Skip to content

chore(deps): update tofu#1634

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/tofu
Open

chore(deps): update tofu#1634
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/tofu

Conversation

@renovate

@renovate renovate Bot commented May 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Update Change
opentofu minor 1.11.8 → 1.12.4
terragrunt minor 1.0.4 → 1.1.1

Release Notes

opentofu/opentofu (opentofu)

v1.12.4

Compare Source

BUG FIXES:

  • tofu plan -out no longer fails when the plan includes a resource with lifecycle { destroy = false } that needs replacement, which previously errored with invalid change action ForgetThenCreate. (#​4324)
  • Moved block now correctly compares provider source addresses. (#​4280)[#​4280]
  • Correct Source Provider Address now passed into Provider MoveResource requests. (#​4355)[#​4355]

Full Changelog: opentofu/opentofu@v1.12.3...v1.12.4

v1.12.3

Compare Source

BUG FIXES:
  • Properly handle TF_ENCRYPTION with only blank spaces. (#​4265)
  • The value resulted from the lifecycle.enabled evaluation now has its deprecation marks processed correctly (#​4162)
  • Update documentation to clarify the usage restriction of ephemeral values in lifecycle.enabled. (#​4220)
  • tofu console -lock=false now works as intended. (#​4291)
SECURITY ADVISORIES:
  • Previous releases in the v1.12 series could read an arbitrary file during certain git operations via a maliciously crafted URL (#​4293)

Full Changelog: opentofu/opentofu@v1.12.2...v1.12.3

v1.12.2

Compare Source

1.12.2

SECURITY ADVISORIES:

  • Previous releases in the v1.12 series could be affected by several vulnerabilities:

    • If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted.

    This is fixed now by (#​4177)

  • Previous releases in the v1.12 series could be affected by several vulnerabilities:

    • When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
    • If using an attacker-controlled server to run tofu against, it might end up in high CPU consumption.

    These are now fixed by (#​4247)

BUG FIXES:

  • Properly handle EDEADLK during provider installation. On Unix systems, the kernel may erroneously detect a deadlock between tofu processes using the global plugin cache. (#​4166)
  • Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)
  • Prevent panic when using ephemeral resources during tofu test`. (#​4254)

Full Changelog: opentofu/opentofu@v1.12.1...v1.12.2

v1.12.1

Compare Source

SECURITY ADVISORIES:

  • Previous releases in the v1.12 series could be affected by several vulnerabilities:

    • ssh usage through OpenTofu generate hangs or panics.
    • Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.

    This is fixed now by (#​4145)

BUG FIXES:
  • Address a bug introduced in v1.12.0 causing excessive memory usage by providers. (#​4126)
  • Address a bug introduced in v1.12.0 where replace_triggered_by was validated incorrectly. (#​4133
  • The Azure key provider will now accept the tenant_id, subscription_id, environment, and metadata_host variables; a bug previously only allowed these to be set through environment variables. (#​4091)

Full Changelog: https://github.com/opentofu/opentofu/blob/v1.12/CHANGELOG.md

v1.12.0

Compare Source

OpenTofu 1.12.0

We're proud to announce that OpenTofu 1.12.0 is now officially available! 🎉

Highlights

This release cycle introduces major new capabilities and integrations:

Dynamic prevent_destroy

OpenTofu v1.12.0 now allows prevent_destroy to be defined dynamically in terms of other values available elsewhere in the same module. For example:

variable "prevent_destroy_database" {
  type    = bool
  default = true
}

resource "example_database" "example" {
  # ...

  lifecycle {
    prevent_destroy = var.prevent_destroy_database
  }
}
Provider Checksum Improvements

The default provider installation behavior in OpenTofu is designed to mostly "just work" by getting the needed providers installed and making the necessary changes to the dependency lock file, but in previous versions friction appeared for any teams using many of the non-default installation settings such as the shared provider plugin cache, or local mirrors of upstream providers.

For OpenTofu v1.12, OpenTofu Registry now provides a full set of official checksums in all of the checksum formats needed by other installation methods. This means that after running tofu init the dependency lock file will immediately have all of the information required to successfully use a global plugin cache directory and to verify matching packages served from a local mirror, without needing to run tofu providers lock separately.

Simultaneous Human-readable and Machine-readable Output

Many OpenTofu commands support both human-oriented UI output and machine-readable JSON output, but previously those commands could be run with only one or the other. This was bothersome for those implementing alternative UIs in terms of the machine-readable output because it meant they would need to implement all possible features of the UI before their tool could actually be used.

