diff --git a/go.mod b/go.mod
index bdaed3c1..97fafe27 100644
--- a/go.mod
+++ b/go.mod
@@ -3,13 +3,13 @@ module github.com/Azure/aztfmigrate
 go 1.25.10
 
 require (
-	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
+	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.0
 	github.com/gertd/go-pluralize v0.2.1
 	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/hashicorp/go-version v1.9.0
 	github.com/hashicorp/hc-install v0.9.5
 	github.com/hashicorp/hcl/v2 v2.24.0
-	github.com/hashicorp/terraform-exec v0.25.2
+	github.com/hashicorp/terraform-exec v0.25.3
 	github.com/hashicorp/terraform-json v0.28.0
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.40.1
 	github.com/magodo/aztft v0.3.1-0.20260715003534-2c6101a24b3e
@@ -78,7 +78,6 @@ require (
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/bgentry/speakeasy v0.2.0 // indirect
 	github.com/fatih/color v1.17.0 // indirect
-	github.com/go-git/go-git/v5 v5.19.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/go-cmp v0.7.0 // indirect
 	github.com/google/uuid v1.6.0 // indirect
@@ -109,7 +108,7 @@ require (
 	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
 	golang.org/x/crypto v0.54.0 // indirect
 	golang.org/x/mod v0.37.0 // indirect
-	golang.org/x/net v0.56.0 // indirect
+	golang.org/x/net v0.57.0 // indirect
 	golang.org/x/sync v0.22.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/text v0.40.0 // indirect
diff --git a/go.sum b/go.sum
index e1745cf4..02dd4dcd 100644
--- a/go.sum
+++ b/go.sum
@@ -1,7 +1,7 @@
 dario.cat/mergo v1.0.1 h1:Ra4+bf83h2ztPIQYNP99R6m+Y7KfnARDfID+a+vLl4s=
 dario.cat/mergo v1.0.1/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0 h1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE=
-github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0/go.mod h1:/WYEx9pcM9Y+Dd/APJaNlSvVSvzl54rrMdZT5+Oi2LM=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.0 h1:4gRPBpN1f6xt88yi4WR26m7XaD9OlWtVT6bWPdGUIok=
+github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.0/go.mod h1:G7QVLxw1j1JVyrO1MA95S8m8HStaaleDZYTcfGgjB2o=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 h1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=
 github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1/go.mod h1:IYus9qsFobWIc2YVwe/WPjcnyCkPKtnHAqUYeebc8z0=
 github.com/Azure/azure-sdk-for-go/sdk/internal v1.12.0 h1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4=
@@ -216,8 +216,8 @@ github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQx
 github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/terraform-exec v0.25.2 h1:fFLAVEtAjKdGfawGUXDnKooCnqJi+TuohT3W99AGbhk=
-github.com/hashicorp/terraform-exec v0.25.2/go.mod h1:uaQV2oqVLqM4cixJryk6qIWS1qji3GtuwPG5pjGXYfc=
+github.com/hashicorp/terraform-exec v0.25.3 h1:Xr9DBt2LX4deJnahlbhw7N25MFPDMxzj/VzE7cdFBoc=
+github.com/hashicorp/terraform-exec v0.25.3/go.mod h1:NeE9+ss4hLaLuVlOIr+M6FK7Bqyy+JLZUHo5kQph+ME=
 github.com/hashicorp/terraform-json v0.28.0 h1:dOkJT55rWfU6T1/VklHde51ym4LfNP+9xYR3ZizAJe4=
 github.com/hashicorp/terraform-json v0.28.0/go.mod h1:PJIRf+Yzu5iLb52c/xYp1tUOL4jzMzfIAB5gvWWKIWE=
 github.com/hashicorp/terraform-plugin-go v0.31.0 h1:0Fz2r9DQ+kNNl6bx8HRxFd1TfMKUvnrOtvJPmp3Z0q8=
@@ -338,8 +338,8 @@ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
+golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md
index ed56ac24..bb215ff1 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/CHANGELOG.md
@@ -1,5 +1,15 @@
 # Release History
 
+## 1.23.0 (2026-08-11)
+
+### Features Added
+
+* Helper method `runtime.NewRequestForNextLink` for creating requests for pageable operations that uses a next link.  It handles absolute and relative next links.
+
+### Bugs Fixed
+
+* Fixed an issue where `runtime.Pager[T].More` could return `true` indefinitely after `NextPage` failed to retrieve the first page, causing `for pager.More()` loops to spin. After a page fetch returns an error the `Pager` now enters a terminal state: `More` returns `false` and subsequent `NextPage` calls return the same error without invoking the fetcher again.
+
 ## 1.22.0 (2026-06-04)
 
 ### Features Added
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/doc.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/doc.go
index 4862a9f6..299ed5e3 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/doc.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/doc.go
@@ -190,7 +190,10 @@ and determining if there are more pages to fetch.  No IO calls are made until th
 	pager := widgetClient.NewListWidgetsPager(nil)
 	for pager.More() {
 		page, err := pager.NextPage(context.TODO())
-		// handle err
+		if err != nil {
+			// process error
+			break
+		}
 		for _, widget := range page.Values {
 			// process widget
 		}
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/request.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/request.go
index 4bf72263..2df0c7a9 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/request.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported/request.go
@@ -11,8 +11,11 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	"net/url"
+	"path"
 	"reflect"
 	"strconv"
+	"strings"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared"
 )
@@ -119,6 +122,26 @@ func NewRequest(ctx context.Context, httpMethod string, endpoint string) (*Reque
 	return &Request{req: req, values: opValues{}}, nil
 }
 
+// NewRequestForNextLink creates a new policy.Request with the specified input.
+// This helper is for use in paged operations that use the "next link" pattern.
+//   - endpoint is the service endpoint (e.g. https://contoso.com)
+//   - nextLink the absolute or relative URL to the next page of items
+//
+// When nextLink is an absolute URL, its value is used to create the request to the next page.
+// If nextLink is a relative URL, it will be joined with the specified endpoint.
+//
+// Exported as runtime.NewRequestForNextLink().
+func NewRequestForNextLink(ctx context.Context, httpMethod, endpoint, nextLink string) (*Request, error) {
+	nextLink, err := EncodeQueryParams(nextLink, true)
+	if err != nil {
+		return nil, err
+	}
+	if !hasScheme(nextLink) {
+		nextLink = JoinPaths(endpoint, nextLink)
+	}
+	return NewRequest(ctx, httpMethod, nextLink)
+}
+
 // Body returns the original body specified when the Request was created.
 func (req *Request) Body() io.ReadSeekCloser {
 	return req.body
@@ -257,3 +280,89 @@ func SetBody(req *Request, body io.ReadSeekCloser, contentType string, clobberCo
 	}
 	return nil
 }
+
+// JoinPaths concatenates multiple URL path segments into one path,
+// inserting path separation characters as required. JoinPaths will preserve
+// query parameters in the root path.
+// Exported as runtime.JoinPaths
+func JoinPaths(root string, paths ...string) string {
+	if len(paths) == 0 {
+		return root
+	}
+
+	qps := ""
+	if strings.Contains(root, "?") {
+		splitPath := strings.Split(root, "?")
+		root, qps = splitPath[0], splitPath[1]
+	}
+
+	p := path.Join(paths...)
+	// path.Join will remove any trailing slashes.
+	// if one was provided, preserve it.
+	if strings.HasSuffix(paths[len(paths)-1], "/") && !strings.HasSuffix(p, "/") {
+		p += "/"
+	}
+
+	if qps != "" {
+		if strings.Contains(p, "?") {
+			p = p + "&" + qps
+		} else {
+			p = p + "?" + qps
+		}
+	}
+
+	if strings.HasSuffix(root, "/") && strings.HasPrefix(p, "/") {
+		root = root[:len(root)-1]
+	} else if !strings.HasSuffix(root, "/") && !strings.HasPrefix(p, "/") && !strings.HasPrefix(p, "?") {
+		p = "/" + p
+	}
+	return root + p
+}
+
+// EncodeQueryParams will parse and encode any query parameters in the specified URL.
+// Any semicolons will automatically be escaped.
+// When encodeSpaces is true all spaces that were form-encoded to + are replaced with %20.
+// Exported as runtime.EncodeQueryParams
+func EncodeQueryParams(u string, encodeSpaces bool) (string, error) {
+	before, after, found := strings.Cut(u, "?")
+	if !found {
+		return u, nil
+	}
+	// starting in Go 1.17, url.ParseQuery will reject semicolons in query params.
+	// so, we must escape them first. note that this assumes that semicolons aren't
+	// being used as query param separators which is per the current RFC.
+	// for more info:
+	// https://github.com/golang/go/issues/25192
+	// https://github.com/golang/go/issues/50034
+	qp, err := url.ParseQuery(strings.ReplaceAll(after, ";", "%3B"))
+	if err != nil {
+		return "", err
+	}
+	encoded := qp.Encode()
+	if encodeSpaces {
+		encoded = strings.ReplaceAll(encoded, "+", "%20")
+	}
+	return before + "?" + encoded, nil
+}
+
+// hasScheme reports whether s begins with a URI scheme, i.e. is an absolute URI.
+// Per RFC 3986: scheme = ALPHA *( ALPHA / DIGIT / "+" / "-" / "." ) ":".
+// This avoids the allocations of url.Parse when we only need to know if the URI is absolute.
+func hasScheme(s string) bool {
+	for i := 0; i < len(s); i++ {
+		c := s[i]
+		switch {
+		case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z':
+			// always valid
+		case c == ':':
+			return i > 0
+		case i == 0:
+			return false
+		case c >= '0' && c <= '9', c == '+', c == '-', c == '.':
+			// valid after the first character
+		default:
+			return false
+		}
+	}
+	return false
+}
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go
index 4f7aa643..4387f71c 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/shared/constants.go
@@ -37,5 +37,5 @@ const (
 	Module = "azcore"
 
 	// Version is the semantic version (see http://semver.org) of this module.
-	Version = "v1.22.0"
+	Version = "v1.23.0"
 )
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pager.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pager.go
index 743513be..a05b0c34 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pager.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/pager.go
@@ -35,6 +35,9 @@ type Pager[T any] struct {
 	handler   PagingHandler[T]
 	tracer    tracing.Tracer
 	firstPage bool
+	// fetchErr is set when Fetcher returns an error, placing the Pager in a
+	// terminal state so that More returns false.
+	fetchErr error
 }
 
 // NewPager creates an instance of Pager using the specified PagingHandler.
@@ -48,7 +51,16 @@ func NewPager[T any](handler PagingHandler[T]) *Pager[T] {
 }
 
 // More returns true if there are more pages to retrieve.
+//
+// If a prior call to [Pager.NextPage] returned an error while fetching a page,
+// the Pager enters a terminal state and More returns false so that a for loop
+// over the pager terminates instead of retrying indefinitely.
 func (p *Pager[T]) More() bool {
+	// a failed fetch puts the Pager in a terminal state; there are no more pages
+	// to retrieve regardless of whether it was the first or a subsequent page.
+	if p.fetchErr != nil {
+		return false
+	}
 	if p.current != nil {
 		return p.handler.More(*p.current)
 	}
@@ -56,7 +68,17 @@ func (p *Pager[T]) More() bool {
 }
 
 // NextPage advances the pager to the next page.
+//
+// If fetching the page returns an error, the Pager enters a terminal state:
+// [Pager.More] returns false and every subsequent call to NextPage returns the
+// same error without invoking the fetcher again.
 func (p *Pager[T]) NextPage(ctx context.Context) (T, error) {
+	if p.fetchErr != nil {
+		// a prior fetch failed; the Pager is in a terminal state. return the
+		// stored error rather than re-invoking the fetcher, which may not be
+		// safe to retry (e.g. stateful handlers that latch into a done state).
+		return *new(T), p.fetchErr
+	}
 	if p.current != nil {
 		if p.firstPage {
 			// we get here if it's an LRO-pager, we already have the first page
@@ -76,6 +98,7 @@ func (p *Pager[T]) NextPage(ctx context.Context) (T, error) {
 
 	resp, err := p.handler.Fetcher(ctx, p.current)
 	if err != nil {
+		p.fetchErr = err
 		return *new(T), err
 	}
 	p.current = &resp
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_retry.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_retry.go
index 696e1d9f..50c86791 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_retry.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/policy_retry.go
@@ -115,7 +115,8 @@ func (p *retryPolicy) Do(req *policy.Request) (resp *http.Response, err error) {
 		// do this outside the for loop so defers don't accumulate.
 		rwbody = &retryableRequestBody{body: req.Body()}
 		defer func() {
-			// TODO: https://github.com/Azure/azure-sdk-for-go/issues/25649
+			// Match net/http behavior: after a request has produced either a response
+			// or a transport error, request body close errors are not surfaced to callers.
 			_ = rwbody.realClose()
 		}()
 	}
diff --git a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go
index 20d86496..20ec6511 100644
--- a/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go
+++ b/vendor/github.com/Azure/azure-sdk-for-go/sdk/azcore/runtime/request.go
@@ -14,8 +14,6 @@ import (
 	"mime/multipart"
 	"net/http"
 	"net/textproto"
-	"net/url"
-	"path"
 	"strings"
 
 	"github.com/Azure/azure-sdk-for-go/sdk/azcore/internal/exported"
@@ -43,6 +41,17 @@ func NewRequest(ctx context.Context, httpMethod string, endpoint string) (*polic
 	return exported.NewRequest(ctx, httpMethod, endpoint)
 }
 
+// NewRequestForNextLink creates a new policy.Request with the specified input.
+// This helper is for use in paged operations that use the "next link" pattern.
+//   - endpoint is the service endpoint (e.g. https://contoso.com)
+//   - nextLink the absolute or relative URL to the next page of items
+//
+// When nextLink is an absolute URL, its value is used to create the request to the next page.
+// If nextLink is a relative URL, it will be joined with the specified endpoint.
+func NewRequestForNextLink(ctx context.Context, httpMethod, endpoint, nextLink string) (*policy.Request, error) {
+	return exported.NewRequestForNextLink(ctx, httpMethod, endpoint, nextLink)
+}
+
 // NewRequestFromRequest creates a new policy.Request with an existing *http.Request
 func NewRequestFromRequest(req *http.Request) (*policy.Request, error) {
 	return exported.NewRequestFromRequest(req)
@@ -51,58 +60,14 @@ func NewRequestFromRequest(req *http.Request) (*policy.Request, error) {
 // EncodeQueryParams will parse and encode any query parameters in the specified URL.
 // Any semicolons will automatically be escaped.
 func EncodeQueryParams(u string) (string, error) {
-	before, after, found := strings.Cut(u, "?")
-	if !found {
-		return u, nil
-	}
-	// starting in Go 1.17, url.ParseQuery will reject semicolons in query params.
-	// so, we must escape them first. note that this assumes that semicolons aren't
-	// being used as query param separators which is per the current RFC.
-	// for more info:
-	// https://github.com/golang/go/issues/25192
-	// https://github.com/golang/go/issues/50034
-	qp, err := url.ParseQuery(strings.ReplaceAll(after, ";", "%3B"))
-	if err != nil {
-		return "", err
-	}
-	return before + "?" + qp.Encode(), nil
+	return exported.EncodeQueryParams(u, false)
 }
 
