SECURITY ADVISORIES: When using either a remote-exec or file provisioner to connect to an attacker-controlled SSH server, the server could previously deadlock the connection by sending certain unexpected packet types. (#4551) This addresses the upstream Go security advisories CVE-2026-78662 and CVE-2026-56855.
BUG FIXES: tofu show -json <planfile> now works again when ephemeral resources are present in the configuration. (4623). Ephemeral output values are now always re-evaluated during the apply phase, instead of sometimes using stale values from the planning phase. (#4582)
OpenTofu 1.13.0 We're proud to announce that OpenTofu 1.13.0 is now officially available! 🎉 Highlights Windows on ARM64 is now a supported platform Starting with OpenTofu v1.13.0 we are now offering official packages targeting Windows on the ARM64 (also known as "aarch64") CPU architecture. Reducing unknowns during planning OpenTofu v1.13 introduces a number of new functions that are all intended…
The v1.13.x release series is supported until August 1 2027. 1.13.0 (Unreleased) UPGRADE NOTES: The "winrm" connection type for provisioners is no longer supported. (#4012) This connection type was deprecated in OpenTofu v1.12, and now removed in v1.13. Some of the upstream libraries OpenTofu was using to implement these features are no longer maintained, so it's not viable for us to offer this an…
The v1.13.x release series is supported until August 1 2027. 1.13.0 (Unreleased) UPGRADE NOTES: The "winrm" connection type for provisioners is no longer supported. (#4012) This connection type was deprecated in OpenTofu v1.12, and now removed in v1.13. Some of the upstream libraries OpenTofu was using to implement these features are no longer maintained, so it's not viable for us to offer this an…
SECURITY ADVISORIES: When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#4422) When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could…
SECURITY ADVISORIES: When interacting with OCI Distribution registries for module or provider package installation, previous versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#4423) When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu coul…
SECURITY ADVISORIES: Previous releases in the v1.12 series could be affected by several vulnerabilities: The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used. Thi…
SECURITY ADVISORIES: Previous releases in the v1.11 series could be affected by several vulnerabilities: The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used. Thi…
BUG FIXES: tofu plan -out no longer fails when the plan includes a resource with lifecycle { destroy = false } that needs replacement, which previously errored with invalid change action ForgetThenCreate. (#4324) Moved block now correctly compares provider source addresses. (#4280)[https://github.com//pull/4280] Correct Source Provider Address now passed into Provider MoveResource requests. (#4355…
BUG FIXES: Moved block now correctly compares provider source addresses. (#4280)[https://github.com//pull/4280] Correct Source Provider Address now passed into Provider MoveResource requests. (#4355)[https://github.com//pull/4355] Full Changelog: v1.11.11...v1.11.12
BUG FIXES: Fixes an incomplete OTEL dependencies upgrade from the previous patch release. (#4303) Full Changelog: v1.11.10...v1.11.11
BUG FIXES: Properly handle TF_ENCRYPTION with only blank spaces. (#4265) The value resulted from the lifecycle.enabled evaluation now has its deprecation marks processed correctly (#4162) Update documentation to clarify the usage restriction of ephemeral values in lifecycle.enabled. (#4220) tofu console -lock=false now works as intended. (#4291) SECURITY ADVISORIES: Previous releases in the v1.12…
BUG FIXES: Update documentation to clarify the usage restriction of ephemeral values in lifecycle.enabled. (#4220) SECURITY ADVISORIES: Previous releases in the v1.11 series could read an arbitrary file during certain git operations via a maliciously crafted URL (#4292). Advisory: GHSA-q7j3-v8qv-22vq Full Changelog: v1.11.9...v1.11.10
1.11.9 SECURITY ADVISORIES: Previous releases in the v1.11 series could be affected by several vulnerabilities: ssh usage through OpenTofu generate hangs or panics. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @Revoked. This is fixed now by (#4145) If for state encryption, OpenBao key pro…
1.12.2 SECURITY ADVISORIES: Previous releases in the v1.12 series could be affected by several vulnerabilities: If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted. This is fixed now by (#4177) Previous releases in the v1.12 series could be affected by several vulnerabilities:…
SECURITY ADVISORIES: Previous releases in the v1.12 series could be affected by several vulnerabilities: ssh usage through OpenTofu generate hangs or panics. Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked. This is fixed now by (#4145) BUG FIXES: Address a bug introduced in v1.12.0…
OpenTofu 1.12.0 We're proud to announce that OpenTofu 1.12.0 is now officially available! 🎉 Highlights This release cycle introduces major new capabilities and integrations: Dynamic prevent_destroy OpenTofu v1.12.0 now allows prevent_destroy to be defined dynamically in terms of other values available elsewhere in the same module. For example: variable "prevent_destroy_database" { type = bool defa…
SECURITY ADVISORIES: Previous releases in the v1.11 series could potentially take an excessive amount of time and send extraneous data to an HTTP2 server that specifies a maximum frame size of zero. This is now fixed. (#4094) An attacker that can coerce an operator to install a dependency from an attacker-controlled server could use this to cause unexpected resource consumption during tofu init. F…
BUG FIXES: When installing provider packages into a local cache directory, the installer will now return an error if a conflicting entry is already present in the cache that doesn't match the expected checksum. Previously OpenTofu would just silently write over the existing entry in that case. (#4082) Full Changelog: v1.11.6...v1.11.7
BUG FIXES: When installing provider packages into a local cache directory, the installer will now return an error if a conflicting entry is already present in the cache that doesn't match the expected checksum. Previously OpenTofu would just silently write over the existing entry in that case. (#4082) Fixed provider-defined functions in import block id expressions causing "BUG: Uninitialized funct…