| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: terragrunt | Distribution: openSUSE Tumbleweed |
| Version: 1.1.2 | Vendor: openSUSE |
| Release: 1.1 | Build date: Thu Jul 30 08:06:33 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 100334911 | Source RPM: terragrunt-1.1.2-1.1.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://github.com/gruntwork-io/terragrunt | |
| Summary: Thin wrapper for Terraform for working with multiple Terraform modules | |
Terragrunt is a thin wrapper for Terraform that provides extra tools for keeping your Terraform configurations DRY, working with multiple Terraform modules, and managing remote state.
MIT
* Thu Jul 30 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 1.1.2:
* New Features
- Scaffold straight from the catalog README view with ctrl+d
In the terragrunt catalog TUI, pressing ctrl+d while reading
a component's README now scaffolds it immediately, skipping
the interactive form. Module and template inputs are written
as # TODO placeholders, and unit/stack copies get a fully
placeholder terragrunt.values.hcl. The hint bar at the bottom
of the README view advertises the new key.
* Performance Improvements
- Fewer filesystem checks when resolving
find_in_parent_folders()
find_in_parent_folders() walks up from a unit toward the
filesystem root, checking each directory for the
configuration file it was asked to find. Even when the call
named a file, as in find_in_parent_folders("root.hcl"), each
directory along the way was also checked for the default
configuration filenames. Units sharing a parent chain then
repeated every check their siblings had already made.
Terragrunt now checks only the filename the call names, and
reuses what it already learned about a directory for the rest
of the command. Deeply nested estates benefit most, since
every level between a unit and its root configuration used to
be re-checked once per unit.
In micro-benchmarks, resolving the root configuration for 100
units nested eight directories deep went from 4.8ms to
0.49ms. Across the benchmarked shapes the lookups run between
7x and 10x faster, and the time saved grows with both the
number of units and how deeply they sit below their root
configuration.
* Bug Fixes
- Fixed roles assuming themselves for backend operations
A regression in v1.1.1 broke setups that provide static AWS
credentials and configure a role via the iam_role attribute,
the --iam-assume-role flag, or TG_IAM_ASSUME_ROLE.
In those setups, Terragrunt assumes the role once at the
start of a run, and every later AWS call uses that role
session. In v1.1.1, backend operations like bootstrapping the
state bucket started performing an extra role assumption of
their own. Since the run was already using the role session
at that point, the role tried to assume itself, and AWS
rejected the call with an AccessDenied error unless the
role's trust policy happened to include the role itself.
Backend operations now reuse the role session from the start
of the run, as they did before v1.1.1.
This does not affect the assume_role attribute of the
remote_state block. Roles configured there are
backend-specific and are still assumed on top of the supplied
credentials, so the cross-account role assumption should
continue to work as expected.
- Local sources no longer re-init when uncopied files change
For units with a local source, Terragrunt decides whether the
cached copy is stale by hashing the source directory. That
hash previously covered every file in the directory,
including hidden files and exclude_from_copy matches that are
never copied into the cache. Creating or touching such a file
(an editor swap file, a scratch note) changed the hash,
forcing a needless re-copy and auto-init on the next run.
The hash now covers only the files a copy would deliver,
honoring the default hidden-file rule along with
include_in_copy and exclude_from_copy. Files that never reach
the cache no longer trigger re-initialization.
- Fixed width truncation of colored and multi-byte log content
The width option in a custom log format sizes a column to a
fixed number of visible characters. When the content held
color codes or multi-byte characters and was longer than the
column, truncation cut the raw bytes: it could slice through
the middle of a color code, leaving color bleeding into the
rest of the line, or split a multi-byte character into
invalid output, and it dropped more visible text than the
configured width.
width now measures and cuts by visible characters. Color
codes are preserved intact, multi-byte characters are never
split, and the column keeps exactly the requested number of
visible characters.
- Provider cache downloads now require a secret URL
The Provider Cache Server now hardens the download endpoint
that fetches provider archives on the caller's behalf. That
endpoint attaches whatever registry credentials are
configured for the upstream host, and it was the only one on
the server that did not require the token generated for the
run, so any other process on the machine could use a running
cache server to pull artifacts from a private registry with
the credentials of whoever started the run.
The download URLs handed to OpenTofu and Terraform now carry
a secret path segment, generated fresh each time the cache
server starts and redacted from the server's own logs.
Requests that omit the segment get a 404.
- Run report no longer mangles the names of paths that share a
prefix with the working directory
When a run's path shared a string prefix with the working
directory without being nested under it, the run report
shortened its name by shearing off the prefix mid-segment. A
working directory of /repo/project alongside a run at
/repo/project-staging/unit produced the name -staging/unit.
The report now shortens a path only when it is genuinely
nested under the working directory. Sibling paths keep their
full name.
- Feature flag defaults no longer leak between units in run
- -all
A feature block's default was recorded once per run and
shared by every unit. During run --all, the first unit to be
parsed set the value for a flag name, so a unit defining
default = false could evaluate feature.toggle.value as true
because a sibling unit was parsed first. Which unit won
depended on parsing order, making the result vary between
runs.
Defaults are now resolved per unit, including defaults
inherited through include. Overrides passed with --feature or
TG_FEATURE continue to apply to every unit in the run.
- Fixed S3 source downloads under EKS Pod Identity
Downloading unit sources from private S3 buckets
(s3::https://...) now works when EKS Pod Identity is the only
credential source. Previously, the bundled aws-sdk-go v1
rejected the Pod Identity Agent endpoint (169.254.170.23)
because it only allowed loopback hosts. Terragrunt now uses
aws-sdk-go v1.55.6, which allows the EKS and ECS container
credential endpoints.
* Experiments Added
- otel-logs experiment exports logs to OpenTelemetry
Terragrunt previously emitted only traces and metrics, so
there was no way to ship its log output to an OpenTelemetry
backend or correlate log lines with the spans of a failed
run.
Enable the new otel-logs experiment to add an OpenTelemetry
logs signal, configured with TG_TELEMETRY_LOGS_EXPORTER:
- none - no log exporting, the default.
- console - write log records to the console as JSON.
- otlpHttp - export logs to an OpenTelemetry collector over
HTTP.
- otlpGrpc - export logs to an OpenTelemetry collector over
gRPC.
TG_TELEMETRY_LOGS_EXPORTER=otlpHttp terragrunt run --all --experiment otel-logs -- apply
The OTLP exporters read the endpoint from the standard
OTEL_EXPORTER_OTLP_ENDPOINT environment variable. Set
TG_TELEMETRY_LOGS_EXPORTER_INSECURE_ENDPOINT=true to disable
TLS when collecting locally. Records emitted while a span is
active carry its trace and span IDs, so a failed unit's logs
link to its span in the backend. Without the experiment
enabled, the logs exporter stays inert regardless of
TG_TELEMETRY_LOGS_EXPORTER.
- profiling experiment adds pprof collection for Terragrunt
runs
Enable the new profiling experiment to collect CPU profiles,
memory (heap) profiles, and goroutine profiles (stack traces
of all goroutines) using CLI flags. Profiling is intended for
debugging the performance of Terragrunt itself, and for
exploring ways to optimize Terragrunt as an application; it
will not help with improving the performance of the
infrastructure Terragrunt manages.
Example:
terragrunt --experiment=profiling --profile-cpu cpu.prof --profile-mem mem.prof --profile-goroutine goroutine.prof run -- plan
Use --profile-dir to collect all profiles into a single
directory with conventional names (terragrunt_cpu.prof,
terragrunt_mem.prof, terragrunt_goroutine.prof):
terragrunt --experiment=profiling --profile-dir /tmp/profiles run --all -- plan
The same behavior is available via environment variables when
the profiling experiment is enabled:
- TG_PROFILE_CPU
- TG_PROFILE_MEM
- TG_PROFILE_GOROUTINE
- TG_PROFILE_DIR
When using --profile-dir or TG_PROFILE_DIR, Terragrunt also
sets TOFU_CPU_PROFILE for each unit so downstream OpenTofu
processes (OpenTofu 1.11 or later) write their own CPU
profiles into unit-specific subdirectories. An explicitly set
TOFU_CPU_PROFILE is never overridden.
* Experiments Updated
- azure-backend now manages Azure Storage remote state
The azure-backend experiment now enables functional
Terragrunt support for the Azure Storage (azurerm)
remote-state backend.
When the experiment is enabled, Terragrunt can bootstrap the
resource group, storage account, and blob container used by
remote_state { backend = "azurerm" }, detect whether the
backend needs bootstrapping, converge blob versioning and
soft-delete settings, delete state blobs or containers, and
migrate state blobs within the same storage account.
Terragrunt-only settings such as location, the storage
account SKU options, the skip_* flags, enable_soft_delete,
soft_delete_retention_days, and msi_resource_id are consumed
by Terragrunt and removed before it runs OpenTofu/Terraform
with init -backend-config, so the underlying azurerm backend
receives only keys it understands. msi_resource_id is not
bootstrap-only: it also selects the managed identity used for
delete and migrate.
This remains opt-in while the experiment is active:
terragrunt --experiment azure-backend run -- plan
- oci - Credential helpers for OCI module sources
oci:// module downloads now use the Docker credential helpers
you already have configured, so registries like Amazon ECR
authenticate automatically with no extra setup.
- oci - Content-addressable caching for OCI module sources
oci:// module sources now integrate with Content Addressable
Storage. When the oci experiment is enabled, downloads are
cached by their manifest digest, so a repeated fetch of the
same tag or digest is served from the local store instead of
re-downloaded from the registry.
Mutable tags stay correct: every fetch re-resolves the tag to
its current manifest digest at download time, so re-pushing a
module under the same tag invalidates the cache and pulls the
new content rather than serving a stale copy. A digest-pinned
source (?digest=sha256:...) skips registry resolution and
keys the cache directly.
- oci - Downloading modules from OCI registries
The oci experiment now downloads source code (including
OpenTofu modules) from OCI Distribution registries. When
enabled, Terragrunt accepts oci:// source URLs in Terragrunt
configurations (including terraform.source attributes).
Specify either tag or digest; omitting both selects the
latest tag. //subdir selectors are supported. Artifacts
follow the same publishing contract OpenTofu 1.10 consumes
natively.
Authentication covers static credentials via interim
TG_TMP_OCI_* environment variables and read-only ambient
discovery of Docker and containers auth files. Static
credentials can be limited to one registry with
TG_TMP_OCI_REGISTRY; without it, the configured token or
username and password may be offered to any registry the
process contacts. Credential helpers (such as ecr-login) are
not invoked yet, so registries that need per-run token
minting only work while an externally obtained login is
present in an ambient file.
When the experiment is disabled, oci:// sources remain
unsupported.
For setup steps, see the experiment documentation.
https://docs.terragrunt.com/reference/experiments/active#oci
* What's changed
- fix: prevent auto-init env vars from leaking into main
command (#6576)
- feat: add experimental azurerm remote state backend (#6428)
- docs: Improving docs by addressing frequently asked questions
(#6560)
- chore: Reducing race in vexec testing (#6551)
- feat(getter): credential helpers for oci:// module sources
(#6508)
- chore: coverage report fixes (#6557)
- chore: Updating Kapa integration (#6558)
- chore: Fixing pprof venv access (#6556)
- feat(profiling): add automatic pprof collection (#5711)
- docs: Adding search telemetry (#6555)
- chore: fixed failed lint tests (#6550)
- chore: Refactor for network isolation in tests (#6507)
- feat: Adding earlier catalog bail (#6493)
- docs: Re-organizing content related to the run queue out of
stack documentation (#6114)
- fix: Fixing self-chained role assumption (#6521)
- perf: Memoize `find_in_parent_folders()` (#6545)
- chore: Cleaning up tests for #6547 (#6549)
- chore: Adding vhttp client to abstract away HTTP client
connections (#6121)
- fix: Fixing report path prefix trim (#6527)
- docs: Adding changelog entry for #5995 (#6548)
- fix: Adding random URL segment to download URI (#6547)
- chore: Adding more tests for build metadata (#6538)
- fix: Isolate feature defaults per unit in run --all (#5995)
- chore: Update grpc, x/mod, go-shellwords deps (#6543)
- chore: Fixing panic in Windows test (#6536)
- fix: support EKS Pod Identity for S3 source downloads (#6532)
- fix: Fixing log truncation (#6526)
- docs: Adding CLI flag precedence rule (#6524)
- chore(deps): bump astro from 7.0.4 to 7.1.0 in /docs (#6515)
- chore: lint fixes (#6518)
- feat(getter): add OCI digest CAS resolver with tag
re-resolution (#6503)
- chore: speed up slowest tests with unit-level coverage and
hermetic fixtures (#6436)
- fix: Preventing spurious re-inits (#6504)
- chore: Adding `vsops` (#6506)
- fix: Fixing docs `TF_TOKEN_*` rendering (#6509)
- chore: Unify Venv struct by dropping `cas.Venv` (#6488)
- chore: Adding some integration testing for the `version`
attribute (#6487)
- chore: Running `fd -tf -e go -x golines -w` to avoid run-on
lines (#6484)
- chore: AWS dependencies bump (#6502)
- feat(getter): add WithOCI and gate oci sources behind the oci
experiment (#6486)
- feat(getter): add static and ambient OCI credential discovery
(#6483)
- feat: Add `otel-logs` experiment (#6279)
- chore: Avoid package-level module resolution for `version`
attribute (#6482)
- feat(getter): implement OCIGetter.Get with fake-store unit
tests (#6479)
- chore: Fixing code fences on `/reference/hcl/blocks/` (#6485)
- chore: Log Windows console mode retrieval failures at debug
level (#6374) (#6376)
* Wed Jul 15 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 1.1.1:
* Bug Fixes
- Chained role assumption for the S3 backend
When AWS credentials were supplied through
- -auth-provider-cmd or environment variables, Terragrunt
ignored the assume_role attribute of the remote_state block
for its own backend operations, such as bootstrapping the
state bucket. In cross-account setups this caused access
errors, even though OpenTofu/Terraform itself assumed the
role correctly during runs.
Terragrunt now uses the supplied credentials as the source
identity and assumes the configured role on top of them. The
same applies to roles configured via the iam_role attribute
or the --iam-assume-role flag, and to fetching dependency
outputs directly from S3 state.
- Safer temporary clone directories for terragrunt catalog
Terragrunt now creates a fresh temporary clone directory for
each catalog load, rejects symlinked clone roots, and removes
catalog clones when the TUI session exits.
- Resolve dependency outputs for units that reference a
dependency in a hook, extra_arguments, or remote_state block
Resolving a unit's dependency outputs for a downstream unit
no longer fails when that unit references its own dependency
in:
a before_hook, after_hook, or error_hook
an extra_arguments block
a remote_state block
Previously these raised There is no variable named
"dependency" on the downstream unit, and a remote_state
reference could crash Terragrunt.
- Limit IaC engine archive extraction
Terragrunt now protects developer machines and CI runners
from engine archives that expand into unexpectedly large
amounts of data. If an IaC engine package is unusually large
or contains too many files, Terragrunt stops processing it
before it can consume excessive disk space.
- --filter-allow-destroy with ...[] dependent-traversal
filters no longer fails
- -filter-allow-destroy --filter '...[HEAD~1...HEAD]' failed
with "Too many command line arguments" or hung when the
deleted unit had dependents. Terragrunt now correctly plans
and destroys deleted units regardless of whether dependents
are included in the run.
- Fix find and list missing units inside generated stacks for
Git-based filters
terragrunt find and terragrunt list with a Git-based filter
(for example --filter '[HEAD^1...HEAD]') now detect units
inside generated stacks. Previously they did not generate
stacks in the worktrees they create for the comparison, so no
unit nested in a generated stack was ever surfaced, while
terragrunt run --all with the same filter targeted those
units correctly.
This affected every change that lands inside a generated
stack, including a modified terragrunt.stack.hcl, a change to
a unit's own files, and a change to a file the stack reads
via read_terragrunt_config or mark_glob_as_read.
Stacks are generated only inside the comparison worktrees;
find and list still do not generate stacks in your current
working directory by default.
- Treat Git source ref values strictly as references
Terragrunt now passes the ref from a Git module source to git
strictly as a reference when downloading through
content-addressable storage. Previously a source whose ref
began with a git option (for example a value starting with
- -) could be interpreted by git as an option rather than a
reference while fetching the source.
Terragrunt now terminates git option parsing before the
repository and reference arguments in its fetch, clone, and
ls-remote invocations, so these values can only ever be read
as the repository and reference they are meant to be. Normal
refs, branches, tags, and commit SHAs continue to work
unchanged.
- hcl validate resolves get_original_terragrunt_dir() to the
discovered unit
terragrunt hcl validate and terragrunt hcl validate --inputs
now resolve get_original_terragrunt_dir() to each discovered
unit's own directory instead of the directory the command was
launched from. Previously, when the command ran from a parent
directory that discovered units in subdirectories, any
read_terragrunt_config() call that built a path relative to
get_original_terragrunt_dir() resolved against the wrong
directory and failed with "You attempted to run terragrunt in
a folder that does not contain a terragrunt.hcl file", even
though plan, apply, and run validate worked on the same
configuration.
Both commands now set the original config path per discovered
unit before parsing, matching the behavior of run and backend
bootstrap, so relative paths resolve against the unit that
owns them.
- Respect -lockfile=readonly during provider caching
When you pass -lockfile=readonly to init, Terragrunt no
longer generates or updates .terraform.lock.hcl while warming
the provider cache. Previously the cache step could write the
lock file before OpenTofu/Terraform ran, so the read-only
check always passed and silently defeated the flag.
Terragrunt now leaves the lock file untouched and lets
OpenTofu/Terraform enforce it, failing when the lock file is
missing or incomplete. The flag is honored whether it is
supplied on the command line or through the TF_CLI_ARGS or
TF_CLI_ARGS_init environment variables.
- run --all no longer crashes on dependency discovery with
graph filters
Running run --all with a filter that expands a git range
through the dependency graph (for example [HEAD~1...HEAD]...)
could fail during dependency discovery, reporting that a
component "is missing its working directory". Whether it
happened depended on the size and shape of the changed unit's
dependency closure, so the same filter succeeded on smaller
branches and find was unaffected.
A dependency reached from several units at once could become
visible to discovery before its working directory was set, so
a concurrent traversal could read it before it was complete.
Dependencies now have their working directory set before they
become visible, so run --all behaves the same regardless of
graph size.
- terraform_binary respected by run --all when both tofu and
terraform are on PATH
run --all ignored a unit's terraform_binary setting and fell
back to the auto-detected default (OpenTofu when both
binaries are on PATH). The per-unit options used to execute
each unit are cloned from the stack options, whose binary
path is the auto-detected default, and the configured value
was never applied to them.
Each unit now honors its own terraform_binary, matching the
behavior of a single run. Setting --tf-path or TG_TF_PATH
still takes precedence over the config value.
- S3 bucket creation failures report the underlying error
When creating the state bucket failed during backend
bootstrap, the reported error was a misleading NoSuchBucket
from a follow-up access check, hiding the actual cause. The
original creation error, such as AccessDenied, is now part of
the reported message.
- Allow empty locals blocks in terragrunt.stack.hcl
Fixed a bug where an empty locals {} block in a stack
configuration could break stack generate.
- Clear error when terraform.source references a dependency
output
A terraform.source that references
dependency.<name>.outputs.<key> is now rejected with a
message explaining that the module source must be resolvable
before dependencies are evaluated.
Terragrunt resolves the source while discovering units and
building the run queue, before any dependency has run, so
such a source can never be satisfied. Previously it surfaced
a cryptic decode error.
* Experiments Added
- oci - Module sources from OCI registries
The oci experiment has been added as the gate for downloading
source code (including OpenTofu modules) from OCI
Distribution registries using oci:// schema URLs in
Terragrunt configurations (including terraform.source
attributes). This targets the same registries OpenTofu 1.10
supports natively, such as Amazon ECR, GitHub Container
Registry, Azure Container Registry, Google Artifact Registry,
and self-hosted or air-gapped registries.
Enabling the experiment has no behavioral effect yet: the
getter that will resolve oci:// sources is not wired into
source downloading, so oci:// sources still fail to download.
Functional support will land in follow-up releases, gated by
this experiment.
For setup steps, see the experiment documentation.
https://docs.terragrunt.com/reference/experiments/active#oci
- version-attribute - Resolve registry modules from a version
constraint
The version-attribute experiment has been added to gate a new
version attribute on the terraform block. It holds a version
constraint (such as ~> 3.3 or >= 1.0.0, < 2.0.0) for a tfr://
registry module, and Terragrunt resolves it to the highest
published version that satisfies the constraint before
downloading:
terraform {
source = "tfr://registry.opentofu.org/terraform-aws-modules/vpc/aws"
version = "~> 3.3"
}
This brings the terraform block to parity with the version
argument on OpenTofu and Terraform module blocks. The
attribute applies to tfr:// sources only, and cannot be
combined with an inline ?version= on the same source.
Enable it with --experiment version-attribute. For setup
steps and the criteria for stabilization, see the experiment
documentation.
https://docs.terragrunt.com/reference/experiments/active#version-attribute
* Process Updates
- Friendly panic reports
Terragrunt now writes a
terragrunt-crash-YYYYMMDDTHHMMSSZ-<pid>.log file when it
crashes.
The report includes runtime details, the command line, the
panic message, and the stack trace. You can conveniently
share this file (after reviewing for sensitive information)
to report panics if Terragrunt crashes.
* What's changed
- docs: Changelog fix-up (#6481)
- feat: Gate and resolve the version constraint at download
time (#6477)
- docs: Documenting the `version-attribute` experiment (#6476)
- chore: Removing `source` from `version` attribute error
(#6480)
- feat: Add and validate the `version` attribute on the
`terraform` block (#6475)
- feat(getter): add OCIGetter (#6478)
- chore: Moving writers to venv (#6410)
- chore: Resolve registry module versions from a constraint
(#6471)
- fix: Fixing `run --all` with graph expression throwing on
missing working dir (#6474)
- fix: Fixing empty locals block for `stack generate` (#6470)
- chore: OCI container fix (#6465)
- chore: add separated us-west-2 pass (#6473)
- chore(deps): bump docker/setup-docker-action from 5.2.0 to
5.3.0 (#6454)
- chore(deps): bump the go-dependencies group across 1
directory with 15 updates (#6457)
- chore: Cleaning up leaking buckets (#6466)
- chore(deps): bump the js-dependencies group across 1
directory with 6 updates (#6456)
- chore: Register the `version` attribute experiment (#6463)
- feat(experiment): introduce oci experiment flag for OCI
module sources (#6461)
- chore(deps): bump golang.org/x/crypto in /test/flake (#6464)
- fix: Fixing chained role assumption for backend (#6327)
- fix: Prevent `terraform_binary` from being ignored in `run
- -all` (#6460)
- chore: Cleaning up #6406 (#6462)
- chore: Move env to venv (#6406)
- fix: Dependency output resolution for more scenarios (#6425)
- feat: terragrunt panic reporting (#6120)
- fix(hcl-validate): set per-unit OriginalTerragruntConfigPath
so get_original_terragrunt_dir() resolves correctly (#6445)
- fix(git): pass repository and ref as positionals in git
fetch, clone, and ls-remote (#6452)
- fix(catalog): harden temporary clone paths (#6438)
- fix: Generate stacks in worktrees generated for `find`/`list`
(#6362)
- fix(engine): limit engine ZIP archive extraction (#6437)
- fix: use updated/correct GTM tag (#6439)
- chore: Addressing weekly reports (2026-06-29) (#6435)
- fix: Fixing combination of `--filter-allow-destroy` with
graph + Git expression combo (#6322)
- fix: Avoiding generation of the lockfile when users supply
`-lockfile=readonly` (#6358)
- docs: Fixing docs builds (#6434)
- Revert "chore(deps): bump the js-dependencies group across 1
directory with 4…" (#6433)
- chore(deps): bump the js-dependencies group across 1
directory with 4 updates (#6432)
- chore(deps): bump mikepenz/action-junit-report from 6.4.1 to
6.4.2 (#6431)
- chore(deps): bump actions/cache from 5.0.5 to 6.1.0 (#6430)
* Wed Jul 01 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 1.1.0:
* New Features
- Stack dependencies
A stack generates a tree of units from a single
terragrunt.stack.hcl file. Wiring one of those units to
another used to mean defining dependency blocks in your
catalog and threading dependency paths through values. Stack
dependencies let you declare those relationships up front
instead.
Add an autoinclude block inside a unit or stack block, and
Terragrunt generates a partial configuration (a
terragrunt.autoinclude.hcl file) next to the generated
terragrunt.hcl or terragrunt.stack.hcl that's automatically
merged into the unit or stack definition. The new
unit.<name>.path and stack.<name>.path references resolve to
generated paths, so you don't have to hardcode them:
[#] terragrunt.stack.hcl
unit "vpc" {
source = "github.com/acme/catalog//units/vpc"
path = "vpc"
}
unit "app" {
source = "github.com/acme/catalog//units/app"
path = "app"
autoinclude {
dependency "vpc" {
config_path = unit.vpc.path
}
inputs = {
vpc_id = dependency.vpc.outputs.vpc_id
}
}
}
Anything that's valid in a unit configuration is valid in its
autoinclude block, so you can also patch catalog units with
configuration they don't ship with, like retry rules:
[#] terragrunt.stack.hcl
unit "app" {
source = "github.com/acme/catalog//units/app"
path = "app"
autoinclude {
errors {
retry "transient_errors" {
retryable_errors = [".*Error: transient network issue.*"]
max_attempts = 3
sleep_interval_sec = 5
}
}
}
}
The same works for nested stacks: an autoinclude block inside
a stack block patches the generated terragrunt.stack.hcl, so
you can, for example, add an extra unit to one environment
without forking the stack in your catalog.
