# OpenTofu v1.13.0-beta1

- Product: OpenTofu (https://whatsnew.fyi/product/opentofu)
- Vendor: Linux Foundation
- Date: 2026-08-27
- Version: v1.13.0-beta1
- Original notes: https://github.com/opentofu/opentofu/releases/tag/v1.13.0-beta1
- Permalink: https://whatsnew.fyi/product/opentofu/releases/v1.13.0-beta1
- Labels: Pre-release

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **removed** — The winrm connection type for provisioners is no longer supported
- **changed** — The base64gzip function now generates results that are equivalent to but not equal to results from previous releases due to a new optimized DEFLATE compression implementation
- **changed** — OpenTofu on macOS now requires macOS 13 Ventura or later
- **deprecated** — OpenTofu v1.13 is the final release series that will include official builds for 32-bit CPU architectures
- **changed** — SSH client implementation file format and wire format parsers are now more robust and may reject certain invalid input that was previously accepted
- **added** — Symbol Libraries are now available as an experimental feature to define re-usable functions and types in hcl-lang based libraries
- **added** — Basic linting support introduced with the -lint flag on supported commands
- **added** — Windows on ARM64 is now an officially-supported platform for OpenTofu
- **added** — New function convert allows converting a given value to a specified type constraint
- **added** — New functions with the prefix assume allow authors to give OpenTofu additional hints about what's expected as the final result of an unknown value
- **changed** — OpenTofu now uses Unicode 17 algorithms and tables for all string processing based on Unicode specifications
- **added** — The gcp_kms encryption key provider now supports an optional additional_authenticated_data as part of encryption and decryption operations
- **added** — The aws_kms encryption key provider now supports an encryption_context field allowing key-value string pairs to be passed to AWS KMS
- **changed** — The cidrsubnets function now supports prefix extensions greater than 32 bits when the base CIDR block uses an IPv6 address
- **added** — The openbao encryption key provider now accepts a new associated_data argument allowing a base64-encoded value to be passed to OpenBao
- **changed** — When installing provider and module packages from OCI Distribution registries OpenTofu now tracks separate transient credentials for each repository

The v1.13.x release series is supported until **August 1 2027**.

##### 1.13.0 (Unreleased)

UPGRADE NOTES:

- The "winrm" connection type for provisioners is no longer supported. ([#4012](https://github.com/opentofu/opentofu/pull/4012))

    This connection type was deprecated in OpenTofu v1.12, and now removed in v1.13. Some of the upstream libraries OpenTofu was using to implement these features are no longer maintained, so it's not viable for us to offer this anymore.

    [Modern Windows versions now support OpenSSH](https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse), and so we suggest that anyone currently relying on WinRM plan to migrate to using SSH instead.


- The `base64gzip` function now generates results that are equivalent to _but not equal to_ the results from previous releases, as a result of a new optimized DEFLATE compression implementation.

    If you use this function as part of an argument to a managed resource then OpenTofu is likely to propose to update or replace the instances of that resource, depending on how the provider responds to the differing base64 data. The new compressed form should nonetheless still decompress to the same sequence of bytes.

- OpenTofu on macOS now requires macOS 13 Ventura or later. Earlier versions are no longer supported.

- OpenTofu v1.13 is the final release series that will include official builds for 32-bit CPU architectures (`*_386` and `*_arm` platforms).

    If you are currently relying on our official releases of OpenTofu on one of these platforms then we suggest that you begin planning to migrate to running OpenTofu on a 64-bit CPU architecture (`*_amd64` or `*_arm64` platforms) before the v1.13 series reaches end-of-life.

    Third parties may continue to offer their own OpenTofu builds targeting platforms that we don't officially support. This only affects the official packages published directly by the OpenTofu project in this repository's release artifacts.

- There are various minor changes to the robustness of file format and wire format parsers in the SSH client implementation used for remote provisioners.

    This may cause certain invalid input that was previously accepted to now be rejected, in an attempt to better match the expectations of other implementations of these protocols and formats.

EXPERIMENTS:

- Symbol Libraries are now available as an experimental feature ([#4052](https://github.com/opentofu/opentofu/pull/4052))

    This new feature adds the capaibility to define re-usable functions and types in hcl-lang based libraries. As this introduces a drastically different way of building modules and sharing functionality, we are looking for early feedback on the design of the language and how it integrates into OpenTofu workflows. If you are interested in this functionality, you can enable to experiment by adding the appropriate experiment to the experiments list in the language block. As it is experimental, it is subject to change before it is marked as stable and should not be relied upon in production.
- Basic linting support introduced ([#4310](https://github.com/opentofu/opentofu/issues/4310))
    
    The linting support can be enabled by using the `-lint` flag on the supported commands. By doing so, OpenTofu will run the selected linting rules against the configuration given to OpenTofu and will show warning diagnostics if any issue is found. The functionality is marked as experimental because this is just a first iteration and we want to see how users interact with it and how useful they find it.

ENHANCEMENTS:

- Windows on ARM64 is now an officially-supported platform for OpenTofu itself, though this new platform may not be supported by all available provider plugins. ([#4450](https://github.com/opentofu/opentofu/pull/4450))
- New function `convert` allows converting a given value to a specified type constraint. ([#4449](https://github.com/opento

_[Truncated at 4000 characters — full notes: https://github.com/opentofu/opentofu/releases/tag/v1.13.0-beta1]_