# Review Go dependency bumps carefully

For Go module, `go.sum`, and `vendor/` bump PRs, review the actual code changes, not just the version bump.

Check for impact on:

- daemon or API behavior
- container runtime, networking, storage, archive, registry, and BuildKit-related paths
- syscall, namespace, cgroup, mount, or rootless behavior
- transitive dependency changes
- major version jumps, default changes, error handling changes, or hidden logic changes in vendored churn

Do not approve only because the PR is autogenerated, the version bump is small, or CI passes.

In the review summary, state what changed, what relevant code paths were inspected, and any remaining risk or need for targeted testing.