upgrade to latest dependencies (#969)

bumping knative.dev/pkg 077dcf0...2be9d56:
  > 2be9d56 Lock before iterating map so that code does not panic on concurrent write (# 3279)
bumping knative.dev/hack af735b2...f2be520:
  > f2be520 [release-1.19] 🐛 Fix knative.dev/toolbox for older versions of Golang (# 444)

Signed-off-by: Knative Automation <[email protected]>

Author: knative-automation

go.mod

@@ -10,8 +10,8 @@ require (
 	k8s.io/client-go v0.33.4
 	k8s.io/code-generator v0.33.4
 	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff
-	knative.dev/hack v0.0.0-20250902154142-af735b2738d6
-	knative.dev/pkg v0.0.0-20250909011231-077dcf0d00e8
+	knative.dev/hack v0.0.0-20251016122918-f2be520302e8
+	knative.dev/pkg v0.0.0-20251022152246-2be9d56c9027
 )
 
 require (

go.sum

@@ -184,10 +184,10 @@ k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff h1:/usPimJzUKKu+m+TE36gUy
 k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff/go.mod h1:5jIi+8yX4RIb8wk3XwBo5Pq2ccx4FP10ohkbSKCZoK8=
 k8s.io/utils v0.0.0-20241210054802-24370beab758 h1:sdbE21q2nlQtFh65saZY+rRM6x6aJJI8IUa1AmH/qa0=
 k8s.io/utils v0.0.0-20241210054802-24370beab758/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
-knative.dev/hack v0.0.0-20250902154142-af735b2738d6 h1:JYZgO9bni32T+BB5v6WpeRFm1hjj+EypBLZCk6HZBt0=
-knative.dev/hack v0.0.0-20250902154142-af735b2738d6/go.mod h1:R0ritgYtjLDO9527h5vb5X6gfvt5LCrJ55BNbVDsWiY=
-knative.dev/pkg v0.0.0-20250909011231-077dcf0d00e8 h1:n0BMHXIem9MyDkK4vfA4Vzdxaf1e+EeLJ6k+8exCjjI=
-knative.dev/pkg v0.0.0-20250909011231-077dcf0d00e8/go.mod h1:a1amDzo4YIUNuGeDgEz/uDHs5MQVYI1DXnRnEpWCAts=
+knative.dev/hack v0.0.0-20251016122918-f2be520302e8 h1:UQGRZ6nsBfzVGmSQYSN2b/aixYy8FJ+fpuI2KJGLBGo=
+knative.dev/hack v0.0.0-20251016122918-f2be520302e8/go.mod h1:R0ritgYtjLDO9527h5vb5X6gfvt5LCrJ55BNbVDsWiY=
+knative.dev/pkg v0.0.0-20251022152246-2be9d56c9027 h1:+J1lJc4Qu2oHUX9S6sTVxu+nY6Y4cTUQjBCLkbreBuo=
+knative.dev/pkg v0.0.0-20251022152246-2be9d56c9027/go.mod h1:a1amDzo4YIUNuGeDgEz/uDHs5MQVYI1DXnRnEpWCAts=
 sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 h1:gBQPwqORJ8d8/YNZWEjoZs7npUVDpVXUUOFfW6CgAqE=
 sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
 sigs.k8s.io/randfill v0.0.0-20250304075658-069ef1bbf016/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=

vendor/knative.dev/hack/library.sh

@@ -681,7 +681,7 @@ function start_knative_eventing_extension() {
 # Parameters: $1 - tool package for go run.
 #             $2..$n - parameters passed to the tool.
 function go_run() {
-  local package
+  local package gotoolchain
   package="$1"
   if [[ "$package" != *@* ]]; then
     abort 'Package for "go_run" needs to have @version'
@@ -696,6 +696,11 @@ function go_run() {
     GORUN_PATH="$(mktemp -t -d -u gopath.XXXXXXXX)"
   fi
   export GORUN_PATH
+  gotoolchain="$(go env GOTOOLCHAIN)"
+  if [[ "$package" == knative.dev/toolbox/* ]]; then
+    gotoolchain=auto
+  fi
+  GOTOOLCHAIN="${gotoolchain}" \
   GOPATH="${GORUN_PATH}" \
   GOFLAGS='' \
     go run "$package" "$@"

vendor/knative.dev/hack/presubmit-tests.sh

@@ -141,7 +141,7 @@ function __build_test_runner_for_module() {
   # Don't merge these two lines, or return code will always be 0.
   # Get all build tags in go code (ignore /vendor, /hack and /third_party)
   local tags
-  tags="$(go run knative.dev/toolbox/go-ls-tags@latest --joiner=,)"
+  tags="$(go_run knative.dev/toolbox/go-ls-tags@latest --joiner=,)"
   local go_pkg_dirs
   go_pkg_dirs="$(go list -tags "${tags}" ./...)" || return $?
   if [[ -z "${go_pkg_dirs}" ]]; then

vendor/knative.dev/pkg/controller/queue_metrics.go

@@ -121,6 +121,10 @@ func (m *queueMetrics) updateUnfinishedWork() {
 	// doesn't seem to have non-hacky ways to reset the summary metrics.
 	var total float64
 	var oldest float64
+
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
 	for _, t := range m.processingStartTimes {
 		age := m.sinceInSeconds(t)
 		total += age

vendor/modules.txt

@@ -718,10 +718,10 @@ k8s.io/utils/net
 k8s.io/utils/pointer
 k8s.io/utils/ptr
 k8s.io/utils/trace
-# knative.dev/hack v0.0.0-20250902154142-af735b2738d6
+# knative.dev/hack v0.0.0-20251016122918-f2be520302e8
 ## explicit; go 1.21
 knative.dev/hack
-# knative.dev/pkg v0.0.0-20250909011231-077dcf0d00e8
+# knative.dev/pkg v0.0.0-20251022152246-2be9d56c9027
 ## explicit; go 1.24.0
 knative.dev/pkg/apis
 knative.dev/pkg/apis/duck