OpenTofu v1.13.2
security****!!
OpenTofu v1.13.2 was released with six changes, two of them security-related. One fixes excessive CPU usage when tofu init connects to an attacker-controlled HTTP2 server during dependency installation. Another filters out compromised intermediate certificates, and four fixes cover lifecycle destroy crashes, workspace autocompletion, the -chdir and -version flag combination, and symbol libraries in plan files.
What changes for platform teams
Teams running tofu init against untrusted or internal HTTP2 registries should upgrade to pick up the CPU exhaustion fix. Pipelines that apply saved plan files no longer fail when symbol libraries are present.
Changes
- Previous versions of OpenTofu could potentially experience excessive CPU usage if connecting to an attacker-controlled HTTP2 server while installing dependencies in tofu init.security
- Filter out compromised intermediate certificatessecurity
- Lifecycle destroy will no longer crash when given an expression with referencesfixed
- Tofu workspace select and tofu workspace delete autocompletion predicts from the existing workspaces. This restores the behavior pre-v1.13fixed
- Combined usage of -chdir and -version flags does not show an error anymore but instead shows the version of the tofu binaryfixed
- Symbol libraries are now saved in plan files and no-longer prevent applying of plan filesfixed
6 lines2 security4 fixedtyped from the source notes
Full release notes ↗ · all OpenTofu releases
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules