diff --git a/dockercompose/auth.go b/dockercompose/auth.go
index 323e8a859..16d3a998a 100644
--- a/dockercompose/auth.go
+++ b/dockercompose/auth.go
@@ -32,8 +32,12 @@ func auth( //nolint:funlen
 	httpPort uint,
 	useTLS bool,
 	nhostFolder string,
-	port uint,
+	exposePort uint,
 ) (*Service, error) {
+	if exposePort != 0 {
+		httpPort = exposePort
+	}
+
 	envars, err := appconfig.HasuraAuthEnv(
 		cfg,
 		"http://graphql:8080/v1/graphql",
@@ -94,7 +98,7 @@ func auth( //nolint:funlen
 				},
 			},
 		}.Labels(),
-		Ports:   ports(port, authPort),
+		Ports:   ports(exposePort, authPort),
 		Restart: "always",
 		Volumes: []Volume{
 			{
diff --git a/dockercompose/auth_test.go b/dockercompose/auth_test.go
index 3c12815cc..3c5dd6145 100644
--- a/dockercompose/auth_test.go
+++ b/dockercompose/auth_test.go
@@ -207,16 +207,18 @@ func TestAuth(t *testing.T) {
 	t.Parallel()
 
 	cases := []struct {
-		name     string
-		cfg      func() *model.ConfigConfig
-		useTlS   bool
-		expected func() *Service
+		name       string
+		cfg        func() *model.ConfigConfig
+		useTlS     bool
+		exposePort uint
+		expected   func() *Service
 	}{
 		{
-			name:     "default",
-			cfg:      getConfig,
-			useTlS:   false,
-			expected: expectedAuth,
+			name:       "default",
+			cfg:        getConfig,
+			useTlS:     false,
+			exposePort: 0,
+			expected:   expectedAuth,
 		},
 		{
 			name: "pre-0.22.0",
@@ -225,7 +227,8 @@ func TestAuth(t *testing.T) {
 				cfg.Auth.Version = ptr("0.21.3")
 				return cfg
 			},
-			useTlS: false,
+			useTlS:     false,
+			exposePort: 0,
 			expected: func() *Service {
 				svc := expectedAuth()
 				svc.Image = "nhost/hasura-auth:0.21.3"
@@ -237,13 +240,34 @@ func TestAuth(t *testing.T) {
 				return svc
 			},
 		},
+		{
+			name:       "custom port",
+			cfg:        getConfig,
+			useTlS:     false,
+			exposePort: 8080,
+			expected: func() *Service {
+				svc := expectedAuth()
+
+				svc.Environment["AUTH_SERVER_URL"] = "http://dev.auth.local.nhost.run:8080/v1"
+				svc.Ports = []Port{
+					{
+						Mode:      "ingress",
+						Target:    4000,
+						Published: "8080",
+						Protocol:  "tcp",
+					},
+				}
+
+				return svc
+			},
+		},
 	}
 
 	for _, tc := range cases {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			got, err := auth(tc.cfg(), "dev", 1336, tc.useTlS, "/tmp/nhost", 0)
+			got, err := auth(tc.cfg(), "dev", 1336, tc.useTlS, "/tmp/nhost", tc.exposePort)
 			if err != nil {
 				t.Errorf("got error: %v", err)
 			}
diff --git a/dockercompose/storage.go b/dockercompose/storage.go
index 460f4f447..13d7ddc4e 100644
--- a/dockercompose/storage.go
+++ b/dockercompose/storage.go
@@ -22,6 +22,10 @@ func storage( //nolint:funlen
 	httpPort uint,
 	exposePort uint,
 ) (*Service, error) {
+	if exposePort != 0 {
+		httpPort = exposePort
+	}
+
 	envars, err := appconfig.HasuraStorageEnv(
 		cfg,
 		"http://graphql:8080/v1",
diff --git a/dockercompose/storage_test.go b/dockercompose/storage_test.go
index 911720dfe..423aa364a 100644
--- a/dockercompose/storage_test.go
+++ b/dockercompose/storage_test.go
@@ -68,16 +68,39 @@ func TestStorage(t *testing.T) {
 	t.Parallel()
 
 	cases := []struct {
-		name     string
-		cfg      func() *model.ConfigConfig
-		useTlS   bool
-		expected func() *Service
+		name       string
+		cfg        func() *model.ConfigConfig
+		useTlS     bool
+		exposePort uint
+		expected   func() *Service
 	}{
 		{
-			name:     "success",
-			cfg:      getConfig,
-			useTlS:   false,
-			expected: expectedStorage,
+			name:       "success",
+			cfg:        getConfig,
+			useTlS:     false,
+			exposePort: 0,
+			expected:   expectedStorage,
+		},
+		{
+			name:       "custom port",
+			cfg:        getConfig,
+			useTlS:     false,
+			exposePort: 8080,
+			expected: func() *Service {
+				svc := expectedStorage()
+				svc.Environment["PUBLIC_URL"] = "http://dev.storage.local.nhost.run:8080"
+
+				svc.Ports = []Port{
+					{
+						Mode:      "ingress",
+						Target:    5000,
+						Published: "8080",
+						Protocol:  "tcp",
+					},
+				}
+
+				return svc
+			},
 		},
 	}
 
@@ -85,7 +108,7 @@ func TestStorage(t *testing.T) {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
 
