Terragrunt Release Notes

🎉 v1.0.0 Release Candidate

This is the second release candidate for Terragrunt 1.0. This release includes bug fixes, documentation updates and a couple breaking changes since RC1 that are necessary to ensure a maximally stable 1.0. With the release of 1.0 in March, you can expect many stability guarantees from Terragrunt, which are documented here. You have roughly 3-5 weeks to influence the final 1.0 release, so make sure you try this release candidate out and share your feedback. If you are happy with this release, make sure to share your feedback with an emoji or a comment on the associated GitHub Discussion. You can learn more about the release candidate process in The Road to 1.0: Release Schedule blog post.

🛠️ Breaking Changes

render --format=json no longer discovers dependents by default

Prior to this release, the render --format=json command would automatically start to perform dependent discovery on other units related to the unit being rendered. Avoiding this required usage of the --disable-dependent-modules flag. That behavior has been removed. HCL and JSON rendering of unit configurations will now proceed without the additional overhead of dependent discovery by default.

This functionality is better served by a combination of find and graph-based filters.

e.g. If you want to detect all the dependents of a given unit foo, expecting to find the dependent unit bar you can run the following:

$ terragrunt find --filter '...^foo'
bar

If you aren’t familiar with filters, this reads as “find all dependents of foo, not foo itself”

🏎️ Performance Improvements

Discovery performance improved

The way in which Terragrunt discovers and filters units and stacks for runs has improved significantly. Terragrunt is now better at avoiding parsing units/stacks unnecessarily, based on the filter you use. Previously, the logic used was more coarse, and could result in a requirement to parse some configurations (e.g. presence of a dependency graph expression to result in parsing all configurations. Discovery has been refactored to allow for much more careful opt-in parsing based on the need to support the filter used by users (or lack thereof). This will also result in improvements to Terragrunt’s ability to ignore broken parts of infrastructure estates when Terragrunt can predictably determine that it won’t impact a run.

EncodeSourceVersion execution sped up

The performance of EncodeSourceVersion has been improved by utilizing SkipDir to optimize directory traversals.

Special thanks to @healthy-pod for contributing this improvement!

🐛 Bug Fixes

Retries added for registry timeouts in provider cache server

The Provider Cache Server will now perform automatic retries on timeouts to OpenTofu/Terraform provider registries.

Discoverability of init-from-module documentation improved

The special internal init-from-module command referenced in hooks has had its documentation improved to make it easier to discover. It was difficult to find in the terraform HCL block documentation, and that resulted in confusion for users.

Over-warning on strict controls prevented

Using --strict-mode resulted in over-warning on completed controls. Those warnings will no longer appear when using strict mode.

Stdout/stderr from run_cmd emitted when included

A bug prevented the run_cmd HCL function from emitting to stdout/stderr when included by a unit. That bug has been fixed.

Provider Cache Server integration with custom registries fixed

The Provider Cache Server now properly integrates with custom registries. You will still need to use the --provider-cache-registry-names flag to ensure that the Provider Cache Server properly handles proxying requests to the custom provider registry.

The no_run attribute of exclude is fixed

A bug prevented the no_run attribute of the exclude block from being respected when being explicitly set to false (as opposed to not being defined at all). This bug has been fixed.

The --report-file is now respected for single runs

The --report-file will now generate reports even when runs are performed without the --all flag.

Path manipulation removed from log messages

Log messages no longer have paths updated automatically. This caused confusion for users when seeing OpenTofu/Terraform stdout and hook stdout emitted through logs, as paths were unconditionally updated to be relative to the unit path. This logic has been moved to logging call sites to ensure that external process stdout/stderr is not manipulated unexpectedly.

Absolute URLs in registry self-discovery integration with Provider Cache Server Fixed

When using the Provider Cache Server in conjunction with a remote registry using absolute URLs for modules, the Provider Cache Server will now properly resolve the module source.

SOPS decryption race condition fixed

A race condition in the concurrent access to SOPS decrypted secrets in different environments combined with usage of the --auth-provider-cmd flag resulted in authentication failures. Synchronization controls have been introduced to ensure authentication proceeds correctly for each environment independently.

Version constraints in stack runs fixed

When running against a stack, a bug prevented Terragrunt + OpenTofu/Terraform version constraints from being respected while using the terragrunt_version_constraint and terraform_version_constraint HCL attributes. That bug has been fixed.

Interrupt signal propagation to OpenTofu/Terraform fixed

The mechanism by which Terragrunt sends interrupt signals to OpenTofu/Terraform processes it started has been made more robust. Terragrunt will now send the interrupt signal in the event that a user explicitly sends an interrupt signal to Terragrunt in addition to scenarios where Terragrunt’s context cancellation is triggered (e.g. in the event of a timeout).

Remote state configuration parsing fixed

Remote state configuration parsing (especially S3) is now more tolerant of common input formats, reducing decode-related failures from type mismatches in configuration values. Parsing behavior has also been made more consistent across related remote configuration blocks in Terragrunt, with regression tests added to prevent future breakages.

Invalid unit configurations cause explicit errors instead of silently being excluded during runs

A bug in discovery logic resulted in units with invalid HCL configurations being silently excluded from runs with a warning. This bug has been fixed, and attempting to parse invalid HCL configurations during a run will result in an error.

Partial parse configuration cache fixed

A bug affecting the partial parse configuration cache (in use when the --use-partial-parse-config-cache flag is supplied) has been resolved, ensuring configurations are cached and read accurately without incorrect cache collisions.

Engine output adjusted

The display and formatting of engine outputs have been updated to be cleaner and more intuitive for users when running Terragrunt workflows. Stdout/Stderr entries emitted from engines will now have the engine tool listed instead of tofu.

⚙️ Process Updates

Go bumped to v1.26

The version of Golang used to compile the Terragrunt binary has been updated to v1.26.0.

OpenTofu/Terraform Compatibility Updated

Terragrunt is now continuously tested against OpenTofu 1.11.4 and Terraform 1.14.4 in CI.

AWS and GRPC dependencies update

Updated AWS SDK and gRPC dependencies to pick up the latest bug fixes and security patches:
google.golang.org/grpc to v1.79.1
github.com/aws/aws-sdk-go-v2/config to v1.32.8
github.com/aws/aws-sdk-go-v2/credentials to v1.19.8

What's Changed

• perf: speed up EncodeSourceVersion by using SkipDir by @healthy-pod in #4533
• perf: Adding discovery benchmark by @yhakbar in #5562
• fix: Handle registry timeouts in provider cache server by @yhakbar in #5471
• fix: Adding test for init-from-module and improving discoverability by @yhakbar in #5491
• fix: Fixing over-warning on strict controls by @yhakbar in #5501
• fix: Emit output from run_cmd when included by @yhakbar in #5495
• fix: Fixing provider cache server integration with custom registry by @yhakbar in #5500
• fix: Fixing exclude no_run behavior by @yhakbar in #5506
• fix: Adding -report-file support to single runs by @yhakbar in #5507
• fix: Removing path manipulation in log messages by @yhakbar in #5489
• fix: Fixing cache server absolute URLs in self-discovery by @yhakbar in #5519
• fix: SOPS decryption env variables locking by @denis256 in #5522
• fix: Fixing respect for version constraints when running a stack by @yhakbar in #5516
• fix: Fixing signal propagation by @yhakbar in #5518
• fix: Addressing render --format=json by @yhakbar in #5511
• fix: Remote config parsing improvements by @denis256 in #5540
• fix: Fixing partial parse config cache by @yhakbar in #5538
• fix: Using SyncWriter to fix TestTerragruntReportWithUnitTiming flakes by @yhakbar in #5494
• fix: Adjusting engine output by @yhakbar in #5386
• docs: Updates the discord link by @karlcarstensen in #5521
• docs: New ambassador by @karlcarstensen in #5496
• docs: Simple component for pagefind styles by @karlcarstensen in #5523
• docs: Pagefind css by @karlcarstensen in #5524
• docs: Fix command reference in CLI redesign documentation by @PedroMartinSteenstrup-htg in #5541
• docs: Adding Golang compatibility notes by @yhakbar in #5544
• docs: Breaking down filters docs by @yhakbar in #5552
• docs: Revert css fixes now that docs site is live by @karlcarstensen in #5556
• docs: Making filter docs a bit more consistent by @yhakbar in #5557
• docs: Adding callout for the lack of library compatibility guarantees by @yhakbar in #5564
• docs: Documenting deprecation of --disable-dependent-modules by @yhakbar in #5539
• chore: Adding testing for RelPathForLog by @yhakbar in #5513
• chore: dependencies update - otel, aws, go-git by @denis256 in #5533
• chore: removed unused constants, simplified noRun checking by @denis256 in #5517
• chore: Adding VFS testing by @yhakbar in #5490
• chore: Refactor discovery for nuanced parse handling by @yhakbar in #5477
• chore: Units code cleanup by @denis256 in #5550
• chore: go bump to 1.25.6 by @denis256 in #5481
• chore: IaC update - Terraform 1.14.4 Opentofu 1.11.4 by @denis256 in #5479
• chore: Bumping Go to 1.26 by @yhakbar in #5543
• chore: SOPS tests improvements by @denis256 in #5554
• chore: Removing options from components by @yhakbar in #5551
• chore: refactor cache dir exclusion code by @healthy-pod in #5559
• chore: Clean up of #5559 by @yhakbar in #5561
• chore: Reducing dependency on opts in config by @yhakbar in #5560
• chore: CICD base tests performance improvements by @denis256 in #5505
• chore(deps): bump aws-actions/configure-aws-credentials from 5 to 6 by @dependabot[bot] in #5553
  New Contributors
• @PedroMartinSteenstrup-htg made their first contribution in #5541
• @healthy-pod made their first contribution in #4533

