diff --git a/go.mod b/go.mod
index b32a0f25c5e..bbbafb8b986 100644
--- a/go.mod
+++ b/go.mod
@@ -46,8 +46,8 @@ require (
 	github.com/moby/sys/user v0.4.0
 	github.com/moby/term v0.5.2
 	github.com/nxadm/tail v1.4.11
-	github.com/onsi/ginkgo/v2 v2.28.2
-	github.com/onsi/gomega v1.39.1
+	github.com/onsi/ginkgo/v2 v2.28.3
+	github.com/onsi/gomega v1.40.0
 	github.com/opencontainers/cgroups v0.0.6
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.1.1
@@ -124,7 +124,7 @@ require (
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/go-containerregistry v0.21.1 // indirect
 	github.com/google/go-intervals v0.0.2 // indirect
-	github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 // indirect
+	github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-retryablehttp v0.7.8 // indirect
@@ -168,7 +168,7 @@ require (
 	github.com/tklauser/numcpus v0.11.0 // indirect
 	github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 // indirect
 	github.com/ulikunitz/xz v0.5.15 // indirect
-	github.com/vbatts/tar-split v0.12.2 // indirect
+	github.com/vbatts/tar-split v0.12.3 // indirect
 	github.com/vishvananda/netns v0.0.5 // indirect
 	github.com/yusufpapurcu/wmi v1.2.4 // indirect
 	go.etcd.io/bbolt v1.4.3 // indirect
@@ -179,12 +179,18 @@ require (
 	go.opentelemetry.io/otel/trace v1.43.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
 	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/mod v0.34.0 // indirect
+	golang.org/x/mod v0.35.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/text v0.36.0 // indirect
-	golang.org/x/tools v0.43.0 // indirect
+	golang.org/x/tools v0.44.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260401024825-9d38bb4040a9 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	tags.cncf.io/container-device-interface/specs-go v1.1.0 // indirect
 )
+
+replace go.podman.io/common => github.com/jankaluza/container-libs/common v0.0.0-20260429095922-ccf4fb27ad49
+
+replace go.podman.io/image/v5 => github.com/jankaluza/container-libs/image/v5 v5.0.0-20260429095922-ccf4fb27ad49
+
+replace go.podman.io/storage => github.com/jankaluza/container-libs/storage v0.0.0-20260429095922-ccf4fb27ad49
diff --git a/go.sum b/go.sum
index 0f5988ad4b9..babf39f10a2 100644
--- a/go.sum
+++ b/go.sum
@@ -161,8 +161,8 @@ github.com/google/go-intervals v0.0.2/go.mod h1:MkaR3LNRfeKLPmqgJYs4E66z5InYjmCj
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
 github.com/google/goterm v0.0.0-20200907032337-555d40f16ae2 h1:CVuJwN34x4xM2aT4sIKhmeib40NeBPhRihNjQmpJsA4=
 github.com/google/goterm v0.0.0-20200907032337-555d40f16ae2/go.mod h1:nOFQdrUlIlx6M6ODdSpBj1NVA+VgLC6kmw60mkw34H4=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83 h1:z2ogiKUYzX5Is6zr/vP9vJGqPwcdqsWjOt+V8J7+bTc=
-github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936 h1:EwtI+Al+DeppwYX2oXJCETMO23COyaKGP6fHVpkpWpg=
+github.com/google/pprof v0.0.0-20260402051712-545e8a4df936/go.mod h1:MxpfABSjhmINe3F1It9d+8exIHFvUqtLIRCdOGNXqiI=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.2.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
@@ -195,6 +195,12 @@ github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
 github.com/insomniacslk/dhcp v0.0.0-20250109001534-8abf58130905 h1:q3OEI9RaN/wwcx+qgGo6ZaoJkCiDYe/gjDLfq7lQQF4=
 github.com/insomniacslk/dhcp v0.0.0-20250109001534-8abf58130905/go.mod h1:VvGYjkZoJyKqlmT1yzakUs4mfKMNB0XdODP0+rdml6k=
+github.com/jankaluza/container-libs/common v0.0.0-20260429095922-ccf4fb27ad49 h1:xuXYc+qinGWuSKHgFGwfYImh0bosTqQpc6SuEnldxBE=
+github.com/jankaluza/container-libs/common v0.0.0-20260429095922-ccf4fb27ad49/go.mod h1:r5jp56eF8o1xu6a7jMqGV+puOaVklDZnVIUBCenQ0QM=
+github.com/jankaluza/container-libs/image/v5 v5.0.0-20260429095922-ccf4fb27ad49 h1:8i3w/w9ii+CNd3p0BuQ8B6de9kXB3dczjshRv4SP2zU=
+github.com/jankaluza/container-libs/image/v5 v5.0.0-20260429095922-ccf4fb27ad49/go.mod h1:nOpK8WraVoE4Ys2ipAMDUYqxH1YSFSxe9IcxoMTliw0=
+github.com/jankaluza/container-libs/storage v0.0.0-20260429095922-ccf4fb27ad49 h1:culWCSQVM1QPjXfTwOKy/F6IbkZ+Ra4F8D/X54s3+jo=
+github.com/jankaluza/container-libs/storage v0.0.0-20260429095922-ccf4fb27ad49/go.mod h1:JqU/Grx2I+uG3fpmRoyeGRuoSAeRmZGCJHZ4JsQfScM=
 github.com/jinzhu/copier v0.4.0 h1:w3ciUoD19shMCRargcpm0cm91ytaBhDvuRpz1ODO/U8=
 github.com/jinzhu/copier v0.4.0/go.mod h1:DfbEm0FYsaqBcKcFuvmOZb218JkPGtvSHsKg8S8hyyg=
 github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
@@ -281,10 +287,10 @@ github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFd
 github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
 github.com/nxadm/tail v1.4.11 h1:8feyoE3OzPrcshW5/MJ4sGESc5cqmGkGCWlco4l0bqY=
 github.com/nxadm/tail v1.4.11/go.mod h1:OTaG3NK980DZzxbRq6lEuzgU+mug70nY11sMd4JXXHc=
-github.com/onsi/ginkgo/v2 v2.28.2 h1:DTrMfpqxiNUyQ3Y0zhn1n3cOO2euFgQPYIpkWwxVFps=
-github.com/onsi/ginkgo/v2 v2.28.2/go.mod h1:CLtbVInNckU3/+gC8LzkGUb9oF+e8W8TdUsxPwvdOgE=
-github.com/onsi/gomega v1.39.1 h1:1IJLAad4zjPn2PsnhH70V4DKRFlrCzGBNrNaru+Vf28=
-github.com/onsi/gomega v1.39.1/go.mod h1:hL6yVALoTOxeWudERyfppUcZXjMwIMLnuSfruD2lcfg=
+github.com/onsi/ginkgo/v2 v2.28.3 h1:4JvMdwtFU0imd8fHx25OJXoDMRexnf8v5NHKYSTTji4=
+github.com/onsi/ginkgo/v2 v2.28.3/go.mod h1:+aXOY+vzZ5mu2iI2HpTZUPmM//oQfsNFX6gU9kNcA44=
+github.com/onsi/gomega v1.40.0 h1:Vtol0e1MghCD2ZVIilPDIg44XSL9l2QAn8ZNaljWcJc=
+github.com/onsi/gomega v1.40.0/go.mod h1:M/Uqpu/8qTjtzCLUA2zJHX9Iilrau25x1PdoSRbWh5A=
 github.com/opencontainers/cgroups v0.0.6 h1:tfZFWTIIGaUUFImTyuTg+Mr5x8XRiSdZESgEBW7UxuI=
 github.com/opencontainers/cgroups v0.0.6/go.mod h1:oWVzJsKK0gG9SCRBfTpnn16WcGEqDI8PAcpMGbqWxcs=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
@@ -383,8 +389,8 @@ github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 h1:pyC9PaHYZFgEKFdlp3G8
 github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701/go.mod h1:P3a5rG4X7tI17Nn3aOIAYr5HbIMukwXG0urG0WuL8OA=
 github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
 github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
-github.com/vbatts/tar-split v0.12.2 h1:w/Y6tjxpeiFMR47yzZPlPj/FcPLpXbTUi/9H7d3CPa4=
-github.com/vbatts/tar-split v0.12.2/go.mod h1:eF6B6i6ftWQcDqEn3/iGFRFRo8cBIMSJVOpnNdfTMFA=
+github.com/vbatts/tar-split v0.12.3 h1:Cd46rkGXI3Td4yrVNwU8ripbxFaQbmesqhjBUUYAJSw=
+github.com/vbatts/tar-split v0.12.3/go.mod h1:sQOc6OlqGCr7HkGx/IDBeKiTIvqhmj8KffNhEXG4Nq0=
 github.com/vbauerster/mpb/v8 v8.12.0 h1:+gneY3ifzc88tKDzOtfG8k8gfngCx615S2ZmFM4liWg=
 github.com/vbauerster/mpb/v8 v8.12.0/go.mod h1:V02YIuMVo301Y1VE9VtZlD8s84OMsk+EKN6mwvf/588=
 github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0=
@@ -431,12 +437,6 @@ go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09
 go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0=
 go.podman.io/buildah v1.42.1-0.20260421143840-0acb6b8cca85 h1:rVKRagobPO6kGHOg2NhGNs6xWVgZctiOn4tmxa3cytA=
 go.podman.io/buildah v1.42.1-0.20260421143840-0acb6b8cca85/go.mod h1:JjFirF1zlILz55ZkVYYhLRnted7mPlmoS2w2ihYw8iw=
-go.podman.io/common v0.67.2-0.20260428163628-e3b0c9aa788d h1:/oR7Ke8lxnw/pTcQ3mcjKLPI0gn0xc/wGPKXGpq+/gM=
-go.podman.io/common v0.67.2-0.20260428163628-e3b0c9aa788d/go.mod h1:3Dn8ywd1MInft7FIPMBcLOvVWgAhiLFCwsNxCTc9QhM=
-go.podman.io/image/v5 v5.39.3-0.20260428163628-e3b0c9aa788d h1:mm8baBK0FvElAxfI6Z9knY0PcnjX4wVvlI+/H4lg1kI=
-go.podman.io/image/v5 v5.39.3-0.20260428163628-e3b0c9aa788d/go.mod h1:c1ged4R93jqNgA1E1Quywv65YAZvPZm4bOEqFMOi1OE=
-go.podman.io/storage v1.62.1-0.20260428163628-e3b0c9aa788d h1:V1Tk7mksAafNAjdDEdJ8IFKkKceYoWXDuOqO5RJw/OI=
-go.podman.io/storage v1.62.1-0.20260428163628-e3b0c9aa788d/go.mod h1:13aOBf6782/fbAzH7QNEqlVzFu+X4sS4MxDM/VdJGZU=
 go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
 go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
@@ -461,8 +461,8 @@ golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.34.0 h1:xIHgNUUnW6sYkcM5Jleh05DvLOtwc6RitGHbDk4akRI=
-golang.org/x/mod v0.34.0/go.mod h1:ykgH52iCZe79kzLLMhyCUzhMci+nQj+0XkbXpNYtVjY=
+golang.org/x/mod v0.35.0 h1:Ww1D637e6Pg+Zb2KrWfHQUnH2dQRLBQyAtpr/haaJeM=
+golang.org/x/mod v0.35.0/go.mod h1:+GwiRhIInF8wPm+4AoT6L0FA1QWAad3OMdTRx4tFYlU=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@@ -548,8 +548,8 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.43.0 h1:12BdW9CeB3Z+J/I/wj34VMl8X+fEXBxVR90JeMX5E7s=
-golang.org/x/tools v0.43.0/go.mod h1:uHkMso649BX2cZK6+RpuIPXS3ho2hZo4FVwfoy1vIk0=
+golang.org/x/tools v0.44.0 h1:UP4ajHPIcuMjT1GqzDWRlalUEoY+uzoZKnhOjbIPD2c=
+golang.org/x/tools v0.44.0/go.mod h1:KA0AfVErSdxRZIsOVipbv3rQhVXTnlU6UhKxHd1seDI=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md b/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
index 2233136e608..d382b0640c3 100644
--- a/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
+++ b/vendor/github.com/onsi/ginkgo/v2/CHANGELOG.md
@@ -1,3 +1,8 @@
+## 2.28.3
+
+### Maintenance
+Bump all dependencies
+
 ## 2.28.2
 
 - Add ArtifactDir() to support Go 1.26 testing.TB interface [f3a36b6]
diff --git a/vendor/github.com/onsi/ginkgo/v2/types/version.go b/vendor/github.com/onsi/ginkgo/v2/types/version.go
index 6874270ac22..4479578f925 100644
--- a/vendor/github.com/onsi/ginkgo/v2/types/version.go
+++ b/vendor/github.com/onsi/ginkgo/v2/types/version.go
@@ -1,3 +1,3 @@
 package types
 
-const VERSION = "2.28.2"
+const VERSION = "2.28.3"
diff --git a/vendor/github.com/onsi/gomega/CHANGELOG.md b/vendor/github.com/onsi/gomega/CHANGELOG.md
index 91e65521b42..9c94d0e6cfd 100644
--- a/vendor/github.com/onsi/gomega/CHANGELOG.md
+++ b/vendor/github.com/onsi/gomega/CHANGELOG.md
@@ -1,3 +1,11 @@
+## 1.40.0
+
+We're adopting a new release strategy to minimize dependency bloat in projects that consume Gomega.  It is a limitation of the go mod toolchain that _test_ subdependencies of your project's direct dependencies get pulled in as *indirect* dependencies.  In the case of Gomega, this ends up pulling in all of Ginkgo into your `go.mod` even if you are only using Gomega (Gomega uses Ginkgo for its own tests).
+
+Going forward, releases will strip out all tests, tidy up the `go.mod` and then push this stripped down version to a new `master-lite` branch.  These stripped-down versions will receive the `vx.y.z` git tag and will be picked up by the go toolchain.
+
+Please open an issue if this new release process causes unexpected changes for your projects.
+
 ## 1.39.1
 
 Update all dependencies.  This auto-updated the required version of Go to 1.24, consistent with the fact that Go 1.23 has been out of support for almost six months.
diff --git a/vendor/github.com/onsi/gomega/gomega_dsl.go b/vendor/github.com/onsi/gomega/gomega_dsl.go
index 87c70692bfa..af1341bdbdb 100644
--- a/vendor/github.com/onsi/gomega/gomega_dsl.go
+++ b/vendor/github.com/onsi/gomega/gomega_dsl.go
@@ -22,7 +22,7 @@ import (
 	"github.com/onsi/gomega/types"
 )
 
-const GOMEGA_VERSION = "1.39.1"
+const GOMEGA_VERSION = "1.40.0"
 
 const nilGomegaPanic = `You are trying to make an assertion, but haven't registered Gomega's fail handler.
 If you're using Ginkgo then you probably forgot to put your assertion in an It().
diff --git a/vendor/github.com/vbatts/tar-split/archive/tar/format.go b/vendor/github.com/vbatts/tar-split/archive/tar/format.go
index 60977980c5a..6f31845e433 100644
--- a/vendor/github.com/vbatts/tar-split/archive/tar/format.go
+++ b/vendor/github.com/vbatts/tar-split/archive/tar/format.go
@@ -147,6 +147,12 @@ const (
 	// Max length of a special file (PAX header, GNU long name or link).
 	// This matches the limit used by libarchive.
 	maxSpecialFileSize = 1 << 20
+
+	// Maximum number of sparse file entries.
+	// We should never actually hit this limit
+	// (every sparse encoding will first be limited by maxSpecialFileSize),
+	// but this adds an additional layer of defense.
+	maxSparseFileEntries = 1 << 20
 )
 
 // blockPadding computes the number of bytes needed to pad offset up to the
diff --git a/vendor/github.com/vbatts/tar-split/archive/tar/reader.go b/vendor/github.com/vbatts/tar-split/archive/tar/reader.go
index a645c41605f..ebe85797727 100644
--- a/vendor/github.com/vbatts/tar-split/archive/tar/reader.go
+++ b/vendor/github.com/vbatts/tar-split/archive/tar/reader.go
@@ -537,7 +537,8 @@ func (tr *Reader) readOldGNUSparseMap(hdr *Header, blk *block) (sparseDatas, err
 	}
 	s := blk.GNU().Sparse()
 	spd := make(sparseDatas, 0, s.MaxEntries())
-	for {
+	totalSize := len(s)
+	for totalSize < maxSpecialFileSize {
 		for i := 0; i < s.MaxEntries(); i++ {
 			// This termination condition is identical to GNU and BSD tar.
 			if s.Entry(i).Offset()[0] == 0x00 {
@@ -548,7 +549,11 @@ func (tr *Reader) readOldGNUSparseMap(hdr *Header, blk *block) (sparseDatas, err
 			if p.err != nil {
 				return nil, p.err
 			}
-			spd = append(spd, sparseEntry{Offset: offset, Length: length})
+			var err error
+			spd, err = appendSparseEntry(spd, sparseEntry{Offset: offset, Length: length})
+			if err != nil {
+				return nil, err
+			}
 		}
 
 		if s.IsExtended()[0] > 0 {
@@ -560,10 +565,12 @@ func (tr *Reader) readOldGNUSparseMap(hdr *Header, blk *block) (sparseDatas, err
 				tr.rawBytes.Write(blk[:])
 			}
 			s = blk.Sparse()
+			totalSize += len(s)
 			continue
 		}
 		return spd, nil // Done
 	}
+	return nil, errSparseTooLong
 }
 
