OpenTofu Release Notes

OpenTofu 1.13.0

We're proud to announce that OpenTofu 1.13.0 is now officially available! 🎉

Highlights

Windows on ARM64 is now a supported platform

Starting with OpenTofu v1.13.0 we are now offering official packages targeting Windows on the ARM64 (also known as "aarch64") CPU architecture.

Reducing unknowns during planning

OpenTofu v1.13 introduces a number of new functions that are all intended to allow module authors to give OpenTofu additional hints about what they know to be true even though OpenTofu cannot infer it automatically.

Linting Experiment

OpenTofu v1.13 includes some very early work towards built-in "linting" features in OpenTofu, although we are hoping to eventually incorporate other similar needs such as policy enforcement into a single comprehensive feature.

Symbol Libraries Experiment

We're considering a new kind of artifact called a "Symbol Library", which is a reusable collection of values, functions, and type aliases that can be imported from all of the same source types that are already supported for modules.

Compatibility Notes

• base64gzip produces results that are equivalent but not byte-for-byte identical to previous versions, this is due to a required golang version upgrade
• WinRM is no longer supported for provisioners
• macOS: Requires macOS 13 Ventura or later
• OpenTofu v1.13 will be the last series that includes official releases for 32 bit CPUs

Reference …

The v1.13.x release series is supported until August 1 2027.

1.13.0 (Unreleased)

UPGRADE NOTES:

• The "winrm" connection type for provisioners is no longer supported. (#4012)

  This connection type was deprecated in OpenTofu v1.12, and now removed in v1.13. Some of the upstream libraries OpenTofu was using to implement these features are no longer maintained, so it's not viable for us to offer this anymore.

  Modern Windows versions now support OpenSSH, and so we suggest that anyone currently relying on WinRM plan to migrate to using SSH instead.

• The base64gzip function now generates results that are equivalent to but not equal to the results from previous releases, as a result of a new optimized DEFLATE compression implementation.

  If you use this function as part of an argument to a managed resource then OpenTofu is likely to propose to update or replace the instances of that resource, depending on how the provider responds to the differing base64 data. The new compressed form should nonetheless still decompress to the same sequence of bytes.

• OpenTofu on macOS now requires macOS 13 Ventura or later. Earlier versions are no longer supported. …

The v1.13.x release series is supported until August 1 2027.

1.13.0 (Unreleased)

UPGRADE NOTES:

• The "winrm" connection type for provisioners is no longer supported. (#4012)

  This connection type was deprecated in OpenTofu v1.12, and now removed in v1.13. Some of the upstream libraries OpenTofu was using to implement these features are no longer maintained, so it's not viable for us to offer this anymore.

  Modern Windows versions now support OpenSSH, and so we suggest that anyone currently relying on WinRM plan to migrate to using SSH instead.

• The base64gzip function now generates results that are equivalent to but not equal to the results from previous releases, as a result of a new optimized DEFLATE compression implementation.

  If you use this function as part of an argument to a managed resource then OpenTofu is likely to propose to update or replace the instances of that resource, depending on how the provider responds to the differing base64 data. The new compressed form should nonetheless still decompress to the same sequence of bytes.

• OpenTofu on macOS now requires macOS 13 Ventura or later. Earlier versions are no longer supported. …

SECURITY ADVISORIES:

• When interacting with OCI Distribution registries for module or provider package installation, earlier versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#4422)
• When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. (#4472)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.5...v1.12.6

SECURITY ADVISORIES:

• When interacting with OCI Distribution registries for module or provider package installation, previous versions of OpenTofu could incorrectly resend credentials intended for the original origin to the target of an HTTP redirect. (#4423)
• When interacting with an attacker-controlled remote state backend or provider/module registry, tofu init in earlier versions of OpenTofu could potentially cause high CPU usage and/or high memory usage resolving crafted relative URLs in the API responses. (#4473)

[!NOTE] This is the final patch release planned for the OpenTofu v1.11 series. We recommend upgrading to a newer release series as soon as possible.

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.13...v1.11.14

SECURITY ADVISORIES:

• Previous releases in the v1.12 series could be affected by several vulnerabilities:

  • The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.

  This is fixed now by (#4363)

BUG FIXES:

• Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState (#4375)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.4...v1.12.5

SECURITY ADVISORIES:

• Previous releases in the v1.11 series could be affected by several vulnerabilities:

  • The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.

  This is fixed now by (#4363)

BUG FIXES:

• Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState (#4375)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.12...v1.11.13

BUG FIXES:

• tofu plan -out no longer fails when the plan includes a resource with lifecycle { destroy = false } that needs replacement, which previously errored with invalid change action ForgetThenCreate. (#4324)
• Moved block now correctly compares provider source addresses. (#4280)[https://github.com/opentofu/opentofu/pull/4280]
• Correct Source Provider Address now passed into Provider MoveResource requests. (#4355)[https://github.com/opentofu/opentofu/pull/4355]

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.3...v1.12.4