diff --git a/go.mod b/go.mod
index d1a475f8..f65468c4 100644
--- a/go.mod
+++ b/go.mod
@@ -8,7 +8,7 @@ require (
 	github.com/gophercloud/utils/v2 v2.0.0-20260424064311-2eeed4ceb3e9
 	github.com/olekukonko/tablewriter v1.1.4
 	github.com/sapcc/go-api-declarations v1.22.0
-	github.com/sapcc/go-bits v0.0.0-20260514170017-1116652010c6
+	github.com/sapcc/go-bits v0.0.0-20260519090007-308851876285
 	github.com/sapcc/gophercloud-sapcc/v2 v2.0.5
 	github.com/spf13/cobra v1.10.2
 )
@@ -40,8 +40,8 @@ require (
 	github.com/spf13/pflag v1.0.9 // indirect
 	go.xyrillian.de/gg v1.7.0 // indirect
 	go.yaml.in/yaml/v2 v2.4.3 // indirect
-	golang.org/x/sys v0.43.0 // indirect
-	golang.org/x/text v0.36.0 // indirect
+	golang.org/x/sys v0.44.0 // indirect
+	golang.org/x/text v0.37.0 // indirect
 	google.golang.org/protobuf v1.36.11 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
diff --git a/go.sum b/go.sum
index 5de1052b..a1edbb69 100644
--- a/go.sum
+++ b/go.sum
@@ -75,8 +75,8 @@ github.com/rogpeppe/go-internal v1.10.0/go.mod h1:UQnix2H7Ngw/k4C5ijL5+65zddjncj
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sapcc/go-api-declarations v1.22.0 h1:nU/eJ6OO54Z9YSo1gWinD0A2etrfZObCwYdB9xA0VWE=
 github.com/sapcc/go-api-declarations v1.22.0/go.mod h1:x3V8bzg7Y4kmbA+DeWWwKteFEdCCSiVQdwRXj4fGAYY=
-github.com/sapcc/go-bits v0.0.0-20260514170017-1116652010c6 h1:bRY1m3Y58pt4CyFaqbF0TTt3/j+Ss6hc48t9L0GpFYQ=
-github.com/sapcc/go-bits v0.0.0-20260514170017-1116652010c6/go.mod h1:HlbUxBX5jObpd6owpG11w/RcnffZF0m0zLtsipqev48=
+github.com/sapcc/go-bits v0.0.0-20260519090007-308851876285 h1:m3WoORYUK0nIxLKxi27HMQEdKXENkoQLiQnkjfEYyKs=
+github.com/sapcc/go-bits v0.0.0-20260519090007-308851876285/go.mod h1:AbFZEVaSrwyhx7x4ZNExokEVIEWdXFOIJ/WHQzs4Y3I=
 github.com/sapcc/gophercloud-sapcc/v2 v2.0.5 h1:pWVIM0qP3YYAoZNx8jtfX+8nBSJ03ETDyrrdBmI/b6I=
 github.com/sapcc/gophercloud-sapcc/v2 v2.0.5/go.mod h1:ylQgPjcEWI6Kw7GvG5e8iEfIP+p1oiFQgrAImGIGvac=
 github.com/sergi/go-diff v1.4.0 h1:n/SP9D5ad1fORl+llWyN+D6qoUETXNZARKjyY2/KVCw=
@@ -97,10 +97,10 @@ go.yaml.in/yaml/v2 v2.4.3 h1:6gvOSjQoTB3vt1l+CU+tSyi/HOjfOjRLJ4YwYZGwRO0=
 go.yaml.in/yaml/v2 v2.4.3/go.mod h1:zSxWcmIDjOzPXpjlTTbAsKokqkDNAVtZO0WOMiT90s8=
 go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI=
-golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg=
-golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164=
+golang.org/x/sys v0.44.0 h1:ildZl3J4uzeKP07r2F++Op7E9B29JRUy+a27EibtBTQ=
+golang.org/x/sys v0.44.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc=
+golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38=
 google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=
 google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
diff --git a/vendor/github.com/sapcc/go-bits/assert/http.go b/vendor/github.com/sapcc/go-bits/assert/http.go
deleted file mode 100644
index b58b2472..00000000
--- a/vendor/github.com/sapcc/go-bits/assert/http.go
+++ /dev/null
@@ -1,146 +0,0 @@
-// SPDX-FileCopyrightText: 2017-2018 SAP SE or an SAP affiliate company
-// SPDX-License-Identifier: Apache-2.0
-
-package assert
-
-import (
-	"bytes"
-	"fmt"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-)
-
-// HTTPRequestBody is the type of field HTTPRequest.RequestBody.
-// It is implemented by StringData and JSONObject.
-type HTTPRequestBody interface {
-	GetRequestBody() (io.Reader, error)
-}
-
-// HTTPResponseBody is the type of field HTTPRequest.ExpectBody.
-// It is implemented by StringData and JSONObject.
-type HTTPResponseBody interface {
-	// Checks that the given actual response body is equal to this expected value.
-	// `request` contains a user-readable representation of the original request,
-	// for use in error messages.
-	//
-	// Returns whether the assertion was successful.
-	AssertResponseBody(t *testing.T, requestInfo string, responseBody []byte) bool
-}
-
-// HTTPRequest is a HTTP request that gets executed by a unit test.
-type HTTPRequest struct {
-	// request properties
-	Method string
-	Path   string
-	Header map[string]string
-	Body   HTTPRequestBody
-	// response properties
-	ExpectStatus int
-	ExpectBody   HTTPResponseBody
-	ExpectHeader map[string]string
-}
-
-// Check performs the HTTP request described by this HTTPRequest against the
-// given http.Handler and compares the response with the expectations in the
-// HTTPRequest.
-//
-// The HTTP response is returned, along with the response body. (resp.Body is
-// already exhausted when the function returns.) This is useful for tests that
-// want to do further checks on `resp` or want to use data from the response.
-//
-// Warning: This function is considered deprecated.
-// Please use httptest.Handler instead, which provides more flexible assertions.
-// For example, instead of this:
-//
-//	assert.HTTPRequest {
-//		Method:       "GET",
-//		Path:         "/v1/info",
-//		ExpectStatus: http.StatusOK,
-//		ExpectBody:   assert.JSONObject{"error_count": 0},
-//	}.Check(GinkgoT(), myHandler)
-//
-// Do this when using the regular std test runner:
-//
-//	h := httptest.NewHandler(myHandler)
-//	resp := h.RespondTo(ctx, "GET /v1/info")
-//	resp.ExpectJSON(t, http.StatusOK, jsonmatch.Object{"error_count": 0})
-//
-// Or do this when using Ginkgo/Gomega:
-//
-//	h := httptest.NewHandler(myHandler)
-//	var info map[string]any
-//	resp := h.RespondTo(ctx, "GET /v1/info", httptest.ReceiveJSONInto(&info))
-//	Expect(resp).To(HaveHTTPStatus(http.StatusOK))
-//	Expect(info).To(Equal(map[string]any{"error_count": 0}))
-func (r HTTPRequest) Check(t *testing.T, handler http.Handler) (resp *http.Response, responseBody []byte) {
-	t.Helper()
-
-	var requestBody io.Reader
-	if r.Body != nil {
-		var err error
-		requestBody, err = r.Body.GetRequestBody()
-		if err != nil {
-			t.Fatal(err)
-		}
-	}
-	request := httptest.NewRequest(r.Method, r.Path, requestBody)
-	if r.Header != nil {
-		for key, value := range r.Header {
-			request.Header.Set(key, value)
-		}
-	}
-
-	recorder := httptest.NewRecorder()
-	handler.ServeHTTP(recorder, request)
-
-	hadErrors := false
-	bodyShown := false
-
-	response := recorder.Result()
-	defer response.Body.Close()
-	responseBytes, err := io.ReadAll(response.Body)
-
-	if err != nil {
-		hadErrors = true
-		t.Errorf("Reading response body failed: %s", err.Error())
-	}
-
-	if response.StatusCode != r.ExpectStatus {
-		hadErrors = true
-		t.Errorf("%s %s: expected status code %d, got %d",
-			r.Method, r.Path, r.ExpectStatus, response.StatusCode,
-		)
-	}
-
-	for key, value := range r.ExpectHeader {
-		actual := response.Header.Get(key)
-		if actual != value {
-			t.Errorf("%s %s: expected %s: %q, got %s: %q",
-				r.Method, r.Path, key, value, key, actual,
-			)
-		}
-	}
-
-	if r.ExpectBody != nil {
-		// json.Encoder.Encode() adds a stupid extra newline that we want to ignore
-		if response.Header.Get("Content-Type") == "application/json" {
-			responseBytes = bytes.TrimSuffix(responseBytes, []byte("\n"))
-		}
-
-		requestInfo := fmt.Sprintf("%s %s", r.Method, r.Path)
-		if !r.ExpectBody.AssertResponseBody(t, requestInfo, responseBytes) {
-			hadErrors = true
-			bodyShown = true
-		}
-	}
-
-	// in case of errors, it's usually very helpful to see the response body
-	// (particularly for 4xx and 5xx responses), so make sure that it gets shown)
-	if hadErrors && !bodyShown {
-		t.Logf("%s %s: response body was %q", r.Method, r.Path, string(responseBytes))
-	}
-
-	return response, responseBytes
-}
diff --git a/vendor/github.com/sapcc/go-bits/assert/values.go b/vendor/github.com/sapcc/go-bits/assert/values.go
deleted file mode 100644
index b7d1e6f5..00000000
--- a/vendor/github.com/sapcc/go-bits/assert/values.go
+++ /dev/null
@@ -1,146 +0,0 @@
-// SPDX-FileCopyrightText: 2018 SAP SE or an SAP affiliate company
-// SPDX-License-Identifier: Apache-2.0
-
-package assert
-
-import (
-	"bytes"
-	"encoding/json"
-	"fmt"
-	"io"
-	"strings"
-	"testing"
-
-	"github.com/sergi/go-diff/diffmatchpatch"
-
-	"github.com/sapcc/go-bits/internal/testdiff"
-	"github.com/sapcc/go-bits/osext"
-)
-
-// ByteData implements the HTTPRequestBody and HTTPResponseBody for plain bytestrings.
-type ByteData []byte
-
-// GetRequestBody implements the HTTPRequestBody interface.
-func (b ByteData) GetRequestBody() (io.Reader, error) {
-	return bytes.NewReader([]byte(b)), nil
-}
-
-func logDiff(t *testing.T, expected, actual string) {
-	t.Helper()
-
-	if osext.GetenvBool("GOBITS_PRETTY_DIFF") {
-		dmp := diffmatchpatch.New()
-		diffs := dmp.DiffMain(fmt.Sprintf("%q\n", expected), fmt.Sprintf("%q\n", actual), false)
-		t.Log(dmp.DiffPrettyText(diffs))
-	} else {
-		t.Logf("\texpected = %q\n", expected)
-		t.Logf("\t  actual = %q\n", actual)
-	}
-}
-
-// AssertResponseBody implements the HTTPResponseBody interface.
-func (b ByteData) AssertResponseBody(t *testing.T, requestInfo string, responseBody []byte) bool {
-	t.Helper()
-
-	if !bytes.Equal([]byte(b), responseBody) {
-		t.Error(requestInfo + ": got unexpected response body")
-		logDiff(t, string(b), string(responseBody))
-		return false
-	}
-
-	return true
-}
-
-// StringData implements HTTPRequestBody and HTTPResponseBody for plain strings.
-type StringData string
-