Stack configurations also gained two capabilities along the way:
- include blocks now work in terragrunt.stack.hcl files, so
shared stack configuration can live in a parent folder.
- dependency blocks can target stack directories, and the run
queue expands them to the units inside. Note that this
relationship only goes one way: units can depend on stacks,
but stacks cannot depend on stacks or units.
See the stacks documentation for the full reference.
https://docs.terragrunt.com/features/stacks/explicit
Previously gated behind the stack-dependencies experiment,
all of this is now enabled by default.
- Content Addressable Store (CAS)
The Content Addressable Store (CAS) deduplicates source
downloads across configurations. It addresses repositories
and modules by their content, stores them locally, and serves
later requests from that local store instead of repeating the
fetch. This speeds up catalog cloning, OpenTofu/Terraform
source fetching, and stack generation, and identical files
occupy disk space once regardless of how many configurations
use them.
The CAS is no longer limited to Git. It also deduplicates
HTTP, Amazon S3, Google Cloud Storage, Mercurial, and SMB
sources, along with OpenTofu/Terraform registry sources
fetched via tfr://. See supported sources for how each one
resolves and deduplicates content.
CAS is enabled by default. Use the --no-cas flag (or
TG_NO_CAS=true) to opt out of it for a run:
terragrunt run --all --no-cas -- plan
Two new attributes give you finer control, and both default
to off:
- update_source_with_cas makes a generated stack
self-contained. Set it on a unit, stack, or terraform block
with a relative source, and terragrunt stack generate
rewrites that source into a content-addressed cas::
reference, so the generated tree no longer depends on the
surrounding repository layout. Catalog authors can keep
relative paths in their sources and still ship a portable,
reproducible stack:
[#] stacks/networking/terragrunt.stack.hcl
unit "vpc" {
source = "../..//units/vpc"
path = "vpc"
update_source_with_cas = true
}
After terragrunt stack generate, the relative path is
replaced by a reference to the exact tree the CAS stored:
[#] Generated output
unit "vpc" {
source = "cas::sha1:f39ea0ebf891c9954c89d07b73b487ff938ef08b"
path = "vpc"
update_source_with_cas = true
}
- mutable controls how the CAS places fetched content on
disk. By default, the CAS hard links files from its shared
store into .terragrunt-cache and marks them read-only,
which is fast and uses no extra space, but means the files
can't be edited in place. Set mutable = true on a terraform
block to copy the content instead, making the working tree
safe to edit at the cost of extra I/O and disk space:
[#] units/vpc/terragrunt.hcl
terraform {
source = "github.com/acme/catalog//modules/vpc"
mutable = true
}
Previously gated behind the cas experiment, the CAS no longer
requires --experiment cas.
- Redesigned terragrunt catalog
The catalog command has been redesigned. It now starts
without any configuration, discovers components across your
catalog repositories in the background, and streams them into
the TUI as they're found.
Discovery is no longer limited to a modules/ directory;
components can live anywhere in a catalog repository. To
control what gets discovered, add a
.terragrunt-catalog-ignore file with .gitignore-style globs
for the paths you want filtered out.
Components in the TUI now carry metadata to help you navigate
a large catalog: each one shows a kind label (template,
stack, unit, or module) and optional tags defined in the
front-matter of its README.md. From the component list, press
s to open a new screen that interactively collects the values
used to scaffold the component into your repository.
Previously gated behind the catalog-redesign experiment, the
redesigned catalog is now the default terragrunt catalog
experience.
- Reading detection for local module sources
Terragrunt can select units by the files they read, which is
the basis of change-based runs in CI. Previously, pointing a
unit's terraform block at a local directory didn't mark the
files inside that directory as read, so a change to the
module wouldn't select the unit.
When a unit's source is a local module, Terragrunt now
records the module's *.tf, *.tf.json, *.hcl, *.tofu, and
* .tofu.json files as read by that unit, so --filter
'reading=<path>' and --queue-include-units-reading select the
unit when a module file changes:
terragrunt run --all --filter 'reading=./modules/vpc/main.tf' -- plan
For files that reading detection doesn't track on its own,
the new mark_glob_as_read() HCL function expands a glob and
marks every matching file as read in one call:
locals {
configs = mark_glob_as_read("${get_terragrunt_dir()}/config/{*.yaml,**/*.yaml}")
}
Existing pipelines built on --queue-include-units-reading or
reading= filters may select more units than before, because
changes to local module files now count as reads. Previously
gated behind the mark-many-as-read experiment, these
behaviors no longer require --experiment mark-many-as-read.
- Skip auth during discovery with
- -no-discovery-auth-provider-cmd
By default, Terragrunt runs your --auth-provider-cmd once for
every unit it discovers, so HCL functions that need
credentials resolve correctly during parsing. In a large
repository, that can mean hundreds of invocations before any
unit runs, which can dominate wall-clock time on change-based
runs.
The --no-discovery-auth-provider-cmd flag (env:
TG_NO_DISCOVERY_AUTH_PROVIDER_CMD) skips those invocations
during the discovery phase, leaving auth to run only for the
units that actually execute:
terragrunt run --all \
- -no-discovery-auth-provider-cmd \
- -queue-include-units-reading=./changed-file.txt \
- - plan
Warning
Use this only when you know parsing resolves without
credentials. Units whose configuration depends on values from
- -auth-provider-cmd during discovery (for example, via
get_aws_account_id()) will fail to parse when the flag is
set.
Previously gated behind the opt-out-auth experiment, the flag
now works without --experiment opt-out-auth.
- Run queue displayed as a dependency tree
Before a run --all, Terragrunt lists the units it's about to
run. That list now renders as a dependency tree by default
instead of a flat list, with units nested under their
dependencies, so the run order and the relationships between
units are visible before anything executes:
The following units will be run, starting with dependencies
and then their dependents:
.
├── monitoring
╰── vpc
╰── database
╰── backend-app
The header adapts to direction: dependencies come before
dependents on apply, and the order reverses on destroy.
Previously gated behind the dag-queue-display experiment, the
tree display no longer requires --experiment
dag-queue-display.
* Tips Added
- Tip when filtering a stack leaves nested stacks ungenerated
terragrunt stack generate --filter './my-stack | type=stack'
generates only the selected stack, not the nested stacks it
contains, which can be surprising for a stack of stacks.
When a non-glob | type=stack filter leaves a stack's nested
stacks ungenerated, Terragrunt now prints a tip showing how
to generate them too, for example --filter './my-stack |
type=stack' --filter './my-stack/** | type=stack'.
* Bug Fixes
- Fix permission denied when generated files overwrite
CAS-materialized files
With the CAS enabled, Terragrunt fetches sources as read-only
files. Writing a generated file over one of them no longer
fails with permission denied:
- Files from generate blocks with if_exists = "overwrite",
when the module ships the target file (for example, its own
versions.tf).
- terragrunt.values.hcl, when the unit or stack source
already contains one.
- terragrunt.autoinclude.hcl, when the unit or stack source
already contains one.
- .terraform.lock.hcl, when the provider cache server updates
a committed lock file during init -upgrade.
In each case, the read-only file is replaced with a writable
one, and the shared CAS store is never modified.
- Fix permission denied when CAS fetches a git source across
filesystems
With the CAS enabled, fetching a git:: source could fail with
permission denied on .git/HEAD or .git/config, sending
Terragrunt back to the standard getter. It happened when the
CAS store and the module's working directory sit on different
filesystems, so the files are copied rather than hard-linked,
and a read-only leftover from an interrupted run was in the
way. Terragrunt now recovers from the leftover and completes
the fetch.
- Reject update_source_with_cas on a terraform block when CAS
is disabled
terragrunt stack generate --no-cas now fails when a generated
unit's terraform block sets update_source_with_cas = true,
instead of silently emitting the unit with its relative
source unchanged. The relative source has no meaning once CAS
is disabled, so the generated unit could not resolve its
module. This matches the existing behavior for the same
attribute on unit and stack blocks, and for a run invoked
with --no-cas.
- Apply extra_arguments env vars when resolving dependency
outputs
Resolving a dependency block's outputs now applies the
env_vars from the unit's terraform extra_arguments blocks
whose commands include output.
- Resolve dependency outputs for units whose before_hook
references a dependency
Resolving a unit's dependency outputs no longer evaluates
that unit's terraform hooks, so a before_hook (or after_hook)
that interpolates ${dependency.<name>.outputs.<key>} no
longer fails downstream units with There is no variable named
"dependency". Dependency output resolution still applies the
unit's extra_arguments env_vars and source.
- Select units reading added or deleted glob files in Git-based
filters
Git-based filters (for example terragrunt run --all --filter
'[HEAD^1...HEAD]' -- plan) now select units that read an
added or deleted file through mark_glob_as_read, even when
that file lives outside the unit's own directory. Previously
only modified files outside a unit reached those units;
adding or deleting a file the glob matched left the reading
unit out of the run, so its real config change was skipped.
Added files are matched against the newer reference, and
deleted files against the older one where the file still
exists.
- mark_glob_as_read constrains its walk to a boundary
mark_glob_as_read now confines glob expansion to a boundary
directory. By default the boundary is the enclosing Git
repository root; outside a Git repository it is unset. A
pattern whose walk would begin outside the boundary returns
an error instead of expanding.
This bounds patterns that resolve higher than intended. For
example, "${local.dir}/{*.yaml}" becomes /{*.yaml} when
local.dir is empty, which previously walked the entire
filesystem. A ? : conditional does not prevent this, because
HCL evaluates both branches of a conditional before selecting
one. Wrapping the call in try lets the error fall back to a
default:
locals {
files = sort(try(mark_glob_as_read("${local.dir}/{*.yaml,*.yml,*.json}"), []))
}
Pass a leading --terragrunt-boundary argument to set the
boundary explicitly, for example to scope the walk to a
subdirectory or to widen it to the filesystem root:
locals {
scoped = mark_glob_as_read("--terragrunt-boundary=/etc/terragrunt", "/etc/terragrunt/{*.yaml}")
all = mark_glob_as_read("--terragrunt-boundary=/", "/{*.yaml}")
}
- Scaffold only detects variables in the module directory
terragrunt scaffold now reads input variables from the module
directory itself, matching what OpenTofu and Terraform load
for a root module. Previously it scanned subdirectories too,
so variable blocks defined in nested modules or examples
leaked into the scaffolded inputs even though the module
never exposes them.
- Resolve interpolated object keys in autoinclude blocks
terragrunt stack generate now resolves interpolated object
keys in autoinclude blocks (for example {
"${local.prefix}_key" = ... }), even when the value
references dependency.*. Previously the generated unit kept
the key verbatim, leaking a stack-only reference that is not
valid in the unit scope.
- Fix panic on non-string literal interpolation in autoinclude
templates
terragrunt stack generate no longer panics when an
autoinclude template interpolates a non-string literal (for
example "${0}" or "${true}") alongside a dependency.*
reference. The interpolated literal is now rendered to its
string form (${0} becomes 0) and the dependency reference is
preserved for the unit.
- Resolve transitive autoinclude dependencies on a stack
directory
run --all no longer fails with "does not contain a
terragrunt.hcl file" when an autoinclude dependency points at
a stack directory (one holding terragrunt.stack.hcl) and the
unit is reached transitively through another unit. The
dependency cycle check now skips a target with no unit
config, matching the direct dependency case.
* Experiments Updated
- Six experiments completed
The following experiments graduated to general availability
in this release, and the features they gated are now enabled
by default:
- stack-dependencies
- cas
- catalog-redesign
- mark-many-as-read
- opt-out-auth
- dag-queue-display
Each feature is described in the New Features section above.
The corresponding --experiment flags (and TG_EXPERIMENT
values) are no longer needed. Passing one still works, but
emits a warning about the completed experiment, so you can
drop it at your convenience.
Thank you to everyone who ran these experiments early and
filed the feedback that got them here.
* Process Updates
- Immutable releases
Starting with this release, Terragrunt releases are published
as immutable releases on GitHub. Once a release is published,
its tag and assets can no longer be modified or deleted, so
the binary you download is guaranteed to be the same binary
that was uploaded when the release was published.
- Install script verifies release attestations The install
script now checks downloaded release assets against the
release attestation that ships with immutable releases. For
releases starting with v1.1.0, when an authenticated GitHub
CLI (v2.81.0 or later) is available, the script verifies the
checksums file and the binary against the attestation before
installing, and aborts if either does not match the published
release. The check is skipped with a warning when gh is
unavailable, too old, or unauthenticated. Use
- -no-verify-attestation to opt out.
Commits
* Features
- feat: Tip how to run a stack's units when a stack filter
matches no units by @denis256 in #6387
* Bug Fixes
- fix: autoincludes variables interpolation by @denis256 in
[#6318]
- fix: generate overwrite of read-only CAS-materialized files
by @denis256 in #6329
- fix: CAS integration with committed module lockfiles by
@yhakbar in #6330
- fix: improved resolving of complex objects in keys by
@denis256 in #6317
- fix: Fixing update_source_with_cas integration with --no-cas
by @yhakbar in #6363
- fix: Adding support for adding/deleting files in Git diffs by
@yhakbar in #6352
- fix: Adding --terragrunt-boundary to mark_glob_as_read by
@yhakbar in #6351
- fix: Only detect variables in root directory of module by
@yhakbar in #6381
- fix: resolve transitive autoinclude dependency on a stack
directory by @denis256 in #6389
- fix: apply extra_arguments env_vars when resolving dependency
outputs by @denis256 in #6396
- fix: Fixing indenter style by @yhakbar in #6402
- fix: Fixing legacy Windows per-drive key for environment
variables by @yhakbar in #6412
- fix: Fixing Git materialization race HEAD update by @yhakbar
in #6411
- fix: fixed reference of dependency outputs in terraform hooks
by @denis256 in #6423
- fix: Fixing deleted changed files by @yhakbar in #6424
* Documentation
- docs: Documenting --parallelism tweaking considerations
better by @yhakbar in #6313
- docs: Adding TGS 'Terragrunt at scale' page by @yhakbar in
[#6307]
- docs: v1.1.0 changelog polish by @yhakbar in #6333
- docs: Improving performance docs by @yhakbar in #6332
- docs: Adding immutable releases docs by @yhakbar in #6337
- docs: Cleaning up 1.1.0 docs by @yhakbar in #6339
- docs: Updating provider size claims for provider cache server
docs by @yhakbar in #6341
- docs: Documenting Discovery as a term by @yhakbar in #6359
- docs: Cleaning up catalog tabs docs by @yhakbar in #6369
* Chores
- chore: marking as completed stack dependencies experiment by
@denis256 in #6249
- chore: Completing mark-many-as-read experiment by @yhakbar in
[#6310]
- chore: Completing cas experiment by @yhakbar in #6254
- chore: Addressing feedback from #6254 by @yhakbar in #6324
- chore: Completing dag-queue-display experiment by @yhakbar in
[#6320]
- chore: Completing opt-out-auth experiment by @yhakbar in
[#6321]
- chore: Dropping go-git by @yhakbar in #6325
- chore: Addressing PR #6325 feedback by @yhakbar in #6335
- chore: bump cicd to use opentofu 1.12.2 by @denis256 in #6343
- chore: Signing GHA update by @denis256 in #6340
- chore: multiple dependencies update by @denis256 in #6356
- chore: Updating CI w/ Terragrunt guide to have more accurate
screenshots by @yhakbar in #6357
- chore: drop usage of github.com/NYTimes/gziphandler by
@denis256 in #6364
- chore(deps): bump astro from 6.3.2 to 6.4.6 in /docs by
@dependabot[bot] in #6366
- chore: Completing catalog-redesign experiment by @yhakbar in
[#6271]
- chore: Bumping JS dependencies by @yhakbar in #6368
- chore: Adding release attestation verification to install
script by @yhakbar in #6344
- chore: Addressing weekly test stats by @yhakbar in #6354
- chore: Addressing #6351 feedback by @yhakbar in #6373
- chore: Adding mise.toml lockfile by @yhakbar in #6372
- chore: Making progress on lll by @yhakbar in #6377
- chore: autoinclude fuzzing tests improvements by @denis256 in
[#6342]
- chore: Expand pure testing through venv by @yhakbar in #6090
- chore: Dropping TestWindowsTflintIsInvoked by @yhakbar in
[#6382]
- chore: Continuing with progress on lll #2 by @yhakbar in
[#6385]
- chore: added CICD guard for detecting not run tests by
@denis256 in #6383
- chore: Addressing weekly tests stats (2026-06-22) by @yhakbar
in #6390
- chore: Addressing #6390 feedback by @yhakbar in #6391
- chore: go deps update by @denis256 in #6392
- chore: Running go fix ./... by @yhakbar in #6398
- chore(deps): bump actions/checkout from 6.0.2 to 7.0.0 by
@dependabot[bot] in #6394
- chore: Update cfg locking for units by @yhakbar in #6401
- chore: Move log flags off writers by @yhakbar in #6403
- chore: Adding env and writers to venv by @yhakbar in #6404
- chore: aws-sdk-go-v2/service/s3 upgrade by @denis256 in #6413
- chore: Downgrading render log to a debug by @yhakbar in #6429
- chore: Engine per unit shutdown by @yhakbar in #6426
* Other Changes
- Adding Terragrunt Patterns section by @karlcarstensen in
[#6379]
- Add FAQ section for docs.terragrunt.com by @karlcarstensen in
[#6378]
- Fixing codespell lint error and adding codespell lint
commands by @karlcarstensen in #6386
* Thu Jun 11 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 1.0.8:
* Performance Improvements
- Faster read-file tracking with the mark-many-as-read experiment
With the mark-many-as-read experiment enabled, Terragrunt
records every module file it marks as read during parsing.
The bookkeeping for that record scaled quadratically: each
new path was checked against every path recorded so far,
which got expensive for units with large local module
sources, and monorepos paid that cost again for every unit
and every command.
Recording a path now takes constant time no matter how many
paths came before it, and re-marking already-recorded files
is cheaper still. The reading lists reported by find and list
are unchanged.
* Bug Fixes
- assume_role: preserve commas inside list expressions
Terragrunt previously failed to correctly parse assume_role
attributes containing list values such as transitive_tag_keys
or policy_arns. Commas inside nested list expressions were
incorrectly treated as top-level separators, causing
generated configurations to fail with parsing errors.
assume_role = {
role_arn = "arn:aws:iam::123456789012:role/test-role"
transitive_tag_keys = ["Project", "Projects"]
}
This resulted in errors similar to:
Missing item separator; Expected a comma to mark the beginning of the next item.
Terragrunt now preserves commas inside nested list and object
expressions when parsing assume_role blocks, allowing
configurations containing array attributes to be processed
correctly.
- Completed experiments now evaluate as permanently enabled
Features gated behind a completed experiment were treated as
disabled instead of permanently enabled, so functionality
that graduated out of experiment status could silently stop
working.
The one affected code path was hcl validate --inputs with a
git filter expression such as --filter '[HEAD~1...HEAD]':
after the filter-flag experiment completed, the command
stopped preparing git worktrees for the filter. Git filter
expressions now work with hcl validate --inputs again,
matching find, list, and the other commands that accept
filters.
- Exposed-include resolution errors now name the include block,
file, and failing field
When resolving an include block with expose = true,
Terragrunt surfaced low-level parsing or conversion errors
with no indication of which include block, file, or field was
at fault. This was especially hard to debug for errors that
carry no source location, such as:
unsuitable value: a bool is required
The error is now annotated with the include block name, the
included (parent) file path, and a single dotted locator for
the failing field — the top-level config field (dependency,
inputs, locals, or feature) plus the attribute path within it
when go-cty can determine one:
exposed include "root" (/path/to/root.hcl): dependency.outputs["enabled"]: unsuitable value: a bool is required
When go-cty cannot resolve a precise attribute path, the
locator degrades to just the field name:
exposed include "root" (/path/to/root.hcl): dependency: unsuitable value: a bool is required
Errors that originate in HCL parsing already carry a source
range (file:line:column) and are preserved unchanged. This
narrows the search from the entire configuration tree to a
specific file and field.
- Intersecting a graph traversal with another filter no longer
drops the traversed components
A graph traversal combined with an intersected filter dropped
the components reached in discovery.
e.g., ...a-dependent | type=unit (the dependents of
a-dependent, intersected with type of units) returned only
a-dependent itself instead of its dependents, and git-change
traversals such as ...[HEAD~1...HEAD] | type=unit lost the
dependents of the changed units.
A component that matched both a graph expression target and a
positive filesystem or git filter was classified as
discovered before the graph traversal ran, so the traversal
never expanded from it. Terragrunt now checks graph
expression targets first, so intersecting a traversal with
another filter keeps the dependencies and dependents it
reaches.
- generate blocks now honor hcl_fmt
Terragrunt now accepts hcl_fmt on generate blocks and
preserves the setting when configurations are parsed,
written, and parsed again. This lets generated .tf, .hcl, and
.tofu files opt out of automatic HCL formatting by setting
hcl_fmt = false, matching the existing generate = { ... }
attribute-map behavior.
- Telemetry resource now honors OTEL_SERVICE_NAME and
OTEL_RESOURCE_ATTRIBUTES
Terragrunt previously hardcoded the service.name resource
attribute to terragrunt for every emitted trace and metric,
ignoring the standard OpenTelemetry environment variables.
Multiple Terragrunt invocations could not be distinguished in
an OpenTelemetry backend without an intermediate collector to
rewrite the attribute.
The resource is now composed via resource.New with
WithFromEnv() placed after Terragrunt's defaults, so
OTEL_SERVICE_NAME and OTEL_RESOURCE_ATTRIBUTES are honored on
every span and metric. Per the OpenTelemetry specification,
OTEL_SERVICE_NAME takes precedence over a service.name entry
in OTEL_RESOURCE_ATTRIBUTES. The default service.name remains
terragrunt when neither variable is set.
- s3:: sources: support virtual-hosted-style URLs
s3:: source URLs using the virtual-hosted-style S3 endpoint
format were rejected:
terraform {
source = "s3::https://my-bucket.s3.us-west-2.amazonaws.com/terraform/modules/myapp.zip"
}
This resulted in errors like:
ERROR downloading source url s3::https://my-bucket.s3.us-west-2.amazonaws.com/...
* URL is not a valid S3 URL
Terragrunt now accepts every AWS S3 endpoint form, including
virtual-hosted-style URLs
(<bucket>.s3.<region>.amazonaws.com) and modern path-style
URLs (s3.<region>.amazonaws.com).
- Windows console mode is restored when Terragrunt exits
On Windows, running a Terragrunt command from Nushell could
leave the shell unable to read input afterward, with
keystrokes such as the arrow keys appearing as raw escape
sequences instead of being interpreted.
While it runs, Terragrunt reconfigures the console it shares
with the parent shell so that terminal escape sequences are
processed, but it did not put the original mode back when it
exited. PowerShell reapplies its own console settings on
every prompt and recovers on its own, so the problem surfaces
only in shells that keep the inherited mode, such as Nushell.
Terragrunt now records the console mode at startup and
restores it on exit, returning the shell to the state it was
in beforehand.
Reported in #6245.
* Documentation Updates
- Clean Markdown is available for every docs page at <url>.md
Every docs page is now served as clean Markdown at the same
URL with .md appended. For example, /getting-started/install
is also available at /getting-started/install.md.
curl https://docs.terragrunt.com/getting-started/install.md
The .md version contains the page content without the site
navigation or other surrounding HTML, which makes it well
suited as context for LLMs and AI tooling: it is smaller and
carries only the documentation itself. Coverage includes
every page, including the CLI command reference and the
changelog.
This complements the existing llms.txt and llms-full.txt
files by providing a per-page Markdown source.
* Experiments Added
- optional-hooks — Add experimental --no-hooks flag support for
terragrunt run
The terragrunt run command now supports an experimental
- -no-hooks flag for disabling hook execution during command
runs.
The feature is gated behind the optional-hooks experiment and
skips execution of before_hook, after_hook, and error_hook
blocks when enabled.
TG_EXPERIMENT=optional-hooks terragrunt run --no-hooks plan
This feature is currently experimental because disabling
hooks changes Terragrunt execution semantics and may evolve
in future releases.
Using --no-hooks without enabling the optional-hooks
experiment will return an error.
- hook-context-env experiment exposes additional TG_CTX_* env
vars to hooks
Enable the new hook-context-env experiment to surface three
additional environment variables to every before_hook,
after_hook, and error_hook:
- TG_CTX_HOOK_TYPE — before_hook, after_hook, or error_hook,
identifying which lifecycle phase invoked the hook.
