Hashicorp Release Notes

1.16.0-rc2 (August 19, 2026)

NEW FEATURES:

Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. (#37986)

terraform_data: The new store block can hold ephemeral and sensitive values across plan and apply. (#38298)

Providers can now use nested blocks as computed values (#38305)

import: import blocks inside modules are now supported. (#38352)

Terraform is now available as a pre-built binary for Linux s390x (zLinux). (#38384)

Resource action triggers can now use on_failure modes of halt, taint, or continue. (#38722)

ENHANCEMENTS:

state show: The state show command can now produce machine-readable output when supplied with the -json flag (#23940)

workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)

test: Terraform now reports which resources were left behind when skip_cleanup is set. (#38449)

stacks: Action configurations now have access to a caller symbol containing the object value of the calling resource. (#38668)

Actions can now use before_destroy and after_destroy events. (#38668)

cloud: Terraform now displays a summary of policy evaluation outcomes for plan and apply runs against HCP Terraform. (#38715)

policy: Terraform now resolves policy plugin credentials from the configured cloud or remote backend during init, plan, and apply, rather than requiring the plugin to read credentials itself. (#38716)

graph: The terraform graph command can now output graphs in Mermaid format using the -format=mermaid flag. (#38719)

Child module outputs with unreferenced deprecated nested attributes no longer return deprecation warnings. (#38778)

Resource lifecycle blocks now support destroy = false to prevent a resource from being destroyed. (#38784)

The contains() function can now test for null values. (#38792)

console: The terraform console command now accepts an optional -scope=<module address> flag, which can be used to evaluate expressions within the scope of a module or a specific module instance. (#31861)

-invoke can now be combined with -target to specify the calling resource instance when multiple resources trigger the same action. (#38845)

The terraform stacks command now automatically infers the target hostname from the local credentials file (credentials.tfrc.json) when neither TF_STACKS_HOSTNAME nor TF_CLOUD_HOSTNAME is set (#38896)

BUG FIXES:

import blocks now correctly respect provider local names. (#38338)

terraform apply no longer panics when the plan contains a no-op change for a deposed resource that has lifecycle.precondition or lifecycle.postcondition blocks. (#38586)

workspace: Terraform now raises an error if an invalid workspace name becomes selected due to out-of-band changes. (#38594)

test: Terraform now raises a warning when a file referenced via the -filter flag does not exist. (#38603)

init: Terraform no longer removes locks from the dependency lock file for providers configured as dev_override. (#38634)

init: Terraform now warns when unmanaged providers are in use and may impact provider installation. (#38656)

Actions are now invoked with respect to all resource dependencies. (#38668)

Terraform now returns the correct error when an import target exists in state but has no corresponding configuration. (#38782)

The merge() function no longer panics when passed null objects. (#38792)

Allow underscores in provider source address namespaces, so private registry provider addresses are no longer rejected as invalid (#38894)

test: Optional ephemeral values do not have to be set at plan time (#38974)

NOTES:

init: Errors due to incompatible -upgrade and -lockfile=readonly flags are now raised earlier in the init process. (#38561)

UPGRADE NOTES:

bastion_host_key is now correctly applied by provisioners. Review your provisioner configurations to verify the configured key is correct before upgrading. (#38318)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

v1.15

v1.14

v1.13

v1.12

v1.11

v1.10

v1.9

v1.8

v1.7

v1.6

v1.5

v1.4

v1.3

v1.2

v1.1

v1.0

v0.15

v0.14

v0.13

v0.12

v0.11 and earlier

1.17.0-alpha20260812 (August 12, 2026)

ENHANCEMENTS:

command/init: Enrich log messages with provider versions (#38918)

BUG FIXES:

funcs: pow and log no longer panic when result is not a number (#38912)

ephemeral: Terraform will now use and display diagnostics raised when renewing an ephemeral resource. This may cause warnings to appear that previously were lost. We expect that any error diagnostics that were previously lost would have caused confusing downstream errors, so we do not anticipate this change to be breaking. (#38989)

NOTES:

version: JSON output now includes a new format_version field, which will enable safer future changes of the command's JSON output format. It is assumed existing tooling ignores unknown fields and therefore this change should not be breaking in itself but we advice consumers to pay attention to format_version in future releases and/or use latest version of hashicorp/terraform-json & hashicorp/terraform-exec which does. (#38930)

EXPERIMENTS:

Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.

The experimental "deferred actions" feature, enabled by passing the -allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values.

terraform test cleanup: The experimental test cleanup command. In experimental builds of Terraform, a manifest file and state files for each failed cleanup operation during test operations are saved within the .terraform local directory. The test cleanup command will attempt to clean up the local state files left behind automatically, without requiring manual intervention.

terraform test: backend blocks and skip_cleanup attributes:

Test authors can now specify backend blocks within run blocks in Terraform Test files. Run blocks with backend blocks will load state from the specified backend instead of starting from empty state on every execution. This allows test authors to keep long-running test infrastructure alive between test operations, saving time during regular test operations.

Test authors can now specify skip_cleanup attributes within test files and within run blocks. The skip_cleanup attribute tells terraform test not to clean up state files produced by run blocks with this attribute set to true. The state files for affected run blocks will be written to disk within the .terraform directory, where they can then be cleaned up manually using the also experimental terraform test cleanup command.

terraform query: The experimental -policies flag permits specifying one or more policy set directory paths to evaluate policies against resources discovered by list blocks during a query operation.

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.16
• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

2.0.4

August 04, 2026

BREAKING CHANGES

containers: The following packages have been removed from UBI based container images: gnupg, openssl, procps.

