{"record":{"id":"e4bd719f6e747716","repo":"hashicorp/terraform","slug":"cannot-serialize-updated-credentials-file-s","errorCode":null,"errorMessage":"cannot serialize updated credentials file: %s","messagePattern":"cannot serialize updated credentials file: (.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/command/cliconfig/credentials.go","lineNumber":386,"sourceCode":"\t\t\tdelete(rawCredsMap, givenHost)\n\t\t}\n\t}\n\n\t// If we have a new object to store we'll write it in now. If the previous\n\t// object had the hostname written in a different way then this will\n\t// appear to change it into our canonical display form, with all the\n\t// letters in lowercase and other transforms from the Internationalized\n\t// Domain Names specification.\n\tif new != nil {\n\t\ttoStore := new.ToStore()\n\t\trawCredsMap[host.ForDisplay()] = ctyjson.SimpleJSONValue{\n\t\t\tValue: toStore,\n\t\t}\n\t}\n\n\tnewSrc, err := json.MarshalIndent(raw, \"\", \"  \")\n\tif err != nil {\n\t\treturn fmt.Errorf(\"cannot serialize updated credentials file: %s\", err)\n\t}\n\n\t// Now we'll write our new content over the top of the existing file.\n\t// Because we updated the data structure surgically here we should not\n\t// have disturbed the meaning of any other content in the file, but it\n\t// might have a different JSON layout than before.\n\t// We'll create a new file with a different name first and then rename\n\t// it over the old file in order to make the change as atomically as\n\t// the underlying OS/filesystem will allow.\n\t{\n\t\tdir, file := filepath.Split(filename)\n\t\tf, err := ioutil.TempFile(dir, file)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"cannot create temporary file to update credentials: %s\", err)\n\t\t}\n\t\ttmpName := f.Name()\n\t\tmoved := false\n\t\tdefer func(f *os.File, name string) {","sourceCodeStart":368,"sourceCodeEnd":404,"githubUrl":"https://github.com/hashicorp/terraform/blob/c9def3e214014c1188faabfc4a5bde5095139765/internal/command/cliconfig/credentials.go#L368-L404","documentation":"Emitted by `updateLocalHostCredentials` (credentials.go:386) when `json.MarshalIndent(raw, \"\", \"  \")` fails while serializing the updated credentials structure. `MarshalIndent` rarely fails because the input is a `map[string]interface{}` already decoded from JSON, so this guards against exotic cases like NaN/Inf numbers that slipped into the map or cyclic references from a corrupted in-memory structure.","triggerScenarios":"Storing/forgetting credentials when the in-memory `raw` map contains a value `json.Marshal` cannot encode — most plausibly a `json.Number` wrapping a non-numeric string, or a manually-injected unsupported type. In normal Terraform operation this is effectively unreachable.","commonSituations":"Corrupted credentials file with a numeric field that is actually non-numeric after partial edits; third-party tooling that mutated the file into an unmarshallable state. End users almost never trigger this directly.","solutions":["Back up and remove `credentials.tfrc.json`, then re-run `terraform login` to regenerate it cleanly.","Inspect the file for malformed numeric values (e.g. `NaN`, `Infinity`, numbers in quotes mixed with `UseNumber`).","Report a bug if it reproduces on an unmodified file — MarshalIndent failing indicates a Terraform defect."],"exampleFix":"# before\nterraform login\n# cannot serialize updated credentials file: json: ...\n\n# after (regenerate cleanly)\nmv ~/.terraform.d/credentials.tfrc.json ~/.terraform.d/credentials.tfrc.json.bak\nterraform login","handlingStrategy":"try-catch","validationCode":"// Sanity-check the file round-trips through json.Marshal before Terraform writes.\nfunc credsFileMarshallable(path string) error {\n    b, err := os.ReadFile(path)\n    if err != nil { return nil }\n    var v map[string]interface{}\n    dec := json.NewDecoder(bytes.NewReader(b))\n    dec.UseNumber()\n    if err := dec.Decode(&v); err != nil { return nil }\n    if _, err := json.MarshalIndent(v, \"\", \"  \"); err != nil {\n        return fmt.Errorf(\"credentials file not serializable: %w\", err)\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":"// if err := src.StoreForHost(host, creds); err != nil {\n//     if strings.Contains(err.Error(), \"cannot serialize updated credentials file\") {\n//         // regenerate the file from scratch via 'terraform login'\n//     }\n// }","preventionTips":["Avoid injecting non-JSON-encodable values into the credentials file.","If serialization fails, back up and recreate the file with `terraform login`.","Treat repeated occurrences as a Terraform bug worth reporting."],"tags":["terraform","credentials","json","serialization","internal"],"analyzedSha":"c9def3e214014c1188faabfc4a5bde5095139765","analyzedAt":"2026-08-07T15:39:49.278Z","schemaVersion":2},"datasetVersion":"2026-08-07T21:17:07.882Z"}