- TG_CTX_SOURCE — the resolved terraform source URL (CLI
- -source override, else evaluated terraform.source with
source-map applied, else .).
- TG_CTX_TERRAGRUNT_DIR — the directory of the current
Terragrunt config.
terragrunt run --all --experiment hook-context-env -- apply
These variables make it easier to share a single hook script
across lifecycle phases and to access the unit's source and
config directory without threading them through hook
arguments.
* Experiments Updated
- cas: fallbacks now emit telemetry
When the cas experiment is enabled and a CAS operation cannot
complete, Terragrunt falls back to a slower path (the
standard download client, or a temporary clone when the
shared git store is unavailable) and keeps going. Until now
the only record of a fallback was a warning in the logs,
which made it impractical to measure how often CAS degrades
across a fleet.
Each fallback now also emits a cas_fallback telemetry event
whose reason attribute identifies the cause: init_error,
getter_error, git_store_unavailable, probe_failure, or
stack_generation_error. Operators collecting OpenTelemetry
traces or metrics from Terragrunt can count and alert on
these events to judge CAS health before relying on it by
default.
- CAS flags for the catalog command
The catalog command now accepts the --no-cas and
- -cas-clone-depth flags, which were already available on run,
stack generate, and stack run. When --no-cas is set, catalog
repositories are cloned with plain Git even if the cas
experiment is enabled. --cas-clone-depth controls the git
clone --depth value the CAS uses when cloning catalog
repositories.
terragrunt catalog --experiment cas --cas-clone-depth=-1
- cas — update_source_with_cas requires a literal source string
When a catalog unit, stack, or terraform block set
update_source_with_cas = true with a source that was not a
literal string, rewriting silently produced a wrong source.
Interpolation such as "../units/${local.name}" had the
interpolated portion dropped, leaving a bare prefix; a
reference such as local.foo resolved to the directory
containing the block itself. In both cases stack generation
packaged the wrong directory without any error.
Stack generation now fails with an error explaining that
update_source_with_cas requires a literal source string.
Non-literal expressions, including interpolation, function
calls, and references like local.foo, are rejected.
- cas — Malformed cas:: references fail with a clear error
A cas:: source with a malformed hash, such as cas::sha1:a,
used to fail with an opaque internal error while looking the
hash up in the store.
CAS references are now validated up front: the hash must be
lowercase hexadecimal with exactly 40 characters for sha1 or
64 for sha256. References that don't match are rejected with
an error identifying the bad reference.
- cas — Repositories with submodules now clone correctly
Cloning a repository that contains git submodules through the
Content Addressable Store failed while ingesting the
repository:
git_cat_file: fatal: Not a valid object name <hash>
A submodule appears in the repository tree as a pointer to a
commit in another repository, so the object behind it cannot
be read from the repository being cloned.
The CAS now fetches each submodule from the URL registered in
.gitmodules at its pinned commit and materializes its
contents in place, including nested submodules. Relative
submodule URLs (such as ../sibling.git) are resolved against
the parent repository URL, matching git's behavior. Submodule
contents are stored and deduplicated like any other content,
so repeated clones reuse the cache.
- catalog-redesign — Failures now exit nonzero and name the
sources that failed
The redesigned catalog exited with code 0 even when it
failed: a session that ended on an unreachable repository, a
failed scaffold, or a failed copy reported success in its
exit code. Repositories that failed to load during discovery
were dropped too: the warning logged for each one was drawn
over by the full-screen interface, so a run where every
source failed showed the same "No catalog sources were
discovered" screen as a run that genuinely found nothing.
The catalog now exits nonzero when the session ends on a
failure: a discovery failure that leaves nothing to browse, a
failed scaffold, or a failed copy. Quitting a working session
still exits 0. When some sources fail to load while others
succeed, the catalog stays usable and a clean quit still
exits 0; the component list shows how many sources failed,
and the failed repositories are printed with their causes
after the catalog closes. When every source fails, the error
screen lists each failed repository instead of claiming
nothing was found, and dismissing it exits nonzero.
Running terragrunt catalog without an interactive terminal,
such as in CI, used to fail with a raw error from the
underlying TUI library:
bubbletea: error opening TTY: bubbletea: could not open TTY: open /dev/tty: no such device or address
It now fails immediately with an error stating that the
catalog command requires an interactive terminal.
- catalog-redesign — Scaffolding a component no longer fails
with a path-traversal error
Scaffolding a component from the catalog (pressing s) could
fail on macOS while downloading the source:
subdirectory component contain path traversal out of the repository
The catalog caches each repository under the system temporary
directory, which macOS reports through a symlink
(/var/folders/... pointing at /private/var/folders/...). The
source location Terragrunt handed to the downloader was built
against the unresolved path, so it pointed outside the cached
repository and was rejected.
Terragrunt now resolves the temporary directory before
discovering components, so the source stays inside the
repository and scaffolding proceeds.
- stack-dependencies: HCL tooling now handles autoinclude
Two tooling gaps around the experimental autoinclude block
are closed:
- hcl validate now validates autoinclude blocks. With the
stack-dependencies experiment enabled, validating a
terragrunt.stack.hcl that declares autoinclude runs the
same strict checks as terragrunt stack generate. A
malformed block (for example, a locals block inside
autoinclude) is now reported at validation time instead of
passing hcl validate and only failing later during
generation. Without the experiment, validation behavior is
unchanged.
- read_terragrunt_config() can read stack-level autoinclude
files. Reading a generated terragrunt.autoinclude.stack.hcl
previously failed because the file was decoded as a unit
configuration, which rejects its unit and stack blocks.
With the experiment enabled, the file is now decoded as the
stack-file fragment it is, returning its unit and stack
blocks the same way reading a terragrunt.stack.hcl does.
Unit-level terragrunt.autoinclude.hcl files already read
correctly and continue to do so.
- stack-dependencies: autoinclude merges like a regular include
A generated unit autoinclude (terragrunt.autoinclude.hcl) now
merges into the unit's config using the same default merge as
a regular include, which is a shallow merge, applied
uniformly across generation, full parse, and discovery.
Top-level keys from the unit and the autoinclude combine, and
on a conflict the autoinclude wins and replaces the unit's
value rather than deep-merging nested maps; locals stay local
in scope.
A generated stack autoinclude
(terragrunt.autoinclude.stack.hcl) injects unit and stack
blocks into the generated terragrunt.stack.hcl. An injected
block whose name matches an existing unit or stack now
overrides that block wholesale, consistent with unit
autoinclude override semantics, and an injected block with a
new name is added. This applies uniformly across generation,
full parse, and discovery, so a name match no longer produces
a duplicate-name error. A stack autoinclude may not declare a
top-level dependency block (stacks have no dependencies;
declare the dependency inside the target unit's own
autoinclude).
A dependency block injected through an autoinclude is now
available before a unit's remote_state is evaluated, so
referencing dependency.<name>.outputs.<key> there no longer
fails. remote_state now behaves the same as generate blocks.
- stack-dependencies: autoinclude blocks can reference values.*
An autoinclude block may now reference the stack's values.*.
Previously a values.* reference was rejected at stack
generate time, except in a dependency config_path. It now
resolves to a literal like local.*, unit.<name>.path, and
stack.<name>.path, wherever it appears: inputs, generate,
remote_state, mock_outputs, and config_path.
Function calls in an autoinclude now resolve at generate time
too, in the terragrunt.stack.hcl context, instead of being
kept verbatim and evaluated in the generated unit. Only a
dependency.* reference (a dependency's outputs) stays
verbatim and resolves inside the unit; in a mixed expression
the stack-level parts resolve and only the dependency.*
reference is kept.
Because functions now evaluate against the stack file rather
than the unit, directory and include functions report the
stack file's location: get_terragrunt_dir returns the stack
file's directory, and path_relative_to_include returns ".".
If you relied on these resolving in the unit, move them to
the unit's own configuration, or derive a per-unit value such
as a remote_state backend key from unit.<name>.path.
A locals block inside an autoinclude remains rejected;
declare stack-level locals in terragrunt.stack.hcl instead.
- stack-dependencies: stack dependencies resolve values.* in
the target stack's locals
Expanding a dependency that points at a generated stack
directory no longer fails when that stack's
terragrunt.stack.hcl reads values.* in its locals block.
Previously, terragrunt stack generate succeeded but
terragrunt run --all then failed with There is no variable
named "values" while expanding the dependency into its units.
Dependency expansion now reads the generated
terragrunt.values.hcl next to each terragrunt.stack.hcl it
visits, including nested stacks, so each nesting level
resolves values.* from its own values file, the same way a
full stack parse does.
- stack-dependencies: component path references in values no
longer break next to autoinclude blocks
A unit or stack block's values can reference unit.<name>.path
and stack.<name>.path even when another block in the same
terragrunt.stack.hcl declares an autoinclude. Previously, the
presence of any autoinclude block made stack generate reject
those references with Unknown variable; There is no variable
named "unit", while the same file without an autoinclude
generated fine.
* Features
- feat: add hook-context-env experiment by @arnaud-dezandee in
[#6189]
- feat: Adding CAS fallback telemetry by @yhakbar in #6298
* Bug Fixes
- fix: Fixing filter tests on Windows by @yhakbar in #6247
- fix: Fix Windows nushell bug by @yhakbar in #6250
- fix(codegen): fix assume_role parsing failure when
transitive_tag_keys or policy_arns arrays are present by
@Rahul-Kumar-prog in #5975
- fix: Fixing scaffold path traversal check by @yhakbar in
[#6255]
- fix(telemetry): honor OTEL_SERVICE_NAME and
OTEL_RESOURCE_ATTRIBUTES environment variables by @Tensho in
[#6256]
- fix: Fixing graph traversal bug with intersected filter by
@yhakbar in #6270
- fix: resolve locals in autoinclude mock_outputs by @denis256
in #6274
- fix: report the offending field in Terragrunt config errors
by @denis256 in #6284
- fix: Fixing values without autoinclude by @yhakbar in #6290
- fix: Fixing values references in locals of
terragrunt.stack.hcl files by @yhakbar in #6291
- fix: Fixing experiment promotion by @yhakbar in #6293
- fix: Adding support for submodules in CAS by @yhakbar in
[#6294]
- fix: Validating CAS sources by @yhakbar in #6296
- fix: Support autoinclude in hcl validate and fix
read_terragrunt_config() for configurations using autoinclude
by @yhakbar in #6297
- fix: Fixing legacy virtual hosted style S3 URLs by @yhakbar
in #6311
- fix: Addressing lint findings by @yhakbar in #6312
* Documentation
- docs: Documenting CAS Getters by @yhakbar in #6251
- docs: Support completedSince by @yhakbar in #6252
- docs: Since/Before cleanup by @yhakbar in #6277
- docs: Since/Before cleanup workflow by @yhakbar in #6276
- docs: Support .md changelog files by @yhakbar in #6286
- docs: Adding autoinclude documentation by @yhakbar in #6299
* Chores
- chore: weekly tests reporting by @denis256 in #6191
- chore: Add thanks for #5975 by @yhakbar in #6253
- chore: autoinclude merge fixes by @denis256 in #6248
- chore: cleaned unused code by @denis256 in #6260
- chore: Add CodeRabbit release check by @yhakbar in #6278
- chore(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1
by @dependabot[bot] in #6265
- chore(deps): bump docker/setup-docker-action from 5.1.0 to
5.2.0 by @dependabot[bot] in #6266
- chore(deps): bump aws-actions/configure-aws-credentials by
@dependabot[bot] in #6267
- chore: Make autoinclude more flexible, supporting values.* by
@yhakbar in #6283
- chore: Threading venv through CLI by @yhakbar in #6089
- chore: Isolate test git servers by @yhakbar in #6233
- chore: Add --no-cas flag to the catalog command by @yhakbar
in #6292
- chore: Clean up from #6290 by @yhakbar in #6295
- chore: Adding DAG view tests by @yhakbar in #6300
- chore: Speeding up files read by @yhakbar in #6301
* Other Changes
- Make guides collapsed to start by @karlcarstensen in #6262
- Fix for light/dark mode by @karlcarstensen in #6264
- Collapse reference section by @karlcarstensen in #6263
- serve clean Markdown at .md for every page by @karlcarstensen
in #6281
- Feature/optional hooks experiment by @Rahul-Kumar-prog in
[#6227]
- Update to llms.txt. Added curated llms.txt and configured
plugin to also serve full and small by @karlcarstensen in
[#6280]
- Changelog by @karlcarstensen in #6285
- Fix #5054: support hcl_fmt in generate blocks by @DadaVinqi
in #6287
- fix Fixing catalog exit codes by @yhakbar in #6302
* Tue Jun 02 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 1.0.7:
* New Features
- tfr:// source URLs accept an optional version
The version query parameter on tfr:// source URLs is now
optional. When omitted, Terragrunt queries the registry's
list-versions endpoint and downloads the latest stable
version, matching how OpenTofu and Terraform resolve a module
reference that has no version constraint.
terraform {
source = "tfr:///terraform-aws-modules/vpc/aws"
}
Prereleases are excluded from resolution, so a registry that
only publishes 4.0.0-rc1 alongside 3.3.0 will pin to 3.3.0.
Pin a version explicitly with ?version= when you need
reproducible builds or want to opt into a prerelease.
* Bug Fixes
- update_source_with_cas: preserve //subdir on a unit's
terraform.source
When a unit's terraform.source used the // subdir convention
(for example, source = "../..//modules/foo") and opted into
update_source_with_cas, the rewritten source dropped the
//subdir tail and the synthetic tree contained only the leaf
module's files. A module that referenced a sibling via a
relative path (source = "../bar") could not resolve that
reference after materialization.
Rewrites now preserve the original //subdir (for example,
cas::sha1:<hash>//modules/foo), and the synthetic tree is
rooted at the path before //, so sibling files reachable via
relative paths land in the materialized working directory.
Sources without // are unchanged: the tree stays scoped to
the leaf module, and the rewritten reference has no //subdir
tail.
- --filter now detects affected units on Windows
On Windows, terragrunt find --filter '[origin/main...HEAD]'
(and its variants) returned no affected units even when git
diff reported changed files. The source= and reading= filters
were affected by the same problem.
Filter glob patterns are always written with forward slashes,
but the affected-unit comparison was being made with Windows
backslash separators, so nothing matched. Terragrunt now
compares paths consistently with forward slashes on every
platform, and the filter detects changed units on Windows as
it already did on Linux and macOS.
Reported in #6214.
- startswith, endswith, strcontains, and run_cmd no longer
panic on malformed calls
Calling startswith, endswith, or strcontains with the wrong
number of arguments (for example a single argument instead of
two) crashed Terragrunt instead of reporting a configuration
error. Calling run_cmd with only option flags and no command
(for example run_cmd("--terragrunt-quiet")) crashed the same
way.
These calls now return a clear error: a
wrong-number-of-parameters error for the string functions,
and an empty-command error for run_cmd.
- The --parallelism flag no longer accepts non-positive numbers
Previously, terragrunt commands that accept the --parallelism
flag (or equivalently the $TG_PARALLELISM environment
variable) used to hang indefinitely when invoked with
- -parallelism=0.
Terragrunt now validates that the value is positive and exits
with an error otherwise.
Reported in #6211
* Experiments Updated
- cas — content-addressing for non-git sources
CAS now covers module sources beyond git: http(s), Amazon S3,
Google Cloud Storage, and Mercurial. Repeat runs against an
unchanged remote reuse the cached tree instead of downloading
the bytes again.
Before fetching, CAS issues a cheap remote probe (an HTTP
HEAD, an S3 object-attributes lookup, a GCS metadata read, or
hg identify) to derive a cache key without pulling the
source. On a hit, the cached tree is linked directly; on a
miss, or when the remote exposes no usable signal, CAS
downloads the source, ingests it, and keys the resulting tree
by its content hash. A remote that publishes a new version
under the same address pins to a new entry, so a stale cache
cannot serve outdated bytes.
- cas — OpenTofu/Terraform registry sources
Module sources of the form tfr://... are now
content-addressed in CAS. Repeat runs against the same pinned
registry version reuse the cached module instead of
re-downloading the archive from the registry.
CAS resolves a tfr:// source by asking the registry where the
underlying archive lives and uses that resolved URL as the
cache key. Two runs that pin the same version share one
entry; a republish under the same version pins to a new
entry, so a stale cache cannot serve outdated bytes.
- stack-dependencies: unit.<name>.path and stack.<name>.path
resolve in values
The stack-dependencies experiment now exposes
unit.<name>.path and stack.<name>.path when evaluating the
values attribute of a unit or stack block, not only inside
autoinclude blocks. A parent stack can pass the generated
path of a sibling component down into a child stack, so a
unit nested in that child stack can depend on a unit that
lives at a different level of the hierarchy.
unit "vpc" {
source = "../catalog/units/vpc"
path = "vpc"
}
stack "app" {
source = "../catalog/stacks/app"
path = "app"
values = {
vpc_path = unit.vpc.path
}
}
A unit inside the app stack reads values.vpc_path and uses it
as the config_path of an autoinclude dependency, wiring the
cross-level relationship at generation time. Paths follow the
same layout the generator produces, including
no_dot_terragrunt_stack on the referenced block.
- stack-dependencies: simplified unit.* / stack.* ref shape
The stack-dependencies experiment no longer resolves
stack.<name>.<unit_name>.path or
stack.<name>.<nested_stack>.path. Only the top-level
stack.<name>.path and unit.<name>.path forms remain.
stack.<name>.name and unit.<name>.name are gone too; both
only ever echoed the label that the reference already had to
spell out.
Nested references required parsing every nested catalog up
front and conflicted with the reserved name and path
attributes on each ref: a nested unit named name or path
could not be addressed.
To depend on a generated unit inside a stack, compute the
path as ${stack.<name>.path}/<unit-relative-path> directly.
The layout under a stack's generated directory follows
no_dot_terragrunt_stack on the parent stack and on each unit,
so hand-computed paths must mirror that resolution.
- stack-dependencies: .terragrunt-stack-origin no longer
written
Terragrunt no longer writes the .terragrunt-stack-origin file
when generating nested stacks. Set update_source_with_cas =
true on your unit and stack blocks if you would like relative
paths in your catalog to resolve correctly instead.
* What's changed
- docs: Cleaning up changelogs for v1.0.7 (#6246)
- chore: Modernizing using gopls (#6232)
- chore: Adding no `//` path test for source with CAS (#6239)
- chore: Ensuring full support for tfr in CAS (#6123)
- fix: Fixing git filters on Windows (#6242)
- chore: Go and GHA dependencies (#6240)
- docs: Fixing unreleased changelog page (#6237)
- fix: Fixing stack autoinclude (#6236)
- fix: Fixing stack path variables in values (#6235)
- validate that `--parallelism` value is positive (#6212)
- fix: Fixing nested generation for paths with `//` (#6234)
- chore: Increasing test coverage for stack dependencies
(#6231)
- chore: Fixing gopls workflow (#6229)
- docs: Cleaning up experiment docs (#6228)
- chore(deps): bump actions/stale from 10.2.0 to 10.3.0 (#6201)
- fix: Fixing synthetic trees for `terraform.source` URLs with
`//` (#6218)
- chore: stacks dependencies simplificaitons (#6171)
- chore: Make clone tests a bit faster (#6081)
- chore: added unknown-unknowns heuristics for coderabbit
(#6220)
- chore: Addressing UI/UX feedback for interactive scaffold in
catalog (#6175)
- chore: Adding separate archive field (#6196)
- chore: tests simplification (#6208)
- chore: Removing `go-errors` as a dependency (#6182)
- fix: Allowing all TG HCL fns in `terragrunt.stack.hcl`,
including `autoinclude` (#6166)
- fix: panics in startswith / endswith / strcontains / run_cmd
(#5984)
- fix: Removing use of `cas.WithFS` (#6195)
- feat: Supporting all getters in CAS (#6076)
- feat: Make version optional in `tfr://` module registry URLs
(#6112)
- chore: Consolidating on lipgloss for color (#6188)
- chore: improved coderabbit rules (#6193)
- chore: Getting rid of `go-homedir` direct dependency (#6184)
- chore: Getting rid of `fatih/structs` dependency (#6186)
* Fri May 29 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 1.0.6:
* Bug Fixes
- terragrunt no longer hangs when download_dir is a non-hidden
subdirectory of the unit
Setting download_dir (via the attribute, --download-dir, or
TG_DOWNLOAD_DIR) to a subdirectory of the unit's working
directory whose name did not start with a dot caused commands
that prepare the OpenTofu or Terraform source (apply, plan,
run, and similar) to hang.
For example:
[#] /infra/web/terragrunt.hcl
download_dir = "cache"
terraform {
source = "./mod"
}
Here terragrunt apply would copy ./mod into cache/, see the
new cache/ directory on the next read of the unit, and
recurse into it. The default .terragrunt-cache was unaffected
because Terragrunt's source-copy step skips any directory
whose name starts with a dot.
These configurations now produce an immediate error
identifying the source and destination paths.
- mark-many-as-read experiment now triggers during discovery
With the mark-many-as-read experiment enabled, a unit whose
terraform { source = ... } pointed at a local module did not
show up under --filter 'reading=' filters that referenced
files inside that module. Discovery would parse the unit, but
the module files were never recorded as read, so the reading
filter attribute could not match and the queue came back
empty.
The module walk now runs on the discovery code path as well,
so changes to files in a local module source flow through to
the units that depend on them.
- terragrunt render no longer crashes on exclude or catalog
blocks with certain attributes
Rendering a config crashed with a value has no attribute of
that name panic before any output could be produced when:
- the exclude block set no_run, or
- the catalog block set default_template, no_shell, or
no_hooks.
These attributes are now carried through the render pipeline
alongside the other fields on their respective blocks, so
both blocks round-trip cleanly. terragrunt render no longer
crashes on multiple errors.ignore blocks with mismatched
signals
Rendering a config that defined more than one errors.ignore
block crashed with an inconsistent list element types panic
when the signals map was populated on one block and absent
(or differently typed) on another. The same crash showed up
in dependency-output evaluation, since both paths build the
same rendered representation of the config.
Each ignore block is now rendered with a uniform shape.
Indexed access (errors.ignore[0]), length, and iteration
still work, and the signals map on each block is preserved as
written.
- Suppress spurious Unknown variable: dependency errors during
dependency resolution
terragrunt plan and apply no longer print ERROR Error:
Unknown variable "dependency" lines when a unit pulls in a
shared include (e.g. via find_in_parent_folders) that
references dependency.* outputs. The plans completed
correctly, but the error lines cluttered CI logs.
Resolves #6036.
- terragrunt stack commands no longer crash on stacks with
multiple units
Running terragrunt stack output (or any command that resolves
concurrently parsing multiple configuration files) against a
stack with several units could intermittently crash while the
units were being parsed in parallel due to a race on internal
bookkeeping of files read (used in the reading filter
attribute).
Parallel unit parsing now coordinates safely when recording
which source files were read, preventing crashes.
- terraform_binary properly respected when both tofu and
terraform are on PATH
A regression in command execution caching resulted in
over-caching the STDOUT result of tofu --version when both
tofu and terraform were available on PATH and
terraform_binary was set. Early on in the execution flow,
Terragrunt checks if OpenTofu is installed what its version
is to determine if it supports setting of the automatic
provider cache directory. This resulted in the value of
terraform_binary being ignored for later version checks to
assess compliance with terraform_version_constraint.
The version-detection cache used per run is now scoped to the
binary that produced each entry, so the version recorded
against an early default-binary resolution no longer leaks
into the later resolution that honors terraform_binary.
* Experiments Added
- deep-merge experiment adds a deep_merge HCL function
Enable the new deep-merge experiment to use the
deep_merge(map1, map2, ...) HCL function.
deep_merge recursively merges map and object values. Later
arguments override earlier arguments for overlapping keys,
nested maps are merged recursively, lists are appended, and
null arguments are ignored.
This is useful when composing inputs from multiple decoded
JSON, YAML, or HCL-derived maps:
locals {
config_json_files = sort(fileset(get_terragrunt_dir(), "*.json"))
config = deep_merge([
for file in local.config_json_files :
jsondecode(file("${get_terragrunt_dir()}/${file}"))
]...)
}
inputs = local.config
Calling deep_merge without enabling the deep-merge experiment
returns an error.
- opt-out-auth — Opt out of --auth-provider-cmd during
discovery
Enable the new opt-out-auth experiment to use
- -no-discovery-auth-provider-cmd (env:
TG_NO_DISCOVERY_AUTH_PROVIDER_CMD), which disables the auth
provider command during the discovery phase.
Without the flag, Terragrunt assumes that --auth-provider-cmd
must be run per parsed component during the discovery phase
so that it can reliably resolve HCL functions such as
get_aws_account_id and run_cmd. On large repositories with
run --all --filter='reading=', this dominates wall-clock time
because the auth command runs for every discovered unit
rather than only the subset that will run.
The --no-discovery-auth-provider-cmd flag turns off auth
invocations during discovery. The auth provider command still
runs normally when running units.
Units whose discovery-relevant blocks depend on credentials
produced by --auth-provider-cmd will fail to parse with the
flag set. Use it when you know that parsing will resolve
successfully without any authentication done beforehand by
Terragrunt.
While this flag is experimental, you must also opt-in to the
opt-out-auth experiment by setting the TG_EXPERIMENT
environment variable to opt-out-auth or by passing the
- -experiment=opt-out-auth flag to terragrunt run. This flag
might experience breaking changes based on community feedback
for the duration of the experiment.
e.g.
terragrunt run --all \
- -experiment=opt-out-auth \
- -no-discovery-auth-provider-cmd \
- -queue-include-units-reading=./changed-file.txt \
plan
* Experiments Updated
- catalog-redesign — Interactive scaffold form on s
Pressing s from the catalog list or detail view now opens an
in-TUI form that prompts for every variable/value the
selected component exposes. The form is modal: in navigate
mode j and k (or the arrow keys) move between fields and
enter interacts with the focused one. Required entries are
flagged, and optional entries show their default in a muted
style until the user opts in.
enter on a text or HCL field switches the form into edit
mode. Typing edits the value in place; esc returns to
navigate. Only fields the user actually changes get written
to the generated file, and optional defaults stay implicit,
so the result is leaner than the placeholder flow.
enter on a boolean field toggles between [x] true and [ ]
false directly, without a separate edit mode.
x on an optional field marks it "use default" again, removing
any in-progress value and leaving the source's default to
apply.
Complex types (lists, maps, objects) accept raw HCL and are
validated before the file is written, so a typo surfaces
inline rather than producing a broken terragrunt.hcl or
terragrunt.values.hcl file.
ctrl+d finishes the form. Required fields the user never set
still write as # TODO: fill in value so the rest of the file
is usable.
S (capital) keeps the previous placeholder-only flow,
generating the same TODO-laden file as before for users who
prefer to populate values by editing the generated file.
- stack-dependencies: parser tolerates HCL expressions
throughout terragrunt.stack.hcl
The stack-dependencies experiment now defers evaluation of
source, path, values, and include.path until each unit or
stack block is parsed on its own. As a result, autoinclude
resolution during stack generation and run --all discovery no
longer fall over when other parts of a stack file use
Terragrunt functions, local.*, or values.*. A few adjacent
behaviors are tightened up at the same time.
- Autoinclude resolves even when sibling units use
expressions.
Before 1.0.6, if any unit in a stack file used a function
call or a local.* / values.* reference in source, path, or
values, generating an autoinclude on a different unit in
the same file could fail. The parser now leaves those
expressions alone until they're needed, so an unrelated
unit can carry an autoinclude block without being blocked
by its neighbors:
locals {
shared_region = "us-east-1"
}
unit "account" {
source = "${get_terragrunt_dir()}/../catalog/units/account"
path = "account"
values = {
account = values.account
region = local.shared_region
}
}
unit "roles" {
source = "${get_terragrunt_dir()}/../catalog/units/roles"
path = "roles"
autoinclude {
dependency "account" {
config_path = unit.account.path
}
}
}
- include blocks in terragrunt.stack.hcl accept computed
paths.
The path attribute on an include block can be an HCL
expression, not just a string literal. An autoinclude block
in the included file is resolved normally after the include
merges in:
include "shared" {
path = find_in_parent_folders("shared.stack.hcl")
}
* What's Changed
- chore: Fixing sops tests (#6187)
- fix: Fixing `download_dir` copy infinite recursion (#6169)
- chore: Removing `go-commons` dependency (#6180)
- chore: Clean up strict control debug message (#6178)
- chore: Clean-up of comments from #6174 (#6179)
- chore: Bumping golang deps from #6164 (#6177)
- fix: Fixing `mark-many-as-read` for discovery (#6174)
- docs: Enhance documentation for `--out-dir` usage (#6176)
- chore: Increasing virtualization further (#6084)
- fix: Upping strict control test coverage (#6080)
- fix: Reducing spurious unknown variable dependency errors
(#6060)
- chore: Plumbing in `vfs` to `getter` (#6070)
- feat: Add TUI interactivity for `catalog` scaffold (#6162)
- fix: Fixing panic in ignore signal (#6167)
- chore: Addressing feedback from #6148 (#6168)
- fix: Fixing tf binary version over-caching (#6148)
- docs: Cleaning up changelog for stack dependencies permissive
parser (#6163)
- chore: google dependencies update (#6161)
- chore: stacks dependencies variables (#6072)
- chore: Removing `setup-go` from Windows signing (#6158)
- feat: Allow opt-out from auth in discovery (#6119)
- chore: Trimming JS deps (#6159)
- chore(deps): bump the js-dependencies group across 1
directory with 12 updates (#6156)
- chore(deps): bump DavidAnson/markdownlint-cli2-action (#6155)
- chore(deps): bump peter-evans/create-pull-request from 8.1.0
to 8.1.1 (#6154)
- chore(deps): bump jdx/mise-action from 4.0.0 to 4.0.1 (#6153)
- feat: add deep_merge HCL function as experiment (#5535)
- docs: added filtering of versions based on latest release
(#6149)
- Implement IndexNow (#6150)
- fix: Fixing files read race (#6145)
- fix: Fixing panic in `render` `WriteTo` (#6144)
- chore: Fixing release bug fix notification (#6143)
* Tue May 19 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 1.0.5:
* New Features
- Full .terraform.lock.hcl files from the provider cache server
When the provider cache server is used against the OpenTofu
provider registry, Terragrunt now writes .terraform.lock.hcl
files containing h1: hashes for every platform the registry
supports. A single terragrunt init produces a lock file that
works on every platform, removing the need to run tofu
providers lock -platform=... separately for each target
architecture.
provider "registry.opentofu.org/hashicorp/null" {
version = "3.2.2"
constraints = "3.2.2"
hashes = [
"h1:+1mRmfyz6oA00IhrrSkHK3h/Mdh032x2p0F6OMdMo5s=",
"h1:FjLTqvaaYo+vHN8pHZB1cOwEGiNzOj+I9kQyHmr9/7o=",
[#] ... one entry per supported platform ...
"zh:00e5877d19fb1c1d8c4b3536334a46a5c86f57146fd115c7b7b4b5d2bf2de86d",
[#] ... one entry per supported platform ...
]
}
The hashes come from the registry's per-platform download
response. When the registry does not supply them (for
example, a third-party registry that has not adopted the
field), Terragrunt falls back to its previous behavior of
writing an h1: hash for the current platform plus zh: hashes
for every platform listed in the shasums document.
Thanks to the OpenTofu team
This feature builds on work done by the OpenTofu team to
expose per-platform hashes directly from the OpenTofu provider
registry. Starting with OpenTofu 1.12, tofu init populates
.terraform.lock.hcl with hashes for every supported platform
out of the box, with no tofu providers lock invocation
required. Users on older OpenTofu versions still get the same
lock files when running through Terragrunt's provider cache
server, but upgrading to 1.12 is the easiest way to get the
same behavior everywhere, including when using the automatic
provider cache dir.
* Performance Improvements
- stack output fetches unit outputs in parallel
terragrunt stack output now fetches outputs from multiple
units at the same time, which is noticeably faster on larger
stacks. Use the existing --parallelism flag (or
TG_PARALLELISM) to lower concurrency if you need to.
terragrunt stack output --parallelism 4
* Tips Added
- Stack-target hint when --filter is missing | type=stack
run and stack generate now emit a tip when a --filter path
resolves to a directory containing terragrunt.stack.hcl but
the filter is not restricted to stacks. Without | type=stack,
stack generate ignores the filter and run does not generate
that stack.
The tip prints the offending filter, the suggested rewrite,
and a link to the filter docs. Suppress it with --no-tip
stack-target-missing-type-stack or --no-tips.
* Bug Fixes
- Auth provider command returning null no longer crashes
Terragrunt
If the command configured via --auth-provider-cmd wrote the
JSON value null to stdout, Terragrunt crashed with a nil
pointer dereference before it could obtain credentials.
A null response is now treated as an empty response: no
environment variables and no credentials are applied, and the
run continues.
- Auto-init now re-runs after a source change when modules are
already cached
terragrunt plan/apply could fail with Error: Required plugins
are not installed after a source-version change in any unit
with a module "" block. The .terragrunt-init-required marker
written on source change was being ignored because
modulesNeedInit short-circuited as soon as
.terraform/modules/ existed.
The marker check now lives at the top of needsInitRunCfg and
is honored regardless of cached .terraform/modules/ contents.
- --download-dir is now respected through dependency blocks and
read_terragrunt_config
A custom download directory set via --download-dir (or
TG_DOWNLOAD_DIR) was honored for the unit being run, but lost
as soon as parsing crossed into another config. dependency
blocks and read_terragrunt_config() would fall back to the
dependency's local .terragrunt-cache next to its
terragrunt.hcl, ignoring the user-set path.
TG_DOWNLOAD_DIR=/tmp/tg-cache terragrunt run --all plan
[#] Root unit: outputs landed in /tmp/tg-cache ✓
[#] Dependency outputs: written next to each dependency's terragrunt.hcl ✗
When the parsing context switches to a new config path, the
download directory is now updated only if it still points at
the previous module's default location. A user-supplied path
never matches any module's default and is carried through
every dependency hop unchanged.
- remote_state — apply tags during DynamoDB lock table creation
Terragrunt previously applied dynamodb_table_tags to DynamoDB
lock tables after table creation rather than during the
initial CreateTable API request.
This caused failures in environments enforcing required AWS
resource tags through SCPs or tag policies, where tags must
be present at resource creation time.
Terragrunt now includes dynamodb_table_tags in the initial
DynamoDB table creation request during remote state
bootstrap.
remote_state {
backend = "s3"
config = {
bucket = "my-state-bucket"
dynamodb_table = "terraform-locks"
dynamodb_table_tags = {
Environment = "prod"
Team = "platform"
}
}
}
- Engine archive extraction rejects path-traversal entries
When Terragrunt extracted an engine archive while the engine
experiment was active, entries whose target path resolved
outside the extraction directory were not rejected correctly.
Such an entry could overwrite files anywhere the Terragrunt
process could write.
These entries are now rejected early with a descriptive error
before any bytes are written. Engine archives produced by
Gruntwork were never affected; the gap only mattered for a
tampered or untrusted archive.
- --filter combined with a negation no longer parses excluded
units
When a positive path filter was combined with a negated one,
Terragrunt classified any unit that matched neither
expression as requiring defensive parsing before exclusion
instead of being excluded early.
e.g.
$ terragrunt run --all --filter './foo' --filter '!./baz'
[#] If `./bar` existed on disk, it would be parsed before being excluded. This is no longer the case.
Any positive filepath filter now consistently results in
units that cannot be discovered during Terragrunt discovery
being excluded from parsing for evaluating candidacy of
inclusion. When a sufficiently complex filter is present,
like the following:
$ terragrunt run --all --filter './foo' --filter '!./baz' --filter 'reading=root.hcl'
[#] If `./bar` existed on disk, it will still be parsed before being excluded to determine if it reads `root.hcl`.
- Fixed 403 Forbidden on nested private modules when using the
provider cache server
With TG_PROVIDER_CACHE enabled, OpenTofu/Terraform sent
nested module-registry lookups to the upstream registry with
the cache server's API key as the bearer token, instead of
the credentials configured for that host. Private registries
rejected those requests:
Error: Error accessing remote module registry
Failed to retrieve available versions for module "<name>" from
<registry>: error looking up module versions: 403 Forbidden.
Terragrunt sets TF_TOKEN_<host> to the cache server's API key
so the cache can front provider downloads. Module-registry
requests bypassed the cache and went straight to the
upstream, so the registry saw the cache key instead of the
user's token.
The cache server now also fronts the modules.v1 endpoint for
each configured registry. It drops the inbound cache-server
bearer, looks up the user's credentials for the upstream host
from the loaded CLI config (TF_TOKEN_<host>,
~/.terraform.d/credentials.tfrc.json, etc.), and forwards the
request with that token.
- Run report file generation no longer stalls or deadlocks with
many runs
Generating a run report via --report-file could stall or
deadlock when a queue contained many runs and some were still
recording their final status as the report was written.
Reports now serialize each run independently, so writing a
report no longer blocks status updates from runs that are
still finishing.
- Declining a run --all or --graph confirmation no longer skips
cleanup
When terragrunt run --all destroy (or --all state, --all
apply, or the equivalent --graph variants) prompted for
confirmation and the user answered "no", Terragrunt
terminated the process directly, skipping cleanup the run had
registered.
Cleanup now runs before Terragrunt exits.
- s3:: and gcs:: stack sources now download
Stack file source URLs starting with s3::https:// or
gcs::https:// previously failed with a credentials error even
when valid credentials were available. They now download.
Existing stack files need no change.
Plain https://www.googleapis.com/storage/... URLs are now
intended to download anonymously without GCP credentials, but
Terragrunt continues to use GCS credentials to download them
for backward compatibility, emitting a deprecation warning
the first time it does so. To opt into the new behavior,
enable the legacy-gcs-public-prefix strict control. To pull
from a private GCS bucket explicitly, prefix the URL with
gcs:: yourself.
- Fixed nested key order in terragrunt stack output
When a unit lived inside more than one nested stack,
terragrunt stack output rendered its key with the stack names
reversed, so a unit inside root_stack_3 > stack_v3 > stack_v2
appeared under stack_v2.stack_v3.root_stack_3 instead of
root_stack_3.stack_v3.stack_v2. Deeply nested units also
leaked to the top level of the output.
The output now joins stack names from outermost to innermost,
matching the declared hierarchy in both the HCL and JSON
formats.
- Fixed failed to create directory ...: file exists from the
provider cache server
If a previous run had cached a provider by symlinking
~/.terraform.d/plugins/<provider> into Terragrunt's own
provider cache, and that user plugin directory was later
moved or deleted, the symlink was left dangling. The next run
failed with failed to create directory ...: file exists and
refused to cache the provider.
Terragrunt now removes a dangling symlink at the cache path
on the next run and proceeds to download the provider. A
non-symlink at that path is left in place and surfaced as an
error.
* Experiments Added
- azure-backend — Native Azure Storage (azurerm) remote-state
support
The azure-backend experiment has been added as the gate for
native Terragrunt support of the Azure Storage (azurerm)
remote-state backend. Once it stabilizes, Terragrunt will
bootstrap, delete, and migrate Azure storage accounts and
blob containers the same way it already does for S3 and GCS,
and read state directly from Azure blobs for
- -dependency-fetch-output-from-state.
In this release the flag is reserved only. Enabling it has no
behavioral effect, and remote_state { backend = "azurerm" }
continues to pass through to the OpenTofu and Terraform
native azurerm backend.
Track progress and share feedback in #4307. For setup steps,
see the experiment documentation.
* Experiments Updated
- CAS keeps a central Git store for incremental fetches
CAS now keeps one bare Git repository per remote URL inside
its store, under ~/.cache/terragrunt/cas/store/git/ on Linux
by default. See Storage for where this lives on macOS and
Windows. On a cache miss, Terragrunt fetches just the
requested ref into that repository instead of running a fresh
shallow clone into a temporary directory. Repeated misses
against the same remote reuse the existing pack files, so
fetching a second ref from the same repository transfers only
the new objects.
Concurrent Terragrunt runs against the same remote URL share
one fetch instead of cloning in parallel; later runs reuse
what the first one transferred. If the shared fetch hangs or
fails, Terragrunt logs a warning and falls back to a
temporary clone so cloning still succeeds.
You can reclaim space at any time by deleting the git/
subdirectory:
rm -rf ~/.cache/terragrunt/cas/store/git
- cas — Commit SHAs accepted in ref=
Source URLs of the form git::<url>?ref=<commit-sha> now
resolve through CAS. Previously these clones failed because
Terragrunt asked the remote to look up the SHA as a symbolic
reference, which Git servers don't support.
Both full SHAs (SHA-1 and SHA-256) and abbreviated SHAs are
accepted. Abbreviated SHAs must disambiguate inside the
repository, the same rule Git itself applies.
terraform {
source = "git::https://github.com/acme/infrastructure-modules.git//vpc?ref=a1b2c3d4e5f67890abcdef1234567890deadbeef"
}
The first cold clone of a repository pinned to a commit SHA
fetches the full history of every branch. Shallow fetches
require a ref name, and fetching a commit SHA at limited
depth depends on a server option
(uploadpack.allowAnySHA1InWant) that is not universally
enabled, so CAS fetches all branches at full depth and
resolves the SHA locally. Subsequent clones reuse the cached
repository and never touch the network for the same commit.
Branch and tag refs continue to use the existing shallow
path.
- cas — mutable attribute on terraform, unit, and stack blocks
A new mutable attribute opts a block out of CAS hardlinking
when its source is fetched through CAS. With mutable = true,
files materialized into .terragrunt-cache (for terraform) or
.terragrunt-stack (for unit and stack) are copied from the
CAS store and the working tree is editable.
The default is false. Files are materialized read-only so an
accidental edit cannot reach back into the shared CAS store.
terraform {
source = "git::https://github.com/acme/infrastructure-modules.git//vpc?ref=v1.0.0"
mutable = true
}
The flag is orthogonal to update_source_with_cas and has no
effect when content is fetched through the standard download
path, which already produces an independent copy.
- cas — update_source_with_cas now idempotent across unit and
stack blocks
A terragrunt.stack.hcl with two blocks pointing at the same
template directory used to fail stack generate when each
block had update_source_with_cas = true. The first block's
pass rewrote the shared template's source to a
cas::sha256:... reference, then the second block's pass
re-read the rewritten file and treated the reference as a
relative path.
CAS now skips re-processing a source once it already carries
the cas:: prefix, so multiple unit or stack blocks can share
a template and resolve to the same synthetic tree.
- cas — symlinks in the source repository
Source repositories fetched through CAS used to materialize
committed symlinks as regular files whose contents were the
link target path. The destination tree no longer matched the
upstream layout, and any tooling that followed the link saw
plain text instead.
CAS now writes a real symbolic link at the destination.
Symlink targets that resolve outside the destination tree are
rejected so a hostile or stale source cannot escape the
working directory.
- catalog-redesign — component tags
The catalog-redesign experiment now reads a tags field from
the component's README.md front-matter. Tags appear as
colored pills next to the component in the list view and in
the detail view above the rendered README.
<!-- Frontmatter
name: VPC App
description: A VPC for application workloads.
tags: [networking, aws, module]
- ->
Either inline-array or dash-list YAML form is accepted. Tags
render in gray by default. When a tag matches a known
component-type name (module, template, unit, or stack,
case-insensitive), the pill takes on that type's color.
A tag matching a component-type name also promotes the
component into that type's tab. A template whose tags include
module appears under both Templates (by its native kind) and
Modules (by tag), without changing how it scaffolds.
To learn more, see Component tags.
https://docs.terragrunt.com/features/catalog/tui#component-tags
* Dependencies
- chore: add support for Opentofu 1.12 (#6134)
- chore(deps): bump sigstore/cosign-installer from 4.0.0 to
4.1.2 (#5772)
- chore(deps): bump actions/cache from 5.0.3 to 5.0.5 (#5735)
- chore(deps): bump fast-xml-builder (#6105)
- chore(deps): bump fast-xml-parser and @aws-sdk/xml-builder
(#5981)
- chore(deps): bump aws-actions/configure-aws-credentials
(#5812)
- chore(deps): bump jdx/mise-action from 4.0.0 to 4.0.1 (#5734)
- chore(deps): bump astro from 6.1.6 to 6.1.10 in /docs (#6087)
* Fri May 08 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 1.0.4:
* Performance Improvements
- run_cmd and Git repo-root results memoized without the
Provider Cache Server
Within a single command, repeated run_cmd(...) calls and
repeated Git repo-root lookups across units used to share
their cached results only when the Provider Cache Server was
running. Commands invoked without --provider-cache (the
common case for find, list, and run --all against estates
that do not need provider caching) re-evaluated each run_cmd
and re-shelled to git rev-parse --show-toplevel for every
unit.
Both caches are now active for every command, so identical
run_cmd arguments and repeated repo-root lookups are reused
across units regardless of whether the Provider Cache Server
is enabled.
- fast-copy strict control
With the new fast-copy strict control enabled, Terragrunt
compiles each include_in_copy and exclude_from_copy pattern
once and evaluates it inline during a single copy walk. This
avoids re-walking subdirectories for every pattern, which
should result in noticeable speed improvements for large
source modules.
terragrunt run plan --strict-control fast-copy
The new matcher does not collapse ** to zero path segments
when a neighbor is a wildcard, so a/**/*.tf matches
a/sub/main.tf but not a/main.tf. Patterns that relied on the
old collapsing behavior should use brace alternation like
{*.tf,**/*.tf} to cover both depths.
- Fewer git rev-parse invocations on large estates
The get_repo_root() HCL function, the runner, and the find
and list discovery commands all ask Git for the enclosing
repository root. Previously, two units in the same repository
each triggered their own git rev-parse --show-toplevel, even
when the answer was identical. On large estates this added up
to one fork per unit (and sometimes more) for a value that
never changed.
A repository discovered for one working directory is now
reused for any other working directory inside it, for the
duration of the command. Nested repositories (a checkout
vendored inside another) still resolve to their own root.
* Bug Fixes
- --auth-provider-cmd no longer runs once per dependency cache
directory
Resolving dependency outputs ran the configured
- -auth-provider-cmd again from inside each .terragrunt-cache
working directory, on top of the call already made for the
unit.
Terragrunt now reuses the credentials already obtained for
the dependency when reading outputs from a cached working
directory, so --auth-provider-cmd is invoked once per
dependency instead of twice.
- Fixed exclude block being dropped when defined only in an
included parent
A unit that pulled in an exclude block from an include that
did not declare its own exclude block saw the include's
exclude configurations ignored.
Included exclude blocks now get properly merged into unit
configurations.
Reported in #5089. Thanks to @HeikoNeblung for contributing
this fix!
- Fixed terragrunt find --include failing on relative include
paths
Running terragrunt find --include against units whose include
blocks reference parent configs with relative paths
(../root.hcl, ./common.hcl, bare filenames, etc.) emitted
errors like Rel: can't make ../root.hcl relative to
/abs/working-dir and dropped those entries from the output.
Relative include paths are now resolved against the unit's
directory before being made relative to the working
directory, matching how the rest of Terragrunt interprets the
path attribute on an include block.
find and list no longer hard-fail when a path cannot be made
relative to its base. The condition is logged as a warning
and the path is emitted as-is, so output stays complete and
the command exits zero.
- Tolerate non-JSON warnings in tofu/terraform output -json
Resolving dependency outputs no longer fails when the
underlying tofu/terraform output -json invocation prints a
deprecation warning to stdout alongside the JSON payload.
Terraform 1.15.0 introduced a backend deprecation warning for
the S3 dynamodb_table parameter that is emitted on stdout
after the JSON object, which broke parsing with errors like
invalid character 'W' after top-level value and the
misleading downstream message There is no variable named
"dependency".
Terragrunt now isolates the first JSON object in the captured
stdout, so leading log lines (for example, the long-standing
AWS Client Side Monitoring Enabling CSM line) and trailing
warning blocks are both ignored when reading dependency
outputs.
Resolves #6001. Thanks to @jpke for contributing this fix!
- get_repo_root() returns OS-native separators on Windows
git rev-parse --show-toplevel always emits forward-slash
paths, even on Windows. Terragrunt returned that string
unchanged from get_repo_root(), so configurations that
compared the result against path/filepath-style paths or fed
it back into helpers expecting OS-native separators saw
spurious mismatches and broken joins on Windows.
The output is now normalized to OS-native separators before
being returned, so get_repo_root() produces C:\repo\path on
Windows and /repo/path on Linux and macOS.
Reported in #5976.
- Hardened module manifest handling
Terragrunt now bounds .terragrunt-module-manifest cleanup to
the manifest's own folder, skips paths with symlinked
parents, and removes invalid manifests after reading any
valid entries. Existing manifests keep the same gob format.
- Provider Cache Server now supports custom host blocks
Running terragrunt with the Provider Cache Server enabled
against a private registry declared via a host block in
.terraformrc (or a file referenced by TF_CLI_CONFIG_FILE)
failed with errors such as provider
registry.opentofu.org/<org>/<provider> was not found, because
the cache server proxy did not recognize the custom registry
and rewrote requests to registry.opentofu.org.
Terragrunt now registers each custom host block with the
cache server, seeds its service discovery from the services
map so registries that do not serve
.well-known/terraform.json still work, and forwards
OPENTOFU_NETRC_* / TF_TOKEN_* credentials so authenticated
registries continue to authenticate through the proxy.
[#] .terraformrc
host "registry.example.com" {
services = {
"providers.v1" = "https://registry.example.com/repository/terraform-hosted/v1/providers/"
}
}
Resolves #5916. Thanks to @elkh510 for contributing this fix!
* Experiments Updated
- stack-dependencies — Stricter validation and clearer parse
errors for autoinclude
Malformed configuration inside an autoinclude block
previously produced misleading messages or, in some cases,
was silently ignored during stack discovery.
Two changes tighten this up:
- A dependency block inside autoinclude must declare exactly
one label. Zero labels (dependency {}) and multiple labels
(dependency "a" "b" {}) are now rejected at parse time with
a diagnostic that points at the offending block.
- Parse failures encountered while expanding autoinclude
files during stack generate, find, and list are surfaced
with the underlying HCL diagnostic instead of being
swallowed or remapped to a generic discovery error.
Reported in #5980.
- cas — Local paths supported as stack component sources
CAS-backed stack generation now accepts a local filesystem
path as the source of a consumer stack or unit block, in
addition to a remote Git URL. Terragrunt copies the
referenced directory into a temporary directory, computes a
content-addressed root hash over the copy, and applies the
same update_source_with_cas rewriting as the remote flow. The
original directory is left untouched.
[#] live/terragrunt.stack.hcl
stack "service" {
source = "../catalog//stacks/service"
path = "service"
}
This makes a catalog usable against a local checkout under
the same update_source_with_cas = true attributes that
already work for Git URLs, which is helpful when iterating on
a catalog before tagging a release.
See the CAS documentation and Explicit Stacks: Local catalog
sources for details.
https://docs.terragrunt.com/features/caching/cas
https://docs.terragrunt.com/features/stacks/explicit#local-catalog-sources
- catalog-redesign — Units and stacks, scaffolded values, and
key-binding cleanup
The redesigned terragrunt catalog TUI gains two new component
kinds, a guided scaffolding flow for placing them, and a
small key-binding cleanup.
- Units and stacks join modules and templates
Catalog discovery now classifies units (directories
containing a terragrunt.hcl) and stacks (directories
containing a terragrunt.stack.hcl) as first-class component
kinds, alongside OpenTofu/Terraform modules and boilerplate
templates. The list view picks them up automatically and
they appear under their own tabs; press tab and shift+tab
to cycle.
When more than one classification could apply to the same
directory (for example, a stack directory that also
contains a unit), Terragrunt resolves it to a single kind
under a fixed precedence: template, stack, unit, module.
- Copy and scaffolded values
Selecting a unit or stack from the catalog now offers a
copy action that materializes the component into your
working directory. Terragrunt walks the copied component
for values.<name> references and, if it finds any, writes a
sibling terragrunt.values.hcl stub. Names referenced
outside a try(...) are listed as required with a "TODO"
placeholder; names referenced through a try(...) are listed
as optional, pre-populated with the literal default from
the fallback. An existing terragrunt.values.hcl is left
alone.
After the TUI exits, Terragrunt prints a short callout
pointing at the directory it wrote to and any follow-up
command you need to run, instead of leaving you to find the
new directory yourself.
- Catalog key bindings
The ctrl+j binding on the catalog list has been removed in
favor of enter alone for choosing a focused entry, and
dropped from the navigation set used while filtering. The
mini help footer is updated to match.
- stack-dependencies - Separate filenames for unit vs stack
autoincludes
Generated autoinclude files now use distinct filenames
depending on the component kind, so tooling (LSP,
read_terragrunt_config(), indexers) can identify a file's
purpose from its name alone:
- Unit-level autoincludes continue to be written as
terragrunt.autoinclude.hcl.
- Stack-level autoincludes (autoinclude blocks declared
inside a stack { ... }) are now written as
terragrunt.autoinclude.stack.hcl. The .stack.hcl suffix
mirrors terragrunt.stack.hcl, matching the convention used
elsewhere for stack files.
[#] terragrunt.stack.hcl
unit "app" {
source = "../catalog/units/app"
path = "app"
autoinclude {
[#] Generated as: .terragrunt-stack/app/terragrunt.autoinclude.hcl
dependency "vpc" { config_path = unit.vpc.path }
}
}
stack "networking" {
source = "../catalog/stacks/networking"
path = "networking"
autoinclude {
[#] Generated as: .terragrunt-stack/networking/terragrunt.autoinclude.stack.hcl
dependency "shared" { config_path = unit.shared.path }
}
}
This change implements the naming convention proposed in the
Stack Dependencies RFC so configurations for units and stacks
always live in files whose names clearly indicate their
purpose.
https://github.com/gruntwork-io/terragrunt/issues/5663
To learn more, see the experiment documentation.
https://docs.terragrunt.com/reference/experiments/active#stack-dependencies
- stack-dependencies — Nested stack paths and discovery
integration
The stack-dependencies experiment gains two improvements:
nested stack path references at arbitrary depth, and
integration with the find and list discovery commands.
- Nested stack path references
stack.<name>.<nested_stack>.path now resolves at arbitrary
nesting depth. Previously, only units within a stack were
reachable via stack.<name>.<unit_name>.path; nested stacks
are now first-class references too.
[#] terragrunt.stack.hcl
stack "infra" {
source = "../catalog/stacks/infra"
path = "infra"
}
unit "app" {
source = "../catalog/units/app"
path = "app"
autoinclude {
dependency "deep" {
[#] infra contains a nested "deep" stack; reference it directly.
config_path = stack.infra.deep.path
}
inputs = {
val = dependency.deep.outputs.val
}
}
}
- Discovery commands surface stack dependencies
The terragrunt find and terragrunt list discovery commands
now reflect stack dependencies generated by the autoinclude
block. The DAG output correctly orders units by their
autoinclude dependencies and shows dependency relationships
in JSON, tree, and long formats.
[#] JSON output includes dependency relationships from autoinclude
$ terragrunt find --json --dag --dependencies --experiment stack-dependencies
[#] Long list format shows a Dependencies column
$ terragrunt list --long --dependencies --dag --experiment stack-dependencies
[#] Tree format visualizes the dependency hierarchy
$ terragrunt list --tree --dag --experiment stack-dependencies
Multi-level dependency trees (for example, A → B,C where B
→ D,E) are ordered correctly in DAG mode: leaf units appear
first, parents appear after all their dependencies.
To learn more, see the experiment documentation.
https://docs.terragrunt.com/reference/experiments/active#stack-dependencies
- Cache and plugin directories follow platform conventions
Terragrunt's global cache directory now resolves to the
platform's user cache location instead of a hard-coded
~/.cache/terragrunt. On Linux this honors XDG_CACHE_HOME
(still ~/.cache/terragrunt by default), on macOS it resolves
to ~/Library/Caches/terragrunt, and on Windows it resolves
under %LocalAppData%. The CAS content store, the auto
provider cache, and the IaC engine plugin directory all move
with it.
Existing caches at the previous locations are not migrated.
They become orphaned and continue to consume disk space until
removed.
Consider deleting the old paths to reclaim that space if you
are on macOS or Windows, or have configured a custom
XDG_CACHE_HOME:
[#] CAS store and engine plugins under the legacy ~/.cache layout
rm -rf ~/.cache/terragrunt
* What's Changed
- docs: Cleaning up changelog for `v1.0.4` (#6050)
- fix: Removing extra `--auth-provider-cmd` call (#6045)
- fix: manifest handling improvements (#6032)
- chore: Adding better symlinks experiment tests (#6038)
- docs: Documenting #5917 (#6044)
- fix: support custom host blocks in Provider Cache Server
(#5917)
- chore: Dropping insignificant OpenTelemetry traces (#6034)
- chore: Adding thank you to @jpke for fix in #6029 (#6035)
- fix: tolerate non-JSON warnings in tofu/terraform output
- json (#6001) (#6029)
- chore: Addressing test flakes (#6028)
- fix: Ensuring relativization is safer (#6025)
- chore: Addressing #6019 feedback (#6023)
- perf: Moving context cache construction earlier (#6019)
- feat: updated name for stack depednencies (#6018)
- fix: better errors reporting form autoincludes (#5985)
- fix: Cleaning up #5232 (#6009)
- docs: Updating terminology to modernize it a bit (#6016)
- chore: Integrating `vexec` into `Command` (#6004)
- fix: Dropping references to `ctrl-\+j` in the catalog key
bindings (#6007)
- chore: Adding checkbox for changelog updates (#6012)
- docs: Calling out update for existing cache locations in
`v1.0.4` (#6005)
- chore: Optimizing catalog performance (#5973)
- chore: Moving to XDG-aware paths (#5941)
- feat: Adding support for local paths in CAS (#5933)
- Update buttons on nav (#6000)
- chore: Integrate `vexec` into engine (#5957)
- chore: Addressing review feedback on #5989 (#5991)
- feat: Adding support for units and stacks in catalog (#5971)
- chore: Expanding `lll` coverage to `queue` (#5867)
- chore: Expanding `lll` coverage to `tflint` (#5866)
- chore: Expanding `lll` coverage to `runner-creds` (#5865)
- chore: Expanding `lll` coverage to `os-exec` (#5862)
- chore: Expanding `lll` coverage to `worktrees` (#5861)
- feat: stack dependencies in find and dag (#5945)
- docs: Optimizing SEO a bit (#5990)
- perf: Memoizing `get_repo_root()` better (#5989)
- chore: Add `fast-copy` strict control (#5966)
- fix: Use `FromSlash` on return of `git rev-parse
- -show-toplevel` (#5987)
- chore: Cleaning up other scripts with shellcheck and shfmt
(#5983)
- docs: Adding a `Pull Requests` section to the changelog
(#5982)
- chore: Supporting immutable releases (#5905)
* Thu Apr 30 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 1.0.3:
* New Features
- --no-cas flag for disabling CAS per command
The new --no-cas flag disables the CAS for a single
invocation, even when the cas experiment is enabled. It is
available on run, stack generate, and stack run.
terragrunt stack generate --experiment cas --no-cas
This is useful when you want to fall back to the standard
getter path without unwinding experiment configuration.
Generation and runs error when --no-cas is combined with
update_source_with_cas = true on any reachable unit, stack,
or terraform block, since relative sources in catalog
repositories cannot be resolved without the CAS.
* Bug Fixes
- hcl fmt --diff no longer requires the diff binary
Previously, terragrunt hcl fmt --diff spawned a diff process
discovered in $PATH to render its output. This made it
incompatible with minimal container images and Windows
installations where that binary was unavailable.
The flag now produces unified diff output without depending
on any external binary.
Note that the output is not byte-identical to GNU diff -u.
Each file diff is now preceded by a diff old/<path>
new/<path> header line, and the ---/+++ lines no longer
include a trailing timestamp. Scripts that parsed the
previous output may need small adjustments.
- Fixed crash when include and locals with
read_terragrunt_config coexist
A unit that combined an include block with a locals block
calling read_terragrunt_config(...) could crash during
discovery, surfacing as a misleading Call to function
"read_terragrunt_config" failed error pointed at the locals
expression.
Discovery now reports the underlying error instead of
crashing.
Reported in #5949.
- Fixed crash when a root.hcl declares no remote_state block
A root.hcl that only declared locals (or otherwise omitted a
remote_state block) could trigger a nil pointer dereference
inside Terragrunt's remote-state initialization. Downstream
tools that embed the Terragrunt config parser, such as
terragrunt-ls, crashed on every such file.
A missing remote_state block now initializes an empty
remote-state value instead of panicking, so parsing proceeds
normally when no backend is configured.
Reported in terragrunt-ls#134.
- Fixed a race condition in terragrunt stack generate
Fixed a race condition in terragrunt stack generate that
could produce non-deterministic file errors on nested stack
hierarchies. The same stack file could reach the worker pool
twice through different path forms and cause the duplicate
writes to conflict with each other. Paths are now normalized
before dispatch so each stack file is generated exactly once
per invocation.
When a stack file is legitimately claimed by more than one
parent during generation, Terragrunt now logs a warning that
names the contending parents and records the latest claimant,
so the configuration can be corrected before it causes silent
overwrites.
- Fixed data race in --version flag parsing under concurrent
CLI invocations
When multiple Terragrunt CLI invocations ran concurrently in
the same process, urfave/cli/v2's package-level VersionFlag
singleton was mutated concurrently by each invocation's
flag-parsing path, producing a WARNING: DATA RACE on shared
flag state.
Terragrunt now sets cli.App.HideVersion = true at
construction, which prevents urfave from auto-appending its
shared VersionFlag into each App's flag set. The --version /
- v flag is unchanged from the user's perspective — it is
handled by Terragrunt's own flag registered in
internal/cli/flags/global.NewHelpVersionFlags.
* Experiments Added
- mark-many-as-read — Mark many files as read in one step
Enable the new mark-many-as-read experiment to turn on two
behaviors that each mark many files as read in a single call:
automatic marking of files inside a local terraform { source
= "..." } block, and the new mark_glob_as_read HCL function.
With the experiment on, a unit like this:
[#] live/unit/terragrunt.hcl
terraform {
source = "../../modules/service"
}
records every *.tf, *.tf.json, *.hcl, *.tofu, and *.tofu.json
file found under ../../modules/service (recursively) as read
for the unit. Non-source files such as README.md are skipped.
A reading-based filter expression such as --filter
'reading=../../modules/service/**' then matches every unit
that points at the module, so a change to any file in the
module cascades to its consumers.
The same experiment also enables a new HCL function,
mark_glob_as_read(pattern), which expands a glob using the
same gobwas/glob syntax as filter expressions and marks every
matching file as read. It returns the list of absolute paths
that matched, so it composes with other expressions:
locals {
configs = mark_glob_as_read("${get_terragrunt_dir()}/config/{*.yaml,**/*.yaml}")
}
'**' only collapses the surrounding separators when the
adjacent segments are literals, so match-at-any-depth with a
wildcard trailing segment is written as {*.yaml,**/*.yaml}.
See the HCL reference for full pattern syntax.
This is useful when a unit reads a collection of files
indirectly (for example, via run_cmd or templatefile) and you
want changes to any of them to trigger the unit through
reading-based filters. Calling mark_glob_as_read without the
experiment enabled returns an error.
* Experiments Updated
- cas — Stack integration via update_source_with_cas
The cas experiment now integrates with stacks. Units and
terraform blocks can set update_source_with_cas = true to use
relative source paths in catalog repositories, removing the
need to plumb remote Git URLs through values expressions.
[#] stacks/my-stack/terragrunt.stack.hcl (in your catalog repository)
unit "service" {
source = "../..//units/my-service"
update_source_with_cas = true
path = "service"
}
During stack generation, Terragrunt rewrites these relative
sources to cas:: references that resolve against content
stored in the CAS. The repository is cloned once, and
subsequent stack generations resolve content from the local
store without network access. Generated .terragrunt-stack
files contain deterministic CAS references, so regeneration
does not produce spurious diffs.
CAS also supports SHA-256 repositories now, detected
automatically via git rev-parse --show-object-format. The
on-disk store layout was reorganized into blobs/ and trees/
namespaces under ~/.cache/terragrunt/cas/store/.
To learn more, see the CAS documentation and Explicit Stacks:
CAS Integration.
https://docs.terragrunt.com/features/caching/cas
https://docs.terragrunt.com/features/stacks/explicit#cas-integration
- catalog-redesign — Templates and .terragrunt-catalog-ignore
The catalog-redesign experiment picked up user-visible
improvements to discovery and filtering.
Discovery walks the entire repository instead of only a
modules/ directory, so modules and templates can live
anywhere in the tree. Boilerplate templates (directories
containing a .boilerplate/ subdirectory or a top-level
boilerplate.yml) are discovered as a distinct component kind
alongside OpenTofu/Terraform modules and labeled as templates
in the UI. When a directory qualifies as both, it is
classified as a template.
Catalog authors can commit a .terragrunt-catalog-ignore file
at the repo root to keep directories such as examples/ or
test/ out of discovery. The file uses .gitignore-style
semantics: one pattern per line, # for comments, ! for
negation, and last match wins. Matching is anchored at the
repo root; a lone * does not cross /, and ** does.
[#] .terragrunt-catalog-ignore
examples
examples/**
test/**
!test/keep
An --ignore-file flag (also available via TG_IGNORE_FILE)
points at an additional ignore file that is layered on top of
the repo's .terragrunt-catalog-ignore. The extra rules are
appended under last-match-wins semantics, so the flag can
either add new exclusions or re-include paths that the repo
file excluded.
To learn more, see Excluding paths from discovery.
https://docs.terragrunt.com/features/catalog/tui#excluding-paths-from-discovery
The list view is split into All, Modules, and Templates tabs,
with All selected on launch so every discovered component is
visible without switching views. Press tab and shift+tab to
cycle between them; each tab keeps its own cursor and search
filter.
- stack-dependencies — Multi-level nested
stack.<name>.<nested_stack>.path references
The stack-dependencies experiment already supported
stack.<name>.path (a whole stack) and
stack.<name>.<unit_name>.path (a unit inside a stack). It now
also resolves references where the second segment is itself a
nested stack, so an autoinclude block in a parent stack can
target a stack that lives inside another stack:
[#] live/terragrunt.stack.hcl
stack "infra" {
source = "../catalog/stacks/infra"
path = "infra"
}
unit "app" {
source = "../catalog/units/app"
path = "app"
autoinclude {
dependency "deep" {
config_path = stack.infra.deep.path
}
}
}
Here stack.infra.deep.path resolves to the generated
directory of a stack "deep" block declared inside
catalog/stacks/infra/terragrunt.stack.hcl. This makes deeper
stack hierarchies addressable from a single dependency
expression without flattening the layout.
* What's Changed
- feat: Mark module sources as read by @yhakbar in #5963
- feat: Adding support for CAS in stacks by @yhakbar in #5911
- feat: Splitting modules from templates by @yhakbar in #5932
- feat: allow units to depend on stacks by @denis256 in #5924
- fix: Addressing panic in read_terragrunt_config() by @yhakbar
in #5953
- fix: version flag race condition fix by @denis256 in #5961
- fix: fixing concurrent-write race in stack generate by
@denis256 in #5962
- fix(remotestate): survive nil Config passed to New by @SAY-5
in #5965
- docs: Cleaning up changelog for v1.0.3 by @yhakbar in #5977
- docs: Touching up docs for catalog-redesign by @yhakbar in
[#5940]
- docs: Adding Terragrunt Scale callout in README.md by
@yhakbar in #5946
- docs: Fixing Kapa integration by @yhakbar in #5942
- chore: Integrating vexec into NewGitRunner by @yhakbar in
[#5934]
- chore: Offboarding Travis by @yhakbar in #5944
- chore: Expanding lll coverage to amazonsts by @yhakbar in
[#5852]
- chore: Expanding lll coverage to runner-common by @yhakbar in
[#5853]
- chore: Expanding lll coverage to runner-graph by @yhakbar in
[#5854]
- chore: Expanding lll coverage to list by @yhakbar in #5855
- chore: stacks generation improvements by @denis256 in #5969
- chore: Expanding lll coverage to errorconfig by @yhakbar in
[#5856]
- chore: Expanding lll coverage to experiment by @yhakbar in
[#5857]
- chore: Expanding lll coverage to externalcmd by @yhakbar in
[#5858]
- chore: Expanding lll coverage to cache-controllers by
@yhakbar in #5859
- chore: Expanding lll coverage to vfs by @yhakbar in #5860
- chore: Expanding lll coverage to stack by @yhakbar in #5841
- chore: Expanding lll coverage to backend-delete by @yhakbar
in #5842
- chore: Expanding lll coverage to cloner by @yhakbar in #5843
- chore: Expanding lll coverage to engine by @yhakbar in #5844
- chore: Expanding lll coverage to git by @yhakbar in #5845
- chore: Consolidating independent integration tests by
@yhakbar in #5938
- chore: Integrating signals into vexec by @yhakbar in #5935
- chore: Expanding lll coverage to prepare by @yhakbar in #5846
- chore: Expanding lll coverage to exec by @yhakbar in #5847
- chore: Expanding lll coverage to find by @yhakbar in #5848
- chore: Expanding lll coverage to stacks-output by @yhakbar in
[#5850]
- chore(deps): bump astro from 6.1.2 to 6.1.6 in /docs by
@dependabot[bot] in #5947
- chore: Expanding lll coverage to placeholders by @yhakbar in
[#5851]
- chore: Removing dependency on diff by @yhakbar in #5954
- chore: Addressing feedback on #5953 and #5954 by @yhakbar in
[#5964]
- chore: Windows signing fix by @denis256 in #5979
* Tue Apr 21 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 1.0.2:
* Bug Fixes
- shared_credentials_files and other list/map backend config
values were serialized incorrectly
Setting shared_credentials_files (or any other list-valued
key) in the remote_state.config block produced a broken
- backend-config argument:
- backend-config=shared_credentials_files=[/a/creds /b/creds]
OpenTofu and Terraform both failed to parse this. The same
problem affected map-valued keys. Lists and maps are now
written as single-line HCL (["/a/creds","/b/creds"] and
{key="value"}), and strings inside them are quoted so
embedded quotes, newlines, and tabs survive the round trip.
- Panic in get_repo_root() when OpenTelemetry tracing is
enabled with TRACEPARENT
Running terragrunt stack generate (or any command that
invoked shell commands like git rev-parse) with OpenTelemetry
trace exporting enabled (TG_TELEMETRY_TRACE_EXPORTER=http)
caused a nil pointer panic:
Call to function "get_repo_root" failed: panic in function implementation:
runtime error: invalid memory address or nil pointer dereference
The root cause of the panic was fixed, and telemetry
codepaths have been hardened against future panics.
* stack output now respects the exclude block
terragrunt stack output previously ignored the exclude block
on units, attempting to fetch outputs (including directly
from S3 state when using
- -dependency-fetch-output-from-state) for units that should
have been excluded.
The fix uses Terragrunt discovery to identify excluded units
before reading outputs. Excluded units are now omitted from
the stack output entirely, consistent with how they are
handled during stack run.
To exclude a unit from stack output, add "output" to the
actions list in the exclude block:
exclude {
if = true
actions = ["plan", "apply", "destroy", "output"]
}
Special action values "all" and "all_except_output" are also
supported.
* Experiments Added
- catalog-redesign — Reworked terragrunt catalog TUI
A new catalog-redesign experiment reworks the design of the
terragrunt catalog TUI.
terragrunt catalog now launches the TUI right away and runs
discovery in the background instead of waiting for discovery
to complete before launching the TUI. As a consequence,
terragrunt catalog users with large catalogs should see
significant speed improvements as they launch the terragrunt
catalog TUI.
Modules now stream into the list view of the catalog as they
are discovered, so you'll be able to select and use a module
even if your entire catalog hasn't been discovered yet.
If catalog.urls is not configured in root.hcl, terragrunt
catalog no longer errors. A welcome screen explains how to
populate the catalog and can open the catalog documentation
on a keypress. In addition, terraform.source values from
existing units are automatically included in the set of URLs
used for discovery, so users with existing units get a
populated catalog pointing to other modules that can be
pulled from the same module source without any additional
configuration.
This experiment is subject to change, and core elements of
the design are being iterated on rapidly.
To try it out, run:
terragrunt catalog --experiment catalog-redesign
To learn more, see the experiment documentation.
https://docs.terragrunt.com/reference/experiments/active#catalog-redesign
* Experiments Updated
- stack-dependencies — Cross-stack dependency support and
autoinclude improvements
The stack-dependencies experiment now supports cross-stack
and nested-stack dependency patterns, expanding the
autoinclude block capabilities in terragrunt.stack.hcl files.
New features:
- stack.<name>.path references for depending on an entire
stack. The DAG expands the stack into its constituent units
so that all units in the stack complete before the
dependent unit runs
- stack.<name>.<unit_name>.path references for depending on a
specific unit within a nested stack (fine-grained
cross-stack dependencies)
- dependency blocks targeting stack directories — aggregated
outputs from all units in the stack are accessible as
dependency.stack_name.outputs.unit_name.output_key
- Partial evaluation of local.* in autoinclude — expressions
mixing local.* and dependency.* are partially evaluated
during stack generation: locals resolve to literals while
dependency references are preserved for evaluation when the
unit is applied
Dependency on an entire stack:
stack "infra" {
source = "../catalog/stacks/infra"
path = "infra"
}
unit "app" {
source = "../catalog/units/app"
path = "app"
autoinclude {
dependency "infra" {
config_path = stack.infra.path
}
inputs = {
vpc_id = dependency.infra.outputs.vpc.vpc_id
}
}
}
Dependency on a unit within a nested stack:
stack "networking" {
source = "../catalog/stacks/networking"
path = "networking"
}
unit "app" {
source = "../catalog/units/app"
path = "app"
autoinclude {
dependency "vpc" {
config_path = stack.networking.vpc.path
}
inputs = {
vpc_id = dependency.vpc.outputs.vpc_id
}
}
}
terragrunt run --all --experiment stack-dependencies -- plan
To learn more, see the experiment documentation.
https://docs.terragrunt.com/reference/experiments/active#stack-dependencies
* Process Updates
- Install script now supports tip and test builds
The install script can now install tip builds and on-demand
test builds. Three new flags are available:
- --tip installs the latest tip build from main
- --test installs an on-demand test build
- --commit <sha> installs a build for a specific commit
Downloads are verified against GPG/Cosign signatures and
SHA256 checksums before installation.
* Tip build notifications on referenced issues
When a tip build is produced on main for a merged PR,
Terragrunt now posts a comment on any issues that PR
references, linking to the build and including instructions
for installing and testing it.
