How Terraform callers constrain registry module versions and review module upgrades independently of provider lock files.
For a registry module, set version in the module call to make upgrades intentional. This is separate from .terraform.lock.hcl, which records selected provider packages and does not lock module versions.
1module "vpc" {
2 source = "terraform-aws-modules/vpc/aws"
3 version = "~> 5.0"
4
5 name = "app-network"
6 cidr = "10.0.0.0/16"
7}
A version constraint should reflect the compatibility policy for the calling configuration. Read the module’s release notes and input/output changes before raising it, then run a plan in an appropriate environment. Local modules and source URLs behave differently from registry modules, so confirm the source-specific versioning rules rather than assuming one upgrade mechanism covers all sources.
Pinning or constraining a module does not establish security or correctness: review its provider requirements, exposed values, and the plan it produces. See HashiCorp’s module source documentation.