Rot Radar
Providers keep shipping majors. A module pinned < 6.0 while 6.4 is out is frozen on an ageing provider, and nothing in your pipeline says so until an upgrade fails. Paste a file and find out where you stand.
We run this on ourselves
46 of our 183 modules are locked out of a newer provider major right now, across 25 providers we watch.
- hashicorp/azurerm allows 4.81.0 → 5.1.0 is out (36 modules)
- linode/linode allows 3.14.1 → 4.3.0 is out (9 modules)
- hashicorp/azurerm allows 4.81.0 → 5.1.0 is out (1 module)
Same parser, same registry lookups, same rule as the scan below — no friendlier version for ourselves.
What this reports, and what it doesn't
Only lockout— a constraint that excludes the provider's newest release. A provider publishing a patch you already allow needs no human: your next tofu init picks it up. That distinction is the whole point; reporting every available bump is the noise that makes upgrade bots ignorable.
If part of your file can't be read, or a registry can't be reached, the scan says so and refuses to show an all-clear. A file we only half understood looks exactly like a healthy one, and that is the failure worth designing against.
Nothing you paste is stored — not in a row, not in a log, not in an error report. It describes your infrastructure, and it is none of our business. We keep a count of which providers and constraints were checked, which is how we decide what to test next.