NEW FEATURES:
Add write-only attributes to resources. Providers can specify that certain attributes are write-only. They are not persisted in state. You can use ephemeral values in write-only attributes. (#36031)
terraform test: The -junit-xml option for the terraform test command is now generally available. This option allows the command to create a test report in JUnit XML format. Feedback during the experimental phase helped map terraform test concepts to the JUnit XML format, and new additons may happen in future releases. (#36324)
S3 native state locking is now generally available. The use_lockfile argument enables users to adopt the S3-native mechanism for state locking. As part of this change, we've deprecated the DynamoDB-related arguments in favor of this new locking mechanism. While you can still use DynamoDB alongside S3-native state locking for migration purposes, we encourage migrating to the new state locking mechanism. (#36338)
ENHANCEMENTS:
init: Provider installation will utilise credentials configured in a .netrc file for the download and shasum URLs returned by provider registries. (#35843)
terraform test: Test runs now support using mocked or overridden values during unit test runs (e.g., with command = "plan"). Set override_during = plan in the test configuration to use the overridden values during the plan phase. The default value is override_during = apply. (#36227)
terraform test: Add new state_key attribute for run blocks, allowing test authors control over which internal state file should be used for the current test run. (#36185)
Updates the azure backend authentication to match the terraform-provider-azurermprovider authentication, in several ways:
Include ca-certificates package in our official Docker image to help with certificate handling by downstream (#36486)
BUG FIXES:
ephemeral values: correct error message when ephemeral values are included in provisioner output (#36427)
Attempting to override a variable during apply via TF_VAR_ environment variable will now yield warning instead of misleading error. (#36435)
backends: Fix crash when interrupting during interactive prompt for values (#36448)
Fixes hanging behavior seen when applying a saved plan with -auto-approve using the cloud backend (#36453)
For information on prior major and minor releases, refer to their changelogs:
NEW FEATURES:
Add write-only attributes to resources. Providers can specify that certain attributes are write-only. They are not persisted in state. You can use ephemeral values in write-only attributes. (#36031)
terraform test: The -junit-xml option for the terraform test command is now generally available. This option allows the command to create a test report in JUnit XML format. Feedback during the experimental phase helped map terraform test concepts to the JUnit XML format, and new additons may happen in future releases. (#36324)
S3 native state locking is now generally available. The use_lockfile argument enables users to adopt the S3-native mechanism for state locking. As part of this change, we've deprecated the DynamoDB-related arguments in favor of this new locking mechanism. While you can still use DynamoDB alongside S3-native state locking for migration purposes, we encourage migrating to the new state locking mechanism. (#36338)
ENHANCEMENTS:
init: Provider installation will utilise credentials configured in a .netrc file for the download and shasum URLs returned by provider registries. (#35843)
terraform test: Test runs now support using mocked or overridden values during unit test runs (e.g., with command = "plan"). Set override_during = plan in the test configuration to use the overridden values during the plan phase. The default value is override_during = apply. (#36227)
terraform test: Add new state_key attribute for run blocks, allowing test authors control over which internal state file should be used for the current test run. (#36185)
Updates the azure backend authentication to match the terraform-provider-azurermprovider authentication, in several ways:
Include ca-certificates package in our official Docker image to help with certificate handling by downstream (#36486)
BUG FIXES:
ephemeral values: correct error message when ephemeral values are included in provisioner output (#36427)
Attempting to override a variable during apply via TF_VAR_ environment variable will now yield warning instead of misleading error. (#36435)
backends: Fix crash when interrupting during interactive prompt for values (#36448)
Fixes hanging behavior seen when applying a saved plan with -auto-approve using the cloud backend (#36453)
For information on prior major and minor releases, refer to their changelogs:
NEW FEATURES:
Add write-only attributes to resources. Providers can specify that certain attributes are write-only. They are not persisted in state. You can use ephemeral values in write-only attributes. (#36031)
terraform test: The -junit-xml option for the terraform test command is now generally available. This option allows the command to create a test report in JUnit XML format. Feedback during the experimental phase helped map terraform test concepts to the JUnit XML format, and new additons may happen in future releases. (#36324)
