terraform

Terraform 1.17.0-rc1, dated October 7, 2026, adds variables in provider requirements and -minimal-refresh, and its notes call Terraform Policy generally available.

HashiCorp argues HCP Terraform's policy, identity, and audit controls must govern AI agents authoring infrastructure changes, pointing to its new tfctl CLI as part of that model.

A maximum-severity flaw let one user's Terraform token be reused for other users' requests in stateless HTTP mode; two related bugs also patched in version 1.1.0.

OpenTofu v1.12.0 lands with variable-driven prevent_destroy, a destroy=false lifecycle flag, and dual output modes — features the Terraform tracker left open since 2016.

HashiCorp's March 31 deadline to kill its legacy free plan is pushing developers toward OpenTofu, Pulumi, and self-hosted alternatives as IBM's ownership tightens access to once-free tools.