dependabot / dependabot/dependabot-core

Update Terraform version at `required_version`

Open
#8,725 15 comments 21 reactions 0 assignees View on GitHub
T: bug 🐞
Dominant language
Ruby
Stars
5.8k
Forks
1.5k
Avg merge
2d 18h
Merged PRs (30d)
149

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Package ecosystem

Terraform

### Package manager version

Terraform

### Language version

Terraform

### Manifest location and content before the Dependabot update

Any Terraform file with the following block:
```terraform
terraform {
required_providers {
aws = {
version = "~> 2.13.0"
}
random = {
version = ">= 2.1.2"
}
}

required_version = "~> 0.12.29"
}
```

https://developer.hashicorp.com/terraform/tutorials/configuration-language/versions

### dependabot.yml content

Default `dependabot.yml` to update Terraform.

```yaml
version: 2
updates:
- package-ecosystem: "terraform"
directory: "/"
schedule:
interval: "daily"
```

### Updated dependency

Main Terraform version.

### What you expected to see, versus what you actually saw

Actually, `dependabot` does not update the Terraform version at `required_version`.

Maybe this is an expected behaviour, if not I can give it a go and try to add the code to do it.

Looking into the code at https://github.com/dependabot/dependabot-core/blob/389cb8a49af6a4c499da6322a6c138f734ccc310/terraform/lib/dependabot/terraform/file_parser.rb#L58-L67 we should fetch the `required_version` object.

### Native package manager behavior

_No response_

### Images of the diff or a link to the PR, issue, or logs

_No response_

### Smallest manifest that reproduces the issue

_No response_

Contributor guide

Open the contributing guide

Research direction

Start in terraform/lib/dependabot/terraform/file_parser.rb, especially lines 58-67, and read the linked Terraform version-constraint documentation. Trace how required_providers constraints are fetched and determine how required_version should be handled. Done means Dependabot updates the Terraform version constraint in matching Terraform files without disrupting provider constraints.

Written by the indexing model from the issue text.

Assessment

Tech stack
terraform
Domain
infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.