-// GetRequestBody implements the HTTPRequestBody interface.
-func (s StringData) GetRequestBody() (io.Reader, error) {
-	return strings.NewReader(string(s)), nil
-}
-
-// AssertResponseBody implements the HTTPResponseBody interface.
-func (s StringData) AssertResponseBody(t *testing.T, requestInfo string, responseBody []byte) bool {
-	t.Helper()
-
-	responseStr := string(responseBody)
-	if responseStr != string(s) {
-		t.Errorf("%s: got unexpected response body", requestInfo)
-		logDiff(t, string(s), responseStr)
-		return false
-	}
-
-	return true
-}
-
-// JSONObject implements HTTPRequestBody and HTTPResponseBody for JSON objects.
-type JSONObject map[string]any
-
-// GetRequestBody implements the HTTPRequestBody interface.
-func (o JSONObject) GetRequestBody() (io.Reader, error) {
-	buf, err := json.Marshal(o)
-	return bytes.NewReader(buf), err
-}
-
-// AssertResponseBody implements the HTTPResponseBody interface.
-func (o JSONObject) AssertResponseBody(t *testing.T, requestInfo string, responseBody []byte) bool {
-	t.Helper()
-
-	buf, err := json.Marshal(o)
-	if err != nil {
-		t.Error(err.Error())
-		return false
-	}
-
-	// need to decode and re-encode the responseBody to ensure identical ordering of keys
-	var data map[string]any
-	err = json.Unmarshal(responseBody, &data)
-	if err == nil {
-		responseBody, err = json.Marshal(data)
-		if err != nil {
-			t.Errorf("JSON marshalling failed: %s", err.Error())
-			return false
-		}
-	}
-
-	if string(responseBody) != string(buf) {
-		t.Errorf("%s: got unexpected response body", requestInfo)
-		logDiff(t, string(buf), string(responseBody))
-		return false
-	}
-
-	return true
-}
-
-// JSONFixtureFile implements HTTPResponseBody by locating the expected JSON
-// response body in the given file.
-type JSONFixtureFile string
-
-// AssertResponseBody implements the HTTPResponseBody interface.
-func (f JSONFixtureFile) AssertResponseBody(t *testing.T, requestInfo string, responseBody []byte) bool {
-	t.Helper()
-
-	var buf bytes.Buffer
-	err := json.Indent(&buf, responseBody, "", "  ")
-	if err != nil {
-		t.Logf("Response body: %s", responseBody)
-		t.Fatal(err)
-		return false
-	}
-	buf.WriteByte('\n')
-	return FixtureFile(f).AssertResponseBody(t, requestInfo, buf.Bytes())
-}
-
-// FixtureFile implements HTTPResponseBody by locating the expected
-// plain-text response body in the given file.
-type FixtureFile string
-
-// AssertResponseBody implements the HTTPResponseBody interface.
-func (f FixtureFile) AssertResponseBody(t *testing.T, requestInfo string, responseBody []byte) bool {
-	t.Helper()
-	err := testdiff.DiffAgainstFixtureFile(string(f), responseBody)
-	if err != nil {
-		t.Errorf("%s: body does not match: %s", requestInfo, err.Error())
-	}
-	return err == nil
-}
diff --git a/vendor/github.com/sapcc/go-bits/internal/testdiff/diff.go b/vendor/github.com/sapcc/go-bits/internal/testdiff/diff.go
deleted file mode 100644
index 53b9f9e3..00000000
--- a/vendor/github.com/sapcc/go-bits/internal/testdiff/diff.go
+++ /dev/null
@@ -1,37 +0,0 @@
-// SPDX-FileCopyrightText: 2025 SAP SE or an SAP affiliate company
-// SPDX-License-Identifier: Apache-2.0
-
-package testdiff
-
-import (
-	"os"
-	"os/exec"
-)
-
-// DiffAgainstFixtureFile checks that the contents of the file at the given
-// path are equal to the provided bytestring. If not, the provided bytestring
-// will be stored at `path + ".actual"` to allow the user to inspect the diff.
-func DiffAgainstFixtureFile(path string, actual []byte) (returnedError error) {
-	// write actual content to file to make it easy to copy the computed result over
-	// to the fixture path when a new test is added or an existing one is modified
-	actualPath := path + ".actual"
-	err := os.WriteFile(actualPath, actual, 0o666)
-	if err != nil {
-		return err
-	}
-	defer func() {
-		// if there is no diff, we do not need to retain the ".actual" file;
-		// this is especially important because, if `reuse lint` runs later as part
-		// of the full test suite, it might be confused about the licensing of this
-		// irrelevant temporary file
-		if returnedError == nil {
-			returnedError = os.Remove(actualPath)
-		}
-	}()
-
-	cmd := exec.Command("diff", "-u", path, actualPath)
-	cmd.Stdin = nil
-	cmd.Stdout = os.Stdout
-	cmd.Stderr = os.Stderr
-	return cmd.Run()
-}
diff --git a/vendor/golang.org/x/sys/unix/affinity_linux.go b/vendor/golang.org/x/sys/unix/affinity_linux.go
index 3ea47038..acd6257f 100644
--- a/vendor/golang.org/x/sys/unix/affinity_linux.go
+++ b/vendor/golang.org/x/sys/unix/affinity_linux.go
@@ -13,11 +13,19 @@ import (
 
