# OpenTofu changelog > An open-source infrastructure-as-code tool. - Vendor: Linux Foundation - Category: Infrastructure & DevOps - License: MPL-2.0 - Language: Go - Official site: https://opentofu.org - Tracked by: What's New (https://whatsnew.fyi/product/opentofu) - Harvested from: GitHub (opentofu/opentofu) - Entries below: 18 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: release facts (products, versions, dates, links, CVE ids and flags) are open data under CC BY 4.0, from the API at https://whatsnew.fyi/api/v1 or the nightly dataset at https://github.com/whatsnew-fyi/dataset. The summaries, labels and curation are © What's New: quote freely with attribution and a link back; wholesale republication of them is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## Releases ### v1.12.8 - Date: 2026-10-14 - Version: v1.12.8 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.8 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.8 - **security** — Fixed excessive CPU usage that could occur when connecting to an attacker-controlled HTTP2 server while installing dependencies in tofu init - **fixed** — Lifecycle destroy no longer crashes when given an expression with references SECURITY ADVISORIES: - Previous versions of OpenTofu could potentially experience excessive CPU usage if connecting to an attacker-controlled HTTP2 server while installing dependencies in `tofu init`. ([#4700](https://github.com/opentofu/opentofu/pull/4700)) BUG FIXES: - Lifecycle destroy will no longer crash when given an expression with references ([#4648](https://github.com/opentofu/opentofu/pull/4648)) ### v1.12.7 - Date: 2026-10-01 - Version: v1.12.7 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.7 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.7 - **security** — Fix deadlock vulnerability in remote-exec and file provisioners when connecting to attacker-controlled SSH servers that send unexpected packet types SECURITY ADVISORIES: - When using either a `remote-exec` or `file` provisioner to connect to an attacker-controlled SSH server, the server could previously deadlock the connection by sending certain unexpected packet types. ([#4551](https://github.com/opentofu/opentofu/pull/4551)) This addresses the upstream Go security advisories [CVE-2026-78662](https://www.cve.org/CVERecord?id=CVE-2026-78662) and [CVE-2026-56855](https://pkg.go.dev/vuln/GO-2026-6355). ### v1.13.1 - Date: 2026-10-01 - Version: v1.13.1 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.13.1 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.13.1 - **fixed** — tofu show -json now works again when ephemeral resources are present in the configuration - **fixed** — Ephemeral output values are now always re-evaluated during the apply phase instead of sometimes using stale values from the planning phase BUG FIXES: - `tofu show -json ` now works again when ephemeral resources are present in the configuration. ([4623](https://github.com/opentofu/opentofu/pull/4623)). - Ephemeral output values are now always re-evaluated during the apply phase, instead of sometimes using stale values from the planning phase. ([#4582](https://github.com/opentofu/opentofu/issues/4582)) ### v1.13.0 - Date: 2026-09-30 - Version: v1.13.0 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.13.0 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.13.0 - **added** — Windows on ARM64 (aarch64) is now a supported platform with official packages - **added** — New functions to allow module authors to provide hints about known values during planning - **added** — Early work towards built-in linting features in OpenTofu - **added** — Symbol Libraries experiment as a reusable collection of values, functions, and type aliases that can be imported from module sources - **changed** — base64gzip now produces results equivalent but not byte-for-byte identical to previous versions due to golang version upgrade - **removed** — WinRM is no longer supported for provisioners - **changed** — macOS now requires macOS 13 Ventura or later - **deprecated** — OpenTofu v1.13 is the last series that includes official releases for 32 bit CPUs #### OpenTofu 1.13.0 We're proud to announce that OpenTofu 1.13.0 is now officially available! 🎉 ##### Highlights ###### Windows on ARM64 is now a supported platform Starting with OpenTofu v1.13.0 we are now offering official packages targeting Windows on the ARM64 (also known as "aarch64") CPU architecture. ###### Reducing unknowns during planning OpenTofu v1.13 introduces a number of new functions that are all intended to allow module authors to give OpenTofu additional hints about what they know to be true even though OpenTofu cannot infer it automatically. ###### Linting Experiment OpenTofu v1.13 includes some very early work towards built-in "linting" features in OpenTofu, although we are hoping to eventually incorporate other similar needs such as policy enforcement into a single comprehensive feature. ###### Symbol Libraries Experiment We're considering a new kind of artifact called a "Symbol Library", which is a reusable collection of values, functions, and type aliases that can be imported from all of the same source types that are already supported for modules. ##### Compatibility Notes - `base64gzip` produces results that are equivalent but _not_ byte-for-byte identical to previous versions, this is due to a required golang version upgrade - WinRM is no longer supported for provisioners - macOS: Requires macOS 13 Ventura or later - OpenTofu v1.13 will be the last series that includes official releases for 32 bit CPUs ##### Reference - [Full Changelog](https://github.com/opentofu/opentofu/blob/v1.13/CHANGELOG.md) - [Blog Post](https://opentofu.org/blog/opentofu-1-13-0) Thank you for your continued support and testing of the OpenTofu project! ### v1.13.0-rc1 - Date: 2026-09-17 - Version: v1.13.0-rc1 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.13.0-rc1 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.13.0-rc1 - Labels: Pre-release - **removed** — Remove support for the winrm connection type for provisioners - **changed** — The base64gzip function now generates results using a new optimized DEFLATE compression implementation that may differ from previous releases - **changed** — OpenTofu on macOS now requires macOS 13 Ventura or later - **deprecated** — OpenTofu v1.13 is the final release series with official builds for 32-bit CPU architectures - **changed** — SSH client implementation now has improved robustness in file format and wire format parsers, which may reject certain previously-accepted invalid input - **added** — Symbol Libraries are now available as an experimental feature allowing definition of re-usable functions and types in hcl-lang based libraries - **added** — Basic linting support introduced as an experimental feature, enabling the -lint flag on supported commands to show warning diagnostics - **added** — Windows on ARM64 is now an officially-supported platform for OpenTofu - **added** — New function convert allows converting a given value to a specified type constraint - **added** — New functions with the prefix assume allow authors to give OpenTofu hints about what's expected as the final result of an unknown value - **changed** — OpenTofu now uses Unicode 17 algorithms and tables for all string processing based on Unicode specifications - **added** — The gcp_kms encryption key provider now supports an optional additional_authenticated_data as part of encryption and decryption operations - **added** — The aws_kms encryption key provider now supports an encryption_context field allowing key-value string pairs to be passed to AWS KMS - **changed** — The cidrsubnets function now supports prefix extensions greater than 32 bits when the base CIDR block uses an IPv6 address - **added** — The openbao encryption key provider now accepts a new associated_data argument allowing a base64-encoded value to be passed to OpenBao - **changed** — When installing provider and module packages from OCI Distribution registries, OpenTofu now tracks separate transient credentials for each repository The v1.13.x release series is supported until **August 1 2027**. ##### 1.13.0 (Unreleased) UPGRADE NOTES: - The "winrm" connection type for provisioners is no longer supported. ([#4012](https://github.com/opentofu/opentofu/pull/4012)) This connection type was deprecated in OpenTofu v1.12, and now removed in v1.13. Some of the upstream libraries OpenTofu was using to implement these features are no longer maintained, so it's not viable for us to offer this anymore. [Modern Windows versions now support OpenSSH](https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse), and so we suggest that anyone currently relying on WinRM plan to migrate to using SSH instead. - The `base64gzip` function now generates results that are equivalent to _but not equal to_ the results from previous releases, as a result of a new optimized DEFLATE compression implementation. If you use this function as part of an argument to a managed resource then OpenTofu is likely to propose to update or replace the instances of that resource, depending on how the provider responds to the differing base64 data. The new compressed form should nonetheless still decompress to the same sequence of bytes. - OpenTofu on macOS now requires macOS 13 Ventura or later. Earlier versions are no longer supported. - OpenTofu v1.13 is the final release series that will include official builds for 32-bit CPU architectures (`*_386` and `*_arm` platforms). If you are currently relying on our official releases of OpenTofu on one of these platforms then we suggest that you begin planning to migrate to running OpenTofu on a 64-bit CPU architecture (`*_amd64` or `*_arm64` platforms) before the v1.13 series reaches end-of-life. Third parties may continue to offer their own OpenTofu builds targeting platforms that we don't officially support. This only affects the official packages published directly by the OpenTofu project in this repository's release artifacts. - There are various minor changes to the robustness of file format and wire format parsers in the SSH client implementation used for remote provisioners. This may cause certain invalid input that was previously accepted to now be rejected, in an attempt to better match the expectations of other implementations of these protocols and formats. EXPERIMENTS: - Symbol Libraries are now available as an experimental feature ([#4052](https://github.com/opentofu/opentofu/pull/4052)) This new feature adds the capaibility to define re-usable functions and types in hcl-lang based libraries. As this introduces a drastically different way of building modules and sharing functionality, we are looking for early feedback on the design of the language and how it integrates into OpenTofu workflows. If you are interested in this functionality, you can enable to experiment by adding the appropriate experiment to the experiments list in the language block. As it is experimental, it is subject to change before it is marked as stable and should not be relied upon in production. - Basic linting support introduced ([#4310](https://github.com/opentofu/opentofu/issues/4310)) The linting support can be enabled by using the `-lint` flag on the supported commands. By doing so, OpenTofu will run the selected linting rules against the configuration given to OpenTofu and will show warning diagnostics if any issue is found. The functionality is marked as experimental because this is just a first iteration and we want to see how users interact with it and how useful they find it. ENHANCEMENTS: - Windows on ARM64 is now an officially-supported platform for OpenTofu itself, though this new platform may not be supported by all available provider plugins. ([#4450](https://github.com/opentofu/opentofu/pull/4450)) - New function `convert` allows converting a given value to a specified type constraint. ([#4449](https://github.com/opento _[Truncated at 4000 characters — full notes: https://github.com/opentofu/opentofu/releases/tag/v1.13.0-rc1]_ ### v1.13.0-beta1 - Date: 2026-08-27 - Version: v1.13.0-beta1 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.13.0-beta1 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.13.0-beta1 - Labels: Pre-release - **removed** — The winrm connection type for provisioners is no longer supported - **changed** — The base64gzip function now generates results that are equivalent to but not equal to results from previous releases due to a new optimized DEFLATE compression implementation - **changed** — OpenTofu on macOS now requires macOS 13 Ventura or later - **deprecated** — OpenTofu v1.13 is the final release series that will include official builds for 32-bit CPU architectures - **changed** — SSH client implementation file format and wire format parsers are now more robust and may reject certain invalid input that was previously accepted - **added** — Symbol Libraries are now available as an experimental feature to define re-usable functions and types in hcl-lang based libraries - **added** — Basic linting support introduced with the -lint flag on supported commands - **added** — Windows on ARM64 is now an officially-supported platform for OpenTofu - **added** — New function convert allows converting a given value to a specified type constraint - **added** — New functions with the prefix assume allow authors to give OpenTofu additional hints about what's expected as the final result of an unknown value - **changed** — OpenTofu now uses Unicode 17 algorithms and tables for all string processing based on Unicode specifications - **added** — The gcp_kms encryption key provider now supports an optional additional_authenticated_data as part of encryption and decryption operations - **added** — The aws_kms encryption key provider now supports an encryption_context field allowing key-value string pairs to be passed to AWS KMS - **changed** — The cidrsubnets function now supports prefix extensions greater than 32 bits when the base CIDR block uses an IPv6 address - **added** — The openbao encryption key provider now accepts a new associated_data argument allowing a base64-encoded value to be passed to OpenBao - **changed** — When installing provider and module packages from OCI Distribution registries OpenTofu now tracks separate transient credentials for each repository The v1.13.x release series is supported until **August 1 2027**. ##### 1.13.0 (Unreleased) UPGRADE NOTES: - The "winrm" connection type for provisioners is no longer supported. ([#4012](https://github.com/opentofu/opentofu/pull/4012)) This connection type was deprecated in OpenTofu v1.12, and now removed in v1.13. Some of the upstream libraries OpenTofu was using to implement these features are no longer maintained, so it's not viable for us to offer this anymore. [Modern Windows versions now support OpenSSH](https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse), and so we suggest that anyone currently relying on WinRM plan to migrate to using SSH instead. - The `base64gzip` function now generates results that are equivalent to _but not equal to_ the results from previous releases, as a result of a new optimized DEFLATE compression implementation. If you use this function as part of an argument to a managed resource then OpenTofu is likely to propose to update or replace the instances of that resource, depending on how the provider responds to the differing base64 data. The new compressed form should nonetheless still decompress to the same sequence of bytes. - OpenTofu on macOS now requires macOS 13 Ventura or later. Earlier versions are no longer supported. - OpenTofu v1.13 is the final release series that will include official builds for 32-bit CPU architectures (`*_386` and `*_arm` platforms). If you are currently relying on our official releases of OpenTofu on one of these platforms then we suggest that you begin planning to migrate to running OpenTofu on a 64-bit CPU architecture (`*_amd64` or `*_arm64` platforms) before the v1.13 series reaches end-of-life. Third parties may continue to offer their own OpenTofu builds targeting platforms that we don't officially support. This only affects the official packages published directly by the OpenTofu project in this repository's release artifacts. - There are various minor changes to the robustness of file format and wire format parsers in the SSH client implementation used for remote provisioners. This may cause certain invalid input that was previously accepted to now be rejected, in an attempt to better match the expectations of other implementations of these protocols and formats. EXPERIMENTS: - Symbol Libraries are now available as an experimental feature ([#4052](https://github.com/opentofu/opentofu/pull/4052)) This new feature adds the capaibility to define re-usable functions and types in hcl-lang based libraries. As this introduces a drastically different way of building modules and sharing functionality, we are looking for early feedback on the design of the language and how it integrates into OpenTofu workflows. If you are interested in this functionality, you can enable to experiment by adding the appropriate experiment to the experiments list in the language block. As it is experimental, it is subject to change before it is marked as stable and should not be relied upon in production. - Basic linting support introduced ([#4310](https://github.com/opentofu/opentofu/issues/4310)) The linting support can be enabled by using the `-lint` flag on the supported commands. By doing so, OpenTofu will run the selected linting rules against the configuration given to OpenTofu and will show warning diagnostics if any issue is found. The functionality is marked as experimental because this is just a first iteration and we want to see how users interact with it and how useful they find it. ENHANCEMENTS: - Windows on ARM64 is now an officially-supported platform for OpenTofu itself, though this new platform may not be supported by all available provider plugins. ([#4450](https://github.com/opentofu/opentofu/pull/4450)) - New function `convert` allows converting a given value to a specified type constraint. ([#4449](https://github.com/opento _[Truncated at 4000 characters — full notes: https://github.com/opentofu/opentofu/releases/tag/v1.13.0-beta1]_ ### v1.12.6 - Date: 2026-08-19 - Version: v1.12.6 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.6 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.6 - **security** — Fix incorrect resending of credentials to HTTP redirect targets when interacting with OCI Distribution registries for module or provider package installation - **security** — Fix potential high CPU and memory usage in tofu init when resolving crafted relative URLs in API responses from attacker-controlled remote state backends or registries ##### SECURITY ADVISORIES: - When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. ([#4422](https://github.com/opentofu/opentofu/pull/4422)) - When interacting with an attacker-controlled remote state backend or provider/module registry, `tofu init` in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. ([#4472](https://github.com/opentofu/opentofu/pull/4472)) **Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.12.5...v1.12.6 ### v1.11.14 - Date: 2026-08-19 - Version: v1.11.14 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.11.14 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.11.14 - **security** — Fix credentials being incorrectly resent to HTTP redirect targets when interacting with OCI Distribution registries for module or provider package installation - **security** — Fix potential high CPU usage and high memory usage in tofu init when resolving crafted relative URLs in API responses from attacker-controlled remote state backends or provider/module registries ##### SECURITY ADVISORIES: - When interacting with OCI Distribution registries for module or provider package installation, previous versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. ([#4423](https://github.com/opentofu/opentofu/pull/4423)) - When interacting with an attacker-controlled remote state backend or provider/module registry, `tofu init` in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. ([#4473](https://github.com/opentofu/opentofu/pull/4473)) > [!NOTE] > This is the final patch release planned for the OpenTofu v1.11 series. We recommend upgrading to a newer release series as soon as possible. **Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.11.13...v1.11.14 ### v1.12.5 - Date: 2026-07-21 - Version: v1.12.5 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.5 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.5 - **security** — Fix Encrypted Client Hello implementation to prevent leaking pre-shared key identities during handshake that could allow passive network observers to de-anonymize the server hostname - **fixed** — Fix bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState SECURITY ADVISORIES: * Previous releases in the v1.12 series could be affected by several vulnerabilities: * The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used. This is fixed now by ([#4363](https://github.com/opentofu/opentofu/pull/4363)) BUG FIXES: - Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState ([#4375](https://github.com/opentofu/opentofu/pull/4375)) **Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.12.4...v1.12.5 ### v1.11.13 - Date: 2026-07-21 - Version: v1.11.13 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.11.13 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.11.13 - **security** — Fix Encrypted Client Hello implementation leaking pre-shared key identities during handshake - **fixed** — Fix bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState SECURITY ADVISORIES: * Previous releases in the v1.11 series could be affected by several vulnerabilities: * The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used. This is fixed now by ([#4363](https://github.com/opentofu/opentofu/pull/4363)) BUG FIXES: - Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState ([#4375](https://github.com/opentofu/opentofu/pull/4375)) **Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.11.12...v1.11.13 ### v1.12.4 - Date: 2026-07-13 - Version: v1.12.4 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.4 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.4 - **fixed** — tofu plan -out no longer fails when the plan includes a resource with lifecycle { destroy = false } that needs replacement - **fixed** — Moved block now correctly compares provider source addresses - **fixed** — Correct Source Provider Address now passed into Provider MoveResource requests BUG FIXES: - `tofu plan -out` no longer fails when the plan includes a resource with `lifecycle { destroy = false }` that needs replacement, which previously errored with `invalid change action ForgetThenCreate`. ([#4324](https://github.com/opentofu/opentofu/issues/4324)) - Moved block now correctly compares provider source addresses. (#4280)[https://github.com/opentofu/opentofu/pull/4280] - Correct Source Provider Address now passed into Provider MoveResource requests. (#4355)[https://github.com/opentofu/opentofu/pull/4355] **Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.12.3...v1.12.4 ### v1.11.12 - Date: 2026-07-13 - Version: v1.11.12 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.11.12 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.11.12 - **fixed** — Moved block now correctly compares provider source addresses - **fixed** — Correct Source Provider Address now passed into Provider MoveResource requests BUG FIXES: - Moved block now correctly compares provider source addresses. (#4280)[https://github.com/opentofu/opentofu/pull/4280] - Correct Source Provider Address now passed into Provider MoveResource requests. (#4355)[https://github.com/opentofu/opentofu/pull/4355] **Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.11.11...v1.11.12 ### v1.11.11 - Date: 2026-06-23 - Version: v1.11.11 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.11.11 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.11.11 - **fixed** — Complete OTEL dependencies upgrade from the previous patch release ###### BUG FIXES: * Fixes an incomplete OTEL dependencies upgrade from the previous patch release. ([#4303](https://github.com/opentofu/opentofu/pull/4303)) **Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.11.10...v1.11.11 ### v1.12.3 - Date: 2026-06-18 - Version: v1.12.3 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.3 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.3 - **fixed** — Properly handle TF_ENCRYPTION with only blank spaces - **fixed** — The value resulted from the lifecycle.enabled evaluation now has its deprecation marks processed correctly - **fixed** — tofu console -lock=false now works as intended - **security** — Fixed an arbitrary file read vulnerability during certain git operations via a maliciously crafted URL ###### BUG FIXES: - Properly handle `TF_ENCRYPTION` with only blank spaces. ([#4265](https://github.com/opentofu/opentofu/pull/4265)) - The value resulted from the `lifecycle.enabled` evaluation now has its deprecation marks processed correctly ([#4162](https://github.com/opentofu/opentofu/pull/4162)) - Update documentation to clarify the usage restriction of ephemeral values in `lifecycle.enabled`. ([#4220](https://github.com/opentofu/opentofu/pull/4220)) - `tofu console -lock=false` now works as intended. ([#4291](https://github.com/opentofu/opentofu/pull/4291)) ###### SECURITY ADVISORIES: * Previous releases in the v1.12 series could read an arbitrary file during certain git operations via a maliciously crafted URL ([#4293](https://github.com/opentofu/opentofu/pull/4293)) * Advisory: https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq **Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.12.2...v1.12.3 ### v1.11.10 - Date: 2026-06-18 - Version: v1.11.10 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.11.10 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.11.10 - **fixed** — Prevent arbitrary file reads during certain git operations via maliciously crafted URLs - **changed** — Update documentation to clarify the usage restriction of ephemeral values in lifecycle.enabled ###### BUG FIXES: * Update documentation to clarify the usage restriction of ephemeral values in `lifecycle.enabled`. ([#4220](https://github.com/opentofu/opentofu/pull/4220)) ###### SECURITY ADVISORIES: * Previous releases in the v1.11 series could read an arbitrary file during certain git operations via a maliciously crafted URL ([#4292](https://github.com/opentofu/opentofu/pull/4292)). * Advisory: https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq **Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.11.9...v1.11.10 ### v1.11.9 - Date: 2026-06-12 - Version: v1.11.9 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.11.9 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.11.9 - **security** — Fix SSH usage through OpenTofu that could hang or panic - **security** — Fix revoked 'SignatureKey' belonging to a CA not being correctly checked for revocation by checking both the 'key' and 'key.SignatureKey' for @revoked - **security** — Fix OpenBao key provider with wrapping algorithms that could generate panics or hangs on compromised systems with specifically crafted JWE - **security** — Fix SSH connection errors that could include unescaped input bytes - **security** — Fix high CPU consumption when using an attacker-controlled server with SSH connections through OpenTofu - **fixed** — Fix race condition while handling closing signals during `tofu login` - **fixed** — Prevent panic when using ephemeral resources during `tofu test` ##### 1.11.9 SECURITY ADVISORIES: * Previous releases in the v1.11 series could be affected by several vulnerabilities: * ssh usage through OpenTofu generate hangs or panics. * Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked. This is fixed now by ([#4145](https://github.com/opentofu/opentofu/pull/4145)) * If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted. ([#4177](https://github.com/opentofu/opentofu/pull/4177)) * Previous releases in the v1.11 series could be affected by several vulnerabilities: * When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes. * If using an attacker-controlled server to run `tofu` against, it might end up in high CPU consumption. These are now fixed by ([#4248](https://github.com/opentofu/opentofu/pull/4248)) BUG FIXES: - Fix race condition while handling closing signals during `tofu login`, both when the signal is sent by the user and when the browser fails to successfully connect. ([4016](https://github.com/opentofu/opentofu/pull/4016)) - Prevent panic when using ephemeral resources during tofu test`. ([#4254](https://github.com/opentofu/opentofu/pull/4253)) **Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.11.8...v1.11.9 ### v1.12.2 - Date: 2026-06-12 - Version: v1.12.2 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.2 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.2 - **security** — Fix OpenBao key provider with wrapping algorithms that could generate panics or hangs on compromised systems with specifically crafted JWE - **security** — Fix SSH connection errors that could include unescaped input bytes - **security** — Fix potential high CPU consumption when using an attacker-controlled server with SSH connections - **fixed** — Properly handle EDEADLK during provider installation on Unix systems where the kernel may erroneously detect a deadlock between tofu processes using the global plugin cache - **fixed** — Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect - **fixed** — Prevent panic when using ephemeral resources during tofu test ##### 1.12.2 SECURITY ADVISORIES: * Previous releases in the v1.12 series could be affected by several vulnerabilities: * If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted. This is fixed now by ([#4177](https://github.com/opentofu/opentofu/pull/4177)) * Previous releases in the v1.12 series could be affected by several vulnerabilities: * When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes. * If using an attacker-controlled server to run `tofu` against, it might end up in high CPU consumption. These are now fixed by ([#4247](https://github.com/opentofu/opentofu/pull/4247)) BUG FIXES: - Properly handle EDEADLK during provider installation. On Unix systems, the kernel may erroneously detect a deadlock between tofu processes using the global plugin cache. ([#4166](https://github.com/opentofu/opentofu/pull/4166)) - Fix race condition while handling closing signals during `tofu login`, both when the signal is sent by the user and when the browser fails to successfully connect. ([4016](https://github.com/opentofu/opentofu/pull/4016)) - Prevent panic when using ephemeral resources during tofu test`. ([#4254](https://github.com/opentofu/opentofu/pull/4253)) **Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.12.1...v1.12.2 ### v1.12.1 - Date: 2026-05-27 - Version: v1.12.1 - Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.1 - Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.1 - **security** — Fix ssh usage through OpenTofu generate hanging or panicking - **security** — Fix revoked SignatureKey belonging to a CA not being correctly checked for revocation by now checking both key and key.SignatureKey for @revoked - **fixed** — Fix excessive memory usage by providers introduced in v1.12.0 - **fixed** — Fix replace_triggered_by being validated incorrectly in v1.12.0 - **fixed** — Allow Azure key provider to accept tenant_id, subscription_id, environment, and metadata_host variables instead of only through environment variables ##### SECURITY ADVISORIES: * Previous releases in the v1.12 series could be affected by several vulnerabilities: * ssh usage through OpenTofu generate hangs or panics. * Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for `@revoked`. This is fixed now by ([#4145](https://github.com/opentofu/opentofu/pull/4145)) ##### BUG FIXES: - Address a bug introduced in v1.12.0 causing excessive memory usage by providers. ([#4126](https://github.com/opentofu/opentofu/pull/4126)) - Address a bug introduced in v1.12.0 where `replace_triggered_by` was validated incorrectly. ([#4133](https://github.com/opentofu/opentofu/pull/4133) - The Azure key provider will now accept the `tenant_id`, `subscription_id`, `environment`, and `metadata_host` variables; a bug previously only allowed these to be set through environment variables. ([#4091](https://github.com/opentofu/opentofu/issues/4091)) **Full Changelog**: https://github.com/opentofu/opentofu/blob/v1.12/CHANGELOG.md