OpenTofu v1.12.0 introduces a new option -json-into=FILENAME, which produces the same output format that -json would have produced but sends that output to the given filename instead of to the standard output stream. The OpenTofu UI output then appears on the standard output stream as normal, so that software interpreting the JSON output can behave as just a supplement to the normal UI rather than a complete replacement.

New destroy lifecycle meta-argument

The new destroy = false lifecycle option for managed resources allows removing an object from the state without first destroying the remote object.

Deprecation Notices
WinRM for Provisioners is Now Deprecated

Some of the Go libraries that OpenTofu uses for WinRM connection support in provisioners have become unmaintained over time, and so unfortunately we are phasing out support for WinRM in OpenTofu starting with deprecation warnings in this release.

If your configuration includes a connection block with type = "winrm" then OpenTofu v1.12 will warn that this connection type is deprecated, but provisioning should otherwise still work as it did before.

We intend to remove WinRM support completely in the forthcoming OpenTofu v1.13 series, and so if you are currently relying on WinRM support we recommend that you begin planning to migrate to using OpenSSH for Windows instead.

Phasing Out Support for 32-bit CPU Architectures

We are also planning to stop producing official releases for 32-bit CPU architectures (386 and arm) in a future version of OpenTofu. Support for 64-bit architectures (amd64 and arm64) is unaffected.

OpenTofu v1.12 does not include any changes to CPU support yet, but we expect that the official builds in the forthcoming v1.13 series will begin producing warnings when running on 32-bit CPU architectures, before we stop producing those packages altogether in a future release series.

Compatibility Notes
  • macOS: Requires macOS 12 Monterey or later
  • The OPENTOFU_USER_AGENT environment variable, which allowed fully overriding the default User-Agent header on all HTTP requests, has been removed.
  • On Unix systems OpenTofu now considers the BROWSER environment variable as a possible override for the default behavior for launching a web browser. If you run OpenTofu in a context where an environment variable of that name is already set, it may cause OpenTofu to now open a web browser in a different way than previous versions would have. Unsetting that environment variable will restore the previous platform-specific behavior.
Reference

Thank you for your continued support and testing of the OpenTofu project!

v1.11.12

Compare Source

BUG FIXES:

  • Moved block now correctly compares provider source addresses. (#​4280)[#​4280]
  • Correct Source Provider Address now passed into Provider MoveResource requests. (#​4355)[#​4355]

Full Changelog: opentofu/opentofu@v1.11.11...v1.11.12

v1.11.11

Compare Source

BUG FIXES:
  • Fixes an incomplete OTEL dependencies upgrade from the previous patch release. (#​4303)

Full Changelog: opentofu/opentofu@v1.11.10...v1.11.11

v1.11.10

Compare Source

BUG FIXES:
  • Update documentation to clarify the usage restriction of ephemeral values in lifecycle.enabled. (#​4220)
SECURITY ADVISORIES:
  • Previous releases in the v1.11 series could read an arbitrary file during certain git operations via a maliciously crafted URL (#​4292).

Full Changelog: opentofu/opentofu@v1.11.9...v1.11.10

v1.11.9

Compare Source

1.11.9

SECURITY ADVISORIES:

  • Previous releases in the v1.11 series could be affected by several vulnerabilities:

    • ssh usage through OpenTofu generate hangs or panics.
    • Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @​revoked.

    This is fixed now by (#​4145)

  • If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted. (#​4177)

  • Previous releases in the v1.11 series could be affected by several vulnerabilities:

    • When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
    • If using an attacker-controlled server to run tofu against, it might end up in high CPU consumption.

    These are now fixed by (#​4248)

BUG FIXES:

  • Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)
  • Prevent panic when using ephemeral resources during tofu test`. (#​4254)

Full Changelog: opentofu/opentofu@v1.11.8...v1.11.9

gruntwork-io/terragrunt (terragrunt)

v1.1.1

Compare Source

🐛 Bug Fixes

Chained role assumption for the S3 backend

When AWS credentials were supplied through --auth-provider-cmd or environment variables, Terragrunt ignored the assume_role attribute of the remote_state block for its own backend operations, such as bootstrapping the state bucket. In cross-account setups this caused access errors, even though OpenTofu/Terraform itself assumed the role correctly during runs.

Terragrunt now uses the supplied credentials as the source identity and assumes the configured role on top of them. The same applies to roles configured via the iam_role attribute or the --iam-assume-role flag, and to fetching dependency outputs directly from S3 state.

Safer temporary clone directories for terragrunt catalog

Terragrunt now creates a fresh temporary clone directory for each catalog load, rejects symlinked clone roots, and removes catalog clones when the TUI session exits.

Resolve dependency outputs for units that reference a dependency in a hook, extra_arguments, or remote_state block

Resolving a unit's dependency outputs for a downstream unit no longer fails when that unit references its own dependency in:

  • a before_hook, after_hook, or error_hook
  • an extra_arguments block
  • a remote_state block

Previously these raised There is no variable named "dependency" on the downstream unit, and a remote_state reference could crash Terragrunt.

Limit IaC engine archive extraction

Terragrunt now protects developer machines and CI runners from engine archives that expand into unexpectedly large amounts of data. If an IaC engine package is unusually large or contains too many files, Terragrunt stops processing it before it can consume excessive disk space.

--filter-allow-destroy with ...[] dependent-traversal filters no longer fails

--filter-allow-destroy --filter '...[HEAD~1...HEAD]' failed with "Too many command line arguments" or hung when the deleted unit had dependents. Terragrunt now correctly plans and destroys deleted units regardless of whether dependents are included in the run.

Fix find and list missing units inside generated stacks for Git-based filters

terragrunt find and terragrunt list with a Git-based filter (for example --filter '[HEAD^1...HEAD]') now detect units inside generated stacks. Previously they did not generate stacks in the worktrees they create for the comparison, so no unit nested in a generated stack was ever surfaced, while terragrunt run --all with the same filter targeted those units correctly.

This affected every change that lands inside a generated stack, including a modified terragrunt.stack.hcl, a change to a unit's own files, and a change to a file the stack reads via read_terragrunt_config or mark_glob_as_read.

Stacks are generated only inside the comparison worktrees; find and list still do not generate stacks in your current working directory by default.

Treat Git source ref values strictly as references

Terragrunt now passes the ref from a Git module source to git strictly as a reference when downloading through content-addressable storage. Previously a source whose ref began with a git option (for example a value starting with --) could be interpreted by git as an option rather than a reference while fetching the source.

Terragrunt now terminates git option parsing before the repository and reference arguments in its fetch, clone, and ls-remote invocations, so these values can only ever be read as the repository and reference they are meant to be. Normal refs, branches, tags, and commit SHAs continue to work unchanged.

hcl validate resolves get_original_terragrunt_dir() to the discovered unit

terragrunt hcl validate and terragrunt hcl validate --inputs now resolve get_original_terragrunt_dir() to each discovered unit's own directory instead of the directory the command was launched from. Previously, when the command ran from a parent directory that discovered units in subdirectories, any read_terragrunt_config() call that built a path relative to get_original_terragrunt_dir() resolved against the wrong directory and failed with "You attempted to run terragrunt in a folder that does not contain a terragrunt.hcl file", even though plan, apply, and run validate worked on the same configuration.

Both commands now set the original config path per discovered unit before parsing, matching the behavior of run and backend bootstrap, so relative paths resolve against the unit that owns them.

Respect -lockfile=readonly during provider caching

When you pass -lockfile=readonly to init, Terragrunt no longer generates or updates .terraform.lock.hcl while warming the provider cache. Previously the cache step could write the lock file before OpenTofu/Terraform ran, so the read-only check always passed and silently defeated the flag.

Terragrunt now leaves the lock file untouched and lets OpenTofu/Terraform enforce it, failing when the lock file is missing or incomplete. The flag is honored whether it is supplied on the command line or through the TF_CLI_ARGS or TF_CLI_ARGS_init environment variables.

run --all no longer crashes on dependency discovery with graph filters

Running run --all with a filter that expands a git range through the dependency graph (for example [HEAD~1...HEAD]...) could fail during dependency discovery, reporting that a component "is missing its working directory". Whether it happened depended on the size and shape of the changed unit's dependency closure, so the same filter succeeded on smaller branches and find was unaffected.

A dependency reached from several units at once could become visible to discovery before its working directory was set, so a concurrent traversal could read it before it was complete. Dependencies now have their working directory set before they become visible, so run --all behaves the same regardless of graph size.

terraform_binary respected by run --all when both tofu and terraform are on PATH

run --all ignored a unit's terraform_binary setting and fell back to the auto-detected default (OpenTofu when both binaries are on PATH). The per-unit options used to execute each unit are cloned from the stack options, whose binary path is the auto-detected default, and the configured value was never applied to them.

Each unit now honors its own terraform_binary, matching the behavior of a single run. Setting --tf-path or TG_TF_PATH still takes precedence over the config value.

S3 bucket creation failures report the underlying error

When creating the state bucket failed during backend bootstrap, the reported error was a misleading NoSuchBucket from a follow-up access check, hiding the actual cause. The original creation error, such as AccessDenied, is now part of the reported message.