 // readGNUSparseMap1x0 reads the sparse map as stored in GNU's PAX sparse format
@@ -636,7 +643,10 @@ func readGNUSparseMap1x0(r io.Reader) (sparseDatas, error) {
 		if err1 != nil || err2 != nil {
 			return nil, ErrHeader
 		}
-		spd = append(spd, sparseEntry{Offset: offset, Length: length})
+		spd, err = appendSparseEntry(spd, sparseEntry{Offset: offset, Length: length})
+		if err != nil {
+			return nil, err
+		}
 	}
 	return spd, nil
 }
@@ -670,12 +680,22 @@ func readGNUSparseMap0x1(paxHdrs map[string]string) (sparseDatas, error) {
 		if err1 != nil || err2 != nil {
 			return nil, ErrHeader
 		}
-		spd = append(spd, sparseEntry{Offset: offset, Length: length})
+		spd, err = appendSparseEntry(spd, sparseEntry{Offset: offset, Length: length})
+		if err != nil {
+			return nil, err
+		}
 		sparseMap = sparseMap[2:]
 	}
 	return spd, nil
 }
 
+func appendSparseEntry(spd sparseDatas, ent sparseEntry) (sparseDatas, error) {
+	if len(spd) >= maxSparseFileEntries {
+		return nil, errSparseTooLong
+	}
+	return append(spd, ent), nil
+}
+
 // Read reads from the current file in the tar archive.
 // It returns (0, io.EOF) when it reaches the end of that file,
 // until Next is called to advance to the next file.
diff --git a/vendor/github.com/vbatts/tar-split/tar/asm/disassemble.go b/vendor/github.com/vbatts/tar-split/tar/asm/disassemble.go
index 80c2522afe5..a17b6eac1ec 100644
--- a/vendor/github.com/vbatts/tar-split/tar/asm/disassemble.go
+++ b/vendor/github.com/vbatts/tar-split/tar/asm/disassemble.go
@@ -1,156 +1,237 @@
 package asm
 
 import (
+	"errors"
 	"io"
 
 	"github.com/vbatts/tar-split/archive/tar"
 	"github.com/vbatts/tar-split/tar/storage"
 )
 
-// NewInputTarStream wraps the Reader stream of a tar archive and provides a
-// Reader stream of the same.
+// runInputTarStreamGoroutine is the goroutine entrypoint.
 //
-// In the middle it will pack the segments and file metadata to storage.Packer
-// `p`.
+// It centralizes the goroutine protocol so the core parsing logic can be
+// written as ordinary Go code that just "returns an error".
 //
-// The the storage.FilePutter is where payload of files in the stream are
-// stashed. If this stashing is not needed, you can provide a nil
-// storage.FilePutter. Since the checksumming is still needed, then a default
-// of NewDiscardFilePutter will be used internally
-func NewInputTarStream(r io.Reader, p storage.Packer, fp storage.FilePutter) (io.Reader, error) {
-	// What to do here... folks will want their own access to the Reader that is
-	// their tar archive stream, but we'll need that same stream to use our
-	// forked 'archive/tar'.
-	// Perhaps do an io.TeeReader that hands back an io.Reader for them to read
-	// from, and we'll MITM the stream to store metadata.
-	// We'll need a storage.FilePutter too ...
+// Protocol guarantees:
+//   - pW is always closed exactly once (CloseWithError(nil) == Close()).
+//   - if done != nil, exactly one value is sent (nil on success, non-nil on failure).
+//   - panics are converted into a non-nil error (and the panic is rethrown).
+func runInputTarStreamGoroutine(outputRdr io.Reader, pW *io.PipeWriter, p storage.Packer, fp storage.FilePutter, done chan<- error) {
+	// Default to a non-nil error so a panic can't accidentally look like success.
+	err := errors.New("panic in runInputTarStream")
+	defer func() {
+		// CloseWithError(nil) is equivalent to Close().
+		pW.CloseWithError(err)
 
-	// Another concern, whether to do any storage.FilePutter operations, such that we
-	// don't extract any amount of the archive. But then again, we're not making
-	// files/directories, hardlinks, etc. Just writing the io to the storage.FilePutter.
-	// Perhaps we have a DiscardFilePutter that is a bit bucket.
+		if done != nil {
+			done <- err
+		}
 
-	// we'll return the pipe reader, since TeeReader does not buffer and will
-	// only read what the outputRdr Read's. Since Tar archives have padding on
-	// the end, we want to be the one reading the padding, even if the user's
-	// `archive/tar` doesn't care.
-	pR, pW := io.Pipe()
-	outputRdr := io.TeeReader(r, pW)
+		// Preserve panic semantics while still ensuring the protocol above runs.
+		if r := recover(); r != nil {
+			panic(r)
+		}
+	}()
 
-	// we need a putter that will generate the crc64 sums of file payloads
-	if fp == nil {
-		fp = storage.NewDiscardFilePutter()
-	}
+	err = runInputTarStream(outputRdr, p, fp)
+}
 
-	go func() {
-		tr := tar.NewReader(outputRdr)
-		tr.RawAccounting = true
-		for {
-			hdr, err := tr.Next()
-			if err != nil {
-				if err != io.EOF {
-					pW.CloseWithError(err)
-					return
-				}
-				// even when an EOF is reached, there is often 1024 null bytes on
-				// the end of an archive. Collect them too.
-				if b := tr.RawBytes(); len(b) > 0 {
-					_, err := p.AddEntry(storage.Entry{
-						Type:    storage.SegmentType,
-						Payload: b,
-					})
-					if err != nil {
-						pW.CloseWithError(err)
-						return
-					}
-				}
-				break // not return. We need the end of the reader.
-			}
-			if hdr == nil {
-				break // not return. We need the end of the reader.
-			}
+// runInputTarStream drives tar-split parsing.
+//
+// It reads a tar stream from outputRdr and records tar-split metadata into the
+// provided storage.Packer.
+//
+// Abort behavior: if the consumer closes the read end early, the tee reader will
+// stop producing bytes (due to pipe write failure) and tar parsing will return
+// an error. We propagate that error so the goroutine terminates promptly rather
+// than draining the input stream for no benefit.
+func runInputTarStream(outputRdr io.Reader, p storage.Packer, fp storage.FilePutter) error {
+	tr := tar.NewReader(outputRdr)
+	tr.RawAccounting = true
 
+	for {
+		hdr, err := tr.Next()
+		if err != nil {
+			if err != io.EOF {
+				return err
+			}
+			// Even when EOF is reached, there is often 1024 null bytes at the end
+			// of an archive. Collect them too.
 			if b := tr.RawBytes(); len(b) > 0 {
-				_, err := p.AddEntry(storage.Entry{
+				if _, err := p.AddEntry(storage.Entry{
 					Type:    storage.SegmentType,
 					Payload: b,
-				})
-				if err != nil {
-					pW.CloseWithError(err)
-					return
-				}
-			}
-
-			var csum []byte
-			if hdr.Size > 0 {
-				var err error
-				_, csum, err = fp.Put(hdr.Name, tr)
-				if err != nil {
-					pW.CloseWithError(err)
-					return
+				}); err != nil {
+					return err
 				}
 			}
+			break // Not return: we still need to drain any additional padding.
+		}
+		if hdr == nil {
+			break // Not return: we still need to drain any additional padding.
+		}
 
-			entry := storage.Entry{
-				Type:    storage.FileType,
-				Size:    hdr.Size,
-				Payload: csum,
+		if b := tr.RawBytes(); len(b) > 0 {
+			if _, err := p.AddEntry(storage.Entry{
+				Type:    storage.SegmentType,
+				Payload: b,
+			}); err != nil {
+				return err
 			}
-			// For proper marshalling of non-utf8 characters
-			entry.SetName(hdr.Name)
+		}
 
-			// File entries added, regardless of size
-			_, err = p.AddEntry(entry)
+		var csum []byte
+		if hdr.Size > 0 {
+			_, csum, err = fp.Put(hdr.Name, tr)
 			if err != nil {
-				pW.CloseWithError(err)
-				return
+				return err
 			}
+		}
 
-			if b := tr.RawBytes(); len(b) > 0 {
-				_, err = p.AddEntry(storage.Entry{
-					Type:    storage.SegmentType,
-					Payload: b,
-				})
-				if err != nil {
-					pW.CloseWithError(err)
-					return
-				}
-			}
+		entry := storage.Entry{
+			Type:    storage.FileType,
+			Size:    hdr.Size,
+			Payload: csum,
 		}
+		// For proper marshalling of non-utf8 characters
+		entry.SetName(hdr.Name)
 
-		// It is allowable, and not uncommon that there is further padding on
-		// the end of an archive, apart from the expected 1024 null bytes. We
-		// do this in chunks rather than in one go to avoid cases where a
-		// maliciously crafted tar file tries to trick us into reading many GBs
-		// into memory.
-		const paddingChunkSize = 1024 * 1024
-		var paddingChunk [paddingChunkSize]byte
-		for {
-			var isEOF bool
-			n, err := outputRdr.Read(paddingChunk[:])
-			if err != nil {
-				if err != io.EOF {
-					pW.CloseWithError(err)
-					return
-				}
-				isEOF = true
+		// File entries added, regardless of size
+		if _, err := p.AddEntry(entry); err != nil {
+			return err
+		}
+
+		if b := tr.RawBytes(); len(b) > 0 {
+			if _, err := p.AddEntry(storage.Entry{
+				Type:    storage.SegmentType,
+				Payload: b,
+			}); err != nil {
+				return err
 			}
-			if n != 0 {
-				_, err = p.AddEntry(storage.Entry{
-					Type:    storage.SegmentType,
-					Payload: paddingChunk[:n],
-				})
-				if err != nil {
-					pW.CloseWithError(err)
-					return
-				}
+		}
+	}
+
+	// It is allowable, and not uncommon that there is further padding on
+	// the end of an archive, apart from the expected 1024 null bytes. We
+	// do this in chunks rather than in one go to avoid cases where a
+	// maliciously crafted tar file tries to trick us into reading many GBs
+	// into memory.
+	const paddingChunkSize = 1024 * 1024
+	var paddingChunk [paddingChunkSize]byte
+	for {
+		n, err := outputRdr.Read(paddingChunk[:])
+		if n != 0 {
+			if _, aerr := p.AddEntry(storage.Entry{
+				Type:    storage.SegmentType,
+				Payload: paddingChunk[:n],
+			}); aerr != nil {
+				return aerr
 			}
-			if isEOF {
+		}
+		if err != nil {
+			if err == io.EOF {
 				break
 			}
+			return err
 		}
-		pW.Close()
-	}()
+	}
+
+	return nil
+}
+
+// newInputTarStreamCommon sets up the shared plumbing for NewInputTarStream and
+// NewInputTarStreamWithDone.
+//
+// It constructs an io.Pipe and an io.TeeReader such that:
+//
+//   - The caller reads tar bytes from the returned *io.PipeReader.
+//   - The background goroutine simultaneously reads the same stream from the
+//     TeeReader to perform tar-split parsing and metadata packing.
+//
+// Abort and synchronization semantics:
+//
+//   - Closing the returned PipeReader causes the TeeReader to fail its write to
+//     the pipe, which in turn causes the background goroutine to exit promptly.
+//   - If withDone is true, a done channel is returned that receives exactly one
+//     error value (nil on success) once the background goroutine has fully
+//     terminated. This allows callers to safely wait until the input reader `r`
+//     is no longer in use.
+func newInputTarStreamCommon(
+	r io.Reader,
+	p storage.Packer,
+	fp storage.FilePutter,
+	done chan<- error,
+) (pr *io.PipeReader) {
+	// What to do here... folks will want their own access to the Reader that is
+	// their tar archive stream, but we'll need that same stream to use our
+	// forked 'archive/tar'.
+	// Perhaps do an io.TeeReader that hands back an io.Reader for them to read
+	// from, and we'll MITM the stream to store metadata.
+	// We'll need a storage.FilePutter too ...
+
+	// Another concern, whether to do any storage.FilePutter operations, such that we
+	// don't extract any amount of the archive. But then again, we're not making
+	// files/directories, hardlinks, etc. Just writing the io to the storage.FilePutter.
+	// Perhaps we have a DiscardFilePutter that is a bit bucket.
 
-	return pR, nil
+	// we'll return the pipe reader, since TeeReader does not buffer and will
+	// only read what the outputRdr Read's. Since Tar archives have padding on
+	// the end, we want to be the one reading the padding, even if the user's
+	// `archive/tar` doesn't care.
+	pr, pw := io.Pipe()
+
+	if fp == nil {
+		fp = storage.NewDiscardFilePutter()
+	}
+
+	outputRdr := io.TeeReader(r, pw)
+	go runInputTarStreamGoroutine(outputRdr, pw, p, fp, done)
+
+	return pr
+}
+
+// NewInputTarStream wraps the Reader stream of a tar archive and provides a
+// Reader stream of the same.
+//
+// In the middle it will pack the segments and file metadata to storage.Packer
+// `p`.
+//
+// The storage.FilePutter is where payload of files in the stream are
+// stashed. If this stashing is not needed, you can provide a nil
+// storage.FilePutter. Since the checksumming is still needed, then a default
+// of NewDiscardFilePutter will be used internally
+//
+// If callers need to be able to abort early and/or wait for goroutine termination,
+// prefer NewInputTarStreamWithDone.
+//
+// Deprecated: This leaves a goroutine around if the consumer aborts without consuming
+// the whole stream, and does not allow the caller to know when r is safe to deallocate
+// or when p has written everything. Use NewInputTarStreamWithDone instead.
+func NewInputTarStream(r io.Reader, p storage.Packer, fp storage.FilePutter) (io.Reader, error) {
+	pr := newInputTarStreamCommon(r, p, fp, nil)
+	return pr, nil
+}
+
+// NewInputTarStreamWithDone wraps the Reader stream of a tar archive and provides a
+// Reader stream of the same.
+//
+// In the middle it will pack the segments and file metadata to storage.Packer `p`.
+//
+// It also returns a done channel that will receive exactly one error value
+// (nil on success) when the internal goroutine has fully completed parsing
+// the tar stream (including the final paddingChunk draining loop) and has
+// finished writing all entries to `p`.
+//
+// The returned reader is an io.ReadCloser so callers can stop early; closing it
+// aborts the pipe so the internal goroutine can terminate promptly (rather than
+// hanging on a blocked pipe write).
+//
+// The caller is expected to consume the returned reader fully until EOF
+// (not just the tar EOF marker); closing the returned reader earlier will
+// cause the done channel to return a failure.
+func NewInputTarStreamWithDone(r io.Reader, p storage.Packer, fp storage.FilePutter) (io.ReadCloser, <-chan error, error) {
+	done := make(chan error, 1)
+	pr := newInputTarStreamCommon(r, p, fp, done)
+	return pr, done, nil
 }
diff --git a/vendor/github.com/vbatts/tar-split/tar/asm/iterate.go b/vendor/github.com/vbatts/tar-split/tar/asm/iterate.go
index 8a65887cf22..9db3ab509d6 100644
--- a/vendor/github.com/vbatts/tar-split/tar/asm/iterate.go
+++ b/vendor/github.com/vbatts/tar-split/tar/asm/iterate.go
@@ -11,7 +11,7 @@ import (
 
 // IterateHeaders calls handler for each tar header provided by Unpacker
 func IterateHeaders(unpacker storage.Unpacker, handler func(hdr *tar.Header) error) error {
-	// We assume about NewInputTarStream:
+	// We assume about NewInputTarStreamWithDone:
 	// - There is a separate SegmentType entry for every tar header, but only one SegmentType entry for the full header incl. any extensions
 	// - (There is a FileType entry for every tar header, we ignore it)
 	// - Trailing padding of a file, if any, is included in the next SegmentType entry
diff --git a/vendor/go.podman.io/common/pkg/config/containers.conf b/vendor/go.podman.io/common/pkg/config/containers.conf
index 49fd38390b8..9a6f38bfd28 100644
--- a/vendor/go.podman.io/common/pkg/config/containers.conf
+++ b/vendor/go.podman.io/common/pkg/config/containers.conf
@@ -936,9 +936,9 @@ default_sysctls = [
 #provider = ""
 
