LoginSign Up
← Back to all sparks
O

OpenTofu

DEVOPS
Velocity6.3

Open-source infrastructure-as-code tool and Terraform-compatible fork

opentofu.org ↗

OpenTofu's v1.13 beta puts user-defined functions and types into the language for the first time.

infrastructure-as-codelanguage-designsecurity-advisoriesbreaking-changeslintingoci-registries
◆Current state
The v1.11 series has just been closed out with a final patch, and the feed's recent history is almost entirely security work: an OCI credential leak on redirect, an init denial-of-service via crafted registry URLs, an ECH pre-shared-key leak, an arbitrary file read. Against that, v1.13.0-beta1 opens a new series with two experiments — Symbol Libraries and a -lint flag — alongside a substantial list of breaking changes.
◆Where it's heading
Symbol Libraries are the first release here that changes what a configuration author can express rather than what the tool does with the configuration. The beta also spends a real compatibility budget to get there: WinRM provisioner connections removed, base64gzip output changed, macOS 13 required, 32-bit builds ending. Everything else in the window — the KMS provider arguments, the OCI credential scoping, the plan-file schema embedding — is the maintenance and supply-chain hardening a fork has to do to be trusted as a drop-in.
◆Prediction
Both new capabilities ship as experiments explicitly seeking feedback before stabilising, so the v1.13 series is likely to iterate on Symbol Library syntax and linting rules ahead of a stable release rather than adding another language feature.

◆Recent moves

  1. 7d ago

    v1.13.0-beta1: Symbol Libraries and an experimental linter

    ⚡ SPARK

    The v1.13 beta introduces Symbol Libraries — reusable functions and types defined in hcl-lang libraries — plus an experimental linter, and pays for the series with removals: WinRM provisioners, 32-bit builds, macOS 12, and a changed base64gzip output. After a year of patch releases dominated by security advisories, this is the first entry that moves the language itself.

    View source ↗
  2. 15d ago

    v1.11.14: OCI credential leak, init DoS fix; last v1.11 patch

    The final v1.11 patch fixes credentials being resent across HTTP redirects to OCI registries and a denial-of-service in init via crafted relative URLs, then closes the series. Both bugs sit in the supply-chain path that the OCI registry work opened up.

    View source ↗
  3. 1mo ago

    v1.11.13: security advisories, ECH leak fix

    An Encrypted Client Hello leak inherited from the Go standard library is fixed, alongside a provider-state upgrade bug on implicit moves. Routine for the patch cadence that has defined the v1.11 series.

    View source ↗
  4. 1mo ago

    v1.11.12: moved-block and provider-address bug fixes

    Two fixes to how provider source addresses are compared and passed during moved-block handling. Internal correctness with no visible change to a working configuration.

    View source ↗
  5. 2mo ago

    v1.11.11: completes an OTEL dependency upgrade

    Completes an OpenTelemetry dependency upgrade left half-finished by the previous patch. Housekeeping inside the tracing stack that later releases build on.

    View source ↗
  6. 2mo ago

    v1.11.10: arbitrary-file-read security fix

    An arbitrary file read via a maliciously crafted git URL is fixed, plus a documentation clarification on ephemeral values in lifecycle.enabled. Another entry in the run of module-source vulnerabilities that dominates the v1.11 patches.

    View source ↗