{"record":{"id":"01d536550f940f41","repo":"hashicorp/terraform","slug":"provider-s-locked-version-selection-s-doesn-t-m","errorCode":null,"errorMessage":"provider %s: locked version selection %s doesn't match the updated version constraints %q","messagePattern":"provider (.+?): locked version selection (.+?) doesn't match the updated version constraints %q","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/configs/config.go","lineNumber":312,"sourceCode":"\t\t\tcontinue\n\t\t}\n\n\t\tselectedVersion := lock.Version()\n\t\tallowedVersions := providerreqs.MeetingConstraints(constraints)\n\t\tlog.Printf(\"[TRACE] Config.VerifyDependencySelections: provider %s has %s to satisfy %q\", providerAddr, selectedVersion.String(), providerreqs.VersionConstraintsString(constraints))\n\t\tif !allowedVersions.Has(selectedVersion) {\n\t\t\t// The most likely cause of this is that the author of a module\n\t\t\t// has changed its constraints, but this could also happen in\n\t\t\t// some other unusual situations, such as the user directly\n\t\t\t// editing the lock file to record something invalid. We'll\n\t\t\t// distinguish those cases here in order to avoid the more\n\t\t\t// specific error message potentially being a red herring in\n\t\t\t// the edge-cases.\n\t\t\tcurrentConstraints := providerreqs.VersionConstraintsString(constraints)\n\t\t\tlockedConstraints := providerreqs.VersionConstraintsString(lock.VersionConstraints())\n\t\t\tswitch {\n\t\t\tcase currentConstraints != lockedConstraints:\n\t\t\t\terrs = append(errs, fmt.Errorf(\"provider %s: locked version selection %s doesn't match the updated version constraints %q\", providerAddr, selectedVersion.String(), currentConstraints))\n\t\t\tdefault:\n\t\t\t\terrs = append(errs, fmt.Errorf(\"provider %s: version constraints %q don't match the locked version selection %s\", providerAddr, currentConstraints, selectedVersion.String()))\n\t\t\t}\n\t\t}\n\t}\n\n\t// Return multiple errors in an arbitrary-but-deterministic order.\n\tsort.Slice(errs, func(i, j int) bool {\n\t\treturn errs[i].Error() < errs[j].Error()\n\t})\n\n\treturn errs\n}\n\n// ProviderRequirements searches the full tree of modules under the receiver\n// for both explicit and implicit dependencies on providers.\n//\n// The result is a full manifest of all of the providers that must be available","sourceCodeStart":294,"sourceCodeEnd":330,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/configs/config.go#L294-L330","documentation":"Indicates the locked provider version is outside the current constraints AND the constraint string recorded in the lock file differs from the one now in the configuration. This is the 'module author changed required_providers since the last init' path: the lock is stale relative to new constraints, so the previously-selected version no longer satisfies. Distinguished from 805 specifically by currentConstraints != lockedConstraints.","triggerScenarios":"Bumping a required_providers constraint (e.g. `~> 3.0` -> `~> 4.0`) without re-running init, pulling a module update that tightens/loosens constraints, or hand-editing the lock file so its VersionConstraints no longer match config.","commonSituations":"Module upgrade, provider major-version bump, constraint edited in a shared module after teammates already ran init against the old constraint.","solutions":["Run `terraform init -upgrade` to re-resolve and rewrite the lock entry under the new constraints.","If you want to keep the old version intentionally, change the constraint back to match the lock (inspect lock.VersionConstraints()).","Commit the updated .terraform.lock.hcl so teammates inherit the new selection."],"exampleFix":"// before: constraint changed, plan fails\n//   required_providers { aws = { version = \"~> 4.0\" } }   # config\n//   lock.hcl still says version = \"~> 3.0\", selected 3.76\n\n$ terraform init -upgrade\n// after: lock.hcl rewritten with constraints \"~> 4.0\", selected 4.x","handlingStrategy":"validation","validationCode":"// Compare each provider's lock-file constraint string against the config constraint\n// before plan; if they diverge, run `terraform init -upgrade` to re-resolve.\n// Tools: `terraform providers lock` / inspecting depsfile.Locks in Go.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["After any required_providers change, immediately run terraform init and commit the lock file.","Treat .terraform.lock.hcl as coupled to required_providers - change one, update the other."],"tags":["config","provider-dependencies","lock-file","version-constraints"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T20:17:04.800Z"}