build(deps): bump github.com/tus/tusd/v2 from 2.8.0 to 2.9.2

Bumps [github.com/tus/tusd/v2](https://github.com/tus/tusd) from 2.8.0 to 2.9.2.
- [Release notes](https://github.com/tus/tusd/releases)
- [Commits](https://github.com/tus/tusd/compare/v2.8.0...v2.9.2)

---
updated-dependencies:
- dependency-name: github.com/tus/tusd/v2
  dependency-version: 2.9.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

vendor/github.com/tus/tusd/v2/pkg/handler/config.go

@@ -33,6 +33,9 @@ type Config struct {
 	// DisableTermination indicates whether the server will refuse termination
 	// requests of the uploaded file, by not mounting the DELETE handler.
 	DisableTermination bool
+	// DisableConcatenation indicates whether the server will refuse POST requests
+	// for creating uploads that use the concatenation extension.
+	DisableConcatenation bool
 	// Cors can be used to customize the handling of Cross-Origin Resource Sharing (CORS).
 	// See the CorsConfig struct for more details.
 	// Defaults to DefaultCorsConfig.

vendor/github.com/tus/tusd/v2/pkg/handler/context.go

@@ -80,18 +80,13 @@ func (h UnroutedHandler) getContext(w http.ResponseWriter, r *http.Request) *htt
 	return c
 }
 
-func (c httpContext) Value(key any) any {
-	// We overwrite the Value function to ensure that the values from the request
-	// context are returned because c.Context does not contain any values.
-	return c.req.Context().Value(key)
-}
-
-// newDelayedContext returns a context that is cancelled with a delay. If the parent context
+// newDelayedContext returns a context with delayed cancellation propagation. If the parent context
 // is done, the new context will also be cancelled but only after waiting the specified delay.
 // Note: The parent context MUST be cancelled or otherwise this will leak resources. In the
 // case of http.Request.Context, the net/http package ensures that the context is always cancelled.
 func newDelayedContext(parent context.Context, delay time.Duration) context.Context {
-	ctx, cancel := context.WithCancel(context.Background())
+	// Use context.WithoutCancel to preserve the values.
+	ctx, cancel := context.WithCancel(context.WithoutCancel(parent))
 	go func() {
 		<-parent.Done()
 		<-time.After(delay)

vendor/github.com/tus/tusd/v2/pkg/handler/hooks.go

@@ -33,7 +33,8 @@ func newHookEvent(c *httpContext, info FileInfo) HookEvent {
 	// > For incoming requests, the Host header is promoted to the
 	// > Request.Host field and removed from the Header map.
 	// That's why we add it back manually.
-	c.req.Header.Set("Host", c.req.Host)
+	copiedHeader := c.req.Header.Clone()
+	copiedHeader.Set("Host", c.req.Host)
 
 	return HookEvent{
 		Context: c,
@@ -42,7 +43,7 @@ func newHookEvent(c *httpContext, info FileInfo) HookEvent {
 			Method:     c.req.Method,
 			URI:        c.req.RequestURI,
 			RemoteAddr: c.req.RemoteAddr,
-			Header:     c.req.Header,
+			Header:     copiedHeader,
 		},
 	}
 }

vendor/github.com/tus/tusd/v2/pkg/handler/http.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"maps"
 	"net/http"
 	"strconv"
 )
@@ -67,13 +68,9 @@ func (resp1 HTTPResponse) MergeWith(resp2 HTTPResponse) HTTPResponse {
 	// into the header map from response 1.
 	newResp.Header = make(HTTPHeader, len(resp1.Header)+len(resp2.Header))
 
-	for key, value := range resp1.Header {
-		newResp.Header[key] = value
-	}
+	maps.Copy(newResp.Header, resp1.Header)
 
-	for key, value := range resp2.Header {
-		newResp.Header[key] = value
-	}
+	maps.Copy(newResp.Header, resp2.Header)
 
 	return newResp
 }

vendor/github.com/tus/tusd/v2/pkg/handler/metrics.go

@@ -1,6 +1,7 @@
 package handler
 
 import (
+	"maps"
 	"sync"
 	"sync/atomic"
 )
@@ -123,9 +124,7 @@ func (e *ErrorsTotalMap) retrievePointerFor(err Error) *uint64 {
 func (e *ErrorsTotalMap) Load() map[ErrorsTotalMapEntry]*uint64 {
 	m := make(map[ErrorsTotalMapEntry]*uint64, len(e.counter))
 	e.lock.RLock()
-	for err, ptr := range e.counter {
-		m[err] = ptr
-	}
+	maps.Copy(m, e.counter)
 	e.lock.RUnlock()
 
 	return m

vendor/github.com/tus/tusd/v2/pkg/handler/unrouted_handler.go

@@ -54,6 +54,7 @@ var (
 	ErrNotImplemented                   = NewError("ERR_NOT_IMPLEMENTED", "feature not implemented", http.StatusNotImplemented)
 	ErrUploadNotFinished                = NewError("ERR_UPLOAD_NOT_FINISHED", "one of the partial uploads is not finished", http.StatusBadRequest)
 	ErrInvalidConcat                    = NewError("ERR_INVALID_CONCAT", "invalid Upload-Concat header", http.StatusBadRequest)
+	ErrConcatenationUnsupported         = NewError("ERR_CONCATENATION_UNSUPPORTED", "Upload-Concat header is not supported by server", http.StatusBadRequest)
 	ErrModifyFinal                      = NewError("ERR_MODIFY_FINAL", "modifying a final upload is not allowed", http.StatusForbidden)
 	ErrUploadLengthAndUploadDeferLength = NewError("ERR_AMBIGUOUS_UPLOAD_LENGTH", "provided both Upload-Length and Upload-Defer-Length", http.StatusBadRequest)
 	ErrInvalidUploadDeferLength         = NewError("ERR_INVALID_UPLOAD_LENGTH_DEFER", "invalid Upload-Defer-Length header", http.StatusBadRequest)
@@ -125,10 +126,10 @@ func NewUnroutedHandler(config Config) (*UnroutedHandler, error) {
 
 	// Only promote extesions using the Tus-Extension header which are implemented
 	extensions := "creation,creation-with-upload"
-	if config.StoreComposer.UsesTerminater {
+	if config.StoreComposer.UsesTerminater && !config.DisableTermination {
 		extensions += ",termination"
 	}
-	if config.StoreComposer.UsesConcater {
+	if config.StoreComposer.UsesConcater && !config.DisableConcatenation {
 		extensions += ",concatenation"
 	}
 	if config.StoreComposer.UsesLengthDeferrer {
@@ -299,6 +300,11 @@ func (handler *UnroutedHandler) PostFile(w http.ResponseWriter, r *http.Request)
 		concatHeader = r.Header.Get("Upload-Concat")
 	}
 
+	if concatHeader != "" && handler.config.DisableConcatenation {
+		handler.sendError(c, ErrConcatenationUnsupported)
+		return
+	}
+
 	// Parse Upload-Concat header
 	isPartial, isFinal, partialUploadIDs, err := parseConcat(concatHeader, handler.basePath)
 	if err != nil {
@@ -1574,7 +1580,7 @@ func getIETFDraftUploadLength(r *http.Request) (length int64, lengthIsDeferred b
 func ParseMetadataHeader(header string) map[string]string {
 	meta := make(map[string]string)
 
-	for _, element := range strings.Split(header, ",") {
+	for element := range strings.SplitSeq(header, ",") {
 		element := strings.TrimSpace(element)
 
 		parts := strings.Split(element, " ")
@@ -1640,8 +1646,8 @@ func parseConcat(header string, basePath string) (isPartial bool, isFinal bool,
 	if strings.HasPrefix(header, "final;") && len(header) > l {
 		isFinal = true
 
-		list := strings.Split(header[l:], " ")
-		for _, value := range list {
+		list := strings.SplitSeq(header[l:], " ")
+		for value := range list {
 			value := strings.TrimSpace(value)
 			if value == "" {
 				continue