 const cpuSetSize = _CPU_SETSIZE / _NCPUBITS
 
-// CPUSet represents a CPU affinity mask.
+// CPUSet represents a bit mask of CPUs, to be used with [SchedGetaffinity], [SchedSetaffinity],
+// and [SetMemPolicy].
+//
+// Note this type can only represent CPU IDs 0 through 1023.
+// Use [CPUSetDynamic]/[NewCPUSet] instead to avoid this limit.
 type CPUSet [cpuSetSize]cpuMask
 
-func schedAffinity(trap uintptr, pid int, set *CPUSet) error {
-	_, _, e := RawSyscall(trap, uintptr(pid), uintptr(unsafe.Sizeof(*set)), uintptr(unsafe.Pointer(set)))
+// CPUSetDynamic represents a bit mask of CPUs, to be used with [SchedGetaffinityDynamic],
+// [SchedSetaffinityDynamic], and [SetMemPolicyDynamic]. Use [NewCPUSet] to allocate.
+type CPUSetDynamic []cpuMask
+
+func schedAffinity(trap uintptr, pid int, size uintptr, ptr unsafe.Pointer) error {
+	_, _, e := RawSyscall(trap, uintptr(pid), uintptr(size), uintptr(ptr))
 	if e != 0 {
 		return errnoErr(e)
 	}
@@ -27,13 +35,13 @@ func schedAffinity(trap uintptr, pid int, set *CPUSet) error {
 // SchedGetaffinity gets the CPU affinity mask of the thread specified by pid.
 // If pid is 0 the calling thread is used.
 func SchedGetaffinity(pid int, set *CPUSet) error {
-	return schedAffinity(SYS_SCHED_GETAFFINITY, pid, set)
+	return schedAffinity(SYS_SCHED_GETAFFINITY, pid, unsafe.Sizeof(*set), unsafe.Pointer(set))
 }
 
 // SchedSetaffinity sets the CPU affinity mask of the thread specified by pid.
 // If pid is 0 the calling thread is used.
 func SchedSetaffinity(pid int, set *CPUSet) error {
-	return schedAffinity(SYS_SCHED_SETAFFINITY, pid, set)
+	return schedAffinity(SYS_SCHED_SETAFFINITY, pid, unsafe.Sizeof(*set), unsafe.Pointer(set))
 }
 
 // Zero clears the set s, so that it contains no CPUs.
@@ -45,9 +53,7 @@ func (s *CPUSet) Zero() {
 // will silently ignore any invalid CPU bits in [CPUSet] so this is an
 // efficient way of resetting the CPU affinity of a process.
 func (s *CPUSet) Fill() {
-	for i := range s {
-		s[i] = ^cpuMask(0)
-	}
+	cpuMaskFill(s[:])
 }
 
 func cpuBitsIndex(cpu int) int {
@@ -58,24 +64,27 @@ func cpuBitsMask(cpu int) cpuMask {
 	return cpuMask(1 << (uint(cpu) % _NCPUBITS))
 }
 
-// Set adds cpu to the set s.
-func (s *CPUSet) Set(cpu int) {
+func cpuMaskFill(s []cpuMask) {
+	for i := range s {
+		s[i] = ^cpuMask(0)
+	}
+}
+
+func cpuMaskSet(s []cpuMask, cpu int) {
 	i := cpuBitsIndex(cpu)
 	if i < len(s) {
 		s[i] |= cpuBitsMask(cpu)
 	}
 }
 
-// Clear removes cpu from the set s.
-func (s *CPUSet) Clear(cpu int) {
+func cpuMaskClear(s []cpuMask, cpu int) {
 	i := cpuBitsIndex(cpu)
 	if i < len(s) {
 		s[i] &^= cpuBitsMask(cpu)
 	}
 }
 
-// IsSet reports whether cpu is in the set s.
-func (s *CPUSet) IsSet(cpu int) bool {
+func cpuMaskIsSet(s []cpuMask, cpu int) bool {
 	i := cpuBitsIndex(cpu)
 	if i < len(s) {
 		return s[i]&cpuBitsMask(cpu) != 0
@@ -83,11 +92,98 @@ func (s *CPUSet) IsSet(cpu int) bool {
 	return false
 }
 
-// Count returns the number of CPUs in the set s.
-func (s *CPUSet) Count() int {
+func cpuMaskCount(s []cpuMask) int {
 	c := 0
 	for _, b := range s {
 		c += bits.OnesCount64(uint64(b))
 	}
 	return c
 }
+
+// Set adds cpu to the set s. If cpu is out of bounds for s, no action is taken.
+func (s *CPUSet) Set(cpu int) {
+	cpuMaskSet(s[:], cpu)
+}
+
+// Clear removes cpu from the set s. If cpu is out of bounds for s, no action is taken.
+func (s *CPUSet) Clear(cpu int) {
+	cpuMaskClear(s[:], cpu)
+}
+
+// IsSet reports whether cpu is in the set s.
+func (s *CPUSet) IsSet(cpu int) bool {
+	return cpuMaskIsSet(s[:], cpu)
+}
+
+// Count returns the number of CPUs in the set s.
+func (s *CPUSet) Count() int {
+	return cpuMaskCount(s[:])
+}
+
+// NewCPUSet creates a CPU affinity mask capable of representing CPU IDs
+// up to maxCPU (exclusive).
+func NewCPUSet(maxCPU int) CPUSetDynamic {
+	numMasks := (maxCPU + _NCPUBITS - 1) / _NCPUBITS
+	if numMasks == 0 {
+		numMasks = 1
+	}
+	return make(CPUSetDynamic, numMasks)
+}
+
+// Zero clears the set s, so that it contains no CPUs.
+func (s CPUSetDynamic) Zero() {
+	clear(s)
+}
+
+// Fill adds all possible CPU bits to the set s. On Linux, [SchedSetaffinityDynamic]
+// will silently ignore any invalid CPU bits in [CPUSetDynamic] so this is an
+// efficient way of resetting the CPU affinity of a process.
+func (s CPUSetDynamic) Fill() {
+	cpuMaskFill(s)
+}
+
+// Set adds cpu to the set s. If cpu is out of bounds for s, no action is taken.
+func (s CPUSetDynamic) Set(cpu int) {
+	cpuMaskSet(s, cpu)
+}
+
+// Clear removes cpu from the set s. If cpu is out of bounds for s, no action is taken.
+func (s CPUSetDynamic) Clear(cpu int) {
+	cpuMaskClear(s, cpu)
+}
+
+// IsSet reports whether cpu is in the set s.
+func (s CPUSetDynamic) IsSet(cpu int) bool {
+	return cpuMaskIsSet(s, cpu)
+}
+
+// Count returns the number of CPUs in the set s.
+func (s CPUSetDynamic) Count() int {
+	return cpuMaskCount(s)
+}
+
+func (s CPUSetDynamic) size() uintptr {
+	return uintptr(len(s)) * unsafe.Sizeof(cpuMask(0))
+}
+
+func (s CPUSetDynamic) pointer() unsafe.Pointer {
+	if len(s) == 0 {
+		return nil
+	}
+	return unsafe.Pointer(&s[0])
+}
+
+// SchedGetaffinityDynamic gets the CPU affinity mask of the thread specified by pid.
+// If pid is 0 the calling thread is used.
+//
+// If the set is smaller than the size of the affinity mask used by the kernel,
+// [EINVAL] is returned.
+func SchedGetaffinityDynamic(pid int, set CPUSetDynamic) error {
+	return schedAffinity(SYS_SCHED_GETAFFINITY, pid, set.size(), set.pointer())
+}
+
+// SchedSetaffinityDynamic sets the CPU affinity mask of the thread specified by pid.
+// If pid is 0 the calling thread is used.
+func SchedSetaffinityDynamic(pid int, set CPUSetDynamic) error {
+	return schedAffinity(SYS_SCHED_SETAFFINITY, pid, set.size(), set.pointer())
+}
diff --git a/vendor/golang.org/x/sys/unix/mkall.sh b/vendor/golang.org/x/sys/unix/mkall.sh
index d0ed6119..f6ddee1a 100644
--- a/vendor/golang.org/x/sys/unix/mkall.sh
+++ b/vendor/golang.org/x/sys/unix/mkall.sh
@@ -51,7 +51,7 @@ if [[ "$GOOS" = "linux" ]]; then
 	# Files generated through docker (use $cmd so you can Ctl-C the build or run)
 	set -e
 	$cmd docker build --tag generate:$GOOS $GOOS
-	$cmd docker run --interactive --tty --volume $(cd -- "$(dirname -- "$0")/.." && pwd):/build generate:$GOOS
+	$cmd docker run --rm --interactive --tty --volume $(cd -- "$(dirname -- "$0")/.." && pwd):/build generate:$GOOS
 	exit
 fi
 
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux.go b/vendor/golang.org/x/sys/unix/syscall_linux.go
index 06c0eea6..f7b82bcc 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux.go
@@ -2644,8 +2644,12 @@ func SchedGetAttr(pid int, flags uint) (*SchedAttr, error) {
 //sys	Cachestat(fd uint, crange *CachestatRange, cstat *Cachestat_t, flags uint) (err error)
 //sys	Mseal(b []byte, flags uint) (err error)
 