SECURITY

acl: Fix privilege-escalation vulnerability where a denied_parameters constraint on the policies request field could be bypassed by submitting a mixed-case policy name (e.g. "Super-Admin" instead of "super-admin"). Vault now normalizes the policies parameter to lowercase before evaluating allowed_parameters/denied_parameters constraints.

identity/scim (enterprise): The identity/entity/merge endpoint now rejects requests that involve any SCIM-managed entity, preventing privileged operators from bypassing SCIM ownership guardrails to transfer aliases, group memberships, or policies across SCIM boundaries.

identity: Prevent the entity batch-delete endpoint (identity/entity/batch-delete) from deleting the underlying storage of entities that belong to another namespace.

identity: entity/name updates now reject mismatched id or external_id selectors to prevent retargeting updates to a different entity

CHANGES

auth/oci: Update plugin to v0.21.3

core: Bump Go version to 1.26.5.

core: remove support for duplicate attributes in HCL configuration files and policy definitions. Parsing HCL with duplicate attributes now always fails, and the VAULT_ALLOW_PENDING_REMOVAL_DUPLICATE_HCL_ATTRIBUTES environment variable that previously restored the legacy behavior has been removed.

FEATURES

secrets: Added ability to view secrets in YAML format

IMPROVEMENTS

auth/cert: Support login via x-forwarded cert headers even with tls disabled on the vault listener.

core (enterprise): Add an endpoint at sys/config/oauth-resource-server/id/:config_id to read oauth resource server profiles by config_id

core (enterprise): Make OAuth resource server JWT typ validation more permissive for tokens from IdPs such as Okta by allowing a missing typ header, while restricting present typ values to at+jwt, application/at+jwt, and JWT.

core (entreprise): Ameriolate sealwrap lock contention for core paths.

core/acl: Adds a global deny_slash_in_templated_path configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to false.

core/identity: Adds a global deny_slash_in_templated_path configuration option to reject the presence of slashes in rendered identity templates in policies, defaulting to false.

core/managed-keys/PKCS#11 (enterprise): Providing a non-empty value for one field while the other is already saved is rejected. To switch addressing modes, you must explicitly clear the old field by sending it as an empty string ("") in the same request alongside the new value.

core/managed-keys/PKCS#11 (enterprise): slot and token_label are now strictly enforced as mutually exclusive identifiers for an HSM token

events: Add VAULT_EVENT_NOTIFICATIONS_BOUNDED_QUEUE_SIZE environment variable to configure bounded event queues for event notification subscribers. Set to a positive integer (e.g., 16) to enable buffered channels of that size (maximum 1000). This prevents resource exhaustion in deployments with high subscriber counts, but comes at the cost of the potential for subscribers to miss events. Defaults to 0 (unbuffered) for backward compatibility.

identity/scim (enterprise): Added filtering support to the GET /scim/v2/Users and GET /scim/v2/Groups endpoints per RFC 7644. Supported filters: userName eq, externalId eq, active eq, and meta.lastModified gt/ge/lt/le for Users; displayName eq and meta.lastModified gt/ge/lt/le for Groups. Unsupported filter expressions return HTTP 400. ServiceProviderConfig now advertises filter.supported: true.

identity/scim (enterprise): Improve SCIM User and Group listing endpoint performance by using prefix sort instead of a separate sort pass.

identity: Include entity status and entity/alias timestamp details in entity list key_info responses.

oauth-resource-server: Add support for fine-grained policy control options (parameter constraints) in Rich Authorization Requests (RAR), including allowed_parameters, denied_parameters, and required_parameters inside authorization_details.

oauth-resource-server: Add support for identity template expressions (e.g. {{identity.entity.id}}) in Rich Authorization Requests (RAR).

scim: User resources now include a read-only groups field listing the direct group memberships managed by the requesting SCIM client, per RFC 7643.

secrets/kv (enterprise): Support reading and recovering KVv2 secrets from a loaded snapshot, including in-place recover and copy-from-path within the same mount and namespace.

ui: Add a read-only YAML view option to the KV v2 secret details page, alongside the existing UI and JSON views.

ui: Bump pnpm.overrides entry for tmp from 0.2.6 to 0.2.7.

ui: Bump pnpm.overrides entry for ws from 8.20.1 to 8.21.0.

BUG FIXES

Proxy/Agent: Fixed a bug where auth method headers accumulated on the shared API client across re-auth cycles.

Proxy: Fixed a bug where the Vault token header accumulated duplicate values across WebSocket reconnects in the static secret cache updater.

Secrets Recovery (enterprise): Do not redirect to the active node for list requests to sys/storage/raft/snapshot-load or read/delete requests to sys/storage/raft/snapshot-load/{id}. If possible, handle these requests on the performance standby, otherwise forward the requests to the active node.

audit: Fix a regression from CVE-2025-6000 that broke enabling audit devices on Windows when a plugin directory was configured.

audit: make file and socket audit sink serialization context-aware so canceled or expired requests stop waiting behind blocked audit writes, reducing buildup of goroutines, memory, connections, and file descriptors during audit sink contention

auth/cert: Add support for x-forwarded cert headers coming from AWS ALBs.

auth/spiffe (enterprise): Use the full peer certificate chain when verifying certificates.

aws/auth: Redact EC2 instance metadata values from AWS auth error messages.

consumption-billing: Fix bug where PKI, SSH and SSH OTP certificate billing units from performance standby nodes were not being forwarded to active nodes for storage, causing billing events on standby nodes to be lost.

consumption-billing: Fix bug where SPIFFE JWT token billing units from performance standby nodes were not being forwarded to active nodes for storage, causing billing events on standby nodes to be lost.