-			got, err := storage(tc.cfg(), "dev", tc.useTlS, 444, 0)
+			got, err := storage(tc.cfg(), "dev", tc.useTlS, 444, tc.exposePort)
 			if err != nil {
 				t.Errorf("got error: %v", err)
 			}
diff --git a/go.mod b/go.mod
index 890634707..fb4ed221e 100644
--- a/go.mod
+++ b/go.mod
@@ -13,7 +13,7 @@ require (
 	github.com/go-git/go-git/v5 v5.16.2
 	github.com/google/go-cmp v0.7.0
 	github.com/google/uuid v1.6.0
-	github.com/hashicorp/go-getter v1.7.8
+	github.com/hashicorp/go-getter v1.7.9
 	github.com/nhost/be v0.0.0-20250826100053-51f349e46355
 	github.com/pelletier/go-toml/v2 v2.2.4
 	github.com/rs/cors/wrapper/gin v0.0.0-20240830163046-1084d89a1692
@@ -100,7 +100,6 @@ require (
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
-	github.com/mitchellh/go-testing-interface v1.14.1 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
 	github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de // indirect
diff --git a/go.sum b/go.sum
index 52e89af02..4d346e867 100644
--- a/go.sum
+++ b/go.sum
@@ -180,7 +180,6 @@ cloud.google.com/go/compute v1.15.1/go.mod h1:bjjoF/NtFUrkD/urWfdHaKuOPDR5nWIs63
 cloud.google.com/go/compute v1.18.0/go.mod h1:1X7yHxec2Ga+Ss6jPyjxRxpu2uu7PLgsOVXvgU0yacs=
 cloud.google.com/go/compute v1.19.0/go.mod h1:rikpw2y+UMidAe9tISo04EHNOIf42RLYF/q8Bs93scU=
 cloud.google.com/go/compute v1.19.1/go.mod h1:6ylj3a05WF8leseCdIf77NK0g1ey+nj5IKd5/kvShxE=
-cloud.google.com/go/compute v1.41.0 h1:S+HvMIzBUAFK/73wxkrA4/GwvM7R9d+egGZvih4kp+M=
 cloud.google.com/go/compute/metadata v0.1.0/go.mod h1:Z1VN+bulIf6bt4P/C37K4DyZYZEXYonfTBHHFPO/4UU=
 cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 cloud.google.com/go/compute/metadata v0.2.1/go.mod h1:jgHgmJd2RKBGzXqF5LR2EZMGxBkeanZ9wwa75XHJgOM=
@@ -685,7 +684,6 @@ github.com/bytedance/sonic/loader v0.3.0/go.mod h1:N8A3vUdtUebEY2/VQC0MyhYeKUFos
 github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
 github.com/census-instrumentation/opencensus-proto v0.4.1/go.mod h1:4T9NM4+4Vw91VeyqjLS6ao50K5bOcLKN6Q42XnYaRYw=
-github.com/cespare/xxhash v1.1.0 h1:a6HrQnmkObjyL+Gs60czilIUGqrzKutQD6XZog3p+ko=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
 github.com/cespare/xxhash/v2 v2.2.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
@@ -726,7 +724,6 @@ github.com/cncf/xds/go v0.0.0-20230105202645-06c439db220b/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20230607035331-e9ce68804cb4/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv1aFbZMiM9vblcSArJRf2Irls=
 github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
-github.com/cockroachdb/apd v1.1.0 h1:3LFP3629v+1aKXU5Q37mxmRxX/pIu1nijXydLShEq5I=
 github.com/cockroachdb/apd/v2 v2.0.2 h1:weh8u7Cneje73dDh+2tEVLUvyBc89iwepWCD8b8034E=
 github.com/cockroachdb/apd/v2 v2.0.2/go.mod h1:DDxRlzC2lo3/vSlmSoS7JkqbbrARPuFOGr0B9pvN3Gw=
 github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
@@ -951,8 +948,8 @@ github.com/grpc-ecosystem/grpc-gateway/v2 v2.7.0/go.mod h1:hgWBS7lorOAVIJEQMi4Zs
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.11.3/go.mod h1:o//XUCC/F+yRGJoPO/VU0GSB0f8Nhgmxx0VIRUvaC0w=
 github.com/hashicorp/go-cleanhttp v0.5.2 h1:035FKYIWjmULyFRBKPs8TBQoi0x6d9G4xc9neXJWAZQ=
 github.com/hashicorp/go-cleanhttp v0.5.2/go.mod h1:kO/YDlP8L1346E6Sodw+PrpBSV4/SoxCXGY6BqNFT48=
-github.com/hashicorp/go-getter v1.7.8 h1:mshVHx1Fto0/MydBekWan5zUipGq7jO0novchgMmSiY=
-github.com/hashicorp/go-getter v1.7.8/go.mod h1:2c6CboOEb9jG6YvmC9xdD+tyAFsrUaJPedwXDGr0TM4=
+github.com/hashicorp/go-getter v1.7.9 h1:G9gcjrDixz7glqJ+ll5IWvggSBR+R0B54DSRt4qfdC4=
+github.com/hashicorp/go-getter v1.7.9/go.mod h1:dyFCmT1AQkDfOIt9NH8pw9XBDqNrIKJT5ylbpi7zPNE=
 github.com/hashicorp/go-safetemp v1.0.0 h1:2HR189eFNrjHQyENnQMMpCiBAsRxzbTMIgBhEyExpmo=
 github.com/hashicorp/go-safetemp v1.0.0/go.mod h1:oaerMy3BhqiTbVye6QuFhFtIceqFoDHxNAB65b+Rj1I=
 github.com/hashicorp/go-version v1.6.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
@@ -1032,8 +1029,6 @@ github.com/minio/asm2plan9s v0.0.0-20200509001527-cdd76441f9d8/go.mod h1:mC1jAcs
 github.com/minio/c2goasm v0.0.0-20190812172519-36a3d3bbc4f3/go.mod h1:RagcQ7I8IeTMnF8JTXieKnO4Z6JCsikNEzj0DwauVzE=
 github.com/mitchellh/go-homedir v1.1.0 h1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
-github.com/mitchellh/go-testing-interface v1.14.1 h1:jrgshOhYAUVNMAJiKbEu7EqAwgJJ2JqpQmpLJOu07cU=
-github.com/mitchellh/go-testing-interface v1.14.1/go.mod h1:gfgS7OtZj6MA4U1UrDRp04twqAjfvlZyCfX3sDjEym8=
 github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
 github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
 github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
@@ -1047,8 +1042,6 @@ github.com/muesli/termenv v0.16.0 h1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc
 github.com/muesli/termenv v0.16.0/go.mod h1:ZRfOIKPFDYQoDFF4Olj7/QJbW60Ol/kL1pU3VfY/Cnk=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
 github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/nhost/be v0.0.0-20250730065440-072ba750534a h1:PBNFdtz2XdGUbFVDTJNBdKwtWLab3jgEl0fpb5rn3j0=
-github.com/nhost/be v0.0.0-20250730065440-072ba750534a/go.mod h1:Btk2JXy1ih/+VTlNItNNFfhOTZlKlrodBqXaJ+2K7Pg=
 github.com/nhost/be v0.0.0-20250826100053-51f349e46355 h1:K0orUm3ex3GBuZ8InnmSjAVbYqcO4LfK1ftcsPDS6k0=
 github.com/nhost/be v0.0.0-20250826100053-51f349e46355/go.mod h1:iRPhO+qcQzTtNQ7PaQMJAcEw0tgWzgjzcGWgJ4ifrUo=
 github.com/onsi/gomega v1.34.1 h1:EUMJIKUjM8sKjYbtxQI9A4z2o+rruxnzNvpknOXie6k=
diff --git a/vendor/github.com/hashicorp/go-getter/.goreleaser.yml b/vendor/github.com/hashicorp/go-getter/.goreleaser.yml
index 6351efb77..a94fc6932 100644
--- a/vendor/github.com/hashicorp/go-getter/.goreleaser.yml
+++ b/vendor/github.com/hashicorp/go-getter/.goreleaser.yml
@@ -7,21 +7,16 @@ env:
   - GOPRIVATE=github.com/hashicorp
 
 builds:
-  - id: signable
-    mod_timestamp: '{{ .CommitTimestamp }}'
-    targets:
-      - darwin_amd64
-      - windows_386
-      - windows_amd64
-    dir: ./cmd/go-getter/
-    flags:
-      - -trimpath
-    ldflags:
-      - -X main.GitCommit={{ .Commit }}
   - mod_timestamp: '{{ .CommitTimestamp }}'
     targets:
+      - darwin_amd64
+      - darwin_arm64
       - linux_386
       - linux_amd64
+      - linux_arm64
+      - windows_386
+      - windows_arm64
+      - windows_amd64
     dir: ./cmd/go-getter/
     flags:
       - -trimpath
@@ -51,4 +46,4 @@ signs:
     artifacts: checksum
 
 changelog:
-  disable: true
\ No newline at end of file
+  disable: true
diff --git a/vendor/github.com/hashicorp/go-getter/CHANGELOG.md b/vendor/github.com/hashicorp/go-getter/CHANGELOG.md
new file mode 100644
index 000000000..a0b285324
--- /dev/null
+++ b/vendor/github.com/hashicorp/go-getter/CHANGELOG.md
@@ -0,0 +1,9 @@
+## Unreleased
+
+### Improvements
+
+### Changes
+
+### Fixed
+
+### Security
diff --git a/vendor/github.com/hashicorp/go-getter/checksum.go b/vendor/github.com/hashicorp/go-getter/checksum.go
index f5116f16d..e28ee5109 100644
--- a/vendor/github.com/hashicorp/go-getter/checksum.go
+++ b/vendor/github.com/hashicorp/go-getter/checksum.go
@@ -56,13 +56,13 @@ func (cerr *ChecksumError) Error() string {
 func (c *FileChecksum) checksum(source string) error {
 	f, err := os.Open(source)
 	if err != nil {
-		return fmt.Errorf("Failed to open file for checksum: %s", err)
+		return fmt.Errorf("failed to open file for checksum: %s", err)
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	c.Hash.Reset()
 	if _, err := io.Copy(c.Hash, f); err != nil {
-		return fmt.Errorf("Failed to hash: %s", err)
+		return fmt.Errorf("failed to hash: %s", err)
 	}
 
 	if actual := c.Hash.Sum(nil); !bytes.Equal(actual, c.Value) {
@@ -80,20 +80,24 @@ func (c *FileChecksum) checksum(source string) error {
 // extractChecksum will return a FileChecksum based on the 'checksum'
 // parameter of u.
 // ex:
-//  http://hashicorp.com/terraform?checksum=<checksumValue>
-//  http://hashicorp.com/terraform?checksum=<checksumType>:<checksumValue>
-//  http://hashicorp.com/terraform?checksum=file:<checksum_url>
+//
+//	http://hashicorp.com/terraform?checksum=<checksumValue>
+//	http://hashicorp.com/terraform?checksum=<checksumType>:<checksumValue>
+//	http://hashicorp.com/terraform?checksum=file:<checksum_url>
+//
 // when checksumming from a file, extractChecksum will go get checksum_url
 // in a temporary directory, parse the content of the file then delete it.
 // Content of files are expected to be BSD style or GNU style.
 //
 // BSD-style checksum:
-//  MD5 (file1) = <checksum>
-//  MD5 (file2) = <checksum>
+//
+//	MD5 (file1) = <checksum>
+//	MD5 (file2) = <checksum>
 //
 // GNU-style:
-//  <checksum>  file1
-//  <checksum> *file2
+//
+//	<checksum>  file1
+//	<checksum> *file2
 //
 // see parseChecksumLine for more detail on checksum file parsing
 func (c *Client) extractChecksum(u *url.URL) (*FileChecksum, error) {
@@ -180,7 +184,7 @@ func newChecksumFromValue(checksumValue, filename string) (*FileChecksum, error)
 		c.Hash = sha512.New()
 		c.Type = "sha512"
 	default:
-		return nil, fmt.Errorf("Unknown type for checksum %s", checksumValue)
+		return nil, fmt.Errorf("unknown type for checksum %s", checksumValue)
 	}
 
 	return c, nil
@@ -203,7 +207,7 @@ func (c *Client) ChecksumFromFile(checksumFile string, src *url.URL) (*FileCheck
 	if err != nil {
 		return nil, err
 	}
-	defer os.Remove(tempfile)
+	defer func() { _ = os.Remove(tempfile) }()
 
 	c2 := &Client{
 		Ctx:              c.Ctx,
@@ -253,7 +257,7 @@ func (c *Client) ChecksumFromFile(checksumFile string, src *url.URL) (*FileCheck
 		return nil, fmt.Errorf(
 			"Error opening downloaded file: %s", err)
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 	rd := bufio.NewReader(f)
 	for {
 		line, err := rd.ReadString('\n')
@@ -303,7 +307,7 @@ func parseChecksumLine(line string) (*FileChecksum, error) {
 		if len(parts[1]) <= 2 ||
 			parts[1][0] != '(' || parts[1][len(parts[1])-1] != ')' {
 			return nil, fmt.Errorf(
-				"Unexpected BSD-style-checksum filename format: %s", line)
+				"unexpected BSD-style-checksum filename format: %s", line)
 		}
 		filename := parts[1][1 : len(parts[1])-1]
 		return newChecksumFromType(parts[0], parts[3], filename)
diff --git a/vendor/github.com/hashicorp/go-getter/client.go b/vendor/github.com/hashicorp/go-getter/client.go
index bf55b8886..77cb496a3 100644
--- a/vendor/github.com/hashicorp/go-getter/client.go
+++ b/vendor/github.com/hashicorp/go-getter/client.go
@@ -135,7 +135,7 @@ func (c *Client) Get() error {
 	if subDir != "" {
 		// Check if the subdirectory is attempting to traverse updwards, outside of
 		// the cloned repository path.
-		subDir := filepath.Clean(subDir)
+		subDir = filepath.Clean(subDir)
 		if containsDotDot(subDir) {
 			return fmt.Errorf("subdirectory component contain path traversal out of the repository")
 		}
@@ -148,7 +148,7 @@ func (c *Client) Get() error {
 		if err != nil {
 			return err
 		}
-		defer tdcloser.Close()
+		defer func() { _ = tdcloser.Close() }()
 
 		realDst = dst
 		dst = td
@@ -210,7 +210,7 @@ func (c *Client) Get() error {
 			return fmt.Errorf(
 				"Error creating temporary directory for archive: %s", err)
 		}
-		defer os.RemoveAll(td)
+		defer func() { _ = os.RemoveAll(td) }()
 
 		// Swap the download directory to be our temporary path and
 		// store the old values.
diff --git a/vendor/github.com/hashicorp/go-getter/common.go b/vendor/github.com/hashicorp/go-getter/common.go
index 2a8ee5ce9..0cc5a7bf9 100644
--- a/vendor/github.com/hashicorp/go-getter/common.go
+++ b/vendor/github.com/hashicorp/go-getter/common.go
@@ -12,6 +12,6 @@ func tmpFile(dir, pattern string) (string, error) {
 	if err != nil {
 		return "", err
 	}
-	f.Close()
+	_ = f.Close()
 	return f.Name(), nil
 }
diff --git a/vendor/github.com/hashicorp/go-getter/copy_dir.go b/vendor/github.com/hashicorp/go-getter/copy_dir.go
index 321887327..035591bf2 100644
--- a/vendor/github.com/hashicorp/go-getter/copy_dir.go
+++ b/vendor/github.com/hashicorp/go-getter/copy_dir.go
@@ -24,11 +24,19 @@ func copyDir(ctx context.Context, dst string, src string, ignoreDot bool, disabl
 	// We can safely evaluate the symlinks here, even if disabled, because they
 	// will be checked before actual use in walkFn and copyFile
 	var err error
-	src, err = filepath.EvalSymlinks(src)
+	resolved, err := filepath.EvalSymlinks(src)
 	if err != nil {
 		return err
 	}
 
+	// Check if the resolved path tries to escape upward from the original
+	if disableSymlinks {
+		rel, err := filepath.Rel(filepath.Dir(src), resolved)
+		if err != nil || filepath.IsAbs(rel) || containsDotDot(rel) {
+			return ErrSymlinkCopy
+		}
+	}
+
 	walkFn := func(path string, info os.FileInfo, err error) error {
 		if err != nil {
 			return err
@@ -42,12 +50,9 @@ func copyDir(ctx context.Context, dst string, src string, ignoreDot bool, disabl
 			if fileInfo.Mode()&os.ModeSymlink == os.ModeSymlink {
 				return ErrSymlinkCopy
 			}
-			// if info.Mode()&os.ModeSymlink == os.ModeSymlink {
-			// 	return ErrSymlinkCopy
-			// }
 		}
 
-		if path == src {
+		if path == resolved {
 			return nil
 		}
 
@@ -62,16 +67,15 @@ func copyDir(ctx context.Context, dst string, src string, ignoreDot bool, disabl
 
 		// The "path" has the src prefixed to it. We need to join our
 		// destination with the path without the src on it.
-		dstPath := filepath.Join(dst, path[len(src):])
+		dstPath := filepath.Join(dst, path[len(resolved):])
 
 		// If we have a directory, make that subdirectory, then continue
 		// the walk.
 		if info.IsDir() {
-			if path == filepath.Join(src, dst) {
+			if path == filepath.Join(resolved, dst) {
 				// dst is in src; don't walk it.
 				return nil
 			}
-
 			if err := os.MkdirAll(dstPath, mode(0755, umask)); err != nil {
 				return err
 			}
@@ -84,5 +88,5 @@ func copyDir(ctx context.Context, dst string, src string, ignoreDot bool, disabl
 		return err
 	}
 
-	return filepath.Walk(src, walkFn)
+	return filepath.Walk(resolved, walkFn)
 }
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_bzip2.go b/vendor/github.com/hashicorp/go-getter/decompress_bzip2.go
index b63f89954..e6de6e0f2 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_bzip2.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_bzip2.go
@@ -35,7 +35,7 @@ func (d *Bzip2Decompressor) Decompress(dst, src string, dir bool, umask os.FileM
 	if err != nil {
 		return err
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	// Bzip2 compression is second
 	bzipR := bzip2.NewReader(f)
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_gzip.go b/vendor/github.com/hashicorp/go-getter/decompress_gzip.go
index 5b9e07831..8c8be55a1 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_gzip.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_gzip.go
@@ -35,14 +35,14 @@ func (d *GzipDecompressor) Decompress(dst, src string, dir bool, umask os.FileMo
 	if err != nil {
 		return err
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	// gzip compression is second
 	gzipR, err := gzip.NewReader(f)
 	if err != nil {
 		return err
 	}
-	defer gzipR.Close()
+	defer func() { _ = gzipR.Close() }()
 
 	// Copy it out
 	return copyReader(dst, gzipR, 0622, umask, d.FileSizeLimit)
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_tar.go b/vendor/github.com/hashicorp/go-getter/decompress_tar.go
index b37b6fcc3..4532923bb 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_tar.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_tar.go
@@ -180,7 +180,7 @@ func (d *TarDecompressor) Decompress(dst, src string, dir bool, umask os.FileMod
 	if err != nil {
 		return err
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	return untar(f, dst, src, dir, umask, d.FileSizeLimit, d.FilesLimit)
 }
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_tbz2.go b/vendor/github.com/hashicorp/go-getter/decompress_tbz2.go
index 82677a3ff..a8429ee98 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_tbz2.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_tbz2.go
@@ -40,7 +40,7 @@ func (d *TarBzip2Decompressor) Decompress(dst, src string, dir bool, umask os.Fi
 	if err != nil {
 		return err
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	// Bzip2 compression is second
 	bzipR := bzip2.NewReader(f)
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_testing.go b/vendor/github.com/hashicorp/go-getter/decompress_testing.go
index bb5270b83..c53d4239a 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_testing.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_testing.go
@@ -14,9 +14,8 @@ import (
 	"runtime"
 	"sort"
 	"strings"
+	"testing"
 	"time"
-
-	"github.com/mitchellh/go-testing-interface"
 )
 
 // TestDecompressCase is a single test case for testing decompressors
@@ -30,7 +29,7 @@ type TestDecompressCase struct {
 }
 
 // TestDecompressor is a helper function for testing generic decompressors.
-func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
+func TestDecompressor(t testing.TB, d Decompressor, cases []TestDecompressCase) {
 	t.Helper()
 
 	for _, tc := range cases {
@@ -47,7 +46,7 @@ func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
 
 		// We use a function so defers work
 		func() {
-			defer os.RemoveAll(td)
+			defer func() { _ = os.RemoveAll(td) }()
 
 			// Decompress
 			err := d.Decompress(dst, tc.Input, tc.Dir, 0022)
@@ -83,7 +82,7 @@ func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
 							t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), dst, actual.String())
 						}
 					} else if actual.Unix() <= 0 {
-						t.Fatalf("err %s: expected mtime to be > 0, got '%s'", actual.String())
+						t.Fatalf("err %s: expected mtime to be > 0, got '%s'", tc.Input, actual.String())
 					}
 				}
 
@@ -94,7 +93,7 @@ func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
 			expected := tc.DirList
 			if runtime.GOOS == "windows" {
 				for i, v := range expected {
-					expected[i] = strings.Replace(v, "/", "\\", -1)
+					expected[i] = strings.ReplaceAll(v, "/", "\\")
 				}
 			}
 
@@ -118,7 +117,7 @@ func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
 							t.Fatalf("err %s: expected mtime '%s' for %s, got '%s'", tc.Input, expected.String(), path, actual.String())
 						}
 					} else if actual.Unix() < 0 {
-						t.Fatalf("err %s: expected mtime to be > 0, got '%s'", actual.String())
+						t.Fatalf("err %s: expected mtime to be > 0, got '%s'", tc.Input, actual.String())
 					}
 
 				}
@@ -127,7 +126,7 @@ func TestDecompressor(t testing.T, d Decompressor, cases []TestDecompressCase) {
 	}
 }
 
-func testListDir(t testing.T, path string) []string {
+func testListDir(t testing.TB, path string) []string {
 	var result []string
 	err := filepath.Walk(path, func(sub string, info os.FileInfo, err error) error {
 		if err != nil {
@@ -156,12 +155,12 @@ func testListDir(t testing.T, path string) []string {
 	return result
 }
 
-func testMD5(t testing.T, path string) string {
+func testMD5(t testing.TB, path string) string {
 	f, err := os.Open(path)
 	if err != nil {
 		t.Fatalf("err: %s", err)
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	h := md5.New()
 	_, err = io.Copy(h, f)
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_tgz.go b/vendor/github.com/hashicorp/go-getter/decompress_tgz.go
index 8915f7b20..6ace64e14 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_tgz.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_tgz.go
@@ -41,14 +41,14 @@ func (d *TarGzipDecompressor) Decompress(dst, src string, dir bool, umask os.Fil
 	if err != nil {
 		return err
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	// Gzip compression is second
 	gzipR, err := gzip.NewReader(f)
 	if err != nil {
 		return fmt.Errorf("Error opening a gzip reader for %s: %s", src, err)
 	}
-	defer gzipR.Close()
+	defer func() { _ = gzipR.Close() }()
 
 	return untar(gzipR, dst, src, dir, umask, d.FileSizeLimit, d.FilesLimit)
 }
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_txz.go b/vendor/github.com/hashicorp/go-getter/decompress_txz.go
index 9b8e80537..e902665a6 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_txz.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_txz.go
@@ -4,6 +4,7 @@
 package getter
 
 import (
+	"bufio"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -42,10 +43,10 @@ func (d *TarXzDecompressor) Decompress(dst, src string, dir bool, umask os.FileM
 	if err != nil {
 		return err
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	// xz compression is second
-	txzR, err := xz.NewReader(f)
+	txzR, err := xz.NewReader(bufio.NewReader(f))
 	if err != nil {
 		return fmt.Errorf("Error opening an xz reader for %s: %s", src, err)
 	}
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_tzst.go b/vendor/github.com/hashicorp/go-getter/decompress_tzst.go
index 15780767d..d42d12bf0 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_tzst.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_tzst.go
@@ -42,7 +42,7 @@ func (d *TarZstdDecompressor) Decompress(dst, src string, dir bool, umask os.Fil
 	if err != nil {
 		return err
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	// Zstd compression is second
 	zstdR, err := zstd.NewReader(f)
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_xz.go b/vendor/github.com/hashicorp/go-getter/decompress_xz.go
index 8f55fb2aa..0cb0f8102 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_xz.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_xz.go
@@ -4,6 +4,7 @@
 package getter
 
 import (
+	"bufio"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -36,10 +37,10 @@ func (d *XzDecompressor) Decompress(dst, src string, dir bool, umask os.FileMode
 	if err != nil {
 		return err
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	// xz compression is second
-	xzR, err := xz.NewReader(f)
+	xzR, err := xz.NewReader(bufio.NewReader(f))
 	if err != nil {
 		return err
 	}
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_zip.go b/vendor/github.com/hashicorp/go-getter/decompress_zip.go
index 77b7d0b73..3b7933845 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_zip.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_zip.go
@@ -41,7 +41,7 @@ func (d *ZipDecompressor) Decompress(dst, src string, dir bool, umask os.FileMod
 	if err != nil {
 		return err
 	}
-	defer zipR.Close()
+	defer func() { _ = zipR.Close() }()
 
 	// Check the zip integrity
 	if len(zipR.File) == 0 {
@@ -104,14 +104,14 @@ func (d *ZipDecompressor) Decompress(dst, src string, dir bool, umask os.FileMod
 		srcF, err := f.Open()
 		if err != nil {
 			if srcF != nil {
-				srcF.Close()
+				_ = srcF.Close()
 			}
 			return err
 		}
 
 		// Size limit is tracked using the returned file info.
 		err = copyReader(path, srcF, f.Mode(), umask, 0)
-		srcF.Close()
+		_ = srcF.Close()
 		if err != nil {
 			return err
 		}
diff --git a/vendor/github.com/hashicorp/go-getter/decompress_zstd.go b/vendor/github.com/hashicorp/go-getter/decompress_zstd.go
index 89d08cd74..de043265f 100644
--- a/vendor/github.com/hashicorp/go-getter/decompress_zstd.go
+++ b/vendor/github.com/hashicorp/go-getter/decompress_zstd.go
@@ -35,7 +35,7 @@ func (d *ZstdDecompressor) Decompress(dst, src string, dir bool, umask os.FileMo
 	if err != nil {
 		return err
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	// zstd compression is second
 	zstdR, err := zstd.NewReader(f)
diff --git a/vendor/github.com/hashicorp/go-getter/get_file_copy.go b/vendor/github.com/hashicorp/go-getter/get_file_copy.go
index b123af642..b64ae2ddf 100644
--- a/vendor/github.com/hashicorp/go-getter/get_file_copy.go
+++ b/vendor/github.com/hashicorp/go-getter/get_file_copy.go
@@ -39,7 +39,7 @@ func copyReader(dst string, src io.Reader, fmode, umask os.FileMode, fileSizeLim
 	if err != nil {
 		return err
 	}
-	defer dstF.Close()
+	defer func() { _ = dstF.Close() }()
 
 	if fileSizeLimit > 0 {
 		src = io.LimitReader(src, fileSizeLimit)
@@ -72,13 +72,13 @@ func copyFile(ctx context.Context, dst, src string, disableSymlinks bool, fmode,
 	if err != nil {
 		return 0, err
 	}
-	defer srcF.Close()
+	defer func() { _ = srcF.Close() }()
 
 	dstF, err := os.OpenFile(dst, os.O_RDWR|os.O_CREATE|os.O_TRUNC, fmode)
 	if err != nil {
 		return 0, err
 	}
-	defer dstF.Close()
+	defer func() { _ = dstF.Close() }()
 
 	count, err := Copy(ctx, dstF, srcF)
 	if err != nil {
diff --git a/vendor/github.com/hashicorp/go-getter/get_gcs.go b/vendor/github.com/hashicorp/go-getter/get_gcs.go
index fa1ffc25e..4de4b2eb6 100644
--- a/vendor/github.com/hashicorp/go-getter/get_gcs.go
+++ b/vendor/github.com/hashicorp/go-getter/get_gcs.go
@@ -170,7 +170,8 @@ func (g *GCSGetter) getObject(ctx context.Context, client *storage.Client, dst,
 	var rc *storage.Reader
 	var err error
 	if fragment != "" {
-		generation, err := strconv.ParseInt(fragment, 10, 64)
+		var generation int64
+		generation, err = strconv.ParseInt(fragment, 10, 64)
 		if err != nil {
 			return err
 		}
@@ -181,7 +182,7 @@ func (g *GCSGetter) getObject(ctx context.Context, client *storage.Client, dst,
 	if err != nil {
 		return err
 	}
-	defer rc.Close()
+	defer func() { _ = rc.Close() }()
 
 	// Create all the parent directories
 	if err := os.MkdirAll(filepath.Dir(dst), g.client.mode(0755)); err != nil {
diff --git a/vendor/github.com/hashicorp/go-getter/get_git.go b/vendor/github.com/hashicorp/go-getter/get_git.go
index 636d5c737..71d48aa59 100644
--- a/vendor/github.com/hashicorp/go-getter/get_git.go
+++ b/vendor/github.com/hashicorp/go-getter/get_git.go
@@ -34,7 +34,6 @@ type GitGetter struct {
 	Timeout time.Duration
 }
 
-var defaultBranchRegexp = regexp.MustCompile(`\s->\sorigin/(.*)`)
 var lsRemoteSymRefRegexp = regexp.MustCompile(`ref: refs/heads/([^\s]+).*`)
 
 func (g *GitGetter) ClientMode(_ *url.URL) (ClientMode, error) {
@@ -83,7 +82,7 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
 		q.Del("depth")
 
 		// Copy the URL
-		var newU url.URL = *u
+		newU := *u
 		u = &newU
 		u.RawQuery = q.Encode()
 	}
@@ -107,7 +106,7 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
 			return err
 		}
 		sshKeyFile = fh.Name()
-		defer os.Remove(sshKeyFile)
+		defer func() { _ = os.Remove(sshKeyFile) }()
 
 		// Set the permissions prior to writing the key material.
 		if err := os.Chmod(sshKeyFile, 0600); err != nil {
@@ -116,7 +115,7 @@ func (g *GitGetter) Get(dst string, u *url.URL) error {
 
 		// Write the raw key into the temp file.
 		_, err = fh.Write(raw)
-		fh.Close()
+		_ = fh.Close()
 		if err != nil {
 			return err
 		}
@@ -154,7 +153,7 @@ func (g *GitGetter) GetFile(dst string, u *url.URL) error {
 	if err != nil {
 		return err
 	}
-	defer tdcloser.Close()
+	defer func() { _ = tdcloser.Close() }()
 
 	// Get the filename, and strip the filename from the URL so we can
 	// just get the repository directly.
@@ -303,6 +302,9 @@ func (g *GitGetter) update(ctx context.Context, dst, sshKeyFile string, u *url.U
 
 // fetchSubmodules downloads any configured submodules recursively.
 func (g *GitGetter) fetchSubmodules(ctx context.Context, dst, sshKeyFile string, depth int) error {
+	if g.client != nil {
+		g.client.DisableSymlinks = true
+	}
 	args := []string{"submodule", "update", "--init", "--recursive"}
 	if depth > 0 {
 		args = append(args, "--depth", strconv.Itoa(depth))
@@ -313,22 +315,6 @@ func (g *GitGetter) fetchSubmodules(ctx context.Context, dst, sshKeyFile string,
 	return getRunCommand(cmd)
 }
 
-// findDefaultBranch checks the repo's origin remote for its default branch
-// (generally "master"). "master" is returned if an origin default branch
-// can't be determined.
-func findDefaultBranch(ctx context.Context, dst string) string {
-	var stdoutbuf bytes.Buffer
-	cmd := exec.CommandContext(ctx, "git", "branch", "-r", "--points-at", "refs/remotes/origin/HEAD")
-	cmd.Dir = dst
-	cmd.Stdout = &stdoutbuf
-	err := cmd.Run()
-	matches := defaultBranchRegexp.FindStringSubmatch(stdoutbuf.String())
-	if err != nil || matches == nil {
-		return "master"
-	}
-	return matches[len(matches)-1]
-}
-
 // findRemoteDefaultBranch checks the remote repo's HEAD symref to return the remote repo's
 // default branch. "master" is returned if no HEAD symref exists.
 func findRemoteDefaultBranch(ctx context.Context, u *url.URL) string {
@@ -374,7 +360,7 @@ func setupGitEnv(cmd *exec.Cmd, sshKeyFile string) {
 
 	// We have an SSH key temp file configured, tell ssh about this.
 	if runtime.GOOS == "windows" {
-		sshKeyFile = strings.Replace(sshKeyFile, `\`, `/`, -1)
+		sshKeyFile = strings.ReplaceAll(sshKeyFile, `\`, `/`)
 	}
 	sshCmd = append(sshCmd, "-i", sshKeyFile)
 	env = append(env, strings.Join(sshCmd, " "))
@@ -398,7 +384,7 @@ func checkGitVersion(ctx context.Context, min string) error {
 
 	fields := strings.Fields(string(out))
 	if len(fields) < 3 {
-		return fmt.Errorf("Unexpected 'git version' output: %q", string(out))
+		return fmt.Errorf("unexpected 'git version' output: %q", string(out))
 	}
 	v := fields[2]
 	if runtime.GOOS == "windows" && strings.Contains(v, ".windows.") {
@@ -416,7 +402,7 @@ func checkGitVersion(ctx context.Context, min string) error {
 	}
 
 	if have.LessThan(want) {
-		return fmt.Errorf("Required git version = %s, have %s", want, have)
+		return fmt.Errorf("required git version = %s, have %s", want, have)
 	}
 
 	return nil
@@ -426,13 +412,13 @@ func checkGitVersion(ctx context.Context, min string) error {
 func removeCaseInsensitiveGitDirectory(dst string) error {
 	files, err := os.ReadDir(dst)
 	if err != nil {
-		return fmt.Errorf("Failed to read the destination directory %s during git update", dst)
+		return fmt.Errorf("failed to read the destination directory %s during git update", dst)
 	}
 	for _, f := range files {
 		if strings.EqualFold(f.Name(), ".git") && f.IsDir() {
 			err := os.RemoveAll(filepath.Join(dst, f.Name()))
 			if err != nil {
-				return fmt.Errorf("Failed to remove the .git directory in the destination directory %s during git update", dst)
+				return fmt.Errorf("failed to remove the .git directory in the destination directory %s during git update", dst)
 			}
 		}
 	}
diff --git a/vendor/github.com/hashicorp/go-getter/get_hg.go b/vendor/github.com/hashicorp/go-getter/get_hg.go
index c7361260c..4f1922b94 100644
--- a/vendor/github.com/hashicorp/go-getter/get_hg.go
+++ b/vendor/github.com/hashicorp/go-getter/get_hg.go
@@ -89,7 +89,7 @@ func (g *HgGetter) GetFile(dst string, u *url.URL) error {
 	if err != nil {
 		return err
 	}
-	defer tdcloser.Close()
+	defer func() { _ = tdcloser.Close() }()
 
 	// Get the filename, and strip the filename from the URL so we can
 	// just get the repository directly.
diff --git a/vendor/github.com/hashicorp/go-getter/get_http.go b/vendor/github.com/hashicorp/go-getter/get_http.go
index 9bd49f6a1..809369951 100644
--- a/vendor/github.com/hashicorp/go-getter/get_http.go
+++ b/vendor/github.com/hashicorp/go-getter/get_http.go
@@ -208,7 +208,7 @@ func (g *HttpGetter) Get(dst string, u *url.URL) error {
 	}
 
