Packer

1.16.0 (July 24, 2026)

FEATURES:

• provenance: add new provenance post-processor and packer verify-attestation command for SLSA Build L1/L2 supply-chain attestations. Derives in-toto subjects from Packer artifacts, builds SLSA Provenance v1 predicates with Git/CI metadata, and signs via local PEM key, cloud KMS (awskms://, gcpkms://, azurekms://, hashivault://), or keyless Sigstore (Fulcio + optional Rekor transparency log). Reference CI workflows for L2 keyless and L3-compatible delegated-signing patterns are included under examples/ci/. GH-13667
• core/hcl2: add rfc3339_parse and unix_timestamp_parse template functions. Both accept RFC 3339 timestamps; unix_timestamp_parse additionally accepts Unix epoch integers. GH-13669
• core/hcl2: add continue_on_error meta-argument to provisioner blocks. When set to true, a provisioner failure is logged and the build continues rather than halting. GH-13674
• core/hcl2: variable object types now support optional() attribute modifiers, allowing object variables to declare per-attribute defaults and omit fields that have a default set. GH-13670

BUG FIXES:

• plugin/getter: prevent path traversal vulnerability in GitHub plugin getter filename handling. GH-13680
• build: update build constraints to support arm architecture on FreeBSD. GH-13650

SECURITY:

• security: drop x/crypto/openpgp by upgrading go-github v33 → v75. GH-13676
• security: suppress false positive for GO-2026-5932. GH-13677
• deps: bump golang.org/x/crypto to v0.54.0. GH-13672

DEPENDENCIES:

• deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.10. GH-13673
• deps: bump github.com/hashicorp/hcp-sdk-go to v0.174.0. GH-13673
• deps: bump github.com/zclconf/go-cty to v1.18.1. GH-13673
• deps: bump github.com/google/go-github v33 → v75. GH-13676
• deps: bump golang.org/x/net to v0.56.0. GH-13664
• deps: update various Go module dependencies. GH-13673

INTERNAL:

• ci: pin GitHub Action refs to latest verified SHAs. GH-13675
• chore: remove old website references. GH-13668

1.15.4 (June 3, 2026)

BUG FIXES:

• builder: update build constraints to support arm architecture on FreeBSD GH-13650

IMPROVEMENTS:

• hcp: removes Syft binary download/handling from the HCP SBOM provisioner GH-13636

SECURITY:

• deps: upgraded crypto version GH-13645
• deps: upgraded go-git version GH-13645
• deps: bump github.com/hashicorp/packer-plugin-sdk to 0.6.9 GH-13640

INTERNAL:

• build: bump Go to 1.25.10 and refresh dependencies GH-13646 GH-13647
• deps: update cloud.google.com/go and aws-sdk-go-v2 related dependencies GH-13610

1.15.3 (April 27, 2026)

BUG FIXES:

• hcp: skip bucket update requests when description and labels already match, avoiding unnecessary updates for existing buckets. GH-13624

1.15.2 (April 21, 2026)

FEATURES:

• provisioner: added support for the enforced provisioner. GH-13591

SECURITY:

• deps: bump github.com/go-jose/go-jose/v4 GH-13594
• deps: bump go.opentelemetry.io/otel/sdk GH-13606
• deps: update cloud.google.com/go and aws-sdk-go-v2 related dependencies GH-13610

INTERNAL:

• build: bump Go to 1.25.9 and refresh dependencies GH-13614 GH-13615

1.15.1 (March 26, 2026)

FEATURES:

• hcp: native sbom generation for hcp. Refer to the guide here for more information. GH-13566

BUG FIXES:

• core: Scrub multiline sensitive values from build output (including OS-specific multiline sensitive-value fixtures) GH-13582

SECURITY:

• deps: bump syft to v1.42.3 (fixes GO-2026-4809) GH-13581
• deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.7 GH-13581
• deps: bump github.com/hashicorp/hcp-sdk-go from 0.136.0 to 0.167.0 GH-13560
• deps: Updates OpenTelemetry dependencies to v1.41.0 GH-13572
• deps: Upgrade go-git to v5.17.0 and grpc to 1.79.3 GH-13570
• deps: Updates circl dependency to v1.6.3 GH-13564

INTERNAL:

• ci: Adds grouped and scheduled updates for GitHub Actions (monthly, grouped PRs, ignore major bumps) GH-13575
• docs: remove docs validation from packer (docs changes move to web-unified-docs) GH-13577
• legal: Update LICENSE GH-13563

1.15.0 (February 4, 2026)

IMPROVEMENTS:

• core/hcp: add support for updating HCP Packer registry channels and bucket log UI metadata. GH-13532

• build: update Go to 1.24.12. GH-13553

• docker: remove vmware and vsphere from the packer full image. GH-13442

• docs: add comments to packer docs. GH-13534

• compliance: update copyright and license headers. GH-13540 GH-13543 GH-13545 GH-13544

BUG FIXES:

• datasource/http: update acceptance test URL to avoid rate limiting. GH-13480

• provisioner/powershell: ensure LASTEXITCODE is set before checking its value in tests. GH-13539

SECURITY:

• Bump golang.org/x/crypto to 0.46.0 GH-13546

1.14.3 (November 18, 2025)

IMPROVEMENTS:

• core/hcp: added cicd metadata support for BitBucket and Jenkins pipelines. GH-13513 GH-13505

• core: bump github.com/hashicorp/packer-plugin-sdk to 0.6.4 GH-13494

• docs: fix typos and linguistic errors in documentation. GH-13496

SECURITY:

• Bump golang.org/x/crypto to 0.43.0 GH-13518

1.14.2 (September 9, 2025)

✨ Features

• HCP Certificate Authentication Support – by @JenGoldstrich (#13435)
  Adds support for the HCP_CRED_FILE environment variable and removes restrictions on HCP_CLIENT_ID and HCP_CLIENT_SECRET when connecting builds to an HCP Packer registry.

• Upgrade Node.js to v22 – by @LeahMarieBush (#13450)
  Updates the Node.js version used for Packer website builds.

---

🐛 Bug Fixes

• fix(winrm): catch cmd err from winrm – by @anurag5sh in (#298)
  Improved reliability by catching WinRM remote shell failures during provisioning
• PowerShell wrapper cleanup – by @kp2099 (#13451)
  Removed the unused $result variable from the wrapper string.
• fix tests for shell and shell-local – by @kp2099 in (#300)
  Acceptance test fixes for shell and shell-local

---

🛠 Improvements

• Added workflow-dispatch and set PACKER_ACC_BUILDERS for acceptance tests – by @kp2099 (#13444)
• Improved spacing in hcl2template error messages – by @sbraz (#13453)
• Added callouts for HashiCorp-maintained plugins moving to releases.hashicorp.com – by @BrianMMcClain (#13438)

---

📦 Dependencies

• Bump github.com/ulikunitz/xz from 0.5.10 → 0.5.14 – by @dependabot (#13459)
• Bump golang.org/x/oauth2 from 0.13.0 → 0.27.0 – by @dependabot (#13460)
• Bump github.com/ulikunitz/xz from 0.5.10 → 0.5.15 – by @kp2099 (#13461)
• Bump github.com/hashicorp/packer-plugin-sdk from 0.6.2 → 0.6.3 – by @kp2099 (#13462)

---

👩‍💻 New Contributors

• @LeahMarieBush made their first contribution in #13450 🎉

1.14.1 (August 5, 2025)

BUG FIXES:

• core: Changes on the packer plugin installation process to ensure that the plugin is installed correctly. The releases binary from official site releases.hashicorp.com was not getting installed from a proxy server, which was addressed in this PR. GH-13439

Nightly releases are snapshots of the development activity on the Packer project that may include new features and bug fixes scheduled for upcoming releases. These releases are made available to make it easier for users to test their existing build configurations against the latest Packer code base for potential issues or to experiment with new features, with a chance to provide feedback on ways to improve the changes before being released.

As these releases are snapshots of the latest code, you may encounter an issue compared to the latest stable release. Users are encouraged to run nightly releases in a non production environment. If you encounter an issue, please check our issue tracker to see if the issue has already been reported; if a report hasn't been made, please report it so we can review the issue and make any needed fixes.

Note: Nightly releases are only available via GitHub Releases, and artifacts are not codesigned or notarized. Distribution via other Release Channels such as the Releases Site or Homebrew is not yet supported.