Update dependency hashicorp/terraform to v1.14.2

[renovate]

This PR contains the following updates:

Package	Update	Change
hashicorp/terraform	minor	1.13.2 -> 1.14.2

---

Release Notes

hashicorp/terraform (hashicorp/terraform)

v1.14.2

Compare Source

v1.14.1

Compare Source

1.14.1 (December 3, 2025)

BUG FIXES:

• test: allow ephemeral outputs in root modules (#​37813)

• Combinations of replace_triggered_by and -replace could result in some instances not being replaced (#​37833)

• providers lock: include providers required by terraform test (#​37851)

• Set state information in the proto request for the GenerateResourceConfig RPC (#​37896)

• actions: make after_create & after_update actions run after the resource has applied (#​37936)

v1.14.0

Compare Source

1.14.0 (November 19, 2025)

NEW FEATURES:

• List Resources: List resources can be defined in *.tfquery.hcl files and allow querying and filterting existing infrastructure.

• A new Terraform command terraform query: Executes list operations against existing infrastructure and displays the results. The command can optionally generate configuration for importing results into Terraform.

• A new GenerateResourceConfiguration RPC allows providers to create more precise configuration values during import. (#​37515)

• New top-level Actions block: Actions are provider defined and meant to codify use cases outside the normal CRUD model in your Terraform configuration. Providers can define Actions like aws_lambda_invoke or aws_cloudfront_create_invalidation that do something imparative outside of Terraforms normal CRUD model. You can configure such a side-effect with an action block and have actions triggered through the lifecycle of a resource or through passing the -invoke CLI flag. (#​37553)

ENHANCEMENTS:

• terraform test: expected diagnostics will be included in test output when running in verbose mode" (#​37362)

• terraform test: ignore prevent_destroy attribute during when cleaning up tests" (#​37364)

• terraform stacks command support for -help flag (#​37645)

• query: support offline validation of query files via -query flag in the validate command (#​37671)

• Updates to support the AWS European Sovereign Cloud (#​37721)

BUG FIXES:

• Retrieve all workspace variables while doing a terraform import, include variables inherited from variable sets but not overwritten by the workspace. (#​37241)

• Fix OSS backend proxy support by adding a proxy layer for OSS backend operations. Resolves #​36897. (#​36897)

• console and test: return explicit diagnostics when referencing resources that were not included in the most recent operation. (#​37663)

• query: generate unique resource identifiers for results of expanded list resources (#​37681)

• The CLI now summarizes the number of actions invoked during terraform apply, matching the plan output. (#​37689)

• Allow filesystem functions to return inconsistent results when evaluated within provider configuration (#​37854)

• query: improve error handling for missing identity schemas (#​37863)

UPGRADE NOTES:

• The parallelism of Terraform operations within container runtimes may be reduced depending on the CPU bandwidth limit setting. (#​37436)

• Building Terraform 1.14 requires macOS Monterey or later (due to being built on Go 1.25 which imposes these requirements) (#​37436)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

v1.13.5

Compare Source

1.13.5 (November 5, 2025)

BUG FIXES:

• impure functions could cause templatefile to incorrectly fail consistency checks (#​37807)

• Allow filesystem functions to return inconsistent results when evaluated within provider configuration (#​37854)

v1.13.4

Compare Source

1.13.4 (October 15, 2025)

BUG FIXES:

• Fix crash when showing a cloud plan without having a cloud backend (#​37751)

v1.13.3

Compare Source

1.13.3 (September 17, 2025)

BUG FIXES:

• variable validation: keep sensitive and ephemeral metadata when evaluating variable conditions. (#​37595)

---

Configuration

📅 Schedule: Branch creation - "after 7am and before 11am every weekday" in timezone Europe/London, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hmcts-jenkins-a-to-c]

Plan Result (aat)

Plan: 0 to add, 5 to change, 0 to destroy.

• Update
  • azurerm_key_vault_secret.flexible_secret_standard_format["DATABASE"]
  • azurerm_key_vault_secret.flexible_secret_standard_format["HOST"]
  • azurerm_key_vault_secret.flexible_secret_standard_format["PASS"]
  • azurerm_key_vault_secret.flexible_secret_standard_format["PORT"]
  • azurerm_key_vault_secret.flexible_secret_standard_format["USER"]

Change Result (Click me)

  # azurerm_key_vault_secret.flexible_secret_standard_format["DATABASE"] will be updated in-place
  ~ resource "azurerm_key_vault_secret" "flexible_secret_standard_format" {
      ~ expiration_date         = "2027-12-11T11:05:38Z" -> (known after apply)
        id                      = "https://bulk-scan-aat.vault.azure.net/secrets/processor-POSTGRES-DATABASE/ff57b9039f9544be979c275eb31b0769"
        name                    = "processor-POSTGRES-DATABASE"
        tags                    = {
            "application"         = "bulk-scan-print"
            "autoShutdown"        = "true"
            "builtFrom"           = "https://github.com/HMCTS/bulk-scan-processor.git"
            "businessArea"        = "CFT"
            "contactSlackChannel" = "#rbs"
            "environment"         = "staging"
            "managedBy"           = "Bulk Scanning and Printing"
            "source"              = "processor PostgreSQL"
        }
        # (9 unchanged attributes hidden)
    }

  # azurerm_key_vault_secret.flexible_secret_standard_format["HOST"] will be updated in-place
  ~ resource "azurerm_key_vault_secret" "flexible_secret_standard_format" {
      ~ expiration_date         = "2027-12-11T11:05:38Z" -> (known after apply)
        id                      = "https://bulk-scan-aat.vault.azure.net/secrets/processor-POSTGRES-HOST/2dc8dc1977504071bd90e0c4b8a591fe"
        name                    = "processor-POSTGRES-HOST"
        tags                    = {
            "application"         = "bulk-scan-print"
            "autoShutdown"        = "true"
            "builtFrom"           = "https://github.com/HMCTS/bulk-scan-processor.git"
            "businessArea"        = "CFT"
            "contactSlackChannel" = "#rbs"
            "environment"         = "staging"
            "managedBy"           = "Bulk Scanning and Printing"
            "source"              = "processor PostgreSQL"
        }
        # (9 unchanged attributes hidden)
    }

  # azurerm_key_vault_secret.flexible_secret_standard_format["PASS"] will be updated in-place
  ~ resource "azurerm_key_vault_secret" "flexible_secret_standard_format" {
      ~ expiration_date         = "2027-12-11T11:05:38Z" -> (known after apply)
        id                      = "https://bulk-scan-aat.vault.azure.net/secrets/processor-POSTGRES-PASS/f96764ee7960495181d327706327af90"
        name                    = "processor-POSTGRES-PASS"
        tags                    = {
            "application"         = "bulk-scan-print"
            "autoShutdown"        = "true"
            "builtFrom"           = "https://github.com/HMCTS/bulk-scan-processor.git"
            "businessArea"        = "CFT"
            "contactSlackChannel" = "#rbs"
            "environment"         = "staging"
            "managedBy"           = "Bulk Scanning and Printing"
            "source"              = "processor PostgreSQL"
        }
        # (9 unchanged attributes hidden)
    }

  # azurerm_key_vault_secret.flexible_secret_standard_format["PORT"] will be updated in-place
  ~ resource "azurerm_key_vault_secret" "flexible_secret_standard_format" {
      ~ expiration_date         = "2027-12-11T11:05:38Z" -> (known after apply)
        id                      = "https://bulk-scan-aat.vault.azure.net/secrets/processor-POSTGRES-PORT/e6b64e0e09e54e39828f8891d838e308"
        name                    = "processor-POSTGRES-PORT"
        tags                    = {
            "application"         = "bulk-scan-print"
            "autoShutdown"        = "true"
            "builtFrom"           = "https://github.com/HMCTS/bulk-scan-processor.git"
            "businessArea"        = "CFT"
            "contactSlackChannel" = "#rbs"
            "environment"         = "staging"
            "managedBy"           = "Bulk Scanning and Printing"
            "source"              = "processor PostgreSQL"
        }
        # (9 unchanged attributes hidden)
    }

  # azurerm_key_vault_secret.flexible_secret_standard_format["USER"] will be updated in-place
  ~ resource "azurerm_key_vault_secret" "flexible_secret_standard_format" {
      ~ expiration_date         = "2027-12-11T11:05:38Z" -> (known after apply)
        id                      = "https://bulk-scan-aat.vault.azure.net/secrets/processor-POSTGRES-USER/9f01ce8315674da5994d66e4761258b7"
        name                    = "processor-POSTGRES-USER"
        tags                    = {
            "application"         = "bulk-scan-print"
            "autoShutdown"        = "true"
            "builtFrom"           = "https://github.com/HMCTS/bulk-scan-processor.git"
            "businessArea"        = "CFT"
            "contactSlackChannel" = "#rbs"
            "environment"         = "staging"
            "managedBy"           = "Bulk Scanning and Printing"
            "source"              = "processor PostgreSQL"
        }
        # (9 unchanged attributes hidden)
    }

Plan: 0 to add, 5 to change, 0 to destroy.

[hmcts-jenkins-a-to-c]

Plan Result (prod)

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 2 to add, 5 to change, 1 to destroy.

• Create
  • module.postgresql.null_resource.set-user-permissions-additionaldbs["bulk_scan"]
• Update
  • azurerm_key_vault_secret.flexible_secret_standard_format["DATABASE"]
  • azurerm_key_vault_secret.flexible_secret_standard_format["HOST"]
  • azurerm_key_vault_secret.flexible_secret_standard_format["PASS"]
  • azurerm_key_vault_secret.flexible_secret_standard_format["PORT"]
  • azurerm_key_vault_secret.flexible_secret_standard_format["USER"]
• Replace
  • module.postgresql.azurerm_postgresql_flexible_server_active_directory_administrator.pgsql_adadmin

Change Result (Click me)

  # azurerm_key_vault_secret.flexible_secret_standard_format["DATABASE"] will be updated in-place
  ~ resource "azurerm_key_vault_secret" "flexible_secret_standard_format" {
      ~ expiration_date         = "2027-12-11T11:08:46Z" -> (known after apply)
        id                      = "https://bulk-scan-prod.vault.azure.net/secrets/processor-POSTGRES-DATABASE/8d2709eb815247cfbd969e34ec1b803b"
        name                    = "processor-POSTGRES-DATABASE"
        tags                    = {
            "application"         = "bulk-scan-print"
            "builtFrom"           = "https://github.com/HMCTS/bulk-scan-processor.git"
            "businessArea"        = "CFT"
            "contactSlackChannel" = "#rbs"
            "environment"         = "production"
            "managedBy"           = "Bulk Scanning and Printing"
            "source"              = "processor PostgreSQL"
        }
        # (9 unchanged attributes hidden)
    }

  # azurerm_key_vault_secret.flexible_secret_standard_format["HOST"] will be updated in-place
  ~ resource "azurerm_key_vault_secret" "flexible_secret_standard_format" {
      ~ expiration_date         = "2027-12-11T11:08:46Z" -> (known after apply)
        id                      = "https://bulk-scan-prod.vault.azure.net/secrets/processor-POSTGRES-HOST/22b5cad58cd6486ab11e901432abbbc4"
        name                    = "processor-POSTGRES-HOST"
        tags                    = {
            "application"         = "bulk-scan-print"
            "builtFrom"           = "https://github.com/HMCTS/bulk-scan-processor.git"
            "businessArea"        = "CFT"
            "contactSlackChannel" = "#rbs"
            "environment"         = "production"
            "managedBy"           = "Bulk Scanning and Printing"
            "source"              = "processor PostgreSQL"
        }
        # (9 unchanged attributes hidden)
    }

  # azurerm_key_vault_secret.flexible_secret_standard_format["PASS"] will be updated in-place
  ~ resource "azurerm_key_vault_secret" "flexible_secret_standard_format" {
      ~ expiration_date         = "2027-12-11T11:08:46Z" -> (known after apply)
        id                      = "https://bulk-scan-prod.vault.azure.net/secrets/processor-POSTGRES-PASS/408559177e444d13b97a8dd3a30d1d01"
        name                    = "processor-POSTGRES-PASS"
        tags                    = {
            "application"         = "bulk-scan-print"
            "builtFrom"           = "https://github.com/HMCTS/bulk-scan-processor.git"
            "businessArea"        = "CFT"
            "contactSlackChannel" = "#rbs"
            "environment"         = "production"
            "managedBy"           = "Bulk Scanning and Printing"
            "source"              = "processor PostgreSQL"
        }
        # (9 unchanged attributes hidden)
    }

  # azurerm_key_vault_secret.flexible_secret_standard_format["PORT"] will be updated in-place
  ~ resource "azurerm_key_vault_secret" "flexible_secret_standard_format" {
      ~ expiration_date         = "2027-12-11T11:08:46Z" -> (known after apply)
        id                      = "https://bulk-scan-prod.vault.azure.net/secrets/processor-POSTGRES-PORT/2cb775893a054a92aee474f5e676c2ef"
        name                    = "processor-POSTGRES-PORT"
        tags                    = {
            "application"         = "bulk-scan-print"
            "builtFrom"           = "https://github.com/HMCTS/bulk-scan-processor.git"
            "businessArea"        = "CFT"
            "contactSlackChannel" = "#rbs"
            "environment"         = "production"
            "managedBy"           = "Bulk Scanning and Printing"
            "source"              = "processor PostgreSQL"
        }
        # (9 unchanged attributes hidden)
    }

  # azurerm_key_vault_secret.flexible_secret_standard_format["USER"] will be updated in-place
  ~ resource "azurerm_key_vault_secret" "flexible_secret_standard_format" {
      ~ expiration_date         = "2027-12-11T11:08:46Z" -> (known after apply)
        id                      = "https://bulk-scan-prod.vault.azure.net/secrets/processor-POSTGRES-USER/a52d84d0f7ea4178a5c0231ee4c2a71f"
        name                    = "processor-POSTGRES-USER"
        tags                    = {
            "application"         = "bulk-scan-print"
            "builtFrom"           = "https://github.com/HMCTS/bulk-scan-processor.git"
            "businessArea"        = "CFT"
            "contactSlackChannel" = "#rbs"
            "environment"         = "production"
            "managedBy"           = "Bulk Scanning and Printing"
            "source"              = "processor PostgreSQL"
        }
        # (9 unchanged attributes hidden)
    }

  # module.postgresql.azurerm_postgresql_flexible_server_active_directory_administrator.pgsql_adadmin must be replaced
-/+ resource "azurerm_postgresql_flexible_server_active_directory_administrator" "pgsql_adadmin" {
      ~ id                  = "/subscriptions/8999dec3-0104-4a27-94ee-6588559729d1/resourceGroups/bulk-scan-processor-flexible-postgres-db-v15-data-prod/providers/Microsoft.DBforPostgreSQL/flexibleServers/bulk-scan-processor-flexible-postgres-db-v15-prod/administrators/4d0554dd-fe60-424a-be9c-36636826d927" -> (known after apply)
      ~ object_id           = "4d0554dd-fe60-424a-be9c-36636826d927" -> "ef17f368-0aa5-43d5-9264-28080f83755e" # forces replacement
      ~ principal_name      = "DTS Platform Operations SC" -> "DTS Platform Operations PostgreSQL Admin Access SC" # forces replacement
        # (4 unchanged attributes hidden)
    }

  # module.postgresql.null_resource.set-user-permissions-additionaldbs["bulk_scan"] will be created
  + resource "null_resource" "set-user-permissions-additionaldbs" {
      + id       = (known after apply)
      + triggers = {
          + "db_reader_schemas" = "public"
          + "db_reader_user"    = "DTS JIT Access bulk-scan DB Reader SC"
          + "force_trigger"     = "1"
          + "name"              = "bulk-scan-processor-flexible-postgres-db-v15"
          + "script_hash"       = "88abfc1a97fc27a8f4d01362525f3b65e85409d3a475ecc79b11ad09a019e469"
        }
    }

Plan: 2 to add, 5 to change, 1 to destroy.