 # Rosetta supports running x86_64 Linux binaries on a Podman machine on Apple silicon.
-# The default value is `true`. Supported on AppleHV(arm64) machines only.
+# The default value is `false`. Supported on AppleHV(arm64) machines only.
 #
-#rosetta=true
+#rosetta=false
 
 # Import the host's trusted CA certificates into the machine.
 # When set to true, the certificates from the host system are imported during machine startup.
diff --git a/vendor/go.podman.io/common/pkg/config/default.go b/vendor/go.podman.io/common/pkg/config/default.go
index 7ea362f6bcf..a567bdc1110 100644
--- a/vendor/go.podman.io/common/pkg/config/default.go
+++ b/vendor/go.podman.io/common/pkg/config/default.go
@@ -274,7 +274,7 @@ func defaultMachineConfig() MachineConfig {
 		Memory:   2048,
 		User:     getDefaultMachineUser(),
 		Volumes:  configfile.NewSlice(getDefaultMachineVolumes()),
-		Rosetta:  true,
+		Rosetta:  false,
 	}
 }
 
diff --git a/vendor/go.podman.io/image/v5/docker/registries_d.go b/vendor/go.podman.io/image/v5/docker/registries_d.go
index 53bbb53cb10..6fe612160bf 100644
--- a/vendor/go.podman.io/image/v5/docker/registries_d.go
+++ b/vendor/go.podman.io/image/v5/docker/registries_d.go
@@ -3,42 +3,29 @@ package docker
 import (
 	"errors"
 	"fmt"
-	"io/fs"
+	"io"
 	"net/url"
-	"os"
 	"path"
 	"path/filepath"
-	"strings"
 
 	"github.com/opencontainers/go-digest"
 	"github.com/sirupsen/logrus"
 	"go.podman.io/image/v5/docker/reference"
 	"go.podman.io/image/v5/internal/rootless"
 	"go.podman.io/image/v5/types"
-	"go.podman.io/storage/pkg/fileutils"
+	"go.podman.io/storage/pkg/configfile"
 	"go.podman.io/storage/pkg/homedir"
+	"go.podman.io/storage/pkg/unshare"
 	"gopkg.in/yaml.v3"
 )
 
-// systemRegistriesDirPath is the path to registries.d, used for locating lookaside Docker signature storage.
-// You can override this at build time with
-// -ldflags '-X go.podman.io/image/v5/docker.systemRegistriesDirPath=$your_path'
-var systemRegistriesDirPath = builtinRegistriesDirPath
-
-// builtinRegistriesDirPath is the path to registries.d.
-// DO NOT change this, instead see systemRegistriesDirPath above.
-const builtinRegistriesDirPath = etcDir + "/containers/registries.d"
-
-// userRegistriesDirPath is the path to the per user registries.d.
-var userRegistriesDir = filepath.FromSlash(".config/containers/registries.d")
-
 // defaultUserDockerDir is the default lookaside directory for unprivileged user
 var defaultUserDockerDir = filepath.FromSlash(".local/share/containers/sigstore")
 
 // defaultDockerDir is the default lookaside directory for root
 var defaultDockerDir = "/var/lib/containers/sigstore"
 
-// registryConfiguration is one of the files in registriesDirPath configuring lookaside locations, or the result of merging them all.
+// registryConfiguration is one of the files configuring lookaside locations, or the result of merging them all.
 // NOTE: Keep this in sync with docs/registries.d.md!
 type registryConfiguration struct {
 	DefaultDocker *registryNamespace `yaml:"default-docker"`
@@ -78,91 +65,56 @@ func SignatureStorageBaseURL(sys *types.SystemContext, ref types.ImageReference,
 
 // loadRegistryConfiguration returns a registryConfiguration appropriate for sys.
 func loadRegistryConfiguration(sys *types.SystemContext) (*registryConfiguration, error) {
-	dirPath := registriesDirPath(sys)
-	logrus.Debugf(`Using registries.d directory %s`, dirPath)
-	return loadAndMergeConfig(dirPath)
-}
-
-// registriesDirPath returns a path to registries.d
-func registriesDirPath(sys *types.SystemContext) string {
-	return registriesDirPathWithHomeDir(sys, homedir.Get())
-}
-
-// registriesDirPathWithHomeDir is an internal implementation detail of registriesDirPath,
-// it exists only to allow testing it with an artificial home directory.
-func registriesDirPathWithHomeDir(sys *types.SystemContext, homeDir string) string {
-	if sys != nil && sys.RegistriesDirPath != "" {
-		return sys.RegistriesDirPath
-	}
-	userRegistriesDirPath := filepath.Join(homeDir, userRegistriesDir)
-	if err := fileutils.Exists(userRegistriesDirPath); err == nil {
-		return userRegistriesDirPath
-	}
-	if sys != nil && sys.RootForImplicitAbsolutePaths != "" {
-		return filepath.Join(sys.RootForImplicitAbsolutePaths, systemRegistriesDirPath)
+	registriesFiles := configfile.File{
+		Name:                           "registries",
+		Extension:                      "yaml",
+		DoNotLoadMainFiles:             true,
+		DoNotUseExtensionForConfigName: true,
+		UserId:                         unshare.GetRootlessUID(),
+		ErrorIfNotFound:                false,
+	}
+	if sys != nil {
+		registriesFiles.RootForImplicitAbsolutePaths = sys.RootForImplicitAbsolutePaths
+		if sys.RegistriesDirPath != "" {
+			registriesFiles.CustomConfigFileDropInDirectory = sys.RegistriesDirPath
+			logrus.Debugf(`Using registries.d directory %s`, registriesFiles.CustomConfigFileDropInDirectory)
+		}
 	}
-
-	return systemRegistriesDirPath
-}
-
-// loadAndMergeConfig loads configuration files in dirPath
-// FIXME: Probably rename to loadRegistryConfigurationForPath
-func loadAndMergeConfig(dirPath string) (*registryConfiguration, error) {
 	mergedConfig := registryConfiguration{Docker: map[string]registryNamespace{}}
 	dockerDefaultMergedFrom := ""
 	nsMergedFrom := map[string]string{}
-
-	dir, err := os.Open(dirPath)
-	if err != nil {
-		if os.IsNotExist(err) {
-			return &mergedConfig, nil
-		}
-		return nil, err
-	}
-	configNames, err := dir.Readdirnames(0)
-	if err != nil {
-		return nil, err
-	}
-	for _, configName := range configNames {
-		if !strings.HasSuffix(configName, ".yaml") {
-			continue
+	for item, err := range configfile.Read(&registriesFiles) {
+		if err != nil {
+			return nil, err
 		}
-		configPath := filepath.Join(dirPath, configName)
-		configBytes, err := os.ReadFile(configPath)
+		contents, err := io.ReadAll(item.Reader)
 		if err != nil {
-			if errors.Is(err, fs.ErrNotExist) {
-				// file must have been removed between the directory listing
-				// and the open call, ignore that as it is a expected race
-				continue
-			}
 			return nil, err
 		}
-
+		logrus.Debugf(`Reading registries signature storage configuration from %q`, item.Name)
 		var config registryConfiguration
-		err = yaml.Unmarshal(configBytes, &config)
-		if err != nil {
-			return nil, fmt.Errorf("parsing %s: %w", configPath, err)
+		if err := yaml.Unmarshal(contents, &config); err != nil {
+			return nil, fmt.Errorf("parsing %s: %w", item.Name, err)
 		}
 
 		if config.DefaultDocker != nil {
 			if mergedConfig.DefaultDocker != nil {
 				return nil, fmt.Errorf(`Error parsing signature storage configuration: "default-docker" defined both in %q and %q`,
-					dockerDefaultMergedFrom, configPath)
+					dockerDefaultMergedFrom, item.Name)
 			}
 			mergedConfig.DefaultDocker = config.DefaultDocker
-			dockerDefaultMergedFrom = configPath
+			dockerDefaultMergedFrom = item.Name
 		}
 
