OpenTofu

The v1.13.x release series is supported until August 1 2027.

1.13.0 (Unreleased)

UPGRADE NOTES:

• The "winrm" connection type for provisioners is no longer supported. (#4012)

  This connection type was deprecated in OpenTofu v1.12, and now removed in v1.13. Some of the upstream libraries OpenTofu was using to implement these features are no longer maintained, so it's not viable for us to offer this anymore.

  Modern Windows versions now support OpenSSH, and so we suggest that anyone currently relying on WinRM plan to migrate to using SSH instead.

• The base64gzip function now generates results that are equivalent to but not equal to the results from previous releases, as a result of a new optimized DEFLATE compression implementation.

  If you use this function as part of an argument to a managed resource then OpenTofu is likely to propose to update or replace the instances of that resource, depending on how the provider responds to the differing base64 data. The new compressed form should nonetheless still decompress to the same sequence of bytes.

• OpenTofu on macOS now requires macOS 13 Ventura or later. Earlier versions are no longer supported.

• OpenTofu v1.13 is the final release series that will include official builds for 32-bit CPU architectures (*_386 and *_arm platforms).

  If you are currently relying on our official releases of OpenTofu on one of these platforms then we suggest that you begin planning to migrate to running OpenTofu on a 64-bit CPU architecture (*_amd64 or *_arm64 platforms) before the v1.13 series reaches end-of-life.

  Third parties may continue to offer their own OpenTofu builds targeting platforms that we don't officially support. This only affects the official packages published directly by the OpenTofu project in this repository's release artifacts.

• There are various minor changes to the robustness of file format and wire format parsers in the SSH client implementation used for remote provisioners.

  This may cause certain invalid input that was previously accepted to now be rejected, in an attempt to better match the expectations of other implementations of these protocols and formats.

EXPERIMENTS:

• Symbol Libraries are now available as an experimental feature (#4052)

  This new feature adds the capaibility to define re-usable functions and types in hcl-lang based libraries. As this introduces a drastically different way of building modules and sharing functionality, we are looking for early feedback on the design of the language and how it integrates into OpenTofu workflows. If you are interested in this functionality, you can enable to experiment by adding the appropriate experiment to the experiments list in the language block. As it is experimental, it is subject to change before it is marked as stable and should not be relied upon in production.

• Basic linting support introduced (#4310)

  The linting support can be enabled by using the -lint flag on the supported commands. By doing so, OpenTofu will run the selected linting rules against the configuration given to OpenTofu and will show warning diagnostics if any issue is found. The functionality is marked as experimental because this is just a first iteration and we want to see how users interact with it and how useful they find it.

ENHANCEMENTS:

• Windows on ARM64 is now an officially-supported platform for OpenTofu itself, though this new platform may not be supported by all available provider plugins. (#4450)
• New function convert allows converting a given value to a specified type constraint. (#4449)
• Various new functions named with the prefix assume... allow authors to give OpenTofu additional hints about what's expected as the final result of an unknown value, potentially allowing more information to be known during the planning phase. (#4449)
• OpenTofu now uses Unicode 17 algorithms and tables for all string processing that is based on Unicode specifications. (#4478)
• The gcp_kms encryption key provider now supports an optional additional_authenticated_data as part of the encryption and decryption operations. (#4287)
• The aws_kms encryption key provider now supports an encryption_context field, allowing key-value string pairs to be passed to AWS KMS with every GenerateDataKey and Decrypt call. (#4298)
• The cidrsubnets function now supports prefix extensions greater than 32 bits when the base CIDR block uses an IPv6 address. (#4042)
• The openbao encryption key provider now accepts a new associated_data argument, allowing a base64-encoded value to be passed to OpenBao on every data key generation and decryption call. (#4365)
• When installing provider and module packages from OCI Distribution registries, OpenTofu now tracks separate transient credentials for each repository to support registry implementations that issue repository-scoped tokens. (#3316)
• The providers lock command now supports the argument -oci-mirror. The functionality mimics that of the field repository_template of oci_mirror-block in provider_installation with the exception of using a URI template instead of a HCL one.
• tofu plan no longer prints the explanatory paragraph that followed the "No changes. Your infrastructure matches the configuration." message, since it only restated that message in more words. (#4340)
• The local-exec provisioner now automatically sets the TRACEPARENT environment variable in child processes when OpenTelemetry tracing is active, following the W3C Trace Context specification. (#4014)
• When OpenTelemetry trace collection is active, OpenTofu now copies any log lines generated by the OpenTelemetry libraries into its own debug log stream that you can activate using the TF_LOG environment variable. (#4285)
• errored.tfstate is now produced if OpenTofu encounters a Go runtime panic. This file will be a partial state and is intended for aiding in recovery from a hard crash. (#4064)
• On Windows systems, OpenTofu uses a heuristic to detect when it seems to be running in a legacy terminal emulator that uses a named pipe instead of a true pseudoterminal, such as with Cygwin and MSYS. This heuristic is now updated to be more reliable on recent versions of Windows that report slightly different names for those pipes. (#4459)
• tofu init in our official releases when running on a 32-bit CPU architecture now warns about our plan to stop publishing official builds for these platforms starting in OpenTofu v1.14. (#4018)
• Saved plan files now include the provider schemas needed to render the plan, so tofu show on a plan file no longer needs to launch the providers where possible. (#4490)
• tofu test now supports instances in test resource overrides, including wildcards. (#4067)

