diff --git a/common/.commonfiles.sha b/common/.commonfiles.sha
index c2bc015126..feb50f6f99 100644
--- a/common/.commonfiles.sha
+++ b/common/.commonfiles.sha
@@ -1 +1 @@
-81eb95e520db4dc8decb267d574288dae41eed68
+089b253613e7e6728815f0721d306cba50b35261
diff --git a/common/Makefile.common.mk b/common/Makefile.common.mk
index d368c17bea..af86c74fc0 100644
--- a/common/Makefile.common.mk
+++ b/common/Makefile.common.mk
@@ -104,6 +104,7 @@ update-common:
 	fi
 	@cp -a $(TMP)/common-files/files/* $(shell pwd)
 	@rm -fr $(TMP)/common-files
+	@$(or $(COMMONFILES_POSTPROCESS), true)
 
 check-clean-repo:
 	@common/scripts/check_clean_repo.sh
diff --git a/common/config/.golangci.yml b/common/config/.golangci.yml
index c384dd3725..6cf50eb014 100644
--- a/common/config/.golangci.yml
+++ b/common/config/.golangci.yml
@@ -12,8 +12,8 @@ run:
   # timeout for analysis, e.g. 30s, 5m, default is 1m
   deadline: 20m
   build-tags:
-  - integ
-  - integfuzz
+    - integ
+    - integfuzz
   # which dirs to skip: they won't be analyzed;
   # can use regexp here: generated.*, regexp is applied on full path;
   # default value is empty list, but next dirs are always skipped independently
@@ -22,7 +22,6 @@ run:
   skip-dirs:
     - genfiles$
     - vendor$
-
   # which files to skip: they will be analyzed, but issues from them
   # won't be reported. Default value is empty list, but there is
   # no need to include all autogenerated files, we confidently recognize
@@ -30,38 +29,35 @@ run:
   skip-files:
     - ".*\\.pb\\.go"
     - ".*\\.gen\\.go"
-
 linters:
   disable-all: true
   enable:
-  - errcheck
-  - exportloopref
-  - depguard
-  - gocritic
-  - gofumpt
-  - goimports
-  - revive
-  - gosimple
-  - govet
-  - ineffassign
-  - lll
-  - misspell
-  - staticcheck
-  - stylecheck
-  - typecheck
-  - unconvert
-  - unparam
-  - unused
-  - gci
-  - gosec
+    - errcheck
+    - exportloopref
+    - depguard
+    - gocritic
+    - gofumpt
+    - goimports
+    - revive
+    - gosimple
+    - govet
+    - ineffassign
+    - lll
+    - misspell
+    - staticcheck
+    - stylecheck
+    - typecheck
+    - unconvert
+    - unparam
+    - unused
+    - gci
+    - gosec
   fast: false
-
 linters-settings:
   errcheck:
     # report about not checking of errors in type assetions: `a := b.(MyStruct)`;
     # default is false: such cases aren't reported by default.
     check-type-assertions: false
-
     # report about assignment of errors to blank identifier: `num, _ := strconv.Atoi(numStr)`;
     # default is false: such cases aren't reported by default.
     check-blank: false
@@ -81,7 +77,7 @@ linters-settings:
     # Setting locale to US will correct the British spelling of 'colour' to 'color'.
     locale: US
     ignore-words:
-    - cancelled
+      - cancelled
   lll:
