From b6fdf69324a5afa4ec43e13572f1d345cecc1a4f Mon Sep 17 00:00:00 2001
From: iliana etaoin <iliana@oxide.computer>
Date: Thu, 26 Feb 2026 13:35:07 -0800
Subject: [PATCH 1/6] update go toolchain to 1.26

---
 .github/buildomat/SHA256SUMS        | 5 -----
 .github/buildomat/SHA256SUMS.helios | 2 ++
 .github/buildomat/SHA256SUMS.linux  | 3 +++
 .github/buildomat/SHA256SUMS.macos  | 3 +++
 .github/buildomat/helios-setup.sh   | 9 +++++----
 .github/buildomat/linux-setup.sh    | 2 +-
 .github/buildomat/versions.sh       | 2 +-
 .github/workflows/macos-setup.sh    | 2 +-
 go.mod                              | 4 +---
 9 files changed, 17 insertions(+), 15 deletions(-)
 delete mode 100644 .github/buildomat/SHA256SUMS
 create mode 100644 .github/buildomat/SHA256SUMS.helios
 create mode 100644 .github/buildomat/SHA256SUMS.linux
 create mode 100644 .github/buildomat/SHA256SUMS.macos

diff --git a/.github/buildomat/SHA256SUMS b/.github/buildomat/SHA256SUMS
deleted file mode 100644
index c7e58b5ce6..0000000000
--- a/.github/buildomat/SHA256SUMS
+++ /dev/null
@@ -1,5 +0,0 @@
-0fc88d966d33896384fbde56e9a8d80a305dc17a9f48f1832e061724b1719991  go1.22.11.linux-amd64.tar.gz
-3980b1d2be042a164989f2fd24f0bb306a2397d581a29c7426885578b369db5d  go1.22.11.darwin-arm64.tar.gz
-d8dab549b09672b03356aa2257699f3de3b58c96e74eb26a8b495fbdc9cf6fbe  node-v20.11.1-linux-x64.tar.xz
-fd771bf3881733bfc0622128918ae6baf2ed1178146538a53c30ac2f7006af5b  node-v20.11.1-darwin-arm64.tar.xz
-1ba910c84256998c4bf4b925857c2693adebdc962a2e3075f4f8b67045f45105  yarn-1.22.22.js
diff --git a/.github/buildomat/SHA256SUMS.helios b/.github/buildomat/SHA256SUMS.helios
new file mode 100644
index 0000000000..439fbbaf71
--- /dev/null
+++ b/.github/buildomat/SHA256SUMS.helios
@@ -0,0 +1,2 @@
+2191668cd3aea0a05e646e6f7919ea357e666c15facf417f33e5cf18b7f00dd9  go1.26.0.illumos-amd64.tar.gz
+1ba910c84256998c4bf4b925857c2693adebdc962a2e3075f4f8b67045f45105  yarn-1.22.22.js
diff --git a/.github/buildomat/SHA256SUMS.linux b/.github/buildomat/SHA256SUMS.linux
new file mode 100644
index 0000000000..7870a04f63
--- /dev/null
+++ b/.github/buildomat/SHA256SUMS.linux
@@ -0,0 +1,3 @@
+aac1b08a0fb0c4e0a7c1555beb7b59180b05dfc5a3d62e40e9de90cd42f88235  go1.26.0.linux-amd64.tar.gz
+d8dab549b09672b03356aa2257699f3de3b58c96e74eb26a8b495fbdc9cf6fbe  node-v20.11.1-linux-x64.tar.xz
+1ba910c84256998c4bf4b925857c2693adebdc962a2e3075f4f8b67045f45105  yarn-1.22.22.js
diff --git a/.github/buildomat/SHA256SUMS.macos b/.github/buildomat/SHA256SUMS.macos
new file mode 100644
index 0000000000..1a788b992a
--- /dev/null
+++ b/.github/buildomat/SHA256SUMS.macos
@@ -0,0 +1,3 @@
+b1640525dfe68f066d56f200bef7bf4dce955a1a893bd061de6754c211431023  go1.26.0.darwin-arm64.tar.gz
+fd771bf3881733bfc0622128918ae6baf2ed1178146538a53c30ac2f7006af5b  node-v20.11.1-darwin-arm64.tar.xz
+1ba910c84256998c4bf4b925857c2693adebdc962a2e3075f4f8b67045f45105  yarn-1.22.22.js
diff --git a/.github/buildomat/helios-setup.sh b/.github/buildomat/helios-setup.sh
index 26bac46753..bebe64f8ff 100644
--- a/.github/buildomat/helios-setup.sh
+++ b/.github/buildomat/helios-setup.sh
@@ -1,16 +1,17 @@
 source .github/buildomat/versions.sh
 