Allow empty locals blocks in terragrunt.stack.hcl

Fixed a bug where an empty locals {} block in a stack configuration could break stack generate.

Clear error when terraform.source references a dependency output

A terraform.source that references dependency.<name>.outputs.<key> is now rejected with a message explaining that the module source must be resolvable before dependencies are evaluated.

Terragrunt resolves the source while discovering units and building the run queue, before any dependency has run, so such a source can never be satisfied. Previously it surfaced a cryptic decode error.

🧪 Experiments Added

oci - Module sources from OCI registries

The oci experiment has been added as the gate for downloading source code (including OpenTofu modules) from OCI Distribution registries using oci:// schema URLs in Terragrunt configurations (including terraform.source attributes). This targets the same registries OpenTofu 1.10 supports natively, such as Amazon ECR, GitHub Container Registry, Azure Container Registry, Google Artifact Registry, and self-hosted or air-gapped registries.

Enabling the experiment has no behavioral effect yet: the getter that will resolve oci:// sources is not wired into source downloading, so oci:// sources still fail to download. Functional support will land in follow-up releases, gated by this experiment.

For setup steps, see the experiment documentation.

version-attribute - Resolve registry modules from a version constraint

The version-attribute experiment has been added to gate a new version attribute on the terraform block. It holds a version constraint (such as ~> 3.3 or >= 1.0.0, < 2.0.0) for a tfr:// registry module, and Terragrunt resolves it to the highest published version that satisfies the constraint before downloading:

terraform {
  source  = "tfr://registry.opentofu.org/terraform-aws-modules/vpc/aws"
  version = "~> 3.3"
}

This brings the terraform block to parity with the version argument on OpenTofu and Terraform module blocks. The attribute applies to tfr:// sources only, and cannot be combined with an inline ?version= on the same source.

Enable it with --experiment version-attribute. For setup steps and the criteria for stabilization, see the experiment documentation.

⚙️ Process Updates

Friendly panic reports

Terragrunt now writes a terragrunt-crash-YYYYMMDDTHHMMSSZ-<pid>.log file when it crashes.

The report includes runtime details, the command line, the panic message, and the stack trace. You can conveniently share this file (after reviewing for sensitive information) to report panics if Terragrunt crashes.

Pull Requests

✨ Features
🐛 Bug Fixes
📖 Documentation
🧹 Chores
📝 Other Changes
  • Revert "chore(deps): bump the js-dependencies group across 1 directory with 4…" by @​yhakbar in #​6433

v1.1.0

Compare Source

✨ New Features

Stack dependencies

A stack generates a tree of units from a single terragrunt.stack.hcl file. Wiring one of those units to another used to mean defining dependency blocks in your catalog and threading dependency paths through values. Stack dependencies let you declare those relationships up front instead.

Add an autoinclude block inside a unit or stack block, and Terragrunt generates a partial configuration (a terragrunt.autoinclude.hcl file) next to the generated terragrunt.hcl or terragrunt.stack.hcl that's automatically merged into the unit or stack definition. The new unit.<name>.path and stack.<name>.path references resolve to generated paths, so you don't have to hardcode them:

# terragrunt.stack.hcl
unit "vpc" {
  source = "github.com/acme/catalog//units/vpc"
  path   = "vpc"
}

unit "app" {
  source = "github.com/acme/catalog//units/app"
  path   = "app"

  autoinclude {
    dependency "vpc" {
      config_path = unit.vpc.path
    }

    inputs = {
      vpc_id = dependency.vpc.outputs.vpc_id
    }
  }
}

Anything that's valid in a unit configuration is valid in its autoinclude block, so you can also patch catalog units with configuration they don't ship with, like retry rules:

# terragrunt.stack.hcl
unit "app" {
  source = "github.com/acme/catalog//units/app"
  path   = "app"

  autoinclude {
    errors {
      retry "transient_errors" {
        retryable_errors   = [".*Error: transient network issue.*"]
        max_attempts       = 3
        sleep_interval_sec = 5
      }
    }
  }
}

The same works for nested stacks: an autoinclude block inside a stack block patches the generated terragrunt.stack.hcl, so you can, for example, add an extra unit to one environment without forking the stack in your catalog.

Stack configurations also gained two capabilities along the way:

  • include blocks now work in terragrunt.stack.hcl files, so shared stack configuration can live in a parent folder.
  • dependency blocks can target stack directories, and the run queue expands them to the units inside. Note that this relationship only goes one way: units can depend on stacks, but stacks cannot depend on stacks or units.

See the stacks documentation for the full reference. Previously gated behind the stack-dependencies experiment, all of this is now enabled by default.

Content Addressable Store (CAS)

The Content Addressable Store (CAS) deduplicates source downloads across configurations. It addresses repositories and modules by their content, stores them locally, and serves later requests from that local store instead of repeating the fetch. This speeds up catalog cloning, OpenTofu/Terraform source fetching, and stack generation, and identical files occupy disk space once regardless of how many configurations use them.

The CAS is no longer limited to Git. It also deduplicates HTTP, Amazon S3, Google Cloud Storage, Mercurial, and SMB sources, along with OpenTofu/Terraform registry sources fetched via tfr://. See supported sources for how each one resolves and deduplicates content.

CAS is enabled by default. Use the --no-cas flag (or TG_NO_CAS=true) to opt out of it for a run:

terragrunt run --all --no-cas -- plan

Two new attributes give you finer control, and both default to off:

  • update_source_with_cas makes a generated stack self-contained. Set it on a unit, stack, or terraform block with a relative source, and terragrunt stack generate rewrites that source into a content-addressed cas:: reference, so the generated tree no longer depends on the surrounding repository layout. Catalog authors can keep relative paths in their sources and still ship a portable, reproducible stack:

    # stacks/networking/terragrunt.stack.hcl
unit "vpc" {
  source = "../..//units/vpc"
  path   = "vpc"

  update_source_with_cas = true
}

    After terragrunt stack generate, the relative path is replaced by a reference to the exact tree the CAS stored:

    # Generated output
unit "vpc" {
  source = "cas::sha1:f39ea0ebf891c9954c89d07b73b487ff938ef08b"
  path   = "vpc"

  update_source_with_cas = true
}

  • mutable controls how the CAS places fetched content on disk. By default, the CAS hard links files from its shared store into .terragrunt-cache and marks them read-only, which is fast and uses no extra space, but means the files can't be edited in place. Set mutable = true on a terraform block to copy the content instead, making the working tree safe to edit at the cost of extra I/O and disk space:

    # units/vpc/terragrunt.hcl
terraform {
  source = "github.com/acme/catalog//modules/vpc"

  mutable = true
}

Previously gated behind the cas experiment, the CAS no longer requires --experiment cas.

Redesigned terragrunt catalog

The catalog command has been redesigned. It now starts without any configuration, discovers components across your catalog repositories in the background, and streams them into the TUI as they're found.

Discovery is no longer limited to a modules/ directory; components can live anywhere in a catalog repository. To control what gets discovered, add a .terragrunt-catalog-ignore file with .gitignore-style globs for the paths you want filtered out.

Components in the TUI now carry metadata to help you navigate a large catalog: each one shows a kind label (template, stack, unit, or module) and optional tags defined in the front-matter of its README.md. From the component list, press s to open a new screen that interactively collects the values used to scaffold the component into your repository.

Previously gated behind the catalog-redesign experiment, the redesigned catalog is now the default terragrunt catalog experience.

Reading detection for local module sources

Terragrunt can select units by the files they read, which is the basis of change-based runs in CI. Previously, pointing a unit's terraform block at a local directory didn't mark the files inside that directory as read, so a change to the module wouldn't select the unit.

When a unit's source is a local module, Terragrunt now records the module's *.tf, *.tf.json, *.hcl, *.tofu, and *.tofu.json files as read by that unit, so --filter 'reading=<path>' and --queue-include-units-reading select the unit when a module file changes:

terragrunt run --all --filter 'reading=./modules/vpc/main.tf' -- plan

For files that reading detection doesn't track on its own, the new mark_glob_as_read() HCL function expands a glob and marks every matching file as read in one call:

locals {
  configs = mark_glob_as_read("${get_terragrunt_dir()}/config/{*.yaml,**/*.yaml}")
}

Existing pipelines built on --queue-include-units-reading or reading= filters may select more units than before, because changes to local module files now count as reads. Previously gated behind the mark-many-as-read experiment, these behaviors no longer require --experiment mark-many-as-read.

Skip auth during discovery with --no-discovery-auth-provider-cmd

By default, Terragrunt runs your --auth-provider-cmd once for every unit it discovers, so HCL functions that need credentials resolve correctly during parsing. In a large repository, that can mean hundreds of invocations before any unit runs, which can dominate wall-clock time on change-based runs.

The --no-discovery-auth-provider-cmd flag (env: TG_NO_DISCOVERY_AUTH_PROVIDER_CMD) skips those invocations during the discovery phase, leaving auth to run only for the units that actually execute:

terragrunt run --all \
  --no-discovery-auth-provider-cmd \
  --queue-include-units-reading=./changed-file.txt \
  -- plan

[!WARNING]
Use this only when you know parsing resolves without credentials. Units whose configuration depends on values from --auth-provider-cmd during discovery (for example, via get_aws_account_id()) will fail to parse when the flag is set.

