shivering-isles/infrastructure-gitops

Watch

Fork 0

chore(deps): update dependency opentofu/opentofu to v1.12.6 #170

Open

botaniker wants to merge 1 commit from renovate/opentofu-opentofu-1.x into main

botaniker commented

2026-08-24 06:11:04 +00:00

Member

This PR contains the following updates:

Package	Update	Change	OpenSSF
opentofu/opentofu	minor	`v1.9.0` → `v1.12.6`

⚠️ Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

opentofu/opentofu (opentofu/opentofu)

`v1.12.6`

Compare Source

SECURITY ADVISORIES:

When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#4422)
When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. (#4472)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.5...v1.12.6

`v1.12.5`

Compare Source

SECURITY ADVISORIES:

Previous releases in the v1.12 series could be affected by several vulnerabilities:
- The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake,
  allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.
This is fixed now by (#4363)

BUG FIXES:

Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState (#4375)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.4...v1.12.5

`v1.12.4`

Compare Source

BUG FIXES:

tofu plan -out no longer fails when the plan includes a resource with lifecycle { destroy = false } that needs replacement, which previously errored with invalid change action ForgetThenCreate. (#4324)
Moved block now correctly compares provider source addresses. (#4280)[#4280]
Correct Source Provider Address now passed into Provider MoveResource requests. (#4355)[#4355]

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.3...v1.12.4

`v1.12.3`

Compare Source

BUG FIXES:

Properly handle TF_ENCRYPTION with only blank spaces. (#4265)
The value resulted from the lifecycle.enabled evaluation now has its deprecation marks processed correctly (#4162)
Update documentation to clarify the usage restriction of ephemeral values in lifecycle.enabled. (#4220)
tofu console -lock=false now works as intended. (#4291)

SECURITY ADVISORIES:

Previous releases in the v1.12 series could read an arbitrary file during certain git operations via a maliciously crafted URL (#4293)
- Advisory: https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.2...v1.12.3

`v1.12.2`

Compare Source

1.12.2

SECURITY ADVISORIES:

Previous releases in the v1.12 series could be affected by several vulnerabilities:
- If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted.
This is fixed now by (#4177)
Previous releases in the v1.12 series could be affected by several vulnerabilities:
- When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
- If using an attacker-controlled server to run tofu against, it might end up in high CPU consumption.
These are now fixed by (#4247)

BUG FIXES:

Properly handle EDEADLK during provider installation. On Unix systems, the kernel may erroneously detect a deadlock between tofu processes using the global plugin cache. (#4166)
Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)
Prevent panic when using ephemeral resources during tofu test`. (#4254)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.1...v1.12.2

`v1.12.1`

Compare Source

SECURITY ADVISORIES:

Previous releases in the v1.12 series could be affected by several vulnerabilities:
- ssh usage through OpenTofu generate hangs or panics.
- Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
This is fixed now by (#4145)

BUG FIXES:

Address a bug introduced in v1.12.0 causing excessive memory usage by providers. (#4126)
Address a bug introduced in v1.12.0 where replace_triggered_by was validated incorrectly. (#4133
The Azure key provider will now accept the tenant_id, subscription_id, environment, and metadata_host variables; a bug previously only allowed these to be set through environment variables. (#4091)

Full Changelog: https://github.com/opentofu/opentofu/blob/v1.12/CHANGELOG.md

`v1.12.0`

Compare Source

OpenTofu 1.12.0

We're proud to announce that OpenTofu 1.12.0 is now officially available! 🎉

Highlights

This release cycle introduces major new capabilities and integrations:

Dynamic `prevent_destroy`

OpenTofu v1.12.0 now allows prevent_destroy to be defined dynamically in terms of other values available elsewhere in the same module. For example:

variable "prevent_destroy_database" {
  type    = bool
  default = true
}

resource "example_database" "example" {
  # ...

  lifecycle {
    prevent_destroy = var.prevent_destroy_database
  }
}

Provider Checksum Improvements

The default provider installation behavior in OpenTofu is designed to mostly "just work" by getting the needed providers installed and making the necessary changes to the dependency lock file, but in previous versions friction appeared for any teams using many of the non-default installation settings such as the shared provider plugin cache, or local mirrors of upstream providers.

For OpenTofu v1.12, OpenTofu Registry now provides a full set of official checksums in all of the checksum formats needed by other installation methods. This means that after running tofu init the dependency lock file will immediately have all of the information required to successfully use a global plugin cache directory and to verify matching packages served from a local mirror, without needing to run tofu providers lock separately.

Simultaneous Human-readable and Machine-readable Output

Many OpenTofu commands support both human-oriented UI output and machine-readable JSON output, but previously those commands could be run with only one or the other. This was bothersome for those implementing alternative UIs in terms of the machine-readable output because it meant they would need to implement all possible features of the UI before their tool could actually be used.

OpenTofu v1.12.0 introduces a new option -json-into=FILENAME, which produces the same output format that -json would have produced but sends that output to the given filename instead of to the standard output stream. The OpenTofu UI output then appears on the standard output stream as normal, so that software interpreting the JSON output can behave as just a supplement to the normal UI rather than a complete replacement.

New `destroy` lifecycle meta-argument

The new destroy = false lifecycle option for managed resources allows removing an object from the state without first destroying the remote object.

Deprecation Notices

WinRM for Provisioners is Now Deprecated

Some of the Go libraries that OpenTofu uses for WinRM connection support in provisioners have become unmaintained over time, and so unfortunately we are phasing out support for WinRM in OpenTofu starting with deprecation warnings in this release.

If your configuration includes a connection block with type = "winrm" then OpenTofu v1.12 will warn that this connection type is deprecated, but provisioning should otherwise still work as it did before.

We intend to remove WinRM support completely in the forthcoming OpenTofu v1.13 series, and so if you are currently relying on WinRM support we recommend that you begin planning to migrate to using OpenSSH for Windows instead.

Phasing Out Support for 32-bit CPU Architectures

We are also planning to stop producing official releases for 32-bit CPU architectures (386 and arm) in a future version of OpenTofu. Support for 64-bit architectures (amd64 and arm64) is unaffected.

OpenTofu v1.12 does not include any changes to CPU support yet, but we expect that the official builds in the forthcoming v1.13 series will begin producing warnings when running on 32-bit CPU architectures, before we stop producing those packages altogether in a future release series.

Compatibility Notes

macOS: Requires macOS 12 Monterey or later
The OPENTOFU_USER_AGENT environment variable, which allowed fully overriding the default User-Agent header on all HTTP requests, has been removed.
On Unix systems OpenTofu now considers the BROWSER environment variable as a possible override for the default behavior for launching a web browser. If you run OpenTofu in a context where an environment variable of that name is already set, it may cause OpenTofu to now open a web browser in a different way than previous versions would have. Unsetting that environment variable will restore the previous platform-specific behavior.

Reference

Thank you for your continued support and testing of the OpenTofu project!

`v1.11.14`

Compare Source

SECURITY ADVISORIES:

When interacting with OCI Distribution registries for module or provider package installation, previous versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#4423)
When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. (#4473)

[!NOTE]
This is the final patch release planned for the OpenTofu v1.11 series. We recommend upgrading to a newer release series as soon as possible.

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.13...v1.11.14

`v1.11.13`

Compare Source

SECURITY ADVISORIES:

Previous releases in the v1.11 series could be affected by several vulnerabilities:
- The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake,
  allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.
This is fixed now by (#4363)

BUG FIXES:

Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState (#4375)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.12...v1.11.13

`v1.11.12`

Compare Source

BUG FIXES:

Moved block now correctly compares provider source addresses. (#4280)[#4280]
Correct Source Provider Address now passed into Provider MoveResource requests. (#4355)[#4355]

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.11...v1.11.12

`v1.11.11`

Compare Source

BUG FIXES:

Fixes an incomplete OTEL dependencies upgrade from the previous patch release. (#4303)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.10...v1.11.11

`v1.11.10`

Compare Source

BUG FIXES:

Update documentation to clarify the usage restriction of ephemeral values in lifecycle.enabled. (#4220)

SECURITY ADVISORIES:

Previous releases in the v1.11 series could read an arbitrary file during certain git operations via a maliciously crafted URL (#4292).
- Advisory: https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.9...v1.11.10

`v1.11.9`

Compare Source

1.11.9

SECURITY ADVISORIES:

Previous releases in the v1.11 series could be affected by several vulnerabilities:
- ssh usage through OpenTofu generate hangs or panics.
- Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.
This is fixed now by (#4145)
If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted. (#4177)
Previous releases in the v1.11 series could be affected by several vulnerabilities:
- When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
- If using an attacker-controlled server to run tofu against, it might end up in high CPU consumption.
These are now fixed by (#4248)

BUG FIXES:

Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)
Prevent panic when using ephemeral resources during tofu test`. (#4254)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.8...v1.11.9

`v1.11.8`

Compare Source

SECURITY ADVISORIES:

Previous releases in the v1.11 series could potentially take an excessive amount of time and send extraneous data to an HTTP2 server that specifies a maximum frame size of zero. This is now fixed. (#4094)

An attacker that can coerce an operator to install a dependency from an attacker-controlled server could use this to cause unexpected resource consumption during tofu init.

