chore(deps): bump the go group with 24 updates (#5638)

Bumps the go group with 24 updates: | Package | From | To | | --- | --- | --- | | [cloud.google.com/go/storage](https://github.com/googleapis/google-cloud-go) | `1.53.0` | `1.55.0` | | [github.com/VictoriaMetrics/fastcache](https://github.com/VictoriaMetrics/fastcache) | `1.12.2` | `1.12.4` | | [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2) | `1.79.3` | `1.80.0` | | [github.com/docker/docker](https://github.com/docker/docker) | `28.1.1+incompatible` | `28.2.2+incompatible` | | [github.com/exaring/otelpgx](https://github.com/exaring/otelpgx) | `0.9.1` | `0.9.3` | | [github.com/google/go-jsonnet](https://github.com/google/go-jsonnet) | `0.20.0` | `0.21.0` | | [github.com/jackc/pgx/v5](https://github.com/jackc/pgx) | `5.7.4` | `5.7.5` | | [github.com/miekg/dns](https://github.com/miekg/dns) | `1.1.65` | `1.1.66` | | [github.com/minio/minio-go/v7](https://github.com/minio/minio-go) | `7.0.91` | `7.0.92` | | [github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa) | `1.4.2` | `1.5.0` | | [github.com/pires/go-proxyproto](https://github.com/pires/go-proxyproto) | `0.8.0` | `0.8.1` | | [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go) | `0.51.0` | `0.52.0` | | [go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.60.0` | `0.61.0` | | [go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.60.0` | `0.61.0` | | [go.opentelemetry.io/contrib/propagators/autoprop](https://github.com/open-telemetry/opentelemetry-go-contrib) | `0.60.0` | `0.61.0` | | [go.opentelemetry.io/otel/bridge/opencensus](https://github.com/open-telemetry/opentelemetry-go) | `1.35.0` | `1.36.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.35.0` | `1.36.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace](https://github.com/open-telemetry/opentelemetry-go) | `1.35.0` | `1.36.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc](https://github.com/open-telemetry/opentelemetry-go) | `1.35.0` | `1.36.0` | | [go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp](https://github.com/open-telemetry/opentelemetry-go) | `1.35.0` | `1.36.0` | | [go.opentelemetry.io/proto/otlp](https://github.com/open-telemetry/opentelemetry-proto-go) | `1.6.0` | `1.7.0` | | [google.golang.org/api](https://github.com/googleapis/google-api-go-client) | `0.230.0` | `0.235.0` | | [google.golang.org/genproto/googleapis/rpc](https://github.com/googleapis/go-genproto) | `0.0.0-20250428153025-10db94c68c34` | `0.0.0-20250528174236-200df99c418a` | | [google.golang.org/grpc](https://github.com/grpc/grpc-go) | `1.72.0` | `1.72.2` | Updates `cloud.google.com/go/storage` from 1.53.0 to 1.55.0 - [Release notes](https://github.com/googleapis/google-cloud-go/releases) - [Changelog](https://github.com/googleapis/google-cloud-go/blob/main/CHANGES.md) - [Commits](googleapis/google-cloud-go@spanner/v1.53.0...spanner/v1.55.0) Updates `github.com/VictoriaMetrics/fastcache` from 1.12.2 to 1.12.4 - [Release notes](https://github.com/VictoriaMetrics/fastcache/releases) - [Commits](VictoriaMetrics/fastcache@v1.12.2...v1.12.4) Updates `github.com/aws/aws-sdk-go-v2/service/s3` from 1.79.3 to 1.80.0 - [Release notes](https://github.com/aws/aws-sdk-go-v2/releases) - [Changelog](https://github.com/aws/aws-sdk-go-v2/blob/main/changelog-template.json) - [Commits](aws/aws-sdk-go-v2@service/s3/v1.79.3...service/s3/v1.80.0) Updates `github.com/docker/docker` from 28.1.1+incompatible to 28.2.2+incompatible - [Release notes](https://github.com/docker/docker/releases) - [Commits](moby/moby@v28.1.1...v28.2.2) Updates `github.com/exaring/otelpgx` from 0.9.1 to 0.9.3 - [Release notes](https://github.com/exaring/otelpgx/releases) - [Commits](exaring/otelpgx@v0.9.1...v0.9.3) Updates `github.com/google/go-jsonnet` from 0.20.0 to 0.21.0 - [Release notes](https://github.com/google/go-jsonnet/releases) - [Changelog](https://github.com/google/go-jsonnet/blob/master/.goreleaser.yml) - [Commits](google/go-jsonnet@v0.20.0...v0.21.0) Updates `github.com/jackc/pgx/v5` from 5.7.4 to 5.7.5 - [Changelog](https://github.com/jackc/pgx/blob/master/CHANGELOG.md) - [Commits](jackc/pgx@v5.7.4...v5.7.5) Updates `github.com/miekg/dns` from 1.1.65 to 1.1.66 - [Changelog](https://github.com/miekg/dns/blob/master/Makefile.release) - [Commits](miekg/dns@v1.1.65...v1.1.66) Updates `github.com/minio/minio-go/v7` from 7.0.91 to 7.0.92 - [Release notes](https://github.com/minio/minio-go/releases) - [Commits](minio/minio-go@v7.0.91...v7.0.92) Updates `github.com/open-policy-agent/opa` from 1.4.2 to 1.5.0 - [Release notes](https://github.com/open-policy-agent/opa/releases) - [Changelog](https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md) - [Commits](open-policy-agent/opa@v1.4.2...v1.5.0) Updates `github.com/pires/go-proxyproto` from 0.8.0 to 0.8.1 - [Release notes](https://github.com/pires/go-proxyproto/releases) - [Commits](pires/go-proxyproto@v0.8.0...v0.8.1) Updates `github.com/quic-go/quic-go` from 0.51.0 to 0.52.0 - [Release notes](https://github.com/quic-go/quic-go/releases) - [Commits](quic-go/quic-go@v0.51.0...v0.52.0) Updates `go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc` from 0.60.0 to 0.61.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.60.0...zpages/v0.61.0) Updates `go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp` from 0.60.0 to 0.61.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.60.0...zpages/v0.61.0) Updates `go.opentelemetry.io/contrib/propagators/autoprop` from 0.60.0 to 0.61.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go-contrib/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go-contrib/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go-contrib@zpages/v0.60.0...zpages/v0.61.0) Updates `go.opentelemetry.io/otel/bridge/opencensus` from 1.35.0 to 1.36.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.35.0...v1.36.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc` from 1.35.0 to 1.36.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.35.0...v1.36.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace` from 1.35.0 to 1.36.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.35.0...v1.36.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc` from 1.35.0 to 1.36.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.35.0...v1.36.0) Updates `go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp` from 1.35.0 to 1.36.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases) - [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md) - [Commits](open-telemetry/opentelemetry-go@v1.35.0...v1.36.0) Updates `go.opentelemetry.io/proto/otlp` from 1.6.0 to 1.7.0 - [Release notes](https://github.com/open-telemetry/opentelemetry-proto-go/releases) - [Commits](open-telemetry/opentelemetry-proto-go@v1.6.0...v1.7.0) Updates `google.golang.org/api` from 0.230.0 to 0.235.0 - [Release notes](https://github.com/googleapis/google-api-go-client/releases) - [Changelog](https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md) - [Commits](googleapis/google-api-go-client@v0.230.0...v0.235.0) Updates `google.golang.org/genproto/googleapis/rpc` from 0.0.0-20250428153025-10db94c68c34 to 0.0.0-20250528174236-200df99c418a - [Commits](https://github.com/googleapis/go-genproto/commits) Updates `google.golang.org/grpc` from 1.72.0 to 1.72.2 - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](grpc/grpc-go@v1.72.0...v1.72.2) --- updated-dependencies: - dependency-name: cloud.google.com/go/storage dependency-version: 1.55.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/VictoriaMetrics/fastcache dependency-version: 1.12.4 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/aws/aws-sdk-go-v2/service/s3 dependency-version: 1.80.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/docker/docker dependency-version: 28.2.2+incompatible dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/exaring/otelpgx dependency-version: 0.9.3 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/google/go-jsonnet dependency-version: 0.21.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/jackc/pgx/v5 dependency-version: 5.7.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/miekg/dns dependency-version: 1.1.66 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/minio/minio-go/v7 dependency-version: 7.0.92 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/open-policy-agent/opa dependency-version: 1.5.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: github.com/pires/go-proxyproto dependency-version: 0.8.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: github.com/quic-go/quic-go dependency-version: 0.52.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc dependency-version: 0.61.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp dependency-version: 0.61.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: go.opentelemetry.io/contrib/propagators/autoprop dependency-version: 0.61.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: go.opentelemetry.io/otel/bridge/opencensus dependency-version: 1.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc dependency-version: 1.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace dependency-version: 1.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc dependency-version: 1.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp dependency-version: 1.36.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: go.opentelemetry.io/proto/otlp dependency-version: 1.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: google.golang.org/api dependency-version: 0.235.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: go - dependency-name: google.golang.org/genproto/googleapis/rpc dependency-version: 0.0.0-20250528174236-200df99c418a dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go - dependency-name: google.golang.org/grpc dependency-version: 1.72.2 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: go ... Signed-off-by: dependabot[bot] <support@github.com>
2025-07-07 11:58:12 +02:00 · 2025-06-17 09:36:50 -07:00 · 2025-06-17 09:36:50 -07:00 · b0c2e2dede
commit b0c2e2dede
parent 3cf420afc9
101 changed files with 470 additions and 486 deletions
--- a/authenticate/authenticate_test.go
+++ b/authenticate/authenticate_test.go
@ -1,7 +1,6 @@
 package authenticate

 import (
-	"context"
 	"testing"

 	"github.com/pomerium/pomerium/config"
@ -105,7 +104,7 @@ func TestNew(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			_, err := New(context.Background(), &config.Config{Options: tt.opts})
+			_, err := New(t.Context(), &config.Config{Options: tt.opts})
 			if (err != nil) != tt.wantErr {
 				t.Errorf("New() error = %v, wantErr %v", err, tt.wantErr)
 				return
--- a/authenticate/handlers_test.go
+++ b/authenticate/handlers_test.go
@ -43,7 +43,7 @@ import (
 func testAuthenticate(t *testing.T) *Authenticate {
 	opts := newTestOptions(t)
 	opts.AuthenticateURLString = "https://auth.example.com/oauth/callback"
-	auth, err := New(context.Background(), &config.Config{
+	auth, err := New(t.Context(), &config.Config{
 		Options: opts,
 	})
 	if err != nil {
--- a/authorize/access_tracker_test.go
+++ b/authorize/access_tracker_test.go
@ -27,7 +27,7 @@ func (provider *testAccessTrackerProvider) GetDataBrokerServiceClient() databrok
 }

 func TestAccessTracker(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(t.Context())
 	defer cancel()

 	var mu sync.Mutex
--- a/authorize/authorize_test.go
+++ b/authorize/authorize_test.go
@ -1,7 +1,6 @@
 package authorize

 import (
-	"context"
 	"testing"

 	"github.com/stretchr/testify/assert"
@ -81,7 +80,7 @@ func TestNew(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			t.Parallel()
-			_, err := New(context.Background(), &config.Config{Options: &tt.config})
+			_, err := New(t.Context(), &config.Config{Options: &tt.config})
 			if (err != nil) != tt.wantErr {
 				t.Errorf("New() error = %v, wantErr %v", err, tt.wantErr)
 				return
@ -112,7 +111,7 @@ func TestAuthorize_OnConfigChange(t *testing.T) {
 				SharedKey:             tc.SharedKey,
 				Policies:              tc.Policies,
 			}
-			a, err := New(context.Background(), &config.Config{Options: o})
+			a, err := New(t.Context(), &config.Config{Options: o})
 			require.NoError(t, err)
 			require.NotNil(t, a)

@ -124,7 +123,7 @@ func TestAuthorize_OnConfigChange(t *testing.T) {
 				o.SigningKey = "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUhHNHZDWlJxUFgwNGtmSFQxeVVDM1pUQkF6MFRYWkNtZ043clpDcFE3cHJvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFbzQzdjAwQlR4c3pKZWpmdHhBOWNtVGVUSmtQQXVtOGt1b0UwVlRUZnlId2k3SHJlN2FRUgpHQVJ6Nm0wMjVRdGFiRGxqeDd5MjIyY1gxblhCQXo3MlF3PT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo="
 				assertFunc = assert.False
 			}
-			a.OnConfigChange(context.Background(), cfg)
+			a.OnConfigChange(t.Context(), cfg)
 			assertFunc(t, oldPe == a.state.Load().evaluator)
 		})
 	}
@ -183,10 +182,10 @@ func TestNewPolicyEvaluator_addDefaultClientCertificateRule(t *testing.T) {
 			c.opts.Policies = []config.Policy{{
 				To: mustParseWeightedURLs(t, "http://example.com"),
 			}}
-			e, err := newPolicyEvaluator(context.Background(), c.opts, store, nil)
+			e, err := newPolicyEvaluator(t.Context(), c.opts, store, nil)
 			require.NoError(t, err)

-			r, err := e.Evaluate(context.Background(), &evaluator.Request{
+			r, err := e.Evaluate(t.Context(), &evaluator.Request{
 				Policy: &c.opts.Policies[0],
 				HTTP:   evaluator.RequestHTTP{},
 			})
--- a/authorize/check_response_test.go
+++ b/authorize/check_response_test.go
@ -1,7 +1,6 @@
 package authorize

 import (
-	"context"
 	"fmt"
 	"net/http"
 	"net/http/httptest"
@ -35,11 +34,11 @@ func TestAuthorize_handleResult(t *testing.T) {
 	t.Cleanup(authnSrv.Close)
 	opt.AuthenticateURLString = authnSrv.URL

-	a, err := New(context.Background(), &config.Config{Options: opt})
+	a, err := New(t.Context(), &config.Config{Options: opt})
 	require.NoError(t, err)

 	t.Run("user-unauthenticated", func(t *testing.T) {
-		res, err := a.handleResult(context.Background(),
+		res, err := a.handleResult(t.Context(),
 			&envoy_service_auth_v3.CheckRequest{},
 			&evaluator.Request{},
 			&evaluator.Result{
@ -48,7 +47,7 @@ func TestAuthorize_handleResult(t *testing.T) {
 		assert.NoError(t, err)
 		assert.Equal(t, 302, int(res.GetDeniedResponse().GetStatus().GetCode()))

-		res, err = a.handleResult(context.Background(),
+		res, err = a.handleResult(t.Context(),
 			&envoy_service_auth_v3.CheckRequest{},
 			&evaluator.Request{},
 			&evaluator.Result{
@ -58,7 +57,7 @@ func TestAuthorize_handleResult(t *testing.T) {
 		assert.Equal(t, 302, int(res.GetDeniedResponse().GetStatus().GetCode()))
 	})
 	t.Run("device-unauthenticated", func(t *testing.T) {
-		res, err := a.handleResult(context.Background(),
+		res, err := a.handleResult(t.Context(),
 			&envoy_service_auth_v3.CheckRequest{},
 			&evaluator.Request{},
 			&evaluator.Result{
@ -68,7 +67,7 @@ func TestAuthorize_handleResult(t *testing.T) {
 		assert.Equal(t, 302, int(res.GetDeniedResponse().GetStatus().GetCode()))

 		t.Run("webauthn path", func(t *testing.T) {
-			res, err := a.handleResult(context.Background(),
+			res, err := a.handleResult(t.Context(),
 				&envoy_service_auth_v3.CheckRequest{
 					Attributes: &envoy_service_auth_v3.AttributeContext{
 						Request: &envoy_service_auth_v3.AttributeContext_Request{
@ -90,7 +89,7 @@ func TestAuthorize_handleResult(t *testing.T) {
 	t.Run("invalid-client-certificate", func(t *testing.T) {
 		// Even if the user is unauthenticated, if a client certificate was required and an invalid
 		// certificate was provided, access should be denied (no login redirect).
-		res, err := a.handleResult(context.Background(),
+		res, err := a.handleResult(t.Context(),
 			&envoy_service_auth_v3.CheckRequest{},
 			&evaluator.Request{},
 			&evaluator.Result{
@ -103,7 +102,7 @@ func TestAuthorize_handleResult(t *testing.T) {
 	t.Run("client-certificate-required", func(t *testing.T) {
 		// Likewise, if a client certificate was required and no certificate
 		// was presented, access should be denied (no login redirect).
-		res, err := a.handleResult(context.Background(),
+		res, err := a.handleResult(t.Context(),
 			&envoy_service_auth_v3.CheckRequest{},
 			&evaluator.Request{},
 			&evaluator.Result{
@ -115,7 +114,7 @@ func TestAuthorize_handleResult(t *testing.T) {
 	})
 	t.Run("mcp-route-unauthenticated, mcp flag is on", func(t *testing.T) {
 		opt.RuntimeFlags[config.RuntimeFlagMCP] = true
-		res, err := a.handleResult(context.Background(),
+		res, err := a.handleResult(t.Context(),
 			&envoy_service_auth_v3.CheckRequest{},
 			&evaluator.Request{
 				Policy: &config.Policy{MCP: &config.MCP{}},
@ -128,7 +127,7 @@ func TestAuthorize_handleResult(t *testing.T) {
 	})
 	t.Run("mcp-route-unauthenticated, mcp flag is off", func(t *testing.T) {
 		opt.RuntimeFlags[config.RuntimeFlagMCP] = false
-		res, err := a.handleResult(context.Background(),
+		res, err := a.handleResult(t.Context(),
 			&envoy_service_auth_v3.CheckRequest{},
 			&evaluator.Request{
 				Policy: &config.Policy{MCP: &config.MCP{}},
@ -157,7 +156,7 @@ func TestAuthorize_okResponse(t *testing.T) {
 		Options: opt,
 	}), state: atomicutil.NewValue(new(authorizeState))}
 	a.store = store.New()
-	pe, err := newPolicyEvaluator(context.Background(), opt, a.store, nil)
+	pe, err := newPolicyEvaluator(t.Context(), opt, a.store, nil)
 	require.NoError(t, err)
 	a.state.Load().evaluator = pe

@ -223,7 +222,7 @@ func TestAuthorize_deniedResponse(t *testing.T) {

 	t.Run("json", func(t *testing.T) {
 		t.Parallel()
-		ctx := context.Background()
+		ctx := t.Context()
 		ctx = requestid.WithValue(ctx, "REQUESTID")

 		res, err := a.deniedResponse(ctx, &envoy_service_auth_v3.CheckRequest{
@ -260,7 +259,7 @@ func TestAuthorize_deniedResponse(t *testing.T) {

 	t.Run("grpc", func(t *testing.T) {
 		t.Parallel()
-		ctx := context.Background()
+		ctx := t.Context()
 		ctx = requestid.WithValue(ctx, "REQUESTID")

 		res, err := a.deniedResponse(ctx, &envoy_service_auth_v3.CheckRequest{
@ -304,7 +303,7 @@ func TestAuthorize_deniedResponse(t *testing.T) {

 	t.Run("grpc-web", func(t *testing.T) {
 		t.Parallel()
-		ctx := context.Background()
+		ctx := t.Context()
 		ctx = requestid.WithValue(ctx, "REQUESTID")

 		res, err := a.deniedResponse(ctx, &envoy_service_auth_v3.CheckRequest{
@ -348,7 +347,7 @@ func TestAuthorize_deniedResponse(t *testing.T) {

 	t.Run("kubernetes", func(t *testing.T) {
 		t.Parallel()
-		ctx := context.Background()
+		ctx := t.Context()
 		ctx = requestid.WithValue(ctx, "REQUESTID")

 		for _, tc := range []struct {
@ -403,7 +402,7 @@ func TestAuthorize_deniedResponse(t *testing.T) {

 	t.Run("html", func(t *testing.T) {
 		t.Parallel()
-		ctx := context.Background()
+		ctx := t.Context()
 		ctx = requestid.WithValue(ctx, "REQUESTID")

 		res, err := a.deniedResponse(ctx, &envoy_service_auth_v3.CheckRequest{}, http.StatusBadRequest, "ERROR", nil)
@ -455,18 +454,18 @@ func TestRequireLogin(t *testing.T) {
 	t.Cleanup(authnSrv.Close)
 	opt.AuthenticateURLString = authnSrv.URL

-	a, err := New(context.Background(), &config.Config{Options: opt})
+	a, err := New(t.Context(), &config.Config{Options: opt})
 	require.NoError(t, err)

 	t.Run("accept empty", func(t *testing.T) {
-		res, err := a.requireLoginResponse(context.Background(),
+		res, err := a.requireLoginResponse(t.Context(),
 			&envoy_service_auth_v3.CheckRequest{},
 			&evaluator.Request{})
 		require.NoError(t, err)
 		assert.Equal(t, http.StatusFound, int(res.GetDeniedResponse().GetStatus().GetCode()))
 	})
 	t.Run("accept html", func(t *testing.T) {
-		res, err := a.requireLoginResponse(context.Background(),
+		res, err := a.requireLoginResponse(t.Context(),
 			&envoy_service_auth_v3.CheckRequest{
 				Attributes: &envoy_service_auth_v3.AttributeContext{
 					Request: &envoy_service_auth_v3.AttributeContext_Request{
@ -483,7 +482,7 @@ func TestRequireLogin(t *testing.T) {
 		assert.Equal(t, http.StatusFound, int(res.GetDeniedResponse().GetStatus().GetCode()))
 	})
 	t.Run("accept json", func(t *testing.T) {
-		res, err := a.requireLoginResponse(context.Background(),
+		res, err := a.requireLoginResponse(t.Context(),
 			&envoy_service_auth_v3.CheckRequest{
 				Attributes: &envoy_service_auth_v3.AttributeContext{
 					Request: &envoy_service_auth_v3.AttributeContext_Request{
--- a/authorize/databroker_test.go
+++ b/authorize/databroker_test.go
@ -17,11 +17,11 @@ import (
 func TestAuthorize_getDataBrokerSessionOrServiceAccount(t *testing.T) {
 	t.Parallel()

-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	opt := config.NewDefaultOptions()
-	a, err := New(context.Background(), &config.Config{Options: opt})
+	a, err := New(t.Context(), &config.Config{Options: opt})
 	require.NoError(t, err)

 	s1 := &session.Session{Id: "s1", ExpiresAt: timestamppb.New(time.Now().Add(-time.Second))}
--- a/authorize/evaluator/evaluator_test.go
+++ b/authorize/evaluator/evaluator_test.go
@ -1,7 +1,6 @@
 package evaluator

 import (
-	"context"
 	"encoding/base64"
 	"net/http"
 	"net/url"
@ -111,7 +110,7 @@ fYCZHo3CID0gRSemaQ/jYMgyeBFrHIr6icZh
 		},
 	}

-	ctx := context.Background()
+	ctx := t.Context()
 	for i := range cases {
 		c := &cases[i]
 		t.Run(c.label, func(t *testing.T) {
@ -140,7 +139,7 @@ func TestEvaluator(t *testing.T) {
 	require.NoError(t, err)

 	eval := func(t *testing.T, options []Option, data []proto.Message, req *Request) (*Result, error) {
-		ctx := context.Background()
+		ctx := t.Context()
 		ctx = storage.WithQuerier(ctx, storage.NewStaticQuerier(data...))
 		store := store.New()
 		store.UpdateJWTClaimHeaders(config.NewJWTClaimHeaders("email", "groups", "user", "CUSTOM_KEY"))
@ -657,7 +656,7 @@ func TestEvaluator(t *testing.T) {
 }

 func TestEvaluator_EvaluateInternal(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	store := store.New()
 	evaluator, err := New(ctx, store, nil)
 	require.NoError(t, err)
@ -723,7 +722,7 @@ func TestEvaluator_EvaluateInternal(t *testing.T) {
 }

 func TestPolicyEvaluatorReuse(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()

 	store := store.New()

--- a/authorize/evaluator/headers_evaluator_test.go
+++ b/authorize/evaluator/headers_evaluator_test.go
@ -2,7 +2,6 @@ package evaluator

 import (
 	"bytes"
-	"context"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
@ -35,7 +34,7 @@ import (
 )

 func BenchmarkHeadersEvaluator(b *testing.B) {
-	ctx := context.Background()
+	ctx := b.Context()

 	privateJWK, _ := newJWK(b)

@ -99,7 +98,7 @@ func TestHeadersEvaluator(t *testing.T) {
 	iat := time.Unix(1686870680, 0)

 	eval := func(_ *testing.T, data []proto.Message, input *Request) (*HeadersResponse, error) {
-		ctx := context.Background()
+		ctx := t.Context()
 		ctx = storage.WithQuerier(ctx, storage.NewStaticQuerier(data...))
 		store := store.New()
 		store.UpdateJWTClaimHeaders(config.NewJWTClaimHeaders("name", "email", "groups", "user", "CUSTOM_KEY"))
@ -451,7 +450,7 @@ func TestHeadersEvaluator_JWTIssuerFormat(t *testing.T) {
 	store.UpdateSigningKey(privateJWK)

 	eval := func(_ *testing.T, input *Request) (*HeadersResponse, error) {
-		ctx := context.Background()
+		ctx := t.Context()
 		e := NewHeadersEvaluator(store)
 		return e.Evaluate(ctx, input)
 	}
@ -554,7 +553,7 @@ func TestHeadersEvaluator_JWTGroupsFilter(t *testing.T) {
 		{"groups claim", []string{"foo", "quux"}, nil, "SESSION-11", []any{"foo", "bar", "baz"}, 0},
 	}

-	ctx := storage.WithQuerier(context.Background(), storage.NewStaticQuerier(records...))
+	ctx := storage.WithQuerier(t.Context(), storage.NewStaticQuerier(records...))
 	for _, c := range cases {
 		t.Run(c.name, func(t *testing.T) {
 			store := store.New()
--- a/authorize/evaluator/log_test.go
+++ b/authorize/evaluator/log_test.go
@ -16,7 +16,7 @@ import (
 func TestPrintHook(t *testing.T) {
 	t.Parallel()

-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	r := rego.New(
--- a/authorize/evaluator/policy_evaluator_test.go
+++ b/authorize/evaluator/policy_evaluator_test.go
@ -1,7 +1,6 @@
 package evaluator

 import (
-	"context"
 	"net/http"
 	"strings"
 	"testing"
@ -35,7 +34,7 @@ func TestPolicyEvaluator(t *testing.T) {
 	var addDefaultClientCertificateRule bool

 	eval := func(t *testing.T, policy *config.Policy, data []proto.Message, input *PolicyRequest) (*PolicyResponse, error) {
-		ctx := context.Background()
+		ctx := t.Context()
 		ctx = storage.WithQuerier(ctx, storage.NewStaticQuerier(data...))
 		store := store.New()
 		store.UpdateJWTClaimHeaders(config.NewJWTClaimHeaders("email", "groups", "user", "CUSTOM_KEY"))
--- a/authorize/grpc_test.go
+++ b/authorize/grpc_test.go
@ -58,7 +58,7 @@ func Test_getEvaluatorRequest(t *testing.T) {
 		},
 	}), state: atomicutil.NewValue(new(authorizeState))}

-	actual, err := a.getEvaluatorRequestFromCheckRequest(context.Background(),
+	actual, err := a.getEvaluatorRequestFromCheckRequest(t.Context(),
 		&envoy_service_auth_v3.CheckRequest{
 			Attributes: &envoy_service_auth_v3.AttributeContext{
 				Request: &envoy_service_auth_v3.AttributeContext_Request{
@ -126,7 +126,7 @@ func Test_getEvaluatorRequestWithPortInHostHeader(t *testing.T) {
 		},
 	}), state: atomicutil.NewValue(new(authorizeState))}

-	actual, err := a.getEvaluatorRequestFromCheckRequest(context.Background(),
+	actual, err := a.getEvaluatorRequestFromCheckRequest(t.Context(),
 		&envoy_service_auth_v3.CheckRequest{
 			Attributes: &envoy_service_auth_v3.AttributeContext{
 				Request: &envoy_service_auth_v3.AttributeContext_Request{
--- a/authorize/log_test.go
+++ b/authorize/log_test.go
@ -2,7 +2,6 @@ package authorize

 import (
 	"bytes"
-	"context"
 	"strings"
 	"testing"

@ -20,7 +19,7 @@ import (
 func Test_populateLogEvent(t *testing.T) {
 	t.Parallel()

-	ctx := context.Background()
+	ctx := t.Context()
 	ctx = requestid.WithValue(ctx, "REQUEST-ID")

 	req := &evaluator.Request{
--- a/config/config_source_test.go
+++ b/config/config_source_test.go
@ -48,9 +48,9 @@ func TestFileWatcherSource(t *testing.T) {
 				},
 			})

-			src := NewFileWatcherSource(context.Background(), ssrc)
+			src := NewFileWatcherSource(t.Context(), ssrc)
 			ch := make(chan struct{}, 10)
-			src.OnConfigChange(context.Background(), func(_ context.Context, _ *Config) {
+			src.OnConfigChange(t.Context(), func(_ context.Context, _ *Config) {
 				ch <- struct{}{}
 			})

@ -90,7 +90,7 @@ func TestFileWatcherSource(t *testing.T) {

 			require.Empty(t, ch, "expected exactly one OnConfigChange event")

-			ssrc.SetConfig(context.Background(), &Config{
+			ssrc.SetConfig(t.Context(), &Config{
 				Options: &Options{
 					CAFile: filepath.Join(tmpdir, "example.txt"),
 				},
@ -148,12 +148,12 @@ runtime_flags:
 			require.NoError(t, err)

 			var src Source
-			src, err = NewFileOrEnvironmentSource(context.Background(), configFilePath, "")
+			src, err = NewFileOrEnvironmentSource(t.Context(), configFilePath, "")
 			require.NoError(t, err)
-			src = NewFileWatcherSource(context.Background(), src)
+			src = NewFileWatcherSource(t.Context(), src)

 			ch := make(chan struct{}, 10)
-			src.OnConfigChange(context.Background(), func(_ context.Context, _ *Config) {
+			src.OnConfigChange(t.Context(), func(_ context.Context, _ *Config) {
 				ch <- struct{}{}
 			})

--- a/config/envoyconfig/bootstrap_test.go
+++ b/config/envoyconfig/bootstrap_test.go
@ -1,7 +1,6 @@
 package envoyconfig

 import (
-	"context"
 	"testing"

 	"github.com/stretchr/testify/assert"
@ -36,7 +35,7 @@ func TestBuilder_BuildBootstrapAdmin(t *testing.T) {

 func TestBuilder_BuildBootstrapLayeredRuntime(t *testing.T) {
 	b := New("localhost:1111", "localhost:2222", "localhost:3333", filemgr.NewManager(), nil, true)
-	staticCfg, err := b.BuildBootstrapLayeredRuntime(context.Background(), &config.Config{})
+	staticCfg, err := b.BuildBootstrapLayeredRuntime(t.Context(), &config.Config{})
 	assert.NoError(t, err)
 	testutil.AssertProtoJSONEqual(t, `
 		{ "layers": [{
@ -62,7 +61,7 @@ func TestBuilder_BuildBootstrapLayeredRuntime(t *testing.T) {
 func TestBuilder_BuildBootstrapStaticResources(t *testing.T) {
 	t.Run("valid", func(t *testing.T) {
 		b := New("localhost:1111", "localhost:2222", "localhost:3333", filemgr.NewManager(), nil, true)
-		staticCfg, err := b.BuildBootstrapStaticResources(context.Background(), &config.Config{}, false)
+		staticCfg, err := b.BuildBootstrapStaticResources(t.Context(), &config.Config{}, false)
 		assert.NoError(t, err)
 		testutil.AssertProtoJSONEqual(t, `
 			{
@ -114,7 +113,7 @@ func TestBuilder_BuildBootstrapStaticResources(t *testing.T) {
 	})
 	t.Run("bad gRPC address", func(t *testing.T) {
 		b := New("xyz:zyx", "localhost:2222", "localhost:3333", filemgr.NewManager(), nil, true)
-		_, err := b.BuildBootstrapStaticResources(context.Background(), &config.Config{}, false)
+		_, err := b.BuildBootstrapStaticResources(t.Context(), &config.Config{}, false)
 		assert.Error(t, err)
 	})
 }
@ -142,7 +141,7 @@ func TestBuilder_BuildBootstrapStatsConfig(t *testing.T) {
 func TestBuilder_BuildBootstrap(t *testing.T) {
 	b := New("localhost:1111", "localhost:2222", "localhost:3333", filemgr.NewManager(), nil, true)
 	t.Run("OverloadManager", func(t *testing.T) {
-		bootstrap, err := b.BuildBootstrap(context.Background(), &config.Config{
+		bootstrap, err := b.BuildBootstrap(t.Context(), &config.Config{
 			Options: &config.Options{
 				EnvoyAdminAddress: "localhost:9901",
 			},
--- a/config/envoyconfig/clusters_test.go
+++ b/config/envoyconfig/clusters_test.go
@ -26,7 +26,7 @@ func Test_BuildClusters(t *testing.T) {
 	t.Setenv("TMPDIR", "/tmp")

 	opts := config.NewDefaultOptions()
-	ctx := context.Background()
+	ctx := t.Context()
 	b := New("local-grpc", "local-http", "local-metrics", filemgr.NewManager(), nil, true)
 	clusters, err := b.BuildClusters(ctx, &config.Config{Options: opts})
 	require.NoError(t, err)
@ -34,7 +34,7 @@ func Test_BuildClusters(t *testing.T) {
 }

 func Test_buildPolicyTransportSocket(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	cacheDir, _ := os.UserCacheDir()
 	customCA := filepath.Join(cacheDir, "pomerium", "envoy", "files", "custom-ca-3133535332543131503345494c.pem")

@ -516,7 +516,7 @@ func Test_buildPolicyTransportSocket(t *testing.T) {
 }

 func Test_buildCluster(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	b := New("local-grpc", "local-http", "local-metrics", filemgr.NewManager(), nil, true)
 	rootCABytes, _ := getCombinedCertificateAuthority(ctx, &config.Config{Options: &config.Options{}})
 	rootCA := b.filemgr.BytesDataSource("ca.pem", rootCABytes).GetFilename()
@ -1009,7 +1009,7 @@ func Test_validateClusters(t *testing.T) {
 }

 func Test_bindConfig(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	defer clearTimeout()

 	b := New("local-grpc", "local-http", "local-metrics", filemgr.NewManager(), nil, true)
--- a/config/envoyconfig/listeners_main_test.go
+++ b/config/envoyconfig/listeners_main_test.go
@ -1,7 +1,6 @@
 package envoyconfig

 import (
-	"context"
 	"testing"

 	"github.com/stretchr/testify/assert"
@ -14,7 +13,7 @@ import (
 func Test_requireProxyProtocol(t *testing.T) {
 	b := New("local-grpc", "local-http", "local-metrics", nil, nil, true)
 	t.Run("required", func(t *testing.T) {
-		li, err := b.buildMainListener(context.Background(), &config.Config{Options: &config.Options{
+		li, err := b.buildMainListener(t.Context(), &config.Config{Options: &config.Options{
 			UseProxyProtocol: true,
 			InsecureServer:   true,
 		}}, false, false)
@ -29,7 +28,7 @@ func Test_requireProxyProtocol(t *testing.T) {
 		]`, li.GetListenerFilters())
 	})
 	t.Run("not required", func(t *testing.T) {
-		li, err := b.buildMainListener(context.Background(), &config.Config{Options: &config.Options{
+		li, err := b.buildMainListener(t.Context(), &config.Config{Options: &config.Options{
 			UseProxyProtocol: false,
 			InsecureServer:   true,
 		}}, false, false)
--- a/config/envoyconfig/listeners_test.go
+++ b/config/envoyconfig/listeners_test.go
@ -2,7 +2,6 @@ package envoyconfig

 import (
 	"bytes"
-	"context"
 	"embed"
 	"os"
 	"path/filepath"
@ -42,7 +41,7 @@ func testData(t *testing.T, name string, data any) string {
 func TestBuildListeners(t *testing.T) {
 	t.Parallel()

-	ctx := context.Background()
+	ctx := t.Context()
 	cfg := &config.Config{
 		Options: config.NewDefaultOptions(),

@ -157,7 +156,7 @@ func Test_buildMainHTTPConnectionManagerFilter(t *testing.T) {
 	options.Tracing.OtelAttributeValueLengthLimit = &limit
 	endpoint := "http://localhost:4317"
 	options.Tracing.OtelExporterOtlpTracesEndpoint = &endpoint
-	filter, err := b.buildMainHTTPConnectionManagerFilter(context.Background(), &config.Config{Options: options}, false, false)
+	filter, err := b.buildMainHTTPConnectionManagerFilter(t.Context(), &config.Config{Options: options}, false, false)
 	require.NoError(t, err)

 	testutil.AssertProtoJSONEqual(t, testData(t, "main_http_connection_manager_filter.json", nil), filter)
--- a/config/envoyconfig/route_configurations_test.go
+++ b/config/envoyconfig/route_configurations_test.go
@ -1,7 +1,6 @@
 package envoyconfig

 import (
-	"context"
 	"encoding/base64"
 	"testing"
 	"time"
@ -19,7 +18,7 @@ import (
 func TestBuilder_buildMainRouteConfiguration(t *testing.T) {
 	t.Parallel()

-	ctx := context.Background()
+	ctx := t.Context()
 	cfg := &config.Config{Options: &config.Options{
 		CookieName:             "pomerium",
 		DefaultUpstreamTimeout: time.Second * 3,
--- a/config/envoyconfig/tls_test.go
+++ b/config/envoyconfig/tls_test.go
@ -1,7 +1,6 @@
 package envoyconfig

 import (
-	"context"
 	"crypto/x509"
 	"crypto/x509/pkix"
 	"encoding/base64"
@ -88,7 +87,7 @@ func Test_buildDownstreamTLSContext(t *testing.T) {
 	clientCAFileName := filepath.Join(cacheDir, "pomerium", "envoy", "files", "client-ca-4e4c564e5a36544a4a33385a.pem")

 	t.Run("no-validation", func(t *testing.T) {
-		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(context.Background(), &config.Config{Options: &config.Options{}}, nil)
+		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(t.Context(), &config.Config{Options: &config.Options{}}, nil)
 		require.NoError(t, err)
 		testutil.AssertProtoJSONEqual(t, `{
 			"commonTlsContext": {
@ -109,7 +108,7 @@ func Test_buildDownstreamTLSContext(t *testing.T) {
 		}`, downstreamTLSContext)
 	})
 	t.Run("client-ca", func(t *testing.T) {
-		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(context.Background(), &config.Config{Options: &config.Options{
+		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(t.Context(), &config.Config{Options: &config.Options{
 			DownstreamMTLS: config.DownstreamMTLSSettings{
 				CA: "VEVTVAo=", // "TEST\n" (with a trailing newline)
 			},
@ -142,7 +141,7 @@ func Test_buildDownstreamTLSContext(t *testing.T) {
 		}`, downstreamTLSContext)
 	})
 	t.Run("client-ca-strict", func(t *testing.T) {
-		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(context.Background(), &config.Config{Options: &config.Options{
+		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(t.Context(), &config.Config{Options: &config.Options{
 			DownstreamMTLS: config.DownstreamMTLSSettings{
 				CA:          "VEVTVAo=", // "TEST\n" (with a trailing newline)
 				Enforcement: config.MTLSEnforcementRejectConnection,
@ -176,7 +175,7 @@ func Test_buildDownstreamTLSContext(t *testing.T) {
 		}`, downstreamTLSContext)
 	})
 	t.Run("policy-client-ca", func(t *testing.T) {
-		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(context.Background(), &config.Config{Options: &config.Options{
+		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(t.Context(), &config.Config{Options: &config.Options{
 			Policies: []config.Policy{
 				{
 					From:                  "https://a.example.com:1234",
@ -222,7 +221,7 @@ func Test_buildDownstreamTLSContext(t *testing.T) {
 		}}

 		maxVerifyDepth = 10
-		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(context.Background(), config, nil)
+		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(t.Context(), config, nil)
 		require.NoError(t, err)
 		testutil.AssertProtoJSONEqual(t, `{
 			"maxVerifyDepth": 10,
@ -234,7 +233,7 @@ func Test_buildDownstreamTLSContext(t *testing.T) {
 		}`, downstreamTLSContext.GetCommonTlsContext().GetValidationContext())

 		maxVerifyDepth = 0
-		downstreamTLSContext, err = b.buildDownstreamTLSContextMulti(context.Background(), config, nil)
+		downstreamTLSContext, err = b.buildDownstreamTLSContextMulti(t.Context(), config, nil)
 		require.NoError(t, err)
 		testutil.AssertProtoJSONEqual(t, `{
 			"onlyVerifyLeafCertCrl": true,
@ -257,7 +256,7 @@ func Test_buildDownstreamTLSContext(t *testing.T) {
 				},
 			},
 		}}
-		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(context.Background(), config, nil)
+		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(t.Context(), config, nil)
 		require.NoError(t, err)
 		testutil.AssertProtoJSONEqual(t, `{
 			"maxVerifyDepth": 1,
@ -317,7 +316,7 @@ func Test_buildDownstreamTLSContext(t *testing.T) {
 		}`, downstreamTLSContext.GetCommonTlsContext().GetValidationContext())
 	})
 	t.Run("http1", func(t *testing.T) {
-		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(context.Background(), &config.Config{Options: &config.Options{
+		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(t.Context(), &config.Config{Options: &config.Options{
 			Cert:      aExampleComCert,
 			Key:       aExampleComKey,
 			CodecType: config.CodecTypeHTTP1,
@ -343,7 +342,7 @@ func Test_buildDownstreamTLSContext(t *testing.T) {
 		}`, downstreamTLSContext)
 	})
 	t.Run("http2", func(t *testing.T) {
-		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(context.Background(), &config.Config{Options: &config.Options{
+		downstreamTLSContext, err := b.buildDownstreamTLSContextMulti(t.Context(), &config.Config{Options: &config.Options{
 			Cert:      aExampleComCert,
 			Key:       aExampleComKey,
 			CodecType: config.CodecTypeHTTP2,
@ -393,7 +392,7 @@ func Test_clientCABundle(t *testing.T) {
 		},
 	}}
 	expected := []byte("client CA 3\nclient CA 2\nclient CA 1\n")
-	actual := clientCABundle(context.Background(), cfg)
+	actual := clientCABundle(t.Context(), cfg)
 	assert.Equal(t, expected, actual)
 }

--- a/config/layered_test.go
+++ b/config/layered_test.go
@ -17,7 +17,7 @@ import (
 func TestLayeredConfig(t *testing.T) {
 	t.Parallel()

-	ctx := context.Background()
+	ctx := t.Context()

 	t.Run("error on initial build", func(t *testing.T) {
 		underlying := config.NewStaticSource(&config.Config{})
--- a/config/metrics_test.go
+++ b/config/metrics_test.go
@ -1,7 +1,6 @@
 package config

 import (
-	"context"
 	"encoding/base64"
 	"fmt"
 	"net/http"
@ -13,7 +12,7 @@ import (
 )

 func TestMetricsManager(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	src := NewStaticSource(&Config{
 		Options: &Options{
 			MetricsAddr: "ADDRESS",
@ -44,7 +43,7 @@ func TestMetricsManagerBasicAuth(t *testing.T) {
 			MetricsBasicAuth: base64.StdEncoding.EncodeToString([]byte("x:y")),
 		},
 	})
-	mgr := NewMetricsManager(context.Background(), src)
+	mgr := NewMetricsManager(t.Context(), src)
 	srv1 := httptest.NewServer(mgr)
 	defer srv1.Close()

--- a/config/options_test.go
+++ b/config/options_test.go
@ -286,7 +286,7 @@ func Test_parseHeaders(t *testing.T) {
 			o.viperSet("set_response_headers", tt.viperHeaders)
 			o.viperSet("HeadersEnv", tt.envHeaders)
 			o.HeadersEnv = tt.envHeaders
-			err := o.parseHeaders(context.Background())
+			err := o.parseHeaders(t.Context())

 			if (err != nil) != tt.wantErr {
 				t.Errorf("Error condition unexpected: err=%s", err)
@ -929,7 +929,7 @@ func TestOptions_GetAllRouteableHTTPHosts(t *testing.T) {
 func TestOptions_ApplySettings(t *testing.T) {
 	t.Parallel()

-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second)
 	defer clearTimeout()

 	t.Run("certificates", func(t *testing.T) {
@ -1615,7 +1615,7 @@ func TestOptions_FromToProto(t *testing.T) {
 		for range 100 {
 			settings := generate(1)
 			var options Options
-			options.ApplySettings(context.Background(), nil, settings)
+			options.ApplySettings(t.Context(), nil, settings)
 			settings2 := options.ToProto()
 			testutil.AssertProtoEqual(t, settings, settings2.Settings)
 		}
@ -1626,7 +1626,7 @@ func TestOptions_FromToProto(t *testing.T) {
 		for range 100 {
 			settings := generate(mathrand.Float64())
 			var options Options
-			options.ApplySettings(context.Background(), nil, settings)
+			options.ApplySettings(t.Context(), nil, settings)
 			settings2 := options.ToProto()
 			testutil.AssertProtoEqual(t, settings, settings2.Settings)
 		}
--- a/databroker/cache_test.go
+++ b/databroker/cache_test.go
@ -1,7 +1,6 @@
 package databroker

 import (
-	"context"
 	"testing"

 	"github.com/pomerium/pomerium/config"
@ -21,7 +20,7 @@ func TestNew(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			tt.opts.Provider = "google"
-			_, err := New(context.Background(), &config.Config{Options: &tt.opts}, events.New())
+			_, err := New(t.Context(), &config.Config{Options: &tt.opts}, events.New())
 			if (err != nil) != tt.wantErr {
 				t.Errorf("New() error = %v, wantErr %v", err, tt.wantErr)
 				return
--- a/databroker/databroker_test.go
+++ b/databroker/databroker_test.go
@ -46,7 +46,7 @@ func bufDialer(context.Context, string) (net.Conn, error) {
 }

 func TestServerSync(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	conn, err := grpc.DialContext(ctx, "bufnet", grpc.WithContextDialer(bufDialer), grpc.WithInsecure())
 	require.NoError(t, err)
 	defer conn.Close()
@ -96,7 +96,7 @@ func TestServerSync(t *testing.T) {
 }

 func BenchmarkSync(b *testing.B) {
-	ctx := context.Background()
+	ctx := b.Context()
 	conn, err := grpc.DialContext(ctx, "bufnet", grpc.WithContextDialer(bufDialer), grpc.WithInsecure())
 	if err != nil {
 		b.Fatalf("Failed to dial bufnet: %v", err)
--- a/go.mod
+++ b/go.mod
@ -1,16 +1,16 @@
 module github.com/pomerium/pomerium

-go 1.23.8
+go 1.24.0

 require (
 	buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.6-20250425153114-8976f5be98c1.1
-	cloud.google.com/go/storage v1.53.0
+	cloud.google.com/go/storage v1.55.0
 	contrib.go.opencensus.io/exporter/prometheus v0.4.2
 	github.com/CAFxX/httpcompression v0.0.9
-	github.com/VictoriaMetrics/fastcache v1.12.2
+	github.com/VictoriaMetrics/fastcache v1.12.4
 	github.com/aws/aws-sdk-go-v2 v1.36.3
 	github.com/aws/aws-sdk-go-v2/config v1.29.14
-	github.com/aws/aws-sdk-go-v2/service/s3 v1.79.3
+	github.com/aws/aws-sdk-go-v2/service/s3 v1.80.0
 	github.com/bits-and-blooms/bitset v1.22.0
 	github.com/bufbuild/protovalidate-go v0.10.1
 	github.com/caddyserver/certmagic v0.23.0
@ -18,10 +18,10 @@ require (
 	github.com/cloudflare/circl v1.6.1
 	github.com/cockroachdb/pebble/v2 v2.0.4
 	github.com/coreos/go-oidc/v3 v3.14.1
-	github.com/docker/docker v28.1.1+incompatible
+	github.com/docker/docker v28.2.2+incompatible
 	github.com/envoyproxy/go-control-plane/envoy v1.32.4
 	github.com/envoyproxy/protoc-gen-validate v1.2.1
-	github.com/exaring/otelpgx v0.9.1
+	github.com/exaring/otelpgx v0.9.3
 	github.com/fsnotify/fsnotify v1.9.0
 	github.com/gaissmai/bart v0.20.4
 	github.com/go-chi/chi/v5 v5.2.1
@ -29,7 +29,7 @@ require (
 	github.com/go-viper/mapstructure/v2 v2.2.1
 	github.com/google/btree v1.1.3
 	github.com/google/go-cmp v0.7.0
-	github.com/google/go-jsonnet v0.20.0
+	github.com/google/go-jsonnet v0.21.0
 	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.1
 	github.com/gorilla/websocket v1.5.3
@ -38,20 +38,20 @@ require (
 	github.com/hashicorp/go-multierror v1.1.1
 	github.com/hashicorp/go-set/v3 v3.0.0
 	github.com/hashicorp/golang-lru/v2 v2.0.7
-	github.com/jackc/pgx/v5 v5.7.4
+	github.com/jackc/pgx/v5 v5.7.5
 	github.com/jxskiss/base62 v1.1.0
 	github.com/klauspost/compress v1.18.0
 	github.com/martinlindhe/base36 v1.1.1
 	github.com/mholt/acmez/v3 v3.1.2
-	github.com/miekg/dns v1.1.65
-	github.com/minio/minio-go/v7 v7.0.91
+	github.com/miekg/dns v1.1.66
+	github.com/minio/minio-go/v7 v7.0.92
 	github.com/mitchellh/hashstructure/v2 v2.0.2
 	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c
 	github.com/natefinch/atomic v1.0.1
 	github.com/oapi-codegen/runtime v1.1.1
-	github.com/open-policy-agent/opa v1.4.2
+	github.com/open-policy-agent/opa v1.5.0
 	github.com/peterbourgon/ff/v3 v3.4.0
-	github.com/pires/go-proxyproto v0.8.0
+	github.com/pires/go-proxyproto v0.8.1
 	github.com/pomerium/csrf v1.7.0
 	github.com/pomerium/datasource v0.18.2-0.20221108160055-c6134b5ed524
 	github.com/pomerium/envoy-custom v1.33.0
@ -61,7 +61,7 @@ require (
 	github.com/prometheus/client_model v0.6.2
 	github.com/prometheus/common v0.64.0
 	github.com/prometheus/procfs v0.16.1
-	github.com/quic-go/quic-go v0.51.0
+	github.com/quic-go/quic-go v0.52.0
 	github.com/rs/cors v1.11.1
 	github.com/rs/zerolog v1.34.0
 	github.com/shirou/gopsutil/v3 v3.24.5
@ -75,21 +75,21 @@ require (
 	github.com/yuin/gopher-lua v1.1.1
 	github.com/zeebo/xxh3 v1.0.2
 	go.opencensus.io v0.24.0
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0
-	go.opentelemetry.io/contrib/propagators/autoprop v0.60.0
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0
+	go.opentelemetry.io/contrib/propagators/autoprop v0.61.0
 	go.opentelemetry.io/otel v1.36.0
-	go.opentelemetry.io/otel/bridge/opencensus v1.35.0
-	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0
+	go.opentelemetry.io/otel/bridge/opencensus v1.36.0
+	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.36.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.36.0
 	go.opentelemetry.io/otel/exporters/prometheus v0.58.0
 	go.opentelemetry.io/otel/metric v1.36.0
 	go.opentelemetry.io/otel/sdk v1.36.0
 	go.opentelemetry.io/otel/sdk/metric v1.36.0
 	go.opentelemetry.io/otel/trace v1.36.0
-	go.opentelemetry.io/proto/otlp v1.6.0
+	go.opentelemetry.io/proto/otlp v1.7.0
 	go.uber.org/automaxprocs v1.6.0
 	go.uber.org/mock v0.5.2
 	go.uber.org/zap v1.27.0
@ -99,9 +99,9 @@ require (
 	golang.org/x/sync v0.14.0
 	golang.org/x/sys v0.33.0
 	golang.org/x/time v0.11.0
-	google.golang.org/api v0.230.0
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34
-	google.golang.org/grpc v1.72.0
+	google.golang.org/api v0.235.0
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a
+	google.golang.org/grpc v1.72.2
 	google.golang.org/protobuf v1.36.6
 	gopkg.in/yaml.v3 v3.0.1
 	sigs.k8s.io/yaml v1.4.0
@ -109,12 +109,12 @@ require (

 require (
 	cel.dev/expr v0.23.1 // indirect
-	cloud.google.com/go v0.120.1 // indirect
-	cloud.google.com/go/auth v0.16.0 // indirect
+	cloud.google.com/go v0.121.1 // indirect
+	cloud.google.com/go/auth v0.16.1 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
-	cloud.google.com/go/compute/metadata v0.6.0 // indirect
+	cloud.google.com/go/compute/metadata v0.7.0 // indirect
 	cloud.google.com/go/iam v1.5.2 // indirect
-	cloud.google.com/go/monitoring v1.24.0 // indirect
+	cloud.google.com/go/monitoring v1.24.2 // indirect
 	dario.cat/mergo v1.0.1 // indirect
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
 	github.com/DataDog/zstd v1.5.6-0.20230824185856-869dae002e5e // indirect
@ -134,7 +134,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 // indirect
-	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1 // indirect
+	github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.2 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 // indirect
 	github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 // indirect
@ -143,6 +143,7 @@ require (
 	github.com/aws/smithy-go v1.22.2 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/caddyserver/zerossl v0.1.3 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42 // indirect
 	github.com/cockroachdb/crlib v0.0.0-20241015224233-894974b3ad94 // indirect
@ -152,8 +153,10 @@ require (
 	github.com/cockroachdb/redact v1.1.5 // indirect
 	github.com/cockroachdb/swiss v0.0.0-20250304010804-34a2c6a59016 // indirect
 	github.com/cockroachdb/tokenbucket v0.0.0-20230807174530-cc333fc44b06 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
-	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/containerd/platforms v1.0.0-rc.1 // indirect
 	github.com/cpuguy83/dockercfg v0.3.2 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/distribution/reference v0.6.0 // indirect
@ -162,7 +165,7 @@ require (
 	github.com/dustin/go-humanize v1.0.1 // indirect
 	github.com/ebitengine/purego v0.8.2 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fxamacker/cbor/v2 v2.6.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/getsentry/sentry-go v0.27.0 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
@ -182,7 +185,7 @@ require (
 	github.com/google/pprof v0.0.0-20240424215950-a892ee059fd6 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.6 // indirect
-	github.com/googleapis/gax-go/v2 v2.14.1 // indirect
+	github.com/googleapis/gax-go/v2 v2.14.2 // indirect
 	github.com/gorilla/securecookie v1.1.1 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
@ -215,7 +218,8 @@ require (
 	github.com/onsi/ginkgo/v2 v2.19.1 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
-	github.com/pelletier/go-toml/v2 v2.2.3 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
+	github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c // indirect
 	github.com/pierrec/lz4/v4 v4.1.21 // indirect
 	github.com/pkg/errors v0.9.1 // indirect
 	github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 // indirect
@ -242,8 +246,10 @@ require (
 	github.com/tchap/go-patricia/v2 v2.3.2 // indirect
 	github.com/tidwall/match v1.1.1 // indirect
 	github.com/tidwall/pretty v1.2.0 // indirect
+	github.com/tinylib/msgp v1.3.0 // indirect
 	github.com/tklauser/go-sysconf v0.3.14 // indirect
 	github.com/tklauser/numcpus v0.8.0 // indirect
+	github.com/vektah/gqlparser/v2 v2.5.26 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
@ -253,18 +259,18 @@ require (
 	github.com/zeebo/blake3 v0.2.4 // indirect
 	github.com/zeebo/errs v1.4.0 // indirect
 	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
-	go.opentelemetry.io/contrib/detectors/gcp v1.35.0 // indirect
-	go.opentelemetry.io/contrib/propagators/aws v1.35.0 // indirect
-	go.opentelemetry.io/contrib/propagators/b3 v1.35.0 // indirect
-	go.opentelemetry.io/contrib/propagators/jaeger v1.35.0 // indirect
-	go.opentelemetry.io/contrib/propagators/ot v1.35.0 // indirect
+	go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
+	go.opentelemetry.io/contrib/propagators/aws v1.36.0 // indirect
+	go.opentelemetry.io/contrib/propagators/b3 v1.36.0 // indirect
+	go.opentelemetry.io/contrib/propagators/jaeger v1.36.0 // indirect
+	go.opentelemetry.io/contrib/propagators/ot v1.36.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap/exp v0.3.0 // indirect
-	golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa // indirect
+	golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f // indirect
 	golang.org/x/mod v0.24.0 // indirect
 	golang.org/x/text v0.25.0 // indirect
-	golang.org/x/tools v0.31.0 // indirect
-	google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34 // indirect
+	golang.org/x/tools v0.32.0 // indirect
+	google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 )
--- a/go.sum
+++ b/go.sum
@ -17,10 +17,10 @@ cloud.google.com/go v0.56.0/go.mod h1:jr7tqZxxKOVYizybht9+26Z/gUq7tiRzu+ACVAMbKV
 cloud.google.com/go v0.57.0/go.mod h1:oXiQ6Rzq3RAkkY7N6t3TcE6jE+CIBBbA36lwQ1JyzZs=
 cloud.google.com/go v0.62.0/go.mod h1:jmCYTdRCQuc1PHIIJ/maLInMho30T/Y0M4hTdTShOYc=
 cloud.google.com/go v0.65.0/go.mod h1:O5N8zS7uWy9vkA9vayVHs65eM1ubvY4h553ofrNHObY=
-cloud.google.com/go v0.120.1 h1:Z+5V7yd383+9617XDCyszmK5E4wJRJL+tquMfDj9hLM=
-cloud.google.com/go v0.120.1/go.mod h1:56Vs7sf/i2jYM6ZL9NYlC82r04PThNcPS5YgFmb0rp8=
-cloud.google.com/go/auth v0.16.0 h1:Pd8P1s9WkcrBE2n/PhAwKsdrR35V3Sg2II9B+ndM3CU=
-cloud.google.com/go/auth v0.16.0/go.mod h1:1howDHJ5IETh/LwYs3ZxvlkXF48aSqqJUM+5o02dNOI=
+cloud.google.com/go v0.121.1 h1:S3kTQSydxmu1JfLRLpKtxRPA7rSrYPRPEUmL/PavVUw=
+cloud.google.com/go v0.121.1/go.mod h1:nRFlrHq39MNVWu+zESP2PosMWA0ryJw8KUBZ2iZpxbw=
+cloud.google.com/go/auth v0.16.1 h1:XrXauHMd30LhQYVRHLGvJiYeczweKQXZxsTbV9TiguU=
+cloud.google.com/go/auth v0.16.1/go.mod h1:1howDHJ5IETh/LwYs3ZxvlkXF48aSqqJUM+5o02dNOI=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/bigquery v1.0.1/go.mod h1:i/xbL2UlR5RvWAURpBYZTtm/cXjCha9lbfbpx4poX+o=
@ -29,8 +29,8 @@ cloud.google.com/go/bigquery v1.4.0/go.mod h1:S8dzgnTigyfTmLBfrtrhyYhwRxG72rYxvf
 cloud.google.com/go/bigquery v1.5.0/go.mod h1:snEHRnqQbz117VIFhE8bmtwIDY80NLUZUMb4Nv6dBIg=
 cloud.google.com/go/bigquery v1.7.0/go.mod h1://okPTzCYNXSlb24MZs83e2Do+h+VXtc4gLoIoXIAPc=
 cloud.google.com/go/bigquery v1.8.0/go.mod h1:J5hqkt3O0uAFnINi6JXValWIb1v0goeZM77hZzJN/fQ=
-cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
-cloud.google.com/go/compute/metadata v0.6.0/go.mod h1:FjyFAW1MW0C203CEOMDTu3Dk1FlqW3Rga40jzHL4hfg=
+cloud.google.com/go/compute/metadata v0.7.0 h1:PBWF+iiAerVNe8UCHxdOt6eHLVc3ydFeOCw78U8ytSU=
+cloud.google.com/go/compute/metadata v0.7.0/go.mod h1:j5MvL9PprKL39t166CoB1uVHfQMs4tFQZZcKwksXUjo=
 cloud.google.com/go/datastore v1.0.0/go.mod h1:LXYbyblFSglQ5pkeyhO+Qmw7ukd3C+pD7TKLgZqpHYE=
 cloud.google.com/go/datastore v1.1.0/go.mod h1:umbIZjpQpHh4hmRpGhH4tLFup+FVzqBi1b3c64qFpCk=
 cloud.google.com/go/iam v1.5.2 h1:qgFRAGEmd8z6dJ/qyEchAuL9jpswyODjA2lS+w234g8=
@ -39,8 +39,8 @@ cloud.google.com/go/logging v1.13.0 h1:7j0HgAp0B94o1YRDqiqm26w4q1rDMH7XNRU34lJXH
 cloud.google.com/go/logging v1.13.0/go.mod h1:36CoKh6KA/M0PbhPKMq6/qety2DCAErbhXT62TuXALA=
 cloud.google.com/go/longrunning v0.6.7 h1:IGtfDWHhQCgCjwQjV9iiLnUta9LBCo8R9QmAFsS/PrE=
 cloud.google.com/go/longrunning v0.6.7/go.mod h1:EAFV3IZAKmM56TyiE6VAP3VoTzhZzySwI/YI1s/nRsY=
-cloud.google.com/go/monitoring v1.24.0 h1:csSKiCJ+WVRgNkRzzz3BPoGjFhjPY23ZTcaenToJxMM=
-cloud.google.com/go/monitoring v1.24.0/go.mod h1:Bd1PRK5bmQBQNnuGwHBfUamAV1ys9049oEPHnn4pcsc=
+cloud.google.com/go/monitoring v1.24.2 h1:5OTsoJ1dXYIiMiuL+sYscLc9BumrL3CarVLL7dd7lHM=
+cloud.google.com/go/monitoring v1.24.2/go.mod h1:x7yzPWcgDRnPEv3sI+jJGBkwl5qINf+6qY4eq0I9B4U=
 cloud.google.com/go/pubsub v1.0.1/go.mod h1:R0Gpsv3s54REJCy4fxDixWD93lHJMoZTyQ2kNxGRt3I=
 cloud.google.com/go/pubsub v1.1.0/go.mod h1:EwwdRX2sKPjnvnqCa270oGRyludottCI76h+R3AArQw=
 cloud.google.com/go/pubsub v1.2.0/go.mod h1:jhfEVHT8odbXTkndysNHCcx0awwzvfOlguIAii9o8iA=
@ -50,10 +50,10 @@ cloud.google.com/go/storage v1.5.0/go.mod h1:tpKbwo567HUNpVclU5sGELwQWBDZ8gh0Zeo
 cloud.google.com/go/storage v1.6.0/go.mod h1:N7U0C8pVQ/+NIKOBQyamJIeKQKkZ+mxpohlUTyfDhBk=
 cloud.google.com/go/storage v1.8.0/go.mod h1:Wv1Oy7z6Yz3DshWRJFhqM/UCfaWIRTdp0RXyy7KQOVs=
 cloud.google.com/go/storage v1.10.0/go.mod h1:FLPqc6j+Ki4BU591ie1oL6qBQGu2Bl/tZ9ullr3+Kg0=
-cloud.google.com/go/storage v1.53.0 h1:gg0ERZwL17pJ+Cz3cD2qS60w1WMDnwcm5YPAIQBHUAw=
-cloud.google.com/go/storage v1.53.0/go.mod h1:7/eO2a/srr9ImZW9k5uufcNahT2+fPb8w5it1i5boaA=
-cloud.google.com/go/trace v1.11.3 h1:c+I4YFjxRQjvAhRmSsmjpASUKq88chOX854ied0K/pE=
-cloud.google.com/go/trace v1.11.3/go.mod h1:pt7zCYiDSQjC9Y2oqCsh9jF4GStB/hmjrYLsxRR27q8=
+cloud.google.com/go/storage v1.55.0 h1:NESjdAToN9u1tmhVqhXCaCwYBuvEhZLLv0gBr+2znf0=
+cloud.google.com/go/storage v1.55.0/go.mod h1:ztSmTTwzsdXe5syLVS0YsbFxXuvEmEyZj7v7zChEmuY=
+cloud.google.com/go/trace v1.11.6 h1:2O2zjPzqPYAHrn3OKl029qlqG6W8ZdYaOWRyr8NgMT4=
+cloud.google.com/go/trace v1.11.6/go.mod h1:GA855OeDEBiBMzcckLPE2kDunIpC72N+Pq8WFieFjnI=
 contrib.go.opencensus.io/exporter/prometheus v0.4.2 h1:sqfsYl5GIY/L570iT+l93ehxaWJs2/OwXtiWwew3oAg=
 contrib.go.opencensus.io/exporter/prometheus v0.4.2/go.mod h1:dvEHbiKmgvbr5pjaF9fpw1KeYcjrnC1J8B+JKjsZyRQ=
 dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
@ -80,8 +80,8 @@ github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapp
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/RaveNoX/go-jsoncommentstrip v1.0.0/go.mod h1:78ihd09MekBnJnxpICcwzCMzGrKSKYe4AqU6PDYYpjk=
-github.com/VictoriaMetrics/fastcache v1.12.2 h1:N0y9ASrJ0F6h0QaC3o6uJb3NIZ9VKLjCM7NQbSmF7WI=
-github.com/VictoriaMetrics/fastcache v1.12.2/go.mod h1:AmC+Nzz1+3G2eCPapF6UcsnkThDcMsQicp4xDukwJYI=
+github.com/VictoriaMetrics/fastcache v1.12.4 h1:2xvmwZBW+9QtHsXggfzAZRs1FZWCsBs8QDg22bMidf0=
+github.com/VictoriaMetrics/fastcache v1.12.4/go.mod h1:K+JGPBn0sueFlLjZ8rcVM0cKkWKNElKyQXmw57QOoYI=
 github.com/aclements/go-perfevent v0.0.0-20240301234650-f7843625020f h1:JjxwchlOepwsUWcQwD2mLUAGE9aCp0/ehy6yCHFBOvo=
 github.com/aclements/go-perfevent v0.0.0-20240301234650-f7843625020f/go.mod h1:tMDTce/yLLN/SK8gMOxQfnyeMeCg8KGzp0D1cbECEeo=
 github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM=
@ -94,6 +94,8 @@ github.com/alecthomas/units v0.0.0-20190924025748-f65c72e2690d/go.mod h1:rBZYJk5
 github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137/go.mod h1:OMCwj8VM1Kc9e19TLln2VL61YJF0x1XFtfdL4JdbSyE=
 github.com/allegro/bigcache v1.2.1-0.20190218064605-e24eb225f156 h1:eMwmnE/GDgah4HI848JfFxHt+iPb26b4zyfspmqY0/8=
 github.com/allegro/bigcache v1.2.1-0.20190218064605-e24eb225f156/go.mod h1:Cb/ax3seSYIx7SuZdm2G2xzfwmv3TPSk2ucNfQESPXM=
+github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
+github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8=
 github.com/andybalholm/brotli v1.0.5 h1:8uQZIdzKmjc/iuPu7O2ioW48L81FgatrcpfFmiq/cCs=
 github.com/andybalholm/brotli v1.0.5/go.mod h1:fO7iG3H7G2nSZ7m0zPUDn85XEX2GTukHGRSepvi9Eig=
 github.com/antlr4-go/antlr/v4 v4.13.0 h1:lxCg3LAv+EUK6t1i0y1V6/SLeUi0eKEKdhQAlS8TVTI=
@ -122,14 +124,14 @@ github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34 h1:ZNTqv4nIdE/DiBfUUfXcLZ/Spcu
 github.com/aws/aws-sdk-go-v2/internal/v4a v1.3.34/go.mod h1:zf7Vcd1ViW7cPqYWEHLHJkS50X0JS2IKz9Cgaj6ugrs=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3 h1:eAh2A4b5IzM/lum78bZ590jy36+d/aFLgKF/4Vd1xPE=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.12.3/go.mod h1:0yKJC/kb8sAnmlYa6Zs3QVYqaC8ug2AbnNChv5Ox3uA=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1 h1:4nm2G6A4pV9rdlWzGMPv4BNtQp22v1hg3yrtkYpeLl8=
-github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.1/go.mod h1:iu6FSzgt+M2/x3Dk8zhycdIcHjEFb36IS8HVUVFoMg0=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.2 h1:BCG7DCXEXpNCcpwCxg1oi9pkJWH2+eZzTn9MY56MbVw=
+github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.7.2/go.mod h1:iu6FSzgt+M2/x3Dk8zhycdIcHjEFb36IS8HVUVFoMg0=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15 h1:dM9/92u2F1JbDaGooxTq18wmmFzbJRfXfVfy96/1CXM=
 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.12.15/go.mod h1:SwFBy2vjtA0vZbjjaFtfN045boopadnoVPhu4Fv66vY=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15 h1:moLQUoVq91LiqT1nbvzDukyqAlCv89ZmwaHw/ZFlFZg=
 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.18.15/go.mod h1:ZH34PJUc8ApjBIfgQCFvkWcUDBtl/WTD+uiYHjd8igA=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.79.3 h1:BRXS0U76Z8wfF+bnkilA2QwpIch6URlm++yPUt9QPmQ=
-github.com/aws/aws-sdk-go-v2/service/s3 v1.79.3/go.mod h1:bNXKFFyaiVvWuR6O16h/I1724+aXe/tAkA9/QS01t5k=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.80.0 h1:fV4XIU5sn/x8gjRouoJpDVHj+ExJaUk4prYF+eb6qTs=
+github.com/aws/aws-sdk-go-v2/service/s3 v1.80.0/go.mod h1:qbn305Je/IofWBJ4bJz/Q7pDEtnnoInw/dGt71v6rHE=
 github.com/aws/aws-sdk-go-v2/service/sso v1.25.3 h1:1Gw+9ajCV1jogloEv1RRnvfRFia2cL6c9cuKV2Ps+G8=
 github.com/aws/aws-sdk-go-v2/service/sso v1.25.3/go.mod h1:qs4a9T5EMLl/Cajiw2TcbNt2UNo/Hqlyp+GiuG4CFDI=
 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.30.1 h1:hXmVKytPfTy5axZ+fYbR5d0cFmC3JvwLm5kM83luako=
@ -155,10 +157,11 @@ github.com/caddyserver/zerossl v0.1.3 h1:onS+pxp3M8HnHpN5MMbOMyNjmTheJyWRaZYwn+Y
 github.com/caddyserver/zerossl v0.1.3/go.mod h1:CxA0acn7oEGO6//4rtrRjYgEoa4MFw/XofZnrYwGqG4=
 github.com/cenkalti/backoff/v4 v4.3.0 h1:MyRJ/UdXutAwSAT+s3wNd7MfTIcy71VQueUuFK343L8=
 github.com/cenkalti/backoff/v4 v4.3.0/go.mod h1:Y3VNntkOUPxTVeUxJ/G5vcM//AlwfmyYozVcomhLiZE=
+github.com/cenkalti/backoff/v5 v5.0.2 h1:rIfFVxEf1QsI7E1ZHfp/B4DF/6QBAUhmgkxc0H7Zss8=
+github.com/cenkalti/backoff/v5 v5.0.2/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw=
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.1.2/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
 github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/chzyer/logex v1.1.10/go.mod h1:+Ywpsq7O8HXn0nuIou7OrIPyXbp3wmkHB+jjWRnGsAI=
@ -190,10 +193,14 @@ github.com/cockroachdb/swiss v0.0.0-20250304010804-34a2c6a59016 h1:d0dxi6Q8yGtRB
 github.com/cockroachdb/swiss v0.0.0-20250304010804-34a2c6a59016/go.mod h1:yBRu/cnL4ks9bgy4vAASdjIW+/xMlFwuHKqtmh3GZQg=
 github.com/cockroachdb/tokenbucket v0.0.0-20230807174530-cc333fc44b06 h1:zuQyyAKVxetITBuuhv3BI9cMrmStnpT18zmgmTxunpo=
 github.com/cockroachdb/tokenbucket v0.0.0-20230807174530-cc333fc44b06/go.mod h1:7nc4anLGjupUW/PeY5qiNYsdNXj7zopG+eqsS7To5IQ=
+github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
+github.com/containerd/errdefs v1.0.0/go.mod h1:+YBYIdtsnF4Iw6nWZhJcqGSg/dwvV7tyJ/kCkyJ2k+M=
+github.com/containerd/errdefs/pkg v0.3.0 h1:9IKJ06FvyNlexW690DXuQNx2KA2cUJXx151Xdx3ZPPE=
+github.com/containerd/errdefs/pkg v0.3.0/go.mod h1:NJw6s9HwNuRhnjJhM7pylWwMyAkmCQvQ4GpJHEqRLVk=
 github.com/containerd/log v0.1.0 h1:TCJt7ioM2cr/tfR8GPbGf9/VRAX8D2B4PjzCpfX540I=
 github.com/containerd/log v0.1.0/go.mod h1:VRRf09a7mHDIRezVKTRCrOq78v577GXq3bSa3EhrzVo=
-github.com/containerd/platforms v0.2.1 h1:zvwtM3rz2YHPQsF2CHYM8+KtB5dvhISiXh5ZpSBQv6A=
-github.com/containerd/platforms v0.2.1/go.mod h1:XHCb+2/hzowdiut9rkudds9bE5yJ7npe7dG/wG+uFPw=
+github.com/containerd/platforms v1.0.0-rc.1 h1:83KIq4yy1erSRgOVHNk1HYdPvzdJ5CnsWaRoJX4C41E=
+github.com/containerd/platforms v1.0.0-rc.1/go.mod h1:J71L7B+aiM5SdIEqmd9wp6THLVRzJGXfNuWCZCllLA4=
 github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
 github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
 github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
@ -215,8 +222,8 @@ github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54 h1:SG7nF6SRlWhcT7c
 github.com/dgryski/trifles v0.0.0-20230903005119-f50d829f2e54/go.mod h1:if7Fbed8SFyPtHLHbg49SI7NAdJiC5WIA09pe59rfAA=
 github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk=
 github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
-github.com/docker/docker v28.1.1+incompatible h1:49M11BFLsVO1gxY9UX9p/zwkE/rswggs8AdFmXQw51I=
-github.com/docker/docker v28.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
+github.com/docker/docker v28.2.2+incompatible h1:CjwRSksz8Yo4+RmQ339Dp/D2tGO5JxwYeqtMOEe0LDw=
+github.com/docker/docker v28.2.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
 github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
 github.com/docker/go-connections v0.5.0/go.mod h1:ov60Kzw0kKElRwhNs9UlUHAE/F9Fe6GLaXnqyDdmEXc=
 github.com/docker/go-units v0.5.0 h1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=
@ -237,8 +244,8 @@ github.com/envoyproxy/go-control-plane/ratelimit v0.1.0/go.mod h1:Wk+tMFAFbCXaJP
 github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
 github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
 github.com/envoyproxy/protoc-gen-validate v1.2.1/go.mod h1:d/C80l/jxXLdfEIhX1W2TmLfsJ31lvEjwamM4DxlWXU=
-github.com/exaring/otelpgx v0.9.1 h1:S/1rUD76cXGG5GZISNazVjANpP14dIH4Bpvdb433T9Y=
-github.com/exaring/otelpgx v0.9.1/go.mod h1:+uyddQfZ+rsZGqfQ5TWvShOfkOT3kZLMu7FDzDoN1DY=
+github.com/exaring/otelpgx v0.9.3 h1:4yO02tXC7ZJZ+hcqcUkfxblYNCIFGVhpUWI0iw1TzPU=
+github.com/exaring/otelpgx v0.9.3/go.mod h1:R5/M5LWsPPBZc1SrRE5e0DiU48bI78C1/GPTWs6I66U=
 github.com/felixge/httpsnoop v1.0.4 h1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=
 github.com/felixge/httpsnoop v1.0.4/go.mod h1:m8KPJKqk1gH5J9DgRY2ASl2lWCfGKXixSwevea8zH2U=
 github.com/fortytw2/leaktest v1.3.0 h1:u8491cBMTQ8ft8aeV+adlcytMZylmA5nnwwkRZjI8vw=
@ -251,8 +258,8 @@ github.com/fsnotify/fsnotify v1.4.7/go.mod h1:jwhsz4b93w/PPRr/qN1Yymfu8t87LnFCMo
 github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4IgpuI1SZQ=
 github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
 github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.6.0 h1:sU6J2usfADwWlYDAFhZBQ6TnLFBHxgesMrQfQgk1tWA=
-github.com/fxamacker/cbor/v2 v2.6.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
+github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
+github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
 github.com/gaissmai/bart v0.20.4 h1:Ik47r1fy3jRVU+1eYzKSW3ho2UgBVTVnUS8O993584U=
 github.com/gaissmai/bart v0.20.4/go.mod h1:cEed+ge8dalcbpi8wtS9x9m2hn/fNJH5suhdGQOHnYk=
 github.com/getsentry/sentry-go v0.27.0 h1:Pv98CIbtB3LkMWmXi4Joa5OOcwbmnX88sF5qbK3r3Ps=
@ -338,7 +345,6 @@ github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaS
 github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
 github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
-github.com/golang/snappy v0.0.4/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/golang/snappy v0.0.5-0.20231225225746-43d5d4cd4e0e h1:4bw4WeyTYPp0smaXiJZCNnLrvVBqirQVreixayXezGc=
 github.com/golang/snappy v0.0.5-0.20231225225746-43d5d4cd4e0e/go.mod h1:/XxbfmMg8lxefKM7IXC3fBNl/7bRcc72aCRzEWrmP2Q=
 github.com/google/brotli/go/cbrotli v0.0.0-20230829110029-ed738e842d2f h1:jopqB+UTSdJGEJT8tEqYyE29zN91fi2827oLET8tl7k=
@ -366,8 +372,8 @@ github.com/google/go-cmp v0.5.9/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeN
 github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
-github.com/google/go-jsonnet v0.20.0 h1:WG4TTSARuV7bSm4PMB4ohjxe33IHT5WVTrJSU33uT4g=
-github.com/google/go-jsonnet v0.20.0/go.mod h1:VbgWF9JX7ztlv770x/TolZNGGFfiHEVx9G6ca2eUmeA=
+github.com/google/go-jsonnet v0.21.0 h1:43Bk3K4zMRP/aAZm9Po2uSEjY6ALCkYUVIcz9HLGMvA=
+github.com/google/go-jsonnet v0.21.0/go.mod h1:tCGAu8cpUpEZcdGMmdOu37nh8bGgqubhI5v2iSk3KJQ=
 github.com/google/go-tpm v0.9.0 h1:sQF6YqWMi+SCXpsmS3fd21oPy/vSddwZry4JnmltHVk=
 github.com/google/go-tpm v0.9.0/go.mod h1:FkNVkc6C+IsvDI9Jw1OveJmxGZUUaKxtrpOS47QWKfU=
 github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@ -395,8 +401,8 @@ github.com/googleapis/enterprise-certificate-proxy v0.3.6 h1:GW/XbdyBFQ8Qe+YAmFU
 github.com/googleapis/enterprise-certificate-proxy v0.3.6/go.mod h1:MkHOF77EYAE7qfSuSS9PU6g4Nt4e11cnsDUowfwewLA=
 github.com/googleapis/gax-go/v2 v2.0.4/go.mod h1:0Wqv26UfaUD9n4G6kQubkQ+KchISgw+vpHVxEJEs9eg=
 github.com/googleapis/gax-go/v2 v2.0.5/go.mod h1:DWXyrwAJ9X0FpwwEdw+IPEYBICEFu5mhpdKc/us6bOk=
-github.com/googleapis/gax-go/v2 v2.14.1 h1:hb0FFeiPaQskmvakKu5EbCbpntQn48jyHuvrkurSS/Q=
-github.com/googleapis/gax-go/v2 v2.14.1/go.mod h1:Hb/NubMaVM88SrNkvl8X/o8XWwDJEPqouaLeN2IUxoA=
+github.com/googleapis/gax-go/v2 v2.14.2 h1:eBLnkZ9635krYIPD+ag1USrOAI0Nr0QYF3+/3GqO0k0=
+github.com/googleapis/gax-go/v2 v2.14.2/go.mod h1:ON64QhlJkhVtSqp4v1uaK92VyZ2gmvDQsweuyLV+8+w=
 github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY=
 github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ=
 github.com/gorilla/securecookie v1.1.1 h1:miw7JPhV+b/lAHSXz4qd/nN9jRiAFV5FwjeKyCS8BvQ=
@ -428,8 +434,8 @@ github.com/jackc/pgpassfile v1.0.0 h1:/6Hmqy13Ss2zCq62VdNG8tM1wchn8zjSGOBJ6icpsI
 github.com/jackc/pgpassfile v1.0.0/go.mod h1:CEx0iS5ambNFdcRtxPj5JhEz+xB6uRky5eyVu/W2HEg=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 h1:iCEnooe7UlwOQYpKFhBabPMi4aNAfoODPEFNiAnClxo=
 github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761/go.mod h1:5TJZWKEWniPve33vlWYSoGYefn3gLQRzjfDlhSJ9ZKM=
-github.com/jackc/pgx/v5 v5.7.4 h1:9wKznZrhWa2QiHL+NjTSPP6yjl3451BX3imWDnokYlg=
-github.com/jackc/pgx/v5 v5.7.4/go.mod h1:ncY89UGWxg82EykZUwSpUKEfccBGGYq1xjrOpsbsfGQ=
+github.com/jackc/pgx/v5 v5.7.5 h1:JHGfMnQY+IEtGM63d+NGMjoRpysB2JBwDr5fsngwmJs=
+github.com/jackc/pgx/v5 v5.7.5/go.mod h1:aruU7o91Tc2q2cFp5h4uP3f6ztExVpyVv88Xl/8Vl8M=
 github.com/jackc/puddle/v2 v2.2.2 h1:PR8nw+E/1w0GLuRFSmiioY6UooMp6KJv0/61nB7icHo=
 github.com/jackc/puddle/v2 v2.2.2/go.mod h1:vriiEXHvEE654aYKXXjOvZM39qJ0q+azkZFrfEOc3H4=
 github.com/jpillora/backoff v1.0.0/go.mod h1:J/6gKK9jxlEcS3zixgDgUAsiuZ7yrSoa/FX5e0EB2j4=
@ -484,14 +490,14 @@ github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D
 github.com/matttproud/golang_protobuf_extensions v1.0.1/go.mod h1:D8He9yQNgCq6Z5Ld7szi9bcBfOoFv/3dc6xSMkL2PC0=
 github.com/mholt/acmez/v3 v3.1.2 h1:auob8J/0FhmdClQicvJvuDavgd5ezwLBfKuYmynhYzc=
 github.com/mholt/acmez/v3 v3.1.2/go.mod h1:L1wOU06KKvq7tswuMDwKdcHeKpFFgkppZy/y0DFxagQ=
-github.com/miekg/dns v1.1.65 h1:0+tIPHzUW0GCge7IiK3guGP57VAw7hoPDfApjkMD1Fc=
-github.com/miekg/dns v1.1.65/go.mod h1:Dzw9769uoKVaLuODMDZz9M6ynFU6Em65csPuoi8G0ck=
+github.com/miekg/dns v1.1.66 h1:FeZXOS3VCVsKnEAd+wBkjMC3D2K+ww66Cq3VnCINuJE=
+github.com/miekg/dns v1.1.66/go.mod h1:jGFzBsSNbJw6z1HYut1RKBKHA9PBdxeHrZG8J+gC2WE=
 github.com/minio/crc64nvme v1.0.1 h1:DHQPrYPdqK7jQG/Ls5CTBZWeex/2FMS3G5XGkycuFrY=
 github.com/minio/crc64nvme v1.0.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
-github.com/minio/minio-go/v7 v7.0.91 h1:tWLZnEfo3OZl5PoXQwcwTAPNNrjyWwOh6cbZitW5JQc=
-github.com/minio/minio-go/v7 v7.0.91/go.mod h1:uvMUcGrpgeSAAI6+sD3818508nUyMULw94j2Nxku/Go=
+github.com/minio/minio-go/v7 v7.0.92 h1:jpBFWyRS3p8P/9tsRc+NuvqoFi7qAmTCFPoRFmobbVw=
+github.com/minio/minio-go/v7 v7.0.92/go.mod h1:vTIc8DNcnAZIhyFsk8EB90AbPjj3j68aWIEQCiPj7d0=
 github.com/mitchellh/hashstructure/v2 v2.0.2 h1:vGKWl0YJqUNxE8d+h8f6NJLcCJrgbhC4NcD46KavDd4=
 github.com/mitchellh/hashstructure/v2 v2.0.2/go.mod h1:MG3aRVU/N29oo/V/IhBX8GR/zz4kQkprJgF2EVszyDE=
 github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c h1:cqn374mizHuIWj+OSJCajGr/phAmuMug9qIX3l9CflE=
@ -540,23 +546,25 @@ github.com/onsi/gomega v1.7.1/go.mod h1:XdKZgCCFLUoM/7CFJVPcG8C1xQ1AJ0vpAezJrB7J
 github.com/onsi/gomega v1.10.1/go.mod h1:iN09h71vgCQne3DLsj+A5owkum+a2tYe+TOCB1ybHNo=
 github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
 github.com/onsi/gomega v1.34.1/go.mod h1:kU1QgUvBDLXBJq618Xvm2LUX6rSAfRaFRTcdOeDLwwY=
-github.com/open-policy-agent/opa v1.4.2 h1:ag4upP7zMsa4WE2p1pwAFeG4Pn3mNwfAx9DLhhJfbjU=
-github.com/open-policy-agent/opa v1.4.2/go.mod h1:DNzZPKqKh4U0n0ANxcCVlw8lCSv2c+h5G/3QvSYdWZ8=
+github.com/open-policy-agent/opa v1.5.0 h1:npsQMUZvafCLYHofoNrZ0cSWbvoDpasvWtrHXdEvSuM=
+github.com/open-policy-agent/opa v1.5.0/go.mod h1:bYbS7u+uhTI+cxHQIpzvr5hxX0hV7urWtY+38ZtjMgk=
 github.com/opencontainers/go-digest v1.0.0 h1:apOUWs51W5PlhuyGyz9FCeeBIOUDA/6nW8Oi/yOhh5U=
 github.com/opencontainers/go-digest v1.0.0/go.mod h1:0JzlMkj0TRzQZfJkVvzbP0HBR3IKzErnv2BNG4W4MAM=
 github.com/opencontainers/image-spec v1.1.1 h1:y0fUlFfIZhPF1W537XOLg0/fcx6zcHCJwooC2xJA040=
 github.com/opencontainers/image-spec v1.1.1/go.mod h1:qpqAh3Dmcf36wStyyWU+kCeDgrGnAve2nCC8+7h8Q0M=
-github.com/pelletier/go-toml/v2 v2.2.3 h1:YmeHyLY8mFWbdkNWwpr+qIL2bEqT0o95WSdkNHvL12M=
-github.com/pelletier/go-toml/v2 v2.2.3/go.mod h1:MfCQTFTvCcUyyvvwm1+G6H/jORL20Xlb6rzQu9GuUkc=
+github.com/pelletier/go-toml/v2 v2.2.4 h1:mye9XuhQ6gvn5h28+VilKrrPoQVanw5PMw/TB0t5Ec4=
+github.com/pelletier/go-toml/v2 v2.2.4/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/peterbourgon/ff/v3 v3.4.0 h1:QBvM/rizZM1cB0p0lGMdmR7HxZeI/ZrBWB4DqLkMUBc=
 github.com/peterbourgon/ff/v3 v3.4.0/go.mod h1:zjJVUhx+twciwfDl0zBcFzl4dW8axCRyXE/eKY9RztQ=
+github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c h1:dAMKvw0MlJT1GshSTtih8C2gDs04w8dReiOGXrGLNoY=
+github.com/philhofer/fwd v1.1.3-0.20240916144458-20a13a1f6b7c/go.mod h1:RqIHx9QI14HlwKwm98g9Re5prTQ6LdeRQn+gXJFxsJM=
 github.com/pierrec/lz4/v4 v4.1.18/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ=
 github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4=
 github.com/pingcap/errors v0.11.4 h1:lFuQV/oaUMGcD2tqt+01ROSmJs75VG1ToEOkZIZ4nE4=
 github.com/pingcap/errors v0.11.4/go.mod h1:Oi8TUi2kEtXXLMJk9l1cGmz20kV3TaQ0usTwv5KuLY8=
-github.com/pires/go-proxyproto v0.8.0 h1:5unRmEAPbHXHuLjDg01CxJWf91cw3lKHc/0xzKpXEe0=
-github.com/pires/go-proxyproto v0.8.0/go.mod h1:iknsfgnH8EkjrMeMyvfKByp9TiBZCKZM0jx2xmKqnVY=
+github.com/pires/go-proxyproto v0.8.1 h1:9KEixbdJfhrbtjpz/ZwCdWDD2Xem0NZ38qMYaASJgp0=
+github.com/pires/go-proxyproto v0.8.1/go.mod h1:ZKAAyp3cgy5Y5Mo4n9AlScrkCZwUy0g3Jf+slqQVcuU=
 github.com/pkg/diff v0.0.0-20210226163009-20ebb0f2a09e/go.mod h1:pJLUxLENpZxwdsKMEsNbx1VGcRFpLqf3715MtcvvzbA=
 github.com/pkg/errors v0.8.0/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pkg/errors v0.8.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
@ -616,8 +624,8 @@ github.com/prometheus/statsd_exporter v0.22.7 h1:7Pji/i2GuhK6Lu7DHrtTkFmNBCudCPT
 github.com/prometheus/statsd_exporter v0.22.7/go.mod h1:N/TevpjkIh9ccs6nuzY3jQn9dFqnUakOjnEuMPJJJnI=
 github.com/quic-go/qpack v0.5.1 h1:giqksBPnT/HDtZ6VhtFKgoLOWmlyo9Ei6u9PqzIMbhI=
 github.com/quic-go/qpack v0.5.1/go.mod h1:+PC4XFrEskIVkcLzpEkbLqq1uCoxPhQuvK5rH1ZgaEg=
-github.com/quic-go/quic-go v0.51.0 h1:K8exxe9zXxeRKxaXxi/GpUqYiTrtdiWP8bo1KFya6Wc=
-github.com/quic-go/quic-go v0.51.0/go.mod h1:MFlGGpcpJqRAfmYi6NC2cptDPSxRWTOGNuP4wqrWmzQ=
+github.com/quic-go/quic-go v0.52.0 h1:/SlHrCRElyaU6MaEPKqKr9z83sBg2v4FLLvWM+Z47pA=
+github.com/quic-go/quic-go v0.52.0/go.mod h1:MFlGGpcpJqRAfmYi6NC2cptDPSxRWTOGNuP4wqrWmzQ=
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 h1:N/ElC8H3+5XpJzTSTfLsJV/mx9Q9g7kxmchpfZyxgzM=
 github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475/go.mod h1:bCqnVzQkZxMG4s8nGwiZ5l3QUCyqpo9Y+/ZMZ9VjZe4=
 github.com/rogpeppe/go-internal v1.3.0/go.mod h1:M8bDsm7K2OlrFYOpmOWEs/qY81heoFRclV5y23lUDJ4=
@ -698,6 +706,8 @@ github.com/tidwall/match v1.1.1 h1:+Ho715JplO36QYgwN9PGYNhgZvoUSc9X2c80KVTi+GA=
 github.com/tidwall/match v1.1.1/go.mod h1:eRSPERbgtNPcGhD8UCthc6PmLEQXEWd3PRB5JTxsfmM=
 github.com/tidwall/pretty v1.2.0 h1:RWIZEg2iJ8/g6fDDYzMpobmaoGh5OLl4AXtGUGPcqCs=
 github.com/tidwall/pretty v1.2.0/go.mod h1:ITEVvHYasfjBbM0u2Pg8T2nJnzm8xPwvNhhsoaGGjNU=
+github.com/tinylib/msgp v1.3.0 h1:ULuf7GPooDaIlbyvgAxBV/FI7ynli6LZ1/nVUNu+0ww=
+github.com/tinylib/msgp v1.3.0/go.mod h1:ykjzy2wzgrlvpDCRc4LA8UXy6D8bzMSuAF3WD57Gok0=
 github.com/tklauser/go-sysconf v0.3.14 h1:g5vzr9iPFFz24v2KZXs/pvpvh8/V9Fw6vQK5ZZb78yU=
 github.com/tklauser/go-sysconf v0.3.14/go.mod h1:1ym4lWMLUOhuBOPGtRcJm7tEGX4SCYNEEEtghGG/8uY=
 github.com/tklauser/numcpus v0.8.0 h1:Mx4Wwe/FjZLeQsK/6kt2EOepwwSl7SmJrK5bV/dXYgY=
@ -707,6 +717,8 @@ github.com/tniswong/go.rfcx v0.0.0-20181019234604-07783c52761f/go.mod h1:N+sR0vL
 github.com/ulikunitz/xz v0.5.11/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
 github.com/valyala/gozstd v1.20.1 h1:xPnnnvjmaDDitMFfDxmQ4vpx0+3CdTg2o3lALvXTU/g=
 github.com/valyala/gozstd v1.20.1/go.mod h1:y5Ew47GLlP37EkTB+B4s7r6A5rdaeB7ftbl9zoYiIPQ=
+github.com/vektah/gqlparser/v2 v2.5.26 h1:REqqFkO8+SOEgZHR/eHScjjVjGS8Nk3RMO/juiTobN4=
+github.com/vektah/gqlparser/v2 v2.5.26/go.mod h1:D1/VCZtV3LPnQrcPBeR/q5jkSQIPti0uYCP/RI0gIeo=
 github.com/volatiletech/null/v9 v9.0.0 h1:JCdlHEiSRVxOi7/MABiEfdsqmuj9oTV20Ao7VvZ0JkE=
 github.com/volatiletech/null/v9 v9.0.0/go.mod h1:zRFghPVahaiIMRXiUJrc6gsoG83Cm3ZoAfSTw7VHGQc=
 github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
@ -746,38 +758,38 @@ go.opencensus.io v0.24.0 h1:y73uSU6J157QMP2kn2r30vwW1A2W2WFwSCGnAVxeaD0=
 go.opencensus.io v0.24.0/go.mod h1:vNK8G9p7aAivkbmorf4v+7Hgx+Zs0yY+0fOtgBfjQKo=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
-go.opentelemetry.io/contrib/detectors/gcp v1.35.0 h1:bGvFt68+KTiAKFlacHW6AhA56GF2rS0bdD3aJYEnmzA=
-go.opentelemetry.io/contrib/detectors/gcp v1.35.0/go.mod h1:qGWP8/+ILwMRIUf9uIVLloR1uo5ZYAslM4O6OqUi1DA=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 h1:x7wzEgXfnzJcHDwStJT+mxOz4etr2EcexjqhBvmoakw=
-go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0/go.mod h1:rg+RlpR5dKwaS95IyyZqj5Wd4E13lk/msnTS0Xl9lJM=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 h1:sbiXRNDSWJOTobXh5HyQKjq6wUC5tNybqjIqDpAY4CU=
-go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0/go.mod h1:69uWxva0WgAA/4bu2Yy70SLDBwZXuQ6PbBpbsa5iZrQ=
-go.opentelemetry.io/contrib/propagators/autoprop v0.60.0 h1:sevByeAWTtfBdJQT7nkJfK5wOCjNpmDMZGPEBx3l1RA=
-go.opentelemetry.io/contrib/propagators/autoprop v0.60.0/go.mod h1:uEhyRPnUTSeUwMjDdrMQnsJ0sQ2mf/fA94hfchemm4A=
-go.opentelemetry.io/contrib/propagators/aws v1.35.0 h1:xoXA+5dVwsf5uE5GvSJ3lKiapyMFuIzbEmJwQ0JP+QU=
-go.opentelemetry.io/contrib/propagators/aws v1.35.0/go.mod h1:s11Orts/IzEgw9Srw5iRXtk2kM2j3jt/45noUWyf60E=
-go.opentelemetry.io/contrib/propagators/b3 v1.35.0 h1:DpwKW04LkdFRFCIgM3sqwTJA/QREHMeMHYPWP1WeaPQ=
-go.opentelemetry.io/contrib/propagators/b3 v1.35.0/go.mod h1:9+SNxwqvCWo1qQwUpACBY5YKNVxFJn5mlbXg/4+uKBg=
-go.opentelemetry.io/contrib/propagators/jaeger v1.35.0 h1:UIrZgRBHUrYRlJ4V419lVb4rs2ar0wFzKNAebaP05XU=
-go.opentelemetry.io/contrib/propagators/jaeger v1.35.0/go.mod h1:0ciyFyYZxE6JqRAQvIgGRabKWDUmNdW3GAQb6y/RlFU=
-go.opentelemetry.io/contrib/propagators/ot v1.35.0 h1:ZsgYijVvOpju4mq3g4QyqCwLKs2vKenlCpZHbKu50OA=
-go.opentelemetry.io/contrib/propagators/ot v1.35.0/go.mod h1:t1ZwtgjEtDH9uW6OlCRVLL2wOgsTJmp0pJwNouUq+HE=
+go.opentelemetry.io/contrib/detectors/gcp v1.36.0 h1:F7q2tNlCaHY9nMKHR6XH9/qkp8FktLnIcy6jJNyOCQw=
+go.opentelemetry.io/contrib/detectors/gcp v1.36.0/go.mod h1:IbBN8uAIIx734PTonTPxAxnjc2pQTxWNkwfstZ+6H2k=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 h1:q4XOmH/0opmeuJtPsbFNivyl7bCt7yRBbeEm2sC/XtQ=
+go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0/go.mod h1:snMWehoOh2wsEwnvvwtDyFCxVeDAODenXHtn5vzrKjo=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 h1:F7Jx+6hwnZ41NSFTO5q4LYDtJRXBf2PD0rNBkeB/lus=
+go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0/go.mod h1:UHB22Z8QsdRDrnAtX4PntOl36ajSxcdUMt1sF7Y6E7Q=
+go.opentelemetry.io/contrib/propagators/autoprop v0.61.0 h1:cxOVDJ30qfzV27G5p9WMtJUB/3cXC0iL+u9EV1fSOws=
+go.opentelemetry.io/contrib/propagators/autoprop v0.61.0/go.mod h1:Y+xiUbWetg65vAroDZcIzJ5wyPNWRH32EoIV9rIaa0g=
+go.opentelemetry.io/contrib/propagators/aws v1.36.0 h1:Txhy/1LZIbbnutftc5pdU8Y9vOQuAkuIOFXuLsdDejs=
+go.opentelemetry.io/contrib/propagators/aws v1.36.0/go.mod h1:M3A0491jGFPNHU8b3zEW7r/gtsMpGOsFUO3WL+SZ1xw=
+go.opentelemetry.io/contrib/propagators/b3 v1.36.0 h1:xrAb/G80z/l5JL6XlmUMSD1i6W8vXkWrLfmkD3w/zZo=
+go.opentelemetry.io/contrib/propagators/b3 v1.36.0/go.mod h1:UREJtqioFu5awNaCR8aEx7MfJROFlAWb6lPaJFbHaG0=
+go.opentelemetry.io/contrib/propagators/jaeger v1.36.0 h1:SoCgXYF4ISDtNyfLUzsGDaaudZVTx2yJhOyBO0+/GYk=
+go.opentelemetry.io/contrib/propagators/jaeger v1.36.0/go.mod h1:VHu48l0YTRKSObdPQ+Sb8xMZvdnJlN7yhHuHoPgNqHM=
+go.opentelemetry.io/contrib/propagators/ot v1.36.0 h1:UBoZjbx483GslNKYK2YpfvePTJV4BHGeFd8+b7dexiM=
+go.opentelemetry.io/contrib/propagators/ot v1.36.0/go.mod h1:adDDRry19/n9WoA7mSCMjoVJcmzK/bZYzX9SR+g2+W4=
 go.opentelemetry.io/otel v1.36.0 h1:UumtzIklRBY6cI/lllNZlALOF5nNIzJVb16APdvgTXg=
 go.opentelemetry.io/otel v1.36.0/go.mod h1:/TcFMXYjyRNh8khOAO9ybYkqaDBb/70aVwkNML4pP8E=
-go.opentelemetry.io/otel/bridge/opencensus v1.35.0 h1:4nJfffRbozhqnuukfRkiahA94mnpryCLJLiduMIDJKI=
-go.opentelemetry.io/otel/bridge/opencensus v1.35.0/go.mod h1:359S30saRYNsB4A46EDx91SpXsQFNgkma7ftg2/L5/M=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0 h1:QcFwRrZLc82r8wODjvyCbP7Ifp3UANaBSmhDSFjnqSc=
-go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.35.0/go.mod h1:CXIWhUomyWBG/oY2/r/kLp6K/cmx9e/7DLpBuuGdLCA=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0 h1:1fTNlAIJZGWLP5FVu0fikVry1IsiUnXjf7QFvoNN3Xw=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.35.0/go.mod h1:zjPK58DtkqQFn+YUMbx0M2XV3QgKU0gS9LeGohREyK4=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0 h1:m639+BofXTvcY1q8CGs4ItwQarYtJPOWmVobfM1HpVI=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.35.0/go.mod h1:LjReUci/F4BUyv+y4dwnq3h/26iNOeC3wAIqgvTIZVo=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 h1:xJ2qHD0C1BeYVTLLR9sX12+Qb95kfeD/byKj6Ky1pXg=
-go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0/go.mod h1:u5BF1xyjstDowA1R5QAO9JHzqK+ublenEW/dyqTjBVk=
+go.opentelemetry.io/otel/bridge/opencensus v1.36.0 h1:4xjPJlychCrPw88hMMDHniilph9ruW3HCcSvGmOlr8c=
+go.opentelemetry.io/otel/bridge/opencensus v1.36.0/go.mod h1:LhCga2zGvlPRQeBRnYsVtX99aeQmeKSigikuji7UE2o=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.36.0 h1:zwdo1gS2eH26Rg+CoqVQpEK1h8gvt5qyU5Kk5Bixvow=
+go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.36.0/go.mod h1:rUKCPscaRWWcqGT6HnEmYrK+YNe5+Sw64xgQTOJ5b30=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 h1:dNzwXjZKpMpE2JhmO+9HsPl42NIXFIFSUSSs0fiqra0=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0/go.mod h1:90PoxvaEB5n6AOdZvi+yWJQoE95U8Dhhw2bSyRqnTD0=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0 h1:JgtbA0xkWHnTmYk7YusopJFX6uleBmAuZ8n05NEh8nQ=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0/go.mod h1:179AK5aar5R3eS9FucPy6rggvU0g52cvKId8pv4+v0c=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.36.0 h1:nRVXXvf78e00EwY6Wp0YII8ww2JVWshZ20HfTlE11AM=
+go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.36.0/go.mod h1:r49hO7CgrxY9Voaj3Xe8pANWtr0Oq916d0XAmOoCZAQ=
 go.opentelemetry.io/otel/exporters/prometheus v0.58.0 h1:CJAxWKFIqdBennqxJyOgnt5LqkeFRT+Mz3Yjz3hL+h8=
 go.opentelemetry.io/otel/exporters/prometheus v0.58.0/go.mod h1:7qo/4CLI+zYSNbv0GMNquzuss2FVZo3OYrGh96n4HNc=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.35.0 h1:PB3Zrjs1sG1GBX51SXyTSoOTqcDglmsk7nT6tkKPb/k=
-go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.35.0/go.mod h1:U2R3XyVPzn0WX7wOIypPuptulsMcPDPs/oiSVOMVnHY=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0 h1:rixTyDGXFxRy1xzhKrotaHy3/KXdPhlWARrCgK+eqUY=
+go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.36.0/go.mod h1:dowW6UsM9MKbJq5JTz2AMVp3/5iW5I/TStsk8S+CfHw=
 go.opentelemetry.io/otel/metric v1.36.0 h1:MoWPKVhQvJ+eeXWHFBOPoBOi20jh6Iq2CcCREuTYufE=
 go.opentelemetry.io/otel/metric v1.36.0/go.mod h1:zC7Ks+yeyJt4xig9DEw9kuUFe5C3zLbVjV2PzT6qzbs=
 go.opentelemetry.io/otel/sdk v1.36.0 h1:b6SYIuLRs88ztox4EyrvRti80uXIFy+Sqzoh9kFULbs=
@ -786,8 +798,8 @@ go.opentelemetry.io/otel/sdk/metric v1.36.0 h1:r0ntwwGosWGaa0CrSt8cuNuTcccMXERFw
 go.opentelemetry.io/otel/sdk/metric v1.36.0/go.mod h1:qTNOhFDfKRwX0yXOqJYegL5WRaW376QbB7P4Pb0qva4=
 go.opentelemetry.io/otel/trace v1.36.0 h1:ahxWNuqZjpdiFAyrIoQ4GIiAIhxAunQR6MUoKrsNd4w=
 go.opentelemetry.io/otel/trace v1.36.0/go.mod h1:gQ+OnDZzrybY4k4seLzPAWNwVBBVlF2szhehOBB/tGA=
-go.opentelemetry.io/proto/otlp v1.6.0 h1:jQjP+AQyTf+Fe7OKj/MfkDrmK4MNVtw2NpXsf9fefDI=
-go.opentelemetry.io/proto/otlp v1.6.0/go.mod h1:cicgGehlFuNdgZkcALOCh3VE6K/u2tAjzlRhDwmVpZc=
+go.opentelemetry.io/proto/otlp v1.7.0 h1:jX1VolD6nHuFzOYso2E73H85i92Mv8JQYk0K9vz09os=
+go.opentelemetry.io/proto/otlp v1.7.0/go.mod h1:fSKjH6YJ7HDlwzltzyMj036AJ3ejJLCgCSHGj4efDDo=
 go.uber.org/automaxprocs v1.6.0 h1:O3y2/QNTOdbF+e/dpXNNW7Rx2hZ4sTIPyybbxyNqTUs=
 go.uber.org/automaxprocs v1.6.0/go.mod h1:ifeIMSnPZuznNm6jmdzmU3/bfk01Fe2fotchwEFJ8r8=
 go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
@ -820,8 +832,8 @@ golang.org/x/exp v0.0.0-20191227195350-da58074b4299/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u096TMicItID8zy7Y6sNkU49FU4=
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
-golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa h1:ELnwvuAXPNtPk1TJRuGkI9fDTwym6AYBu0qzT8AcHdI=
-golang.org/x/exp v0.0.0-20240808152545-0cdaa3abc0fa/go.mod h1:akd2r19cwCdwSwWeIdzYQGa/EZZyqcOdwWiwj5L5eKQ=
+golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f h1:XdNn9LlyWAhLVp6P/i8QYBW+hlyhrhei9uErw2B5GJo=
+golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f/go.mod h1:D5SMRVC3C2/4+F/DB1wZsLRnSNimn2Sp/NPsCrsv8ak=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
@ -968,7 +980,6 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
 golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
@ -1041,8 +1052,8 @@ golang.org/x/tools v0.0.0-20201224043029-2b0845dc783e/go.mod h1:emZCQorbCU4vsT4f
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
-golang.org/x/tools v0.31.0 h1:0EedkvKDbh+qistFTd0Bcwe/YLh4vHwWEkiI0toFIBU=
-golang.org/x/tools v0.31.0/go.mod h1:naFTU+Cev749tSJRXJlna0T3WxKvb1kWEx15xA4SdmQ=
+golang.org/x/tools v0.32.0 h1:Q7N1vhpkQv7ybVzLFtTjvQya2ewbwNDZzUgfXGqtMWU=
+golang.org/x/tools v0.32.0/go.mod h1:ZxrU41P/wAbZD8EDa6dDCa6XfpkhJ7HFMjHJXfBDu8s=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@ -1063,8 +1074,8 @@ google.golang.org/api v0.24.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0M
 google.golang.org/api v0.28.0/go.mod h1:lIXQywCXRcnZPGlsd8NbLnOjtAoL6em04bJ9+z0MncE=
 google.golang.org/api v0.29.0/go.mod h1:Lcubydp8VUV7KeIHD9z2Bys/sm/vGKnG1UHuDBSrHWM=
 google.golang.org/api v0.30.0/go.mod h1:QGmEvQ87FHZNiUVJkT14jQNYJ4ZJjdRF23ZXz5138Fc=
-google.golang.org/api v0.230.0 h1:2u1hni3E+UXAXrONrrkfWpi/V6cyKVAbfGVeGtC3OxM=
-google.golang.org/api v0.230.0/go.mod h1:aqvtoMk7YkiXx+6U12arQFExiRV9D/ekvMCwCd/TksQ=
+google.golang.org/api v0.235.0 h1:C3MkpQSRxS1Jy6AkzTGKKrpSCOd2WOGrezZ+icKSkKo=
+google.golang.org/api v0.235.0/go.mod h1:QpeJkemzkFKe5VCE/PMv7GsUfn9ZF+u+q1Q7w6ckxTg=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@ -1100,12 +1111,12 @@ google.golang.org/genproto v0.0.0-20200618031413-b414f8b61790/go.mod h1:jDfRM7Fc
 google.golang.org/genproto v0.0.0-20200729003335-053ba62fc06f/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200804131852-c06518451d9c/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
 google.golang.org/genproto v0.0.0-20200825200019-8632dd797987/go.mod h1:FWY/as6DDZQgahTzZj3fqbO1CbirC29ZNUFHwi0/+no=
-google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb h1:ITgPrl429bc6+2ZraNSzMDk3I95nmQln2fuPstKwFDE=
-google.golang.org/genproto v0.0.0-20250303144028-a0af3efb3deb/go.mod h1:sAo5UzpjUwgFBCzupwhcLcxHVDK7vG5IqI30YnwX2eE=
-google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34 h1:0PeQib/pH3nB/5pEmFeVQJotzGohV0dq4Vcp09H5yhE=
-google.golang.org/genproto/googleapis/api v0.0.0-20250428153025-10db94c68c34/go.mod h1:0awUlEkap+Pb1UMeJwJQQAdJQrt3moU7J2moTy69irI=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34 h1:h6p3mQqrmT1XkHVTfzLdNz1u7IhINeZkz67/xTbOuWs=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250428153025-10db94c68c34/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
+google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2 h1:1tXaIXCracvtsRxSBsYDiSBN0cuJvM7QYW+MrpIRY78=
+google.golang.org/genproto v0.0.0-20250505200425-f936aa4a68b2/go.mod h1:49MsLSx0oWMOZqcpB3uL8ZOkAh1+TndpJ8ONoCBWiZk=
+google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a h1:SGktgSolFCo75dnHJF2yMvnns6jCmHFJ0vE4Vn2JKvQ=
+google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a/go.mod h1:a77HrdMjoeKbnd2jmgcWdaS++ZLZAEq3orIOAEIKiVw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a h1:v2PbRU4K3llS09c7zodFpNePeamkAwG3mPrAery9VeE=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@ -1119,8 +1130,8 @@ google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3Iji
 google.golang.org/grpc v1.30.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.31.0/go.mod h1:N36X2cJ7JwdamYAgDz+s+rVMFjt3numwzf/HckM8pak=
 google.golang.org/grpc v1.33.2/go.mod h1:JMHMWHQWaTccqQQlmk3MJZS+GWXOdAesneDmEnv2fbc=
-google.golang.org/grpc v1.72.0 h1:S7UkcVa60b5AAQTaO6ZKamFp1zMZSU0fGDK2WZLbBnM=
-google.golang.org/grpc v1.72.0/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
+google.golang.org/grpc v1.72.2 h1:TdbGzwb82ty4OusHWepvFWGLgIbNo1/SUynEN0ssqv8=
+google.golang.org/grpc v1.72.2/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
 google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
--- a/integration/authentication_test.go
+++ b/integration/authentication_test.go
@ -16,7 +16,7 @@ import (
 )

 func TestRouteSessions(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*30)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*30)
 	defer clearTimeout()

 	testHTTPClient(t, func(t *testing.T, client *http.Client) {
--- a/integration/authorization_test.go
+++ b/integration/authorization_test.go
@ -12,7 +12,7 @@ import (
 )

 func TestAuthorization(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*30)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*30)
 	defer clearTimeout()

 	withBrowserAcceptHeader := flows.WithRequestHeader("Accept",
--- a/integration/benchmark_test.go
+++ b/integration/benchmark_test.go
@ -1,7 +1,6 @@
 package main

 import (
-	"context"
 	"net/http"
 	"testing"

@ -11,7 +10,7 @@ import (
 )

 func BenchmarkLoggedInUserAccess(b *testing.B) {
-	ctx := context.Background()
+	ctx := b.Context()
 	client := getClient(b, false)
 	res, err := flows.Authenticate(ctx, client, mustParseURL("https://httpdetails.localhost.pomerium.io/by-domain"),
 		flows.WithEmail("user1@dogs.test"))
@ -29,7 +28,7 @@ func BenchmarkLoggedInUserAccess(b *testing.B) {
 }

 func BenchmarkLoggedOutUserAccess(b *testing.B) {
-	ctx := context.Background()
+	ctx := b.Context()
 	client := getClient(b, false)

 	b.ResetTimer()
--- a/integration/control_plane_test.go
+++ b/integration/control_plane_test.go
@ -12,7 +12,7 @@ import (
 )

 func TestDashboard(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*30)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*30)
 	defer clearTimeout()

 	t.Run("user dashboard", func(t *testing.T) {
@ -52,7 +52,7 @@ func TestDashboard(t *testing.T) {
 }

 func TestHealth(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*30)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*30)
 	defer clearTimeout()

 	pomeriumRoutes := []string{
--- a/integration/policy_test.go
+++ b/integration/policy_test.go
@ -23,7 +23,7 @@ import (
 )

 func TestQueryStringParams(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	ctx, clearTimeout := context.WithTimeout(ctx, time.Second*30)
 	defer clearTimeout()

@ -59,7 +59,7 @@ func TestQueryStringParams(t *testing.T) {
 }

 func TestCORS(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	ctx, clearTimeout := context.WithTimeout(ctx, time.Second*30)
 	defer clearTimeout()

@ -102,7 +102,7 @@ func TestCORS(t *testing.T) {
 }

 func TestPreserveHostHeader(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	ctx, clearTimeout := context.WithTimeout(ctx, time.Second*30)
 	defer clearTimeout()

@ -162,7 +162,7 @@ func TestPreserveHostHeader(t *testing.T) {
 }

 func TestSetRequestHeaders(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	ctx, clearTimeout := context.WithTimeout(ctx, time.Second*30)
 	defer clearTimeout()

@ -192,7 +192,7 @@ func TestSetRequestHeaders(t *testing.T) {
 }

 func TestRemoveRequestHeaders(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	ctx, clearTimeout := context.WithTimeout(ctx, time.Second*30)
 	defer clearTimeout()

@ -223,7 +223,7 @@ func TestRemoveRequestHeaders(t *testing.T) {
 }

 func TestWebsocket(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	ctx, clearTimeout := context.WithTimeout(ctx, time.Second*30)
 	defer clearTimeout()

@ -258,7 +258,7 @@ func TestWebsocket(t *testing.T) {
 }

 func TestGoogleCloudRun(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	ctx, clearTimeout := context.WithTimeout(ctx, time.Second*30)
 	defer clearTimeout()

@ -289,7 +289,7 @@ func TestGoogleCloudRun(t *testing.T) {
 }

 func TestLoadBalancer(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Minute*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Minute*10)
 	defer clearTimeout()

 	getDistribution := func(t *testing.T, path string) map[string]float64 {
@ -361,7 +361,7 @@ func TestLoadBalancer(t *testing.T) {
 }

 func TestDownstreamClientCA(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Minute*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Minute*10)
 	defer clearTimeout()

 	t.Run("no client cert", func(t *testing.T) {
@ -428,7 +428,7 @@ func TestDownstreamClientCA(t *testing.T) {
 }

 func TestMultipleDownstreamClientCAs(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Minute*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Minute*10)
 	defer clearTimeout()

 	// Initializes a new http.Client with the given certificate.
@ -516,7 +516,7 @@ func TestMultipleDownstreamClientCAs(t *testing.T) {
 }

 func TestPomeriumJWT(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*30)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*30)
 	defer clearTimeout()

 	testHTTPClient(t, func(t *testing.T, client *http.Client) {
--- a/internal/authenticateflow/stateful_test.go
+++ b/internal/authenticateflow/stateful_test.go
@ -69,7 +69,7 @@ func TestStatefulSignIn(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			sessionStore := &mstore.Store{SaveError: tt.saveError}
-			flow, err := NewStateful(context.Background(), trace.NewNoopTracerProvider(), &config.Config{Options: opts}, sessionStore)
+			flow, err := NewStateful(t.Context(), trace.NewNoopTracerProvider(), &config.Config{Options: opts}, sessionStore)
 			if err != nil {
 				t.Fatal(err)
 			}
@ -123,12 +123,12 @@ func TestStatefulAuthenticateSignInURL(t *testing.T) {
 	opts.AuthenticateURLString = "https://authenticate.example.com"
 	key := cryptutil.NewKey()
 	opts.SharedKey = base64.StdEncoding.EncodeToString(key)
-	flow, err := NewStateful(context.Background(), trace.NewNoopTracerProvider(), &config.Config{Options: opts}, nil)
+	flow, err := NewStateful(t.Context(), trace.NewNoopTracerProvider(), &config.Config{Options: opts}, nil)
 	require.NoError(t, err)

 	t.Run("NilQueryParams", func(t *testing.T) {
 		redirectURL := &url.URL{Scheme: "https", Host: "example.com"}
-		u, err := flow.AuthenticateSignInURL(context.Background(), nil, redirectURL, "fake-idp-id", nil)
+		u, err := flow.AuthenticateSignInURL(t.Context(), nil, redirectURL, "fake-idp-id", nil)
 		assert.NoError(t, err)
 		parsed, _ := url.Parse(u)
 		assert.NoError(t, urlutil.NewSignedURL(key, parsed).Validate())
@ -143,7 +143,7 @@ func TestStatefulAuthenticateSignInURL(t *testing.T) {
 		redirectURL := &url.URL{Scheme: "https", Host: "example.com"}
 		q := url.Values{}
 		q.Set("foo", "bar")
-		u, err := flow.AuthenticateSignInURL(context.Background(), q, redirectURL, "fake-idp-id", nil)
+		u, err := flow.AuthenticateSignInURL(t.Context(), q, redirectURL, "fake-idp-id", nil)
 		assert.NoError(t, err)
 		parsed, _ := url.Parse(u)
 		assert.NoError(t, urlutil.NewSignedURL(key, parsed).Validate())
@ -158,7 +158,7 @@ func TestStatefulAuthenticateSignInURL(t *testing.T) {
 	t.Run("AdditionalHosts", func(t *testing.T) {
 		redirectURL := &url.URL{Scheme: "https", Host: "example.com"}
 		additionalHosts := []string{"foo.example.com", "bar.example.com:1234"}
-		u, err := flow.AuthenticateSignInURL(context.Background(), nil, redirectURL, "fake-idp-id", additionalHosts)
+		u, err := flow.AuthenticateSignInURL(t.Context(), nil, redirectURL, "fake-idp-id", additionalHosts)
 		assert.NoError(t, err)
 		parsed, _ := url.Parse(u)
 		assert.NoError(t, urlutil.NewSignedURL(key, parsed).Validate())
@ -253,7 +253,7 @@ func TestStatefulCallback(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			flow, err := NewStateful(context.Background(), trace.NewNoopTracerProvider(), &config.Config{Options: opts}, tt.sessionStore)
+			flow, err := NewStateful(t.Context(), trace.NewNoopTracerProvider(), &config.Config{Options: opts}, tt.sessionStore)
 			if err != nil {
 				t.Fatal(err)
 			}
@ -309,7 +309,7 @@ func TestStatefulCallback_AdditionalHosts(t *testing.T) {
 	sharedKey, _ := opts.GetSharedKey()

 	flow, err := NewStateful(
-		context.Background(),
+		t.Context(),
 		trace.NewNoopTracerProvider(),
 		&config.Config{Options: opts},
 		&mstore.Store{Session: &sessions.State{}},
@ -359,7 +359,7 @@ func TestStatefulCallback_AdditionalHosts(t *testing.T) {

 func TestStatefulRevokeSession(t *testing.T) {
 	opts := config.NewDefaultOptions()
-	flow, err := NewStateful(context.Background(), trace.NewNoopTracerProvider(), &config.Config{Options: opts}, nil)
+	flow, err := NewStateful(t.Context(), trace.NewNoopTracerProvider(), &config.Config{Options: opts}, nil)
 	require.NoError(t, err)

 	ctrl := gomock.NewController(t)
@ -370,7 +370,7 @@ func TestStatefulRevokeSession(t *testing.T) {
 	// fetch and delete a session record from the databroker and make a request
 	// to the identity provider to revoke the corresponding OAuth2 token.

-	ctx := context.Background()
+	ctx := t.Context()
 	authenticator := &mockAuthenticator{}
 	sessionState := &sessions.State{ID: "session-id"}
 	tokenExpiry := time.Date(2024, 1, 1, 12, 0, 0, 0, time.UTC)
@ -437,14 +437,14 @@ func TestPersistSession(t *testing.T) {

 	opts := config.NewDefaultOptions()
 	opts.CookieExpire = 4 * time.Hour
-	flow, err := NewStateful(context.Background(), trace.NewNoopTracerProvider(), &config.Config{Options: opts}, nil)
+	flow, err := NewStateful(t.Context(), trace.NewNoopTracerProvider(), &config.Config{Options: opts}, nil)
 	require.NoError(t, err)

 	ctrl := gomock.NewController(t)
 	client := mock_databroker.NewMockDataBrokerServiceClient(ctrl)
 	flow.dataBrokerClient = client

-	ctx := context.Background()
+	ctx := t.Context()

 	client.EXPECT().Get(ctx, protoEqualMatcher{
 		&databroker.GetRequest{
--- a/internal/autocert/manager_test.go
+++ b/internal/autocert/manager_test.go
@ -203,7 +203,7 @@ func newMockACME(ca *testCA, srv *httptest.Server) http.Handler {
 }

 func TestConfig(t *testing.T) {
-	ctx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(t.Context())
 	defer cancel()

 	var mockACME http.Handler
@ -316,7 +316,7 @@ func TestRedirect(t *testing.T) {
 			},
 		},
 	})
-	_, err = New(context.Background(), src)
+	_, err = New(t.Context(), src)
 	if !assert.NoError(t, err) {
 		return
 	}
--- a/internal/autocert/storage_test.go
+++ b/internal/autocert/storage_test.go
@ -19,7 +19,7 @@ func TestS3Storage(t *testing.T) {
 		t.Skip("Github action can not run docker on MacOS")
 	}

-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*30)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*30)
 	t.Cleanup(clearTimeout)

 	testutil.WithTestMinIO(t, "bucket", func(endpoint string) {
@ -32,7 +32,7 @@ func TestS3Storage(t *testing.T) {
 func runStorageTests(t *testing.T, s certmagic.Storage) {
 	t.Helper()

-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*30)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*30)
 	t.Cleanup(clearTimeout)

 	for _, key := range []string{"1", "a/1", "b/c/2"} {
--- a/internal/controlplane/events_test.go
+++ b/internal/controlplane/events_test.go
@ -35,7 +35,7 @@ func (mock *mockDataBrokerServer) SetOptions(ctx context.Context, req *databroke

 func TestEvents(t *testing.T) {
 	t.Run("saves events", func(t *testing.T) {
-		ctx := context.Background()
+		ctx := t.Context()
 		ctx, cancel := context.WithCancel(ctx)
 		defer cancel()
 		ctx, clearTimeout := context.WithTimeout(ctx, time.Second*5)
--- a/internal/controlplane/server_test.go
+++ b/internal/controlplane/server_test.go
@ -21,7 +21,7 @@ func TestServerHTTP(t *testing.T) {
 	ports, err := netutil.AllocatePorts(5)
 	require.NoError(t, err)

-	ctx := context.Background()
+	ctx := t.Context()
 	ctx, cancel := context.WithCancel(ctx)
 	defer cancel()

--- a/internal/controlplane/xdsmgr/xdsmgr_test.go
+++ b/internal/controlplane/xdsmgr/xdsmgr_test.go
@ -24,7 +24,7 @@ import (
 const bufSize = 1024 * 1024

 func TestManager(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	defer clearTimeout()

 	typeURL := "example.com/example"
--- a/internal/databroker/config_source_test.go
+++ b/internal/databroker/config_source_test.go
@ -32,7 +32,7 @@ func TestConfigSource(t *testing.T) {
 		return certPEM, keyPEM
 	}

-	ctx, clearTimeout := context.WithTimeout(context.Background(), 50*time.Second)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), 50*time.Second)
 	defer clearTimeout()

 	li, err := net.Listen("tcp", "127.0.0.1:0")
--- a/internal/databroker/server_test.go
+++ b/internal/databroker/server_test.go
@ -63,7 +63,7 @@ func TestServer_Get(t *testing.T) {
 		s := new(session.Session)
 		s.Id = "1"
 		data := protoutil.NewAny(s)
-		_, err := srv.Put(context.Background(), &databroker.PutRequest{
+		_, err := srv.Put(t.Context(), &databroker.PutRequest{
 			Records: []*databroker.Record{{
 				Type: data.TypeUrl,
 				Id:   s.Id,
@ -71,7 +71,7 @@ func TestServer_Get(t *testing.T) {
 			}},
 		})
 		assert.NoError(t, err)
-		_, err = srv.Put(context.Background(), &databroker.PutRequest{
+		_, err = srv.Put(t.Context(), &databroker.PutRequest{
 			Records: []*databroker.Record{{
 				Type:      data.TypeUrl,
 				Id:        s.Id,
@ -79,7 +79,7 @@ func TestServer_Get(t *testing.T) {
 			}},
 		})
 		assert.NoError(t, err)
-		_, err = srv.Get(context.Background(), &databroker.GetRequest{
+		_, err = srv.Get(t.Context(), &databroker.GetRequest{
 			Type: data.TypeUrl,
 			Id:   s.Id,
 		})
@ -97,7 +97,7 @@ func TestServer_Patch(t *testing.T) {
 		OauthToken: &session.OAuthToken{AccessToken: "access-token"},
 	}
 	data := protoutil.NewAny(s)
-	_, err := srv.Put(context.Background(), &databroker.PutRequest{
+	_, err := srv.Put(t.Context(), &databroker.PutRequest{
 		Records: []*databroker.Record{{
 			Type: data.TypeUrl,
 			Id:   s.Id,
@ -113,7 +113,7 @@ func TestServer_Patch(t *testing.T) {
 	s.AccessedAt = now
 	s.OauthToken.AccessToken = "access-token-field-ignored"
 	data = protoutil.NewAny(s)
-	patchResponse, err := srv.Patch(context.Background(), &databroker.PatchRequest{
+	patchResponse, err := srv.Patch(t.Context(), &databroker.PatchRequest{
 		Records: []*databroker.Record{{
 			Type: data.TypeUrl,
 			Id:   s.Id,
@ -128,7 +128,7 @@ func TestServer_Patch(t *testing.T) {
 		OauthToken: &session.OAuthToken{AccessToken: "access-token"},
 	}), patchResponse.GetRecord().GetData())

-	getResponse, err := srv.Get(context.Background(), &databroker.GetRequest{
+	getResponse, err := srv.Get(t.Context(), &databroker.GetRequest{
 		Type: data.TypeUrl,
 		Id:   s.Id,
 	})
@ -147,7 +147,7 @@ func TestServer_Options(t *testing.T) {
 	s := new(session.Session)
 	s.Id = "1"
 	data := protoutil.NewAny(s)
-	_, err := srv.Put(context.Background(), &databroker.PutRequest{
+	_, err := srv.Put(t.Context(), &databroker.PutRequest{
 		Records: []*databroker.Record{{
 			Type: data.TypeUrl,
 			Id:   s.Id,
@ -155,7 +155,7 @@ func TestServer_Options(t *testing.T) {
 		}},
 	})
 	assert.NoError(t, err)
-	_, err = srv.SetOptions(context.Background(), &databroker.SetOptionsRequest{
+	_, err = srv.SetOptions(t.Context(), &databroker.SetOptionsRequest{
 		Type: data.TypeUrl,
 		Options: &databroker.Options{
 			Capacity: proto.Uint64(1),
@ -168,21 +168,21 @@ func TestServer_Lease(t *testing.T) {
 	cfg := newServerConfig()
 	srv := newServer(cfg)

-	res, err := srv.AcquireLease(context.Background(), &databroker.AcquireLeaseRequest{
+	res, err := srv.AcquireLease(t.Context(), &databroker.AcquireLeaseRequest{
 		Name:     "TEST",
 		Duration: durationpb.New(time.Second * 10),
 	})
 	assert.NoError(t, err)
 	assert.NotEmpty(t, res.GetId())

-	_, err = srv.RenewLease(context.Background(), &databroker.RenewLeaseRequest{
+	_, err = srv.RenewLease(t.Context(), &databroker.RenewLeaseRequest{
 		Name:     "TEST",
 		Id:       res.GetId(),
 		Duration: durationpb.New(time.Second * 10),
 	})
 	assert.NoError(t, err)

-	_, err = srv.ReleaseLease(context.Background(), &databroker.ReleaseLeaseRequest{
+	_, err = srv.ReleaseLease(t.Context(), &databroker.ReleaseLeaseRequest{
 		Name: "TEST",
 		Id:   res.GetId(),
 	})
@ -197,7 +197,7 @@ func TestServer_Query(t *testing.T) {
 		s := new(session.Session)
 		s.Id = fmt.Sprint(i)
 		data := protoutil.NewAny(s)
-		_, err := srv.Put(context.Background(), &databroker.PutRequest{
+		_, err := srv.Put(t.Context(), &databroker.PutRequest{
 			Records: []*databroker.Record{{
 				Type: data.TypeUrl,
 				Id:   s.Id,
@ -206,7 +206,7 @@ func TestServer_Query(t *testing.T) {
 		})
 		assert.NoError(t, err)
 	}
-	res, err := srv.Query(context.Background(), &databroker.QueryRequest{
+	res, err := srv.Query(t.Context(), &databroker.QueryRequest{
 		Type: protoutil.GetTypeURL(new(session.Session)),
 		Filter: &structpb.Struct{
 			Fields: map[string]*structpb.Value{
@ -248,7 +248,7 @@ func TestServer_Sync(t *testing.T) {
 	s := new(session.Session)
 	s.Id = "1"
 	data := protoutil.NewAny(s)
-	_, err := srv.Put(context.Background(), &databroker.PutRequest{
+	_, err := srv.Put(t.Context(), &databroker.PutRequest{
 		Records: []*databroker.Record{{
 			Type: data.TypeUrl,
 			Id:   s.Id,
@ -263,7 +263,7 @@ func TestServer_Sync(t *testing.T) {
 	require.NoError(t, err)
 	defer li.Close()

-	eg, ctx := errgroup.WithContext(context.Background())
+	eg, ctx := errgroup.WithContext(t.Context())
 	eg.Go(func() error {
 		return gs.Serve(li)
 	})
@ -304,7 +304,7 @@ func TestServer_Sync(t *testing.T) {

 		}

-		_, err = srv.Put(context.Background(), &databroker.PutRequest{
+		_, err = srv.Put(t.Context(), &databroker.PutRequest{
 			Records: []*databroker.Record{{
 				Type: data.TypeUrl,
 				Id:   s.Id,
@ -332,7 +332,7 @@ func TestServerInvalidStorage(t *testing.T) {
 	s := new(session.Session)
 	s.Id = "1"
 	data := protoutil.NewAny(s)
-	_, err := srv.Put(context.Background(), &databroker.PutRequest{
+	_, err := srv.Put(t.Context(), &databroker.PutRequest{
 		Records: []*databroker.Record{{
 			Type: data.TypeUrl,
 			Id:   s.Id,
@ -358,7 +358,7 @@ func TestServerPostgres(t *testing.T) {
 		s := new(session.Session)
 		s.Id = "1"
 		data := protoutil.NewAny(s)
-		_, err := srv.Put(context.Background(), &databroker.PutRequest{
+		_, err := srv.Put(t.Context(), &databroker.PutRequest{
 			Records: []*databroker.Record{{
 				Type: data.TypeUrl,
 				Id:   s.Id,
@ -373,7 +373,7 @@ func TestServerPostgres(t *testing.T) {
 		require.NoError(t, err)
 		defer li.Close()

-		eg, ctx := errgroup.WithContext(context.Background())
+		eg, ctx := errgroup.WithContext(t.Context())
 		eg.Go(func() error {
 			return gs.Serve(li)
 		})
--- a/internal/enabler/enabler_test.go
+++ b/internal/enabler/enabler_test.go
@ -21,7 +21,7 @@ func TestEnabler(t *testing.T) {
 		e := enabler.New("test", enabler.HandlerFunc(func(_ context.Context) error {
 			return errors.New("ERROR")
 		}), true)
-		err := e.Run(context.Background())
+		err := e.Run(t.Context())
 		assert.Error(t, err)
 	})
 	t.Run("enabled delayed", func(t *testing.T) {
@ -31,13 +31,13 @@ func TestEnabler(t *testing.T) {
 			return errors.New("ERROR")
 		}), false)
 		time.AfterFunc(time.Millisecond*10, e.Enable)
-		err := e.Run(context.Background())
+		err := e.Run(t.Context())
 		assert.Error(t, err)
 	})
 	t.Run("disabled", func(t *testing.T) {
 		t.Parallel()

-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(t.Context())
 		t.Cleanup(cancel)

 		var started, stopped atomic.Int64
--- a/internal/events/target_test.go
+++ b/internal/events/target_test.go
@ -36,18 +36,18 @@ func TestTarget(t *testing.T) {
 		assert.Eventually(t, func() bool { return calls3.Load() == i3 }, time.Second, time.Millisecond)
 	}

-	target.Dispatch(context.Background(), 1)
+	target.Dispatch(t.Context(), 1)
 	shouldBe(1, 1, 1)

 	target.RemoveListener(h2)
-	target.Dispatch(context.Background(), 2)
+	target.Dispatch(t.Context(), 2)
 	shouldBe(3, 1, 3)

 	target.RemoveListener(h1)
-	target.Dispatch(context.Background(), 3)
+	target.Dispatch(t.Context(), 3)
 	shouldBe(3, 1, 6)

 	target.RemoveListener(h3)
-	target.Dispatch(context.Background(), 4)
+	target.Dispatch(t.Context(), 4)
 	shouldBe(3, 1, 6)
 }
--- a/internal/httputil/client_test.go
+++ b/internal/httputil/client_test.go
@ -1,7 +1,6 @@
 package httputil

 import (
-	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@ -20,6 +19,6 @@ func TestDefaultClient(t *testing.T) {
 	}))
 	defer ts.Close()
 	req, _ := http.NewRequest(http.MethodGet, ts.URL, nil)
-	req = req.WithContext(requestid.WithValue(context.Background(), "foo"))
+	req = req.WithContext(requestid.WithValue(t.Context(), "foo"))
 	_, _ = getDefaultClient().Do(req)
 }
--- a/internal/httputil/reproxy/reproxy_test.go
+++ b/internal/httputil/reproxy/reproxy_test.go
@ -1,7 +1,6 @@
 package reproxy

 import (
-	"context"
 	"io"
 	"net/http"
 	"net/http/httptest"
@ -58,7 +57,7 @@ func TestMiddleware(t *testing.T) {
 				}},
 			},
 		}
-		h.Update(context.Background(), cfg)
+		h.Update(t.Context(), cfg)

 		policyID, _ := cfg.Options.Policies[0].RouteID()

--- a/internal/retry/retry_test.go
+++ b/internal/retry/retry_test.go
@ -15,7 +15,7 @@ import (
 func TestRetry(t *testing.T) {
 	t.Parallel()

-	ctx := context.Background()
+	ctx := t.Context()
 	limit := retry.WithMaxInterval(time.Second * 5)

 	t.Run("no error", func(t *testing.T) {
--- a/internal/sessions/middleware_test.go
+++ b/internal/sessions/middleware_test.go
@ -24,7 +24,7 @@ func TestNewContext(t *testing.T) {
 		err  error
 		want context.Context
 	}{
-		{"simple", context.Background(), &sessions.State{ID: "xyz"}, nil, nil},
+		{"simple", t.Context(), &sessions.State{ID: "xyz"}, nil, nil},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
--- a/internal/telemetry/metrics/grpc_test.go
+++ b/internal/telemetry/metrics/grpc_test.go
@ -91,7 +91,7 @@ func Test_GRPCClientInterceptor(t *testing.T) {
 			}
 			var reply wrapperspb.StringValue

-			interceptor(context.Background(), tt.method, nil, &reply, newTestCC(t), invoker.UnaryInvoke)
+			interceptor(t.Context(), tt.method, nil, &reply, newTestCC(t), invoker.UnaryInvoke)

 			testDataRetrieval(GRPCClientResponseSizeView, t, tt.wantgrpcClientResponseSize)
 			testDataRetrieval(GRPCClientRequestDurationView, t, tt.wantgrpcClientRequestDuration)
--- a/internal/telemetry/metrics/info_test.go
+++ b/internal/telemetry/metrics/info_test.go
@ -1,7 +1,6 @@
 package metrics

 import (
-	"context"
 	"fmt"
 	"runtime"
 	"testing"
@ -29,7 +28,7 @@ func Test_SetConfigInfo(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			view.Unregister(InfoViews...)
 			view.Register(InfoViews...)
-			SetConfigInfo(context.Background(), "test_service", "test config", 0, tt.success)
+			SetConfigInfo(t.Context(), "test_service", "test config", 0, tt.success)

 			testDataRetrieval(ConfigLastReloadView, t, tt.wantLastReload)
 			testDataRetrieval(ConfigLastReloadSuccessView, t, tt.wantLastReloadSuccess)
@ -56,7 +55,7 @@ func Test_SetDBConfigInfo(t *testing.T) {
 		t.Run(fmt.Sprintf("version=%d errors=%d", tt.version, tt.errCount), func(t *testing.T) {
 			view.Unregister(InfoViews...)
 			view.Register(InfoViews...)
-			SetDBConfigInfo(context.TODO(), "test_service", "test_config", tt.version, tt.errCount)
+			SetDBConfigInfo(t.Context(), "test_service", "test_config", tt.version, tt.errCount)

 			testDataRetrieval(ConfigDBVersionView, t, tt.wantVersion)
 			testDataRetrieval(ConfigDBErrorsView, t, tt.wantErrors)
--- a/internal/telemetry/metrics/processes_test.go
+++ b/internal/telemetry/metrics/processes_test.go
@ -1,7 +1,6 @@
 package metrics

 import (
-	"context"
 	"net/http"
 	"net/http/httptest"
 	"os"
@ -28,7 +27,7 @@ func TestProcessCollector(t *testing.T) {
 	require.NoError(t, err)
 	defer view.Unregister(pc.Views()...)

-	err = pc.Measure(context.Background(), os.Getpid())
+	err = pc.Measure(t.Context(), os.Getpid())
 	require.NoError(t, err)

 	expect := []string{
--- a/internal/telemetry/metrics/storage_test.go
+++ b/internal/telemetry/metrics/storage_test.go
@ -1,7 +1,6 @@
 package metrics

 import (
-	"context"
 	"errors"
 	"testing"
 	"time"
@ -24,7 +23,7 @@ func Test_RecordStorageOperation(t *testing.T) {
 		t.Run(tt.name, func(t *testing.T) {
 			view.Unregister(StorageViews...)
 			view.Register(StorageViews...)
-			RecordStorageOperation(context.Background(), tt.tags, tt.duration)
+			RecordStorageOperation(t.Context(), tt.tags, tt.duration)

 			testDataRetrieval(StorageOperationDurationView, t, tt.want)
 		})
--- a/internal/testenv/environment.go
+++ b/internal/testenv/environment.go
@ -396,7 +396,7 @@ func New(t testing.TB, opts ...EnvironmentOption) Environment {

 	ctx := trace.Options{
 		DebugFlags: options.traceDebugFlags,
-	}.NewContext(logger.WithContext(context.Background()), options.traceClient)
+	}.NewContext(logger.WithContext(context.Background()), options.traceClient) //nolint:usetesting
 	tracerProvider := trace.NewTracerProvider(ctx, "Test Environment")
 	tracer := tracerProvider.Tracer(trace.PomeriumCoreTracer)
 	ctx, span := tracer.Start(ctx, t.Name(), oteltrace.WithNewRoot())
@ -1088,7 +1088,10 @@ func newOtelConfigFromEnv(t testing.TB) otelconfig.Config {
 	require.NoError(t, err)
 	defer os.Remove(f.Name())
 	f.Close()
-	cfg, err := config.NewFileOrEnvironmentSource(context.Background(), f.Name(), version.FullVersion())
+	cfg, err := config.NewFileOrEnvironmentSource(
+		context.Background(), //nolint:usetesting
+		f.Name(),
+		version.FullVersion())
 	require.NoError(t, err)
 	return cfg.GetConfig().Options.Tracing
 }
--- a/internal/testenv/selftests/tracing_test.go
+++ b/internal/testenv/selftests/tracing_test.go
@ -136,7 +136,7 @@ func TestOTLPTracing_TraceCorrelation(t *testing.T) {
 	env.Start()
 	snippets.WaitStartupComplete(env)

-	resp, err := up.Get(route, upstreams.AuthenticateAs("foo@example.com"), upstreams.Path("/foo"), upstreams.Context(context.Background()))
+	resp, err := up.Get(route, upstreams.AuthenticateAs("foo@example.com"), upstreams.Path("/foo"), upstreams.Context(t.Context()))
 	require.NoError(t, err)
 	body, err := io.ReadAll(resp.Body)
 	assert.NoError(t, err)
@ -342,7 +342,7 @@ func TestExternalSpans(t *testing.T) {
 	require.NoError(t, external.Start(env.Context()))
 	snippets.WaitStartupComplete(env)

-	ctx, span := externalTracerProvider.Tracer("external").Start(context.Background(), "External Root", oteltrace.WithNewRoot())
+	ctx, span := externalTracerProvider.Tracer("external").Start(t.Context(), "External Root", oteltrace.WithNewRoot())
 	t.Logf("external span id: %s", span.SpanContext().SpanID().String())
 	resp, err := up.Get(route, upstreams.AuthenticateAs("foo@example.com"), upstreams.Path("/foo"), upstreams.Context(ctx))
 	span.End()
@ -353,8 +353,8 @@ func TestExternalSpans(t *testing.T) {
 	assert.Equal(t, resp.StatusCode, 200)
 	assert.Equal(t, "OK", string(body))

-	assert.NoError(t, externalTracerProvider.ForceFlush(context.Background()))
-	assert.NoError(t, externalTracerProvider.Shutdown(context.Background()))
+	assert.NoError(t, externalTracerProvider.ForceFlush(t.Context()))
+	assert.NoError(t, externalTracerProvider.Shutdown(t.Context()))
 	assert.NoError(t, external.Shutdown(ctx))
 	env.Stop()

--- a/internal/testutil/context.go
+++ b/internal/testutil/context.go
@ -10,7 +10,7 @@ import (
 func GetContext(t *testing.T, maxWait time.Duration) context.Context {
 	t.Helper()

-	ctx := context.Background()
+	ctx := t.Context()
 	ctx, clearTimeout := context.WithTimeout(ctx, maxWait)
 	t.Cleanup(clearTimeout)

--- a/internal/zero/bootstrap/source_test.go
+++ b/internal/zero/bootstrap/source_test.go
@ -57,7 +57,7 @@ func TestConfigChanges(t *testing.T) {
 	} {
 		t.Run(fmt.Sprintf("test-%d", i), func(t *testing.T) {
 			listenerCalled = false
-			changed := src.UpdateBootstrap(context.Background(), tc.bootstrap)
+			changed := src.UpdateBootstrap(t.Context(), tc.bootstrap)
 			cfg := src.GetConfig()
 			assert.Equal(t, tc.expectChanged, changed, "changed")
 			assert.Equal(t, tc.expectChanged, listenerCalled, "listenerCalled")
--- a/internal/zero/bootstrap/writers/filesystem/file_test.go
+++ b/internal/zero/bootstrap/writers/filesystem/file_test.go
@ -1,7 +1,6 @@
 package filesystem_test

 import (
-	"context"
 	"fmt"
 	"os"
 	"testing"
@ -34,7 +33,7 @@ func TestFileWriter(t *testing.T) {
 	writer = writer.WithOptions(writers.ConfigWriterOptions{
 		Cipher: cipher,
 	})
-	require.NoError(t, bootstrap.SaveBootstrapConfig(context.Background(), writer, &src))
+	require.NoError(t, bootstrap.SaveBootstrapConfig(t.Context(), writer, &src))

 	dst, err := bootstrap.LoadBootstrapConfigFromFile(fd.Name(), cipher)
 	require.NoError(t, err)
--- a/internal/zero/bootstrap/writers/k8s/secret_test.go
+++ b/internal/zero/bootstrap/writers/k8s/secret_test.go
@ -2,7 +2,6 @@ package k8s

 import (
 	"bytes"
-	"context"
 	"crypto/tls"
 	"crypto/x509"
 	"encoding/base64"
@ -28,7 +27,7 @@ import (
 func TestSecretWriter(t *testing.T) {
 	requests := make(chan *http.Request, 1)
 	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		req := r.Clone(context.Background())
+		req := r.Clone(t.Context())
 		contents, _ := io.ReadAll(r.Body)
 		req.Body = io.NopCloser(bytes.NewReader(contents))
 		requests <- req
@ -71,7 +70,7 @@ func TestSecretWriter(t *testing.T) {
 			Cipher: cipher,
 		})

-		require.NoError(t, bootstrap.SaveBootstrapConfig(context.Background(), writer, &src))
+		require.NoError(t, bootstrap.SaveBootstrapConfig(t.Context(), writer, &src))

 		r := <-requests
 		assert.Equal(t, "PATCH", r.Method)
--- a/internal/zero/controller/databroker_restart_test.go
+++ b/internal/zero/controller/databroker_restart_test.go
@ -48,7 +48,7 @@ func TestDatabrokerRestart(t *testing.T) {
 		src.On("OnConfigChange", mock.Anything, mock.Anything).Once()
 		src.On("GetConfig").Once().Return(newConfig())

-		ctx := context.Background()
+		ctx := t.Context()
 		r := controller.NewDatabrokerRestartRunner(ctx, src)
 		defer r.Close()

@ -64,7 +64,7 @@ func TestDatabrokerRestart(t *testing.T) {
 		src.On("OnConfigChange", mock.Anything, mock.Anything).Once()
 		src.On("GetConfig").Once().Return(newConfig())

-		ctx := context.Background()
+		ctx := t.Context()
 		r := controller.NewDatabrokerRestartRunner(ctx, src)
 		defer r.Close()

@ -89,7 +89,7 @@ func TestDatabrokerRestart(t *testing.T) {
 		})
 		src.On("GetConfig").Once().Return(newConfig())

-		ctx := context.Background()
+		ctx := t.Context()
 		r := controller.NewDatabrokerRestartRunner(ctx, src)
 		defer r.Close()

@ -99,7 +99,7 @@ func TestDatabrokerRestart(t *testing.T) {
 			clients[count] = client
 			count++
 			if count == 1 {
-				cl(context.Background(), newConfig())
+				cl(t.Context(), newConfig())
 				<-ctx.Done()
 				require.ErrorIs(t, context.Cause(ctx), controller.ErrBootstrapConfigurationChanged)
 				return context.Cause(ctx)
--- a/internal/zero/controller/usagereporter/usagereporter_test.go
+++ b/internal/zero/controller/usagereporter/usagereporter_test.go
@ -31,7 +31,7 @@ func (m mockAPI) ReportUsage(ctx context.Context, req cluster.ReportUsageRequest
 func TestUsageReporter(t *testing.T) {
 	t.Parallel()

-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	ctx, cancel := context.WithCancel(ctx)
--- a/internal/zero/token/cache_test.go
+++ b/internal/zero/token/cache_test.go
@ -33,7 +33,7 @@ func TestCache(t *testing.T) {
 		c.TimeNow = func() time.Time { return now }

 		testToken = &token.Token{"bearer-1", now.Add(time.Hour)}
-		bearer, err := c.GetToken(context.Background(), time.Minute)
+		bearer, err := c.GetToken(t.Context(), time.Minute)
 		require.NoError(t, err)
 		assert.Equal(t, "bearer-1", bearer)

@ -41,13 +41,13 @@ func TestCache(t *testing.T) {
 		testToken.Bearer = "bearer-2"

 		// token is still valid, so we should get the same one
-		bearer, err = c.GetToken(context.Background(), time.Minute*20)
+		bearer, err = c.GetToken(t.Context(), time.Minute*20)
 		require.NoError(t, err)
 		assert.Equal(t, "bearer-1", bearer)

 		now = now.Add(time.Minute * 30)
 		testToken = &token.Token{"bearer-3", now.Add(time.Hour)}
-		bearer, err = c.GetToken(context.Background(), time.Minute*30)
+		bearer, err = c.GetToken(t.Context(), time.Minute*30)
 		require.NoError(t, err)
 		assert.Equal(t, "bearer-3", bearer)
 	})
@ -61,7 +61,7 @@ func TestCache(t *testing.T) {
 			return &token.Token{fmt.Sprintf("bearer-%d", calls), time.Now().Add(time.Hour)}, nil
 		}

-		ctx := context.Background()
+		ctx := t.Context()
 		c := token.NewCache(fetcher, "test-refresh-token")
 		got, err := c.GetToken(ctx, time.Minute*2)
 		assert.NoError(t, err)
--- a/pkg/contextutil/contextutil_test.go
+++ b/pkg/contextutil/contextutil_test.go
@ -15,16 +15,16 @@ func TestMerge(t *testing.T) {
 		k1 := contextKey("key1")
 		k2 := contextKey("key2")

-		ctx1 := context.WithValue(context.Background(), k1, "value1")
-		ctx2 := context.WithValue(context.Background(), k2, "value2")
+		ctx1 := context.WithValue(t.Context(), k1, "value1")
+		ctx2 := context.WithValue(t.Context(), k2, "value2")
 		ctx3, _ := Merge(ctx1, ctx2)
 		assert.Equal(t, "value1", ctx3.Value(k1))
 		assert.Equal(t, "value2", ctx3.Value(k2))
 	})
 	t.Run("cancel", func(t *testing.T) {
-		ctx1, cancel1 := context.WithCancel(context.Background())
+		ctx1, cancel1 := context.WithCancel(t.Context())
 		defer cancel1()
-		ctx2, cancel2 := context.WithCancel(context.Background())
+		ctx2, cancel2 := context.WithCancel(t.Context())
 		ctx3, _ := Merge(ctx1, ctx2)
 		cancel2()
 		assert.Eventually(t, func() bool {
--- a/pkg/envoy/envoy_test.go
+++ b/pkg/envoy/envoy_test.go
@ -1,7 +1,6 @@
 package envoy

 import (
-	"context"
 	"io"
 	"regexp"
 	"strings"
@ -44,6 +43,6 @@ func Benchmark_handleLogs(b *testing.B) {
 	b.ResetTimer()
 	b.ReportAllocs()
 	for i := 0; i < b.N; i++ {
-		srv.handleLogs(context.Background(), rc)
+		srv.handleLogs(b.Context(), rc)
 	}
 }
--- a/pkg/envoy/resource_monitor_test.go
+++ b/pkg/envoy/resource_monitor_test.go
@ -606,7 +606,7 @@ func TestSharedResourceMonitor(t *testing.T) {
 	}

 	configSrc := config.NewStaticSource(&config.Config{})
-	monitor, err := NewSharedResourceMonitor(context.Background(), configSrc, tempDir, WithCgroupDriver(driver))
+	monitor, err := NewSharedResourceMonitor(t.Context(), configSrc, tempDir, WithCgroupDriver(driver))
 	require.NoError(t, err)

 	readMemorySaturation := func(t assert.TestingT) string {
@ -617,7 +617,7 @@ func TestSharedResourceMonitor(t *testing.T) {

 	assert.Equal(t, "0", readMemorySaturation(t))

-	ctx, ca := context.WithCancel(context.Background())
+	ctx, ca := context.WithCancel(t.Context())

 	errC := make(chan error)
 	go func() {
@ -693,13 +693,13 @@ func TestSharedResourceMonitor(t *testing.T) {
 	// test deletion of memory.max
 	updateMemoryCurrent("150")
 	updateMemoryMax("300")
-	monitor, err = NewSharedResourceMonitor(context.Background(), configSrc, tempDir, WithCgroupDriver(driver))
+	monitor, err = NewSharedResourceMonitor(t.Context(), configSrc, tempDir, WithCgroupDriver(driver))
 	require.NoError(t, err)

 	errC = make(chan error)
 	go func() {
 		defer close(errC)
-		errC <- monitor.Run(context.Background(), testEnvoyPid)
+		errC <- monitor.Run(t.Context(), testEnvoyPid)
 	}()

 	// 150/300
@ -716,7 +716,7 @@ func TestBootstrapConfig(t *testing.T) {
 	b := envoyconfig.New("localhost:1111", "localhost:2222", "localhost:3333", filemgr.NewManager(), nil, true)
 	testEnvoyPid := 99
 	tempDir := t.TempDir()
-	monitor, err := NewSharedResourceMonitor(context.Background(), config.NewStaticSource(nil), tempDir, WithCgroupDriver(&cgroupV2Driver{
+	monitor, err := NewSharedResourceMonitor(t.Context(), config.NewStaticSource(nil), tempDir, WithCgroupDriver(&cgroupV2Driver{
 		root: "sys/fs/cgroup",
 		fs: &hybridTestFS{
 			base: with(v2Fs, fstest.MapFS{
@ -730,7 +730,7 @@ func TestBootstrapConfig(t *testing.T) {
 	}))
 	require.NoError(t, err)

-	bootstrap, err := b.BuildBootstrap(context.Background(), &config.Config{
+	bootstrap, err := b.BuildBootstrap(t.Context(), &config.Config{
 		Options: &config.Options{
 			EnvoyAdminAddress: "localhost:9901",
 		},
--- a/pkg/fanout/fanout_test.go
+++ b/pkg/fanout/fanout_test.go
@ -17,15 +17,15 @@ import (
 func TestFanOutStopped(t *testing.T) {
 	t.Parallel()

-	ctx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(t.Context())
 	cancel()

 	f := fanout.Start[int](ctx, fanout.WithPublishTimeout(time.Millisecond*10))
 	assert.Eventually(t, func() bool {
-		return errors.Is(f.Publish(context.Background(), 1), fanout.ErrStopped)
+		return errors.Is(f.Publish(t.Context(), 1), fanout.ErrStopped)
 	}, 5*time.Second, 10*time.Millisecond)

-	err := f.Receive(context.Background(), func(_ context.Context, _ int) error {
+	err := f.Receive(t.Context(), func(_ context.Context, _ int) error {
 		return nil
 	})
 	assert.ErrorIs(t, err, fanout.ErrStopped)
@ -35,7 +35,7 @@ func TestFanOutEvictSlowSubscriber(t *testing.T) {
 	t.Parallel()

 	timeout := time.Second * 5
-	ctx, cancel := context.WithTimeout(context.Background(), timeout)
+	ctx, cancel := context.WithTimeout(t.Context(), timeout)
 	t.Cleanup(cancel)

 	f := fanout.Start[int](ctx,
@ -82,7 +82,7 @@ func TestFanOutEvictSlowSubscriber(t *testing.T) {
 func TestFanOutReceiverCancelOnError(t *testing.T) {
 	t.Parallel()

-	ctx, cancel := context.WithCancel(context.Background())
+	ctx, cancel := context.WithCancel(t.Context())
 	t.Cleanup(cancel)

 	f := fanout.Start[int](ctx)
@ -104,7 +104,7 @@ func TestFanOutReceiverCancelOnError(t *testing.T) {
 func TestFanOutFilter(t *testing.T) {
 	t.Parallel()

-	ctx, cancel := context.WithTimeout(context.Background(), time.Second*5)
+	ctx, cancel := context.WithTimeout(t.Context(), time.Second*5)
 	t.Cleanup(cancel)

 	f := fanout.Start[int](ctx)
@ -132,7 +132,7 @@ func TestFanOutFilter(t *testing.T) {
 }

 func BenchmarkFanout(b *testing.B) {
-	ctx, cancel := context.WithTimeout(context.Background(), time.Minute*10)
+	ctx, cancel := context.WithTimeout(b.Context(), time.Minute*10)
 	b.Cleanup(cancel)

 	cycles := 1
--- a/pkg/grpc/databroker/databroker_test.go
+++ b/pkg/grpc/databroker/databroker_test.go
@ -57,7 +57,7 @@ func TestApplyOffsetAndLimit(t *testing.T) {
 }

 func TestInitialSync(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	defer clearTimeout()

 	li, err := net.Listen("tcp", "127.0.0.1:0")
--- a/pkg/grpc/databroker/fast_forward_test.go
+++ b/pkg/grpc/databroker/fast_forward_test.go
@ -38,7 +38,7 @@ func (ff *mockFF) getUpdate(ctx context.Context) (uint64, error) {
 }

 func TestFastForward(t *testing.T) {
-	ctx, cancel := context.WithTimeout(context.Background(), time.Second*15)
+	ctx, cancel := context.WithTimeout(t.Context(), time.Second*15)
 	defer cancel()

 	m := &mockFF{
--- a/pkg/grpc/databroker/leaser_test.go
+++ b/pkg/grpc/databroker/leaser_test.go
@ -52,7 +52,7 @@ func TestLeaser(t *testing.T) {
 			Times(1)

 		leaser := databroker.NewLeaser("TEST", time.Second*30, handler)
-		err := leaser.Run(context.Background())
+		err := leaser.Run(t.Context())
 		assert.Equal(t, exitErr, err)
 	})
 	t.Run("retries acquire", func(t *testing.T) {
@ -91,7 +91,7 @@ func TestLeaser(t *testing.T) {
 			Times(1)

 		leaser := databroker.NewLeaser("TEST", time.Second*30, handler)
-		err := leaser.Run(context.Background())
+		err := leaser.Run(t.Context())
 		assert.Equal(t, exitErr, err)
 	})
 	t.Run("renews", func(t *testing.T) {
@ -133,7 +133,7 @@ func TestLeaser(t *testing.T) {
 			Times(1)

 		leaser := databroker.NewLeaser("TEST", time.Millisecond, handler)
-		err := leaser.Run(context.Background())
+		err := leaser.Run(t.Context())
 		assert.Equal(t, exitErr, err)
 	})
 }
@ -172,7 +172,7 @@ func TestLeasers(t *testing.T) {
 		return context.Cause(ctx)
 	}
 	leaser := databroker.NewLeasers("TEST", time.Second*30, client, fn1, fn2)
-	err := leaser.Run(context.Background())
+	err := leaser.Run(t.Context())
 	assert.Equal(t, exitErr, err)
 	assert.EqualValues(t, 11, counter)
 }
--- a/pkg/grpc/databroker/sync_cache_test.go
+++ b/pkg/grpc/databroker/sync_cache_test.go
@ -24,7 +24,7 @@ import (
 func TestSyncCache(t *testing.T) {
 	t.Parallel()

-	ctx, cancel := context.WithTimeout(context.Background(), time.Second*15)
+	ctx, cancel := context.WithTimeout(t.Context(), time.Second*15)
 	defer cancel()

 	prefix := []byte{1, 2, 3}
--- a/pkg/grpc/databroker/sync_test.go
+++ b/pkg/grpc/databroker/sync_test.go
@ -21,7 +21,7 @@ import (
 func Test_SyncLatestRecords(t *testing.T) {
 	t.Parallel()

-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Minute)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Minute)
 	defer clearTimeout()

 	cc := testutil.NewGRPCServer(t, func(s *grpc.Server) {
@ -58,7 +58,7 @@ func Test_SyncLatestRecords(t *testing.T) {
 	require.NoError(t, err)

 	var actual []*user.User
-	serverVersion, latestRecordVersion, err := databrokerpb.SyncLatestRecords(context.Background(), c, func(u *user.User) {
+	serverVersion, latestRecordVersion, err := databrokerpb.SyncLatestRecords(t.Context(), c, func(u *user.User) {
 		actual = append(actual, u)
 	})
 	assert.NoError(t, err)
--- a/pkg/grpc/databroker/syncer_test.go
+++ b/pkg/grpc/databroker/syncer_test.go
@ -49,7 +49,7 @@ func (t testServer) SyncLatest(req *SyncLatestRequest, server DataBrokerService_
 }

 func TestSyncer(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	ctx, clearTimeout := context.WithTimeout(ctx, time.Second*10)
 	defer clearTimeout()
 	ctx, cancel := context.WithCancel(ctx)
--- a/pkg/grpc/session/session_test.go
+++ b/pkg/grpc/session/session_test.go
@ -28,7 +28,7 @@ func TestDelete(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	client := mock_databroker.NewMockDataBrokerServiceClient(ctrl)

-	ctx := context.Background()
+	ctx := t.Context()
 	rpcErr := status.Error(codes.Unavailable, "dummy error for testing")

 	client.EXPECT().Put(ctx, gomock.Any(), []grpc.CallOption{}).DoAndReturn(
@ -50,7 +50,7 @@ func TestDelete(t *testing.T) {
 func TestGet(t *testing.T) {
 	t.Parallel()

-	ctx := context.Background()
+	ctx := t.Context()

 	t.Run("ok", func(t *testing.T) {
 		t.Parallel()
@ -114,7 +114,7 @@ func TestPut(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	client := mock_databroker.NewMockDataBrokerServiceClient(ctrl)

-	ctx := context.Background()
+	ctx := t.Context()

 	dummyPutResponse := &databroker.PutResponse{}
 	rpcErr := status.Error(codes.Unavailable, "dummy error for testing")
@ -145,7 +145,7 @@ func TestPatch(t *testing.T) {
 	ctrl := gomock.NewController(t)
 	client := mock_databroker.NewMockDataBrokerServiceClient(ctrl)

-	ctx := context.Background()
+	ctx := t.Context()

 	dummyFieldMask := &fieldmaskpb.FieldMask{}
 	dummyPatchResponse := &databroker.PatchResponse{}
--- a/pkg/grpcutil/grpcutil_test.go
+++ b/pkg/grpcutil/grpcutil_test.go
@ -1,7 +1,6 @@
 package grpcutil

 import (
-	"context"
 	"testing"

 	"github.com/stretchr/testify/assert"
@ -9,7 +8,7 @@ import (
 )

 func TestWithOutgoingSessionID(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	ctx = WithOutgoingSessionID(ctx, "EXAMPLE")
 	md, ok := metadata.FromOutgoingContext(ctx)
 	if !assert.True(t, ok) {
@ -19,7 +18,7 @@ func TestWithOutgoingSessionID(t *testing.T) {
 }

 func TestSessionIDFromGRPCRequest(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	ctx = metadata.NewIncomingContext(ctx, metadata.MD{
 		"sessionid": {"EXAMPLE"},
 	})
@ -30,7 +29,7 @@ func TestSessionIDFromGRPCRequest(t *testing.T) {

 func TestWithOutgoingJWT(t *testing.T) {
 	rawjwt := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
-	ctx := context.Background()
+	ctx := t.Context()
 	ctx = WithOutgoingJWT(ctx, rawjwt)
 	md, ok := metadata.FromOutgoingContext(ctx)
 	if !assert.True(t, ok) {
@ -41,7 +40,7 @@ func TestWithOutgoingJWT(t *testing.T) {

 func TestJWTFromGRPCRequest(t *testing.T) {
 	rawjwt := "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
-	ctx := context.Background()
+	ctx := t.Context()
 	ctx = metadata.NewIncomingContext(ctx, metadata.MD{
 		"jwt": {rawjwt},
 	})
--- a/pkg/grpcutil/options_test.go
+++ b/pkg/grpcutil/options_test.go
@ -23,7 +23,7 @@ import (
 )

 func TestSignedJWT(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	defer clearTimeout()

 	li, err := net.Listen("tcp4", "127.0.0.1:0")
--- a/pkg/grpcutil/serve_test.go
+++ b/pkg/grpcutil/serve_test.go
@ -28,7 +28,7 @@ func TestServeWithGracefulStop(t *testing.T) {

 		srv := grpc.NewServer()

-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(t.Context())
 		cancel()

 		now := time.Now()
@ -49,7 +49,7 @@ func TestServeWithGracefulStop(t *testing.T) {
 		hsrv.SetServingStatus("test", grpc_health_v1.HealthCheckResponse_SERVING)

 		now := time.Now()
-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(t.Context())
 		eg, ctx := errgroup.WithContext(ctx)
 		eg.Go(func() error {
 			return grpcutil.ServeWithGracefulStop(ctx, srv, li, time.Millisecond*100)
@ -82,7 +82,7 @@ func TestServeWithGracefulStop(t *testing.T) {
 			}

 			// start streaming to hold open the server during graceful stop
-			_, err = c.Watch(context.Background(), &grpc_health_v1.HealthCheckRequest{
+			_, err = c.Watch(t.Context(), &grpc_health_v1.HealthCheckRequest{
 				Service: "test",
 			})
 			if err != nil {
--- a/pkg/hpke/http_test.go
+++ b/pkg/hpke/http_test.go
@ -17,7 +17,7 @@ import (
 func TestFetchPublicKeyFromJWKS(t *testing.T) {
 	t.Parallel()

-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	hpkePrivateKey, err := hpke.GeneratePrivateKey()
--- a/pkg/httputil/serve_test.go
+++ b/pkg/httputil/serve_test.go
@ -24,7 +24,7 @@ func TestServeWithGracefulStop(t *testing.T) {
 		li, err := net.Listen("tcp4", "127.0.0.1:0")
 		require.NoError(t, err)

-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(t.Context())
 		cancel()

 		h := http.HandlerFunc(func(_ http.ResponseWriter, _ *http.Request) {
@ -60,7 +60,7 @@ func TestServeWithGracefulStop(t *testing.T) {
 		})

 		now := time.Now()
-		ctx, cancel := context.WithCancel(context.Background())
+		ctx, cancel := context.WithCancel(t.Context())
 		eg, ctx := errgroup.WithContext(ctx)
 		eg.Go(func() error {
 			return httputil.ServeWithGracefulStop(ctx, h, li, time.Millisecond*100)
--- a/pkg/identity/manager/data_test.go
+++ b/pkg/identity/manager/data_test.go
@ -1,7 +1,6 @@
 package manager

 import (
-	"context"
 	"crypto"
 	"crypto/rand"
 	"crypto/rsa"
@ -100,7 +99,7 @@ func TestSession_RefreshUpdate(t *testing.T) {
 	})

 	// Finally, we can obtain a go_oidc.IDToken.
-	idToken, err := verifier.Verify(context.Background(), rawIDToken)
+	idToken, err := verifier.Verify(t.Context(), rawIDToken)
 	require.NoError(t, err)

 	// This is the behavior under test.
--- a/pkg/identity/manager/schedulers_test.go
+++ b/pkg/identity/manager/schedulers_test.go
@ -16,7 +16,7 @@ func TestRefreshSessionScheduler(t *testing.T) {
 	t.Parallel()

 	var calls safeSlice[time.Time]
-	ctx := context.Background()
+	ctx := t.Context()
 	sessionRefreshGracePeriod := time.Millisecond
 	sessionRefreshCoolOffDuration := time.Millisecond
 	rss := newRefreshSessionScheduler(
@ -49,7 +49,7 @@ func TestUpdateUserInfoScheduler(t *testing.T) {

 	var calls safeSlice[time.Time]

-	ctx := context.Background()
+	ctx := t.Context()
 	userUpdateInfoInterval := 100 * time.Millisecond
 	uuis := newUpdateUserInfoScheduler(ctx, userUpdateInfoInterval, func(_ context.Context, _ string) {
 		calls.Append(time.Now())
--- a/pkg/identity/oidc/auth0/auth0_test.go
+++ b/pkg/identity/oidc/auth0/auth0_test.go
@ -18,7 +18,7 @@ import (
 func TestProvider(t *testing.T) {
 	t.Parallel()

-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	var srv *httptest.Server
--- a/pkg/identity/oidc/azure/microsoft_test.go
+++ b/pkg/identity/oidc/azure/microsoft_test.go
@ -1,7 +1,6 @@
 package azure

 import (
-	"context"
 	"crypto/rand"
 	"crypto/rsa"
 	"encoding/json"
@ -23,12 +22,12 @@ func TestAuthCodeOptions(t *testing.T) {
 	t.Parallel()

 	var options oauth.Options
-	p, err := New(context.Background(), &options)
+	p, err := New(t.Context(), &options)
 	require.NoError(t, err)
 	assert.Equal(t, defaultAuthCodeOptions, p.AuthCodeOptions)

 	options.AuthCodeOptions = map[string]string{}
-	p, err = New(context.Background(), &options)
+	p, err = New(t.Context(), &options)
 	require.NoError(t, err)
 	assert.Equal(t, map[string]string{}, p.AuthCodeOptions)
 }
--- a/pkg/identity/oidc/cognito/cognito_test.go
+++ b/pkg/identity/oidc/cognito/cognito_test.go
@ -18,7 +18,7 @@ import (
 func TestProvider(t *testing.T) {
 	t.Parallel()

-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	var srv *httptest.Server
--- a/pkg/identity/oidc/google/google_test.go
+++ b/pkg/identity/oidc/google/google_test.go
@ -1,7 +1,6 @@
 package google

 import (
-	"context"
 	"testing"

 	"github.com/stretchr/testify/assert"
@ -12,12 +11,12 @@ import (

 func TestAuthCodeOptions(t *testing.T) {
 	var options oauth.Options
-	p, err := New(context.Background(), &options)
+	p, err := New(t.Context(), &options)
 	require.NoError(t, err)
 	assert.Equal(t, defaultAuthCodeOptions, p.AuthCodeOptions)

 	options.AuthCodeOptions = map[string]string{}
-	p, err = New(context.Background(), &options)
+	p, err = New(t.Context(), &options)
 	require.NoError(t, err)
 	assert.Equal(t, map[string]string{}, p.AuthCodeOptions)
 }
--- a/pkg/identity/oidc/oidc_test.go
+++ b/pkg/identity/oidc/oidc_test.go
@ -36,7 +36,7 @@ func (c *Claims) SetRawIDToken(idToken string) {
 }

 func TestSignIn(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	redirectURL, _ := url.Parse("https://localhost/oauth2/callback")
@ -94,7 +94,7 @@ func TestSignIn(t *testing.T) {
 }

 func TestSignOut(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	redirectURL, _ := url.Parse("https://localhost/oauth2/callback")
@ -146,7 +146,7 @@ func TestSignOut(t *testing.T) {
 }

 func TestAuthenticate(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	redirectURL, _ := url.Parse("https://localhost/oauth2/callback")
@ -252,7 +252,7 @@ func TestAuthenticate(t *testing.T) {
 }

 func TestRefresh_WithIDToken(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	redirectURL, _ := url.Parse("https://localhost/oauth2/callback")
@ -347,7 +347,7 @@ func TestRefresh_WithIDToken(t *testing.T) {
 }

 func TestRefresh_WithoutIDToken(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	redirectURL, _ := url.Parse("https://localhost/oauth2/callback")
@ -409,7 +409,7 @@ func TestRefresh_WithoutIDToken(t *testing.T) {
 }

 func TestRevoke(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	var srv *httptest.Server
@ -459,7 +459,7 @@ func TestRevoke(t *testing.T) {
 }

 func TestUnsupportedFeatures(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	redirectURL, _ := url.Parse("https://localhost/oauth2/callback")
--- a/pkg/identity/oidc/refresh_test.go
+++ b/pkg/identity/oidc/refresh_test.go
@ -15,7 +15,7 @@ import (
 func TestRefresh(t *testing.T) {
 	t.Parallel()

-	ctx, clearTimeout := context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), 10*time.Second)
 	t.Cleanup(clearTimeout)

 	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
@ -49,7 +49,7 @@ func TestRefresh(t *testing.T) {
 func TestRefresh_errors(t *testing.T) {
 	t.Parallel()

-	ctx, clearTimeout := context.WithTimeout(context.Background(), 10*time.Second)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), 10*time.Second)
 	t.Cleanup(clearTimeout)

 	s := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) {
--- a/pkg/identity/oidc/userinfo_test.go
+++ b/pkg/identity/oidc/userinfo_test.go
@ -1,7 +1,6 @@
 package oidc

 import (
-	"context"
 	"io"
 	"net/http"
 	"net/http/httptest"
@ -54,7 +53,7 @@ func TestUserInfoRoundTrip(t *testing.T) {
 	}))
 	defer srv.Close()

-	provider, err := oidc.NewProvider(context.Background(), srv.URL)
+	provider, err := oidc.NewProvider(t.Context(), srv.URL)
 	if !assert.NoError(t, err) {
 		return
 	}
@ -66,7 +65,7 @@ func TestUserInfoRoundTrip(t *testing.T) {
 		Expiry:       time.Now().Add(time.Minute),
 	})

-	userInfo, err := getUserInfo(context.Background(), provider, token)
+	userInfo, err := getUserInfo(t.Context(), provider, token)
 	if !assert.NoError(t, err) {
 		return
 	}
--- a/pkg/policy/criteria/criteria_test.go
+++ b/pkg/policy/criteria/criteria_test.go
@ -2,7 +2,6 @@ package criteria

 import (
 	"bytes"
-	"context"
 	"encoding/json"
 	"fmt"
 	"strings"
@ -144,12 +143,12 @@ func evaluate(t *testing.T,
 		rego.Input(input),
 		rego.SetRegoVersion(ast.RegoV1),
 	)
-	preparedQuery, err := r.PrepareForEval(context.Background())
+	preparedQuery, err := r.PrepareForEval(t.Context())
 	if err != nil {
 		t.Log("source:", regoPolicy)
 		return nil, err
 	}
-	resultSet, err := preparedQuery.Eval(context.Background(),
+	resultSet, err := preparedQuery.Eval(t.Context(),
 		// set the eval time so we get a consistent result
 		rego.EvalTime(testingNow))
 	if err != nil {
--- a/pkg/storage/cache_test.go
+++ b/pkg/storage/cache_test.go
@ -10,7 +10,7 @@ import (
 )

 func TestGlobalCache(t *testing.T) {
-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	defer clearTimeout()

 	callCount := 0
--- a/pkg/storage/inmemory/backend_test.go
+++ b/pkg/storage/inmemory/backend_test.go
@ -19,7 +19,7 @@ import (
 )

 func TestBackend(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	backend := New()
 	defer func() { _ = backend.Close() }()
 	t.Run("get missing record", func(t *testing.T) {
@ -79,7 +79,7 @@ func TestBackend(t *testing.T) {
 }

 func TestExpiry(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	backend := New(WithExpiry(0))
 	defer func() { _ = backend.Close() }()

@ -113,7 +113,7 @@ func TestExpiry(t *testing.T) {
 }

 func TestConcurrency(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	backend := New()

 	eg, ctx := errgroup.WithContext(ctx)
@ -135,7 +135,7 @@ func TestConcurrency(t *testing.T) {
 }

 func TestStream(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	backend := New()
 	defer func() { _ = backend.Close() }()

@ -168,7 +168,7 @@ func TestStream(t *testing.T) {
 }

 func TestStreamClose(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	t.Run("by backend", func(t *testing.T) {
 		backend := New()
 		stream, err := backend.Sync(ctx, "", backend.serverVersion, 0)
@ -197,7 +197,7 @@ func TestStreamClose(t *testing.T) {
 }

 func TestCapacity(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	backend := New()
 	defer func() { _ = backend.Close() }()

@ -229,7 +229,7 @@ func TestCapacity(t *testing.T) {
 }

 func TestLease(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	backend := New()
 	{
 		ok, err := backend.Lease(ctx, "test", "a", time.Second*30)
@ -254,8 +254,8 @@ func TestLease(t *testing.T) {
 }

 // Concurrent calls to Put() and ListTypes() should not cause a data race.
-func TestListTypes_concurrent(_ *testing.T) {
-	ctx := context.Background()
+func TestListTypes_concurrent(t *testing.T) {
+	ctx := t.Context()
 	backend := New()
 	for i := 0; i < 10; i++ {
 		t := fmt.Sprintf("Type-%02d", i)
--- a/pkg/storage/postgres/backend_test.go
+++ b/pkg/storage/postgres/backend_test.go
@ -33,7 +33,7 @@ func TestBackend(t *testing.T) {
 		t.Skip("Github action can not run docker on MacOS")
 	}

-	ctx, clearTimeout := context.WithTimeout(context.Background(), maxWait)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), maxWait)
 	defer clearTimeout()

 	testutil.WithTestPostgres(t, func(dsn string) {
@ -208,7 +208,7 @@ func TestLookup(t *testing.T) {
 	net.DefaultResolver = stubResolver(t)
 	t.Cleanup(func() { net.DefaultResolver = originalDefaultResolver })

-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	cfg, err := ParseConfig("host=localhost")
--- a/pkg/storage/postgres/registry_test.go
+++ b/pkg/storage/postgres/registry_test.go
@ -38,7 +38,7 @@ func TestRegistry(t *testing.T) {
 		t.Skip("Github action can not run docker on MacOS")
 	}

-	ctx, clearTimeout := context.WithTimeout(context.Background(), maxWait)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), maxWait)
 	defer clearTimeout()

 	testutil.WithTestPostgres(t, func(dsn string) {
--- a/pkg/storage/querier_test.go
+++ b/pkg/storage/querier_test.go
@ -23,7 +23,7 @@ import (
 func TestGetDataBrokerRecord(t *testing.T) {
 	t.Parallel()

-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	t.Cleanup(clearTimeout)

 	for _, tc := range []struct {
--- a/pkg/telemetry/requestid/requestid_test.go
+++ b/pkg/telemetry/requestid/requestid_test.go
@ -1,7 +1,6 @@
 package requestid

 import (
-	"context"
 	"testing"

 	"github.com/stretchr/testify/assert"
@ -9,7 +8,7 @@ import (

 func TestFromContext(t *testing.T) {
 	id := New()
-	ctx := WithValue(context.Background(), id)
+	ctx := WithValue(t.Context(), id)
 	ctxID := FromContext(ctx)
 	assert.Equal(t, ctxID, id)
 }
--- a/pkg/telemetry/trace/client_test.go
+++ b/pkg/telemetry/trace/client_test.go
@ -31,9 +31,9 @@ import (
 func TestSyncClient(t *testing.T) {
 	t.Run("No client", func(t *testing.T) {
 		sc := trace.NewSyncClient(nil)
-		assert.ErrorIs(t, sc.Start(context.Background()), trace.ErrNoClient)
-		assert.ErrorIs(t, sc.UploadTraces(context.Background(), nil), trace.ErrNoClient)
-		assert.ErrorIs(t, sc.Stop(context.Background()), trace.ErrNoClient)
+		assert.ErrorIs(t, sc.Start(t.Context()), trace.ErrNoClient)
+		assert.ErrorIs(t, sc.UploadTraces(t.Context(), nil), trace.ErrNoClient)
+		assert.ErrorIs(t, sc.Stop(t.Context()), trace.ErrNoClient)
 	})

 	t.Run("Valid client", func(t *testing.T) {
@ -51,9 +51,9 @@ func TestSyncClient(t *testing.T) {
 			Return(nil).
 			After(upload)
 		sc := trace.NewSyncClient(mockClient)
-		assert.NoError(t, sc.Start(context.Background()))
-		assert.NoError(t, sc.UploadTraces(context.Background(), []*tracev1.ResourceSpans{}))
-		assert.NoError(t, sc.Stop(context.Background()))
+		assert.NoError(t, sc.Start(t.Context()))
+		assert.NoError(t, sc.UploadTraces(t.Context(), []*tracev1.ResourceSpans{}))
+		assert.NoError(t, sc.Stop(t.Context()))
 	})
 	t.Run("Update", func(t *testing.T) {
 		ctrl := gomock.NewController(t)
@ -84,11 +84,11 @@ func TestSyncClient(t *testing.T) {
 			Return(nil).
 			After(upload2)
 		sc := trace.NewSyncClient(mockClient1)
-		assert.NoError(t, sc.Start(context.Background()))
-		assert.NoError(t, sc.UploadTraces(context.Background(), []*tracev1.ResourceSpans{}))
-		assert.NoError(t, sc.Update(context.Background(), mockClient2))
-		assert.NoError(t, sc.UploadTraces(context.Background(), []*tracev1.ResourceSpans{}))
-		assert.NoError(t, sc.Stop(context.Background()))
+		assert.NoError(t, sc.Start(t.Context()))
+		assert.NoError(t, sc.UploadTraces(t.Context(), []*tracev1.ResourceSpans{}))
+		assert.NoError(t, sc.Update(t.Context(), mockClient2))
+		assert.NoError(t, sc.UploadTraces(t.Context(), []*tracev1.ResourceSpans{}))
+		assert.NoError(t, sc.Stop(t.Context()))
 	})

 	t.Run("Update from nil client to non-nil client", func(t *testing.T) {
@ -108,9 +108,9 @@ func TestSyncClient(t *testing.T) {
 			Stop(gomock.Any()).
 			Return(nil).
 			After(upload)
-		assert.NoError(t, sc.Update(context.Background(), mockClient))
-		assert.NoError(t, sc.UploadTraces(context.Background(), []*tracev1.ResourceSpans{}))
-		assert.NoError(t, sc.Stop(context.Background()))
+		assert.NoError(t, sc.Update(t.Context(), mockClient))
+		assert.NoError(t, sc.UploadTraces(t.Context(), []*tracev1.ResourceSpans{}))
+		assert.NoError(t, sc.Stop(t.Context()))
 	})

 	t.Run("Update from non-nil client to nil client", func(t *testing.T) {
@ -127,11 +127,11 @@ func TestSyncClient(t *testing.T) {
 				Stop(gomock.Any()).
 				Return(nil).
 				After(start)
-			assert.NoError(t, sc.Update(context.Background(), mockClient))
+			assert.NoError(t, sc.Update(t.Context(), mockClient))
 		}

-		sc.Update(context.Background(), nil)
-		assert.ErrorIs(t, sc.UploadTraces(context.Background(), []*tracev1.ResourceSpans{}), trace.ErrNoClient)
+		sc.Update(t.Context(), nil)
+		assert.ErrorIs(t, sc.UploadTraces(t.Context(), []*tracev1.ResourceSpans{}), trace.ErrNoClient)
 	})

 	spinWait := func(counter *atomic.Int32, until int32) error {
@ -166,7 +166,7 @@ func TestSyncClient(t *testing.T) {
 				runtime.LockOSThread()
 				defer runtime.UnlockOSThread()
 				<-start
-				require.NoError(t, sc.UploadTraces(context.Background(), []*tracev1.ResourceSpans{}))
+				require.NoError(t, sc.UploadTraces(t.Context(), []*tracev1.ResourceSpans{}))
 			}()
 		}

@ -244,11 +244,11 @@ func TestSyncClient(t *testing.T) {
 			}).
 			After(fUpload2)
 		sc := trace.NewSyncClient(mockClient1)
-		require.NoError(t, sc.Start(context.Background()))
+		require.NoError(t, sc.Start(t.Context()))

 		for range concurrency {
 			go func() {
-				require.NoError(t, sc.UploadTraces(context.Background(), []*tracev1.ResourceSpans{}))
+				require.NoError(t, sc.UploadTraces(t.Context(), []*tracev1.ResourceSpans{}))
 			}()
 		}
 		require.NoError(t, spinWait(&uploadTracesCount1, int32(concurrency)))
@ -259,10 +259,10 @@ func TestSyncClient(t *testing.T) {
 				<-unlock1 // wait for client1.Stop
 				// after this, calls to UploadTraces will block waiting for the
 				// new client, instead of using the old one we're about to close
-				require.NoError(t, sc.UploadTraces(context.Background(), []*tracev1.ResourceSpans{}))
+				require.NoError(t, sc.UploadTraces(t.Context(), []*tracev1.ResourceSpans{}))
 			}()
 		}
-		require.NoError(t, sc.Update(context.Background(), mockClient2))
+		require.NoError(t, sc.Update(t.Context(), mockClient2))
 		require.NoError(t, spinWait(&uploadTracesCount2, int32(concurrency)))
 		// at this point, all calls to UploadTraces for client2 are blocked.

@ -273,16 +273,16 @@ func TestSyncClient(t *testing.T) {
 		for range concurrency {
 			go func() {
 				<-waitForStop
-				assert.ErrorIs(t, sc.UploadTraces(context.Background(), []*tracev1.ResourceSpans{}), trace.ErrClientStopped)
+				assert.ErrorIs(t, sc.UploadTraces(t.Context(), []*tracev1.ResourceSpans{}), trace.ErrClientStopped)
 			}()
 		}
-		assert.NoError(t, sc.Stop(context.Background()))
+		assert.NoError(t, sc.Stop(t.Context()))

 		// sanity checks
-		assert.ErrorIs(t, sc.UploadTraces(context.Background(), []*tracev1.ResourceSpans{}), trace.ErrNoClient)
-		assert.ErrorIs(t, sc.Start(context.Background()), trace.ErrNoClient)
-		assert.ErrorIs(t, sc.Stop(context.Background()), trace.ErrNoClient)
-		assert.NoError(t, sc.Update(context.Background(), nil))
+		assert.ErrorIs(t, sc.UploadTraces(t.Context(), []*tracev1.ResourceSpans{}), trace.ErrNoClient)
+		assert.ErrorIs(t, sc.Start(t.Context()), trace.ErrNoClient)
+		assert.ErrorIs(t, sc.Stop(t.Context()), trace.ErrNoClient)
+		assert.NoError(t, sc.Update(t.Context(), nil))
 	})
 }

@ -524,7 +524,7 @@ func TestNewTraceClientFromConfig(t *testing.T) {
 			for k, v := range tc.env {
 				t.Setenv(k, v)
 			}
-			cfg, err := config.NewFileOrEnvironmentSource(context.Background(), emptyConfigFilePath, version.FullVersion())
+			cfg, err := config.NewFileOrEnvironmentSource(t.Context(), emptyConfigFilePath, version.FullVersion())
 			require.NoError(t, err)

 			remoteClient, err := trace.NewTraceClientFromConfig(cfg.GetConfig().Options.Tracing)
@ -534,7 +534,7 @@ func TestNewTraceClientFromConfig(t *testing.T) {
 			}
 			require.NoError(t, err)

-			ctx := trace.NewContext(log.Ctx(env.Context()).WithContext(context.Background()), remoteClient)
+			ctx := trace.NewContext(log.Ctx(env.Context()).WithContext(t.Context()), remoteClient)

 			tp := trace.NewTracerProvider(ctx, t.Name())

--- a/pkg/telemetry/trace/debug_test.go
+++ b/pkg/telemetry/trace/debug_test.go
@ -2,7 +2,6 @@ package trace_test

 import (
 	"bytes"
-	"context"
 	"fmt"
 	"runtime"
 	"sync/atomic"
@ -160,7 +159,7 @@ func TestSpanTracker(t *testing.T) {
 		tp := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(tracker))
 		tracer := tp.Tracer("test")
 		assert.Equal(t, []oteltrace.SpanID{}, tracker.XInflightSpans())
-		_, span1 := tracer.Start(context.Background(), "span 1")
+		_, span1 := tracer.Start(t.Context(), "span 1")
 		assert.Equal(t, []oteltrace.SpanID{span1.SpanContext().SpanID()}, tracker.XInflightSpans())
 		assert.Equal(t, []oteltrace.SpanID{}, obs.XObservedIDs())
 		span1.End()
@ -174,7 +173,7 @@ func TestSpanTracker(t *testing.T) {
 		tp := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(tracker))
 		tracer := tp.Tracer("test")
 		assert.Equal(t, []oteltrace.SpanID{}, tracker.XInflightSpans())
-		_, span1 := tracer.Start(context.Background(), "span 1")
+		_, span1 := tracer.Start(t.Context(), "span 1")
 		assert.Equal(t, []oteltrace.SpanID{span1.SpanContext().SpanID()}, tracker.XInflightSpans())
 		assert.Equal(t, []oteltrace.SpanID{span1.SpanContext().SpanID()}, obs.XObservedIDs())
 		span1.End()
@ -192,9 +191,9 @@ func TestSpanTrackerWarnings(t *testing.T) {
 		tracker := trace.NewSpanTracker(obs, trace.WarnOnIncompleteSpans)
 		tp := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(tracker))
 		tracer := tp.Tracer("test")
-		_, span1 := tracer.Start(context.Background(), "span 1")
+		_, span1 := tracer.Start(t.Context(), "span 1")

-		assert.ErrorIs(t, tp.Shutdown(context.Background()), trace.ErrIncompleteSpans)
+		assert.ErrorIs(t, tp.Shutdown(t.Context()), trace.ErrIncompleteSpans)

 		assert.Equal(t, fmt.Sprintf(`
 ==================================================
@ -213,9 +212,9 @@ Note: set TrackAllSpans flag for more info
 		tracker := trace.NewSpanTracker(obs, trace.WarnOnIncompleteSpans|trace.TrackAllSpans)
 		tp := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(tracker))
 		tracer := tp.Tracer("test")
-		_, span1 := tracer.Start(context.Background(), "span 1")
+		_, span1 := tracer.Start(t.Context(), "span 1")

-		assert.ErrorIs(t, tp.Shutdown(context.Background()), trace.ErrIncompleteSpans)
+		assert.ErrorIs(t, tp.Shutdown(t.Context()), trace.ErrIncompleteSpans)

 		assert.Equal(t, fmt.Sprintf(`
 ==================================================
@ -233,11 +232,11 @@ WARNING: spans not ended:
 		tracker := trace.NewSpanTracker(obs, trace.WarnOnIncompleteSpans|trace.TrackAllSpans)
 		tp := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(&trace.XStackTraceProcessor{}), sdktrace.WithSpanProcessor(tracker))
 		tracer := tp.Tracer("test")
-		_, span1 := tracer.Start(context.Background(), "span 1")
+		_, span1 := tracer.Start(t.Context(), "span 1")
 		_, file, line, _ := runtime.Caller(0)
 		line--

-		assert.ErrorIs(t, tp.Shutdown(context.Background()), trace.ErrIncompleteSpans)
+		assert.ErrorIs(t, tp.Shutdown(t.Context()), trace.ErrIncompleteSpans)

 		assert.Equal(t, fmt.Sprintf(`
 ==================================================
@ -255,15 +254,15 @@ WARNING: spans not ended:
 		tracker := trace.NewSpanTracker(obs, trace.WarnOnIncompleteSpans|trace.TrackAllSpans|trace.LogAllSpansOnWarn)
 		tp := sdktrace.NewTracerProvider(sdktrace.WithSpanProcessor(&trace.XStackTraceProcessor{}), sdktrace.WithSpanProcessor(tracker))
 		tracer := tp.Tracer("test")
-		_, span1 := tracer.Start(context.Background(), "span 1")
+		_, span1 := tracer.Start(t.Context(), "span 1")
 		time.Sleep(10 * time.Millisecond)
 		span1.End()
 		time.Sleep(10 * time.Millisecond)
-		_, span2 := tracer.Start(context.Background(), "span 2")
+		_, span2 := tracer.Start(t.Context(), "span 2")
 		_, file, line, _ := runtime.Caller(0)
 		line--

-		tp.Shutdown(context.Background())
+		tp.Shutdown(t.Context())

 		assert.Equal(t,
 			fmt.Sprintf(`
--- a/pkg/telemetry/trace/global_test.go
+++ b/pkg/telemetry/trace/global_test.go
@ -1,7 +1,6 @@
 package trace_test

 import (
-	"context"
 	"testing"

 	"github.com/stretchr/testify/assert"
@ -18,6 +17,6 @@ func TestUseGlobalPanicTracer(t *testing.T) {
 	trace.UseGlobalPanicTracer()
 	tracer := otel.GetTracerProvider().Tracer("test")
 	assert.Panics(t, func() {
-		tracer.Start(context.Background(), "span")
+		tracer.Start(t.Context(), "span")
 	})
 }
--- a/pkg/telemetry/trace/middleware_test.go
+++ b/pkg/telemetry/trace/middleware_test.go
@ -30,7 +30,7 @@ func TestHTTPMiddleware(t *testing.T) {
 		assert.Equal(t, "Server: GET /foo", span.(interface{ Name() string }).Name())
 	}).Methods(http.MethodGet)
 	w := httptest.NewRecorder()
-	ctx, span := tp.Tracer("test").Start(context.Background(), "test")
+	ctx, span := tp.Tracer("test").Start(t.Context(), "test")
 	router.ServeHTTP(w, httptest.NewRequestWithContext(ctx, http.MethodGet, "/foo", nil))
 	span.End()
 }
@ -111,7 +111,7 @@ func TestStatsInterceptor(t *testing.T) {
 		IsServerStream:            false,
 		IsTransparentRetryAttempt: false,
 	}
-	handler.HandleRPC(context.Background(), inBegin)
+	handler.HandleRPC(t.Context(), inBegin)
 	assert.NotNil(t, outBegin)
 	assert.NotSame(t, inBegin, outBegin)
 	assert.Equal(t, inBegin.BeginTime.Add(-1*time.Minute), outBegin.BeginTime)
@ -128,7 +128,7 @@ func TestStatsInterceptor(t *testing.T) {
 		Trailer:   metadata.Pairs("a", "b", "c", "d"),
 		Error:     errors.New("input"),
 	}
-	handler.HandleRPC(context.Background(), inEnd)
+	handler.HandleRPC(t.Context(), inEnd)
 	assert.NotNil(t, outEnd)
 	assert.NotSame(t, inEnd, outEnd)
 	assert.Equal(t, inEnd.Client, outEnd.Client)
@ -170,7 +170,7 @@ func TestStatsInterceptor_Nil(t *testing.T) {
 		trace.WithStatsInterceptor(nil),
 	)

-	inCtx := context.Background()
+	inCtx := t.Context()
 	inConnStats := &stats.ConnBegin{}
 	inRPCStats := &stats.Begin{}
 	inConnTagInfo := &stats.ConnTagInfo{}
@ -206,6 +206,6 @@ func TestStatsInterceptor_Bug(t *testing.T) {
 		}),
 	)
 	assert.PanicsWithValue(t, "bug: stats interceptor returned a message of a different type", func() {
-		handler.HandleRPC(context.Background(), &stats.Begin{})
+		handler.HandleRPC(t.Context(), &stats.Begin{})
 	})
 }
--- a/pkg/webauthnutil/credential_storage_test.go
+++ b/pkg/webauthnutil/credential_storage_test.go
@ -50,13 +50,13 @@ func TestCredentialStorage(t *testing.T) {
 		},
 	}
 	storage := NewCredentialStorage(client)
-	_, err := storage.GetCredential(context.Background(), []byte{0, 1, 2, 3, 4})
+	_, err := storage.GetCredential(t.Context(), []byte{0, 1, 2, 3, 4})
 	assert.ErrorIs(t, err, webauthn.ErrCredentialNotFound)
-	err = storage.SetCredential(context.Background(), &webauthn.Credential{
+	err = storage.SetCredential(t.Context(), &webauthn.Credential{
 		ID: []byte{0, 1, 2, 3, 4},
 	})
 	assert.NoError(t, err)
-	c, err := storage.GetCredential(context.Background(), []byte{0, 1, 2, 3, 4})
+	c, err := storage.GetCredential(t.Context(), []byte{0, 1, 2, 3, 4})
 	assert.NoError(t, err)
 	assert.Equal(t, []byte{0, 1, 2, 3, 4}, c.ID)
 }
--- a/pkg/webauthnutil/device_type_test.go
+++ b/pkg/webauthnutil/device_type_test.go
@ -15,7 +15,7 @@ import (
 )

 func TestGetDeviceType(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()

 	t.Run("from databroker", func(t *testing.T) {
 		client := &mockDataBrokerServiceClient{
--- a/pkg/zero/cluster/client_test.go
+++ b/pkg/zero/cluster/client_test.go
@ -1,7 +1,6 @@
 package cluster_test

 import (
-	"context"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
@ -49,7 +48,7 @@ func TestAPIClient(t *testing.T) {
 	client, err := api.NewAuthorizedClient(srv.URL, tokenCache, http.DefaultClient)
 	require.NoError(t, err)

-	resp, err := client.ExchangeClusterIdentityTokenWithResponse(context.Background(),
+	resp, err := client.ExchangeClusterIdentityTokenWithResponse(t.Context(),
 		api.ExchangeTokenRequest{
 			RefreshToken: "refresh-token",
 		},
--- a/proxy/data_test.go
+++ b/proxy/data_test.go
@ -30,7 +30,7 @@ import (
 func Test_getUserInfoData(t *testing.T) {
 	t.Parallel()

-	ctx, clearTimeout := context.WithTimeout(context.Background(), time.Second*10)
+	ctx, clearTimeout := context.WithTimeout(t.Context(), time.Second*10)
 	defer clearTimeout()

 	t.Run("incoming idp token", func(t *testing.T) {
--- a/proxy/handlers_portal_test.go
+++ b/proxy/handlers_portal_test.go
@ -1,7 +1,6 @@
 package proxy

 import (
-	"context"
 	"net/http"
 	"net/http/httptest"
 	"testing"
@ -14,7 +13,7 @@ import (
 )

 func TestProxy_routesPortalJSON(t *testing.T) {
-	ctx := context.Background()
+	ctx := t.Context()
 	cfg := &config.Config{Options: config.NewDefaultOptions()}
 	to, err := config.ParseWeightedUrls("https://to.example.com")
 	require.NoError(t, err)
--- a/proxy/handlers_test.go
+++ b/proxy/handlers_test.go
@ -2,7 +2,6 @@ package proxy

 import (
 	"bytes"
-	"context"
 	"io"
 	"net/http"
 	"net/http/httptest"
@ -37,7 +36,7 @@ func TestProxy_SignOut(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			opts := testOptions(t)
-			p, err := New(context.Background(), &config.Config{Options: opts})
+			p, err := New(t.Context(), &config.Config{Options: opts})
 			if err != nil {
 				t.Fatal(err)
 			}
@ -130,7 +129,7 @@ func TestProxy_ProgrammaticLogin(t *testing.T) {
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			p, err := New(context.Background(), &config.Config{Options: tt.options})
+			p, err := New(t.Context(), &config.Config{Options: tt.options})
 			if err != nil {
 				t.Fatal(err)
 			}
@ -225,7 +224,7 @@ func TestProxy_jsonUserInfo(t *testing.T) {

 // The /.pomerium/jwt endpoint should be registered only if explicitly enabled.
 func TestProxy_registerDashboardHandlers_jwtEndpoint(t *testing.T) {
-	proxy, err := New(context.Background(), &config.Config{Options: config.NewDefaultOptions()})
+	proxy, err := New(t.Context(), &config.Config{Options: config.NewDefaultOptions()})
 	require.NoError(t, err)
 	req := httptest.NewRequest(http.MethodGet, "/.pomerium/jwt", nil)
 	rawJWT := "eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0.eyJzdWIiOiIxMjM0NTY3ODkwIn0."
@ -270,7 +269,7 @@ func TestLoadSessionState(t *testing.T) {
 		t.Parallel()

 		opts := testOptions(t)
-		proxy, err := New(context.Background(), &config.Config{Options: opts})
+		proxy, err := New(t.Context(), &config.Config{Options: opts})
 		require.NoError(t, err)

 		r := httptest.NewRequest(http.MethodGet, "/.pomerium/", nil)
@ -285,7 +284,7 @@ func TestLoadSessionState(t *testing.T) {
 		t.Parallel()

 		opts := testOptions(t)
-		proxy, err := New(context.Background(), &config.Config{Options: opts})
+		proxy, err := New(t.Context(), &config.Config{Options: opts})
 		require.NoError(t, err)

 		session := encodeSession(t, opts, &sessions.State{
@ -308,7 +307,7 @@ func TestLoadSessionState(t *testing.T) {
 		t.Parallel()

 		opts := testOptions(t)
-		proxy, err := New(context.Background(), &config.Config{Options: opts})
+		proxy, err := New(t.Context(), &config.Config{Options: opts})
 		require.NoError(t, err)

 		session := encodeSession(t, opts, &sessions.State{
--- a/Show more
+++ b/Show more