 // JoinPaths concatenates multiple URL path segments into one path,
 // inserting path separation characters as required. JoinPaths will preserve
 // query parameters in the root path
 func JoinPaths(root string, paths ...string) string {
-	if len(paths) == 0 {
-		return root
-	}
-
-	qps := ""
-	if strings.Contains(root, "?") {
-		splitPath := strings.Split(root, "?")
-		root, qps = splitPath[0], splitPath[1]
-	}
-
-	p := path.Join(paths...)
-	// path.Join will remove any trailing slashes.
-	// if one was provided, preserve it.
-	if strings.HasSuffix(paths[len(paths)-1], "/") && !strings.HasSuffix(p, "/") {
-		p += "/"
-	}
-
-	if qps != "" {
-		if strings.Contains(p, "?") {
-			p = p + "&" + qps
-		} else {
-			p = p + "?" + qps
-		}
-	}
-
-	if strings.HasSuffix(root, "/") && strings.HasPrefix(p, "/") {
-		root = root[:len(root)-1]
-	} else if !strings.HasSuffix(root, "/") && !strings.HasPrefix(p, "/") && !strings.HasPrefix(p, "?") {
-		p = "/" + p
-	}
-	return root + p
+	return exported.JoinPaths(root, paths...)
 }
 
 // EncodeByteArray will base-64 encode the byte slice v.
diff --git a/vendor/github.com/hashicorp/terraform-exec/internal/version/version.go b/vendor/github.com/hashicorp/terraform-exec/internal/version/version.go
index 8742a150..dbc297e1 100644
--- a/vendor/github.com/hashicorp/terraform-exec/internal/version/version.go
+++ b/vendor/github.com/hashicorp/terraform-exec/internal/version/version.go
@@ -3,7 +3,7 @@
 
 package version
 
-const version = "0.25.2"
+const version = "0.25.3"
 
 // ModuleVersion returns the current version of the github.com/hashicorp/terraform-exec Go module.
 // This is a function to allow for future possible enhancement using debug.BuildInfo.
diff --git a/vendor/golang.org/x/net/http2/transport_wrap.go b/vendor/golang.org/x/net/http2/transport_wrap.go
index eab2e6b0..534e77ab 100644
--- a/vendor/golang.org/x/net/http2/transport_wrap.go
+++ b/vendor/golang.org/x/net/http2/transport_wrap.go
@@ -55,7 +55,7 @@ type transportConfig struct {
 // Registered is called by net/http.Transport.RegisterProtocol,
 // to let us know that it understands the registration mechanism we're using.
 func (t transportConfig) Registered(t1 *http.Transport) {
-	t.t.t1 = t1
+	t.t.lazyt1 = t1
 }
 
 func (t transportConfig) DisableCompression() bool {
@@ -145,29 +145,30 @@ func (t transportConfig) DialFromContext(ctx context.Context, network, address s
 
 type transportInternal struct {
 	initOnce sync.Once
-	t1       *http.Transport
+	lazyt1   *http.Transport
 }
 
-func (t *Transport) init() {
+func (t *Transport) init() *http.Transport {
 	t.initOnce.Do(func() {
-		if t.t1 != nil {
+		if t.lazyt1 != nil {
 			return
 		}
 		t1 := &http.Transport{}
 		t.configure(t1)
 	})
+	return t.lazyt1
 }
 
 func (t *Transport) configure(t1 *http.Transport) {
 	t1.RegisterProtocol("http/2", transportConfig{t})
-	// tr2.t1 is set by transportConfig.Registered.
-	if t.t1 != t1 {
+	// tr2.lazyt1 is set by transportConfig.Registered.
+	if t.lazyt1 != t1 {
 		panic("http2: net/http does not support this version of x/net/http2")
 	}
 }
 
 func (t *Transport) roundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Response, error) {
-	t.init()
+	t1 := t.init()
 
 	if req.URL.Scheme == "http" && !t.AllowHTTP {
 		return nil, errors.New("http2: unencrypted HTTP/2 not enabled")
@@ -188,22 +189,23 @@ func (t *Transport) roundTripOpt(req *http.Request, opt RoundTripOpt) (*http.Res
 	ctx := context.WithValue(req.Context(), http2TransportContextKey{}, t)
 	req = req.WithContext(ctx)
 
-	return t.t1.RoundTrip(req)
+	return t1.RoundTrip(req)
 }
 
 func (t *Transport) closeIdleConnections() {
-	t.init()
-	t.t1.CloseIdleConnections()
+	t1 := t.init()
+	t1.CloseIdleConnections()
 }
 
 func (t *Transport) newUserClientConn(c net.Conn) (*ClientConn, error) {
+	t1 := t.init()
 	// http.Transport's NewClientConn doesn't provide a supported way to create
 	// a connection from a net.Conn. (This might be useful to add in the future?)
 	// We're going to craftily sneak one in via the context key, with the
 	// scheme of "http/2" telling NewClientConn to look for it.
 	ctx := context.WithValue(context.Background(), netConnContextKey{}, c)
 
-	nhcc, err := t.t1.NewClientConn(ctx, "http/2", "")
+	nhcc, err := t1.NewClientConn(ctx, "http/2", "")
 	if err != nil {
 		return nil, err
 	}
diff --git a/vendor/golang.org/x/net/idna/idna.go b/vendor/golang.org/x/net/idna/idna.go
index 22767125..e2f28fed 100644
--- a/vendor/golang.org/x/net/idna/idna.go
+++ b/vendor/golang.org/x/net/idna/idna.go
@@ -400,7 +400,11 @@ func (p *Profile) process(s string, toASCII bool) (string, error) {
 				// Spec says keep the old label.
 				continue
 			}
-			if unicode16 && err == nil && len(u) > 0 && isASCII(u) {
+			if err == nil && len(u) > 0 && isASCII(u) {
+				// UTS 43 pre-revision 33 doesn't classify a xn-- label
+				// which contains only ASCII characters as an error,
+				// but that's a specification bug and a security issue.
+				// Always return an error in this case.
 				err = punyError(enc)
 			}
 			isBidi = isBidi || bidirule.DirectionString(u) != bidi.LeftToRight
diff --git a/vendor/modules.txt b/vendor/modules.txt
index b0614bfa..0c885382 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -1,7 +1,7 @@
 # dario.cat/mergo v1.0.1
 ## explicit; go 1.13
 dario.cat/mergo
-# github.com/Azure/azure-sdk-for-go/sdk/azcore v1.22.0
+# github.com/Azure/azure-sdk-for-go/sdk/azcore v1.23.0
 ## explicit; go 1.25.0
 github.com/Azure/azure-sdk-for-go/sdk/azcore
 github.com/Azure/azure-sdk-for-go/sdk/azcore/arm
@@ -210,8 +210,6 @@ github.com/fatih/color
 # github.com/gertd/go-pluralize v0.2.1
 ## explicit; go 1.17
 github.com/gertd/go-pluralize
-# github.com/go-git/go-git/v5 v5.19.2
-## explicit; go 1.25.0
 # github.com/golang-jwt/jwt/v4 v4.5.2
 ## explicit; go 1.16
 github.com/golang-jwt/jwt/v4
@@ -271,7 +269,7 @@ github.com/hashicorp/hcl/v2/hclwrite
 # github.com/hashicorp/logutils v1.0.0
 ## explicit
 github.com/hashicorp/logutils
-# github.com/hashicorp/terraform-exec v0.25.2
+# github.com/hashicorp/terraform-exec v0.25.3
 ## explicit; go 1.25.0
 github.com/hashicorp/terraform-exec/internal/version
 github.com/hashicorp/terraform-exec/tfexec
@@ -407,7 +405,7 @@ golang.org/x/mod/internal/lazyregexp
 golang.org/x/mod/modfile
 golang.org/x/mod/module
 golang.org/x/mod/semver
-# golang.org/x/net v0.56.0
+# golang.org/x/net v0.57.0
 ## explicit; go 1.25.0
 golang.org/x/net/http/httpguts
 golang.org/x/net/http2