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.7...v1.11.8

`v1.11.7`

Compare Source

BUG FIXES:

When installing provider packages into a local cache directory, the installer will now return an error if a conflicting entry is already present in the cache that doesn't match the expected checksum. Previously OpenTofu would just silently write over the existing entry in that case. (#4082)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.6...v1.11.7

`v1.11.6`

Compare Source

BUG FIXES:

Running tofu apply -refresh-only with a configuration that contains ephemeral resources does not fail anymore because the refresh produced changes (#3776)
Fixed tofu init crashing when a module version uses a variable and the module is referenced from a test file. (#3686)
Fixed provider-defined functions in import block id expressions causing "BUG: Uninitialized function provider" error. (#3803)
tofu test no longer fails during cleanup when using a mocked version of a resource type with write-only attributes. (#3964)
A malicious remote TLS server can no longer deadlock OpenTofu by sending multiple key update messages in a single record. (#3966)
When installing module packages from "tar" archives, OpenTofu now accepts only a limited number of sparse file entries to avoid unbounded memory usage from maliciously-crafted archives containing many sparse regions. (#3966)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.5...v1.11.6

`v1.11.5`

Compare Source

BUG FIXES:

Add universe_domain option in the gcs backend to support sovereign GCP services (#3758)
The azurerm backend's MSI authentication method will now respect the provided client ID (#3586)
Using a network mirror for the providers source does not print debug logs without being asked for (#3736)

Full Changelog: https://github.com/opentofu/opentofu/blob/67fe9db49b7dafd46470cf9ac7f437aaa95f5c40/CHANGELOG.md

`v1.11.4`

Compare Source

SECURITY ADVISORIES:

Previous releases in the v1.11 series could potentially take an excessive amount of time processing a maliciously-crafted .zip archive during either provider or module installation during tofu init. (#3689)

BREAKING CHANGES:

Modules containing local provider configurations now also reject the enabled argument, matching existing behavior for count, for_each, and depends_on. (#3680)

This was an oversight in the original design of the enabled feature and was missed during the review process. Although our goal is to not introduce breaking changes in patch releases, in some cases it may be warranted. Anyone who has used the enabled feature in this particular way will have unintentionally introduced a foot-gun into their infrastructure and should remedy it post-haste.

BUG FIXES:

In JSON syntax, the state encryption method configuration now allows specifying keys using both normal expression syntax and using template interpolation syntax. Previously only the template interpolation syntax was allowed, which was inconsistent with other parts of the encryption configuration. (#3654)
Providers are not configured anymore with DeferralAllowed capability of OpenTofu since having that created unwanted behaviour from some providers. (#3676)
Resources containing write-only attributes now are rendered consistently during planning. (#3667)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.3...v1.11.4

`v1.11.3`

Compare Source

BUG FIXES:

Fix crash when the executed configuration contains an import block that points to unexisting configuration block (#3616)
Fixed tofu test with mock_provider failing during cleanup when lifecycle { ignore_changes } references a block. (#3644)
Fixed state lock not being released when tofu apply is interrupted with Ctrl+C while using the HTTP backend. (#3624)
azure backend: resolve OIDC token dynamically to support ADO refresh. (#3594)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.2...v1.11.3

`v1.11.2`

Compare Source

UPGRADE NOTES:

The change from #2643, that was announced previously in v1.11.0, has been reverted in this release. OpenTofu will no longer directly recommend using the -exclude= option to work around problems caused by unknown values in provider configurations.

Unfortunately there are existing providers that spuriously report that they cannot plan due to unknown values even when planning would have been successful, and so we cannot rely on providers to accurately signal when unknown values are the cause of an error. Using -exclude is still a valid workaround for these problems even though OpenTofu cannot accurately detect when it's useful to make that suggestion.

BUG FIXES:

Fix crash in plan -generate-config-out with read-only nested attributes (#3553)
It's now possible again to plan changes with the hashicorp/helm and hashicorp/kubernetes providers when the provider configuration contains unknown values, as long as the configuration is carefully written to avoid the plan phase actually depending on those values. (#3592)
When running tofu init on Windows with an azurerm backend, the subscription_id is quoted correctly allowing successful authentication. (#3602)
Fix serialization error in apply when using cloud backend (#3611)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.1...v1.11.2

`v1.11.1`

Compare Source

BUG FIXES:

Fixed regression where import validation would incorrectly flag variables used in for_each statements within import blocks (#3564)
Fixed lifecycle enabled serialization in plan file (#3566)
Fixed regression when validating import.id expressions (#3567)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.0...v1.11.1

`v1.11.0`

Compare Source

OpenTofu 1.11.0

We're proud to announce that OpenTofu 1.11.0 is now officially available! 🎉

Highlights

This release cycle introduces major new capabilities and integrations:

Ephemeral Values and Write Only Attributes

Ephemeral resources allow you to work with confidential data, temporary credentials, and transient infrastructure without persisting them to your state.

ephemeral "aws_secretsmanager_random_password" "password" {

}

resource "kubernetes_secret_v1" "credentials" {
  metadata {
    name = "admin"
    namespace = "my-app"
  }
  data_wo = {
    username = "admin"
    password = ephemeral.aws_secretsmanager_random_password.password.random_password
  }

  data_wo_revision = 1
  type = "kubernetes.io/basic-auth"
}

The `enabled` Meta-Argument

If you want to conditionally deploy a resource, you no longer have to use count = var.create_my_resource ? 1 : 0, you can now add the new enabled meta-argument to your resource to conditionally deploy it.

resource "aws_instance" "web" {
  ami           = "ami-12345"
  instance_type = "t3.micro"

  lifecycle {
    enabled = var.create_instance  # Simple boolean condition
  }
}

Compatibility Notes

macOS: Requires macOS 12 Monterey or later
Azure Backend (azurerm):
- The endpoint and ARM_ENDPOINT configuration options are no longer supported
- The msi_endpoint and ARM_MSI_ENDPOINT options are no longer supported
- The environment and metadata_host arguments are now mutually exclusive
issensitive() Function: Now correctly returns unknown results when evaluating unknown values. Code that previously relied on the incorrect behavior may need updates.
Testing with Mocks: Mock values generated during testing now strictly adhere to provider schemas. Test configurations with invalid mock values will need to be corrected.
S3 Module Installation: When installing module packages from Amazon S3 buckets using S3 source addresses OpenTofu will use the same credentials as the AWS CLI and SDK.
TLS and SSH Security:
- SHA-1 signatures are no longer accepted for TLS or SSH connections
- SSH certificates must comply with the draft-miller-ssh-cert-03 specification
-var/-var-file during tofu apply <planfile>:
- Since ephemeral variables values cannot be saved into the plan, now we allow using -var/-var-file during tofu apply <planfile> to pass again the values for ephemeral variables during apply
- This new functionality allows -var/-var-file to be used with non-ephemeral variables too, but it will error if the values given for this type of variables is different from the ones given during the plan creation
- TF_VAR values should stay consistent between plan and apply <planfile> to avoid the errors mentioned above

Reference

Thank you for your continued support and testing of the OpenTofu project!

`v1.10.10`

Compare Source

BUG FIXES:

When installing provider packages into a local cache directory, the installer will now return an error if a conflicting entry is already present in the cache that doesn't match the expected checksum. Previously OpenTofu would just silently write over the existing entry in that case. (#4082)
Fixed provider-defined functions in import block id expressions causing "BUG: Uninitialized function provider" error. (#3803)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.10.9...v1.10.10

`v1.10.9`

Compare Source

SECURITY ADVISORIES:

This release contains fixes for some security advisories related to previous releases in this series.

No limit on number of query string arguments in net/url's ParseQuery
This release incorporates the upstream fixes for GO-2026-4341.
crypto/tls handling of multiple messages that span across encryption level boundaries
This release incorporates the upstream fixes for GO-2026-4340.

