LoginSign Up
← Back to all sparks
O

OpenTofu

DEVOPS
Velocity5.0

Open-source infrastructure-as-code tool and Terraform-compatible fork

opentofu.org ↗

OpenTofu keeps the 1.12 line patched while 1.13's Symbol Libraries wait in beta

infrastructure-as-codelanguage-designsecurity-patchesstate-encryptionlinting
◆Current state
OpenTofu's recent feed is patch work on the 1.12 line: v1.12.11 stopped a panic on invalid state-encryption config and v1.12.12 fixes local state not being saved when the first apply crashes. The last directional entry is still v1.13.0-beta1 from August, which added Symbol Libraries for user-defined functions and types and an experimental -lint flag.
◆Where it's heading
Language design moves in the 1.13 series while older minors receive narrowly scoped security and stability fixes, often released on the same day across lines. Recent patches skew toward hardening inputs: registries, git URLs and now state-encryption config.
◆Prediction
More same-day patch releases across the supported lines are likely; the feed does not show how far Symbol Libraries have moved past experimental status.

◆Recent moves

  1. 8d ago

    v1.12.12: local state now persists if the first apply crashes

    A single fix: the local backend now saves state even when the first apply crashes. It continues the 1.12 patch rhythm while 1.13 sits in beta.

    View source ↗
  2. 15d ago

    v1.12.11: no more panic on bad state-encryption config

    A single fix: invalid state-encryption configuration now errors instead of panicking. Routine hardening on the 1.12 line.

    View source ↗
  3. 2mo ago

    v1.13.0-beta1: Symbol Libraries and an experimental linter

    ⚡ SPARK

    The v1.13 beta introduces Symbol Libraries — reusable functions and types defined in hcl-lang libraries — plus an experimental linter, and pays for the series with removals: WinRM provisioners, 32-bit builds, macOS 12, and a changed base64gzip output. After a year of patch releases dominated by security advisories, this is the first entry that moves the language itself.

    View source ↗
  4. 2mo ago

    v1.11.14: OCI credential leak, init DoS fix; last v1.11 patch

    The final v1.11 patch fixes credentials being resent across HTTP redirects to OCI registries and a denial-of-service in init via crafted relative URLs, then closes the series. Both bugs sit in the supply-chain path that the OCI registry work opened up.

    View source ↗
  5. 3mo ago

    v1.11.13: security advisories, ECH leak fix

    An Encrypted Client Hello leak inherited from the Go standard library is fixed, alongside a provider-state upgrade bug on implicit moves. Routine for the patch cadence that has defined the v1.11 series.

    View source ↗
  6. 4mo ago

    v1.11.12: moved-block and provider-address bug fixes

    Two fixes to how provider source addresses are compared and passed during moved-block handling. Internal correctness with no visible change to a working configuration.

    View source ↗