consumption-billing: Fixed a bug where SSH duration-adjusted certificate counts and OTP counts whose decimal representation began with '4' could not be read back from storage, causing sys/billing/overview to return a 500 error with "lz4: bad magic number". The storage encoding now uses plain decimal strings consistent with other billing metrics, avoiding misidentification as lz4-compressed data.

consumption-billing: Fixed bug where OIDC token duration counts from performance standby nodes were not forwarded to active nodes for storage, causing billing events on standby nodes to be lost.

consumption-billing: Fixed deadlocks in KMIP and mount-scanning billing paths by avoiding nested lock acquisition during mount and plugin enumeration.

consumption-billing: Fixes LDAP and OpenLDAP dynamic and static role counting in use-case billing to use dedicated count endpoints (role-count, static-role-count) instead of LIST-based counting, which was undercounting roles.

core (enterprise): Fix a bug that causes unnecessary seal rewrapping.

core (enterprise): Preserve wrapping metadata when Control Group unwrap replays an approved request that returns a wrapped response.

core (enterprise): Update state checking of Sever-Side Consistent Token (SSCT) when used on performance secondary clusters. 403 response codes will be preferred over 412 for invalid, cross cluster token requests to secondary active nodes.

core/managed-keys (enterprise): Allow slot numbers above 32 bits in PKCS#11 managed keys.

core/seal: Fixed goroutine leak occurring when Encryption and Decryption functions time out.

core: Preserve URL query parameters when redirecting API requests containing duplicate slashes to their canonical path. Previously, the redirect dropped parameters such as ?list=true, potentially changing the result of the request.

events (enterprise): Fix a bug where events stopped being forwarded to performance secondaries after the active node restarted or had a change event (seal/unseal, etc).

export API: Normalize the end_time parameter in the activity export API to the end of the month to match the behavior stated in the documentation.

oauth-resource-server (enterprise): OAuth Resource Server authorization now treats an empty authorization_details array like an absent claim when authorization details are optional. Previously, tokens containing an empty array were rejected with RAR_NO_MATCH instead of continuing through normal identity and policy authorization.

secrets-sync (enterprise):fixed incorrect error response code mapping for GCP Secrets Sync Customer Controlled Encryption validations, which were returned as 500 Internal Server Error instead of 400 Bad Request.

secrets-sync: Fix GCP Secret Manager destinations losing their per-region KMS key on Vault restart.

secrets-sync: Fixes Custom Tags field in Details view to display keys with empty value

secrets/pki-external-ca (enterprise): Include the private key within the certificate API response field's PEMs when certificate_format is set to pem_bundle

secrets/transit (enterprise): Add managed key support to CSR sign and set certificate chain endpoints.

ui: Correctly handle string values ("true"/"false") for tls_disable when displaying TLS status in the Cluster Configuration widget.

ui: Fixes PKI generate root so Not valid after correctly controls cert expiration inputs.

1.17.0-alpha20260729 (July 29, 2026)

ENHANCEMENTS:

command/init: Enrich log messages with provider versions (#38918)

BUG FIXES:

funcs: pow and log no longer panic when result is not a number (#38912)

EXPERIMENTS:

Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.

The experimental "deferred actions" feature, enabled by passing the -allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values.

terraform test cleanup: The experimental test cleanup command. In experimental builds of Terraform, a manifest file and state files for each failed cleanup operation during test operations are saved within the .terraform local directory. The test cleanup command will attempt to clean up the local state files left behind automatically, without requiring manual intervention.

terraform test: backend blocks and skip_cleanup attributes:

Test authors can now specify backend blocks within run blocks in Terraform Test files. Run blocks with backend blocks will load state from the specified backend instead of starting from empty state on every execution. This allows test authors to keep long-running test infrastructure alive between test operations, saving time during regular test operations.

Test authors can now specify skip_cleanup attributes within test files and within run blocks. The skip_cleanup attribute tells terraform test not to clean up state files produced by run blocks with this attribute set to true. The state files for affected run blocks will be written to disk within the .terraform directory, where they can then be cleaned up manually using the also experimental terraform test cleanup command.

terraform query: The experimental -policies flag permits specifying one or more policy set directory paths to evaluate policies against resources discovered by list blocks during a query operation.

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.16
• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

1.16.0-alpha20260715 (July 15, 2026)

NEW FEATURES

• Store PlannedPrivate data for providers (#37986)
• New store block in terraform_data that can handle ephemeral and sensitive values (#38298)
• Providers can now use nested blocks as computed values (#38305)
• import: add support for import blocks inside modules (#38352)
• We now produce builds for Linux s390x (zLinux) (#38384)
• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)
• Resource action triggers can now use on_failure modes of halt, taint, or continue (#38722)

ENHANCEMENTS

• feat(cli): terraform state show accepts a -json flag (#23940)
• Show info when resources are left behind due to skip_cleanup (#38449)
• Action configuration now has a new caller symbol which contains the object value from the calling resource. (#38668)
• Actions can now use before_destroy and after_destroy events (#38668)
• cloud: Render a summary of Terraform policy evaluation outcomes for plan and apply runs against HCP Terraform (#38715)
• policy: Resolve the policy plugin entitlement (host, token, organization) from the configured cloud/remote backend for init, plan, and apply, instead of the plugin reading credentials itself (#38716)
• The 'terraform graph' command now accepts a -format flag, and can output graphs in Mermaid format (#38719)
• child module outputs with unreferenced deprecated nested attributes no longer return deprecation warnings. (#38778)
• Support destroy=false in resource lifecycle blocks. (#38784)
• contains() function can now test for null (#38792)
• The terraform console command now accepts an optional -scope=<module address> flag, which can be used to evaluate expressions within the scope of a module or a specific module instance. (#31861)
• If -invoke results in multiple resource calls triggering the action, it can now be combined with -target to specify the calling resource instance (#38845)