BUG FIXES:

Using a network mirror for the providers source does not print debug logs without being asked for (#3736)

Full Changelog: https://github.com/opentofu/opentofu/blob/0de30e8050bc32dfada2c4c978e736239e0ab265/CHANGELOG.md

`v1.10.8`

Compare Source

SECURITY ADVISORIES:

This release contains fixes for some security advisories related to previous releases in this series.

Incorrect handling of excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs

This release incorporates the upstream fixes for GO-2025-4175.
Excessive CPU usage when reporting error about crafted TLS certificate with many hostnames

This release incorporates the upstream fixes for GO-2025-4155.

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.10.7...v1.10.8

`v1.10.7`

Compare Source

SECURITY ADVISORIES:

This release contains fixes for some security advisories related to previous releases in this series.

tofu init in OpenTofu v1.10.6 and earlier could potentially use unbounded memory if there is a direct or indirect dependency on a maliciously-crafted module package distributed as a "tar" archive.

This would require the attacker to coerce a root module author to depend (directly or indirectly) on a module package they control, using the HTTP, Amazon S3, or Google Cloud Storage source types to refer to a tar archive.

This release incorporates the upstream fixes for CVE-2025-58183.
When making requests to HTTPS servers, OpenTofu v1.10.6 and earlier could potentially use unbounded memory or crash with a "panic" error if TLS verification involves an excessively-long certificate chain or a chain including DSA public keys.

This affected all outgoing HTTPS requests made by OpenTofu itself, including requests to HTTPS-based state storage backends, module registries, and provider registries. For example, an attacker could coerce a root module author to depend (directly or indirectly) on a module they control which then refers to a module or provider from an attacker-controlled registry. That mode of attack would cause failures in tofu init, at module or provider installation time.

Provider plugins contain their own HTTPS client code, which may have similar problems. OpenTofu v1.10.7 cannot address similar problems within provider plugins, and so we recommend checking for similar advisories and fixes in the provider plugins you use.

This release incorporates upstream fixes for CVE-2025-58185, CVE-2025-58187, and CVE-2025-58188.

BUG FIXES:

Fix crash in tofu test when using deprecated outputs (#3249)
Fix missing provider functions when parentheses are used (#3402)
for_each inside dynamic blocks can now call provider-defined functions. (#3429)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.10.6...v1.10.7

`v1.10.6`

Compare Source

1.10.6

UPGRADE NOTES:

Upgrade go from 1.24.4 to 1.24.6 to fix GO-2025-3849 (3127)
Upgrade github.com/openbao/openbao/api/v2 from 2.1.0 to 2.3.0 to fix GO-2025-3783 (3134)
- The upgrade is necessary to silence the security scanner and does not affect the actual state encryption provided by OpenBao.

BUG FIXES:

Variables with validation no longer interfere with the destroy process (#3131)
Fixed crash when processing multiple deprecated marks on a complex object (#3105)
When OpenTelemetry encounters errors, log it at the warning level instead of panic (#3235)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.10.5...v1.10.6

`v1.10.5`

Compare Source

BUG FIXES:

Fixed issue where usage of TF_PLUGIN_CACHE_DIR could result in unexpected lock contention errors (#3090)
- NOTE: It is still highly recommended to have valid .terraform.lock.hcl files in projects using TF_PLUGIN_CACHE_DIR

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.10.4...v1.10.5

`v1.10.4`

Compare Source

BUG FIXES:

Fixed crash where sensitive set values used in for_each could cause a panic. (#3070)
Fixed incorrect approach to mocking provider "ReadResource" calls in test. (#3068)
Reduced calls to ListKeys in azure backend (for rate limiting). (#3083)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.10.3...v1.10.4

`v1.10.3`

Compare Source

1.10.3

BUG FIXES:

OpenTofu will no longer crash in a rare case where a dynamically-invalid expression has its error suppressed by try or can and then that expression becomes relevant for deciding whether to report a "change outside of OpenTofu" in the human-oriented plan diff. (#2988)
Ensure provider downloads into temp are cleaned up correctly on windows. (#2843)
Correctly handle structural typed attributes during test provider mocking. (#2994)
Fix erroneous detection of changes with sensitive resource attributes. (#3024)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.10.2...v1.10.3

`v1.10.2`

Compare Source

1.10.2

S3 backend now correctly sends the x-amz-server-side-encryption header for the lockfile. (#2870)
A provider source address explicitly using the hostname registry.terraform.io will no longer cause errors related to a corresponding provider on registry.opentofu.org when executing workflow commands like plan and apply. (#2979)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.10.1...v1.10.2

`v1.10.1`

Compare Source

BUG FIXES:

Fix TF_APPEND_USER_AGENT handling in the S3 remote state backend. (#2955)

OTHER CHANGES:

OpenTofu is now built with Go 1.24.4, which should clear some false-positive indirect security advisories.

`v1.10.0`

Compare Source

OpenTofu 1.10.0

We're thrilled to announce the release of OpenTofu 1.10.0, our most comprehensive update yet! This release represents months of dedicated work from our community, introducing some fantastic features that will improve how OpenTofu users manage and distribute infrastructure as code.

Highlights

This release cycle introduces major new capabilities and integrations:

OCI Registry Support

Full integration with OCI registries for both provider and module distribution, valuable for organizations with private infrastructure-as-code components, air-gapped environments, or enhanced security requirements.


# Use OCI modules directly in your configuration (normal .tf files)
module "vpc" {
  source = "oci://example.com/modules/vpc/aws"
}


# Configure OCI registry mirrors in your CLI configuration (e.g. .tofurc)
provider_installation {
  oci_mirror {
    repository_template = "example.com/opentofu-providers/${namespace}/${type}"
    include             = ["registry.opentofu.org/*/*"]
  }
}

For more information, refer to Module Packages in OCI Registries and Provider Mirrors in OCI Registries.

Native S3 Locking

Simplify your infrastructure by using S3's conditional writes capability for state locking, eliminating the need for a separate DynamoDB table.

terraform {
  backend "s3" {
    bucket       = "tofu-state-backend"
    key          = "statefile"
    region       = "us-east-1"
    use_lockfile = true  # Enable native S3 locking
  }
}

OpenTelemetry Tracing

Gain insights into OpenTofu operations with experimental OpenTelemetry tracing, completely local and under your control.


# Launch a tracing backend like Jaeger
docker run -d --name jaeger \
  -p 16686:16686 -p 4317:4317 \
  jaegertracing/jaeger:2.5.0

# Configure OpenTofu to use OpenTelemetry
export OTEL_TRACES_EXPORTER=otlp
export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317
export OTEL_EXPORTER_OTLP_INSECURE=true

# Run your operations and view traces at http://localhost:16686
tofu init

Resource Management with Target Files

Manage complex deployments more easily with the new -target-file and -exclude-file options, allowing version-controlled resource targeting patterns.


# Create a targets.txt file
# Critical infrastructure components
module.networking.aws_vpc.main
module.networking.aws_subnet.public[*]


# Apply only those resources
tofu apply -target-file=targets.txt

# Similarly, create an excludes.txt file to skip certain resources
tofu plan -exclude-file=excludes.txt

Compatibility Notes

Linux: Requires kernel version 3.2 or later
macOS: Requires macOS 11 Big Sur or later
The ghcr.io/opentofu/opentofu image is no longer supported as a base image
Windows: Symbolic links and junctions are now handled differently
The PostgreSQL backend in OpenTofu 1.10 should not be used alongside older versions

Reference

`v1.9.4`

Compare Source

1.9.4

BUG FIXES:

Variables with validation no longer interfere with the destroy process (#3131)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.9.3...v1.9.4

`v1.9.3`

Compare Source

BUG FIXES:

Fixed incorrect approach to mocking provider "ReadResource" calls in test. (#3068)
Reduced calls to ListKeys in azure backend (for rate limiting). (#3083)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.9.2...v1.9.3

`v1.9.2`

Compare Source

1.9.2

BUG FIXES:

OpenTofu will no longer crash in a rare case where a dynamically-invalid expression has its error suppressed by try or can and then that expression becomes relevant for deciding whether to report a "change outside of OpenTofu" in the human-oriented plan diff. (#2988)
Ensure provider downloads into temp are cleaned up correctly on windows. (#2843)
Correctly handle structural typed attributes during test provider mocking. (#2994)
Fix erroneous detection of changes with sensitive resource attributes. (#3024)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.9.1...v1.9.2

`v1.9.1`

Compare Source

BUG FIXES:

Provider used in import is correctly identified. (#2336)
plantimestamp() now returns unknown value during validation (#2397)
Syntax error in the required_providers block does not panic anymore, but yields "syntax error" (2344)
Fix the error message when default value of a complex variable is containing a wrong type (2394)
Changing Go version to 1.22.11 in order to fix CVE-2024-45336 and CVE-2024-45341 (#2438)
Fix the way OpenTofu downloads a module that is sourced from a GitHub branch containing slashes in the name. (2396)
Changing Go version to 1.22.12 in order to fix CVE-2025-22866 and CVE-2024-45341 (#2438)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.9.0...v1.9.1

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot. The local configuration can be found in the SI Renovate Bot repository.

This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [opentofu/opentofu](https://github.com/opentofu/opentofu) | minor | `v1.9.0` → `v1.12.6` | [![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/opentofu/opentofu/badge)](https://securityscorecards.dev/viewer/?uri=github.com/opentofu/opentofu) | --- > ⚠️ **Warning** > > Some dependencies could not be looked up. Check the [Dependency Dashboard](issues/30) for more information. --- ### Release Notes <details> <summary>opentofu/opentofu (opentofu/opentofu)</summary> ### [`v1.12.6`](https://github.com/opentofu/opentofu/releases/tag/v1.12.6) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.12.5...v1.12.6) ##### SECURITY ADVISORIES: - When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. ([#4422](https://github.com/opentofu/opentofu/pull/4422)) - When interacting with an attacker-controlled remote state backend or provider/module registry, `tofu init` in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. ([#4472](https://github.com/opentofu/opentofu/pull/4472)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.12.5...v1.12.6> ### [`v1.12.5`](https://github.com/opentofu/opentofu/releases/tag/v1.12.5) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.12.4...v1.12.5) SECURITY ADVISORIES: - Previous releases in the v1.12 series could be affected by several vulnerabilities: - The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used. This is fixed now by ([#4363](https://github.com/opentofu/opentofu/pull/4363)) BUG FIXES: - Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState ([#4375](https://github.com/opentofu/opentofu/pull/4375)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.12.4...v1.12.5> ### [`v1.12.4`](https://github.com/opentofu/opentofu/releases/tag/v1.12.4) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.12.3...v1.12.4) BUG FIXES: - `tofu plan -out` no longer fails when the plan includes a resource with `lifecycle { destroy = false }` that needs replacement, which previously errored with `invalid change action ForgetThenCreate`. ([#4324](https://github.com/opentofu/opentofu/issues/4324)) - Moved block now correctly compares provider source addresses. ([#4280](https://github.com/opentofu/opentofu/issues/4280))\[[#4280](https://github.com/opentofu/opentofu/pull/4280)] - Correct Source Provider Address now passed into Provider MoveResource requests. ([#4355](https://github.com/opentofu/opentofu/issues/4355))\[[#4355](https://github.com/opentofu/opentofu/pull/4355)] **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.12.3...v1.12.4> ### [`v1.12.3`](https://github.com/opentofu/opentofu/releases/tag/v1.12.3) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.12.2...v1.12.3) ##### BUG FIXES: - Properly handle `TF_ENCRYPTION` with only blank spaces. ([#4265](https://github.com/opentofu/opentofu/pull/4265)) - The value resulted from the `lifecycle.enabled` evaluation now has its deprecation marks processed correctly ([#4162](https://github.com/opentofu/opentofu/pull/4162)) - Update documentation to clarify the usage restriction of ephemeral values in `lifecycle.enabled`. ([#4220](https://github.com/opentofu/opentofu/pull/4220)) - `tofu console -lock=false` now works as intended. ([#4291](https://github.com/opentofu/opentofu/pull/4291)) ##### SECURITY ADVISORIES: - Previous releases in the v1.12 series could read an arbitrary file during certain git operations via a maliciously crafted URL ([#4293](https://github.com/opentofu/opentofu/pull/4293)) - Advisory: <https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq> **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.12.2...v1.12.3> ### [`v1.12.2`](https://github.com/opentofu/opentofu/releases/tag/v1.12.2) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.12.1...v1.12.2) #### 1.12.2 SECURITY ADVISORIES: - Previous releases in the v1.12 series could be affected by several vulnerabilities: - If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted. This is fixed now by ([#4177](https://github.com/opentofu/opentofu/pull/4177)) - Previous releases in the v1.12 series could be affected by several vulnerabilities: - When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes. - If using an attacker-controlled server to run `tofu` against, it might end up in high CPU consumption. These are now fixed by ([#4247](https://github.com/opentofu/opentofu/pull/4247)) BUG FIXES: - Properly handle EDEADLK during provider installation. On Unix systems, the kernel may erroneously detect a deadlock between tofu processes using the global plugin cache. ([#4166](https://github.com/opentofu/opentofu/pull/4166)) - Fix race condition while handling closing signals during `tofu login`, both when the signal is sent by the user and when the browser fails to successfully connect. ([4016](https://github.com/opentofu/opentofu/pull/4016)) - Prevent panic when using ephemeral resources during tofu test\`. ([#4254](https://github.com/opentofu/opentofu/pull/4253)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.12.1...v1.12.2> ### [`v1.12.1`](https://github.com/opentofu/opentofu/releases/tag/v1.12.1) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.12.0...v1.12.1) ##### SECURITY ADVISORIES: - Previous releases in the v1.12 series could be affected by several vulnerabilities: - ssh usage through OpenTofu generate hangs or panics. - Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for `@revoked`. This is fixed now by ([#4145](https://github.com/opentofu/opentofu/pull/4145)) ##### BUG FIXES: - Address a bug introduced in v1.12.0 causing excessive memory usage by providers. ([#4126](https://github.com/opentofu/opentofu/pull/4126)) - Address a bug introduced in v1.12.0 where `replace_triggered_by` was validated incorrectly. ([#4133](https://github.com/opentofu/opentofu/pull/4133) - The Azure key provider will now accept the `tenant_id`, `subscription_id`, `environment`, and `metadata_host` variables; a bug previously only allowed these to be set through environment variables. ([#4091](https://github.com/opentofu/opentofu/issues/4091)) **Full Changelog**: <https://github.com/opentofu/opentofu/blob/v1.12/CHANGELOG.md> ### [`v1.12.0`](https://github.com/opentofu/opentofu/releases/tag/v1.12.0) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.14...v1.12.0) ##### OpenTofu 1.12.0 We're proud to announce that OpenTofu 1.12.0 is now officially available! 🎉 ##### Highlights This release cycle introduces major new capabilities and integrations: ##### Dynamic `prevent_destroy` OpenTofu v1.12.0 now allows `prevent_destroy` to be defined dynamically in terms of other values available elsewhere in the same module. For example: ```hcl variable "prevent_destroy_database" { type = bool default = true } resource "example_database" "example" { # ... lifecycle { prevent_destroy = var.prevent_destroy_database } } ``` ##### Provider Checksum Improvements The default provider installation behavior in OpenTofu is designed to mostly "just work" by getting the needed providers installed and making the necessary changes to [the dependency lock file](https://opentofu.org/docs/language/files/dependency-lock/), but in previous versions friction appeared for any teams using many of the non-default installation settings such as the shared provider plugin cache, or local mirrors of upstream providers. For OpenTofu v1.12, OpenTofu Registry now provides a full set of official checksums in all of the checksum formats needed by other installation methods. This means that after running `tofu init` the dependency lock file will immediately have all of the information required to successfully use a global plugin cache directory and to verify matching packages served from a local mirror, without needing to run `tofu providers lock` separately. ##### Simultaneous Human-readable and Machine-readable Output Many OpenTofu commands support both human-oriented UI output and machine-readable JSON output, but previously those commands could be run with only one or the other. This was bothersome for those implementing alternative UIs in terms of the machine-readable output because it meant they would need to implement all possible features of the UI before their tool could actually be used. OpenTofu v1.12.0 introduces a new option `-json-into=FILENAME`, which produces the same output format that `-json` would have produced but sends that output to the given filename instead of to the standard output stream. The OpenTofu UI output then appears on the standard output stream as normal, so that software interpreting the JSON output can behave as just a supplement to the normal UI rather than a complete replacement. ##### New `destroy` lifecycle meta-argument The new `destroy = false` lifecycle option for managed resources allows removing an object from the state without first destroying the remote object. ##### Deprecation Notices ##### WinRM for Provisioners is Now Deprecated Some of the Go libraries that OpenTofu uses for WinRM connection support in provisioners have become unmaintained over time, and so unfortunately we are phasing out support for WinRM in OpenTofu starting with deprecation warnings in this release. If your configuration includes a `connection` block with `type = "winrm"` then OpenTofu v1.12 will warn that this connection type is deprecated, but provisioning should otherwise still work as it did before. We intend to remove WinRM support completely in the forthcoming OpenTofu v1.13 series, and so if you are currently relying on WinRM support we recommend that you begin planning to migrate to using [OpenSSH for Windows](https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse) instead. ##### Phasing Out Support for 32-bit CPU Architectures We are also planning to stop producing official releases for 32-bit CPU architectures (`386` and `arm`) in a future version of OpenTofu. Support for 64-bit architectures (`amd64` and `arm64`) is unaffected. OpenTofu v1.12 does not include any changes to CPU support yet, but we expect that the official builds in the forthcoming v1.13 series will begin producing warnings when running on 32-bit CPU architectures, before we stop producing those packages altogether in a future release series. ##### Compatibility Notes - macOS: Requires macOS 12 Monterey or later - The `OPENTOFU_USER_AGENT` environment variable, which allowed fully overriding the default User-Agent header on all HTTP requests, has been removed. - On Unix systems OpenTofu now considers the `BROWSER` environment variable as a possible override for the default behavior for launching a web browser. If you run OpenTofu in a context where an environment variable of that name is already set, it may cause OpenTofu to now open a web browser in a different way than previous versions would have. Unsetting that environment variable will restore the previous platform-specific behavior. ##### Reference - [Full Changelog](https://github.com/opentofu/opentofu/blob/v1.12/CHANGELOG.md) - [Blog Post](https://opentofu.org/blog/opentofu-1-12-0) Thank you for your continued support and testing of the OpenTofu project! ### [`v1.11.14`](https://github.com/opentofu/opentofu/releases/tag/v1.11.14) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.13...v1.11.14) ##### SECURITY ADVISORIES: - When interacting with OCI Distribution registries for module or provider package installation, previous versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. ([#4423](https://github.com/opentofu/opentofu/pull/4423)) - When interacting with an attacker-controlled remote state backend or provider/module registry, `tofu init` in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. ([#4473](https://github.com/opentofu/opentofu/pull/4473)) > \[!NOTE] > This is the final patch release planned for the OpenTofu v1.11 series. We recommend upgrading to a newer release series as soon as possible. **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.11.13...v1.11.14> ### [`v1.11.13`](https://github.com/opentofu/opentofu/releases/tag/v1.11.13) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.12...v1.11.13) SECURITY ADVISORIES: - Previous releases in the v1.11 series could be affected by several vulnerabilities: - The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used. This is fixed now by ([#4363](https://github.com/opentofu/opentofu/pull/4363)) BUG FIXES: - Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState ([#4375](https://github.com/opentofu/opentofu/pull/4375)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.11.12...v1.11.13> ### [`v1.11.12`](https://github.com/opentofu/opentofu/releases/tag/v1.11.12) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.11...v1.11.12) BUG FIXES: - Moved block now correctly compares provider source addresses. ([#4280](https://github.com/opentofu/opentofu/issues/4280))\[[#4280](https://github.com/opentofu/opentofu/pull/4280)] - Correct Source Provider Address now passed into Provider MoveResource requests. ([#4355](https://github.com/opentofu/opentofu/issues/4355))\[[#4355](https://github.com/opentofu/opentofu/pull/4355)] **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.11.11...v1.11.12> ### [`v1.11.11`](https://github.com/opentofu/opentofu/releases/tag/v1.11.11) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.10...v1.11.11) ##### BUG FIXES: - Fixes an incomplete OTEL dependencies upgrade from the previous patch release. ([#4303](https://github.com/opentofu/opentofu/pull/4303)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.11.10...v1.11.11> ### [`v1.11.10`](https://github.com/opentofu/opentofu/releases/tag/v1.11.10) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.9...v1.11.10) ##### BUG FIXES: - Update documentation to clarify the usage restriction of ephemeral values in `lifecycle.enabled`. ([#4220](https://github.com/opentofu/opentofu/pull/4220)) ##### SECURITY ADVISORIES: - Previous releases in the v1.11 series could read an arbitrary file during certain git operations via a maliciously crafted URL ([#4292](https://github.com/opentofu/opentofu/pull/4292)). - Advisory: <https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq> **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.11.9...v1.11.10> ### [`v1.11.9`](https://github.com/opentofu/opentofu/releases/tag/v1.11.9) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.8...v1.11.9) ##### 1.11.9 SECURITY ADVISORIES: - Previous releases in the v1.11 series could be affected by several vulnerabilities: - ssh usage through OpenTofu generate hangs or panics. - Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for [@revoked](https://github.com/revoked). This is fixed now by ([#4145](https://github.com/opentofu/opentofu/pull/4145)) - If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted. ([#4177](https://github.com/opentofu/opentofu/pull/4177)) - Previous releases in the v1.11 series could be affected by several vulnerabilities: - When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes. - If using an attacker-controlled server to run `tofu` against, it might end up in high CPU consumption. These are now fixed by ([#4248](https://github.com/opentofu/opentofu/pull/4248)) BUG FIXES: - Fix race condition while handling closing signals during `tofu login`, both when the signal is sent by the user and when the browser fails to successfully connect. ([4016](https://github.com/opentofu/opentofu/pull/4016)) - Prevent panic when using ephemeral resources during tofu test\`. ([#4254](https://github.com/opentofu/opentofu/pull/4253)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.11.8...v1.11.9> ### [`v1.11.8`](https://github.com/opentofu/opentofu/releases/tag/v1.11.8) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.7...v1.11.8) ##### SECURITY ADVISORIES: - Previous releases in the v1.11 series could potentially take an excessive amount of time and send extraneous data to an HTTP2 server that specifies a maximum frame size of zero. This is now fixed. ([#4094](https://github.com/opentofu/opentofu/issues/4094)) An attacker that can coerce an operator to install a dependency from an attacker-controlled server could use this to cause unexpected resource consumption during `tofu init`. **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.11.7...v1.11.8> ### [`v1.11.7`](https://github.com/opentofu/opentofu/releases/tag/v1.11.7) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.6...v1.11.7) ##### BUG FIXES: - When installing provider packages into a local cache directory, the installer will now return an error if a conflicting entry is already present in the cache that doesn't match the expected checksum. Previously OpenTofu would just silently write over the existing entry in that case. ([#4082](https://github.com/opentofu/opentofu/pull/4082)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.11.6...v1.11.7> ### [`v1.11.6`](https://github.com/opentofu/opentofu/releases/tag/v1.11.6) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.5...v1.11.6) ##### BUG FIXES: - Running `tofu apply -refresh-only` with a configuration that contains ephemeral resources does not fail anymore because the refresh produced changes ([#3776](https://github.com/opentofu/opentofu/issues/3776)) - Fixed `tofu init` crashing when a module `version` uses a variable and the module is referenced from a test file. ([#3686](https://github.com/opentofu/opentofu/issues/3686)) - Fixed provider-defined functions in `import` block `id` expressions causing "BUG: Uninitialized function provider" error. ([#3803](https://github.com/opentofu/opentofu/issues/3803)) - `tofu test` no longer fails during cleanup when using a mocked version of a resource type with write-only attributes. ([#3964](https://github.com/opentofu/opentofu/issues/3964)) - A malicious remote TLS server can no longer deadlock OpenTofu by sending multiple key update messages in a single record. ([#3966](https://github.com/opentofu/opentofu/pull/3966)) - When installing module packages from "tar" archives, OpenTofu now accepts only a limited number of sparse file entries to avoid unbounded memory usage from maliciously-crafted archives containing many sparse regions. ([#3966](https://github.com/opentofu/opentofu/pull/3966)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.11.5...v1.11.6> ### [`v1.11.5`](https://github.com/opentofu/opentofu/releases/tag/v1.11.5) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.4...v1.11.5) BUG FIXES: - Add `universe_domain` option in the gcs backend to support sovereign GCP services ([#3758](https://github.com/opentofu/opentofu/issues/3758)) - The azurerm backend's MSI authentication method will now respect the provided client ID ([#3586](https://github.com/opentofu/opentofu/issues/3586)) - Using a network mirror for the providers source does not print debug logs without being asked for ([#3736](https://github.com/opentofu/opentofu/issues/3736)) **Full Changelog**: <https://github.com/opentofu/opentofu/blob/67fe9db49b7dafd46470cf9ac7f437aaa95f5c40/CHANGELOG.md> ### [`v1.11.4`](https://github.com/opentofu/opentofu/releases/tag/v1.11.4) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.3...v1.11.4) ##### SECURITY ADVISORIES: - Previous releases in the v1.11 series could potentially take an excessive amount of time processing a maliciously-crafted `.zip` archive during either provider or module installation during `tofu init`. ([#3689](https://github.com/opentofu/opentofu/pull/3689)) ##### BREAKING CHANGES: - Modules containing local provider configurations now also reject the `enabled` argument, matching existing behavior for `count`, `for_each`, and `depends_on`. ([#3680](https://github.com/opentofu/opentofu/pull/3680)) This was an oversight in the original design of the enabled feature and was missed during the review process. Although our goal is to not introduce breaking changes in patch releases, in some cases it may be warranted. Anyone who has used the enabled feature in this particular way will have unintentionally introduced a foot-gun into their infrastructure and should remedy it post-haste. ##### BUG FIXES: - In JSON syntax, the state encryption method configuration now allows specifying keys using both normal expression syntax and using template interpolation syntax. Previously only the template interpolation syntax was allowed, which was inconsistent with other parts of the encryption configuration. ([#3654](https://github.com/opentofu/opentofu/issues/3654)) - Providers are not configured anymore with `DeferralAllowed` capability of OpenTofu since having that created unwanted behaviour from some providers. ([#3676](https://github.com/opentofu/opentofu/pull/3676)) - Resources containing write-only attributes now are rendered consistently during planning. ([#3667](https://github.com/opentofu/opentofu/pull/3667)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.11.3...v1.11.4> ### [`v1.11.3`](https://github.com/opentofu/opentofu/releases/tag/v1.11.3) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.2...v1.11.3) ##### BUG FIXES: - Fix crash when the executed configuration contains an import block that points to unexisting configuration block ([#3616](https://github.com/opentofu/opentofu/pull/3616)) - Fixed `tofu test` with `mock_provider` failing during cleanup when `lifecycle { ignore_changes }` references a block. ([#3644](https://github.com/opentofu/opentofu/issues/3644)) - Fixed state lock not being released when `tofu apply` is interrupted with Ctrl+C while using the HTTP backend. ([#3624](https://github.com/opentofu/opentofu/issues/3624)) - azure backend: resolve OIDC token dynamically to support ADO