LoginSign Up
← Back to all sparks
O

OpenTofu

DEVOPS
Velocity5.0

Open-source infrastructure-as-code tool and Terraform-compatible fork

opentofu.org ↗

OpenTofu keeps the v1.11 line patched while v1.12 cooks in beta.

infrastructure-as-codeterraform-alternativesecurity-fixesrelease-maintenancedevops
◆Current state
OpenTofu is in steady maintenance on the stable v1.11 series, mostly bug fixes plus a run of security advisories, including an Encrypted Client Hello information leak inherited from the Go stdlib and an arbitrary-file-read fix. The next minor, v1.12, is in beta, led by deprecating the WinRM connection type for the remote-exec and file provisioners.
◆Where it's heading
Development is bifurcated: hardening and back-porting security fixes to v1.11 while v1.12 accumulates deprecations and upgrade notes. None of this changes the tool's surface; it is disciplined release hygiene for an infrastructure-as-code core.
◆Prediction
v1.12.0 should reach a stable release next, carrying the WinRM deprecation and whatever features accumulated across the beta and rc line.

◆Recent moves

  1. 29d ago

    v1.11.13: security advisories, ECH leak fix

    A security-focused patch addressing vulnerabilities in the v1.11 series, including an Encrypted Client Hello information leak from the Go stdlib. Part of the ongoing hardening of the stable line.

    View source ↗
  2. 1mo ago

    v1.11.12: moved-block and provider-address bug fixes

    Bug fixes for moved-block provider source comparison and MoveResource provider addresses. Routine maintenance on the stable branch.

    View source ↗
  3. 1mo ago

    v1.11.11: completes an OTEL dependency upgrade

    Fixes an incomplete OTEL dependency upgrade left by the prior patch. Internal cleanup with no user-facing change.

    View source ↗
  4. 2mo ago

    v1.11.10: arbitrary-file-read security fix

    Patches an arbitrary-file-read security advisory in the v1.11 series and clarifies ephemeral-value usage docs. Continues the security back-porting effort.

    View source ↗
  5. 3mo ago

    v1.12.0-beta1: deprecates WinRM provisioner connections

    The first v1.12 beta deprecates the WinRM connection type for remote-exec and file provisioners, citing an unhealthy WinRM library ecosystem. Signals where the next minor is heading.

    View source ↗
  6. 3mo ago

    v1.10.10: provider-cache checksum guard

    Back-port fix so the installer errors on a conflicting cached provider package instead of using a mismatched checksum. Maintenance on the older stable line.

    View source ↗