# OpenTofu changelog

> An open-source infrastructure-as-code tool.

- Vendor: Linux Foundation
- Category: Developer Tools
- Official site: https://opentofu.org
- Tracked by: What's New (https://whatsnew.fyi/product/opentofu)
- Harvested from: GitHub (opentofu/opentofu)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v1.12.5

- Date: 2026-07-21
- Version: v1.12.5
- Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.5
- Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.5

- **security** — Fix Encrypted Client Hello implementation to prevent leaking pre-shared key identities during handshake that could allow passive network observers to de-anonymize the server hostname
- **fixed** — Fix bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState

SECURITY ADVISORIES:

* Previous releases in the v1.12 series could be affected by several vulnerabilities:
  * The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, 
    allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.

  This is fixed now by ([#4363](https://github.com/opentofu/opentofu/pull/4363))

BUG FIXES:
- Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState ([#4375](https://github.com/opentofu/opentofu/pull/4375))


**Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.12.4...v1.12.5

### v1.11.13

- Date: 2026-07-21
- Version: v1.11.13
- Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.11.13
- Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.11.13

- **security** — Fix Encrypted Client Hello implementation leaking pre-shared key identities during handshake
- **fixed** — Fix bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState

SECURITY ADVISORIES:

* Previous releases in the v1.11 series could be affected by several vulnerabilities:
  * The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, 
    allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.

  This is fixed now by ([#4363](https://github.com/opentofu/opentofu/pull/4363))

BUG FIXES:
- Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState ([#4375](https://github.com/opentofu/opentofu/pull/4375))


**Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.11.12...v1.11.13

### v1.12.4

- Date: 2026-07-13
- Version: v1.12.4
- Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.4
- Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.4

- **fixed** — tofu plan -out no longer fails when the plan includes a resource with lifecycle { destroy = false } that needs replacement
- **fixed** — Moved block now correctly compares provider source addresses
- **fixed** — Correct Source Provider Address now passed into Provider MoveResource requests

BUG FIXES:

- `tofu plan -out` no longer fails when the plan includes a resource with `lifecycle { destroy = false }` that needs replacement, which previously errored with `invalid change action ForgetThenCreate`. ([#4324](https://github.com/opentofu/opentofu/issues/4324))
- Moved block now correctly compares provider source addresses. (#4280)[https://github.com/opentofu/opentofu/pull/4280]
- Correct Source Provider Address now passed into Provider MoveResource requests. (#4355)[https://github.com/opentofu/opentofu/pull/4355]


**Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.12.3...v1.12.4

### v1.11.12

- Date: 2026-07-13
- Version: v1.11.12
- Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.11.12
- Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.11.12

- **fixed** — Moved block now correctly compares provider source addresses
- **fixed** — Correct Source Provider Address now passed into Provider MoveResource requests

BUG FIXES:

- Moved block now correctly compares provider source addresses. (#4280)[https://github.com/opentofu/opentofu/pull/4280]
- Correct Source Provider Address now passed into Provider MoveResource requests. (#4355)[https://github.com/opentofu/opentofu/pull/4355]

**Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.11.11...v1.11.12

### v1.11.11

- Date: 2026-06-23
- Version: v1.11.11
- Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.11.11
- Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.11.11

- **fixed** — Complete OTEL dependencies upgrade from the previous patch release

###### BUG FIXES:

* Fixes an incomplete OTEL dependencies upgrade from the previous patch release. ([#4303](https://github.com/opentofu/opentofu/pull/4303))


**Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.11.10...v1.11.11

### v1.12.3

- Date: 2026-06-18
- Version: v1.12.3
- Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.3
- Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.3

- **fixed** — Properly handle TF_ENCRYPTION with only blank spaces
- **fixed** — The value resulted from the lifecycle.enabled evaluation now has its deprecation marks processed correctly
- **fixed** — tofu console -lock=false now works as intended
- **security** — Fixed an arbitrary file read vulnerability during certain git operations via a maliciously crafted URL

###### BUG FIXES:

- Properly handle `TF_ENCRYPTION` with only blank spaces. ([#4265](https://github.com/opentofu/opentofu/pull/4265))
- The value resulted from the `lifecycle.enabled` evaluation now has its deprecation marks processed correctly ([#4162](https://github.com/opentofu/opentofu/pull/4162))
- Update documentation to clarify the usage restriction of ephemeral values in `lifecycle.enabled`. ([#4220](https://github.com/opentofu/opentofu/pull/4220))
- `tofu console -lock=false` now works as intended. ([#4291](https://github.com/opentofu/opentofu/pull/4291))

###### SECURITY ADVISORIES:
* Previous releases in the v1.12 series could read an arbitrary file during certain git operations via a maliciously crafted URL ([#4293](https://github.com/opentofu/opentofu/pull/4293))
  * Advisory: https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq


**Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.12.2...v1.12.3

### v1.11.10

- Date: 2026-06-18
- Version: v1.11.10
- Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.11.10
- Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.11.10

- **fixed** — Prevent arbitrary file reads during certain git operations via maliciously crafted URLs
- **changed** — Update documentation to clarify the usage restriction of ephemeral values in lifecycle.enabled

###### BUG FIXES:

* Update documentation to clarify the usage restriction of ephemeral values in `lifecycle.enabled`. ([#4220](https://github.com/opentofu/opentofu/pull/4220))

###### SECURITY ADVISORIES:
* Previous releases in the v1.11 series could read an arbitrary file during certain git operations via a maliciously crafted URL ([#4292](https://github.com/opentofu/opentofu/pull/4292)).
  * Advisory: https://github.com/opentofu/opentofu/security/advisories/GHSA-q7j3-v8qv-22vq


**Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.11.9...v1.11.10

### v1.11.9

- Date: 2026-06-12
- Version: v1.11.9
- Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.11.9
- Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.11.9

- **security** — Fix SSH usage through OpenTofu that could hang or panic
- **security** — Fix revoked 'SignatureKey' belonging to a CA not being correctly checked for revocation by checking both the 'key' and 'key.SignatureKey' for @revoked
- **security** — Fix OpenBao key provider with wrapping algorithms that could generate panics or hangs on compromised systems with specifically crafted JWE
- **security** — Fix SSH connection errors that could include unescaped input bytes
- **security** — Fix high CPU consumption when using an attacker-controlled server with SSH connections through OpenTofu
- **fixed** — Fix race condition while handling closing signals during `tofu login`
- **fixed** — Prevent panic when using ephemeral resources during `tofu test`

##### 1.11.9

SECURITY ADVISORIES:

* Previous releases in the v1.11 series could be affected by several vulnerabilities:
  * ssh usage through OpenTofu generate hangs or panics.
  * Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

  This is fixed now by ([#4145](https://github.com/opentofu/opentofu/pull/4145))

* If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted. ([#4177](https://github.com/opentofu/opentofu/pull/4177))

* Previous releases in the v1.11 series could be affected by several vulnerabilities:
  * When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
  * If using an attacker-controlled server to run `tofu` against, it might end up in high CPU consumption.
  
  These are now fixed by ([#4248](https://github.com/opentofu/opentofu/pull/4248))

BUG FIXES:

- Fix race condition while handling closing signals during `tofu login`, both when the signal is sent by the user and when the browser fails to successfully connect. ([4016](https://github.com/opentofu/opentofu/pull/4016))
- Prevent panic when using ephemeral resources during tofu test`. ([#4254](https://github.com/opentofu/opentofu/pull/4253))


**Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.11.8...v1.11.9

### v1.12.2

- Date: 2026-06-12
- Version: v1.12.2
- Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.2
- Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.2

- **security** — Fix OpenBao key provider with wrapping algorithms that could generate panics or hangs on compromised systems with specifically crafted JWE
- **security** — Fix SSH connection errors that could include unescaped input bytes
- **security** — Fix potential high CPU consumption when using an attacker-controlled server with SSH connections
- **fixed** — Properly handle EDEADLK during provider installation on Unix systems where the kernel may erroneously detect a deadlock between tofu processes using the global plugin cache
- **fixed** — Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect
- **fixed** — Prevent panic when using ephemeral resources during tofu test

##### 1.12.2

SECURITY ADVISORIES:

* Previous releases in the v1.12 series could be affected by several vulnerabilities:
  * If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted.

  This is fixed now by ([#4177](https://github.com/opentofu/opentofu/pull/4177))

* Previous releases in the v1.12 series could be affected by several vulnerabilities:
  * When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
  * If using an attacker-controlled server to run `tofu` against, it might end up in high CPU consumption.
  
  These are now fixed by ([#4247](https://github.com/opentofu/opentofu/pull/4247))

BUG FIXES:

- Properly handle EDEADLK during provider installation. On Unix systems, the kernel may erroneously detect a deadlock between tofu processes using the global plugin cache. ([#4166](https://github.com/opentofu/opentofu/pull/4166))
- Fix race condition while handling closing signals during `tofu login`, both when the signal is sent by the user and when the browser fails to successfully connect. ([4016](https://github.com/opentofu/opentofu/pull/4016))
- Prevent panic when using ephemeral resources during tofu test`. ([#4254](https://github.com/opentofu/opentofu/pull/4253))




**Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.12.1...v1.12.2

### v1.12.1

- Date: 2026-05-27
- Version: v1.12.1
- Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.12.1
- Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.12.1

- **security** — Fix ssh usage through OpenTofu generate hanging or panicking
- **security** — Fix revoked SignatureKey belonging to a CA not being correctly checked for revocation by now checking both key and key.SignatureKey for @revoked
- **fixed** — Fix excessive memory usage by providers introduced in v1.12.0
- **fixed** — Fix replace_triggered_by being validated incorrectly in v1.12.0
- **fixed** — Allow Azure key provider to accept tenant_id, subscription_id, environment, and metadata_host variables instead of only through environment variables

##### SECURITY ADVISORIES:

* Previous releases in the v1.12 series could be affected by several vulnerabilities:
  * ssh usage through OpenTofu generate hangs or panics.
  * Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for `@revoked`.

  This is fixed now by ([#4145](https://github.com/opentofu/opentofu/pull/4145))

##### BUG FIXES:

- Address a bug introduced in v1.12.0 causing excessive memory usage by providers. ([#4126](https://github.com/opentofu/opentofu/pull/4126))
- Address a bug introduced in v1.12.0 where `replace_triggered_by` was validated incorrectly. ([#4133](https://github.com/opentofu/opentofu/pull/4133)
- The Azure key provider will now accept the `tenant_id`, `subscription_id`, `environment`, and `metadata_host` variables; a bug previously only allowed these to be set through environment variables. ([#4091](https://github.com/opentofu/opentofu/issues/4091))


**Full Changelog**: https://github.com/opentofu/opentofu/blob/v1.12/CHANGELOG.md