refresh. ([#3594](https://github.com/opentofu/opentofu/pull/3594)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.11.2...v1.11.3> ### [`v1.11.2`](https://github.com/opentofu/opentofu/releases/tag/v1.11.2) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.1...v1.11.2) UPGRADE NOTES: - The change from [#2643](https://github.com/opentofu/opentofu/pull/2643), that was announced previously in v1.11.0, has been reverted in this release. OpenTofu will no longer directly recommend using the `-exclude=` option to work around problems caused by unknown values in provider configurations. Unfortunately there are existing providers that spuriously report that they cannot plan due to unknown values even when planning would have been successful, and so we cannot rely on providers to accurately signal when unknown values are the cause of an error. Using `-exclude` is still a valid workaround for these problems even though OpenTofu cannot accurately detect when it's useful to make that suggestion. BUG FIXES: - Fix crash in plan -generate-config-out with read-only nested attributes ([#3553](https://github.com/opentofu/opentofu/pull/3553)) - It's now possible again to plan changes with the `hashicorp/helm` and `hashicorp/kubernetes` providers when the provider configuration contains unknown values, as long as the configuration is carefully written to avoid the plan phase actually depending on those values. ([#3592](https://github.com/opentofu/opentofu/pull/3592)) - When running `tofu init` on Windows with an azurerm backend, the subscription\_id is quoted correctly allowing successful authentication. ([#3602](https://github.com/opentofu/opentofu/pull/3602)) - Fix serialization error in apply when using cloud backend ([#3611](https://github.com/opentofu/opentofu/pull/3611)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.11.1...v1.11.2> ### [`v1.11.1`](https://github.com/opentofu/opentofu/releases/tag/v1.11.1) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.11.0...v1.11.1) BUG FIXES: - Fixed regression where import validation would incorrectly flag variables used in for\_each statements within import blocks ([#3564](https://github.com/opentofu/opentofu/pull/3564)) - Fixed lifecycle enabled serialization in plan file ([#3566](https://github.com/opentofu/opentofu/pull/3566)) - Fixed regression when validating import.id expressions ([#3567](https://github.com/opentofu/opentofu/pull/3567)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.11.0...v1.11.1> ### [`v1.11.0`](https://github.com/opentofu/opentofu/releases/tag/v1.11.0) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.10.10...v1.11.0) ##### OpenTofu 1.11.0 We're proud to announce that OpenTofu 1.11.0 is now officially available! 🎉 ##### Highlights This release cycle introduces major new capabilities and integrations: ##### Ephemeral Values and Write Only Attributes Ephemeral resources allow you to work with confidential data, temporary credentials, and transient infrastructure without persisting them to your state. ```hcl ephemeral "aws_secretsmanager_random_password" "password" { } resource "kubernetes_secret_v1" "credentials" { metadata { name = "admin" namespace = "my-app" } data_wo = { username = "admin" password = ephemeral.aws_secretsmanager_random_password.password.random_password } data_wo_revision = 1 type = "kubernetes.io/basic-auth" } ``` ##### The `enabled` Meta-Argument If you want to conditionally deploy a resource, you no longer have to use `count = var.create_my_resource ? 1 : 0`, you can now add the new `enabled` meta-argument to your resource to conditionally deploy it. ```hcl resource "aws_instance" "web" { ami = "ami-12345" instance_type = "t3.micro" lifecycle { enabled = var.create_instance # Simple boolean condition } } ``` ##### Compatibility Notes - macOS: Requires macOS 12 Monterey or later - **Azure Backend (`azurerm`)**: - The `endpoint` and `ARM_ENDPOINT` configuration options are no longer supported - The `msi_endpoint` and `ARM_MSI_ENDPOINT` options are no longer supported - The `environment` and `metadata_host` arguments are now mutually exclusive - **issensitive() Function**: Now correctly returns unknown results when evaluating unknown values. Code that previously relied on the incorrect behavior may need updates. - **Testing with Mocks**: Mock values generated during testing now strictly adhere to provider schemas. Test configurations with invalid mock values will need to be corrected. - **S3 Module Installation**: When installing module packages from Amazon S3 buckets using S3 source addresses OpenTofu will use the same credentials as the AWS CLI and SDK. - **TLS and SSH Security**: - SHA-1 signatures are no longer accepted for TLS or SSH connections - SSH certificates must comply with the `draft-miller-ssh-cert-03` specification - **`-var`/`-var-file` during `tofu apply <planfile>`**: - Since ephemeral variables values cannot be saved into the plan, now we allow using `-var`/`-var-file` during `tofu apply <planfile>` to pass again the values for ephemeral variables during apply - This new functionality allows `-var`/`-var-file` to be used with non-ephemeral variables too, but **it will error if the values given for this type of variables is different from the ones given during the plan creation** - `TF_VAR` values should stay consistent between `plan` and `apply <planfile>` to avoid the errors mentioned above ##### Reference - [Full Changelog](https://github.com/opentofu/opentofu/blob/v1.11/CHANGELOG.md) - [Blog Post](https://opentofu.org/blog/opentofu-1-11-0) Thank you for your continued support and testing of the OpenTofu project! ### [`v1.10.10`](https://github.com/opentofu/opentofu/releases/tag/v1.10.10) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.10.9...v1.10.10) ##### BUG FIXES: - When installing provider packages into a local cache directory, the installer will now return an error if a conflicting entry is already present in the cache that doesn't match the expected checksum. Previously OpenTofu would just silently write over the existing entry in that case. ([#4082](https://github.com/opentofu/opentofu/pull/4082)) - Fixed provider-defined functions in `import` block `id` expressions causing "BUG: Uninitialized function provider" error. ([#3803](https://github.com/opentofu/opentofu/issues/3803)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.10.9...v1.10.10> ### [`v1.10.9`](https://github.com/opentofu/opentofu/releases/tag/v1.10.9) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.10.8...v1.10.9) ##### SECURITY ADVISORIES: This release contains fixes for some security advisories related to previous releases in this series. - No limit on number of query string arguments in net/url's ParseQuery This release incorporates the upstream fixes for [GO-2026-4341](https://pkg.go.dev/vuln/GO-2026-4341). - crypto/tls handling of multiple messages that span across encryption level boundaries This release incorporates the upstream fixes for [GO-2026-4340](https://pkg.go.dev/vuln/GO-2026-4340). ##### BUG FIXES: Using a network mirror for the providers source does not print debug logs without being asked for ([#3736](https://github.com/opentofu/opentofu/issues/3736)) **Full Changelog**: <https://github.com/opentofu/opentofu/blob/0de30e8050bc32dfada2c4c978e736239e0ab265/CHANGELOG.md> ### [`v1.10.8`](https://github.com/opentofu/opentofu/releases/tag/v1.10.8) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.10.7...v1.10.8) SECURITY ADVISORIES: This release contains fixes for some security advisories related to previous releases in this series. - Incorrect handling of excluded subdomain constraint in conjunction with TLS certificates containing wildcard SANs This release incorporates the upstream fixes for [GO-2025-4175](https://pkg.go.dev/vuln/GO-2025-4175). - Excessive CPU usage when reporting error about crafted TLS certificate with many hostnames This release incorporates the upstream fixes for [GO-2025-4155](https://pkg.go.dev/vuln/GO-2025-4155). **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.10.7...v1.10.8> ### [`v1.10.7`](https://github.com/opentofu/opentofu/releases/tag/v1.10.7) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.10.6...v1.10.7) SECURITY ADVISORIES: This release contains fixes for some security advisories related to previous releases in this series. - `tofu init` in OpenTofu v1.10.6 and earlier could potentially use unbounded memory if there is a direct or indirect dependency on a maliciously-crafted module package distributed as a "tar" archive. This would require the attacker to coerce a root module author to depend (directly or indirectly) on a module package they control, using the HTTP, Amazon S3, or Google Cloud Storage source types to refer to a tar archive. This release incorporates the upstream fixes for [CVE-2025-58183](https://www.cve.org/CVERecord?id=CVE-2025-58183). - When making requests to HTTPS servers, OpenTofu v1.10.6 and earlier could potentially use unbounded memory or crash with a "panic" error if TLS verification involves an excessively-long certificate chain or a chain including DSA public keys. This affected all outgoing HTTPS requests made by OpenTofu itself, including requests to HTTPS-based state storage backends, module registries, and provider registries. For example, an attacker could coerce a root module author to depend (directly or indirectly) on a module they control which then refers to a module or provider from an attacker-controlled registry. That mode of attack would cause failures in `tofu init`, at module or provider installation time. Provider plugins contain their own HTTPS client code, which may have similar problems. OpenTofu v1.10.7 cannot address similar problems within provider plugins, and so we recommend checking for similar advisories and fixes in the provider plugins you use. This release incorporates upstream fixes for [CVE-2025-58185](https://www.cve.org/CVERecord?id=CVE-2025-58185), [CVE-2025-58187](https://www.cve.org/CVERecord?id=CVE-2025-58187), and [CVE-2025-58188](https://www.cve.org/CVERecord?id=CVE-2025-58188). BUG FIXES: - Fix crash in tofu test when using deprecated outputs ([#3249](https://github.com/opentofu/opentofu/pull/3249)) - Fix missing provider functions when parentheses are used ([#3402](https://github.com/opentofu/opentofu/pull/3402)) - `for_each` inside `dynamic` blocks can now call provider-defined functions. ([#3429](https://github.com/opentofu/opentofu/issues/3429)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.10.6...v1.10.7> ### [`v1.10.6`](https://github.com/opentofu/opentofu/releases/tag/v1.10.6) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.10.5...v1.10.6) ##### 1.10.6 UPGRADE NOTES: - Upgrade go from 1.24.4 to 1.24.6 to fix [GO-2025-3849](https://pkg.go.dev/vuln/GO-2025-3849) ([3127](https://github.com/opentofu/opentofu/pull/3127)) - Upgrade github.com/openbao/openbao/api/v2 