S3 native state locking is now generally available. The use_lockfile argument enables users to adopt the S3-native mechanism for state locking. As part of this change, we've deprecated the DynamoDB-related arguments in favor of this new locking mechanism. While you can still use DynamoDB alongside S3-native state locking for migration purposes, we encourage migrating to the new state locking mechanism. (#36338)
ENHANCEMENTS:
init: Provider installation will utilise credentials configured in a .netrc file for the download and shasum URLs returned by provider registries. (#35843)
terraform test: Test runs now support using mocked or overridden values during unit test runs (e.g., with command = "plan"). Set override_during = plan in the test configuration to use the overridden values during the plan phase. The default value is override_during = apply. (#36227)
terraform test: Add new state_key attribute for run blocks, allowing test authors control over which internal state file should be used for the current test run. (#36185)
Updates the azure backend authentication to match the terraform-provider-azurermprovider authentication, in several ways:
Include ca-certificates package in our official Docker image to help with certificate handling by downstream (#36486)
BUG FIXES:
ephemeral values: correct error message when ephemeral values are included in provisioner output (#36427)
Attempting to override a variable during apply via TF_VAR_ environment variable will now yield warning instead of misleading error. (#36435)
backends: Fix crash when interrupting during interactive prompt for values (#36448)
Fixes hanging behavior seen when applying a saved plan with -auto-approve using the cloud backend (#36453)
For information on prior major and minor releases, refer to their changelogs:
EXPERIMENTS:
Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.
terraform rpcapi exposes some Terraform Core functionality through an RPC interface compatible with go-plugin. The exact RPC API exposed here is currently subject to change at any time, because it's here primarily as a vehicle to support the Terraform Stacks private preview and so will be broken if necessary to respond to feedback from private preview participants, or possibly for other reasons. Do not use this mechanism yet outside of Terraform Stacks private preview.-allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values. This experiment is under active development, and so it's not yet useful to participate in this experimentFor information on prior major and minor releases, refer to their changelogs:
NEW FEATURES:
Add write-only attributes to resources. Providers can specify that certain attributes are write-only. They are not persisted in state. You can use ephemeral values in write-only attributes. (#36031)
terraform test: The -junit-xml option for the terraform test command is now generally available. This option allows the command to create a test report in JUnit XML format. Feedback during the experimental phase helped map terraform test concepts to the JUnit XML format, and new additons may happen in future releases. (#36324)
S3 native state locking is now generally available. The use_lockfile argument enables users to adopt the S3-native mechanism for state locking. As part of this change, we've deprecated the DynamoDB-related arguments in favor of this new locking mechanism. While you can still use DynamoDB alongside S3-native state locking for migration purposes, we encourage migrating to the new state locking mechanism. (#36338)
ENHANCEMENTS:
init: Provider installation will utilise credentials configured in a .netrc file for the download and shasum URLs returned by provider registries. (#35843)
New command modules -json: Displays a full list of all installed modules in a working directory, including whether each module is currently referenced by the working directory's configuration. (#35884)
terraform test: Test runs now support using mocked or overridden values during unit test runs (e.g., with command = "plan"). Set override_during = plan in the test configuration to use the overridden values during the plan phase. The default value is override_during = apply. (#36227)
terraform test: Add new state_key attribute for run blocks, allowing test authors control over which internal state file should be used for the current test run. (#36185)
Include ca-certificates package in our official Docker image to help with certificate handling by downstream (#36471)
BUG FIXES:
ephemeral values: correct error message when ephemeral values are included in provisioner output (#36427)
Attempting to override a variable during apply via TF_VAR_ environment variable will now yield warning instead of misleading error. (#36435)
backends: Fix crash when interrupting during interactive prompt for values (#36448)
For information on prior major and minor releases, refer to their changelogs:
NEW FEATURES:
Add write-only attributes to resources. Providers can specify that certain attributes are write-only. They are not persisted in state. You can use ephemeral values in write-only attributes. (#36031)