* What's Changed
- feat: add new hclparse package in internal by @denis256 in
[#5816]
- feat: Adding catalog-redesign experiment by @yhakbar in #5894
- feat: Adding types, sources and versions to catalog by
@yhakbar in #5922
- feat: handling of stacks dependencies in run queue / runner
pool by @denis256 in #5909
- feat: Supporting catalog with no config by @yhakbar in #5902
- feat: Supporting streaming components to the catalog by
@yhakbar in #5914
- fix: Addressing #5895 review comments by @yhakbar in #5897
- fix: correct cloud-nuke config YAML keys and bump to v0.49.0
by @james00012 in #5920
- fix: Fixing panic in telemetry by @yhakbar in #5915
- fix: handling of exclusions when reading outputs by @denis256
in #5900
- fix: Use httptest in ./internal/tf to avoid issues from
integration in unit tests by @yhakbar in #5925
- fix(s3): fix shared_credentials_files HCL serialization for
backend config by @Rahul-Kumar-prog in #5886
- docs: Avoid indexing changelog in search by @yhakbar in #5928
- docs: Fix bash commands in "Terralith to Terragrunt" guide by
@chorrell in #5904
- docs: Fix missing newline in remote_state examples by
@thoreinstein in #5921
- docs: Splitting up changelog by @yhakbar in #5930
- docs: updated stack-dependencies implementation roadmap by
@denis256 in #5910
- docs: Updating v1.0.2 changelog entries by @yhakbar in #5927
- docs: Updating install docs by @yhakbar in #5923
- chore: add 7-day cooldown to dependabot updates by @diofeher
in #5889
- chore: Adding vexec by @yhakbar in #5931
- chore: Adding catalog redesign fork by @yhakbar in #5896
- chore: Adding support for vfs in cas by @yhakbar in #5908
- chore: Adding tests and docs missing from #5886 by @yhakbar
in #5926
- chore: Adding tip notification system by @yhakbar in #5895
- chore: bump cloud-nuke to v0.49.0 by @james00012 in #5893
- chore: coverage scripts collection simplifications by
@denis256 in #5724
- chore: Dropping CAS test by @yhakbar in #5936
- chore: Expanding lll coverage to configbridge by @yhakbar in
[#5834]
- chore: Expanding lll coverage to errors by @yhakbar in #5833
- chore: Expanding lll coverage to gcphelper by @yhakbar in
[#5832]
- chore: Expanding lll coverage to generate by @yhakbar in
[#5840]
- chore: Expanding lll coverage to help by @yhakbar in #5835
- chore: Expanding lll coverage to middleware by @yhakbar in
[#5839]
- chore: Expanding lll coverage to tips by @yhakbar in #5837
- chore: Expanding lll coverage to tui by @yhakbar in #5836
- chore: Expanding lll coverage to writer by @yhakbar in #5838
- chore: Make workflow dispatch for signing useful by @yhakbar
in #5929
- chore: otel dependencies update by @denis256 in #5878
- chore: simplified returned discovery errors by @denis256 in
[#5664]
- chore: Updating install script to support tip builds by
@yhakbar in #5892
- chore: Revert "chore: bump cloud-nuke to v0.49.0" by @yhakbar
in #5919
* Sat Apr 18 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 1.0.1:
* Experiments Added
- dag-queue-display — DAG tree visualization for the run queue
A new dag-queue-display experiment renders the run queue as a
dependency tree instead of a flat list, making it easier to
understand execution order and dependency relationships at a
glance.
$ terragrunt run --all --experiment dag-queue-display -- plan
19:06:59.108 INFO The following units will be run, starting with dependencies and then their dependents:
.
├── monitoring
╰── vpc
╰── database
╰── backend-app
╰── frontend-app
To learn more, see the experiment documentation.
https://docs.terragrunt.com/reference/experiments/active#dag-queue-display
- slow-task-reporting — Progress reporting for long-running
operations
A new slow-task-reporting experiment displays animated
progress spinners for operations that take longer than 1
second, such as source downloads, Git worktree creation, and
catalog repository cloning. In non-interactive environments
(CI/CD, piped output), spinners are replaced with periodic
INFO log lines every 30 seconds to prevent CI systems from
killing jobs due to output inactivity.
$ terragrunt run --all --experiment slow-task-reporting -- plan
INFO Downloading source from git::https://github.com/example/module.git...
INFO Downloaded source from git::https://github.com/example/module.git (3.2s)
To learn more, see the experiment documentation.
https://docs.terragrunt.com/reference/experiments/active#slow-task-reporting
- stack-dependencies — Dependency wiring between units in
stacks
A new stack-dependencies experiment enables the autoinclude
block in terragrunt.stack.hcl files, allowing units and
stacks to define dependency relationships and arbitrary
configuration overrides during stack generation. This
implements RFC #5663.
unit "vpc" {
source = "../catalog/units/vpc"
path = "vpc"
}
unit "app" {
source = "../catalog/units/app"
path = "app"
autoinclude {
dependency "vpc" {
config_path = unit.vpc.path
}
inputs = {
vpc_id = dependency.vpc.outputs.vpc_id
}
}
}
terragrunt run --all --experiment stack-dependencies -- plan
To learn more, see the experiment documentation.
https://docs.terragrunt.com/reference/experiments/active#stack-dependencies
* Bug Fixes
- hcl validate no longer fails on dependency.outputs references
terragrunt hcl validate previously failed with "Unsupported
attribute" when a configuration referenced
dependency.<name>.outputs.<key> without mock_outputs.
During validation, output resolution is skipped, but the
outputs attribute was never added to the dependency
evaluation context, causing any output reference to error.
The fix provides a dynamic placeholder for dependency outputs
(and inputs) during validation so that attribute access
evaluates to unknown rather than failing. Additionally, the
dependency resolution pipeline is now more resilient during
validation. Dependencies with unresolvable config_path values
or nonexistent targets no longer cause the entire dependency
namespace to disappear from the evaluation context.
- Destroy queue now displays units in correct order
Previously, the run queue display showed units in apply order
even for destroy commands. The queue now correctly shows
dependents before their dependencies when running destroy,
matching the actual execution order.
- Dependent discovery fixed in worktrees
Dependents are now correctly discovered when units are
discovered in worktrees. Previously, dependent discovery
could fail to find related units when operating within a git
worktree.
- Filter exclusions now respected in worktree sub-discoveries
Negated filters (e.g., !./catalog/** from .terragrunt-filters
or --filter) are now propagated to worktree sub-discoveries
used by git-based filtering (--filter-affected, --filter
'[ref...ref]').
Previously, excluded source catalog units in worktrees were
still discovered and parsed, causing errors when they
referenced values.* or dependency.* variables without the
stack generation context.
- read_terragrunt_config() behavior in implicit stacks fixed
A regression introduced in v0.99.4 caused
read_terragrunt_config() to fail to parse dependency blocks
in external configurations during stack execution. This is
fixed by resetting parsing context fields that prevented
proper evaluation of dependencies in configurations read by
read_terragrunt_config().
- get_original_terragrunt_dir() now resolves correctly during
dependency parsing
A regression introduced in v1.0.0-rc3 caused
get_original_terragrunt_dir() to return the dependent
directory instead of the dependency's directory when parsing
dependency configurations from a unit.
This broke configurations where a dependency's
read_terragrunt_config() chain relied on
get_original_terragrunt_dir() to locate sibling files. The
fix introduces a dedicated WithDependencyConfigPath method
that correctly resets the original config path when parsing a
dependency as an independent unit.
- Chained dependency with exposed include conversion fixed
Chaining dependencies with exposed includes no longer
produces a spurious "Could not convert include to the
execution ctx to evaluate additional locals" error during
partial parsing.
- Provider cache fixed on Windows for remote URLs
The provider cache failed on Windows with CreateFile
https://...: The filename, directory name, or volume label
syntax is incorrect because remote download URLs were passed
to os.Stat, and the colon in https: is invalid Windows path
syntax. The fix skips the filesystem existence check when the
download URL is a remote URL (://), going directly to the
download path.
- Additional transient network errors now retried automatically
Added retry patterns for provider resolution and registry
connection failures commonly seen in CI environments,
including TLS handshake timeouts, TCP connection resets,
context deadline exceeded errors, and failed discovery
document requests. These cover both Terraform and OpenTofu
provider workflows.
- File copy performance improved
Terragrunt now streams data from source files to target files
more often by replacing some instances where files were read
into memory in their entirety and written to a target file.
This results in improved performance when copying files and
reduced memory footprint.
* Process Updates
- Tip builds now available from main
Every successful CI run on the main branch now automatically
produces tip build binaries with signed checksums for all
supported platforms (Windows and macOS binaries are not
codesigned in tip builds). These builds are accessible via
the builds API at https://builds.terragrunt.com — see the
releases process documentation for API endpoints and usage
examples. Maintainers can also trigger on-demand test builds
from any branch using the test-build.yml workflow.
- Concurrency limits now respect GOMAXPROCS
All internal concurrency limits now use runtime.GOMAXPROCS(0)
instead of runtime.NumCPU(). This means Terragrunt correctly
honors the GOMAXPROCS environment variable and container CPU
quotas (e.g., cgroups), resulting in better behavior in
resource-constrained environments like Kubernetes pods and CI
runners with CPU limits.
- AWS SDK updated to v1.41.5
The aws-sdk-go-v2 dependency has been updated to v1.41.5.
- Terragrunt Scale documentation added
A new Terragrunt Scale section has been added to the docs,
covering Pipelines, Drift Detection, and Patcher with brief
overviews and links to the full Gruntwork documentation.
* What's Changed
- fix: Fixing up lints (#5887)
- misc testing and lint updates (#5885)
- fix: Addressing #5828 feedback (#5876)
- chore: Upgrading go deps (#5795)
- docs: Adding TGS docs (#5831)
- fix: Preventing parse errors in stack generation in worktrees
(#5826)
- fix: Using cty.DynamicVal to avoid 'Unsupported Attribute'
errors (#5827)
- fix: Fixing `get_original_terragrunt_dir()` interaction with
dependencies (#5828)
- docs: Documenting tip/test build installation instructions
(#5829)
- chore: Adding tip build workflows (#5823)
- feat: add stack dependencies experiment (#5809)
- various lint fixes (#5796)
- chore: Replace `runtime.NumCPU()` usage with
`runtime.GOMAXPROCS(0)` (#5794)
- fix: add retry patterns for transient provider/registry
network errors (#5779)
- feat: experiment for reporting long running tasks (#5730)
- fix coverage compare regarding retries (#5793)
- use io.Copy instead of reading files into memory (#5608)
- fix: Fixing generation in stacks that read files (#5790)
- chore(deps): bump peter-evans/create-pull-request from 7.0.8
to 8.1.0 (#5736)
- fix: Addressing test flakes for
`TestReadTerragruntConfigDependencyInStack` (#5781)
- chore(deps): bump the js-dependencies group across 1
directory with 5 updates (#5764)
- fix: Adding Windows symlink tip (#5778)
- fix: provider cache path handling in Windows (#5788)
- Disable vercel skew protection (#5789)
- chore: disabled tmpfs usage in GHA (#5787)
- docs: Fixing up changelog implementation (#5784)
- docs: Fixing strict controls (#5782)
- fix: Discover dependents in worktrees if units are discovered
there (#5763)
- chore: updated aws-sdk-go-v2 to 1.41.5 (#5771)
- fix: Refactoring unit display in runs for better
communication (#5752)
- docs: Fixing search (#5776)
- fix: Fixing macOS linting (#5775)
- chore: updating GTM tag (#5769)
- fix: Fixing #4153 (#5746)
- docs: Adding `v1.0.0` call out (#5768)
- fix: Fixing #5624 (#5766)
- chore: Adding tests to confirm #4395 is resolved (#5761)
* Tue Mar 31 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 1.0.0:
https://github.com/gruntwork-io/terragrunt/releases/tag/v1.0.0
* v1.0.0 Release
- Terragrunt is now v1!
This means that Terragrunt will no longer have any breaking
changes in minor releases, with all future breaking changes
taking place in (infrequent) future major releases.
For a list of guarantees that will be observed by maintainers
for the duration of Terragrunt 1.0, see the Terragrunt 1.0
Guarantees page in the docs.
* Breaking Changes
- Consistent .terragrunt-cache directory generation
Terragrunt now creates a .terragrunt-cache directory for
every run, regardless of whether the terragrunt.hcl file
defines a terraform block with a source attribute.
This change improves consistency across all Terragrunt
executions, as OpenTofu/Terraform will now always run within
the .terragrunt-cache directory. This standardized behavior
simplifies troubleshooting and makes the execution model more
predictable.
- Removal of tflint
Terragrunt has been shipping with a version of tflint
compiled into the binary to allow for more convenient usage
without installing tflint directly. However due to the
adoption of a BUSL license in tflint, the version included in
Terragrunt was frozen.
The dependency on tflint is now fully removed from
Terragrunt. If you want to call tflint using a before_hook
using Terragrunt, you will have to have tflint installed
locally to do so.
To reduce the burden of this breaking change, Terragrunt will
continue to provide conveniences like automatically running
tflint init on behalf of users, although it no longer ships
with a compiled version of tflint in the terragrunt binary.
To learn more, read the documentation on the integration with
tflint.
- Discovery commands discover hidden configurations by default
The find and list commands now discover units/stacks in
hidden directories by default (this previously required usage
of the --hidden flag), notably this now discovers
.terragrunt-stack directories by default. The commands also
now support an opt-in --no-hidden flag to avoid discovery in
hidden directories.
The --hidden flag has been deprecated, and will not be
removed in 1.0. Using the flag no longer does anything.
- render --format=json no longer discovers dependents by default
Prior to this release, the render --format=json command would
automatically start to perform dependent discovery on other
units related to the unit being rendered. Avoiding this
required usage of the --disable-dependent-modules flag. That
behavior has been removed. HCL and JSON rendering of unit
configurations will now proceed without the additional
overhead of dependent discovery by default.
This functionality is better served by a combination of find
and graph-based filters.
e.g. If you want to detect all the dependents of a given unit
foo, expecting to find the dependent unit bar you can run the
following:
$ terragrunt find --filter '...^foo'
bar
If you aren't familiar with filters, this reads as "find all
dependents of foo, not foo itself"
- Ambiguous unit/stack components now throw errors
Previously, Terragrunt would silently engage in undefined
behavior when both a terragrunt.hcl and terragrunt.stack.hcl
file existed in the same directory.
With this release, Terragrunt will start to throw warnings
and prevent such usage. Users will have to ensure that only
one of a unit (terragrunt.hcl) or stack configuration
(terragrunt.stack.hcl) exist in a unit or stack directory,
respectively.
* New Features
- Tips added
Terragrunt will now provide helpful tips when it detects
usage patterns that might benefit from some additional
guidance.
You can disable the display of tips at any time using
- -no-tips or disable individual tips with --no-tip, (e.g.
- -no-tip=debugging-docs).
- --report-file support for single runs
The --report-file will now generate reports even when runs
are performed without the --all flag.
- Improved error messages for undefined flags
Detection has been added for scenarios when a user is using a
flag that might be meant to be passed to OpenTofu/Terraform
in the run command, and suggests using the -- argument to
pass it through.
As an example:
$ terragrunt run providers lock -platform linux_amd64 -platform darwin_arm64
14:52:19.496 ERROR flag `-platform` is not a Terragrunt flag. If this is an OpenTofu/Terraform flag, use `--` to forward it (e.g., `terragrunt run -- <command> -platform`).
* Performance Improvements
- Discovery performance improved
The way in which Terragrunt discovers and filters units and
stacks for runs has improved significantly.
Terragrunt is now better at avoiding parsing units/stacks
unnecessarily, based on the filter you use. Previously, the
logic used was more coarse, and could result in a requirement
to parse some configurations (e.g. presence of a dependency
graph expression) to result in parsing all configurations.
Discovery has been refactored to allow for much more careful
opt-in parsing based on the need to support the filter used
by users (or lack thereof).
This will also result in improvements to Terragrunt's ability
to ignore broken parts of infrastructure estates when
Terragrunt can predictably determine that it won't impact a
run.
- EncodeSourceVersion execution sped up
The performance of EncodeSourceVersion has been improved by
utilizing SkipDir to optimize directory traversals.
- Provider Cache Server used for fetching outputs from
dependencies
The Provider Cache Server is now used when fetching outputs
from dependencies, improving performance of output resolution
for users using the provider cache server.
* Bug Fixes
- Improved filter parsing errors
Parsing errors returned when invalid filter queries are used
with --filter have been improved to provide more detailed
error messages and actionable recommendations.
- Retries added for registry timeouts in provider cache server
The Provider Cache Server will now perform automatic retries
on timeouts to OpenTofu/Terraform provider registries.
- Discoverability of init-from-module documentation improved
The special internal init-from-module command referenced in
hooks has had its documentation improved to make it easier to
discover. It was difficult to find in the terraform HCL block
documentation, and that resulted in confusion for users.
- Over-warning on strict controls prevented
Using --strict-mode resulted in over-warning on completed
controls. Those warnings will no longer appear when using
strict mode.
- Stdout/stderr from run_cmd emitted when included
A bug prevented the run_cmd HCL function from emitting to
stdout/stderr when included by a unit. That bug has been
fixed.
- Provider Cache Server integration with custom registries fixed
The Provider Cache Server now properly integrates with custom
registries. You will still need to use the
- -provider-cache-registry-names flag to ensure that the
Provider Cache Server properly handles proxying requests to
the custom provider registry.
- The no_run attribute of exclude is fixed
A bug prevented the no_run attribute of the exclude block
from being respected when being explicitly set to false (as
opposed to not being defined at all). This bug has been
fixed.
- The --report-file is now respected for single runs
The --report-file will now generate reports even when runs
are performed without the --all flag.
- Path manipulation removed from log messages
Log messages no longer have paths updated automatically. This
caused confusion for users when seeing OpenTofu/Terraform
stdout and hook stdout emitted through logs, as paths were
unconditionally updated to be relative to the unit path. This
logic has been moved to logging call sites to ensure that
external process stdout/stderr is not manipulated
unexpectedly.
- Absolute URLs in registry self-discovery integration with Provider Cache Server Fixed
When using the Provider Cache Server in conjunction with a
remote registry using absolute URLs for modules, the Provider
Cache Server will now properly resolve the module source.
- SOPS decryption race condition fixed
A race condition in the concurrent access to SOPS decrypted
secrets in different environments combined with usage of the
- -auth-provider-cmd flag resulted in authentication failures.
Synchronization controls have been introduced to ensure
authentication proceeds correctly for each environment
independently.
- Version constraints in stack runs fixed
When running against a stack, a bug prevented Terragrunt +
OpenTofu/Terraform version constraints from being respected
while using the terragrunt_version_constraint and
terraform_version_constraint HCL attributes. That bug has
been fixed.
- Interrupt signal propagation to OpenTofu/Terraform fixed
The mechanism by which Terragrunt sends interrupt signals to
OpenTofu/Terraform processes it started has been made more
robust. Terragrunt will now send the interrupt signal in the
event that a user explicitly sends an interrupt signal to
Terragrunt in addition to scenarios where Terragrunt's
context cancellation is triggered (e.g. in the event of a
timeout).
- Remote state configuration parsing fixed
Remote state configuration parsing (especially S3) is now
more tolerant of common input formats, reducing
decode-related failures from type mismatches in configuration
values.
Parsing behavior has also been made more consistent across
related remote configuration blocks in Terragrunt, with
regression tests added to prevent future breakages.
- Invalid unit configurations cause explicit errors instead of silently being excluded during runs
A bug in discovery logic resulted in units with invalid HCL
configurations being silently excluded from runs with a
warning. This bug has been fixed, and attempting to parse
invalid HCL configurations during a run will result in an
error.
- Partial parse configuration cache fixed
A bug affecting the partial parse configuration cache (in use
when the --use-partial-parse-config-cache flag is supplied)
has been resolved, ensuring configurations are cached and
read accurately without incorrect cache collisions.
- Engine output adjusted
The display and formatting of engine outputs have been
updated to be cleaner and more intuitive for users when
running Terragrunt workflows.
Stdout/Stderr entries emitted from engines will now have the
engine tool listed instead of tofu.
- More accurate matching of retryable errors
Fixes a bug where retries were triggered when an expected
error is matched against non-stderr output from external
process errors.
- Duplicate error reporting fixed
Fixes a bug where duplicate errors were reported when running
units through the worker pool subsystem.
- Interaction between --working-dir and -detailed-exitcode fixed
Fixes a bug where the wrong cache key was used for storing
exit codes for OpenTofu/Terraform runs in units when the
- -working-dir flag was also used.
- Variable sanitization via escaping added
Escaping added for interpolation expressions (e.g. ${foo})
that are unlikely to be desired by users.
- Removing usage of filepath.Abs and reducing usage of filepath.ToSlash
Usage of the Golang filepath.Abs and filepath.ToSlash
standard library functions significantly reduced. Overly
broad application of these functions to file paths caused
subtle operating system compatibility issues and
incompatibility with the --working-dir flag.
The codebase has been updated to only use filepath.Abs early
on in initialization of the CLI prior to setting the value of
- -working-dir (after which, working dir is considered the
source of truth for file path canonicalization) and tests.
The codebase has been updated to use filepath.ToSlash only
where unix-style forward slash normalization is a requirement
(e.g. when used in file path globs).
- Handling of backend init when disable_init=true
Fixes a bug where disable_init = true affected behavior
beyond Terragrunt's bootstrap operations. disable_init now
correctly limits its scope to Terragrunt bootstrap steps
only.
- Fix detection of offline usage in Provider Cache Server
A bug in the detection of offline usage in the Provider Cache
Server resulted in attempts to reach the default provider
registry for OpenTofu/Terraform to trigger errors even when
using the Provider Cache Server to proxy requests to a
network or filesystem mirror.
This has been fixed. When the default provider registry isn't
available for OpenTofu/Terraform for any reason, the Provider
Cache Server will use the provided network/filesystem mirror
instead without attempting to use the discovery endpoint.
This will help users in air-gapped environments using the
Provider Cache Server.
- Improved log messages for hooks with errors
Hooks encountering errors will now return errors that better
communicate whether an error was caused by failure to execute
an external process or successfully running an external
process, but receiving a non-zero exit code.
- Relative paths in reading files fixed
A bug in the logic for incorporating includes as absolute
paths in tracked "read" files has been fixed.
- OpenTofu file extensions handled in catalog and scaffold
Terragrunt catalog now lists modules that use .tofu,
.tf.json, or .tofu.json files. Terragrunt scaffold now parses
variables from .tofu files — previously, variables defined in
.tofu files were silently missing from the generated
terragrunt.hcl.
- Bootstrap use_lockfile boolean handling fixed
A bug in remote state backend configuration caused
use_lockfile = true to be emitted as use_lockfile = "true"
(quoted string), which OpenTofu/Terraform rejects. Boolean
values in backend config are now normalized correctly.
- Provider cache lock file corruption fixed
A bug that could cause provider cache lock file corruption
has been fixed.
- Git filter discovery for read_terragrunt_config fixed
Git-filter discovery now correctly detects stacks affected by
changes to sidecar files read via read_terragrunt_config(),
by parsing stack files to check FilesRead against diff paths
instead of relying on generic directory-based detection.
- S3 bucket tagging moved to bucket creation
S3 bucket tagging during backend bootstrapping has been moved
to bucket creation. This prevents errors caused when SCPs
restrict creation of buckets without appropriate tags.
- Windows user input fixed
A bug on Windows caused user input prompts (e.g. for
confirming apply) to stop working after subprocess execution.
Terragrunt now saves and restores console state around every
subprocess execution and re-enables Virtual Terminal
processing.
- Authentication during queue construction fixed
A bug in the logic for parsing configurations during
discovery for use-cases like --filter 'reading=*' where
configurations need to be parsed to determine whether or not
they end up in the final run queue has been fixed.
Configurations will now properly call any configured
- -auth-provider-cmd authenticator before parsing
configurations, preventing errors for HCL functions like
sops_decrypt_file that require authentication before parsing
can proceed.
- hcl fmt on unintended files during scaffold fixed
A bug caused hcl fmt to run on files that weren't generated
by scaffold. Formatting is now scoped to only scaffolded
content.
- Input precision loss fixed
A bug in the way Terragrunt handled setting of
OpenTofu/Terraform inputs from numbers resulted in precision
loss. That bug has been fixed.
* Documentation Updates
- 1.0 Guarantees
A living document named Terragrunt 1.0 Guarantees has been
added to the Terragrunt website clarifying what is and isn't
considered a breaking change for the duration of 1.0.
Over time, as ambiguity in edge-cases for what is considered
a breaking change are addressed, the page will be updated so
that you can be confident your workflows won't be impaired.
- llms.txt added
An /llms.txt route has been added to the Terragrunt website
to make it easier for LLMs to consume Terragrunt
documentation in Markdown format.
- New Home for the Terragrunt website!
The Terragrunt website is now hosted at
https://terragrunt.com and https://docs.terragrunt.com for
marketing and documentation purposes, respectively.
Existing links to https://terragrunt.gruntwork.io should
seamlessly redirect to the new domain that hosts the content
for that URI.
* Experiments Updated
- Engines now use GitHub environment variables for downloads
When downloading engines using the engine experiment,
Terragrunt will detect and leverage the GH_TOKEN and
GITHUB_TOKEN environment variables if present to authenticate
with the GitHub API while performing release discovery and
download of engines.
* Process Updates
- Go bumped to v1.26
The version of Golang used to compile the Terragrunt binary
has been updated to v1.26.0.