-		for nsName, nsConfig := range config.Docker { // includes config.Docker == nil
+		for nsName, nsConfig := range config.Docker {
 			if _, ok := mergedConfig.Docker[nsName]; ok {
 				return nil, fmt.Errorf(`Error parsing signature storage configuration: "docker" namespace %q defined both in %q and %q`,
-					nsName, nsMergedFrom[nsName], configPath)
+					nsName, nsMergedFrom[nsName], item.Name)
 			}
 			mergedConfig.Docker[nsName] = nsConfig
-			nsMergedFrom[nsName] = configPath
+			nsMergedFrom[nsName] = item.Name
 		}
 	}
-
 	return &mergedConfig, nil
 }
 
diff --git a/vendor/go.podman.io/storage/layers.go b/vendor/go.podman.io/storage/layers.go
index a70a6f8ba26..a7d508bdc94 100644
--- a/vendor/go.podman.io/storage/layers.go
+++ b/vendor/go.podman.io/storage/layers.go
@@ -2699,21 +2699,30 @@ func applyDiff(layerOptions *LayerOptions, diff io.Reader, tarSplitFile *os.File
 		if uncompressedDigester != nil {
 			uncompressedWriter = io.MultiWriter(uncompressedWriter, uncompressedDigester.Hash())
 		}
-		payload, err := asm.NewInputTarStream(io.TeeReader(uncompressed, uncompressedWriter), metadata, storage.NewDiscardFilePutter())
+		payload, done, err := asm.NewInputTarStreamWithDone(io.TeeReader(uncompressed, uncompressedWriter), metadata, storage.NewDiscardFilePutter())
 		if err != nil {
 			return -1, err
 		}
 
 		size, err := applyDriverFunc(payload)
 		if err != nil {
+			payload.Close()
+			<-done
 			return -1, err
 		}
 		// Fully consume the payload; it may contain trailing zero padding, and we need all of that
-		// recorded in tar-split (which happens when the data passes through NewInputTarStream).
+		// recorded in tar-split (which happens when the data passes through NewInputTarStreamWithDone).
 		if _, err := io.Copy(io.Discard, payload); err != nil {
+			payload.Close()
+			<-done
 			return -1, err
 		}
 
+		// Wait until tar-split has fully completed parsing and has drained the
+		// final padding loop. This prevents uncompressed.Close() races.
+		if doneErr := <-done; doneErr != nil {
+			return -1, doneErr
+		}
 		return size, nil
 	}()
 	if err != nil {
diff --git a/vendor/go.podman.io/storage/pkg/chunked/compressor/compressor.go b/vendor/go.podman.io/storage/pkg/chunked/compressor/compressor.go
index 85aced45780..3c13a507100 100644
--- a/vendor/go.podman.io/storage/pkg/chunked/compressor/compressor.go
+++ b/vendor/go.podman.io/storage/pkg/chunked/compressor/compressor.go
@@ -226,7 +226,7 @@ func newTarSplitData(createZstdWriter minimal.CreateZstdWriterFunc) (*tarSplitDa
 	}, nil
 }
 
-func writeZstdChunkedStream(destFile io.Writer, outMetadata map[string]string, reader io.Reader, createZstdWriter minimal.CreateZstdWriterFunc) error {
+func writeZstdChunkedStream(destFile io.Writer, outMetadata map[string]string, reader io.Reader, createZstdWriter minimal.CreateZstdWriterFunc) (retErr error) {
 	// total written so far.  Used to retrieve partial offsets in the file
 	dest := ioutils.NewWriteCounter(destFile)
 
@@ -240,10 +240,20 @@ func writeZstdChunkedStream(destFile io.Writer, outMetadata map[string]string, r
 		}
 	}()
 
-	its, err := asm.NewInputTarStream(reader, tarSplitData.packer, nil)
+	its, done, err := asm.NewInputTarStreamWithDone(reader, tarSplitData.packer, nil)
 	if err != nil {
 		return err
 	}
+	defer func() {
+		if its != nil {
+			its.Close()
+		}
+		if done != nil {
+			if doneErr := <-done; doneErr != nil && retErr == nil {
+				retErr = doneErr
+			}
+		}
+	}()
 
 	tr := tar.NewReader(its)
 	tr.RawAccounting = true
diff --git a/vendor/go.podman.io/storage/pkg/configfile/parse.go b/vendor/go.podman.io/storage/pkg/configfile/parse.go
index ad09f98fee0..eb397dcd929 100644
--- a/vendor/go.podman.io/storage/pkg/configfile/parse.go
+++ b/vendor/go.podman.io/storage/pkg/configfile/parse.go
@@ -384,7 +384,7 @@ func readDropInsFromPaths(paths []string, suffix string) ([]string, error) {
 			return nil, err
 		}
 		for _, entry := range entries {
-			if entry.Type().IsRegular() && strings.HasSuffix(entry.Name(), suffix) {
+			if !entry.IsDir() && strings.HasSuffix(entry.Name(), suffix) {
 				dropInMap[entry.Name()] = filepath.Join(path, entry.Name())
 			}
 		}
diff --git a/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go b/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go
index 56723d1f82e..77aad553d5b 100644
--- a/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go
+++ b/vendor/golang.org/x/tools/go/types/objectpath/objectpath.go
@@ -524,7 +524,7 @@ func (f *finder) find(T types.Type, path []byte) []byte {
 		for i := 0; i < T.NumMethods(); i++ {
 			m := T.Method(i)
 			if f.seenMethods[m] {
-				return nil
+				continue // break cycles (see TestIssue70418)
 			}
 			path2 := appendOpArg(path, opMethod, i)
 			if m == f.obj {
diff --git a/vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.go b/vendor/golang.org/x/tools/internal/gcimporter/ureader.go
similarity index 88%
rename from vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.go
rename to vendor/golang.org/x/tools/internal/gcimporter/ureader.go
index 2e0d80585f3..3db62b89089 100644
--- a/vendor/golang.org/x/tools/internal/gcimporter/ureader_yes.go
+++ b/vendor/golang.org/x/tools/internal/gcimporter/ureader.go
@@ -35,6 +35,10 @@ type pkgReader struct {
 
 	// laterFns holds functions that need to be invoked at the end of
 	// import reading.
+	//
+	// TODO(mdempsky): Is it safe to have a single "later" slice or do
+	// we need to have multiple passes? See comments on CL 386002 and
+	// go.dev/issue/52104.
 	laterFns []func()
 	// laterFors is used in case of 'type A B' to ensure that B is processed before A.
 	laterFors map[types.Type]int
@@ -158,12 +162,11 @@ type reader struct {
 // A readerDict holds the state for type parameters that parameterize
 // the current unified IR element.
 type readerDict struct {
-	// bounds is a slice of typeInfos corresponding to the underlying
-	// bounds of the element's type parameters.
-	bounds []typeInfo
+	rtbounds []typeInfo         // contains constraint types for each parameter in rtparams
+	rtparams []*types.TypeParam // contains receiver type parameters for an element
 
-	// tparams is a slice of the constructed TypeParams for the element.
-	tparams []*types.TypeParam
+	tbounds []typeInfo         // contains constraint types for each parameter in tparams
+	tparams []*types.TypeParam // contains type parameters for an element
 
 	// derived is a slice of types derived from tparams, which may be
 	// instantiated while reading the current element.
@@ -353,7 +356,11 @@ func (r *reader) doTyp() (res types.Type) {
 		return name.Type()
 
 	case pkgbits.TypeTypeParam:
-		return r.dict.tparams[r.Len()]
+		n := r.Len()
+		if n < len(r.dict.rtbounds) {
+			return r.dict.rtparams[n]
+		}
+		return r.dict.tparams[n-len(r.dict.rtbounds)]
 
 	case pkgbits.TypeArray:
 		len := int64(r.Uint64())
@@ -534,7 +541,7 @@ func (pr *pkgReader) objIdx(idx pkgbits.Index) (*types.Package, string) {
 			pos := r.pos()
 			var tparams []*types.TypeParam
 			if r.Version().Has(pkgbits.AliasTypeParamNames) {
-				tparams = r.typeParamNames()
+				tparams = r.typeParamNames(false)
 			}
 			typ := r.typ()
 			declare(aliases.New(pos, objPkg, objName, typ, tparams))
@@ -547,8 +554,15 @@ func (pr *pkgReader) objIdx(idx pkgbits.Index) (*types.Package, string) {
 
 		case pkgbits.ObjFunc:
 			pos := r.pos()
-			tparams := r.typeParamNames()
-			sig := r.signature(nil, nil, tparams)
+			var rtparams []*types.TypeParam
+			var recv *types.Var
+			if r.Version().Has(pkgbits.GenericMethods) && r.Bool() {
+				r.selector()
+				rtparams = r.typeParamNames(true)
+				recv = r.param()
+			}
+			tparams := r.typeParamNames(false)
+			sig := r.signature(recv, rtparams, tparams)
 			declare(types.NewFunc(pos, objPkg, objName, sig))
 
 		case pkgbits.ObjType:
@@ -558,7 +572,7 @@ func (pr *pkgReader) objIdx(idx pkgbits.Index) (*types.Package, string) {
 			named := types.NewNamed(obj, nil, nil)
 			declare(obj)
 
