Packer

v1.16.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 2d Infrastructure as Code

✓ No known CVEs patched

This release patches 2 known CVEs

Affected surfaces

deps rce_ssrf

Summary

AI summary

Broad release touches BUG FIXES, deps, 1.16.0, and https://github.com/hashicorp/packer/pull/13673.

Full changelog

provenance: add new provenance post-processor and packer verify-attestation command for
SLSA Build L1/L2 supply-chain attestations. Derives in-toto subjects from Packer artifacts,
builds SLSA Provenance v1 predicates with Git/CI metadata, and signs via local PEM key, cloud
KMS (awskms://, gcpkms://, azurekms://, hashivault://), or keyless Sigstore (Fulcio +
optional Rekor transparency log). Reference CI workflows for L2 keyless and L3-compatible
delegated-signing patterns are included under examples/ci/.
GH-13667
core/hcl2: add rfc3339_parse and unix_timestamp_parse template functions. Both accept
RFC 3339 timestamps; unix_timestamp_parse additionally accepts Unix epoch integers.
GH-13669
core/hcl2: add continue_on_error meta-argument to provisioner blocks. When set to true,
a provisioner failure is logged and the build continues rather than halting.
GH-13674
core/hcl2: variable object types now support optional() attribute modifiers, allowing
object variables to declare per-attribute defaults and omit fields that have a default set.
GH-13670

plugin/getter: prevent path traversal vulnerability in GitHub plugin getter filename handling.
GH-13680
build: update build constraints to support arm architecture on FreeBSD.
GH-13650

GHSA: Path traversal vulnerability in GitHub plugin getter filename handling fixed (GH-13680).
Dropped vulnerable `x/crypto/openpgp` by upgrading `go-github` from v33 to v75 (GH-13676).

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track Packer

Get notified when new releases ship.

About Packer

Packer is a tool for creating identical machine images for multiple platforms from a single source configuration.