hashicorp

Terraform 1.17.0-rc1, dated October 7, 2026, adds variables in provider requirements and -minimal-refresh, and its notes call Terraform Policy generally available.

HashiCorp argues HCP Terraform's policy, identity, and audit controls must govern AI agents authoring infrastructure changes, pointing to its new tfctl CLI as part of that model.

Packer 1.16 adds a provenance post-processor and a verify-attestation command, letting teams cryptographically sign and check the origin of every machine image they build.

A maximum-severity flaw let one user's Terraform token be reused for other users' requests in stateless HTTP mode; two related bugs also patched in version 1.1.0.

HashiCorp's March 31 deadline to kill its legacy free plan is pushing developers toward OpenTofu, Pulumi, and self-hosted alternatives as IBM's ownership tightens access to once-free tools.