-			named.SetTypeParams(r.typeParamNames())
+			named.SetTypeParams(r.typeParamNames(false))
 
 			setUnderlying := func(underlying types.Type) {
 				// If the underlying type is an interface, we need to
@@ -638,9 +652,20 @@ func (pr *pkgReader) objDictIdx(idx pkgbits.Index) *readerDict {
 			errorf("unexpected object with %v implicit type parameter(s)", implicits)
 		}
 
-		dict.bounds = make([]typeInfo, r.Len())
-		for i := range dict.bounds {
-			dict.bounds[i] = r.typInfo()
+		nreceivers := 0
+		if r.Version().Has(pkgbits.GenericMethods) && r.Bool() {
+			nreceivers = r.Len()
+		}
+		nexplicits := r.Len()
+
+		dict.rtbounds = make([]typeInfo, nreceivers)
+		for i := range dict.rtbounds {
+			dict.rtbounds[i] = r.typInfo()
+		}
+
+		dict.tbounds = make([]typeInfo, nexplicits)
+		for i := range dict.tbounds {
+			dict.tbounds[i] = r.typInfo()
 		}
 
 		dict.derived = make([]derivedInfo, r.Len())
@@ -659,15 +684,24 @@ func (pr *pkgReader) objDictIdx(idx pkgbits.Index) *readerDict {
 	return &dict
 }
 
-func (r *reader) typeParamNames() []*types.TypeParam {
+func (r *reader) typeParamNames(isGenMeth bool) []*types.TypeParam {
 	r.Sync(pkgbits.SyncTypeParamNames)
 
-	// Note: This code assumes it only processes objects without
-	// implement type parameters. This is currently fine, because
-	// reader is only used to read in exported declarations, which are
-	// always package scoped.
+	// Note: This code assumes there are no implicit type parameters.
+	// This is fine since it only reads exported declarations, which
+	// never have implicits.
 
-	if len(r.dict.bounds) == 0 {
+	var in []typeInfo
+	var out *[]*types.TypeParam
+	if isGenMeth {
+		in = r.dict.rtbounds
+		out = &r.dict.rtparams
+	} else {
+		in = r.dict.tbounds
+		out = &r.dict.tparams
+	}
+
+	if len(in) == 0 {
 		return nil
 	}
 
@@ -676,40 +710,34 @@ func (r *reader) typeParamNames() []*types.TypeParam {
 	// create all the TypeNames and TypeParams, then we construct and
 	// set the bound type.
 
-	r.dict.tparams = make([]*types.TypeParam, len(r.dict.bounds))
-	for i := range r.dict.bounds {
+	// We have to save tparams outside of the closure, because typeParamNames
+	// can be called multiple times with the same dictionary instance.
+	tparams := make([]*types.TypeParam, len(in))
+	*out = tparams
+
+	for i := range in {
 		pos := r.pos()
 		pkg, name := r.localIdent()
 
 		tname := types.NewTypeName(pos, pkg, name, nil)
-		r.dict.tparams[i] = types.NewTypeParam(tname, nil)
+		tparams[i] = types.NewTypeParam(tname, nil)
 	}
 
-	typs := make([]types.Type, len(r.dict.bounds))
-	for i, bound := range r.dict.bounds {
-		typs[i] = r.p.typIdx(bound, r.dict)
+	// The reader dictionary will continue mutating before we have time
+	// to call delayed functions; make a local copy of the constraints.
+	types := make([]types.Type, len(in))
+	for i, info := range in {
+		types[i] = r.p.typIdx(info, r.dict)
 	}
 
-	// TODO(mdempsky): This is subtle, elaborate further.
-	//
-	// We have to save tparams outside of the closure, because
-	// typeParamNames() can be called multiple times with the same
-	// dictionary instance.
-	//
-	// Also, this needs to happen later to make sure SetUnderlying has
-	// been called.
-	//
-	// TODO(mdempsky): Is it safe to have a single "later" slice or do
-	// we need to have multiple passes? See comments on CL 386002 and
-	// go.dev/issue/52104.
-	tparams := r.dict.tparams
+	// This needs to happen later to make sure SetUnderlying has been called.
 	r.p.later(func() {
-		for i, typ := range typs {
+		for i, typ := range types {
 			tparams[i].SetConstraint(typ)
 		}
 	})
 
-	return r.dict.tparams
+	return tparams
 }
 
 func (r *reader) method() *types.Func {
@@ -717,7 +745,7 @@ func (r *reader) method() *types.Func {
 	pos := r.pos()
 	pkg, name := r.selector()
 
-	rparams := r.typeParamNames()
+	rparams := r.typeParamNames(false)
 	sig := r.signature(r.param(), rparams, nil)
 
 	_ = r.pos() // TODO(mdempsky): Remove; this is a hacker for linker.go.
diff --git a/vendor/golang.org/x/tools/internal/gocommand/version.go b/vendor/golang.org/x/tools/internal/gocommand/version.go
index 446c5846a60..cce290c4194 100644
--- a/vendor/golang.org/x/tools/internal/gocommand/version.go
+++ b/vendor/golang.org/x/tools/internal/gocommand/version.go
@@ -26,6 +26,9 @@ func GoVersion(ctx context.Context, inv Invocation, r *Runner) (int, error) {
 	inv.BuildFlags = nil // This is not a build command.
 	inv.ModFlag = ""
 	inv.ModFile = ""
+	// Set GO111MODULE=off so that we are immune to errors in go.{work,mod}.
+	// Unfortunately, this breaks the Go 1.21+ toolchain directive and
+	// may affect the set of ReleaseTags; see #68495.
 	inv.Env = append(inv.Env[:len(inv.Env):len(inv.Env)], "GO111MODULE=off")
 
 	stdoutBytes, err := r.Run(ctx, inv)
diff --git a/vendor/golang.org/x/tools/internal/pkgbits/version.go b/vendor/golang.org/x/tools/internal/pkgbits/version.go
index 53af9df22b3..0db96527480 100644
--- a/vendor/golang.org/x/tools/internal/pkgbits/version.go
+++ b/vendor/golang.org/x/tools/internal/pkgbits/version.go
@@ -28,6 +28,15 @@ const (
 	// - remove derived info "needed" bool
 	V2
 
+	// V3: introduces a more compact format for composite literal element lists
+	// - negative lengths indicate that (some) elements may have keys
+	// - positive lengths indicate that no element has a key
+	// - a negative struct field index indicates an embedded field
+	V3
+
+	// V4: encodes generic methods as standalone function objects
+	V4
+
 	numVersions = iota
 )
 
@@ -61,6 +70,12 @@ const (
 	// whether a type was a derived type.
 	DerivedInfoNeeded
 
+	// Composite literals use a more compact format for element lists.
+	CompactCompLiterals
+
+	// Generic methods may appear as standalone function objects.
+	GenericMethods
+
 	numFields = iota
 )
 
@@ -68,6 +83,8 @@ const (
 var introduced = [numFields]Version{
 	Flags:               V1,
 	AliasTypeParamNames: V2,
+	CompactCompLiterals: V3,
+	GenericMethods:      V4,
 }
 
 // removed is the version a field was removed in or 0 for fields
diff --git a/vendor/golang.org/x/tools/internal/typeparams/coretype.go b/vendor/golang.org/x/tools/internal/typeparams/coretype.go
index 27a2b179299..2e05de4649a 100644
--- a/vendor/golang.org/x/tools/internal/typeparams/coretype.go
+++ b/vendor/golang.org/x/tools/internal/typeparams/coretype.go
@@ -11,7 +11,9 @@ import (
 
 // CoreType returns the core type of T or nil if T does not have a core type.
 //
-// See https://go.dev/ref/spec#Core_types for the definition of a core type.
+// As of Go1.25, the notion of a core type has been removed from the language spec.
+// See https://go.dev/blog/coretypes for more details.
+// TODO(mkalil): We should eventually consider removing all uses of CoreType.
 func CoreType(T types.Type) types.Type {
 	U := T.Underlying()
 	if _, ok := U.(*types.Interface); !ok {
@@ -34,7 +36,7 @@ func CoreType(T types.Type) types.Type {
 	}
 
 	if identical == len(terms) {
-		// https://go.dev/ref/spec#Core_types
+		// From the deprecated core types spec:
 		// "There is a single type U which is the underlying type of all types in the type set of T"
 		return U
 	}
@@ -42,7 +44,7 @@ func CoreType(T types.Type) types.Type {
 	if !ok {
 		return nil // no core type as identical < len(terms) and U is not a channel.
 	}
-	// https://go.dev/ref/spec#Core_types
+	// From the deprecated core types spec:
 	// "the type chan E if T contains only bidirectional channels, or the type chan<- E or
 	// <-chan E depending on the direction of the directional channels present."
 	for chans := identical; chans < len(terms); chans++ {
diff --git a/vendor/golang.org/x/tools/internal/typesinternal/types.go b/vendor/golang.org/x/tools/internal/typesinternal/types.go
index 7112318fc2a..6582cc81f5a 100644
--- a/vendor/golang.org/x/tools/internal/typesinternal/types.go
+++ b/vendor/golang.org/x/tools/internal/typesinternal/types.go
@@ -194,3 +194,51 @@ func Imports(pkg *types.Package, path string) bool {
 	}
 	return false
 }
+
+// ObjectKind returns a description of the object's kind.
+//
+// from objectKind in go/types
+func ObjectKind(obj types.Object) string {
+	switch obj := obj.(type) {
+	case *types.PkgName:
+		return "package name"
+	case *types.Const:
+		return "constant"
+	case *types.TypeName:
+		if obj.IsAlias() {
+			return "type alias"
+		} else if _, ok := obj.Type().(*types.TypeParam); ok {
+			return "type parameter"
+		} else {
+			return "defined type"
+		}
+	case *types.Var:
+		switch obj.Kind() {
+		case PackageVar:
+			return "package-level variable"
+		case LocalVar:
+			return "local variable"
+		case RecvVar:
+			return "receiver"
+		case ParamVar:
+			return "parameter"
+		case ResultVar:
+			return "result variable"
+		case FieldVar:
+			return "struct field"
+		}
+	case *types.Func:
+		if obj.Signature().Recv() != nil {
+			return "method"
+		} else {
+			return "function"
+		}
+	case *types.Label:
+		return "label"
+	case *types.Builtin:
+		return "built-in function"
+	case *types.Nil:
+		return "untyped nil"
+	}
+	return "unknown symbol"
+}
diff --git a/vendor/golang.org/x/tools/internal/versions/features.go b/vendor/golang.org/x/tools/internal/versions/features.go
index cdd36c388ab..360a5b55297 100644
--- a/vendor/golang.org/x/tools/internal/versions/features.go
+++ b/vendor/golang.org/x/tools/internal/versions/features.go
@@ -19,6 +19,7 @@ const (
 	Go1_24 = "go1.24"
 	Go1_25 = "go1.25"
 	Go1_26 = "go1.26"
+	Go1_27 = "go1.27"
 )
 
 // Future is an invalid unknown Go version sometime in the future.
diff --git a/vendor/modules.txt b/vendor/modules.txt
index d33e24a564d..7b00ec0efd1 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -262,7 +262,7 @@ github.com/google/go-containerregistry/pkg/v1/types
 # github.com/google/go-intervals v0.0.2
 ## explicit; go 1.12
 github.com/google/go-intervals/intervalset
-# github.com/google/pprof v0.0.0-20260115054156-294ebfa9ad83
+# github.com/google/pprof v0.0.0-20260402051712-545e8a4df936
 ## explicit; go 1.24.0
 github.com/google/pprof/profile
 # github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
@@ -443,8 +443,8 @@ github.com/nxadm/tail/ratelimiter
 github.com/nxadm/tail/util
 github.com/nxadm/tail/watch
 github.com/nxadm/tail/winfile
-# github.com/onsi/ginkgo/v2 v2.28.2
-## explicit; go 1.24.0
+# github.com/onsi/ginkgo/v2 v2.28.3
+## explicit; go 1.25.0
 github.com/onsi/ginkgo/v2
 github.com/onsi/ginkgo/v2/config
 github.com/onsi/ginkgo/v2/formatter
@@ -467,7 +467,7 @@ github.com/onsi/ginkgo/v2/internal/reporters
 github.com/onsi/ginkgo/v2/internal/testingtproxy
 github.com/onsi/ginkgo/v2/reporters
 github.com/onsi/ginkgo/v2/types
-# github.com/onsi/gomega v1.39.1
+# github.com/onsi/gomega v1.40.0
 ## explicit; go 1.24.0
 github.com/onsi/gomega
 github.com/onsi/gomega/format
@@ -637,8 +637,8 @@ github.com/ulikunitz/xz
 github.com/ulikunitz/xz/internal/hash
 github.com/ulikunitz/xz/internal/xlog
 github.com/ulikunitz/xz/lzma
-# github.com/vbatts/tar-split v0.12.2
-## explicit; go 1.17
+# github.com/vbatts/tar-split v0.12.3
+## explicit; go 1.22.0
 github.com/vbatts/tar-split/archive/tar
 github.com/vbatts/tar-split/tar/asm
 github.com/vbatts/tar-split/tar/storage
@@ -736,7 +736,7 @@ go.podman.io/buildah/pkg/sshagent
 go.podman.io/buildah/pkg/util
 go.podman.io/buildah/pkg/volumes
 go.podman.io/buildah/util
-# go.podman.io/common v0.67.2-0.20260428163628-e3b0c9aa788d
+# go.podman.io/common v0.67.2-0.20260428163628-e3b0c9aa788d => github.com/jankaluza/container-libs/common v0.0.0-20260429095922-ccf4fb27ad49
 ## explicit; go 1.25.6
 go.podman.io/common/internal
 go.podman.io/common/libimage
@@ -802,7 +802,7 @@ go.podman.io/common/pkg/umask
 go.podman.io/common/pkg/util
 go.podman.io/common/pkg/version
 go.podman.io/common/version
-# go.podman.io/image/v5 v5.39.3-0.20260428163628-e3b0c9aa788d
+# go.podman.io/image/v5 v5.39.3-0.20260428163628-e3b0c9aa788d => github.com/jankaluza/container-libs/image/v5 v5.0.0-20260429095922-ccf4fb27ad49
 ## explicit; go 1.25.6
 go.podman.io/image/v5/copy
 go.podman.io/image/v5/directory
@@ -879,7 +879,7 @@ go.podman.io/image/v5/transports
 go.podman.io/image/v5/transports/alltransports
 go.podman.io/image/v5/types
 go.podman.io/image/v5/version
-# go.podman.io/storage v1.62.1-0.20260428163628-e3b0c9aa788d
+# go.podman.io/storage v1.62.1-0.20260428163628-e3b0c9aa788d => github.com/jankaluza/container-libs/storage v0.0.0-20260429095922-ccf4fb27ad49
 ## explicit; go 1.25.0
 go.podman.io/storage
 go.podman.io/storage/drivers
@@ -965,7 +965,7 @@ golang.org/x/crypto/ssh/internal/bcrypt_pbkdf
 golang.org/x/crypto/ssh/knownhosts
 golang.org/x/crypto/twofish
 golang.org/x/crypto/xts
-# golang.org/x/mod v0.34.0
+# golang.org/x/mod v0.35.0
 ## explicit; go 1.25.0
 golang.org/x/mod/semver
 # golang.org/x/net v0.53.0
@@ -1025,7 +1025,7 @@ golang.org/x/text/secure/bidirule
 golang.org/x/text/transform
 golang.org/x/text/unicode/bidi
 golang.org/x/text/unicode/norm
-# golang.org/x/tools v0.43.0
+# golang.org/x/tools v0.44.0
 ## explicit; go 1.25.0
 golang.org/x/tools/cover
 golang.org/x/tools/go/ast/edge
@@ -1182,3 +1182,6 @@ tags.cncf.io/container-device-interface/pkg/parser
 # tags.cncf.io/container-device-interface/specs-go v1.1.0
 ## explicit; go 1.19
 tags.cncf.io/container-device-interface/specs-go
+# go.podman.io/common => github.com/jankaluza/container-libs/common v0.0.0-20260429095922-ccf4fb27ad49
+# go.podman.io/image/v5 => github.com/jankaluza/container-libs/image/v5 v5.0.0-20260429095922-ccf4fb27ad49
+# go.podman.io/storage => github.com/jankaluza/container-libs/storage v0.0.0-20260429095922-ccf4fb27ad49