-//sys	setMemPolicy(mode int, mask *CPUSet, size int) (err error) = SYS_SET_MEMPOLICY
+//sys	setMemPolicy(mode int, mask unsafe.Pointer, size uintptr) (err error) = SYS_SET_MEMPOLICY
 
 func SetMemPolicy(mode int, mask *CPUSet) error {
-	return setMemPolicy(mode, mask, _CPU_SETSIZE)
+	return setMemPolicy(mode, unsafe.Pointer(mask), _CPU_SETSIZE)
+}
+
+func SetMemPolicyDynamic(mode int, mask CPUSetDynamic) error {
+	return setMemPolicy(mode, mask.pointer(), mask.size())
 }
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_arm.go b/vendor/golang.org/x/sys/unix/syscall_linux_arm.go
index cd2dd797..ecf92bfa 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_arm.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_arm.go
@@ -82,6 +82,9 @@ func Time(t *Time_t) (Time_t, error) {
 }
 
 func Utime(path string, buf *Utimbuf) error {
+	if buf == nil {
+		return Utimes(path, nil)
+	}
 	tv := []Timeval{
 		{Sec: buf.Actime},
 		{Sec: buf.Modtime},
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go b/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
index 745e5c7e..17373807 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_arm64.go
@@ -113,6 +113,9 @@ func Time(t *Time_t) (Time_t, error) {
 }
 
 func Utime(path string, buf *Utimbuf) error {
+	if buf == nil {
+		return Utimes(path, nil)
+	}
 	tv := []Timeval{
 		{Sec: buf.Actime},
 		{Sec: buf.Modtime},
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go b/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go
index dd2262a4..a3fd1d0b 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_loong64.go
@@ -150,6 +150,9 @@ func Time(t *Time_t) (Time_t, error) {
 }
 
 func Utime(path string, buf *Utimbuf) error {
+	if buf == nil {
+		return Utimes(path, nil)
+	}
 	tv := []Timeval{
 		{Sec: buf.Actime},
 		{Sec: buf.Modtime},
diff --git a/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go b/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
index 8cf3670b..fc5543c5 100644
--- a/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
+++ b/vendor/golang.org/x/sys/unix/syscall_linux_riscv64.go
@@ -112,6 +112,9 @@ func Time(t *Time_t) (Time_t, error) {
 }
 
 func Utime(path string, buf *Utimbuf) error {
+	if buf == nil {
+		return Utimes(path, nil)
+	}
 	tv := []Timeval{
 		{Sec: buf.Actime},
 		{Sec: buf.Modtime},
diff --git a/vendor/golang.org/x/sys/unix/zsyscall_linux.go b/vendor/golang.org/x/sys/unix/zsyscall_linux.go
index 8935d10a..886f5de5 100644
--- a/vendor/golang.org/x/sys/unix/zsyscall_linux.go
+++ b/vendor/golang.org/x/sys/unix/zsyscall_linux.go
@@ -2241,8 +2241,8 @@ func Mseal(b []byte, flags uint) (err error) {
 
 // THIS FILE IS GENERATED BY THE COMMAND AT THE TOP; DO NOT EDIT
 
-func setMemPolicy(mode int, mask *CPUSet, size int) (err error) {
-	_, _, e1 := Syscall(SYS_SET_MEMPOLICY, uintptr(mode), uintptr(unsafe.Pointer(mask)), uintptr(size))
+func setMemPolicy(mode int, mask unsafe.Pointer, size uintptr) (err error) {
+	_, _, e1 := Syscall(SYS_SET_MEMPOLICY, uintptr(mode), uintptr(mask), uintptr(size))
 	if e1 != 0 {
 		err = errnoErr(e1)
 	}
diff --git a/vendor/golang.org/x/sys/windows/syscall_windows.go b/vendor/golang.org/x/sys/windows/syscall_windows.go
index d7664365..453a7b97 100644
--- a/vendor/golang.org/x/sys/windows/syscall_windows.go
+++ b/vendor/golang.org/x/sys/windows/syscall_windows.go
@@ -892,9 +892,13 @@ const socket_error = uintptr(^uint32(0))
 //sys	MultiByteToWideChar(codePage uint32, dwFlags uint32, str *byte, nstr int32, wchar *uint16, nwchar int32) (nwrite int32, err error) = kernel32.MultiByteToWideChar
 //sys	getBestInterfaceEx(sockaddr unsafe.Pointer, pdwBestIfIndex *uint32) (errcode error) = iphlpapi.GetBestInterfaceEx
 //sys   GetIfEntry2Ex(level uint32, row *MibIfRow2) (errcode error) = iphlpapi.GetIfEntry2Ex
+//sys   GetIfTable2Ex(level uint32, table **MibIfTable2) (errcode error) = iphlpapi.GetIfTable2Ex
 //sys   GetIpForwardEntry2(row *MibIpForwardRow2) (errcode error) = iphlpapi.GetIpForwardEntry2
 //sys   GetIpForwardTable2(family uint16, table **MibIpForwardTable2) (errcode error) = iphlpapi.GetIpForwardTable2
+//sys   GetIpInterfaceEntry(row *MibIpInterfaceRow) (errcode error) = iphlpapi.GetIpInterfaceEntry
+//sys   GetIpInterfaceTable(family uint16, table **MibIpInterfaceTable) (errcode error) = iphlpapi.GetIpInterfaceTable
 //sys   GetUnicastIpAddressEntry(row *MibUnicastIpAddressRow) (errcode error) = iphlpapi.GetUnicastIpAddressEntry
+//sys   GetUnicastIpAddressTable(family uint16, table **MibUnicastIpAddressTable) (errcode error) = iphlpapi.GetUnicastIpAddressTable
 //sys   FreeMibTable(memory unsafe.Pointer) = iphlpapi.FreeMibTable
 //sys   NotifyIpInterfaceChange(family uint16, callback uintptr, callerContext unsafe.Pointer, initialNotification bool, notificationHandle *Handle) (errcode error) = iphlpapi.NotifyIpInterfaceChange
 //sys   NotifyRouteChange2(family uint16, callback uintptr, callerContext unsafe.Pointer, initialNotification bool, notificationHandle *Handle) (errcode error) = iphlpapi.NotifyRouteChange2
@@ -1693,10 +1697,13 @@ func NewNTUnicodeString(s string) (*NTUnicodeString, error) {
 	if err != nil {
 		return nil, err
 	}
-	n := uint16(len(s16) * 2)
+	n := len(s16) * 2
+	if n > (1<<16)-1 {
+		return nil, syscall.EINVAL
+	}
 	return &NTUnicodeString{
-		Length:        n - 2, // subtract 2 bytes for the NULL terminator
-		MaximumLength: n,
+		Length:        uint16(n) - 2, // subtract 2 bytes for the NULL terminator
+		MaximumLength: uint16(n),
 		Buffer:        &s16[0],
 	}, nil
 }
diff --git a/vendor/golang.org/x/sys/windows/types_windows.go b/vendor/golang.org/x/sys/windows/types_windows.go
index d5658a13..d82299e3 100644
--- a/vendor/golang.org/x/sys/windows/types_windows.go
+++ b/vendor/golang.org/x/sys/windows/types_windows.go
@@ -2320,6 +2320,21 @@ type MibIfRow2 struct {
 	OutQLen                     uint64
 }
 
+// MIB_IF_TABLE_LEVEL enumeration from netioapi.h or
+// https://learn.microsoft.com/en-us/windows/win32/api/netioapi/ne-netioapi-mib_if_table_level.
+const (
+	MibIfTableNormal                  = 0
+	MibIfTableRaw                     = 1
+	MibIfTableNormalWithoutStatistics = 2
+)
+
+// MibIfTable2 contains a table of logical and physical interface entries. See
+// https://learn.microsoft.com/en-us/windows/win32/api/netioapi/ns-netioapi-mib_if_table2.
+type MibIfTable2 struct {
+	NumEntries uint32
+	Table      [1]MibIfRow2
+}
+
 // IP_ADDRESS_PREFIX stores an IP address prefix. See
 // https://learn.microsoft.com/en-us/windows/win32/api/netioapi/ns-netioapi-ip_address_prefix.
 type IpAddressPrefix struct {
@@ -2413,6 +2428,13 @@ type MibUnicastIpAddressRow struct {
 	CreationTimeStamp  Filetime
 }
 
+// MibUnicastIpAddressTable contains a table of unicast IP address entries. See
+// https://learn.microsoft.com/en-us/windows/win32/api/netioapi/ns-netioapi-mib_unicastipaddress_table.
+type MibUnicastIpAddressTable struct {
+	NumEntries uint32
+	Table      [1]MibUnicastIpAddressRow
+}
+
 const ScopeLevelCount = 16
 
 // MIB_IPINTERFACE_ROW stores interface management information for a particular IP address family on a network interface.
@@ -2455,6 +2477,13 @@ type MibIpInterfaceRow struct {
 	DisableDefaultRoutes                 uint8
 }
 
+// MibIpInterfaceTable contains a table of IP interface entries. See
+// https://learn.microsoft.com/en-us/windows/win32/api/netioapi/ns-netioapi-mib_ipinterface_table.
+type MibIpInterfaceTable struct {
+	NumEntries uint32
+	Table      [1]MibIpInterfaceRow
+}
+
 // Console related constants used for the mode parameter to SetConsoleMode. See
 // https://docs.microsoft.com/en-us/windows/console/setconsolemode for details.
 
diff --git a/vendor/golang.org/x/sys/windows/zsyscall_windows.go b/vendor/golang.org/x/sys/windows/zsyscall_windows.go
index fe7a4ea1..a506ac0f 100644
--- a/vendor/golang.org/x/sys/windows/zsyscall_windows.go
+++ b/vendor/golang.org/x/sys/windows/zsyscall_windows.go
@@ -188,9 +188,13 @@ var (
 	procGetBestInterfaceEx                                   = modiphlpapi.NewProc("GetBestInterfaceEx")
 	procGetIfEntry                                           = modiphlpapi.NewProc("GetIfEntry")
 	procGetIfEntry2Ex                                        = modiphlpapi.NewProc("GetIfEntry2Ex")
+	procGetIfTable2Ex                                        = modiphlpapi.NewProc("GetIfTable2Ex")
 	procGetIpForwardEntry2                                   = modiphlpapi.NewProc("GetIpForwardEntry2")
 	procGetIpForwardTable2                                   = modiphlpapi.NewProc("GetIpForwardTable2")
+	procGetIpInterfaceEntry                                  = modiphlpapi.NewProc("GetIpInterfaceEntry")
+	procGetIpInterfaceTable                                  = modiphlpapi.NewProc("GetIpInterfaceTable")
 	procGetUnicastIpAddressEntry                             = modiphlpapi.NewProc("GetUnicastIpAddressEntry")
+	procGetUnicastIpAddressTable                             = modiphlpapi.NewProc("GetUnicastIpAddressTable")
 	procNotifyIpInterfaceChange                              = modiphlpapi.NewProc("NotifyIpInterfaceChange")
 	procNotifyRouteChange2                                   = modiphlpapi.NewProc("NotifyRouteChange2")
 	procNotifyUnicastIpAddressChange                         = modiphlpapi.NewProc("NotifyUnicastIpAddressChange")
@@ -1674,6 +1678,14 @@ func GetIfEntry2Ex(level uint32, row *MibIfRow2) (errcode error) {
 	return
 }
 
+func GetIfTable2Ex(level uint32, table **MibIfTable2) (errcode error) {
+	r0, _, _ := syscall.SyscallN(procGetIfTable2Ex.Addr(), uintptr(level), uintptr(unsafe.Pointer(table)))
+	if r0 != 0 {
+		errcode = syscall.Errno(r0)
+	}
+	return
+}
+
 func GetIpForwardEntry2(row *MibIpForwardRow2) (errcode error) {
 	r0, _, _ := syscall.SyscallN(procGetIpForwardEntry2.Addr(), uintptr(unsafe.Pointer(row)))
 	if r0 != 0 {
@@ -1690,6 +1702,22 @@ func GetIpForwardTable2(family uint16, table **MibIpForwardTable2) (errcode erro
 	return
 }
 
+func GetIpInterfaceEntry(row *MibIpInterfaceRow) (errcode error) {
+	r0, _, _ := syscall.SyscallN(procGetIpInterfaceEntry.Addr(), uintptr(unsafe.Pointer(row)))
+	if r0 != 0 {
+		errcode = syscall.Errno(r0)
+	}
+	return
+}
+
+func GetIpInterfaceTable(family uint16, table **MibIpInterfaceTable) (errcode error) {
+	r0, _, _ := syscall.SyscallN(procGetIpInterfaceTable.Addr(), uintptr(family), uintptr(unsafe.Pointer(table)))
+	if r0 != 0 {
+		errcode = syscall.Errno(r0)
+	}
+	return
+}
+
 func GetUnicastIpAddressEntry(row *MibUnicastIpAddressRow) (errcode error) {
 	r0, _, _ := syscall.SyscallN(procGetUnicastIpAddressEntry.Addr(), uintptr(unsafe.Pointer(row)))
 	if r0 != 0 {
@@ -1698,6 +1726,14 @@ func GetUnicastIpAddressEntry(row *MibUnicastIpAddressRow) (errcode error) {
 	return
 }
 
+func GetUnicastIpAddressTable(family uint16, table **MibUnicastIpAddressTable) (errcode error) {
+	r0, _, _ := syscall.SyscallN(procGetUnicastIpAddressTable.Addr(), uintptr(family), uintptr(unsafe.Pointer(table)))
+	if r0 != 0 {
+		errcode = syscall.Errno(r0)
+	}
+	return
+}
+
 func NotifyIpInterfaceChange(family uint16, callback uintptr, callerContext unsafe.Pointer, initialNotification bool, notificationHandle *Handle) (errcode error) {
 	var _p0 uint32
 	if initialNotification {
diff --git a/vendor/modules.txt b/vendor/modules.txt
index 03b51a35..7502f1c5 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -128,7 +128,7 @@ github.com/sapcc/go-api-declarations/limes
 github.com/sapcc/go-api-declarations/limes/rates
 github.com/sapcc/go-api-declarations/limes/resources
 github.com/sapcc/go-api-declarations/liquid
-# github.com/sapcc/go-bits v0.0.0-20260514170017-1116652010c6
+# github.com/sapcc/go-bits v0.0.0-20260519090007-308851876285
 ## explicit; go 1.26
 github.com/sapcc/go-bits/assert
 github.com/sapcc/go-bits/gophercloudext
@@ -137,7 +137,6 @@ github.com/sapcc/go-bits/httpapi
 github.com/sapcc/go-bits/httpapi/pprofapi
 github.com/sapcc/go-bits/httpext
 github.com/sapcc/go-bits/internal
-github.com/sapcc/go-bits/internal/testdiff
 github.com/sapcc/go-bits/liquidapi
 github.com/sapcc/go-bits/logg
 github.com/sapcc/go-bits/must
@@ -168,11 +167,11 @@ go.xyrillian.de/gg/option
 # go.yaml.in/yaml/v2 v2.4.3
 ## explicit; go 1.15
 go.yaml.in/yaml/v2
-# golang.org/x/sys v0.43.0
+# golang.org/x/sys v0.44.0
 ## explicit; go 1.25.0
 golang.org/x/sys/unix
 golang.org/x/sys/windows
-# golang.org/x/text v0.36.0
+# golang.org/x/text v0.37.0
 ## explicit; go 1.25.0
 golang.org/x/text/encoding
 golang.org/x/text/encoding/charmap