Providers, Dependency Locking, and Version Constraints
Provider sources and constraints
Each provider is addressed as [<hostname>/]<namespace>/<type> inside required_providers, which is also the only place version constraints belong - not in the provider block. Terraform intersects constraints across the whole configuration and selects the newest version that satisfies all of them. required_version pins the CLI itself using the same syntax.
Constraint semantics
~> is the operator candidates misread. ~> 5.31 means >= 5.31.0, < 6.0.0; ~> 5.31.0 means >= 5.31.0, < 5.32.0. =, !=, >, >=, <, and <= behave conventionally, and prereleases are excluded unless explicitly requested.
The dependency lock file
.terraform.lock.hcl records the selected versions plus h1: hashes of the downloaded packages and zh: hashes of the provider's Go module dependencies. Commit it for root modules so every laptop and CI runner installs identical providers. terraform init -upgrade re-resolves within constraints and rewrites the lock file; plain terraform init honors it and fails if the recorded provider cannot be installed. When platforms differ (linux_amd64 CI, darwin_arm64 laptops), run terraform providers lock -platform=linux_amd64 -platform=darwin_arm64 to record hashes for all of them.
Distribution
Providers install from the public registry, a network mirror, or a filesystem mirror configured in the CLI configuration file (~/.terraformrc or TF_CLI_CONFIG_FILE). A plugin_cache_dir shares downloads across configurations but never replaces the lock file, and terraform providers mirror builds an offline mirror.
Rule of thumb
Pin providers with a pessimistic constraint at the minor level, commit the lock file, and re-run terraform providers lock whenever CI adds a platform.