- OpenTofu/Terraform Compatibility Updated
Terragrunt is now continuously tested against OpenTofu 1.11.4
and Terraform 1.14.4 in CI.
- AWS and GRPC dependencies update
Updated AWS SDK and gRPC dependencies to pick up the latest
bug fixes and security patches:
- google.golang.org/grpc to v1.79.1
- github.com/aws/aws-sdk-go-v2/config to v1.32.8
- github.com/aws/aws-sdk-go-v2/credentials to v1.19.8
* Fri Mar 27 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.99.5:
* Bug Fixes
- --working-dir interaction with exit codes fixed
A bug in the logic for tracking exit codes for plan
- detailed-exitcode when users supply the --working-dir flag
has been fixed.
- Authentication during queue construction fixed
A bug in the logic for parsing configurations during
discovery for use-cases like --filter 'reading=*' where
configurations need to be parsed to determine whether or not
they end up in the final run queue has been fixed.
Configurations will now properly call any configured
- -auth-provider-cmd authenticator before parsing
configurations, preventing errors for HCL functions like
sops_decrypt_file that require authentication.
* What's Changed
chore: Backporting #5590 by @yhakbar in #5593
chore: Backporting #5722 by @yhakbar in #5731
* Fri Feb 20 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.99.4:
* Performance Improvements
- Discovery performance improved
The way in which Terragrunt discovers and filters units and
stacks for runs has improved significantly.
Terragrunt is now better at avoiding parsing units/stacks
unnecessarily, based on the filter you use. Previously, the
logic used was more coarse, and could result in a requirement
to parse some configurations (e.g. presence of a dependency
graph expression to result in parsing all configurations.
Discovery has been refactored to allow for much more careful
opt-in parsing based on the need to support the filter used
by users (or lack thereof).
This will also result in improvements to Terragrunt’s ability
to ignore broken parts of infrastructure estates when
Terragrunt can predictably determine that it won’t impact a
run.
* Bug Fixes
- Invalid unit configurations cause explicit errors instead of
silently being excluded during runs
A bug in discovery logic resulted in units with invalid HCL
configurations being silently excluded from runs with a
warning. This bug has been fixed, and attempting to parse
invalid HCL configurations during a run will result in an
error.
* What's Changed
- chore: Backporting #5477 (#5567)
* Thu Feb 19 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.99.3:
* Bug Fixes
- Over-warning on strict controls prevented
Using --strict-mode resulted in over-warning on completed
controls. Those warnings will no longer appear when using
strict mode.
* What's Changed
- chore: Backport #5501 by @yhakbar in #5566
* Sat Feb 14 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.99.2:
* Bug Fixes
- Interrupt signal propagation to OpenTofu/Terraform fixed
The mechanism by which Terragrunt sends interrupt signals to
OpenTofu/Terraform processes it started has been made more
robust. Terragrunt will now send the interrupt signal in the
event that a user explicitly sends an interrupt signal to
Terragrunt in addition to scenarios where Terragrunt’s
context cancellation is triggered (e.g. in the event of a
timeout).
- SOPS decryption race condition fixed
A race condition in the concurrent access to SOPS decrypted
secrets in different environments combined with usage of the
- -auth-provider-cmd flag resulted in authentication failures.
Synchronization controls have been introduced to ensure
authentication proceeds correctly for each environment
independently.
* What's Changed
- SOPS decode change porting to v0.99 (#5549)
- chore: Backporting #5518 to `v0.99` (#5547)
* Fri Jan 30 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.99.1:
* Bug Fixes
- Pass through null inputs
Fixes a bug where null inputs weren't being passed through
correctly to OpenTofu/Terraform.
* What's Changed
- fix: Fixing null input passing (#5458)
* Tue Jan 27 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.99.0:
* Breaking Changes
- Undocumented behavior removed
We have removed several undocumented features that served as
temporary stop-gaps to facilitate experimentation.
The following environment variables no longer affect
Terragrunt behavior:
- TERRAGRUNT_TEMP_QUOTE_NULL
- TMP_UNDOCUMENTED_REPORT_PADDER
- TMP_UNDOCUMENTED_REPORT_UNIT_COLORIZE
- TMP_UNDOCUMENTED_COLORIZE_DEFAULT_SUMMARY_PADDING
- Internal tflint deprecated
Terragrunt has been shipping with a version of tflint
compiled into the binary to allow for more convenient usage
without installing tflint directly. However due to the
adoption of a BUSL license in tflint, the version included in
Terragrunt was frozen.
We have now deprecated use of the internal tflint hook, and
will be fully removing it in the future. We still do work to
integrate with tflint; Including automatically running tflint
init and passing through variables. For now using the
internal version will only emit a warning, and you can opt in
to the future behavior today in one of two ways:
The legacy-internal-tflint strict control (recommended)
Adding the --terragrunt-external-tflint flag to your hook
usage (this also works in previous versions of Terragrunt);
this flag is stripped prior to running the external tflint.
Example:
terraform {
before_hook "tflint" {
commands = ["apply", "plan"]
execute = ["tflint", "--terragrunt-external-tflint", "--minimum-failure-severity=error", "--config", "custom.tflint.hcl"]
}
}
* New Features
- Depth control for dependency traversal
Graph-based expressions in the --filter flag now support
limiting the depth of graph traversal they perform when
discovering units. You can now append/prepend a number to the
end of a graph expression ellipsis to control how deep in
graph traversal Terragrunt will look for
dependents/dependencies.
e.g.
[#] Find 'service' and only its direct dependencies (1 level deep)
terragrunt find --filter 'service...1'
[#] Find 'vpc' and only components that directly depend on it (1 level)
terragrunt find --filter '1...vpc'
[#] Find 'db' with 2 levels of dependencies and 1 level of dependents
terragrunt find --filter '1...db...2'
This should result in significant performance and usability
improvements for users with large dependency graphs.
Special thanks to @sofianedjerbi for contributing this
feature!
- Run report schema extended
The run report has been extended to include the Ref, Cmd and
Args fields when relevant to a run.
- The Ref field will be populated for runs performed in Git
worktrees due to their discovery from a Git-based
expression in a filter.
- The Cmd field will contain the sub command of
OpenTofu/Terraform executed in a run (e.g. plan , apply)
and the Args field will contain the arguments passed to
that subcommand (e.g. -auto-approve, -destroy). These can
differ between runs when using Git-based expressions, as
additions or modifications of units between Git references
can result in a plan or apply, whereas removal of units can
result in plan -destroy or apply -destroy .
* Experiments Updated
- IaC Engines Updated to use v0.1.0 of terragrunt-engine-go
The iac-engine experiment has been updated to use v0.1.0 of
the terragrunt-engine-go library.
Given that this is still experimental functionality, no
effort has been made to maintain backwards compatibility with
existing engines. If you are currently using the OpenTofu
engine, you will need to upgrade to v0.1.0 of the engine. The
Terraform engine will be updated in the near future.
This update pulls in changes to the protobuf schema used in
communication between Terragrunt and IaC engines to give
engines the ability to log messages in Terragrunt and reduces
the overall size of messages passed to Terragrunt for
stdout/stderr messages.
* Process Updates
- Curl to Bash script available
In addition to all the other installation mechanisms
available to install Terragrunt, a convenient curl to bash
script has been added to minimize the friction in installing
and getting started with Terragrunt, and removing any
dependency on third party tools if you don’t want to use
them.
curl -sL https://terragrunt.gruntwork.io/install | bash
The installation can be customized, with full customization
options available via the --help flag.
curl -sL https://terragrunt.gruntwork.io/install | bash -s -- --help
In addition to providing this script, the ASDF plugin for
Terragrunt has been updated to automatically perform
signature verification on an opt-out basis for any version of
Terragrunt equal or newer to v0.98.0. The Terragrunt entry in
the Aqua registry has been updated to do the same, meaning
mise users will automatically benefit from this as well.
If you don’t want to use the curl to bash script, or any of
the other distribution methods available, the instructions
for performing signature verification manually have been
updated in the installation documentation as well.
* Documentation Updates
- OpenTofu/Terraform compatibility matrix now available as API
In addition to providing a compatibility matrix in the
Supported Versions documentation, compatibility verification
is also available via an API endpoint here:
https://terragrunt.gruntwork.io/api/v1/compatibility
See the compatibility API documentation for more details,
including availability of query string parameters for
filtering responses.
- JSON schema for --auth-provider-cmd published
A JSON schema has been published for the schema expected for
the stdout of commands invoked using --auth-provider-cmd. You
can access the schema here.
You can use tools like this JSON schema validator or other
simple utilities to programmatically validate that the stdout
of JSON responses in your commands invoked by
- -auth-provider-cmd obey the expected schema.
* Bug Fixes
- Exit Codes for run --all more consistent
Fixed an issue where run --all incorrectly returned a 0 exit
code when individual units failed.
- Automatic retry for provider queries
To address intermittent errors in queries to the
OpenTofu/Terraform provider registries, we expanded the
automatic retry logic to include timeouts from provider
registries.
* What's Changed
- fix: Removing unnecessary schema validation (#5416)
- docs: add depth-limited traversal to filter documentation
(#5382)
- fix: docs build (#5415)
- fix: Ensuring go mod cache in addition to go cache (#5411)
- add internal-tflint strict control (#5361)
- feat: Extending report schema (#5401)
- fix: Fixing `TestTUIFinalModel` flake (#5410)
- chore: Committing lockfiles (#5404)
- fix: Improving test speed (#5399)
- fix: Adding `schema.json` for the `auth-provider-cmd` (#5405)
- improve the error message of a test that flaked on me (#5408)
- New ambassador (#5406)
- fix: Adding red test for HTTP backend encryption failing
(#5393)
- docs: Fixing Discord link in README (#5403)
- fix: Adding auto-retry for provider queries (#5395)
- chore: Removing undocumented behavior (#5396)
- fix: Fixing exit codes for `run --all` (#5385)
- chore: Upgrade `golangci-lint` to `v2.8.0` (#5365)
- feat: Using updated `v0.1.0` version of
`terragrunt-engine-go` (#5381)
- docs: compatibility API (#5383)
- Updates to LP (#5391)
- fix: Addressing empty mark as read (#5387)
- Revert "Migrate workflows to Blacksmith (#5388)" (#5389)
- Migrate workflows to Blacksmith (#5388)
- feat: install script for Terragrunt (#5364)
- chore: Removing `runfn` package (#5359)
- feat(filter): add depth control for dependency traversal
(#5268)
- Update error messages to deduplicate (#5375)
* Tue Jan 20 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.98.0:
* New Features
- The --filter flag now implies --all
When using the --filter flag, it is now optional to also
supply --all. Terragrunt will automatically set the --all
flag when you use the --filter flag.
* Bug Fixes
- Plan files are now correctly passed as CLI arguments for
destroy operations
A bug in the logic used for injecting plan files as arguments
to the apply -destroy command resulted in the plan file
argument being injected prior to the -auto-approve flag,
which is disallowed in OpenTofu/Terraform. That bug has been
fixed.
- GCS bootstrap authentication fixed
A bug in the authentication logic for GCS backends prevented
successful bootstrapping of backends when using the
- -auth-provider-cmd flag. That bug has been fixed.
- Git-based and Graph-based combinations fixed
A bug in the discovery logic for Git worktrees prevented
using a combination of Git-based and Graph-based filter
expressions in the same filter from working correctly.
e.g.
terragrunt find --filter '...^[HEAD^...HEAD]...'
That bug has been fixed.
- Proper exit codes returned from -detailed-exitcode
A bug in the logic for handling retries combined with the
OpenTofu/Terraform plan -detailed-exitcode and the Terragrunt
- -all flag resulted in the wrong exit code being returned
when a failed run succeeded on a subsequent retry with a
status code related to drift (exit code 2).
That logic has been corrected, and properly follows the rules
outlined under the --all flag:
When not using -detailed-exitcode:
- Terragrunt will return the highest exit code of all runs
performed.
When using -detailed-exitcode:
- If any run has an exit code that is 1, or greater than 2,
run --all will return the highest exit code.
- Otherwise, if any run returns an exit code of 2, run --all
will return an exit code of 2.
- Otherwise, run --all will return an exit code of 0.
- OpenTelemetry traces in console mode fixed
A bug in OpenTelemetry trace exporting prevented traces from
being exported when in console mode. That bug has been fixed.
- Negation logic fixed
A bug in how negation logic was handled in filter expressions
prevented successful exclusion of stacks from generation and
over excluded units in runs when users only supplied negative
filters.
* Process Improvements
- Upgrade to Go 1.25.5
The Golang toolchain used to build Terragrunt has been
upgraded to v1.25.5.
- Package reorganization
All top-level Golang packages in the Terragrunt project have
been migrated to either internal or pkg. The distinction
between the two indicates maintainer expectations as to
whether either are being actively being consumed as libraries
by third parties (with internal being impossible to import
without vendoring in go modules).
Note that this does not indicate any backwards compatibility
guarantee for usage of the Terragrunt as a library. It will
remain unstable, and can change at any time.
* What's Changed
- docs: Cleaning up references to filter as an experiment
(#5366)
- chore: cloud dependencies update (#5374)
- fix: Fixing negation logic (#5368)
- fix: Cleanup from #5342 (#5356)
- Fix link to Dallas Slaughter (#5370)
- fix: traces output in console mode (#5329)
- fix: Addressing #5355 feedback (#5363)
- fix: Fixing `-detailed-exitcode` (#5362)
- chore: Remove `RunTarget` from `options` (#5264)
- chore: Lint everything when linting (#5344)
- chore: Dropping more utils (#5300)
- fix: Fixing Git-expression + Graph-expression filter
combinations (#5355)
- chore: moved cli package to internal/cli (#5345)
- chore: internal packages update (#5360)
- chore: pkg packages organisation (#5358)
- feat: Automatically enable `--all` when using `--filter`
(#5265)
- fix: Fixing auth in GCS bootstrap (#5342)
- chore: scripts directories cleanup (#5343)
- chore: move engine to internal package (#5340)
- feat: release files signing (#5291)
- chore: Undo `--all` and `--graph` wrap (#5257)
- chore: go 1.25.5 version update (#5339)
- bug: Fixed passing of existing destroy plan files (#5327)
- Typo (#5331)
- Adding ambassadors (#5330)
- build(deps): bump @smithy/config-resolver (#5328)
* Mon Jan 12 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.97.2:
* Performance Improvements
- Partial parse used for get_working_dir()
To assess where Terragrunt is going to run OpenTofu, it needs
partially parsed information from the relevant terragrunt.hcl
file of the unit running the HCL get_working_dir() function.
The function was performing a full parse of the
terragrunt.hcl file, which can be slow for users with large
HCL configurations.
Given that the parse only requires access to the value of
source in the terraform block, a partial parse is now
performed by the function, only looking at the contents of
the terraform block, improving performance significantly.
* Bug Fixes
- False positive parsing errors suppressed
When parsing an include that defined dependencies, the HCL
parser used by Terragrunt would emit spurious errors that are
internally ignored. Those messages are now suppressed.
- Signal propagation for interrupts fixed
A bug in how Terragrunt forwarded signals to processes it
spawned (like running tofu) resulted in underlying processes
receiving SIGKILL signals rather than the original signal
(e.g. SIGINT) sent to the Terragrunt process. That has been
fixed.
* Chores
- Avoiding contextcheck suppression
While not changing much functionally in Terragrunt, this
release did involve quite a lot of changes to Terragrunt
internals. The majority of these changes related to better
propagation of the Golang
[context](https://pkg.go.dev/context) object to better obey
Golang best practices. These issues were reported by the
contextcheck linter in the codebase, but the findings were
suppressed due to the scope of work required to address them.
These changes should make it so that context is propagated
correctly more reliably in the codebase, increasing the
usefulness of things like OpenTelemetry tracing and reduced
resource usage.
Note that some public function signatures have changed in the
Terragrunt codebase, which may be a breaking change to users
consuming Terragrunt as a library. Given that we do not offer
any stability guarantees for usage of Terragrunt as a
library, these changes are still to be included in a patch
release.
* What's Changed
- fix: Fixing signal propagation issues (#5326)
- chore: Avoiding `contextcheck` suppression (#5320)
- build(deps): bump golang.org/x/crypto in /test/flake (#5322)
- fix: Locking during run ensure calls (#5312)
- build(deps): bump golang.org/x/oauth2 in /test/flake (#5323)
- build(deps): bump github.com/cloudflare/circl in /test/flake
(#5324)
- chore: Cleaning up HCL fn spans (#5315)
- fix: Using a partial parse for `get_working_dir()` (#5318)
- chore: Adding flake utility (#5311)
- fix: Fixing flaky tests (#5316)
- bug: false positive parsing errors (#5258)
* Mon Jan 12 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.97.1:
* New Features
- All HCL functions instrumented with OpenTelemetry
All Terragrunt HCL functions now emit OpenTelemetry spans
when they run, making it easier to understand HCL function
usage and performance.
- HCL parsing telemetry improved
Additional fidelity has been added to traces emitted during
parsing to give insight as to why configuration parsing is
being performed, and how.
* Bug Fixes
- plan -destroy called correctly for --filter-affected
A bug in the logic for --filter-affected resulted in removed
units getting planned/applied instead of being destroyed when
users supplied --filter-allow-destroy. That bug has been
fixed.
- Nested spans in track parents appropriately even when the
TRACEPARENT environment variable is used.
A bug in the logic for propagating TRACEPARENT as the
ultimate parent of traces started in Terragrunt prevented
child traces from properly tracking parent spans. That bug
has been fixed.
- Reports on runs in worktrees now use relative directories to
worktree root
Instead of displaying runs of units in Git worktrees during
Git-based filter expression runs with the absolute path of
their directories in a temporary directory, they now display
with the path to the unit relative to the root of the
worktree.
- Unnecessary relationship discovery prevented
Discovery of relationships between units has been made opt-in
in the discovery process. This will result in no changes to
usage of commands like run --all, but will significantly
improve the performance of commands like list and stack
generate.
* What's Changed
- chore: Increasing telemetry of config parsing (#5309)
- fix: Avoiding unnecessary relationship discovery (#5313)
- fix: Fixing worktree reports (#5308)
- chore: Adding spans for HCL functions (#5306)
- fix: Fixing nested spans (#5305)
- New ambassador (#5302)
- chore: Dropping usage of `MapToSlice` and `StringListInsert`
(#5297)
- fix: Fixing `plan -destroy` logic in Git-diffs (#5295)
- Adding ambassadors (#5296)
* Mon Jan 12 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.97.0:
* Breaking Changes
- The --queue-strict-include flag is deprecated
Terragrunt no longer automatically includes dependencies of
included units. As such the --queue-strict-include flag is no
longer useful in the Terragrunt CLI.
The flag has been deprecated, and no longer does anything.
This flag will not be removed before 2.0.
- Run report no longer reports --queue-exclude-dir as a reason
for exclusion
Run reports no longer report on units excluded from runs as a
consequence of the --queue-exclude-dir flag.
- The --units-that-include flag is deprecated
The --units-that-include flag is now an alias for the
reading= attribute filter, just like the
- -queue-include-units-reading flag.
Given that the two flags no longer differ in functionality,
and that the functionality of the --units-that-include is no
longer strictly including units that are included, the flag
has been deprecated.
- The double-star strict control is complete
The globbing behavior of Terragrunt in CLI flags has been
updated to match all paths when ending with a trailing ** .
* Experiments Completed
- The filter-flag experiment is completed
The filter-flag experiment is completed, and the --filter
flag is now generally available.
You can use filter expressions as a single unified API for
controlling the Run Queue, replacing the need to use the
following CLI flags:
Legacy —queue flag Equivalent —filter expression
—-queue-include-dir=path —-filter='{./path}'
—-queue-exclude-dir=path —-filter='!{./path}'
- -queue-include-units-reading=root.hcl --filter='reading=root.hcl'
- -units-that-include=root.hcl --filter='reading=root.hcl'
- -queue-include-external-dependencies --filter='{./**}...'
- -queue-excludes-file=excludes.txt --filters-file='filters.txt' *
- -graph --filter='...{.}'
Note that the file used for the --queue-excludes-file does
not directly translate to the kind of file you can use for a
- -filters-file. To learn more, see the documentation.
The table above also explains the aliasing that has been done
internally to replace queue flags with their filter
equivalents. The aliasing for these queue flags is present
purely for backwards compatibility purposes, but they are not
going to emit deprecation warnings, and will not be removed
before the Terragrunt 1.0 release.
You are heavily encouraged to adopt the new --filter flag for
your infrastructure targeting needs as soon as feasible in
your workflows. It will offer a significantly more flexible
and powerful experience.
To learn more see the Filters feature documentation.
https://terragrunt.gruntwork.io/docs/features/filter
* Bug Fixes
- The get_original_terragrunt_dir() function is now supported
in terragrunt.stack.hcl files
When authoring explicit stacks, using the
get_original_terragrunt_dir() HCL function in
terragrunt.stack.hcl files will now return the directory
where the terragrunt.stack.hcl file lives, even when the
configuration is read from another stack/unit using
read_terragrunt_config().
- Using Git-based expressions with the --out-dir flag is fixed
When using Git-based expressions using the --filter flag, the
relative path of units relative to their respective Git
worktree roots is used for determining where the plan file
will be saved, rather than a path in the relevant Git
worktree.
- Color for output fetching is suppressed more reliably
Terragrunt will use tofu output -json / terraform output
- json more reliably when users expect a lack of colors (like
when colors are suppressed for Terragrunt).
* What's Changed
- fix: added git worktree cleanup on errors (#5254)
- chore: add no color for dependency fetching (#5285)
- fix: saving of plan in git based filtering (#5288)
- fix: `get_original_terragrunt_dir` during stack generate
(#5176)
- chore: opentelemetry and aws dependencies update (#5279)
- feat: on demand no proxy build execution (#5277)
- Adding ambassador (#5266)
- docs: Documenting backport of queue flags into filter flags
(#5263)
- chore: Backporting queue flags into filter flags (#5241)
- chore: Removing latest Terraform OSS workflows (#5262)
- Adding announcement banner (#5260)
- Adding ambassador (#5259)
- Adding ambassador (#5261)
- chore: Adding debug log for assume already applied (#5198)
- chore: Dropping `ListContains` and `ListEquals` and using
standard library instead (#5221)
- fix: improved log error messages (#5256)
- fix: Fixing report run duplication error (#5252)
- chore: Cleaning up test symlinks resolution (#5251)
- fix: Using `testing/synctest` to make
`TestWriteUnitLevelSummary` more reliable (#5253)
* Thu Dec 18 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.96.1:
* Experiments Updated
- The --filter-affected flag has more robust determination of
the default branch in a Git repository
The --filter-affected flag will now use Git plumbing to
interrogate the default branch as considered by the remote
repository before falling back to interrogating local
configurations for determination of a default branch
(remember that you must use the filter-flag experiment to try
this out).
[#] This is checked first
$ git rev-parse --abbrev-ref origin/HEAD
[#] Followed by this
$ git ls-remote --symref origin HEAD
[#] Followed with this
$ git config init.defaultBranch
[#] If none of the above succeed, the default branch is assumed to be `main`.
- Git-based filter expressions now warn users when using local
state
Usage of --filter Git-based expressions in combination with
local state will now emit a warning, recommending usage of
remote states (remember that you must use the filter-flag
experiment to try this out).
$ terragrunt run --all --filter '[HEAD~1...HEAD]' -- plan
09:30:38.017 WARN One or more units discovered using Git-based filter expressions (e.g. [HEAD~1...HEAD]) do not have a remote_state configuration. This may result in unexpected outcomes, such as outputs for dependencies returning empty. It is strongly recommended to use remote state when working with Git-based filter expressions.
See the warning at the bottom of Git-based expressions
documentation for more information.
https://terragrunt.gruntwork.io/docs/features/filter/#git-based-expressions
- OpenTelemetry traces added for filter evaluation
Filter evaluation now emits OpenTelemetry spans and metrics,
including filter resolution details, evaluation duration, and
filtering scope. This helps teams analyze performance and
pinpoint bottlenecks in filtering with large Terragrunt
repositories.
* Bug Fixes
- Path-based filters targeting external paths fixed
A bug in the parsing of path-based filter expressions in the
- -filter flag of the filter-flag experiment prevented parsing
of path-based filters for external paths (e.g. --filter
../external-dir). This bug has been fixed.
- HTTPS Git CAS URLs fixed
A bug in the parsing of source URLs with forced usage of the
Git protocol (e.g. git::https://github.com/acme/catalog)
prevented using the cas experiment with HTTPS Git URLs with
forced usage of the Git protocol. This bug has been fixed.
- Regression of support for root terragrunt.hcl fixed
A bug in the processing of --queue-exclude-dir resulted in
prefix based matching of non-glob expressions in
- -queue-exclude-dir values. This broke backwards
compatibility for users with a root terragrunt.hcl file
instead of a differently named file for the root include
(e.g. root.hcl). This bug has been fixed.
Note that you are still advised to migrate away from using a
root terragrunt.hcl as soon as possible for your team. We
will maintain backwards compatibility until at least 2.0,
however.
