A platform team maintains a Terraform 1.6 root module for AWS. The module has recently been changed to require the AWS provider version ~> 5.0 instead of ~> 4.0:

terraform {
  required_providers {
    aws = {
      source  = "hashicorp/aws"
      version = "~> 5.0"
    }
  }
}

The repository already contains a committed .terraform.lock.hcl file that pins hashicorp/aws to a 4.x version. A CI job runs terraform init and then terraform plan, but init fails because the locked provider version does not satisfy the new constraint.

The team wants CI to update the dependency selections to versions allowed by the current configuration while still using the normal provider installation workflow. Which command should the CI job run?