Skip to content

v0.3.16 — Terraform/OpenTofu registry signals

Choose a tag to compare

View all tags
@github-actions github-actions released this 05 Aug 18:50
v0.3.16
db75fa9

lockvet v0.3.16 — Terraform/OpenTofu providers join the registry lineup

Neither OSV nor deps.dev has any Terraform system, so until now
.terraform.lock.hcl diffs were explained with no registry data at all.
lockvet now asks the Terraform and OpenTofu registries directly:

  • Release ages + ⏱ cooldown flag from the registries' per-version
    publish times. Dependabot/Renovate provider bumps show how old the
    incoming release is; -fail-on fresh gates them.

  • Deprecation lane: providers the registry warns about, providers
    delisted from registry.terraform.io, providers blocked by the OpenTofu
    registry (block reason included), and HashiCorp's archived providers
    with their suggested replacement:

    ↑ hashicorp/template 2.1.2 → 2.2.0  minor  (5y old)
    ● deprecated upstream: This provider has been archived. Please use the
      `templatefile` function or the `Cloudinit` provider instead

  • Registry-verified unlisted detection. The registry's version-list
    endpoints hard-cap at 500 entries (the AWS provider has more), so a
    version absent from the list is re-checked against the per-version
    endpoint and only flagged after the registry itself answers 404. That
    matters: HashiCorp pulled hashicorp/aws 5.71.0 after a bad release —
    the GitHub tag still exists, and a lockfile pinning it gets the ▲ flag.
    It was the only flag raised in a 162-commit replay of three real infra
    repos' lockfile history. See the new
    case study 6.

  • Verified changelog links and -changelogs for providers, via the
    source repository the registry reports.

  • Routing follows the lockfile: default-host providers →
    registry.terraform.io; registry.opentofu.org/… pins →
    api.opentofu.org; custom/private registry hosts are left alone.

  • Playground: registry.terraform.io sends no CORS headers, so the
    browser build gets ages + changelog links from the CORS-open OpenTofu
    mirror — and, because a mirror can lag, makes no unlisted or
    deprecation claims there.

Registry lineup: npm · PyPI · crates.io · RubyGems · Packagist · NuGet ·
Hex · Go · Pub · CocoaPods · Terraform/OpenTofu.

Install: brew install matteo-sung/tap/lockvet · scoop bucket add matteo-sung https://github.com/matteo-sung/scoop-bucket && scoop install lockvet · go install github.com/matteo-sung/lockvet@v0.3.16 · docker run ghcr.io/matteo-sung/lockvet:0.3.16 · install.sh / binaries

Assets 9
Loading