terraform test: The -junit-xml option for the terraform test command is now generally available. This option allows the command to create a test report in JUnit XML format. Feedback during the experimental phase helped map terraform test concepts to the JUnit XML format, and new additons may happen in future releases. (#36324)
S3 native state locking is now generally available. The use_lockfile argument enables users to adopt the S3-native mechanism for state locking. As part of this change, we've deprecated the DynamoDB-related arguments in favor of this new locking mechanism. While you can still use DynamoDB alongside S3-native state locking for migration purposes, we encourage migrating to the new state locking mechanism. (#36338)
ENHANCEMENTS:
init: Provider installation will utilise credentials configured in a .netrc file for the download and shasum URLs returned by provider registries. (#35843)
New command modules -json: Displays a full list of all installed modules in a working directory, including whether each module is currently referenced by the working directory's configuration. (#35884)
terraform test: Test runs now support using mocked or overridden values during unit test runs (e.g., with command = "plan"). Set override_during = plan in the test configuration to use the overridden values during the plan phase. The default value is override_during = apply. (#36227)
terraform test: Add new state_key attribute for run blocks, allowing test authors control over which internal state file should be used for the current test run. (#36185)
BUG FIXES:
For information on prior major and minor releases, refer to their changelogs:
BUG FIXES:
NEW FEATURES:
Add write-only attributes to resources. Providers can specify that certain attributes are write-only. They are not persisted in state. You can use ephemeral values in write-only attributes. (#36031)
terraform test: The -junit-xml option for the terraform test command is now generally available. This option allows the command to create a test report in JUnit XML format. Feedback during the experimental phase helped map terraform test concepts to the JUnit XML format, and new additons may happen in future releases. (#36324)
S3 native state locking is now generally available. The use_lockfile argument enables users to adopt the S3-native mechanism for state locking. As part of this change, we've deprecated the DynamoDB-related arguments in favor of this new locking mechanism. While you can still use DynamoDB alongside S3-native state locking for migration purposes, we encourage migrating to the new state locking mechanism.
ENHANCEMENTS:
init: Provider installation will utilise credentials configured in a .netrc file for the download and shasum URLs returned by provider registries. (#35843)
terraform test: Test runs now support using mocked or overridden values during unit test runs (e.g., with command = "plan"). Set override_during = plan in the test configuration to use the overridden values during the plan phase. The default value is override_during = apply. (#36227)
terraform test: Add new state_key attribute for run blocks, allowing test authors control over which internal state file should be used for the current test run. (#36185)
BUG FIXES:
github.com/hashicorp/go-slug v0.16.0 => v0.16.3 to integrate latest changes (fix for CVE-2025-0377) (#36273)For information on prior major and minor releases, refer to their changelogs:
ENHANCEMENTS:
init: Provider installation will utilise credentials configured in a .netrc file for the download and shasum URLs returned by provider registries. (https://github.com/hashicorp/terraform/pull/35843)modules -json: Displays a full list of all installed modules in a working directory, including whether each module is currently referenced by the working directory's configuration. (#35884, #36062)EXPERIMENTS:
Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.
terraform test accepts a new option -junit-xml=FILENAME. If specified, and if the test configuration is valid enough to begin executing, then Terraform writes a JUnit XML test result report to the given filename, describing similar information as included in the normal test output. (#34291)terraform rpcapi exposes some Terraform Core functionality through an RPC interface compatible with go-plugin. The exact RPC API exposed here is currently subject to change at any time, because it's here primarily as a vehicle to support the Terraform Stacks private preview and so will be broken if necessary to respond to feedback from private preview participants, or possibly for other reasons. Do not use this mechanism yet outside of Terraform Stacks private preview.-allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values. This experiment is under active development, and so it's not yet useful to participate in this experimentFor information on prior major and minor releases, refer to their changelogs:
ENHANCEMENTS:
init: Provider installation will utilise credentials configured in a .netrc file for the download and shasum URLs returned by provider registries. (https://github.com/hashicorp/terraform/pull/35843)modules -json: Displays a full list of all installed modules in a working directory, including whether each module is currently referenced by the working directory's configuration. (#35884, #36062)EXPERIMENTS:
Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.
terraform test accepts a new option -junit-xml=FILENAME. If specified, and if the test configuration is valid enough to begin executing, then Terraform writes a JUnit XML test result report to the given filename, describing similar information as included in the normal test output. (#34291)terraform rpcapi exposes some Terraform Core functionality through an RPC interface compatible with go-plugin. The exact RPC API exposed here is currently subject to change at any time, because it's here primarily as a vehicle to support the Terraform Stacks private preview and so will be broken if necessary to respond to feedback from private preview participants, or possibly for other reasons. Do not use this mechanism yet outside of Terraform Stacks private preview.-allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values. This experiment is under active development, and so it's not yet useful to participate in this experimentFor information on prior major and minor releases, refer to their changelogs:
BUG FIXES:
BUG FIXES:
ENHANCEMENTS:
init: Provider installation will utilise credentials configured in a .netrc file for the download and shasum URLs returned by provider registries. (https://github.com/hashicorp/terraform/pull/35843)EXPERIMENTS:
Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.
terraform test accepts a new option -junit-xml=FILENAME. If specified, and if the test configuration is valid enough to begin executing, then Terraform writes a JUnit XML test result report to the given filename, describing similar information as included in the normal test output. (#34291)terraform rpcapi exposes some Terraform Core functionality through an RPC interface compatible with go-plugin. The exact RPC API exposed here is currently subject to change at any time, because it's here primarily as a vehicle to support the Terraform Stacks private preview and so will be broken if necessary to respond to feedback from private preview participants, or possibly for other reasons. Do not use this mechanism yet outside of Terraform Stacks private preview.-allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values. This experiment is under active development, and so it's not yet useful to participate in this experimentFor information on prior major and minor releases, refer to their changelogs:
BUG FIXES:
templatefile would panic if given and entirely unknown map of variables (#36118)templatefile would panic if the variables map contains marked values (#36127)for_each (#36119)NEW FEATURES:
ephemeralasnull function: a function takes a value of any type and returns a similar value of the same type with any ephemeral values replaced with non-ephemeral null values and all non-ephemeral values preserved.BUG FIXES:
secret_suffix in the kubernetes backend now includes validation to prevent errors when the secret_suffix ends with a number (#35666).error_message values to pass the core validate step, so variable validation can be completed later during plan
(#35537)self with many instances could encounter an error during evaluation (#35895)plantimestamp() function would return an invalid date during validation (#35902)plan -generate-config-out) for string attributes that contain primitive types (e.g. numbers or booleans) (#35984)issensitive could incorrectly assert that an unknown value was not sensitive during plan, but later became sensitive during apply, causing failures where changes did not match the planned result (#36012)ENHANCEMENTS:
element function now accepts negative indices (#35501)terraform validate (#35543)plan, apply, and refresh commands now produce a deprecated warning when using the -state flag. Instead use the path attribute within the local backend to modify the state file. (#35660)UPGRADE NOTES:
assume_role block (#35721)moved: Moved blocks now respect reserved keywords when parsing resource addresses. Configurations that reference resources with type names that match top level blocks and keywords from moved blocks will need to prepend the resource. identifier to these references. (#35850)For information on prior major and minor releases, refer to their changelogs:
NEW FEATURES:
ephemeralasnull function: a function takes a value of any type and returns a similar value of the same type with any ephemeral values replaced with non-ephemeral null values and all non-ephemeral values preserved.BUG FIXES:
secret_suffix in the kubernetes backend now includes validation to prevent errors when the secret_suffix ends with a number (#35666).error_message values to pass the core validate step, so variable validation can be completed later during plan
(#35537)self with many instances could encounter an error during evaluation (#35895)plantimestamp() function would return an invalid date during validation (#35902)plan -generate-config-out) for string attributes that contain primitive types (e.g. numbers or booleans) (#35984)issensitive could incorrectly assert that an unknown value was not sensitive during plan, but later became sensitive during apply, causing failures where changes did not match the planned result (#36012)ENHANCEMENTS:
element function now accepts negative indices (#35501)terraform validate (#35543)plan, apply, and refresh commands now produce a deprecated warning when using the -state flag. Instead use the path attribute within the local backend to modify the state file. (#35660)UPGRADE NOTES:
assume_role block (#35721)moved: Moved blocks now respect reserved keywords when parsing resource addresses. Configurations that reference resources with type names that match top level blocks and keywords from moved blocks will need to prepend the resource. identifier to these references. (#35850)For information on prior major and minor releases, refer to their changelogs:
NEW FEATURES:
ephemeralasnull function: a function takes a value of any type and returns a similar value of the same type with any ephemeral values replaced with non-ephemeral null values and all non-ephemeral values preserved.BUG FIXES:
secret_suffix in the kubernetes backend now includes validation to prevent errors when the secret_suffix ends with a number (#35666).error_message values to pass the core validate step, so variable validation can be completed later during plan
(#35537)self with many instances could encounter an error during evaluation (#35895)plantimestamp() function would return an invalid date during validation (#35902)plan -generate-config-out) for string attributes that contain primitive types (e.g. numbers or booleans) (#35984)issensitive could incorrectly assert that an unknown value was not sensitive during plan, but later became sensitive during apply, causing failures where changes did not match the planned result (#36012)ENHANCEMENTS:
element function now accepts negative indices (#35501)terraform validate (#35543)plan, apply, and refresh commands now produce a deprecated warning when using the -state flag. Instead use the path attribute within the local backend to modify the state file. (#35660)UPGRADE NOTES:
assume_role block (#35721)moved: Moved blocks now respect reserved keywords when parsing resource addresses. Configurations that reference resources with type names that match top level blocks and keywords from moved blocks will need to prepend the resource. identifier to these references. (#35850)For information on prior major and minor releases, refer to their changelogs:
NEW FEATURES:
ephemeralasnull function: a function takes a value of any type and returns a similar value of the same type with any ephemeral values replaced with non-ephemeral null values and all non-ephemeral values preserved.BUG FIXES:
secret_suffix in the kubernetes backend now includes validation to prevent errors when the secret_suffix ends with a number (#35666).error_message values to pass the core validate step, so variable validation can be completed later during plan
(#35537)self with many instances could encounter an error during evaluation (#35895)plantimestamp() function would return an invalid date during validation (#35902)plan -generate-config-out) for string attributes that contain primitive types (e.g. numbers or booleans) (#35984)ENHANCEMENTS:
element function now accepts negative indices (#35501)terraform validate (#35543)plan, apply, and refresh commands now produce a deprecated warning when using the -state flag. Instead use the path attribute within the local backend to modify the state file. (#35660)UPGRADE NOTES:
assume_role block (#35721)moved: Moved blocks now respect reserved keywords when parsing resource addresses. Configurations that reference resources with type names that match top level blocks and keywords from moved blocks will need to prepend the resource. identifier to these references. (#35850)For information on prior major and minor releases, refer to their changelogs:
EXPERIMENTS:
Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.
terraform test accepts a new option -junit-xml=FILENAME. If specified, and if the test configuration is valid enough to begin executing, then Terraform writes a JUnit XML test result report to the given filename, describing similar information as included in the normal test output. (#34291)terraform rpcapi exposes some Terraform Core functionality through an RPC interface compatible with go-plugin. The exact RPC API exposed here is currently subject to change at any time, because it's here primarily as a vehicle to support the Terraform Stacks private preview and so will be broken if necessary to respond to feedback from private preview participants, or possibly for other reasons. Do not use this mechanism yet outside of Terraform Stacks private preview.-allow-deferral option to terraform plan, permits count and for_each arguments in module, resource, and data blocks to have unknown values and allows providers to react more flexibly to unknown values. This experiment is under active development, and so it's not yet useful to participate in this experimentFor information on prior major and minor releases, refer to their changelogs: