[open-constructs-cdktn]

🤖 Release PR — merge to cut a new release. Kept open and rebased as commits land on main.

0.25.0

0.25.0 (2026-10-13)

⚠ BREAKING CHANGES

• lib: IAssetPackaging gains acceptsDirectorySource as a required member. Custom implementations of the interface must add it.
• lib: ValidateBinaryVersion and ValidateTerraformVersion are removed (they were only reachable through deep imports, not the cdktn package root). Synth no longer executes the terraform/tofu binary for feature validation; set validateInstalledBinary: true in cdktf.json to verify the installed binary before commands that run it.
• lib: resource moves (moved blocks) are now validated at synth against the project's declared targetVersions (default terraform >=1.5.7, opentofu >=1.6.0) instead of the locally installed binary. Projects that declare terraform targets below 1.5.0 now fail synth; projects whose installed binary is older than their declared targets should set validateInstalledBinary: true in cdktf.json.
• lib: import blocks (importFrom / ImportableResource) are now validated at synth against the project's declared targetVersions (default terraform >=1.5.7, opentofu >=1.6.0) instead of the locally installed binary. Projects that declare terraform targets below 1.5.0 now fail synth; projects whose installed binary is older than their declared targets should set validateInstalledBinary: true in cdktf.json.
• lib: terraform_data resources are now validated at synth against the project's declared targetVersions (default terraform >=1.5.7, opentofu >=1.6.0) instead of the locally installed binary. Projects that declare terraform targets below 1.4.0 now fail synth; projects whose installed binary is older than their declared targets should set
• lib: cloud backends (the cloud block) are now validated at synth against the project's declared targetVersions (default terraform >=1.5.7, opentofu >=1.6.0) instead of the locally installed binary. Projects that declare terraform targets below 1.1.0 now fail synth; projects whose installed binary is older than their declared targets should set validateInstalledBinary: true in cdktf.json.
• lib: IAssetPackaging gains a required member omitsDirectoryEntries; external implementations must add it. Custom TerraformAsset assetHash values are now validated against /^[A-Za-z0-9_.-]+$/ and throw if they contain other characters (e.g. "feature/my-branch").
• lib: add asset pipeline foundation types and hash utilities (#371)

Features

• cli: add a typescript-pnpm init template and deprecate Yarn (#422) (81da164)
• cli: move the TypeScript template to tsx and TypeScript 6 (#396) (b50349d)
• cli: replace HashiCorp checkpoint telemetry with Sentry usage metrics and consent (#411) (e17046a)
• cli: report aggregated stack, provider and command usage metrics (#413) (ed9b1e5)
• cli: report the installed binary, target versions, platform and package manager in usage metrics (#412) (bfe26a8)
• cli: resolve providers from the registry the project targets (#445) (78898ae)
• deps: adopt jsii 6.0 and TypeScript 6 (#395) (26fa8fa)
• gha: Revert "run the affected unit tests against OpenTofu (#439)" (#446) (ae015ef)
• gha: run the affected unit tests against OpenTofu (#439) (823682d)
• gha: run the affected unit tests against OpenTofu (#447) (c0c4c1c)
• lib: add asset bundling extension interface (#442) (7839625)
• lib: add asset pipeline foundation types and hash utilities (#371) (a008d12)
• lib: add asset staging core with no bundling (#433) (44d8bd1)
• lib: add support for single-file bundler outputs (#464) (3592db0)
• lib: pass ignore strategy through terraform asset (#472) (705e5b9)
• tests: add per-test runtime pinning to the integration matrix (#405) (17c2278)

Bug Fixes

• cli: correct the constructs range comment in the TypeScript template hook (#408) (9fc0e43)
• cli: make cdktn get remove stale files for resources removed from a provider (#421) (d6e28dc)
• cli: probe with version instead of -v (#471) (b87ee22)
• cli: resolve bundled handlers next to the entrypoint (#414) (49600c1)
• cli: stop the top-level error handler racing yargs (#410) (5d0c2ef)
• deps: move jsii-rosetta to 6.0.16 for stream-json 3 (#463) (f1ec16f)
• gha: don't fail the pnpm upgrade jobs on ignored dep builds (#399) (5b66342)
• gha: pass -R to gh pr edit in release_github relabel step (#372) (358edc7)
• gha: push only the prerelease tag from prepare-next (#476) (848f2a6)
• lib: avoid terraform init plugin-cache race in test matchers (#467) (26847f9)
• lib: retry the staging install without --prefer-offline outside CI (#407) (7bb26e7)
• provider-generator: pass the default provider configuration a module requires on get (#466) (a5225ab)
• provider-generator: pick the docs registry from targetVersions (#443) (00f2884)
• provider-generator: satisfy module provider configuration aliases on get (#383) (54a8217)
• provider-generator: stop a provider_functions resource clobbering the functions submodule (#403) (cf19de9)
• tests: await the pip install in the python provider command tests (#478) (1c83a36)
• tests: bound and retry the dist publish to the local registry (#425) (cc9f9e2)
• tests: build the edge provider bindings in their own cached Nx target (#482) (f480cc9)
• tests: drop unused ts-jest transform from shared jest preset (#382) (03f6e16)
• tests: mark the terraform-cloud target Terraform-only in the matrix (#430) (b0deefa)
• tests: run example builds with the Nx cache skipped (#477) (3e25e13)
• tools: declare the cdktn-cli bundle as a cached Nx output with its real inputs (#485) (10dd118)
• tools: make the workspace build, package, lint and test on Windows (#364) (8dcddbe)

Code Refactoring

• lib: Remove the ValidateBinaryVersion synth-time binary probe (#457) (e60142e)
• lib: Use declared targetVersions for synth-time validation of import blocks (#454) (c0097f4)
• lib: Use declared targetVersions for synth-time validation of resource moves (#453) (43edc1e)
• lib: Use declared targetVersions for synth-time validation of terraform_data (#455) (a1c125b)
• lib: Use declared targetVersions for synth-time validation of the cloud backend (#456) (4a83507)

Miscellaneous Chores

• add OpenTofu and current Terraform to the jsii-terraform image (#394) (2f29d5a)
• declare complete Nx build outputs so cache hits restore them (#474) (794cf77)
• deps: move the remaining packages to TypeScript 6 (#406) (c55d360)
• deps: move the root TypeScript to 6 (#417) (3cae1e2)
• deps: Update xstate to v5.32.4 (#333) (5ebf74f)
• deps: upgrade @sentry/node to 10.x (#409) (2714fff)
• deps: use caret ranges for unbundled runtime dependencies (#503) (e722357)
• docs: add the test-audit skill for authoring and auditing tests (#475) (909c612)
• examples: move the TypeScript examples to tsx and TypeScript 6 (#419) (857e182)
• Flexible python version (#420) (955f62a)
• gha: adopt the new jsii-terraform image and test Terraform 1.5.7 + 1.16.1 (#398) (3ad760b)
• gha: gate dependency upgrades on release age (#418) (b611a87)
• gha: retire Docker Hub publishing of jsii-terraform (#388) (e53cddf)
• gha: select the CLI by binary name instead of concatenating a version (#438) (914da56)
• gha: skip the remote Nx cache in the release workflow (#487) (bce91da)
• lib: stop publishing build state in the cdktn package (#397) (51e4a95)
• npm-check-updates && pnpm update (#326) (7095f6b)
• readme: point to the cdktn-io/action GitHub Action (#504) (e387852), closes #58
• tests: add timeout handling to spawned commands (#432) (ddb4a8a)
• tests: run the function-binding scripts with tsx (#431) (fec67bf)

Tests

• lib: ensure TerraformAsset stage within stack own directory (#434) (9a80366)
• lib: move matcher Docker fixture to a provider version OpenTofu accepts (#429) (7b0da12)
• tests: move the python providers fixture to Docker provider 3.9.0 (#440) (a678473)
• tests: move the remaining kreuzwerker/docker pins off unsigned versions (#459) (d855cc1)
• tests: move the testing-matchers fixtures to Docker provider 3.x (#436) (8e2c60e)
• tests: re-enable the Python edge integration test (#404) (0a80626)

---

This PR was generated with Release Please. See documentation.