-GO_MAJOR=${GO_VERSION%.*}
 NODE_MAJOR=${NODE_VERSION%%.*}
 
 pfexec pkg install \
-    /developer/build-essential /ooce/developer/cmake "/ooce/developer/go-${GO_MAJOR/./}@$GO_VERSION" "/ooce/runtime/node-$NODE_MAJOR@$NODE_VERSION"
+    /developer/build-essential /ooce/developer/cmake "/ooce/runtime/node-$NODE_MAJOR@$NODE_VERSION"
 
 pushd /work
 mkdir bin
+curl -sSfL --retry 10 -O "https://go.dev/dl/go$GO_VERSION.illumos-amd64.tar.gz"
 curl -sSfL --retry 10 -O "https://github.com/yarnpkg/yarn/releases/download/v$YARN_VERSION/yarn-$YARN_VERSION.js"
-sha256sum --ignore-missing -c "$OLDPWD/.github/buildomat/SHA256SUMS"
+sha256sum -c "$OLDPWD/.github/buildomat/SHA256SUMS.helios"
+gtar xf "go$GO_VERSION.illumos-amd64.tar.gz"
 mv "yarn-$YARN_VERSION.js" bin/yarn
 chmod a+x bin/yarn
 popd
-export PATH="/work/bin:/opt/ooce/go-$GO_MAJOR/bin:/opt/ooce/node-$NODE_MAJOR/bin:$PATH"
+export PATH="/work/bin:/work/go/bin:/opt/ooce/node-$NODE_MAJOR/bin:$PATH"
diff --git a/.github/buildomat/linux-setup.sh b/.github/buildomat/linux-setup.sh
index c1a2c089b2..0b218a9960 100644
--- a/.github/buildomat/linux-setup.sh
+++ b/.github/buildomat/linux-setup.sh
@@ -7,7 +7,7 @@ pushd /work
 curl -sSfL --retry 10 -O "https://go.dev/dl/go$GO_VERSION.linux-amd64.tar.gz"
 curl -sSfL --retry 10 -O "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-linux-x64.tar.xz"
 curl -sSfL --retry 10 -O "https://github.com/yarnpkg/yarn/releases/download/v$YARN_VERSION/yarn-$YARN_VERSION.js"
-sha256sum --ignore-missing -c "$OLDPWD/.github/buildomat/SHA256SUMS"
+sha256sum -c "$OLDPWD/.github/buildomat/SHA256SUMS.linux"
 tar xf "go$GO_VERSION.linux-amd64.tar.gz"
 tar xf "node-v$NODE_VERSION-linux-x64.tar.xz"
 mv "yarn-$YARN_VERSION.js" "node-v$NODE_VERSION-linux-x64/bin/yarn"
diff --git a/.github/buildomat/versions.sh b/.github/buildomat/versions.sh
index f4c1915d28..4670dde1d6 100644
--- a/.github/buildomat/versions.sh
+++ b/.github/buildomat/versions.sh
@@ -1,4 +1,4 @@
 export GOTOOLCHAIN=local
-GO_VERSION=1.22.11
+GO_VERSION=1.26.0
 NODE_VERSION=20.11.1
 YARN_VERSION=1.22.22
diff --git a/.github/workflows/macos-setup.sh b/.github/workflows/macos-setup.sh
index 523c825664..f7b34f5f96 100644
--- a/.github/workflows/macos-setup.sh
+++ b/.github/workflows/macos-setup.sh
@@ -8,7 +8,7 @@ pushd "$HOME/toolchain"
 curl -sSfL --retry 10 -O "https://go.dev/dl/go$GO_VERSION.darwin-arm64.tar.gz"
 curl -sSfL --retry 10 -O "https://nodejs.org/dist/v$NODE_VERSION/node-v$NODE_VERSION-darwin-arm64.tar.xz"
 curl -sSfL --retry 10 -O "https://github.com/yarnpkg/yarn/releases/download/v$YARN_VERSION/yarn-$YARN_VERSION.js"
-sha256sum --ignore-missing -c "$SOURCE_DIR/.github/buildomat/SHA256SUMS"
+sha256sum -c "$OLDPWD/.github/buildomat/SHA256SUMS.macos"
 tar xf "go$GO_VERSION.darwin-arm64.tar.gz"
 tar xf "node-v$NODE_VERSION-darwin-arm64.tar.xz"
 mv "yarn-$YARN_VERSION.js" "node-v$NODE_VERSION-darwin-arm64/bin/yarn"
diff --git a/go.mod b/go.mod
index 1666f96570..d15cbd664d 100644
--- a/go.mod
+++ b/go.mod
@@ -1,8 +1,6 @@
 module github.com/cockroachdb/cockroach
 
-go 1.22.1
-
-toolchain go1.22.11
+go 1.26.0
 
 require (
 	cloud.google.com/go/kms v1.1.0

From e41395f838c50378f7bafcbec895e654ea051bca Mon Sep 17 00:00:00 2001
From: iliana etaoin <iliana@oxide.computer>
Date: Thu, 26 Feb 2026 13:34:01 -0800
Subject: [PATCH 2/6] delete unwanted makefile noise

---
 Makefile | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/Makefile b/Makefile
index f8700aa500..4d19d362c1 100644
--- a/Makefile
+++ b/Makefile
@@ -283,16 +283,6 @@ $(call make-lazy,yellow)
 $(call make-lazy,cyan)
 $(call make-lazy,term-reset)
 
-# Warn maintainers for if ccache is not found.
-ifeq (, $(shell which ccache))
-$(info $(yellow)Warning: 'ccache' not found, consider installing it for faster builds$(term-reset))
-endif
-
-# Warn maintainers if bazel is not found.
-ifeq (, $(shell which bazel))
-$(info $(yellow)Warning: 'bazel' not found (`brew install bazelisk` for macs)$(term-reset))
-endif
-
 # Tell Make to delete the target if its recipe fails. Otherwise, if a recipe
 # modifies its target before failing, the target's timestamp will make it appear
 # up-to-date on the next invocation of Make, even though it is likely corrupt.

From 188aeedb6f0a3c4157a97f22ffd6e8ad376eb384 Mon Sep 17 00:00:00 2001
From: iliana etaoin <iliana@oxide.computer>
Date: Thu, 26 Feb 2026 13:35:13 -0800
Subject: [PATCH 3/6] goschedstats: replace unsafe bullshit with new metric

---
 pkg/util/goschedstats/runtime.go        |  16 +++
 pkg/util/goschedstats/runtime_go1.22.go | 170 ------------------------
 2 files changed, 16 insertions(+), 170 deletions(-)
 create mode 100644 pkg/util/goschedstats/runtime.go
 delete mode 100644 pkg/util/goschedstats/runtime_go1.22.go

