Skip to content

Release history

opentofu releases

OpenTofu lets you declaratively manage your cloud infrastructure.

Back to tool Latest release

All releases

19 shown

Upgrade now
v1.12.5 Security relevant
Crypto / TLS

ECH identity leakage fix

Open
Upgrade now
v1.11.13 Security relevant
Crypto / TLS

ECH identity leak fix

Open
No immediate action
v1.12.4 Bug fix

Plan output fix

Open
No immediate action
v1.11.12 Bug fix

Provider address fixes

Open
Upgrade now
v1.11.11 Bug fix
Dependencies

OTEL dependency fix

Open
Upgrade now
v1.12.3 Security relevant
RCE / SSRF

File‑read security fix + bugfixes

Open
Upgrade now
v1.11.10 Security relevant
RCE / SSRF Breaking upgrade

Arbitrary file disclosure fix

Open
Upgrade now
v1.11.9 Security relevant
Auth RCE / SSRF

SSH security fixes

Open
Upgrade now
v1.12.2 Security relevant
Auth RCE / SSRF

Security fixes

Open
Upgrade now
v1.12.1 Security relevant
Auth

SSH hang fix + revocation check

Open
No immediate action
v1.12.0 Breaking risk

Dynamic prevent_destroy

Open
Upgrade now
v1.11.8 Security relevant
Dependencies

HTTP2 frame size fix

Open
v1.11.7 Bug fix

Installer returns an error when a cached provider package has a mismatched checksum instead of silently overwriting.

Full changelog

BUG FIXES:

  • When installing provider packages into a local cache directory, the installer will now return an error if a conflicting entry is already present in the cache that doesn't match the expected checksum. Previously OpenTofu would just silently write over the existing entry in that case. (#4082)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.11.6...v1.11.7

View release on GitHub
v1.10.10 Bug fix

Fixed import‑block provider functions bug and made installer error on cache checksum mismatches.

Full changelog

BUG FIXES:

  • When installing provider packages into a local cache directory, the installer will now return an error if a conflicting entry is already present in the cache that doesn't match the expected checksum. Previously OpenTofu would just silently write over the existing entry in that case. (#4082)
  • Fixed provider-defined functions in import block id expressions causing "BUG: Uninitialized function provider" error. (#3803)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.10.9...v1.10.10

View release on GitHub
v1.11.6 Security relevant
Security fixes
  • TLS deadlock from multiple key update messages in single record
  • Sparse file entry limit in tar archives to prevent malicious memory exhaustion
View release on GitHub
v1.10.9 Security relevant
Security fixes
  • GO-2026-4341: net/url ParseQuery DoS with unlimited query arguments
  • GO-2026-4340: crypto/tls deadlock with multiple encryption level messages
View release on GitHub
v1.11.4 Breaking risk
Breaking changes
  • Modules with local provider configurations now reject enabled argument
Security fixes
  • Fix for DoS vulnerability in .zip archive processing during init
View release on GitHub
v1.11.3 Bug fix

Fixed state lock not being released when tofu apply is interrupted with Ctrl+C.

View release on GitHub

Beta — feedback welcome: [email protected]