BUG FIXES:

• The built-in function contains now accepts null as its second argument, to test whether a collection contains any null values. (#4043)
• The built-in function merge no longer fails when its only argument is a null value of an object type. (#4043)
• The built-in function cidrhost no longer returns a "panic" error when called with an out-of-range host number represented in more than 64 bits. (#4056)
• The built-in function templatestring no longer returns a "panic" error when its vars argument is a wholly sensitive collection; the result is marked sensitive instead. (#4430)
• tofu workspace new now includes a hint to use tofu workspace select when the given workspace name already exists, instead of just reporting that it already exists. (#4428)
• tofu apply -json now emits periodic apply_progress heartbeat messages for the full duration of a resource operation, instead of stopping after the first one. (#4107)
• provisioner output is no longer suppressed when -show-sensitive is passed. (#3927)
• In the azurerm backend's OpenID Connect authorization method, when audience is provided as a query parameter in the URL, it will be passed through instead of being overwritten by a default value. (#4037)
• Using -backend=false during tofu init now skips reading the local encrypted state (#4077)
• Fixed span error status not being set on module fetch failure path during tofu init, so observability tools now correctly identify failed spans. (#4169)
• When using OpenTelemetry tracing, the TRACESTATE log message no longer incorrectly prints the TRACEPARENT value. (#4168)
• Fix rendering of plans where a nested block's replacement is unknown. (#4256)
• removed blocks with an invalid from address and a destroy provisioner now report a configuration error instead of crashing. (#4321)
• tofu plan -out no longer fails when the plan includes a resource with lifecycle { destroy = false } that needs replacement, which previously errored with invalid change action ForgetThenCreate. (#4324)
• connection.script_path is escaped correctly not allowing anymore additional commands to be executed on the remote host together with the script path indicated by the argument. (#4330)
• tofu plan: Fixed Incorrect warnings produced for tofu plan -replace=ADDR. (#4368)
• tofu plan: Performance improved for large depends_on chains. (#4465)
• SSH connections through an HTTP proxy now report a connection error instead of crashing when the proxy fails to answer the CONNECT request. (#4358)

SECURITY ADVISORIES:

• When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#4422)
• When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. (#4472)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.5...v1.12.6

SECURITY ADVISORIES:

• When interacting with OCI Distribution registries for module or provider package installation, previous versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#4423)
• When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. (#4473)

[!NOTE] This is the final patch release planned for the OpenTofu v1.11 series. We recommend upgrading to a newer release series as soon as possible.

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.13...v1.11.14

SECURITY ADVISORIES:

• Previous releases in the v1.12 series could be affected by several vulnerabilities:

  • The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.

  This is fixed now by (#4363)

BUG FIXES:

• Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState (#4375)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.4...v1.12.5

SECURITY ADVISORIES:

• Previous releases in the v1.11 series could be affected by several vulnerabilities:

  • The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.

  This is fixed now by (#4363)

BUG FIXES:

• Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState (#4375)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.12...v1.11.13

BUG FIXES:

• tofu plan -out no longer fails when the plan includes a resource with lifecycle { destroy = false } that needs replacement, which previously errored with invalid change action ForgetThenCreate. (#4324)
• Moved block now correctly compares provider source addresses. (#4280)[https://github.com/opentofu/opentofu/pull/4280]
• Correct Source Provider Address now passed into Provider MoveResource requests. (#4355)[https://github.com/opentofu/opentofu/pull/4355]

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.3...v1.12.4

BUG FIXES:

• Moved block now correctly compares provider source addresses. (#4280)[https://github.com/opentofu/opentofu/pull/4280]
• Correct Source Provider Address now passed into Provider MoveResource requests. (#4355)[https://github.com/opentofu/opentofu/pull/4355]

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.11...v1.11.12

BUG FIXES:

• Fixes an incomplete OTEL dependencies upgrade from the previous patch release. (#4303)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.10...v1.11.11

BUG FIXES:

• Properly handle TF_ENCRYPTION with only blank spaces. (#4265)
• The value resulted from the lifecycle.enabled evaluation now has its deprecation marks processed correctly (#4162)
• Update documentation to clarify the usage restriction of ephemeral values in lifecycle.enabled. (#4220)
• tofu console -lock=false now works as intended. (#4291)

SECURITY ADVISORIES:

• Previous releases in the v1.12 series could read an arbitrary file during certain git operations via a maliciously crafted URL (#4293)
  • Advisory: https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.2...v1.12.3

BUG FIXES:

• Update documentation to clarify the usage restriction of ephemeral values in lifecycle.enabled. (#4220)

SECURITY ADVISORIES:

• Previous releases in the v1.11 series could read an arbitrary file during certain git operations via a maliciously crafted URL (#4292).
  • Advisory: https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.9...v1.11.10

1.11.9

SECURITY ADVISORIES:

• Previous releases in the v1.11 series could be affected by several vulnerabilities:

  • ssh usage through OpenTofu generate hangs or panics.
  • Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

  This is fixed now by (#4145)

• If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted. (#4177)

• Previous releases in the v1.11 series could be affected by several vulnerabilities:

  • When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
  • If using an attacker-controlled server to run tofu against, it might end up in high CPU consumption.

  These are now fixed by (#4248)

BUG FIXES:

• Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)
• Prevent panic when using ephemeral resources during tofu test`. (#4254)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.8...v1.11.9

1.12.2

SECURITY ADVISORIES:

• Previous releases in the v1.12 series could be affected by several vulnerabilities:

  • If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted.

  This is fixed now by (#4177)

• Previous releases in the v1.12 series could be affected by several vulnerabilities:

  • When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
  • If using an attacker-controlled server to run tofu against, it might end up in high CPU consumption.

  These are now fixed by (#4247)

BUG FIXES:

• Properly handle EDEADLK during provider installation. On Unix systems, the kernel may erroneously detect a deadlock between tofu processes using the global plugin cache. (#4166)
• Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)
• Prevent panic when using ephemeral resources during tofu test`. (#4254)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.1...v1.12.2

SECURITY ADVISORIES:

• Previous releases in the v1.12 series could be affected by several vulnerabilities:

  • ssh usage through OpenTofu generate hangs or panics.
  • Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

  This is fixed now by (#4145)

BUG FIXES:

• Address a bug introduced in v1.12.0 causing excessive memory usage by providers. (#4126)
• Address a bug introduced in v1.12.0 where replace_triggered_by was validated incorrectly. (#4133
• The Azure key provider will now accept the tenant_id, subscription_id, environment, and metadata_host variables; a bug previously only allowed these to be set through environment variables. (#4091)

Full Changelog: https://github.com/opentofu/opentofu/blob/v1.12/CHANGELOG.md