::sdk::metrics::AggregationType::kDrop;
+  }
+
+  void VisitExplicitBucketHistogram(
+      const opentelemetry::sdk::configuration::ExplicitBucketHistogramAggregationConfiguration
+          *model) override
+  {
+    aggregation_type   = opentelemetry::sdk::metrics::AggregationType::kHistogram;
+    aggregation_config = sdk_builder_->CreateExplicitBucketHistogramAggregation(model);
+  }
+
+  void VisitLastValue(const opentelemetry::sdk::configuration::LastValueAggregationConfiguration
+                          * /* model */) override
+  {
+    aggregation_type = opentelemetry::sdk::metrics::AggregationType::kLastValue;
+  }
+
+  void VisitSum(
+      const opentelemetry::sdk::configuration::SumAggregationConfiguration * /* model */) override
+  {
+    aggregation_type = opentelemetry::sdk::metrics::AggregationType::kSum;
+  }
+
+  opentelemetry::sdk::metrics::AggregationType aggregation_type;
+  std::unique_ptr<opentelemetry::sdk::metrics::AggregationConfig> aggregation_config;
+
+private:
+  const SdkBuilder *sdk_builder_;
+};
+
+class LogRecordProcessorBuilder
+    : public opentelemetry::sdk::configuration::LogRecordProcessorConfigurationVisitor
+{
+public:
+  LogRecordProcessorBuilder(const SdkBuilder *b) : sdk_builder_(b) {}
+  LogRecordProcessorBuilder(LogRecordProcessorBuilder &&)                      = delete;
+  LogRecordProcessorBuilder(const LogRecordProcessorBuilder &)                 = delete;
+  LogRecordProcessorBuilder &operator=(LogRecordProcessorBuilder &&)           = delete;
+  LogRecordProcessorBuilder &operator=(const LogRecordProcessorBuilder &other) = delete;
+  ~LogRecordProcessorBuilder() override                                        = default;
+
+  void VisitBatch(
+      const opentelemetry::sdk::configuration::BatchLogRecordProcessorConfiguration *model) override
+  {
+    processor = sdk_builder_->CreateBatchLogRecordProcessor(model);
+  }
+
+  void VisitSimple(const opentelemetry::sdk::configuration::SimpleLogRecordProcessorConfiguration
+                       *model) override
+  {
+    processor = sdk_builder_->CreateSimpleLogRecordProcessor(model);
+  }
+
+  void VisitExtension(
+      const opentelemetry::sdk::configuration::ExtensionLogRecordProcessorConfiguration *model)
+      override
+  {
+    processor = sdk_builder_->CreateExtensionLogRecordProcessor(model);
+  }
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor> processor;
+
+private:
+  const SdkBuilder *sdk_builder_;
+};
+
+class LogRecordExporterBuilder
+    : public opentelemetry::sdk::configuration::LogRecordExporterConfigurationVisitor
+{
+public:
+  LogRecordExporterBuilder(const SdkBuilder *b) : sdk_builder_(b) {}
+  LogRecordExporterBuilder(LogRecordExporterBuilder &&)                      = delete;
+  LogRecordExporterBuilder(const LogRecordExporterBuilder &)                 = delete;
+  LogRecordExporterBuilder &operator=(LogRecordExporterBuilder &&)           = delete;
+  LogRecordExporterBuilder &operator=(const LogRecordExporterBuilder &other) = delete;
+  ~LogRecordExporterBuilder() override                                       = default;
+
+  void VisitOtlpHttp(const opentelemetry::sdk::configuration::OtlpHttpLogRecordExporterConfiguration
+                         *model) override
+  {
+    exporter = sdk_builder_->CreateOtlpHttpLogRecordExporter(model);
+  }
+
+  void VisitOtlpGrpc(const opentelemetry::sdk::configuration::OtlpGrpcLogRecordExporterConfiguration
+                         *model) override
+  {
+    exporter = sdk_builder_->CreateOtlpGrpcLogRecordExporter(model);
+  }
+
+  void VisitOtlpFile(const opentelemetry::sdk::configuration::OtlpFileLogRecordExporterConfiguration
+                         *model) override
+  {
+    exporter = sdk_builder_->CreateOtlpFileLogRecordExporter(model);
+  }
+
+  void VisitConsole(const opentelemetry::sdk::configuration::ConsoleLogRecordExporterConfiguration
+                        *model) override
+  {
+    exporter = sdk_builder_->CreateConsoleLogRecordExporter(model);
+  }
+
+  void VisitExtension(
+      const opentelemetry::sdk::configuration::ExtensionLogRecordExporterConfiguration *model)
+      override
+  {
+    exporter = sdk_builder_->CreateExtensionLogRecordExporter(model);
+  }
+
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> exporter;
+
+private:
+  const SdkBuilder *sdk_builder_;
+};
+
+std::unique_ptr<opentelemetry::sdk::trace::Sampler> SdkBuilder::CreateAlwaysOffSampler(
+    const opentelemetry::sdk::configuration::AlwaysOffSamplerConfiguration * /* model */) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> sdk;
+
+  sdk = opentelemetry::sdk::trace::AlwaysOffSamplerFactory::Create();
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::Sampler> SdkBuilder::CreateAlwaysOnSampler(
+    const opentelemetry::sdk::configuration::AlwaysOnSamplerConfiguration * /* model */) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> sdk;
+
+  sdk = opentelemetry::sdk::trace::AlwaysOnSamplerFactory::Create();
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::Sampler> SdkBuilder::CreateJaegerRemoteSampler(
+    const opentelemetry::sdk::configuration::JaegerRemoteSamplerConfiguration * /* model */) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> sdk;
+
+  static const std::string die("JaegerRemoteSampler not supported");
+  throw UnsupportedException(die);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::Sampler> SdkBuilder::CreateParentBasedSampler(
+    const opentelemetry::sdk::configuration::ParentBasedSamplerConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> sdk;
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> remote_parent_sampled_sdk;
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> remote_parent_not_sampled_sdk;
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> local_parent_sampled_sdk;
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> local_parent_not_sampled_sdk;
+
+  auto root_sdk = SdkBuilder::CreateSampler(model->root);
+
+  if (model->remote_parent_sampled != nullptr)
+  {
+    remote_parent_sampled_sdk = SdkBuilder::CreateSampler(model->remote_parent_sampled);
+  }
+  else
+  {
+    remote_parent_sampled_sdk = opentelemetry::sdk::trace::AlwaysOnSamplerFactory::Create();
+  }
+
+  if (model->remote_parent_not_sampled != nullptr)
+  {
+    remote_parent_not_sampled_sdk = SdkBuilder::CreateSampler(model->remote_parent_not_sampled);
+  }
+  else
+  {
+    remote_parent_not_sampled_sdk = opentelemetry::sdk::trace::AlwaysOffSamplerFactory::Create();
+  }
+
+  if (model->local_parent_sampled != nullptr)
+  {
+    local_parent_sampled_sdk = SdkBuilder::CreateSampler(model->local_parent_sampled);
+  }
+  else
+  {
+    local_parent_sampled_sdk = opentelemetry::sdk::trace::AlwaysOnSamplerFactory::Create();
+  }
+
+  if (model->local_parent_not_sampled != nullptr)
+  {
+    local_parent_not_sampled_sdk = SdkBuilder::CreateSampler(model->local_parent_not_sampled);
+  }
+  else
+  {
+    local_parent_not_sampled_sdk = opentelemetry::sdk::trace::AlwaysOffSamplerFactory::Create();
+  }
+
+  std::shared_ptr<opentelemetry::sdk::trace::Sampler> shared_root = std::move(root_sdk);
+  std::shared_ptr<opentelemetry::sdk::trace::Sampler> shared_remote_parent_sampled =
+      std::move(remote_parent_sampled_sdk);
+  std::shared_ptr<opentelemetry::sdk::trace::Sampler> shared_remote_parent_not_sampled =
+      std::move(remote_parent_not_sampled_sdk);
+  std::shared_ptr<opentelemetry::sdk::trace::Sampler> shared_local_parent_sampled =
+      std::move(local_parent_sampled_sdk);
+  std::shared_ptr<opentelemetry::sdk::trace::Sampler> shared_local_parent_not_sampled =
+      std::move(local_parent_not_sampled_sdk);
+
+  sdk = opentelemetry::sdk::trace::ParentBasedSamplerFactory::Create(
+      shared_root, shared_remote_parent_sampled, shared_remote_parent_not_sampled,
+      shared_local_parent_sampled, shared_local_parent_not_sampled);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::Sampler> SdkBuilder::CreateTraceIdRatioBasedSampler(
+    const opentelemetry::sdk::configuration::TraceIdRatioBasedSamplerConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> sdk;
+
+  sdk = opentelemetry::sdk::trace::TraceIdRatioBasedSamplerFactory::Create(model->ratio);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::Sampler> SdkBuilder::CreateExtensionSampler(
+    const opentelemetry::sdk::configuration::ExtensionSamplerConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> sdk;
+  std::string name = model->name;
+
+  const ExtensionSamplerBuilder *builder = registry_->GetExtensionSamplerBuilder(name);
+
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateExtensionSampler() using registered builder " << name);
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  std::string die("CreateExtensionSampler() no builder for ");
+  die.append(name);
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::Sampler> SdkBuilder::CreateSampler(
+    const std::unique_ptr<opentelemetry::sdk::configuration::SamplerConfiguration> &model) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> sdk;
+
+  SamplerBuilder builder(this);
+  model->Accept(&builder);
+  sdk = std::move(builder.sampler);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> SdkBuilder::CreateOtlpHttpSpanExporter(
+    const opentelemetry::sdk::configuration::OtlpHttpSpanExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> sdk;
+  const OtlpHttpSpanExporterBuilder *builder;
+
+  builder = registry_->GetOtlpHttpSpanBuilder();
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateOtlpHttpSpanExporter() using registered http builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No http builder for OtlpHttpSpanExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> SdkBuilder::CreateOtlpGrpcSpanExporter(
+    const opentelemetry::sdk::configuration::OtlpGrpcSpanExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> sdk;
+  const OtlpGrpcSpanExporterBuilder *builder;
+
+  builder = registry_->GetOtlpGrpcSpanBuilder();
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateOtlpGrpcSpanExporter() using registered grpc builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No builder for OtlpGrpcSpanExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> SdkBuilder::CreateOtlpFileSpanExporter(
+    const opentelemetry::sdk::configuration::OtlpFileSpanExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> sdk;
+  const OtlpFileSpanExporterBuilder *builder;
+
+  builder = registry_->GetOtlpFileSpanBuilder();
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateOtlpFileSpanExporter() using registered file builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No builder for OtlpFileSpanExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> SdkBuilder::CreateConsoleSpanExporter(
+    const opentelemetry::sdk::configuration::ConsoleSpanExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> sdk;
+  const ConsoleSpanExporterBuilder *builder = registry_->GetConsoleSpanBuilder();
+
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateConsoleSpanExporter() using registered builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No builder for ConsoleSpanExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> SdkBuilder::CreateZipkinSpanExporter(
+    const opentelemetry::sdk::configuration::ZipkinSpanExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> sdk;
+  const ZipkinSpanExporterBuilder *builder = registry_->GetZipkinSpanBuilder();
+
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateZipkinSpanExporter() using registered builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No builder for ZipkinSpanExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> SdkBuilder::CreateExtensionSpanExporter(
+    const opentelemetry::sdk::configuration::ExtensionSpanExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> sdk;
+  std::string name = model->name;
+
+  const ExtensionSpanExporterBuilder *builder = registry_->GetExtensionSpanExporterBuilder(name);
+
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateExtensionSpanExporter() using registered builder " << name);
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  std::string die("CreateExtensionSpanExporter() no builder for ");
+  die.append(name);
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> SdkBuilder::CreateSpanExporter(
+    const std::unique_ptr<opentelemetry::sdk::configuration::SpanExporterConfiguration> &model)
+    const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::SpanExporter> sdk;
+
+  SpanExporterBuilder builder(this);
+  model->Accept(&builder);
+  sdk = std::move(builder.exporter);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> SdkBuilder::CreateBatchSpanProcessor(
+    const opentelemetry::sdk::configuration::BatchSpanProcessorConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> sdk;
+  opentelemetry::sdk::trace::BatchSpanProcessorOptions options;
+
+  options.schedule_delay_millis = std::chrono::milliseconds(model->schedule_delay);
+
+#ifdef LATER
+  options.xxx = model->export_timeout;
+#endif
+
+  options.max_queue_size        = model->max_queue_size;
+  options.max_export_batch_size = model->max_export_batch_size;
+
+  auto exporter_sdk = CreateSpanExporter(model->exporter);
+
+  sdk = opentelemetry::sdk::trace::BatchSpanProcessorFactory::Create(std::move(exporter_sdk),
+                                                                     options);
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> SdkBuilder::CreateSimpleSpanProcessor(
+    const opentelemetry::sdk::configuration::SimpleSpanProcessorConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> sdk;
+
+  auto exporter_sdk = CreateSpanExporter(model->exporter);
+
+  sdk = opentelemetry::sdk::trace::SimpleSpanProcessorFactory::Create(std::move(exporter_sdk));
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> SdkBuilder::CreateExtensionSpanProcessor(
+    const opentelemetry::sdk::configuration::ExtensionSpanProcessorConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> sdk;
+  std::string name = model->name;
+
+  const ExtensionSpanProcessorBuilder *builder = registry_->GetExtensionSpanProcessorBuilder(name);
+
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateExtensionSpanProcessor() using registered builder " << name);
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  std::string die("CreateExtensionSpanProcessor() no builder for ");
+  die.append(name);
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> SdkBuilder::CreateSpanProcessor(
+    const std::unique_ptr<opentelemetry::sdk::configuration::SpanProcessorConfiguration> &model)
+    const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor> sdk;
+
+  SpanProcessorBuilder builder(this);
+  model->Accept(&builder);
+  sdk = std::move(builder.processor);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::trace::TracerProvider> SdkBuilder::CreateTracerProvider(
+    const std::unique_ptr<opentelemetry::sdk::configuration::TracerProviderConfiguration> &model,
+    const opentelemetry::sdk::resource::Resource &resource) const
+{
+  std::unique_ptr<opentelemetry::sdk::trace::TracerProvider> sdk;
+
+  // FIXME-CONFIG: https://github.com/open-telemetry/opentelemetry-configuration/issues/70
+  // FIXME-CONFIG: Add support for IdGenerator
+
+  std::unique_ptr<opentelemetry::sdk::trace::Sampler> sampler;
+
+  if (model->sampler)
+  {
+    sampler = CreateSampler(model->sampler);
+  }
+
+  std::vector<std::unique_ptr<opentelemetry::sdk::trace::SpanProcessor>> sdk_processors;
+
+  for (const auto &processor_model : model->processors)
+  {
+    sdk_processors.push_back(CreateSpanProcessor(processor_model));
+  }
+
+  // FIXME-SDK: https://github.com/open-telemetry/opentelemetry-cpp/issues/3303
+  // FIXME-SDK: use limits, id_generator, ...
+  sdk = opentelemetry::sdk::trace::TracerProviderFactory::Create(std::move(sdk_processors),
+                                                                 resource, std::move(sampler));
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::context::propagation::TextMapPropagator>
+SdkBuilder::CreateTextMapPropagator(const std::string &name) const
+{
+  std::unique_ptr<opentelemetry::context::propagation::TextMapPropagator> sdk;
+
+  const TextMapPropagatorBuilder *builder = registry_->GetTextMapPropagatorBuilder(name);
+
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateTextMapPropagator() using registered builder " << name);
+    sdk = builder->Build();
+    return sdk;
+  }
+
+  std::string die("CreateTextMapPropagator() no builder for ");
+  die.append(name);
+  throw UnsupportedException(die);
+}
+
+static bool IsDuplicate(const std::vector<std::string> &propagator_seen, const std::string &name)
+{
+  bool duplicate = false;
+  for (const auto &seen : propagator_seen)
+  {
+    if (name == seen)
+    {
+      duplicate = true;
+    }
+  }
+
+  return duplicate;
+}
+
+std::unique_ptr<opentelemetry::context::propagation::TextMapPropagator>
+SdkBuilder::CreatePropagator(
+    const std::unique_ptr<opentelemetry::sdk::configuration::PropagatorConfiguration> &model) const
+{
+  std::unique_ptr<opentelemetry::context::propagation::CompositePropagator> sdk;
+  std::vector<std::unique_ptr<opentelemetry::context::propagation::TextMapPropagator>> propagators;
+  std::unique_ptr<opentelemetry::context::propagation::TextMapPropagator> propagator;
+  std::vector<std::string> propagator_seen;
+  bool duplicate = false;
+
+  /*
+   * Note that the spec only requires to check duplicates between
+   * composite and composite_list.
+   * Here we check for duplicates globally, for ease of use.
+   */
+
+  for (const auto &name : model->composite)
+  {
+    duplicate = IsDuplicate(propagator_seen, name);
+
+    if (!duplicate)
+    {
+      propagator = CreateTextMapPropagator(name);
+      propagators.push_back(std::move(propagator));
+      propagator_seen.push_back(name);
+    }
+  }
+
+  if (model->composite_list.size() > 0)
+  {
+    std::string str_list = model->composite_list;
+    size_t start_pos     = 0;
+    size_t end_pos       = 0;
+    char separator       = ',';
+    std::string name;
+
+    while ((end_pos = str_list.find(separator, start_pos)) != std::string::npos)
+    {
+      name = str_list.substr(start_pos, end_pos - start_pos);
+
+      duplicate = IsDuplicate(propagator_seen, name);
+
+      if (!duplicate)
+      {
+        propagator = CreateTextMapPropagator(name);
+        propagators.push_back(std::move(propagator));
+        propagator_seen.push_back(name);
+      }
+      start_pos = end_pos + 1;
+    }
+
+    name = str_list.substr(start_pos);
+
+    duplicate = IsDuplicate(propagator_seen, name);
+
+    if (!duplicate)
+    {
+      propagator = CreateTextMapPropagator(name);
+      propagators.push_back(std::move(propagator));
+    }
+  }
+
+  if (propagators.size() > 0)
+  {
+    sdk = std::make_unique<opentelemetry::context::propagation::CompositePropagator>(
+        std::move(propagators));
+  }
+
+  return sdk;
+}
+
+static opentelemetry::sdk::metrics::InstrumentType ConvertInstrumentType(
+    enum opentelemetry::sdk::configuration::InstrumentType config)
+{
+  opentelemetry::sdk::metrics::InstrumentType sdk;
+
+  switch (config)
+  {
+    case opentelemetry::sdk::configuration::InstrumentType::none:
+    case opentelemetry::sdk::configuration::InstrumentType::counter:
+      sdk = opentelemetry::sdk::metrics::InstrumentType::kCounter;
+      break;
+    case opentelemetry::sdk::configuration::InstrumentType::histogram:
+      sdk = opentelemetry::sdk::metrics::InstrumentType::kHistogram;
+      break;
+    case opentelemetry::sdk::configuration::InstrumentType::observable_counter:
+      sdk = opentelemetry::sdk::metrics::InstrumentType::kObservableCounter;
+      break;
+    case opentelemetry::sdk::configuration::InstrumentType::observable_gauge:
+      sdk = opentelemetry::sdk::metrics::InstrumentType::kObservableGauge;
+      break;
+    case opentelemetry::sdk::configuration::InstrumentType::observable_up_down_counter:
+      sdk = opentelemetry::sdk::metrics::InstrumentType::kObservableUpDownCounter;
+      break;
+    case opentelemetry::sdk::configuration::InstrumentType::up_down_counter:
+      sdk = opentelemetry::sdk::metrics::InstrumentType::kUpDownCounter;
+      break;
+  }
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter>
+SdkBuilder::CreateOtlpHttpPushMetricExporter(
+    const opentelemetry::sdk::configuration::OtlpHttpPushMetricExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> sdk;
+  const OtlpHttpPushMetricExporterBuilder *builder;
+
+  builder = registry_->GetOtlpHttpPushMetricExporterBuilder();
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateOtlpHttpPushMetricExporter() using registered http builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No http builder for OtlpPushMetricExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter>
+SdkBuilder::CreateOtlpGrpcPushMetricExporter(
+    const opentelemetry::sdk::configuration::OtlpGrpcPushMetricExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> sdk;
+  const OtlpGrpcPushMetricExporterBuilder *builder;
+
+  builder = registry_->GetOtlpGrpcPushMetricExporterBuilder();
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateOtlpGrpcPushMetricExporter() using registered grpc builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No grpc builder for OtlpPushMetricExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter>
+SdkBuilder::CreateOtlpFilePushMetricExporter(
+    const opentelemetry::sdk::configuration::OtlpFilePushMetricExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> sdk;
+  const OtlpFilePushMetricExporterBuilder *builder;
+
+  builder = registry_->GetOtlpFilePushMetricExporterBuilder();
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateOtlpFilePushMetricExporter() using registered file builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No file builder for OtlpPushMetricExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter>
+SdkBuilder::CreateConsolePushMetricExporter(
+    const opentelemetry::sdk::configuration::ConsolePushMetricExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> sdk;
+
+  const ConsolePushMetricExporterBuilder *builder =
+      registry_->GetConsolePushMetricExporterBuilder();
+
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateConsolePushMetricExporter() using registered builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No builder for ConsolePushMetricExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter>
+SdkBuilder::CreateExtensionPushMetricExporter(
+    const opentelemetry::sdk::configuration::ExtensionPushMetricExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> sdk;
+  std::string name = model->name;
+
+  const ExtensionPushMetricExporterBuilder *builder =
+      registry_->GetExtensionPushMetricExporterBuilder(name);
+
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateExtensionPushMetricExporter() using registered builder "
+                            << name);
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  std::string die("No builder for ExtensionPushMetricExporter ");
+  die.append(name);
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::MetricReader>
+SdkBuilder::CreatePrometheusPullMetricExporter(
+    const opentelemetry::sdk::configuration::PrometheusPullMetricExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> sdk;
+
+  const PrometheusPullMetricExporterBuilder *builder =
+      registry_->GetPrometheusPullMetricExporterBuilder();
+
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreatePrometheusPullMetricExporter() using registered builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No builder for PrometheusMetricExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::MetricReader>
+SdkBuilder::CreateExtensionPullMetricExporter(
+    const opentelemetry::sdk::configuration::ExtensionPullMetricExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> sdk;
+  std::string name = model->name;
+
+  const ExtensionPullMetricExporterBuilder *builder =
+      registry_->GetExtensionPullMetricExporterBuilder(name);
+
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateExtensionPullMetricExporter() using registered builder "
+                            << name);
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  std::string die("No builder for ExtensionPullMetricExporter ");
+  die.append(name);
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter>
+SdkBuilder::CreatePushMetricExporter(
+    const std::unique_ptr<opentelemetry::sdk::configuration::PushMetricExporterConfiguration>
+        &model) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::PushMetricExporter> sdk;
+
+  PushMetricExporterBuilder builder(this);
+  model->Accept(&builder);
+  sdk = std::move(builder.exporter);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> SdkBuilder::CreatePullMetricExporter(
+    const std::unique_ptr<opentelemetry::sdk::configuration::PullMetricExporterConfiguration>
+        &model) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> sdk;
+
+  PullMetricExporterBuilder builder(this);
+  model->Accept(&builder);
+  sdk = std::move(builder.exporter);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> SdkBuilder::CreatePeriodicMetricReader(
+    const opentelemetry::sdk::configuration::PeriodicMetricReaderConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> sdk;
+
+  opentelemetry::sdk::metrics::PeriodicExportingMetricReaderOptions options;
+
+  options.export_interval_millis = std::chrono::milliseconds(model->interval);
+  options.export_timeout_millis  = std::chrono::milliseconds(model->timeout);
+
+  auto exporter_sdk = CreatePushMetricExporter(model->exporter);
+
+  if (model->producers.size() > 0)
+  {
+    OTEL_INTERNAL_LOG_WARN("metric producer not supported, ignoring");
+  }
+
+  sdk = opentelemetry::sdk::metrics::PeriodicExportingMetricReaderFactory::Create(
+      std::move(exporter_sdk), options);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> SdkBuilder::CreatePullMetricReader(
+    const opentelemetry::sdk::configuration::PullMetricReaderConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> sdk;
+
+  sdk = CreatePullMetricExporter(model->exporter);
+
+  if (model->producers.size() > 0)
+  {
+    OTEL_INTERNAL_LOG_WARN("metric producer not supported, ignoring");
+  }
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> SdkBuilder::CreateMetricReader(
+    const std::unique_ptr<opentelemetry::sdk::configuration::MetricReaderConfiguration> &model)
+    const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::MetricReader> sdk;
+
+  MetricReaderBuilder builder(this);
+  model->Accept(&builder);
+  sdk = std::move(builder.metric_reader);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::Base2ExponentialHistogramAggregationConfig>
+SdkBuilder::CreateBase2ExponentialBucketHistogramAggregation(
+    const opentelemetry::sdk::configuration::Base2ExponentialBucketHistogramAggregationConfiguration
+        *model) const
+{
+  auto sdk =
+      std::make_unique<opentelemetry::sdk::metrics::Base2ExponentialHistogramAggregationConfig>();
+
+  sdk->max_buckets_    = model->max_size;
+  sdk->max_scale_      = static_cast<int32_t>(model->max_scale);
+  sdk->record_min_max_ = model->record_min_max;
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::HistogramAggregationConfig>
+SdkBuilder::CreateExplicitBucketHistogramAggregation(
+    const opentelemetry::sdk::configuration::ExplicitBucketHistogramAggregationConfiguration *model)
+    const
+{
+  auto sdk = std::make_unique<opentelemetry::sdk::metrics::HistogramAggregationConfig>();
+
+  sdk->boundaries_     = model->boundaries;
+  sdk->record_min_max_ = model->record_min_max;
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::AggregationConfig> SdkBuilder::CreateAggregationConfig(
+    const std::unique_ptr<opentelemetry::sdk::configuration::AggregationConfiguration> &model,
+    opentelemetry::sdk::metrics::AggregationType &aggregation_type) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::AggregationConfig> sdk;
+
+  AggregationConfigBuilder builder(this);
+  model->Accept(&builder);
+  aggregation_type = builder.aggregation_type;
+  sdk              = std::move(builder.aggregation_config);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::AttributesProcessor>
+SdkBuilder::CreateAttributesProcessor(
+    const std::unique_ptr<opentelemetry::sdk::configuration::IncludeExcludeConfiguration>
+        & /* model */) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::AttributesProcessor> sdk;
+
+  // FIXME-SDK: https://github.com/open-telemetry/opentelemetry-cpp/issues/3546
+  // FIXME-SDK: Need a subclass of AttributesProcessor for IncludeExclude
+  OTEL_INTERNAL_LOG_WARN("IncludeExclude attribute processor not supported, ignoring");
+
+  return sdk;
+}
+
+void SdkBuilder::AddView(
+    opentelemetry::sdk::metrics::ViewRegistry *view_registry,
+    const std::unique_ptr<opentelemetry::sdk::configuration::ViewConfiguration> &model) const
+{
+  auto *selector = model->selector.get();
+
+  if (selector->instrument_type == opentelemetry::sdk::configuration::InstrumentType::none)
+  {
+    std::string die("Runtime does not support instrument_type: null");
+    throw UnsupportedException(die);
+  }
+
+  auto sdk_instrument_type = ConvertInstrumentType(selector->instrument_type);
+
+  auto sdk_instrument_selector = std::make_unique<opentelemetry::sdk::metrics::InstrumentSelector>(
+      sdk_instrument_type, selector->instrument_name, selector->unit);
+
+  auto sdk_meter_selector = std::make_unique<opentelemetry::sdk::metrics::MeterSelector>(
+      selector->meter_name, selector->meter_version, selector->meter_schema_url);
+
+  auto *stream = model->stream.get();
+
+  opentelemetry::sdk::metrics::AggregationType sdk_aggregation_type =
+      opentelemetry::sdk::metrics::AggregationType::kDefault;
+
+  std::shared_ptr<opentelemetry::sdk::metrics::AggregationConfig> sdk_aggregation_config;
+
+  sdk_aggregation_config = CreateAggregationConfig(stream->aggregation, sdk_aggregation_type);
+
+  std::unique_ptr<opentelemetry::sdk::metrics::AttributesProcessor> sdk_attribute_processor;
+
+  if (stream->attribute_keys != nullptr)
+  {
+    sdk_attribute_processor = CreateAttributesProcessor(stream->attribute_keys);
+  }
+
+  auto sdk_view = std::make_unique<opentelemetry::sdk::metrics::View>(
+      stream->name, stream->description, sdk_aggregation_type, sdk_aggregation_config,
+      std::move(sdk_attribute_processor));
+
+  view_registry->AddView(std::move(sdk_instrument_selector), std::move(sdk_meter_selector),
+                         std::move(sdk_view));
+}
+
+std::unique_ptr<opentelemetry::sdk::metrics::MeterProvider> SdkBuilder::CreateMeterProvider(
+    const std::unique_ptr<opentelemetry::sdk::configuration::MeterProviderConfiguration> &model,
+    const opentelemetry::sdk::resource::Resource &resource) const
+{
+  std::unique_ptr<opentelemetry::sdk::metrics::MeterProvider> sdk;
+
+  auto view_registry = opentelemetry::sdk::metrics::ViewRegistryFactory::Create();
+
+  for (const auto &view_configuration : model->views)
+  {
+    AddView(view_registry.get(), view_configuration);
+  }
+
+  auto meter_context =
+      opentelemetry::sdk::metrics::MeterContextFactory::Create(std::move(view_registry), resource);
+
+  for (const auto &reader_configuration : model->readers)
+  {
+    std::shared_ptr<opentelemetry::sdk::metrics::MetricReader> metric_reader;
+    metric_reader = CreateMetricReader(reader_configuration);
+    meter_context->AddMetricReader(metric_reader);
+  }
+
+  sdk = opentelemetry::sdk::metrics::MeterProviderFactory::Create(std::move(meter_context));
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter>
+SdkBuilder::CreateOtlpHttpLogRecordExporter(
+    const opentelemetry::sdk::configuration::OtlpHttpLogRecordExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> sdk;
+  const OtlpHttpLogRecordExporterBuilder *builder;
+
+  builder = registry_->GetOtlpHttpLogRecordBuilder();
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateOtlpHttpLogRecordExporter() using registered http builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No http builder for OtlpLogRecordExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter>
+SdkBuilder::CreateOtlpGrpcLogRecordExporter(
+    const opentelemetry::sdk::configuration::OtlpGrpcLogRecordExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> sdk;
+  const OtlpGrpcLogRecordExporterBuilder *builder;
+
+  builder = registry_->GetOtlpGrpcLogRecordBuilder();
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateOtlpGrpcLogRecordExporter() using registered grpc builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No grpc builder for OtlpLogRecordExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter>
+SdkBuilder::CreateOtlpFileLogRecordExporter(
+    const opentelemetry::sdk::configuration::OtlpFileLogRecordExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> sdk;
+  const OtlpFileLogRecordExporterBuilder *builder;
+
+  builder = registry_->GetOtlpFileLogRecordBuilder();
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateOtlpFileLogRecordExporter() using registered file builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No file builder for OtlpLogRecordExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter>
+SdkBuilder::CreateConsoleLogRecordExporter(
+    const opentelemetry::sdk::configuration::ConsoleLogRecordExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> sdk;
+  const ConsoleLogRecordExporterBuilder *builder = registry_->GetConsoleLogRecordBuilder();
+
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateConsoleLogRecordExporter() using registered builder");
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  static const std::string die("No builder for ConsoleLogRecordExporter");
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter>
+SdkBuilder::CreateExtensionLogRecordExporter(
+    const opentelemetry::sdk::configuration::ExtensionLogRecordExporterConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> sdk;
+  std::string name = model->name;
+
+  const ExtensionLogRecordExporterBuilder *builder =
+      registry_->GetExtensionLogRecordExporterBuilder(name);
+
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateExtensionLogRecordExporter() using registered builder " << name);
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  std::string die("CreateExtensionLogRecordExporter() no builder for ");
+  die.append(name);
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> SdkBuilder::CreateLogRecordExporter(
+    const std::unique_ptr<opentelemetry::sdk::configuration::LogRecordExporterConfiguration> &model)
+    const
+{
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordExporter> sdk;
+
+  LogRecordExporterBuilder builder(this);
+  model->Accept(&builder);
+  sdk = std::move(builder.exporter);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor>
+SdkBuilder::CreateBatchLogRecordProcessor(
+    const opentelemetry::sdk::configuration::BatchLogRecordProcessorConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor> sdk;
+  opentelemetry::sdk::logs::BatchLogRecordProcessorOptions options;
+
+  options.schedule_delay_millis = std::chrono::milliseconds(model->schedule_delay);
+  options.max_queue_size        = model->max_queue_size;
+  options.max_export_batch_size = model->max_export_batch_size;
+
+  auto exporter_sdk = CreateLogRecordExporter(model->exporter);
+
+  sdk = opentelemetry::sdk::logs::BatchLogRecordProcessorFactory::Create(std::move(exporter_sdk),
+                                                                         options);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor>
+SdkBuilder::CreateSimpleLogRecordProcessor(
+    const opentelemetry::sdk::configuration::SimpleLogRecordProcessorConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor> sdk;
+
+  auto exporter_sdk = CreateLogRecordExporter(model->exporter);
+
+  sdk = opentelemetry::sdk::logs::SimpleLogRecordProcessorFactory::Create(std::move(exporter_sdk));
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor>
+SdkBuilder::CreateExtensionLogRecordProcessor(
+    const opentelemetry::sdk::configuration::ExtensionLogRecordProcessorConfiguration *model) const
+{
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor> sdk;
+  std::string name = model->name;
+
+  const ExtensionLogRecordProcessorBuilder *builder =
+      registry_->GetExtensionLogRecordProcessorBuilder(name);
+
+  if (builder != nullptr)
+  {
+    OTEL_INTERNAL_LOG_DEBUG("CreateExtensionLogRecordProcessor() using registered builder "
+                            << name);
+    sdk = builder->Build(model);
+    return sdk;
+  }
+
+  std::string die("CreateExtensionLogRecordProcessor() no builder for ");
+  die.append(name);
+  throw UnsupportedException(die);
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor> SdkBuilder::CreateLogRecordProcessor(
+    const std::unique_ptr<opentelemetry::sdk::configuration::LogRecordProcessorConfiguration>
+        &model) const
+{
+  std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor> sdk;
+
+  LogRecordProcessorBuilder builder(this);
+  model->Accept(&builder);
+  sdk = std::move(builder.processor);
+
+  return sdk;
+}
+
+std::unique_ptr<opentelemetry::sdk::logs::LoggerProvider> SdkBuilder::CreateLoggerProvider(
+    const std::unique_ptr<opentelemetry::sdk::configuration::LoggerProviderConfiguration> &model,
+    const opentelemetry::sdk::resource::Resource &resource) const
+{
+  std::unique_ptr<opentelemetry::sdk::logs::LoggerProvider> sdk;
+
+  std::vector<std::unique_ptr<opentelemetry::sdk::logs::LogRecordProcessor>> sdk_processors;
+
+  for (const auto &processor_model : model->processors)
+  {
+    sdk_processors.push_back(CreateLogRecordProcessor(processor_model));
+  }
+
+  // FIXME-SDK: https://github.com/open-telemetry/opentelemetry-cpp/issues/3303
+  // FIXME-SDK: use limits
+  sdk =
+      opentelemetry::sdk::logs::LoggerProviderFactory::Create(std::move(sdk_processors), resource);
+
+  return sdk;
+}
+
+void SdkBuilder::SetResourceAttribute(
+    opentelemetry::sdk::resource::ResourceAttributes &resource_attributes,
+    const std::string &name,
+    const opentelemetry::sdk::configuration::AttributeValueConfiguration *model) const
+{
+  ResourceAttributeValueSetter setter(resource_attributes, name);
+  // Invokes resource_attributes.SetAttribute(name, <proper value from model>)
+  model->Accept(&setter);
+}
+
+void SdkBuilder::SetResource(
+    opentelemetry::sdk::resource::Resource &resource,
+    const std::unique_ptr<opentelemetry::sdk::configuration::ResourceConfiguration> &opt_model)
+    const
+{
+  if (opt_model)
+  {
+    opentelemetry::sdk::resource::ResourceAttributes sdk_attributes;
+
+    // First, scan attributes_list, which has low priority.
+    if (opt_model->attributes_list.size() != 0)
+    {
+      opentelemetry::common::KeyValueStringTokenizer tokenizer{opt_model->attributes_list};
+
+      opentelemetry::nostd::string_view attribute_key;
+      opentelemetry::nostd::string_view attribute_value;
+      bool attribute_valid = true;
+
+      while (tokenizer.next(attribute_valid, attribute_key, attribute_value))
+      {
+        if (attribute_valid)
+        {
+          opentelemetry::common::AttributeValue wrapped_attribute_value(attribute_value);
+          sdk_attributes.SetAttribute(attribute_key, wrapped_attribute_value);
+        }
+        else
+        {
+          OTEL_INTERNAL_LOG_WARN("Found invalid key/value pair in attributes_list");
+        }
+      }
+    }
+
+    // Second, scan attributes, which has high priority.
+    if (opt_model->attributes)
+    {
+      for (const auto &kv : opt_model->attributes->kv_map)
+      {
+        SetResourceAttribute(sdk_attributes, kv.first, kv.second.get());
+      }
+    }
+
+    if (opt_model->detectors != nullptr)
+    {
+      // FIXME-SDK: https://github.com/open-telemetry/opentelemetry-cpp/issues/3548
+      // FIXME-SDK: Implement resource detectors
+      OTEL_INTERNAL_LOG_WARN("resource detectors not supported, ignoring");
+    }
+
+    auto sdk_resource =
+        opentelemetry::sdk::resource::Resource::Create(sdk_attributes, opt_model->schema_url);
+    resource = resource.Merge(sdk_resource);
+  }
+  else
+  {
+    resource = opentelemetry::sdk::resource::Resource::GetDefault();
+  }
+}
+
+std::unique_ptr<ConfiguredSdk> SdkBuilder::CreateConfiguredSdk(
+    const std::unique_ptr<opentelemetry::sdk::configuration::Configuration> &model) const
+{
+  auto sdk = std::make_unique<ConfiguredSdk>();
+
+  if (!model->disabled)
+  {
+    SetResource(sdk->resource, model->resource);
+
+    if (model->attribute_limits)
+    {
+      // FIXME-SDK: https://github.com/open-telemetry/opentelemetry-cpp/issues/3303
+      // FIXME-SDK: Implement attribute limits
+      OTEL_INTERNAL_LOG_WARN("attribute_limits not supported, ignoring");
+    }
+
+    if (model->tracer_provider)
+    {
+      sdk->tracer_provider = CreateTracerProvider(model->tracer_provider, sdk->resource);
+    }
+
+    if (model->propagator)
+    {
+      sdk->propagator = CreatePropagator(model->propagator);
+    }
+
+    if (model->meter_provider)
+    {
+      sdk->meter_provider = CreateMeterProvider(model->meter_provider, sdk->resource);
+    }
+
+    if (model->logger_provider)
+    {
+      sdk->logger_provider = CreateLoggerProvider(model->logger_provider, sdk->resource);
+    }
+  }
+
+  return sdk;
+}
+
+}  // namespace configuration
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/src/logs/batch_log_record_processor.cc b/deps/opentelemetry-cpp/sdk/src/logs/batch_log_record_processor.cc
index 14c88eeed9f..a656ef1f640 100644
--- a/deps/opentelemetry-cpp/sdk/src/logs/batch_log_record_processor.cc
+++ b/deps/opentelemetry-cpp/sdk/src/logs/batch_log_record_processor.cc
@@ -368,6 +368,19 @@ void BatchLogRecordProcessor::GetWaitAdjustedTime(
 }
 
 bool BatchLogRecordProcessor::Shutdown(std::chrono::microseconds timeout) noexcept
+{
+  return InternalShutdown(timeout);
+}
+
+BatchLogRecordProcessor::~BatchLogRecordProcessor()
+{
+  if (synchronization_data_->is_shutdown.load() == false)
+  {
+    InternalShutdown();
+  }
+}
+
+bool BatchLogRecordProcessor::InternalShutdown(std::chrono::microseconds timeout) noexcept
 {
   auto start_time = std::chrono::system_clock::now();
 
@@ -391,14 +404,6 @@ bool BatchLogRecordProcessor::Shutdown(std::chrono::microseconds timeout) noexce
   return true;
 }
 
-BatchLogRecordProcessor::~BatchLogRecordProcessor()
-{
-  if (synchronization_data_->is_shutdown.load() == false)
-  {
-    Shutdown();
-  }
-}
-
 }  // namespace logs
 }  // namespace sdk
 OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/src/logs/multi_log_record_processor.cc b/deps/opentelemetry-cpp/sdk/src/logs/multi_log_record_processor.cc
index 8fdbf083289..d7dc1127d37 100644
--- a/deps/opentelemetry-cpp/sdk/src/logs/multi_log_record_processor.cc
+++ b/deps/opentelemetry-cpp/sdk/src/logs/multi_log_record_processor.cc
@@ -30,8 +30,8 @@ MultiLogRecordProcessor::MultiLogRecordProcessor(
 
 MultiLogRecordProcessor::~MultiLogRecordProcessor()
 {
-  ForceFlush();
-  Shutdown();
+  InternalForceFlush();
+  InternalShutdown();
 }
 
 void MultiLogRecordProcessor::AddProcessor(std::unique_ptr<LogRecordProcessor> &&processor)
@@ -74,6 +74,16 @@ void MultiLogRecordProcessor::OnEmit(std::unique_ptr<Recordable> &&record) noexc
 }
 
 bool MultiLogRecordProcessor::ForceFlush(std::chrono::microseconds timeout) noexcept
+{
+  return InternalForceFlush(timeout);
+}
+
+bool MultiLogRecordProcessor::Shutdown(std::chrono::microseconds timeout) noexcept
+{
+  return InternalShutdown(timeout);
+}
+
+bool MultiLogRecordProcessor::InternalForceFlush(std::chrono::microseconds timeout) noexcept
 {
   bool result           = true;
   auto start_time       = std::chrono::system_clock::now();
@@ -108,7 +118,7 @@ bool MultiLogRecordProcessor::ForceFlush(std::chrono::microseconds timeout) noex
   return result;
 }
 
-bool MultiLogRecordProcessor::Shutdown(std::chrono::microseconds timeout) noexcept
+bool MultiLogRecordProcessor::InternalShutdown(std::chrono::microseconds timeout) noexcept
 {
   bool result           = true;
   auto start_time       = std::chrono::system_clock::now();
diff --git a/deps/opentelemetry-cpp/sdk/src/metrics/CMakeLists.txt b/deps/opentelemetry-cpp/sdk/src/metrics/CMakeLists.txt
index b56fd553e92..73abddc16a7 100644
--- a/deps/opentelemetry-cpp/sdk/src/metrics/CMakeLists.txt
+++ b/deps/opentelemetry-cpp/sdk/src/metrics/CMakeLists.txt
@@ -15,6 +15,7 @@ add_library(
   instrument_metadata_validator.cc
   export/periodic_exporting_metric_reader.cc
   export/periodic_exporting_metric_reader_factory.cc
+  export/periodic_exporting_metric_reader_options.cc
   state/filtered_ordered_attribute_map.cc
   state/metric_collector.cc
   state/observable_registry.cc
diff --git a/deps/opentelemetry-cpp/sdk/src/metrics/export/periodic_exporting_metric_reader_options.cc b/deps/opentelemetry-cpp/sdk/src/metrics/export/periodic_exporting_metric_reader_options.cc
new file mode 100644
index 00000000000..94dbed48f8c
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/src/metrics/export/periodic_exporting_metric_reader_options.cc
@@ -0,0 +1,35 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <chrono>
+
+#include "opentelemetry/nostd/string_view.h"
+#include "opentelemetry/sdk/common/env_variables.h"
+#include "opentelemetry/sdk/metrics/export/periodic_exporting_metric_reader_options.h"
+#include "opentelemetry/version.h"
+
+OPENTELEMETRY_BEGIN_NAMESPACE
+namespace sdk
+{
+namespace metrics
+{
+
+std::chrono::milliseconds GetEnvDuration(nostd::string_view env_var_name,
+                                         std::chrono::milliseconds default_value)
+{
+  std::chrono::system_clock::duration duration;
+  if (common::GetDurationEnvironmentVariable(env_var_name.data(), duration))
+  {
+    return std::chrono::duration_cast<std::chrono::milliseconds>(duration);
+  }
+  return default_value;
+}
+
+PeriodicExportingMetricReaderOptions::PeriodicExportingMetricReaderOptions()
+    : export_interval_millis(GetEnvDuration("OTEL_METRIC_EXPORT_INTERVAL", kExportIntervalMillis)),
+      export_timeout_millis(GetEnvDuration("OTEL_METRIC_EXPORT_TIMEOUT", kExportTimeOutMillis))
+{}
+
+}  // namespace metrics
+}  // namespace sdk
+OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/src/metrics/state/sync_metric_storage.cc b/deps/opentelemetry-cpp/sdk/src/metrics/state/sync_metric_storage.cc
index ad6ea278213..3844d2b05d8 100644
--- a/deps/opentelemetry-cpp/sdk/src/metrics/state/sync_metric_storage.cc
+++ b/deps/opentelemetry-cpp/sdk/src/metrics/state/sync_metric_storage.cc
@@ -9,6 +9,7 @@
 #include "opentelemetry/common/timestamp.h"
 #include "opentelemetry/nostd/function_ref.h"
 #include "opentelemetry/nostd/span.h"
+#include "opentelemetry/sdk/metrics/aggregation/aggregation_config.h"
 #include "opentelemetry/sdk/metrics/data/metric_data.h"
 #include "opentelemetry/sdk/metrics/state/attributes_hashmap.h"
 #include "opentelemetry/sdk/metrics/state/metric_collector.h"
@@ -35,7 +36,7 @@ bool SyncMetricStorage::Collect(CollectorHandle *collector,
   {
     std::lock_guard<opentelemetry::common::SpinLockMutex> guard(attribute_hashmap_lock_);
     delta_metrics = std::move(attributes_hashmap_);
-    attributes_hashmap_.reset(new AttributesHashMap);
+    attributes_hashmap_.reset(new AttributesHashMap(aggregation_config_->cardinality_limit_));
   }
 
   return temporal_metric_storage_.buildMetrics(collector, collectors, sdk_start_ts, collection_ts,
diff --git a/deps/opentelemetry-cpp/sdk/src/metrics/state/temporal_metric_storage.cc b/deps/opentelemetry-cpp/sdk/src/metrics/state/temporal_metric_storage.cc
index fb839ffd7ce..9e991f73f94 100644
--- a/deps/opentelemetry-cpp/sdk/src/metrics/state/temporal_metric_storage.cc
+++ b/deps/opentelemetry-cpp/sdk/src/metrics/state/temporal_metric_storage.cc
@@ -97,7 +97,9 @@ bool TemporalMetricStorage::buildMetrics(CollectorHandle *collector,
   }
   auto unreported_list = std::move(present->second);
   // Iterate over the unreporter metrics for `collector` and store result in `merged_metrics`
-  std::unique_ptr<AttributesHashMap> merged_metrics(new AttributesHashMap);
+  std::unique_ptr<AttributesHashMap> merged_metrics(
+      new AttributesHashMap(aggregation_config_ ? aggregation_config_->cardinality_limit_
+                                                : kAggregationCardinalityLimit));
   for (auto &agg_hashmap : unreported_list)
   {
     agg_hashmap->GetAllEnteries(
diff --git a/deps/opentelemetry-cpp/sdk/src/metrics/view/view_factory.cc b/deps/opentelemetry-cpp/sdk/src/metrics/view/view_factory.cc
index 319c10b956b..13d4678ece1 100644
--- a/deps/opentelemetry-cpp/sdk/src/metrics/view/view_factory.cc
+++ b/deps/opentelemetry-cpp/sdk/src/metrics/view/view_factory.cc
@@ -25,46 +25,36 @@ std::unique_ptr<View> ViewFactory::Create(const std::string &name)
 
 std::unique_ptr<View> ViewFactory::Create(const std::string &name, const std::string &description)
 {
-  return Create(name, description, "", AggregationType::kDefault);
+  return Create(name, description, AggregationType::kDefault);
 }
 
 std::unique_ptr<View> ViewFactory::Create(const std::string &name,
                                           const std::string &description,
-                                          const std::string &unit)
-{
-  return Create(name, description, unit, AggregationType::kDefault);
-}
-
-std::unique_ptr<View> ViewFactory::Create(const std::string &name,
-                                          const std::string &description,
-                                          const std::string &unit,
                                           AggregationType aggregation_type)
 {
   std::shared_ptr<AggregationConfig> aggregation_config(nullptr);
-  return Create(name, description, unit, aggregation_type, aggregation_config);
+  return Create(name, description, aggregation_type, aggregation_config);
 }
 
 std::unique_ptr<View> ViewFactory::Create(const std::string &name,
                                           const std::string &description,
-                                          const std::string &unit,
                                           AggregationType aggregation_type,
                                           std::shared_ptr<AggregationConfig> aggregation_config)
 {
   auto attributes_processor =
       std::unique_ptr<AttributesProcessor>(new DefaultAttributesProcessor());
 
-  return Create(name, description, unit, aggregation_type, std::move(aggregation_config),
+  return Create(name, description, aggregation_type, std::move(aggregation_config),
                 std::move(attributes_processor));
 }
 
 std::unique_ptr<View> ViewFactory::Create(const std::string &name,
                                           const std::string &description,
-                                          const std::string &unit,
                                           AggregationType aggregation_type,
                                           std::shared_ptr<AggregationConfig> aggregation_config,
                                           std::unique_ptr<AttributesProcessor> attributes_processor)
 {
-  std::unique_ptr<View> view(new View(name, description, unit, aggregation_type,
+  std::unique_ptr<View> view(new View(name, description, aggregation_type,
                                       std::move(aggregation_config),
                                       std::move(attributes_processor)));
   return view;
diff --git a/deps/opentelemetry-cpp/sdk/src/resource/resource.cc b/deps/opentelemetry-cpp/sdk/src/resource/resource.cc
index 5ae5446e805..95b41498f8d 100644
--- a/deps/opentelemetry-cpp/sdk/src/resource/resource.cc
+++ b/deps/opentelemetry-cpp/sdk/src/resource/resource.cc
@@ -20,6 +20,12 @@ namespace sdk
 namespace resource
 {
 
+Resource::Resource() noexcept : attributes_(), schema_url_() {}
+
+Resource::Resource(const ResourceAttributes &attributes) noexcept
+    : attributes_(attributes), schema_url_()
+{}
+
 Resource::Resource(const ResourceAttributes &attributes, const std::string &schema_url) noexcept
     : attributes_(attributes), schema_url_(schema_url)
 {}
diff --git a/deps/opentelemetry-cpp/sdk/src/resource/resource_detector.cc b/deps/opentelemetry-cpp/sdk/src/resource/resource_detector.cc
index 3158f2a43d9..f51d9a2a70a 100644
--- a/deps/opentelemetry-cpp/sdk/src/resource/resource_detector.cc
+++ b/deps/opentelemetry-cpp/sdk/src/resource/resource_detector.cc
@@ -19,8 +19,8 @@ namespace sdk
 namespace resource
 {
 
-const char *OTEL_RESOURCE_ATTRIBUTES = "OTEL_RESOURCE_ATTRIBUTES";
-const char *OTEL_SERVICE_NAME        = "OTEL_SERVICE_NAME";
+constexpr const char *kOtelResourceAttributes = "OTEL_RESOURCE_ATTRIBUTES";
+constexpr const char *kOtelServiceName        = "OTEL_SERVICE_NAME";
 
 Resource ResourceDetector::Create(const ResourceAttributes &attributes,
                                   const std::string &schema_url)
@@ -33,9 +33,9 @@ Resource OTELResourceDetector::Detect() noexcept
   std::string attributes_str, service_name;
 
   bool attributes_exists = opentelemetry::sdk::common::GetStringEnvironmentVariable(
-      OTEL_RESOURCE_ATTRIBUTES, attributes_str);
+      kOtelResourceAttributes, attributes_str);
   bool service_name_exists =
-      opentelemetry::sdk::common::GetStringEnvironmentVariable(OTEL_SERVICE_NAME, service_name);
+      opentelemetry::sdk::common::GetStringEnvironmentVariable(kOtelServiceName, service_name);
 
   if (!attributes_exists && !service_name_exists)
   {
diff --git a/deps/opentelemetry-cpp/sdk/src/trace/batch_span_processor.cc b/deps/opentelemetry-cpp/sdk/src/trace/batch_span_processor.cc
index 5ec2376656f..ad93eae7aec 100644
--- a/deps/opentelemetry-cpp/sdk/src/trace/batch_span_processor.cc
+++ b/deps/opentelemetry-cpp/sdk/src/trace/batch_span_processor.cc
@@ -358,6 +358,19 @@ void BatchSpanProcessor::GetWaitAdjustedTime(
 }
 
 bool BatchSpanProcessor::Shutdown(std::chrono::microseconds timeout) noexcept
+{
+  return InternalShutdown(timeout);
+}
+
+BatchSpanProcessor::~BatchSpanProcessor()
+{
+  if (synchronization_data_->is_shutdown.load() == false)
+  {
+    InternalShutdown();
+  }
+}
+
+bool BatchSpanProcessor::InternalShutdown(std::chrono::microseconds timeout) noexcept
 {
   auto start_time = std::chrono::system_clock::now();
   std::lock_guard<std::mutex> shutdown_guard{synchronization_data_->shutdown_m};
@@ -380,14 +393,6 @@ bool BatchSpanProcessor::Shutdown(std::chrono::microseconds timeout) noexcept
   return true;
 }
 
-BatchSpanProcessor::~BatchSpanProcessor()
-{
-  if (synchronization_data_->is_shutdown.load() == false)
-  {
-    Shutdown();
-  }
-}
-
 }  // namespace trace
 }  // namespace sdk
 OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/src/trace/samplers/parent.cc b/deps/opentelemetry-cpp/sdk/src/trace/samplers/parent.cc
index 1e7dd9ba3df..e77db2e4aec 100644
--- a/deps/opentelemetry-cpp/sdk/src/trace/samplers/parent.cc
+++ b/deps/opentelemetry-cpp/sdk/src/trace/samplers/parent.cc
@@ -1,7 +1,6 @@
 // Copyright The OpenTelemetry Authors
 // SPDX-License-Identifier: Apache-2.0
 
-#include <map>
 #include <memory>
 #include <string>
 
@@ -21,9 +20,18 @@ namespace sdk
 {
 namespace trace
 {
-ParentBasedSampler::ParentBasedSampler(const std::shared_ptr<Sampler> &delegate_sampler) noexcept
-    : delegate_sampler_(delegate_sampler),
-      description_("ParentBased{" + std::string{delegate_sampler->GetDescription()} + "}")
+ParentBasedSampler::ParentBasedSampler(
+    const std::shared_ptr<Sampler> &root_sampler,
+    const std::shared_ptr<Sampler> &remote_parent_sampled_sampler,
+    const std::shared_ptr<Sampler> &remote_parent_nonsampled_sampler,
+    const std::shared_ptr<Sampler> &local_parent_sampled_sampler,
+    const std::shared_ptr<Sampler> &local_parent_nonsampled_sampler) noexcept
+    : root_sampler_(root_sampler),
+      remote_parent_sampled_sampler_(remote_parent_sampled_sampler),
+      remote_parent_nonsampled_sampler_(remote_parent_nonsampled_sampler),
+      local_parent_sampled_sampler_(local_parent_sampled_sampler),
+      local_parent_nonsampled_sampler_(local_parent_nonsampled_sampler),
+      description_("ParentBased{" + std::string{root_sampler->GetDescription()} + "}")
 {}
 
 SamplingResult ParentBasedSampler::ShouldSample(
@@ -36,24 +44,38 @@ SamplingResult ParentBasedSampler::ShouldSample(
 {
   if (!parent_context.IsValid())
   {
-    // If no parent (root span) exists returns the result of the delegateSampler
-    return delegate_sampler_->ShouldSample(parent_context, trace_id, name, span_kind, attributes,
-                                           links);
+    // If no parent (root span) exists returns the result of the root_sampler
+    return root_sampler_->ShouldSample(parent_context, trace_id, name, span_kind, attributes,
+                                       links);
   }
 
   // If parent exists:
   if (parent_context.IsSampled())
   {
-    return {Decision::RECORD_AND_SAMPLE, nullptr, parent_context.trace_state()};
+    if (parent_context.IsRemote())
+    {
+      return remote_parent_sampled_sampler_->ShouldSample(parent_context, trace_id, name, span_kind,
+                                                          attributes, links);
+    }
+    return local_parent_sampled_sampler_->ShouldSample(parent_context, trace_id, name, span_kind,
+                                                       attributes, links);
   }
 
-  return {Decision::DROP, nullptr, parent_context.trace_state()};
+  // Parent is not sampled
+  if (parent_context.IsRemote())
+  {
+    return remote_parent_nonsampled_sampler_->ShouldSample(parent_context, trace_id, name,
+                                                           span_kind, attributes, links);
+  }
+  return local_parent_nonsampled_sampler_->ShouldSample(parent_context, trace_id, name, span_kind,
+                                                        attributes, links);
 }
 
 nostd::string_view ParentBasedSampler::GetDescription() const noexcept
 {
   return description_;
 }
+
 }  // namespace trace
 }  // namespace sdk
 OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/src/trace/samplers/parent_factory.cc b/deps/opentelemetry-cpp/sdk/src/trace/samplers/parent_factory.cc
index 25a2e94f653..a927ee7b2ea 100644
--- a/deps/opentelemetry-cpp/sdk/src/trace/samplers/parent_factory.cc
+++ b/deps/opentelemetry-cpp/sdk/src/trace/samplers/parent_factory.cc
@@ -4,6 +4,8 @@
 #include <memory>
 
 #include "opentelemetry/sdk/trace/sampler.h"
+#include "opentelemetry/sdk/trace/samplers/always_off.h"
+#include "opentelemetry/sdk/trace/samplers/always_on.h"
 #include "opentelemetry/sdk/trace/samplers/parent.h"
 #include "opentelemetry/sdk/trace/samplers/parent_factory.h"
 #include "opentelemetry/version.h"
@@ -15,9 +17,24 @@ namespace trace
 {
 
 std::unique_ptr<Sampler> ParentBasedSamplerFactory::Create(
-    const std::shared_ptr<Sampler> &delegate_sampler)
+    const std::shared_ptr<Sampler> &root_sampler)
 {
-  std::unique_ptr<Sampler> sampler(new ParentBasedSampler(delegate_sampler));
+  std::unique_ptr<Sampler> sampler = ParentBasedSamplerFactory::Create(
+      root_sampler, std::make_shared<AlwaysOnSampler>(), std::make_shared<AlwaysOffSampler>(),
+      std::make_shared<AlwaysOnSampler>(), std::make_shared<AlwaysOffSampler>());
+  return sampler;
+}
+
+std::unique_ptr<Sampler> ParentBasedSamplerFactory::Create(
+    const std::shared_ptr<Sampler> &root_sampler,
+    const std::shared_ptr<Sampler> &remote_parent_sampled_sampler,
+    const std::shared_ptr<Sampler> &remote_parent_nonsampled_sampler,
+    const std::shared_ptr<Sampler> &local_parent_sampled_sampler,
+    const std::shared_ptr<Sampler> &local_parent_nonsampled_sampler)
+{
+  std::unique_ptr<Sampler> sampler(new ParentBasedSampler(
+      root_sampler, remote_parent_sampled_sampler, remote_parent_nonsampled_sampler,
+      local_parent_sampled_sampler, local_parent_nonsampled_sampler));
   return sampler;
 }
 
diff --git a/deps/opentelemetry-cpp/sdk/src/trace/samplers/trace_id_ratio.cc b/deps/opentelemetry-cpp/sdk/src/trace/samplers/trace_id_ratio.cc
index fcb074ffc61..6d7009fedff 100644
--- a/deps/opentelemetry-cpp/sdk/src/trace/samplers/trace_id_ratio.cc
+++ b/deps/opentelemetry-cpp/sdk/src/trace/samplers/trace_id_ratio.cc
@@ -4,11 +4,11 @@
 
 #include <cmath>
 #include <cstdint>
-#include <cstring>
 #include <map>
 #include <memory>
 #include <string>
 
+#include "opentelemetry/nostd/span.h"
 #include "opentelemetry/nostd/string_view.h"
 #include "opentelemetry/sdk/trace/sampler.h"
 #include "opentelemetry/sdk/trace/samplers/trace_id_ratio.h"
@@ -56,8 +56,13 @@ uint64_t CalculateThresholdFromBuffer(const trace_api::TraceId &trace_id) noexce
   // We only use the first 8 bytes of TraceId.
   static_assert(trace_api::TraceId::kSize >= 8, "TraceID must be at least 8 bytes long.");
 
-  uint64_t res = 0;
-  std::memcpy(&res, &trace_id, 8);
+  // Always interpret as big-endian
+  const uint8_t *data = trace_id.Id().data();
+  uint64_t res        = 0;
+  for (int i = 0; i < 8; ++i)
+  {
+    res = (res << 8) | data[i];
+  }
 
   double ratio = static_cast<double>(res) / static_cast<double>(UINT64_MAX);
 
diff --git a/deps/opentelemetry-cpp/sdk/src/version/version.cc b/deps/opentelemetry-cpp/sdk/src/version/version.cc
index 451f7d38eda..fb343dc0f52 100644
--- a/deps/opentelemetry-cpp/sdk/src/version/version.cc
+++ b/deps/opentelemetry-cpp/sdk/src/version/version.cc
@@ -12,13 +12,13 @@ namespace sdk
 namespace version
 {
 const int major_version    = 1;
-const int minor_version    = 22;
+const int minor_version    = 23;
 const int patch_version    = 0;
-const char *pre_release    = "NONE";
-const char *build_metadata = "NONE";
-const char *short_version  = "1.22.0";
-const char *full_version   = "1.22.0-NONE-NONE";
-const char *build_date     = "Fri Jul 11 08:13:24 PM UTC 2025";
+const char *pre_release    = "";
+const char *build_metadata = "none";
+const char *short_version  = "1.23.0";
+const char *full_version   = "1.23.0";
+const char *build_date     = "Thu Sep 25 07:47:31 PM UTC 2025";
 }  // namespace version
 }  // namespace sdk
 OPENTELEMETRY_END_NAMESPACE
diff --git a/deps/opentelemetry-cpp/sdk/test/configuration/yaml_metrics_test.cc b/deps/opentelemetry-cpp/sdk/test/configuration/yaml_metrics_test.cc
index 8f963f293e0..4b202c2cf1c 100644
--- a/deps/opentelemetry-cpp/sdk/test/configuration/yaml_metrics_test.cc
+++ b/deps/opentelemetry-cpp/sdk/test/configuration/yaml_metrics_test.cc
@@ -144,7 +144,7 @@ file_format: xx.yy
   readers:
     - pull:
         exporter:
-          prometheus:
+          prometheus/development:
 )";
 
   auto config = DoParse(yaml);
@@ -519,7 +519,7 @@ file_format: xx.yy
   readers:
     - pull:
         exporter:
-          prometheus:
+          prometheus/development:
 )";
 
   auto config = DoParse(yaml);
@@ -550,7 +550,7 @@ file_format: xx.yy
   readers:
     - pull:
         exporter:
-          prometheus:
+          prometheus/development:
             host: "prometheus"
             port: 1234
             without_units: true
diff --git a/deps/opentelemetry-cpp/sdk/test/configuration/yaml_propagator_test.cc b/deps/opentelemetry-cpp/sdk/test/configuration/yaml_propagator_test.cc
new file mode 100644
index 00000000000..cba8bde4dad
--- /dev/null
+++ b/deps/opentelemetry-cpp/sdk/test/configuration/yaml_propagator_test.cc
@@ -0,0 +1,172 @@
+// Copyright The OpenTelemetry Authors
+// SPDX-License-Identifier: Apache-2.0
+
+#include <gtest/gtest.h>
+#include <memory>
+#include <string>
+#include <vector>
+
+#include "opentelemetry/sdk/configuration/configuration.h"
+#include "opentelemetry/sdk/configuration/propagator_configuration.h"
+#include "opentelemetry/sdk/configuration/yaml_configuration_parser.h"
+
+static std::unique_ptr<opentelemetry::sdk::configuration::Configuration> DoParse(
+    const std::string &yaml)
+{
+  static const std::string source("test");
+  return opentelemetry::sdk::configuration::YamlConfigurationParser::ParseString(source, yaml);
+}
+
+TEST(YamlPropagator, empty_propagator)
+{
+  std::string yaml = R"(
+file_format: xx.yy
+propagator:
+)";
+
+  auto config = DoParse(yaml);
+  ASSERT_NE(config, nullptr);
+  ASSERT_NE(config->propagator, nullptr);
+  ASSERT_EQ(config->propagator->composite.size(), 0);
+  ASSERT_EQ(config->propagator->composite_list, "");
+}
+
+TEST(YamlPropagator, empty_composite)
+{
+  std::string yaml = R"(
+file_format: xx.yy
+propagator:
+  composite:
+)";
+
+  auto config = DoParse(yaml);
+  ASSERT_NE(config, nullptr);
+  ASSERT_NE(config->propagator, nullptr);
+  ASSERT_EQ(config->propagator->composite.size(), 0);
+  ASSERT_EQ(config->propagator->composite_list, "");
+}
+
+TEST(YamlPropagator, old_propagator_1)
+{
+  // This is the old format, must fail
+  std::string yaml = R"(
+file_format: xx.yy
+propagator:
+  composite:
+    - foo
+    - bar
+)";
+
+  auto config = DoParse(yaml);
+  ASSERT_EQ(config, nullptr);
+}
+
+TEST(YamlPropagator, old_propagator_2)
+{
+  // This is the old format, must fail
+  std::string yaml = R"(
+file_format: xx.yy
+propagator:
+  composite: [foo, bar]
+)";
+
+  auto config = DoParse(yaml);
+  ASSERT_EQ(config, nullptr);
+}
+
+TEST(YamlPropagator, propagator_array_ok)
+{
+  std::string yaml = R"(
+file_format: xx.yy
+propagator:
+  composite:
+    - foo:
+    - bar:
+    - baz:
+)";
+
+  auto config = DoParse(yaml);
+  ASSERT_NE(config, nullptr);
+  ASSERT_NE(config->propagator, nullptr);
+  ASSERT_EQ(config->propagator->composite.size(), 3);
+  ASSERT_EQ(config->propagator->composite[0], "foo");
+  ASSERT_EQ(config->propagator->composite[1], "bar");
+  ASSERT_EQ(config->propagator->composite[2], "baz");
+  ASSERT_EQ(config->propagator->composite_list, "");
+}
+
+TEST(YamlPropagator, propagator_array_broken)
+{
+  std::string yaml = R"(
+file_format: xx.yy
+propagator:
+  composite:
+    - foo:
+    - bar:
+      baz:
+)";
+
+  auto config = DoParse(yaml);
+  ASSERT_EQ(config, nullptr);
+}
+
+TEST(YamlPropagator, propagator_composite_list)
+{
+  std::string yaml = R"(
+file_format: xx.yy
+propagator:
+  composite_list: "foo,bar,baz"
+)";
+
+  auto config = DoParse(yaml);
+  ASSERT_NE(config, nullptr);
+  ASSERT_NE(config->propagator, nullptr);
+  ASSERT_EQ(config->propagator->composite.size(), 0);
+  ASSERT_EQ(config->propagator->composite_list, "foo,bar,baz");
+}
+
+TEST(YamlPropagator, propagator_both)
+{
+  std::string yaml = R"(
+file_format: xx.yy
+propagator:
+  composite:
+    - aaa:
+    - bbb:
+    - ccc:
+  composite_list: "ddd,eee,fff"
+)";
+
+  auto config = DoParse(yaml);
+  ASSERT_NE(config, nullptr);
+  ASSERT_NE(config->propagator, nullptr);
+  ASSERT_EQ(config->propagator->composite.size(), 3);
+  ASSERT_EQ(config->propagator->composite[0], "aaa");
+  ASSERT_EQ(config->propagator->composite[1], "bbb");
+  ASSERT_EQ(config->propagator->composite[2], "ccc");
+  ASSERT_EQ(config->propagator->composite_list, "ddd,eee,fff");
+}
+
+TEST(YamlPropagator, propagator_duplicates)
+{
+  std::string yaml = R"(
+file_format: xx.yy
+propagator:
+  composite:
+    - aaa:
+    - bbb:
+    - bbb:
+    - ccc:
+  composite_list: "aaa,eee,eee,fff,ccc"
+)";
+
+  auto config = DoParse(yaml);
+  ASSERT_NE(config, nullptr);
+  ASSERT_NE(config->propagator, nullptr);
+  ASSERT_EQ(config->propagator->composite.size(), 4);
+  ASSERT_EQ(config->propagator->composite[0], "aaa");
+  ASSERT_EQ(config->propagator->composite[1], "bbb");
+  ASSERT_EQ(config->propagator->composite[2], "bbb");
+  ASSERT_EQ(config->propagator->composite[3], "ccc");
+  ASSERT_EQ(config->propagator->composite_list, "aaa,eee,eee,fff,ccc");
+}
diff --git a/deps/opentelemetry-cpp/sdk/test/metrics/async_metric_storage_test.cc b/deps/opentelemetry-cpp/sdk/test/metrics/async_metric_storage_test.cc
index f6213793841..380ddd05643 100644
--- a/deps/opentelemetry-cpp/sdk/test/metrics/async_metric_storage_test.cc
+++ b/deps/opentelemetry-cpp/sdk/test/metrics/async_metric_storage_test.cc
@@ -25,11 +25,13 @@
 #include "opentelemetry/sdk/metrics/state/attributes_hashmap.h"
 #include "opentelemetry/sdk/metrics/state/filtered_ordered_attribute_map.h"
 #include "opentelemetry/sdk/metrics/state/metric_collector.h"
-#include "opentelemetry/sdk/metrics/view/attributes_processor.h"
 
 #ifdef ENABLE_METRICS_EXEMPLAR_PREVIEW
+#  include "opentelemetry/sdk/metrics/data/exemplar_data.h"
 #  include "opentelemetry/sdk/metrics/exemplar/filter_type.h"
 #  include "opentelemetry/sdk/metrics/exemplar/reservoir.h"
+#else
+#  include "opentelemetry/sdk/metrics/view/attributes_processor.h"
 #endif
 
 using namespace opentelemetry::sdk::metrics;
@@ -192,8 +194,10 @@ TEST_P(WritableMetricStorageTestUpDownFixture, TestAggregation)
         }
         return true;
       });
-  // subsequent recording after collection shouldn't fail
-  // monotonic increasing values;
+  // Note: When the cardinality limit is set to n, the attributes hashmap emits n-1 distinct
+  // attribute sets, plus an overflow bucket for additional attributes. The test logic below is made
+  // generic to succeed for either n or n-1 total cardinality. If this behavior is unexpected,
+  // please investigate and file an issue.
   int64_t get_count2 = -50;
   int64_t put_count2 = -70;
 
diff --git a/deps/opentelemetry-cpp/sdk/test/metrics/attributes_hashmap_test.cc b/deps/opentelemetry-cpp/sdk/test/metrics/attributes_hashmap_test.cc
index c51f4fe8003..944bbef3b69 100644
--- a/deps/opentelemetry-cpp/sdk/test/metrics/attributes_hashmap_test.cc
+++ b/deps/opentelemetry-cpp/sdk/test/metrics/attributes_hashmap_test.cc
@@ -158,3 +158,67 @@ TEST(AttributesHashMap, HashConsistencyAcrossStringTypes)
   EXPECT_EQ(hash_c_str, hash_std_str_view);
 #endif
 }
+
+TEST(AttributesHashMap, OverflowCardinalityLimitBehavior)
+{
+  // Configure a very small limit to exercise overflow logic easily.
+  const size_t limit = 4;  // real attributes limit
+  AttributesHashMapWithCustomHash<> map(limit);
+
+  // We expect to be able to insert exactly 'limit' distinct real attribute sets.
+  // After that, further distinct attributes should route to the overflow bucket,
+  // which should appear only once regardless of how many additional unique sets arrive.
+
+  // Insert distinct attributes up to the limit.
+  for (size_t i = 0; i < limit; ++i)
+  {
+    MetricAttributes attr = {{"k", std::to_string(i)}};
+    map.GetOrSetDefault(attr, []() { return std::unique_ptr<Aggregation>(new DropAggregation()); })
+        ->Aggregate(static_cast<int64_t>(1));
+  }
+
+  // Size should be exactly 'limit' (no overflow yet)
+  EXPECT_EQ(map.Size(), limit);
+
+  // Insert one more distinct attribute; this should not increase the real attributes count
+  MetricAttributes overflow_trigger = {{"k", "overflow"}};
+  map.GetOrSetDefault(overflow_trigger,
+                      []() { return std::unique_ptr<Aggregation>(new DropAggregation()); })
+      ->Aggregate(static_cast<int64_t>(1));
+
+  EXPECT_EQ(map.Size(), limit);
+
+  // Insert several more unique attributes - size must remain constant (limit)
+  for (size_t i = 0; i < limit - 1; ++i)
+  {
+    MetricAttributes extra_attr = {{"k", std::string("extra") + std::to_string(i)}};
+    map.GetOrSetDefault(extra_attr,
+                        []() { return std::unique_ptr<Aggregation>(new DropAggregation()); })
+        ->Aggregate(static_cast<int64_t>(1));
+  }
+  EXPECT_EQ(map.Size(), limit);
+
+  // Ensure overflow key was actually created and accessible via Get
+  EXPECT_NE(map.Get(kOverflowAttributes), nullptr);
+
+  // Ensure original real attributes still present
+  for (size_t i = 0; i < limit - 1; ++i)
+  {
+    MetricAttributes attr = {{"k", std::to_string(i)}};
+    EXPECT_NE(map.Get(attr), nullptr);
+  }
+
+  // Copy the hash map to a new map in non-determistic order and verify all entries are present
+  AttributesHashMapWithCustomHash<> map_copy(limit);
+  map.GetAllEnteries([&map_copy](const MetricAttributes &attributes, Aggregation &) {
+    map_copy.Set(attributes, std::unique_ptr<Aggregation>(new DropAggregation()));
+    return true;
+  });
+  EXPECT_EQ(map_copy.Size(), map.Size());
+  EXPECT_NE(map_copy.Get(kOverflowAttributes), nullptr);
+  for (size_t i = 0; i < limit - 1; ++i)
+  {
+    MetricAttributes attr = {{"k", std::to_string(i)}};
+    EXPECT_NE(map_copy.Get(attr), nullptr);
+  }
+}
diff --git a/deps/opentelemetry-cpp/sdk/test/metrics/attributes_processor_benchmark.cc b/deps/opentelemetry-cpp/sdk/test/metrics/attributes_processor_benchmark.cc
index 02923c56424..c64aa6a77c4 100644
--- a/deps/opentelemetry-cpp/sdk/test/metrics/attributes_processor_benchmark.cc
+++ b/deps/opentelemetry-cpp/sdk/test/metrics/attributes_processor_benchmark.cc
@@ -4,7 +4,6 @@
 #include <benchmark/benchmark.h>
 #include <map>
 #include <string>
-#include <unordered_map>
 #include <utility>
 
 #include "opentelemetry/common/key_value_iterable_view.h"
diff --git a/deps/opentelemetry-cpp/sdk/test/metrics/attributes_processor_test.cc b/deps/opentelemetry-cpp/sdk/test/metrics/attributes_processor_test.cc
index 25652ed3e15..3e13f0e1011 100644
--- a/deps/opentelemetry-cpp/sdk/test/metrics/attributes_processor_test.cc
+++ b/deps/opentelemetry-cpp/sdk/test/metrics/attributes_processor_test.cc
@@ -8,7 +8,7 @@
 #include <utility>
 
 #include "opentelemetry/common/key_value_iterable_view.h"
-#include "opentelemetry/sdk/common/attribute_utils.h"
+#include "opentelemetry/sdk/common/custom_hash_equality.h"
 #include "opentelemetry/sdk/metrics/view/attributes_processor.h"
 
 using namespace opentelemetry::sdk::metrics;
@@ -17,8 +17,8 @@ using namespace opentelemetry::sdk::common;
 
 TEST(AttributesProcessor, FilteringAttributesProcessor)
 {
-  const int kNumFilterAttributes               = 3;
-  std::unordered_map<std::string, bool> filter = {
+  const int kNumFilterAttributes                         = 3;
+  opentelemetry::sdk::metrics::FilterAttributeMap filter = {
       {"attr2", true}, {"attr4", true}, {"attr6", true}};
   const int kNumAttributes              = 6;
   std::string keys[kNumAttributes]      = {"attr1", "attr2", "attr3", "attr4", "attr5", "attr6"};
@@ -38,9 +38,9 @@ TEST(AttributesProcessor, FilteringAttributesProcessor)
 
 TEST(AttributesProcessor, FilteringAllAttributesProcessor)
 {
-  const int kNumFilterAttributes               = 0;
-  std::unordered_map<std::string, bool> filter = {};
-  const int kNumAttributes                     = 6;
+  const int kNumFilterAttributes                         = 0;
+  opentelemetry::sdk::metrics::FilterAttributeMap filter = {};
+  const int kNumAttributes                               = 6;
   std::string keys[kNumAttributes]      = {"attr1", "attr2", "attr3", "attr4", "attr5", "attr6"};
   int values[kNumAttributes]            = {10, 20, 30, 40, 50, 60};
   std::map<std::string, int> attributes = {{keys[0], values[0]}, {keys[1], values[1]},
@@ -51,3 +51,40 @@ TEST(AttributesProcessor, FilteringAllAttributesProcessor)
   auto filtered_attributes = attributes_processor.process(iterable);
   EXPECT_EQ(filter.size(), kNumFilterAttributes);
 }
+
+TEST(AttributesProcessor, FilteringExcludeAttributesProcessor)
+{
+  opentelemetry::sdk::metrics::FilterAttributeMap filter = {
+      {"attr2", true}, {"attr4", true}, {"attr6", true}};
+  const int kNumAttributes              = 7;
+  std::string keys[kNumAttributes]      = {"attr1", "attr2", "attr3", "attr4",
+                                           "attr5", "attr6", "attr7"};
+  int values[kNumAttributes]            = {10, 20, 30, 40, 50, 60, 70};
+  std::map<std::string, int> attributes = {
+      {keys[0], values[0]}, {keys[1], values[1]}, {keys[2], values[2]}, {keys[3], values[3]},
+      {keys[4], values[4]}, {keys[5], values[5]}, {keys[6], values[6]}};
+  FilteringExcludeAttributesProcessor attributes_processor(filter);
+  opentelemetry::common::KeyValueIterableView<std::map<std::string, int>> iterable(attributes);
+  auto filtered_attributes = attributes_processor.process(iterable);
+  for (auto &e : filtered_attributes)
+  {
+    EXPECT_TRUE(filter.find(e.first) == filter.end());
+  }
+  int expected_filtered_attributes_size = 4;
+  EXPECT_EQ(filtered_attributes.size(), expected_filtered_attributes_size);
+}
+
+TEST(AttributesProcessor, FilteringExcludeAllAttributesProcessor)
+{
+  opentelemetry::sdk::metrics::FilterAttributeMap filter = {};
+  const int kNumAttributes                               = 6;
+  std::string keys[kNumAttributes]      = {"attr1", "attr2", "attr3", "attr4", "attr5", "attr6"};
+  int values[kNumAttributes]            = {10, 20, 30, 40, 50, 60};
+  std::map<std::string, int> attributes = {{keys[0], values[0]}, {keys[1], values[1]},
+                                           {keys[2], values[2]}, {keys[3], values[3]},
+                                           {keys[4], values[4]}, {keys[5], values[5]}};
+  FilteringExcludeAttributesProcessor attributes_processor(filter);
+  opentelemetry::common::KeyValueIterableView<std::map<std::string, int>> iterable(attributes);
+  auto filtered_attributes = attributes_processor.process(iterable);
+  EXPECT_EQ(filtered_attributes.size(), kNumAttributes);
+}
diff --git a/deps/opentelemetry-cpp/sdk/test/metrics/cardinality_limit_test.cc b/deps/opentelemetry-cpp/sdk/test/metrics/cardinality_limit_test.cc
index 45e15200c35..61a47c5983d 100644
--- a/deps/opentelemetry-cpp/sdk/test/metrics/cardinality_limit_test.cc
+++ b/deps/opentelemetry-cpp/sdk/test/metrics/cardinality_limit_test.cc
@@ -20,6 +20,7 @@
 #include "opentelemetry/nostd/span.h"
 #include "opentelemetry/nostd/variant.h"
 #include "opentelemetry/sdk/metrics/aggregation/aggregation.h"
+#include "opentelemetry/sdk/metrics/aggregation/aggregation_config.h"
 #include "opentelemetry/sdk/metrics/aggregation/sum_aggregation.h"
 #include "opentelemetry/sdk/metrics/data/metric_data.h"
 #include "opentelemetry/sdk/metrics/data/point_data.h"
@@ -110,6 +111,7 @@ TEST_P(WritableMetricStorageCardinalityLimitTestFixture, LongCounterSumAggregati
   const size_t attributes_limit   = 10;
   InstrumentDescriptor instr_desc = {"name", "desc", "1unit", InstrumentType::kCounter,
                                      InstrumentValueType::kLong};
+  AggregationConfig aggConfig(attributes_limit);
   std::shared_ptr<DefaultAttributesProcessor> default_attributes_processor{
       new DefaultAttributesProcessor{}};
   SyncMetricStorage storage(instr_desc, AggregationType::kSum, default_attributes_processor,
@@ -117,7 +119,7 @@ TEST_P(WritableMetricStorageCardinalityLimitTestFixture, LongCounterSumAggregati
                             ExemplarFilterType::kAlwaysOff,
                             ExemplarReservoir::GetNoExemplarReservoir(),
 #endif
-                            nullptr, attributes_limit);
+                            &aggConfig);
 
   int64_t record_value = 100;
   // add 9 unique metric points, and 6 more above limit.
diff --git a/deps/opentelemetry-cpp/sdk/test/metrics/histogram_aggregation_benchmark.cc b/deps/opentelemetry-cpp/sdk/test/metrics/histogram_aggregation_benchmark.cc
index 45fcb5b1a45..e4b90eebc41 100644
--- a/deps/opentelemetry-cpp/sdk/test/metrics/histogram_aggregation_benchmark.cc
+++ b/deps/opentelemetry-cpp/sdk/test/metrics/histogram_aggregation_benchmark.cc
@@ -116,8 +116,7 @@ void RunBase2ExponentialHistogramAggregation(benchmark::State &state, int scale)
   config.max_scale_ = scale;
 
   std::unique_ptr<View> histogram_view{
-      new View("base2_expohisto", "description", instrument_unit,
-               AggregationType::kBase2ExponentialHistogram,
+      new View("base2_expohisto", "description", AggregationType::kBase2ExponentialHistogram,
                std::make_shared<Base2ExponentialHistogramAggregationConfig>(config))};
 
   std::unique_ptr<ViewRegistry> views{new ViewRegistry()};
diff --git a/deps/opentelemetry-cpp/sdk/test/metrics/histogram_aggregation_test.cc b/deps/opentelemetry-cpp/sdk/test/metrics/histogram_aggregation_test.cc
index 25640209d16..9de7af7d8e6 100644
--- a/deps/opentelemetry-cpp/sdk/test/metrics/histogram_aggregation_test.cc
+++ b/deps/opentelemetry-cpp/sdk/test/metrics/histogram_aggregation_test.cc
@@ -87,8 +87,7 @@ TEST(CounterToHistogram, Double)
   std::shared_ptr<MetricReader> reader{new MockMetricReader(std::move(exporter))};
   mp.AddMetricReader(reader);
 
-  std::unique_ptr<View> view{
-      new View("view1", "view1_description", "unit", AggregationType::kHistogram)};
+  std::unique_ptr<View> view{new View("view1", "view1_description", AggregationType::kHistogram)};
   std::unique_ptr<InstrumentSelector> instrument_selector{
       new InstrumentSelector(InstrumentType::kCounter, "counter1", "unit")};
   std::unique_ptr<MeterSelector> meter_selector{new MeterSelector("meter1", "version1", "schema1")};
diff --git a/deps/opentelemetry-cpp/sdk/test/metrics/histogram_test.cc b/deps/opentelemetry-cpp/sdk/test/metrics/histogram_test.cc
index a75b4f3f139..ad819d9e998 100644
--- a/deps/opentelemetry-cpp/sdk/test/metrics/histogram_test.cc
+++ b/deps/opentelemetry-cpp/sdk/test/metrics/histogram_test.cc
@@ -103,7 +103,7 @@ TEST(Histogram, DoubleCustomBuckets)
   std::shared_ptr<HistogramAggregationConfig> config(new HistogramAggregationConfig());
   config->boundaries_ = {10, 20, 30, 40};
   std::unique_ptr<View> view{
-      new View("view1", "view1_description", instrument_unit, AggregationType::kHistogram, config)};
+      new View("view1", "view1_description", AggregationType::kHistogram, config)};
   std::unique_ptr<InstrumentSelector> instrument_selector{
       new InstrumentSelector(InstrumentType::kHistogram, instrument_name, instrument_unit)};
   std::unique_ptr<MeterSelector> meter_selector{new MeterSelector("meter1", "version1", "schema1")};
@@ -163,7 +163,7 @@ TEST(Histogram, DoubleEmptyBuckets)
   std::shared_ptr<HistogramAggregationConfig> config(new HistogramAggregationConfig());
   config->boundaries_ = {};
   std::unique_ptr<View> view{
-      new View("view1", "view1_description", instrument_unit, AggregationType::kHistogram, config)};
+      new View("view1", "view1_description", AggregationType::kHistogram, config)};
   std::unique_ptr<InstrumentSelector> instrument_selector{
       new InstrumentSelector(InstrumentType::kHistogram, instrument_name, instrument_unit)};
   std::unique_ptr<MeterSelector> meter_selector{new MeterSelector("meter1", "version1", "schema1")};
@@ -278,7 +278,7 @@ TEST(Histogram, UInt64CustomBuckets)
   std::shared_ptr<HistogramAggregationConfig> config(new HistogramAggregationConfig());
   config->boundaries_ = {10, 20, 30, 40};
   std::unique_ptr<View> view{
-      new View("view1", "view1_description", "ms", AggregationType::kHistogram, config)};
+      new View("view1", "view1_description", AggregationType::kHistogram, config)};
   std::unique_ptr<InstrumentSelector> instrument_selector{
       new InstrumentSelector(InstrumentType::kHistogram, instrument_name, instrument_unit)};
   std::unique_ptr<MeterSelector> meter_selector{new MeterSelector("meter1", "version1", "schema1")};
@@ -338,7 +338,7 @@ TEST(Histogram, UInt64EmptyBuckets)
   std::shared_ptr<HistogramAggregationConfig> config(new HistogramAggregationConfig());
   config->boundaries_ = {};
   std::unique_ptr<View> view{
-      new View("view1", "view1_description", "ms", AggregationType::kHistogram, config)};
+      new View("view1", "view1_description", AggregationType::kHistogram, config)};
   std::unique_ptr<InstrumentSelector> instrument_selector{
       new InstrumentSelector(InstrumentType::kHistogram, instrument_name, instrument_unit)};
   std::unique_ptr<MeterSelector> meter_selector{new MeterSelector("meter1", "version1", "schema1")};
diff --git a/deps/opentelemetry-cpp/sdk/test/metrics/meter_test.cc b/deps/opentelemetry-cpp/sdk/test/metrics/meter_test.cc
index a4212996a36..5fe99b41a83 100644
--- a/deps/opentelemetry-cpp/sdk/test/metrics/meter_test.cc
+++ b/deps/opentelemetry-cpp/sdk/test/metrics/meter_test.cc
@@ -881,7 +881,7 @@ TEST(MeterTest, RecordAfterProviderDestructionWithCustomProcessor_NoResetInMain)
 
   // Register a View with custom processor
   std::unique_ptr<View> view(
-      new View("my_counter", "", "", AggregationType::kSum, nullptr, std::move(processor)));
+      new View("my_counter", "", AggregationType::kSum, nullptr, std::move(processor)));
   std::unique_ptr<InstrumentSelector> instr_selector(
       new InstrumentSelector(InstrumentType::kCounter, "my_counter", ""));
   std::unique_ptr<MeterSelector> meter_selector(new MeterSelector("test_meter", "", ""));
diff --git a/deps/opentelemetry-cpp/sdk/test/metrics/periodic_exporting_metric_reader_test.cc b/deps/opentelemetry-cpp/sdk/test/metrics/periodic_exporting_metric_reader_test.cc
index 158ba49c145..2b817276e8d 100644
--- a/deps/opentelemetry-cpp/sdk/test/metrics/periodic_exporting_metric_reader_test.cc
+++ b/deps/opentelemetry-cpp/sdk/test/metrics/periodic_exporting_metric_reader_test.cc
@@ -4,6 +4,7 @@
 #include <gtest/gtest.h>
 #include <stddef.h>
 #include <chrono>
+#include <cstdlib>
 #include <memory>
 #include <ratio>
 #include <thread>
@@ -18,6 +19,12 @@
 #include "opentelemetry/sdk/metrics/instruments.h"
 #include "opentelemetry/sdk/metrics/push_metric_exporter.h"
 
+#if defined(_MSC_VER)
+#  include "opentelemetry/sdk/common/env_variables.h"
+using opentelemetry::sdk::common::setenv;
+using opentelemetry::sdk::common::unsetenv;
+#endif
+
 using namespace opentelemetry;
 using namespace opentelemetry::sdk::instrumentationscope;
 using namespace opentelemetry::sdk::metrics;
@@ -76,7 +83,7 @@ class MockMetricProducer : public MetricProducer
   size_t data_sent_size_{0};
 };
 
-TEST(PeriodicExporingMetricReader, BasicTests)
+TEST(PeriodicExportingMetricReader, BasicTests)
 {
   std::unique_ptr<PushMetricExporter> exporter(
       new MockPushMetricExporter(std::chrono::milliseconds{0}));
@@ -95,7 +102,7 @@ TEST(PeriodicExporingMetricReader, BasicTests)
             static_cast<MockMetricProducer *>(&producer)->GetDataCount());
 }
 
-TEST(PeriodicExporingMetricReader, Timeout)
+TEST(PeriodicExportingMetricReader, Timeout)
 {
   std::unique_ptr<PushMetricExporter> exporter(
       new MockPushMetricExporter(std::chrono::milliseconds{2000}));
@@ -109,3 +116,32 @@ TEST(PeriodicExporingMetricReader, Timeout)
   std::this_thread::sleep_for(std::chrono::milliseconds(1000));
   reader->Shutdown();
 }
+
+TEST(PeriodicExportingMetricReaderOptions, UsesEnvVars)
+{
+  const char *env_interval = "OTEL_METRIC_EXPORT_INTERVAL";
+  const char *env_timeout  = "OTEL_METRIC_EXPORT_TIMEOUT";
+
+  setenv(env_interval, "1500ms", 1);
+  setenv(env_timeout, "1000ms", 1);
+
+  PeriodicExportingMetricReaderOptions options;
+  EXPECT_EQ(options.export_interval_millis, std::chrono::milliseconds(1500));
+  EXPECT_EQ(options.export_timeout_millis, std::chrono::milliseconds(1000));
+
+  unsetenv(env_interval);
+  unsetenv(env_timeout);
+}
+
+TEST(PeriodicExportingMetricReaderOptions, UsesDefault)
+{
+  const char *env_interval = "OTEL_METRIC_EXPORT_INTERVAL";
+  const char *env_timeout  = "OTEL_METRIC_EXPORT_TIMEOUT";
+
+  unsetenv(env_interval);
+  unsetenv(env_timeout);
+
+  PeriodicExportingMetricReaderOptions options;
+  EXPECT_EQ(options.export_interval_millis, std::chrono::milliseconds(60000));
+  EXPECT_EQ(options.export_timeout_millis, std::chrono::milliseconds(30000));
+}
diff --git a/deps/opentelemetry-cpp/sdk/test/metrics/sum_aggregation_test.cc b/deps/opentelemetry-cpp/sdk/test/metrics/sum_aggregation_test.cc
index 732f29e1f47..02421a9e260 100644
--- a/deps/opentelemetry-cpp/sdk/test/metrics/sum_aggregation_test.cc
+++ b/deps/opentelemetry-cpp/sdk/test/metrics/sum_aggregation_test.cc
@@ -2,7 +2,9 @@
 // SPDX-License-Identifier: Apache-2.0
 
 #include <gtest/gtest.h>
+#include <stddef.h>
 #include <initializer_list>
+#include <map>
 #include <string>
 #include <unordered_map>
 #include <utility>
@@ -26,6 +28,7 @@
 #include "opentelemetry/sdk/metrics/meter_provider.h"
 #include "opentelemetry/sdk/metrics/metric_reader.h"
 #include "opentelemetry/sdk/metrics/push_metric_exporter.h"
+#include "opentelemetry/sdk/metrics/state/attributes_hashmap.h"
 #include "opentelemetry/sdk/metrics/view/attributes_processor.h"
 #include "opentelemetry/sdk/metrics/view/instrument_selector.h"
 #include "opentelemetry/sdk/metrics/view/meter_selector.h"
@@ -42,15 +45,14 @@ TEST(HistogramToSum, Double)
   MeterProvider mp;
   auto m                      = mp.GetMeter("meter1", "version1", "schema1");
   std::string instrument_unit = "ms";
-  std::string instrument_name = "historgram1";
+  std::string instrument_name = "histogram1";
   std::string instrument_desc = "histogram metrics";
 
   std::unique_ptr<MockMetricExporter> exporter(new MockMetricExporter());
   std::shared_ptr<MetricReader> reader{new MockMetricReader(std::move(exporter))};
   mp.AddMetricReader(reader);
 
-  std::unique_ptr<View> view{
-      new View("view1", "view1_description", instrument_unit, AggregationType::kSum)};
+  std::unique_ptr<View> view{new View("view1", "view1_description", AggregationType::kSum)};
   std::unique_ptr<InstrumentSelector> instrument_selector{
       new InstrumentSelector(InstrumentType::kHistogram, instrument_name, instrument_unit)};
   std::unique_ptr<MeterSelector> meter_selector{new MeterSelector("meter1", "version1", "schema1")};
@@ -95,10 +97,10 @@ TEST(HistogramToSumFilterAttributes, Double)
   MeterProvider mp;
   auto m                      = mp.GetMeter("meter1", "version1", "schema1");
   std::string instrument_unit = "ms";
-  std::string instrument_name = "historgram1";
+  std::string instrument_name = "histogram1";
   std::string instrument_desc = "histogram metrics";
 
-  std::unordered_map<std::string, bool> allowedattr;
+  opentelemetry::sdk::metrics::FilterAttributeMap allowedattr;
   allowedattr["attr1"] = true;
   std::unique_ptr<opentelemetry::sdk::metrics::AttributesProcessor> attrproc{
       new opentelemetry::sdk::metrics::FilteringAttributesProcessor(allowedattr)};
@@ -109,9 +111,8 @@ TEST(HistogramToSumFilterAttributes, Double)
   std::shared_ptr<MetricReader> reader{new MockMetricReader(std::move(exporter))};
   mp.AddMetricReader(reader);
 
-  std::unique_ptr<View> view{new View("view1", "view1_description", instrument_unit,
-                                      AggregationType::kSum, dummy_aggregation_config,
-                                      std::move(attrproc))};
+  std::unique_ptr<View> view{new View("view1", "view1_description", AggregationType::kSum,
+                                      dummy_aggregation_config, std::move(attrproc))};
   std::unique_ptr<InstrumentSelector> instrument_selector{
       new InstrumentSelector(InstrumentType::kHistogram, instrument_name, instrument_unit)};
   std::unique_ptr<MeterSelector> meter_selector{new MeterSelector("meter1", "version1", "schema1")};
@@ -144,6 +145,85 @@ TEST(HistogramToSumFilterAttributes, Double)
   });
 }
 
+TEST(HistogramToSumFilterAttributesWithCardinalityLimit, Double)
+{
+  MeterProvider mp;
+  auto m                      = mp.GetMeter("meter1", "version1", "schema1");
+  std::string instrument_unit = "ms";
+  std::string instrument_name = "histogram1";
+  std::string instrument_desc = "histogram metrics";
+  size_t cardinality_limit    = 10000;
+
+  opentelemetry::sdk::metrics::FilterAttributeMap allowedattr;
+  allowedattr["attr1"] = true;
+  std::unique_ptr<opentelemetry::sdk::metrics::AttributesProcessor> attrproc{
+      new opentelemetry::sdk::metrics::FilteringAttributesProcessor(allowedattr)};
+
+  std::shared_ptr<opentelemetry::sdk::metrics::AggregationConfig> dummy_aggregation_config{
+      new opentelemetry::sdk::metrics::AggregationConfig(cardinality_limit)};
+  std::unique_ptr<MockMetricExporter> exporter(new MockMetricExporter());
+  std::shared_ptr<MetricReader> reader{new MockMetricReader(std::move(exporter))};
+  mp.AddMetricReader(reader);
+
+  std::unique_ptr<View> view{new View("view1", "view1_description", AggregationType::kSum,
+                                      dummy_aggregation_config, std::move(attrproc))};
+  std::unique_ptr<InstrumentSelector> instrument_selector{
+      new InstrumentSelector(InstrumentType::kHistogram, instrument_name, instrument_unit)};
+  std::unique_ptr<MeterSelector> meter_selector{new MeterSelector("meter1", "version1", "schema1")};
+  mp.AddView(std::move(instrument_selector), std::move(meter_selector), std::move(view));
+
+  auto h = m->CreateDoubleHistogram(instrument_name, instrument_desc, instrument_unit);
+  size_t total_metrics_times = 5;
+
+  size_t agg_repeat_count = 5;
+  for (size_t repeat = 0; repeat < agg_repeat_count; repeat++)
+  {
+
+    for (size_t times = 0; times < total_metrics_times; times++)
+    {
+      for (size_t i = 0; i < 2 * cardinality_limit; i++)
+      {
+        std::unordered_map<std::string, std::string> attr = {{"attr1", std::to_string(i)},
+                                                             {"attr2", "val2"}};
+        h->Record(1, attr, opentelemetry::context::Context{});
+      }
+    }
+
+    reader->Collect([&](ResourceMetrics &rm) {
+      for (const ScopeMetrics &smd : rm.scope_metric_data_)
+      {
+        for (const MetricData &md : smd.metric_data_)
+        {
+          // Something weird about attributes hashmap. If cardinality is setup to n, it emits n-1
+          // including overflow. Just making the logic generic here to succeed for n or n-1 total
+          // cardinality.
+          EXPECT_GE(cardinality_limit, md.point_data_attr_.size());
+          EXPECT_LT(cardinality_limit / 2, md.point_data_attr_.size());
+          for (size_t i = 0; i < md.point_data_attr_.size(); i++)
+          {
+            EXPECT_EQ(1, md.point_data_attr_[i].attributes.size());
+            if (md.point_data_attr_[i].attributes.end() !=
+                md.point_data_attr_[i].attributes.find("attr1"))
+            {
+              EXPECT_EQ(total_metrics_times * (repeat + 1),
+                        opentelemetry::nostd::get<double>(opentelemetry::nostd::get<SumPointData>(
+                                                              md.point_data_attr_[i].point_data)
+                                                              .value_));
+            }
+            else
+            {
+              EXPECT_NE(md.point_data_attr_[i].attributes.end(),
+                        md.point_data_attr_[i].attributes.find(
+                            sdk::metrics::kAttributesLimitOverflowKey));
+            }
+          }
+        }
+      }
+      return true;
+    });
+  }
+}
+
 TEST(CounterToSum, Double)
 {
   MeterProvider mp;
@@ -153,7 +233,7 @@ TEST(CounterToSum, Double)
   std::shared_ptr<MetricReader> reader{new MockMetricReader(std::move(exporter))};
   mp.AddMetricReader(reader);
 
-  std::unique_ptr<View> view{new View("view1", "view1_description", "ms", AggregationType::kSum)};
+  std::unique_ptr<View> view{new View("view1", "view1_description", AggregationType::kSum)};
   std::unique_ptr<InstrumentSelector> instrument_selector{
       new InstrumentSelector(InstrumentType::kCounter, "counter1", "ms")};
   std::unique_ptr<MeterSelector> meter_selector{new MeterSelector("meter1", "version1", "schema1")};
@@ -201,7 +281,7 @@ TEST(CounterToSumFilterAttributes, Double)
   std::string instrument_name = "counter1";
   std::string instrument_desc = "counter metrics";
 
-  std::unordered_map<std::string, bool> allowedattr;
+  opentelemetry::sdk::metrics::FilterAttributeMap allowedattr;
   allowedattr["attr1"] = true;
   std::unique_ptr<opentelemetry::sdk::metrics::AttributesProcessor> attrproc{
       new opentelemetry::sdk::metrics::FilteringAttributesProcessor(allowedattr)};
@@ -212,9 +292,8 @@ TEST(CounterToSumFilterAttributes, Double)
   std::shared_ptr<MetricReader> reader{new MockMetricReader(std::move(exporter))};
   mp.AddMetricReader(reader);
 
-  std::unique_ptr<View> view{new View("view1", "view1_description", instrument_unit,
-                                      AggregationType::kSum, dummy_aggregation_config,
-                                      std::move(attrproc))};
+  std::unique_ptr<View> view{new View("view1", "view1_description", AggregationType::kSum,
+                                      dummy_aggregation_config, std::move(attrproc))};
   std::unique_ptr<InstrumentSelector> instrument_selector{
       new InstrumentSelector(InstrumentType::kCounter, instrument_name, instrument_unit)};
   std::unique_ptr<MeterSelector> meter_selector{new MeterSelector("meter1", "version1", "schema1")};
@@ -247,6 +326,87 @@ TEST(CounterToSumFilterAttributes, Double)
   });
 }
 
+TEST(CounterToSumFilterAttributesWithCardinalityLimit, Double)
+{
+  MeterProvider mp;
+  auto m                      = mp.GetMeter("meter1", "version1", "schema1");
+  std::string instrument_unit = "ms";
+  std::string instrument_name = "counter1";
+  std::string instrument_desc = "counter metrics";
+  size_t cardinality_limit    = 10000;
+
+  opentelemetry::sdk::metrics::FilterAttributeMap allowedattr;
+  allowedattr["attr1"] = true;
+  std::unique_ptr<opentelemetry::sdk::metrics::AttributesProcessor> attrproc{
+      new opentelemetry::sdk::metrics::FilteringAttributesProcessor(allowedattr)};
+
+  std::shared_ptr<opentelemetry::sdk::metrics::AggregationConfig> dummy_aggregation_config{
+      new opentelemetry::sdk::metrics::AggregationConfig(cardinality_limit)};
+  std::unique_ptr<MockMetricExporter> exporter(new MockMetricExporter());
+  std::shared_ptr<MetricReader> reader{new MockMetricReader(std::move(exporter))};
+  mp.AddMetricReader(reader);
+
+  std::unique_ptr<View> view{new View("view1", "view1_description", AggregationType::kSum,
+                                      dummy_aggregation_config, std::move(attrproc))};
+  std::unique_ptr<InstrumentSelector> instrument_selector{
+      new InstrumentSelector(InstrumentType::kCounter, instrument_name, instrument_unit)};
+  std::unique_ptr<MeterSelector> meter_selector{new MeterSelector("meter1", "version1", "schema1")};
+  mp.AddView(std::move(instrument_selector), std::move(meter_selector), std::move(view));
+
+  auto c = m->CreateDoubleCounter(instrument_name, instrument_desc, instrument_unit);
+
+  size_t agg_repeat_count = 5;
+  for (size_t repeat = 0; repeat < agg_repeat_count; repeat++)
+  {
+    size_t total_metrics_times = 5;
+
+    for (size_t times = 0; times < total_metrics_times; times++)
+    {
+      for (size_t i = 0; i < 2 * cardinality_limit; i++)
+      {
+        std::unordered_map<std::string, std::string> attr = {{"attr1", std::to_string(i)},
+                                                             {"attr2", "val2"}};
+        c->Add(1, attr, opentelemetry::context::Context{});
+      }
+    }
+
+    reader->Collect([&](ResourceMetrics &rm) {
+      for (const ScopeMetrics &smd : rm.scope_metric_data_)
+      {
+        for (const MetricData &md : smd.metric_data_)
+        {
+          // When the number of unique attribute sets exceeds the cardinality limit, the
+          // implementation emits up to (cardinality_limit - 1) unique sets and one overflow set,
+          // resulting in a total of cardinality_limit sets. This test checks that the number of
+          // emitted attribute sets is within the expected range, accounting for the overflow
+          // behavior.
+          EXPECT_GE(cardinality_limit, md.point_data_attr_.size());
+          EXPECT_LT(cardinality_limit / 2, md.point_data_attr_.size());
+          for (size_t i = 0; i < md.point_data_attr_.size(); i++)
+          {
+            EXPECT_EQ(1, md.point_data_attr_[i].attributes.size());
+            if (md.point_data_attr_[i].attributes.find("attr1") !=
+                md.point_data_attr_[i].attributes.end())
+            {
+              EXPECT_EQ(total_metrics_times * (repeat + 1),
+                        opentelemetry::nostd::get<double>(opentelemetry::nostd::get<SumPointData>(
+                                                              md.point_data_attr_[i].point_data)
+                                                              .value_));
+            }
+            else
+            {
+              EXPECT_NE(md.point_data_attr_[i].attributes.end(),
+                        md.point_data_attr_[i].attributes.find(
+                            sdk::metrics::kAttributesLimitOverflowKey));
+            }
+          }
+        }
+      }
+      return true;
+    });
+  }
+}
+
 class UpDownCounterToSumFixture : public ::testing::TestWithParam<bool>
 {};
 
@@ -265,8 +425,7 @@ TEST_P(UpDownCounterToSumFixture, Double)
 
   if (is_matching_view)
   {
-    std::unique_ptr<View> view{
-        new View("view1", "view1_description", instrument_unit, AggregationType::kSum)};
+    std::unique_ptr<View> view{new View("view1", "view1_description", AggregationType::kSum)};
     std::unique_ptr<InstrumentSelector> instrument_selector{
         new InstrumentSelector(InstrumentType::kUpDownCounter, instrument_name, instrument_unit)};
     std::unique_ptr<MeterSelector> meter_selector{
diff --git a/deps/opentelemetry-cpp/sdk/test/trace/parent_sampler_test.cc b/deps/opentelemetry-cpp/sdk/test/trace/parent_sampler_test.cc
index e5ac16ff140..db179c96952 100644
--- a/deps/opentelemetry-cpp/sdk/test/trace/parent_sampler_test.cc
+++ b/deps/opentelemetry-cpp/sdk/test/trace/parent_sampler_test.cc
@@ -51,10 +51,14 @@ TEST(ParentBasedSampler, ShouldSample)
   opentelemetry::common::KeyValueIterableView<M> view{m1};
   trace_api::SpanContextKeyValueIterableView<L> links{l1};
   auto trace_state = trace_api::TraceState::FromHeader("congo=t61rcWkgMzE");
-  trace_api::SpanContext parent_context_sampled(trace_id, span_id, trace_api::TraceFlags{1}, false,
-                                                trace_state);
-  trace_api::SpanContext parent_context_nonsampled(trace_id, span_id, trace_api::TraceFlags{0},
-                                                   false, trace_state);
+  trace_api::SpanContext parent_context_sampled_local(trace_id, span_id, trace_api::TraceFlags{1},
+                                                      false, trace_state);
+  trace_api::SpanContext parent_context_nonsampled_local(
+      trace_id, span_id, trace_api::TraceFlags{0}, false, trace_state);
+  trace_api::SpanContext parent_context_sampled_remote(trace_id, span_id, trace_api::TraceFlags{1},
+                                                       true, trace_state);
+  trace_api::SpanContext parent_context_nonsampled_remote(
+      trace_id, span_id, trace_api::TraceFlags{0}, true, trace_state);
 
   // Case 1: Parent doesn't exist. Return result of delegateSampler()
   auto sampling_result  = sampler_off.ShouldSample(trace_api::SpanContext::GetInvalid(), trace_id,
@@ -67,17 +71,29 @@ TEST(ParentBasedSampler, ShouldSample)
   ASSERT_EQ("", sampling_result.trace_state->ToHeader());
   ASSERT_EQ("", sampling_result2.trace_state->ToHeader());
 
-  // Case 2: Parent exists and SampledFlag is true
+  // Case 2: Parent exists and SampledFlag is true and RemoteFlag is false
   auto sampling_result3 =
-      sampler_off.ShouldSample(parent_context_sampled, trace_id, "", span_kind, view, links);
+      sampler_off.ShouldSample(parent_context_sampled_local, trace_id, "", span_kind, view, links);
   ASSERT_EQ(Decision::RECORD_AND_SAMPLE, sampling_result3.decision);
   ASSERT_EQ("congo=t61rcWkgMzE", sampling_result3.trace_state->ToHeader());
 
-  // Case 3: Parent exists and SampledFlag is false
-  auto sampling_result4 =
-      sampler_on.ShouldSample(parent_context_nonsampled, trace_id, "", span_kind, view, links);
+  // Case 3: Parent exists and SampledFlag is false and RemoteFlag is false
+  auto sampling_result4 = sampler_on.ShouldSample(parent_context_nonsampled_local, trace_id, "",
+                                                  span_kind, view, links);
   ASSERT_EQ(Decision::DROP, sampling_result4.decision);
   ASSERT_EQ("congo=t61rcWkgMzE", sampling_result4.trace_state->ToHeader());
+
+  // Case 4: Parent exists, SampledFlag is true and RemoteFlag is true
+  auto sampling_result5 =
+      sampler_off.ShouldSample(parent_context_sampled_remote, trace_id, "", span_kind, view, links);
+  ASSERT_EQ(Decision::RECORD_AND_SAMPLE, sampling_result5.decision);
+  ASSERT_EQ("congo=t61rcWkgMzE", sampling_result5.trace_state->ToHeader());
+
+  // Case 5: Parent exists, SampledFlag is false and RemoteFlag is true
+  auto sampling_result6 = sampler_on.ShouldSample(parent_context_nonsampled_remote, trace_id, "",
+                                                  span_kind, view, links);
+  ASSERT_EQ(Decision::DROP, sampling_result6.decision);
+  ASSERT_EQ("congo=t61rcWkgMzE", sampling_result6.trace_state->ToHeader());
 }
 
 TEST(ParentBasedSampler, GetDescription)
diff --git a/deps/opentelemetry-cpp/sdk/test/trace/trace_id_ratio_sampler_test.cc b/deps/opentelemetry-cpp/sdk/test/trace/trace_id_ratio_sampler_test.cc
index 86aaeb40677..fd509281ebd 100644
--- a/deps/opentelemetry-cpp/sdk/test/trace/trace_id_ratio_sampler_test.cc
+++ b/deps/opentelemetry-cpp/sdk/test/trace/trace_id_ratio_sampler_test.cc
@@ -99,7 +99,7 @@ TEST(TraceIdRatioBasedSampler, ShouldSampleWithoutContext)
   ASSERT_EQ(Decision::RECORD_AND_SAMPLE, sampling_result.decision);
   ASSERT_EQ(nullptr, sampling_result.attributes);
 
-  constexpr uint8_t buf[] = {0, 0, 0, 0, 0, 0, 0, 0x80, 0, 0, 0, 0, 0, 0, 0, 0};
+  constexpr uint8_t buf[] = {0x80, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
   trace_api::TraceId valid_trace_id(buf);
 
   sampling_result = s1.ShouldSample(trace_api::SpanContext::GetInvalid(), valid_trace_id, "",
diff --git a/deps/protobuf/protobuf.gyp b/deps/protobuf/protobuf.gyp
index 510fc1f8115..0d8ebc4c61d 100644
--- a/deps/protobuf/protobuf.gyp
+++ b/deps/protobuf/protobuf.gyp
@@ -60,11 +60,19 @@
         'src/google/protobuf/generated_message_util.cc',
         'src/google/protobuf/implicit_weak_message.cc',
         'src/google/protobuf/inlined_string_field.cc',
+        'src/google/protobuf/json/json.cc',
+        'src/google/protobuf/json/internal/lexer.cc',
+        'src/google/protobuf/json/internal/message_path.cc',
+        'src/google/protobuf/json/internal/parser.cc',
+        'src/google/protobuf/json/internal/unparser.cc',
+        'src/google/protobuf/json/internal/untyped_message.cc',
+        'src/google/protobuf/json/internal/writer.cc',
+        'src/google/protobuf/json/internal/zero_copy_buffered_stream.cc',
         'src/google/protobuf/map.cc',
         'src/google/protobuf/map_field.cc',
         'src/google/protobuf/message.cc',
         'src/google/protobuf/message_lite.cc',
-	'src/google/protobuf/micro_string.cc',
+        'src/google/protobuf/micro_string.cc',
         'src/google/protobuf/parse_context.cc',
         'src/google/protobuf/port.cc',
         'src/google/protobuf/raw_ptr.cc',
diff --git a/deps/v8/apply-patches.sh b/deps/v8/apply-patches.sh
new file mode 100755
index 00000000000..737b94378f7
--- /dev/null
+++ b/deps/v8/apply-patches.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+set -Eeuo pipefail
+
+PATCHES_DIR="$(dirname "$0")/patches"
+
+shopt -s nullglob
+for patch in "$PATCHES_DIR"/*.patch; do
+  [ -f "$patch" ] || continue
+  name="$(basename "$patch")"
+  echo "Processing ${name}..."
+  # If the reverse applies cleanly, the patch is already applied.
+  if git apply --reverse --check "$patch" >/dev/null 2>&1; then
+    echo "  ${name}: already applied, skipping."
+    continue
+  fi
+  # Otherwise, apply if it would apply cleanly.
+  if git apply --check "$patch" >/dev/null 2>&1; then
+    echo "  ${name}: applying..."
+    git apply --index --3way "$patch"
+    echo "  ${name}: applied."
+  else
+    echo "  ${name}: ERROR: patch does not apply cleanly:"
+    # Show why it fails, then exit non-zero to stop the build.
+    git apply --check "$patch" || true
+    exit 1
+  fi
+done
diff --git a/deps/v8/patches/000-allocation-tracker-fix.patch b/deps/v8/patches/000-allocation-tracker-fix.patch
new file mode 100644
index 00000000000..d50cfa24eb6
--- /dev/null
+++ b/deps/v8/patches/000-allocation-tracker-fix.patch
@@ -0,0 +1,16 @@
+diff --git a/deps/v8/src/profiler/allocation-tracker.cc b/deps/v8/src/profiler/allocation-tracker.cc
+index eac8c082aee..be9a6fa8132 100644
+--- a/deps/v8/src/profiler/allocation-tracker.cc
++++ b/deps/v8/src/profiler/allocation-tracker.cc
+@@ -189,7 +189,10 @@ AllocationTracker::~AllocationTracker() {
+ 
+ 
+ void AllocationTracker::PrepareForSerialization() {
+-  for (UnresolvedLocation* location : unresolved_locations_) {
++  for (std::vector<UnresolvedLocation*>::size_type i = 0;
++       i < unresolved_locations_.size() /* size may grow in loop! */;
++       ++i) {
++    UnresolvedLocation* location = unresolved_locations_[i];
+     location->Resolve();
+     delete location;
+   }
diff --git a/deps/v8/patches/001-clang-macros-fix.patch b/deps/v8/patches/001-clang-macros-fix.patch
new file mode 100644
index 00000000000..57588826116
--- /dev/null
+++ b/deps/v8/patches/001-clang-macros-fix.patch
@@ -0,0 +1,23 @@
+diff --git a/deps/v8/src/base/macros.h b/deps/v8/src/base/macros.h
+index d404b6120ab..82bec735d64 100644
+--- a/deps/v8/src/base/macros.h
++++ b/deps/v8/src/base/macros.h
+@@ -173,7 +173,8 @@ namespace base {
+ // base::is_trivially_copyable will differ for these cases.
+ template <typename T>
+ struct is_trivially_copyable {
+-#if V8_CC_MSVC || (__GNUC__ == 12 && __GNUC_MINOR__ <= 2)
++#if V8_CC_MSVC || (__GNUC__ == 12 && __GNUC_MINOR__ <= 2) || \
++  (defined(__clang__) && __clang_major__ <= 17)
+   // Unfortunately, MSVC 2015 is broken in that std::is_trivially_copyable can
+   // be false even though it should be true according to the standard.
+   // (status at 2018-02-26, observed on the msvc waterfall bot).
+@@ -186,6 +187,8 @@ struct is_trivially_copyable {
+   // distributions, so the same polyfill is also used.
+   // See
+   // https://gcc.gnu.org/git/?p=gcc.git;a=commitdiff;h=aeba3e009b0abfccaf01797556445dbf891cc8dc
++  //
++  // Also observed with an eclectic range of clang++ releases.
+   static constexpr bool value =
+       // Copy constructor is trivial or deleted.
+       (std::is_trivially_copy_constructible<T>::value ||
diff --git a/deps/v8/patches/002-cpu-profiler-sigprof-fix.patch b/deps/v8/patches/002-cpu-profiler-sigprof-fix.patch
new file mode 100644
index 00000000000..e71ae599d57
--- /dev/null
+++ b/deps/v8/patches/002-cpu-profiler-sigprof-fix.patch
@@ -0,0 +1,17 @@
+diff --git a/deps/v8/src/profiler/cpu-profiler.cc b/deps/v8/src/profiler/cpu-profiler.cc
+index c94e8f95457..d22ce2c1400 100644
+--- a/deps/v8/src/profiler/cpu-profiler.cc
++++ b/deps/v8/src/profiler/cpu-profiler.cc
+@@ -51,6 +51,12 @@ class CpuSampler : public sampler::Sampler {
+ #if V8_HEAP_USE_PKU_JIT_WRITE_PROTECT
+     i::RwxMemoryWriteScope::SetDefaultPermissionsForSignalHandler();
+ #endif
++
++    // (santigimeno): It prevents a crash when handling a `SIGPROF` signal while
++    // shutting down the profiler.
++    if (!processor_->running()) {
++      return;
++    }
+     TickSample* sample = processor_->StartTickSample();
+     if (sample == nullptr) {
+       ProfilerStats::Instance()->AddReason(
diff --git a/deps/v8/patches/003-heap-snapshot-generator-header.patch b/deps/v8/patches/003-heap-snapshot-generator-header.patch
new file mode 100644
index 00000000000..d1895312900
--- /dev/null
+++ b/deps/v8/patches/003-heap-snapshot-generator-header.patch
@@ -0,0 +1,26 @@
+diff --git a/deps/v8/src/profiler/heap-snapshot-generator.h b/deps/v8/src/profiler/heap-snapshot-generator.h
+index d7ae312d8c9..b2e20514f80 100644
+--- a/deps/v8/src/profiler/heap-snapshot-generator.h
++++ b/deps/v8/src/profiler/heap-snapshot-generator.h
+@@ -724,7 +724,7 @@ class HeapSnapshotJSONSerializer {
+   HeapSnapshotJSONSerializer(const HeapSnapshotJSONSerializer&) = delete;
+   HeapSnapshotJSONSerializer& operator=(const HeapSnapshotJSONSerializer&) =
+       delete;
+-  void Serialize(v8::OutputStream* stream);
++  void Serialize(v8::OutputStream* stream, bool redact = false);
+ 
+  private:
+   V8_INLINE static bool StringsMatch(void* key1, void* key2) {
+@@ -739,9 +739,9 @@ class HeapSnapshotJSONSerializer {
+   V8_INLINE int to_node_index(int entry_index);
+   void SerializeEdge(HeapGraphEdge* edge, bool first_edge);
+   void SerializeEdges();
+-  void SerializeImpl();
+-  void SerializeNode(const HeapEntry* entry);
+-  void SerializeNodes();
++  void SerializeImpl(bool redact = false);
++  void SerializeNode(const HeapEntry* entry, bool redact = false);
++  void SerializeNodes(bool redact = false);
+   void SerializeSnapshot();
+   void SerializeTraceTree();
+   void SerializeTraceNode(AllocationTraceNode* node);
diff --git a/deps/v8/patches/004-heap-snapshot-generator-redact.patch b/deps/v8/patches/004-heap-snapshot-generator-redact.patch
new file mode 100644
index 00000000000..0c07c469760
--- /dev/null
+++ b/deps/v8/patches/004-heap-snapshot-generator-redact.patch
@@ -0,0 +1,78 @@
+diff --git a/deps/v8/src/profiler/heap-snapshot-generator.cc b/deps/v8/src/profiler/heap-snapshot-generator.cc
+index 38e75f4243d..714e16075bc 100644
+--- a/deps/v8/src/profiler/heap-snapshot-generator.cc
++++ b/deps/v8/src/profiler/heap-snapshot-generator.cc
+@@ -3072,7 +3072,7 @@ bool HeapSnapshotGenerator::FillReferences() {
+ // type, name, id, self_size, edge_count, trace_node_id, detachedness.
+ const int HeapSnapshotJSONSerializer::kNodeFieldsCount = 7;
+ 
+-void HeapSnapshotJSONSerializer::Serialize(v8::OutputStream* stream) {
++void HeapSnapshotJSONSerializer::Serialize(v8::OutputStream* stream, bool redact) {
+   v8::base::ElapsedTimer timer;
+   timer.Start();
+   if (AllocationTracker* allocation_tracker =
+@@ -3081,7 +3081,7 @@ void HeapSnapshotJSONSerializer::Serialize(v8::OutputStream* stream) {
+   }
+   DCHECK_NULL(writer_);
+   writer_ = new OutputStreamWriter(stream);
+-  SerializeImpl();
++  SerializeImpl(redact);
+   delete writer_;
+   writer_ = nullptr;
+ 
+@@ -3092,7 +3092,7 @@ void HeapSnapshotJSONSerializer::Serialize(v8::OutputStream* stream) {
+   timer.Stop();
+ }
+ 
+-void HeapSnapshotJSONSerializer::SerializeImpl() {
++void HeapSnapshotJSONSerializer::SerializeImpl(bool redact) {
+   DCHECK_EQ(0, snapshot_->root()->index());
+   writer_->AddCharacter('{');
+   writer_->AddString("\"snapshot\":{");
+@@ -3100,7 +3100,9 @@ void HeapSnapshotJSONSerializer::SerializeImpl() {
+   if (writer_->aborted()) return;
+   writer_->AddString("},\n");
+   writer_->AddString("\"nodes\":[");
+-  SerializeNodes();
++  // This is where strings are copied into the strings_ cache so redaction must
++  // be performed here
++  SerializeNodes(redact);
+   if (writer_->aborted()) return;
+   writer_->AddString("],\n");
+   writer_->AddString("\"edges\":[");
+@@ -3226,7 +3228,8 @@ void HeapSnapshotJSONSerializer::SerializeEdges() {
+   }
+ }
+ 
+-void HeapSnapshotJSONSerializer::SerializeNode(const HeapEntry* entry) {
++void HeapSnapshotJSONSerializer::SerializeNode(const HeapEntry* entry,
++                                               bool redact) {
+   // The buffer needs space for 5 unsigned ints, 1 size_t, 1 uint8_t, 7 commas,
+   // \n and \0
+   static const int kBufferSize =
+@@ -3240,7 +3243,11 @@ void HeapSnapshotJSONSerializer::SerializeNode(const HeapEntry* entry) {
+   }
+   buffer_pos = utoa(entry->type(), buffer, buffer_pos);
+   buffer[buffer_pos++] = ',';
+-  buffer_pos = utoa(GetStringId(entry->name()), buffer, buffer_pos);
++  if (redact && entry->type() == HeapEntry::kString) {
++    buffer_pos = utoa(GetStringId("(redacted)"), buffer, buffer_pos);
++  } else {
++    buffer_pos = utoa(GetStringId(entry->name()), buffer, buffer_pos);
++  }
+   buffer[buffer_pos++] = ',';
+   buffer_pos = utoa(entry->id(), buffer, buffer_pos);
+   buffer[buffer_pos++] = ',';
+@@ -3256,10 +3263,10 @@ void HeapSnapshotJSONSerializer::SerializeNode(const HeapEntry* entry) {
+   writer_->AddString(buffer.begin());
+ }
+ 
+-void HeapSnapshotJSONSerializer::SerializeNodes() {
++void HeapSnapshotJSONSerializer::SerializeNodes(bool redact) {
+   const std::deque<HeapEntry>& entries = snapshot_->entries();
+   for (const HeapEntry& entry : entries) {
+-    SerializeNode(&entry);
++    SerializeNode(&entry, redact);
+     if (writer_->aborted()) return;
+   }
+ }
diff --git a/deps/v8/patches/005-output-stream-escape.patch b/deps/v8/patches/005-output-stream-escape.patch
new file mode 100644
index 00000000000..07cda914cb1
--- /dev/null
+++ b/deps/v8/patches/005-output-stream-escape.patch
@@ -0,0 +1,65 @@
+diff --git a/deps/v8/src/profiler/output-stream-writer.h b/deps/v8/src/profiler/output-stream-writer.h
+index c6d144d8a76..3934a33c822 100644
+--- a/deps/v8/src/profiler/output-stream-writer.h
++++ b/deps/v8/src/profiler/output-stream-writer.h
+@@ -36,6 +36,48 @@ struct MaxDecimalDigitsIn<8> {
+   static const int kUnsigned = 20;
+ };
+ 
++namespace {
++  void EscapeAndAppendString(const char* value, std::string* result) {
++  *result += '"';
++  while (*value) {
++    unsigned char c = *value++;
++    switch (c) {
++      case '\b':
++        *result += "\\b";
++        break;
++      case '\f':
++        *result += "\\f";
++        break;
++      case '\n':
++        *result += "\\n";
++        break;
++      case '\r':
++        *result += "\\r";
++        break;
++      case '\t':
++        *result += "\\t";
++        break;
++      case '\"':
++        *result += "\\\"";
++        break;
++      case '\\':
++        *result += "\\\\";
++        break;
++      default:
++        if (c < '\x20' || c == '\x7F') {
++          char number_buffer[8];
++          base::OS::SNPrintF(number_buffer, arraysize(number_buffer), "\\u%04X",
++                             static_cast<unsigned>(c));
++          *result += number_buffer;
++        } else {
++          *result += c;
++        }
++    }
++  }
++  *result += '"';
++}
++}  // namespace
++
+ class OutputStreamWriter {
+  public:
+   explicit OutputStreamWriter(v8::OutputStream* stream)
+@@ -73,6 +115,11 @@ class OutputStreamWriter {
+     }
+   }
+   void AddNumber(unsigned n) { AddNumberImpl<unsigned>(n, "%u"); }
++  void EscapeAndAddString(const char* s) {
++    std::string escaped;
++    EscapeAndAppendString(s, &escaped);
++    AddString(escaped.c_str());
++  }
+   void Finalize() {
+     if (aborted_) return;
+     DCHECK(chunk_pos_ < chunk_size_);
diff --git a/deps/v8/patches/006-profile-generator-json-fix.patch b/deps/v8/patches/006-profile-generator-json-fix.patch
new file mode 100644
index 00000000000..75bf739dcda
--- /dev/null
+++ b/deps/v8/patches/006-profile-generator-json-fix.patch
@@ -0,0 +1,58 @@
+diff --git a/deps/v8/src/profiler/profile-generator.cc b/deps/v8/src/profiler/profile-generator.cc
+index 8b4319be9fe..6937534dae8 100644
+--- a/deps/v8/src/profiler/profile-generator.cc
++++ b/deps/v8/src/profiler/profile-generator.cc
+@@ -803,17 +803,26 @@ void CpuProfileJSONSerializer::SerializePositionTicks(
+ 
+ void CpuProfileJSONSerializer::SerializeCallFrame(
+     const v8::CpuProfileNode* node) {
+-  writer_->AddString("\"functionName\":\"");
+-  writer_->AddString(node->GetFunctionNameStr());
+-  writer_->AddString("\",\"lineNumber\":");
+-  writer_->AddNumber(node->GetLineNumber() - 1);
+-  writer_->AddString(",\"columnNumber\":");
+-  writer_->AddNumber(node->GetColumnNumber() - 1);
++  writer_->AddString("\"functionName\":");
++  writer_->EscapeAndAddString(node->GetFunctionNameStr());
++  if (node->GetLineNumber()) {
++    writer_->AddString(",\"lineNumber\":");
++    writer_->AddNumber(node->GetLineNumber() - 1);
++  }
++
++  if (node->GetColumnNumber()) {
++    writer_->AddString(",\"columnNumber\":");
++    writer_->AddNumber(node->GetColumnNumber() - 1);
++  }
++
+   writer_->AddString(",\"scriptId\":");
+   writer_->AddNumber(node->GetScriptId());
+-  writer_->AddString(",\"url\":\"");
+-  writer_->AddString(node->GetScriptResourceNameStr());
+-  writer_->AddCharacter('"');
++
++  const char* url = node->GetScriptResourceNameStr();
++  if (url) {
++    writer_->AddString(",\"url\":");
++    writer_->EscapeAndAddString(url);
++  }
+ }
+ 
+ void CpuProfileJSONSerializer::SerializeChildren(const v8::CpuProfileNode* node,
+@@ -874,12 +883,13 @@ void CpuProfileJSONSerializer::SerializeNodes() {
+ 
+ void CpuProfileJSONSerializer::SerializeTimeDeltas() {
+   int count = profile_->samples_count();
+-  uint64_t lastTime = profile_->start_time().since_origin().InMicroseconds();
++  base::TimeTicks lastTimestamp = profile_->start_time();
+   for (int i = 0; i < count; i++) {
+-    uint64_t ts = profile_->sample(i).timestamp.since_origin().InMicroseconds();
+-    writer_->AddNumber(static_cast<int>(ts - lastTime));
++    int delta = static_cast<int>(
++        (profile_->sample(i).timestamp - lastTimestamp).InMicroseconds());
++    writer_->AddString(std::to_string(delta).c_str());
+     if (i != (count - 1)) writer_->AddString(",");
+-    lastTime = ts;
++    lastTimestamp = profile_->sample(i).timestamp;
+   }
+ }
+ 
diff --git a/deps/v8/patches/007-redacted-heap-snapshot-api.patch b/deps/v8/patches/007-redacted-heap-snapshot-api.patch
new file mode 100644
index 00000000000..ce9bfe04e5f
--- /dev/null
+++ b/deps/v8/patches/007-redacted-heap-snapshot-api.patch
@@ -0,0 +1,20 @@
+diff --git a/deps/v8/src/api/api.cc b/deps/v8/src/api/api.cc
+index 2dd476dda34..cc1b8d41680 100644
+--- a/deps/v8/src/api/api.cc
++++ b/deps/v8/src/api/api.cc
+@@ -11268,6 +11268,15 @@ void HeapSnapshot::Serialize(OutputStream* stream,
+   serializer.Serialize(stream);
+ }
+ 
++RedactedHeapSnapshot::RedactedHeapSnapshot(const HeapSnapshot* snapshot):
++  snapshot_(snapshot) {
++}
++
++void RedactedHeapSnapshot::Serialize(OutputStream* stream) const {
++  i::HeapSnapshotJSONSerializer serializer(ToInternal(snapshot_));
++  serializer.Serialize(stream, true);
++}
++
+ // static
+ STATIC_CONST_MEMBER_DEFINITION const SnapshotObjectId
+     HeapProfiler::kUnknownObjectId;
diff --git a/deps/v8/patches/008-redacted-heap-snapshot-header.patch b/deps/v8/patches/008-redacted-heap-snapshot-header.patch
new file mode 100644
index 00000000000..9e4eacea71f
--- /dev/null
+++ b/deps/v8/patches/008-redacted-heap-snapshot-header.patch
@@ -0,0 +1,22 @@
+diff --git a/deps/v8/include/v8-profiler.h b/deps/v8/include/v8-profiler.h
+index 3ec0cd4bb31..8cc07269d65 100644
+--- a/deps/v8/include/v8-profiler.h
++++ b/deps/v8/include/v8-profiler.h
+@@ -686,6 +686,17 @@ class V8_EXPORT HeapSnapshot {
+                  SerializationFormat format = kJSON) const;
+ };
+ 
++/**
++ * Wrapper to provide redacted serialization for HeapSnapshot
++ */
++class V8_EXPORT RedactedHeapSnapshot {
++ public:
++  RedactedHeapSnapshot() = delete;
++  RedactedHeapSnapshot(const HeapSnapshot* snapshot);
++  void Serialize(OutputStream* stream) const;
++ private:
++  const HeapSnapshot* snapshot_;
++};
+ 
+ /**
+  * An interface for reporting progress and controlling long-running
diff --git a/deps/v8/patches/README.md b/deps/v8/patches/README.md
new file mode 100644
index 00000000000..422b6b24e16
--- /dev/null
+++ b/deps/v8/patches/README.md
@@ -0,0 +1,25 @@
+# V8 Patches for N|Solid
+
+This directory contains individual patches applied to the V8 dependency for N|Solid-specific features and fixes.
+
+## Patches
+
+- **000-allocation-tracker-fix.patch**: Fixes iterator invalidation in allocation-tracker.cc
+- **001-clang-macros-fix.patch**: Fixes is_trivially_copyable for Clang versions <= 17 in base/macros.h
+- **002-cpu-profiler-sigprof-fix.patch**: Prevents crash when handling SIGPROF signal during profiler shutdown in cpu-profiler.cc
+- **003-heap-snapshot-generator-header.patch**: Updates header for redaction support in heap-snapshot-generator.h
+- **004-heap-snapshot-generator-redact.patch**: Adds redaction support to heap snapshot serialization in heap-snapshot-generator.cc
+- **005-output-stream-escape.patch**: Adds string escaping functions to output-stream-writer.h
+- **006-profile-generator-json-fix.patch**: Improves JSON serialization in profile-generator.cc
+- **007-redacted-heap-snapshot-api.patch**: Implements RedactedHeapSnapshot in api.cc
+- **008-redacted-heap-snapshot-header.patch**: Adds RedactedHeapSnapshot class to v8-profiler.h
+
+## Usage
+
+The V8 patches are applied using the `apply-patches.sh` script as a developer tool. This script should be run after checking out the repository or when V8 patches need to be updated.
+The script can be executed from either location:
+
+- From the deps/v8 directory: `cd deps/v8 && ./apply-patches.sh`
+- From the repository root: `deps/v8/apply-patches.sh`
+
+The script is idempotent - it can be run multiple times safely, as it will skip patches that are already applied and only apply those that aren't.
diff --git a/deps/v8/src/heap/cppgc/marking-state.h b/deps/v8/src/heap/cppgc/marking-state.h
index 4ce1ce40741..3153407f4f2 100644
--- a/deps/v8/src/heap/cppgc/marking-state.h
+++ b/deps/v8/src/heap/cppgc/marking-state.h
@@ -342,7 +342,7 @@ class MutatorMarkingState final : public BasicMarkingState {
   ~MutatorMarkingState() override = default;
 
   inline bool MarkNoPush(HeapObjectHeader& header) {
-    return MutatorMarkingState::BasicMarkingState::MarkNoPush(header);
+    return BasicMarkingState::MarkNoPush(header);
   }
 
   inline void ReTraceMarkedWeakContainer(cppgc::Visitor&, HeapObjectHeader&);
diff --git a/deps/zlib/BUILD.gn b/deps/zlib/BUILD.gn
index 378bd0df75c..9f3938021f7 100644
--- a/deps/zlib/BUILD.gn
+++ b/deps/zlib/BUILD.gn
@@ -70,7 +70,7 @@ source_set("zlib_common_headers") {
 use_arm_neon_optimizations = false
 if ((current_cpu == "arm" || current_cpu == "arm64") &&
     !(is_win && !is_clang)) {
-  # TODO(richard.townsend@arm.com): Optimizations temporarily disabled for
+  # TODO(ritownsend@google.com): Optimizations temporarily disabled for
   # Windows on Arm MSVC builds, see http://crbug.com/v8/10012.
   if (arm_use_neon) {
     use_arm_neon_optimizations = true
@@ -173,12 +173,15 @@ if (use_arm_neon_optimizations) {
   }
 }
 
-config("zlib_inflate_chunk_simd_config") {
+config("zlib_data_chunk_simd_config") {
   if (use_x86_x64_optimizations) {
     defines = [ "INFLATE_CHUNK_SIMD_SSE2" ]
 
     if (current_cpu == "x64") {
-      defines += [ "INFLATE_CHUNK_READ_64LE" ]
+      defines += [
+        "INFLATE_CHUNK_READ_64LE",
+        "DEFLATE_CHUNK_WRITE_64LE",
+      ]
     }
   }
 
@@ -186,12 +189,15 @@ config("zlib_inflate_chunk_simd_config") {
     defines = [ "INFLATE_CHUNK_SIMD_NEON" ]
 
     if (current_cpu == "arm64") {
-      defines += [ "INFLATE_CHUNK_READ_64LE" ]
+      defines += [
+        "INFLATE_CHUNK_READ_64LE",
+        "DEFLATE_CHUNK_WRITE_64LE",
+      ]
     }
   }
 }
 
-source_set("zlib_inflate_chunk_simd") {
+source_set("zlib_data_chunk_simd") {
   visibility = [ ":*" ]
 
   if (use_x86_x64_optimizations || use_arm_neon_optimizations) {
@@ -213,7 +219,7 @@ source_set("zlib_inflate_chunk_simd") {
   configs += [ "//build/config/compiler:no_chromium_code" ]
   configs += [ ":zlib_warnings" ]
 
-  public_configs = [ ":zlib_inflate_chunk_simd_config" ]
+  public_configs = [ ":zlib_data_chunk_simd_config" ]
 
   public_deps = [ ":zlib_common_headers" ]
 }
@@ -336,7 +342,7 @@ component("zlib") {
   if (use_x86_x64_optimizations || use_arm_neon_optimizations) {
     deps += [
       ":zlib_adler32_simd",
-      ":zlib_inflate_chunk_simd",
+      ":zlib_data_chunk_simd",
       ":zlib_slide_hash_simd",
     ]
 
diff --git a/deps/zlib/CMakeLists.txt b/deps/zlib/CMakeLists.txt
index 59d77c3a413..f90e719ef4d 100644
--- a/deps/zlib/CMakeLists.txt
+++ b/deps/zlib/CMakeLists.txt
@@ -3,7 +3,7 @@ set(CMAKE_ALLOW_LOOSE_LOOP_CONSTRUCTS ON)
 
 project(zlib C)
 
-set(VERSION "1.3.0.1")
+set(VERSION "1.3.1")
 
 set(INSTALL_BIN_DIR "${CMAKE_INSTALL_PREFIX}/bin" CACHE PATH "Installation directory for executables")
 set(INSTALL_LIB_DIR "${CMAKE_INSTALL_PREFIX}/lib" CACHE PATH "Installation directory for libraries")
@@ -47,6 +47,7 @@ if (ENABLE_SIMD_OPTIMIZATIONS)
     add_definitions(-DINFLATE_CHUNK_SIMD_SSE2)
     add_definitions(-DADLER32_SIMD_SSSE3)
     add_definitions(-DINFLATE_CHUNK_READ_64LE)
+    add_definitions(-DDEFLATE_CHUNK_WRITE_64LE)
     add_definitions(-DCRC32_SIMD_SSE42_PCLMUL)
     if (ENABLE_SIMD_AVX512)
       add_definitions(-DCRC32_SIMD_AVX512_PCLMUL)
@@ -64,6 +65,7 @@ if (ENABLE_SIMD_OPTIMIZATIONS)
     add_definitions(-DINFLATE_CHUNK_SIMD_NEON)
     add_definitions(-DADLER32_SIMD_NEON)
     add_definitions(-DINFLATE_CHUNK_READ_64LE)
+    add_definitions(-DDEFLATE_CHUNK_WRITE_64LE)
     add_definitions(-DCRC32_ARMV8_CRC32)
     add_definitions(-DDEFLATE_SLIDE_HASH_NEON)
     # Required by CPU features detection code.
@@ -83,10 +85,13 @@ if (ENABLE_SIMD_OPTIMIZATIONS)
     add_definitions(-DDEFLATE_SLIDE_HASH_RVV)
     add_definitions(-DADLER32_SIMD_RVV)
 
-    # TODO(cavalcantii): add remaining flags as we port optimizations to RVV.
     # chunk_copy is required for READ64 and unconditional decode of literals.
     add_definitions(-DINFLATE_CHUNK_GENERIC)
     add_definitions(-DINFLATE_CHUNK_READ_64LE)
+    add_definitions(-DDEFLATE_CHUNK_WRITE_64LE)
+
+    # TODO(cavalcantii): only missing optimization is SLIDE_HASH, got port it
+    # to RISCV.
 
     # Tested with clang-17, unaligned loads are required by read64 & chunk_copy.
     # TODO(cavalcantii): replace internal clang flags for -munaligned-access
@@ -267,7 +272,9 @@ if(MINGW)
 endif(MINGW)
 
 add_library(zlib SHARED ${ZLIB_SRCS} ${ZLIB_DLL_SRCS} ${ZLIB_PUBLIC_HDRS} ${ZLIB_PRIVATE_HDRS})
+target_include_directories(zlib PUBLIC ${CMAKE_CURRENT_BINARY_DIR} ${CMAKE_CURRENT_SOURCE_DIR})
 add_library(zlibstatic STATIC ${ZLIB_SRCS} ${ZLIB_PUBLIC_HDRS} ${ZLIB_PRIVATE_HDRS})
+target_include_directories(zlibstatic PUBLIC ${CMAKE_CURRENT_BINARY_DIR} ${CMAKE_CURRENT_SOURCE_DIR})
 set_target_properties(zlib PROPERTIES DEFINE_SYMBOL ZLIB_DLL)
 set_target_properties(zlib PROPERTIES SOVERSION 1)
 
@@ -386,6 +393,7 @@ if (BUILD_MINIZIP_BIN)
   add_executable(minizip_bin contrib/minizip/minizip.c contrib/minizip/ioapi.c
     contrib/minizip/ioapi.h contrib/minizip/unzip.c
     contrib/minizip/unzip.h contrib/minizip/zip.c contrib/minizip/zip.h
+    contrib/minizip/ints.h contrib/minizip/skipset.h
     )
   target_link_libraries(minizip_bin zlib)
 endif()
diff --git a/deps/zlib/OWNERS b/deps/zlib/OWNERS
index 3a821578a74..333dabdbae6 100644
--- a/deps/zlib/OWNERS
+++ b/deps/zlib/OWNERS
@@ -1,4 +1,3 @@
-agl@chromium.org
 cavalcantii@chromium.org
-cblume@chromium.org
-scroggo@google.com
+hans@chromium.org
+agl@chromium.org  #{LAST_RESORT_SUGGESTION}
diff --git a/deps/zlib/README.chromium b/deps/zlib/README.chromium
index 92c5bfd1af2..1f7c7460451 100644
--- a/deps/zlib/README.chromium
+++ b/deps/zlib/README.chromium
@@ -1,9 +1,9 @@
 Name: zlib
 Short Name: zlib
 URL: http://zlib.net/
-Version: 1.3.0.1
-Revision: ac8f12c97d1afd9bafa9c710f827d40a407d3266
-CPEPrefix: cpe:/a:zlib:zlib:1.3.0.1
+Version: 1.3.1
+Revision: 51b7f2abdade71cd9bb0e7a373ef2610ec6f9daf
+CPEPrefix: cpe:/a:zlib:zlib:1.3.1
 Security Critical: yes
 Shipped: yes
 License: Zlib
@@ -21,14 +21,17 @@ also implements the zlib (RFC 1950) and gzip (RFC 1952) wrapper formats.
 Local Modifications:
  - Only source code from the zlib distribution used to build the zlib and
    minizip libraries are present. Many other files have been omitted. Only *.c
-   and *.h files from the upstream root directory and contrib/minizip were
-   imported.
+   and *.h files from the upstream root directory, contrib/minizip and
+   examples/zpipe.c were imported.
+ - The files named '*simd*' are original x86/Arm/RISC-V specific optimizations.
  - The contents of the google directory are original Chromium-specific
    additions.
+ - The contents of the 'contrib' of directory are either Chromium-specific
+   additions or heavily patched zlib files (e.g. inffast_chunk*).
  - Added chromeconf.h
  - Plus the changes in 'patches' folder.
  - Code in contrib/ other than contrib/minizip was added to match zlib's
    contributor layout.
- - In sync with 1.2.13 official release
+ - In sync with 1.3.1 official release
  - ZIP reader modified to allow for progress callbacks during extraction.
  - ZIP reader modified to add detection of AES encrypted content.
diff --git a/deps/zlib/contrib/bench/zlib_bench.cc b/deps/zlib/contrib/bench/zlib_bench.cc
index 6df296c8721..5d84b8c9cb6 100644
--- a/deps/zlib/contrib/bench/zlib_bench.cc
+++ b/deps/zlib/contrib/bench/zlib_bench.cc
@@ -18,18 +18,19 @@
  *   g++|clang++ -O3 -Wall -std=c++11 zlib_bench.cc -lstdc++ -lz
  */
 
+#include <memory.h>
+#include <stdint.h>
+#include <stdio.h>
+#include <stdlib.h>
+
 #include <algorithm>
 #include <chrono>
 #include <fstream>
 #include <memory>
+#include <new>
 #include <string>
 #include <vector>
 
-#include <memory.h>
-#include <stdint.h>
-#include <stdio.h>
-#include <stdlib.h>
-
 #include "zlib.h"
 
 void error_exit(const char* error, int code) {
diff --git a/deps/zlib/contrib/minizip/Makefile b/deps/zlib/contrib/minizip/Makefile
index aac76e07f6b..b3e050a0416 100644
--- a/deps/zlib/contrib/minizip/Makefile
+++ b/deps/zlib/contrib/minizip/Makefile
@@ -1,5 +1,5 @@
-CC=cc
-CFLAGS := $(CFLAGS) -O -I../..
+CC?=cc
+CFLAGS := -O $(CFLAGS) -I../..
 
 UNZ_OBJS = miniunz.o unzip.o ioapi.o ../../libz.a
 ZIP_OBJS = minizip.o zip.o   ioapi.o ../../libz.a
@@ -9,13 +9,21 @@ ZIP_OBJS = minizip.o zip.o   ioapi.o ../../libz.a
 
 all: miniunz minizip
 
-miniunz:  $(UNZ_OBJS)
+miniunz.o: miniunz.c unzip.h iowin32.h
+minizip.o: minizip.c zip.h iowin32.h ints.h
+unzip.o: unzip.c unzip.h crypt.h
+zip.o: zip.c zip.h crypt.h skipset.h ints.h
+ioapi.o: ioapi.c ioapi.h ints.h
+iowin32.o: iowin32.c iowin32.h ioapi.h
+mztools.o: mztools.c unzip.h
+
+miniunz: $(UNZ_OBJS)
 	$(CC) $(CFLAGS) -o $@ $(UNZ_OBJS)
 
-minizip:  $(ZIP_OBJS)
+minizip: $(ZIP_OBJS)
 	$(CC) $(CFLAGS) -o $@ $(ZIP_OBJS)
 
-test:	miniunz minizip
+test: miniunz minizip
 	@rm -f test.*
 	@echo hello hello hello > test.txt
 	./minizip test test.txt
diff --git a/deps/zlib/contrib/minizip/README.chromium b/deps/zlib/contrib/minizip/README.chromium
index ceaff34f0f3..ee70ec59ad1 100644
--- a/deps/zlib/contrib/minizip/README.chromium
+++ b/deps/zlib/contrib/minizip/README.chromium
@@ -1,8 +1,8 @@
 Name: ZIP file API for reading file entries in a ZIP archive
 Short Name: minizip
 URL: https://github.com/madler/zlib/tree/master/contrib/minizip
-Version: 1.3.0.1
-Revision: 643e17b7498d12ab8d15565662880579692f769d
+Version: 1.3.1.1
+Revision: ef24c4c7502169f016dcd2a26923dbaf3216748c
 License: Zlib
 License File: //third_party/zlib/LICENSE
 Shipped: yes
@@ -14,6 +14,13 @@ Minizip provides API on top of zlib that can enumerate and extract ZIP archive
 files. See minizip.md for chromium build instructions.
 
 Local Modifications:
+- OS macro tweaks for Android and Fuchsia
+  0000-build.patch (the contrib/minizip/ parts)
+  0008-minizip-zip-unzip-tools.patch (crrev.com/886990)
+
+- Fix build on UWP. (crrev.com/750639)
+  0004-fix-uwp.patch
+
 - Fixed uncompressing files with wrong uncompressed size set
   crrev.com/268940
   0014-minizip-unzip-with-incorrect-size.patch
@@ -27,3 +34,8 @@ Local Modifications:
   https://pkware.cachefly.net/webdocs/casestudies/APPNOTE.TXT section 4.6.9.
   (see crrev.com/1002476)
   0016-minizip-parse-unicode-path-extra-field.patch
+
+- Added support for zip64 archives that have extra bytes on front (for example,
+  large CRX files).
+  0018-support-prefixed-zip64.patch
+
diff --git a/deps/zlib/contrib/minizip/ints.h b/deps/zlib/contrib/minizip/ints.h
new file mode 100644
index 00000000000..4c84375b213
--- /dev/null
+++ b/deps/zlib/contrib/minizip/ints.h
@@ -0,0 +1,57 @@
+/* ints.h -- create integer types for 8, 16, 32, and 64 bits
+ * Copyright (C) 2024 Mark Adler
+ * For conditions of distribution and use, see the copyright notice in zlib.h
+ *
+ * There exist compilers with limits.h, but not stdint.h or inttypes.h.
+ */
+
+#ifndef INTS_H
+#define INTS_H
+#include <limits.h>
+#if defined(UCHAR_MAX) && UCHAR_MAX == 0xff
+    typedef signed char i8_t;
+    typedef unsigned char ui8_t;
+#else
+#   error "no 8-bit integer"
+#endif
+#if defined(USHRT_MAX) && USHRT_MAX == 0xffff
+    typedef short i16_t;
+    typedef unsigned short ui16_t;
+#elif defined(UINT_MAX) && UINT_MAX == 0xffff
+    typedef int i16_t;
+    typedef unsigned ui16_t;
+#else
+#   error "no 16-bit integer"
+#endif
+#if defined(UINT_MAX) && UINT_MAX == 0xffffffff
+    typedef int i32_t;
+    typedef unsigned ui32_t;
+#   define PI32 "d"
+#   define PUI32 "u"
+#elif defined(ULONG_MAX) && ULONG_MAX == 0xffffffff
+    typedef long i32_t;
+    typedef unsigned long ui32_t;
+#   define PI32 "ld"
+#   define PUI32 "lu"
+#else
+#   error "no 32-bit integer"
+#endif
+#if defined(ULONG_MAX) && ULONG_MAX == 0xffffffffffffffff
+    typedef long i64_t;
+    typedef unsigned long ui64_t;
+#   define PI64 "ld"
+#   define PUI64 "lu"
+#elif defined(ULLONG_MAX) && ULLONG_MAX == 0xffffffffffffffff
+    typedef long long i64_t;
+    typedef unsigned long long ui64_t;
+#   define PI64 "lld"
+#   define PUI64 "llu"
+#elif defined(ULONG_LONG_MAX) && ULONG_LONG_MAX == 0xffffffffffffffff
+    typedef long long i64_t;
+    typedef unsigned long long ui64_t;
+#   define PI64 "lld"
+#   define PUI64 "llu"
+#else
+#   error "no 64-bit integer"
+#endif
+#endif
diff --git a/deps/zlib/contrib/minizip/ioapi.h b/deps/zlib/contrib/minizip/ioapi.h
index a2d2e6e60d9..f3b193d8030 100644
--- a/deps/zlib/contrib/minizip/ioapi.h
+++ b/deps/zlib/contrib/minizip/ioapi.h
@@ -18,8 +18,8 @@
 
 */
 
-#ifndef _ZLIBIOAPI64_H
-#define _ZLIBIOAPI64_H
+#ifndef ZLIBIOAPI64_H
+#define ZLIBIOAPI64_H
 
 #if (!defined(_WIN32)) && (!defined(WIN32)) && (!defined(__APPLE__))
 
@@ -67,39 +67,12 @@
 #endif
 #endif
 
-/*
-#ifndef ZPOS64_T
-  #ifdef _WIN32
-                #define ZPOS64_T fpos_t
-  #else
-    #include <stdint.h>
-    #define ZPOS64_T uint64_t
-  #endif
-#endif
-*/
-
 #ifdef HAVE_MINIZIP64_CONF_H
 #include "mz64conf.h"
 #endif
 
-/* a type chosen by DEFINE */
-#ifdef HAVE_64BIT_INT_CUSTOM
-typedef  64BIT_INT_CUSTOM_TYPE ZPOS64_T;
-#else
-#ifdef HAS_STDINT_H
-#include "stdint.h"
-typedef uint64_t ZPOS64_T;
-#else
-
-
-
-#if defined(_MSC_VER) || defined(__BORLANDC__)
-typedef unsigned __int64 ZPOS64_T;
-#else
-typedef unsigned long long int ZPOS64_T;
-#endif
-#endif
-#endif
+#include "ints.h"
+typedef ui64_t ZPOS64_T;
 
 /* Maximum unsigned 32-bit value used as placeholder for zip64 */
 #ifndef MAXU32
diff --git a/deps/zlib/contrib/minizip/iowin32.c b/deps/zlib/contrib/minizip/iowin32.c
index 3f6867fd7e4..393c98676f0 100644
--- a/deps/zlib/contrib/minizip/iowin32.c
+++ b/deps/zlib/contrib/minizip/iowin32.c
@@ -88,7 +88,7 @@ static voidpf win32_build_iowin(HANDLE hFile) {
 }
 
 voidpf ZCALLBACK win32_open64_file_func(voidpf opaque, const void* filename, int mode) {
-    const char* mode_fopen = NULL;
+    (void)opaque;
     DWORD dwDesiredAccess,dwCreationDisposition,dwShareMode,dwFlagsAndAttributes ;
     HANDLE hFile = NULL;
 
@@ -116,7 +116,7 @@ voidpf ZCALLBACK win32_open64_file_func(voidpf opaque, const void* filename, int
 
 
 voidpf ZCALLBACK win32_open64_file_funcA(voidpf opaque, const void* filename, int mode) {
-    const char* mode_fopen = NULL;
+    (void)opaque;
     DWORD dwDesiredAccess,dwCreationDisposition,dwShareMode,dwFlagsAndAttributes ;
     HANDLE hFile = NULL;
 
@@ -139,7 +139,7 @@ voidpf ZCALLBACK win32_open64_file_funcA(voidpf opaque, const void* filename, in
 
 
 voidpf ZCALLBACK win32_open64_file_funcW(voidpf opaque, const void* filename, int mode) {
-    const char* mode_fopen = NULL;
+    (void)opaque;
     DWORD dwDesiredAccess,dwCreationDisposition,dwShareMode,dwFlagsAndAttributes ;
     HANDLE hFile = NULL;
 
@@ -158,7 +158,7 @@ voidpf ZCALLBACK win32_open64_file_funcW(voidpf opaque, const void* filename, in
 
 
 voidpf ZCALLBACK win32_open_file_func(voidpf opaque, const char* filename, int mode) {
-    const char* mode_fopen = NULL;
+    (void)opaque;
     DWORD dwDesiredAccess,dwCreationDisposition,dwShareMode,dwFlagsAndAttributes ;
     HANDLE hFile = NULL;
 
@@ -186,6 +186,7 @@ voidpf ZCALLBACK win32_open_file_func(voidpf opaque, const char* filename, int m
 
 
 uLong ZCALLBACK win32_read_file_func(voidpf opaque, voidpf stream, void* buf,uLong size) {
+    (void)opaque;
     uLong ret=0;
     HANDLE hFile = NULL;
     if (stream!=NULL)
@@ -207,6 +208,7 @@ uLong ZCALLBACK win32_read_file_func(voidpf opaque, voidpf stream, void* buf,uLo
 
 
 uLong ZCALLBACK win32_write_file_func(voidpf opaque, voidpf stream, const void* buf, uLong size) {
+    (void)opaque;
     uLong ret=0;
     HANDLE hFile = NULL;
     if (stream!=NULL)
@@ -246,6 +248,7 @@ static BOOL MySetFilePointerEx(HANDLE hFile, LARGE_INTEGER pos, LARGE_INTEGER *n
 }
 
 long ZCALLBACK win32_tell_file_func(voidpf opaque, voidpf stream) {
+    (void)opaque;
     long ret=-1;
     HANDLE hFile = NULL;
     if (stream!=NULL)
@@ -268,6 +271,7 @@ long ZCALLBACK win32_tell_file_func(voidpf opaque, voidpf stream) {
 }
 
 ZPOS64_T ZCALLBACK win32_tell64_file_func(voidpf opaque, voidpf stream) {
+    (void)opaque;
     ZPOS64_T ret= (ZPOS64_T)-1;
     HANDLE hFile = NULL;
     if (stream!=NULL)
@@ -292,6 +296,7 @@ ZPOS64_T ZCALLBACK win32_tell64_file_func(voidpf opaque, voidpf stream) {
 
 
 long ZCALLBACK win32_seek_file_func(voidpf opaque, voidpf stream, uLong offset, int origin) {
+    (void)opaque;
     DWORD dwMoveMethod=0xFFFFFFFF;
     HANDLE hFile = NULL;
 
@@ -329,6 +334,7 @@ long ZCALLBACK win32_seek_file_func(voidpf opaque, voidpf stream, uLong offset,
 }
 
 long ZCALLBACK win32_seek64_file_func(voidpf opaque, voidpf stream, ZPOS64_T offset, int origin) {
+    (void)opaque;
     DWORD dwMoveMethod=0xFFFFFFFF;
     HANDLE hFile = NULL;
     long ret=-1;
@@ -367,6 +373,7 @@ long ZCALLBACK win32_seek64_file_func(voidpf opaque, voidpf stream, ZPOS64_T off
 }
 
 int ZCALLBACK win32_close_file_func(voidpf opaque, voidpf stream) {
+    (void)opaque;
     int ret=-1;
 
     if (stream!=NULL)
@@ -384,6 +391,7 @@ int ZCALLBACK win32_close_file_func(voidpf opaque, voidpf stream) {
 }
 
 int ZCALLBACK win32_error_file_func(voidpf opaque, voidpf stream) {
+    (void)opaque;
     int ret=-1;
     if (stream!=NULL)
     {
diff --git a/deps/zlib/contrib/minizip/miniunz.c b/deps/zlib/contrib/minizip/miniunz.c
index 5b4312e5647..f4ad16bdd37 100644
--- a/deps/zlib/contrib/minizip/miniunz.c
+++ b/deps/zlib/contrib/minizip/miniunz.c
@@ -39,6 +39,9 @@
 #endif
 
 
+#ifndef _CRT_SECURE_NO_WARNINGS
+#  define _CRT_SECURE_NO_WARNINGS
+#endif
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -79,10 +82,11 @@
 
 /* change_file_date : change the date/time of a file
     filename : the filename of the file where date/time must be modified
-    dosdate : the new date at the MSDos format (4 bytes)
+    dosdate : the new date at the MSDOS format (4 bytes)
     tmu_date : the SAME new date at the tm_unz format */
 static void change_file_date(const char *filename, uLong dosdate, tm_unz tmu_date) {
 #ifdef _WIN32
+  (void)tmu_date;
   HANDLE hFile;
   FILETIME ftm,ftLocal,ftCreate,ftLastAcc,ftLastWrite;
 
@@ -93,8 +97,7 @@ static void change_file_date(const char *filename, uLong dosdate, tm_unz tmu_dat
   LocalFileTimeToFileTime(&ftLocal,&ftm);
   SetFileTime(hFile,&ftm,&ftLastAcc,&ftm);
   CloseHandle(hFile);
-#else
-#if defined(unix) || defined(__APPLE__) || defined(__Fuchsia__) || defined(__ANDROID_API__)
+#elif defined(__unix__) || defined(__unix) || defined(__APPLE__) || defined(__Fuchsia__) || defined(__ANDROID_API__)
   (void)dosdate;
   struct utimbuf ut;
   struct tm newdate;
@@ -116,7 +119,6 @@ static void change_file_date(const char *filename, uLong dosdate, tm_unz tmu_dat
   (void)dosdate;
   (void)tmu_date;
 #endif
-#endif
 }
 
 
@@ -125,9 +127,9 @@ static void change_file_date(const char *filename, uLong dosdate, tm_unz tmu_dat
 
 static int mymkdir(const char* dirname) {
     int ret=0;
-#if defined(_WIN32)
+#ifdef _WIN32
     ret = _mkdir(dirname);
-#elif defined(unix) || defined(__APPLE__) || defined(__Fuchsia__) || defined(__ANDROID_API__)
+#elif defined(__unix__) || defined(__unix) || defined(__APPLE__) || defined(__Fuchsia__) || defined(__ANDROID_API__)
     ret = mkdir (dirname,0775);
 #else
     (void)dirname;
@@ -238,7 +240,7 @@ static int do_list(unzFile uf) {
     printf("  ------  ------     ---- -----   ----    ----   ------     ----\n");
     for (i=0;i<gi.number_entry;i++)
     {
-        char filename_inzip[256];
+        char filename_inzip[65536+1];
         unz_file_info64 file_info;
         uLong ratio=0;
         const char *string_method = "";
@@ -303,7 +305,7 @@ static int do_list(unzFile uf) {
 
 
 static int do_extract_currentfile(unzFile uf, const int* popt_extract_without_path, int* popt_overwrite, const char* password) {
-    char filename_inzip[256];
+    char filename_inzip[65536+1];
     char* filename_withoutpath;
     char* p;
     int err=UNZ_OK;
@@ -354,6 +356,20 @@ static int do_extract_currentfile(unzFile uf, const int* popt_extract_without_pa
         else
             write_filename = filename_withoutpath;
 
+        if (write_filename[0]!='\0')
+        {
+            const char* relative_check = write_filename;
+            while (relative_check[1]!='\0')
+            {
+                if (relative_check[0]=='.' && relative_check[1]=='.')
+                    write_filename = relative_check;
+                relative_check++;
+            }
+        }
+
+        while (write_filename[0]=='/' || write_filename[0]=='.')
+            write_filename++;
+
         err = unzOpenCurrentFilePassword(uf,password);
         if (err!=UNZ_OK)
         {
diff --git a/deps/zlib/contrib/minizip/minizip.c b/deps/zlib/contrib/minizip/minizip.c
index 9eb3956a55e..53fdd363e62 100644
--- a/deps/zlib/contrib/minizip/minizip.c
+++ b/deps/zlib/contrib/minizip/minizip.c
@@ -40,6 +40,9 @@
 
 
 
+#ifndef _CRT_SECURE_NO_WARNINGS
+#  define _CRT_SECURE_NO_WARNINGS
+#endif
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -58,6 +61,7 @@
 #endif
 
 #include "zip.h"
+#include "ints.h"
 
 #ifdef _WIN32
         #define USEWIN32IOAPI
@@ -73,6 +77,7 @@
 /* f: name of file to get info on, tmzip: return value: access,
    modification and creation times, dt: dostime */
 static int filetime(const char *f, tm_zip *tmzip, uLong *dt) {
+  (void)tmzip;
   int ret = 0;
   {
       FILETIME ftLocal;
@@ -90,8 +95,7 @@ static int filetime(const char *f, tm_zip *tmzip, uLong *dt) {
   }
   return ret;
 }
-#else
-#if defined(unix) || defined(__APPLE__) || defined(__Fuchsia__) || defined(__ANDROID_API__)
+#elif defined(__unix__) || defined(__unix) || defined(__APPLE__) || defined(__Fuchsia__) || defined(__ANDROID_API__)
 /* f: name of file to get info on, tmzip: return value: access,
    modification and creation times, dt: dostime */
 static int filetime(const char *f, tm_zip *tmzip, uLong *dt) {
@@ -142,7 +146,6 @@ static int filetime(const char *f, tm_zip *tmzip, uLong *dt) {
     return 0;
 }
 #endif
-#endif
 
 
 
@@ -191,7 +194,7 @@ static int getFileCrc(const char* filenameinzip, void* buf, unsigned long size_b
         do
         {
             err = ZIP_OK;
-            size_read = fread(buf,1,size_buf,fin);
+            size_read = (unsigned long)fread(buf,1,size_buf,fin);
             if (size_read < size_buf)
                 if (feof(fin)==0)
             {
@@ -223,7 +226,7 @@ static int isLargeFile(const char* filename) {
     FSEEKO_FUNC(pFile, 0, SEEK_END);
     pos = (ZPOS64_T)FTELLO_FUNC(pFile);
 
-                printf("File : %s is %llu bytes\n", filename, pos);
+                printf("File : %s is %"PUI64" bytes\n", filename, pos);
 
     if(pos >= 0xffffffff)
      largeFile = 1;
@@ -243,7 +246,7 @@ int main(int argc, char *argv[]) {
     char filename_try[MAXFILENAME+16];
     int zipok;
     int err=0;
-    size_t size_buf=0;
+    unsigned long size_buf=0;
     void* buf=NULL;
     const char* password=NULL;
 
@@ -305,7 +308,7 @@ int main(int argc, char *argv[]) {
     }
     else
     {
-        int i,len;
+        int len;
         int dot_found=0;
 
         zipok = 1 ;
diff --git a/deps/zlib/contrib/minizip/mztools.c b/deps/zlib/contrib/minizip/mztools.c
index c8d23756155..f86c1e71b09 100644
--- a/deps/zlib/contrib/minizip/mztools.c
+++ b/deps/zlib/contrib/minizip/mztools.c
@@ -5,6 +5,9 @@
 */
 
 /* Code */
+#ifndef _CRT_SECURE_NO_WARNINGS
+#  define _CRT_SECURE_NO_WARNINGS
+#endif
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
@@ -140,28 +143,28 @@ extern int ZEXPORT unzRepair(const char* file, const char* fileOut, const char*
 
         /* Central directory entry */
         {
-          char header[46];
+          char central[46];
           char* comment = "";
           int comsize = (int) strlen(comment);
-          WRITE_32(header, 0x02014b50);
-          WRITE_16(header + 4, version);
-          WRITE_16(header + 6, version);
-          WRITE_16(header + 8, gpflag);
-          WRITE_16(header + 10, method);
-          WRITE_16(header + 12, filetime);
-          WRITE_16(header + 14, filedate);
-          WRITE_32(header + 16, crc);
-          WRITE_32(header + 20, cpsize);
-          WRITE_32(header + 24, uncpsize);
-          WRITE_16(header + 28, fnsize);
-          WRITE_16(header + 30, extsize);
-          WRITE_16(header + 32, comsize);
-          WRITE_16(header + 34, 0);     /* disk # */
-          WRITE_16(header + 36, 0);     /* int attrb */
-          WRITE_32(header + 38, 0);     /* ext attrb */
-          WRITE_32(header + 42, currentOffset);
+          WRITE_32(central, 0x02014b50);
+          WRITE_16(central + 4, version);
+          WRITE_16(central + 6, version);
+          WRITE_16(central + 8, gpflag);
+          WRITE_16(central + 10, method);
+          WRITE_16(central + 12, filetime);
+          WRITE_16(central + 14, filedate);
+          WRITE_32(central + 16, crc);
+          WRITE_32(central + 20, cpsize);
+          WRITE_32(central + 24, uncpsize);
+          WRITE_16(central + 28, fnsize);
+          WRITE_16(central + 30, extsize);
+          WRITE_16(central + 32, comsize);
+          WRITE_16(central + 34, 0);    /* disk # */
+          WRITE_16(central + 36, 0);    /* int attrb */
+          WRITE_32(central + 38, 0);    /* ext attrb */
+          WRITE_32(central + 42, currentOffset);
           /* Header */
-          if (fwrite(header, 1, 46, fpOutCD) == 46) {
+          if (fwrite(central, 1, 46, fpOutCD) == 46) {
             offsetCD += 46;
 
             /* Filename */
@@ -215,23 +218,23 @@ extern int ZEXPORT unzRepair(const char* file, const char* fileOut, const char*
     /* Final central directory  */
     {
       int entriesZip = entries;
-      char header[22];
+      char end[22];
       char* comment = ""; // "ZIP File recovered by zlib/minizip/mztools";
       int comsize = (int) strlen(comment);
       if (entriesZip > 0xffff) {
         entriesZip = 0xffff;
       }
-      WRITE_32(header, 0x06054b50);
-      WRITE_16(header + 4, 0);    /* disk # */
-      WRITE_16(header + 6, 0);    /* disk # */
-      WRITE_16(header + 8, entriesZip);   /* hack */
-      WRITE_16(header + 10, entriesZip);  /* hack */
-      WRITE_32(header + 12, offsetCD);    /* size of CD */
-      WRITE_32(header + 16, offset);      /* offset to CD */
-      WRITE_16(header + 20, comsize);     /* comment */
+      WRITE_32(end, 0x06054b50);
+      WRITE_16(end + 4, 0);         /* disk # */
+      WRITE_16(end + 6, 0);         /* disk # */
+      WRITE_16(end + 8, entriesZip);        /* hack */
+      WRITE_16(end + 10, entriesZip);       /* hack */
+      WRITE_32(end + 12, offsetCD);         /* size of CD */
+      WRITE_32(end + 16, offset);           /* offset to CD */
+      WRITE_16(end + 20, comsize);          /* comment */
 
       /* Header */
-      if (fwrite(header, 1, 22, fpOutCD) == 22) {
+      if (fwrite(end, 1, 22, fpOutCD) == 22) {
 
         /* Comment field */
         if (comsize > 0) {
diff --git a/deps/zlib/contrib/minizip/skipset.h b/deps/zlib/contrib/minizip/skipset.h
new file mode 100644
index 00000000000..5e648b9d234
--- /dev/null
+++ b/deps/zlib/contrib/minizip/skipset.h
@@ -0,0 +1,361 @@
+// skipset.h -- set operations using a skiplist
+// Copyright (C) 2024 Mark Adler
+// See MiniZip_info.txt for the license.
+
+// This implements a skiplist set, i.e. just keys, no data, with ~O(log n) time
+// insert and search operations. The application defines the type of a key, and
+// provides a function to compare two keys.
+
+// This header is not definitions of functions found in another source file --
+// it creates the set functions, with the application's key type, right where
+// the #include is. Before this header is #included, these must be defined:
+//
+// 1. A macro or typedef for set_key_t, the type of a key.
+// 2. A macro or function set_cmp(a, b) to compare two keys. The return values
+//    are < 0 for a < b, 0 for a == b, and > 0 for a > b.
+// 3. A macro or function set_drop(s, k) to release the key k's resources, if
+//    any, when doing a set_end() or set_clear(). s is a pointer to the set
+//    that key is in, for use with set_free() if desired.
+//
+// Example usage:
+//
+//      typedef int set_key_t;
+//      #define set_cmp(a, b) ((a) < (b) ? -1 : (a) == (b) ? 0 : 1)
+//      #define set_drop(s, k)
+//      #include "skipset.h"
+//
+//      int test(void) {        // return 0: good, 1: bad, -1: out of memory
+//          set_t set;
+//          if (setjmp(set.env))
+//              return -1;
+//          set_start(&set);
+//          set_insert(&set, 2);
+//          set_insert(&set, 1);
+//          set_insert(&set, 7);
+//          int bad = !set_found(&set, 2);
+//          bad = bad || set_found(&set, 5);
+//          set_end(&set);
+//          return bad;
+//      }
+//
+// Interface summary (see more details below):
+// - set_t is the type of the set being operated on (a set_t pointer is passed)
+// - set_start() initializes a new, empty set (initialize set.env first)
+// - set_insert() inserts a new key into the set, or not if it's already there
+// - set_found() determines whether or not a key is in the set
+// - set_end() ends the use of the set, freeing all memory
+// - set_clear() empties the set, equivalent to set_end() and then set_start()
+// - set_ok() checks if set appears to be usable, i.e. started and not ended
+//
+// Auxiliary functions available to the application:
+// - set_alloc() allocates memory with optional tracking (#define SET_TRACK)
+// - set_free() deallocates memory allocated by set_alloc()
+// - set_rand() returns 32 random bits (seeded by set_start())
+
+#ifndef SKIPSET_H
+#define SKIPSET_H
+
+#include <stdlib.h>     // realloc(), free(), NULL, size_t
+#include <stddef.h>     // ptrdiff_t
+#include <setjmp.h>     // jmp_buf, longjmp()
+#include <errno.h>      // ENOMEM
+#include <time.h>       // time(), clock()
+#include <assert.h>     // assert.h
+#include "ints.h"       // i16_t, ui32_t, ui64_t
+
+// Structures and functions below noted as "--private--" should not be used by
+// the application. set_t is partially private and partially public -- see the
+// comments there.
+
+// There is no POSIX random() in MSVC, and rand() is awful. For portability, we
+// cannot rely on a library function for random numbers. Instead we use the
+// fast and effective algorithm below, invented by Melissa O'Neill.
+
+// *Really* minimal PCG32 code / (c) 2014 M.E. O'Neill / www.pcg-random.org
+// Licensed under Apache License 2.0 (NO WARRANTY, etc. see website)
+// --private-- Random number generator state.
+typedef struct {
+    ui64_t state;       // 64-bit generator state
+    ui64_t inc;         // 63-bit sequence id
+} set_rand_t;
+// --private-- Initialize the state *gen using seed and seq. seed seeds the
+// advancing 64-bit state. seq is a sequence selection constant.
+void set_seed(set_rand_t *gen, ui64_t seed, ui64_t seq) {
+    gen->inc = (seq << 1) | 1;
+    gen->state = (seed + gen->inc) * 6364136223846793005ULL + gen->inc;
+}
+// Return 32 random bits, advancing the state *gen.
+ui32_t set_rand(set_rand_t *gen) {
+    ui64_t state = gen->state;
+    gen->state = state * 6364136223846793005ULL + gen->inc;
+    ui32_t mix = (ui32_t)(((state >> 18) ^ state) >> 27);
+    int rot = state >> 59;
+    return (mix >> rot) | (mix << ((-rot) & 31));
+}
+// End of PCG32 code.
+
+// --private-- Linked-list node.
+typedef struct set_node_s set_node_t;
+struct set_node_s {
+    set_key_t key;          // the key (not used for head or path)
+    i16_t size;             // number of allocated pointers in right[]
+    i16_t fill;             // number of pointers in right[] filled in
+    set_node_t **right;     // pointer for each level, each to the right
+};
+
+// A set. The application sets env, may use gen with set_rand(), and may read
+// allocs and memory. The remaining variables are --private-- .
+typedef struct set_s {
+    set_node_t *head;       // skiplist head -- no key, just links
+    set_node_t *path;       // right[] is path to key from set_found()
+    set_node_t *node;       // node under construction, in case of longjmp()
+    i16_t depth;            // maximum depth of the skiplist
+    ui64_t ran;             // a precious trove of random bits
+    set_rand_t gen;         // random number generator state
+    jmp_buf env;            // setjmp() environment for allocation errors
+#ifdef SET_TRACK
+    size_t allocs;          // number of allocations
+    size_t memory;          // total amount of allocated memory (>= requests)
+#endif
+} set_t;
+
+// Memory allocation and deallocation. set_alloc(set, ptr, size) returns a
+// pointer to an allocation of size bytes if ptr is NULL, or the previous
+// allocation ptr resized to size bytes. set_alloc() will never return NULL.
+// set_free(set, ptr) frees an allocation created by set_alloc(). These may be
+// used by the application. e.g. if allocation tracking is desired.
+#ifdef SET_TRACK
+// Track the number of allocations and the total backing memory size.
+#  if defined(_WIN32)
+#    include <malloc.h>
+#    define SET_ALLOC_SIZE(ptr) _msize(ptr)
+#  elif defined(__MACH__)
+#    include <malloc/malloc.h>
+#    define SET_ALLOC_SIZE(ptr) malloc_size(ptr)
+#  elif defined(__linux__)
+#    include <malloc.h>
+#    define SET_ALLOC_SIZE(ptr) malloc_usable_size(ptr)
+#  elif defined(__FreeBSD__)
+#    include <malloc_np.h>
+#    define SET_ALLOC_SIZE(ptr) malloc_usable_size(ptr)
+#  elif defined(__NetBSD__)
+#    include <jemalloc/jemalloc.h>
+#    define SET_ALLOC_SIZE(ptr) malloc_usable_size(ptr)
+#  else     // e.g. OpenBSD
+#    define SET_ALLOC_SIZE(ptr) 0
+#  endif
+// With tracking.
+void *set_alloc(set_t *set, void *ptr, size_t size) {
+    size_t had = ptr == NULL ? 0 : SET_ALLOC_SIZE(ptr);
+    void *mem = realloc(ptr, size);
+    if (mem == NULL)
+        longjmp(set->env, ENOMEM);
+    set->allocs += ptr == NULL;
+    set->memory += SET_ALLOC_SIZE(mem) - had;
+    return mem;
+}
+void set_free(set_t *set, void *ptr) {
+    if (ptr != NULL) {
+        set->allocs--;
+        set->memory -= SET_ALLOC_SIZE(ptr);
+        free(ptr);
+    }
+}
+#else
+// Without tracking.
+void *set_alloc(set_t *set, void *ptr, size_t size) {
+    void *mem = realloc(ptr, size);
+    if (mem == NULL)
+        longjmp(set->env, ENOMEM);
+    return mem;
+}
+void set_free(set_t *set, void *ptr) {
+    (void)set;
+    free(ptr);
+}
+#endif
+
+// --private-- Grow node's array right[] as needed to be able to hold at least
+// want links. If fill is true, assure that the first want links are filled in,
+// setting them to set->head if not previously filled in. Otherwise it is
+// assumed that the first want links are about to be filled in.
+void set_grow(set_t *set, set_node_t *node, int want, int fill) {
+    if (node->size < want) {
+        int more = node->size ? node->size : 1;
+        while (more < want)
+            more <<= 1;
+        node->right = set_alloc(set, node->right, more * sizeof(set_node_t *));
+        node->size = (i16_t)more;
+    }
+    int i;
+    if (fill)
+        for (i = node->fill; i < want; i++)
+            node->right[i] = set->head;
+    node->fill = (i16_t)want;
+}
+
+// --private-- Return a new node. key is left uninitialized.
+set_node_t *set_node(set_t *set) {
+    set_node_t *node = set_alloc(set, NULL, sizeof(set_node_t));
+    node->size = 0;
+    node->fill = 0;
+    node->right = NULL;
+    return node;
+}
+
+// --private-- Free the list linked from head, along with the keys.
+void set_sweep(set_t *set) {
+    set_node_t *step = set->head->right[0];
+    while (step != set->head) {
+        set_node_t *next = step->right[0];      // save link to next node
+        set_drop(set, step->key);
+        set_free(set, step->right);
+        set_free(set, step);
+        step = next;
+    }
+}
+
+// Initialize a new set. set->env must be initialized using setjmp() before
+// set_start() is called. A longjmp(set->env, ENOMEM) will be used to handle a
+// memory allocation failure during any of the operations. (See setjmp.h and
+// errno.h.) The set can still be used if this happens, assuming that it didn't
+// happen during set_start(). Whether set_start() completed or not, set_end()
+// can be used to free the set's memory after a longjmp().
+void set_start(set_t *set) {
+#ifdef SET_TRACK
+    set->allocs = 0;
+    set->memory = 0;
+#endif
+    set->head = set->path = set->node = NULL;   // in case set_node() fails
+    set->path = set_node(set);
+    set->head = set_node(set);
+    set_grow(set, set->head, 1, 1); // one link back to head for an empty set
+    *(unsigned char *)&set->head->key = 137;    // set id
+    set->depth = 0;
+    set_seed(&set->gen, ((ui64_t)(ptrdiff_t)set << 32) ^
+                        ((ui64_t)time(NULL) << 12) ^ clock(), 0);
+    set->ran = 1;
+}
+
+// Return true if *set appears to be in a usable state. If *set has been zeroed
+// out, then set_ok(set) will be false and set_end(set) will be safe.
+int set_ok(set_t *set) {
+    return set->head != NULL &&
+           set->head->right != NULL &&
+           *(unsigned char *)&set->head->key == 137;
+}
+
+// Empty the set. This frees the memory used for the previous set contents.
+// After set_clear(), *set is ready for use, as if after a set_start().
+void set_clear(set_t *set) {
+    assert(set_ok(set) && "improper use");
+
+    // Free all the keys and their nodes.
+    set_sweep(set);
+
+    // Leave the head and path allocations as is. Clear their contents, with
+    // head pointing to itself and setting depth to zero, for an empty set.
+    set->head->right[0] = set->head;
+    set->head->fill = 1;
+    set->path->fill = 0;
+    set->depth = 0;
+}
+
+// Done using the set -- free all allocations. The only operation on *set
+// permitted after this is set_start(). Though another set_end() would do no
+// harm. This can be done at any time after a set_start(), or after a longjmp()
+// on any allocation failure, including during a set_start().
+void set_end(set_t *set) {
+    if (set->head != NULL) {
+        // Empty the set and free the head node.
+        if (set->head->right != NULL) {
+            set_sweep(set);
+            set_free(set, set->head->right);
+        }
+        set_free(set, set->head);
+        set->head = NULL;
+    }
+    if (set->path != NULL) {
+        // Free the path work area.
+        set_free(set, set->path->right);
+        set_free(set, set->path);
+        set->path = NULL;
+    }
+    if (set->node != NULL) {
+        // Free the node that was under construction when longjmp() hit.
+        set_drop(set, set->node->key);
+        set_free(set, set->node->right);
+        set_free(set, set->node);
+        set->node = NULL;
+    }
+}
+
+// Look for key. Return 1 if found or 0 if not. This also puts the path to get
+// there in set->path, for use by set_insert().
+int set_found(set_t *set, set_key_t key) {
+    assert(set_ok(set) && "improper use");
+
+    // Start at depth and work down and right as determined by key comparisons.
+    set_node_t *head = set->head, *here = head;
+    int i = set->depth;
+    set_grow(set, set->path, i + 1, 0);
+    do {
+        while (here->right[i] != head &&
+               set_cmp(here->right[i]->key, key) < 0)
+            here = here->right[i];
+        set->path->right[i] = here;
+    } while (i--);
+
+    // See if the key matches.
+    here = here->right[0];
+    return here != head && set_cmp(here->key, key) == 0;
+}
+
+// Insert the key key. Return 0 on success, or 1 if key is already in the set.
+int set_insert(set_t *set, set_key_t key) {
+    assert(set_ok(set) && "improper use");
+
+    if (set_found(set, key))
+        // That key is already in the set.
+        return 1;
+
+    // Randomly generate a new level-- level 0 with probability 1/2, 1 with
+    // probability 1/4, 2 with probability 1/8, etc.
+    int level = 0;
+    for (;;) {
+        if (set->ran == 1)
+            // Ran out. Get another 32 random bits.
+            set->ran = set_rand(&set->gen) | (1ULL << 32);
+        int bit = set->ran & 1;
+        set->ran >>= 1;
+        if (bit)
+            break;
+        assert(level < 32767 &&
+               "Overhead, without any fuss, the stars were going out.");
+        level++;
+    }
+    if (level > set->depth) {
+        // The maximum depth is now deeper. Update the structures.
+        set_grow(set, set->path, level + 1, 1);
+        set_grow(set, set->head, level + 1, 1);
+        set->depth = (i16_t)level;
+    }
+
+    // Make a new node for the provided key, and insert it in the lists up to
+    // and including level.
+    set->node = set_node(set);
+    set->node->key = key;
+    set_grow(set, set->node, level + 1, 0);
+    int i;
+    for (i = 0; i <= level; i++) {
+        set->node->right[i] = set->path->right[i]->right[i];
+        set->path->right[i]->right[i] = set->node;
+    }
+    set->node = NULL;
+    return 0;
+}
+
+#else
+#error ** another skiplist set already created here
+// Would need to implement a prefix in order to support multiple sets.
+#endif
diff --git a/deps/zlib/contrib/minizip/unzip.c b/deps/zlib/contrib/minizip/unzip.c
index 3576a8504dd..95a945c0ac5 100644
--- a/deps/zlib/contrib/minizip/unzip.c
+++ b/deps/zlib/contrib/minizip/unzip.c
@@ -88,7 +88,7 @@
 
 
 #ifndef CASESENSITIVITYDEFAULT_NO
-#  if !defined(unix) && !defined(CASESENSITIVITYDEFAULT_YES)
+#  if (!defined(__unix__) && !defined(__unix) || defined(__CYGWIN__))  && !defined(CASESENSITIVITYDEFAULT_YES)
 #    define CASESENSITIVITYDEFAULT_NO
 #  endif
 #endif
@@ -113,7 +113,7 @@
 const char unz_copyright[] =
    " unzip 1.01 Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll";
 
-/* unz_file_info_interntal contain internal info about a file in zipfile*/
+/* unz_file_info64_internal contain internal info about a file in zipfile*/
 typedef struct unz_file_info64_internal_s
 {
     ZPOS64_T offset_curfile;/* relative offset of local header 8 bytes */
@@ -336,7 +336,6 @@ extern int ZEXPORT unzStringFileNameCompare (const char*  fileName1,
 #define CENTRALDIRINVALID ((ZPOS64_T)(-1))
 #endif
 
-
 /*
   Locate the Central directory of a zipfile (at the end, just before
     the global comment)
@@ -467,7 +466,7 @@ local ZPOS64_T unz64local_SearchCentralDir64(const zlib_filefunc64_32_def* pzlib
     if (unz64local_getLong(pzlib_filefunc_def,filestream,&uL)!=UNZ_OK)
         return CENTRALDIRINVALID;
 
-    /* number of the disk with the start of the zip64 end of  central directory */
+    /* number of the disk with the start of the zip64 end of central directory */
     if (unz64local_getLong(pzlib_filefunc_def,filestream,&uL)!=UNZ_OK)
         return CENTRALDIRINVALID;
     if (uL != 0)
@@ -483,6 +482,46 @@ local ZPOS64_T unz64local_SearchCentralDir64(const zlib_filefunc64_32_def* pzlib
     if (uL != 1)
         return CENTRALDIRINVALID;
 
+    /* If bytes are pre-pended to the archive, relativeOffset must be advanced
+       by that many bytes. The central dir must exist between the specified
+       relativeOffset and uPosFound. */
+    if (relativeOffset > uPosFound)
+        return CENTRALDIRINVALID;
+    const int BUFSIZE = 1024 * 4;
+    buf = (unsigned char*)ALLOC(BUFSIZE);
+    if (buf==NULL)
+        return CENTRALDIRINVALID;
+    // Zip64 EOCDR is at least 48 bytes long.
+    while (uPosFound - relativeOffset >= 48) {
+        int found = 0;
+        uLong uReadSize = uPosFound - relativeOffset;
+        if (uReadSize > BUFSIZE) {
+            uReadSize = BUFSIZE;
+        }
+        if (ZSEEK64(*pzlib_filefunc_def, filestream, relativeOffset, ZLIB_FILEFUNC_SEEK_SET) != 0) {
+            break;
+        }
+        if (ZREAD64(*pzlib_filefunc_def, filestream, buf, uReadSize) != uReadSize) {
+            break;
+        }
+        for (int i = 0; i < uReadSize - 3; ++i) {
+            // Looking for 0x06064b50, the Zip64 EOCDR signature.
+            if (buf[i] == 0x50 && buf[i + 1] == 0x4b &&
+                buf[i + 2] == 0x06 && buf[i + 3] == 0x06)
+            {
+                relativeOffset += i;
+                found = 1;
+                break;
+            }
+        }
+        if (found) {
+            break;
+        }
+        // Re-read the last 3 bytes, in case they're the front of the signature.
+        relativeOffset += uReadSize - 3;
+    }
+    free(buf);
+
     /* Goto end of central directory record */
     if (ZSEEK64(*pzlib_filefunc_def,filestream, relativeOffset,ZLIB_FILEFUNC_SEEK_SET)!=0)
         return CENTRALDIRINVALID;
@@ -514,9 +553,9 @@ local unzFile unzOpenInternal(const void *path,
     ZPOS64_T central_pos;
     uLong   uL;
 
-    uLong number_disk;          /* number of the current dist, used for
+    uLong number_disk;          /* number of the current disk, used for
                                    spanning ZIP, unsupported, always 0*/
-    uLong number_disk_with_CD;  /* number the the disk with central dir, used
+    uLong number_disk_with_CD;  /* number the disk with central dir, used
                                    for spanning ZIP, unsupported, always 0*/
     ZPOS64_T number_entry_CD;      /* total number of entries in
                                    the central dir
@@ -1006,6 +1045,8 @@ local int unz64local_GetCurrentFileInfoInternal(unzFile file,
                     {
                         uLong uSizeRead;
 
+                        file_info.size_filename = fileNameSize;
+
                         if (fileNameSize < fileNameBufferSize)
                         {
                              *(szFileName + fileNameSize) = '\0';
@@ -1682,7 +1723,7 @@ extern int ZEXPORT unzReadCurrentFile(unzFile file, voidp buf, unsigned len) {
                 uInt i;
                 for(i=0;i<uReadThis;i++)
                   pfile_in_zip_read_info->read_buffer[i] =
-                      zdecode(s->keys,s->pcrc_32_tab,
+                      (char)zdecode(s->keys,s->pcrc_32_tab,
                               pfile_in_zip_read_info->read_buffer[i]);
             }
 #            endif
diff --git a/deps/zlib/contrib/minizip/unzip.h b/deps/zlib/contrib/minizip/unzip.h
index 14105840f6d..ceb614e7832 100644
--- a/deps/zlib/contrib/minizip/unzip.h
+++ b/deps/zlib/contrib/minizip/unzip.h
@@ -306,13 +306,17 @@ extern int ZEXPORT unzGetCurrentFileInfo(unzFile file,
   Get Info about the current file
   if pfile_info!=NULL, the *pfile_info structure will contain some info about
         the current file
-  if szFileName!=NULL, the filemane string will be copied in szFileName
+  if szFileName!=NULL, the filename string will be copied in szFileName
             (fileNameBufferSize is the size of the buffer)
   if extraField!=NULL, the extra field information will be copied in extraField
             (extraFieldBufferSize is the size of the buffer).
             This is the Central-header version of the extra field
   if szComment!=NULL, the comment string of the file will be copied in szComment
             (commentBufferSize is the size of the buffer)
+  The file name and comment will be zero-terminated if there is room in the
+  provided buffer. Otherwise the buffer will contain as much as will fit. If at
+  least 65537 bytes of room is provided, then the result will always be
+  complete and zero-terminated.
 */
 
 
diff --git a/deps/zlib/contrib/minizip/zip.c b/deps/zlib/contrib/minizip/zip.c
index e2e9da07c5f..93d2612e29a 100644
--- a/deps/zlib/contrib/minizip/zip.c
+++ b/deps/zlib/contrib/minizip/zip.c
@@ -25,8 +25,10 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <stdint.h>
 #include <time.h>
+#ifndef ZLIB_CONST
+#  define ZLIB_CONST
+#endif
 #include "zlib.h"
 #include "zip.h"
 
@@ -123,6 +125,19 @@ typedef struct linkedlist_data_s
 } linkedlist_data;
 
 
+// zipAlreadyThere() set functions for a set of zero-terminated strings, and
+// a block_t type for reading the central directory datablocks.
+typedef char *set_key_t;
+#define set_cmp(a, b) strcmp(a, b)
+#define set_drop(s, k) set_free(s, k)
+#include "skipset.h"
+typedef struct {
+    unsigned char *next;        // next byte in datablock data
+    size_t left;                // number of bytes left in data (at least)
+    linkedlist_datablock_internal *node;    // current datablock
+} block_t;
+
+
 typedef struct
 {
     z_stream stream;            /* zLib stream structure for inflate */
@@ -174,6 +189,10 @@ typedef struct
     char *globalcomment;
 #endif
 
+    // Support for zipAlreadyThere().
+    set_t set;              // set for detecting name collisions
+    block_t block;          // block for reading the central directory
+
 } zip64_internal;
 
 
@@ -264,6 +283,228 @@ local int add_data_in_datablock(linkedlist_data* ll, const void* buf, uLong len)
     return ZIP_OK;
 }
 
+// zipAlreadyThere() operations. "set" in the zip internal structure keeps the
+// set of names that are in the under-construction central directory so far. A
+// skipset provides ~O(log n) time insertion and searching. Central directory
+// records, stored in a linked list of allocated memory datablocks, is read
+// through "block" in the zip internal structure.
+
+// The block_*() functions support extracting the central directory file names
+// from the datablocks. They are designed to support a growing directory by
+// automatically continuing once more data has been appended to the linked
+// datablocks.
+
+// Initialize *block to the head of list. This should only be called once the
+// list has at least some data in it, i.e. list->first_block is not NULL.
+local void block_init(block_t *block, linkedlist_data *list) {
+    block->node = list->first_block;
+    block->next = block->node->data;
+    block->left = block->node->filled_in_this_block;
+}
+
+// Mark *block as bad, with all subsequent reads returning end, even if more
+// data is added to the datablocks. This is invoked if the central directory is
+// invalid, so there is no longer any point in attempting to interpret it.
+local void block_stop(block_t *block) {
+    block->left = 0;
+    block->next = NULL;
+}
+
+// Return true if *block has reached the end of the data in the datablocks.
+local int block_end(block_t *block) {
+    linkedlist_datablock_internal *node = block->node;
+    if (node == NULL)
+        // This block was previously terminated with extreme prejudice.
+        return 1;
+    if (block->next < node->data + node->filled_in_this_block)
+        // There are more bytes to read in the current datablock.
+        return 0;
+    while (node->next_datablock != NULL) {
+        if (node->filled_in_this_block != 0)
+            // There are some bytes in a later datablock.
+            return 0;
+        node = node->next_datablock;
+    }
+    // Reached the end of the list of datablocks. There's nothing.
+    return 1;
+}
+
+// Return one byte from *block, or -1 if the end is reached.
+local int block_get(block_t *block) {
+    while (block->left == 0) {
+        if (block->node == NULL)
+            // We've been marked bad. Return end.
+            return -1;
+        // Update left in case more was filled in since we were last here.
+        block->left = block->node->filled_in_this_block -
+                      (block->next - block->node->data);
+        if (block->left != 0)
+            // There was indeed more data appended in the current datablock.
+            break;
+        if (block->node->next_datablock == NULL)
+            // No more data here, and there is no next datablock. At the end.
+            return -1;
+        // Try the next datablock for more data.
+        block->node = block->node->next_datablock;
+        block->next = block->node->data;
+        block->left = block->node->filled_in_this_block;
+    }
+    // We have a byte to return.
+    block->left--;
+    return *block->next++;
+}
+
+// Return a 16-bit unsigned little-endian value from block, or a negative value
+// if the end is reached.
+local long block_get2(block_t *block) {
+    long got = block_get(block);
+    return got | ((unsigned long)block_get(block) << 8);
+}
+
+// Read up to len bytes from block into buf. Return the number of bytes read.
+local size_t block_read(block_t *block, unsigned char *buf, size_t len) {
+    size_t need = len;
+    while (need) {
+        if (block->left == 0) {
+            // Get a byte to update and step through the linked list as needed.
+            int got = block_get(block);
+            if (got == -1)
+                // Reached the end.
+                break;
+            *buf++ = (unsigned char)got;
+            need--;
+            continue;
+        }
+        size_t take = need > block->left ? block->left : need;
+        memcpy(buf, block->next, take);
+        block->next += take;
+        block->left -= take;
+        buf += take;
+        need -= take;
+    }
+    return len - need;      // return the number of bytes copied
+}
+
+// Skip n bytes in block. Return 0 on success or -1 if there are less than n
+// bytes to the end.
+local int block_skip(block_t *block, size_t n) {
+    while (n > block->left) {
+        n -= block->left;
+        block->next += block->left;
+        block->left = 0;
+        if (block_get(block) == -1)
+            return -1;
+        n--;
+    }
+    block->next += n;
+    block->left -= n;
+    return 0;
+}
+
+// Process the next central directory record at *block. Return the allocated,
+// zero-terminated file name, or NULL for end of input or invalid data. If
+// invalid, *block is marked bad. This uses *set for the allocation of memory.
+local char *block_central_name(block_t *block, set_t *set) {
+    char *name = NULL;
+    for (;;) {
+        if (block_end(block))
+            // At the end of the central directory (so far).
+            return NULL;
+
+        // Check for a central directory record signature.
+        if (block_get2(block) != (CENTRALHEADERMAGIC & 0xffff) ||
+            block_get2(block) != (CENTRALHEADERMAGIC >> 16))
+            // Incorrect signature.
+            break;
+
+        // Go through the remaining fixed-length portion of the record,
+        // extracting the lengths of the three variable-length fields.
+        block_skip(block, 24);
+        unsigned flen = block_get2(block);      // file name length
+        unsigned xlen = block_get2(block);      // extra field length
+        unsigned clen = block_get2(block);      // comment field length
+        if (block_skip(block, 12) == -1)
+            // Premature end of the record.
+            break;
+
+        // Extract the name and skip over the extra and comment fields.
+        name = set_alloc(set, NULL, flen + 1);
+        if (block_read(block, (unsigned char *)name, flen) < flen ||
+            block_skip(block, xlen + clen) == -1)
+            // Premature end of the record.
+            break;
+
+        // Check for embedded nuls in the name.
+        if (memchr(name, 0, flen) != NULL) {
+            // This name can never match the zero-terminated name provided to
+            // zipAlreadyThere(), so we discard it and go back to get another
+            // name. (Who the heck is putting nuls inside their zip file entry
+            // names anyway?)
+            set_free(set, name);
+            continue;
+        }
+
+        // All good. Return the zero-terminated file name.
+        name[flen] = 0;
+        return name;
+    }
+
+    // Invalid signature or premature end of the central directory record.
+    // Abandon trying to process the central directory.
+    set_free(set, name);
+    block_stop(block);
+    return NULL;
+}
+
+// Return 0 if name is not in the central directory so far, 1 if it is, -1 if
+// the central directory is invalid, -2 if out of memory, or ZIP_PARAMERROR if
+// file is NULL.
+extern int ZEXPORT zipAlreadyThere(zipFile file, char const *name) {
+    zip64_internal *zip = file;
+    if (zip == NULL)
+        return ZIP_PARAMERROR;
+    if (zip->central_dir.first_block == NULL)
+        // No central directory yet, so no, name isn't there.
+        return 0;
+    if (setjmp(zip->set.env)) {
+        // Memory allocation failure.
+        set_end(&zip->set);
+        return -2;
+    }
+    if (!set_ok(&zip->set)) {
+        // This is the first time here with some central directory content. We
+        // construct this set of names only on demand. Prepare set and block.
+        set_start(&zip->set);
+        block_init(&zip->block, &zip->central_dir);
+    }
+
+    // Update the set of names from the current central directory contents.
+    // This reads any new central directory records since the last time we were
+    // here.
+    for (;;) {
+        char *there = block_central_name(&zip->block, &zip->set);
+        if (there == NULL) {
+            if (zip->block.next == NULL)
+                // The central directory is invalid.
+                return -1;
+            break;
+        }
+
+        // Add there to the set.
+        if (set_insert(&zip->set, there))
+            // There's already a duplicate in the central directory! We'll just
+            // let this be and carry on.
+            set_free(&zip->set, there);
+    }
+
+    // Return true if name is in the central directory.
+    size_t len = strlen(name);
+    char *copy = set_alloc(&zip->set, NULL, len + 1);
+    strcpy(copy, name);
+    int found = set_found(&zip->set, copy);
+    set_free(&zip->set, copy);
+    return found;
+}
 
 
 /****************************************************************************/
@@ -551,7 +792,7 @@ local ZPOS64_T zip64local_SearchCentralDir64(const zlib_filefunc64_32_def* pzlib
 
     for (i=(int)uReadSize-3; (i--)>0;)
     {
-      // Signature "0x07064b50" Zip64 end of central directory locater
+      // Signature "0x07064b50" Zip64 end of central directory locator
       if (((*(buf+i))==0x50) && ((*(buf+i+1))==0x4b) && ((*(buf+i+2))==0x06) && ((*(buf+i+3))==0x07))
       {
         uPosFound = uReadPos+(unsigned)i;
@@ -575,7 +816,7 @@ local ZPOS64_T zip64local_SearchCentralDir64(const zlib_filefunc64_32_def* pzlib
   if (zip64local_getLong(pzlib_filefunc_def,filestream,&uL)!=ZIP_OK)
     return 0;
 
-  /* number of the disk with the start of the zip64 end of  central directory */
+  /* number of the disk with the start of the zip64 end of central directory */
   if (zip64local_getLong(pzlib_filefunc_def,filestream,&uL)!=ZIP_OK)
     return 0;
   if (uL != 0)
@@ -843,6 +1084,7 @@ extern zipFile ZEXPORT zipOpen3(const void *pathname, int append, zipcharpc* glo
     ziinit.number_entry = 0;
     ziinit.add_position_when_writing_offset = 0;
     init_linkedlist(&(ziinit.central_dir));
+    memset(&ziinit.set, 0, sizeof(set_t));  // make sure set appears dormant
 
 
 
@@ -1027,7 +1269,6 @@ extern int ZEXPORT zipOpenNewFileInZip4_64(zipFile file, const char* filename, c
     int err = ZIP_OK;
 
 #    ifdef NOCRYPT
-    (crcForCrypting);
     if (password != NULL)
         return ZIP_PARAMERROR;
 #    endif
@@ -1412,7 +1653,7 @@ extern int ZEXPORT zipWriteInFileInZip(zipFile file, const void* buf, unsigned i
     else
 #endif
     {
-      zi->ci.stream.next_in = (Bytef*)(uintptr_t)buf;
+      zi->ci.stream.next_in = buf;
       zi->ci.stream.avail_in = len;
 
       while ((err==ZIP_OK) && (zi->ci.stream.avail_in>0))
@@ -1608,7 +1849,7 @@ extern int ZEXPORT zipCloseFileInZipRaw64(zipFile file, ZPOS64_T uncompressed_si
 
       if((uLong)(datasize + 4) > zi->ci.size_centralExtraFree)
       {
-        // we can not write more data to the buffer that we have room for.
+        // we cannot write more data to the buffer that we have room for.
         return ZIP_BADZIPFILE;
       }
 
@@ -1871,6 +2112,8 @@ extern int ZEXPORT zipClose(zipFile file, const char* global_comment) {
     }
     free_linkedlist(&(zi->central_dir));
 
+    set_end(&zi->set);          // set was zeroed, so this is safe
+
     pos = centraldir_pos_inzip - zi->add_position_when_writing_offset;
     if(pos >= 0xffffffff || zi->number_entry >= 0xFFFF)
     {
diff --git a/deps/zlib/contrib/minizip/zip.h b/deps/zlib/contrib/minizip/zip.h
index 3e230d3405f..1f7f0b263d4 100644
--- a/deps/zlib/contrib/minizip/zip.h
+++ b/deps/zlib/contrib/minizip/zip.h
@@ -35,7 +35,7 @@
 
         See header of zip.h
 
-*/
+ */
 
 #ifndef _zip12_H
 #define _zip12_H
@@ -127,12 +127,12 @@ extern zipFile ZEXPORT zipOpen64(const void *pathname, int append);
      If the zipfile cannot be opened, the return value is NULL.
      Else, the return value is a zipFile Handle, usable with other function
        of this zip package.
-*/
+ */
 
 /* Note : there is no delete function into a zipfile.
    If you want delete file into a zipfile, you must open a zipfile, and create another
    Of course, you can use RAW reading and writing to copy the file you did not want delete
-*/
+ */
 
 extern zipFile ZEXPORT zipOpen2(const char *pathname,
                                 int append,
@@ -186,7 +186,7 @@ extern int ZEXPORT zipOpenNewFileInZip64(zipFile file,
   zip64 is set to 1 if a zip64 extended information block should be added to the local file header.
                     this MUST be '1' if the uncompressed size is >= 0xffffffff.
 
-*/
+ */
 
 
 extern int ZEXPORT zipOpenNewFileInZip2(zipFile file,
@@ -311,12 +311,12 @@ extern int ZEXPORT zipWriteInFileInZip(zipFile file,
                                        unsigned len);
 /*
   Write data in the zipfile
-*/
+ */
 
 extern int ZEXPORT zipCloseFileInZip(zipFile file);
 /*
   Close the current file in the zipfile
-*/
+ */
 
 extern int ZEXPORT zipCloseFileInZipRaw(zipFile file,
                                         uLong uncompressed_size,
@@ -326,17 +326,23 @@ extern int ZEXPORT zipCloseFileInZipRaw64(zipFile file,
                                           ZPOS64_T uncompressed_size,
                                           uLong crc32);
 
+extern int ZEXPORT zipAlreadyThere(zipFile file,
+                                   char const* name);
+/*
+  See if name is already in file's central directory.
+ */
+
 /*
   Close the current file in the zipfile, for file opened with
     parameter raw=1 in zipOpenNewFileInZip2
   uncompressed_size and crc32 are value for the uncompressed size
-*/
+ */
 
 extern int ZEXPORT zipClose(zipFile file,
                             const char* global_comment);
 /*
   Close the zipfile
-*/
+ */
 
 
 extern int ZEXPORT zipRemoveExtraInfoBlock(char* pData, int* dataLen, short sHeader);
@@ -355,7 +361,7 @@ extern int ZEXPORT zipRemoveExtraInfoBlock(char* pData, int* dataLen, short sHea
 
                         Remove ZIP64 Extra information from a Local File Header extra field data
         zipRemoveExtraInfoBlock(pLocalHeaderExtraFieldData, &nLocalHeaderExtraFieldDataLen, 0x0001);
-*/
+ */
 
 #ifdef __cplusplus
 }
diff --git a/deps/zlib/contrib/tests/fuzzers/BUILD.gn b/deps/zlib/contrib/tests/fuzzers/BUILD.gn
index d7db4b3459b..1538482f2ec 100644
--- a/deps/zlib/contrib/tests/fuzzers/BUILD.gn
+++ b/deps/zlib/contrib/tests/fuzzers/BUILD.gn
@@ -43,3 +43,9 @@ fuzzer_test("zlib_deflate_fuzzer") {
   sources = [ "deflate_fuzzer.cc" ]
   deps = [ "../../../:zlib" ]
 }
+
+fuzzer_test("minizip_unzip_fuzzer") {
+  sources = [ "minizip_unzip_fuzzer.cc" ]
+  deps = [ "../../../:minizip" ]
+  include_dirs = [ "//third_party/zlib/contrib/minizip" ]
+}
diff --git a/deps/zlib/contrib/tests/fuzzers/minizip_unzip_fuzzer.cc b/deps/zlib/contrib/tests/fuzzers/minizip_unzip_fuzzer.cc
new file mode 100644
index 00000000000..3b9fa446bfb
--- /dev/null
+++ b/deps/zlib/contrib/tests/fuzzers/minizip_unzip_fuzzer.cc
@@ -0,0 +1,119 @@
+// Copyright 2025 The Chromium Authors
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <algorithm>
+#include <cstdint>
+#include <cstring>
+#include <vector>
+
+#include "unzip.h"
+
+// Fuzzer builds often have NDEBUG set, so roll our own assert macro.
+#define ASSERT(cond)                                                           \
+  do {                                                                         \
+    if (!(cond)) {                                                             \
+      fprintf(stderr, "%s:%d Assert failed: %s\n", __FILE__, __LINE__, #cond); \
+      exit(1);                                                                 \
+    }                                                                          \
+  } while (0)
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+  // Mock read-only filesystem with only one file, file_data. In the calls
+  // below, 'opaque' points to file_data, and 'strm' points to the file's seek
+  // position, which is heap allocated so that failing to "close" it triggers a
+  // leak error.
+  std::vector<uint8_t> file_data(data, data + size);
+  zlib_filefunc64_def file_func = {
+      .zopen64_file = [](void* opaque, const void* filename,
+                         int mode) -> void* {
+        ASSERT(mode == (ZLIB_FILEFUNC_MODE_READ | ZLIB_FILEFUNC_MODE_EXISTING));
+        return new size_t(0);
+      },
+      .zread_file = [](void* opaque, void* strm, void* buf,
+                       uLong size) -> uLong {
+        std::vector<uint8_t>* vec = static_cast<std::vector<uint8_t>*>(opaque);
+        size_t* pos = static_cast<size_t*>(strm);
+        if (*pos >= vec->size()) {
+          return 0;
+        }
+        size = std::min(static_cast<size_t>(size), vec->size() - *pos);
+        memcpy(buf, vec->data() + *pos, size);
+        (*pos) += size;
+        return size;
+      },
+      .zwrite_file = [](void*, void*, const void*, uLong) -> uLong {
+        ASSERT(0 && "Writing is not supported.");
+        return 0;
+      },
+      .ztell64_file = [](void*, void* strm) -> ZPOS64_T {
+        return *static_cast<size_t*>(strm);
+      },
+      .zseek64_file = [](void* opaque, void* strm, ZPOS64_T offset,
+                         int origin) -> long {
+        std::vector<uint8_t>* vec = static_cast<std::vector<uint8_t>*>(opaque);
+        size_t* pos = static_cast<size_t*>(strm);
+        switch (origin) {
+          case ZLIB_FILEFUNC_SEEK_SET:
+            *pos = offset;
+            break;
+          case ZLIB_FILEFUNC_SEEK_CUR:
+            *pos = *pos + offset;
+            break;
+          case ZLIB_FILEFUNC_SEEK_END:
+            *pos = vec->size() + offset;
+            break;
+          default:
+            ASSERT(0 && "Invalid origin");
+        }
+        return 0;
+      },
+      .zclose_file = [](void*, void* strm) -> int {
+        delete static_cast<size_t*>(strm);
+        return 0;
+      },
+      .zerror_file = [](void*, void*) -> int { return 0; },
+      .opaque = &file_data};
+
+  unzFile uzf = unzOpen2_64("foo.zip", &file_func);
+  if (uzf == NULL) {
+    return 0;
+  }
+
+  while (true) {
+    unz_file_info64 info = {0};
+
+    // TODO: Pass nullptrs and different buffer sizes to cover more code.
+    char filename[UINT16_MAX + 1];  // +1 for the null terminator.
+    char extra[UINT16_MAX];         // No null terminator.
+    char comment[UINT16_MAX + 1];   // +1 for the null terminator.
+
+    if (unzGetCurrentFileInfo64(uzf, &info, filename, sizeof(filename), extra,
+                                sizeof(extra), comment, sizeof(comment)) == UNZ_OK) {
+      ASSERT(info.size_filename <= UINT16_MAX);
+      ASSERT(info.size_file_extra <= UINT16_MAX);
+      ASSERT(info.size_file_comment <= UINT16_MAX);
+
+      ASSERT(filename[info.size_filename] == '\0');
+      ASSERT(comment[info.size_file_comment] == '\0');
+    }
+
+    if (unzOpenCurrentFile(uzf) == UNZ_OK) {
+      while (true) {
+        char buffer[4096];
+        int num_read = unzReadCurrentFile(uzf, buffer, sizeof(buffer));
+        if (num_read <= 0) {
+          break;
+        }
+      }
+      unzCloseCurrentFile(uzf);
+    }
+
+    if (unzGoToNextFile(uzf) != UNZ_OK) {
+      break;
+    }
+  }
+
+  unzClose(uzf);
+  return 0;
+}
diff --git a/deps/zlib/deflate.c b/deps/zlib/deflate.c
index 8a5281c2b6c..872ba790178 100644
--- a/deps/zlib/deflate.c
+++ b/deps/zlib/deflate.c
@@ -1,5 +1,5 @@
 /* deflate.c -- compress data using the deflation algorithm
- * Copyright (C) 1995-2023 Jean-loup Gailly and Mark Adler
+ * Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -69,7 +69,7 @@
 #endif
 
 const char deflate_copyright[] =
-   " deflate 1.3.0.1 Copyright 1995-2023 Jean-loup Gailly and Mark Adler ";
+   " deflate 1.3.1 Copyright 1995-2024 Jean-loup Gailly and Mark Adler ";
 /*
   If you use the zlib library in a product, an acknowledgment is welcome
   in the documentation of your product. If for some reason you cannot
@@ -485,14 +485,7 @@ int ZEXPORT deflateInit2_(z_streamp strm, int level, int method,
     s->window = (Bytef *) ZALLOC(strm,
                                  s->w_size + WINDOW_PADDING,
                                  2*sizeof(Byte));
-    /* Avoid use of unitialized values in the window, see crbug.com/1137613 and
-     * crbug.com/1144420 */
-    zmemzero(s->window, (s->w_size + WINDOW_PADDING) * (2 * sizeof(Byte)));
     s->prev   = (Posf *)  ZALLOC(strm, s->w_size, sizeof(Pos));
-    /* Avoid use of uninitialized value, see:
-     * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360
-     */
-    zmemzero(s->prev, s->w_size * sizeof(Pos));
     s->head   = (Posf *)  ZALLOC(strm, s->hash_size, sizeof(Pos));
 
     s->high_water = 0;      /* nothing written to s->window yet */
@@ -551,6 +544,13 @@ int ZEXPORT deflateInit2_(z_streamp strm, int level, int method,
         deflateEnd (strm);
         return Z_MEM_ERROR;
     }
+    /* Avoid use of unitialized values in the window, see crbug.com/1137613 and
+     * crbug.com/1144420 */
+    zmemzero(s->window, (s->w_size + WINDOW_PADDING) * (2 * sizeof(Byte)));
+    /* Avoid use of uninitialized value, see:
+     * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360
+     */
+    zmemzero(s->prev, s->w_size * sizeof(Pos));
 #ifdef LIT_MEM
     s->d_buf = (ushf *)(s->pending_buf + (s->lit_bufsize << 1));
     s->l_buf = s->pending_buf + (s->lit_bufsize << 2);
@@ -790,7 +790,11 @@ int ZEXPORT deflatePrime(z_streamp strm, int bits, int value) {
         put = Buf_size - s->bi_valid;
         if (put > bits)
             put = bits;
+#if defined(DEFLATE_CHUNK_WRITE_64LE)
+        s->bi_buf |= (uint64_t)((value & ((1ULL << put) - 1)) << s->bi_valid);
+#else
         s->bi_buf |= (ush)((value & ((1 << put) - 1)) << s->bi_valid);
+#endif /* DEFLATE_CHUNK_WRITE_64LE */
         s->bi_valid += put;
         _tr_flush_bits(s);
         value >>= put;
@@ -1663,13 +1667,21 @@ local uInt longest_match(deflate_state *s, IPos cur_match) {
  */
 local void check_match(deflate_state *s, IPos start, IPos match, int length) {
     /* check that the match is indeed a match */
-    if (zmemcmp(s->window + match,
-                s->window + start, length) != EQUAL) {
-        fprintf(stderr, " start %u, match %u, length %d\n",
-                start, match, length);
+    Bytef *back = s->window + (int)match, *here = s->window + start;
+    IPos len = length;
+    if (match == (IPos)-1) {
+        /* match starts one byte before the current window -- just compare the
+           subsequent length-1 bytes */
+        back++;
+        here++;
+        len--;
+    }
+    if (zmemcmp(back, here, len) != EQUAL) {
+        fprintf(stderr, " start %u, match %d, length %d\n",
+                start, (int)match, length);
         do {
-            fprintf(stderr, "%c%c", s->window[match++], s->window[start++]);
-        } while (--length != 0);
+            fprintf(stderr, "(%02x %02x)", *back++, *here++);
+        } while (--len != 0);
         z_error("invalid match");
     }
     if (z_verbose > 1) {
@@ -2106,13 +2118,7 @@ local block_state deflate_slow(deflate_state *s, int flush) {
             uInt max_insert = s->strstart + s->lookahead - MIN_MATCH;
             /* Do not insert strings in hash table beyond this. */
 
-            if (s->prev_match == -1) {
-                /* The window has slid one byte past the previous match,
-                 * so the first byte cannot be compared. */
-                check_match(s, s->strstart, s->prev_match + 1, s->prev_length - 1);
-            } else {
-                check_match(s, s->strstart - 1, s->prev_match, s->prev_length);
-            }
+            check_match(s, s->strstart - 1, s->prev_match, s->prev_length);
 
             _tr_tally_dist(s, s->strstart - 1 - s->prev_match,
                            s->prev_length - MIN_MATCH, bflush);
diff --git a/deps/zlib/deflate.h b/deps/zlib/deflate.h
index 099d3594319..b699f6b73b3 100644
--- a/deps/zlib/deflate.h
+++ b/deps/zlib/deflate.h
@@ -1,5 +1,5 @@
 /* deflate.h -- internal compression state
- * Copyright (C) 1995-2018 Jean-loup Gailly
+ * Copyright (C) 1995-2024 Jean-loup Gailly
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -13,6 +13,10 @@
 #ifndef DEFLATE_H
 #define DEFLATE_H
 
+#if defined(DEFLATE_CHUNK_WRITE_64LE)
+#include <stdint.h>
+#endif
+
 #include "zutil.h"
 
 /* define NO_GZIP when compiling if you want to disable gzip header and
@@ -52,7 +56,11 @@
 #define MAX_BITS 15
 /* All codes must not exceed MAX_BITS bits */
 
+#if defined(DEFLATE_CHUNK_WRITE_64LE)
+#define Buf_size 64
+#else
 #define Buf_size 16
+#endif
 /* size of bit buffer in bi_buf */
 
 #define INIT_STATE    42    /* zlib header -> BUSY_STATE */
@@ -261,7 +269,11 @@ typedef struct internal_state {
     ulg bits_sent;      /* bit length of compressed data sent mod 2^32 */
 #endif
 
+#if defined(DEFLATE_CHUNK_WRITE_64LE)
+    uint64_t bi_buf;
+#else
     ush bi_buf;
+#endif
     /* Output buffer. bits are inserted starting at the bottom (least
      * significant bits).
      */
diff --git a/deps/zlib/google/OWNERS b/deps/zlib/google/OWNERS
index 868af3cc662..1bd83ac482e 100644
--- a/deps/zlib/google/OWNERS
+++ b/deps/zlib/google/OWNERS
@@ -2,5 +2,4 @@ satorux@chromium.org
 
 # compression_utils*
 asvitkine@chromium.org
-isherman@chromium.org
 cavalcantii@chromium.org
diff --git a/deps/zlib/google/compression_utils.cc b/deps/zlib/google/compression_utils.cc
index 0ba31101489..d50c969504b 100644
--- a/deps/zlib/google/compression_utils.cc
+++ b/deps/zlib/google/compression_utils.cc
@@ -89,19 +89,18 @@ bool GzipUncompress(const std::string& input, std::string* output) {
   return false;
 }
 
-bool GzipUncompress(base::span<const char> input,
-                    base::span<const char> output) {
-  return GzipUncompress(base::as_bytes(input), base::as_bytes(output));
+bool GzipUncompress(base::span<const char> input, base::span<char> output) {
+  return GzipUncompress(base::as_bytes(input), base::as_writable_bytes(output));
 }
 
 bool GzipUncompress(base::span<const uint8_t> input,
-                    base::span<const uint8_t> output) {
+                    base::span<uint8_t> output) {
   uLongf uncompressed_size = GetUncompressedSize(input);
   if (uncompressed_size > output.size())
     return false;
   return zlib_internal::GzipUncompressHelper(
-             reinterpret_cast<Bytef*>(const_cast<uint8_t*>(output.data())),
-             &uncompressed_size, reinterpret_cast<const Bytef*>(input.data()),
+             reinterpret_cast<Bytef*>(output.data()), &uncompressed_size,
+             reinterpret_cast<const Bytef*>(input.data()),
              static_cast<uLongf>(input.size())) == Z_OK;
 }
 
diff --git a/deps/zlib/google/compression_utils.h b/deps/zlib/google/compression_utils.h
index ea399816f60..fd81153076d 100644
--- a/deps/zlib/google/compression_utils.h
+++ b/deps/zlib/google/compression_utils.h
@@ -43,12 +43,11 @@ bool GzipUncompress(const std::string& input, std::string* output);
 // needed. |output|'s size must be at least as large as the return value from
 // GetUncompressedSize.
 // Returns true for success.
-bool GzipUncompress(base::span<const char> input,
-                    base::span<const char> output);
+bool GzipUncompress(base::span<const char> input, base::span<char> output);
 
 // Like the above method, but using uint8_t instead.
 bool GzipUncompress(base::span<const uint8_t> input,
-                    base::span<const uint8_t> output);
+                    base::span<uint8_t> output);
 
 // Uncompresses the data in |input| using gzip, and writes the results to
 // |output|, which must NOT be the underlying string of |input|, and is resized
diff --git a/deps/zlib/google/test/data/create_symlink_test_zips.py b/deps/zlib/google/test/data/create_symlink_test_zips.py
new file mode 100644
index 00000000000..833887acaf7
--- /dev/null
+++ b/deps/zlib/google/test/data/create_symlink_test_zips.py
@@ -0,0 +1,48 @@
+# Creates zip files for symlink-related tests.
+import zipfile
+
+
+def make_zip(filename):
+    return zipfile.ZipFile(filename, 'w', zipfile.ZIP_DEFLATED)
+
+
+def make_link(zf, target, link):
+    zip_info = zipfile.ZipInfo(link)
+    zip_info.external_attr = 0o120777 << 16  # lrwxrwxrwx
+    zf.writestr(zip_info, target)
+
+
+def make_file(zf, path, content):
+    zf.writestr(zipfile.ZipInfo(path), content)
+
+
+def make_test_zips():
+    with make_zip('symlinks.zip') as zf:
+        make_file(zf, 'a.txt', 'A')
+        make_file(zf, 'b.txt', 'B')
+        make_file(zf, 'dir/c.txt', 'C')
+        make_link(zf, '../a.txt', 'dir/a_link')
+        make_link(zf, 'b.txt', 'b_link')
+        make_link(zf, 'dir/c.txt', 'c_link')
+
+    with make_zip('symlink_evil_relative_path.zip') as zf:
+        make_file(zf, 'dir/a.txt', 'A')
+        make_link(zf, 'dir/../dir/../../outside.txt', 'evil_link')
+
+    with make_zip('symlink_absolute_path.zip') as zf:
+        make_link(zf, '/absolute/path/to/outside.txt', 'absolute_link')
+
+    with make_zip('symlink_too_large.zip') as zf:
+        make_link(zf, 'a' * 10000, 'big_link')
+
+    with make_zip('symlink_follow_own_link.zip') as zf:
+        make_link(zf, 'file', 'link')
+        make_file(zf, 'link', 'Hello world')
+
+    with make_zip('symlink_duplicate_link.zip') as zf:
+        make_link(zf, 'target_1', 'link')
+        make_link(zf, 'target_2', 'link')
+
+
+if __name__ == '__main__':
+    make_test_zips()
diff --git a/deps/zlib/google/test/data/symlink_absolute_path.zip b/deps/zlib/google/test/data/symlink_absolute_path.zip
new file mode 100644
index 00000000000..0bcf88b67d7
Binary files /dev/null and b/deps/zlib/google/test/data/symlink_absolute_path.zip differ
diff --git a/deps/zlib/google/test/data/symlink_duplicate_link.zip b/deps/zlib/google/test/data/symlink_duplicate_link.zip
new file mode 100644
index 00000000000..19830110a10
Binary files /dev/null and b/deps/zlib/google/test/data/symlink_duplicate_link.zip differ
diff --git a/deps/zlib/google/test/data/symlink_evil_relative_path.zip b/deps/zlib/google/test/data/symlink_evil_relative_path.zip
new file mode 100644
index 00000000000..9aded0337de
Binary files /dev/null and b/deps/zlib/google/test/data/symlink_evil_relative_path.zip differ
diff --git a/deps/zlib/google/test/data/symlink_follow_own_link.zip b/deps/zlib/google/test/data/symlink_follow_own_link.zip
new file mode 100644
index 00000000000..933ede55632
Binary files /dev/null and b/deps/zlib/google/test/data/symlink_follow_own_link.zip differ
diff --git a/deps/zlib/google/test/data/symlink_too_large.zip b/deps/zlib/google/test/data/symlink_too_large.zip
new file mode 100644
index 00000000000..f226aedf21e
Binary files /dev/null and b/deps/zlib/google/test/data/symlink_too_large.zip differ
diff --git a/deps/zlib/google/test/data/symlinks.zip b/deps/zlib/google/test/data/symlinks.zip
new file mode 100644
index 00000000000..24e3fbdcca8
Binary files /dev/null and b/deps/zlib/google/test/data/symlinks.zip differ
diff --git a/deps/zlib/google/test_data.filelist b/deps/zlib/google/test_data.filelist
index 0a9d20bcea6..5b29f3665e3 100644
--- a/deps/zlib/google/test_data.filelist
+++ b/deps/zlib/google/test_data.filelist
@@ -15,11 +15,18 @@ test/data/Repeated File Name.zip
 test/data/SJIS Bug 846195.zip
 test/data/Windows Special Names.zip
 test/data/Wrong CRC.zip
+test/data/create_symlink_test_zips.py
 test/data/create_test_zip.sh
 test/data/empty.zip
 test/data/evil.zip
 test/data/evil_via_absolute_file_name.zip
 test/data/evil_via_invalid_utf8.zip
+test/data/symlink_absolute_path.zip
+test/data/symlink_duplicate_link.zip
+test/data/symlink_evil_relative_path.zip
+test/data/symlink_follow_own_link.zip
+test/data/symlink_too_large.zip
+test/data/symlinks.zip
 test/data/test.zip
 test/data/test/foo.txt
 test/data/test/foo/bar.txt
diff --git a/deps/zlib/google/zip.cc b/deps/zlib/google/zip.cc
index 87065b91887..48c821e4219 100644
--- a/deps/zlib/google/zip.cc
+++ b/deps/zlib/google/zip.cc
@@ -4,13 +4,16 @@
 
 #include "third_party/zlib/google/zip.h"
 
+#include <cstdint>
 #include <string>
 #include <vector>
 
 #include "base/files/file.h"
 #include "base/files/file_enumerator.h"
+#include "base/files/file_path.h"
 #include "base/files/file_util.h"
 #include "base/functional/bind.h"
+#include "base/functional/callback.h"
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/string_util.h"
@@ -23,6 +26,11 @@
 namespace zip {
 namespace {
 
+#if defined(OS_POSIX)
+// The maximum allowed size of a symbolic link in bytes.
+constexpr uint64_t kMaxSymlinkFileSize = 8192;
+#endif
+
 bool IsHiddenFile(const base::FilePath& file_path) {
   return file_path.BaseName().value()[0] == '.';
 }
@@ -36,6 +44,34 @@ bool CreateDirectory(const base::FilePath& extract_dir,
   return ok;
 }
 
+#if defined(OS_POSIX)
+// Creates a symbolic link at |extract_dir|/|target| to |link|. Fails if |link|
+// points outside of |extract_dir|.
+bool CreateSymbolicLink(const base::FilePath& extract_dir,
+                        const base::FilePath& target,
+                        const base::FilePath& link) {
+  const base::FilePath full_link_path = extract_dir.Append(link);
+  if (target.IsAbsolute()) {
+    LOG(ERROR) << "Won't create link with an absolute target "
+               << Redact(target);
+    return false;
+  }
+  std::optional<base::FilePath> absolute_target =
+      base::MakeAbsoluteFilePathNoResolveSymbolicLinks(
+          full_link_path.DirName().Append(target));
+  if (!absolute_target) {
+    LOG(ERROR) << "Failed to make an absolute path to " << Redact(target);
+    return false;
+  }
+  if (!extract_dir.IsParent(*absolute_target)) {
+    LOG(ERROR) << "Won't create link with target outside extract dir "
+               << Redact(target);
+    return false;
+  }
+  return base::CreateSymbolicLink(target, full_link_path);
+}
+#endif  // defined(OS_POSIX)
+
 // Creates a WriterDelegate that can write a file at |extract_dir|/|entry_path|.
 std::unique_ptr<WriterDelegate> CreateFilePathWriterDelegate(
     const base::FilePath& extract_dir,
@@ -113,6 +149,95 @@ class DirectFileAccessor : public FileAccessor {
   const base::FilePath src_dir_;
 };
 
+// |symlink_creator| may be null in which case symbolic link entries are
+// considered errors.
+bool UnzipImpl(
+    const base::PlatformFile& src_file,
+    WriterFactory writer_factory,
+    DirectoryCreator directory_creator,
+    UnzipOptions options,
+    base::RepeatingCallback<bool(const base::FilePath&, const base::FilePath&)>
+        symlink_creator) {
+  ZipReader reader;
+  reader.SetEncoding(std::move(options.encoding));
+  reader.SetPassword(std::move(options.password));
+
+  if (!reader.OpenFromPlatformFile(src_file)) {
+    LOG(ERROR) << "Cannot open ZIP from file handle " << src_file;
+    return false;
+  }
+
+  while (const ZipReader::Entry* const entry = reader.Next()) {
+    if (entry->is_unsafe) {
+      LOG(ERROR) << "Found unsafe entry " << Redact(entry->path) << " in ZIP";
+      if (!options.continue_on_error) {
+        return false;
+      }
+      continue;
+    }
+
+    if (options.filter && !options.filter.Run(entry->path)) {
+      VLOG(1) << "Skipped ZIP entry " << Redact(entry->path);
+      continue;
+    }
+
+    if (entry->is_directory) {
+      // It's a directory.
+      if (!directory_creator.Run(entry->path)) {
+        LOG(ERROR) << "Cannot create directory " << Redact(entry->path);
+        if (!options.continue_on_error) {
+          return false;
+        }
+      }
+
+      continue;
+    }
+
+#if defined(OS_POSIX)
+    if (entry->is_symbolic_link) {
+      if (!symlink_creator) {
+        LOG(ERROR) << "Skipping symbolic link " << Redact(entry->path);
+        if (!options.continue_on_error) {
+          return false;
+        }
+        continue;
+      }
+      std::string target;
+      if (!reader.ExtractCurrentEntryToString(kMaxSymlinkFileSize, &target)) {
+        LOG(ERROR) << "Failed to read link target " << Redact(entry->path);
+        if (!options.continue_on_error) {
+          return false;
+        }
+        continue;
+      }
+      if (!symlink_creator.Run(base::FilePath(target), entry->path)) {
+        LOG(ERROR) << "Failed to create symbolic link " << Redact(entry->path);
+        if (!options.continue_on_error) {
+          return false;
+        }
+        continue;
+      }
+      continue;
+    }
+#endif  // defined(OS_POSIX)
+
+    // It's a file.
+    std::unique_ptr<WriterDelegate> writer = writer_factory.Run(entry->path);
+    if (!writer ||
+        (options.progress ? !reader.ExtractCurrentEntryWithListener(
+                                writer.get(), options.progress)
+                          : !reader.ExtractCurrentEntry(writer.get()))) {
+      LOG(ERROR) << "Cannot extract file " << Redact(entry->path)
+                 << " from ZIP";
+      if (!options.continue_on_error) {
+        return false;
+      }
+    }
+  }
+
+  return reader.ok();
+}
+
 }  // namespace
 
 std::ostream& operator<<(std::ostream& out, const Progress& progress) {
@@ -132,15 +257,17 @@ bool Zip(const ZipParams& params) {
     DCHECK(params.dest_file.empty());
     zip_writer =
         internal::ZipWriter::CreateWithFd(params.dest_fd, file_accessor);
-    if (!zip_writer)
+    if (!zip_writer) {
       return false;
+    }
   }
 #endif
 
   if (!zip_writer) {
     zip_writer = internal::ZipWriter::Create(params.dest_file, file_accessor);
-    if (!zip_writer)
+    if (!zip_writer) {
       return false;
+    }
   }
 
   zip_writer->SetProgressCallback(params.progress_callback,
@@ -148,7 +275,7 @@ bool Zip(const ZipParams& params) {
   zip_writer->SetRecursive(params.recursive);
   zip_writer->ContinueOnError(params.continue_on_error);
 
-  if (!params.include_hidden_files || params.filter_callback)
+  if (!params.include_hidden_files || params.filter_callback) {
     zip_writer->SetFilterCallback(base::BindRepeating(
         [](const ZipParams* const params, const base::FilePath& path) -> bool {
           return (params->include_hidden_files || !IsHiddenFile(path)) &&
@@ -156,16 +283,19 @@ bool Zip(const ZipParams& params) {
                   params->filter_callback.Run(params->src_dir.Append(path)));
         },
         &params));
+  }
 
   if (params.src_files.empty()) {
     // No source items are specified. Zip the entire source directory.
     zip_writer->SetRecursive(true);
-    if (!zip_writer->AddDirectoryContents(base::FilePath()))
+    if (!zip_writer->AddDirectoryContents(base::FilePath())) {
       return false;
+    }
   } else {
     // Only zip the specified source items.
-    if (!zip_writer->AddMixedEntries(params.src_files))
+    if (!zip_writer->AddMixedEntries(params.src_files)) {
       return false;
+    }
   }
 
   return zip_writer->Close();
@@ -173,7 +303,8 @@ bool Zip(const ZipParams& params) {
 
 bool Unzip(const base::FilePath& src_file,
            const base::FilePath& dest_dir,
-           UnzipOptions options) {
+           UnzipOptions options,
+           UnzipSymlinkOption symlink_option) {
   base::File file(src_file, base::File::FLAG_OPEN | base::File::FLAG_READ);
   if (!file.IsValid()) {
     PLOG(ERROR) << "Cannot open " << Redact(src_file) << ": "
@@ -184,63 +315,27 @@ bool Unzip(const base::FilePath& src_file,
   DLOG_IF(WARNING, !base::IsDirectoryEmpty(dest_dir))
       << "ZIP extraction directory is not empty: " << dest_dir;
 
-  return Unzip(file.GetPlatformFile(),
-               base::BindRepeating(&CreateFilePathWriterDelegate, dest_dir),
-               base::BindRepeating(&CreateDirectory, dest_dir),
-               std::move(options));
+  base::RepeatingCallback<bool(const base::FilePath&, const base::FilePath&)>
+      symlink_creator;
+#if defined(OS_POSIX)
+  if (symlink_option == UnzipSymlinkOption::PRESERVE) {
+    symlink_creator = base::BindRepeating(&CreateSymbolicLink, dest_dir);
+  }
+#endif  // defined(OS_POSIX)
+
+  return UnzipImpl(file.GetPlatformFile(),
+                   base::BindRepeating(&CreateFilePathWriterDelegate, dest_dir),
+                   base::BindRepeating(&CreateDirectory, dest_dir),
+                   std::move(options), symlink_creator);
 }
 
 bool Unzip(const base::PlatformFile& src_file,
            WriterFactory writer_factory,
            DirectoryCreator directory_creator,
            UnzipOptions options) {
-  ZipReader reader;
-  reader.SetEncoding(std::move(options.encoding));
-  reader.SetPassword(std::move(options.password));
-
-  if (!reader.OpenFromPlatformFile(src_file)) {
-    LOG(ERROR) << "Cannot open ZIP from file handle " << src_file;
-    return false;
-  }
-
-  while (const ZipReader::Entry* const entry = reader.Next()) {
-    if (entry->is_unsafe) {
-      LOG(ERROR) << "Found unsafe entry " << Redact(entry->path) << " in ZIP";
-      if (!options.continue_on_error)
-        return false;
-      continue;
-    }
-
-    if (options.filter && !options.filter.Run(entry->path)) {
-      VLOG(1) << "Skipped ZIP entry " << Redact(entry->path);
-      continue;
-    }
-
-    if (entry->is_directory) {
-      // It's a directory.
-      if (!directory_creator.Run(entry->path)) {
-        LOG(ERROR) << "Cannot create directory " << Redact(entry->path);
-        if (!options.continue_on_error)
-          return false;
-      }
-
-      continue;
-    }
-
-    // It's a file.
-    std::unique_ptr<WriterDelegate> writer = writer_factory.Run(entry->path);
-    if (!writer ||
-        (options.progress ? !reader.ExtractCurrentEntryWithListener(
-                                writer.get(), options.progress)
-                          : !reader.ExtractCurrentEntry(writer.get()))) {
-      LOG(ERROR) << "Cannot extract file " << Redact(entry->path)
-                 << " from ZIP";
-      if (!options.continue_on_error)
-        return false;
-    }
-  }
-
-  return reader.ok();
+  return UnzipImpl(src_file, writer_factory, directory_creator,
+                   std::move(options),
+                   /*symlink_creator=*/{});
 }
 
 bool ZipWithFilterCallback(const base::FilePath& src_dir,
diff --git a/deps/zlib/google/zip.h b/deps/zlib/google/zip.h
index ea8778681da..3a574849944 100644
--- a/deps/zlib/google/zip.h
+++ b/deps/zlib/google/zip.h
@@ -193,6 +193,19 @@ struct UnzipOptions {
   bool continue_on_error = false;
 };
 
+// Option of the Unzip function to control handling of symbolic link entries.
+enum class UnzipSymlinkOption {
+  // Don't preserve internal symbolic links. On POSIX, consider symbolic link
+  // entries as errors. On other platforms, links are not differentiated from
+  // regular files.
+  DONT_PRESERVE,
+#if defined(OS_POSIX)
+  // Preserve internal symbolic links. Links which point outside of the
+  // extraction directory or specify an absolute target are rejected.
+  PRESERVE,
+#endif
+};
+
 typedef base::RepeatingCallback<std::unique_ptr<WriterDelegate>(
     const base::FilePath&)>
     WriterFactory;
@@ -206,13 +219,16 @@ bool Unzip(const base::PlatformFile& zip_file,
            DirectoryCreator directory_creator,
            UnzipOptions options = {});
 
-// Unzips the contents of |zip_file| into |dest_dir|.
-// This function does not overwrite any existing file.
-// A filename collision will result in an error.
-// Therefore, |dest_dir| should initially be an empty directory.
-bool Unzip(const base::FilePath& zip_file,
-           const base::FilePath& dest_dir,
-           UnzipOptions options = {});
+// Unzips the contents of |zip_file| into |dest_dir|.  This function does not
+// overwrite any existing file.  A filename collision will result in an error.
+// Therefore, |dest_dir| should initially be an empty directory. If
+// |allow_symlinks| is set internal symbolics links will be preserved. Else,
+// symbolic link entries are considered errors.
+bool Unzip(
+    const base::FilePath& zip_file,
+    const base::FilePath& dest_dir,
+    UnzipOptions options = {},
+    UnzipSymlinkOption symlink_option = UnzipSymlinkOption::DONT_PRESERVE);
 
 }  // namespace zip
 
diff --git a/deps/zlib/google/zip_internal.cc b/deps/zlib/google/zip_internal.cc
index e6b5a4fc3bc..f33da592cf8 100644
--- a/deps/zlib/google/zip_internal.cc
+++ b/deps/zlib/google/zip_internal.cc
@@ -397,14 +397,14 @@ Compression GetCompressionMethod(const base::FilePath& path) {
 
 
   // Skip the leading dot.
-  base::FilePath::StringPieceType ext_without_dot = ext;
+  base::FilePath::StringViewType ext_without_dot = ext;
   DCHECK_EQ(ext_without_dot.front(), FILE_PATH_LITERAL('.'));
   ext_without_dot.remove_prefix(1);
 
   // Well known filename extensions of files that a likely to be already
   // compressed. The extensions are in lower case without the leading dot.
   static constexpr auto kExts =
-      base::MakeFixedFlatSet<base::FilePath::StringPieceType>({
+      base::MakeFixedFlatSet<base::FilePath::StringViewType>({
           FILE_PATH_LITERAL("3g2"),   //
           FILE_PATH_LITERAL("3gp"),   //
           FILE_PATH_LITERAL("7z"),    //
diff --git a/deps/zlib/google/zip_internal.h b/deps/zlib/google/zip_internal.h
index f107d7fe883..550cab0bbd7 100644
--- a/deps/zlib/google/zip_internal.h
+++ b/deps/zlib/google/zip_internal.h
@@ -7,6 +7,8 @@
 
 #include <string>
 
+#include <stdint.h>
+
 #include "base/time/time.h"
 #include "build/build_config.h"
 
@@ -79,8 +81,10 @@ bool ZipOpenNewFileInZip(zipFile zip_file,
 // PNG...) then the compression method is simply kStored.
 Compression GetCompressionMethod(const base::FilePath& path);
 
-const int kZipMaxPath = 256;
-const int kZipBufSize = 8192;
+// ZIP file names are up to 2^16 - 1, buffers should be 1 larger (for \0).
+inline constexpr int kZipMaxPath = UINT16_MAX + 1;
+
+inline constexpr int kZipBufSize = 8192;
 
 }  // namespace internal
 }  // namespace zip
diff --git a/deps/zlib/google/zip_reader.cc b/deps/zlib/google/zip_reader.cc
index 182a802ad84..f71fcf51778 100644
--- a/deps/zlib/google/zip_reader.cc
+++ b/deps/zlib/google/zip_reader.cc
@@ -9,6 +9,7 @@
 #include <utility>
 
 #include "base/check.h"
+#include "base/containers/heap_array.h"
 #include "base/files/file.h"
 #include "base/files/file_util.h"
 #include "base/functional/bind.h"
@@ -209,16 +210,17 @@ bool ZipReader::OpenEntry() {
 
   // Get entry info.
   unz_file_info64 info = {};
-  char path_in_zip[internal::kZipMaxPath] = {};
+  auto path_in_zip = base::HeapArray<char>::WithSize(internal::kZipMaxPath);
   if (const UnzipError err{unzGetCurrentFileInfo64(
-          zip_file_, &info, path_in_zip, sizeof(path_in_zip) - 1, nullptr, 0,
-          nullptr, 0)};
+          zip_file_, &info, path_in_zip.data(), path_in_zip.size() - 1,
+          nullptr, 0, nullptr, 0)};
       err != UNZ_OK) {
     LOG(ERROR) << "Cannot get entry from ZIP: " << err;
     return false;
   }
 
-  entry_.path_in_original_encoding = path_in_zip;
+  DCHECK(path_in_zip[info.size_filename] == '\0');
+  entry_.path_in_original_encoding = path_in_zip.data();
 
   // Convert path from original encoding to Unicode.
   std::u16string path_in_utf16;
@@ -260,8 +262,10 @@ bool ZipReader::OpenEntry() {
 
 #if defined(OS_POSIX)
   entry_.posix_mode = (info.external_fa >> 16L) & (S_IRWXU | S_IRWXG | S_IRWXO);
+  entry_.is_symbolic_link = S_ISLNK(info.external_fa >> 16L);
 #else
   entry_.posix_mode = 0;
+  entry_.is_symbolic_link = false;
 #endif
 
   return true;
diff --git a/deps/zlib/google/zip_reader.h b/deps/zlib/google/zip_reader.h
index 0dbf50b87b6..3caacc0bedd 100644
--- a/deps/zlib/google/zip_reader.h
+++ b/deps/zlib/google/zip_reader.h
@@ -143,6 +143,9 @@ class ZipReader {
 
     // Entry POSIX permissions (POSIX systems only).
     int posix_mode;
+
+    // True if the entry is a symbolic link (POSIX systems only).
+    bool is_symbolic_link = false;
   };
 
   ZipReader();
diff --git a/deps/zlib/google/zip_reader_unittest.cc b/deps/zlib/google/zip_reader_unittest.cc
index 46c0beb1453..d77838cb5e7 100644
--- a/deps/zlib/google/zip_reader_unittest.cc
+++ b/deps/zlib/google/zip_reader_unittest.cc
@@ -887,6 +887,31 @@ TEST_F(ZipReaderTest, WrongCrc) {
   EXPECT_EQ("This file has been changed after its CRC was computed.", contents);
 }
 
+// The Unicode Path Extra field overrides the regular filename. Make sure the
+// size_filename field is also correctly updated (ZipReader has a DCHECK for
+// this).
+TEST_F(ZipReaderTest, WrongFilenameLength) {
+  static const char test_data[] = {
+      0x50, 0x4b, 0x03, 0x04, 0x0a, 0x03, 0x00, 0x00, 0x00, 0x00, 0xd0, 0x71,
+      0x91, 0x4e, 0xbc, 0x2c, 0x7f, 0x06, 0x09, 0x00, 0x00, 0x00, 0x09, 0x00,
+      0x00, 0x00, 0x0b, 0x00, 0x00, 0x00, 0xc8, 0xfe, 0x20, 0xc8, 0xfe, 0xc8,
+      0xfe, 0x2e, 0x74, 0x78, 0x74, 0xed, 0x95, 0x9c, 0xea, 0xb5, 0xad, 0xeb,
+      0xa7, 0x90, 0x50, 0x4b, 0x01, 0x02, 0x3f, 0x03, 0x0a, 0x03, 0x00, 0x00,
+      0x00, 0x00, 0xd0, 0x71, 0x91, 0x4e, 0xbc, 0x2c, 0x7f, 0x06, 0x09, 0x00,
+      0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x0b, 0x00, 0x17, 0x00, 0x00, 0x00,
+      0x00, 0x00, 0x00, 0x00, 0x20, 0x80, 0xc9, 0x81, 0x00, 0x00, 0x00, 0x00,
+      0xc8, 0xfe, 0x20, 0xc8, 0xfe, 0xc8, 0xfe, 0x2e, 0x74, 0x78, 0x74, 0x75,
+      0x70, 0x13, 0x00, 0x01, 0xe9, 0x73, 0xbf, 0xc8, 0xec, 0x83, 0x88, 0x20,
+      0xeb, 0xac, 0xb8, 0xec, 0x84, 0x9c, 0x2e, 0x74, 0x78, 0x74, 0x50, 0x4b,
+      0x05, 0x06, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x01, 0x00, 0x50, 0x00,
+      0x00, 0x00, 0x32, 0x00, 0x00, 0x00, 0x00, 0x00};
+
+  std::string test_string(test_data, sizeof(test_data));
+  ZipReader reader;
+  ASSERT_TRUE(reader.OpenFromString(test_string));
+  reader.Next();
+}
+
 class FileWriterDelegateTest : public ::testing::Test {
  protected:
   void SetUp() override {
diff --git a/deps/zlib/google/zip_unittest.cc b/deps/zlib/google/zip_unittest.cc
index 2bcfa309281..150844ae3eb 100644
--- a/deps/zlib/google/zip_unittest.cc
+++ b/deps/zlib/google/zip_unittest.cc
@@ -60,8 +60,9 @@ std::vector<std::string> GetRelativePaths(const base::FilePath& dir,
 bool CreateFile(const std::string& content,
                 base::FilePath* file_path,
                 base::File* file) {
-  if (!base::CreateTemporaryFile(file_path))
+  if (!base::CreateTemporaryFile(file_path)) {
     return false;
+  }
 
   if (!base::WriteFile(*file_path, content)) {
     return false;
@@ -93,8 +94,9 @@ class ProgressWriterDelegate : public zip::WriterDelegate {
  private:
   void LogProgressIfNecessary() {
     const base::TimeTicks now = base::TimeTicks::Now();
-    if (next_progress_report_time_ > now)
+    if (next_progress_report_time_ > now) {
       return;
+    }
 
     next_progress_report_time_ = now + progress_period_;
     LogProgress();
@@ -184,8 +186,9 @@ class VirtualFileSystem : public zip::FileAccessor {
     DCHECK(subdirs);
 
     const auto it = file_tree_.find(path);
-    if (it == file_tree_.end())
+    if (it == file_tree_.end()) {
       return false;
+    }
 
     for (const base::FilePath& file : it->second.files) {
       DCHECK(!file.empty());
@@ -204,8 +207,9 @@ class VirtualFileSystem : public zip::FileAccessor {
     DCHECK(!path.IsAbsolute());
     DCHECK(info);
 
-    if (!file_tree_.count(path))
+    if (!file_tree_.count(path)) {
       return false;
+    }
 
     info->is_directory = !files_.count(path);
     info->last_modified =
@@ -309,8 +313,9 @@ class ZipTest : public PlatformTest {
 
     size_t expected_count = 0;
     for (const base::FilePath& path : zip_contents_) {
-      if (expect_hidden_files || path.BaseName().value()[0] != '.')
+      if (expect_hidden_files || path.BaseName().value()[0] != '.') {
         ++expected_count;
+      }
     }
 
     EXPECT_EQ(expected_count, count);
@@ -788,8 +793,8 @@ TEST_F(ZipTest, UnzipMixedPaths) {
       "c/NUL",                    // Disappears on Windows
       "nul.very long extension",  // Disappears on Windows
 #ifndef OS_APPLE
-      "CASE",                     // Conflicts with "Case"
-      "case",                     // Conflicts with "Case"
+      "CASE",  // Conflicts with "Case"
+      "case",  // Conflicts with "Case"
 #endif
 #endif
       " NUL.txt",                  //
@@ -956,6 +961,90 @@ TEST_F(ZipTest, UnzipOnlyDirectories) {
   EXPECT_FALSE(base::PathExists(dir_foo_bar.AppendASCII("quux.txt")));
 }
 
+#if defined(OS_POSIX)
+
+TEST_F(ZipTest, UnzipSymlinks) {
+  ASSERT_TRUE(zip::Unzip(GetDataDirectory().AppendASCII("symlinks.zip"),
+                         test_dir_, /*options=*/{},
+                         zip::UnzipSymlinkOption::PRESERVE));
+
+  EXPECT_TRUE(base::PathExists(test_dir_.AppendASCII("a.txt")));
+  EXPECT_TRUE(base::PathExists(test_dir_.AppendASCII("b.txt")));
+  EXPECT_TRUE(base::PathExists(test_dir_.AppendASCII("dir/c.txt")));
+  base::FilePath target;
+  ASSERT_TRUE(
+      base::ReadSymbolicLink(test_dir_.AppendASCII("dir/a_link"), &target));
+  EXPECT_EQ(target.AsUTF8Unsafe(), "../a.txt");
+  ASSERT_TRUE(base::ReadSymbolicLink(test_dir_.AppendASCII("b_link"), &target));
+  EXPECT_EQ(target.AsUTF8Unsafe(), "b.txt");
+  ASSERT_TRUE(base::ReadSymbolicLink(test_dir_.AppendASCII("c_link"), &target));
+  EXPECT_EQ(target.AsUTF8Unsafe(), "dir/c.txt");
+}
+
+TEST_F(ZipTest, UnzipRejectsSymlinks) {
+  EXPECT_FALSE(zip::Unzip(GetDataDirectory().AppendASCII("symlinks.zip"),
+                          test_dir_, /*options=*/{},
+                          zip::UnzipSymlinkOption::DONT_PRESERVE));
+}
+
+TEST_F(ZipTest, UnzipSkipsSymlinks) {
+  ASSERT_TRUE(zip::Unzip(GetDataDirectory().AppendASCII("symlinks.zip"),
+                         test_dir_,
+                         {
+                             .continue_on_error = true,
+                         },
+                         zip::UnzipSymlinkOption::DONT_PRESERVE));
+
+  EXPECT_TRUE(base::PathExists(test_dir_.AppendASCII("a.txt")));
+  EXPECT_TRUE(base::PathExists(test_dir_.AppendASCII("b.txt")));
+  EXPECT_TRUE(base::PathExists(test_dir_.AppendASCII("dir/c.txt")));
+  EXPECT_FALSE(base::PathExists(test_dir_.AppendASCII("dir/a_link")));
+  EXPECT_FALSE(base::PathExists(test_dir_.AppendASCII("b_link")));
+  EXPECT_FALSE(base::PathExists(test_dir_.AppendASCII("c_link")));
+}
+
+TEST_F(ZipTest, UnzipSymlinksRejectsEvilRelativePath) {
+  const base::FilePath zip_path =
+      GetDataDirectory().AppendASCII("symlink_evil_relative_path.zip");
+  ASSERT_TRUE(base::PathExists(zip_path));
+  EXPECT_FALSE(zip::Unzip(zip_path, test_dir_, /*options=*/{},
+                          zip::UnzipSymlinkOption::PRESERVE));
+}
+
+TEST_F(ZipTest, UnzipSymlinksRejectsAbsolutePath) {
+  const base::FilePath zip_path =
+      GetDataDirectory().AppendASCII("symlink_absolute_path.zip");
+  ASSERT_TRUE(base::PathExists(zip_path));
+  EXPECT_FALSE(zip::Unzip(zip_path, test_dir_, /*options=*/{},
+                          zip::UnzipSymlinkOption::PRESERVE));
+}
+
+TEST_F(ZipTest, UnzipSymlinksRejectsSymlinkTooLarge) {
+  const base::FilePath zip_path =
+      GetDataDirectory().AppendASCII("symlink_too_large.zip");
+  ASSERT_TRUE(base::PathExists(zip_path));
+  EXPECT_FALSE(zip::Unzip(zip_path, test_dir_, /*options=*/{},
+                          zip::UnzipSymlinkOption::PRESERVE));
+}
+
+TEST_F(ZipTest, UnzipSymlinksNoFollowOwnLink) {
+  const base::FilePath zip_path =
+      GetDataDirectory().AppendASCII("symlink_follow_own_link.zip");
+  ASSERT_TRUE(base::PathExists(zip_path));
+  EXPECT_FALSE(zip::Unzip(zip_path, test_dir_, /*options=*/{},
+                          zip::UnzipSymlinkOption::PRESERVE));
+}
+
+TEST_F(ZipTest, UnzipSymlinksRejectsDuplicateLink) {
+  const base::FilePath zip_path =
+      GetDataDirectory().AppendASCII("symlink_duplicate_link.zip");
+  ASSERT_TRUE(base::PathExists(zip_path));
+  EXPECT_FALSE(zip::Unzip(zip_path, test_dir_, /*options=*/{},
+                          zip::UnzipSymlinkOption::PRESERVE));
+}
+
+#endif  // defined(OS_POSIX)
+
 // Tests that a ZIP archive containing SJIS-encoded file names can be correctly
 // extracted if the encoding is specified.
 TEST_F(ZipTest, UnzipSjis) {
diff --git a/deps/zlib/gzguts.h b/deps/zlib/gzguts.h
index f9375047e8c..eba72085bb7 100644
--- a/deps/zlib/gzguts.h
+++ b/deps/zlib/gzguts.h
@@ -1,5 +1,5 @@
 /* gzguts.h -- zlib internal header definitions for gz* operations
- * Copyright (C) 2004-2019 Mark Adler
+ * Copyright (C) 2004-2024 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -210,9 +210,5 @@ char ZLIB_INTERNAL *gz_strwinerror(DWORD error);
 /* GT_OFF(x), where x is an unsigned value, is true if x > maximum z_off64_t
    value -- needed when comparing unsigned to z_off64_t, which is signed
    (possible z_off64_t types off_t, off64_t, and long are all signed) */
-#ifdef INT_MAX
-#  define GT_OFF(x) (sizeof(int) == sizeof(z_off64_t) && (x) > INT_MAX)
-#else
 unsigned ZLIB_INTERNAL gz_intmax(void);
-#  define GT_OFF(x) (sizeof(int) == sizeof(z_off64_t) && (x) > gz_intmax())
-#endif
+#define GT_OFF(x) (sizeof(int) == sizeof(z_off64_t) && (x) > gz_intmax())
diff --git a/deps/zlib/gzlib.c b/deps/zlib/gzlib.c
index 0d3ebf8d297..7136395f89a 100644
--- a/deps/zlib/gzlib.c
+++ b/deps/zlib/gzlib.c
@@ -1,5 +1,5 @@
 /* gzlib.c -- zlib functions common to reading and writing gzip files
- * Copyright (C) 2004-2019 Mark Adler
+ * Copyright (C) 2004-2024 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -566,20 +566,20 @@ void ZLIB_INTERNAL gz_error(gz_statep state, int err, const char *msg) {
 #endif
 }
 
-#ifndef INT_MAX
 /* portably return maximum value for an int (when limits.h presumed not
    available) -- we need to do this to cover cases where 2's complement not
    used, since C standard permits 1's complement and sign-bit representations,
    otherwise we could just use ((unsigned)-1) >> 1 */
 unsigned ZLIB_INTERNAL gz_intmax(void) {
-    unsigned p, q;
-
-    p = 1;
+#ifdef INT_MAX
+    return INT_MAX;
+#else
+    unsigned p = 1, q;
     do {
         q = p;
         p <<= 1;
         p++;
     } while (p > q);
     return q >> 1;
-}
 #endif
+}
diff --git a/deps/zlib/inftrees.c b/deps/zlib/inftrees.c
index 73d5a776987..98cfe164458 100644
--- a/deps/zlib/inftrees.c
+++ b/deps/zlib/inftrees.c
@@ -1,5 +1,5 @@
 /* inftrees.c -- generate Huffman trees for efficient decoding
- * Copyright (C) 1995-2023 Mark Adler
+ * Copyright (C) 1995-2024 Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -9,7 +9,7 @@
 #define MAXBITS 15
 
 const char inflate_copyright[] =
-   " inflate 1.3.0.1 Copyright 1995-2023 Mark Adler ";
+   " inflate 1.3.1 Copyright 1995-2024 Mark Adler ";
 /*
   If you use the zlib library in a product, an acknowledgment is welcome
   in the documentation of your product. If for some reason you cannot
@@ -57,7 +57,7 @@ int ZLIB_INTERNAL inflate_table(codetype type, unsigned short FAR *lens,
         35, 43, 51, 59, 67, 83, 99, 115, 131, 163, 195, 227, 258, 0, 0};
     static const unsigned short lext[31] = { /* Length codes 257..285 extra */
         16, 16, 16, 16, 16, 16, 16, 16, 17, 17, 17, 17, 18, 18, 18, 18,
-        19, 19, 19, 19, 20, 20, 20, 20, 21, 21, 21, 21, 16, 70, 200};
+        19, 19, 19, 19, 20, 20, 20, 20, 21, 21, 21, 21, 16, 203, 77};
     static const unsigned short dbase[32] = { /* Distance codes 0..29 base */
         1, 2, 3, 4, 5, 7, 9, 13, 17, 25, 33, 49, 65, 97, 129, 193,
         257, 385, 513, 769, 1025, 1537, 2049, 3073, 4097, 6145,
diff --git a/deps/zlib/inftrees.h b/deps/zlib/inftrees.h
index f11f29c0761..6e7f0fa2a8a 100644
--- a/deps/zlib/inftrees.h
+++ b/deps/zlib/inftrees.h
@@ -41,7 +41,7 @@ typedef struct {
    examples/enough.c found in the zlib distribution.  The arguments to that
    program are the number of symbols, the initial root table size, and the
    maximum bit length of a code.  "enough 286 10 15" for literal/length codes
-   returns returns 1332, and "enough 30 9 15" for distance codes returns 592.
+   returns 1332, and "enough 30 9 15" for distance codes returns 592.
    The initial root table size (10 or 9) is found in the fifth argument of the
    inflate_table() calls in inflate.c and infback.c.  If the root table size is
    changed, then these maximum sizes would be need to be recalculated and
diff --git a/deps/zlib/patches/0006-fix-check_match.patch b/deps/zlib/patches/0006-fix-check_match.patch
deleted file mode 100644
index b21c363b1ec..00000000000
--- a/deps/zlib/patches/0006-fix-check_match.patch
+++ /dev/null
@@ -1,42 +0,0 @@
-From 8304bdda5293ffd5b3efce8e4f54904b387029d6 Mon Sep 17 00:00:00 2001
-From: Hans Wennborg <hans@chromium.org>
-Date: Wed, 23 Sep 2020 16:36:38 +0200
-Subject: [PATCH] Avoid crashing in check_match when prev_match == -1
-
-prev_match can be set to -1 after sliding the window. In that case, the
-window has slid past the first byte of the last match, which means it
-cannot be compared in check_match.
-
-This would cause zlib to crash on some inputs to deflate when built
-with ZLIB_DEBUG enabled.
-
-Check for this situation and avoid crashing by not trying to compare
-the first byte.
-
-Bug: 1113142
----
- third_party/zlib/deflate.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/third_party/zlib/deflate.c b/third_party/zlib/deflate.c
-index cfdd2f46b230..d70732ec6fc2 100644
---- a/third_party/zlib/deflate.c
-+++ b/third_party/zlib/deflate.c
-@@ -2060,7 +2060,13 @@ local block_state deflate_slow(s, flush)
-             uInt max_insert = s->strstart + s->lookahead - MIN_MATCH;
-             /* Do not insert strings in hash table beyond this. */
- 
--            check_match(s, s->strstart-1, s->prev_match, s->prev_length);
-+            if (s->prev_match == -1) {
-+                /* The window has slid one byte past the previous match,
-+                 * so the first byte cannot be compared. */
-+                check_match(s, s->strstart, s->prev_match+1, s->prev_length-1);
-+            } else {
-+                check_match(s, s->strstart-1, s->prev_match, s->prev_length);
-+            }
- 
-             _tr_tally_dist(s, s->strstart -1 - s->prev_match,
-                            s->prev_length - MIN_MATCH, bflush);
--- 
-2.28.0.681.g6f77f65b4e-goog
-
diff --git a/deps/zlib/patches/0008-minizip-zip-unzip-tools.patch b/deps/zlib/patches/0008-minizip-zip-unzip-tools.patch
index 273a8c98011..a359e0f72b0 100644
--- a/deps/zlib/patches/0008-minizip-zip-unzip-tools.patch
+++ b/deps/zlib/patches/0008-minizip-zip-unzip-tools.patch
@@ -9,7 +9,7 @@ Subject: [PATCH] Build minizip zip and unzip tools
  2 files changed, 9 insertions(+), 11 deletions(-)
 
 diff --git a/third_party/zlib/contrib/minizip/miniunz.c b/third_party/zlib/contrib/minizip/miniunz.c
-index 8ada038dbd4e7..5b4312e5647cd 100644
+index 616c30325e07c..f4ad16bdd377b 100644
 --- a/third_party/zlib/contrib/minizip/miniunz.c
 +++ b/third_party/zlib/contrib/minizip/miniunz.c
 @@ -12,7 +12,7 @@
@@ -30,31 +30,26 @@ index 8ada038dbd4e7..5b4312e5647cd 100644
  // In darwin and perhaps other BSD variants off_t is a 64 bit value, hence no need for specific 64 bit functions
  #define FOPEN_FUNC(filename, mode) fopen(filename, mode)
  #define FTELLO_FUNC(stream) ftello(stream)
-@@ -94,7 +94,7 @@ static void change_file_date(const char *filename, uLong dosdate, tm_unz tmu_dat
+@@ -97,7 +97,7 @@ static void change_file_date(const char *filename, uLong dosdate, tm_unz tmu_dat
+   LocalFileTimeToFileTime(&ftLocal,&ftm);
    SetFileTime(hFile,&ftm,&ftLastAcc,&ftm);
    CloseHandle(hFile);
- #else
--#if defined(unix) || defined(__APPLE__)
-+#if defined(unix) || defined(__APPLE__) || defined(__Fuchsia__) || defined(__ANDROID_API__)
+-#elif defined(__unix__) || defined(__unix) || defined(__APPLE__)
++#elif defined(__unix__) || defined(__unix) || defined(__APPLE__) || defined(__Fuchsia__) || defined(__ANDROID_API__)
    (void)dosdate;
    struct utimbuf ut;
    struct tm newdate;
-@@ -125,11 +125,9 @@ static void change_file_date(const char *filename, uLong dosdate, tm_unz tmu_dat
- 
- static int mymkdir(const char* dirname) {
+@@ -129,7 +129,7 @@ static int mymkdir(const char* dirname) {
      int ret=0;
--#ifdef _WIN32
-+#if defined(_WIN32)
+ #ifdef _WIN32
      ret = _mkdir(dirname);
--#elif unix
--    ret = mkdir (dirname,0775);
--#elif __APPLE__
-+#elif defined(unix) || defined(__APPLE__) || defined(__Fuchsia__) || defined(__ANDROID_API__)
+-#elif defined(__unix__) || defined(__unix) || defined(__APPLE__)
++#elif defined(__unix__) || defined(__unix) || defined(__APPLE__) || defined(__Fuchsia__) || defined(__ANDROID_API__)
      ret = mkdir (dirname,0775);
  #else
      (void)dirname;
 diff --git a/third_party/zlib/contrib/minizip/minizip.c b/third_party/zlib/contrib/minizip/minizip.c
-index 26ee8d029efe6..9eb3956a55e00 100644
+index a44e36a01869d..53fdd363e6222 100644
 --- a/third_party/zlib/contrib/minizip/minizip.c
 +++ b/third_party/zlib/contrib/minizip/minizip.c
 @@ -12,8 +12,7 @@
@@ -76,14 +71,12 @@ index 26ee8d029efe6..9eb3956a55e00 100644
  // In darwin and perhaps other BSD variants off_t is a 64 bit value, hence no need for specific 64 bit functions
  #define FOPEN_FUNC(filename, mode) fopen(filename, mode)
  #define FTELLO_FUNC(stream) ftello(stream)
-@@ -92,7 +91,7 @@ static int filetime(const char *f, tm_zip *tmzip, uLong *dt) {
+@@ -96,7 +95,7 @@ static int filetime(const char *f, tm_zip *tmzip, uLong *dt) {
+   }
    return ret;
  }
- #else
--#if defined(unix) || defined(__APPLE__)
-+#if defined(unix) || defined(__APPLE__) || defined(__Fuchsia__) || defined(__ANDROID_API__)
+-#elif defined(__unix__) || defined(__unix) || defined(__APPLE__)
++#elif defined(__unix__) || defined(__unix) || defined(__APPLE__) || defined(__Fuchsia__) || defined(__ANDROID_API__)
  /* f: name of file to get info on, tmzip: return value: access,
     modification and creation times, dt: dostime */
  static int filetime(const char *f, tm_zip *tmzip, uLong *dt) {
---
-2.31.1.818.g46aad6cb9e-goog
diff --git a/deps/zlib/patches/0015-minizip-unzip-enable-decryption.patch b/deps/zlib/patches/0015-minizip-unzip-enable-decryption.patch
index 966e83c7dc5..feeeb1c4007 100644
--- a/deps/zlib/patches/0015-minizip-unzip-enable-decryption.patch
+++ b/deps/zlib/patches/0015-minizip-unzip-enable-decryption.patch
@@ -18,17 +18,6 @@ diff --git a/third_party/zlib/contrib/minizip/unzip.c b/third_party/zlib/contrib
 index 82275d6c1775d..c8a01b23efd42 100644
 --- a/third_party/zlib/contrib/minizip/unzip.c
 +++ b/third_party/zlib/contrib/minizip/unzip.c
-@@ -68,10 +68,6 @@
- #include <stdlib.h>
- #include <string.h>
- 
--#ifndef NOUNCRYPT
--        #define NOUNCRYPT
--#endif
--
- #include "zlib.h"
- #include "unzip.h"
- 
 @@ -1502,6 +1498,7 @@ extern int ZEXPORT unzOpenCurrentFile3(unzFile file, int* method,
              zdecode(s->keys,s->pcrc_32_tab,source[i]);
  
diff --git a/deps/zlib/patches/0016-minizip-parse-unicode-path-extra-field.patch b/deps/zlib/patches/0016-minizip-parse-unicode-path-extra-field.patch
index 9a99a8ae027..73ea055d5bb 100644
--- a/deps/zlib/patches/0016-minizip-parse-unicode-path-extra-field.patch
+++ b/deps/zlib/patches/0016-minizip-parse-unicode-path-extra-field.patch
@@ -21,6 +21,20 @@ Date:   Thu May 12 03:29:52 2022 +0000
     Commit-Queue: Alex Danilo <adanilo@chromium.org>
     Cr-Commit-Position: refs/heads/main@{#1002476}
 
+commit 5a56f75b0da23a10f2c6d9068029a00e53425ddf
+Author: Hans Wennborg <hans@chromium.org>
+Date:   Fri May 16 15:48:19 2025 +0200
+
+    [minizip] Set filename length when using the Unicode Path Extra field
+
+    This is a follow-up to crrev.com/1002476 which added support for parsing
+    the Unicode Path Extra field, which overrides the regular filename. It
+    also needs to update the filename length.
+
+    Bug: 40623474
+    Change-Id: Ifab65f470736b45b1b51a1cc130a5753a2b20583
+    Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6553931
+
 diff --git a/third_party/zlib/contrib/minizip/unzip.c b/third_party/zlib/contrib/minizip/unzip.c
 index c8a01b23efd42..42677cff82c96 100644
 --- a/third_party/zlib/contrib/minizip/unzip.c
@@ -93,6 +107,8 @@ index c8a01b23efd42..42677cff82c96 100644
 +                    {
 +                        uLong uSizeRead;
 +
++                        file_info.size_filename = fileNameSize;
++
 +                        if (fileNameSize < fileNameBufferSize)
 +                        {
 +                             *(szFileName + fileNameSize) = '\0';
diff --git a/deps/zlib/patches/0017-deflate-move-zmemzero-after-null-check.patch b/deps/zlib/patches/0017-deflate-move-zmemzero-after-null-check.patch
new file mode 100644
index 00000000000..ac8ade53621
--- /dev/null
+++ b/deps/zlib/patches/0017-deflate-move-zmemzero-after-null-check.patch
@@ -0,0 +1,49 @@
+From 93f86001b67609106c658fe0908a9b7931245b8a Mon Sep 17 00:00:00 2001
+From: pedro martelletto <martelletto@google.com>
+Date: Thu, 3 Apr 2025 16:46:42 +0000
+Subject: [PATCH] [zlib] Deflate: move zmemzero after NULL check
+
+ZALLOC() might fail, in which case dereferencing the returned pointer
+results in undefined behaviour. N.B. These conditions are not reachable
+from Chromium, as Chromium will abort rather than return nullptr from
+malloc. Found by libfido2's fuzz harness.
+---
+ third_party/zlib/deflate.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+diff --git a/third_party/zlib/deflate.c b/third_party/zlib/deflate.c
+index 8a5281c2b6cd8..49496bb3b0561 100644
+--- a/third_party/zlib/deflate.c
++++ b/third_party/zlib/deflate.c
+@@ -485,14 +485,7 @@ int ZEXPORT deflateInit2_(z_streamp strm, int level, int method,
+     s->window = (Bytef *) ZALLOC(strm,
+                                  s->w_size + WINDOW_PADDING,
+                                  2*sizeof(Byte));
+-    /* Avoid use of unitialized values in the window, see crbug.com/1137613 and
+-     * crbug.com/1144420 */
+-    zmemzero(s->window, (s->w_size + WINDOW_PADDING) * (2 * sizeof(Byte)));
+     s->prev   = (Posf *)  ZALLOC(strm, s->w_size, sizeof(Pos));
+-    /* Avoid use of uninitialized value, see:
+-     * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360
+-     */
+-    zmemzero(s->prev, s->w_size * sizeof(Pos));
+     s->head   = (Posf *)  ZALLOC(strm, s->hash_size, sizeof(Pos));
+ 
+     s->high_water = 0;      /* nothing written to s->window yet */
+@@ -551,6 +544,13 @@ int ZEXPORT deflateInit2_(z_streamp strm, int level, int method,
+         deflateEnd (strm);
+         return Z_MEM_ERROR;
+     }
++    /* Avoid use of unitialized values in the window, see crbug.com/1137613 and
++     * crbug.com/1144420 */
++    zmemzero(s->window, (s->w_size + WINDOW_PADDING) * (2 * sizeof(Byte)));
++    /* Avoid use of uninitialized value, see:
++     * https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=11360
++     */
++    zmemzero(s->prev, s->w_size * sizeof(Pos));
+ #ifdef LIT_MEM
+     s->d_buf = (ushf *)(s->pending_buf + (s->lit_bufsize << 1));
+     s->l_buf = s->pending_buf + (s->lit_bufsize << 2);
+-- 
+2.49.0.504.g3bcea36a83-goog
+
diff --git a/deps/zlib/patches/0018-support-prefixed-zip64.patch b/deps/zlib/patches/0018-support-prefixed-zip64.patch
new file mode 100644
index 00000000000..9e1b4732344
--- /dev/null
+++ b/deps/zlib/patches/0018-support-prefixed-zip64.patch
@@ -0,0 +1,82 @@
+commit 410a23e8a442e3de4f8df29339946a7d826120d0
+Author: Joshua Pawlicki <waffles@chromium.org>
+Date:   Wed May 14 10:58:18 2025 -0700
+
+    [zip]: Allow zip64 files to have prepended content.
+
+    This was already supported for non-zip64 files.
+
+    Fixed: 414848094
+    Change-Id: I3bd79f4b5175d8abca8d8e81f26373037868dcf8
+    Cq-Include-Trybots: luci.chromium.try:ios-blink-dbg-fyi
+    Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6533087
+    Commit-Queue: Joshua Pawlicki <waffles@chromium.org>
+    Auto-Submit: Joshua Pawlicki <waffles@chromium.org>
+    Reviewed-by: Hans Wennborg <hans@chromium.org>
+    Cr-Commit-Position: refs/heads/main@{#1460236}
+
+commit 3daf10f4a4cd6dbfaaaef6a90091f7c6c3148a24
+Author: Hans Wennborg <hans@chromium.org>
+Date:   Fri May 16 15:35:36 2025 +0200
+
+    [minizip] Fix possible infinite loop in unz64local_SearchCentralDir64
+
+    This is a follow-up to crrev.com/1460236, where `uPosFound - 48` could
+    overflow, resulting in a possible readSize of 3, which meant the loop
+    did not make progress.
+
+    Bug: 414848094
+    Change-Id: Icda653b2c9ac59161fb2aba9ac287fe510ee8653
+    Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6554217
+
+diff --git a/third_party/zlib/contrib/minizip/unzip.c b/third_party/zlib/contrib/minizip/unzip.c
+index a39e1752f6d2e..2c8a73e87e011 100644
+--- a/third_party/zlib/contrib/minizip/unzip.c
++++ b/third_party/zlib/contrib/minizip/unzip.c
+@@ -482,6 +482,44 @@ local ZPOS64_T unz64local_SearchCentralDir64(const zlib_filefunc64_32_def* pzlib
+     if (uL != 1)
+         return CENTRALDIRINVALID;
+ 
++    /* If bytes are pre-pended to the archive, relativeOffset must be advanced
++       by that many bytes. The central dir must exist between the specified
++       relativeOffset and uPosFound. */
++    const int BUFSIZE = 1024 * 4;
++    buf = (unsigned char*)ALLOC(BUFSIZE);
++    if (buf==NULL)
++        return CENTRALDIRINVALID;
++    if (relativeOffset > uPosFound)
++        return CENTRALDIRINVALID;
++    // Zip64 EOCDR is at least 48 bytes long.
++    while (relativeOffset + 48 <= uPosFound) {
++        int found = 0;
++        uLong uReadSize = uPosFound - relativeOffset;
++        if (uReadSize > BUFSIZE) {
++            uReadSize = BUFSIZE;
++        }
++        if (ZSEEK64(*pzlib_filefunc_def, filestream, relativeOffset, ZLIB_FILEFUNC_SEEK_SET) != 0) {
++            break;
++        }
++        if (ZREAD64(*pzlib_filefunc_def, filestream, buf, uReadSize) != uReadSize) {
++            break;
++        }
++        for (int i = 0; i < uReadSize - 3; ++i) {
++            // Looking for 0x06064b50, the Zip64 EOCDR signature.
++            if (buf[i] == 0x50 && buf[i + 1] == 0x4b &&
++                buf[i + 2] == 0x06 && buf[i + 3] == 0x06)
++            {
++                relativeOffset += i;
++                found = 1;
++                break;
++            }
++        }
++        if (found) {
++            break;
++        }
++        // Re-read the last 3 bytes, in case they're the front of the signature.
++        relativeOffset += uReadSize - 3;
++    }
++    free(buf);
++
+     /* Goto end of central directory record */
+     if (ZSEEK64(*pzlib_filefunc_def,filestream, relativeOffset,ZLIB_FILEFUNC_SEEK_SET)!=0)
+         return CENTRALDIRINVALID;
diff --git a/deps/zlib/test/minigzip.c b/deps/zlib/test/minigzip.c
index c72356dbccf..134e10e6c3e 100644
--- a/deps/zlib/test/minigzip.c
+++ b/deps/zlib/test/minigzip.c
@@ -303,7 +303,7 @@ static void error(const char *msg) {
 #ifdef USE_MMAP /* MMAP version, Miguel Albrecht <malbrech@eso.org> */
 
 /* Try compressing the input file at once using mmap. Return Z_OK if
- * if success, Z_ERRNO otherwise.
+ * success, Z_ERRNO otherwise.
  */
 static int gz_compress_mmap(FILE *in, gzFile out) {
     int len;
diff --git a/deps/zlib/trees.c b/deps/zlib/trees.c
index 38135273c9c..7359429702f 100644
--- a/deps/zlib/trees.c
+++ b/deps/zlib/trees.c
@@ -1,5 +1,5 @@
 /* trees.c -- output deflated data using Huffman coding
- * Copyright (C) 1995-2021 Jean-loup Gailly
+ * Copyright (C) 1995-2024 Jean-loup Gailly
  * detect_data_type() function provided freely by Cosmin Truta, 2006
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
@@ -141,11 +141,18 @@ local TCONST static_tree_desc static_bl_desc =
  * Output a short LSB first on the stream.
  * IN assertion: there is enough room in pendingBuf.
  */
+#if defined(DEFLATE_CHUNK_WRITE_64LE)
+#define put_short(s, w) { \
+    uint16_t data = (uint16_t)(w); \
+    zmemcpy(&s->pending_buf[s->pending], &data, sizeof(data)); \
+    s->pending += 2; \
+  }
+#else
 #define put_short(s, w) { \
     put_byte(s, (uch)((w) & 0xff)); \
     put_byte(s, (uch)((ush)(w) >> 8)); \
 }
-
+#endif /* DEFLATE_CHUNK_WRITE_64LE */
 /* ===========================================================================
  * Reverse the first len bits of a code, using straightforward code (a faster
  * method would use a table)
@@ -164,6 +171,13 @@ local unsigned bi_reverse(unsigned code, int len) {
  * Flush the bit buffer, keeping at most 7 bits in it.
  */
 local void bi_flush(deflate_state *s) {
+#if defined(DEFLATE_CHUNK_WRITE_64LE)
+    while (s->bi_valid >= 16) {
+        put_short(s, s->bi_buf);
+        s->bi_buf >>= 16;
+        s->bi_valid -= 16;
+    }
+#endif /* DEFLATE_CHUNK_WRITE_64LE */
     if (s->bi_valid == 16) {
         put_short(s, s->bi_buf);
         s->bi_buf = 0;
@@ -173,12 +187,21 @@ local void bi_flush(deflate_state *s) {
         s->bi_buf >>= 8;
         s->bi_valid -= 8;
     }
+
+    Assert(s->bi_valid >= 0 && s->bi_valid <= 7, "bad bi_flush");
 }
 
 /* ===========================================================================
  * Flush the bit buffer and align the output on a byte boundary
  */
 local void bi_windup(deflate_state *s) {
+#if defined(DEFLATE_CHUNK_WRITE_64LE)
+    while (s->bi_valid >= 16) {
+        put_short(s, s->bi_buf);
+        s->bi_buf >>= 16;
+        s->bi_valid -= 16;
+    }
+#endif /* DEFLATE_CHUNK_WRITE_64LE */
     if (s->bi_valid > 8) {
         put_short(s, s->bi_buf);
     } else if (s->bi_valid > 0) {
@@ -248,7 +271,28 @@ local void gen_trees_header(void);
  * Send a value on a given number of bits.
  * IN assertion: length <= 16 and value fits in length bits.
  */
+#if defined(DEFLATE_CHUNK_WRITE_64LE)
+local void send_bits(deflate_state *s, uint64_t value, int length)
+{
+    Tracevv((stderr," l %2d v %4llx ", length, (unsigned long long)value));
+    Assert(s->bi_valid >= 0 && s->bi_valid <= 63, "invalid bi_valid");
+    Assert(length > 0 && length <= 15, "invalid length");
 #ifdef ZLIB_DEBUG
+    s->bits_sent += (ulg)length;
+#endif
+
+    s->bi_buf |= (value << s->bi_valid);
+    s->bi_valid += length;
+
+    if (s->bi_valid >= Buf_size) {
+      zmemcpy(&s->pending_buf[s->pending], &s->bi_buf, sizeof(s->bi_buf));
+      s->pending += 8;
+      s->bi_valid -= Buf_size;
+      s->bi_buf = value >> (length - s->bi_valid);
+    }
+    Assert(s->bi_valid >= 0 && s->bi_valid <= 63, "invalid bi_valid");
+}
+#elif defined(ZLIB_DEBUG)
 local void send_bits(deflate_state *s, int value, int length) {
     Tracevv((stderr," l %2d v %4x ", length, value));
     Assert(length > 0 && length <= 15, "invalid length");
@@ -268,8 +312,7 @@ local void send_bits(deflate_state *s, int value, int length) {
         s->bi_valid += length;
     }
 }
-#else /* !ZLIB_DEBUG */
-
+#else /* !ZLIB_DEBUG && !DEFLATE_CHUNK_WRITE_64LE */
 #define send_bits(s, value, length) \
 { int len = length;\
   if (s->bi_valid > (int)Buf_size - len) {\
@@ -283,7 +326,7 @@ local void send_bits(deflate_state *s, int value, int length) {
     s->bi_valid += len;\
   }\
 }
-#endif /* ZLIB_DEBUG */
+#endif /* DEFLATE_CHUNK_WRITE_64LE */
 
 
 /* the arguments must not have side effects */
diff --git a/deps/zlib/zconf.h b/deps/zlib/zconf.h
index 4f2ebbb755e..d72d337f701 100644
--- a/deps/zlib/zconf.h
+++ b/deps/zlib/zconf.h
@@ -1,5 +1,5 @@
 /* zconf.h -- configuration of the zlib compression library
- * Copyright (C) 1995-2016 Jean-loup Gailly, Mark Adler
+ * Copyright (C) 1995-2024 Jean-loup Gailly, Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -312,14 +312,6 @@
 #  endif
 #endif
 
-#ifndef Z_ARG /* function prototypes for stdarg */
-#  if defined(STDC) || defined(Z_HAVE_STDARG_H)
-#    define Z_ARG(args)  args
-#  else
-#    define Z_ARG(args)  ()
-#  endif
-#endif
-
 /* The following definitions for FAR are needed only for MSDOS mixed
  * model programming (small or medium model with some far allocations).
  * This was tested only with MSC; for other MSDOS compilers you may have
diff --git a/deps/zlib/zconf.h.cmakein b/deps/zlib/zconf.h.cmakein
index 310c43928a2..0abe3bc9d8f 100644
--- a/deps/zlib/zconf.h.cmakein
+++ b/deps/zlib/zconf.h.cmakein
@@ -1,5 +1,5 @@
 /* zconf.h -- configuration of the zlib compression library
- * Copyright (C) 1995-2016 Jean-loup Gailly, Mark Adler
+ * Copyright (C) 1995-2024 Jean-loup Gailly, Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -302,14 +302,6 @@
 #  endif
 #endif
 
-#ifndef Z_ARG /* function prototypes for stdarg */
-#  if defined(STDC) || defined(Z_HAVE_STDARG_H)
-#    define Z_ARG(args)  args
-#  else
-#    define Z_ARG(args)  ()
-#  endif
-#endif
-
 /* The following definitions for FAR are needed only for MSDOS mixed
  * model programming (small or medium model with some far allocations).
  * This was tested only with MSC; for other MSDOS compilers you may have
diff --git a/deps/zlib/zconf.h.in b/deps/zlib/zconf.h.in
index fb76ffe312a..62adc8d8431 100644
--- a/deps/zlib/zconf.h.in
+++ b/deps/zlib/zconf.h.in
@@ -1,5 +1,5 @@
 /* zconf.h -- configuration of the zlib compression library
- * Copyright (C) 1995-2016 Jean-loup Gailly, Mark Adler
+ * Copyright (C) 1995-2024 Jean-loup Gailly, Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -300,14 +300,6 @@
 #  endif
 #endif
 
-#ifndef Z_ARG /* function prototypes for stdarg */
-#  if defined(STDC) || defined(Z_HAVE_STDARG_H)
-#    define Z_ARG(args)  args
-#  else
-#    define Z_ARG(args)  ()
-#  endif
-#endif
-
 /* The following definitions for FAR are needed only for MSDOS mixed
  * model programming (small or medium model with some far allocations).
  * This was tested only with MSC; for other MSDOS compilers you may have
diff --git a/deps/zlib/zlib.3 b/deps/zlib/zlib.3
index adc5b7f03e8..c716020ea9c 100644
--- a/deps/zlib/zlib.3
+++ b/deps/zlib/zlib.3
@@ -1,4 +1,4 @@
-.TH ZLIB 3 "xx Aug 2023"
+.TH ZLIB 3 "22 Jan 2024"
 .SH NAME
 zlib \- compression/decompression library
 .SH SYNOPSIS
@@ -105,9 +105,9 @@ before asking for help.
 Send questions and/or comments to zlib@gzip.org,
 or (for the Windows DLL version) to Gilles Vollant (info@winimage.com).
 .SH AUTHORS AND LICENSE
-Version 1.2.3.0.1
+Version 1.3.1
 .LP
-Copyright (C) 1995-2022 Jean-loup Gailly and Mark Adler
+Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler
 .LP
 This software is provided 'as-is', without any express or implied
 warranty.  In no event will the authors be held liable for any damages
diff --git a/deps/zlib/zlib.gyp b/deps/zlib/zlib.gyp
index 25f570fbe7b..9753250e427 100644
--- a/deps/zlib/zlib.gyp
+++ b/deps/zlib/zlib.gyp
@@ -134,7 +134,7 @@
         #   ],
         # }, # zlib_crc32_simd
         {
-          'target_name': 'zlib_inflate_chunk_simd',
+          'target_name': 'zlib_data_chunk_simd',
           'type': 'static_library',
           'conditions': [
             ['target_arch in "ia32 x64" and OS!="ios"', {
@@ -167,9 +167,9 @@
             'include_dirs': [ '<(ZLIB_ROOT)' ],
           },
           'sources': [
-            '<!@pymod_do_main(GN-scraper "<(ZLIB_ROOT)/BUILD.gn" "\\"zlib_inflate_chunk_simd\\".*?sources = ")',
+            '<!@pymod_do_main(GN-scraper "<(ZLIB_ROOT)/BUILD.gn" "\\"zlib_data_chunk_simd\\".*?sources = ")',
           ],
-        }, # zlib_inflate_chunk_simd
+        }, # zlib_data_chunk_simd
         {
           'target_name': 'zlib',
           'type': 'static_library',
@@ -198,7 +198,7 @@
             }],
             # Incorporate optimizations where possible.
             ['(target_arch in "ia32 x64" and OS!="ios") or arm_fpu=="neon"', {
-              'dependencies': [ 'zlib_inflate_chunk_simd' ],
+              'dependencies': [ 'zlib_data_chunk_simd' ],
               'sources': [ '<(ZLIB_ROOT)/slide_hash_simd.h' ]
             }, {
               'defines': [ 'CPU_NO_SIMD' ],
diff --git a/deps/zlib/zlib.h b/deps/zlib/zlib.h
index f1b149b93e4..8b2f6c1db99 100644
--- a/deps/zlib/zlib.h
+++ b/deps/zlib/zlib.h
@@ -1,7 +1,7 @@
 /* zlib.h -- interface of the 'zlib' general purpose compression library
-  version 1.3.0.1, August xxth, 2023
+  version 1.3.1, January 22nd, 2024
 
-  Copyright (C) 1995-2023 Jean-loup Gailly and Mark Adler
+  Copyright (C) 1995-2024 Jean-loup Gailly and Mark Adler
 
   This software is provided 'as-is', without any express or implied
   warranty.  In no event will the authors be held liable for any damages
@@ -37,12 +37,12 @@
 extern "C" {
 #endif
 
-#define ZLIB_VERSION "1.3.0.1-motley"
-#define ZLIB_VERNUM 0x1301
+#define ZLIB_VERSION "1.3.1"
+#define ZLIB_VERNUM 0x1310
 #define ZLIB_VER_MAJOR 1
 #define ZLIB_VER_MINOR 3
-#define ZLIB_VER_REVISION 0
-#define ZLIB_VER_SUBREVISION 1
+#define ZLIB_VER_REVISION 1
+#define ZLIB_VER_SUBREVISION 0
 
 /*
     The 'zlib' compression library provides in-memory compression and
@@ -935,10 +935,10 @@ ZEXTERN int ZEXPORT inflateSync(z_streamp strm);
      inflateSync returns Z_OK if a possible full flush point has been found,
    Z_BUF_ERROR if no more input was provided, Z_DATA_ERROR if no flush point
    has been found, or Z_STREAM_ERROR if the stream structure was inconsistent.
-   In the success case, the application may save the current current value of
-   total_in which indicates where valid compressed data was found.  In the
-   error case, the application may repeatedly call inflateSync, providing more
-   input each time, until success or end of the input data.
+   In the success case, the application may save the current value of total_in
+   which indicates where valid compressed data was found.  In the error case,
+   the application may repeatedly call inflateSync, providing more input each
+   time, until success or end of the input data.
 */
 
 ZEXTERN int ZEXPORT inflateCopy(z_streamp dest,
@@ -1757,14 +1757,14 @@ ZEXTERN uLong ZEXPORT crc32_combine(uLong crc1, uLong crc2, z_off_t len2);
    seq1 and seq2 with lengths len1 and len2, CRC-32 check values were
    calculated for each, crc1 and crc2.  crc32_combine() returns the CRC-32
    check value of seq1 and seq2 concatenated, requiring only crc1, crc2, and
-   len2.
+   len2. len2 must be non-negative.
 */
 
 /*
 ZEXTERN uLong ZEXPORT crc32_combine_gen(z_off_t len2);
 
      Return the operator corresponding to length len2, to be used with
-   crc32_combine_op().
+   crc32_combine_op(). len2 must be non-negative.
 */
 
 ZEXTERN uLong ZEXPORT crc32_combine_op(uLong crc1, uLong crc2, uLong op);
diff --git a/deps/zlib/zlib.map b/deps/zlib/zlib.map
index b330b606feb..31544f2e93d 100644
--- a/deps/zlib/zlib.map
+++ b/deps/zlib/zlib.map
@@ -1,100 +1,100 @@
-ZLIB_1.2.0 {
-  global:
-    compressBound;
-    deflateBound;
-    inflateBack;
-    inflateBackEnd;
-    inflateBackInit_;
-    inflateCopy;
-  local:
-    deflate_copyright;
-    inflate_copyright;
-    inflate_fast;
-    inflate_table;
-    zcalloc;
-    zcfree;
-    z_errmsg;
-    gz_error;
-    gz_intmax;
-    _*;
-};
-
-ZLIB_1.2.0.2 {
-    gzclearerr;
-    gzungetc;
-    zlibCompileFlags;
-} ZLIB_1.2.0;
-
-ZLIB_1.2.0.8 {
-    deflatePrime;
-} ZLIB_1.2.0.2;
-
-ZLIB_1.2.2 {
-    adler32_combine;
-    crc32_combine;
-    deflateSetHeader;
-    inflateGetHeader;
-} ZLIB_1.2.0.8;
-
-ZLIB_1.2.2.3 {
-    deflateTune;
-    gzdirect;
-} ZLIB_1.2.2;
-
-ZLIB_1.2.2.4 {
-    inflatePrime;
-} ZLIB_1.2.2.3;
-
-ZLIB_1.2.3.3 {
-    adler32_combine64;
-    crc32_combine64;
-    gzopen64;
-    gzseek64;
-    gztell64;
-    inflateUndermine;
-} ZLIB_1.2.2.4;
-
-ZLIB_1.2.3.4 {
-    inflateReset2;
-    inflateMark;
-} ZLIB_1.2.3.3;
-
-ZLIB_1.2.3.5 {
-    gzbuffer;
-    gzoffset;
-    gzoffset64;
-    gzclose_r;
-    gzclose_w;
-} ZLIB_1.2.3.4;
-
-ZLIB_1.2.5.1 {
-    deflatePending;
-} ZLIB_1.2.3.5;
-
-ZLIB_1.2.5.2 {
-    deflateResetKeep;
-    gzgetc_;
-    inflateResetKeep;
-} ZLIB_1.2.5.1;
-
-ZLIB_1.2.7.1 {
-    inflateGetDictionary;
-    gzvprintf;
-} ZLIB_1.2.5.2;
-
-ZLIB_1.2.9 {
-    inflateCodesUsed;
-    inflateValidate;
-    uncompress2;
-    gzfread;
-    gzfwrite;
-    deflateGetDictionary;
-    adler32_z;
-    crc32_z;
-} ZLIB_1.2.7.1;
-
-ZLIB_1.2.12 {
-	crc32_combine_gen;
-	crc32_combine_gen64;
-	crc32_combine_op;
-} ZLIB_1.2.9;
+ZLIB_1.2.0 {
+  global:
+    compressBound;
+    deflateBound;
+    inflateBack;
+    inflateBackEnd;
+    inflateBackInit_;
+    inflateCopy;
+  local:
+    deflate_copyright;
+    inflate_copyright;
+    inflate_fast;
+    inflate_table;
+    zcalloc;
+    zcfree;
+    z_errmsg;
+    gz_error;
+    gz_intmax;
+    _*;
+};
+
+ZLIB_1.2.0.2 {
+    gzclearerr;
+    gzungetc;
+    zlibCompileFlags;
+} ZLIB_1.2.0;
+
+ZLIB_1.2.0.8 {
+    deflatePrime;
+} ZLIB_1.2.0.2;
+
+ZLIB_1.2.2 {
+    adler32_combine;
+    crc32_combine;
+    deflateSetHeader;
+    inflateGetHeader;
+} ZLIB_1.2.0.8;
+
+ZLIB_1.2.2.3 {
+    deflateTune;
+    gzdirect;
+} ZLIB_1.2.2;
+
+ZLIB_1.2.2.4 {
+    inflatePrime;
+} ZLIB_1.2.2.3;
+
+ZLIB_1.2.3.3 {
+    adler32_combine64;
+    crc32_combine64;
+    gzopen64;
+    gzseek64;
+    gztell64;
+    inflateUndermine;
+} ZLIB_1.2.2.4;
+
+ZLIB_1.2.3.4 {
+    inflateReset2;
+    inflateMark;
+} ZLIB_1.2.3.3;
+
+ZLIB_1.2.3.5 {
+    gzbuffer;
+    gzoffset;
+    gzoffset64;
+    gzclose_r;
+    gzclose_w;
+} ZLIB_1.2.3.4;
+
+ZLIB_1.2.5.1 {
+    deflatePending;
+} ZLIB_1.2.3.5;
+
+ZLIB_1.2.5.2 {
+    deflateResetKeep;
+    gzgetc_;
+    inflateResetKeep;
+} ZLIB_1.2.5.1;
+
+ZLIB_1.2.7.1 {
+    inflateGetDictionary;
+    gzvprintf;
+} ZLIB_1.2.5.2;
+
+ZLIB_1.2.9 {
+    inflateCodesUsed;
+    inflateValidate;
+    uncompress2;
+    gzfread;
+    gzfwrite;
+    deflateGetDictionary;
+    adler32_z;
+    crc32_z;
+} ZLIB_1.2.7.1;
+
+ZLIB_1.2.12 {
+	crc32_combine_gen;
+	crc32_combine_gen64;
+	crc32_combine_op;
+} ZLIB_1.2.9;
diff --git a/deps/zlib/zutil.h b/deps/zlib/zutil.h
index 2e2f57665bb..045a35a4f55 100644
--- a/deps/zlib/zutil.h
+++ b/deps/zlib/zutil.h
@@ -1,5 +1,5 @@
 /* zutil.h -- internal interface and configuration of the compression library
- * Copyright (C) 1995-2022 Jean-loup Gailly, Mark Adler
+ * Copyright (C) 1995-2024 Jean-loup Gailly, Mark Adler
  * For conditions of distribution and use, see copyright notice in zlib.h
  */
 
@@ -71,7 +71,7 @@ typedef unsigned long  ulg;
 extern z_const char * const z_errmsg[10]; /* indexed by 2-zlib_error */
 /* (size given to avoid silly warnings with Visual C++) */
 
-#define ERR_MSG(err) z_errmsg[Z_NEED_DICT-(err)]
+#define ERR_MSG(err) z_errmsg[(err) < -6 || (err) > 2 ? 9 : 2 - (err)]
 
 #define ERR_RETURN(strm,err) \
   return (strm->msg = ERR_MSG(err), (err))
diff --git a/doc/api/assert.md b/doc/api/assert.md
index 847dfcfd74c..32194c2bd8c 100644
--- a/doc/api/assert.md
+++ b/doc/api/assert.md
@@ -1092,6 +1092,7 @@ added: v10.0.0
 * `asyncFn` {Function|Promise}
 * `error` {RegExp|Function}
 * `message` {string}
+* Returns: {Promise}
 
 Awaits the `asyncFn` promise or, if `asyncFn` is a function, immediately
 calls the function and awaits the returned promise to complete. It will then
@@ -2036,6 +2037,7 @@ added: v10.0.0
 * `asyncFn` {Function|Promise}
 * `error` {RegExp|Function|Object|Error}
 * `message` {string}
+* Returns: {Promise}
 
 Awaits the `asyncFn` promise or, if `asyncFn` is a function, immediately
 calls the function and awaits the returned promise to complete. It will then
diff --git a/doc/api/buffer.md b/doc/api/buffer.md
index 7844b840c9c..38042f46559 100644
--- a/doc/api/buffer.md
+++ b/doc/api/buffer.md
@@ -1096,7 +1096,7 @@ added: v19.8.0
 -->
 
 * `view` {TypedArray} The {TypedArray} to copy.
-* `offset` {integer} The starting offset within `view`. **Default:**: `0`.
+* `offset` {integer} The starting offset within `view`. **Default:** `0`.
 * `length` {integer} The number of elements from `view` to copy.
   **Default:** `view.length - offset`.
 * Returns: {Buffer}
diff --git a/doc/api/cli.md b/doc/api/cli.md
index d39b090ba6c..219b24a92b7 100644
--- a/doc/api/cli.md
+++ b/doc/api/cli.md
@@ -206,30 +206,18 @@ The valid arguments for the `--allow-fs-read` flag are:
 * Multiple paths can be allowed using multiple `--allow-fs-read` flags.
   Example `--allow-fs-read=/folder1/ --allow-fs-read=/folder1/`
 
-Paths delimited by comma (`,`) are no longer allowed.
-When passing a single flag with a comma a warning will be displayed.
-
 Examples can be found in the [File System Permissions][] documentation.
 
-Relative paths are NOT yet supported by the CLI flag.
-
 The initializer module also needs to be allowed. Consider the following example:
 
 ```console
-$ node --experimental-permission t.js
-node:internal/modules/cjs/loader:162
-  const result = internalModuleStat(filename);
-                 ^
+$ node --experimental-permission index.js
 
 Error: Access to this API has been restricted
-    at stat (node:internal/modules/cjs/loader:162:18)
-    at Module._findPath (node:internal/modules/cjs/loader:640:16)
-    at resolveMainPath (node:internal/modules/run_main:15:25)
-    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:53:24)
     at node:internal/main/run_main_module:23:47 {
   code: 'ERR_ACCESS_DENIED',
   permission: 'FileSystemRead',
-  resource: '/Users/rafaelgss/repos/os/node/t.js'
+  resource: '/Users/rafaelgss/repos/os/node/index.js'
 }
 ```
 
@@ -265,8 +253,6 @@ When passing a single flag with a comma a warning will be displayed.
 
 Examples can be found in the [File System Permissions][] documentation.
 
-Relative paths are NOT supported through the CLI flag.
-
 ### `--allow-wasi`
 
 <!-- YAML
diff --git a/doc/api/deprecations.md b/doc/api/deprecations.md
index 21f2ba7d5e1..a22e86fdc5e 100644
--- a/doc/api/deprecations.md
+++ b/doc/api/deprecations.md
@@ -3397,7 +3397,7 @@ changes:
 
 Type: Documentation-only
 
-Calling [`util.promisify`][] on a function that returns a <Promise> will ignore
+Calling [`util.promisify`][] on a function that returns a `Promise` will ignore
 the result of said promise, which can lead to unhandled promise rejections.
 
 ### DEP0175: `util.toUSVString`
@@ -3589,6 +3589,39 @@ Type: Documentation-only
 Passing non-supported argument types is deprecated and, instead of returning `false`,
 will throw an error in a future version.
 
+<!-- md-lint skip-deprecation DEP0188 -->
+
+<!-- md-lint skip-deprecation DEP0189 -->
+
+<!-- md-lint skip-deprecation DEP0190 -->
+
+<!-- md-lint skip-deprecation DEP0191 -->
+
+<!-- md-lint skip-deprecation DEP0192 -->
+
+<!-- md-lint skip-deprecation DEP0193 -->
+
+<!-- md-lint skip-deprecation DEP0194 -->
+
+<!-- md-lint skip-deprecation DEP0195 -->
+
+<!-- md-lint skip-deprecation DEP0196 -->
+
+<!-- md-lint skip-deprecation DEP0197 -->
+
+### DEP0198: Creating SHAKE-128 and SHAKE-256 digests without an explicit `options.outputLength`
+
+<!-- YAML
+changes:
+  - version: v20.19.5
+    pr-url: https://github.com/nodejs/node/pull/58942
+    description: Documentation-only deprecation with support for `--pending-deprecation`.
+-->
+
+Type: Documentation-only (supports [`--pending-deprecation`][])
+
+Creating SHAKE-128 and SHAKE-256 digests without an explicit `options.outputLength` is deprecated.
+
 [NIST SP 800-38D]: https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-38d.pdf
 [RFC 6066]: https://tools.ietf.org/html/rfc6066#section-3
 [RFC 8247 Section 2.4]: https://www.rfc-editor.org/rfc/rfc8247#section-2.4
diff --git a/doc/api/esm.md b/doc/api/esm.md
index 3100d5756cd..aea83fb712d 100644
--- a/doc/api/esm.md
+++ b/doc/api/esm.md
@@ -1159,7 +1159,7 @@ resolution for ESM specifiers is [commonjs-extension-resolution-loader][].
 [`path.dirname()`]: path.md#pathdirnamepath
 [`process.dlopen`]: process.md#processdlopenmodule-filename-flags
 [`url.fileURLToPath()`]: url.md#urlfileurltopathurl-options
-[cjs-module-lexer]: https://github.com/nodejs/cjs-module-lexer/tree/1.2.2
+[cjs-module-lexer]: https://github.com/nodejs/cjs-module-lexer/tree/2.0.0
 [commonjs-extension-resolution-loader]: https://github.com/nodejs/loaders-test/tree/main/commonjs-extension-resolution-loader
 [custom https loader]: module.md#import-from-https
 [import.meta.resolve]: #importmetaresolvespecifier
diff --git a/doc/api/modules.md b/doc/api/modules.md
index 3c0c87ff662..8eb8a39cabb 100644
--- a/doc/api/modules.md
+++ b/doc/api/modules.md
@@ -204,8 +204,8 @@ regarding which files are parsed as ECMAScript modules.
   3. The file has a `.js` extension, the closest `package.json` does not contain
      `"type": "commonjs"`, and the module contains ES module syntax.
 
-If the ES Module being loaded meet the requirements, `require()` can load it and
-return the module namespace object. In this case it is similar to dynamic
+If the ES Module being loaded meets the requirements, `require()` can load it and
+return the [module namespace object][]. In this case it is similar to dynamic
 `import()` but is run synchronously and returns the name space object
 directly.
 
@@ -213,7 +213,7 @@ With the following ES Modules:
 
 ```mjs
 // distance.mjs
-export function distance(a, b) { return (b.x - a.x) ** 2 + (b.y - a.y) ** 2; }
+export function distance(a, b) { return Math.sqrt((b.x - a.x) ** 2 + (b.y - a.y) ** 2); }
 ```
 
 ```mjs
@@ -249,8 +249,8 @@ This property is experimental and can change in the future. It should only be us
 by tools converting ES modules into CommonJS modules, following existing ecosystem
 conventions. Code authored directly in CommonJS should avoid depending on it.
 
-When a ES Module contains both named exports and a default export, the result returned by `require()`
-is the module namespace object, which places the default export in the `.default` property, similar to
+When an ES Module contains both named exports and a default export, the result returned by `require()`
+is the [module namespace object][], which places the default export in the `.default` property, similar to
 the results returned by `import()`.
 To customize what should be returned by `require(esm)` directly, the ES Module can export the
 desired value using the string name `"module.exports"`.
@@ -265,7 +265,7 @@ export default class Point {
 
 // `distance` is lost to CommonJS consumers of this module, unless it's
 // added to `Point` as a static property.
-export function distance(a, b) { return (b.x - a.x) ** 2 + (b.y - a.y) ** 2; }
+export function distance(a, b) { return Math.sqrt((b.x - a.x) ** 2 + (b.y - a.y) ** 2); }
 export { Point as 'module.exports' }
 ```
 
@@ -289,7 +289,7 @@ named exports attached to it as properties. For example with the example above,
 <!-- eslint-disable @stylistic/js/semi -->
 
 ```mjs
-export function distance(a, b) { return (b.x - a.x) ** 2 + (b.y - a.y) ** 2; }
+export function distance(a, b) { return Math.sqrt((b.x - a.x) ** 2 + (b.y - a.y) ** 2); }
 
 export default class Point {
   constructor(x, y) { this.x = x; this.y = y; }
@@ -342,7 +342,7 @@ require(X) from module at path Y
    a. return the core module
    b. STOP
 2. If X begins with '/'
-   a. set Y to be the file system root
+   a. set Y to the file system root
 3. If X begins with './' or '/' or '../'
    a. LOAD_AS_FILE(Y + X)
    b. LOAD_AS_DIRECTORY(Y + X)
@@ -369,7 +369,7 @@ LOAD_AS_FILE(X)
       1. MAYBE_DETECT_AND_LOAD(X.js)
     c. If the SCOPE/package.json contains "type" field,
       1. If the "type" field is "module", load X.js as an ECMAScript module. STOP.
-      2. If the "type" field is "commonjs", load X.js as an CommonJS module. STOP.
+      2. If the "type" field is "commonjs", load X.js as a CommonJS module. STOP.
     d. MAYBE_DETECT_AND_LOAD(X.js)
 3. If X.json is a file, load X.json to a JavaScript Object. STOP
 4. If X.node is a file, load X.node as binary addon. STOP
@@ -380,7 +380,7 @@ LOAD_INDEX(X)
     b. If no scope was found, load X/index.js as a CommonJS module. STOP.
     c. If the SCOPE/package.json contains "type" field,
       1. If the "type" field is "module", load X/index.js as an ECMAScript module. STOP.
-      2. Else, load X/index.js as an CommonJS module. STOP.
+      2. Else, load X/index.js as a CommonJS module. STOP.
 2. If X/index.json is a file, parse X/index.json to a JavaScript object. STOP
 3. If X/index.node is a file, load X/index.node as binary addon. STOP
 
@@ -1291,6 +1291,7 @@ This section was moved to
 [`process.features.require_module`]: process.md#processfeaturesrequire_module
 [`require.main`]: #requiremain
 [exports shortcut]: #exports-shortcut
+[module namespace object]: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/import#module_namespace_object
 [module resolution]: #all-together
 [native addons]: addons.md
 [subpath exports]: packages.md#subpath-exports
diff --git a/doc/api/path.md b/doc/api/path.md
index a0619d12287..62552782808 100644
--- a/doc/api/path.md
+++ b/doc/api/path.md
@@ -315,17 +315,19 @@ added: v0.11.2
 * `path` {string}
 * Returns: {boolean}
 
-The `path.isAbsolute()` method determines if `path` is an absolute path.
+The `path.isAbsolute()` method determines if the literal `path` is absolute.
+Therefore, it’s not safe for mitigating path traversals.
 
 If the given `path` is a zero-length string, `false` will be returned.
 
 For example, on POSIX:
 
 ```js
-path.isAbsolute('/foo/bar'); // true
-path.isAbsolute('/baz/..');  // true
-path.isAbsolute('qux/');     // false
-path.isAbsolute('.');        // false
+path.isAbsolute('/foo/bar');   // true
+path.isAbsolute('/baz/..');    // true
+path.isAbsolute('/baz/../..'); // true
+path.isAbsolute('qux/');       // false
+path.isAbsolute('.');          // false
 ```
 
 On Windows:
diff --git a/doc/api/perf_hooks.md b/doc/api/perf_hooks.md
index 0bdf8626f47..1113b618378 100644
--- a/doc/api/perf_hooks.md
+++ b/doc/api/perf_hooks.md
@@ -1849,7 +1849,7 @@ const obs = new PerformanceObserver((list, observer) => {
   performance.clearMeasures();
   observer.disconnect();
 });
-obs.observe({ entryTypes: ['measure'], buffered: true });
+obs.observe({ entryTypes: ['measure'] });
 
 setTimeout(() => {}, 1000);
 ```
@@ -1884,7 +1884,7 @@ const obs = new PerformanceObserver((list) => {
   performance.clearMeasures();
   obs.disconnect();
 });
-obs.observe({ entryTypes: ['function'], buffered: true });
+obs.observe({ entryTypes: ['function'] });
 
 require('some-module');
 ```
diff --git a/doc/api/permissions.md b/doc/api/permissions.md
index 80516643e89..ab010cf4d95 100644
--- a/doc/api/permissions.md
+++ b/doc/api/permissions.md
@@ -500,15 +500,8 @@ will be restricted.
 
 ```console
 $ node --experimental-permission index.js
-node:internal/modules/cjs/loader:171
-  const result = internalModuleStat(filename);
-                 ^
 
 Error: Access to this API has been restricted
-    at stat (node:internal/modules/cjs/loader:171:18)
-    at Module._findPath (node:internal/modules/cjs/loader:627:16)
-    at resolveMainPath (node:internal/modules/run_main:19:25)
-    at Function.executeUserEntryPoint [as runMain] (node:internal/modules/run_main:76:24)
     at node:internal/main/run_main_module:23:47 {
   code: 'ERR_ACCESS_DENIED',
   permission: 'FileSystemRead',
@@ -588,6 +581,43 @@ does not exist, the wildcard will not be added, and access will be limited to
 yet, make sure to explicitly include the wildcard:
 `/my-path/folder-do-not-exist/*`.
 
+#### Using the Permission Model with `npx`
+
+If you're using [`npx`][] to execute a Node.js script, you can enable the
+Permission Model by passing the `--node-options` flag. For example:
+
+```bash
+npx --node-options="--permission" package-name
+```
+
+This sets the `NODE_OPTIONS` environment variable for all Node.js processes
+spawned by [`npx`][], without affecting the `npx` process itself.
+
+**FileSystemRead Error with `npx`**
+
+The above command will likely throw a `FileSystemRead` invalid access error
+because Node.js requires file system read access to locate and execute the
+package. To avoid this:
+
+1. **Using a Globally Installed Package**
+   Grant read access to the global `node_modules` directory by running:
+
+   ```bash
+   npx --node-options="--permission --allow-fs-read=$(npm prefix -g)" package-name
+   ```
+
+2. **Using the `npx` Cache**
+   If you are installing the package temporarily or relying on the `npx` cache,
+   grant read access to the npm cache directory:
+
+   ```bash
+   npx --node-options="--permission --allow-fs-read=$(npm config get cache)" package-name
+   ```
+
+Any arguments you would normally pass to `node` (e.g., `--allow-*` flags) can
+also be passed through the `--node-options` flag. This flexibility makes it
+easy to configure permissions as needed when using `npx`.
+
 #### Permission Model constraints
 
 There are constraints you need to know before using this system:
@@ -627,6 +657,7 @@ There are constraints you need to know before using this system:
 [`--allow-wasi`]: cli.md#--allow-wasi
 [`--allow-worker`]: cli.md#--allow-worker
 [`--experimental-permission`]: cli.md#--experimental-permission
+[`npx`]: https://docs.npmjs.com/cli/commands/npx
 [`permission.has()`]: process.md#processpermissionhasscope-reference
 [relative-url string]: https://url.spec.whatwg.org/#relative-url-with-fragment-string
 [special schemes]: https://url.spec.whatwg.org/#special-scheme
diff --git a/doc/api/util.md b/doc/api/util.md
index d57230966cb..0bc8f1e8a60 100644
--- a/doc/api/util.md
+++ b/doc/api/util.md
@@ -286,7 +286,7 @@ corresponding argument. Supported specifiers are:
 
 * `%s`: `String` will be used to convert all values except `BigInt`, `Object`
   and `-0`. `BigInt` values will be represented with an `n` and Objects that
-  have no user defined `toString` function are inspected using `util.inspect()`
+  have neither a user defined `toString` function nor `Symbol.toPrimitive` function are inspected using `util.inspect()`
   with options `{ depth: 0, colors: false, compact: 3 }`.
 * `%d`: `Number` will be used to convert all values except `BigInt` and
   `Symbol`.
diff --git a/doc/api/zlib.md b/doc/api/zlib.md
index b4c763a130a..fe026b44e39 100644
--- a/doc/api/zlib.md
+++ b/doc/api/zlib.md
@@ -599,7 +599,6 @@ Allowed flush values.
 * `zlib.constants.Z_FULL_FLUSH`
 * `zlib.constants.Z_FINISH`
 * `zlib.constants.Z_BLOCK`
-* `zlib.constants.Z_TREES`
 
 Return codes for the compression/decompression functions. Negative
 values are errors, positive values are used for special but normal
diff --git a/doc/api_assets/style.css b/doc/api_assets/style.css
index 1288b1a5956..bcf6b88b94b 100644
--- a/doc/api_assets/style.css
+++ b/doc/api_assets/style.css
@@ -295,6 +295,10 @@ li.picker-header a span {
   line-height: 1.5;
 }
 
+#api-section-documentation .api_stability {
+  position: static;
+}
+
 .api_stability * {
   color: var(--white) !important;
 }
@@ -365,6 +369,11 @@ p {
   padding-bottom: 2rem;
 }
 
+/* prevent the module-level sticky stability header from overlapping the section headers when clicked */
+#apicontent:has(> .api_stability) a {
+  scroll-margin-top: 50px;
+}
+
 table {
   border-collapse: collapse;
   margin: 0 0 1.5rem;
@@ -826,6 +835,12 @@ kbd {
     position: relative;
     top: 0;
   }
+  .api_stability {
+    top: 0;
+  }
+  #apicontent a {
+    scroll-margin-top: 0;
+  }
 }
 
 @media not screen, (max-height: 1000px) {
diff --git a/doc/changelogs/CHANGELOG_V20.md b/doc/changelogs/CHANGELOG_V20.md
index 96eb7e54301..33c7c3dbe19 100644
--- a/doc/changelogs/CHANGELOG_V20.md
+++ b/doc/changelogs/CHANGELOG_V20.md
@@ -9,6 +9,7 @@
 </tr>
 <tr>
 <td>
+<a href="#20.19.5">20.19.5</a><br/>
 <a href="#20.19.4">20.19.4</a><br/>
 <a href="#20.19.3">20.19.3</a><br/>
 <a href="#20.19.2">20.19.2</a><br/>
@@ -73,6 +74,157 @@
   * [io.js](CHANGELOG_IOJS.md)
   * [Archive](CHANGELOG_ARCHIVE.md)
 
+<a id="20.19.5"></a>
+
+## 2025-09-03, Version 20.19.5 'Iron' (LTS), @marco-ippolito
+
+### Notable Changes
+
+* \[[`f5b293ad48`](https://github.com/nodejs/node/commit/f5b293ad48)] - **doc**: add JonasBa to collaborators (Jonas Badalic) [#58355](https://github.com/nodejs/node/pull/58355)
+* \[[`4e6ae787c6`](https://github.com/nodejs/node/commit/4e6ae787c6)] - **doc**: add puskin to collaborators (Giovanni Bucci) [#58308](https://github.com/nodejs/node/pull/58308)
+* \[[`d06db658fc`](https://github.com/nodejs/node/commit/d06db658fc)] - **doc**: add Filip Skokan to TSC (Rafael Gonzaga) [#58499](https://github.com/nodejs/node/pull/58499)
+* \[[`3c6206cac9`](https://github.com/nodejs/node/commit/3c6206cac9)] - **doc**: add @geeksilva97 to collaborators (Edy Silva) [#57241](https://github.com/nodejs/node/pull/57241)
+
+### Commits
+
+* \[[`ea20403467`](https://github.com/nodejs/node/commit/ea20403467)] - **build**: fix uvwasi pkgname (Antoine du Hamel) [#58270](https://github.com/nodejs/node/pull/58270)
+* \[[`c647aa4b30`](https://github.com/nodejs/node/commit/c647aa4b30)] - **build**: fix pointer compression builds (Joyee Cheung) [#58171](https://github.com/nodejs/node/pull/58171)
+* \[[`d2c5e609ae`](https://github.com/nodejs/node/commit/d2c5e609ae)] - **build**: disable v8\_enable\_pointer\_compression\_shared\_cage on non-64bit (Shelley Vohr) [#58867](https://github.com/nodejs/node/pull/58867)
+* \[[`84d5c4d244`](https://github.com/nodejs/node/commit/84d5c4d244)] - **build**: search for libnode.so in multiple places (Jan Staněk) [#58213](https://github.com/nodejs/node/pull/58213)
+* \[[`068c439552`](https://github.com/nodejs/node/commit/068c439552)] - **crypto**: fix SHAKE128/256 breaking change introduced with OpenSSL 3.4 (Filip Skokan) [#58942](https://github.com/nodejs/node/pull/58942)
+* \[[`edff105c34`](https://github.com/nodejs/node/commit/edff105c34)] - **debugger**: fix behavior of plain object exec in debugger repl (Dario Piotrowicz) [#57498](https://github.com/nodejs/node/pull/57498)
+* \[[`0473e35b7f`](https://github.com/nodejs/node/commit/0473e35b7f)] - **deps**: update zlib to 1.3.1-470d3a2 (Node.js GitHub Bot) [#58628](https://github.com/nodejs/node/pull/58628)
+* \[[`1218dbbea5`](https://github.com/nodejs/node/commit/1218dbbea5)] - **deps**: update zlib to 1.3.0.1-motley-780819f (Node.js GitHub Bot) [#57768](https://github.com/nodejs/node/pull/57768)
+* \[[`0e3cd9ec00`](https://github.com/nodejs/node/commit/0e3cd9ec00)] - **deps**: update zlib to 1.3.0.1-motley-788cb3c (Node.js GitHub Bot) [#56655](https://github.com/nodejs/node/pull/56655)
+* \[[`a194dd9bd4`](https://github.com/nodejs/node/commit/a194dd9bd4)] - **deps**: update archs files for openssl-3.0.16 (Node.js GitHub Bot) [#57335](https://github.com/nodejs/node/pull/57335)
+* \[[`cc9b79ca70`](https://github.com/nodejs/node/commit/cc9b79ca70)] - **deps**: upgrade openssl sources to quictls/openssl-3.0.16 (Node.js GitHub Bot) [#57335](https://github.com/nodejs/node/pull/57335)
+* \[[`82c46d5358`](https://github.com/nodejs/node/commit/82c46d5358)] - **deps**: update cjs-module-lexer to 2.1.0 (Node.js GitHub Bot) [#57180](https://github.com/nodejs/node/pull/57180)
+* \[[`43e3f9b26b`](https://github.com/nodejs/node/commit/43e3f9b26b)] - **deps**: update cjs-module-lexer to 2.0.0 (Michael Dawson) [#56855](https://github.com/nodejs/node/pull/56855)
+* \[[`91282ff16b`](https://github.com/nodejs/node/commit/91282ff16b)] - **deps**: update corepack to 0.33.0 (Node.js GitHub Bot) [#58566](https://github.com/nodejs/node/pull/58566)
+* \[[`b76bca6f38`](https://github.com/nodejs/node/commit/b76bca6f38)] - **deps**: update acorn to 8.15.0 (Node.js GitHub Bot) [#58711](https://github.com/nodejs/node/pull/58711)
+* \[[`ae11481011`](https://github.com/nodejs/node/commit/ae11481011)] - **deps**: update acorn to 8.14.1 (Node.js GitHub Bot) [#57382](https://github.com/nodejs/node/pull/57382)
+* \[[`142d701201`](https://github.com/nodejs/node/commit/142d701201)] - **deps**: update minimatch to 10.0.3 (Node.js GitHub Bot) [#58712](https://github.com/nodejs/node/pull/58712)
+* \[[`fee082d684`](https://github.com/nodejs/node/commit/fee082d684)] - **deps**: update llhttp to 9.3.0 (Fedor Indutny) [#58144](https://github.com/nodejs/node/pull/58144)
+* \[[`c06f6f3f05`](https://github.com/nodejs/node/commit/c06f6f3f05)] - **dns**: remove redundant code using common variable (Deokjin Kim) [#57386](https://github.com/nodejs/node/pull/57386)
+* \[[`cded8e7e77`](https://github.com/nodejs/node/commit/cded8e7e77)] - **dns**: fix parse memory leaky (theanarkh) [#58973](https://github.com/nodejs/node/pull/58973)
+* \[[`182ae67233`](https://github.com/nodejs/node/commit/182ae67233)] - **dns**: fix dns query cache implementation (Ethan Arrowood) [#58404](https://github.com/nodejs/node/pull/58404)
+* \[[`621b66a297`](https://github.com/nodejs/node/commit/621b66a297)] - **doc**: add review guidelines for collaborator nominations (Antoine du Hamel) [#57449](https://github.com/nodejs/node/pull/57449)
+* \[[`b1009b5b72`](https://github.com/nodejs/node/commit/b1009b5b72)] - **doc**: explicit mention arbitrary code execution as a vuln (Rafael Gonzaga) [#57426](https://github.com/nodejs/node/pull/57426)
+* \[[`f5b293ad48`](https://github.com/nodejs/node/commit/f5b293ad48)] - **doc**: add JonasBa to collaborators (Jonas Badalic) [#58355](https://github.com/nodejs/node/pull/58355)
+* \[[`4e6ae787c6`](https://github.com/nodejs/node/commit/4e6ae787c6)] - **doc**: add puskin to collaborators (Giovanni Bucci) [#58308](https://github.com/nodejs/node/pull/58308)
+* \[[`530473f479`](https://github.com/nodejs/node/commit/530473f479)] - **doc**: add ovflowd back to core collaborators (Claudio W.) [#58911](https://github.com/nodejs/node/pull/58911)
+* \[[`38e8bbc131`](https://github.com/nodejs/node/commit/38e8bbc131)] - **doc**: add info on how project manages social media (Michael Dawson) [#57318](https://github.com/nodejs/node/pull/57318)
+* \[[`d06bb4dcc2`](https://github.com/nodejs/node/commit/d06bb4dcc2)] - **doc**: ping nodejs/tsc for each security pull request (Rafael Gonzaga) [#57309](https://github.com/nodejs/node/pull/57309)
+* \[[`d06db658fc`](https://github.com/nodejs/node/commit/d06db658fc)] - **doc**: add Filip Skokan to TSC (Rafael Gonzaga) [#58499](https://github.com/nodejs/node/pull/58499)
+* \[[`8c3bc156ed`](https://github.com/nodejs/node/commit/8c3bc156ed)] - **doc**: clarify `path.isAbsolute` is not path traversal mitigation (Eric Fortis) [#57073](https://github.com/nodejs/node/pull/57073)
+* \[[`e688410bda`](https://github.com/nodejs/node/commit/e688410bda)] - **doc**: fix rendering of DEP0174 description (David Sanders) [#56835](https://github.com/nodejs/node/pull/56835)
+* \[[`e6a0c6a0fa`](https://github.com/nodejs/node/commit/e6a0c6a0fa)] - **doc**: add missing assert return types (Colin Ihrig) [#57219](https://github.com/nodejs/node/pull/57219)
+* \[[`026b3cab6a`](https://github.com/nodejs/node/commit/026b3cab6a)] - **doc**: add 1ilsang to triage team (1ilsang) [#57183](https://github.com/nodejs/node/pull/57183)
+* \[[`3c6206cac9`](https://github.com/nodejs/node/commit/3c6206cac9)] - **doc**: add @geeksilva97 to collaborators (Edy Silva) [#57241](https://github.com/nodejs/node/pull/57241)
+* \[[`ef3a4675c7`](https://github.com/nodejs/node/commit/ef3a4675c7)] - **doc**: fix web.libera.chat link in pull-requests.md (Samuel Bronson) [#57076](https://github.com/nodejs/node/pull/57076)
+* \[[`1db42b76f7`](https://github.com/nodejs/node/commit/1db42b76f7)] - **doc**: remove buffered flag from performance hooks examples (Pavel Romanov) [#52607](https://github.com/nodejs/node/pull/52607)
+* \[[`b73a1356ce`](https://github.com/nodejs/node/commit/b73a1356ce)] - **doc**: add `module namespace object` links (Dario Piotrowicz) [#57093](https://github.com/nodejs/node/pull/57093)
+* \[[`09368db20f`](https://github.com/nodejs/node/commit/09368db20f)] - **doc**: disambiguate pseudo-code statement (Dario Piotrowicz) [#57092](https://github.com/nodejs/node/pull/57092)
+* \[[`2c3dc569a1`](https://github.com/nodejs/node/commit/2c3dc569a1)] - **doc**: fix wrong articles used to address modules (Dario Piotrowicz) [#57090](https://github.com/nodejs/node/pull/57090)
+* \[[`cd8259cb4e`](https://github.com/nodejs/node/commit/cd8259cb4e)] - **doc**: `modules.md`: fix `distance` definition (Alexander “weej” Jones) [#57046](https://github.com/nodejs/node/pull/57046)
+* \[[`7b0ea9ab2d`](https://github.com/nodejs/node/commit/7b0ea9ab2d)] - **doc**: fix wrong verb form (Dario Piotrowicz) [#57091](https://github.com/nodejs/node/pull/57091)
+* \[[`14fcfc242b`](https://github.com/nodejs/node/commit/14fcfc242b)] - **doc**: add a note about `require('../common')` in testing documentation (Aditi) [#56953](https://github.com/nodejs/node/pull/56953)
+* \[[`bc7d18b6ea`](https://github.com/nodejs/node/commit/bc7d18b6ea)] - **doc**: recommend writing tests in new files and including comments (Joyee Cheung) [#57028](https://github.com/nodejs/node/pull/57028)
+* \[[`acd4d7f269`](https://github.com/nodejs/node/commit/acd4d7f269)] - **doc**: improve documentation on argument validation (Aditi) [#56954](https://github.com/nodejs/node/pull/56954)
+* \[[`4cd6b3ca73`](https://github.com/nodejs/node/commit/4cd6b3ca73)] - **doc**: buffer: fix typo on `Buffer.copyBytesFrom(` `offset` option (tpoisseau) [#57015](https://github.com/nodejs/node/pull/57015)
+* \[[`01220607f2`](https://github.com/nodejs/node/commit/01220607f2)] - **doc**: update cleanup to trust on vuln db automation (Rafael Gonzaga) [#57004](https://github.com/nodejs/node/pull/57004)
+* \[[`77a0505a32`](https://github.com/nodejs/node/commit/77a0505a32)] - **doc**: update post sec release process (Rafael Gonzaga) [#56907](https://github.com/nodejs/node/pull/56907)
+* \[[`77dbcfce5f`](https://github.com/nodejs/node/commit/77dbcfce5f)] - **doc**: add section about using npx with permission model (Rafael Gonzaga) [#56539](https://github.com/nodejs/node/pull/56539)
+* \[[`73e51407b7`](https://github.com/nodejs/node/commit/73e51407b7)] - **doc**: remove RedYetiDev from triagers team (Aviv Keller) [#55947](https://github.com/nodejs/node/pull/55947)
+* \[[`9a36cbb792`](https://github.com/nodejs/node/commit/9a36cbb792)] - **doc**: fix relative path mention in --allow-fs (Rafael Gonzaga) [#55791](https://github.com/nodejs/node/pull/55791)
+* \[[`04d9c5baeb`](https://github.com/nodejs/node/commit/04d9c5baeb)] - **doc**: add scroll margin to links (Roman Reiss) [#58982](https://github.com/nodejs/node/pull/58982)
+* \[[`959a67f6ff`](https://github.com/nodejs/node/commit/959a67f6ff)] - **doc**: make Stability labels not sticky in Stability index (Livia Medeiros) [#58291](https://github.com/nodejs/node/pull/58291)
+* \[[`8757a5532f`](https://github.com/nodejs/node/commit/8757a5532f)] - **doc**: update release key for aduh95 (Antoine du Hamel) [#58877](https://github.com/nodejs/node/pull/58877)
+* \[[`6fa0626327`](https://github.com/nodejs/node/commit/6fa0626327)] - **doc,src,test**: fix typos (Noritaka Kobayashi) [#58477](https://github.com/nodejs/node/pull/58477)
+* \[[`9991788e4a`](https://github.com/nodejs/node/commit/9991788e4a)] - **http**: coerce content-length to number (Marco Ippolito) [#57458](https://github.com/nodejs/node/pull/57458)
+* \[[`ff5cf8a428`](https://github.com/nodejs/node/commit/ff5cf8a428)] - **http2**: fix check for `frame->hd.type` (hanguanqiang) [#57644](https://github.com/nodejs/node/pull/57644)
+* \[[`2f333b6c51`](https://github.com/nodejs/node/commit/2f333b6c51)] - **lib**: optimize `prepareStackTrace` on builtin frames (Chengzhong Wu) [#56299](https://github.com/nodejs/node/pull/56299)
+* \[[`cdf985071f`](https://github.com/nodejs/node/commit/cdf985071f)] - **lib**: suppress source map lookup exceptions (Chengzhong Wu) [#56299](https://github.com/nodejs/node/pull/56299)
+* \[[`faa08b14ed`](https://github.com/nodejs/node/commit/faa08b14ed)] - **lib**: fixup incorrect argument order in assertEncoding (James M Snell) [#57177](https://github.com/nodejs/node/pull/57177)
+* \[[`a683cd1232`](https://github.com/nodejs/node/commit/a683cd1232)] - **meta**: add IlyasShabi to collaborators (Ilyas Shabi) [#58916](https://github.com/nodejs/node/pull/58916)
+* \[[`b145bb28aa`](https://github.com/nodejs/node/commit/b145bb28aa)] - **meta**: bump codecov/codecov-action from 5.4.2 to 5.4.3 (dependabot\[bot]) [#58551](https://github.com/nodejs/node/pull/58551)
+* \[[`2c59789001`](https://github.com/nodejs/node/commit/2c59789001)] - **meta**: bump ossf/scorecard-action from 2.4.1 to 2.4.2 (dependabot\[bot]) [#58550](https://github.com/nodejs/node/pull/58550)
+* \[[`4095337e96`](https://github.com/nodejs/node/commit/4095337e96)] - **meta**: bump rtCamp/action-slack-notify from 2.3.2 to 2.3.3 (dependabot\[bot]) [#58108](https://github.com/nodejs/node/pull/58108)
+* \[[`631fed8e39`](https://github.com/nodejs/node/commit/631fed8e39)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#58456](https://github.com/nodejs/node/pull/58456)
+* \[[`7d2f7180b6`](https://github.com/nodejs/node/commit/7d2f7180b6)] - **meta**: bump codecov/codecov-action from 5.4.0 to 5.4.2 (dependabot\[bot]) [#58110](https://github.com/nodejs/node/pull/58110)
+* \[[`1558551ea5`](https://github.com/nodejs/node/commit/1558551ea5)] - **meta**: bump actions/download-artifact from 4.2.1 to 4.3.0 (dependabot\[bot]) [#58106](https://github.com/nodejs/node/pull/58106)
+* \[[`e1f12fe737`](https://github.com/nodejs/node/commit/e1f12fe737)] - **meta**: ignore mailmap changes in linux ci (Jonas Badalic) [#58356](https://github.com/nodejs/node/pull/58356)
+* \[[`1b78eb1313`](https://github.com/nodejs/node/commit/1b78eb1313)] - **meta**: bump actions/setup-node from 4.3.0 to 4.4.0 (dependabot\[bot]) [#58111](https://github.com/nodejs/node/pull/58111)
+* \[[`2b8449c39a`](https://github.com/nodejs/node/commit/2b8449c39a)] - **meta**: bump actions/setup-python from 5.5.0 to 5.6.0 (dependabot\[bot]) [#58107](https://github.com/nodejs/node/pull/58107)
+* \[[`833b70bbc5`](https://github.com/nodejs/node/commit/833b70bbc5)] - **meta**: allow penetration testing on live system with prior authorization (Matteo Collina) [#57966](https://github.com/nodejs/node/pull/57966)
+* \[[`c6a88561f5`](https://github.com/nodejs/node/commit/c6a88561f5)] - **meta**: bump actions/setup-python from 5.4.0 to 5.5.0 (dependabot\[bot]) [#57718](https://github.com/nodejs/node/pull/57718)
+* \[[`9046ef4fb3`](https://github.com/nodejs/node/commit/9046ef4fb3)] - **meta**: bump peter-evans/create-pull-request from 7.0.7 to 7.0.8 (dependabot\[bot]) [#57717](https://github.com/nodejs/node/pull/57717)
+* \[[`46388a4e2a`](https://github.com/nodejs/node/commit/46388a4e2a)] - **meta**: bump actions/cache from 4.2.2 to 4.2.3 (dependabot\[bot]) [#57715](https://github.com/nodejs/node/pull/57715)
+* \[[`d3970685bd`](https://github.com/nodejs/node/commit/d3970685bd)] - **meta**: bump actions/setup-node from 4.2.0 to 4.3.0 (dependabot\[bot]) [#57714](https://github.com/nodejs/node/pull/57714)
+* \[[`47004ef37f`](https://github.com/nodejs/node/commit/47004ef37f)] - **meta**: bump actions/upload-artifact from 4.6.1 to 4.6.2 (dependabot\[bot]) [#57713](https://github.com/nodejs/node/pull/57713)
+* \[[`4abe83ec03`](https://github.com/nodejs/node/commit/4abe83ec03)] - **meta**: add some clarification to the nomination process (James M Snell) [#57503](https://github.com/nodejs/node/pull/57503)
+* \[[`45e9b88363`](https://github.com/nodejs/node/commit/45e9b88363)] - **meta**: remove collaborator self-nomination (Rich Trott) [#57537](https://github.com/nodejs/node/pull/57537)
+* \[[`d10949b7d8`](https://github.com/nodejs/node/commit/d10949b7d8)] - **meta**: edit collaborator nomination process (Antoine du Hamel) [#57483](https://github.com/nodejs/node/pull/57483)
+* \[[`704562fb7a`](https://github.com/nodejs/node/commit/704562fb7a)] - **meta**: move ovflowd to emeritus (Claudio W.) [#57443](https://github.com/nodejs/node/pull/57443)
+* \[[`3f981b8537`](https://github.com/nodejs/node/commit/3f981b8537)] - **meta**: bump codecov/codecov-action from 5.3.1 to 5.4.0 (dependabot\[bot]) [#57257](https://github.com/nodejs/node/pull/57257)
+* \[[`7e1ff7b332`](https://github.com/nodejs/node/commit/7e1ff7b332)] - **meta**: bump ossf/scorecard-action from 2.4.0 to 2.4.1 (dependabot\[bot]) [#57253](https://github.com/nodejs/node/pull/57253)
+* \[[`8d4ec412b9`](https://github.com/nodejs/node/commit/8d4ec412b9)] - **meta**: move RaisinTen back to collaborators, triagers and SEA champion (Darshan Sen) [#57292](https://github.com/nodejs/node/pull/57292)
+* \[[`cc2abb5d17`](https://github.com/nodejs/node/commit/cc2abb5d17)] - **meta**: bump peter-evans/create-pull-request from 7.0.6 to 7.0.7 (dependabot\[bot]) [#57259](https://github.com/nodejs/node/pull/57259)
+* \[[`4fad2b8758`](https://github.com/nodejs/node/commit/4fad2b8758)] - **meta**: bump actions/cache from 4.2.0 to 4.2.2 (dependabot\[bot]) [#57256](https://github.com/nodejs/node/pull/57256)
+* \[[`5f5bb8b986`](https://github.com/nodejs/node/commit/5f5bb8b986)] - **meta**: bump actions/upload-artifact from 4.6.0 to 4.6.1 (dependabot\[bot]) [#57255](https://github.com/nodejs/node/pull/57255)
+* \[[`e949359a56`](https://github.com/nodejs/node/commit/e949359a56)] - **meta**: bump `actions/setup-python` from 5.3.0 to 5.4.0 (dependabot\[bot]) [#56867](https://github.com/nodejs/node/pull/56867)
+* \[[`d3c5ad7510`](https://github.com/nodejs/node/commit/d3c5ad7510)] - **meta**: bump `peter-evans/create-pull-request` from 7.0.5 to 7.0.6 (dependabot\[bot]) [#56866](https://github.com/nodejs/node/pull/56866)
+* \[[`56decfe2d1`](https://github.com/nodejs/node/commit/56decfe2d1)] - **meta**: bump `codecov/codecov-action` from 5.0.7 to 5.3.1 (dependabot\[bot]) [#56864](https://github.com/nodejs/node/pull/56864)
+* \[[`52e518444d`](https://github.com/nodejs/node/commit/52e518444d)] - **meta**: bump `actions/cache` from 4.1.2 to 4.2.0 (dependabot\[bot]) [#56862](https://github.com/nodejs/node/pull/56862)
+* \[[`9cac93d9c3`](https://github.com/nodejs/node/commit/9cac93d9c3)] - **meta**: bump `actions/stale` from 9.0.0 to 9.1.0 (dependabot\[bot]) [#56860](https://github.com/nodejs/node/pull/56860)
+* \[[`ecf4252f7c`](https://github.com/nodejs/node/commit/ecf4252f7c)] - **meta**: update last name for jkrems (Jan Martin) [#57006](https://github.com/nodejs/node/pull/57006)
+* \[[`e8beaaaedf`](https://github.com/nodejs/node/commit/e8beaaaedf)] - **meta**: bump `actions/upload-artifact` from 4.4.3 to 4.6.0 (dependabot\[bot]) [#56861](https://github.com/nodejs/node/pull/56861)
+* \[[`5462c257f8`](https://github.com/nodejs/node/commit/5462c257f8)] - **meta**: bump `actions/setup-node` from 4.1.0 to 4.2.0 (dependabot\[bot]) [#56868](https://github.com/nodejs/node/pull/56868)
+* \[[`89c37891a0`](https://github.com/nodejs/node/commit/89c37891a0)] - **meta**: move one or more collaborators to emeritus (Node.js GitHub Bot) [#56889](https://github.com/nodejs/node/pull/56889)
+* \[[`2a0175c291`](https://github.com/nodejs/node/commit/2a0175c291)] - **meta**: add @nodejs/url as codeowner (Chengzhong Wu) [#56783](https://github.com/nodejs/node/pull/56783)
+* \[[`c12aae1e78`](https://github.com/nodejs/node/commit/c12aae1e78)] - **meta**: bump github/codeql-action from 3.28.18 to 3.29.2 (dependabot\[bot]) [#58922](https://github.com/nodejs/node/pull/58922)
+* \[[`4ef09990f1`](https://github.com/nodejs/node/commit/4ef09990f1)] - **meta**: bump github/codeql-action from 3.28.16 to 3.28.18 (dependabot\[bot]) [#58552](https://github.com/nodejs/node/pull/58552)
+* \[[`889654eb2c`](https://github.com/nodejs/node/commit/889654eb2c)] - **meta**: bump github/codeql-action from 3.28.11 to 3.28.16 (dependabot\[bot]) [#58112](https://github.com/nodejs/node/pull/58112)
+* \[[`091e5c1bb9`](https://github.com/nodejs/node/commit/091e5c1bb9)] - **meta**: bump github/codeql-action from 3.28.10 to 3.28.13 (dependabot\[bot]) [#57716](https://github.com/nodejs/node/pull/57716)
+* \[[`01415153de`](https://github.com/nodejs/node/commit/01415153de)] - **meta**: bump github/codeql-action from 3.28.8 to 3.28.10 (dependabot\[bot]) [#57254](https://github.com/nodejs/node/pull/57254)
+* \[[`72ea8aac34`](https://github.com/nodejs/node/commit/72ea8aac34)] - **meta**: bump `github/codeql-action` from 3.27.5 to 3.28.8 (dependabot\[bot]) [#56859](https://github.com/nodejs/node/pull/56859)
+* \[[`99a271e588`](https://github.com/nodejs/node/commit/99a271e588)] - **meta**: bump step-security/harden-runner from 2.12.0 to 2.12.2 (dependabot\[bot]) [#58923](https://github.com/nodejs/node/pull/58923)
+* \[[`b4c4c02490`](https://github.com/nodejs/node/commit/b4c4c02490)] - **meta**: bump step-security/harden-runner from 2.11.0 to 2.12.0 (dependabot\[bot]) [#58109](https://github.com/nodejs/node/pull/58109)
+* \[[`5361bb9157`](https://github.com/nodejs/node/commit/5361bb9157)] - **meta**: bump step-security/harden-runner from 2.10.4 to 2.11.0 (dependabot\[bot]) [#57258](https://github.com/nodejs/node/pull/57258)
+* \[[`28e33acf30`](https://github.com/nodejs/node/commit/28e33acf30)] - **meta**: bump `step-security/harden-runner` from 2.10.2 to 2.10.4 (dependabot\[bot]) [#56863](https://github.com/nodejs/node/pull/56863)
+* \[[`fad773cede`](https://github.com/nodejs/node/commit/fad773cede)] - **module**: throw error when re-runing errored module jobs (Joyee Cheung) [#58957](https://github.com/nodejs/node/pull/58957)
+* \[[`2531185423`](https://github.com/nodejs/node/commit/2531185423)] - **module**: allow cycles in require() in the CJS handling in ESM loader (Joyee Cheung) [#58598](https://github.com/nodejs/node/pull/58598)
+* \[[`ed43b69689`](https://github.com/nodejs/node/commit/ed43b69689)] - **module**: clarify cjs global-like error on ModuleJobSync (Carlos Espa) [#56491](https://github.com/nodejs/node/pull/56491)
+* \[[`6e02db1b12`](https://github.com/nodejs/node/commit/6e02db1b12)] - **module**: handle instantiated async module jobs in require(esm) (Joyee Cheung) [#58067](https://github.com/nodejs/node/pull/58067)
+* \[[`badba50d30`](https://github.com/nodejs/node/commit/badba50d30)] - **module**: fix incorrect formatting in require(esm) cycle error message (haykam821) [#57453](https://github.com/nodejs/node/pull/57453)
+* \[[`939ecf8906`](https://github.com/nodejs/node/commit/939ecf8906)] - **module**: handle cached linked async jobs in require(esm) (Joyee Cheung) [#57187](https://github.com/nodejs/node/pull/57187)
+* \[[`ba7f8a0353`](https://github.com/nodejs/node/commit/ba7f8a0353)] - **module**: improve error message from asynchronicity in require(esm) (Joyee Cheung) [#57126](https://github.com/nodejs/node/pull/57126)
+* \[[`c1e7fa2586`](https://github.com/nodejs/node/commit/c1e7fa2586)] - **module**: handle .mjs in .js handler in CommonJS (Joyee Cheung) [#55590](https://github.com/nodejs/node/pull/55590)
+* \[[`41f3dfd21b`](https://github.com/nodejs/node/commit/41f3dfd21b)] - **module**: fix require.resolve() crash on non-string paths (Aditi) [#56942](https://github.com/nodejs/node/pull/56942)
+* \[[`043dcdd628`](https://github.com/nodejs/node/commit/043dcdd628)] - **os**: fix GetInterfaceAddresses memory lieaky (theanarkh) [#58940](https://github.com/nodejs/node/pull/58940)
+* \[[`9b74e9bfd9`](https://github.com/nodejs/node/commit/9b74e9bfd9)] - **permission**: ignore internalModuleStat on module loading (Rafael Gonzaga) [#55797](https://github.com/nodejs/node/pull/55797)
+* \[[`611a147b45`](https://github.com/nodejs/node/commit/611a147b45)] - **readline**: fix unresolved promise on abortion (Daniel Venable) [#54030](https://github.com/nodejs/node/pull/54030)
+* \[[`f891ae3421`](https://github.com/nodejs/node/commit/f891ae3421)] - **repl**: avoid deprecated `require.extensions` in tab completion (baki gul) [#58653](https://github.com/nodejs/node/pull/58653)
+* \[[`7ba44290bf`](https://github.com/nodejs/node/commit/7ba44290bf)] - **repl**: fix tab completion not working with computer string properties (Dario Piotrowicz) [#58709](https://github.com/nodejs/node/pull/58709)
+* \[[`eb842048b2`](https://github.com/nodejs/node/commit/eb842048b2)] - **src**: do not format single string argument for THROW\_ERR\_\* (Joyee Cheung) [#57126](https://github.com/nodejs/node/pull/57126)
+* \[[`4f004937ec`](https://github.com/nodejs/node/commit/4f004937ec)] - **src**: fixup errorhandling more in various places (James M Snell) [#57852](https://github.com/nodejs/node/pull/57852)
+* \[[`5daa7fe2e2`](https://github.com/nodejs/node/commit/5daa7fe2e2)] - **src**: fix module buffer allocation (X-BW) [#57738](https://github.com/nodejs/node/pull/57738)
+* \[[`586b1be11b`](https://github.com/nodejs/node/commit/586b1be11b)] - **src**: fix build when using shared simdutf (Antoine du Hamel) [#58407](https://github.com/nodejs/node/pull/58407)
+* \[[`563e61f012`](https://github.com/nodejs/node/commit/563e61f012)] - **src**: fix possible dereference of null pointer (Eusgor) [#58459](https://github.com/nodejs/node/pull/58459)
+* \[[`cbec07ea0b`](https://github.com/nodejs/node/commit/cbec07ea0b)] - **src**: fix FIPS init error handling (Tobias Nießen) [#58379](https://github.com/nodejs/node/pull/58379)
+* \[[`80fb80e71b`](https://github.com/nodejs/node/commit/80fb80e71b)] - **src**: fix -Wunreachable-code in src/node\_api.cc (Shelley Vohr) [#58901](https://github.com/nodejs/node/pull/58901)
+* \[[`5e97719860`](https://github.com/nodejs/node/commit/5e97719860)] - **test**: skip test-http-imports on macos (Marco Ippolito) [#59745](https://github.com/nodejs/node/pull/59745)
+* \[[`69c43bdfcc`](https://github.com/nodejs/node/commit/69c43bdfcc)] - **test**: fix internet/test-dns (Michaël Zasso) [#59660](https://github.com/nodejs/node/pull/59660)
+* \[[`6fd58e0338`](https://github.com/nodejs/node/commit/6fd58e0338)] - **tools**: update coverage GitHub Actions to fixed version (Rich Trott) [#59512](https://github.com/nodejs/node/pull/59512)
+* \[[`eb7bbce73e`](https://github.com/nodejs/node/commit/eb7bbce73e)] - **tools**: disable failing coverage jobs (Antoine du Hamel) [#58770](https://github.com/nodejs/node/pull/58770)
+* \[[`65b1669936`](https://github.com/nodejs/node/commit/65b1669936)] - **util**: fix formatting of objects with built-in Symbol.toPrimitive (Shima Ryuhei) [#57832](https://github.com/nodejs/node/pull/57832)
+* \[[`8a29f13bec`](https://github.com/nodejs/node/commit/8a29f13bec)] - **util**: fix parseEnv incorrectly splitting multiple ‘=‘ in value (HEESEUNG) [#57421](https://github.com/nodejs/node/pull/57421)
+* \[[`077d5020c4`](https://github.com/nodejs/node/commit/077d5020c4)] - **v8**: fix missing callback in heap utils destroy (Ruben Bridgewater) [#58846](https://github.com/nodejs/node/pull/58846)
+* \[[`34ae9f8b18`](https://github.com/nodejs/node/commit/34ae9f8b18)] - **vm**: import call should return a promise in the current context (Chengzhong Wu) [#58309](https://github.com/nodejs/node/pull/58309)
+* \[[`0dd3a8d6d1`](https://github.com/nodejs/node/commit/0dd3a8d6d1)] - **win,build**: fix MSVS v17.14 compilation issue (StefanStojanovic) [#58902](https://github.com/nodejs/node/pull/58902)
+* \[[`1b83a2bd2d`](https://github.com/nodejs/node/commit/1b83a2bd2d)] - **zlib**: remove mentions of unexposed Z\_TREES constant (Jimmy Leung) [#58371](https://github.com/nodejs/node/pull/58371)
+* \[[`9dc9604502`](https://github.com/nodejs/node/commit/9dc9604502)] - **zlib**: fix pointer alignment (jhofstee) [#57727](https://github.com/nodejs/node/pull/57727)
+
 <a id="20.19.4"></a>
 
 ## 2025-07-15, Version 20.19.4 'Iron' (LTS), @RafaelGSS
diff --git a/doc/changelogs/NSOLID_CHANGELOG_V6_NODE_V20.md b/doc/changelogs/NSOLID_CHANGELOG_V6_NODE_V20.md
new file mode 100644
index 00000000000..b354d4fb302
--- /dev/null
+++ b/doc/changelogs/NSOLID_CHANGELOG_V6_NODE_V20.md
@@ -0,0 +1,75 @@
+# N|Solid Changelog
+
+<!--lint disable maximum-line-length no-literal-urls prohibited-strings-->
+
+## 2025-10-29, Version 20.19.5-nsolid-v6.0.2 'Iron'
+
+### Commits
+
+* \[[`9dae5aaa10`](https://github.com/nodesource/nsolid/commit/9dae5aaa10)] - Merge tag 'v20.19.5' into node-v20.19.5-nsolid-v6.0.2-release (Santiago Gimeno)
+* \[[`263eeee871`](https://github.com/nodesource/nsolid/commit/263eeee871)] - **agents**: improve debug logging and fix win crash (Santiago Gimeno) [#376](https://github.com/nodesource/nsolid/pull/376)
+* \[[`0d71f54201`](https://github.com/nodesource/nsolid/commit/0d71f54201)] - **agents**: guard StartWritesDone() in grpc streams (Santiago Gimeno) [#379](https://github.com/nodesource/nsolid/pull/379)
+* \[[`60e905e951`](https://github.com/nodesource/nsolid/commit/60e905e951)] - **build,deps**: add v8 patch management system (Santiago Gimeno) [#381](https://github.com/nodesource/nsolid/pull/381)
+* \[[`40a9809378`](https://github.com/nodesource/nsolid/commit/40a9809378)] - **deps**: add missing files to grpc and curl gyp files (Santiago Gimeno) [#380](https://github.com/nodesource/nsolid/pull/380)
+* \[[`4e24bbc857`](https://github.com/nodesource/nsolid/commit/4e24bbc857)] - **deps**: add missing source file to libcurl gyp (Santiago Gimeno)
+* \[[`159dbbf9a5`](https://github.com/nodesource/nsolid/commit/159dbbf9a5)] - **deps**: add support for exporting Summary via OTLP (Santiago Gimeno) [#371](https://github.com/nodesource/nsolid/pull/371)
+* \[[`def02f8e29`](https://github.com/nodesource/nsolid/commit/def02f8e29)] - **deps**: update opentelemetry-cpp to 1.23.0 (Santiago Gimeno) [#371](https://github.com/nodesource/nsolid/pull/371)
+* \[[`590fe44283`](https://github.com/nodesource/nsolid/commit/590fe44283)] - **deps**: update libcurl to 8.16.0 (Santiago Gimeno) [#370](https://github.com/nodesource/nsolid/pull/370)
+* \[[`bb1320cb5d`](https://github.com/nodesource/nsolid/commit/bb1320cb5d)] - **deps**: update grpc to 1.75.0 (Santiago Gimeno) [#369](https://github.com/nodesource/nsolid/pull/369)
+* \[[`b665e3d776`](https://github.com/nodesource/nsolid/commit/b665e3d776)] - **doc**: explain NSOLID\_DISABLE\_PACKAGE\_SCAN better (Santiago Gimeno) [#362](https://github.com/nodesource/nsolid/pull/362)
+* \[[`dca0a2780b`](https://github.com/nodesource/nsolid/commit/dca0a2780b)] - **src**: clamp idle time to avoid underflow in metrics (Santiago Gimeno) [#372](https://github.com/nodesource/nsolid/pull/372)
+* \[[`f2fc4d6c4a`](https://github.com/nodesource/nsolid/commit/f2fc4d6c4a)] - **test**: fix flaky test-grpc-packages (Santiago Gimeno) [#368](https://github.com/nodesource/nsolid/pull/368)
+
+## 2025-09-17, Version 20.19.4-nsolid-v6.0.1 'Iron'
+
+### Commits
+
+* \[[`b8cce4f42e`](https://github.com/nodesource/nsolid/commit/b8cce4f42e)] - **src**: allow missing process title in metrics update (Santiago Gimeno) [#364](https://github.com/nodesource/nsolid/pull/364)
+* \[[`71eff2f67c`](https://github.com/nodesource/nsolid/commit/71eff2f67c)] - **src**: handle nameless user @ ProcessMetrics::Update (Santiago Gimeno) [#364](https://github.com/nodesource/nsolid/pull/364)
+
+## 2025-08-27, Version 20.19.4-nsolid-v6.0.0 'Iron'
+
+### Commits
+
+* \[[`6fe5981de3`](https://github.com/nodesource/nsolid/commit/6fe5981de3)] - **agents**: enable compression in GrpcAgent (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`71e8ba668f`](https://github.com/nodesource/nsolid/commit/71e8ba668f)] - **agents**: fix crash accessing cont prof queue (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`247cac1d84`](https://github.com/nodesource/nsolid/commit/247cac1d84)] - **agents**: optimize span collector message sending (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`daaac13d07`](https://github.com/nodesource/nsolid/commit/daaac13d07)] - **agents**: support `contCpuProfile` command in the GRPC interface (Juan José Arboleda) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`9089a4c079`](https://github.com/nodesource/nsolid/commit/9089a4c079)] - **agents**: fix cont profiling timestamp calculation (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`4e0c43991d`](https://github.com/nodesource/nsolid/commit/4e0c43991d)] - **agents**: add continuous profiling to gRPC agent (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`c104e14a91`](https://github.com/nodesource/nsolid/commit/c104e14a91)] - **agents**: grow AssetStream to support cont profiling (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`bccb1f9930`](https://github.com/nodesource/nsolid/commit/bccb1f9930)] - **agents**: add ExportContinuousProfile rpc (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`254f5fb7db`](https://github.com/nodesource/nsolid/commit/254f5fb7db)] - **build**: real fix for test-grpc-packages (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`99969bdfde`](https://github.com/nodesource/nsolid/commit/99969bdfde)] - **build,test**: make test-grpc-packages pass again (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`59e320ef98`](https://github.com/nodesource/nsolid/commit/59e320ef98)] - **deps**: bump nsolid-cli to solve vulnerabilities (Minwoo) [nodesource/nsolid-private#14](https://github.com/nodesource/nsolid-private/pull/14)
+* \[[`1fb74be9f6`](https://github.com/nodesource/nsolid/commit/1fb74be9f6)] - **deps**: update grpc to 1.74.0 (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`8cc1e530b5`](https://github.com/nodesource/nsolid/commit/8cc1e530b5)] - **deps**: add support for exporting Summary via OTLP (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`80d38209d2`](https://github.com/nodesource/nsolid/commit/80d38209d2)] - **deps**: update to opentelemetry 1.22.0 (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`eb250dbdbb`](https://github.com/nodesource/nsolid/commit/eb250dbdbb)] - **deps**: update protobuf to 32.0 (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`df016815fa`](https://github.com/nodesource/nsolid/commit/df016815fa)] - **deps**: update grpc to 1.73.1 (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`ce088f59ca`](https://github.com/nodesource/nsolid/commit/ce088f59ca)] - **deps**: update protobuf to 31.1 (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`8220e771b9`](https://github.com/nodesource/nsolid/commit/8220e771b9)] - **deps**: update libcurl to 8.15.0 (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`5eb93c4d33`](https://github.com/nodesource/nsolid/commit/5eb93c4d33)] - **deps**: update protobuf to 30.2 and grpc to 1.72.0 (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`b6b2fc4d00`](https://github.com/nodesource/nsolid/commit/b6b2fc4d00)] - **deps**: add support for exporting Summary via OTLP (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`10735208d9`](https://github.com/nodesource/nsolid/commit/10735208d9)] - **deps**: update opentelemetry-cpp to 1.21.0 (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`b3afa67166`](https://github.com/nodesource/nsolid/commit/b3afa67166)] - **deps**: update json to 3.12.0 (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`b09d6f87d4`](https://github.com/nodesource/nsolid/commit/b09d6f87d4)] - **deps**: update libcurl to 8.13.0 (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`4610f35626`](https://github.com/nodesource/nsolid/commit/4610f35626)] - **deps,win**: fix grpc build (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`bba804e112`](https://github.com/nodesource/nsolid/commit/bba804e112)] - **deps,win**: fix protobuf abseil-cpp compilation (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`3af7d8174e`](https://github.com/nodesource/nsolid/commit/3af7d8174e)] - **lib**: only use gRPC to connect to SaaS (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`c870caec35`](https://github.com/nodesource/nsolid/commit/c870caec35)] - **lib**: add continuous CPU profiling configuration (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`4f84d0b0c7`](https://github.com/nodesource/nsolid/commit/4f84d0b0c7)] - **src**: make AsyncTSQueue C++17 compatible (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`a96b9884a1`](https://github.com/nodesource/nsolid/commit/a96b9884a1)] - **src**: add fast api call to get spanId and traceId (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`88d649df02`](https://github.com/nodesource/nsolid/commit/88d649df02)] - **src**: add fast api calls to push span strings (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`3017d63746`](https://github.com/nodesource/nsolid/commit/3017d63746)] - **src**: add batching options to AsyncTSQueue (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`2a575a03ba`](https://github.com/nodesource/nsolid/commit/2a575a03ba)] - **src**: optimize async notifications in enqueue (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`a4bc3fd57e`](https://github.com/nodesource/nsolid/commit/a4bc3fd57e)] - **src**: add batched support callback in AsyncTSQueue (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`ed8f6e5518`](https://github.com/nodesource/nsolid/commit/ed8f6e5518)] - **src**: fix thread-safety issues @ ContinuousProfiler (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`cf85b9fc27`](https://github.com/nodesource/nsolid/commit/cf85b9fc27)] - **src**: store hasEbpfSupport metadata in info.proto (RafaelGSS) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`74c6a1e4fa`](https://github.com/nodesource/nsolid/commit/74c6a1e4fa)] - **src**: integrate ContinuousProfiler with EnvList (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`2d8d138edf`](https://github.com/nodesource/nsolid/commit/2d8d138edf)] - **src**: implement ContinuousProfiler class (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`27823e079b`](https://github.com/nodesource/nsolid/commit/27823e079b)] - **test**: fix test-zmq-packages.mjs agents test (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`50f9000e25`](https://github.com/nodesource/nsolid/commit/50f9000e25)] - **test**: add gRPC continuous profiling tests (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`f1d9a0c02e`](https://github.com/nodesource/nsolid/commit/f1d9a0c02e)] - **test**: add continuous profiling configuration tests (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`5ecc8bc78a`](https://github.com/nodesource/nsolid/commit/5ecc8bc78a)] - **tools**: fix linting in update-protobuf.sh updater (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
+* \[[`2f90535d80`](https://github.com/nodesource/nsolid/commit/2f90535d80)] - **tools**: add script to regenerate protofiles (Santiago Gimeno) [#359](https://github.com/nodesource/nsolid/pull/359)
diff --git a/doc/contributing/managing-social-media-acounts.md b/doc/contributing/managing-social-media-acounts.md
new file mode 100644
index 00000000000..3095e0ab740
--- /dev/null
+++ b/doc/contributing/managing-social-media-acounts.md
@@ -0,0 +1,49 @@
+# Managing social media accounts
+
+The project obtains and manages social media accounts in order to help
+promote the project and to share content that benefits the ecosystem.
+
+Currently the project has the following social media accounts:
+
+* [bluesky](https://bsky.app/profile/nodejs.org)
+* [twitter](https://x.com/nodejs)
+* [Facebook](https://www.facebook.com/nodejsfoundation)
+* [LinkedIn](https://www.linkedin.com/company/node.js-foundation/)
+
+## bluesky
+
+Bluesky is managed directly by the project. Automation is used
+to request posts/reposts as outlined in
+[nodejs/bluesky](https://github.com/nodejs/bluesky).
+
+Login credentials are available to members of the Technical
+Steering Committee, but are not to be used directly except
+in exceptional circumstances.
+
+## Twitter/X
+
+Day to day management of the Twitter/X account has been
+delegated to the Foundation Staff.
+
+In addition, it has been agreed that Releasers may login
+and post when doing a release, and TSC members may post
+an announcement of a release if a releaser is not able to
+do it themselves.
+
+Login credentials are available to members of the Technical
+Steering Committee. Releasers may request access by
+opening an issue in the nodejs/admin repo asking for access.
+
+## Facebook
+
+Day to day management of the Facebook account has been
+delegated to the Foundation Staff.
+
+No project members have access to the Facebook account.
+
+## Linkedin
+
+Day to day management of the LinkedIn account has been
+delegated to the Foundation Staff.
+
+No project members have access to the LinkedIn account.
diff --git a/doc/contributing/pull-requests.md b/doc/contributing/pull-requests.md
index 2c1849b67ad..fb2318f7137 100644
--- a/doc/contributing/pull-requests.md
+++ b/doc/contributing/pull-requests.md
@@ -59,7 +59,7 @@ help, questions, and discussions.
 development of Node.js core specifically.
 
 Node.js also has an unofficial IRC channel:
-[#Node.js](https://web.libera.chat/?channels=node.js).
+[#Node.js](https://web.libera.chat/#node.js).
 
 ## Setting up your local environment
 
diff --git a/doc/contributing/security-release-process.md b/doc/contributing/security-release-process.md
index d2eef2c6dad..6ba435c9bd2 100644
--- a/doc/contributing/security-release-process.md
+++ b/doc/contributing/security-release-process.md
@@ -60,6 +60,9 @@ The current security stewards are documented in the main Node.js
     * Use the "summary" feature in HackerOne. Example [2038134](https://hackerone.com/reports/2038134)
     * `git node security --add-report=report_id`
     * `git node security --remove-report=report_id`
+  * Ensure to ping the Node.js TSC team for review of the PRs prior to the release date.
+    * Adding individuals with expertise in the report topic is also a viable option if
+      communicated properly with nodejs/security and TSC.
 
 * [ ] 3\. **Assigning Severity and Writing Team Summary:**
   * [ ] Assign a severity and write a team summary on HackerOne for the reports
@@ -160,14 +163,10 @@ security announcements for more information.
 
 ## Post-Release
 
-* [ ] 1\. **Merge the Next Security Release PR:**
-  * This involves moving the `vulnerabilities.json` file from
-    `security-release/next-security-release` to the `security-release/YYYY-MM-DD`
-    folder and merging the PR.
-
-* [ ] 2\. **Cleanup:**
+* [ ] 1\. **Cleanup:**
   * [ ] `git node security --cleanup`. This command will:
-  * Close PRs and backports.
+  * Update next-security-release folder
+  * Close all PRs and backports labeled with `Security Release`.
   * Close HackerOne reports:
     * Close Resolved
     * Request Disclosure
@@ -178,7 +177,7 @@ security announcements for more information.
       Then uncheck the Public Disclosure on HackerOne box at the bottom of the
       page.
       ![screenshot of HackerOne CVE form](https://github.com/nodejs/node/assets/26234614/e22e4f33-7948-4dd2-952e-2f9166f5568d)
-  * [ ] PR machine-readable JSON descriptions of the vulnerabilities to the [core](https://github.com/nodejs/security-wg/tree/HEAD/vuln/core)
+  * PR machine-readable JSON descriptions of the vulnerabilities to the [core](https://github.com/nodejs/security-wg/tree/HEAD/vuln/core)
     vulnerability DB.
   * [ ] Add yourself as a steward in the [Security Release Stewards](https://github.com/nodejs/node/blob/HEAD/doc/contributing/security-release-process.md#security-release-stewards)
 
diff --git a/doc/contributing/strategic-initiatives.md b/doc/contributing/strategic-initiatives.md
index cd4072f6d19..3b8bb4aafaf 100644
--- a/doc/contributing/strategic-initiatives.md
+++ b/doc/contributing/strategic-initiatives.md
@@ -18,7 +18,7 @@ agenda to ensure they are active and have the support they need.
 | Startup Snapshot       | [Joyee Cheung][joyeecheung]      | <https://github.com/nodejs/node/issues/35711>     |
 | V8 Currency            | [Michaël Zasso][targos]          |                                                   |
 | Next-10                | [Michael Dawson][mhdawson]       | <https://github.com/nodejs/next-10>               |
-| Single executable apps |                                  | <https://github.com/nodejs/node/issues/43432>     |
+| Single executable apps | [Darshan Sen][RaisinTen]         | <https://github.com/nodejs/single-executable>     |
 | Performance            |                                  | <https://github.com/nodejs/performance>           |
 | Primordials            | [Benjamin Gruenbaum][benjamingr] | <https://github.com/nodejs/primordials-use-cases> |
 
@@ -43,6 +43,7 @@ agenda to ensure they are active and have the support they need.
 
 </details>
 
+[RaisinTen]: https://github.com/RaisinTen
 [aduh95]: https://github.com/aduh95
 [benjamingr]: https://github.com/benjamingr
 [jasnell]: https://github.com/jasnell
diff --git a/doc/contributing/writing-tests.md b/doc/contributing/writing-tests.md
index 0a6af29bf04..8c67ed2c941 100644
--- a/doc/contributing/writing-tests.md
+++ b/doc/contributing/writing-tests.md
@@ -21,9 +21,22 @@ Add tests when:
 ## Test directory structure
 
 See [directory structure overview][] for outline of existing test and locations.
-When deciding on whether to expand an existing test file or create a new one,
-consider going through the files related to the subsystem.
-For example, look for `test-streams` when writing a test for `lib/streams.js`.
+
+## How to write a good test
+
+A good test should be written in a style that is optimial for debugging
+when it fails.
+
+In principle, when adding a new test, it should be placed in a new file.
+Unless there is strong motivation to do so, refrain from appending
+new test cases to an existing file. Similar to the reproductions we ask
+for in the issue tracker, a good test should be as minimal and isolated as
+possible to facilitate debugging.
+
+A good test should come with comments explaining what it tries to test,
+so that when it fails, other contributors can fix it with the full context
+of its intention, and be able to modify it in good confidence when the context
+changes.
 
 ## Test structure
 
diff --git a/lib/_http_outgoing.js b/lib/_http_outgoing.js
index 7c663920188..60deb453ee3 100644
--- a/lib/_http_outgoing.js
+++ b/lib/_http_outgoing.js
@@ -606,7 +606,7 @@ function matchHeader(self, state, field, value) {
       break;
     case 'content-length':
       state.contLen = true;
-      self._contentLength = value;
+      self._contentLength = +value;
       self._removedContLen = false;
       break;
     case 'date':
diff --git a/lib/dns.js b/lib/dns.js
index 18288b7d6f2..215dfd3d48c 100644
--- a/lib/dns.js
+++ b/lib/dns.js
@@ -55,6 +55,8 @@ const {
   getDefaultResultOrder,
   setDefaultResultOrder,
   errorCodes: dnsErrorCodes,
+  validDnsOrders,
+  validFamilies,
 } = require('internal/dns/utils');
 const {
   Resolver,
@@ -197,7 +199,6 @@ function onlookupall(err, addresses) {
 
 // Easy DNS A/AAAA look up
 // lookup(hostname, [options,] callback)
-const validFamilies = [0, 4, 6];
 function lookup(hostname, options, callback) {
   let hints = 0;
   let family = 0;
@@ -251,7 +252,7 @@ function lookup(hostname, options, callback) {
       dnsOrder = options.verbatim ? 'verbatim' : 'ipv4first';
     }
     if (options?.order != null) {
-      validateOneOf(options.order, 'options.order', ['ipv4first', 'ipv6first', 'verbatim']);
+      validateOneOf(options.order, 'options.order', validDnsOrders);
       dnsOrder = options.order;
     }
   }
diff --git a/lib/internal/crypto/hash.js b/lib/internal/crypto/hash.js
index fda2017fa0c..f5b89cd9ac3 100644
--- a/lib/internal/crypto/hash.js
+++ b/lib/internal/crypto/hash.js
@@ -3,6 +3,7 @@
 const {
   ObjectSetPrototypeOf,
   ReflectApply,
+  StringPrototypeReplace,
   StringPrototypeToLowerCase,
   Symbol,
 } = primordials;
@@ -33,6 +34,8 @@ const {
   lazyDOMException,
   normalizeEncoding,
   encodingsMap,
+  isPendingDeprecation,
+  getDeprecationWarningEmitter,
 } = require('internal/util');
 
 const {
@@ -63,6 +66,25 @@ const LazyTransform = require('internal/streams/lazy_transform');
 const kState = Symbol('kState');
 const kFinalized = Symbol('kFinalized');
 
+/**
+ * @param {string} name
+ */
+function normalizeAlgorithm(name) {
+  return StringPrototypeReplace(StringPrototypeToLowerCase(name), '-', '');
+}
+
+const maybeEmitDeprecationWarning = getDeprecationWarningEmitter(
+  'DEP0198',
+  'Creating SHAKE128/256 digests without an explicit options.outputLength is deprecated.',
+  undefined,
+  false,
+  (algorithm) => {
+    if (!isPendingDeprecation()) return false;
+    const normalized = normalizeAlgorithm(algorithm);
+    return normalized === 'shake128' || normalized === 'shake256';
+  },
+);
+
 function Hash(algorithm, options) {
   if (!new.target)
     return new Hash(algorithm, options);
@@ -80,6 +102,9 @@ function Hash(algorithm, options) {
   this[kState] = {
     [kFinalized]: false,
   };
+  if (!isCopy && xofLen === undefined) {
+    maybeEmitDeprecationWarning(algorithm);
+  }
   ReflectApply(LazyTransform, this, [options]);
 }
 
@@ -213,6 +238,12 @@ function hash(algorithm, input, outputEncoding = 'hex') {
       }
     }
   }
+  // TODO: ideally we have to ship https://github.com/nodejs/node/pull/58121 so
+  // that a proper DEP0198 deprecation can be done here as well.
+  const normalizedAlgorithm = normalizeAlgorithm(algorithm);
+  if (normalizedAlgorithm === 'shake128' || normalizedAlgorithm === 'shake256') {
+    return new Hash(algorithm).update(input).digest(normalized);
+  }
   return oneShotDigest(algorithm, getCachedHashId(algorithm), getHashCache(),
                        input, normalized, encodingsMap[normalized]);
 }
diff --git a/lib/internal/debugger/inspect_repl.js b/lib/internal/debugger/inspect_repl.js
index b4f454152dc..0c6e3470694 100644
--- a/lib/internal/debugger/inspect_repl.js
+++ b/lib/internal/debugger/inspect_repl.js
@@ -56,6 +56,7 @@ const { fileURLToPath } = require('internal/url');
 
 const { customInspectSymbol, SideEffectFreeRegExpPrototypeSymbolReplace } = require('internal/util');
 const { inspect: utilInspect } = require('internal/util/inspect');
+const { isObjectLiteral } = require('internal/repl/utils');
 const debuglog = require('internal/util/debuglog').debuglog('inspect');
 
 const SHORTCUTS = {
@@ -573,8 +574,15 @@ function createRepl(inspector) {
     if (input === '\n') return lastCommand;
     // Add parentheses: exec process.title => exec("process.title");
     const match = RegExpPrototypeExec(/^\s*(?:exec|p)\s+([^\n]*)/, input);
+    input = match ? match[1] : input;
+
+    if (isObjectLiteral(input)) {
+      // Add parentheses to make sure `input` is parsed as an expression
+      input = `(${StringPrototypeTrim(input)})\n`;
+    }
+
     if (match) {
-      lastCommand = `exec(${JSONStringify(match[1])})`;
+      lastCommand = `exec(${JSONStringify(input)})`;
     } else {
       lastCommand = input;
     }
diff --git a/lib/internal/dns/promises.js b/lib/internal/dns/promises.js
index b2804aa663c..73918410e67 100644
--- a/lib/internal/dns/promises.js
+++ b/lib/internal/dns/promises.js
@@ -25,6 +25,8 @@ const {
   getDefaultResultOrder,
   setDefaultResultOrder,
   setDefaultResolver,
+  validDnsOrders,
+  validFamilies,
 } = require('internal/dns/utils');
 
 const {
@@ -257,7 +259,6 @@ function createLookupPromise(family, hostname, all, hints, dnsOrder) {
   });
 }
 
-const validFamilies = [0, 4, 6];
 /**
  * Get the IP address for a given hostname.
  * @param {string} hostname - The hostname to resolve (ex. 'nodejs.org').
@@ -305,7 +306,7 @@ function lookup(hostname, options) {
       dnsOrder = options.verbatim ? 'verbatim' : 'ipv4first';
     }
     if (options?.order != null) {
-      validateOneOf(options.order, 'options.order', ['ipv4first', 'ipv6first', 'verbatim']);
+      validateOneOf(options.order, 'options.order', validDnsOrders);
       dnsOrder = options.order;
     }
   }
diff --git a/lib/internal/dns/utils.js b/lib/internal/dns/utils.js
index a79a5b846a6..b0ea4bf99ae 100644
--- a/lib/internal/dns/utils.js
+++ b/lib/internal/dns/utils.js
@@ -200,6 +200,8 @@ class ResolverBase {
 
 let defaultResolver;
 let dnsOrder;
+const validDnsOrders = ['verbatim', 'ipv4first', 'ipv6first'];
+const validFamilies = [0, 4, 6];
 
 function initializeDns() {
   const orderFromCLI = getOptionValue('--dns-result-order');
@@ -207,7 +209,7 @@ function initializeDns() {
     dnsOrder ??= 'verbatim';
   } else {
     // Allow the deserialized application to override order from CLI.
-    validateOneOf(orderFromCLI, '--dns-result-order', ['verbatim', 'ipv4first', 'ipv6first']);
+    validateOneOf(orderFromCLI, '--dns-result-order', validDnsOrders);
     dnsOrder = orderFromCLI;
   }
 
@@ -279,7 +281,7 @@ function emitInvalidHostnameWarning(hostname) {
 }
 
 function setDefaultResultOrder(value) {
-  validateOneOf(value, 'dnsOrder', ['verbatim', 'ipv4first', 'ipv6first']);
+  validateOneOf(value, 'dnsOrder', validDnsOrders);
   dnsOrder = value;
 }
 
@@ -353,4 +355,6 @@ module.exports = {
   errorCodes,
   createResolverClass,
   initializeDns,
+  validDnsOrders,
+  validFamilies,
 };
diff --git a/lib/internal/errors.js b/lib/internal/errors.js
index efad1be9c34..8e52916a9c2 100644
--- a/lib/internal/errors.js
+++ b/lib/internal/errors.js
@@ -1715,9 +1715,18 @@ E('ERR_PARSE_ARGS_UNKNOWN_OPTION', (option, allowPositionals) => {
 E('ERR_PERFORMANCE_INVALID_TIMESTAMP',
   '%d is not a valid timestamp', TypeError);
 E('ERR_PERFORMANCE_MEASURE_INVALID_OPTIONS', '%s', TypeError);
-E('ERR_REQUIRE_ASYNC_MODULE', 'require() cannot be used on an ESM ' +
-  'graph with top-level await. Use import() instead. To see where the' +
-  ' top-level await comes from, use --experimental-print-required-tla.', Error);
+E('ERR_REQUIRE_ASYNC_MODULE', function(filename, parentFilename) {
+  let message = 'require() cannot be used on an ESM ' +
+    'graph with top-level await. Use import() instead. To see where the' +
+    ' top-level await comes from, use --experimental-print-required-tla.';
+  if (parentFilename) {
+    message += `\n  From ${parentFilename} `;
+  }
+  if (filename) {
+    message += `\n  Requiring ${filename} `;
+  }
+  return message;
+}, Error);
 E('ERR_REQUIRE_CYCLE_MODULE', '%s', Error);
 E('ERR_REQUIRE_ESM',
   function(filename, hasEsmSyntax, parentPath = null, packageJsonPath = null) {
diff --git a/lib/internal/fs/utils.js b/lib/internal/fs/utils.js
index 124432afd43..a63d2d2b6a4 100644
--- a/lib/internal/fs/utils.js
+++ b/lib/internal/fs/utils.js
@@ -155,7 +155,7 @@ function lazyLoadFs() {
 function assertEncoding(encoding) {
   if (encoding && !Buffer.isEncoding(encoding)) {
     const reason = 'is invalid encoding';
-    throw new ERR_INVALID_ARG_VALUE(encoding, 'encoding', reason);
+    throw new ERR_INVALID_ARG_VALUE('encoding', encoding, reason);
   }
 }
 
diff --git a/lib/internal/heap_utils.js b/lib/internal/heap_utils.js
index c39d811ab79..6d72fb1d628 100644
--- a/lib/internal/heap_utils.js
+++ b/lib/internal/heap_utils.js
@@ -53,11 +53,12 @@ class HeapSnapshotStream extends Readable {
       this[kHandle].readStart();
   }
 
-  _destroy() {
+  _destroy(err, callback) {
     // Release the references on the handle so that
     // it can be garbage collected.
     this[kHandle][owner_symbol] = undefined;
     this[kHandle] = undefined;
+    callback(err);
   }
 
   [kUpdateTimer]() {
diff --git a/lib/internal/modules/cjs/loader.js b/lib/internal/modules/cjs/loader.js
index 37a0c4c50b0..45c82605d55 100644
--- a/lib/internal/modules/cjs/loader.js
+++ b/lib/internal/modules/cjs/loader.js
@@ -101,6 +101,9 @@ const kIsMainSymbol = Symbol('kIsMainSymbol');
 const kIsCachedByESMLoader = Symbol('kIsCachedByESMLoader');
 const kRequiredModuleSymbol = Symbol('kRequiredModuleSymbol');
 const kIsExecuting = Symbol('kIsExecuting');
+
+const kFormat = Symbol('kFormat');
+
 // Set first due to cycle with ESM loader functions.
 module.exports = {
   kModuleSource,
@@ -164,13 +167,13 @@ const policy = getLazy(
 );
 const shouldReportRequiredModules = getLazy(() => process.env.WATCH_REPORT_DEPENDENCIES);
 
-const permission = require('internal/process/permission');
 const {
   vm_dynamic_import_default_internal,
 } = internalBinding('symbols');
 
 const {
   codes: {
+    ERR_INVALID_ARG_TYPE,
     ERR_INVALID_ARG_VALUE,
     ERR_INVALID_MODULE_SPECIFIER,
     ERR_REQUIRE_CYCLE_MODULE,
@@ -226,6 +229,9 @@ function internalRequire(module, id) {
  * @param {string} filename Absolute path to the file
  */
 function stat(filename) {
+  // Guard against internal bugs where a non-string filename is passed in by mistake.
+  assert(typeof filename === 'string');
+
   filename = path.toNamespacedPath(filename);
   if (statCache !== null) {
     const result = statCache.get(filename);
@@ -449,10 +455,6 @@ function initializeCJS() {
   // TODO(joyeecheung): deprecate this in favor of a proper hook?
   Module.runMain =
     require('internal/modules/run_main').executeUserEntryPoint;
-
-  if (getOptionValue('--experimental-require-module')) {
-    Module._extensions['.mjs'] = loadESMFromCJS;
-  }
 }
 
 // Given a module name, and a list of paths to test, returns the first
@@ -662,14 +664,7 @@ function resolveExports(nmPath, request) {
 // We don't cache this in case user extends the extensions.
 function getDefaultExtensions() {
   const extensions = ObjectKeys(Module._extensions);
-  if (!getOptionValue('--experimental-require-module')) {
-    return extensions;
-  }
-  // If the .mjs extension is added by --experimental-require-module,
-  // remove it from the supported default extensions to maintain
-  // compatibility.
-  // TODO(joyeecheung): allow both .mjs and .cjs?
-  return ArrayPrototypeFilter(extensions, (ext) => ext !== '.mjs' || Module._extensions['.mjs'] !== loadESMFromCJS);
+  return extensions;
 }
 
 /**
@@ -718,11 +713,11 @@ Module._findPath = function(request, paths, isMain) {
   // For each path
   for (let i = 0; i < paths.length; i++) {
     // Don't search further if path doesn't exist
-    // or doesn't have permission to it
     const curPath = paths[i];
-    if (insidePath && curPath &&
-      ((permission.isEnabled() && !permission.has('fs.read', curPath)) || _stat(curPath) < 1)
-    ) {
+    if (typeof curPath !== 'string') {
+      throw new ERR_INVALID_ARG_TYPE('paths', 'array of strings', paths);
+    }
+    if (insidePath && curPath && _stat(curPath) < 1) {
       continue;
     }
 
@@ -1281,10 +1276,6 @@ Module.prototype.load = function(filename) {
   this.paths = Module._nodeModulePaths(path.dirname(filename));
 
   const extension = findLongestRegisteredExtension(filename);
-  // allow .mjs to be overridden
-  if (StringPrototypeEndsWith(filename, '.mjs') && !Module._extensions['.mjs']) {
-    throw new ERR_REQUIRE_ESM(filename, true);
-  }
 
   Module._extensions[extension](this, filename);
   this.loaded = true;
@@ -1320,9 +1311,10 @@ let requireModuleWarningMode;
  * Resolve and evaluate it synchronously as ESM if it's ESM.
  * @param {Module} mod CJS module instance
  * @param {string} filename Absolute path of the file.
+ * @param {string} format Format of the module. If it had types, this would be what it is after type-stripping.
+ * @param {string} source Source the module. If it had types, this would have the type stripped.
  */
-function loadESMFromCJS(mod, filename) {
-  const source = getMaybeCachedSource(mod, filename);
+function loadESMFromCJS(mod, filename, format, source) {
   const cascadedLoader = require('internal/modules/esm/loader').getOrInitializeCascadedLoader();
   const isMain = mod[kIsMainSymbol];
   if (isMain) {
@@ -1498,7 +1490,9 @@ function wrapSafe(filename, content, cjsModuleInstance, format) {
  * `exports`) to the file. Returns exception, if any.
  * @param {string} content The source code of the module
  * @param {string} filename The file path of the module
- * @param {'module'|'commonjs'|undefined} format Intended format of the module.
+ * @param {
+ *    'module'|'commonjs'|'commonjs-typescript'|'module-typescript'
+ * } format Intended format of the module.
  */
 Module.prototype._compile = function(content, filename, format) {
   let moduleURL;
@@ -1520,9 +1514,7 @@ Module.prototype._compile = function(content, filename, format) {
   }
 
   if (format === 'module') {
-    // Pass the source into the .mjs extension handler indirectly through the cache.
-    this[kModuleSource] = content;
-    loadESMFromCJS(this, filename);
+    loadESMFromCJS(this, filename, format, content);
     return;
   }
 
@@ -1550,22 +1542,72 @@ Module.prototype._compile = function(content, filename, format) {
 
 /**
  * Get the source code of a module, using cached ones if it's cached.
+ * After this returns, mod[kFormat], mod[kModuleSource] and mod[kURL] will be set.
  * @param {Module} mod Module instance whose source is potentially already cached.
  * @param {string} filename Absolute path to the file of the module.
- * @returns {string}
+ * @returns {{source: string, format?: string}}
  */
-function getMaybeCachedSource(mod, filename) {
-  // If already analyzed the source, then it will be cached.
-  let content;
-  if (mod[kModuleSource] !== undefined) {
-    content = mod[kModuleSource];
+function loadSource(mod, filename, formatFromNode) {
+  if (formatFromNode !== undefined) {
+    mod[kFormat] = formatFromNode;
+  }
+  const format = mod[kFormat];
+
+  let source = mod[kModuleSource];
+  if (source !== undefined) {
     mod[kModuleSource] = undefined;
   } else {
     // TODO(joyeecheung): we can read a buffer instead to speed up
     // compilation.
-    content = fs.readFileSync(filename, 'utf8');
+    source = fs.readFileSync(filename, 'utf8');
+  }
+  return { source, format };
+}
+
+function reconstructErrorStack(err, parentPath, parentSource) {
+  const errLine = StringPrototypeSplit(
+    StringPrototypeSlice(err.stack, StringPrototypeIndexOf(
+      err.stack, '    at ')), '\n', 1)[0];
+  const { 1: line, 2: col } =
+    RegExpPrototypeExec(/(\d+):(\d+)\)/, errLine) || [];
+  if (line && col) {
+    const srcLine = StringPrototypeSplit(parentSource, '\n')[line - 1];
+    const frame = `${parentPath}:${line}\n${srcLine}\n${StringPrototypeRepeat(' ', col - 1)}^\n`;
+    setArrowMessage(err, frame);
+  }
+}
+
+/**
+ * Generate the legacy ERR_REQUIRE_ESM for the cases where require(esm) is disabled.
+ * @param {Module} mod The module being required.
+ * @param {undefined|object} pkg Data of the nearest package.json of the module.
+ * @param {string} content Source code of the module.
+ * @param {string} filename Filename of the module
+ * @returns {Error}
+ */
+function getRequireESMError(mod, pkg, content, filename) {
+  // This is an error path because `require` of a `.js` file in a `"type": "module"` scope is not allowed.
+  const parent = mod[kModuleParent];
+  const parentPath = parent?.filename;
+  const packageJsonPath = pkg?.path ? path.resolve(pkg.path, 'package.json') : null;
+  const usesEsm = containsModuleSyntax(content, filename);
+  const err = new ERR_REQUIRE_ESM(filename, usesEsm, parentPath,
+                                  packageJsonPath);
+  // Attempt to reconstruct the parent require frame.
+  const parentModule = Module._cache[parentPath];
+  if (parentModule) {
+    let parentSource;
+    try {
+      ({ source: parentSource } = loadSource(parentModule, parentPath));
+    } catch {
+      // Continue regardless of error.
+    }
+    if (parentSource) {
+      // TODO(joyeecheung): trim off internal frames from the stack.
+      reconstructErrorStack(err, parentPath, parentSource);
+    }
   }
-  return content;
+  return err;
 }
 
 /**
@@ -1574,57 +1616,25 @@ function getMaybeCachedSource(mod, filename) {
  * @param {string} filename The file path of the module
  */
 Module._extensions['.js'] = function(module, filename) {
-  // If already analyzed the source, then it will be cached.
-  const content = getMaybeCachedSource(module, filename);
-
-  let format;
-  if (StringPrototypeEndsWith(filename, '.js')) {
-    const pkg = packageJsonReader.readPackageScope(filename) || { __proto__: null };
-    // Function require shouldn't be used in ES modules.
-    if (pkg.data?.type === 'module') {
-      if (getOptionValue('--experimental-require-module')) {
-        module._compile(content, filename, 'module');
-        return;
-      }
-
-      // This is an error path because `require` of a `.js` file in a `"type": "module"` scope is not allowed.
-      const parent = module[kModuleParent];
-      const parentPath = parent?.filename;
-      const packageJsonPath = path.resolve(pkg.path, 'package.json');
-      const usesEsm = containsModuleSyntax(content, filename);
-      const err = new ERR_REQUIRE_ESM(filename, usesEsm, parentPath,
-                                      packageJsonPath);
-      // Attempt to reconstruct the parent require frame.
-      if (Module._cache[parentPath]) {
-        let parentSource;
-        try {
-          parentSource = fs.readFileSync(parentPath, 'utf8');
-        } catch {
-          // Continue regardless of error.
-        }
-        if (parentSource) {
-          const errLine = StringPrototypeSplit(
-            StringPrototypeSlice(err.stack, StringPrototypeIndexOf(
-              err.stack, '    at ')), '\n', 1)[0];
-          const { 1: line, 2: col } =
-              RegExpPrototypeExec(/(\d+):(\d+)\)/, errLine) || [];
-          if (line && col) {
-            const srcLine = StringPrototypeSplit(parentSource, '\n')[line - 1];
-            const frame = `${parentPath}:${line}\n${srcLine}\n${
-              StringPrototypeRepeat(' ', col - 1)}^\n`;
-            setArrowMessage(err, frame);
-          }
-        }
-      }
-      throw err;
-    } else if (pkg.data?.type === 'commonjs') {
-      format = 'commonjs';
-    }
-  } else if (StringPrototypeEndsWith(filename, '.cjs')) {
+  let format, pkg;
+  if (StringPrototypeEndsWith(filename, '.cjs')) {
     format = 'commonjs';
+  } else if (StringPrototypeEndsWith(filename, '.mjs')) {
+    format = 'module';
+  } else if (StringPrototypeEndsWith(filename, '.js')) {
+    pkg = packageJsonReader.readPackageScope(filename) || { __proto__: null };
+    const typeFromPjson = pkg.data?.type;
+    if (typeFromPjson === 'module' || typeFromPjson === 'commonjs' || !typeFromPjson) {
+      format = typeFromPjson;
+    }
   }
-
-  module._compile(content, filename, format);
+  const { source, format: loadedFormat } = loadSource(module, filename, format);
+  // Function require shouldn't be used in ES modules when require(esm) is disabled.
+  if (loadedFormat === 'module' && !getOptionValue('--experimental-require-module')) {
+    const err = getRequireESMError(module, pkg, source, filename);
+    throw err;
+  }
+  module._compile(source, filename, loadedFormat);
 };
 
 /**
diff --git a/lib/internal/modules/esm/loader.js b/lib/internal/modules/esm/loader.js
index d9b2c75dd97..e85f4b3acc3 100644
--- a/lib/internal/modules/esm/loader.js
+++ b/lib/internal/modules/esm/loader.js
@@ -36,12 +36,23 @@ const {
   getDefaultConditions,
 } = require('internal/modules/esm/utils');
 const { kImplicitAssertType } = require('internal/modules/esm/assert');
-const { ModuleWrap, kEvaluating, kEvaluated } = internalBinding('module_wrap');
+const {
+  ModuleWrap,
+  kEvaluated,
+  kEvaluating,
+  kInstantiated,
+  kErrored,
+  throwIfPromiseRejected,
+} = internalBinding('module_wrap');
 const {
   urlToFilename,
 } = require('internal/modules/helpers');
 let defaultResolve, defaultLoad, defaultLoadSync, importMetaInitializer;
 
+let debug = require('internal/util/debuglog').debuglog('esm', (fn) => {
+  debug = fn;
+});
+
 /**
  * @typedef {import('./hooks.js').HooksProxy} HooksProxy
  * @typedef {import('./module_job.js').ModuleJobBase} ModuleJobBase
@@ -75,6 +86,23 @@ function getTranslators() {
   return translators;
 }
 
+/**
+ * Generate message about potential race condition caused by requiring a cached module that has started
+ * async linking.
+ * @param {string} filename Filename of the module being required.
+ * @param {string|undefined} parentFilename Filename of the module calling require().
+ * @returns {string} Error message.
+ */
+function getRaceMessage(filename, parentFilename) {
+  let raceMessage = `Cannot require() ES Module ${filename} because it is not yet fully loaded. `;
+  raceMessage += 'This may be caused by a race condition if the module is simultaneously dynamically ';
+  raceMessage += 'import()-ed via Promise.all(). Try await-ing the import() sequentially in a loop instead.';
+  if (parentFilename) {
+    raceMessage += ` (from ${parentFilename})`;
+  }
+  return raceMessage;
+}
+
 /**
  * @type {HooksProxy}
  * Multiple loader instances exist for various, specific reasons (see code comments at site).
@@ -295,20 +323,58 @@ class ModuleLoader {
     //    TODO(joyeecheung): ensure that imported synchronous graphs are evaluated
     //    synchronously so that any previously imported synchronous graph is already
     //    evaluated at this point.
+    // TODO(joyeecheung): add something similar to CJS loader's requireStack to help
+    // debugging the the problematic links in the graph for import.
+    debug('importSyncForRequire', parent?.filename, '->', filename, job);
     if (job !== undefined) {
       mod[kRequiredModuleSymbol] = job.module;
+      const parentFilename = urlToFilename(parent?.filename);
+      // TODO(node:55782): this race may stop to happen when the ESM resolution and loading become synchronous.
+      if (!job.module) {
+        assert.fail(getRaceMessage(filename, parentFilename));
+      }
       if (job.module.async) {
-        throw new ERR_REQUIRE_ASYNC_MODULE();
+        throw new ERR_REQUIRE_ASYNC_MODULE(filename, parentFilename);
       }
-      if (job.module.getStatus() !== kEvaluated) {
-        const parentFilename = urlToFilename(parent?.filename);
-        let message = `Cannot require() ES Module ${filename} in a cycle.`;
-        if (parentFilename) {
-          message += ` (from ${parentFilename})`;
-        }
-        throw new ERR_REQUIRE_CYCLE_MODULE(message);
+      const status = job.module.getStatus();
+      debug('Module status', job, status);
+      if (status === kEvaluated) {
+        return { wrap: job.module, namespace: job.module.getNamespaceSync(filename, parentFilename) };
+      } else if (status === kInstantiated) {
+        // When it's an async job cached by another import request,
+        // which has finished linking but has not started its
+        // evaluation because the async run() task would be later
+        // in line. Then start the evaluation now with runSync(), which
+        // is guaranteed to finish by the time the other run() get to it,
+        // and the other task would just get the cached evaluation results,
+        // similar to what would happen when both are async.
+        mod[kRequiredModuleSymbol] = job.module;
+        const { namespace } = job.runSync(parent);
+        return { wrap: job.module, namespace: namespace || job.module.getNamespace() };
+      } else if (status === kErrored) {
+        // If the module was previously imported and errored, throw the error.
+        throw job.module.getError();
+      }
+      // When the cached async job have already encountered a linking
+      // error that gets wrapped into a rejection, but is still later
+      // in line to throw on it, just unwrap and throw the linking error
+      // from require().
+      if (job.instantiated) {
+        throwIfPromiseRejected(job.instantiated);
       }
-      return { wrap: job.module, namespace: job.module.getNamespaceSync() };
+      if (status !== kEvaluating) {
+        assert.fail(`Unexpected module status ${status}. ` +
+                    getRaceMessage(filename, parentFilename));
+      }
+      let message = `Cannot require() ES Module ${filename} in a cycle.`;
+      if (parentFilename) {
+        message += ` (from ${parentFilename})`;
+      }
+      message += ' A cycle involving require(esm) is not allowed to maintain ';
+      message += 'invariants mandated by the ECMAScript specification. ';
+      message += 'Try making at least part of the dependency in the graph lazily loaded.';
+      throw new ERR_REQUIRE_CYCLE_MODULE(message);
+
     }
     // TODO(joyeecheung): refactor this so that we pre-parse in C++ and hit the
     // cache here, or use a carrier object to carry the compiled module script
@@ -320,7 +386,7 @@ class ModuleLoader {
     job = new ModuleJobSync(this, url, kEmptyObject, wrap, isMain, inspectBrk);
     this.loadCache.set(url, kImplicitAssertType, job);
     mod[kRequiredModuleSymbol] = job.module;
-    return { wrap: job.module, namespace: job.runSync().namespace };
+    return { wrap: job.module, namespace: job.runSync(parent).namespace };
   }
 
   /**
diff --git a/lib/internal/modules/esm/module_job.js b/lib/internal/modules/esm/module_job.js
index 0c8f031080a..3b68647e455 100644
--- a/lib/internal/modules/esm/module_job.js
+++ b/lib/internal/modules/esm/module_job.js
@@ -21,8 +21,14 @@ let debug = require('internal/util/debuglog').debuglog('esm', (fn) => {
   debug = fn;
 });
 
-const { ModuleWrap, kInstantiated } = internalBinding('module_wrap');
-
+const {
+  ModuleWrap,
+  kErrored,
+  kEvaluated,
+  kEvaluating,
+  kInstantiated,
+  kUninstantiated,
+} = internalBinding('module_wrap');
 const { decorateErrorStack, kEmptyObject } = require('internal/util');
 const {
   getSourceMapsEnabled,
@@ -31,6 +37,7 @@ const assert = require('internal/assert');
 const resolvedPromise = PromiseResolve();
 const {
   setHasStartedUserESMExecution,
+  urlToFilename,
 } = require('internal/modules/helpers');
 const { getOptionValue } = require('internal/options');
 const noop = FunctionPrototype;
@@ -52,6 +59,37 @@ const isCommonJSGlobalLikeNotDefinedError = (errorMessage) =>
     (globalLike) => errorMessage === `${globalLike} is not defined`,
   );
 
+
+/**
+ *
+ * @param {Error} e
+ * @param {string} url
+ * @returns {void}
+ */
+const explainCommonJSGlobalLikeNotDefinedError = (e, url) => {
+  if (e?.name === 'ReferenceError' &&
+      isCommonJSGlobalLikeNotDefinedError(e.message)) {
+    e.message += ' in ES module scope';
+
+    if (StringPrototypeStartsWith(e.message, 'require ')) {
+      e.message += ', you can use import instead';
+    }
+
+    const packageConfig =
+      StringPrototypeStartsWith(url, 'file://') &&
+        RegExpPrototypeExec(/\.js(\?[^#]*)?(#.*)?$/, url) !== null &&
+        require('internal/modules/esm/resolve')
+          .getPackageScopeConfig(url);
+    if (packageConfig.type === 'module') {
+      e.message +=
+        '\nThis file is being treated as an ES module because it has a ' +
+        `'.js' file extension and '${packageConfig.pjsonPath}' contains ` +
+        '"type": "module". To treat it as a CommonJS script, rename it ' +
+        'to use the \'.cjs\' file extension.';
+    }
+  }
+};
+
 class ModuleJobBase {
   constructor(url, importAttributes, isMain, inspectBrk) {
     this.importAttributes = importAttributes;
@@ -239,22 +277,46 @@ class ModuleJob extends ModuleJobBase {
     }
   }
 
-  runSync() {
+  runSync(parent) {
     assert(this.module instanceof ModuleWrap);
-    if (this.instantiated !== undefined) {
-      return { __proto__: null, module: this.module };
+    let status = this.module.getStatus();
+
+    debug('ModuleJob.runSync()', status, this.module);
+    // FIXME(joyeecheung): this cannot fully handle < kInstantiated. Make the linking
+    // fully synchronous instead.
+    if (status === kUninstantiated) {
+      this.module.async = this.module.instantiateSync();
+      status = this.module.getStatus();
     }
+    if (status === kInstantiated || status === kErrored) {
+      const filename = urlToFilename(this.url);
+      const parentFilename = urlToFilename(parent?.filename);
+      this.module.async ??= this.module.isGraphAsync();
 
-    this.module.instantiate();
-    this.instantiated = PromiseResolve();
-    const timeout = -1;
-    const breakOnSigint = false;
-    setHasStartedUserESMExecution();
-    this.module.evaluate(timeout, breakOnSigint);
-    return { __proto__: null, module: this.module };
+      if (this.module.async && !getOptionValue('--experimental-print-required-tla')) {
+        throw new ERR_REQUIRE_ASYNC_MODULE(filename, parentFilename);
+      }
+      if (status === kInstantiated) {
+        setHasStartedUserESMExecution();
+        const namespace = this.module.evaluateSync(filename, parentFilename);
+        return { __proto__: null, module: this.module, namespace };
+      }
+      throw this.module.getError();
+    } else if (status === kEvaluating || status === kEvaluated) {
+      // kEvaluating can show up when this is being used to deal with CJS <-> CJS cycles.
+      // Allow it for now, since we only need to ban ESM <-> CJS cycles which would be
+      // detected earlier during the linking phase, though the CJS handling in the ESM
+      // loader won't be able to emit warnings on pending circular exports like what
+      // the CJS loader does.
+      // TODO(joyeecheung): remove the re-invented require() in the ESM loader and
+      // always handle CJS using the CJS loader to eliminate the quirks.
+      return { __proto__: null, module: this.module, namespace: this.module.getNamespaceSync() };
+    }
+    assert.fail(`Unexpected module status ${status}.`);
   }
 
   async run() {
+    debug('ModuleJob.run()', this.module);
     await this.instantiate();
     const timeout = -1;
     const breakOnSigint = false;
@@ -262,27 +324,7 @@ class ModuleJob extends ModuleJobBase {
     try {
       await this.module.evaluate(timeout, breakOnSigint);
     } catch (e) {
-      if (e?.name === 'ReferenceError' &&
-          isCommonJSGlobalLikeNotDefinedError(e.message)) {
-        e.message += ' in ES module scope';
-
-        if (StringPrototypeStartsWith(e.message, 'require ')) {
-          e.message += ', you can use import instead';
-        }
-
-        const packageConfig =
-          StringPrototypeStartsWith(this.module.url, 'file://') &&
-            RegExpPrototypeExec(/\.js(\?[^#]*)?(#.*)?$/, this.module.url) !== null &&
-            require('internal/modules/esm/resolve')
-              .getPackageScopeConfig(this.module.url);
-        if (packageConfig.type === 'module') {
-          e.message +=
-            '\nThis file is being treated as an ES module because it has a ' +
-            `'.js' file extension and '${packageConfig.pjsonPath}' contains ` +
-            '"type": "module". To treat it as a CommonJS script, rename it ' +
-            'to use the \'.cjs\' file extension.';
-        }
-      }
+      explainCommonJSGlobalLikeNotDefinedError(e, this.module.url);
       throw e;
     }
     return { __proto__: null, module: this.module };
@@ -351,7 +393,11 @@ class ModuleJobSync extends ModuleJobBase {
   async run() {
     // This path is hit by a require'd module that is imported again.
     const status = this.module.getStatus();
-    if (status > kInstantiated) {
+    debug('ModuleJobSync.run()', status, this.module);
+    // If the module was previously required and errored, reject from import() again.
+    if (status === kErrored) {
+      throw this.module.getError();
+    } else if (status > kInstantiated) {
       if (this.evaluationPromise) {
         await this.evaluationPromise;
       }
@@ -371,7 +417,8 @@ class ModuleJobSync extends ModuleJobBase {
                 `Status = ${status}`);
   }
 
-  runSync() {
+  runSync(parent) {
+    debug('ModuleJobSync.runSync()', this.module);
     // TODO(joyeecheung): add the error decoration logic from the async instantiate.
     this.module.async = this.module.instantiateSync();
     // If --experimental-print-required-tla is true, proceeds to evaluation even
@@ -380,12 +427,19 @@ class ModuleJobSync extends ModuleJobBase {
     // TODO(joyeecheung): track the asynchroniticy using v8::Module::HasTopLevelAwait()
     // and we'll be able to throw right after compilation of the modules, using acron
     // to find and print the TLA.
+    const parentFilename = urlToFilename(parent?.filename);
+    const filename = urlToFilename(this.url);
     if (this.module.async && !getOptionValue('--experimental-print-required-tla')) {
-      throw new ERR_REQUIRE_ASYNC_MODULE();
+      throw new ERR_REQUIRE_ASYNC_MODULE(filename, parentFilename);
     }
     setHasStartedUserESMExecution();
-    const namespace = this.module.evaluateSync();
-    return { __proto__: null, module: this.module, namespace };
+    try {
+      const namespace = this.module.evaluateSync(filename, parentFilename);
+      return { __proto__: null, module: this.module, namespace };
+    } catch (e) {
+      explainCommonJSGlobalLikeNotDefinedError(e, this.module.url);
+      throw e;
+    }
   }
 }
 
diff --git a/lib/internal/readline/interface.js b/lib/internal/readline/interface.js
index e1381b5341a..05ff898bfce 100644
--- a/lib/internal/readline/interface.js
+++ b/lib/internal/readline/interface.js
@@ -32,12 +32,14 @@ const {
   SafeStringIterator,
 } = primordials;
 
-const { codes } = require('internal/errors');
-
 const {
-  ERR_INVALID_ARG_VALUE,
-  ERR_USE_AFTER_CLOSE,
-} = codes;
+  AbortError,
+  codes: {
+    ERR_INVALID_ARG_VALUE,
+    ERR_USE_AFTER_CLOSE,
+  },
+} = require('internal/errors');
+
 const {
   validateAbortSignal,
   validateArray,
@@ -111,6 +113,7 @@ const kPrompt = Symbol('_prompt');
 const kPushToKillRing = Symbol('_pushToKillRing');
 const kPushToUndoStack = Symbol('_pushToUndoStack');
 const kQuestionCallback = Symbol('_questionCallback');
+const kQuestionReject = Symbol('_questionReject');
 const kRedo = Symbol('_redo');
 const kRedoStack = Symbol('_redoStack');
 const kRefreshLine = Symbol('_refreshLine');
@@ -1126,6 +1129,7 @@ class Interface extends InterfaceConstructor {
           } else {
             // This readline instance is finished
             this.close();
+            this[kQuestionReject]?.(new AbortError('Aborted with Ctrl+C'));
           }
           break;
 
@@ -1137,6 +1141,7 @@ class Interface extends InterfaceConstructor {
           if (this.cursor === 0 && this.line.length === 0) {
             // This readline instance is finished
             this.close();
+            this[kQuestionReject]?.(new AbortError('Aborted with Ctrl+D'));
           } else if (this.cursor < this.line.length) {
             this[kDeleteRight]();
           }
@@ -1392,6 +1397,7 @@ module.exports = {
   kQuestion,
   kQuestionCallback,
   kQuestionCancel,
+  kQuestionReject,
   kRefreshLine,
   kSawKeyPress,
   kSawReturnAt,
diff --git a/lib/internal/repl/utils.js b/lib/internal/repl/utils.js
index 126f8ae85d0..79a2c55dff1 100644
--- a/lib/internal/repl/utils.js
+++ b/lib/internal/repl/utils.js
@@ -739,6 +739,22 @@ function setupReverseSearch(repl) {
   return { reverseSearch };
 }
 
+const startsWithBraceRegExp = /^\s*{/;
+const endsWithSemicolonRegExp = /;\s*$/;
+
+/**
+ * Checks if some provided code represents an object literal.
+ * This is helpful to prevent confusing repl code evaluations where
+ * strings such as `{ a : 1 }` would get interpreted as block statements
+ * rather than object literals.
+ * @param {string} code the code to check
+ * @returns {boolean} true if the code represents an object literal, false otherwise
+ */
+function isObjectLiteral(code) {
+  return RegExpPrototypeExec(startsWithBraceRegExp, code) !== null &&
+    RegExpPrototypeExec(endsWithSemicolonRegExp, code) === null;
+}
+
 module.exports = {
   REPL_MODE_SLOPPY: Symbol('repl-sloppy'),
   REPL_MODE_STRICT,
@@ -746,4 +762,5 @@ module.exports = {
   kStandaloneREPL: Symbol('kStandaloneREPL'),
   setupPreview,
   setupReverseSearch,
+  isObjectLiteral,
 };
diff --git a/lib/internal/source_map/prepare_stack_trace.js b/lib/internal/source_map/prepare_stack_trace.js
index f06ea6380ce..ad065c6cac2 100644
--- a/lib/internal/source_map/prepare_stack_trace.js
+++ b/lib/internal/source_map/prepare_stack_trace.js
@@ -53,9 +53,15 @@ function prepareStackTraceWithSourceMaps(error, trace) {
       const sm = fileName === lastFileName ?
         lastSourceMap :
         findSourceMap(fileName);
-      lastSourceMap = sm;
-      lastFileName = fileName;
+      // Only when a source map is found, cache it for the next iteration.
+      // This is a performance optimization to avoid interleaving with JS builtin function
+      // invalidating the cache.
+      // - at myFunc (file:///path/to/file.js:1:2)
+      // - at Array.map (<anonymous>)
+      // - at myFunc (file:///path/to/file.js:3:4)
       if (sm) {
+        lastSourceMap = sm;
+        lastFileName = fileName;
         return `${kStackLineAt}${serializeJSStackFrame(sm, callSite, trace[i + 1])}`;
       }
     } catch (err) {
diff --git a/lib/internal/source_map/source_map_cache.js b/lib/internal/source_map/source_map_cache.js
index 9defc32da8e..c50a44464a2 100644
--- a/lib/internal/source_map/source_map_cache.js
+++ b/lib/internal/source_map/source_map_cache.js
@@ -157,6 +157,9 @@ function maybeCacheSourceMap(filename, content, moduleInstance, isGeneratedSourc
   }
 
   const data = dataFromUrl(filename, sourceMapURL);
+  // `data` could be null if the source map is invalid.
+  // In this case, create a cache entry with null data with source url for test coverage.
+
   const entry = {
     __proto__: null,
     lineLengths: lineLengths(content),
@@ -279,6 +282,8 @@ function sourceMapFromDataUrl(sourceURL, url) {
       const parsedData = JSONParse(decodedData);
       return sourcesToAbsolute(sourceURL, parsedData);
     } catch (err) {
+      // TODO(legendecas): warn about invalid source map JSON string.
+      // But it could be verbose.
       debug(err);
       return null;
     }
@@ -333,26 +338,38 @@ function sourceMapCacheToObject() {
 
 /**
  * Find a source map for a given actual source URL or path.
+ *
+ * This function may be invoked from user code or test runner, this must not throw
+ * any exceptions.
  * @param {string} sourceURL - actual source URL or path
  * @returns {import('internal/source_map/source_map').SourceMap | undefined} a source map or undefined if not found
  */
 function findSourceMap(sourceURL) {
-  if (RegExpPrototypeExec(kLeadingProtocol, sourceURL) === null) {
-    sourceURL = pathToFileURL(sourceURL).href;
-  }
-  if (!SourceMap) {
-    SourceMap = require('internal/source_map/source_map').SourceMap;
-  }
-  const entry = getModuleSourceMapCache().get(sourceURL) ?? generatedSourceMapCache.get(sourceURL);
-  if (entry === undefined) {
+  if (typeof sourceURL !== 'string') {
     return undefined;
   }
-  let sourceMap = entry.sourceMap;
-  if (sourceMap === undefined) {
-    sourceMap = new SourceMap(entry.data, { lineLengths: entry.lineLengths });
-    entry.sourceMap = sourceMap;
+
+  SourceMap ??= require('internal/source_map/source_map').SourceMap;
+  try {
+    if (RegExpPrototypeExec(kLeadingProtocol, sourceURL) === null) {
+      // If the sourceURL is an invalid path, this will throw an error.
+      sourceURL = pathToFileURL(sourceURL).href;
+    }
+    const entry = getModuleSourceMapCache().get(sourceURL) ?? generatedSourceMapCache.get(sourceURL);
+    if (entry?.data == null) {
+      return undefined;
+    }
+
+    let sourceMap = entry.sourceMap;
+    if (sourceMap === undefined) {
+      sourceMap = new SourceMap(entry.data, { lineLengths: entry.lineLengths });
+      entry.sourceMap = sourceMap;
+    }
+    return sourceMap;
+  } catch (err) {
+    debug(err);
+    return undefined;
   }
-  return sourceMap;
 }
 
 module.exports = {
diff --git a/lib/internal/util.js b/lib/internal/util.js
index 0c34a5ea4e5..bcc8bdd58da 100644
--- a/lib/internal/util.js
+++ b/lib/internal/util.js
@@ -104,8 +104,8 @@ function getDeprecationWarningEmitter(
   shouldEmitWarning = () => true,
 ) {
   let warned = false;
-  return function() {
-    if (!warned && shouldEmitWarning()) {
+  return function(arg) {
+    if (!warned && shouldEmitWarning(arg)) {
       warned = true;
       if (code !== undefined) {
         if (!codesWarned.has(code)) {
@@ -994,4 +994,6 @@ module.exports = {
   setOwnProperty,
   pendingDeprecate,
   WeakReference,
+  isPendingDeprecation,
+  getDeprecationWarningEmitter,
 };
diff --git a/lib/internal/util/inspect.js b/lib/internal/util/inspect.js
index 873e9d5f561..ecf5622fcb3 100644
--- a/lib/internal/util/inspect.js
+++ b/lib/internal/util/inspect.js
@@ -2125,27 +2125,32 @@ function hasBuiltInToString(value) {
     value = proxyTarget;
   }
 
-  // Check if value has a custom Symbol.toPrimitive transformation.
-  if (typeof value[SymbolToPrimitive] === 'function') {
-    return false;
-  }
+  let hasOwnToString = ObjectPrototypeHasOwnProperty;
+  let hasOwnToPrimitive = ObjectPrototypeHasOwnProperty;
 
-  // Count objects that have no `toString` function as built-in.
+  // Count objects without `toString` and `Symbol.toPrimitive` function as built-in.
   if (typeof value.toString !== 'function') {
-    return true;
-  }
-
-  // The object has a own `toString` property. Thus it's not not a built-in one.
-  if (ObjectPrototypeHasOwnProperty(value, 'toString')) {
+    if (typeof value[SymbolToPrimitive] !== 'function') {
+      return true;
+    } else if (ObjectPrototypeHasOwnProperty(value, SymbolToPrimitive)) {
+      return false;
+    }
+    hasOwnToString = returnFalse;
+  } else if (ObjectPrototypeHasOwnProperty(value, 'toString')) {
+    return false;
+  } else if (typeof value[SymbolToPrimitive] !== 'function') {
+    hasOwnToPrimitive = returnFalse;
+  } else if (ObjectPrototypeHasOwnProperty(value, SymbolToPrimitive)) {
     return false;
   }
 
-  // Find the object that has the `toString` property as own property in the
-  // prototype chain.
+  // Find the object that has the `toString` property or `Symbol.toPrimitive` property
+  // as own property in the prototype chain.
   let pointer = value;
   do {
     pointer = ObjectGetPrototypeOf(pointer);
-  } while (!ObjectPrototypeHasOwnProperty(pointer, 'toString'));
+  } while (!hasOwnToString(pointer, 'toString') &&
+    !hasOwnToPrimitive(pointer, SymbolToPrimitive));
 
   // Check closer if the object is a built-in.
   const descriptor = ObjectGetOwnPropertyDescriptor(pointer, 'constructor');
@@ -2154,6 +2159,10 @@ function hasBuiltInToString(value) {
     builtInObjects.has(descriptor.value.name);
 }
 
+function returnFalse() {
+  return false;
+}
+
 const firstErrorLine = (error) => StringPrototypeSplit(error.message, '\n', 1)[0];
 let CIRCULAR_ERROR_MESSAGE;
 function tryStringify(arg) {
diff --git a/lib/readline/promises.js b/lib/readline/promises.js
index 286222bfab9..dfac30ea821 100644
--- a/lib/readline/promises.js
+++ b/lib/readline/promises.js
@@ -12,6 +12,7 @@ const {
   Interface: _Interface,
   kQuestion,
   kQuestionCancel,
+  kQuestionReject,
 } = require('internal/readline/interface');
 
 const {
@@ -54,6 +55,8 @@ class Interface extends _Interface {
         };
       }
 
+      this[kQuestionReject] = reject;
+
       this[kQuestion](query, cb);
     });
   }
diff --git a/lib/repl.js b/lib/repl.js
index abd7ca512e6..87f54b28fe0 100644
--- a/lib/repl.js
+++ b/lib/repl.js
@@ -171,6 +171,7 @@ const {
   kStandaloneREPL,
   setupPreview,
   setupReverseSearch,
+  isObjectLiteral,
 } = require('internal/repl/utils');
 const {
   constants: {
@@ -441,13 +442,8 @@ function REPLServer(prompt,
     let awaitPromise = false;
     const input = code;
 
-    // It's confusing for `{ a : 1 }` to be interpreted as a block
-    // statement rather than an object literal.  So, we first try
-    // to wrap it in parentheses, so that it will be interpreted as
-    // an expression.  Note that if the above condition changes,
-    // lib/internal/repl/utils.js needs to be changed to match.
-    if (RegExpPrototypeExec(/^\s*{/, code) !== null &&
-        RegExpPrototypeExec(/;\s*$/, code) === null) {
+    if (isObjectLiteral(code)) {
+      // Add parentheses to make sure `code` is parsed as an expression
       code = `(${StringPrototypeTrim(code)})\n`;
       wrappedCmd = true;
     }
@@ -1213,7 +1209,7 @@ const importRE = /\bimport\s*\(\s*['"`](([\w@./:-]+\/)?(?:[\w@./:-]*))(?![^'"`])
 const requireRE = /\brequire\s*\(\s*['"`](([\w@./:-]+\/)?(?:[\w@./:-]*))(?![^'"`])$/;
 const fsAutoCompleteRE = /fs(?:\.promises)?\.\s*[a-z][a-zA-Z]+\(\s*["'](.*)/;
 const simpleExpressionRE =
-    /(?:[\w$'"`[{(](?:\w|\$|['"`\]})])*\??\.)*[a-zA-Z_$](?:\w|\$)*\??\.?$/;
+    /(?:[\w$'"`[{(](?:(\w| |\t)*?['"`]|\$|['"`\]})])*\??(?:\.|])?)*?(?:[a-zA-Z_$])?(?:\w|\$)*\??\.?$/;
 const versionedFileNamesRe = /-\d+\.\d+/;
 
 function isIdentifier(str) {
@@ -1344,7 +1340,7 @@ function complete(line, callback) {
     filter = completeOn;
     if (this.allowBlockingCompletions) {
       const subdir = match[2] || '';
-      const extensions = ObjectKeys(this.context.require.extensions);
+      const extensions = ObjectKeys(CJSModule._extensions);
       const indexes = ArrayPrototypeMap(extensions,
                                         (extension) => `index${extension}`);
       ArrayPrototypePush(indexes, 'package.json', 'index');
diff --git a/lib/zlib.js b/lib/zlib.js
index 2fc3b88d72c..09986a16d51 100644
--- a/lib/zlib.js
+++ b/lib/zlib.js
@@ -315,7 +315,7 @@ ZlibBase.prototype._final = function(callback) {
 // This is currently only used to figure out which flush flag to use for the
 // last chunk.
 // Roughly, the following holds:
-// Z_NO_FLUSH (< Z_TREES) < Z_BLOCK < Z_PARTIAL_FLUSH <
+// Z_NO_FLUSH < Z_BLOCK < Z_PARTIAL_FLUSH <
 //     Z_SYNC_FLUSH < Z_FULL_FLUSH < Z_FINISH
 const flushiness = [];
 const kFlushFlagList = [Z_NO_FLUSH, Z_BLOCK, Z_PARTIAL_FLUSH,
diff --git a/src/README.md b/src/README.md
index 565ac0df5ce..036bd13f5b3 100644
--- a/src/README.md
+++ b/src/README.md
@@ -589,6 +589,68 @@ void InitializeHttpParser(Local<Object> target,
 }
 ```
 
+### Argument validation in public APIs vs. internal code
+
+#### Public API argument sanitization
+
+When arguments come directly from user code, Node.js will typically validate them at the
+JavaScript layer and throws user-friendly
+[errors](https://github.com/nodejs/node/blob/main/doc/contributing/using-internal-errors.md)
+(e.g., `ERR_INVALID_*`), if they are invalid. This helps end users
+quickly understand and fix mistakes in their own code.
+
+This approach ensures that the error message pinpoints which argument is wrong
+and how it should be fixed. Additionally, problems in user code do not cause
+mysterious crashes or hard-to-diagnose failures deeper in the engine.
+
+Example from `zlib.js`:
+
+```js
+function crc32(data, value = 0) {
+  if (typeof data !== 'string' && !isArrayBufferView(data)) {
+    throw new ERR_INVALID_ARG_TYPE('data', ['Buffer', 'TypedArray', 'DataView','string'], data);
+  }
+  validateUint32(value, 'value');
+  return crc32Native(data, value);
+}
+```
+
+The corresponding C++ assertion code for the above example from it's binding `node_zlib.cc`:
+
+```cpp
+CHECK(args[0]->IsArrayBufferView() || args[0]->IsString());
+CHECK(args[1]->IsUint32());
+```
+
+#### Internal code and C++ binding checks
+
+Inside Node.js’s internal layers, especially the C++ [binding function][]s
+typically assume their arguments have already been checked and sanitized
+by the upper-level (JavaScript) callers. As a result, internal C++ code
+often just uses `CHECK()` or similar assertions to confirm that the
+types/values passed in are correct. If that assertion fails, Node.js will
+crash or abort with an internal diagnostic message. This is to avoid
+re-validating every internal function argument repeatedly which can slow
+down the system.
+
+However, in a less common case where the API is implemented completely in
+C++, the arguments would be validated directly in C++, with the errors
+thrown using `THROW_ERR_INVALID_*` macros from `src/node_errors.h`.
+
+For example in `worker_threads.moveMessagePortToContext`:
+
+```cpp
+void MessagePort::MoveToContext(const FunctionCallbackInfo<Value>& args) {
+  Environment* env = Environment::GetCurrent(args);
+  if (!args[0]->IsObject() ||
+      !env->message_port_constructor_template()->HasInstance(args[0])) {
+    return THROW_ERR_INVALID_ARG_TYPE(env,
+        "The \"port\" argument must be a MessagePort instance");
+  }
+  // ...
+}
+```
+
 <a id="exception-handling"></a>
 
 ### Exception handling
diff --git a/src/acorn_version.h b/src/acorn_version.h
index b4e18696f8b..a8af314b687 100644
--- a/src/acorn_version.h
+++ b/src/acorn_version.h
@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-acorn.sh
 #ifndef SRC_ACORN_VERSION_H_
 #define SRC_ACORN_VERSION_H_
-#define ACORN_VERSION "8.14.0"
+#define ACORN_VERSION "8.15.0"
 #endif  // SRC_ACORN_VERSION_H_
diff --git a/src/api/environment.cc b/src/api/environment.cc
index 7f7eb695c0e..18c8bcd6e92 100644
--- a/src/api/environment.cc
+++ b/src/api/environment.cc
@@ -530,8 +530,11 @@ MaybeLocal<Value> LoadEnvironment(Environment* env,
   return LoadEnvironment(
       env,
       [&](const StartExecutionCallbackInfo& info) -> MaybeLocal<Value> {
-        Local<Value> main_script =
-            ToV8Value(env->context(), main_script_source_utf8).ToLocalChecked();
+        Local<Value> main_script;
+        if (!ToV8Value(env->context(), main_script_source_utf8)
+                 .ToLocal(&main_script)) {
+          return {};
+        }
         return info.run_cjs->Call(
             env->context(), Null(env->isolate()), 1, &main_script);
       },
diff --git a/src/cares_wrap.cc b/src/cares_wrap.cc
index cc19df09f17..2388c60486e 100644
--- a/src/cares_wrap.cc
+++ b/src/cares_wrap.cc
@@ -724,9 +724,9 @@ void ChannelWrap::Setup() {
   }
 
   /* We do the call to ares_init_option for caller. */
-  const int optmask =
-      ARES_OPT_FLAGS | ARES_OPT_TIMEOUTMS |
-      ARES_OPT_SOCK_STATE_CB | ARES_OPT_TRIES;
+  const int optmask = ARES_OPT_FLAGS | ARES_OPT_TIMEOUTMS |
+                      ARES_OPT_SOCK_STATE_CB | ARES_OPT_TRIES |
+                      ARES_OPT_QUERY_CACHE;
   r = ares_init_options(&channel_, &options, optmask);
 
   if (r != ARES_SUCCESS) {
@@ -1319,6 +1319,8 @@ int SoaTraits::Parse(
   if (status != ARES_SUCCESS)
     return status;
 
+  auto cleanup = OnScopeLeave([&]() { ares_free_data(soa_out); });
+
   Local<Object> soa_record = Object::New(env->isolate());
 
   soa_record->Set(env->context(),
@@ -1345,8 +1347,6 @@ int SoaTraits::Parse(
                   Integer::NewFromUnsigned(
                       env->isolate(), soa_out->minttl)).Check();
 
-  ares_free_data(soa_out);
-
   wrap->CallOnComplete(soa_record);
   return ARES_SUCCESS;
 }
diff --git a/src/cjs_module_lexer_version.h b/src/cjs_module_lexer_version.h
index 72a66ba9e90..8d754aadde0 100644
--- a/src/cjs_module_lexer_version.h
+++ b/src/cjs_module_lexer_version.h
@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-cjs-module-lexer.sh
 #ifndef SRC_CJS_MODULE_LEXER_VERSION_H_
 #define SRC_CJS_MODULE_LEXER_VERSION_H_
-#define CJS_MODULE_LEXER_VERSION "1.4.1"
+#define CJS_MODULE_LEXER_VERSION "2.1.0"
 #endif  // SRC_CJS_MODULE_LEXER_VERSION_H_
diff --git a/src/crypto/crypto_hash.cc b/src/crypto/crypto_hash.cc
index da301e43315..aa02ff76326 100644
--- a/src/crypto/crypto_hash.cc
+++ b/src/crypto/crypto_hash.cc
@@ -341,10 +341,22 @@ bool Hash::HashInit(const EVP_MD* md, Maybe<unsigned int> xof_md_len) {
   }
 
   md_len_ = EVP_MD_size(md);
+  bool is_xof = (EVP_MD_flags(md) & EVP_MD_FLAG_XOF) != 0;
+  if (is_xof && !xof_md_len.IsJust() && md_len_ == 0) {
+    const char* name = OBJ_nid2sn(EVP_MD_type(md));
+    if (name != nullptr) {
+      if (strcmp(name, "SHAKE128") == 0) {
+        md_len_ = 16;
+      } else if (strcmp(name, "SHAKE256") == 0) {
+        md_len_ = 32;
+      }
+    }
+  }
+
   if (xof_md_len.IsJust() && xof_md_len.FromJust() != md_len_) {
     // This is a little hack to cause createHash to fail when an incorrect
     // hashSize option was passed for a non-XOF hash function.
-    if ((EVP_MD_flags(md) & EVP_MD_FLAG_XOF) == 0) {
+    if (!is_xof) {
       EVPerr(EVP_F_EVP_DIGESTFINALXOF, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
       return false;
     }
diff --git a/src/debug_utils.cc b/src/debug_utils.cc
index 9d36082db67..df4ad4e9a1e 100644
--- a/src/debug_utils.cc
+++ b/src/debug_utils.cc
@@ -471,7 +471,7 @@ std::vector<std::string> NativeSymbolDebuggingContext::GetLoadedLibraries() {
   DWORD size_2 = 0;
   // First call to get the size of module array needed
   if (EnumProcessModules(process_handle, nullptr, 0, &size_1)) {
-    MallocedBuffer<HMODULE> modules(size_1);
+    MallocedBuffer<HMODULE> modules(size_1 / sizeof(HMODULE));
 
     // Second call to populate the module array
     if (EnumProcessModules(process_handle, modules.data, size_1, &size_2)) {
@@ -480,16 +480,15 @@ std::vector<std::string> NativeSymbolDebuggingContext::GetLoadedLibraries() {
            i++) {
         WCHAR module_name[MAX_PATH];
         // Obtain and report the full pathname for each module
-        if (GetModuleFileNameExW(process_handle,
-                                 modules.data[i],
-                                 module_name,
-                                 arraysize(module_name) / sizeof(WCHAR))) {
+        if (GetModuleFileNameW(
+                modules.data[i], module_name, arraysize(module_name))) {
           DWORD size = WideCharToMultiByte(
               CP_UTF8, 0, module_name, -1, nullptr, 0, nullptr, nullptr);
           char* str = new char[size];
           WideCharToMultiByte(
               CP_UTF8, 0, module_name, -1, str, size, nullptr, nullptr);
           list.emplace_back(str);
+          delete str;
         }
       }
     }
diff --git a/src/debug_utils.h b/src/debug_utils.h
index e8b32d453ac..5437636393d 100644
--- a/src/debug_utils.h
+++ b/src/debug_utils.h
@@ -51,6 +51,7 @@ void NODE_EXTERN_PRIVATE FWrite(FILE* file, const std::string& str);
   V(NGTCP2_DEBUG)                                                              \
   V(SEA)                                                                       \
   V(WASI)                                                                      \
+  V(MODULE)                                                                    \
   V(MKSNAPSHOT)                                                                \
   V(SNAPSHOT_SERDES)                                                           \
   V(PERMISSION_MODEL)                                                          \
diff --git a/src/js_stream.cc b/src/js_stream.cc
index 0d13066f54c..b7e63d6509d 100644
--- a/src/js_stream.cc
+++ b/src/js_stream.cc
@@ -116,10 +116,13 @@ int JSStream::DoWrite(WriteWrap* w,
   HandleScope scope(env()->isolate());
   Context::Scope context_scope(env()->context());
 
+  int value_int = UV_EPROTO;
+
   MaybeStackBuffer<Local<Value>, 16> bufs_arr(count);
   for (size_t i = 0; i < count; i++) {
-    bufs_arr[i] =
-        Buffer::Copy(env(), bufs[i].base, bufs[i].len).ToLocalChecked();
+    if (!Buffer::Copy(env(), bufs[i].base, bufs[i].len).ToLocal(&bufs_arr[i])) {
+      return value_int;
+    }
   }
 
   Local<Value> argv[] = {
@@ -129,7 +132,6 @@ int JSStream::DoWrite(WriteWrap* w,
 
   TryCatchScope try_catch(env());
   Local<Value> value;
-  int value_int = UV_EPROTO;
   if (!MakeCallback(env()->onwrite_string(),
                     arraysize(argv),
                     argv).ToLocal(&value) ||
diff --git a/src/js_udp_wrap.cc b/src/js_udp_wrap.cc
index a4f183025df..51e4f8c45ff 100644
--- a/src/js_udp_wrap.cc
+++ b/src/js_udp_wrap.cc
@@ -99,8 +99,9 @@ ssize_t JSUDPWrap::Send(uv_buf_t* bufs,
 
   MaybeStackBuffer<Local<Value>, 16> buffers(nbufs);
   for (size_t i = 0; i < nbufs; i++) {
-    buffers[i] = Buffer::Copy(env(), bufs[i].base, bufs[i].len)
-        .ToLocalChecked();
+    if (!Buffer::Copy(env(), bufs[i].base, bufs[i].len).ToLocal(&buffers[i])) {
+      return value_int;
+    }
     total_len += bufs[i].len;
   }
 
diff --git a/src/module_wrap.cc b/src/module_wrap.cc
index a061eafe1de..a906376ce80 100644
--- a/src/module_wrap.cc
+++ b/src/module_wrap.cc
@@ -25,6 +25,7 @@ using v8::Array;
 using v8::ArrayBufferView;
 using v8::Context;
 using v8::EscapableHandleScope;
+using v8::Exception;
 using v8::FixedArray;
 using v8::Function;
 using v8::FunctionCallbackInfo;
@@ -33,15 +34,22 @@ using v8::HandleScope;
 using v8::Int32;
 using v8::Integer;
 using v8::Isolate;
+using v8::JustVoid;
 using v8::Local;
+using v8::Maybe;
 using v8::MaybeLocal;
+using v8::Message;
 using v8::MicrotaskQueue;
 using v8::Module;
 using v8::ModuleRequest;
+using v8::Name;
+using v8::Nothing;
+using v8::Null;
 using v8::Object;
 using v8::ObjectTemplate;
 using v8::PrimitiveArray;
 using v8::Promise;
+using v8::PromiseRejectEvent;
 using v8::ScriptCompiler;
 using v8::ScriptOrigin;
 using v8::String;
@@ -588,6 +596,43 @@ void ModuleWrap::InstantiateSync(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(module->IsGraphAsync());
 }
 
+Maybe<void> ThrowIfPromiseRejected(Realm* realm, Local<Promise> promise) {
+  Isolate* isolate = realm->isolate();
+  Local<Context> context = realm->context();
+  if (promise->State() != Promise::PromiseState::kRejected) {
+    return JustVoid();
+  }
+  // The rejected promise is created by V8, so we don't get a chance to mark
+  // it as resolved before the rejection happens from evaluation. But we can
+  // tell the promise rejection callback to treat it as a promise rejected
+  // before handler was added which would remove it from the unhandled
+  // rejection handling, since we are converting it into an error and throw
+  // from here directly.
+  Local<Value> type =
+      Integer::New(isolate,
+                   static_cast<int32_t>(
+                       PromiseRejectEvent::kPromiseHandlerAddedAfterReject));
+  Local<Value> args[] = {type, promise, Undefined(isolate)};
+  if (realm->promise_reject_callback()
+          ->Call(context, Undefined(isolate), arraysize(args), args)
+          .IsEmpty()) {
+    return Nothing<void>();
+  }
+  Local<Value> exception = promise->Result();
+  Local<Message> message = Exception::CreateMessage(isolate, exception);
+  AppendExceptionLine(
+      realm->env(), exception, message, ErrorHandlingMode::MODULE_ERROR);
+  isolate->ThrowException(exception);
+  return Nothing<void>();
+}
+
+void ThrowIfPromiseRejected(const FunctionCallbackInfo<Value>& args) {
+  if (!args[0]->IsPromise()) {
+    return;
+  }
+  ThrowIfPromiseRejected(Realm::GetCurrent(args), args[0].As<Promise>());
+}
+
 void ModuleWrap::EvaluateSync(const FunctionCallbackInfo<Value>& args) {
   Realm* realm = Realm::GetCurrent(args);
   Isolate* isolate = args.GetIsolate();
@@ -612,29 +657,7 @@ void ModuleWrap::EvaluateSync(const FunctionCallbackInfo<Value>& args) {
 
   CHECK(result->IsPromise());
   Local<Promise> promise = result.As<Promise>();
-  if (promise->State() == Promise::PromiseState::kRejected) {
-    // The rejected promise is created by V8, so we don't get a chance to mark
-    // it as resolved before the rejection happens from evaluation. But we can
-    // tell the promise rejection callback to treat it as a promise rejected
-    // before handler was added which would remove it from the unhandled
-    // rejection handling, since we are converting it into an error and throw
-    // from here directly.
-    Local<Value> type = v8::Integer::New(
-        isolate,
-        static_cast<int32_t>(
-            v8::PromiseRejectEvent::kPromiseHandlerAddedAfterReject));
-    Local<Value> args[] = {type, promise, Undefined(isolate)};
-    if (env->promise_reject_callback()
-            ->Call(context, Undefined(isolate), arraysize(args), args)
-            .IsEmpty()) {
-      return;
-    }
-    Local<Value> exception = promise->Result();
-    Local<v8::Message> message =
-        v8::Exception::CreateMessage(isolate, exception);
-    AppendExceptionLine(
-        env, exception, message, ErrorHandlingMode::MODULE_ERROR);
-    isolate->ThrowException(exception);
+  if (ThrowIfPromiseRejected(realm, promise).IsNothing()) {
     return;
   }
 
@@ -652,7 +675,7 @@ void ModuleWrap::EvaluateSync(const FunctionCallbackInfo<Value>& args) {
         FPrintF(stderr, "%s\n", reason);
       }
     }
-    THROW_ERR_REQUIRE_ASYNC_MODULE(env);
+    THROW_ERR_REQUIRE_ASYNC_MODULE(env, args[0], args[1]);
     return;
   }
 
@@ -674,15 +697,14 @@ void ModuleWrap::GetNamespaceSync(const FunctionCallbackInfo<Value>& args) {
       return realm->env()->ThrowError(
           "Cannot get namespace, module has not been instantiated");
     case v8::Module::Status::kInstantiated:
+    case v8::Module::Status::kEvaluating:
     case v8::Module::Status::kEvaluated:
     case v8::Module::Status::kErrored:
       break;
-    case v8::Module::Status::kEvaluating:
-      UNREACHABLE();
   }
 
   if (module->IsGraphAsync()) {
-    return THROW_ERR_REQUIRE_ASYNC_MODULE(realm->env());
+    return THROW_ERR_REQUIRE_ASYNC_MODULE(realm->env(), args[0], args[1]);
   }
   Local<Value> result = module->GetModuleNamespace();
   args.GetReturnValue().Set(result);
@@ -724,6 +746,16 @@ void ModuleWrap::GetStatus(const FunctionCallbackInfo<Value>& args) {
   args.GetReturnValue().Set(module->GetStatus());
 }
 
+void ModuleWrap::IsGraphAsync(const FunctionCallbackInfo<Value>& args) {
+  Isolate* isolate = args.GetIsolate();
+  ModuleWrap* obj;
+  ASSIGN_OR_RETURN_UNWRAP(&obj, args.This());
+
+  Local<Module> module = obj->module_.Get(isolate);
+
+  args.GetReturnValue().Set(module->IsGraphAsync());
+}
+
 void ModuleWrap::GetError(const FunctionCallbackInfo<Value>& args) {
   Isolate* isolate = args.GetIsolate();
   ModuleWrap* obj;
@@ -821,16 +853,23 @@ static MaybeLocal<Promise> ImportModuleDynamically(
   };
 
   Local<Value> result;
-  if (import_callback->Call(
-        context,
-        Undefined(isolate),
-        arraysize(import_args),
-        import_args).ToLocal(&result)) {
-    CHECK(result->IsPromise());
-    return handle_scope.Escape(result.As<Promise>());
+  if (!import_callback
+           ->Call(
+               context, Undefined(isolate), arraysize(import_args), import_args)
+           .ToLocal(&result)) {
+    return {};
   }
 
-  return MaybeLocal<Promise>();
+  // Wrap the returned value in a promise created in the referrer context to
+  // avoid dynamic scopes.
+  Local<Promise::Resolver> resolver;
+  if (!Promise::Resolver::New(context).ToLocal(&resolver)) {
+    return {};
+  }
+  if (resolver->Resolve(context, result).IsNothing()) {
+    return {};
+  }
+  return handle_scope.Escape(resolver->GetPromise());
 }
 
 void ModuleWrap::SetImportModuleDynamicallyCallback(
@@ -1064,6 +1103,7 @@ void ModuleWrap::CreatePerIsolateProperties(IsolateData* isolate_data,
       isolate, tpl, "createCachedData", CreateCachedData);
   SetProtoMethodNoSideEffect(isolate, tpl, "getNamespace", GetNamespace);
   SetProtoMethodNoSideEffect(isolate, tpl, "getStatus", GetStatus);
+  SetProtoMethodNoSideEffect(isolate, tpl, "isGraphAsync", IsGraphAsync);
   SetProtoMethodNoSideEffect(isolate, tpl, "getError", GetError);
   SetConstructorFunction(isolate, target, "ModuleWrap", tpl);
   isolate_data->set_module_wrap_constructor_template(tpl);
@@ -1080,6 +1120,7 @@ void ModuleWrap::CreatePerIsolateProperties(IsolateData* isolate_data,
             target,
             "createRequiredModuleFacade",
             CreateRequiredModuleFacade);
+  SetMethod(isolate, target, "throwIfPromiseRejected", ThrowIfPromiseRejected);
 }
 
 void ModuleWrap::CreatePerContextProperties(Local<Object> target,
@@ -1119,11 +1160,13 @@ void ModuleWrap::RegisterExternalReferences(
   registry->Register(GetNamespace);
   registry->Register(GetStatus);
   registry->Register(GetError);
+  registry->Register(IsGraphAsync);
 
   registry->Register(CreateRequiredModuleFacade);
 
   registry->Register(SetImportModuleDynamicallyCallback);
   registry->Register(SetInitializeImportMetaObjectCallback);
+  registry->Register(ThrowIfPromiseRejected);
 }
 }  // namespace loader
 }  // namespace node
diff --git a/src/module_wrap.h b/src/module_wrap.h
index 51b127209af..860495d8db6 100644
--- a/src/module_wrap.h
+++ b/src/module_wrap.h
@@ -110,6 +110,7 @@ class ModuleWrap : public BaseObject {
   static void Instantiate(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void Evaluate(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetNamespace(const v8::FunctionCallbackInfo<v8::Value>& args);
+  static void IsGraphAsync(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetStatus(const v8::FunctionCallbackInfo<v8::Value>& args);
   static void GetError(const v8::FunctionCallbackInfo<v8::Value>& args);
 
diff --git a/src/node.cc b/src/node.cc
index 97d2b972999..c98acbcf28c 100644
--- a/src/node.cc
+++ b/src/node.cc
@@ -1180,10 +1180,7 @@ InitializeOncePerProcessInternal(const std::vector<std::string>& args,
     }
 #endif
     if (!crypto::ProcessFipsOptions()) {
-      // XXX: ERR_GET_REASON does not return something that is
-      // useful as an exit code at all.
-      result->exit_code_ =
-          static_cast<ExitCode>(ERR_GET_REASON(ERR_peek_error()));
+      result->exit_code_ = ExitCode::kGenericUserError;
       result->early_return_ = true;
       result->errors_.emplace_back(
           "OpenSSL error when trying to enable FIPS:\n" +
diff --git a/src/node_api.cc b/src/node_api.cc
index d8a203ba420..326e51330f9 100644
--- a/src/node_api.cc
+++ b/src/node_api.cc
@@ -693,9 +693,9 @@ void napi_module_register_by_symbol(v8::Local<v8::Object> exports,
                                     napi_addon_register_func init,
                                     int32_t module_api_version) {
   node::Environment* node_env = node::Environment::GetCurrent(context);
+  CHECK_NOT_NULL(node_env);
   std::string module_filename = "";
   if (init == nullptr) {
-    CHECK_NOT_NULL(node_env);
     node_env->ThrowError("Module has no declared entry point.");
     return;
   }
@@ -1046,8 +1046,7 @@ napi_create_external_buffer(napi_env env,
 
 #if defined(V8_ENABLE_SANDBOX)
   return napi_set_last_error(env, napi_no_external_buffers_allowed);
-#endif
-
+#else
   v8::Isolate* isolate = env->isolate;
 
   // The finalizer object will delete itself after invoking the callback.
@@ -1069,6 +1068,7 @@ napi_create_external_buffer(napi_env env,
   // as it will be deleted when the buffer to which it is associated
   // is finalized.
   // coverity[leaked_storage]
+#endif  // V8_ENABLE_SANDBOX
 }
 
 napi_status NAPI_CDECL napi_create_buffer_copy(napi_env env,
diff --git a/src/node_contextify.cc b/src/node_contextify.cc
index 3b26372f24b..60ed678217e 100644
--- a/src/node_contextify.cc
+++ b/src/node_contextify.cc
@@ -1185,7 +1185,12 @@ bool ContextifyScript::EvalMachine(Local<Context> context,
     return false;
   }
 
-  args.GetReturnValue().Set(result.ToLocalChecked());
+  // We checked for res being empty previously so this is a bit redundant
+  // but still safer than using ToLocalChecked.
+  Local<Value> res;
+  if (!result.ToLocal(&res)) return false;
+
+  args.GetReturnValue().Set(res);
   return true;
 }
 
diff --git a/src/node_dotenv.cc b/src/node_dotenv.cc
index d22783cb779..9d2bc526572 100644
--- a/src/node_dotenv.cc
+++ b/src/node_dotenv.cc
@@ -155,7 +155,16 @@ void Dotenv::ParseContent(const std::string_view input) {
     // If there is no equal character, then ignore everything
     auto equal = content.find('=');
     if (equal == std::string_view::npos) {
-      break;
+      auto newline = content.find('\n');
+      if (newline != std::string_view::npos) {
+        // If we used `newline` only,
+        // the '\n' might remain and cause an empty-line parse
+        content.remove_prefix(newline + 1);
+      } else {
+        content = {};
+      }
+      // No valid data here, skip to next line
+      continue;
     }
 
     key = content.substr(0, equal);
@@ -199,7 +208,9 @@ void Dotenv::ParseContent(const std::string_view input) {
         store_.insert_or_assign(std::string(key), multi_line_value);
         auto newline = content.find('\n', closing_quote + 1);
         if (newline != std::string_view::npos) {
-          content.remove_prefix(newline);
+          content.remove_prefix(newline + 1);
+        } else {
+          content = {};
         }
         continue;
       }
@@ -220,7 +231,7 @@ void Dotenv::ParseContent(const std::string_view input) {
         if (newline != std::string_view::npos) {
           value = content.substr(0, newline);
           store_.insert_or_assign(std::string(key), value);
-          content.remove_prefix(newline);
+          content.remove_prefix(newline + 1);
         }
       } else {
         // Example: KEY="value"
@@ -230,8 +241,13 @@ void Dotenv::ParseContent(const std::string_view input) {
         // since there could be newline characters inside the value.
         auto newline = content.find('\n', closing_quote + 1);
         if (newline != std::string_view::npos) {
-          content.remove_prefix(newline);
+          // Use +1 to discard the '\n' itself => next line
+          content.remove_prefix(newline + 1);
+        } else {
+          content = {};
         }
+        // No valid data here, skip to next line
+        continue;
       }
     } else {
       // Regular key value pair.
@@ -247,15 +263,21 @@ void Dotenv::ParseContent(const std::string_view input) {
         if (hash_character != std::string_view::npos) {
           value = content.substr(0, hash_character);
         }
-        content.remove_prefix(newline);
+        store_.insert_or_assign(std::string(key), trim_spaces(value));
+        content.remove_prefix(newline + 1);
       } else {
         // In case the last line is a single key/value pair
         // Example: KEY=VALUE (without a newline at the EOF)
-        value = content.substr(0);
+        value = content;
+        auto hash_char = value.find('#');
+        if (hash_char != std::string_view::npos) {
+          value = content.substr(0, hash_char);
+        }
+        store_.insert_or_assign(std::string(key), trim_spaces(value));
+        content = {};
       }
 
-      value = trim_spaces(value);
-      store_.insert_or_assign(std::string(key), value);
+      store_.insert_or_assign(std::string(key), trim_spaces(value));
     }
   }
 }
diff --git a/src/node_errors.h b/src/node_errors.h
index d5e2f86f516..7cacf416b6e 100644
--- a/src/node_errors.h
+++ b/src/node_errors.h
@@ -105,11 +105,21 @@ void OOMErrorHandler(const char* location, const v8::OOMDetails& details);
   V(ERR_WORKER_INIT_FAILED, Error)                                             \
   V(ERR_PROTO_ACCESS, Error)
 
+// If the macros are used as ERR_*(isolate, message) or
+// THROW_ERR_*(isolate, message) with a single string argument, do run
+// formatter on the message, and allow the caller to pass in a message
+// directly with characters that would otherwise need escaping if used
+// as format string unconditionally.
 #define V(code, type)                                                          \
   template <typename... Args>                                                  \
   inline v8::Local<v8::Object> code(                                           \
       v8::Isolate* isolate, const char* format, Args&&... args) {              \
-    std::string message = SPrintF(format, std::forward<Args>(args)...);        \
+    std::string message;                                                       \
+    if (sizeof...(Args) == 0) {                                                \
+      message = format;                                                        \
+    } else {                                                                   \
+      message = SPrintF(format, std::forward<Args>(args)...);                  \
+    }                                                                          \
     v8::Local<v8::String> js_code = OneByteString(isolate, #code);             \
     v8::Local<v8::String> js_msg =                                             \
         v8::String::NewFromUtf8(isolate,                                       \
@@ -198,10 +208,6 @@ ERRORS_WITH_CODE(V)
     "creating Workers")                                                        \
   V(ERR_NON_CONTEXT_AWARE_DISABLED,                                            \
     "Loading non context-aware native addons has been disabled")               \
-  V(ERR_REQUIRE_ASYNC_MODULE,                                                  \
-    "require() cannot be used on an ESM graph with top-level await. Use "      \
-    "import() instead. To see where the top-level await comes from, use "      \
-    "--experimental-print-required-tla.")                                      \
   V(ERR_SCRIPT_EXECUTION_INTERRUPTED,                                          \
     "Script execution was interrupted by `SIGINT`")                            \
   V(ERR_TLS_PSK_SET_IDENTIY_HINT_FAILED, "Failed to set PSK identity hint")    \
@@ -231,6 +237,28 @@ inline void THROW_ERR_SCRIPT_EXECUTION_TIMEOUT(Environment* env,
   THROW_ERR_SCRIPT_EXECUTION_TIMEOUT(env, message.str().c_str());
 }
 
+inline void THROW_ERR_REQUIRE_ASYNC_MODULE(
+    Environment* env,
+    v8::Local<v8::Value> filename,
+    v8::Local<v8::Value> parent_filename) {
+  static constexpr const char* prefix =
+      "require() cannot be used on an ESM graph with top-level await. Use "
+      "import() instead. To see where the top-level await comes from, use "
+      "--experimental-print-required-tla.";
+  std::string message = prefix;
+  if (!parent_filename.IsEmpty() && parent_filename->IsString()) {
+    Utf8Value utf8(env->isolate(), parent_filename);
+    message += "\n  From ";
+    message += utf8.out();
+  }
+  if (!filename.IsEmpty() && filename->IsString()) {
+    Utf8Value utf8(env->isolate(), filename);
+    message += "\n  Requiring ";
+    message += +utf8.out();
+  }
+  THROW_ERR_REQUIRE_ASYNC_MODULE(env, message.c_str());
+}
+
 inline v8::Local<v8::Object> ERR_BUFFER_TOO_LARGE(v8::Isolate* isolate) {
   char message[128];
   snprintf(message, sizeof(message),
diff --git a/src/node_file.cc b/src/node_file.cc
index ece5ea0795a..1f7f3427159 100644
--- a/src/node_file.cc
+++ b/src/node_file.cc
@@ -1049,6 +1049,8 @@ static void ExistsSync(const FunctionCallbackInfo<Value>& args) {
 }
 
 // Used to speed up module loading. Returns an array [string, boolean]
+// Do not expose this function through public API as it doesn't hold
+// Permission Model checks.
 static void InternalModuleReadJSON(const FunctionCallbackInfo<Value>& args) {
   Environment* env = Environment::GetCurrent(args);
   Isolate* isolate = env->isolate();
@@ -1056,8 +1058,6 @@ static void InternalModuleReadJSON(const FunctionCallbackInfo<Value>& args) {
 
   CHECK(args[0]->IsString());
   node::Utf8Value path(isolate, args[0]);
-  THROW_IF_INSUFFICIENT_PERMISSIONS(
-      env, permission::PermissionScope::kFileSystemRead, path.ToStringView());
 
   if (strlen(*path) != path.length()) {
     args.GetReturnValue().Set(Array::New(isolate));
@@ -1153,8 +1153,6 @@ static void InternalModuleStat(const FunctionCallbackInfo<Value>& args) {
 
   CHECK(args[0]->IsString());
   node::Utf8Value path(env->isolate(), args[0]);
-  THROW_IF_INSUFFICIENT_PERMISSIONS(
-      env, permission::PermissionScope::kFileSystemRead, path.ToStringView());
 
   uv_fs_t req;
   int rc = uv_fs_stat(env->event_loop(), &req, *path, nullptr);
diff --git a/src/node_http2.cc b/src/node_http2.cc
index c190252e5a5..d0c30fdfc06 100644
--- a/src/node_http2.cc
+++ b/src/node_http2.cc
@@ -1214,7 +1214,7 @@ int Http2Session::OnFrameNotSent(nghttp2_session* handle,
     // closed but the Http2Session will still be up causing a memory leak.
     // Therefore, if the GOAWAY frame couldn't be send due to
     // ERR_SESSION_CLOSING we should force close from our side.
-    if (frame->hd.type != 0x03) {
+    if (frame->hd.type != NGHTTP2_GOAWAY) {
       return 0;
     }
   }
diff --git a/src/node_http_common.h b/src/node_http_common.h
index b58e8cb5607..e2e13e9972f 100644
--- a/src/node_http_common.h
+++ b/src/node_http_common.h
@@ -414,8 +414,11 @@ class NgRcBufPointer : public MemoryRetainer {
         const char* header_name = reinterpret_cast<const char*>(ptr.data());
         v8::Eternal<v8::String>& eternal = static_str_map[header_name];
         if (eternal.IsEmpty()) {
-          v8::Local<v8::String> str =
-              GetInternalizedString(env, ptr).ToLocalChecked();
+          v8::Local<v8::String> str;
+          if (!GetInternalizedString(env, ptr).ToLocal(&str)) {
+            ptr.reset();
+            return {};
+          }
           eternal.Set(env->isolate(), str);
           return str;
         }
diff --git a/src/node_http_parser.cc b/src/node_http_parser.cc
index 663f7da5b90..8ded2021920 100644
--- a/src/node_http_parser.cc
+++ b/src/node_http_parser.cc
@@ -1200,6 +1200,10 @@ void ConnectionsList::Expired(const FunctionCallbackInfo<Value>& args) {
 
 const llhttp_settings_t Parser::settings = {
     Proxy<Call, &Parser::on_message_begin>::Raw,
+
+    // on_protocol
+    nullptr,
+
     Proxy<DataCall, &Parser::on_url>::Raw,
     Proxy<DataCall, &Parser::on_status>::Raw,
 
@@ -1220,6 +1224,8 @@ const llhttp_settings_t Parser::settings = {
     Proxy<DataCall, &Parser::on_body>::Raw,
     Proxy<Call, &Parser::on_message_complete>::Raw,
 
+    // on_protocol_complete
+    nullptr,
     // on_url_complete
     nullptr,
     // on_status_complete
diff --git a/src/node_i18n.cc b/src/node_i18n.cc
index 1ddae30e972..44040057999 100644
--- a/src/node_i18n.cc
+++ b/src/node_i18n.cc
@@ -172,7 +172,7 @@ MaybeLocal<Object> TranscodeLatin1ToUcs2(Environment* env,
                                          const char* source,
                                          const size_t source_length,
                                          UErrorCode* status) {
-  MaybeStackBuffer<UChar> destbuf(source_length);
+  MaybeStackBuffer<char16_t> destbuf(source_length);
   auto actual_length =
       simdutf::convert_latin1_to_utf16le(source, source_length, destbuf.out());
   if (actual_length == 0) {
@@ -216,7 +216,7 @@ MaybeLocal<Object> TranscodeUcs2FromUtf8(Environment* env,
                                          UErrorCode* status) {
   size_t expected_utf16_length =
       simdutf::utf16_length_from_utf8(source, source_length);
-  MaybeStackBuffer<UChar> destbuf(expected_utf16_length);
+  MaybeStackBuffer<char16_t> destbuf(expected_utf16_length);
   auto actual_length =
       simdutf::convert_utf8_to_utf16le(source, source_length, destbuf.out());
 
diff --git a/src/node_os.cc b/src/node_os.cc
index ce2af8d83b7..ddaf61d5eb6 100644
--- a/src/node_os.cc
+++ b/src/node_os.cc
@@ -192,6 +192,9 @@ static void GetInterfaceAddresses(const FunctionCallbackInfo<Value>& args) {
     return args.GetReturnValue().SetUndefined();
   }
 
+  auto cleanup =
+      OnScopeLeave([&]() { uv_free_interface_addresses(interfaces, count); });
+
   Local<Value> no_scope_id = Integer::New(isolate, -1);
   std::vector<Local<Value>> result;
   result.reserve(count * 7);
@@ -243,7 +246,6 @@ static void GetInterfaceAddresses(const FunctionCallbackInfo<Value>& args) {
     }
   }
 
-  uv_free_interface_addresses(interfaces, count);
   args.GetReturnValue().Set(Array::New(isolate, result.data(), result.size()));
 }
 
diff --git a/src/node_version.h b/src/node_version.h
index b51c1658c71..56bddf624fa 100644
--- a/src/node_version.h
+++ b/src/node_version.h
@@ -24,7 +24,7 @@
 
 #define NODE_MAJOR_VERSION 20
 #define NODE_MINOR_VERSION 19
-#define NODE_PATCH_VERSION 4
+#define NODE_PATCH_VERSION 5
 
 #define NODE_VERSION_IS_LTS 1
 #define NODE_VERSION_LTS_CODENAME "Iron"
@@ -36,7 +36,7 @@
 #define NSOLID_MINOR_VERSION 0
 #define NSOLID_PATCH_VERSION 2
 
-#define NSOLID_VERSION_IS_RELEASE 0
+#define NSOLID_VERSION_IS_RELEASE 1
 
 #ifndef NODE_STRINGIFY
 #define NODE_STRINGIFY(n) NODE_STRINGIFY_HELPER(n)
diff --git a/src/node_zlib.cc b/src/node_zlib.cc
index 66370e41659..a537e766722 100644
--- a/src/node_zlib.cc
+++ b/src/node_zlib.cc
@@ -493,20 +493,22 @@ class CompressionStream : public AsyncWrap, public ThreadPoolWork {
   }
 
   static void* AllocForBrotli(void* data, size_t size) {
-    size += sizeof(size_t);
+    constexpr size_t offset = std::max(sizeof(size_t), alignof(max_align_t));
+    size += offset;
     CompressionStream* ctx = static_cast<CompressionStream*>(data);
     char* memory = UncheckedMalloc(size);
     if (UNLIKELY(memory == nullptr)) return nullptr;
     *reinterpret_cast<size_t*>(memory) = size;
     ctx->unreported_allocations_.fetch_add(size,
                                            std::memory_order_relaxed);
-    return memory + sizeof(size_t);
+    return memory + offset;
   }
 
   static void FreeForZlib(void* data, void* pointer) {
     if (UNLIKELY(pointer == nullptr)) return;
     CompressionStream* ctx = static_cast<CompressionStream*>(data);
-    char* real_pointer = static_cast<char*>(pointer) - sizeof(size_t);
+    constexpr size_t offset = std::max(sizeof(size_t), alignof(max_align_t));
+    char* real_pointer = static_cast<char*>(pointer) - offset;
     size_t real_size = *reinterpret_cast<size_t*>(real_pointer);
     ctx->unreported_allocations_.fetch_sub(real_size,
                                            std::memory_order_relaxed);
diff --git a/src/nsolid/nsolid_api.cc b/src/nsolid/nsolid_api.cc
index fcc856e18de..728f726aa46 100644
--- a/src/nsolid/nsolid_api.cc
+++ b/src/nsolid/nsolid_api.cc
@@ -606,6 +606,10 @@ void EnvInst::uv_metrics_cb_(nsuv::ns_prepare* handle, EnvInst* envinst) {
   // Use the previous values to calculate the values for this loop iteration.
   loop_duration = metrics_cb_time - envinst->prev_metrics_cb_time_;
   loop_idle_time = idle_time - envinst->prev_loop_idle_time_;
+  // Clamp loop_idle_time to avoid unsigned underflow in loop_proc_time when
+  // clock skew causes idle_time to be slightly larger than loop_duration.
+  if (loop_idle_time > loop_duration)
+    loop_idle_time = loop_duration;
   loop_proc_time = loop_duration - loop_idle_time;
   events_procd = metrics->events - envinst->prev_events_processed_;
   events_waiting = metrics->events_waiting - envinst->prev_events_waiting_;
@@ -2157,6 +2161,12 @@ void EnvInst::get_event_loop_stats_(EnvInst* envinst,
   uint64_t loop_idle_time = uv_metrics_idle_time(envinst->event_loop());
   uint64_t loop_diff = stor->current_hrtime_ - stor->prev_call_time_;
   uint64_t idle_diff = loop_idle_time - stor->prev_idle_time_;
+  // On some platforms the clocks backing loop_diff and idle_diff can differ by
+  // a few hundred nanoseconds when the loop is nearly 100% idle, making
+  // idle_diff slightly larger than loop_diff. Clamp to avoid unsigned
+  // underflow in proc_diff and bogus utilization values.
+  if (idle_diff > loop_diff)
+    idle_diff = loop_diff;
   uint64_t proc_diff = loop_diff - idle_diff;
   uint64_t count_diff = metrics->loop_count - stor->loop_iterations;
   auto entry_exit = envinst->provider_times();
diff --git a/src/pipe_wrap.cc b/src/pipe_wrap.cc
index f3e783233ba..bdb59a35e96 100644
--- a/src/pipe_wrap.cc
+++ b/src/pipe_wrap.cc
@@ -53,10 +53,12 @@ MaybeLocal<Object> PipeWrap::Instantiate(Environment* env,
   EscapableHandleScope handle_scope(env->isolate());
   AsyncHooks::DefaultTriggerAsyncIdScope trigger_scope(parent);
   CHECK_EQ(false, env->pipe_constructor_template().IsEmpty());
-  Local<Function> constructor = env->pipe_constructor_template()
-                                    ->GetFunction(env->context())
-                                    .ToLocalChecked();
-  CHECK_EQ(false, constructor.IsEmpty());
+  Local<Function> constructor;
+  if (!env->pipe_constructor_template()
+           ->GetFunction(env->context())
+           .ToLocal(&constructor)) {
+    return {};
+  }
   Local<Value> type_value = Int32::New(env->isolate(), type);
   return handle_scope.EscapeMaybe(
       constructor->NewInstance(env->context(), 1, &type_value));
diff --git a/src/quic/sessionticket.h b/src/quic/sessionticket.h
index 4700af57439..106447f00f6 100644
--- a/src/quic/sessionticket.h
+++ b/src/quic/sessionticket.h
@@ -58,7 +58,7 @@ class SessionTicket final : public MemoryRetainer {
 };
 
 // SessionTicket::AppData is a utility class that is used only during the
-// generation or access of TLS stateless sesson tickets. It exists solely to
+// generation or access of TLS stateless session tickets. It exists solely to
 // provide a easier way for Session::Application instances to set relevant
 // metadata in the session ticket when it is created, and the exract and
 // subsequently verify that data when a ticket is received and is being
diff --git a/src/tcp_wrap.cc b/src/tcp_wrap.cc
index 6c70f270baf..84191ff46ee 100644
--- a/src/tcp_wrap.cc
+++ b/src/tcp_wrap.cc
@@ -59,10 +59,12 @@ MaybeLocal<Object> TCPWrap::Instantiate(Environment* env,
   EscapableHandleScope handle_scope(env->isolate());
   AsyncHooks::DefaultTriggerAsyncIdScope trigger_scope(parent);
   CHECK_EQ(env->tcp_constructor_template().IsEmpty(), false);
-  Local<Function> constructor = env->tcp_constructor_template()
-                                    ->GetFunction(env->context())
-                                    .ToLocalChecked();
-  CHECK_EQ(constructor.IsEmpty(), false);
+  Local<Function> constructor;
+  if (!env->tcp_constructor_template()
+           ->GetFunction(env->context())
+           .ToLocal(&constructor)) {
+    return {};
+  }
   Local<Value> type_value = Int32::New(env->isolate(), type);
   return handle_scope.EscapeMaybe(
       constructor->NewInstance(env->context(), 1, &type_value));
diff --git a/src/util.cc b/src/util.cc
index b24b588aff3..5450b0931a7 100644
--- a/src/util.cc
+++ b/src/util.cc
@@ -791,8 +791,11 @@ v8::Maybe<int32_t> GetValidatedFd(Environment* env,
   const bool is_out_of_range = fd < 0 || fd > INT32_MAX;
 
   if (is_out_of_range || !IsSafeJsInt(input)) {
-    Utf8Value utf8_value(
-        env->isolate(), input->ToDetailString(env->context()).ToLocalChecked());
+    Local<String> str;
+    if (!input->ToDetailString(env->context()).ToLocal(&str)) {
+      return v8::Nothing<int32_t>();
+    }
+    Utf8Value utf8_value(env->isolate(), str);
     if (is_out_of_range && !std::isinf(fd)) {
       THROW_ERR_OUT_OF_RANGE(env,
                              "The value of \"fd\" is out of range. "
diff --git a/src/zlib_version.h b/src/zlib_version.h
index 3b53884aae2..67856b28ad6 100644
--- a/src/zlib_version.h
+++ b/src/zlib_version.h
@@ -2,5 +2,5 @@
 // Refer to tools/dep_updaters/update-zlib.sh
 #ifndef SRC_ZLIB_VERSION_H_
 #define SRC_ZLIB_VERSION_H_
-#define ZLIB_VERSION "1.3.0.1-motley-82a5fec"
+#define ZLIB_VERSION "1.3.1-470d3a2"
 #endif  // SRC_ZLIB_VERSION_H_
diff --git a/test/agents/test-grpc-blocked-loop.mjs b/test/agents/test-grpc-blocked-loop.mjs
index 90e72999a68..977e877bd34 100644
--- a/test/agents/test-grpc-blocked-loop.mjs
+++ b/test/agents/test-grpc-blocked-loop.mjs
@@ -69,7 +69,7 @@ const {
 // },
 function checkBlockedLoopData(blocked, metadata, agentId, threadId) {
   console.dir(blocked, { depth: null });
-  assert.strictEqual(blocked.common.requestId, '');
+  validateString(blocked.common.requestId, 'common.requestId');
   assert.strictEqual(blocked.common.command, 'loop_blocked');
   // From here check at least that all the fields are present
   validateObject(blocked.common.recorded, 'recorded');
@@ -119,7 +119,7 @@ function checkBlockedLoopData(blocked, metadata, agentId, threadId) {
 // }
 function checkUnblockedLoopData(blocked, metadata, agentId, threadId, bInfo) {
   console.dir(blocked, { depth: null });
-  assert.strictEqual(blocked.common.requestId, '');
+  validateString(blocked.common.requestId, 'common.requestId');
   assert.strictEqual(blocked.common.command, 'loop_unblocked');
   // From here check at least that all the fields are present
   validateObject(blocked.common.recorded, 'recorded');
diff --git a/test/cctest/node_test_fixture.cc b/test/cctest/node_test_fixture.cc
index d2662604d14..66c3591049f 100644
--- a/test/cctest/node_test_fixture.cc
+++ b/test/cctest/node_test_fixture.cc
@@ -20,9 +20,6 @@ void NodeTestEnvironment::SetUp() {
   NodeZeroIsolateTestFixture::platform.reset(
       new node::NodePlatform(kV8ThreadPoolSize, tracing_controller));
   v8::V8::InitializePlatform(NodeZeroIsolateTestFixture::platform.get());
-#ifdef V8_ENABLE_SANDBOX
-  ASSERT_TRUE(v8::V8::InitializeSandbox());
-#endif
   cppgc::InitializeProcess(
       NodeZeroIsolateTestFixture::platform->GetPageAllocator());
 
diff --git a/test/common/README.md b/test/common/README.md
index eef654963d5..8dbe4f0cd79 100644
--- a/test/common/README.md
+++ b/test/common/README.md
@@ -1,6 +1,29 @@
 # Node.js Core Test Common Modules
 
 This directory contains modules used to test the Node.js implementation.
+All tests must begin by requiring the `common` module:
+
+```js
+require('../common');
+```
+
+This is not just a convenience for exporting helper functions etc; it also performs
+several other tasks:
+
+* Verifies that no unintended globals have been leaked to ensure that tests
+  don't accidentally pollute the global namespace.
+
+* Some tests assume a default umask of `0o022`. To enforce this assumption,
+  the common module sets the unmask at startup. Tests that require a
+  different umask can override this setting after loading the module.
+
+* Some tests specify runtime flags (example, `--expose-internals`) via a
+  comment at the top of the file: `// Flags: --expose-internals`.
+  If the test is run without those flags, the common module automatically
+  spawns a child process with proper flags. This ensures that the tests
+  always run under the expected conditions. Because of this behaviour, the
+  common module must be loaded first so that any code below it is not
+  executed until the process has been re-spawned with the correct flags.
 
 ## Table of contents
 
diff --git a/test/common/index.js b/test/common/index.js
index 171fb854326..7150e7f843d 100644
--- a/test/common/index.js
+++ b/test/common/index.js
@@ -947,6 +947,17 @@ function expectRequiredModule(mod, expectation, checkESModule = true) {
   assert.deepStrictEqual(clone, { ...expectation });
 }
 
+function expectRequiredTLAError(err) {
+  const message = /require\(\) cannot be used on an ESM graph with top-level await/;
+  if (typeof err === 'string') {
+    assert.match(err, /ERR_REQUIRE_ASYNC_MODULE/);
+    assert.match(err, message);
+  } else {
+    assert.strictEqual(err.code, 'ERR_REQUIRE_ASYNC_MODULE');
+    assert.match(err.message, message);
+  }
+}
+
 const common = {
   allowGlobals,
   buildType,
@@ -956,6 +967,7 @@ const common = {
   defaultAutoSelectFamilyAttemptTimeout,
   expectsError,
   expectRequiredModule,
+  expectRequiredTLAError,
   expectWarning,
   getArrayBufferViews,
   getBufferSources,
diff --git a/test/common/nsolid-grpc-agent/index.js b/test/common/nsolid-grpc-agent/index.js
index a86bbb9089b..2bac8acf3a9 100644
--- a/test/common/nsolid-grpc-agent/index.js
+++ b/test/common/nsolid-grpc-agent/index.js
@@ -16,7 +16,7 @@ const {
 
 function checkExitData(data, metadata, agentId, expectedData) {
   console.dir(data, { depth: null });
-  assert.strictEqual(data.common.requestId, '');
+  validateString(data.common.requestId, 'common.requestId');
   assert.strictEqual(data.common.command, 'exit');
   // From here check at least that all the fields are present
   validateObject(data.common.recorded, 'recorded');
diff --git a/test/es-module/es-module.status b/test/es-module/es-module.status
index 58a422dc152..36d4b4d6a1c 100644
--- a/test/es-module/es-module.status
+++ b/test/es-module/es-module.status
@@ -13,3 +13,7 @@ test-esm-loader-http-imports: PASS,FLAKY
 [$arch==arm || $arch==arm64]
 # https://github.com/nodejs/node/issues/47297
 test-wasm-web-api: SKIP
+
+[$system==macos]
+# https://github.com/nodejs/node/pull/59551#issuecomment-3248510249
+test-http-imports: SKIP
diff --git a/test/es-module/test-import-module-retry-require-errored.js b/test/es-module/test-import-module-retry-require-errored.js
new file mode 100644
index 00000000000..79afa20aa70
--- /dev/null
+++ b/test/es-module/test-import-module-retry-require-errored.js
@@ -0,0 +1,17 @@
+// This tests that after failing to import an ESM that rejects,
+// retrying with require() still throws.
+
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+
+(async () => {
+  await assert.rejects(import('../fixtures/es-modules/throw-error.mjs'), {
+    message: 'test',
+  });
+  assert.throws(() => {
+    require('../fixtures/es-modules/throw-error.mjs');
+  }, {
+    message: 'test',
+  });
+})().catch(common.mustNotCall());
diff --git a/test/es-module/test-import-preload-require-cycle.js b/test/es-module/test-import-preload-require-cycle.js
new file mode 100644
index 00000000000..c47b64ba584
--- /dev/null
+++ b/test/es-module/test-import-preload-require-cycle.js
@@ -0,0 +1,20 @@
+'use strict';
+
+// This tests that --import preload does not break CJS entry points that contains
+// require cycles.
+
+require('../common');
+const fixtures = require('../common/fixtures');
+const { spawnSyncAndAssert } = require('../common/child_process');
+
+spawnSyncAndAssert(
+  process.execPath,
+  [
+    '--import',
+    fixtures.fileURL('import-require-cycle/preload.mjs'),
+    fixtures.path('import-require-cycle/c.js'),
+  ],
+  {
+    stdout: /cycle equality true/,
+  }
+);
diff --git a/test/es-module/test-require-module-error-catching.js b/test/es-module/test-require-module-error-catching.js
index c314513d9bb..5400564b318 100644
--- a/test/es-module/test-require-module-error-catching.js
+++ b/test/es-module/test-require-module-error-catching.js
@@ -17,5 +17,5 @@ assert.throws(() => {
   require('../fixtures/es-modules/reference-error-esm.js');
 }, {
   name: 'ReferenceError',
-  message: 'exports is not defined'
+  message: 'exports is not defined in ES module scope'
 });
diff --git a/test/es-module/test-require-module-instantiated.mjs b/test/es-module/test-require-module-instantiated.mjs
new file mode 100644
index 00000000000..9dd50f31d36
--- /dev/null
+++ b/test/es-module/test-require-module-instantiated.mjs
@@ -0,0 +1,4 @@
+import '../common/index.mjs';
+import assert from 'node:assert';
+import { b, c } from '../fixtures/es-modules/require-module-instantiated/a.mjs';
+assert.strictEqual(b, c);
diff --git a/test/es-module/test-require-module-retry-import-errored-2.js b/test/es-module/test-require-module-retry-import-errored-2.js
new file mode 100644
index 00000000000..3504d9932c6
--- /dev/null
+++ b/test/es-module/test-require-module-retry-import-errored-2.js
@@ -0,0 +1,16 @@
+// This tests that after failing to require an ESM that throws,
+// retrying with import() still rejects.
+
+'use strict';
+const common = require('../common');
+const assert = require('assert');
+
+assert.throws(() => {
+  require('../fixtures/es-modules/throw-error.mjs');
+}, {
+  message: 'test',
+});
+
+assert.rejects(import('../fixtures/es-modules/throw-error.mjs'), {
+  message: 'test',
+}).catch(common.mustNotCall());
diff --git a/test/es-module/test-require-module-tla-execution.js b/test/es-module/test-require-module-tla-execution.js
new file mode 100644
index 00000000000..bdd222d1f8f
--- /dev/null
+++ b/test/es-module/test-require-module-tla-execution.js
@@ -0,0 +1,26 @@
+'use strict';
+
+// Tests that require(esm) with top-level-await throws before execution starts
+// if --experimental-print-required-tla is not enabled.
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSyncAndExit } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+
+{
+  spawnSyncAndExit(process.execPath, [
+    fixtures.path('es-modules/tla/require-execution.js'),
+  ], {
+    signal: null,
+    status: 1,
+    stderr(output) {
+      assert.doesNotMatch(output, /I am executed/);
+      common.expectRequiredTLAError(output);
+      assert.match(output, /From .*require-execution\.js/);
+      assert.match(output, /Requiring .*execution\.mjs/);
+      return true;
+    },
+    stdout: ''
+  });
+}
diff --git a/test/es-module/test-require-module-tla-nested.js b/test/es-module/test-require-module-tla-nested.js
new file mode 100644
index 00000000000..583cd7cd0c9
--- /dev/null
+++ b/test/es-module/test-require-module-tla-nested.js
@@ -0,0 +1,15 @@
+'use strict';
+
+// Tests that require(esm) throws for top-level-await in inner graphs.
+
+const common = require('../common');
+const assert = require('assert');
+
+assert.throws(() => {
+  require('../fixtures/es-modules/tla/parent.mjs');
+}, (err) => {
+  common.expectRequiredTLAError(err);
+  assert.match(err.message, /From .*test-require-module-tla-nested\.js/);
+  assert.match(err.message, /Requiring .*parent\.mjs/);
+  return true;
+});
diff --git a/test/es-module/test-require-module-tla-print-execution.js b/test/es-module/test-require-module-tla-print-execution.js
new file mode 100644
index 00000000000..40992ae32e0
--- /dev/null
+++ b/test/es-module/test-require-module-tla-print-execution.js
@@ -0,0 +1,29 @@
+'use strict';
+
+// Tests that require(esm) with top-level-await throws after execution
+// if --experimental-print-required-tla is enabled.
+
+const common = require('../common');
+const assert = require('assert');
+const { spawnSyncAndExit } = require('../common/child_process');
+const fixtures = require('../common/fixtures');
+
+{
+  spawnSyncAndExit(process.execPath, [
+    '--experimental-print-required-tla',
+    fixtures.path('es-modules/tla/require-execution.js'),
+  ], {
+    signal: null,
+    status: 1,
+    stderr(output) {
+      assert.match(output, /I am executed/);
+      common.expectRequiredTLAError(output);
+      assert.match(output, /Error: unexpected top-level await at.*execution\.mjs:3/);
+      assert.match(output, /await Promise\.resolve\('hi'\)/);
+      assert.match(output, /From .*require-execution\.js/);
+      assert.match(output, /Requiring .*execution\.mjs/);
+      return true;
+    },
+    stdout: ''
+  });
+}
diff --git a/test/es-module/test-require-module-tla-rejected.js b/test/es-module/test-require-module-tla-rejected.js
new file mode 100644
index 00000000000..0c1f8de2c30
--- /dev/null
+++ b/test/es-module/test-require-module-tla-rejected.js
@@ -0,0 +1,15 @@
+'use strict';
+
+// Tests that require(esm) throws for rejected top-level await.
+
+const common = require('../common');
+const assert = require('assert');
+
+assert.throws(() => {
+  require('../fixtures/es-modules/tla/rejected.mjs');
+}, (err) => {
+  common.expectRequiredTLAError(err);
+  assert.match(err.message, /From .*test-require-module-tla-rejected\.js/);
+  assert.match(err.message, /Requiring .*rejected\.mjs/);
+  return true;
+});
diff --git a/test/es-module/test-require-module-tla-resolved.js b/test/es-module/test-require-module-tla-resolved.js
new file mode 100644
index 00000000000..f35bb68b7dc
--- /dev/null
+++ b/test/es-module/test-require-module-tla-resolved.js
@@ -0,0 +1,15 @@
+'use strict';
+
+// Tests that require(esm) throws for resolved top-level-await.
+
+const common = require('../common');
+const assert = require('assert');
+
+assert.throws(() => {
+  require('../fixtures/es-modules/tla/resolved.mjs');
+}, (err) => {
+  common.expectRequiredTLAError(err);
+  assert.match(err.message, /From .*test-require-module-tla-resolved\.js/);
+  assert.match(err.message, /Requiring .*resolved\.mjs/);
+  return true;
+});
diff --git a/test/es-module/test-require-module-tla-unresolved.js b/test/es-module/test-require-module-tla-unresolved.js
new file mode 100644
index 00000000000..35cf12c4461
--- /dev/null
+++ b/test/es-module/test-require-module-tla-unresolved.js
@@ -0,0 +1,15 @@
+'use strict';
+
+// Tests that require(esm) throws for unresolved top-level-await.
+
+const common = require('../common');
+const assert = require('assert');
+
+assert.throws(() => {
+  require('../fixtures/es-modules/tla/unresolved.mjs');
+}, (err) => {
+  common.expectRequiredTLAError(err);
+  assert.match(err.message, /From .*test-require-module-tla-unresolved\.js/);
+  assert.match(err.message, /Requiring .*unresolved\.mjs/);
+  return true;
+});
diff --git a/test/es-module/test-require-module-tla.js b/test/es-module/test-require-module-tla.js
deleted file mode 100644
index 9b38b1cab3f..00000000000
--- a/test/es-module/test-require-module-tla.js
+++ /dev/null
@@ -1,63 +0,0 @@
-// Flags: --experimental-require-module
-'use strict';
-
-require('../common');
-const assert = require('assert');
-const { spawnSyncAndExit } = require('../common/child_process');
-const fixtures = require('../common/fixtures');
-
-const message = /require\(\) cannot be used on an ESM graph with top-level await/;
-const code = 'ERR_REQUIRE_ASYNC_MODULE';
-
-assert.throws(() => {
-  require('../fixtures/es-modules/tla/rejected.mjs');
-}, { message, code });
-
-assert.throws(() => {
-  require('../fixtures/es-modules/tla/unresolved.mjs');
-}, { message, code });
-
-
-assert.throws(() => {
-  require('../fixtures/es-modules/tla/resolved.mjs');
-}, { message, code });
-
-// Test TLA in inner graphs.
-assert.throws(() => {
-  require('../fixtures/es-modules/tla/parent.mjs');
-}, { message, code });
-
-{
-  spawnSyncAndExit(process.execPath, [
-    '--experimental-require-module',
-    fixtures.path('es-modules/tla/require-execution.js'),
-  ], {
-    signal: null,
-    status: 1,
-    stderr(output) {
-      assert.doesNotMatch(output, /I am executed/);
-      assert.match(output, message);
-      return true;
-    },
-    stdout: ''
-  });
-}
-
-{
-  spawnSyncAndExit(process.execPath, [
-    '--experimental-require-module',
-    '--experimental-print-required-tla',
-    fixtures.path('es-modules/tla/require-execution.js'),
-  ], {
-    signal: null,
-    status: 1,
-    stderr(output) {
-      assert.match(output, /I am executed/);
-      assert.match(output, /Error: unexpected top-level await at.*execution\.mjs:3/);
-      assert.match(output, /await Promise\.resolve\('hi'\)/);
-      assert.match(output, message);
-      return true;
-    },
-    stdout: ''
-  });
-}
diff --git a/test/fixtures/dotenv/valid.env b/test/fixtures/dotenv/valid.env
index 120488d5791..6df454da653 100644
--- a/test/fixtures/dotenv/valid.env
+++ b/test/fixtures/dotenv/valid.env
@@ -6,6 +6,8 @@ BASIC=basic
 
 # previous line intentionally left blank
 AFTER_LINE=after_line
+A="B=C"
+B=C=D
 EMPTY=
 EMPTY_SINGLE_QUOTES=''
 EMPTY_DOUBLE_QUOTES=""
diff --git a/test/fixtures/es-modules/require-module-instantiated/a.mjs b/test/fixtures/es-modules/require-module-instantiated/a.mjs
new file mode 100644
index 00000000000..2918d414621
--- /dev/null
+++ b/test/fixtures/es-modules/require-module-instantiated/a.mjs
@@ -0,0 +1,2 @@
+export { default as b } from './b.cjs';
+export { default as c } from './c.mjs';
diff --git a/test/fixtures/es-modules/require-module-instantiated/b.cjs b/test/fixtures/es-modules/require-module-instantiated/b.cjs
new file mode 100644
index 00000000000..1e23a5d46d2
--- /dev/null
+++ b/test/fixtures/es-modules/require-module-instantiated/b.cjs
@@ -0,0 +1 @@
+module.exports = require('./c.mjs');
diff --git a/test/fixtures/es-modules/require-module-instantiated/c.mjs b/test/fixtures/es-modules/require-module-instantiated/c.mjs
new file mode 100644
index 00000000000..a5b4faccf9a
--- /dev/null
+++ b/test/fixtures/es-modules/require-module-instantiated/c.mjs
@@ -0,0 +1,3 @@
+const foo = 1;
+export default foo;
+export { foo as 'module.exports' };
diff --git a/test/fixtures/import-require-cycle/a.js b/test/fixtures/import-require-cycle/a.js
new file mode 100644
index 00000000000..595a5085cf5
--- /dev/null
+++ b/test/fixtures/import-require-cycle/a.js
@@ -0,0 +1 @@
+module.exports.b = require('./b.js');
diff --git a/test/fixtures/import-require-cycle/b.js b/test/fixtures/import-require-cycle/b.js
new file mode 100644
index 00000000000..869be257319
--- /dev/null
+++ b/test/fixtures/import-require-cycle/b.js
@@ -0,0 +1 @@
+module.exports.a = require('./a.js');
diff --git a/test/fixtures/import-require-cycle/c.js b/test/fixtures/import-require-cycle/c.js
new file mode 100644
index 00000000000..39099ad7607
--- /dev/null
+++ b/test/fixtures/import-require-cycle/c.js
@@ -0,0 +1,3 @@
+const obj = require('./b.js');
+
+console.log('cycle equality', obj.a.b === obj);
diff --git a/test/fixtures/import-require-cycle/preload.mjs b/test/fixtures/import-require-cycle/preload.mjs
new file mode 100644
index 00000000000..83690b86fea
--- /dev/null
+++ b/test/fixtures/import-require-cycle/preload.mjs
@@ -0,0 +1,10 @@
+import * as mod from "module";
+
+// This API is not available on v20.x. We are just checking that a
+// using a --import preload to force the ESM loader to load CJS
+// still handles CJS <-> CJS cycles just fine.
+// mod.registerHooks({
+//   load(url, context, nextLoad) {
+//     return nextLoad(url, context);
+//   },
+// });
diff --git a/test/fixtures/permission/fs-read.js b/test/fixtures/permission/fs-read.js
index 03261d975ab..5679387cfd6 100644
--- a/test/fixtures/permission/fs-read.js
+++ b/test/fixtures/permission/fs-read.js
@@ -281,6 +281,13 @@ const regularFile = __filename;
     permission: 'FileSystemRead',
     // resource: path.toNamespacedPath(blockedFolder),
   }));
+  assert.throws(() => {
+    fs.readdirSync(blockedFolder, { recursive: true });
+  }, common.expectsError({
+    code: 'ERR_ACCESS_DENIED',
+    permission: 'FileSystemRead',
+    resource: path.toNamespacedPath(blockedFolder),
+  }));
   assert.throws(() => {
     fs.readdirSync(blockedFolder);
   }, common.expectsError({
diff --git a/test/fixtures/permission/main-module.js b/test/fixtures/permission/main-module.js
new file mode 100644
index 00000000000..cac52e04ddd
--- /dev/null
+++ b/test/fixtures/permission/main-module.js
@@ -0,0 +1 @@
+require('./required-module');
\ No newline at end of file
diff --git a/test/fixtures/permission/main-module.mjs b/test/fixtures/permission/main-module.mjs
new file mode 100644
index 00000000000..e7c28f7f6ca
--- /dev/null
+++ b/test/fixtures/permission/main-module.mjs
@@ -0,0 +1 @@
+import './required-module.mjs';
\ No newline at end of file
diff --git a/test/fixtures/permission/required-module.js b/test/fixtures/permission/required-module.js
new file mode 100644
index 00000000000..e8dbf442c5b
--- /dev/null
+++ b/test/fixtures/permission/required-module.js
@@ -0,0 +1 @@
+console.log('ok');
\ No newline at end of file
diff --git a/test/fixtures/permission/required-module.mjs b/test/fixtures/permission/required-module.mjs
new file mode 100644
index 00000000000..e8dbf442c5b
--- /dev/null
+++ b/test/fixtures/permission/required-module.mjs
@@ -0,0 +1 @@
+console.log('ok');
\ No newline at end of file
diff --git a/test/internet/test-dns.js b/test/internet/test-dns.js
index abf94314b1b..0b485e6daa3 100644
--- a/test/internet/test-dns.js
+++ b/test/internet/test-dns.js
@@ -482,9 +482,9 @@ TEST(function test_resolveCname_failure(done) {
 
 TEST(async function test_resolveTxt(done) {
   function validateResult(result) {
-    assert.ok(Array.isArray(result[0]));
-    assert.strictEqual(result.length, 1);
-    assert(result[0][0].startsWith('v=spf1'));
+    assert.ok(result.length > 0);
+    assert.ok(result.every((elem) => Array.isArray(elem) && elem.length === 1));
+    assert.ok(result.some((elem) => elem[0].startsWith('v=spf1')));
   }
 
   validateResult(await dnsPromises.resolveTxt(addresses.TXT_HOST));
diff --git a/test/parallel/test-crypto-default-shake-lengths.js b/test/parallel/test-crypto-default-shake-lengths.js
new file mode 100644
index 00000000000..1e558814ca0
--- /dev/null
+++ b/test/parallel/test-crypto-default-shake-lengths.js
@@ -0,0 +1,18 @@
+// Flags: --pending-deprecation
+'use strict';
+
+const common = require('../common');
+if (!common.hasCrypto)
+  common.skip('missing crypto');
+
+const { createHash } = require('crypto');
+
+common.expectWarning({
+  DeprecationWarning: {
+    DEP0198: 'Creating SHAKE128/256 digests without an explicit options.outputLength is deprecated.',
+  }
+});
+
+{
+  createHash('shake128').update('test').digest();
+}
diff --git a/test/parallel/test-crypto-fips.js b/test/parallel/test-crypto-fips.js
index 8a8a8089a3c..3dfbd1fdd40 100644
--- a/test/parallel/test-crypto-fips.js
+++ b/test/parallel/test-crypto-fips.js
@@ -22,13 +22,16 @@ const FIPS_ENABLE_ERROR_STRING = 'OpenSSL error when trying to enable FIPS:';
 const CNF_FIPS_ON = fixtures.path('openssl_fips_enabled.cnf');
 const CNF_FIPS_OFF = fixtures.path('openssl_fips_disabled.cnf');
 
+const kNoFailure = 0;
+const kGenericUserError = 1;
+
 let num_children_ok = 0;
 
 function sharedOpenSSL() {
   return process.config.variables.node_shared_openssl;
 }
 
-function testHelper(stream, args, expectedOutput, cmd, env) {
+function testHelper(stream, args, expectedStatus, expectedOutput, cmd, env) {
   const fullArgs = args.concat(['-e', `console.log(${cmd})`]);
   const child = spawnSync(process.execPath, fullArgs, {
     cwd: path.dirname(process.execPath),
@@ -55,6 +58,7 @@ function testHelper(stream, args, expectedOutput, cmd, env) {
         // Normal path where we expect either FIPS enabled or disabled.
         assert.strictEqual(getFipsValue, expectedOutput);
     }
+    assert.strictEqual(child.status, expectedStatus);
     childOk(child);
   }
 
@@ -65,6 +69,7 @@ function testHelper(stream, args, expectedOutput, cmd, env) {
 testHelper(
   testFipsCrypto() ? 'stdout' : 'stderr',
   ['--enable-fips'],
+  testFipsCrypto() ? kNoFailure : kGenericUserError,
   testFipsCrypto() ? FIPS_ENABLED : FIPS_ENABLE_ERROR_STRING,
   'process.versions',
   process.env);
@@ -73,6 +78,7 @@ testHelper(
 testHelper(
   testFipsCrypto() ? 'stdout' : 'stderr',
   ['--force-fips'],
+  testFipsCrypto() ? kNoFailure : kGenericUserError,
   testFipsCrypto() ? FIPS_ENABLED : FIPS_ENABLE_ERROR_STRING,
   'process.versions',
   process.env);
@@ -84,6 +90,7 @@ if (!sharedOpenSSL()) {
   testHelper(
     'stdout',
     [],
+    kNoFailure,
     FIPS_DISABLED,
     'require("crypto").getFips()',
     { ...process.env, 'OPENSSL_CONF': ' ' });
@@ -93,6 +100,7 @@ if (!sharedOpenSSL()) {
 testHelper(
   'stderr',
   [],
+  kGenericUserError,
   'Calling crypto.setFips() is not supported in workers',
   'new worker_threads.Worker(\'require("crypto").setFips(true);\', { eval: true })',
   process.env);
@@ -119,6 +127,7 @@ if (!sharedOpenSSL() && !common.hasOpenSSL3) {
   testHelper(
     'stdout',
     [`--openssl-config=${CNF_FIPS_ON}`],
+    kNoFailure,
     testFipsCrypto() ? FIPS_ENABLED : FIPS_DISABLED,
     'require("crypto").getFips()',
     process.env);
@@ -127,6 +136,7 @@ if (!sharedOpenSSL() && !common.hasOpenSSL3) {
   testHelper(
     'stdout',
     [],
+    kNoFailure,
     testFipsCrypto() ? FIPS_ENABLED : FIPS_DISABLED,
     'require("crypto").getFips()',
     Object.assign({}, process.env, { 'OPENSSL_CONF': CNF_FIPS_ON }));
@@ -135,6 +145,7 @@ if (!sharedOpenSSL() && !common.hasOpenSSL3) {
   testHelper(
     'stdout',
     [`--openssl-config=${CNF_FIPS_ON}`],
+    kNoFailure,
     testFipsCrypto() ? FIPS_ENABLED : FIPS_DISABLED,
     'require("crypto").getFips()',
     Object.assign({}, process.env, { 'OPENSSL_CONF': CNF_FIPS_OFF }));
@@ -148,6 +159,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     'stdout',
     [`--openssl-config=${CNF_FIPS_OFF}`],
+    kNoFailure,
     FIPS_DISABLED,
     'require("crypto").getFips()',
     Object.assign({}, process.env, { 'OPENSSL_CONF': CNF_FIPS_ON }));
@@ -156,6 +168,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     testFipsCrypto() ? 'stdout' : 'stderr',
     ['--enable-fips', `--openssl-config=${CNF_FIPS_OFF}`],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
     testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
     'require("crypto").getFips()',
     process.env);
@@ -163,6 +176,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     testFipsCrypto() ? 'stdout' : 'stderr',
     ['--force-fips', `--openssl-config=${CNF_FIPS_OFF}`],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
     testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
     'require("crypto").getFips()',
     process.env);
@@ -170,6 +184,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     testFipsCrypto() ? 'stdout' : 'stderr',
     ['--enable-fips'],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
     testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
     'require("crypto").getFips()',
     process.env);
@@ -178,6 +193,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     testFipsCrypto() ? 'stdout' : 'stderr',
     ['--force-fips'],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
     testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
     'require("crypto").getFips()',
     process.env);
@@ -186,6 +202,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     testFipsCrypto() ? 'stdout' : 'stderr',
     ['--enable-fips'],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
     testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
     'require("crypto").getFips()',
     Object.assign({}, process.env, { 'OPENSSL_CONF': CNF_FIPS_OFF }));
@@ -194,6 +211,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     testFipsCrypto() ? 'stdout' : 'stderr',
     ['--force-fips'],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
     testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
     'require("crypto").getFips()',
     Object.assign({}, process.env, { 'OPENSSL_CONF': CNF_FIPS_OFF }));
@@ -202,6 +220,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     testFipsCrypto() ? 'stdout' : 'stderr',
     [],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
     testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
     '(require("crypto").setFips(true),' +
     'require("crypto").getFips())',
@@ -211,6 +230,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     testFipsCrypto() ? 'stdout' : 'stderr',
     [],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
     testFipsCrypto() ? FIPS_DISABLED : FIPS_UNSUPPORTED_ERROR_STRING,
     '(require("crypto").setFips(true),' +
     'require("crypto").setFips(false),' +
@@ -221,6 +241,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     testFipsCrypto() ? 'stdout' : 'stderr',
     [`--openssl-config=${CNF_FIPS_OFF}`],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
     testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
     '(require("crypto").setFips(true),' +
     'require("crypto").getFips())',
@@ -230,6 +251,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     'stdout',
     [`--openssl-config=${CNF_FIPS_ON}`],
+    kNoFailure,
     FIPS_DISABLED,
     '(require("crypto").setFips(false),' +
     'require("crypto").getFips())',
@@ -239,6 +261,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     testFipsCrypto() ? 'stdout' : 'stderr',
     ['--enable-fips'],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
     testFipsCrypto() ? FIPS_DISABLED : FIPS_UNSUPPORTED_ERROR_STRING,
     '(require("crypto").setFips(false),' +
     'require("crypto").getFips())',
@@ -248,6 +271,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     'stderr',
     ['--force-fips'],
+    kGenericUserError,
     testFipsCrypto() ? FIPS_ERROR_STRING2 : FIPS_UNSUPPORTED_ERROR_STRING,
     'require("crypto").setFips(false)',
     process.env);
@@ -256,6 +280,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     testFipsCrypto() ? 'stdout' : 'stderr',
     ['--force-fips'],
+    testFipsCrypto() ? kNoFailure : kGenericUserError,
     testFipsCrypto() ? FIPS_ENABLED : FIPS_UNSUPPORTED_ERROR_STRING,
     '(require("crypto").setFips(true),' +
     'require("crypto").getFips())',
@@ -265,6 +290,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     'stderr',
     ['--force-fips', '--enable-fips'],
+    kGenericUserError,
     testFipsCrypto() ? FIPS_ERROR_STRING2 : FIPS_UNSUPPORTED_ERROR_STRING,
     'require("crypto").setFips(false)',
     process.env);
@@ -273,6 +299,7 @@ if (!common.hasOpenSSL3) {
   testHelper(
     'stderr',
     ['--enable-fips', '--force-fips'],
+    kGenericUserError,
     testFipsCrypto() ? FIPS_ERROR_STRING2 : FIPS_UNSUPPORTED_ERROR_STRING,
     'require("crypto").setFips(false)',
     process.env);
diff --git a/test/parallel/test-crypto-hash.js b/test/parallel/test-crypto-hash.js
index 8a946ac55ad..af2146982c7 100644
--- a/test/parallel/test-crypto-hash.js
+++ b/test/parallel/test-crypto-hash.js
@@ -7,7 +7,6 @@ const assert = require('assert');
 const crypto = require('crypto');
 const fs = require('fs');
 
-const { hasOpenSSL } = common;
 const fixtures = require('../common/fixtures');
 
 let cryptoType;
@@ -183,21 +182,19 @@ assert.throws(
 
 // Test XOF hash functions and the outputLength option.
 {
-  // Default outputLengths. Since OpenSSL 3.4 an outputLength is mandatory
-  if (!hasOpenSSL(3, 4)) {
-    assert.strictEqual(crypto.createHash('shake128').digest('hex'),
-                       '7f9c2ba4e88f827d616045507605853e');
-    assert.strictEqual(crypto.createHash('shake128', null).digest('hex'),
-                       '7f9c2ba4e88f827d616045507605853e');
-    assert.strictEqual(crypto.createHash('shake256').digest('hex'),
-                       '46b9dd2b0ba88d13233b3feb743eeb24' +
-                       '3fcd52ea62b81b82b50c27646ed5762f');
-    assert.strictEqual(crypto.createHash('shake256', { outputLength: 0 })
-                             .copy()  // Default outputLength.
-                             .digest('hex'),
-                       '46b9dd2b0ba88d13233b3feb743eeb24' +
-                       '3fcd52ea62b81b82b50c27646ed5762f');
-  }
+  // Default outputLengths.
+  assert.strictEqual(crypto.createHash('shake128').digest('hex'),
+                     '7f9c2ba4e88f827d616045507605853e');
+  assert.strictEqual(crypto.createHash('shake128', null).digest('hex'),
+                     '7f9c2ba4e88f827d616045507605853e');
+  assert.strictEqual(crypto.createHash('shake256').digest('hex'),
+                     '46b9dd2b0ba88d13233b3feb743eeb24' +
+                     '3fcd52ea62b81b82b50c27646ed5762f');
+  assert.strictEqual(crypto.createHash('shake256', { outputLength: 0 })
+                           .copy()  // Default outputLength.
+                           .digest('hex'),
+                     '46b9dd2b0ba88d13233b3feb743eeb24' +
+                     '3fcd52ea62b81b82b50c27646ed5762f');
 
   // Short outputLengths.
   assert.strictEqual(crypto.createHash('shake128', { outputLength: 0 })
diff --git a/test/parallel/test-crypto-oneshot-hash.js b/test/parallel/test-crypto-oneshot-hash.js
index 69051c43d9e..56b4c04a65a 100644
--- a/test/parallel/test-crypto-oneshot-hash.js
+++ b/test/parallel/test-crypto-oneshot-hash.js
@@ -31,9 +31,6 @@ const methods = crypto.getHashes();
 const input = fs.readFileSync(fixtures.path('utf8_test_text.txt'));
 
 for (const method of methods) {
-  // Skip failing tests on OpenSSL 3.4.0
-  if (method.startsWith('shake') && common.hasOpenSSL(3, 4))
-    continue;
   for (const outputEncoding of ['buffer', 'hex', 'base64', undefined]) {
     const oldDigest = crypto.createHash(method).update(input).digest(outputEncoding || 'hex');
     const digestFromBuffer = crypto.hash(method, input, outputEncoding);
diff --git a/test/parallel/test-debugger-exec.js b/test/parallel/test-debugger-exec.js
index 51bc7497345..536e0128ea2 100644
--- a/test/parallel/test-debugger-exec.js
+++ b/test/parallel/test-debugger-exec.js
@@ -60,6 +60,11 @@ async function waitInitialBreak() {
       /\[ 'undefined', 'function' \]/,
       'non-paused exec can see global but not module-scope values'
     );
+
+    // Ref: https://github.com/nodejs/node/issues/46808
+    await cli.waitForPrompt();
+    await cli.command('exec { a: 1 }');
+    assert.match(cli.output, /\{ a: 1 \}/);
   } finally {
     await cli.quit();
   }
diff --git a/test/parallel/test-dns.js b/test/parallel/test-dns.js
index a6b3e459aa0..7d67b09d58f 100644
--- a/test/parallel/test-dns.js
+++ b/test/parallel/test-dns.js
@@ -415,7 +415,7 @@ assert.throws(() => {
         (answer) => Object.assign({ domain }, answer)
       ),
     }), port, address);
-  }, cases.length * 2 - 1));
+  }, cases.length * 2));
 
   server.bind(0, common.mustCall(() => {
     const address = server.address();
diff --git a/test/parallel/test-dotenv.js b/test/parallel/test-dotenv.js
index 3c81bf98782..0115496875e 100644
--- a/test/parallel/test-dotenv.js
+++ b/test/parallel/test-dotenv.js
@@ -82,3 +82,5 @@ assert.strictEqual(process.env.DONT_EXPAND_SQUOTED, 'dontexpand\\nnewlines');
 assert.strictEqual(process.env.EXPORT_EXAMPLE, 'ignore export');
 // Ignore spaces before double quotes to avoid quoted strings as value
 assert.strictEqual(process.env.SPACE_BEFORE_DOUBLE_QUOTES, 'space before double quotes');
+assert.strictEqual(process.env.A, 'B=C');
+assert.strictEqual(process.env.B, 'C=D');
diff --git a/test/parallel/test-fs-internal-assertencoding.js b/test/parallel/test-fs-internal-assertencoding.js
new file mode 100644
index 00000000000..ea88517b908
--- /dev/null
+++ b/test/parallel/test-fs-internal-assertencoding.js
@@ -0,0 +1,15 @@
+'use strict';
+
+// Tests to verify that a correctly formatted invalid encoding error
+// is thrown. Originally the internal assertEncoding utility was
+// reversing the arguments when constructing the ERR_INVALID_ARG_VALUE
+// error.
+
+require('../common');
+const { opendirSync } = require('node:fs');
+const { throws } = require('node:assert');
+
+throws(() => opendirSync('.', { encoding: 'no' }), {
+  code: 'ERR_INVALID_ARG_VALUE',
+  message: 'The argument \'encoding\' is invalid encoding. Received \'no\'',
+});
diff --git a/test/parallel/test-http-client-parse-error.js b/test/parallel/test-http-client-parse-error.js
index 5d0ad4b1463..c2167aaabcf 100644
--- a/test/parallel/test-http-client-parse-error.js
+++ b/test/parallel/test-http-client-parse-error.js
@@ -47,7 +47,7 @@ server.listen(0, common.mustCall(() => {
       assert.strictEqual(req.socket.listenerCount('end'), 1);
       common.expectsError({
         code: 'HPE_INVALID_CONSTANT',
-        message: 'Parse Error: Expected HTTP/'
+        message: 'Parse Error: Expected HTTP/, RTSP/ or ICE/'
       })(e);
       countdown.dec();
     }));
diff --git a/test/parallel/test-http-content-length-mismatch.js b/test/parallel/test-http-content-length-mismatch.js
index 540acbe759d..2d4714694d8 100644
--- a/test/parallel/test-http-content-length-mismatch.js
+++ b/test/parallel/test-http-content-length-mismatch.js
@@ -78,3 +78,23 @@ function shouldThrowOnFewerBytes() {
 shouldThrowOnMoreBytes();
 shouldNotThrow();
 shouldThrowOnFewerBytes();
+
+
+{
+  const server = http.createServer(common.mustCall((req, res) => {
+    res.strictContentLength = true;
+    // Pass content-length as string
+    res.setHeader('content-length', '5');
+    res.end('12345');
+  }));
+
+
+  server.listen(0, common.mustCall(() => {
+    http.get({ port: server.address().port }, common.mustCall((res) => {
+      res.resume().on('end', common.mustCall(() => {
+        assert.strictEqual(res.statusCode, 200);
+        server.close();
+      }));
+    }));
+  }));
+}
diff --git a/test/parallel/test-http2-premature-close.js b/test/parallel/test-http2-premature-close.js
index a9b08f55d8a..df30c429188 100644
--- a/test/parallel/test-http2-premature-close.js
+++ b/test/parallel/test-http2-premature-close.js
@@ -29,9 +29,9 @@ async function requestAndClose(server) {
     // Send a valid HEADERS frame
     const headersFrame = Buffer.concat([
       Buffer.from([
-        0x00, 0x00, 0x0c, // Length: 12 bytes
+        0x00, 0x00, 0x0e, // Length: 14 bytes
         0x01, // Type: HEADERS
-        0x05, // Flags: END_HEADERS + END_STREAM
+        0x04, // Flags: END_HEADERS
         (streamId >> 24) & 0xFF, // Stream ID: high byte
         (streamId >> 16) & 0xFF,
         (streamId >> 8) & 0xFF,
@@ -41,7 +41,7 @@ async function requestAndClose(server) {
         0x82, // Indexed Header Field Representation (Predefined ":method: GET")
         0x84, // Indexed Header Field Representation (Predefined ":path: /")
         0x86, // Indexed Header Field Representation (Predefined ":scheme: http")
-        0x44, 0x0a, // Custom ":authority: localhost"
+        0x41, 0x09, // ":authority: localhost" Length: 9 bytes
         0x6c, 0x6f, 0x63, 0x61, 0x6c, 0x68, 0x6f, 0x73, 0x74,
       ]),
     ]);
diff --git a/test/parallel/test-permission-fs-internal-module-stat.js b/test/parallel/test-permission-fs-internal-module-stat.js
new file mode 100644
index 00000000000..68e02f7f963
--- /dev/null
+++ b/test/parallel/test-permission-fs-internal-module-stat.js
@@ -0,0 +1,19 @@
+// Flags: --expose-internals --experimental-permission --allow-fs-read=test/common* --allow-fs-read=tools* --allow-fs-read=test/parallel* --allow-child-process
+'use strict';
+
+const common = require('../common');
+common.skipIfWorker();
+
+if (!common.hasCrypto) {
+  common.skip('no crypto');
+}
+
+const { internalBinding } = require('internal/test/binding');
+const fixtures = require('../common/fixtures');
+
+const blockedFile = fixtures.path('permission', 'deny', 'protected-file.md');
+const internalFsBinding = internalBinding('fs');
+
+{
+  internalFsBinding.internalModuleStat(blockedFile);
+}
diff --git a/test/parallel/test-permission-fs-require.js b/test/parallel/test-permission-fs-require.js
new file mode 100644
index 00000000000..6a2e9201dac
--- /dev/null
+++ b/test/parallel/test-permission-fs-require.js
@@ -0,0 +1,76 @@
+// Flags: --experimental-permission --allow-fs-read=* --allow-child-process
+'use strict';
+
+const common = require('../common');
+common.skipIfWorker();
+const fixtures = require('../common/fixtures');
+
+const assert = require('node:assert');
+const { spawnSync } = require('node:child_process');
+
+{
+  const mainModule = fixtures.path('permission', 'main-module.js');
+  const requiredModule = fixtures.path('permission', 'required-module.js');
+  const { status, stdout, stderr } = spawnSync(
+    process.execPath,
+    [
+      '--experimental-permission',
+      '--allow-fs-read', mainModule,
+      '--allow-fs-read', requiredModule,
+      mainModule,
+    ]
+  );
+
+  assert.strictEqual(status, 0, stderr.toString());
+  assert.strictEqual(stdout.toString(), 'ok\n');
+}
+
+{
+  // When required module is not passed as allowed path
+  const mainModule = fixtures.path('permission', 'main-module.js');
+  const { status, stderr } = spawnSync(
+    process.execPath,
+    [
+      '--experimental-permission',
+      '--allow-fs-read', mainModule,
+      mainModule,
+    ]
+  );
+
+  assert.strictEqual(status, 1, stderr.toString());
+  assert.match(stderr.toString(), /Error: Access to this API has been restricted/);
+}
+
+{
+  // ESM loader test
+  const mainModule = fixtures.path('permission', 'main-module.mjs');
+  const requiredModule = fixtures.path('permission', 'required-module.mjs');
+  const { status, stdout, stderr } = spawnSync(
+    process.execPath,
+    [
+      '--experimental-permission',
+      '--allow-fs-read', mainModule,
+      '--allow-fs-read', requiredModule,
+      mainModule,
+    ]
+  );
+
+  assert.strictEqual(status, 0, stderr.toString());
+  assert.strictEqual(stdout.toString(), 'ok\n');
+}
+
+{
+  // When required module is not passed as allowed path (ESM)
+  const mainModule = fixtures.path('permission', 'main-module.mjs');
+  const { status, stderr } = spawnSync(
+    process.execPath,
+    [
+      '--experimental-permission',
+      '--allow-fs-read', mainModule,
+      mainModule,
+    ]
+  );
+
+  assert.strictEqual(status, 1, stderr.toString());
+  assert.match(stderr.toString(), /Error: Access to this API has been restricted/);
+}
diff --git a/test/parallel/test-process-versions.js b/test/parallel/test-process-versions.js
index 4be85458c48..ecb6047b04a 100644
--- a/test/parallel/test-process-versions.js
+++ b/test/parallel/test-process-versions.js
@@ -4,7 +4,7 @@ const assert = require('assert');
 
 // Import of pure js (non-shared) deps for comparison
 const acorn = require('../../deps/acorn/acorn/package.json');
-const cjs_module_lexer = require('../../deps/cjs-module-lexer/package.json');
+const cjs_module_lexer = require('../../deps/cjs-module-lexer/src/package.json');
 
 const expected_keys = [
   'ares',
diff --git a/test/parallel/test-readline-promises-interface.js b/test/parallel/test-readline-promises-interface.js
index b7ce0c4ff20..a984bd20ed9 100644
--- a/test/parallel/test-readline-promises-interface.js
+++ b/test/parallel/test-readline-promises-interface.js
@@ -948,6 +948,22 @@ for (let i = 0; i < 12; i++) {
     rli.close();
   }
 
+  // Aborting a question with ctrl+C
+  {
+    const [rli, fi] = getInterface({ terminal: true });
+    assert.rejects(rli.question('hello?'), { name: 'AbortError' })
+        .then(common.mustCall());
+    fi.emit('keypress', '.', { ctrl: true, name: 'c' });
+  }
+
+  // Aborting a question with ctrl+D
+  {
+    const [rli, fi] = getInterface({ terminal: true });
+    assert.rejects(rli.question('hello?'), { name: 'AbortError' })
+        .then(common.mustCall());
+    fi.emit('keypress', '.', { ctrl: true, name: 'd' });
+  }
+
   (async () => {
     const [rli] = getInterface({ terminal });
     const signal = AbortSignal.abort('boom');
diff --git a/test/parallel/test-repl-tab-complete-computed-props.js b/test/parallel/test-repl-tab-complete-computed-props.js
new file mode 100644
index 00000000000..830da99b4c3
--- /dev/null
+++ b/test/parallel/test-repl-tab-complete-computed-props.js
@@ -0,0 +1,130 @@
+'use strict';
+
+const common = require('../common');
+const ArrayStream = require('../common/arraystream');
+const { describe, it, before, after } = require('node:test');
+const assert = require('assert');
+
+const repl = require('repl');
+
+function prepareREPL() {
+  const input = new ArrayStream();
+  const replServer = repl.start({
+    prompt: '',
+    input,
+    output: process.stdout,
+    allowBlockingCompletions: true,
+  });
+
+  // Some errors are passed to the domain, but do not callback
+  replServer._domain.on('error', assert.ifError);
+
+  return { replServer, input };
+}
+
+function testCompletion(replServer, { input, expectedCompletions }) {
+  replServer.complete(
+    input,
+    common.mustCall((_error, data) => {
+      assert.deepStrictEqual(data, [expectedCompletions, input]);
+    }),
+  );
+}
+
+describe('REPL tab object completion on computed properties', () => {
+  describe('simple string cases', () => {
+    let replServer;
+
+    before(() => {
+      const { replServer: server, input } = prepareREPL();
+      replServer = server;
+
+      input.run([
+        `
+          const obj = {
+            one: 1,
+            innerObj: { two: 2 },
+            'inner object': { three: 3 },
+          };
+
+          const oneStr = 'one';
+        `,
+      ]);
+    });
+
+    after(() => {
+      replServer.close();
+    });
+
+    it('works with double quoted strings', () => testCompletion(replServer, {
+      input: 'obj["one"].toFi',
+      expectedCompletions: ['obj["one"].toFixed'],
+    }));
+
+    it('works with single quoted strings', () => testCompletion(replServer, {
+      input: "obj['one'].toFi",
+      expectedCompletions: ["obj['one'].toFixed"],
+    }));
+
+    it('works with template strings', () => testCompletion(replServer, {
+      input: 'obj[`one`].toFi',
+      expectedCompletions: ['obj[`one`].toFixed'],
+    }));
+
+    it('works with nested objects', () => {
+      testCompletion(replServer, {
+        input: 'obj["innerObj"].tw',
+        expectedCompletions: ['obj["innerObj"].two'],
+      });
+      testCompletion(replServer, {
+        input: 'obj["innerObj"].two.tofi',
+        expectedCompletions: ['obj["innerObj"].two.toFixed'],
+      });
+    });
+
+    it('works with nested objects combining different type of strings', () => testCompletion(replServer, {
+      input: 'obj["innerObj"][`two`].tofi',
+      expectedCompletions: ['obj["innerObj"][`two`].toFixed'],
+    }));
+
+    it('works with strings with spaces', () => testCompletion(replServer, {
+      input: 'obj["inner object"].th',
+      expectedCompletions: ['obj["inner object"].three'],
+    }));
+  });
+
+  describe('variables as indexes', () => {
+    let replServer;
+
+    before(() => {
+      const { replServer: server, input } = prepareREPL();
+      replServer = server;
+
+      input.run([
+        `
+          const oneStr = 'One';
+          const helloWorldStr = 'Hello' + ' ' + 'World';
+
+          const obj = {
+            [oneStr]: 1,
+            ['Hello World']: 'hello world!',
+          };
+        `,
+      ]);
+    });
+
+    after(() => {
+      replServer.close();
+    });
+
+    it('works with a simple variable', () => testCompletion(replServer, {
+      input: 'obj[oneStr].toFi',
+      expectedCompletions: ['obj[oneStr].toFixed'],
+    }));
+
+    it('works with a computed variable', () => testCompletion(replServer, {
+      input: 'obj[helloWorldStr].tolocaleup',
+      expectedCompletions: ['obj[helloWorldStr].toLocaleUpperCase'],
+    }));
+  });
+});
diff --git a/test/parallel/test-require-resolve-invalid-paths.js b/test/parallel/test-require-resolve-invalid-paths.js
new file mode 100644
index 00000000000..efe929d0c30
--- /dev/null
+++ b/test/parallel/test-require-resolve-invalid-paths.js
@@ -0,0 +1,18 @@
+'use strict';
+
+require('../common');
+const assert = require('assert');
+
+// Test invalid `paths` entries: Ensure non-string entries throw an error
+{
+  const paths = [1, false, null, undefined, () => {}, {}];
+  paths.forEach((value) => {
+    assert.throws(
+      () => require.resolve('.', { paths: [value] }),
+      {
+        name: 'TypeError',
+        code: 'ERR_INVALID_ARG_TYPE',
+      }
+    );
+  });
+}
diff --git a/test/parallel/test-runner-source-maps-invalid-json.js b/test/parallel/test-runner-source-maps-invalid-json.js
new file mode 100644
index 00000000000..508e2d43211
--- /dev/null
+++ b/test/parallel/test-runner-source-maps-invalid-json.js
@@ -0,0 +1,12 @@
+// Flags: --enable-source-maps
+'use strict';
+
+require('../common');
+const test = require('node:test');
+
+// Verify that test runner can handle invalid source maps.
+
+test('ok', () => {});
+
+// eslint-disable-next-line @stylistic/js/spaced-comment
+//# sourceMappingURL=data:application/json;base64,-1
diff --git a/test/parallel/test-util-format.js b/test/parallel/test-util-format.js
index 8d2cab5a9c7..9d6419b6608 100644
--- a/test/parallel/test-util-format.js
+++ b/test/parallel/test-util-format.js
@@ -290,6 +290,68 @@ assert.strictEqual(util.format('%s', -Infinity), '-Infinity');
   assert.strictEqual(util.format('%s', objectWithToPrimitive + ''), 'default context');
 }
 
+// built-in toPrimitive is the same behavior as inspect
+{
+  const date = new Date('2023-10-01T00:00:00Z');
+  assert.strictEqual(util.format('%s', date), util.inspect(date));
+
+  const symbol = Symbol('foo');
+  assert.strictEqual(util.format('%s', symbol), util.inspect(symbol));
+}
+
+// Prototype chain handling for toString
+{
+  function hasToStringButNoToPrimitive() {}
+
+  hasToStringButNoToPrimitive.prototype.toString = function() {
+    return 'hasToStringButNoToPrimitive';
+  };
+
+  let obj = new hasToStringButNoToPrimitive();
+  assert.strictEqual(util.format('%s', obj.toString()), 'hasToStringButNoToPrimitive');
+
+  function inheritsFromHasToStringButNoToPrimitive() {}
+  Object.setPrototypeOf(inheritsFromHasToStringButNoToPrimitive.prototype,
+                        hasToStringButNoToPrimitive.prototype);
+  obj = new inheritsFromHasToStringButNoToPrimitive();
+  assert.strictEqual(util.format('%s', obj.toString()), 'hasToStringButNoToPrimitive');
+}
+
+// Prototype chain handling for Symbol.toPrimitive
+{
+  function hasToPrimitiveButNoToString() {}
+
+  hasToPrimitiveButNoToString.prototype[Symbol.toPrimitive] = function() {
+    return 'hasToPrimitiveButNoToString';
+  };
+
+  let obj = new hasToPrimitiveButNoToString();
+  assert.strictEqual(util.format('%s', obj[Symbol.toPrimitive]()), 'hasToPrimitiveButNoToString');
+  function inheritsFromHasToPrimitiveButNoToString() {}
+  Object.setPrototypeOf(inheritsFromHasToPrimitiveButNoToString.prototype,
+                        hasToPrimitiveButNoToString.prototype);
+  obj = new inheritsFromHasToPrimitiveButNoToString();
+  assert.strictEqual(util.format('%s', obj[Symbol.toPrimitive]()), 'hasToPrimitiveButNoToString');
+}
+
+// Prototype chain handling for both toString and Symbol.toPrimitive
+{
+  function hasBothToStringAndToPrimitive() {}
+  hasBothToStringAndToPrimitive.prototype.toString = function() {
+    return 'toString';
+  };
+  hasBothToStringAndToPrimitive.prototype[Symbol.toPrimitive] = function() {
+    return 'toPrimitive';
+  };
+  let obj = new hasBothToStringAndToPrimitive();
+  assert.strictEqual(util.format('%s', obj.toString()), 'toString');
+  function inheritsFromHasBothToStringAndToPrimitive() {}
+  Object.setPrototypeOf(inheritsFromHasBothToStringAndToPrimitive.prototype,
+                        hasBothToStringAndToPrimitive.prototype);
+  obj = new inheritsFromHasBothToStringAndToPrimitive();
+  assert.strictEqual(util.format('%s', obj.toString()), 'toString');
+}
+
 // JSON format specifier
 assert.strictEqual(util.format('%j'), '%j');
 assert.strictEqual(util.format('%j', 42), '42');
diff --git a/test/parallel/test-util-parse-env.js b/test/parallel/test-util-parse-env.js
index 13d2fda37a0..80ab736dd38 100644
--- a/test/parallel/test-util-parse-env.js
+++ b/test/parallel/test-util-parse-env.js
@@ -11,6 +11,8 @@ const fs = require('node:fs');
   const validContent = fs.readFileSync(validEnvFilePath, 'utf8');
 
   assert.deepStrictEqual(util.parseEnv(validContent), {
+    A: 'B=C',
+    B: 'C=D',
     AFTER_LINE: 'after_line',
     BACKTICKS: 'backticks',
     BACKTICKS_INSIDE_DOUBLE: '`backticks` work inside double quotes',
diff --git a/test/parallel/test-vm-module-dynamic-import-promise.js b/test/parallel/test-vm-module-dynamic-import-promise.js
new file mode 100644
index 00000000000..63493212cd3
--- /dev/null
+++ b/test/parallel/test-vm-module-dynamic-import-promise.js
@@ -0,0 +1,135 @@
+// Flags: --experimental-vm-modules
+'use strict';
+
+const common = require('../common');
+
+const assert = require('assert');
+const { createContext, Script, SourceTextModule } = require('vm');
+
+// Verifies that a `import` call returns a promise created in the context
+// where the `import` was called, not the context of `importModuleDynamically`
+// callback.
+
+async function testScript() {
+  const ctx = createContext();
+
+  const mod1 = new SourceTextModule('export const a = 1;', {
+    context: ctx,
+  });
+  // No import statements, so must not link statically.
+  await mod1.link(common.mustNotCall());
+
+  const script2 = new Script(`
+    const promise = import("mod1");
+    if (Object.getPrototypeOf(promise) !== Promise.prototype) {
+      throw new Error('Expected promise to be created in the current context');
+    }
+    globalThis.__result = promise;
+  `, {
+    importModuleDynamically: common.mustCall((specifier, referrer) => {
+      assert.strictEqual(specifier, 'mod1');
+      assert.strictEqual(referrer, script2);
+      return mod1;
+    }),
+  });
+  script2.runInContext(ctx);
+
+  // Wait for the promise to resolve.
+  await ctx.__result;
+}
+
+async function testScriptImportFailed() {
+  const ctx = createContext();
+
+  const mod1 = new SourceTextModule('export const a = 1;', {
+    context: ctx,
+  });
+  // No import statements, so must not link statically.
+  await mod1.link(common.mustNotCall());
+
+  const err = new Error('import failed');
+  const script2 = new Script(`
+    const promise = import("mod1");
+    if (Object.getPrototypeOf(promise) !== Promise.prototype) {
+      throw new Error('Expected promise to be created in the current context');
+    }
+    globalThis.__result = promise;
+  `, {
+    importModuleDynamically: common.mustCall((specifier, referrer) => {
+      throw err;
+    }),
+  });
+  script2.runInContext(ctx);
+
+  // Wait for the promise to reject.
+  await assert.rejects(ctx.__result, err);
+}
+
+async function testModule() {
+  const ctx = createContext();
+
+  const mod1 = new SourceTextModule('export const a = 1;', {
+    context: ctx,
+  });
+  // No import statements, so must not link statically.
+  await mod1.link(common.mustNotCall());
+
+  const mod2 = new SourceTextModule(`
+    const promise = import("mod1");
+    if (Object.getPrototypeOf(promise) !== Promise.prototype) {
+      throw new Error('Expected promise to be created in the current context');
+    }
+    await promise;
+  `, {
+    context: ctx,
+    importModuleDynamically: common.mustCall((specifier, referrer) => {
+      assert.strictEqual(specifier, 'mod1');
+      assert.strictEqual(referrer, mod2);
+      return mod1;
+    }),
+  });
+  // No import statements, so must not link statically.
+  await mod2.link(common.mustNotCall());
+  await mod2.evaluate();
+}
+
+async function testModuleImportFailed() {
+  const ctx = createContext();
+
+  const mod1 = new SourceTextModule('export const a = 1;', {
+    context: ctx,
+  });
+  // No import statements, so must not link statically.
+  await mod1.link(common.mustNotCall());
+
+  const err = new Error('import failed');
+  ctx.__err = err;
+  const mod2 = new SourceTextModule(`
+    const promise = import("mod1");
+    if (Object.getPrototypeOf(promise) !== Promise.prototype) {
+      throw new Error('Expected promise to be created in the current context');
+    }
+    await promise.then(() => {
+      throw new Error('Expected promise to be rejected');
+    }, (e) => {
+      if (e !== globalThis.__err) {
+        throw new Error('Expected promise to be rejected with "import failed"');
+      }
+    });
+  `, {
+    context: ctx,
+    importModuleDynamically: common.mustCall((specifier, referrer) => {
+      throw err;
+    }),
+  });
+  // No import statements, so must not link statically.
+  await mod2.link(common.mustNotCall());
+  await mod2.evaluate();
+}
+
+Promise.all([
+  testScript(),
+  testScriptImportFailed(),
+  testModule(),
+  testModuleImportFailed(),
+]).then(common.mustCall());
diff --git a/test/sequential/test-heapdump.js b/test/sequential/test-heapdump.js
index 1388623e61f..ee025f57fb8 100644
--- a/test/sequential/test-heapdump.js
+++ b/test/sequential/test-heapdump.js
@@ -8,6 +8,7 @@ if (!common.isMainThread)
 const { writeHeapSnapshot, getHeapSnapshot } = require('v8');
 const assert = require('assert');
 const fs = require('fs');
+const { promises: { pipeline }, PassThrough } = require('stream');
 const tmpdir = require('../common/tmpdir');
 
 tmpdir.refresh();
@@ -76,3 +77,13 @@ process.chdir(tmpdir.path);
     JSON.parse(data);
   }));
 }
+
+{
+  const passthrough = new PassThrough();
+  passthrough.on('data', common.mustCallAtLeast(1));
+
+  pipeline(
+    getHeapSnapshot(),
+    passthrough,
+  ).then(common.mustCall());
+}
diff --git a/tools/dep_updaters/update-cjs-module-lexer.sh b/tools/dep_updaters/update-cjs-module-lexer.sh
index 44167e2f93e..1d12546ab45 100755
--- a/tools/dep_updaters/update-cjs-module-lexer.sh
+++ b/tools/dep_updaters/update-cjs-module-lexer.sh
@@ -27,7 +27,8 @@ console.log(name);
 EOF
 )"
 
-CURRENT_VERSION=$("$NODE" -p "require('./deps/cjs-module-lexer/package.json').version")
+
+CURRENT_VERSION=$("$NODE" -p "require('./deps/cjs-module-lexer/src/package.json').version")
 
 # This function exit with 0 if new version and current version are the same
 compare_dependency_version "cjs-module-lexer" "$NEW_VERSION" "$CURRENT_VERSION"
@@ -44,15 +45,53 @@ cleanup () {
 
 trap cleanup INT TERM EXIT
 
-cd "$WORKSPACE"
-
-"$NODE" "$NPM" init --yes
+CJS_MODULE_LEXER_ZIP="cjs-module-lexer-$NEW_VERSION"
 
-"$NODE" "$NPM" install --global-style --no-bin-links --ignore-scripts "cjs-module-lexer@$NEW_VERSION"
+# remove existing source and built files
+rm -rf "$DEPS_DIR/cjs-module-lexer/src"
+rm -rf "$DEPS_DIR/cjs-module-lexer/dist"
+rm "$DEPS_DIR/cjs-module-lexer/lexer.js"
 
-rm -rf "$DEPS_DIR/cjs-module-lexer"
+cd "$WORKSPACE"
 
-mv node_modules/cjs-module-lexer "$DEPS_DIR/cjs-module-lexer"
+curl -sL -o "$CJS_MODULE_LEXER_ZIP.zip" "https://github.com/nodejs/cjs-module-lexer/archive/refs/tags/$NEW_VERSION.zip"
+
+log_and_verify_sha256sum "cjs-module-lexer" "$CJS_MODULE_LEXER_ZIP.zip"
+
+echo "Unzipping..."
+unzip "$CJS_MODULE_LEXER_ZIP.zip" -d "src"
+mv "src/$CJS_MODULE_LEXER_ZIP" "$DEPS_DIR/cjs-module-lexer/src"
+rm "$CJS_MODULE_LEXER_ZIP.zip"
+cd "$ROOT"
+
+(
+  # remove components we don't need to keep in nodejs/deps
+  # these are files that we don't need to build from source
+  cd "$DEPS_DIR/cjs-module-lexer/src"
+  rm -rf bench
+  rm -rf .github || true 
+  rm -rf test
+  rm .gitignore
+  rm .travis.yml
+  rm CODE_OF_CONDUCT.md
+  rm CONTRIBUTING.md
+
+  # Rebuild components from source
+  rm lib/*.*
+  "$NODE" "$NPM" install --ignore-scripts
+  "$NODE" "$NPM" run build-wasm
+  "$NODE" "$NPM" run build
+  "$NODE" "$NPM" prune --production
+
+  # remove files we don't need in Node.js
+  rm -rf node_modules
+
+  # copy over the built files to the expected locations
+  mv dist ..
+  cp lexer.js ..
+  cp LICENSE ..
+  cp README.md ..
+)
 
 # update cjs_module_lexer_version.h
 cat > "$BASE_DIR/src/cjs_module_lexer_version.h" << EOL
diff --git a/tools/install.py b/tools/install.py
index c14c418f325..d964d5a2efe 100755
--- a/tools/install.py
+++ b/tools/install.py
@@ -232,9 +232,19 @@ def files(options, action):
       link_path = abspath(options.install_path, 'lib/libnode.so')
       try_symlink(options, so_name, link_path)
     else:
-      output_lib = 'libnode.' + options.variables.get('shlib_suffix')
-      action(options, [os.path.join(options.build_dir, output_lib)],
-             os.path.join(options.variables.get('libdir'), output_lib))
+      # Ninja and Makefile generators output the library in different directories;
+      # find out which one we have, and install first found
+      output_lib_name = 'libnode.' + options.variables.get('shlib_suffix')
+      output_lib_candidate_paths = [
+        os.path.join(options.build_dir, output_lib_name),
+        os.path.join(options.build_dir, "lib", output_lib_name),
+      ]
+      try:
+        output_lib = next(filter(os.path.exists, output_lib_candidate_paths))
+      except StopIteration as not_found:
+        raise RuntimeError("No libnode.so to install!") from not_found
+      action(options, [output_lib],
+             os.path.join(options.variables.get('libdir'), output_lib_name))
 
   if not options.is_win:
     # Install nsolid -> node compatibility symlink.
diff --git a/tools/v8_gypfiles/features.gypi b/tools/v8_gypfiles/features.gypi
index c768d7a0f13..45700e940c9 100644
--- a/tools/v8_gypfiles/features.gypi
+++ b/tools/v8_gypfiles/features.gypi
@@ -253,6 +253,11 @@
     # Sets -DV8_ENABLE_SANDBOX.
     'v8_enable_sandbox%': 0,
 
+    # Enable support for external code range relative to the pointer compression
+    # cage.
+    # Sets -DV8_EXTERNAL_CODE_SPACE.
+    'v8_enable_external_code_space%': 0,
+
     # Experimental feature for collecting per-class zone memory stats.
     # Requires use_rtti = true
     'v8_enable_precise_zone_stats%': 0,
@@ -371,6 +376,9 @@
       ['v8_enable_sandbox==1', {
         'defines': ['V8_ENABLE_SANDBOX',],
       }],
+      ['v8_enable_external_code_space==1', {
+        'defines': ['V8_EXTERNAL_CODE_SPACE',],
+      }],
       ['v8_enable_object_print==1', {
         'defines': ['OBJECT_PRINT',],
       }],