OpenTofu Release Notes

SECURITY ADVISORIES:

• When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#4422)
• When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. (#4472)

Full Changelog: v1.12.5...v1.12.6

SECURITY ADVISORIES

• When interacting with OCI Distribution registries for module or provider package installation, previous versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#4423)
• When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. (#4473)

Note

This is the final patch release planned for the OpenTofu v1.11 series. We recommend upgrading to a newer release series as soon as possible.

Full Changelog: v1.11.13...v1.11.14

SECURITY ADVISORIES

• Previous releases in the v1.12 series could be affected by several vulnerabilities:
  • The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.
  • This is fixed now by (#4363)

BUG FIXES

• Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState (#4375)

Full Changelog: v1.12.4...v1.12.5

SECURITY ADVISORIES

• Previous releases in the v1.11 series could be affected by several vulnerabilities:
  • The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.
  • This is fixed now by (#4363)

BUG FIXES

• Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState (#4375)

Full Changelog: v1.11.12...v1.11.13

BUG FIXES

• Properly handle TF_ENCRYPTION with only blank spaces. (#4265)
• The value resulted from the lifecycle.enabled evaluation now has its deprecation marks processed correctly (#4162)
• Update documentation to clarify the usage restriction of ephemeral values in lifecycle.enabled. (#4220)
• tofu console -lock=false now works as intended. (#4291)

SECURITY ADVISORIES

• Previous releases in the v1.12 series could read an arbitrary file during certain git operations via a maliciously crafted URL (#4293)
  • Advisory: GHSA-q7j3-v8qv-22vq

Full Changelog: v1.12.2...v1.12.3

SECURITY ADVISORIES:

• Previous releases in the v1.12 series could be affected by several vulnerabilities:

  • If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted.
    This is fixed now by (#4177)

• Previous releases in the v1.12 series could be affected by several vulnerabilities:

  • When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
  • If using an attacker-controlled server to run tofu against, it might end up in high CPU consumption.
    These are now fixed by (#4247)

BUG FIXES:

• Properly handle EDEADLK during provider installation. On Unix systems, the kernel may erroneously detect a deadlock between tofu processes using the global plugin cache. (#4166)
• Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)
• Prevent panic when using ephemeral resources during tofu test`. (#4254)

Full Changelog: v1.12.1...v1.12.2

SECURITY ADVISORIES

• Previous releases in the v1.11 series could be affected by several vulnerabilities:

  • ssh usage through OpenTofu generate hangs or panics.
  • Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @Revoked.
    This is fixed now by (#4145)

• If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted. (#4177)

• Previous releases in the v1.11 series could be affected by several vulnerabilities:

  • When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
  • If using an attacker-controlled server to run tofu against, it might end up in high CPU consumption.
    These are now fixed by (#4248)

BUG FIXES

• Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)

• Prevent panic when using ephemeral resources during tofu test`. (#4254)

Full Changelog: v1.11.8...v1.11.9

Here are some highlights from the new features in this release:

• Dynamic prevent_destroy: The prevent_destroy argument in a resource's lifecycle block can now refer to other symbols within the same module, such as input variables.
• Improved provider checksum handling: tofu init now automatically includes a full set of checksums for all platforms using both zh: and h1: hashes, reducing the need for manually running tofu providers lock.
• Simultaneous output formats: The new -json-into=FILENAME CLI option allows saving machine-readable output to a separate file while still producing human-readable output in the terminal.
• New destroy lifecycle meta-argument: The new destroy = false lifecycle option for managed resources allows removing an object from the state without first destroying the remote object.
• Provider installer performance: Provider installation now performs concurrent requests for faster tofu init completion when many providers are needed.

For more information, refer to the v1.12.0 release announcement and the v1.12 series changelog.

Compatibility Notes

• New h1: checksums in dependency lock file: Due to the improved provider checksum handling in this release, the first time you run tofu init after upgrading you are likely to find additional h1: checksums have been added for any providers that were already tracked in your dependency lock file.

This behavior is an example of what's described in New provider package checksums: the newly-added checksums each match one of the zh: checksums previously recorded and represent the same information in a different way. In OpenTofu v1.12 this is now a one-time backfill of all of the official checksums, rather than "upgrading" them one-by-one as in earlier versions.

• WinRM connections for provisioners are deprecated: Provisioner connection blocks with type = "winrm" will now cause warnings in this release, and will no longer be supported at all in OpenTofu v1.13.

We recommend migrating to OpenSSH for Windows.

• Phasing out support for 32-bit CPU architectures: In a future release we plan to stop providing official release builds for the 32-bit 386 and arm CPU architectures. Support for amd64 and arm64 is unaffected.

There is no immediate change to supported platforms in the v1.12 series, but we expect to introduce a deprecation warning in v1.13 and then stop providing official builds for these architectures completely in a future release series. If you don't expect that you'll be able to complete a migration to running on a 64-bit architecture in the next year, please tell us about your situation in issue #3912.

Previous releases in the v1.12 series could be affected by several vulnerabilities:

• ssh usage through OpenTofu generate hangs or panics.
• Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

This is fixed now by (#4145).

BUG FIXES

• Address a bug introduced in v1.12.0 causing excessive memory usage by providers. (#4126)
• Address a bug introduced in v1.12.0 where replace_triggered_by was validated incorrectly. (#4133)
• The Azure key provider will now accept the tenant_id, subscription_id, environment, and metadata_host variables; a bug previously only allowed these to be set through environment variables. (#4091)

Full Changelog: https://github.com/opentofu/opentofu/blob/v1.12/CHANGELOG.md

We're proud to announce that OpenTofu 1.12.0 is now officially available! 🎉

Highlights

This release cycle introduces major new capabilities and integrations:

Dynamic prevent_destroy

OpenTofu v1.12.0 now allows prevent_destroy to be defined dynamically in terms of other values available elsewhere in the same module. For example:

variable "prevent_destroy_database" {
  type = bool
  default = true
}
resource "example_database" "example" {
  # ...
  lifecycle {
    prevent_destroy = var.prevent_destroy_database
  }
}

Provider Checksum Improvements

The default provider installation behavior in OpenTofu is designed to mostly "just work" by getting the needed providers installed and making the necessary changes to the dependency lock file, but in previous versions friction appeared for any teams using many of the non-default installation settings such as the shared provider plugin cache, or local mirrors of upstream providers.

For OpenTofu v1.12, OpenTofu Registry now provides a full set of official checksums in all of the checksum formats needed by other installation methods. This means that after running tofu init the dependency lock file will immediately have all of the information required to successfully use a global plugin cache directory and to verify matching packages served from a local mirror, without needing to run tofu providers lock separately.

Simultaneous Human-readable and Machine-readable Output

Many OpenTofu commands support both human-oriented UI output and machine-readable JSON output, but previously those commands could be run with only one or the other. This was bothersome for those implementing alternative UIs in terms of the machine-readable output because it meant they would need to implement all possible features of the UI before their tool could actually be used.

OpenTofu v1.12.0 introduces a new option -json-into=FILENAME, which produces the same output format that -json would have produced but sends that output to the given filename instead of to the standard output stream. The OpenTofu UI output then appears on the standard output stream as normal, so that software interpreting the JSON output can behave as just a supplement to the normal UI rather than a complete replacement.

New destroy lifecycle meta-argument

New destroy lifecycle meta-argument

The new destroy = false lifecycle option for managed resources allows removing an object from the state without first destroying the remote object.

Deprecation Notices

WinRM for Provisioners is Now Deprecated

Some of the Go libraries that OpenTofu uses for WinRM connection support in provisioners have become unmaintained over time, and so unfortunately we are phasing out support for WinRM in OpenTofu starting with deprecation warnings in this release.

If your configuration includes a connection block with type = "winrm" then OpenTofu v1.12 will warn that this connection type is deprecated, but provisioning should otherwise still work as it did before.

We intend to remove WinRM support completely in the forthcoming OpenTofu v1.13 series, and so if you are currently relying on WinRM support we recommend that you begin planning to migrate to using OpenSSH for Windows instead.

Phasing Out Support for 32-bit CPU Architectures

We are also planning to stop producing official releases for 32-bit CPU architectures (386 and arm) in a future version of OpenTofu. Support for 64-bit architectures (amd64 and arm64) is unaffected.

OpenTofu v1.12 does not include any changes to CPU support yet, but we expect that the official builds in the forthcoming v1.13 series will begin producing warnings when running on 32-bit CPU architectures, before we stop producing those packages altogether in a future release series.

Compatibility Notes

• macOS: Requires macOS 12 Monterey or later
• The OPENTOFU_USER_AGENT environment variable, which allowed fully overriding the default User-Agent header on all HTTP requests, has been removed.
• On Unix systems OpenTofu now considers the BROWSER environment variable as a possible override for the default behavior for launching a web browser. If you run OpenTofu in a context where an environment variable of that name is already set, it may cause OpenTofu to now open a web browser in a different way than previous versions would have. Unsetting that environment variable will restore the previous platform-specific behavior.

Reference

• Full Changelog
• Blog Post

Thank you for your continued support and testing of the OpenTofu project!