diff --git a/pf/tests/go.mod b/pf/tests/go.mod
index 5622ae44b..addf0f9c0 100644
--- a/pf/tests/go.mod
+++ b/pf/tests/go.mod
@@ -81,7 +81,9 @@ require (
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	gotest.tools v2.2.0+incompatible // indirect
+	gotest.tools/v3 v3.0.3 // indirect
 	mvdan.cc/gofumpt v0.5.0 // indirect
+	pgregory.net/rapid v0.6.1 // indirect
 )
 
 replace (
@@ -244,7 +246,7 @@ require (
 	github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
-	github.com/zclconf/go-cty v1.14.2 // indirect
+	github.com/zclconf/go-cty v1.14.2
 	go.opencensus.io v0.24.0 // indirect
 	go.uber.org/atomic v1.9.0 // indirect
 	gocloud.dev v0.37.0 // indirect
diff --git a/pf/tests/go.sum b/pf/tests/go.sum
index e4ac8402e..2835b2866 100644
--- a/pf/tests/go.sum
+++ b/pf/tests/go.sum
@@ -2645,6 +2645,7 @@ golang.org/x/tools v0.0.0-20190506145303-2d16b83fe98c/go.mod h1:RgjU9mgBXZiqYHBn
 golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
 golang.org/x/tools v0.0.0-20190606124116-d0a3d012864b/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190621195816-6e04913cbbac/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
+golang.org/x/tools v0.0.0-20190624222133-a101b041ded4/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190628153133-6cdbf07be9d0/go.mod h1:/rFqwRUd4F7ZHNgwSSTFct+R/Kf4OFW1sUzUTQQTgfc=
 golang.org/x/tools v0.0.0-20190729092621-ff9f1409240a/go.mod h1:jcCCGcm9btYwXyDqrUWc6MKQKKGJCWEQ3AfLSRIbEuI=
 golang.org/x/tools v0.0.0-20190816200558-6889da9d5479/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
diff --git a/pf/tests/internal/cross-tests/README.md b/pf/tests/internal/cross-tests/README.md
new file mode 100644
index 000000000..4af5f3899
--- /dev/null
+++ b/pf/tests/internal/cross-tests/README.md
@@ -0,0 +1,51 @@
+# Cross-tests for PF
+
+This package provides [cross-testing](../../../../pkg/tests/cross-tests/README.md) for [Plugin Framework](https://developer.hashicorp.com/terraform/plugin/framework) based Terraform
+providers, bridged into Pulumi with [pf](../../../README.md).
+
+It *does not* contain cross-tests. It just provides a library for writing cross-tests.
+
+An example usage looks like this:
+
+``` go
+func TestConfigure(t *testing.T) {
+	t.Parallel()
+
+    schema := schema.Schema{Attributes: map[string]schema.Attribute{
+		"k": schema.StringAttribute{Optional: true},
+	}}
+
+    tfInput := map[string]cty.Value{"k": cty.StringVal("foo")}
+
+    puInput := resource.PropertyMap{"k": resource.MakeSecret(resource.NewProperty("foo"))}
+
+	crosstests.Configure(schema, tfInput, puInput)
+}
+```
+
+Here, the cross-test will assert that a provider who's configuration is described by
+`schema` will observe the same inputs when configured in via HCL with the inputs
+`tfInputs` and when bridged and configured with Pulumi and `puInputs`.
+
+The idea is that the "Configured Provider" should not be able to tell if it was configured
+via HCL or Pulumi YAML:
+
+
+```
+    +--------------------+                      +---------------------+
+    | Terraform Provider |--------------------->| Configure(tfInputs) |
+    +--------------------+                      +---------------------+
+              |                                                        \
+              |                                                         \
+              |                                                          \
+              |                                                      +---------------------+
+              | tfbridge.ShimProvider                                | Configured Provider |
+              |                                                      +---------------------+
+              |                                                          /
+              |                                                         /
+              V                                                        /
+    +--------------------+                      +---------------------+
+    |   Pulumi Provider  |--------------------->| Configure(puInputs) |
+    +--------------------+                      +---------------------+
+```
+
diff --git a/pf/tests/internal/cross-tests/configure.go b/pf/tests/internal/cross-tests/configure.go
new file mode 100644
index 000000000..283f59002
--- /dev/null
+++ b/pf/tests/internal/cross-tests/configure.go
@@ -0,0 +1,227 @@
+package crosstests
+
+import (
+	"bytes"
+	"context"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
+	"github.com/hashicorp/terraform-plugin-framework/tfsdk"
+	"github.com/pulumi/providertest/providers"
+	"github.com/pulumi/providertest/pulumitest"
+	"github.com/pulumi/providertest/pulumitest/opttest"
+	pb "github.com/pulumi/pulumi-terraform-bridge/pf/tests/internal/providerbuilder"
+	"github.com/pulumi/pulumi-terraform-bridge/pf/tfbridge"
+	"github.com/pulumi/pulumi-terraform-bridge/pf/tfgen"
+	crosstests "github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tests/cross-tests"
+	"github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tests/tfcheck"
+	"github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tfbridge/info"
+	"github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tfbridge/tokens"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/diag"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/util/contract"
+	pulumirpc "github.com/pulumi/pulumi/sdk/v3/proto/go"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"github.com/zclconf/go-cty/cty"
+	"gopkg.in/yaml.v3"
+)
+
+// MakeConfigure returns a [testing] subtest of [Configure].
+//
+//	func TestMyProperty(t *testing.T) {
+//		t.Run("my-subtest", crosstests.MakeConfigure(schema, tfConfig, puConfig))
+//	}
+//
+// For details on the test itself, see [Configure].
+func MakeConfigure(schema schema.Schema, tfConfig map[string]cty.Value, puConfig resource.PropertyMap) func(t *testing.T) {
+	return func(t *testing.T) {
+		t.Parallel()
+		Configure(t, schema, tfConfig, puConfig)
+	}
+}
+
+// Configure will assert that a provider who's configuration is described by
+// schema will observe the same inputs when configured in via HCL with the inputs
+// tfInputs and when bridged and configured with Pulumi and puInputs.
+//
+// The idea is that the "Configured Provider" should not be able to tell if it was configured
+// via HCL or Pulumi YAML:
+//
+//	+--------------------+                      +---------------------+
+//	| Terraform Provider |--------------------->| Configure(tfInputs) |
