OpenTofu v1.11.9

Changes

• !Previous releases in the v1.11 series could be affected by several vulnerabilities:security
• !Ssh usage through OpenTofu generate hangs or panics.security
• !Previously, a revoked 'SignatureKey' belonging to a CA was not correctly checked for revocation. Now, both the 'key' and 'key.SignatureKey' are checked for @revoked.security
• !If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted.security
• !Previous releases in the v1.11 series could be affected by several vulnerabilities:security
• !When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.security
• !If using an attacker-controlled server to run tofu against, it might end up in high CPU consumption.security
• *Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)fixed
• *Prevent panic when using ephemeral resources during tofu test.fixed