[renovate]

This PR contains the following updates:

Package	Update	Change
hashicorp/terraform	minor	1.15.8 → 1.17.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

hashicorp/terraform

v1.17.0

Compare Source

1.17.0 (October 21, 2026)

NEW FEATURES:

• Terraform now supports variables and locals in provider requirements (#​39153)

• A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. (#​35290)

• policy: Terraform Policy is now generally available. The -policies flag for plan, apply, and query no longer requires an experimental build or the -allow-experimental-features flag. Query policies evaluate resources discovered by list blocks and report human-readable or JSON results. See https://developer.hashicorp.com/terraform/policy for more information. (#​38970)

ENHANCEMENTS:

• command/init: Enrich log messages with provider versions (#​38918)

• test: Add mock_provider support for ephemeral resources (#​38928)

• command/login: display warning after successful login if user is subject to an organization's TTL policy

BUG FIXES:

• funcs: pow and log no longer panic when result is not a number (#​38912)

• ephemeral: Terraform will now use and display diagnostics raised when renewing an ephemeral resource. This may cause warnings to appear that previously were lost. We expect that any error diagnostics that were previously lost would have caused confusing downstream errors, so we do not anticipate this change to be breaking. (#​38989)

• test: Deterministic dependency ordering in cleanup graph (#​38247)

• query: report Unknown and N/A results for policy evaluations of discovered resources (#​39058)

• query: terraform query -policies now rejects a path that is not a directory, instead of passing it on to the policy engine (#​39238)

• funcs: The log and pow functions now raise errors when they return +/- Infinity, as this result is not usable in downstream code. (#​39304)

• show: Read variable values from the plan file when showing a local plan (#​39362)

NOTES:

• version: JSON output now includes a new format_version field, which will enable safer future changes of the command's JSON output format. It is assumed existing tooling ignores unknown fields and therefore this change should not be breaking in itself but we advice consumers to pay attention to format_version in future releases and/or use latest version of hashicorp/terraform-json & hashicorp/terraform-exec which does. (#​38930)

• Terraform is now built with Go 1.26.10, which no longer trusts certificates issued through a set of compromised eMudhra intermediate CAs (CVE-2026-111943) (#​39417)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.16
• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

v1.16.7

Compare Source

1.16.7 (October 22, 2026)

BUG FIXES:

• command/test: Avoid panic when testing schema w/ deprecated values (#​39406)

NOTES:

• Terraform is now built with Go 1.26.10, which no longer trusts certificates issued through a set of compromised eMudhra intermediate CAs (CVE-2026-111943) (#​39417)

v1.16.6

Compare Source

1.16.6 (October 14, 2026)

BUG FIXES:

• cloud: terraform init can now find workspaces selected by key/value tags whose keys contain uppercase letters. (#​39306)

• test: Allow module under test to use deprecated outputs. (#​39207)

NOTES:

• Prevent a HTTP/2 resource exhaustion via CVE-2026-78669. Exploitation would require a compromised (untrusted) provider/module registry. Such a threat is considered to be outside the perimeter of Terraform core security guarantees. (#​39375)

v1.16.5

Compare Source

1.16.5 (September 30, 2026)

BUG FIXES:

• Fixed a crash that happens when a tainted instance state is seen without a valid status (#​39287)

• resource-identity: fixed an issue where resource identity could be nil during delete (#​39285)

v1.16.4

Compare Source

1.16.4 (September 23, 2026)

BUG FIXES:

• Fixed an issue where Terraform fails when rendering policy evaluation outcomes for older versions of Terraform Enterprise (#​39095)

• stacks: Fix invalid deferred error triggered by provider returning a deferral when a resource also has an unknown count/for_each. (#​39237)

v1.16.3

Compare Source

1.16.3 (September 16, 2026)

BUG FIXES:

• Fix handling of destroy=false around create_before_destroy instances (#​39169)

• Fix function result comparison when there are multiple marks (#​39170)

• Filter logic for marks could cause values with multiple marks to erroneously fail validations (#​39171)

• Fix issue with import provider resolution (#​39185)

v1.16.2

Compare Source

1.16.2 (September 9, 2026)

BUG FIXES:

• Fix panic in module installation when encoutering invalid module calls (#​39129)

v1.16.1

Compare Source

1.16.1 (September 2, 2026)

BUG FIXES:

• cloud: Fixed a bug causing the CLI to pause indefinitely after a run task failure with pending policy evaluations (#​38751)

• Support referencing modules containing dynamic sources in Terraform Test (#​38950)

• stacks: Fixed validation to ensure the provider versions in the lock file and configuration are compatible. (#​38829)

• Fix panic when import identity references sensitive value (#​39013)

• import: Fixed a bug where import blocks would be ignored when multiple imports targeted different instances of a resource config using for_each or count. (#​39068)

• state show: Fix a panic when given an attribute path instead of a resource instance address (#​39087)

• Fix create_before_destroy ordering in some combinations of changes (#​39091)

v1.16.0

Compare Source

1.16.0 (August 26, 2026)

NEW FEATURES:

• Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. (#​37986)

• terraform_data: The new store block can hold ephemeral and sensitive values across plan and apply. (#​38298)

• Providers can now use nested blocks as computed values (#​38305)

• import: import blocks inside modules are now supported. (#​38352)

• Terraform is now available as a pre-built binary for Linux s390x (zLinux). (#​38384)

• Resource action triggers can now use on_failure modes of halt, taint, or continue. (#​38722)

ENHANCEMENTS:

• state show: The state show command can now produce machine-readable output when supplied with the -json flag (#​23940)

• workspace: The workspace list command can now produce machine-readable output when supplied with the -json flag (#​38397)

• test: Terraform now reports which resources were left behind when skip_cleanup is set. (#​38449)

• stacks: Action configurations now have access to a caller symbol containing the object value of the calling resource. (#​38668)

• Actions can now use before_destroy and after_destroy events. (#​38668)

• cloud: Terraform now displays a summary of policy evaluation outcomes for plan and apply runs against HCP Terraform. (#​38715)

• policy: Terraform now resolves policy plugin credentials from the configured cloud or remote backend during init, plan, and apply, rather than requiring the plugin to read credentials itself. (#​38716)

• graph: The terraform graph command can now output graphs in Mermaid format using the -format=mermaid flag. (#​38719)

• Child module outputs with unreferenced deprecated nested attributes no longer return deprecation warnings. (#​38778)

• Resource lifecycle blocks now support destroy = false to prevent a resource from being destroyed. (#​38784)

• The contains() function can now test for null values. (#​38792)

• console: The terraform console command now accepts an optional -scope=<module address> flag, which can be used to evaluate expressions within the scope of a module or a specific module instance. (#​31861)

• -invoke can now be combined with -target to specify the calling resource instance when multiple resources trigger the same action. (#​38845)

• The terraform stacks command now automatically infers the target hostname from the local credentials file (credentials.tfrc.json) when neither TF_STACKS_HOSTNAME nor TF_CLOUD_HOSTNAME is set (#​38896)

BUG FIXES:

• import blocks now correctly respect provider local names. (#​38338)

• terraform apply no longer panics when the plan contains a no-op change for a deposed resource that has lifecycle.precondition or lifecycle.postcondition blocks. (#​38586)

• workspace: Terraform now raises an error if an invalid workspace name becomes selected due to out-of-band changes. (#​38594)

• test: Terraform now raises a warning when a file referenced via the -filter flag does not exist. (#​38603)

• init: Terraform no longer removes locks from the dependency lock file for providers configured as dev_override. (#​38634)

• init: Terraform now warns when unmanaged providers are in use and may impact provider installation. (#​38656)

• Actions are now invoked with respect to all resource dependencies. (#​38668)

• Terraform now returns the correct error when an import target exists in state but has no corresponding configuration. (#​38782)

• The merge() function no longer panics when passed null objects. (#​38792)

• Allow underscores in provider source address namespaces, so private registry provider addresses are no longer rejected as invalid (#​38894)

• test: Optional ephemeral values do not have to be set at plan time (#​38974)

NOTES:

• init: Errors due to incompatible -upgrade and -lockfile=readonly flags are now raised earlier in the init process. (#​38561)

UPGRADE NOTES:

• bastion_host_key is now correctly applied by provisioners. Review your provisioner configurations to verify the configured key is correct before upgrading. (#​38318)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

v1.15.9

Compare Source

1.15.9 (August 19, 2026)

BUG FIXES:

• validate: Child module validation has been fixed and will now raise errors or warning diagnostics for invalid blocks. (list, import, backend, and cloud) (#​38994)

NOTES:

• Update go-slug to v0.18.3 to mitigate CVE-2026-14978, which is a Unicode normalization issue that could lead to files not being correctly excluded via .terraformignore from upload to a Terraform Enterprise or HCP Terraform during a run (#​39036)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

Branch automerge failure

This PR was configured for branch automerge. However, this is not possible, so it has been raised as a PR instead.

---

• Branch has one or more failed status checks