BUG FIXES

• import blocks no longer ignore provider local names (#38338)
• Fix a terraform apply panic when the plan contained a no-op change for a deposed object on a resource whose configuration declared a lifecycle.precondition or lifecycle.postcondition (#38586)
• workspace: Terraform will now error if an invalid workspace name becomes selected due to actions performed out-of-band (#38594)
• test: Terraform will now raise a warning when a file referenced via -filter flag does not exist. (#38603)
• init: Stop removing locks from the dependency lock file corresponding to providers configured as a dev_override (#38634)
• init: Add warnings when unmanaged providers are in use and will impact provider installation processes. (#38656)
• Actions are now invoked with respect to all resource dependencies. (#38668)
• return correct error when import target exists in state, but not config (#38782)
• merge no longer panics with null objects (#38792)

NOTES

• init: Errors due to incompatible -upgrade and -lockfile=readonly flags are now raised earlier in the init process. (#38561)

UPGRADE NOTES

• Provisioner bastion_host_key is now correctly applied. Existing usage of bastion_host_key should verify the configured key is correct. (#38318)

EXPERIMENTS

Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.

• The experimental "deferred actions" feature, enabled by passing the -allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values.
• terraform test cleanup: The experimental test cleanup command. In experimental builds of Terraform, a manifest file and state files for each failed cleanup operation during test operations are saved within the .terraform local directory. The test cleanup command will attempt to clean up the local state files left behind automatically, without requiring manual intervention.
• terraform test: backend blocks and skip_cleanup attributes:
  • Test authors can now specify backend blocks within run blocks in Terraform Test files. Run blocks with backend blocks will load state from the specified backend instead of starting from empty state on every execution. This allows test authors to keep long-running test infrastructure alive between test operations, saving time during regular test operations.
  • Test authors can now specify skip_cleanup attributes within test files and within run blocks. The skip_cleanup attribute tells terraform test not to clean up state files produced by run blocks with this attribute set to true. The state files for affected run blocks will be written to disk within the .terraform directory, where they can then be cleaned up manually using the also experimental terraform test cleanup command.
• terraform query: The experimental -policies flag permits specifying one or more policy set directory paths to evaluate policies against resources discovered by list blocks during a query operation.

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

1.16.0-alpha20260708 (July 08, 2026)

NEW FEATURES:

• Store PlannedPrivate data for providers (#37986)
• New store block in terraform_data that can handle ephemeral and sensitive values (#38298)
• Providers can now use nested blocks as computed values (#38305)
• import: add support for import blocks inside modules (#38352)
• We now produce builds for Linux s390x (zLinux) (#38384)
• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)
• Resource action triggers can now use on_failure modes of halt, taint, or continue (#38722)

ENHANCEMENTS:

• feat(cli): terraform state show accepts a -json flag (#23940)
• Show info when resources are left behind due to skip_cleanup (#38449)
• Action configuration now has a new caller symbol which contains the object value from the calling resource. (#38668)
• Actions can now use before_destroy and after_destroy events (#38668)
• cloud: Render a summary of Terraform policy evaluation outcomes for plan and apply runs against HCP Terraform (#38715)
• policy: Resolve the policy plugin entitlement (host, token, organization) from the configured cloud/remote backend for init, plan, and apply, instead of the plugin reading credentials itself (#38716)
• The 'terraform graph' command now accepts a -format flag, and can output graphs in Mermaid format (#38719)
• child module outputs with unreferenced deprecated nested attributes no longer return deprecation warnings. (#38778)
• Support destroy=false in resource lifecycle blocks. (#38784)
• contains() function can now test for null (#38792)

BUG FIXES:

• import blocks no longer ignore provider local names (#38338)
• Fix a terraform apply panic when the plan contained a no-op change for a deposed object on a resource whose configuration declared a lifecycle.precondition or lifecycle.postcondition (#38586)
• workspace: Terraform will now error if an invalid workspace name becomes selected due to actions performed out-of-band (#38594)
• test: Terraform will now raise a warning when a file referenced via -filter flag does not exist. (#38603)
• init: Stop removing locks from the dependency lock file corresponding to providers configured as a dev_override (#38634)
• init: Add warnings when unmanaged providers are in use and will impact provider installation processes. (#38656)
• Actions are now invoked with respect to all resource dependencies. (#38668)
• return correct error when import target exists in state, but not config (#38782)
• merge no longer panics with null objects (#38792)

NOTES:

• init: Errors due to incompatible -upgrade and -lockfile=readonly flags are now raised earlier in the init process. (#38561)
• command/init: Provider installation was changed to enable future enhancements in the area. This effectively reverses the log message changes from v1.15. initializing_provider_plugin_message is being re-introduced to replace the short-lived two message types initializing_provider_plugin_from_config_message & initializing_provider_plugin_from_state_message. The change should not have any significant end-user impact aside from the command output. (#38648)
• command/init: Provider installation was changed to enable future enhancements in the area. This partially reverses the init event order changes from v1.15; module installation will now occur after the backend is initialized. The change should not have any significant end-user impact aside from the command output. (#38699)

UPGRADE NOTES:

• Provisioner bastion_host_key is now correctly applied. Existing usage of bastion_host_key should verify the configured key is correct. (#38318)

EXPERIMENTS:

Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.

The experimental "deferred actions" feature, enabled by passing the -allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values.

terraform test cleanup: The experimental test cleanup command. In experimental builds of Terraform, a manifest file and state files for each failed cleanup operation during test operations are saved within the .terraform local directory. The test cleanup command will attempt to clean up the local state files left behind automatically, without requiring manual intervention.

terraform test: backend blocks and skip_cleanup attributes:

Test authors can now specify backend blocks within run blocks in Terraform Test files. Run blocks with backend blocks will load state from the specified backend instead of starting from empty state on every execution. This allows test authors to keep long-running test infrastructure alive between test operations, saving time during regular test operations.

Test authors can now specify skip_cleanup attributes within test files and within run blocks. The skip_cleanup attribute tells terraform test not to clean up state files produced by run blocks with this attribute set to true. The state files for affected run blocks will be written to disk within the .terraform directory, where they can then be cleaned up manually using the also experimental terraform test cleanup command.

terraform query: The experimental -policies flag permits specifying one or more policy set directory paths to evaluate policies against resources discovered by list blocks during a query operation.

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

1.15.8 (July 8, 2026)

BUG FIXES:

Fix terraform init error when installing providers sourced from a service-discovery alias advertised by the configured backend (such as localterraform.com)

NOTES:

command/init: Provider installation was changed to enable future enhancements in the area. This effectively reverses the log message changes from v1.15. initializing_provider_plugin_message is being re-introduced to replace the short-lived two message types initializing_provider_plugin_from_config_message & initializing_provider_plugin_from_state_message. The change should not have any significant end-user impact aside from the command output. (#38838)

command/init: Provider installation was changed to enable future enhancements in the area. This partially reverses the init event order changes from v1.15; module installation will now occur after the backend is initialized. The change should not have any significant end-user impact aside from the command output. (#38838)

1.16.0-alpha20260706 (July 06, 2026)

NEW FEATURES:

• Store PlannedPrivate data for providers (#37986)
• New store block in terraform_data that can handle ephemeral and sensitive values (#38298)
• Providers can now use nested blocks as computed values (#38305)
• import: add support for import blocks inside modules (#38352)
• We now produce builds for Linux s390x (zLinux) (#38384)
• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)
• Resource action triggers can now use on_failure modes of halt, taint, or continue (#38722)

ENHANCEMENTS:

• feat(cli): terraform state show accepts a -json flag (#23940)
• Show info when resources are left behind due to skip_cleanup (#38449)
• Action configuration now has a new caller symbol which contains the object value from the calling resource. (#38668)
• Actions can now use before_destroy and after_destroy events (#38668)
• cloud: Render a summary of Terraform policy evaluation outcomes for plan and apply runs against HCP Terraform (#38715)
• policy: Resolve the policy plugin entitlement (host, token, organization) from the configured cloud/remote backend for init, plan, and apply, instead of the plugin reading credentials itself (#38716)
• The 'terraform graph' command now accepts a -format flag, and can output graphs in Mermaid format (#38719)
• child module outputs with unreferenced deprecated nested attributes no longer return deprecation warnings. (#38778)
• contains() function can now test for null (#38792)

BUG FIXES:

• import blocks no longer ignore provider local names (#38338)
• Fix a terraform apply panic when the plan contained a no-op change for a deposed object on a resource whose configuration declared a lifecycle.precondition or lifecycle.postcondition (#38586)
• workspace: Terraform will now error if an invalid workspace name becomes selected due to actions performed out-of-band (#38594)
• test: Terraform will now raise a warning when a file referenced via -filter flag does not exist. (#38603)
• init: Stop removing locks from the dependency lock file corresponding to providers configured as a dev_override (#38634)
• init: Add warnings when unmanaged providers are in use and will impact provider installation processes. (#38656)
• Actions are now invoked with respect to all resource dependencies. (#38668)
• merge no longer panics with null objects (#38792)

NOTES:

• init: Errors due to incompatible -upgrade and -lockfile=readonly flags are now raised earlier in the init process. (#38561)
• command/init: Provider installation was changed to enable future enhancements in the area. This effectively reverses the log message changes from v1.15. initializing_provider_plugin_message is being re-introduced to replace the short-lived two message types initializing_provider_plugin_from_config_message & initializing_provider_plugin_from_state_message. The change should not have any significant end-user impact aside from the command output. (#38648)
• command/init: Provider installation was changed to enable future enhancements in the area. This partially reverses the init event order changes from v1.15; module installation will now occur after the backend is initialized. The change should not have any significant end-user impact aside from the command output. (#38699)

UPGRADE NOTES:

• Provisioner bastion_host_key is now correctly applied. Existing usage of bastion_host_key should verify the configured key is correct. (#38318)

EXPERIMENTS:

Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.

The experimental "deferred actions" feature, enabled by passing the -allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values.

terraform test cleanup: The experimental test cleanup command. In experimental builds of Terraform, a manifest file and state files for each failed cleanup operation during test operations are saved within the .terraform local directory. The test cleanup command will attempt to clean up the local state files left behind automatically, without requiring manual intervention.

terraform test: backend blocks and skip_cleanup attributes:
Test authors can now specify backend blocks within run blocks in Terraform Test files. Run blocks with backend blocks will load state from the specified backend instead of starting from empty state on every execution. This allows test authors to keep long-running test infrastructure alive between test operations, saving time during regular test operations.
Test authors can now specify skip_cleanup attributes within test files and within run blocks. The skip_cleanup attribute tells terraform test not to clean up state files produced by run blocks with this attribute set to true. The state files for affected run blocks will be written to disk within the .terraform directory, where they can then be cleaned up manually using the also experimental terraform test cleanup command.

terraform query: The experimental -policies flag permits specifying one or more policy set directory paths to evaluate policies against resources discovered by list blocks during a query operation.

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

1.16.0-alpha20260701 (July 01, 2026)

NEW FEATURES:

• Store PlannedPrivate data for providers (#37986)
• New store block in terraform_data that can handle ephemeral and sensitive values (#38298)
• Providers can now use nested blocks as computed values (#38305)
• import: add support for import blocks inside modules (#38352)
• We now produce builds for Linux s390x (zLinux) (#38384)
• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)
• Resource action triggers can now use on_failure modes of halt, taint, or continue (#38722)

ENHANCEMENTS:

• feat(cli): terraform state show accepts a -json flag (#23940)
• Show info when resources are left behind due to skip_cleanup (#38449)
• Action configuration now has a new caller symbol which contains the object value from the calling resource. (#38668)
• Actions can now use before_destroy and after_destroy events (#38668)
• cloud: Render a summary of Terraform policy evaluation outcomes for plan and apply runs against HCP Terraform (#38715)
• policy: Resolve the policy plugin entitlement (host, token, organization) from the configured cloud/remote backend for init, plan, and apply, instead of the plugin reading credentials itself (#38716)
• child module outputs with unreferenced deprecated nested attributes no longer return deprecation warnings. (#38778)
• contains() function can now test for null (#38792)

BUG FIXES:

• import blocks no longer ignore provider local names (#38338)
• Fix a terraform apply panic when the plan contained a no-op change for a deposed object on a resource whose configuration declared a lifecycle.precondition or lifecycle.postcondition (#38586)
• workspace: Terraform will now error if an invalid workspace name becomes selected due to actions performed out-of-band (#38594)
• test: Terraform will now raise a warning when a file referenced via -filter flag does not exist. (#38603)
• init: Stop removing locks from the dependency lock file corresponding to providers configured as a dev_override (#38634)
• init: Add warnings when unmanaged providers are in use and will impact provider installation processes. (#38656)
• Actions are now invoked with respect to all resource dependencies. (#38668)
• merge no longer panics with null objects (#38792)

NOTES:

• init: Errors due to incompatible -upgrade and -lockfile=readonly flags are now raised earlier in the init process. (#38561)
• command/init: Provider installation was changed to enable future enhancements in the area. This effectively reverses the log message changes from v1.15. initializing_provider_plugin_message is being re-introduced to replace the short-lived two message types initializing_provider_plugin_from_config_message & initializing_provider_plugin_from_state_message. The change should not have any significant end-user impact aside from the command output. (#38648)
• command/init: Provider installation was changed to enable future enhancements in the area. This partially reverses the init event order changes from v1.15; module installation will now occur after the backend is initialized. The change should not have any significant end-user impact aside from the command output. (#38699)

UPGRADE NOTES:

• Provisioner bastion_host_key is now correctly applied. Existing usage of bastion_host_key should verify the configured key is correct. (#38318)

EXPERIMENTS:

Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.

The experimental "deferred actions" feature, enabled by passing the -allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values.

terraform test cleanup: The experimental test cleanup command. In experimental builds of Terraform, a manifest file and state files for each failed cleanup operation during test operations are saved within the .terraform local directory. The test cleanup command will attempt to clean up the local state files left behind automatically, without requiring manual intervention.

terraform test: backend blocks and skip_cleanup attributes:

Test authors can now specify backend blocks within run blocks in Terraform Test files. Run blocks with backend blocks will load state from the specified backend instead of starting from empty state on every execution. This allows test authors to keep long-running test infrastructure alive between test operations, saving time during regular test operations.

Test authors can now specify skip_cleanup attributes within test files and within run blocks. The skip_cleanup attribute tells terraform test not to clean up state files produced by run blocks with this attribute set to true. The state files for affected run blocks will be written to disk within the .terraform directory, where they can then be cleaned up manually using the also experimental terraform test cleanup command.

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

1.16.0-alpha20260626 (June 26, 2026)

NEW FEATURES

• Store PlannedPrivate data for providers (#37986)
• New store block in terraform_data that can handle ephemeral and sensitive values (#38298)
• Providers can now use nested blocks as computed values (#38305)
• import: add support for import blocks inside modules (#38352)
• We now produce builds for Linux s390x (zLinux) (#38384)
• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)
• Resource action triggers can now use on_failure modes of halt, taint, or continue (#38722)

ENHANCEMENTS

• feat(cli): terraform state show accepts a -json flag (#23940)
• Show info when resources are left behind due to skip_cleanup (#38449)
• Action configuration now has a new caller symbol which contains the object value from the calling resource. (#38668)
• Actions can now use before_destroy and after_destroy events (#38668)
• cloud: Render a summary of Terraform policy evaluation outcomes for plan and apply runs against HCP Terraform (#38715)
• policy: Resolve the policy plugin entitlement (host, token, organization) from the configured cloud/remote backend for init, plan, and apply, instead of the plugin reading credentials itself (#38716)
• child module outputs with unreferenced deprecated nested attributes no longer return deprecation warnings. (#38778)

BUG FIXES

• import blocks no longer ignore provider local names (#38338)
• Fix a terraform apply panic when the plan contained a no-op change for a deposed object on a resource whose configuration declared a lifecycle.precondition or lifecycle.postcondition (#38586)
• workspace: Terraform will now error if an invalid workspace name becomes selected due to actions performed out-of-band (#38594)
• test: Terraform will now raise a warning when a file referenced via -filter flag does not exist. (#38603)
• init: Stop removing locks from the dependency lock file corresponding to providers configured as a dev_override (#38634)
• init: Add warnings when unmanaged providers are in use and will impact provider installation processes. (#38656)
• Actions are now invoked with respect to all resource dependencies. (#38668)

NOTES

• init: Errors due to incompatible -upgrade and -lockfile=readonly flags are now raised earlier in the init process. (#38561)
• command/init: Provider installation was changed to enable future enhancements in the area. This effectively reverses the log message changes from v1.15. initializing_provider_plugin_message is being re-introduced to replace the short-lived two message types initializing_provider_plugin_from_config_message & initializing_provider_plugin_from_state_message. The change should not have any significant end-user impact aside from the command output. (#38648)
• command/init: Provider installation was changed to enable future enhancements in the area. This partially reverses the init event order changes from v1.15; module installation will now occur after the backend is initialized. The change should not have any significant end-user impact aside from the command output. (#38699)

UPGRADE NOTES

• Provisioner bastion_host_key is now correctly applied. Existing usage of bastion_host_key should verify the configured key is correct. (#38318)

EXPERIMENTS

Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.

The experimental "deferred actions" feature, enabled by passing the -allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values.

terraform test cleanup: The experimental test cleanup command. In experimental builds of Terraform, a manifest file and state files for each failed cleanup operation during test operations are saved within the .terraform local directory. The test cleanup command will attempt to clean up the local state files left behind automatically, without requiring manual intervention.

terraform test: backend blocks and skip_cleanup attributes:
Test authors can now specify backend blocks within run blocks in Terraform Test files. Run blocks with backend blocks will load state from the specified backend instead of starting from empty state on every execution. This allows test authors to keep long-running test infrastructure alive between test operations, saving time during regular test operations.

Test authors can now specify skip_cleanup attributes within test files and within run blocks. The skip_cleanup attribute tells terraform test not to clean up state files produced by run blocks with this attribute set to true. The state files for affected run blocks will be written to disk within the .terraform directory, where they can then be cleaned up manually using the also experimental terraform test cleanup command.

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

1.16.0-alpha20260624 (June 24, 2026)

NEW FEATURES:

Store PlannedPrivate data for providers (#37986)

New store block in terraform_data that can handle ephemeral and sensitive values (#38298)

Providers can now use nested blocks as computed values (#38305)

import: add support for import blocks inside modules (#38352)

We now produce builds for Linux s390x (zLinux) (#38384)

workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)

Resource action triggers can now use on_failure modes of halt, taint, or continue (#38722)

ENHANCEMENTS:

feat(cli): terraform state show accepts a -json flag (#23940)

Show info when resources are left behind due to skip_cleanup (#38449)

Action configuration now has a new caller symbol which contains the object value from the calling resource. (#38668)

Actions can now use before_destroy and after_destroy events (#38668)

policy: Resolve the policy plugin entitlement (host, token, organization) from the configured cloud/remote backend for init, plan, and apply, instead of the plugin reading credentials itself (#38716)

BUG FIXES:

import blocks no longer ignore provider local names (#38338)

Fix a terraform apply panic when the plan contained a no-op change for a deposed object on a resource whose configuration declared a lifecycle.precondition or lifecycle.postcondition (#38586)

workspace: Terraform will now error if an invalid workspace name becomes selected due to actions performed out-of-band (#38594)

test: Terraform will now raise a warning when a file referenced via -filter flag does not exist. (#38603)

init: Stop removing locks from the dependency lock file corresponding to providers configured as a dev_override (#38634)

init: Add warnings when unmanaged providers are in use and will impact provider installation processes. (#38656)

Actions are now invoked with respect to all resource dependencies. (#38668)

NOTES:

init: Errors due to incompatible -upgrade and -lockfile=readonly flags are now raised earlier in the init process. (#38561)

command/init: Provider installation was changed to enable future enhancements in the area. This effectively reverses the log message changes from v1.15. initializing_provider_plugin_message is being re-introduced to replace the short-lived two message types initializing_provider_plugin_from_config_message & initializing_provider_plugin_from_state_message. The change should not have any significant end-user impact aside from the command output. (#38648)

command/init: Provider installation was changed to enable future enhancements in the area. This partially reverses the init event order changes from v1.15; module installation will now occur after the backend is initialized. The change should not have any significant end-user impact aside from the command output. (#38699)

UPGRADE NOTES:

Provisioner bastion_host_key is now correctly applied. Existing usage of bastion_host_key should verify the configured key is correct. (#38318)

EXPERIMENTS:

Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.

The experimental "deferred actions" feature, enabled by passing the -allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values.

terraform test cleanup: The experimental test cleanup command. In experimental builds of Terraform, a manifest file and state files for each failed cleanup operation during test operations are saved within the .terraform local directory. The test cleanup command will attempt to clean up the local state files left behind automatically, without requiring manual intervention.

terraform test: backend blocks and skip_cleanup attributes:

Test authors can now specify backend blocks within run blocks in Terraform Test files. Run blocks with backend blocks will load state from the specified backend instead of starting from empty state on every execution. This allows test authors to keep long-running test infrastructure alive between test operations, saving time during regular test operations.

Test authors can now specify skip_cleanup attributes within test files and within run blocks. The skip_cleanup attribute tells terraform test not to clean up state files produced by run blocks with this attribute set to true. The state files for affected run blocks will be written to disk within the .terraform directory, where they can then be cleaned up manually using the also experimental terraform test cleanup command.

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

SECURITY:

• auth/radius: Added case_insensitive_names toggle to prevent username collisions and enable case-insensitive user handling.
• core/acl: Fix LIST ACL bypass where a trailing-slash request could skip a more-specific deny rule.
• core: Use constant-time recovery token comparison
• secrets/spiffe (enterprise): Ensure template values are properly escaped.
• transform (enterprise): Add appropriate db specific quoting and escaping.

CHANGES:

• auth/cf: Update plugin to v0.23.1
• core/acl: LIST requests with a trailing slash now correctly respect more-specific deny policies. Previously, a deny on path "kv/" { deny } could be bypassed for LIST kv/private/ if a broader allow path "kv/" also existed. Policies relying on the previous (incorrect) behavior may now be denied.
• core: Vault will now redirect non-canonicalized paths (containing /./, /../, or //) to a cleaned path, instead of rejecting these requests
• secrets/azure: Update plugin to v0.26.5+ent

FEATURES:

AI Agent Support (Beta/Enterprise): Adds beta support for first-class AI agents. Adds an Agent Registry to register agents, and adds support for using Vault as an OAuth resource server for registered agent entities. When configured, allows OAuth 2.0 JWTs to be used to directly authorize requests to Vault, without needing a Vault token.

IMPROVEMENTS:

• consumption-billing: Add a new sys/billing/config endpoint to allow configuration of billing data retention (min 13 months, max 6 years).
• core (Enterprise): Make deadlock detection in sealwrap configurable by adding "sealwrap" to existing configuration detect_deadlocks.
• identity/scim (enterprise): Update PATCH operations on scim/v2/Users to allow multiple modifications in the same patch call, support for patch operations on user metadata and name in addition to active status, and allow specifying path value in patch operations
• sdk/helper/keysutil: The lock manager's GetPolicy function now always returns a locked Policy, even when caching is enabled. The PolicyRequest struct has a new field to indicate whether the caller requires a write lock on the policy.
• ui (enterprise): Migrate charts from Lineal to Carbon Charts in the Client usage overview and Vault usage dashboard.

BUG FIXES:

• core/rotationMgr: Fix storage routing for local mounts in namespaces to prevent metadata replication and ensure GDPR compliance.
• kmip (enterprise): Fix a bug that prevents the legacy CA from working on a named listener.
• secret-sync (enterprise): Fix GCP Secret Manager replication policy persistence across Vault restarts.
• secrets/database/mssql: Deregister stale TLS configurations when MySQL connection TLS settings change or the connection is closed, preventing retained certificate pools from accumulating.
• secrets/pki: Fix PKI certificate issuance not_after time to respect max TTL.
• secrets/transit: Add managed key support to Transit rewrap endpoint.
• storage/raft: reject performance_multiplier values less than or equal to zero

1.16.0-alpha20260617 (June 17, 2026)

NEW FEATURES:

• Store PlannedPrivate data for providers (#37986)
• New store block in terraform_data that can handle ephemeral and sensitive values (#38298)
• Providers can now use nested blocks as computed values (#38305)
• import: add support for import blocks inside modules (#38352)
• We now produce builds for Linux s390x (zLinux) (#38384)
• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)
• Resource action triggers can now use on_failure modes of halt, taint, or continue (#38722)

ENHANCEMENTS:

• feat(cli): terraform state show accepts a -json flag (#23940)
• Show info when resources are left behind due to skip_cleanup (#38449)
• Action configuration now has a new caller symbol which contains the object value from the calling resource. (#38668)
• Actions can now use before_destroy and after_destroy events (#38668)

BUG FIXES:

• import blocks no longer ignore provider local names (#38338)
• Fix a terraform apply panic when the plan contained a no-op change for a deposed object on a resource whose configuration declared a lifecycle.precondition or lifecycle.postcondition (#38586)
• workspace: Terraform will now error if an invalid workspace name becomes selected due to actions performed out-of-band (#38594)
• test: Terraform will now raise a warning when a file referenced via -filter flag does not exist. (#38603)
• init: Stop removing locks from the dependency lock file corresponding to providers configured as a dev_override (#38634)
• init: Add warnings when unmanaged providers are in use and will impact provider installation processes. (#38656)
• Actions are now invoked with respect to all resource dependencies. (#38668)

NOTES:

• init: Errors due to incompatible -upgrade and -lockfile=readonly flags are now raised earlier in the init process. (#38561)
• command/init: Provider installation was changed to enable future enhancements in the area. This effectively reverses the log message changes from v1.15. initializing_provider_plugin_message is being re-introduced to replace the short-lived two message types initializing_provider_plugin_from_config_message & initializing_provider_plugin_from_state_message. The change should not have any significant end-user impact aside from the command output. (#38648)
• command/init: Provider installation was changed to enable future enhancements in the area. This partially reverses the init event order changes from v1.15; module installation will now occur after the backend is initialized. The change should not have any significant end-user impact aside from the command output. (#38699)

UPGRADE NOTES:

• Provisioner bastion_host_key is now correctly applied. Existing usage of bastion_host_key should verify the configured key is correct. (#38318)

EXPERIMENTS:

Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.

The experimental "deferred actions" feature, enabled by passing the -allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values.

terraform test cleanup: The experimental test cleanup command. In experimental builds of Terraform, a manifest file and state files for each failed cleanup operation during test operations are saved within the .terraform local directory. The test cleanup command will attempt to clean up the local state files left behind automatically, without requiring manual intervention.

terraform test: backend blocks and skip_cleanup attributes:

Test authors can now specify backend blocks within run blocks in Terraform Test files. Run blocks with backend blocks will load state from the specified backend instead of starting from empty state on every execution. This allows test authors to keep long-running test infrastructure alive between test operations, saving time during regular test operations.

Test authors can now specify skip_cleanup attributes within test files and within run blocks. The skip_cleanup attribute tells terraform test not to clean up state files produced by run blocks with this attribute set to true. The state files for affected run blocks will be written to disk within the .terraform directory, where they can then be cleaned up manually using the also experimental terraform test cleanup command.

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier