Will It Vibe?Provider without a pinned version
Part of Dependencies & Hygiene, which counts for 10% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
A provider entry in required_providers has no version constraint, so terraform init pulls the newest release, which can introduce breaking changes or a compromised version without warning.
Why it matters
A provider listed in required_providers without a version constraint lets terraform init pull whatever the latest release happens to be. That makes builds non-reproducible across machines and over time, and it means a breaking change, or a compromised provider release, can be pulled in silently. Pinning is a basic supply-chain and stability control.
How to fix it
Add a version constraint to each provider in required_providers, for example version = "~> 5.0" to allow patch and minor updates within a major version. Commit the .terraform.lock.hcl lock file so exact provider versions and checksums are pinned for everyone. Update versions deliberately and review provider changelogs when you do.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo