Terraform Updates & Release Notes

1.17.0-rc1 (October 07, 2026)

NEW FEATURES:

• Terraform now supports variables and locals in provider requirements (#39153)

• A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. (#35290)

• policy: Terraform Policy is now generally available. The -policies flag for plan, apply, and query no longer requires an experimental build or the -allow-experimental-features flag. Query policies evaluate resources discovered by list blocks and report human-readable or JSON results. See https://developer.hashicorp.com/terraform/policy for more information. (#38970)

ENHANCEMENTS:

• command/init: Enrich log messages with provider versions (#38918)

• test: Add mock_provider support for ephemeral resources (#38928)

• command/login: display warning after successful login if user is subject to an organization's TTL policy

BUG FIXES:

• funcs: pow and log no longer panic when result is not a number (#38912) …

1.17.0-beta2 (September 23, 2026)

NEW FEATURES:

• Terraform now supports variables and locals in provider requirements (#39153)

• A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. (#35290)

• policy: Terraform Policy is now generally available. The -policies flag for plan, apply, and query no longer requires an experimental build or the -allow-experimental-features flag. Query policies evaluate resources discovered by list blocks and report human-readable or JSON results. See https://developer.hashicorp.com/terraform/policy for more information. (#38970)

ENHANCEMENTS:

• command/init: Enrich log messages with provider versions (#38918)

• test: Add mock_provider support for ephemeral resources (#38928)

• command/login: display warning after successful login if user is subject to an organization's TTL policy

BUG FIXES:

• funcs: pow and log no longer panic when result is not a number (#38912) …

1.16.3 (September 16, 2026)

BUG FIXES:

• Fix handling of destroy=false around create_before_destroy instances (#39169)

• Fix function result comparison when there are multiple marks (#39170)

• Filter logic for marks could cause values with multiple marks to erroneously fail validations (#39171)

• Fix issue with import provider resolution (#39185)

1.17.0-beta1 (September 09, 2026)

NEW FEATURES:

• Terraform now supports variables and locals in provider requirements (#39153)

• A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. (#35290)

• policy: Terraform Policy is now generally available. The -policies flag for plan, apply, and init no longer requires the -allow-experimental-features flag. See https://developer.hashicorp.com/terraform/policy for more information. (#38970)

ENHANCEMENTS:

• command/init: Enrich log messages with provider versions (#38918)

• test: Add mock_provider support for ephemeral resources (#38928)

• command/login: display warning after successful login if user is subject to an organization's TTL policy

BUG FIXES:

• funcs: pow and log no longer panic when result is not a number (#38912) …

1.16.1 (September 2, 2026)

BUG FIXES:

• cloud: Fixed a bug causing the CLI to pause indefinitely after a run task failure with pending policy evaluations (#38751)

• Support referencing modules containing dynamic sources in Terraform Test (#38950)

• stacks: Fixed validation to ensure the provider versions in the lock file and configuration are compatible. (#38829)

• Fix panic when import identity references sensitive value (#39013)

• import: Fixed a bug where import blocks would be ignored when multiple imports targeted different instances of a resource config using for_each or count. (#39068)

• state show: Fix a panic when given an attribute path instead of a resource instance address (#39087)

• Fix create_before_destroy ordering in some combinations of changes (#39091)

1.17.0-alpha20260827 (August 27, 2026)

NEW FEATURES:

• A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. (#35290)

ENHANCEMENTS:

• command/init: Enrich log messages with provider versions (#38918)

• command/login: display warning after successful login if user is subject to an organization's TTL policy

BUG FIXES:

• funcs: pow and log no longer panic when result is not a number (#38912)

• ephemeral: Terraform will now use and display diagnostics raised when renewing an ephemeral resource. This may cause warnings to appear that previously were lost. We expect that any error diagnostics that were previously lost would have caused confusing downstream errors, so we do not anticipate this change to be breaking. (#38989)

• Fix panic when import identity references sensitive value (#39013)

NOTES: …

1.16.0 (August 26, 2026)

NEW FEATURES:

• Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. (#37986)

• terraform_data: The new store block can hold ephemeral and sensitive values across plan and apply. (#38298)

• Providers can now use nested blocks as computed values (#38305)

• import: import blocks inside modules are now supported. (#38352)

• Terraform is now available as a pre-built binary for Linux s390x (zLinux). (#38384)

• Resource action triggers can now use on_failure modes of halt, taint, or continue. (#38722)

ENHANCEMENTS:

• state show: The state show command can now produce machine-readable output when supplied with the -json flag (#23940)

• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)

• test: Terraform now reports which resources were left behind when skip_cleanup is set. (#38449) …

1.16.0-rc2 (August 19, 2026)

NEW FEATURES:

• Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. (#37986)

• terraform_data: The new store block can hold ephemeral and sensitive values across plan and apply. (#38298)

• Providers can now use nested blocks as computed values (#38305)

• import: import blocks inside modules are now supported. (#38352)

• Terraform is now available as a pre-built binary for Linux s390x (zLinux). (#38384)

• Resource action triggers can now use on_failure modes of halt, taint, or continue. (#38722)

ENHANCEMENTS:

• state show: The state show command can now produce machine-readable output when supplied with the -json flag (#23940)

• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)

• test: Terraform now reports which resources were left behind when skip_cleanup is set. (#38449) …

1.15.9 (August 19, 2026)

BUG FIXES:

• validate: Child module validation has been fixed and will now raise errors or warning diagnostics for invalid blocks. (list, import, backend, and cloud) (#38994)

NOTES:

• Update go-slug to v0.18.3 to mitigate CVE-2026-14978, which is a Unicode normalization issue that could lead to files not being correctly excluded via .terraformignore from upload to a Terraform Enterprise or HCP Terraform during a run (#39036)

1.17.0-alpha20260812 (August 12, 2026)

ENHANCEMENTS:

• command/init: Enrich log messages with provider versions (#38918)

BUG FIXES:

• funcs: pow and log no longer panic when result is not a number (#38912)

• ephemeral: Terraform will now use and display diagnostics raised when renewing an ephemeral resource. This may cause warnings to appear that previously were lost. We expect that any error diagnostics that were previously lost would have caused confusing downstream errors, so we do not anticipate this change to be breaking. (#38989)

NOTES:

• version: JSON output now includes a new format_version field, which will enable safer future changes of the command's JSON output format. It is assumed existing tooling ignores unknown fields and therefore this change should not be breaking in itself but we advice consumers to pay attention to format_version in future releases and/or use latest version of hashicorp/terraform-json & hashicorp/terraform-exec which does. (#38930)

EXPERIMENTS:

Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases. …

1.16.0-rc1 (August 12, 2026)

NEW FEATURES:

• Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. (#37986)

• terraform_data: The new store block can hold ephemeral and sensitive values across plan and apply. (#38298)

• Providers can now use nested blocks as computed values (#38305)

• import: import blocks inside modules are now supported. (#38352)

• Terraform is now available as a pre-built binary for Linux s390x (zLinux). (#38384)

• Resource action triggers can now use on_failure modes of halt, taint, or continue. (#38722)

ENHANCEMENTS:

• state show: The state show command can now produce machine-readable output when supplied with the -json flag (#23940)

• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)

• test: Terraform now reports which resources were left behind when skip_cleanup is set. (#38449) …

1.16.0-beta2 (August 05, 2026)

NEW FEATURES:

• Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. (#37986)

• terraform_data: The new store block can hold ephemeral and sensitive values across plan and apply. (#38298)

• Providers can now use nested blocks as computed values (#38305)

• import: import blocks inside modules are now supported. (#38352)

• Terraform is now available as a pre-built binary for Linux s390x (zLinux). (#38384)

• Resource action triggers can now use on_failure modes of halt, taint, or continue. (#38722)

ENHANCEMENTS:

• state show: The state show command can now produce machine-readable output when supplied with the -json flag (#23940)

• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)

• test: Terraform now reports which resources were left behind when skip_cleanup is set. (#38449) …

1.17.0-alpha20260729 (July 29, 2026)

ENHANCEMENTS:

• command/init: Enrich log messages with provider versions (#38918)

BUG FIXES:

• funcs: pow and log no longer panic when result is not a number (#38912)

EXPERIMENTS:

Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.

• The experimental "deferred actions" feature, enabled by passing the -allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values.
• terraform test cleanup: The experimental test cleanup command. In experimental builds of Terraform, a manifest file and state files for each failed cleanup operation during test operations are saved within the .terraform local directory. The test cleanup command will attempt to clean up the local state files left behind automatically, without requiring manual intervention.
• terraform test: backend blocks and skip_cleanup attributes: …

1.16.0-beta1 (July 23, 2026)

NEW FEATURES:

• Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. (#37986)

• terraform_data: The new store block can hold ephemeral and sensitive values across plan and apply. (#38298)

• Providers can now use nested blocks as computed values (#38305)

• import: import blocks inside modules are now supported. (#38352)

• Terraform is now available as a pre-built binary for Linux s390x (zLinux). (#38384)

• Resource action triggers can now use on_failure modes of halt, taint, or continue. (#38722)

ENHANCEMENTS:

• state show: The state show command can now produce machine-readable output when supplied with the -json flag (#23940)

• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)

• test: Terraform now reports which resources were left behind when skip_cleanup is set. (#38449) …

1.16.0-alpha20260715 (July 15, 2026)

NEW FEATURES:

• Store PlannedPrivate data for providers (#37986)

• New store block in terraform_data that can handle ephemeral and sensitive values (#38298)

• Providers can now use nested blocks as computed values (#38305)

• import: add support for import blocks inside modules (#38352)

• We now produce builds for Linux s390x (zLinux) (#38384)

• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)

• Resource action triggers can now use on_failure modes of halt, taint, or continue (#38722)

ENHANCEMENTS:

• feat(cli): terraform state show accepts a -json flag (#23940)

• Show info when resources are left behind due to skip_cleanup (#38449)

• Action configuration now has a new caller symbol which contains the object value from the calling resource. (#38668) …

1.16.0-alpha20260708 (July 08, 2026)

NEW FEATURES:

• Store PlannedPrivate data for providers (#37986)

• New store block in terraform_data that can handle ephemeral and sensitive values (#38298)

• Providers can now use nested blocks as computed values (#38305)

• import: add support for import blocks inside modules (#38352)

• We now produce builds for Linux s390x (zLinux) (#38384)

• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#38397)

• Resource action triggers can now use on_failure modes of halt, taint, or continue (#38722)

ENHANCEMENTS:

• feat(cli): terraform state show accepts a -json flag (#23940)

• Show info when resources are left behind due to skip_cleanup (#38449)

• Action configuration now has a new caller symbol which contains the object value from the calling resource. (#38668) …

1.15.8 (July 8, 2026)

BUG FIXES:

• Fix terraform init error when installing providers sourced from a service-discovery alias advertised by the configured backend (such as localterraform.com)

NOTES:

• command/init: Provider installation was changed to enable future enhancements in the area. This effectively reverses the log message changes from v1.15. initializing_provider_plugin_message is being re-introduced to replace the short-lived two message types initializing_provider_plugin_from_config_message & initializing_provider_plugin_from_state_message. The change should not have any significant end-user impact aside from the command output. (#38838)

• command/init: Provider installation was changed to enable future enhancements in the area. This partially reverses the init event order changes from v1.15; module installation will now occur after the backend is initialized. The change should not have any significant end-user impact aside from the command output. (#38838)