Full Changelog: v1.0.0-rc1...v1.0.0-rc2

Original source Report a problem

🏎️ Performance Improvements

Discovery performance improved

The way in which Terragrunt discovers and filters units and stacks for runs has improved significantly. Terragrunt is now better at avoiding parsing units/stacks unnecessarily, based on the filter you use. Previously, the logic used was more coarse, and could result in a requirement to parse some configurations (e.g. presence of a dependency graph expression to result in parsing all configurations. Discovery has been refactored to allow for much more careful opt-in parsing based on the need to support the filter used by users (or lack thereof). This will also result in improvements to Terragrunt’s ability to ignore broken parts of infrastructure estates when Terragrunt can predictably determine that it won’t impact a run.

🐛 Bug Fixes

Invalid unit configurations cause explicit errors instead of silently being excluded during runs

A bug in discovery logic resulted in units with invalid HCL configurations being silently excluded from runs with a warning. This bug has been fixed, and attempting to parse invalid HCL configurations during a run will result in an error.

What's Changed

chore: Backporting #5477 by @yhakbar in #5567

Full Changelog: v0.99.3...v0.99.4

Original source Report a problem

⚠️ Alpha Release

Release process testing after CICD pipeline updates

What's Changed

• chore: Refactor discovery for nuanced parse handling by @yhakbar in #5477
• chore: Units code cleanup by @denis256 in #5550
• chore(deps): bump aws-actions/configure-aws-credentials from 5 to 6 by @dependabot[bot] in #5553
• fix: Adjusting engine output by @yhakbar in #5386
• docs: Breaking down filters docs by @yhakbar in #5552
• chore: SOPS tests improvements by @denis256 in #5554
• perf: speed up EncodeSourceVersion by using SkipDir by @healthy-pod in #4533
• Revert css fixes now that docs site is live by @karlcarstensen in #5556

New Contributors

• @healthy-pod made their first contribution in #4533

Full Changelog: alpha-2026021301...alpha-2026021701

Original source Report a problem

🐛 Bug Fixes

Interrupt signal propagation to OpenTofu/Terraform fixed
The mechanism by which Terragrunt sends interrupt signals to OpenTofu/Terraform processes it started has been made more robust. Terragrunt will now send the interrupt signal in the event that a user explicitly sends an interrupt signal to Terragrunt in addition to scenarios where Terragrunt’s context cancellation is triggered (e.g. in the event of a timeout).

SOPS decryption race condition fixed
A race condition in the concurrent access to SOPS decrypted secrets in different environments combined with usage of the --auth-provider-cmd flag resulted in authentication failures. Synchronization controls have been introduced to ensure authentication proceeds correctly for each environment independently.

What's Changed

• chore: Backporting #5518 to v0.99 by @yhakbar in #5547
• chore: SOPS decode improvements by @denis256 in #5549
• Full Changelog: v0.99.1...v0.99.2

Original source Report a problem

⚠️ Alpha Release

Release process testing after CICD pipeline updates

What's Changed

• fix: Handle registry timeouts in provider cache server by @yhakbar in #5471
• chore: go bump to 1.25.6 by @denis256 in #5481
• chore: IaC update - Terraform 1.14.4 Opentofu 1.11.4 by @denis256 in #5479
• New ambassador by @karlcarstensen in #5496
• fix: Adding test for init-from-module and improving discoverability by @yhakbar in #5491
• fix: Fixing over-warning on strict controls by @yhakbar in #5501
• fix: Emit output from run_cmd when included by @yhakbar in #5495
• fix: Fixing provider cache server integration with custom registry by @yhakbar in #5500
• fix: Fixing exclude no_run behavior by @yhakbar in #5506
• fix: Adding --report-file support to single runs by @yhakbar in #5507
• fix: Removing path manipulation in log messages by @yhakbar in #5489
• Updates the discord link by @karlcarstensen in #5521
• chore: Adding testing for RelPathForLog by @yhakbar in #5513
• Simple component for pagefind styles by @karlcarstensen in #5523
• Pagefind css by @karlcarstensen in #5524
• chore: dependencies update - otel, aws, go-git by @denis256 in #5533
• chore: removed unused constatns, simplified noRun checking by @denis256 in #5517
• fix: Fixing cache server absolute URLs in self-discovery by @yhakbar in #5519
• fix: SOPS decryption env variables locking by @denis256 in #5522
• fix: Fixing respect for version constraints when running a stack by @yhakbar in #5516
• fix: Fixing signal propagation by @yhakbar in #5518
• fix: Addressing render --format=json by @yhakbar in #5511
• chore: Adding VFS testing by @yhakbar in #5490
• Fix command reference in CLI redesign documentation by @PedroMartinSteenstrup-htg in #5541
• docs: Adding Golang compatibility notes by @yhakbar in #5544
• chore: Bumping Go to 1.26 by @yhakbar in #5543
• Remote config parsing improvements by @denis256 in #5540
• fix: Fixing partial parse config cache by @yhakbar in #5538
• fix: Using SyncWriter to fix TestTerragruntReportWithUnitTiming flakes by @yhakbar in #5494

New Contributors

• @PedroMartinSteenstrup-htg made their first contribution in #5541

Full Changelog: v1.0.0-rc1...alpha-2026021301

Original source Report a problem

⚠️ Alpha Release

SOPS decryption race condition fix

Fixed a race condition when setting environment variables used to decode SOPS secrets

What's Changed

• fix: Handle registry timeouts in provider cache server by @yhakbar in #5471
• chore: go bump to 1.25.6 by @denis256 in #5481
• chore: IaC update - Terraform 1.14.4 Opentofu 1.11.4 by @denis256 in #5479
• New ambassador by @karlcarstensen in #5496
• fix: Adding test for init-from-module and improving discoverability by @yhakbar in #5491
• fix: Fixing over-warning on strict controls by @yhakbar in #5501
• fix: Emit output from run_cmd when included by @yhakbar in #5495
• fix: Fixing provider cache server integration with custom registry by @yhakbar in #5500
• fix: Fixing exclude no_run behavior by @yhakbar in #5506
• fix: Adding --report-file support to single runs by @yhakbar in #5507
• fix: Removing path manipulation in log messages by @yhakbar in #5489
• Updates the discord link by @karlcarstensen in #5521
  Full Changelog: v1.0.0-rc1...alpha-2026020601

Original source Report a problem