LoginSign Up
← Back to all sparks
O

OpenTofu

DEVOPS
Velocity5.0

Open-source infrastructure-as-code tool and Terraform-compatible fork

opentofu.org ↗

OpenTofu holds the 1.11 line steady while 1.12 lines up a WinRM-to-OpenSSH shift.

infrastructure-as-codeterraform-alternativesecurity-patchdeprecationwindowsmaintenance
◆Current state
OpenTofu is in mature maintenance mode: the 1.11 line receives narrow bug fixes (moved-block provider addresses, an OTEL dependency upgrade) plus a security patch for an arbitrary-file-read advisory. In parallel, 1.12 pre-releases are staged, headlined by deprecating the WinRM connection type in favor of OpenSSH on Windows.
◆Where it's heading
The project is modernizing its Windows remote-execution story — WinRM is deprecated in 1.12 and expected to error by 1.13 — while keeping older lines patched for security. This is the cadence of an infrastructure tool prioritizing stability and supply-chain integrity over new surface area.
◆Prediction
1.12.0 should reach stable with the WinRM deprecation intact; expect the 1.11 line to keep receiving security and correctness backports until then.

◆Recent moves

  1. 7d ago

    OpenTofu 1.11.12: moved-block provider-address fix

    Corrects how `moved` blocks compare provider source addresses so cross-provider refactors resolve correctly — a narrow correctness fix in the stable 1.11 line.

    View source ↗
  2. 27d ago

    OpenTofu 1.11.11: completes OTEL dependency upgrade

    Finishes an OTEL dependency upgrade left incomplete by the prior patch; internal, with no user-facing change.

    View source ↗
  3. 1mo ago

    OpenTofu 1.11.10: patches arbitrary-file-read advisory

    Ships the fix behind advisory GHSA-q7j3-v8qv-22vq, where a crafted git URL could read an arbitrary file during certain git operations — the most consequential item in the recent 1.11 patches and consistent with the project's security-first maintenance.

    View source ↗
  4. 2mo ago

    OpenTofu 1.12.0-beta1: deprecates WinRM, moves to OpenSSH

    First 1.12 beta flags the WinRM remote-exec/file connection type as deprecated as the ecosystem's WinRM libraries decay, steering Windows users toward OpenSSH. Directionally meaningful but still a beta warning, not yet a breaking change.

    View source ↗
  5. 2mo ago

    OpenTofu 1.10.10: provider-cache checksum integrity fix

    Stops the installer from silently overwriting a cached provider that fails its checksum, and fixes provider-defined functions in import IDs — supply-chain-integrity fixes backported to the 1.10 line.

    View source ↗
  6. 2mo ago

    OpenTofu 1.12.0-rc1: WinRM deprecation heads toward release

    An earlier 1.12 release candidate carrying the same WinRM-to-OpenSSH deprecation notes as the beta; together they signal 1.12 is closing in on stable.

    View source ↗