diff --git a/pkg/util/goschedstats/runtime.go b/pkg/util/goschedstats/runtime.go
new file mode 100644
index 0000000000..5a346d2c2a
--- /dev/null
+++ b/pkg/util/goschedstats/runtime.go
@@ -0,0 +1,16 @@
+// Copyright 2026 Oxide Computer Company
+//
+// Use of this software is governed by the Apache License, Version 2.0,
+// included in the file licenses/APL.txt.
+
+package goschedstats
+
+import "runtime/metrics"
+
+func numRunnableGoroutines() (numRunnable int, numProcs int) {
+	sample := make([]metrics.Sample, 2)
+	sample[0].Name = "/sched/goroutines/runnable:goroutines"
+	sample[1].Name = "/sched/gomaxprocs:threads"
+	metrics.Read(sample)
+	return int(sample[0].Value.Uint64()), int(sample[1].Value.Uint64())
+}
diff --git a/pkg/util/goschedstats/runtime_go1.22.go b/pkg/util/goschedstats/runtime_go1.22.go
deleted file mode 100644
index a4bf71907f..0000000000
--- a/pkg/util/goschedstats/runtime_go1.22.go
+++ /dev/null
@@ -1,170 +0,0 @@
-// Copyright 2021 The Cockroach Authors.
-// Copyright 2024 Oxide Computer Company
-//
-// Use of this software is governed by the Business Source License
-// included in the file licenses/BSL.txt.
-//
-// As of the Change Date specified in that file, in accordance with
-// the Business Source License, use of this software will be governed
-// by the Apache License, Version 2.0, included in the file
-// licenses/APL.txt.
-//
-// The structure definitions in this file have been cross-checked against go1.22.
-// Before allowing newer versions, please check that the structures
-// still match with those in go/src/runtime.
-
-//go:build gc && go1.22
-// +build gc,go1.22
-
-package goschedstats
-
-import (
-	"sync/atomic"
-	_ "unsafe" // required by go:linkname
-)
-
-type puintptr uintptr
-
-type muintptr uintptr
-
-type guintptr uintptr
-
-type sysmontick struct {
-	schedtick   uint32
-	schedwhen   int64
-	syscalltick uint32
-	syscallwhen int64
-}
-
-type pageCache struct {
-	base  uintptr // base address of the chunk
-	cache uint64  // 64-bit bitmap representing free pages (1 means free)
-	scav  uint64  // 64-bit bitmap representing scavenged pages (1 means scavenged)
-}
-
-type p struct {
-	id          int32
-	status      uint32 // one of pidle/prunning/...
-	link        puintptr
-	schedtick   uint32     // incremented on every scheduler call
-	syscalltick uint32     // incremented on every system call
-	sysmontick  sysmontick // last tick observed by sysmon
-	m           muintptr   // back-link to associated m (nil if idle)
-	mcache      uintptr
-	pcache      pageCache
-	raceprocctx uintptr
-
-	deferpool    []uintptr // pool of available defer structs (see panic.go)
-	deferpoolbuf [32]uintptr
-
-	// Cache of goroutine ids, amortizes accesses to runtime·sched.goidgen.
-	goidcache    uint64
-	goidcacheend uint64
-
-	// Queue of runnable goroutines. Accessed without lock.
-	runqhead uint32
-	runqtail uint32
-	runq     [256]guintptr
-	// runnext, if non-nil, is a runnable G that was ready'd by
-	// the current G and should be run next instead of what's in
-	// runq if there's time remaining in the running G's time
-	// slice. It will inherit the time left in the current time
-	// slice. If a set of goroutines is locked in a
-	// communicate-and-wait pattern, this schedules that set as a
-	// unit and eliminates the (potentially large) scheduling
-	// latency that otherwise arises from adding the ready'd
-	// goroutines to the end of the run queue.
-	//
-	// Note that while other P's may atomically CAS this to zero,
-	// only the owner P can CAS it to a valid G.
-	runnext guintptr
-
-	// The rest of the fields aren't important.
-}
-
-type mutex struct {
-	// Empty struct if lock ranking is disabled, otherwise includes the lock rank
-	//lockRankStruct
-	// Futex-based impl treats it as uint32 key,
-	// while sema-based impl as M* waitm.
-	// Used to be a union, but unions break precise GC.
-	key uintptr
-}
-
-type gQueue struct {
-	head guintptr
-	tail guintptr
-}
-
-type schedt struct {
-	goidgen   atomic.Uint64
-	lastpoll  atomic.Int64 // time of last network poll, 0 if currently polling
-	pollUntil atomic.Int64 // time to which current poll is sleeping
-
-	lock mutex
-
-	// When increasing nmidle, nmidlelocked, nmsys, or nmfreed, be
-	// sure to call checkdead().
-
-	midle        muintptr // idle m's waiting for work
-	nmidle       int32    // number of idle m's waiting for work
-	nmidlelocked int32    // number of locked m's waiting for work
-	mnext        int64    // number of m's that have been created and next M ID
-	maxmcount    int32    // maximum number of m's allowed (or die)
-	nmsys        int32    // number of system m's not counted for deadlock
-	nmfreed      int64    // cumulative number of freed m's
-
-	ngsys atomic.Int32 // number of system goroutines
-
-	pidle        puintptr // idle p's
-	npidle       atomic.Int32
-	nmspinning   atomic.Int32  // See "Worker thread parking/unparking" comment in proc.go.
-	needspinning atomic.Uint32 // See "Delicate dance" comment in proc.go. Boolean. Must hold sched.lock to set to 1.
-
-	// Global runnable queue.
-	runq     gQueue
-	runqsize int32
-
-	// The rest of the fields aren't important.
-}
-
-//go:linkname allp runtime.allp
-var allp []*p
-
-//go:linkname sched runtime.sched
-var sched schedt
-
-//go:linkname lock runtime.lock
-func lock(l *mutex)
-
-//go:linkname unlock runtime.unlock
-func unlock(l *mutex)
-
-func numRunnableGoroutines() (numRunnable int, numProcs int) {
-	lock(&sched.lock)
-	numRunnable = int(sched.runqsize)
-	numProcs = len(allp)
-
-	// Note that holding sched.lock prevents the number of Ps from changing, so
-	// it's safe to loop over allp.
-	for _, p := range allp {
-		// Retry loop for concurrent updates.
-		for {
-			h := atomic.LoadUint32(&p.runqhead)
-			t := atomic.LoadUint32(&p.runqtail)
-			next := atomic.LoadUintptr((*uintptr)(&p.runnext))
-			runnable := int32(t - h)
-			if atomic.LoadUint32(&p.runqhead) != h || runnable < 0 {
-				// A concurrent update messed with us; try again.
-				continue
-			}
-			if next != 0 {
-				runnable++
-			}
-			numRunnable += int(runnable)
-			break
-		}
-	}
-	unlock(&sched.lock)
-	return numRunnable, numProcs
-}

From 18a3f8214c90329903be481b83766081f5912fb2 Mon Sep 17 00:00:00 2001
From: iliana etaoin <iliana@oxide.computer>
Date: Thu, 26 Feb 2026 16:06:17 -0800
Subject: [PATCH 4/6] deal with new minimum in go1.24 for test RSA keys

---
 pkg/security/certificate_loader_test.go | 2 +-
 pkg/security/x509_test.go               | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pkg/security/certificate_loader_test.go b/pkg/security/certificate_loader_test.go
index ee0e4e111f..3217819d41 100644
--- a/pkg/security/certificate_loader_test.go
+++ b/pkg/security/certificate_loader_test.go
@@ -131,7 +131,7 @@ func makeTestCert(
 	t *testing.T, commonName string, keyUsage x509.KeyUsage, extUsages []x509.ExtKeyUsage,
 ) (*x509.Certificate, []byte) {
 	// Make smallest rsa key possible: not saved.
-	key, err := rsa.GenerateKey(rand.Reader, 512)
+	key, err := rsa.GenerateKey(rand.Reader, 1024)
 	if err != nil {
 		t.Fatalf("error on GenerateKey for CN=%s: %v", commonName, err)
 	}
diff --git a/pkg/security/x509_test.go b/pkg/security/x509_test.go
index c43694fe8b..48ebbac512 100644
--- a/pkg/security/x509_test.go
+++ b/pkg/security/x509_test.go
@@ -38,7 +38,7 @@ func timesFuzzyEqual(a, b time.Time) bool {
 func TestGenerateCertLifetime(t *testing.T) {
 	defer leaktest.AfterTest(t)()
 
-	testKey, err := rsa.GenerateKey(rand.Reader, 512)
+	testKey, err := rsa.GenerateKey(rand.Reader, 1024)
 	if err != nil {
 		t.Fatal(err)
 	}

From 5768281f31110264bb3edca2e06c2b8852f94bd6 Mon Sep 17 00:00:00 2001
From: iliana etaoin <iliana@oxide.computer>
Date: Thu, 26 Feb 2026 13:33:37 -0800
Subject: [PATCH 5/6] set GODEBUG=urlstrictcolons=0 for
 pkg/cloud/httpsink/http_storage_test.go

---
 pkg/cloud/httpsink/http_storage_test.go | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/pkg/cloud/httpsink/http_storage_test.go b/pkg/cloud/httpsink/http_storage_test.go
index 7a86f83b64..57370beada 100644
--- a/pkg/cloud/httpsink/http_storage_test.go
+++ b/pkg/cloud/httpsink/http_storage_test.go
@@ -8,6 +8,14 @@
 // by the Apache License, Version 2.0, included in the file
 // licenses/APL.txt.
 
+// TestPutHttp relies on url.Parse in cloud_test_helpers.go
+// for reading the schema from a URL like
+// "https://127.0.0.1:39301,127.0.0.1:41869,127.0.0.1:34705/testing". Go 1.26
+// changed the default behavior of url.Parse to return an error if the port
+// number after a host is invalid, providing this GODEBUG setting to reverse
+// the behavior.
+//go:debug urlstrictcolons=0
+
 package httpsink
 
 import (

From 6e3cdc03d75a2c2548a811389e857b3f38abd440 Mon Sep 17 00:00:00 2001
From: iliana etaoin <iliana@oxide.computer>
Date: Thu, 26 Feb 2026 15:21:22 -0800
Subject: [PATCH 6/6] update golang.org/x/tools for go vet compatibility

---
 go.mod                                        | 17 +++++-----
 go.sum                                        | 34 ++++++++++---------
 .../testdata/logic_test/builtin_function      |  2 +-
 pkg/sql/pgwire/testdata/auth/password_change  |  2 +-
 4 files changed, 29 insertions(+), 26 deletions(-)

diff --git a/go.mod b/go.mod
index d15cbd664d..58f2167e33 100644
--- a/go.mod
+++ b/go.mod
@@ -142,17 +142,17 @@ require (
 	go.opentelemetry.io/otel/exporters/zipkin v1.0.0-RC3
 	go.opentelemetry.io/otel/sdk v1.0.0-RC3
 	go.opentelemetry.io/otel/trace v1.0.0-RC3
-	golang.org/x/crypto v0.33.0
+	golang.org/x/crypto v0.44.0
 	golang.org/x/exp v0.0.0-20231110203233-9a3e6036ecaa
-	golang.org/x/net v0.35.0
+	golang.org/x/net v0.47.0
 	golang.org/x/oauth2 v0.0.0-20220309155454-6242fa91716a
 	golang.org/x/perf v0.0.0-20180704124530-6e6d33e29852
-	golang.org/x/sync v0.11.0
-	golang.org/x/sys v0.30.0
-	golang.org/x/term v0.29.0
-	golang.org/x/text v0.22.0
+	golang.org/x/sync v0.18.0
+	golang.org/x/sys v0.38.0
+	golang.org/x/term v0.37.0
+	golang.org/x/text v0.31.0
 	golang.org/x/time v0.0.0-20210723032227-1f47c861a9ac
-	golang.org/x/tools v0.30.0
+	golang.org/x/tools v0.39.0
 	google.golang.org/api v0.69.0
 	google.golang.org/genproto v0.0.0-20220505152158-f39f71e6c8f3
 	google.golang.org/grpc v1.46.0
@@ -286,7 +286,8 @@ require (
 	go.opentelemetry.io/proto/otlp v0.9.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	golang.org/x/exp/typeparams v0.0.0-20231108232855-2478ac86f678 // indirect
-	golang.org/x/mod v0.23.0 // indirect
+	golang.org/x/mod v0.30.0 // indirect
+	golang.org/x/tools/go/expect v0.1.1-deprecated // indirect
 	golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 )
diff --git a/go.sum b/go.sum
index 4245736473..c7f9f69eaa 100644
--- a/go.sum
+++ b/go.sum
@@ -2166,8 +2166,8 @@ golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5y
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.13.0/go.mod h1:y6Z2r+Rw4iayiXXAIxJIDAJ1zMW4yaTpebo8fPOliYc=
 golang.org/x/crypto v0.18.0/go.mod h1:R0j02AL6hcrfOiy9T4ZYp/rcWeMxM3L6QYxlOuEG1mg=
-golang.org/x/crypto v0.33.0 h1:IOBPskki6Lysi0lo9qQvbxiQ+FvsCC/YWOecCHAixus=
-golang.org/x/crypto v0.33.0/go.mod h1:bVdXmD7IV/4GdElGPozy6U7lWdRXA4qyRVGJV57uQ5M=
+golang.org/x/crypto v0.44.0 h1:A97SsFvM3AIwEEmTBiaxPPTYpDC47w720rdiiUvgoAU=
+golang.org/x/crypto v0.44.0/go.mod h1:013i+Nw79BMiQiMsOPcVCB5ZIJbYkerPrGnOa00tvmc=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -2219,8 +2219,8 @@ golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91
 golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.23.0 h1:Zb7khfcRGKk+kqfxFaP5tZqCnDZMjC5VtUBs87Hr6QM=
-golang.org/x/mod v0.23.0/go.mod h1:6SkKJ3Xj0I0BrPOZoBy3bdMptDDU9oJrpohJ3eWZ1fY=
+golang.org/x/mod v0.30.0 h1:fDEXFVZ/fmCKProc/yAXXUijritrDzahmwwefnjoPFk=
+golang.org/x/mod v0.30.0/go.mod h1:lAsf5O2EvJeSFMiBxXDki7sCgAxEUcZHXoXMKT4GJKc=
 golang.org/x/net v0.0.0-20170114055629-f2499483f923/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180218175443-cbe0f9307d01/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180530234432-1e491301e022/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
@@ -2299,8 +2299,8 @@ golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
 golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
 golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.20.0/go.mod h1:z8BVo6PvndSri0LbOE3hAn0apkU+1YvI6E70E9jsnvY=
-golang.org/x/net v0.35.0 h1:T5GQRQb2y08kTAByq9L4/bz8cipCdA8FbRTXewonqY8=
-golang.org/x/net v0.35.0/go.mod h1:EglIi67kWsHKlRzzVMUD93VMSWGFOMSZgxFjparz1Qk=
+golang.org/x/net v0.47.0 h1:Mx+4dIFzqraBXUugkia1OOvlD6LemFo1ALMHjrXDOhY=
+golang.org/x/net v0.47.0/go.mod h1:/jNxtkgq5yWUGYkaZGqo27cfGZ1c5Nen03aYrrKpVRU=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -2338,8 +2338,8 @@ golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJ
 golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.3.0/go.mod h1:FU7BRWz2tNW+3quACPkgCx/L+uEAv1htQ0V83Z9Rj+Y=
 golang.org/x/sync v0.6.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
-golang.org/x/sync v0.11.0 h1:GGz8+XQP4FvTTrjZPzNKTMFtSXH80RAzG+5ghFPgK9w=
-golang.org/x/sync v0.11.0/go.mod h1:Czt+wKu1gCyEFDUtn0jG5QVvpJ6rzVqr5aXyt9drQfk=
+golang.org/x/sync v0.18.0 h1:kr88TuHDroi+UVf+0hZnirlk8o8T+4MrK6mr60WkH/I=
+golang.org/x/sync v0.18.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI=
 golang.org/x/sys v0.0.0-20170830134202-bb24a47a89ea/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180810173357-98c5dad5d1a0/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -2483,8 +2483,8 @@ golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.30.0 h1:QjkSwP/36a20jFYWkSue1YwXzLmsV5Gfq7Eiy72C1uc=
-golang.org/x/sys v0.30.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/sys v0.38.0 h1:3yZWxaJjBmCWXqhN1qh02AkOnCQ1poK6oF+a7xWL6Gc=
+golang.org/x/sys v0.38.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210220032956-6a3ed077a48d/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
@@ -2493,8 +2493,8 @@ golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
 golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
 golang.org/x/term v0.12.0/go.mod h1:owVbMEjm3cBLCHdkQu9b1opXd4ETQWc3BhuQGKgXgvU=
 golang.org/x/term v0.16.0/go.mod h1:yn7UURbUtPyrVJPGPq404EukNFxcm/foM+bV/bfcDsY=
-golang.org/x/term v0.29.0 h1:L6pJp37ocefwRRtYPKSWOWzOtWSxVajvz2ldH/xi3iU=
-golang.org/x/term v0.29.0/go.mod h1:6bl4lRlvVuDgSf3179VpIxBF0o10JUpXWOnI7nErv7s=
+golang.org/x/term v0.37.0 h1:8EGAD0qCmHYZg6J17DvsMy9/wJ7/D/4pV/wfnld5lTU=
+golang.org/x/term v0.37.0/go.mod h1:5pB4lxRNYYVZuTLmy8oR2BH8dflOR+IbTYFD8fi3254=
 golang.org/x/text v0.0.0-20160726164857-2910a502d2bf/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2509,8 +2509,8 @@ golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
 golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
 golang.org/x/text v0.13.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE=
 golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.22.0 h1:bofq7m3/HAFvbF51jz3Q9wLg3jkvSPuiZu/pD1XwgtM=
-golang.org/x/text v0.22.0/go.mod h1:YRoo4H8PVmsu+E3Ou7cqLVH8oXWIHVoX0jqUWALQhfY=
+golang.org/x/text v0.31.0 h1:aC8ghyu4JhP8VojJ2lEHBnochRno1sgL6nEi9WGFGMM=
+golang.org/x/text v0.31.0/go.mod h1:tKRAlv61yKIjGGHX/4tP1LTbc13YSec1pxVEWXzfoeM=
 golang.org/x/time v0.0.0-20180412165947-fbb02b2291d2/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -2619,8 +2619,10 @@ golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc
 golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.17.0/go.mod h1:xsh6VxdV005rRVaS6SSAf9oiAqljS7UZUacMZ8Bnsps=
-golang.org/x/tools v0.30.0 h1:BgcpHewrV5AUp2G9MebG4XPFI1E2W41zU1SaqVA9vJY=
-golang.org/x/tools v0.30.0/go.mod h1:c347cR/OJfw5TI+GfX7RUPNMdDRRbjvYTS0jPyvsVtY=
+golang.org/x/tools v0.39.0 h1:ik4ho21kwuQln40uelmciQPp9SipgNDdrafrYA4TmQQ=
+golang.org/x/tools v0.39.0/go.mod h1:JnefbkDPyD8UU2kI5fuf8ZX4/yUeh9W877ZeBONxUqQ=
+golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnpsEAGHaNy0n/rJM=
+golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
 golang.org/x/xerrors v0.0.0-20190410155217-1f06c39b4373/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190513163551-3ee3066db522/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
diff --git a/pkg/sql/logictest/testdata/logic_test/builtin_function b/pkg/sql/logictest/testdata/logic_test/builtin_function
index 0eb4228ee6..213aae8a4d 100644
--- a/pkg/sql/logictest/testdata/logic_test/builtin_function
+++ b/pkg/sql/logictest/testdata/logic_test/builtin_function
@@ -3081,7 +3081,7 @@ SELECT crdb_internal.check_password_hash_format(('CRDB-BCRYPT$'||'3a$'||'10$'||'
 query error pgcode 42601 too short to be a bcrypted password
 SELECT crdb_internal.check_password_hash_format(('CRDB-BCRYPT$'||'2a$'||'10$'||'vcmoIBvgeHjgScVHWRMWI.Z3v0')::bytes)
 
-query error pgcode 42601 cost 1 is outside allowed range \(4,31\)
+query error pgcode 42601 cost 1 is outside allowed inclusive range 4..31
 SELECT crdb_internal.check_password_hash_format(('CRDB-BCRYPT$'||'2a$'||'01$'||'vcmoIBvgeHjgScVHWRMWI.Z3v03WMixAw2bBS6qZihljSUuwi88Yq')::bytes)
 
 query T
diff --git a/pkg/sql/pgwire/testdata/auth/password_change b/pkg/sql/pgwire/testdata/auth/password_change
index a6e72eae4a..f6ff3012ba 100644
--- a/pkg/sql/pgwire/testdata/auth/password_change
+++ b/pkg/sql/pgwire/testdata/auth/password_change
@@ -134,7 +134,7 @@ ERROR: crypto/bcrypt: hashedSecret too short to be a bcrypted password (SQLSTATE
 sql
 CREATE USER userhpw WITH PASSWORD 'CRDB-BCRYPT$2a$01$vcmoIBvgeHjgScVHWRMWI.Z3v03WMixAw2bBS6qZihljSUuwi88Yq'
 ----
-ERROR: crypto/bcrypt: cost 1 is outside allowed range (4,31) (SQLSTATE 42601)
+ERROR: crypto/bcrypt: cost 1 is outside allowed inclusive range 4..31 (SQLSTATE 42601)
 
 sql
 CREATE USER userhpw WITH PASSWORD 'CRDB-BCRYPT$2a$10$vcmoIBvgeHjgScVHWRMWI.Z3v03WMixAw2bBS6qZihljSUuwi88Yq'