Nightly releases are snapshots of the development activity on the Packer project that may include new features and bug fixes scheduled for upcoming releases. These releases are made available to make it easier for users to test their existing build configurations against the latest Packer code base for potential issues or to experiment with new features, with a chance to provide feedback on ways to improve the changes before being released.

As these releases are snapshots of the latest code, you may encounter an issue compared to the latest stable release. Users are encouraged to run nightly releases in a non production environment. If you encounter an issue, please check our issue tracker to see if the issue has already been reported; if a report hasn't been made, please report it so we can review the issue and make any needed fixes.

Note: Nightly releases are only available via GitHub Releases, and artifacts are not codesigned or notarized. Distribution via other Release Channels such as the Releases Site or Homebrew is not yet supported.

1.16.2 (October 22, 2026)

BUG FIXES:

• core: fix case-insensitive parsing of generated enum values for configuration
  types and PowerShell execution policies.
  GH-13719

IMPROVEMENTS:

• build: update Go to 1.26.10.
  GH-13728

DEPENDENCIES:

• deps: bump github.com/hashicorp/hcp-sdk-go to v0.176.0.
  GH-13722
• deps: bump github.com/hashicorp/packer-plugin-sdk in the plugin tester to
  v0.6.13, github.com/hashicorp/hcl/v2 to v2.25.0, and
  github.com/zclconf/go-cty to v1.19.0; update other dependencies.
  GH-13728
• test/deps: bump go.opentelemetry.io/otel/sdk in the plugin tester to
  v1.45.0.
  GH-13709

INTERNAL:

• ci: update pinned GitHub Actions dependencies.
  GH-13720
• ci: bump lock-threads to v6.0.2 so the scheduled workflow can lock issues
  and pull requests.
  GH-13693
• compliance: update copyright headers.
  GH-13718

1.16.1 (September 18, 2026)

FEATURES:

• plugin/getter: add support for installing plugins from non-GitHub HTTPS sources,
  including mirrors and artifact repositories that expose the HashiCorp release
  directory format.
  GH-13691

IMPROVEMENTS:

• communicator/winrm: add configurable connection timeout and retry interval settings.
  GH-13701
• build: update Go to 1.26.8.
  GH-13701

BUG FIXES:

• core/hcl2: pass user variable values to builders, provisioners, and post-processors
  as packer_user_variables, restoring legacy {{ user "name" }} interpolation in
  plugin-managed templates.
  GH-13686
• post-processor/shell-local: execute inline scripts through the shell to avoid
  intermittent ETXTBSY errors.
  GH-13701
• build: bump github.com/shoenig/go-m1cpu to v0.2.2 to prevent segmentation
  faults on Apple M5 hardware.
  GH-13696

SECURITY:

• deps: bump google.golang.org/grpc to v1.83.2 in Packer and the plugin
  tester to reject requests missing both the :authority and Host headers.
  GH-13704
  GH-13707

DEPENDENCIES:

• deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.11.
  GH-13701
• deps: bump github.com/hashicorp/go-getter/v2 to v2.2.4.
  GH-13701
• deps: bump github.com/hashicorp/hcp-sdk-go to v0.175.0,
  github.com/go-git/go-git/v5 to v5.19.2, and
  github.com/klauspost/compress to v1.18.7.
  GH-13689
• deps: bump golang.org/x/crypto to v0.56.0, golang.org/x/net to
  v0.58.0, and google.golang.org/grpc to v1.83.2.
  GH-13701
  GH-13707
• deps: bump go.opentelemetry.io/otel, go.opentelemetry.io/otel/metric,
  and go.opentelemetry.io/otel/trace to v1.45.0, and
  github.com/go-logr/logr to v1.4.4.
  GH-13710
• deps: update additional Go module dependencies in Packer and the plugin tester.
  GH-13689
  GH-13701

INTERNAL:

• docs: update the README contribution link to use the main branch.
  GH-13700
• compliance: update copyright headers.
  GH-13699

1.16.0 (July 24, 2026)

FEATURES:

• provenance: add new provenance post-processor and packer verify-attestation command for
  SLSA Build L1/L2 supply-chain attestations. Derives in-toto subjects from Packer artifacts,
  builds SLSA Provenance v1 predicates with Git/CI metadata, and signs via local PEM key, cloud
  KMS (awskms://, gcpkms://, azurekms://, hashivault://), or keyless Sigstore (Fulcio +
  optional Rekor transparency log). Reference CI workflows for L2 keyless and L3-compatible
  delegated-signing patterns are included under examples/ci/.
  GH-13667
• core/hcl2: add rfc3339_parse and unix_timestamp_parse template functions. Both accept
  RFC 3339 timestamps; unix_timestamp_parse additionally accepts Unix epoch integers.
  GH-13669
• core/hcl2: add continue_on_error meta-argument to provisioner blocks. When set to true,
  a provisioner failure is logged and the build continues rather than halting.
  GH-13674
• core/hcl2: variable object types now support optional() attribute modifiers, allowing
  object variables to declare per-attribute defaults and omit fields that have a default set.
  GH-13670

BUG FIXES:

• plugin/getter: prevent path traversal vulnerability in GitHub plugin getter filename handling.
  GH-13680
• build: update build constraints to support arm architecture on FreeBSD.
  GH-13650

SECURITY:

• security: drop x/crypto/openpgp by upgrading go-github v33 → v75.
  GH-13676
• security: suppress false positive for GO-2026-5932.
  GH-13677
• deps: bump golang.org/x/crypto to v0.54.0.
  GH-13672

DEPENDENCIES:

• deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.10.
  GH-13673
• deps: bump github.com/hashicorp/hcp-sdk-go to v0.174.0.
  GH-13673
• deps: bump github.com/zclconf/go-cty to v1.18.1.
  GH-13673
• deps: bump github.com/google/go-github v33 → v75.
  GH-13676
• deps: bump golang.org/x/net to v0.56.0.
  GH-13664
• deps: update various Go module dependencies.
  GH-13673

INTERNAL:

• ci: pin GitHub Action refs to latest verified SHAs.
  GH-13675
• chore: remove old website references.
  GH-13668

1.15.4 (June 3, 2026)

BUG FIXES:

• builder: update build constraints to support arm architecture on FreeBSD
  GH-13650

IMPROVEMENTS:

• hcp: removes Syft binary download/handling from the HCP SBOM provisioner
  GH-13636

SECURITY:

• deps: upgraded crypto version
  GH-13645
• deps: upgraded go-git version
  GH-13645
• deps: bump github.com/hashicorp/packer-plugin-sdk to 0.6.9
  GH-13640

INTERNAL:

• build: bump Go to 1.25.10 and refresh dependencies
  GH-13646
  GH-13647
• deps: update cloud.google.com/go and aws-sdk-go-v2 related dependencies
  GH-13610

1.15.3 (April 27, 2026)

BUG FIXES:

• hcp: skip bucket update requests when description and labels already match, avoiding unnecessary updates for existing buckets.
  GH-13624

1.15.2 (April 21, 2026)

FEATURES:

• provisioner: added support for the enforced provisioner.
  GH-13591

SECURITY:

• deps: bump github.com/go-jose/go-jose/v4
  GH-13594
• deps: bump go.opentelemetry.io/otel/sdk
  GH-13606
• deps: update cloud.google.com/go and aws-sdk-go-v2 related dependencies
  GH-13610

INTERNAL:

• build: bump Go to 1.25.9 and refresh dependencies
  GH-13614
  GH-13615

1.15.1 (March 26, 2026)

FEATURES:

• hcp: native sbom generation for hcp. Refer to the guide here for more information.
  GH-13566

BUG FIXES:

• core: Scrub multiline sensitive values from build output (including OS-specific multiline sensitive-value fixtures)
  GH-13582

SECURITY:

• deps: bump syft to v1.42.3 (fixes GO-2026-4809)
  GH-13581
• deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.7
  GH-13581
• deps: bump github.com/hashicorp/hcp-sdk-go from 0.136.0 to 0.167.0
  GH-13560
• deps: Updates OpenTelemetry dependencies to v1.41.0
  GH-13572
• deps: Upgrade go-git to v5.17.0 and grpc to 1.79.3
  GH-13570
• deps: Updates circl dependency to v1.6.3
  GH-13564

INTERNAL:

• ci: Adds grouped and scheduled updates for GitHub Actions (monthly, grouped PRs, ignore major bumps)
  GH-13575
• docs: remove docs validation from packer (docs changes move to web-unified-docs)
  GH-13577
• legal: Update LICENSE
  GH-13563

1.15.0 (February 4, 2026)

IMPROVEMENTS:

• core/hcp: add support for updating HCP Packer registry channels and bucket log UI metadata.
  GH-13532

• build: update Go to 1.24.12.
  GH-13553

• docker: remove vmware and vsphere from the packer full image.
  GH-13442

• docs: add comments to packer docs.
  GH-13534

• compliance: update copyright and license headers.
  GH-13540
  GH-13543
  GH-13545
  GH-13544

BUG FIXES:

• datasource/http: update acceptance test URL to avoid rate limiting.
  GH-13480

• provisioner/powershell: ensure LASTEXITCODE is set before checking its value in tests.
  GH-13539

SECURITY:

• Bump golang.org/x/crypto to 0.46.0
  GH-13546

1.14.3 (November 18, 2025)

IMPROVEMENTS:

• core/hcp: added cicd metadata support for BitBucket and Jenkins pipelines.
  GH-13513
  GH-13505

• core: bump github.com/hashicorp/packer-plugin-sdk to 0.6.4
  GH-13494

• docs: fix typos and linguistic errors in documentation.
  GH-13496

SECURITY:

• Bump golang.org/x/crypto to 0.43.0
  GH-13518