from 2.1.0 to 2.3.0 to fix [GO-2025-3783](https://pkg.go.dev/vuln/GO-2025-3783) ([3134](https://github.com/opentofu/opentofu/pull/3134)) - The upgrade is necessary to silence the security scanner and does not affect the actual state encryption provided by OpenBao. BUG FIXES: - Variables with validation no longer interfere with the destroy process ([#3131](https://github.com/opentofu/opentofu/pull/3131)) - Fixed crash when processing multiple deprecated marks on a complex object ([#3105](https://github.com/opentofu/opentofu/pull/3105)) - When OpenTelemetry encounters errors, log it at the warning level instead of panic ([#3235](https://github.com/opentofu/opentofu/pull/3235)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.10.5...v1.10.6> ### [`v1.10.5`](https://github.com/opentofu/opentofu/releases/tag/v1.10.5) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.10.4...v1.10.5) BUG FIXES: - Fixed issue where usage of TF\_PLUGIN\_CACHE\_DIR could result in unexpected lock contention errors ([#3090](https://github.com/opentofu/opentofu/pull/3090)) - NOTE: It is still highly recommended to have valid .terraform.lock.hcl files in projects using TF\_PLUGIN\_CACHE\_DIR **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.10.4...v1.10.5> ### [`v1.10.4`](https://github.com/opentofu/opentofu/releases/tag/v1.10.4) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.10.3...v1.10.4) BUG FIXES: - Fixed crash where sensitive set values used in for\_each could cause a panic. ([#3070](https://github.com/opentofu/opentofu/pull/3070)) - Fixed incorrect approach to mocking provider "ReadResource" calls in test. ([#3068](https://github.com/opentofu/opentofu/pull/3068)) - Reduced calls to ListKeys in azure backend (for rate limiting). ([#3083](https://github.com/opentofu/opentofu/pull/3083)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.10.3...v1.10.4> ### [`v1.10.3`](https://github.com/opentofu/opentofu/releases/tag/v1.10.3) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.10.2...v1.10.3) ##### 1.10.3 BUG FIXES: - OpenTofu will no longer crash in a rare case where a dynamically-invalid expression has its error suppressed by `try` or `can` and then that expression becomes relevant for deciding whether to report a "change outside of OpenTofu" in the human-oriented plan diff. ([#2988](https://github.com/opentofu/opentofu/pull/2988)) - Ensure provider downloads into temp are cleaned up correctly on windows. ([#2843](https://github.com/opentofu/opentofu/issues/2843)) - Correctly handle structural typed attributes during test provider mocking. ([#2994](https://github.com/opentofu/opentofu/pull/2994)) - Fix erroneous detection of changes with sensitive resource attributes. ([#3024](https://github.com/opentofu/opentofu/pull/3024)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.10.2...v1.10.3> ### [`v1.10.2`](https://github.com/opentofu/opentofu/releases/tag/v1.10.2) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.10.1...v1.10.2) ##### 1.10.2 - S3 backend now correctly sends the `x-amz-server-side-encryption` header for the lockfile. ([#2870](https://github.com/opentofu/opentofu/issues/2970)) - A provider source address explicitly using the hostname `registry.terraform.io` will no longer cause errors related to a corresponding provider on `registry.opentofu.org` when executing workflow commands like plan and apply. ([#2979](https://github.com/opentofu/opentofu/issues/2979)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.10.1...v1.10.2> ### [`v1.10.1`](https://github.com/opentofu/opentofu/releases/tag/v1.10.1) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.10.0...v1.10.1) BUG FIXES: - Fix `TF_APPEND_USER_AGENT` handling in the S3 remote state backend. ([#2955](https://github.com/opentofu/opentofu/pull/2955)) OTHER CHANGES: - OpenTofu is now built with Go 1.24.4, which should clear some false-positive indirect security advisories. ### [`v1.10.0`](https://github.com/opentofu/opentofu/releases/tag/v1.10.0) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.9.4...v1.10.0) ##### OpenTofu 1.10.0 We're thrilled to announce the release of OpenTofu 1.10.0, our most comprehensive update yet! This release represents months of dedicated work from our community, introducing some fantastic features that will improve how OpenTofu users manage and distribute infrastructure as code. ##### Highlights This release cycle introduces major new capabilities and integrations: ##### OCI Registry Support Full integration with OCI registries for both provider and module distribution, valuable for organizations with private infrastructure-as-code components, air-gapped environments, or enhanced security requirements. ```hcl # Use OCI modules directly in your configuration (normal .tf files) module "vpc" { source = "oci://example.com/modules/vpc/aws" } ``` ```hcl # Configure OCI registry mirrors in your CLI configuration (e.g. .tofurc) provider_installation { oci_mirror { repository_template = "example.com/opentofu-providers/${namespace}/${type}" include = ["registry.opentofu.org/*/*"] } } ``` For more information, refer to [Module Packages in OCI Registries](https://opentofu.org/docs/cli/oci_registries/module-package/) and [Provider Mirrors in OCI Registries](https://opentofu.org/docs/cli/oci_registries/provider-mirror/). ##### Native S3 Locking Simplify your infrastructure by using S3's conditional writes capability for state locking, eliminating the need for a separate DynamoDB table. ```hcl terraform { backend "s3" { bucket = "tofu-state-backend" key = "statefile" region = "us-east-1" use_lockfile = true # Enable native S3 locking } } ``` ##### OpenTelemetry Tracing Gain insights into OpenTofu operations with experimental OpenTelemetry tracing, completely local and under your control. ```bash # Launch a tracing backend like Jaeger docker run -d --name jaeger \ -p 16686:16686 -p 4317:4317 \ jaegertracing/jaeger:2.5.0 # Configure OpenTofu to use OpenTelemetry export OTEL_TRACES_EXPORTER=otlp export OTEL_EXPORTER_OTLP_ENDPOINT=http://localhost:4317 export OTEL_EXPORTER_OTLP_INSECURE=true # Run your operations and view traces at http://localhost:16686 tofu init ``` ##### Resource Management with Target Files Manage complex deployments more easily with the new `-target-file` and `-exclude-file` options, allowing version-controlled resource targeting patterns. ```bash # Create a targets.txt file # Critical infrastructure components module.networking.aws_vpc.main module.networking.aws_subnet.public[*] ``` ```bash # Apply only those resources tofu apply -target-file=targets.txt # Similarly, create an excludes.txt file to skip certain resources tofu plan -exclude-file=excludes.txt ``` ##### Compatibility Notes - Linux: Requires kernel version 3.2 or later - macOS: Requires macOS 11 Big Sur or later - The `ghcr.io/opentofu/opentofu` image is no longer supported as a base image - Windows: Symbolic links and junctions are now handled differently - The PostgreSQL backend in OpenTofu 1.10 should not be used alongside older versions ##### Reference - [Full Changelog](https://github.com/opentofu/opentofu/blob/v1.10/CHANGELOG.md) - [GitHub Comparison: v1.9.0...v1.10.0](https://github.com/opentofu/opentofu/compare/v1.9.0...v1.10.0) - [Blog Post](https://opentofu.org/blog/opentofu-1-10-0/) ### [`v1.9.4`](https://github.com/opentofu/opentofu/releases/tag/v1.9.4) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.9.3...v1.9.4) ##### 1.9.4 BUG FIXES: - Variables with validation no longer interfere with the destroy process ([#3131](https://github.com/opentofu/opentofu/pull/3131)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.9.3...v1.9.4> ### [`v1.9.3`](https://github.com/opentofu/opentofu/releases/tag/v1.9.3) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.9.2...v1.9.3) BUG FIXES: - Fixed incorrect approach to mocking provider "ReadResource" calls in test. ([#3068](https://github.com/opentofu/opentofu/pull/3068)) - Reduced calls to ListKeys in azure backend (for rate limiting). ([#3083](https://github.com/opentofu/opentofu/pull/3083)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.9.2...v1.9.3> ### [`v1.9.2`](https://github.com/opentofu/opentofu/releases/tag/v1.9.2) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.9.1...v1.9.2) ##### 1.9.2 BUG FIXES: - OpenTofu will no longer crash in a rare case where a dynamically-invalid expression has its error suppressed by `try` or `can` and then that expression becomes relevant for deciding whether to report a "change outside of OpenTofu" in the human-oriented plan diff. ([#2988](https://github.com/opentofu/opentofu/pull/2988)) - Ensure provider downloads into temp are cleaned up correctly on windows. ([#2843](https://github.com/opentofu/opentofu/issues/2843)) - Correctly handle structural typed attributes during test provider mocking. ([#2994](https://github.com/opentofu/opentofu/pull/2994)) - Fix erroneous detection of changes with sensitive resource attributes. ([#3024](https://github.com/opentofu/opentofu/pull/3024)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.9.1...v1.9.2> ### [`v1.9.1`](https://github.com/opentofu/opentofu/releases/tag/v1.9.1) [Compare Source](https://github.com/opentofu/opentofu/compare/v1.9.0...v1.9.1) BUG FIXES: - Provider used in import is correctly identified. ([#2336](https://github.com/opentofu/opentofu/pull/2336)) - `plantimestamp()` now returns unknown value during validation ([#2397](https://github.com/opentofu/opentofu/issues/2397)) - Syntax error in the `required_providers` block does not panic anymore, but yields "syntax error" ([2344](https://github.com/opentofu/opentofu/issues/2344)) - Fix the error message when default value of a complex variable is containing a wrong type ([2394](https://github.com/opentofu/opentofu/issues/2394)) - Changing Go version to 1.22.11 in order to fix [CVE-2024-45336](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45336) and [CVE-2024-45341](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45341) ([#2438](https://github.com/opentofu/opentofu/pull/2438)) - Fix the way OpenTofu downloads a module that is sourced from a GitHub branch containing slashes in the name. ([2396](https://github.com/opentofu/opentofu/issues/2396)) - Changing Go version to 1.22.12 in order to fix [CVE-2025-22866](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22866) and [CVE-2024-45341](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45341) ([#2438](https://github.com/opentofu/opentofu/pull/2438)) **Full Changelog**: <https://github.com/opentofu/opentofu/compare/v1.9.0...v1.9.1> </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate). The local configuration can be found in the [SI Renovate Bot repository](https://git.shivering-isles.com/shivering-isles/infrastructure-gitops/src/branch/main/apps/k8s01/renovate).

botaniker added 1 commit

2026-08-24 06:11:04 +00:00

chore(deps): update dependency opentofu/opentofu to v1.12.6

gitops-images Image build started

Details

gitops-pr-validation Pipeline failed

Details

10aa3b700b

sheogorath was assigned by botaniker

2026-08-24 06:11:04 +00:00

botaniker force-pushed renovate/opentofu-opentofu-1.x from 10aa3b700b

gitops-images Image build started

Details

gitops-pr-validation Pipeline failed

Details

to 255f673013

gitops-pr-validation Pipeline completed successfully

Details

gitops-images Pipeline completed successfully

Details

2026-08-30 06:06:29 +00:00

Compare

botaniker force-pushed renovate/opentofu-opentofu-1.x from 255f673013

gitops-pr-validation Pipeline completed successfully

Details

gitops-images Pipeline completed successfully

Details

to 9d24d30a99

gitops-images Image build started

Details

gitops-pr-validation Pipeline failed

Details

2026-09-02 06:10:03 +00:00

Compare

gitops-images Image build started

Required

Details

gitops-pr-validation Pipeline failed

Required

Details

Some required checks were not successful.

This branch is out-of-date with the base branch

You are not authorized to merge this pull request.

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin renovate/opentofu-opentofu-1.x:renovate/opentofu-opentofu-1.x

git switch renovate/opentofu-opentofu-1.x

No reviewers

No labels

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

shivering-isles/infrastructure-gitops!170

No description provided.

Rows
Columns

chore(deps): update dependency opentofu/opentofu to v1.12.6 #170

Release Notes

SECURITY ADVISORIES:

BUG FIXES:

SECURITY ADVISORIES:

1.12.2

SECURITY ADVISORIES:

BUG FIXES:

OpenTofu 1.12.0

Highlights

Dynamic prevent_destroy

Provider Checksum Improvements

Simultaneous Human-readable and Machine-readable Output

New destroy lifecycle meta-argument

Deprecation Notices

WinRM for Provisioners is Now Deprecated

Phasing Out Support for 32-bit CPU Architectures

Compatibility Notes

Reference

SECURITY ADVISORIES:

BUG FIXES:

BUG FIXES:

SECURITY ADVISORIES:

1.11.9

SECURITY ADVISORIES:

BUG FIXES:

BUG FIXES:

SECURITY ADVISORIES:

BREAKING CHANGES:

BUG FIXES:

BUG FIXES:

OpenTofu 1.11.0

Highlights

Ephemeral Values and Write Only Attributes

The enabled Meta-Argument

Compatibility Notes

Reference

BUG FIXES:

SECURITY ADVISORIES:

BUG FIXES:

1.10.6

1.10.3

1.10.2

OpenTofu 1.10.0

Highlights

OCI Registry Support

Native S3 Locking

OpenTelemetry Tracing

Resource Management with Target Files

Compatibility Notes

Reference

1.9.4

1.9.2

Configuration

Checkout

Dynamic `prevent_destroy`

New `destroy` lifecycle meta-argument

The `enabled` Meta-Argument