v1.16.6
Fixed cloud workspace selection with uppercase letters in tag keys and deprecated output handling in test modules. Includes HTTP/2 resource exhaustion mitigation via CVE-2026-78669.
1.16.6 (October 14, 2026)
BUG FIXES:
-
cloud:
terraform initcan now find workspaces selected by key/value tags whose keys contain uppercase letters. (#39306) -
test: Allow module under test to use deprecated outputs. (#39207)
NOTES:
- Prevent a HTTP/2 resource exhaustion via CVE-2026-78669. Exploitation would require a compromised (untrusted) provider/module registry. Such a threat is considered to be outside the perimeter of Terraform core security guarantees. (#39375)
Source: original entry ↗
More from Terraform
Follow Terraform to get its new changes in your feed and email digest.
Terraform v1.17.0-rc2 release
Release candidate 1.17.0 includes support for variables and locals in provider requirements, a new -minimal-refresh planning option, general availability of Terraform Policy, and various enhancements and bug fixes for ephemeral resources, policy evaluation, and mathematical functions.
Terraform 1.17.0-rc1 release
Release candidate 1.17.0 introduces Terraform Policy as generally available (removing experimental flags), adds support for variables and locals in provider requirements, includes a new -minimal-refresh planning option for efficiency, and fixes critical bugs in function evaluation and ephemeral resource handling.
Terraform v1.16.5
This patch release fixes a crash when processing tainted instance state without a valid status and resolves an issue where resource identity could be nil during delete operations.