Previously gated behind the opt-out-auth experiment, the flag now works without --experiment opt-out-auth.

Run queue displayed as a dependency tree

Before a run --all, Terragrunt lists the units it's about to run. That list now renders as a dependency tree by default instead of a flat list, with units nested under their dependencies, so the run order and the relationships between units are visible before anything executes:

The following units will be run, starting with dependencies and then their dependents:
.
├── monitoring
╰── vpc
    ╰── database
        ╰── backend-app

The header adapts to direction: dependencies come before dependents on apply, and the order reverses on destroy.

Previously gated behind the dag-queue-display experiment, the tree display no longer requires --experiment dag-queue-display.

💡 Tips Added

Tip when filtering a stack leaves nested stacks ungenerated

terragrunt stack generate --filter './my-stack | type=stack' generates only the selected
stack, not the nested stacks it contains, which can be surprising for a stack of stacks.
When a non-glob | type=stack filter leaves a stack's nested stacks ungenerated, Terragrunt
now prints a tip showing how to generate them too, for example
--filter './my-stack | type=stack' --filter './my-stack/** | type=stack'.

🐛 Bug Fixes

Fix permission denied when generated files overwrite CAS-materialized files

With the CAS enabled, Terragrunt fetches sources as read-only files. Writing a generated file over one of them no longer fails with permission denied:

  • Files from generate blocks with if_exists = "overwrite", when the module ships the target file (for example, its own versions.tf).
  • terragrunt.values.hcl, when the unit or stack source already contains one.
  • terragrunt.autoinclude.hcl, when the unit or stack source already contains one.
  • .terraform.lock.hcl, when the provider cache server updates a committed lock file during init -upgrade.

In each case, the read-only file is replaced with a writable one, and the shared CAS store is never modified.

Fix permission denied when CAS fetches a git source across filesystems

With the CAS enabled, fetching a git:: source could fail with permission denied on .git/HEAD or .git/config, sending Terragrunt back to the standard getter. It happened when the CAS store and the module's working directory sit on different filesystems, so the files are copied rather than hard-linked, and a read-only leftover from an interrupted run was in the way. Terragrunt now recovers from the leftover and completes the fetch.

Reject update_source_with_cas on a terraform block when CAS is disabled

terragrunt stack generate --no-cas now fails when a generated unit's terraform block sets update_source_with_cas = true, instead of silently emitting the unit with its relative source unchanged. The relative source has no meaning once CAS is disabled, so the generated unit could not resolve its module. This matches the existing behavior for the same attribute on unit and stack blocks, and for a run invoked with --no-cas.

Apply extra_arguments env vars when resolving dependency outputs

Resolving a dependency block's outputs now applies the env_vars from the unit's terraform extra_arguments blocks whose commands include output.

Resolve dependency outputs for units whose before_hook references a dependency

Resolving a unit's dependency outputs no longer evaluates that unit's terraform hooks, so a before_hook (or after_hook) that interpolates ${dependency.<name>.outputs.<key>} no longer fails downstream units with There is no variable named "dependency". Dependency output resolution still applies the unit's extra_arguments env_vars and source.

Select units reading added or deleted glob files in Git-based filters

Git-based filters (for example terragrunt run --all --filter '[HEAD^1...HEAD]' -- plan) now select units
that read an added or deleted file through mark_glob_as_read, even when that file lives outside the unit's
own directory. Previously only modified files outside a unit reached those units; adding or deleting a file
the glob matched left the reading unit out of the run, so its real config change was skipped. Added files are
matched against the newer reference, and deleted files against the older one where the file still exists.

mark_glob_as_read constrains its walk to a boundary

mark_glob_as_read now confines glob expansion to a boundary directory. By default the boundary is the enclosing Git repository root; outside a Git repository it is unset. A pattern whose walk would begin outside the boundary returns an error instead of expanding.