+//	+--------------------+                      +---------------------+
+//	          |                                                        \
+//	          |                                                         \
+//	          |                                                          \
+//	          |                                                      +---------------------+
+//	          | tfbridge.ShimProvider                                | Configured Provider |
+//	          |                                                      +---------------------+
+//	          |                                                          /
+//	          |                                                         /
+//	          V                                                        /
+//	+--------------------+                      +---------------------+
+//	|   Pulumi Provider  |--------------------->| Configure(puInputs) |
+//	+--------------------+                      +---------------------+
+//
+// Configure should be safe to run in parallel.
+func Configure(t *testing.T, schema schema.Schema, tfConfig map[string]cty.Value, puConfig resource.PropertyMap) {
+	// By default, logs only show when they are on a failed test. By logging to
+	// topLevelT, we can log items to be shown if downstream tests fail.
+	topLevelT := t
+	const providerName = "test"
+
+	prov := func(config *tfsdk.Config) *pb.Provider {
+		return pb.NewProvider(pb.NewProviderArgs{
+			TypeName:       providerName,
+			ProviderSchema: schema,
+			OnConfigure:    func(c tfsdk.Config) { *config = c },
+			AllResources: []pb.Resource{{
+				Name: "res",
+			}},
+		})
+	}
+
+	var tfOutput, puOutput tfsdk.Config
+	t.Run("tf", func(t *testing.T) {
+
+		var hcl bytes.Buffer
+		err := crosstests.WritePF(&hcl).Provider(schema, providerName, tfConfig)
+		require.NoError(t, err)
+		// TF does not configure providers unless they are involved with creating
+		// a resource or datasource, so we create "res" to give the TF provider a
+		// reason to be configured.
+		hcl.WriteString(`
+resource "` + providerName + `_res" "res" {}
+`)
+
+		prov := prov(&tfOutput)
+		driver := tfcheck.NewTfDriver(t, t.TempDir(), prov.TypeName, prov)
+
+		driver.Write(t, hcl.String())
+		plan, err := driver.Plan(t)
+		require.NoError(t, err)
+		err = driver.Apply(t, plan)
+		require.NoError(t, err)
+	})
+
+	t.Run("bridged", func(t *testing.T) {
+		dir := t.TempDir()
+
+		pulumiYaml := map[string]any{
+			"name":    "project",
+			"runtime": "yaml",
+			"backend": map[string]any{
+				"url": "file://./data",
+			},
+			"resources": map[string]any{
+				"p": map[string]any{
+					"type":       "pulumi:providers:" + providerName,
+					"properties": convertResourceValue(t, puConfig),
+				},
+			},
+		}
+
+		bytes, err := yaml.Marshal(pulumiYaml)
+		require.NoError(t, err)
+		topLevelT.Logf("Pulumi.yaml:\n%s", string(bytes))
+		err = os.WriteFile(filepath.Join(dir, "Pulumi.yaml"), bytes, 0600)
+		require.NoError(t, err)
+
+		makeProvider := func(providers.PulumiTest) (pulumirpc.ResourceProviderServer, error) {
+			ctx, sink := context.Background(), testLogSink{t}
+			p := info.Provider{
+				Name:             providerName,
+				P:                tfbridge.ShimProvider(prov(&puOutput)),
+				Version:          "0.1.0-dev",
+				UpstreamRepoPath: ".",
+			}
+			p.MustComputeTokens(tokens.SingleModule(providerName, "index", tokens.MakeStandard(providerName)))
+
+			for _, v := range p.DataSources {
+				v.Docs = &info.Doc{Markdown: []byte{' '} /* don't warn the user that docs cannot be found */}
+			}
+			for _, v := range p.Resources {
+				v.Docs = &info.Doc{Markdown: []byte{' '} /* don't warn the user that docs cannot be found */}
+			}
+			schema, err := tfgen.GenerateSchema(ctx, tfgen.GenerateSchemaOptions{
+				ProviderInfo: p,
+			})
+			if err != nil {
+				return nil, err
+			}
+
+			p.MetadataInfo = &info.Metadata{Path: "non-empty"}
+			return tfbridge.NewProviderServer(ctx, sink, p, tfbridge.ProviderMetadata{
+				PackageSchema: schema.ProviderMetadata.PackageSchema,
+			})
+		}
+
+		test := pulumitest.NewPulumiTest(t, dir,
+			opttest.AttachProviderServer(providerName, makeProvider),
+			opttest.SkipInstall(),
+			opttest.Env("PULUMI_DISABLE_AUTOMATIC_PLUGIN_ACQUISITION", "true"),
+		)
+		contract.Ignore(test.Preview()) // Assert that the preview succeeded, but not the result.
+		contract.Ignore(test.Up())      // Assert that the update succeeded, but not the result.
+	})
+
+	skipCompare := t.Failed()
+	t.Run("compare", func(t *testing.T) {
+		if skipCompare {
+			t.Skipf("skipping comparison due to earlier test failure")
+		}
+		assert.Equal(t, tfOutput, puOutput)
+	})
+}
+
+type testLogSink struct{ t *testing.T }
+
+func (s testLogSink) Log(_ context.Context, sev diag.Severity, urn resource.URN, msg string) error {
+	return s.log("LOG", sev, urn, msg)
+}
+func (s testLogSink) LogStatus(_ context.Context, sev diag.Severity, urn resource.URN, msg string) error {
+	return s.log("STATUS", sev, urn, msg)
+}
+
+func (s testLogSink) log(kind string, sev diag.Severity, urn resource.URN, msg string) error {
+	var urnMsg string
+	if urn != "" {
+		urnMsg = " (" + string(urn) + ")"
+	}
+	s.t.Logf("Provider[%s]: %s%s: %s", kind, sev, urnMsg, msg)
+	return nil
+}
+
+func convertResourceValue(t *testing.T, properties resource.PropertyMap) map[string]any {
+	var convertValue func(resource.PropertyValue) (any, bool)
+	convertValue = func(v resource.PropertyValue) (any, bool) {
+		if v.IsComputed() {
+			require.Fail(t, "cannot convert computed value to YAML")
+		}
+		var isSecret bool
+		if v.IsOutput() {
+			o := v.OutputValue()
+			if !o.Known {
+				require.Fail(t, "cannot convert unknown output value to YAML")
+			}
+			v = o.Element
+			isSecret = o.Secret
+		}
+		if v.IsSecret() {
+			isSecret = true
+			v = v.SecretValue().Element
+		}
+
+		if isSecret {
+			return map[string]any{
+				"fn::secret": v.MapRepl(nil, convertValue),
+			}, true
+		}
+		return nil, false
+
+	}
+	return properties.MapRepl(nil, convertValue)
+}
diff --git a/pf/tests/internal/providerbuilder/build_provider.go b/pf/tests/internal/providerbuilder/build_provider.go
index 16126ca3e..82ec40f99 100644
--- a/pf/tests/internal/providerbuilder/build_provider.go
+++ b/pf/tests/internal/providerbuilder/build_provider.go
@@ -36,6 +36,8 @@ type Provider struct {
 	Version        string
 	ProviderSchema schema.Schema
 	AllResources   []Resource
+
+	onConfigure func(tfsdk.Config)
 }
 
 var _ provider.Provider = (*Provider)(nil)
@@ -49,10 +51,13 @@ func (impl *Provider) Schema(ctx context.Context, req provider.SchemaRequest, re
 	resp.Schema = impl.ProviderSchema
 }
 
-func (*Provider) Configure(ctx context.Context, req provider.ConfigureRequest, resp *provider.ConfigureResponse) {
+func (impl *Provider) Configure(ctx context.Context, req provider.ConfigureRequest, resp *provider.ConfigureResponse) {
+	if impl.onConfigure != nil {
+		impl.onConfigure(req.Config)
+	}
 }
 
-func (*Provider) DataSources(ctx context.Context) []func() datasource.DataSource {
+func (impl *Provider) DataSources(ctx context.Context) []func() datasource.DataSource {
 	return []func() datasource.DataSource{}
 }
 
@@ -76,6 +81,9 @@ type NewProviderArgs struct {
 	Version        string
 	ProviderSchema schema.Schema
 	AllResources   []Resource
+
+	// OnConfigure is called when a provider is configured.
+	OnConfigure func(tfsdk.Config)
 }
 
 // NewProvider creates a new provider with the given resources, filling reasonable defaults.
@@ -85,6 +93,8 @@ func NewProvider(params NewProviderArgs) *Provider {
 		Version:        params.Version,
 		ProviderSchema: params.ProviderSchema,
 		AllResources:   params.AllResources,
+
+		onConfigure: params.OnConfigure,
 	}
 
 	if prov.TypeName == "" {
diff --git a/pf/tests/provider_configure_test.go b/pf/tests/provider_configure_test.go
index 601e67ee5..b8b9305e1 100644
--- a/pf/tests/provider_configure_test.go
+++ b/pf/tests/provider_configure_test.go
@@ -20,71 +20,110 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/diag"
 	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
 	"github.com/pulumi/providertest/replay"
+	"github.com/pulumi/pulumi-terraform-bridge/pf/tests/internal/cross-tests"
 	"github.com/pulumi/pulumi-terraform-bridge/pf/tests/internal/testprovider"
 	tfpf "github.com/pulumi/pulumi-terraform-bridge/pf/tfbridge"
 	"github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tfbridge"
+	"github.com/pulumi/pulumi/sdk/v3/go/common/resource"
 	"github.com/stretchr/testify/require"
+	"github.com/zclconf/go-cty/cty"
 )
 
 func TestConfigure(t *testing.T) {
-	t.Run("configiure communicates to create", func(t *testing.T) {
-		// Test interaction of Configure and Create.
-		//
-		// TestConfigRes will read stringConfigProp information the provider receives via Configure.
-		server, err := newProviderServer(t, testprovider.SyntheticTestBridgeProvider())
-		require.NoError(t, err)
-		testCase := `
-		[
-		  {
-		    "method": "/pulumirpc.ResourceProvider/Configure",
-		    "request": {
-		      "args": {
-			"stringConfigProp": "example"
-		      }
-		    },
-		    "response": {
-		      "supportsPreview": true,
-		      "acceptResources": true
-		    }
-		  },
-		  {
-		    "method": "/pulumirpc.ResourceProvider/Create",
-		    "request": {
-		      "urn": "urn:pulumi:test-stack::basicprogram::testbridge:index/testres:TestConfigRes::r1",
-		      "preview": false
-		    },
-		    "response": {
-		      "id": "id-1",
-		      "properties": {
-			"configCopy": "example",
-			"id": "id-1"
-		      }
-		    }
-		  }
-		]`
-		replay.ReplaySequence(t, server, testCase)
-	})
+	t.Run("string", crosstests.MakeConfigure(
+		schema.Schema{Attributes: map[string]schema.Attribute{
+			"k": schema.StringAttribute{Optional: true},
+		}},
+		map[string]cty.Value{"k": cty.StringVal("foo")},
+		resource.PropertyMap{"k": resource.NewProperty("foo")},
+	))
 
-	t.Run("booleans", func(t *testing.T) {
-		// Non-string properties caused trouble at some point, test booleans.
-		server, err := newProviderServer(t, testprovider.SyntheticTestBridgeProvider())
-		require.NoError(t, err)
+	t.Run("secret-string", crosstests.MakeConfigure(
+		schema.Schema{Attributes: map[string]schema.Attribute{
+			"k": schema.StringAttribute{Optional: true},
+		}},
+		map[string]cty.Value{"k": cty.StringVal("foo")},
+		resource.PropertyMap{"k": resource.MakeSecret(resource.NewProperty("foo"))},
+	))
 
-		testCase := `
-		{
-		  "method": "/pulumirpc.ResourceProvider/Configure",
-		  "request": {
-		    "args": {
-                      "boolConfigProp": "true"
-		    }
-		  },
-		  "response": {
-		    "supportsPreview": true,
-		    "acceptResources": true
-		  }
-		}`
-		replay.Replay(t, server, testCase)
-	})
+	t.Run("bool", crosstests.MakeConfigure(
+		schema.Schema{Attributes: map[string]schema.Attribute{
+			"b": schema.BoolAttribute{Optional: true},
+		}},
+		map[string]cty.Value{"b": cty.BoolVal(false)},
+		resource.PropertyMap{"b": resource.NewProperty(false)},
+	))
+}
+
+// TestConfigureInvalidTypes tests configure for inputs that are not type-safe but that we
+// expect to work.
+func TestConfigureInvalidTypes(t *testing.T) {
+	t.Setenv("PULUMI_DEBUG_YAML_DISABLE_TYPE_CHECKING", "true")
+
+	t.Run("bool-type-conversion", crosstests.MakeConfigure(
+		schema.Schema{Attributes: map[string]schema.Attribute{
+			"b": schema.BoolAttribute{Optional: true},
+		}},
+		map[string]cty.Value{"b": cty.BoolVal(false)},
+		resource.PropertyMap{"b": resource.NewProperty("false")},
+	))
+}
+
+// Test interaction of Configure and Create.
+//
+// The resource TestConfigRes will read stringConfigProp information the provider receives via Configure.
+func TestConfigureToCreate(t *testing.T) {
+	server, err := newProviderServer(t, testprovider.SyntheticTestBridgeProvider())
+	require.NoError(t, err)
+	replay.ReplaySequence(t, server, `
+	[
+	  {
+	    "method": "/pulumirpc.ResourceProvider/Configure",
+	    "request": {
+	      "args": {
+		"stringConfigProp": "example"
+	      }
+	    },
+	    "response": {
+	      "supportsPreview": true,
+	      "acceptResources": true
+	    }
+	  },
+	  {
+	    "method": "/pulumirpc.ResourceProvider/Create",
+	    "request": {
+	      "urn": "urn:pulumi:test-stack::basicprogram::testbridge:index/testres:TestConfigRes::r1",
+	      "preview": false
+	    },
+	    "response": {
+	      "id": "id-1",
+	      "properties": {
+		"configCopy": "example",
+		"id": "id-1"
+	      }
+	    }
+	  }
+	]`)
+}
+
+func TestConfigureBooleans(t *testing.T) {
+	// Non-string properties caused trouble at some point, test booleans.
+	server, err := newProviderServer(t, testprovider.SyntheticTestBridgeProvider())
+	require.NoError(t, err)
+
+	replay.Replay(t, server, `
+	{
+	  "method": "/pulumirpc.ResourceProvider/Configure",
+	  "request": {
+	    "args": {
+	      "boolConfigProp": "true"
+	    }
+	  },
+	  "response": {
+	    "supportsPreview": true,
+	    "acceptResources": true
+	  }
+	}`)
 }
 
 func TestConfigureErrorReplacement(t *testing.T) {
diff --git a/pkg/tests/cross-tests/tfwrite.go b/pkg/tests/cross-tests/tfwrite.go
index a6e76d910..f8a52ff0a 100644
--- a/pkg/tests/cross-tests/tfwrite.go
+++ b/pkg/tests/cross-tests/tfwrite.go
@@ -21,6 +21,7 @@ import (
 	"sort"
 
 	"github.com/hashicorp/hcl/v2/hclwrite"
+	pfproviderschema "github.com/hashicorp/terraform-plugin-framework/provider/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/pulumi/pulumi/sdk/v3/go/common/util/contract"
 	"github.com/zclconf/go-cty/cty"
@@ -38,6 +39,87 @@ func WriteHCL(out io.Writer, sch map[string]*schema.Schema, resourceType, resour
 	return err
 }
 
+type PFWriter struct {
+	out io.Writer
+}
+
+func WritePF(out io.Writer) PFWriter { return PFWriter{out} }
+
+func (w PFWriter) Provider(sch pfproviderschema.Schema, providerName string, config map[string]cty.Value) error {
+	if !cty.ObjectVal(config).IsWhollyKnown() {
+		return fmt.Errorf("WriteHCL cannot yet write unknowns")
+	}
+	f := hclwrite.NewEmptyFile()
+	block := f.Body().AppendNewBlock("provider", []string{providerName})
+	writePfProvider(block.Body(), sch, config)
+	_, err := f.WriteTo(w.out)
+	return err
+}
+
+func writePfProvider(body *hclwrite.Body, schemas pfproviderschema.Schema, values map[string]cty.Value) {
+	writePfObject(body, pfproviderschema.NestedBlockObject{
+		Attributes: schemas.Attributes,
+		Blocks:     schemas.Blocks,
+	}, values)
+}
+
+func writePfBlock(key string, body *hclwrite.Body, schemas pfproviderschema.Block, value cty.Value) {
+	switch schemas := schemas.(type) {
+	case *pfproviderschema.ListNestedBlock:
+		for _, v := range value.AsValueSlice() {
+			b := body.AppendNewBlock(key, nil).Body()
+			writePfObject(b, schemas.NestedObject, v.AsValueMap())
+		}
+	case *pfproviderschema.SetNestedBlock:
+		values := value.AsValueSet().Values()
+		for _, v := range values {
+			b := body.AppendNewBlock(key, nil).Body()
+			writePfObject(b, schemas.NestedObject, v.AsValueMap())
+		}
+	case *pfproviderschema.SingleNestedBlock:
+		body := body.AppendNewBlock(key, nil).Body() // This goes in directly, so just overwrite body
+
+		values := value.AsValueMap()
+		keys := make([]string, 0, len(values))
+		for k := range values {
+			keys = append(keys, k)
+		}
+		sort.Strings(keys)
+
+		for _, key := range keys {
+			if _, ok := schemas.Attributes[key]; ok {
+				body.SetAttributeValue(key, values[key])
+				continue
+			}
+			if block, ok := schemas.Blocks[key]; ok {
+				writePfBlock(key, body, block, values[key])
+			}
+			contract.Failf("Could not find a attr or block for value key %q", key)
+		}
+	default:
+		contract.Failf("Unknown block type: %T", schemas)
+	}
+}
+
+func writePfObject(body *hclwrite.Body, schemas pfproviderschema.NestedBlockObject, values map[string]cty.Value) {
+	keys := make([]string, 0, len(values))
+	for k := range values {
+		keys = append(keys, k)
+	}
+	sort.Strings(keys)
+
+	for _, key := range keys {
+		if _, ok := schemas.Attributes[key]; ok {
+			body.SetAttributeValue(key, values[key])
+			continue
+		}
+		if block, ok := schemas.Blocks[key]; ok {
+			writePfBlock(key, body, block, values[key])
+		}
+		contract.Failf("Could not find a attr or block for value key %q", key)
+	}
+}
+
 func writeBlock(body *hclwrite.Body, schemas map[string]*schema.Schema, values map[string]cty.Value) {
 	internalMap := schema.InternalMap(schemas)
 	coreConfigSchema := internalMap.CoreConfigSchema()
diff --git a/pkg/tests/go.mod b/pkg/tests/go.mod
index 5ed638eda..08028f238 100644
--- a/pkg/tests/go.mod
+++ b/pkg/tests/go.mod
@@ -1,6 +1,8 @@
 module github.com/pulumi/pulumi-terraform-bridge/v3/pkg/tests
 
-go 1.22
+go 1.22.0
+
+toolchain go1.23.2
 
 replace (
 	github.com/pulumi/pulumi-terraform-bridge/v3 => ../..
@@ -8,6 +10,7 @@ replace (
 )
 
 require (
+	github.com/hashicorp/terraform-plugin-framework v1.12.0
 	github.com/hashicorp/terraform-plugin-mux v0.16.0
 	github.com/hashicorp/terraform-plugin-sdk/v2 v2.33.0
 	github.com/hexops/autogold/v2 v2.2.1
@@ -102,16 +105,15 @@ require (
 	go.opentelemetry.io/otel/trace v1.24.0 // indirect
 	golang.org/x/exp v0.0.0-20240604190554-fc45aab8b7f8 // indirect
 	golang.org/x/tools v0.22.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240311173647-c811ad7063a7 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20240604185151-ef581f913117 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117 // indirect
 	gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect
 	mvdan.cc/gofumpt v0.5.0 // indirect
 )
 
 require (
 	cloud.google.com/go v0.112.1 // indirect
-	cloud.google.com/go/compute v1.25.0 // indirect
-	cloud.google.com/go/compute/metadata v0.2.3 // indirect
+	cloud.google.com/go/compute/metadata v0.3.0 // indirect
 	cloud.google.com/go/iam v1.1.6 // indirect
 	cloud.google.com/go/kms v1.15.7 // indirect
 	cloud.google.com/go/logging v1.9.0 // indirect
@@ -149,7 +151,7 @@ require (
 	github.com/go-git/go-git/v5 v5.12.0 // indirect
 	github.com/gofrs/uuid v4.2.0+incompatible // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/glog v1.2.0 // indirect
+	github.com/golang/glog v1.2.1 // indirect
 	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/go-cmp v0.6.0 // indirect
@@ -165,7 +167,7 @@ require (
 	github.com/hashicorp/go-cty v1.4.1-0.20200414143053-d3edf31b6320
 	github.com/hashicorp/go-hclog v1.6.3
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-plugin v1.6.0
+	github.com/hashicorp/go-plugin v1.6.1
 	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/go-rootcerts v1.0.2 // indirect
 	github.com/hashicorp/go-secure-stdlib/parseutil v0.1.8 // indirect
@@ -176,7 +178,7 @@ require (
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/hashicorp/hcl/v2 v2.19.1
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.23.0
+	github.com/hashicorp/terraform-plugin-go v0.24.0
 	github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
 	github.com/hashicorp/vault/api v1.12.0 // indirect
 	github.com/hashicorp/yamux v0.1.1 // indirect
@@ -238,7 +240,7 @@ require (
 	golang.org/x/crypto v0.25.0 // indirect
 	golang.org/x/mod v0.18.0 // indirect
 	golang.org/x/net v0.27.0 // indirect
-	golang.org/x/oauth2 v0.18.0 // indirect
+	golang.org/x/oauth2 v0.21.0 // indirect
 	golang.org/x/sync v0.7.0 // indirect
 	golang.org/x/sys v0.22.0 // indirect
 	golang.org/x/term v0.22.0 // indirect
@@ -248,8 +250,8 @@ require (
 	google.golang.org/api v0.169.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/genproto v0.0.0-20240311173647-c811ad7063a7 // indirect
-	google.golang.org/grpc v1.63.2
-	google.golang.org/protobuf v1.34.0
+	google.golang.org/grpc v1.66.2
+	google.golang.org/protobuf v1.34.2
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v3 v3.0.1
 	lukechampine.com/frand v1.4.2 // indirect
diff --git a/pkg/tests/go.sum b/pkg/tests/go.sum
index 687877f85..cd3af1eff 100644
--- a/pkg/tests/go.sum
+++ b/pkg/tests/go.sum
@@ -304,13 +304,12 @@ cloud.google.com/go/compute v1.23.0/go.mod h1:4tCnrn48xsqlwSAiLf1HXMQk8CONslYbdi
 cloud.google.com/go/compute v1.23.1/go.mod h1:CqB3xpmPKKt3OJpW2ndFIXnA9A4xAy/F3Xp1ixncW78=
 cloud.google.com/go/compute v1.23.2/go.mod h1:JJ0atRC0J/oWYiiVBmsSsrRnh92DhZPG4hFDcR04Rns=
 cloud.google.com/go/compute v1.23.3/go.mod h1:VCgBUoMnIVIR0CscqQiPJLAG25E3ZRZMzcFZeQ+h8CI=
-cloud.google.com/go/compute v1.25.0 h1:H1/4SqSUhjPFE7L5ddzHOfY2bCAvjwNRZPNl6Ni5oYU=
-cloud.google.com/go/compute v1.25.0/go.mod h1:GR7F0ZPZH8EhChlMo9FkLd7eUTwEymjqQagxzilIxIE=
 cloud.google.com/go/compute/metadata v0.1.0/go.mod h1:Z1VN+bulIf6bt4P/C37K4DyZYZEXYonfTBHHFPO/4UU=
 cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 cloud.google.com/go/compute/metadata v0.2.1/go.mod h1:jgHgmJd2RKBGzXqF5LR2EZMGxBkeanZ9wwa75XHJgOM=
-cloud.google.com/go/compute/metadata v0.2.3 h1:mg4jlk7mCAj6xXp9UJ4fjI9VUI5rubuGBW5aJ7UnBMY=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
+cloud.google.com/go/compute/metadata v0.3.0 h1:Tz+eQXMEqDIKRsmY3cHTL6FVaynIjX2QxYC4trgAKZc=
+cloud.google.com/go/compute/metadata v0.3.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 cloud.google.com/go/contactcenterinsights v1.3.0/go.mod h1:Eu2oemoePuEFc/xKFPjbTuPSj0fYJcPls9TFlPNnHHY=
 cloud.google.com/go/contactcenterinsights v1.4.0/go.mod h1:L2YzkGbPsv+vMQMCADxJoT9YiTTnSEd6fEvCeHTYVck=
 cloud.google.com/go/contactcenterinsights v1.6.0/go.mod h1:IIDlT6CLcDoyv79kDv8iWxMSTZhLxSCofVV5W6YFM/w=
@@ -1477,8 +1476,8 @@ github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfU
 github.com/golang/glog v1.0.0/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=
 github.com/golang/glog v1.1.0/go.mod h1:pfYeQZ3JWZoXTV5sFc986z3HTpwQs9At6P4ImfuP3NQ=
 github.com/golang/glog v1.1.2/go.mod h1:zR+okUeTbrL6EL3xHUDxZuEtGv04p5shwip1+mL/rLQ=
-github.com/golang/glog v1.2.0 h1:uCdmnmatrKCgMBlM4rMuJZWOkPDqdbZPnrMXDY4gI68=
-github.com/golang/glog v1.2.0/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
+github.com/golang/glog v1.2.1 h1:OptwRhECazUx5ix5TTWC3EZhsZEHWcYWY4FQHTIubm4=
+github.com/golang/glog v1.2.1/go.mod h1:6AhwSGph0fcJtXVM/PEHPqZlFeoLxhs7/t5UDAwmO+w=
 github.com/golang/groupcache v0.0.0-20190129154638-5b532d6fd5ef/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
 github.com/golang/groupcache v0.0.0-20191227052852-215e87163ea7/go.mod h1:cIg4eruTrX1D+g88fzRXU5OdNfaM+9IcxsU14FzY7Hc=
@@ -1651,8 +1650,9 @@ github.com/hashicorp/go-multierror v1.0.0/go.mod h1:dHtQlpGsu+cZNNAkkCN/P3hoUDHh
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-plugin v1.0.1/go.mod h1:++UyYGoz3o5w9ZzAdZxtQKrWWP+iqPBn3cQptSMzBuY=
-github.com/hashicorp/go-plugin v1.6.0 h1:wgd4KxHJTVGGqWBq4QPB1i5BZNEx9BR8+OFmHDmTk8A=
 github.com/hashicorp/go-plugin v1.6.0/go.mod h1:lBS5MtSSBZk0SHc66KACcjjlU6WzEVP/8pwz68aMkCI=
+github.com/hashicorp/go-plugin v1.6.1 h1:P7MR2UP6gNKGPp+y7EZw2kOiq4IR9WiqLvp0XOsVdwI=
+github.com/hashicorp/go-plugin v1.6.1/go.mod h1:XPHFku2tFo3o3QKFgSYo+cghcUhw1NA1hZyMK0PWAw0=
 github.com/hashicorp/go-retryablehttp v0.7.7 h1:C8hUCYzor8PIfXHa4UrZkU4VvK8o9ISHxT2Q8+VepXU=
 github.com/hashicorp/go-retryablehttp v0.7.7/go.mod h1:pkQpWZeYWskR+D1tR2O5OcBFOxfA7DoAO6xtkuQnHTk=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
@@ -1692,9 +1692,11 @@ github.com/hashicorp/terraform-exec v0.20.0/go.mod h1:ckKGkJWbsNqFKV1itgMnE0hY9I
 github.com/hashicorp/terraform-json v0.4.0/go.mod h1:eAbqb4w0pSlRmdvl8fOyHAi/+8jnkVYN28gJkSJrLhU=
 github.com/hashicorp/terraform-json v0.19.0/go.mod h1:qdeBs11ovMzo5puhrRibdD6d2Dq6TyE/28JiU4tIQxk=
 github.com/hashicorp/terraform-json v0.21.0/go.mod h1:qdeBs11ovMzo5puhrRibdD6d2Dq6TyE/28JiU4tIQxk=
+github.com/hashicorp/terraform-plugin-framework v1.12.0 h1:7HKaueHPaikX5/7cbC1r9d1m12iYHY+FlNZEGxQ42CQ=
+github.com/hashicorp/terraform-plugin-framework v1.12.0/go.mod h1:N/IOQ2uYjW60Jp39Cp3mw7I/OpC/GfZ0385R0YibmkE=
 github.com/hashicorp/terraform-plugin-go v0.22.0/go.mod h1:mPULV91VKss7sik6KFEcEu7HuTogMLLO/EvWCuFkRVE=
-github.com/hashicorp/terraform-plugin-go v0.23.0 h1:AALVuU1gD1kPb48aPQUjug9Ir/125t+AAurhqphJ2Co=
-github.com/hashicorp/terraform-plugin-go v0.23.0/go.mod h1:1E3Cr9h2vMlahWMbsSEcNrOCxovCZhOOIXjFHbjc/lQ=
+github.com/hashicorp/terraform-plugin-go v0.24.0 h1:2WpHhginCdVhFIrWHxDEg6RBn3YaWzR2o6qUeIEat2U=
+github.com/hashicorp/terraform-plugin-go v0.24.0/go.mod h1:tUQ53lAsOyYSckFGEefGC5C8BAaO0ENqzFd3bQeuYQg=
 github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=
 github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow=
 github.com/hashicorp/terraform-plugin-mux v0.16.0 h1:RCzXHGDYwUwwqfYYWJKBFaS3fQsWn/ZECEiW7p2023I=
@@ -2417,8 +2419,8 @@ golang.org/x/oauth2 v0.10.0/go.mod h1:kTpgurOux7LqtuxjuyZa4Gj2gdezIt/jQtGnNFfypQ
 golang.org/x/oauth2 v0.11.0/go.mod h1:LdF7O/8bLR/qWK9DrpXmbHLTouvRHK0SgJl0GmDBchk=
 golang.org/x/oauth2 v0.13.0/go.mod h1:/JMhi4ZRXAf4HG9LiNmxvk+45+96RUlVThiH8FzNBn0=
 golang.org/x/oauth2 v0.14.0/go.mod h1:lAtNWgaWfL4cm7j2OV8TxGi9Qb7ECORx8DktCY74OwM=
-golang.org/x/oauth2 v0.18.0 h1:09qnuIAgzdx1XplqJvW6CQqMCtGZykZWcXzPMPUusvI=
-golang.org/x/oauth2 v0.18.0/go.mod h1:Wf7knwG0MPoWIMMBgFlEaSUDaKskp0dCfrlJRJXbBi8=
+golang.org/x/oauth2 v0.21.0 h1:tsimM75w1tF/uws5rbeHzIWxEqElMehnc+iW793zsZs=
+golang.org/x/oauth2 v0.21.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -2957,8 +2959,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20231012201019-e917dd12ba7a/go.
 google.golang.org/genproto/googleapis/api v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:IBQ646DjkDkvUIsVq/cc03FUFQ9wbZu7yE396YcL870=
 google.golang.org/genproto/googleapis/api v0.0.0-20231030173426-d783a09b4405/go.mod h1:oT32Z4o8Zv2xPQTg0pbVaPr0MPOH6f14RgXt7zfIpwg=
 google.golang.org/genproto/googleapis/api v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:0xJLfVdJqpAPl8tDg1ujOCGzx6LFLttXT5NhllGOXY4=
-google.golang.org/genproto/googleapis/api v0.0.0-20240311173647-c811ad7063a7 h1:oqta3O3AnlWbmIE3bFnWbu4bRxZjfbWCp0cKSuZh01E=
-google.golang.org/genproto/googleapis/api v0.0.0-20240311173647-c811ad7063a7/go.mod h1:VQW3tUculP/D4B+xVCo+VgSq8As6wA9ZjHl//pmk+6s=
+google.golang.org/genproto/googleapis/api v0.0.0-20240604185151-ef581f913117 h1:+rdxYoE3E5htTEWIe15GlN6IfvbURM//Jt0mmkmm6ZU=
+google.golang.org/genproto/googleapis/api v0.0.0-20240604185151-ef581f913117/go.mod h1:OimBR/bc1wPO9iV4NC2bpyjy3VnAwZh5EBPQdtaE5oo=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20230530153820-e85fd2cbaebc/go.mod h1:ylj+BE99M198VPbBh6A8d9n3w8fChvyLK3wwBOjXBFA=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20230807174057-1744710a1577/go.mod h1:NjCQG/D8JandXxM57PZbAJL1DCNL6EypA0vPPwfsc7c=
 google.golang.org/genproto/googleapis/bytestream v0.0.0-20231030173426-d783a09b4405/go.mod h1:GRUCuLdzVqZte8+Dl/D4N25yLzcGqqWaYkeVOwulFqw=
@@ -2979,8 +2981,8 @@ google.golang.org/genproto/googleapis/rpc v0.0.0-20231012201019-e917dd12ba7a/go.
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231016165738-49dd2c1f3d0b/go.mod h1:swOH3j0KzcDDgGUWr+SNpyTen5YrXjS3eyPzFYKc6lc=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231030173426-d783a09b4405/go.mod h1:67X1fPuzjcrkymZzZV1vvkFeTn2Rvc6lYF9MYFGCcwE=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20231106174013-bbf56f31fb17/go.mod h1:oQ5rr10WTTMvP4A36n8JpR1OrO1BEiV4f78CneXZxkA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7 h1:8EeVk1VKMD+GD/neyEHGmz7pFblqPjHoi+PGQIlLx2s=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20240311173647-c811ad7063a7/go.mod h1:WtryC6hu0hhx87FDGxWCDptyssuo68sk10vYjF+T9fY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117 h1:1GBuWVLM/KMVUv1t1En5Gs+gFZCNd360GGb4sSxtrhU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240604185151-ef581f913117/go.mod h1:EfXuqaE1J41VCDicxHzUDm+8rk+7ZdXzHV0IhO/I6s0=
 google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
@@ -3032,8 +3034,8 @@ google.golang.org/grpc v1.58.2/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSs
 google.golang.org/grpc v1.58.3/go.mod h1:tgX3ZQDlNJGU96V6yHh1T/JeoBQ2TXdr43YbYSsCJk0=
 google.golang.org/grpc v1.59.0/go.mod h1:aUPDwccQo6OTjy7Hct4AfBPD1GptF4fyUjIkQ9YtF98=
 google.golang.org/grpc v1.61.1/go.mod h1:VUbo7IFqmF1QtCAstipjG0GIoq49KvMe9+h1jFLBNJs=
-google.golang.org/grpc v1.63.2 h1:MUeiw1B2maTVZthpU5xvASfTh3LDbxHd6IJ6QQVU+xM=
-google.golang.org/grpc v1.63.2/go.mod h1:WAX/8DgncnokcFUldAxq7GeB5DXHDbMF+lLvDomNkRA=
+google.golang.org/grpc v1.66.2 h1:3QdXkuq3Bkh7w+ywLdLvM56cmGvQHUMZpiCzt6Rqaoo=
+google.golang.org/grpc v1.66.2/go.mod h1:s3/l6xSSCURdVfAnL+TqCNMyTDAGN6+lZeVxnZR128Y=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
@@ -3055,8 +3057,8 @@ google.golang.org/protobuf v1.29.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqw
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.31.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.32.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
-google.golang.org/protobuf v1.34.0 h1:Qo/qEd2RZPCf2nKuorzksSknv0d3ERwp1vFG38gSmH4=
-google.golang.org/protobuf v1.34.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
+google.golang.org/protobuf v1.34.2 h1:6xV6lTsCfpGD21XK49h7MhtcApnLqkfYgPcdHftf6hg=
+google.golang.org/protobuf v1.34.2/go.mod h1:qYOHts0dSfpeUzUFpOMr/WGzszTmLH+DiWniOlNbLDw=
 gopkg.in/alecthomas/kingpin.v2 v2.2.6/go.mod h1:FMv+mEhP44yOT+4EoQTLFTRgOQ1FBLkstjWtayDeSgw=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=