1.17.1 (October 28, 2026)

BUG FIXES:

• fmt: The original content of a file is now preserved if Terraform experiences an error writing to the original file. (#39303)

• Always evaluate module policies during destroy plan (#39455)

• stacks: report every policy result for a replaced resource instead of only one of them (#39453)

1.16.7 (October 22, 2026)

BUG FIXES:

• command/test: Avoid panic when testing schema w/ deprecated values (#39406)

NOTES:

• Terraform is now built with Go 1.26.10, which no longer trusts certificates issued through a set of compromised eMudhra intermediate CAs (CVE-2026-111943) (#39417)

1.17.0 (October 21, 2026)

NEW FEATURES:

• Terraform now supports variables and locals in provider requirements (#39153)

• A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. (#35290)

• policy: Terraform Policy is now generally available. The -policies flag for plan, apply, and query no longer requires an experimental build or the -allow-experimental-features flag. Query policies evaluate resources discovered by list blocks and report human-readable or JSON results. See https://developer.hashicorp.com/terraform/policy for more information. (#38970)

ENHANCEMENTS:

• command/init: Enrich log messages with provider versions (#38918)

• test: Add mock_provider support for ephemeral resources (#38928)

• command/login: display warning after successful login if user is subject to an organization's TTL policy

BUG FIXES:

• funcs: pow and log no longer panic when result is not a number (#38912)

• ephemeral: Terraform will now use and display diagnostics raised when renewing an ephemeral resource. This may cause warnings to appear that previously were lost. We expect that any error diagnostics that were previously lost would have caused confusing downstream errors, so we do not anticipate this change to be breaking. (#38989)

• test: Deterministic dependency ordering in cleanup graph (#38247)

• query: report Unknown and N/A results for policy evaluations of discovered resources (#39058)

• query: terraform query -policies now rejects a path that is not a directory, instead of passing it on to the policy engine (#39238)

• funcs: The log and pow functions now raise errors when they return +/- Infinity, as this result is not usable in downstream code. (#39304)

• show: Read variable values from the plan file when showing a local plan (#39362)

NOTES:

• version: JSON output now includes a new format_version field, which will enable safer future changes of the command's JSON output format. It is assumed existing tooling ignores unknown fields and therefore this change should not be breaking in itself but we advice consumers to pay attention to format_version in future releases and/or use latest version of hashicorp/terraform-json & hashicorp/terraform-exec which does. (#38930)

• Terraform is now built with Go 1.26.10, which no longer trusts certificates issued through a set of compromised eMudhra intermediate CAs (CVE-2026-111943) (#39417)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.16
• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

1.17.0-rc2 (October 14, 2026)

NEW FEATURES:

• Terraform now supports variables and locals in provider requirements (#39153)

• A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. (#35290)

• policy: Terraform Policy is now generally available. The -policies flag for plan, apply, and query no longer requires an experimental build or the -allow-experimental-features flag. Query policies evaluate resources discovered by list blocks and report human-readable or JSON results. See https://developer.hashicorp.com/terraform/policy for more information. (#38970)

ENHANCEMENTS:

• command/init: Enrich log messages with provider versions (#38918)

• test: Add mock_provider support for ephemeral resources (#38928)

• command/login: display warning after successful login if user is subject to an organization's TTL policy

BUG FIXES:

• funcs: pow and log no longer panic when result is not a number (#38912)

• ephemeral: Terraform will now use and display diagnostics raised when renewing an ephemeral resource. This may cause warnings to appear that previously were lost. We expect that any error diagnostics that were previously lost would have caused confusing downstream errors, so we do not anticipate this change to be breaking. (#38989)

• test: Deterministic dependency ordering in cleanup graph (#38247)

• query: report Unknown and N/A results for policy evaluations of discovered resources (#39058)

• query: terraform query -policies now rejects a path that is not a directory, instead of passing it on to the policy engine (#39238)

• funcs: The log and pow functions now raise errors when they return +/- Infinity, as this result is not usable in downstream code. (#39304)

• show: Read variable values from the plan file when showing a local plan (#39362)

NOTES:

• version: JSON output now includes a new format_version field, which will enable safer future changes of the command's JSON output format. It is assumed existing tooling ignores unknown fields and therefore this change should not be breaking in itself but we advice consumers to pay attention to format_version in future releases and/or use latest version of hashicorp/terraform-json & hashicorp/terraform-exec which does. (#38930)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.16
• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

1.16.6 (October 14, 2026)

BUG FIXES:

• cloud: terraform init can now find workspaces selected by key/value tags whose keys contain uppercase letters. (#39306)

• test: Allow module under test to use deprecated outputs. (#39207)

NOTES:

• Prevent a HTTP/2 resource exhaustion via CVE-2026-78669. Exploitation would require a compromised (untrusted) provider/module registry. Such a threat is considered to be outside the perimeter of Terraform core security guarantees. (#39375)

1.17.0-rc1 (October 07, 2026)

NEW FEATURES:

• Terraform now supports variables and locals in provider requirements (#39153)

• A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. (#35290)

• policy: Terraform Policy is now generally available. The -policies flag for plan, apply, and query no longer requires an experimental build or the -allow-experimental-features flag. Query policies evaluate resources discovered by list blocks and report human-readable or JSON results. See https://developer.hashicorp.com/terraform/policy for more information. (#38970)

ENHANCEMENTS:

• command/init: Enrich log messages with provider versions (#38918)

• test: Add mock_provider support for ephemeral resources (#38928)

• command/login: display warning after successful login if user is subject to an organization's TTL policy

BUG FIXES:

• funcs: pow and log no longer panic when result is not a number (#38912)

• ephemeral: Terraform will now use and display diagnostics raised when renewing an ephemeral resource. This may cause warnings to appear that previously were lost. We expect that any error diagnostics that were previously lost would have caused confusing downstream errors, so we do not anticipate this change to be breaking. (#38989)

• test: Deterministic dependency ordering in cleanup graph (#38247)

• query: report Unknown and N/A results for policy evaluations of discovered resources (#39058)

• query: terraform query -policies now rejects a path that is not a directory, instead of passing it on to the policy engine (#39238)

NOTES:

• version: JSON output now includes a new format_version field, which will enable safer future changes of the command's JSON output format. It is assumed existing tooling ignores unknown fields and therefore this change should not be breaking in itself but we advice consumers to pay attention to format_version in future releases and/or use latest version of hashicorp/terraform-json & hashicorp/terraform-exec which does. (#38930)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.16
• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

1.16.5 (September 30, 2026)

BUG FIXES:

• Fixed a crash that happens when a tainted instance state is seen without a valid status (#39287)

• resource-identity: fixed an issue where resource identity could be nil during delete (#39285)

1.17.0-beta2 (September 23, 2026)

NEW FEATURES:

• Terraform now supports variables and locals in provider requirements (#39153)

• A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. (#35290)

• policy: Terraform Policy is now generally available. The -policies flag for plan, apply, and query no longer requires an experimental build or the -allow-experimental-features flag. Query policies evaluate resources discovered by list blocks and report human-readable or JSON results. See https://developer.hashicorp.com/terraform/policy for more information. (#38970)

ENHANCEMENTS:

• command/init: Enrich log messages with provider versions (#38918)

• test: Add mock_provider support for ephemeral resources (#38928)

• command/login: display warning after successful login if user is subject to an organization's TTL policy

BUG FIXES:

• funcs: pow and log no longer panic when result is not a number (#38912)

• ephemeral: Terraform will now use and display diagnostics raised when renewing an ephemeral resource. This may cause warnings to appear that previously were lost. We expect that any error diagnostics that were previously lost would have caused confusing downstream errors, so we do not anticipate this change to be breaking. (#38989)

• test: Deterministic dependency ordering in cleanup graph (#38247)

• query: report Unknown and N/A results for policy evaluations of discovered resources (#39058)

• query: terraform query -policies now rejects a path that is not a directory, instead of passing it on to the policy engine (#39238)

NOTES:

• version: JSON output now includes a new format_version field, which will enable safer future changes of the command's JSON output format. It is assumed existing tooling ignores unknown fields and therefore this change should not be breaking in itself but we advice consumers to pay attention to format_version in future releases and/or use latest version of hashicorp/terraform-json & hashicorp/terraform-exec which does. (#38930)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.16
• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

1.16.4 (September 23, 2026)

BUG FIXES:

• Fixed an issue where Terraform fails when rendering policy evaluation outcomes for older versions of Terraform Enterprise (#39095)

• stacks: Fix invalid deferred error triggered by provider returning a deferral when a resource also has an unknown count/for_each. (#39237)

1.16.3 (September 16, 2026)

BUG FIXES:

• Fix handling of destroy=false around create_before_destroy instances (#39169)

• Fix function result comparison when there are multiple marks (#39170)

• Filter logic for marks could cause values with multiple marks to erroneously fail validations (#39171)

• Fix issue with import provider resolution (#39185)