This bounds patterns that resolve higher than intended. For example, "${local.dir}/{*.yaml}" becomes /{*.yaml} when local.dir is empty, which previously walked the entire filesystem. A ? : conditional does not prevent this, because HCL evaluates both branches of a conditional before selecting one. Wrapping the call in try lets the error fall back to a default:

locals {
  files = sort(try(mark_glob_as_read("${local.dir}/{*.yaml,*.yml,*.json}"), []))
}

Pass a leading --terragrunt-boundary argument to set the boundary explicitly, for example to scope the walk to a subdirectory or to widen it to the filesystem root:

locals {
  scoped = mark_glob_as_read("--terragrunt-boundary=/etc/terragrunt", "/etc/terragrunt/{*.yaml}")
  all    = mark_glob_as_read("--terragrunt-boundary=/", "/{*.yaml}")
}

Scaffold only detects variables in the module directory

terragrunt scaffold now reads input variables from the module directory itself, matching what OpenTofu and Terraform load for a root module. Previously it scanned subdirectories too, so variable blocks defined in nested modules or examples leaked into the scaffolded inputs even though the module never exposes them.

Resolve interpolated object keys in autoinclude blocks

terragrunt stack generate now resolves interpolated object keys in autoinclude blocks (for example
{ "${local.prefix}_key" = ... }), even when the value references dependency.*. Previously the generated
unit kept the key verbatim, leaking a stack-only reference that is not valid in the unit scope.

Fix panic on non-string literal interpolation in autoinclude templates

terragrunt stack generate no longer panics when an autoinclude template interpolates a non-string literal (for example "${0}" or "${true}") alongside a dependency.* reference. The interpolated literal is now rendered to its string form (${0} becomes 0) and the dependency reference is preserved for the unit.

Resolve transitive autoinclude dependencies on a stack directory

run --all no longer fails with "does not contain a terragrunt.hcl file" when an autoinclude dependency points at a stack directory (one holding terragrunt.stack.hcl) and the unit is reached transitively through another unit. The dependency cycle check now skips a target with no unit config, matching the direct dependency case.

🧪 Experiments Updated

Six experiments completed

The following experiments graduated to general availability in this release, and the features they gated are now enabled by default:

  • stack-dependencies
  • cas
  • catalog-redesign
  • mark-many-as-read
  • opt-out-auth
  • dag-queue-display

Each feature is described in the New Features section above.

The corresponding --experiment flags (and TG_EXPERIMENT values) are no longer needed. Passing one still works, but emits a warning about the completed experiment, so you can drop it at your convenience.

Thank you to everyone who ran these experiments early and filed the feedback that got them here.

⚙️ Process Updates

Immutable releases

Starting with this release, Terragrunt releases are published as immutable releases on GitHub. Once a release is published, its tag and assets can no longer be modified or deleted, so the binary you download is guaranteed to be the same binary that was uploaded when the release was published.

See the releases process documentation for details, and Verifying releases with the GitHub CLI for how to check a download against the release attestation.

Install script verifies release attestations

The install script now checks downloaded release assets against the release attestation that ships with immutable releases. For releases starting with v1.1.0, when an authenticated GitHub CLI (v2.81.0 or later) is available, the script verifies the checksums file and the binary against the attestation before installing, and aborts if either does not match the published release. The check is skipped with a warning when gh is unavailable, too old, or unauthenticated. Use --no-verify-attestation to opt out.

Pull Requests

✨ Features
  • feat: Tip how to run a stack's units when a stack filter matches no units by @​denis256 in #​6387
🐛 Bug Fixes
📖 Documentation
🧹 Chores

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • "before 9am on tuesday"
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled because a matching PR was automerged previously.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from a team as a code owner May 26, 2026 04:28
@github-actions

github-actions Bot commented May 26, 2026 •
edited
Loading

Copy link
Copy Markdown

Terraform Plan

Shared

✅ 1password/account — No changes
✅ 1password/futo-account — No changes
✅ bunny/futo-account — No changes
✅ cloudflare/account — No changes
✅ cloudflare/api-keys — No changes
✅ cloudflare/futo-account — No changes
✅ cloudflare/futo-api-keys — No changes
✅ docker/org — No changes
⚠️ github/org — Plan: 0 to add, 4 to change, 0 to destroy. 
OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  ~ update in-place (current -> planned)
  # github_repository_collaborators.repo_collaborators["immich"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "455229168"
      ~ invitation_ids = {
          - "koen-futo"  = "286515056"
          - "martabal"   = "284848949"
          - "martyfuhry" = "284848968"
          - "matthinc"   = "284848954"
          - "sudoicezen" = "284848972"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (59 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["static-pages"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "822727374"
      ~ invitation_ids = {
          - "PixelJonas" = "284848947"
          - "fyfrey"     = "284848959"
          - "kennyfuto"  = "288622006"
          - "koen-futo"  = "286515046"
          - "martabal"   = "284848951"
          - "martyfuhry" = "284848969"
          - "matthinc"   = "284848955"
          - "orhan98"    = "315880176"
          - "sudoicezen" = "284848974"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (58 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["test-assets"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "697157116"
      ~ invitation_ids = {
          - "PixelJonas" = "284848946"
          - "fyfrey"     = "284848960"
          - "kennyfuto"  = "288622000"
          - "koen-futo"  = "286515048"
          - "martabal"   = "284848952"
          - "martyfuhry" = "284848970"
          - "matthinc"   = "284848956"
          - "orhan98"    = "315880175"
          - "staticdog"  = "320859393"
          - "sudoicezen" = "284848973"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (58 unchanged blocks hidden)
    }
  # github_repository_collaborators.repo_collaborators["walkrs"] will be updated in-place
  ~ resource "github_repository_collaborators" "repo_collaborators" {
        id             = "1156754889"
      ~ invitation_ids = {
          - "C-Otto"          = "307331486"
          - "PixelJonas"      = "307331438"
          - "adamantike"      = "307331464"
          - "dahool"          = "307331471"
          - "ddshd"           = "307331444"
          - "fyfrey"          = "307331463"
          - "github-cli"      = "307331445"
          - "jbaez"           = "307331428"
          - "kennyfuto"       = "307331447"
          - "koen-futo"       = "307331458"
          - "martabal"        = "307331390"
          - "martyfuhry"      = "307331483"
          - "matthinc"        = "307331420"
          - "michelheusschen" = "307331480"
          - "midzelis"        = "309034718"
          - "orhan98"         = "315880173"
          - "samholton"       = "307331386"
          - "schuhbacca"      = "307331432"
          - "skatsubo"        = "307331414"
          - "staticdog"       = "320859390"
        } -> (known after apply)
        # (2 unchanged attributes hidden)
      - user {
          - permission = "admin" -> null
          - username   = "alextran1502" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "bo0tzz" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "jrasm91" -> null
        }
      - user {
          - permission = "admin" -> null
          - username   = "zackpollard" -> null
        }
      + user {
          + permission = "maintain"
          + username   = "alextran1502"
        }
      + user {
          + permission = "maintain"
          + username   = "bo0tzz"
        }
      + user {
          + permission = "maintain"
          + username   = "jrasm91"
        }
      + user {
          + permission = "maintain"
          + username   = "zackpollard"
        }
        # (58 unchanged blocks hidden)
    }
Plan: 0 to add, 4 to change, 0 to destroy.
╷
│ Warning: Argument is deprecated
│ 
│   with github_repository.repositories[".github"],
│   on repositories.tf line 173, in resource "github_repository" "repositories":
│  173:   vulnerability_alerts      = !each.value.archived
│ 
│ Use the github_repository_vulnerability_alerts resource instead. This field
│ will be removed in a future version.
│ 
│ (and 24 more similar warnings elsewhere)
╵
─────────────────────────────────────────────────────────────────────────────
Note: You didn't use the -out option to save this plan, so OpenTofu can't
guarantee to take exactly these actions if you run "tofu apply" now.
✅ github/secrets — No changes
✅ github/webhooks — No changes
✅ netbird/account — No changes
✅ zitadel/cloud — No changes
✅ zitadel/self-hosted — No changes

Scoped (dev)

✅ discord/community — No changes
✅ monitoring/grafana — No changes
✅ zitadel/customer — No changes

Scoped (prod)

✅ discord/community — No changes
✅ discord/futo — No changes
✅ monitoring/grafana — No changes
✅ zitadel/customer — No changes

Scoped (staging — zitadel customer)

✅ customer — No changes

@renovate
renovate Bot force-pushed the renovate/tofu branch 5 times, most recently from 6f35a8c to bd1e603 Compare June 2, 2026 23:21
@renovate
renovate Bot force-pushed the renovate/tofu branch 3 times, most recently from 5903a4b to 932c65e Compare June 12, 2026 12:18
@renovate
renovate Bot force-pushed the renovate/tofu branch 3 times, most recently from 34a53cc to fbbcb97 Compare June 17, 2026 16:09
@renovate
renovate Bot force-pushed the renovate/tofu branch 2 times, most recently from d1a762f to c36775a Compare June 23, 2026 18:02
@renovate
renovate Bot force-pushed the renovate/tofu branch 3 times, most recently from c7e43e2 to 317e1d7 Compare July 6, 2026 11:34
@renovate
renovate Bot force-pushed the renovate/tofu branch 4 times, most recently from 7e19108 to fcbcd73 Compare July 18, 2026 16:25
@renovate
renovate Bot force-pushed the renovate/tofu branch from fcbcd73 to e90de90 Compare July 19, 2026 17:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

changelog:skip dependencies renovate

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants