if isH2CUpgrade(r.Header) {
			w.WriteHeader(http.StatusMethodNotAllowed)
			_, _ = w.Write([]byte("h2c upgrade not allowed"))
			return
		}
		h.ServeHTTP(w, r)
	})
}

func isH2CUpgrade(h http.Header) bool {
	return httpguts.HeaderValuesContainsToken(h[textproto.CanonicalMIMEHeaderKey("Upgrade")], "h2c") &&
		httpguts.HeaderValuesContainsToken(h[textproto.CanonicalMIMEHeaderKey("Connection")], "HTTP2-Settings")

! go get rsc.io/sampler@v1.0.0 rsc.io/quote@v1.5.2 golang.org/x/text@none
! stderr add|remove|upgrad|downgrad
stderr '^go: rsc.io/quote@v1.5.2 requires rsc.io/sampler@v1.3.0, not rsc.io/sampler@v1.0.0$'

go list -m all
stdout 'rsc.io/quote v1.5.1'
stdout 'rsc.io/sampler v1.3.0'

# go get -u args should limit upgrades
cp go.mod.empty go.mod
go get -u rsc.io/quote@v1.4.0 rsc.io/sampler@v1.0.0
go list -m all

 */
public interface FilterableBytecodeInterceptor {

    BytecodeInterceptorType getType();

    /**
     * A marker interface that indicates that a class is used for bytecode upgrades.
     */
    interface BytecodeUpgradeInterceptor extends FilterableBytecodeInterceptor {
        @Override
        default BytecodeInterceptorType getType() {
            return BytecodeInterceptorType.BYTECODE_UPGRADE;

    },

    // forced upgrade: the following modules will automatically be replaced with the selected module
    // even if there's no conflict, and forces an upgrade to the specified version
    {
        "name": "asm",
        "providedBy": [
            "asm:asm", "asm:asm-all", "asm:asm-debug-all"
        ],
        "selected": "org.ow2.asm:asm",
        "upgrade": "7.1"
    },
    {

# actual flag parsing if we don't switch toolchains. In particular,
# unrecognized flags should still be diagnosed after the module for
# the requested package has been downloaded and checked for toolchain
# upgrades.


! go install -cake=delicious -modcacherw example.com/printversion@v0.1.0
stderr '^flag provided but not defined: -cake$'
	# Because the -modcacherw flag was set, we should be able to modify the contents

-- simplified configuration
-- multiple versions of the ingress can be used, to minimize upgrade risks

- the new chart uses the default namespace service account, and doesn't require
additional RBAC permissions.

- simplified label and chart structure.
- ability to run a pilot dedicated for the gateway, isolated from the main pilot. This is more robust, safer on upgrades
and allows a bit more flexibility.

```yaml
meshConfig:
  accessLogFile: /dev/stdout
```

#### Revisions

Control plane revisions allow deploying multiple versions of the control plane in the same cluster.
This allows safe [canary upgrades](https://istio.io/latest/docs/setup/upgrade/canary/)

```yaml
revision: my-revision-name

	// including in which errors it chooses to report, so sort the candidates
	// into a deterministic-but-arbitrary order.
	sort.Slice(upgrades, func(i, j int) bool {
		return upgrades[i].path < upgrades[j].path
	})
	return upgrades
}

// loadPackages loads the packages matching the given patterns, invoking the
// findPackage function for each package that may require a change to the

go mod tidy
cmp go.mod go.mod.orig
cd ..

go list -m all
stdout '^rsc\.io/quote v1\.5\.1$'
stdout '^rsc\.io/sampler v1\.3\.1$'

# Now remove the module dependencies from the module cache.
# Because one module upgrades a transitive dependency needed by another,
# listing the modules in the workspace should error out.

go clean -modcache
env GOPROXY=off
! go list -m all

 * that it is not "API-frozen."
 *
 * <p>It is generally safe for <i>applications</i> to depend on beta APIs, at the cost of some extra
 * work during upgrades. However it is generally inadvisable for <i>libraries</i> (which get
 * included on users' CLASSPATHs, outside the library developers' control) to do so.
 *
 * @author Kevin Bourrillion
 */
@Retention(RetentionPolicy.CLASS)