atmos vendor update

Check each Git-backed source in your vendor.yaml for a newer version — honoring any per-source constraints — and update the version field in place, preserving comments, anchors, and Go templates such as {{.Version}} in source URLs.

atmos vendor update --help

Usage

atmos vendor update [--check] [--pull] [--pull-request] [--group <name>] [--component <name>]... [--tags <a,b>] [--outdated] [--component-manifests]

Sources whose version is templated ({{...}}) or whose source is not a Git repository are skipped and reported. Updates are written to the file that declares each source, including imported manifests — a component declared in vendor.yaml has its spec.sources[].version updated, while a component resolved from a per-component component.yaml has its spec.source.version updated instead.

If --component isn't declared in vendor.yaml — or no vendor.yaml exists — Atmos falls back to the component's own component.yaml/component.yml manifest, matching atmos vendor pull's existing precedence: vendor.yaml wins whenever it declares the component. Without --component, a repo-wide sweep of every component.yaml found under each component type's base path runs automatically whenever no vendor.yaml exists — a repo that vendors exclusively via component.yaml works with no extra flag. Add --component-manifests to also run that sweep alongside an existing vendor.yaml (for repos that mix both manifest styles).

Examples

# Dry run: show what would be updated.
atmos vendor update --check

# Update all Git-backed sources.
atmos vendor update

# Update versions and then pull the new components.
atmos vendor update --pull

# Update one or more components, or by tags.
atmos vendor update --component vpc
atmos vendor update --component vpc --component eks
atmos vendor update --tags networking,aws

# Show only sources with an available update.
atmos vendor update --check --outdated

# Also sweep per-component component.yaml manifests alongside an existing vendor.yaml.
atmos vendor update --check --component-manifests

# Commit, push, and open (or update) a pull request with available updates.
atmos vendor update --pull-request

# Only update the named vendor.update.groups selection, and open a pull request for it.
atmos vendor update --group platform --pull-request

See Native Pull Requests for Vendored Component Updates for the full --pull-request workflow (the Component Updater), including CI wiring.

The --pull-request flag authenticates to GitHub using ATMOS_CI_GITHUB_TOKEN, ATMOS_PRO_GITHUB_TOKEN, GITHUB_TOKEN, or GH_TOKEN, in that order. A PR opened with the default GITHUB_TOKEN won't trigger downstream on: pull_request/on: push Actions workflows. GitHub excludes its own default token from re-triggering workflows. To get a token that does trigger downstream workflows, pair the Component Updater with the github/sts auth integration (see also Just-in-time GitHub tokens for CI with Atmos Pro STS). Run atmos auth exec --identity <github-sts-identity> -- atmos vendor update --pull-request. This mints a real GitHub App installation token and exports it as ATMOS_PRO_GITHUB_TOKEN. The Component Updater picks up this token automatically.

Version constraints

Per-source constraints control which upstream versions are eligible:

sources:
  - component: "vpc"
    source: "github.com/cloudposse/terraform-aws-components"
    version: "1.323.0"
    constraints:
      version: "^1.0.0"            # semver constraint (Masterminds/semver)
      excluded_versions:
        - "1.2.3"                  # a specific bad version
        - "1.5.*"                  # an entire broken series
      no_prereleases: true         # skip alpha/beta/rc

Flags

--check

Dry run: show available updates without modifying any files.

--pull

After updating versions, run atmos vendor pull.

--all

Update all discoverable vendor sources. This is the default when you give no --component, --tags, or --group selector.

--component / -c (string, repeatable)

Update only these components. Repeat the flag to select more than one (--component vpc --component eks).

--tags (string)

Update only components carrying any of these comma-separated tags.

--group (string)

Update only the named vendor.update.groups selection.

--pull-request

Commit, push, and create or update a pull request for the available updates. See Native Pull Requests for Vendored Component Updates.

--outdated

Show only sources with an available update.

--archived

Show only sources whose upstream repository is archived.

--format (string, default table)

Output format: table or json.

--type / -t (string, default terraform)

Component type (terraform, helmfile, or packer), used when falling back to a per-component component.yaml, or to restrict a --component-manifests sweep to one type.

--component-manifests

Also check per-component component.yaml manifests when a vendor.yaml is present (this sweep runs automatically when no vendor.yaml exists). Only applies when --component is not set.

--file (string, default ./vendor.yaml)

The vendor manifest to start from (imports are followed).

These flags apply only together with --pull. Atmos passes them through to atmos vendor pull:

--everything

Pull all components, not just the ones that were updated.

--dry-run

Simulate the pull without writing any files.

--refresh-lock

Refresh immutable vendor.lock.yaml entries from declared sources instead of failing on drift.

--lock-enforcement (string)

Override vendor.lock.enforcement for this run: strict, warn, or silent.

note

Version detection is supported for Git sources only (tags via git ls-remote), which covers GitHub, GitLab, Bitbucket, and self-hosted Git. OCI, S3, GCS, and HTTP sources are skipped. Private repositories are not yet supported.