Renovate can update Terraform modules, providers, required_providers entries, helm_release charts and container images named in several resource types, plus the lock file and Helm Chart.yaml dependencies. By default it does not pin Terraform image digests. Review what it opens, because an automatic pull request is still a change to production.
Files it reads
According to the Renovate documentation, the Terraform manager checks files ending in .tf and .tofu. The Helm v3 manager checks Chart.yaml files. Both can be extended with file patterns if your repository uses other names.
What the Terraform manager extracts
The documentation lists dependency types, which tell you what gets noticed:
| Type | What it is |
|---|---|
| module | A module source reference |
| provider, required_provider | Providers in provider or required_providers blocks |
| required_version | The Terraform version constraint |
| helm_release | A Helm chart deployed through a helm_release resource |
| docker_image and related | Images in Docker provider resources |
| kubernetes_* resources | Container images in pod, deployment, job and similar resources |
Supported data sources include Git tags, GitHub releases and tags, Bitbucket tags, Docker, Helm, the Terraform module registry and the Terraform provider registry. It also supports lock file maintenance for the .terraform.lock.hcl file, which Renovate does itself.
That list shows how far infrastructure dependencies spread. An image tag inside a Kubernetes resource written in Terraform is a dependency, and so is a chart in a helm_release.
What the Helm manager covers
For Helm v3 the docs list docker and helm data sources. Chart repository aliases such as stable need a registry alias setting so Renovate can find the repository. Private repositories and OCI registries need host rules with credentials. The manager also has options for subchart archives and OCI charts, which matter if you commit packaged dependencies.
Defaults worth knowing
The Terraform manager default config has pinDigests set to false. So image references stay as tags unless you turn pinning on. If your policy is digest pinning, enable it for those managers deliberately and test how your reviewers read the resulting pull requests.
Settings to consider
- Group provider updates so one pull request shows the whole set.
- Turn on lock file maintenance so checksums in the lock file stay current.
- Require manual merge for major provider versions.
- Keep Terraform version updates separate from provider updates.
- Use host rules with least privilege tokens for private modules and registries.
- Label infrastructure pull requests so the right reviewers see them.
Combine this with required status checks, for example a plan and a scan, before merge. See also Dependabot for Terraform modules and providers for the other common option.
Limits to remember
An updater tells you a newer version exists. It does not judge whether it is safe. A release can be yanked, can break a plan, or can change defaults. Treat the pull request as a prompt to review release notes and run a plan, not as a pre-approved change.
Also note that automation tokens can themselves be a risk. A token able to merge to the infrastructure repository should be scoped, rotated and audited.
Where a scanner fits
A bot proposes updates, and a scanner tells you which ones matter. Safeguard's dependency scanning, reachability analysis and fix pull requests (off by default, with every category on Manual) can help you decide what to take first, and policy gates can hold risky updates. Check which infrastructure file types your scanner reads. Free scan: gold.safeguard.sh/scan.
Try it yourself
Click through it at your own pace, or open it full screen.
See how a fix proposal arrives as a reviewable change, rather than a silent update.
Quick check
Does Renovate pin Terraform image digests by default?
No. The documented default config for the Terraform manager sets pinDigests to false.
Can Renovate update the Terraform lock file?
Yes. The documentation says the manager supports lock file maintenance for .terraform.lock.hcl.
Sources
Last reviewed: 19 October 2026.
