v1.12.3
Fixed 3
- Properly handle TF_ENCRYPTION with only blank spaces
- The value resulted from the lifecycle.enabled evaluation now has its deprecation marks processed correctly
- tofu console -lock=false now works as intended
Security 1
- Fixed an arbitrary file read vulnerability during certain git operations via a maliciously crafted URL
BUG FIXES:
- Properly handle
TF_ENCRYPTIONwith only blank spaces. (#4265) - The value resulted from the
lifecycle.enabledevaluation now has its deprecation marks processed correctly (#4162) - Update documentation to clarify the usage restriction of ephemeral values in
lifecycle.enabled. (#4220) tofu console -lock=falsenow works as intended. (#4291)
SECURITY ADVISORIES:
- Previous releases in the v1.12 series could read an arbitrary file during certain git operations via a maliciously crafted URL (#4293)
Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.2...v1.12.3