# Packer changelog

> Build automated machine images.

- Vendor: HashiCorp
- Category: Developer Tools
- Official site: https://www.packer.io
- Tracked by: What's New (https://whatsnew.fyi/product/packer)
- Harvested from: GitHub (hashicorp/packer)
- Entries below: 10 (newest first)

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

## Releases

### v1.16.0

- Date: 2026-07-24
- Version: v1.16.0
- Original notes: https://github.com/hashicorp/packer/releases/tag/v1.16.0
- Permalink: https://whatsnew.fyi/product/packer/releases/v1.16.0

- **added** — Add new provenance post-processor and packer verify-attestation command for SLSA Build L1/L2 supply-chain attestations, deriving in-toto subjects from Packer artifacts, building SLSA Provenance v1 predicates with Git/CI metadata, and signing via local PEM key, cloud KMS, or keyless Sigstore
- **added** — Add rfc3339_parse and unix_timestamp_parse template functions that accept RFC 3339 timestamps, with unix_timestamp_parse additionally accepting Unix epoch integers
- **added** — Add continue_on_error meta-argument to provisioner blocks that logs provisioner failures and continues the build rather than halting when set to true
- **added** — Add support for optional() attribute modifiers in variable object types, allowing per-attribute defaults and omission of fields with defaults set
- **fixed** — Prevent path traversal vulnerability in GitHub plugin getter filename handling
- **fixed** — Update build constraints to support arm architecture on FreeBSD
- **security** — Drop x/crypto/openpgp by upgrading go-github from v33 to v75
- **security** — Suppress false positive for GO-2026-5932
- **security** — Bump golang.org/x/crypto to v0.54.0

##### 1.16.0 (July 24, 2026)

###### FEATURES:

* provenance: add new `provenance` post-processor and `packer verify-attestation` command for
  SLSA Build L1/L2 supply-chain attestations. Derives in-toto subjects from Packer artifacts,
  builds SLSA Provenance v1 predicates with Git/CI metadata, and signs via local PEM key, cloud
  KMS (`awskms://`, `gcpkms://`, `azurekms://`, `hashivault://`), or keyless Sigstore (Fulcio +
  optional Rekor transparency log). Reference CI workflows for L2 keyless and L3-compatible
  delegated-signing patterns are included under `examples/ci/`.
    [GH-13667](https://github.com/hashicorp/packer/pull/13667)
* core/hcl2: add `rfc3339_parse` and `unix_timestamp_parse` template functions. Both accept
  RFC 3339 timestamps; `unix_timestamp_parse` additionally accepts Unix epoch integers.
    [GH-13669](https://github.com/hashicorp/packer/pull/13669)
* core/hcl2: add `continue_on_error` meta-argument to provisioner blocks. When set to `true`,
  a provisioner failure is logged and the build continues rather than halting.
    [GH-13674](https://github.com/hashicorp/packer/pull/13674)
* core/hcl2: variable `object` types now support `optional()` attribute modifiers, allowing
  object variables to declare per-attribute defaults and omit fields that have a default set.
    [GH-13670](https://github.com/hashicorp/packer/pull/13670)

###### BUG FIXES:

* plugin/getter: prevent path traversal vulnerability in GitHub plugin getter filename handling.
    [GH-13680](https://github.com/hashicorp/packer/pull/13680)
* build: update build constraints to support arm architecture on FreeBSD.
    [GH-13650](https://github.com/hashicorp/packer/pull/13650)

###### SECURITY:

* security: drop `x/crypto/openpgp` by upgrading `go-github` v33 → v75.
    [GH-13676](https://github.com/hashicorp/packer/pull/13676)
* security: suppress false positive for GO-2026-5932.
    [GH-13677](https://github.com/hashicorp/packer/pull/13677)
* deps: bump `golang.org/x/crypto` to v0.54.0.
    [GH-13672](https://github.com/hashicorp/packer/pull/13672)

###### DEPENDENCIES:

* deps: bump `github.com/hashicorp/packer-plugin-sdk` to `v0.6.10`.
    [GH-13673](https://github.com/hashicorp/packer/pull/13673)
* deps: bump `github.com/hashicorp/hcp-sdk-go` to `v0.174.0`.
    [GH-13673](https://github.com/hashicorp/packer/pull/13673)
* deps: bump `github.com/zclconf/go-cty` to `v1.18.1`.
    [GH-13673](https://github.com/hashicorp/packer/pull/13673)
* deps: bump `github.com/google/go-github` v33 → v75.
    [GH-13676](https://github.com/hashicorp/packer/pull/13676)
* deps: bump `golang.org/x/net` to `v0.56.0`.
    [GH-13664](https://github.com/hashicorp/packer/pull/13664)
* deps: update various Go module dependencies.
    [GH-13673](https://github.com/hashicorp/packer/pull/13673)

###### INTERNAL:

* ci: pin GitHub Action refs to latest verified SHAs.
    [GH-13675](https://github.com/hashicorp/packer/pull/13675)
* chore: remove old website references.
    [GH-13668](https://github.com/hashicorp/packer/pull/13668)

### v1.15.4

- Date: 2026-06-03
- Version: v1.15.4
- Original notes: https://github.com/hashicorp/packer/releases/tag/v1.15.4
- Permalink: https://whatsnew.fyi/product/packer/releases/v1.15.4

- **fixed** — Update build constraints to support arm architecture on FreeBSD
- **changed** — Remove Syft binary download/handling from the HCP SBOM provisioner
- **security** — Upgrade crypto version
- **security** — Upgrade go-git version
- **security** — Bump github.com/hashicorp/packer-plugin-sdk to 0.6.9

##### 1.15.4 (June 3, 2026)

###### BUG FIXES:

* builder: update build constraints to support arm architecture on FreeBSD
    [GH-13650](https://github.com/hashicorp/packer/pull/13650)

###### IMPROVEMENTS:

* hcp: removes Syft binary download/handling from the HCP SBOM provisioner
    [GH-13636](https://github.com/hashicorp/packer/pull/13636)

###### SECURITY:

* deps: upgraded crypto version
    [GH-13645](https://github.com/hashicorp/packer/pull/13645)
* deps: upgraded go-git version
    [GH-13645](https://github.com/hashicorp/packer/pull/13645)
* deps: bump github.com/hashicorp/packer-plugin-sdk to 0.6.9
    [GH-13640](https://github.com/hashicorp/packer/pull/13640)

###### INTERNAL:

* build: bump Go to 1.25.10 and refresh dependencies
    [GH-13646](https://github.com/hashicorp/packer/pull/13646)
    [GH-13647](https://github.com/hashicorp/packer/pull/13647)
* deps: update cloud.google.com/go and aws-sdk-go-v2 related dependencies
    [GH-13610](https://github.com/hashicorp/packer/pull/13610)

### v1.15.3

- Date: 2026-04-27
- Version: v1.15.3
- Original notes: https://github.com/hashicorp/packer/releases/tag/v1.15.3
- Permalink: https://whatsnew.fyi/product/packer/releases/v1.15.3

- **fixed** — Skip bucket update requests when description and labels already match in HCP, avoiding unnecessary updates for existing buckets

##### 1.15.3 (April 27, 2026)

###### BUG FIXES:

* hcp: skip bucket update requests when description and labels already match, avoiding unnecessary updates for existing buckets.
    [GH-13624](https://github.com/hashicorp/packer/pull/13624)

### v1.15.2

- Date: 2026-04-24
- Version: v1.15.2
- Original notes: https://github.com/hashicorp/packer/releases/tag/v1.15.2
- Permalink: https://whatsnew.fyi/product/packer/releases/v1.15.2

- **added** — Add support for the enforced provisioner
- **security** — Bump github.com/go-jose/go-jose/v4
- **security** — Bump go.opentelemetry.io/otel/sdk
- **security** — Update cloud.google.com/go and aws-sdk-go-v2 related dependencies

##### 1.15.2 (April 21, 2026)

###### FEATURES:

* provisioner: added support for the enforced provisioner.
    [GH-13591](https://github.com/hashicorp/packer/pull/13591)


###### SECURITY:

* deps: bump github.com/go-jose/go-jose/v4
    [GH-13594](https://github.com/hashicorp/packer/pull/13594)
* deps: bump go.opentelemetry.io/otel/sdk
    [GH-13606](https://github.com/hashicorp/packer/pull/13606)
* deps: update cloud.google.com/go and aws-sdk-go-v2 related dependencies
    [GH-13610](https://github.com/hashicorp/packer/pull/13610)

###### INTERNAL:

* build: bump Go to 1.25.9 and refresh dependencies
    [GH-13614](https://github.com/hashicorp/packer/pull/13614)
    [GH-13615](https://github.com/hashicorp/packer/pull/13615)

### v1.15.1

- Date: 2026-03-26
- Version: v1.15.1
- Original notes: https://github.com/hashicorp/packer/releases/tag/v1.15.1
- Permalink: https://whatsnew.fyi/product/packer/releases/v1.15.1

- **added** — Add native SBOM generation for HCP
- **fixed** — Scrub multiline sensitive values from build output including OS-specific multiline sensitive-value fixtures
- **security** — Bump syft to v1.42.3 to fix GO-2026-4809
- **security** — Bump github.com/hashicorp/packer-plugin-sdk to v0.6.7
- **security** — Bump github.com/hashicorp/hcp-sdk-go from 0.136.0 to 0.167.0
- **security** — Update OpenTelemetry dependencies to v1.41.0
- **security** — Upgrade go-git to v5.17.0 and grpc to 1.79.3
- **security** — Update circl dependency to v1.6.3

##### 1.15.1 (March 26, 2026)

###### FEATURES:

* hcp: native sbom generation for hcp. Refer to the guide [here](https://developer.hashicorp.com/packer/docs/provisioners/hcp-sbom) for more information.
    [GH-13566](https://github.com/hashicorp/packer/pull/13566)

###### BUG FIXES:

* core: Scrub multiline sensitive values from build output (including OS-specific multiline sensitive-value fixtures)
    [GH-13582](https://github.com/hashicorp/packer/pull/13582)

###### SECURITY:

* deps: bump syft to v1.42.3 (fixes GO-2026-4809)
    [GH-13581](https://github.com/hashicorp/packer/pull/13581)
* deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.7
    [GH-13581](https://github.com/hashicorp/packer/pull/13581)
* deps: bump github.com/hashicorp/hcp-sdk-go from 0.136.0 to 0.167.0
    [GH-13560](https://github.com/hashicorp/packer/pull/13560)
* deps: Updates OpenTelemetry dependencies to v1.41.0
    [GH-13572](https://github.com/hashicorp/packer/pull/13572)
* deps: Upgrade go-git to v5.17.0 and grpc to 1.79.3
    [GH-13570](https://github.com/hashicorp/packer/pull/13570)
* deps: Updates circl dependency to v1.6.3
    [GH-13564](https://github.com/hashicorp/packer/pull/13564)

###### INTERNAL:

* ci: Adds grouped and scheduled updates for GitHub Actions (monthly, grouped PRs, ignore major bumps)
    [GH-13575](https://github.com/hashicorp/packer/pull/13575)
* docs: remove docs validation from packer (docs changes move to web-unified-docs)
    [GH-13577](https://github.com/hashicorp/packer/pull/13577)
* legal: Update LICENSE
    [GH-13563](https://github.com/hashicorp/packer/pull/13563)

### v1.15.0

- Date: 2026-02-04
- Version: v1.15.0
- Original notes: https://github.com/hashicorp/packer/releases/tag/v1.15.0
- Permalink: https://whatsnew.fyi/product/packer/releases/v1.15.0

- **added** — Add support for updating HCP Packer registry channels and bucket log UI metadata
- **changed** — Update Go to 1.24.12
- **changed** — Remove vmware and vsphere from the packer full image
- **fixed** — Update datasource/http acceptance test URL to avoid rate limiting
- **fixed** — Ensure LASTEXITCODE is set before checking its value in provisioner/powershell tests
- **security** — Bump golang.org/x/crypto to 0.46.0

##### 1.15.0 (February 4, 2026)

###### IMPROVEMENTS:

* core/hcp: add support for updating HCP Packer registry channels and bucket log UI metadata.
    [GH-13532](https://github.com/hashicorp/packer/pull/13532)

* build: update Go to 1.24.12.
    [GH-13553](https://github.com/hashicorp/packer/pull/13553)

* docker: remove vmware and vsphere from the packer full image.
    [GH-13442](https://github.com/hashicorp/packer/pull/13442)

* docs: add comments to packer docs.
    [GH-13534](https://github.com/hashicorp/packer/pull/13534)

* compliance: update copyright and license headers.
    [GH-13540](https://github.com/hashicorp/packer/pull/13540)
    [GH-13543](https://github.com/hashicorp/packer/pull/13543)
    [GH-13545](https://github.com/hashicorp/packer/pull/13545)
    [GH-13544](https://github.com/hashicorp/packer/pull/13544)

###### BUG FIXES:

* datasource/http: update acceptance test URL to avoid rate limiting.
    [GH-13480](https://github.com/hashicorp/packer/pull/13480)

* provisioner/powershell: ensure `LASTEXITCODE` is set before checking its value in tests.
    [GH-13539](https://github.com/hashicorp/packer/pull/13539)

###### SECURITY:

* Bump golang.org/x/crypto to 0.46.0
    [GH-13546](https://github.com/hashicorp/packer/pull/13546)

### v1.14.3

- Date: 2025-11-18
- Version: v1.14.3
- Original notes: https://github.com/hashicorp/packer/releases/tag/v1.14.3
- Permalink: https://whatsnew.fyi/product/packer/releases/v1.14.3

- **added** — Added CI/CD metadata support for BitBucket and Jenkins pipelines in HCP
- **changed** — Bumped github.com/hashicorp/packer-plugin-sdk to 0.6.4
- **fixed** — Fixed typos and linguistic errors in documentation
- **security** — Bumped golang.org/x/crypto to 0.43.0

##### 1.14.3 (November 18, 2025)

###### IMPROVEMENTS:

* core/hcp: added cicd metadata support for BitBucket and Jenkins pipelines.
  [GH-13513](https://github.com/hashicorp/packer/pull/13513)
  [GH-13505](https://github.com/hashicorp/packer/pull/13505)

* core: bump github.com/hashicorp/packer-plugin-sdk to 0.6.4
  [GH-13494](https://github.com/hashicorp/packer/pull/13494)

* docs: fix typos and linguistic errors in documentation.
  [GH-13496](https://github.com/hashicorp/packer/pull/13496)

###### SECURITY:

* Bump golang.org/x/crypto to 0.43.0
  [GH-13518](https://github.com/hashicorp/packer/pull/13518)

### v1.14.2

- Date: 2025-09-09
- Version: v1.14.2
- Original notes: https://github.com/hashicorp/packer/releases/tag/v1.14.2
- Permalink: https://whatsnew.fyi/product/packer/releases/v1.14.2

##### 1.14.2 (September 9, 2025)
##### ✨ Features
- **HCP Certificate Authentication Support** – by @JenGoldstrich ([#13435](https://github.com/hashicorp/packer/pull/13435))  
  Adds support for the `HCP_CRED_FILE` environment variable and removes restrictions on `HCP_CLIENT_ID` and `HCP_CLIENT_SECRET` when connecting builds to an HCP Packer registry.

- **Upgrade Node.js to v22** – by @LeahMarieBush ([#13450](https://github.com/hashicorp/packer/pull/13450))  
  Updates the Node.js version used for Packer website builds.

---

##### 🐛 Bug Fixes
- **fix(winrm): catch cmd err from winrm** – by @anurag5sh in ([#298](https://github.com/hashicorp/packer-plugin-sdk/pull/298))  
  Improved reliability by catching WinRM remote shell failures during provisioning
- **PowerShell wrapper cleanup** – by @kp2099 ([#13451](https://github.com/hashicorp/packer/pull/13451))  
  Removed the unused `$result` variable from the wrapper string.
- **fix tests for shell and shell-local** – by @kp2099 in ([#300](https://github.com/hashicorp/packer-plugin-sdk/pull/300))  
  Acceptance test fixes for shell and shell-local

---

##### 🛠 Improvements
- Added workflow-dispatch and set `PACKER_ACC_BUILDERS` for acceptance tests – by @kp2099 ([#13444](https://github.com/hashicorp/packer/pull/13444))
- Improved spacing in `hcl2template` error messages – by @sbraz ([#13453](https://github.com/hashicorp/packer/pull/13453))
- Added callouts for HashiCorp-maintained plugins moving to [releases.hashicorp.com](https://releases.hashicorp.com) – by @BrianMMcClain ([#13438](https://github.com/hashicorp/packer/pull/13438))

---

##### 📦 Dependencies
- Bump `github.com/ulikunitz/xz` from **0.5.10 → 0.5.14** – by @dependabot ([#13459](https://github.com/hashicorp/packer/pull/13459))
- Bump `golang.org/x/oauth2` from **0.13.0 → 0.27.0** – by @dependabot ([#13460](https://github.com/hashicorp/packer/pull/13460))
- Bump `github.com/ulikunitz/xz` from **0.5.10 → 0.5.15** – by @kp2099 ([#13461](https://github.com/hashicorp/packer/pull/13461))
- Bump `github.com/hashicorp/packer-plugin-sdk` from **0.6.2 → 0.6.3** – by @kp2099 ([#13462](https://github.com/hashicorp/packer/pull/13462))

---

##### 👩‍💻 New Contributors
- @LeahMarieBush made their first contribution in [#13450](https://github.com/hashicorp/packer/pull/13450) 🎉

### v1.14.1

- Date: 2025-08-05
- Version: v1.14.1
- Original notes: https://github.com/hashicorp/packer/releases/tag/v1.14.1
- Permalink: https://whatsnew.fyi/product/packer/releases/v1.14.1

##### 1.14.1 (August 5, 2025)

###### BUG FIXES:

* core: Changes on the packer plugin installation process to ensure that the plugin is installed correctly.
  The releases binary from official site releases.hashicorp.com was not getting installed from a proxy server, which was addressed in this PR.
  [GH-13439](https://github.com/hashicorp/packer/pull/13439)

### nightly

- Date: 2022-03-10
- Version: nightly
- Original notes: https://github.com/hashicorp/packer/releases/tag/nightly
- Permalink: https://whatsnew.fyi/product/packer/releases/nightly
- Labels: Pre-release; nightly

Nightly releases are snapshots of the development activity on the Packer project that may include new features and bug fixes scheduled for upcoming [releases](https://github.com/hashicorp/packer/milestones). These releases are made available to make it easier for users to test their existing build configurations against the latest Packer code base for potential issues or to experiment with new features, with a chance to provide feedback on ways to improve the changes before being released.

As these releases are snapshots of the latest code, you may encounter an issue compared to the latest stable release. Users are encouraged to run nightly releases in a non production environment. If you encounter an issue, please check our [issue tracker](https://github.com/hashicorp/packer/issues) to see if the issue has already been reported; if a report hasn't been made, please report it so we can review the issue and make any needed fixes.

**Note**: Nightly releases are only available via GitHub Releases, and artifacts are not codesigned or notarized. Distribution via other [Release Channels](https://www.hashicorp.com/official-release-channels) such as the Releases Site or Homebrew is not yet supported.