Hold the cloudflare provider at 5.25.0: 5.26.0 plans 23 DNS record writes that fail upstream #35

New issue

Open

opened 2026-09-29 18:40:44 +00:00 by hutao · 0 comments

hutao commented

2026-09-29 18:40:44 +00:00

Owner

The Dependency Dashboard (#31) offers terraform cloudflare to v5.26.0. It was left out of chore/updates on purpose.

What 5.26.0 does to this workspace

tofu init -upgrade to 5.26.0, then tofu plan: 0 to add, 23 to change, 0 to destroy. Every cloudflare_dns_record shows one line:

+ include_shadow_metadata = false

In the provider source at v5.26.0 (internal/services/dns_record/), the new attribute is Optional + Computed with booldefault.StaticBool(false). Read never fills it in (normalizeIncludeShadowMetadata runs only on import), so state keeps null and config wants false. The field is only a query parameter (query:"include_shadow_metadata"), so the records themselves would not change. But Update is a PUT, so applying means 23 record writes, and two open upstream bugs say those writes fail:

cloudflare/terraform-provider-cloudflare#7387: Provider produced inconsistent result after apply on modified_on, for every record.
cloudflare/terraform-provider-cloudflare#7396: a hard 400, code 1046, on records managed by Email Routing. cf2024-1._domainkey (module.dns.cloudflare_dns_record.dkim_cloudflare) is Cloudflare's own DKIM selector and may be one of those. If it is, the workspace cannot apply at all.

On 5.25.0 the plan is No changes.

To do

Leave the lock on 5.25.0.
Take the bump once a release fixes both bugs. Recheck: after tofu init -upgrade, the plan must be 0/0/0 and not show the 23 include_shadow_metadata lines.

The Dependency Dashboard (#31) offers `terraform cloudflare to v5.26.0`. It was left out of `chore/updates` on purpose. ## What 5.26.0 does to this workspace `tofu init -upgrade` to 5.26.0, then `tofu plan`: **0 to add, 23 to change, 0 to destroy**. Every `cloudflare_dns_record` shows one line: ``` + include_shadow_metadata = false ``` In the provider source at `v5.26.0` (`internal/services/dns_record/`), the new attribute is `Optional` + `Computed` with `booldefault.StaticBool(false)`. `Read` never fills it in (`normalizeIncludeShadowMetadata` runs only on import), so state keeps `null` and config wants `false`. The field is only a query parameter (`query:"include_shadow_metadata"`), so the records themselves would not change. But `Update` is a `PUT`, so applying means 23 record writes, and two open upstream bugs say those writes fail: - [cloudflare/terraform-provider-cloudflare#7387](https://github.com/cloudflare/terraform-provider-cloudflare/issues/7387): `Provider produced inconsistent result after apply` on `modified_on`, for every record. - [cloudflare/terraform-provider-cloudflare#7396](https://github.com/cloudflare/terraform-provider-cloudflare/issues/7396): a hard `400`, code 1046, on records managed by Email Routing. `cf2024-1._domainkey` (`module.dns.cloudflare_dns_record.dkim_cloudflare`) is Cloudflare's own DKIM selector and may be one of those. If it is, the workspace cannot apply at all. On 5.25.0 the plan is `No changes`. ## To do - Leave the lock on 5.25.0. - Take the bump once a release fixes both bugs. Recheck: after `tofu init -upgrade`, the plan must be 0/0/0 and not show the 23 `include_shadow_metadata` lines.

hutao referenced this issue from a commit

2026-09-29 19:10:32 +00:00

chore(deps): take the container updates from the dependency dashboard

hutao referenced this issue

2026-09-29 19:10:32 +00:00

chore(deps): clear the dependency dashboard #36

hutao added the