     # max line length, lines longer will be reported. Default is 120.
     # '\t' is counted as 1 character by default, and can be changed with the tab-width option
@@ -95,60 +91,61 @@ linters-settings:
     error-code: 2
     warning-code: 1
     rules:
-    - name: blank-imports
-    - name: context-keys-type
-    - name: time-naming
-    - name: var-declaration
-    - name: unexported-return
-    - name: errorf
-    - name: context-as-argument
-    - name: dot-imports
-    - name: error-return
-    - name: error-strings
-    - name: error-naming
-    - name: increment-decrement
-    - name: var-naming
-    - name: package-comments
-    - name: range
-    - name: receiver-naming
-    - name: indent-error-flow
-    - name: superfluous-else
-    - name: modifies-parameter
-    - name: unreachable-code
-    - name: struct-tag
-    - name: constant-logical-expr
-    - name: bool-literal-in-expr
-    - name: redefines-builtin-id
-    - name: imports-blacklist
-    - name: range-val-in-closure
-    - name: range-val-address
-    - name: waitgroup-by-value
-    - name: atomic
-    - name: call-to-gc
-    - name: duplicated-imports
-    - name: string-of-int
-    - name: defer
-      arguments: [["call-chain"]]
-    - name: unconditional-recursion
-    - name: identical-branches
-    # the following rules can be enabled in the future
-    # - name: empty-lines
-    # - name: confusing-results
-    # - name: empty-block
-    # - name: get-return
-    # - name: confusing-naming
-    # - name: unexported-naming
-    # - name: early-return
-    # - name: unused-parameter
-    # - name: unnecessary-stmt
-    # - name: deep-exit
-    # - name: import-shadowing
-    # - name: modifies-value-receiver
-    # - name: unused-receiver
-    # - name: bare-return
-    # - name: flag-parameter
-    # - name: unhandled-error
-    # - name: if-return
+      - name: blank-imports
+      - name: context-keys-type
+      - name: time-naming
+      - name: var-declaration
+      - name: unexported-return
+      - name: errorf
+      - name: context-as-argument
+      - name: dot-imports
+      - name: error-return
+      - name: error-strings
+      - name: error-naming
+      - name: increment-decrement
+      - name: var-naming
+      - name: package-comments
+      - name: range
+      - name: receiver-naming
+      - name: indent-error-flow
+      - name: superfluous-else
+      - name: modifies-parameter
+      - name: unreachable-code
+      - name: struct-tag
+      - name: constant-logical-expr
+      - name: bool-literal-in-expr
+      - name: redefines-builtin-id
+      - name: imports-blacklist
+      - name: range-val-in-closure
+      - name: range-val-address
+      - name: waitgroup-by-value
+      - name: atomic
+      - name: call-to-gc
+      - name: duplicated-imports
+      - name: string-of-int
+      - name: defer
+        arguments:
+          - - "call-chain"
+      - name: unconditional-recursion
+      - name: identical-branches
+        # the following rules can be enabled in the future
+        # - name: empty-lines
+        # - name: confusing-results
+        # - name: empty-block
+        # - name: get-return
+        # - name: confusing-naming
+        # - name: unexported-naming
+        # - name: early-return
+        # - name: unused-parameter
+        # - name: unnecessary-stmt
+        # - name: deep-exit
+        # - name: import-shadowing
+        # - name: modifies-value-receiver
+        # - name: unused-receiver
+        # - name: bare-return
+        # - name: flag-parameter
+        # - name: unhandled-error
+        # - name: if-return
   unused:
     # treat code as a program (not a library) and report unused exported identifiers; default is false.
     # XXX: if you enable this setting, unused will report a lot of false-positives in text editors:
@@ -159,7 +156,6 @@ linters-settings:
     # call graph construction algorithm (cha, rta). In general, use cha for libraries,
     # and rta for programs with main packages. Default is cha.
     algo: cha
-
     # Inspect exported functions, default is false. Set to true if no external program/library imports your code.
     # XXX: if you enable this setting, unparam will report a lot of false-positives in text editors:
     # if it's called for subdir of a project it can't find external interfaces. All text editor integrations
@@ -216,7 +212,6 @@ linters-settings:
       - unslice
       - valSwap
       - weakCond
-
       # Unused
       # - yodaStyleExpr
       # - appendAssign
@@ -237,15 +232,12 @@ linters-settings:
       # - wrapperFunc
   depguard:
     packages-with-error-message:
-    - github.com/gogo/protobuf: "gogo/protobuf is deprecated, use golang/protobuf"
-    - golang.org/x/net/http2/h2c: "h2c.NewHandler is unsafe; use wrapper istio.io/istio/pkg/h2c"
-    - github.com/golang/protobuf/jsonpb: "don't use the jsonpb package directly; use util/protomarshal instead"
-    - google.golang.org/protobuf/encoding/protojson: "don't use the protojson package directly; use util/protomarshal instead"
+      - github.com/gogo/protobuf: "gogo/protobuf is deprecated, use golang/protobuf"
   gosec:
     includes:
-    - G401
-    - G402
-    - G404
+      - G401
+      - G402
+      - G404
 issues:
   # List of regexps of issue texts to exclude, empty list by default.
   # But independently from this option we use default exclude patterns,
@@ -253,14 +245,12 @@ issues:
   # excluded by default patterns execute `golangci-lint run --help`
   exclude:
     - composite literal uses unkeyed fields
-
   exclude-rules:
     # Exclude some linters from running on test files.
     - path: _test\.go$|^tests/|^samples/
       linters:
         - errcheck
         - maligned
-
     # We need to use the deprecated module since the jsonpb replacement is not backwards compatible.
     - linters:
         - staticcheck
@@ -268,15 +258,12 @@ issues:
     - linters:
         - staticcheck
       text: 'SA1019: "github.com/golang/protobuf/jsonpb"'
-
   # Independently from option `exclude` we use default exclude patterns,
   # it can be disabled by this option. To list all
   # excluded by default patterns execute `golangci-lint run --help`.
   # Default value for this option is true.
   exclude-use-default: true
-
   # Maximum issues count per one linter. Set to 0 to disable. Default is 50.
   max-per-linter: 0
-
   # Maximum count of issues with the same text. Set to 0 to disable. Default is 3.
   max-same-issues: 0