{"record":{"id":"91a0f7ddf6824818","repo":"hashicorp/terraform","slug":"provider-s-version-constraints-q-don-t-match-th","errorCode":null,"errorMessage":"provider %s: version constraints %q don't match the locked version selection %s","messagePattern":"provider (.+?): version constraints %q don't match the locked version selection (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/configs/config.go","lineNumber":314,"sourceCode":"\n\t\tselectedVersion := lock.Version()\n\t\tallowedVersions := providerreqs.MeetingConstraints(constraints)\n\t\tlog.Printf(\"[TRACE] Config.VerifyDependencySelections: provider %s has %s to satisfy %q\", providerAddr, selectedVersion.String(), providerreqs.VersionConstraintsString(constraints))\n\t\tif !allowedVersions.Has(selectedVersion) {\n\t\t\t// The most likely cause of this is that the author of a module\n\t\t\t// has changed its constraints, but this could also happen in\n\t\t\t// some other unusual situations, such as the user directly\n\t\t\t// editing the lock file to record something invalid. We'll\n\t\t\t// distinguish those cases here in order to avoid the more\n\t\t\t// specific error message potentially being a red herring in\n\t\t\t// the edge-cases.\n\t\t\tcurrentConstraints := providerreqs.VersionConstraintsString(constraints)\n\t\t\tlockedConstraints := providerreqs.VersionConstraintsString(lock.VersionConstraints())\n\t\t\tswitch {\n\t\t\tcase currentConstraints != lockedConstraints:\n\t\t\t\terrs = append(errs, fmt.Errorf(\"provider %s: locked version selection %s doesn't match the updated version constraints %q\", providerAddr, selectedVersion.String(), currentConstraints))\n\t\t\tdefault:\n\t\t\t\terrs = append(errs, fmt.Errorf(\"provider %s: version constraints %q don't match the locked version selection %s\", providerAddr, currentConstraints, selectedVersion.String()))\n\t\t\t}\n\t\t}\n\t}\n\n\t// Return multiple errors in an arbitrary-but-deterministic order.\n\tsort.Slice(errs, func(i, j int) bool {\n\t\treturn errs[i].Error() < errs[j].Error()\n\t})\n\n\treturn errs\n}\n\n// ProviderRequirements searches the full tree of modules under the receiver\n// for both explicit and implicit dependencies on providers.\n//\n// The result is a full manifest of all of the providers that must be available\n// in order to work with the receiving configuration.\n//","sourceCodeStart":296,"sourceCodeEnd":332,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/configs/config.go#L296-L332","documentation":"Same check as 804 but the constraint strings match (the `default` branch at line 314): the locked selected version is simply not in allowedVersions for those unchanged constraints. Usually means the lock recorded a version that no longer satisfies: a hand-edited lock, a provider yanking an old release so the resolver's set shrank, or constraints tightened in a way init didn't propagate.","triggerScenarios":"Manually editing the lock file's version field, a constraint like `>= 1.3.0` paired with a lock still on 1.2.0 after a partial/failed init, or a provider release being withdrawn so the version is no longer selectable.","commonSituations":"Hand-editing .terraform.lock.hcl, partial init across providers, constraint and lock updated out of order.","solutions":["Run `terraform init -upgrade` to recompute the selected version under the existing constraints.","If you intentionally pin a specific version, make the constraint match (e.g. `= 1.2.0`) rather than editing the lock directly.","Inspect the lock file, remove the corrupted provider block, then `terraform init` to regenerate it."],"exampleFix":"// before: constraint \">= 1.3.0\", lock selected \"1.2.0\"\n\n$ terraform init -upgrade\n// after: lock selected \"1.3.x\" satisfying the constraint","handlingStrategy":"validation","validationCode":"// Never edit .terraform.lock.hcl by hand; regenerate via `terraform init` /\n// `terraform providers lock -platform=...`. In Go, assert lock.Version() is in\n// providerreqs.MeetingConstraints(configConstraints) before plan.","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Regenerate locks only through terraform init / terraform providers lock.","Pin exact versions with `=` constraints when reproducibility matters.","Run terraform init -upgrade after provider withdrawals to refresh the selectable set."],"tags":["config","provider-dependencies","lock-file"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}