 	// Copy the URL so we can modify it
-	var newU url.URL = *u
+	newU := *u
 	u = &newU
 
 	if g.Netrc {
@@ -264,7 +264,7 @@ func (g *HttpGetter) Get(dst string, u *url.URL) error {
 	if err != nil {
 		return err
 	}
-	defer resp.Body.Close()
+	defer func() { _ = resp.Body.Close() }()
 
 	body := resp.Body
 
@@ -401,7 +401,7 @@ func (g *HttpGetter) GetFile(dst string, src *url.URL) error {
 	if err != nil {
 		return err
 	}
-	defer f.Close()
+	defer func() { _ = f.Close() }()
 
 	if g.Client == nil {
 		g.Client = httpClient
@@ -439,7 +439,7 @@ func (g *HttpGetter) GetFile(dst string, src *url.URL) error {
 		}
 		headResp, err := g.Client.Do(req)
 		if err == nil {
-			headResp.Body.Close()
+			_ = headResp.Body.Close()
 			if headResp.StatusCode == 200 {
 				// If the HEAD request succeeded, then attempt to set the range
 				// query if we can.
@@ -485,7 +485,7 @@ func (g *HttpGetter) GetFile(dst string, src *url.URL) error {
 	case http.StatusOK, http.StatusPartialContent:
 		// all good
 	default:
-		resp.Body.Close()
+		_ = resp.Body.Close()
 		return fmt.Errorf("bad response code: %d", resp.StatusCode)
 	}
 
@@ -500,7 +500,7 @@ func (g *HttpGetter) GetFile(dst string, src *url.URL) error {
 		fn := filepath.Base(src.EscapedPath())
 		body = g.client.ProgressListener.TrackProgress(fn, currentFileSize, currentFileSize+resp.ContentLength, resp.Body)
 	}
-	defer body.Close()
+	defer func() { _ = body.Close() }()
 
 	n, err := Copy(readCtx, f, body)
 	if err == nil && n < resp.ContentLength {
@@ -518,7 +518,7 @@ func (g *HttpGetter) getSubdir(ctx context.Context, dst, source, subDir string,
 	if err != nil {
 		return err
 	}
-	defer tdcloser.Close()
+	defer func() { _ = tdcloser.Close() }()
 
 	// Download that into the given directory
 	if err := Get(td, source, opts...); err != nil {
diff --git a/vendor/github.com/hashicorp/go-getter/get_s3.go b/vendor/github.com/hashicorp/go-getter/get_s3.go
index a4148af08..fd0b7a7a6 100644
--- a/vendor/github.com/hashicorp/go-getter/get_s3.go
+++ b/vendor/github.com/hashicorp/go-getter/get_s3.go
@@ -210,24 +210,29 @@ func (g *S3Getter) getObject(ctx context.Context, client *s3.S3, dst, bucket, ke
 		fn := filepath.Base(key)
 		body = g.client.ProgressListener.TrackProgress(fn, 0, *resp.ContentLength, resp.Body)
 	}
-	defer body.Close()
+	defer func() { _ = body.Close() }()
 
 	// There is no limit set for the size of an object from S3
 	return copyReader(dst, body, 0666, g.client.umask(), 0)
 }
 
-func (g *S3Getter) getAWSConfig(region string, url *url.URL, creds *credentials.Credentials) *aws.Config {
+func (g *S3Getter) getAWSConfig(region string, url *url.URL, creds *credentials.Credentials) (*aws.Config, error) {
 	conf := &aws.Config{}
 	metadataURLOverride := os.Getenv("AWS_METADATA_URL")
 	if creds == nil && metadataURLOverride != "" {
+		s, err := session.NewSession(&aws.Config{
+			Endpoint: aws.String(metadataURLOverride),
+		})
+		if err != nil {
+			return nil, err
+		}
+
 		creds = credentials.NewChainCredentials(
 			[]credentials.Provider{
 				&credentials.EnvProvider{},
 				&credentials.SharedCredentialsProvider{Filename: "", Profile: ""},
 				&ec2rolecreds.EC2RoleProvider{
-					Client: ec2metadata.New(session.New(&aws.Config{
-						Endpoint: aws.String(metadataURLOverride),
-					})),
+					Client: ec2metadata.New(s),
 				},
 			})
 	}
@@ -245,7 +250,8 @@ func (g *S3Getter) getAWSConfig(region string, url *url.URL, creds *credentials.
 		conf.Region = aws.String(region)
 	}
 
-	return conf.WithCredentialsChainVerboseErrors(true)
+	conf = conf.WithCredentialsChainVerboseErrors(true)
+	return conf, nil
 }
 
 func (g *S3Getter) parseUrl(u *url.URL) (region, bucket, path, version string, creds *credentials.Credentials, err error) {
@@ -354,8 +360,14 @@ func (g *S3Getter) newS3Client(
 			return nil, err
 		}
 	} else {
-		config := g.getAWSConfig(region, url, creds)
-		sess = session.New(config)
+		config, err := g.getAWSConfig(region, url, creds)
+		if err != nil {
+			return nil, err
+		}
+		sess, err = session.NewSession(config)
+		if err != nil {
+			return nil, err
+		}
 	}
 
 	return s3.New(sess), nil
diff --git a/vendor/github.com/hashicorp/go-getter/url.go b/vendor/github.com/hashicorp/go-getter/url.go
index 0c5f5f9c3..60885af2c 100644
--- a/vendor/github.com/hashicorp/go-getter/url.go
+++ b/vendor/github.com/hashicorp/go-getter/url.go
@@ -9,7 +9,8 @@ import "net/url"
 // which is like url.String but replaces any password with "redacted".
 // Only the password in u.URL is redacted. This allows the library
 // to maintain compatibility with go1.14.
-// This port was also extended to redact SSH key from URL query parameter.
+// This port was also extended to redact all "sshkey" from URL query parameter
+// and replace them with "redacted".
 func RedactURL(u *url.URL) string {
 	if u == nil {
 		return ""
@@ -20,8 +21,11 @@ func RedactURL(u *url.URL) string {
 		ru.User = url.UserPassword(ru.User.Username(), "redacted")
 	}
 	q := ru.Query()
-	if q.Get("sshkey") != "" {
-		q.Set("sshkey", "redacted")
+	if q.Has("sshkey") {
+		values := q["sshkey"]
+		for i := range values {
+			values[i] = "redacted"
+		}
 		ru.RawQuery = q.Encode()
 	}
 	return ru.String()
diff --git a/vendor/github.com/mitchellh/go-testing-interface/.travis.yml b/vendor/github.com/mitchellh/go-testing-interface/.travis.yml
deleted file mode 100644
index cca949103..000000000
--- a/vendor/github.com/mitchellh/go-testing-interface/.travis.yml
+++ /dev/null
@@ -1,12 +0,0 @@
-language: go
-
-go:
-    - 1.x
-    - tip
-
-script:
-    - go test
-
-matrix:
-    allow_failures:
-        - go: tip
diff --git a/vendor/github.com/mitchellh/go-testing-interface/LICENSE b/vendor/github.com/mitchellh/go-testing-interface/LICENSE
deleted file mode 100644
index a3866a291..000000000
--- a/vendor/github.com/mitchellh/go-testing-interface/LICENSE
+++ /dev/null
@@ -1,21 +0,0 @@
-The MIT License (MIT)
-
-Copyright (c) 2016 Mitchell Hashimoto
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.
diff --git a/vendor/github.com/mitchellh/go-testing-interface/README.md b/vendor/github.com/mitchellh/go-testing-interface/README.md
deleted file mode 100644
index ee435adc5..000000000
--- a/vendor/github.com/mitchellh/go-testing-interface/README.md
+++ /dev/null
@@ -1,60 +0,0 @@
-# go-testing-interface
-
-go-testing-interface is a Go library that exports an interface that
-`*testing.T` implements as well as a runtime version you can use in its
-place.
-
-The purpose of this library is so that you can export test helpers as a
-public API without depending on the "testing" package, since you can't
-create a `*testing.T` struct manually. This lets you, for example, use the
-public testing APIs to generate mock data at runtime, rather than just at
-test time.
-
-## Usage & Example
-
-For usage and examples see the [Godoc](http://godoc.org/github.com/mitchellh/go-testing-interface).
-
-Given a test helper written using `go-testing-interface` like this:
-
-    import "github.com/mitchellh/go-testing-interface"
-
-    func TestHelper(t testing.T) {
-        t.Fatal("I failed")
-    }
-
-You can call the test helper in a real test easily:
-
-    import "testing"
-
-    func TestThing(t *testing.T) {
-        TestHelper(t)
-    }
-
-You can also call the test helper at runtime if needed:
-
-    import "github.com/mitchellh/go-testing-interface"
-
-    func main() {
-        TestHelper(&testing.RuntimeT{})
-    }
-
-## Versioning
-
-The tagged version matches the version of Go that the interface is
-compatible with. For example, the version "1.14.0" is for Go 1.14 and
-introduced the `Cleanup` function. The patch version (the ".0" in the
-prior example) is used to fix any bugs found in this library and has no
-correlation to the supported Go version.
-
-## Why?!
-
-**Why would I call a test helper that takes a *testing.T at runtime?**
-
-You probably shouldn't. The only use case I've seen (and I've had) for this
-is to implement a "dev mode" for a service where the test helpers are used
-to populate mock data, create a mock DB, perhaps run service dependencies
-in-memory, etc.
-
-Outside of a "dev mode", I've never seen a use case for this and I think
-there shouldn't be one since the point of the `testing.T` interface is that
-you can fail immediately.
diff --git a/vendor/github.com/mitchellh/go-testing-interface/testing.go b/vendor/github.com/mitchellh/go-testing-interface/testing.go
deleted file mode 100644
index 86510322a..000000000
--- a/vendor/github.com/mitchellh/go-testing-interface/testing.go
+++ /dev/null
@@ -1,112 +0,0 @@
-package testing
-
-import (
-	"fmt"
-	"log"
-)
-
-// T is the interface that mimics the standard library *testing.T.
-//
-// In unit tests you can just pass a *testing.T struct. At runtime, outside
-// of tests, you can pass in a RuntimeT struct from this package.
-type T interface {
-	Cleanup(func())
-	Error(args ...interface{})
-	Errorf(format string, args ...interface{})
-	Fail()
-	FailNow()
-	Failed() bool
-	Fatal(args ...interface{})
-	Fatalf(format string, args ...interface{})
-	Helper()
-	Log(args ...interface{})
-	Logf(format string, args ...interface{})
-	Name() string
-	Parallel()
-	Skip(args ...interface{})
-	SkipNow()
-	Skipf(format string, args ...interface{})
-	Skipped() bool
-}
-
-// RuntimeT implements T and can be instantiated and run at runtime to
-// mimic *testing.T behavior. Unlike *testing.T, this will simply panic
-// for calls to Fatal. For calls to Error, you'll have to check the errors
-// list to determine whether to exit yourself.
-//
-// Cleanup does NOT work, so if you're using a helper that uses Cleanup,
-// there may be dangling resources.
-//
-// Parallel does not do anything.
-type RuntimeT struct {
-	skipped bool
-	failed  bool
-}
-
-func (t *RuntimeT) Error(args ...interface{}) {
-	log.Println(fmt.Sprintln(args...))
-	t.Fail()
-}
-
-func (t *RuntimeT) Errorf(format string, args ...interface{}) {
-	log.Printf(format, args...)
-	t.Fail()
-}
-
-func (t *RuntimeT) Fail() {
-	t.failed = true
-}
-
-func (t *RuntimeT) FailNow() {
-	panic("testing.T failed, see logs for output (if any)")
-}
-
-func (t *RuntimeT) Failed() bool {
-	return t.failed
-}
-
-func (t *RuntimeT) Fatal(args ...interface{}) {
-	log.Print(args...)
-	t.FailNow()
-}
-
-func (t *RuntimeT) Fatalf(format string, args ...interface{}) {
-	log.Printf(format, args...)
-	t.FailNow()
-}
-
-func (t *RuntimeT) Log(args ...interface{}) {
-	log.Println(fmt.Sprintln(args...))
-}
-
-func (t *RuntimeT) Logf(format string, args ...interface{}) {
-	log.Println(fmt.Sprintf(format, args...))
-}
-
-func (t *RuntimeT) Name() string {
-	return ""
-}
-
-func (t *RuntimeT) Parallel() {}
-
-func (t *RuntimeT) Skip(args ...interface{}) {
-	log.Print(args...)
-	t.SkipNow()
-}
-
-func (t *RuntimeT) SkipNow() {
-	t.skipped = true
-}
-
-func (t *RuntimeT) Skipf(format string, args ...interface{}) {
-	log.Printf(format, args...)
-	t.SkipNow()
-}
-
-func (t *RuntimeT) Skipped() bool {
-	return t.skipped
-}
-
-func (t *RuntimeT) Helper() {}
-
-func (t *RuntimeT) Cleanup(func()) {}
diff --git a/vendor/modules.txt b/vendor/modules.txt
index ed5eecff3..626a0f977 100644
--- a/vendor/modules.txt
+++ b/vendor/modules.txt
@@ -570,7 +570,7 @@ github.com/gorilla/websocket
 # github.com/hashicorp/go-cleanhttp v0.5.2
 ## explicit; go 1.13
 github.com/hashicorp/go-cleanhttp
-# github.com/hashicorp/go-getter v1.7.8
+# github.com/hashicorp/go-getter v1.7.9
 ## explicit; go 1.13
 github.com/hashicorp/go-getter
 github.com/hashicorp/go-getter/helper/url
@@ -644,9 +644,6 @@ github.com/mattn/go-runewidth
 # github.com/mitchellh/go-homedir v1.1.0
 ## explicit
 github.com/mitchellh/go-homedir
-# github.com/mitchellh/go-testing-interface v1.14.1
-## explicit; go 1.14
-github.com/mitchellh/go-testing-interface
 # github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
 ## explicit
 github.com/modern-go/concurrent