* What's Changed
- feat: add opentelemtry integration in filter flag (#5247)
- fix: Adding warnings for local state usage with Git-based expressions (#5245)
- fix: Fixing regression with support for include of root `terragrunt.hcl` (#5249)
- docs: Cleaning up some docs (#5239)
- fix: Use more robust default branch detection in Git-based expressions (#5243)
- fix: Fixing warnings for how to replicate (#5246)
- fix: Fixing HTTPS CAS URLs (#5240)
- fix: Fixing parsing of external filters (#5238)
- chore: Dropping `util.JoinPath` (#5219)
- chore: Verify `--filter` results in minimal parsing (#5229)
- chore: Verify `--queue-include-external` isn't necessary when using the `--filter` flag (#5216)
* Tue Dec 16 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.96.0:
* Breaking Changes
- The --no-destroy-dependencies-check flag has been deprecated
The default behavior of Terragrunt with respect to checking
dependents during destroys has been inverted. As a
consequence the --no-destroy-dependencies-check has been
deprecated, and a new --destroy-dependencies-check flag has
been introduced.
Previously, Terragrunt would automatically parse all
configurations that might depend on a unit being destroyed to
warn users that the destroyed configuration might orphan
other units that depend on it. This was frequently
undesirable behavior due to the fact that it introduced
additional unnecessary work (parsing all HCL configurations
unnecessarily), and could introduce errors if users had
unrelated invalid HCL configurations.
Terragrunt now requires that users opt-in to this behavior
via the new --destroy-dependencies-check flag, which enables
the destroy check, and will not perform the destroy check by
default.
terragrunt run --destroy-dependencies-check -- destroy
To learn more, see the no-destroy-dependencies-check strict
control.
https://terragrunt.gruntwork.io/docs/reference/strict-controls/#no-destroy-dependencies-check
- The --disable-command-validation flag has been deprecated
Terragrunt no longer performs command name validation when
passing commands to OpenTofu/Terraform from Terragrunt when
using the run command. This makes the
- -disable-command-validation flag unnecessary, as the lack of
validation is now the default behavior.
Previously, Terragrunt had no way to explicitly indicate that
a command being used on the Terragrunt CLI was intended as a
passthrough to the OpenTofu/Terraform CLI, so it was
important that validation be done on the command being
supplied on the Terragrunt CLI.
Since completion of the CLI Redesign, this has changed
significantly. Users now have explicit shortcuts on the
Terragrunt CLI for common OpenTofu/Terraform commands and an
explicit interface for passing through OpenTofu/Terraform
commands to the OpenTofu/Terraform CLIs using the run
command. By removing this validation, Terragrunt will now
automatically support new OpenTofu/Terraform commands in
future versions of the tools and allow for greater
flexibility in IaC Engines, as novel commands can be
introduced.
To learn more, see the disable-command-validation strict
control.
https://terragrunt.gruntwork.io/docs/reference/strict-controls/#disable-command-validation
- The --experimental-engine flag now enables the iac-engine experiment
The experimental IaC Engine feature was introduced in
Terragrunt prior to the introduction of the experiment
system. As such, it wasn’t enabled when users enabled
experiment mode, and didn’t have a dedicated section in the
experiments docs.
The --experimental-engine flag is now an alias for explicitly
enabling the iac-engine experiment, and using IaC Engines
will be allowed when using Terragrunt in experiment mode.
This increases consistency with how experimental features are
managed in Terragrunt, and reduces the surface area users
have to be aware of in the Terragrunt CLI.
terragrunt run --experiment=iac-engine
Note that you can explicitly disable usage of engines now
with the --no-engine flag, even when the experiment is
active.
terragrunt run --experiment=iac-engine --no-engine
To learn more, see the iac-engine experiment.
https://terragrunt.gruntwork.io/docs/reference/experiments/#iac-engine
- The --dependency-fetch-output-from-state flag now enables the
dependency-fetch-output-from-state experiment
The experimental —dependency-fetch-output-from-state flag was
introduced in Terragrunt prior to the introduction of the
experiment system. As such, it wasn’t enabled when users
enabled experiment mode, and didn’t have a dedicated section
in the experiments docs.
The --dependency-fetch-output-from-state flag is now an alias
for explicitly enabling the
dependency-fetch-output-from-state experiment, and Terragrunt
will automatically attempt to fetch outputs from backend
state when in experiment mode. This increases consistency
with how experimental features are managed in Terragrunt, and
reduces the surface area users have to be aware of in the
Terragrunt CLI.
terragrunt run --experiment=dependency-fetch-output-from-state
Note that you can explicitly disable fetching output from
state with the --no-dependency-fetch-output-from-state flag,
even when the experiment is active.
terragrunt run --experiment=dependency-fetch-output-from-state --no-dependency-fetch-output-from-state
To learn more, see the dependency-fetch-output-from-state
experiment.
https://terragrunt.gruntwork.io/docs/reference/experiments/#dependency-fetch-output-from-state
* Experiments Updated
- The filter-flag experiment now supports the --filters-file
flag
The --filters-file flag has been introduced to allow for the
application of multiple filters as defined in a
newline-delimited text file, similar to the existing
- -excludes-file flag (remember that you must use the
filter-flag experiment to try this).
[#] custom-filters.txt
!./unstable/**
$ terragrunt find --filters-file custom-filters.txt
[#] No results in `./unstable` discovered.
When the filter-flag experiment is active, Terragrunt will
automatically parse and apply filters found in a
.terragrunt-filters file, similar to how it automatically
parses and applies excludes found in a .terragrunt-excludes
file.
[#] .terragrunt-filters
!./unstable/**
[#] Note that it only does this by default when the experiment is active.
terragrunt find
[#] Still no results in `./unstable` discovered.
To explicitly disable usage of filter files (including the
automatic .terragrunt-filters file), use the
- -no-filters-file flag.
[#] .terragrunt-filters
!./unstable/**
[#] Note that it only does this by default when the experiment is active.
terragrunt find --no-filters-file
[#] This _will_ allow results in `./unstable` to be discovered.
Unlike the --excludes-file, usage of the --filters-file flag
also allows for always filtering for particular
configurations.
[#] .terragrunt-filters
./always-include/**
To learn more, see the filters file documentation.
https://terragrunt.gruntwork.io/docs/reference/cli/commands/run/#the-filters-file
* Bug Fixes
- Unnecessary .terragrunt-cache directory no longer generated
in run --all runs
Fixed a regression where run --all would create empty
.terragrunt-cache directories in the current working
directory, even when not needed.
* What's Changed
- docs: Documenting `--filters-file` flag (#5112)
- feat: Adding `--destroy-dependencies-check` (#5204)
- fix: Remove unnecessary `.terragrunt-cache` dir at the stack
level (#5231)
- feat: Add `dependency-fetch-output-from-state` experiment
(#5201)
- feat: Add `iac-engine` experiment (#5203)
- feat: Removing support for `--disable-command-validation`
(#5189)
- feat: Adding `--filters-file` flag (#5111)
- build(deps): bump actions/cache from 4 to 5 (#5234)
- build(deps): bump actions/download-artifact from 6 to 7
(#5235)
- build(deps): bump actions/upload-artifact from 5 to 6 (#5233)
- docs: Fix Runner Pool description in terminology section
(#5236)
- Update terminology from 'module' to 'unit' in scaffold.md
(#5121)
* Sun Dec 14 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.95.1:
* Experiments Updated
- The filter-flag experiment now supports the --filter-affected
flag
The --filter-affected flag has been introduced as an
convenience alias for --filter [main...HEAD] (remember that
you must use the filter-flag experiment to try this).
terragrunt find --filter-affected
Note that if you have local Git configurations that results
in a different branch being your default branch, that branch
will be used instead of main.
* Bug Fixes
- Integration of --queue-strict-include with
- -queue-include-units-reading fixed
A regression in --queue-strict-include resulted in empty run
queues when using a combination of --queue-strict-include
with --queue-include-units-reading. That bug has been
resolved.
- Integration of --source with run --all fixed
A regression in --source prevented it from working correctly
in combination with run --all , resulting in empty run
queues. That bug has been resolved.
- Integration of Git-expressions with explicit stacks
A bug in the implementation of explicit stack generation for
Git-expressions prevented stacks from being generated in Git
worktrees when using Git-expressions in the filter-flag
experiment. That bug has been resolved.
* Chores
- Dependencies updates
- cloud.google.com/go/storage —> v1.58.0
- github.com/aws/aws-sdk-go-v2 —> v1.41.0
- github.com/hashicorp/go-version —> v1.8.0
- github.com/aws/smithy-go —> v1.24.0
* What's Changed
- fix: Fixing `--queue-strict-include` integration with
`--queue-include-units-reading` (#5222)
- chore: go cloud dependencies update (#5183)
- docs: Documenting `--filter-affected` (#5110)
- bug: improved dependency config path validation (#5212)
- fix: Fixing Git expressions with explicit stacks (#5223)
- feat: Adding `--filter-affected` flag (#5109)
- fix: Fixing integration of `run --all` with `--source`
(#5209)
- chore: Re-enabling `TestAwsDocsTerralithToTerragruntGuide`
test (#5220)
- chore: worktree tests simplification (#5217)
- docs: Fixing Git-based docs (#5218)
- fix: Cleaning up `TestExcludeDirs` tests (#5215)
* Fri Dec 12 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.95.0:
* Breaking Changes
- The --queue-exclude-external flag has been deprecated
Previously, Terragrunt would automatically pull in external
dependencies (dependencies outside the current working
directory when running terragrunt run --all) into the run
queue.
To prevent this behavior, users had to manually supply the
- -queue-exclude-external flag. This has caused significant
confusion and unexpected behavior for users over the duration
of it’s existence in the Terragrunt CLI. To prevent this
unexpected behavior for users and follow the principle of
least surprise, this flag has been deprecated and its
behavior is now the default in Terragrunt.
To explicitly request inclusion of external dependencies in
the run queue, use the —queue-include-external flag.
https://terragrunt.gruntwork.io/docs/reference/cli/commands/run/#queue-include-external
* Process Updates
- OpenTofu 1.11.x added to compatibility matrix
We are now continuously testing against OpenTofu 1.11.1 in
our Continuous Integration testing, and have updated the
compatibility matrix to reflect that.
https://terragrunt.gruntwork.io/docs/reference/supported-versions/
* Updated Experiments
- The filter-flag experiment now supports Git-based expressions
The --filter flag can now be used to filter units based on
changes in Git history (remember that you must use the
filter-flag experiment to try this).
[#] Compare between two references
terragrunt find --filter '[main...HEAD]'
[#] Shorthand: compare reference to HEAD
terragrunt find --filter '[main]'
[#] Compare between specific commits
terragrunt find --filter '[abc123...def456]'
[#] Compare between tags
terragrunt find --filter '[v1.0.0...v2.0.0]'
[#] Compare using relative references
terragrunt find --filter '[HEAD~1...HEAD]'
[#] Compare between branches
terragrunt find --filter '[feature-branch...main]'
For more information, see the dedicated documentation on
Git-Based Filtering.
https://terragrunt.gruntwork.io/docs/features/filter/#git-based-filtering
* Bug Fixes
- Units now properly flush stdout in run --all
A regression in unit stdout flushing caused stdout for unit
logs to hang pending resolution of run --all runs. This
regression has been fixed to ensure that logs are streamed in
real time again.
- Queue entries now properly run, even if dependent units are
excluded
A bug in run queue optimization made it so that excluding the
dependent of a unit within a multi-unit run queue would
incorrectly exclude the dependency unit from the run queue.
This bug has been resolved, and units are now properly
included, even if their dependents are excluded.
- Provider cache server only contacts relevant registries
The provider cache server was incorrectly establishing a
connection with multiple registries even though only one
registry for a given IaC tool run by Terragrunt. For users
with network-restricted environments, this could cause
problems. Terragrunt will now only contact the relevant
registry for a given IaC tool unless users explicitly request
for usage of multiple registries.
* Documentation Updates
- Provider cache server no longer documented as experimental
The Provider Cache Server has been used in production by a
good portion of the Terragrunt community based on voluntary
community reporting. The need for the feature is also
mitigated by advances in OpenTofu that makes the Automatic
Provider Cache Dir the default solution all Terragrunt users
using OpenTofu ≥ v1.10.0.
As such, the Provider Cache Server has been promoted to a
generally available feature that is exclusively opt-in for
users that cannot benefit from the Automatic Provider Cache
Dir feature, or are better served by the Provider Cache
Server due to scale or platform limitations.
* What's Changed
- docs: Documenting `--filter` Git support (#5108)
- chore: Upgrade to Opentofu 1.11 (#5214)
- feat: Adding `--filter-allow-destroy` flag (#5210)
- bug: runner pool external dependencies inclusion fix (#5199)
- Adding new ambassador (#5211)
- fix: Temporarily skipping
`TestAwsDocsTerralithToTerragruntGuide` until we get a new
release (#5208)
- docs: Documenting stacks limitations (#5188)
- fix: Fixing #5192 (#5194)
- feat: filter git improvements (#5184)
- chore: Adding `--queue-exclude-dir` / `--filter` equivalence
test (#5078)
- fix: Only call necessary registries based on
OpenTofu/Terraform usage (#5196)
- bug: unit output flushing (#5193)
- docs: Updating documentation around the provider cache server
(#5190)
- Nav revisions (#5172)
- build(deps): bump mikepenz/action-junit-report from 5 to 6
(#5046)
- build(deps): bump DavidAnson/markdownlint-cli2-action from 20
to 21 (#5140)
- build(deps): bump actions/checkout from 5 to 6 (#5141)
- Reapply "fix: Remove outdated Bun/Node locking" (#5186)
- Revert "fix: Remove outdated Bun/Node locking"
- fix: Remove outdated Bun/Node locking
- feat: Adding --filter Git support (#5166)
* Tue Dec 09 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.94.0:
* Features
- Terraform 1.14: We are now testing Terragrunt against
Terraform 1.14 and is confirmed to be working.
NOTE: Although this release is marked as backward
incompatible, it is functionally compatible as nothing has
been changed in Terragrunt internals. The minor version
release is useful to mark the change in Terraform version
that is being tested.
* What's Changed
- chore: add support for Terraform 1.14 (#5180)
- feat: Usage of common for discovery and runnerpool (#5100)
* Mon Dec 08 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.13:
* Bug Fixes
- Catalog module source URL construction
Fixed malformed version-pinned catalog module URLs where
TerraformSourcePath() incorrectly placed //moduleDir after
?ref=, ensuring correct root and submodule URL formatting.
* What's Changed
- fix(catalog): construct valid module source URLs for
version-pinned modules #5173 (#5174)
- Adding 2 addt'l ambassadors (#5164)
* Fri Dec 05 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.12:
* Bug Fixes
- False positive errors during dependent units discovery
Reduced false-positive log messages emitted while discovering
dependent units during destroy operations.
* What's Changed
- fix: false positive errors during dependent units discovery
(#5137)
- chore: cloud dependencies update (#5150)
- Adding Terragrunt Scale FAQ (#5147)
- Terragrunt Ambassadors (#5138)
* Tue Nov 25 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.11:
* Bug Fixes
- Stack files matching
Fixed stack detection so only files whose base name exactly
matches the default stack name are treated as stack files.
* What's Changed
- fix: exact matching of stack files (#5129)
* Fri Nov 21 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.10:
* Bug Fixes
- Handling of disabled units in discovery
Discovery now skips units that are marked as disabled.
* What's Changed
- fix: Avoid discovering dependencies if they are disabled
(#5119)
- docs: Documenting how CAS works (#5115)
- build(deps): bump js-yaml in /docs-starlight (#5117)
* Tue Nov 18 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.9:
* New Features
- Added support for Openbao encryption provider
Key provider now supports openbao
* Bug Fixes
- Fixed error in calling sensitive() function in HCL
HCL sensitive() function now correctly handles values and
calls without errors.
* What's Changed
- deps: updated aws and gcp dependencies (#5107)
- bug: sensitive() values handling in HCL (#5097)
- support Openbao as an encryption provider (#5048)
* Thu Nov 13 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.8:
* Process Improvements
- Terragrunt static executables
Release pipeline now publishes statically linked executables
* What's Changed
- chore: static executables building (#5093)
- chore: Re-enable units reading with filter test (#5077)
- chore: updated installation steps (#5091)
* Thu Nov 13 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.7:
* fix(discovery): add OriginalTerragruntConfigPath to parse
options and test its functionality (#5090)
* chore: release scripts simplification (#5085)
* Thu Nov 13 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.6:
* Process Improvements
- Terragrunt release automation moved to GitHub Actions
The release automation for Terragrunt has moved to GitHub
Actions. With this move, Terragrunt releases now support:
- Windows binary signing
- Additional packaging for artifacts (.zip and .tar.gz
release artifacts)
You can still download standalone executables from release
assets for backward compatibility.
* Experiments Updated
- The filter-flag experiment now supports the source= attribute
The --filter flag can now be used to filter units by their
usage of particular OpenTofu/Terraform modules in their
terraform source blocks (remember that you must use the
filter-flag experiment to try this).
[#] Filter by exact source match
terragrunt find --filter 'source=github.com/acme/foo'
terragrunt find --filter 'source=gitlab.com/example/baz'
terragrunt find --filter 'source=./module'
[#] Filter by source using glob patterns
terragrunt find --filter 'source=*github.com**acme/*'
terragrunt find --filter 'source=git::git@github.com:acme/**'
terragrunt find --filter 'source=**github.com**'
terragrunt find --filter 'source=gitlab.com/**'
For more information, see the filter feature documentation.
https://terragrunt.gruntwork.io/docs/features/filter/#source-based-filtering
* What's Changed
- docs: Documenting `--filter` for `source=` attribute (#5076)
- feat: Adding `--filter` `source=` support (#5075)
- chore: Github action release improvements (#5066)
- chore: Switching to mise for go install in tidy check (#5082)
* Tue Nov 11 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.5:
* Experiments Updated
- The filter-flag experiment now supports --filter in stack
generate
The --filter flag can now be used in the stack generate
command, and any command that performs stack generation, e.g.
run --all (remember that you must use the filter-flag
experiment to try this).
The --filter flag works in a slightly unique way when used to
control stack generation in that it needs to be explicitly
restricted to stacks for it to impact stack generation using
the type=stack attribute filter.
e.g.
[#] Supported: Only generate the stacks that match the
[#] filter, as we are explicitly indicating that we are
[#] targeting stacks.
terragrunt stack generate --filter 'name=prod | type=stack'
[#] Not supported: This filter will be ignored, as we are not
[#] explicitly indicating that we are targeting stacks.
terragrunt stack generate --filter 'name=prod' # This will not work
The reason for this is that stack generation can also be done
automatically as part of other commands, like run, and thus
we need to make it clear that we’re trying to control stack
generation rather than run behavior.
[#] This will run any unit named 'vpc'
terragrunt run --all --filter 'vpc' -- plan
[#] This will run any unit named 'vpc', and prevent stack
[#] generation in any stack not named 'dev' (including any
[#] stacks named 'vpc')
terragrunt stack run --filter 'vpc' --filter 'name=dev | type=stack' -- apply
For more information, see the filter feature documentation
https://terragrunt.gruntwork.io/docs/features/filter/#stack-generate
* What's Changed
- docs: Documenting `--filter` for `stack generate` (#5084)
- feat: Adding support for `--filter` in `stack generate`
(#5073)
* Mon Nov 10 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.4:
* Updated Experiments
- The filter-flag experiment now supports graph expressions
The --filter flag now supports usage of graph expressions,
allowing users to filter based on the dependency relationship
of units discovered by Terragrunt (remember that you must use
the filter-flag experiment to try this).
e.g.
[#] Find 'service' and everything it depends on
terragrunt find --filter 'service...'
[#] Find 'vpc' and everything that depends on it
terragrunt find --filter '...vpc'
[#] Find 'db' and its complete dependency graph
terragrunt find --filter '...db...'
[#] Find all dependents of 'vpc' but exclude 'vpc' itself
terragrunt find --filter '...^vpc'
You can learn more about graph-based filtering in the filter
feature documentation.
* What's Changed
- docs: Documenting filter graph expressions (#5050)
- fix: Avoiding panic on missing `if_exists` (#5072)
- feat: Adding support for graph expressions in `--filter`
(#5049)
- chore: Adding Travis as a code owner (#5067)
- feat: Integrating filters into discovery (#5034)
- chore: Refactor direct access of `run` command flags to
access in `shared` package (#5062)
- bug: discovery parsing errors handling (#5037)
- chore: Refactor logic for `run` into dedicated internal
package (#5060)
* Thu Nov 06 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.3:
* Bug Fixes
- hcl validate --inputs regression on validation blocks
resolved
A bug introduced in v0.93.1 preventing hcl validate --inputs
from succeeding on OpenTofu/Terraform modules with variables
containing validation blocks. This was caused by an error in
the update to OpenTofu/Terraform .tf file parsing by
Terragrunt in the hcl validate command.
That bug has been resolved.
* What's Changed
- Allow validation blocks in inputs (#5063)
- build(deps): bump tar from 7.5.1 to 7.5.2 in /docs-starlight
(#5057)
- chore: Updating pin to `v0.93.2` for remote references
(#5058)
* Wed Nov 05 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.2:
* New Features
- The list command now supports the dot fomat
The list command can now render its output in the Graphviz
DOT language:
$ terragrunt list --format=dot --dependencies
digraph {
"live/dev/vpc" ;
"live/dev/db" ;
"live/dev/ec2" ;
"live/dev/db" -> "live/dev/vpc";
"live/dev/ec2" -> "live/dev/db";
"live/dev/ec2" -> "live/dev/vpc";
"live/prod/vpc" ;
"live/prod/db" ;
"live/prod/ec2" ;
"live/prod/db" -> "live/prod/vpc";
"live/prod/ec2" -> "live/prod/db";
"live/prod/ec2" -> "live/prod/vpc";
}
This was previously only possible using the dag graph
command, but that command has been refactored to be an alias
for the list --format=dot --dependencies command, to provide
greater flexibility in how graphs are rendered in the DOT
language. This includes integration with the experimental
Filter feature.
You can learn more about this in the list command
documentation
https://terragrunt.gruntwork.io/docs/reference/cli/commands/list/#dot-format
* What's Changed
- docs: Documenting `dot` format for the `list` command (#5042)
- chore: Refactor `find` & `list` so that they use a single
write instead of intermediate writes (#5027)
- feat: Moving `dag graph` to `list` (#5013)
- fix: Pinning commit until we can fix more permanently
- chore: Disable experimental tests ignore in CI
- chore: CICD updates (#5056)
* Tue Nov 04 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.1:
* Performance Improvements
- Reduced redundant --auth-provider-cmd invocations during
run-all
- This cuts down on external credential calls and lowers
authentication overhead for large runs.
- Updated the unit resolver to reuse the configuration parsed
during discovery instead of re-parsing each terragrunt.hcl.
- This reduces HCL parses and allocations, shortening execution
time on complex stacks.
In our internal “Run all with Auth Provider” benchmark (10
runs, ~10 ms on auth command), these changes reduced average
runtime from ~235 ms to ~213 ms (about 9% faster) compared to
v0.93.0.
https://github.com/gruntwork-io/terragrunt/releases/tag/v0.93.1
* What's Changed
- feat: unit resolver performance improvements (#5040)
- Add beta releases (#5052)
- allow input validation with variable in source or version
(#5041)
- perf: More useful benchmark for determining impact of `hcl
fmt` optimization (#5026)
* Sun Nov 02 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.93.0:
* Breaking Changes
- Removal of deprecated HCL attributes
The skip, retryable_errors, retry_max_attempts and
retry_sleep_interval_sec have all been removed from
Terragrunt.
This is the final planned breaking change on the road to
Terragrunt 1.0 related to removal of deprecated
functionality. Breaking changes will be minimized before
Terragrunt 1.0, but may still occur based on user feedback,
or based on the need to stabilize parts of Terragrunt before
1.0.
If you are currently using the skip attribute, you'll want to
adjust your usage to leverage the exclude block instead:
Before:
[#] terragrunt.hcl
skip = true
After:
[#] terragrunt.hcl
exclude {
if = true
actions = ["all"]
}
If you are currently using the retryable_errors attribute,
you'll want to adjust your usage to leverage the errors block
instead:
Before:
[#] terragrunt.hcl
retryable_errors = [
".*Error: transient network issue.*",
".*Error: timeout.*"
]
retry_max_attempts = 3
retry_sleep_interval_sec = 5
After:
[#] terragrunt.hcl
errors {
retry "transient_errors" {
retryable_errors = [
".*Error: transient network issue.*",
".*Error: timeout.*"
]
max_attempts = 3
sleep_interval_sec = 5
}
}
Read the detailed migration guide for more information.
https://terragrunt.gruntwork.io/docs/migrate/deprecated-attributes/
* What's Changed
- feat: removal of deprecated hcl attributes skip,
retryable_errors (#5033)
- bug: empty paths handling in dependencies (#5016)
* Wed Oct 29 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.92.1:
* New Features
- hcl fmt supports --parallelism for controlling concurrency
The hcl fmt command now supports the --parallelism flag for
controlling the number of concurrent files getting formatted.
By default, the number of concurrent file formats will be
determined by the number of CPU cores detected on the system
running Terragrunt.
See hcl fmt documentation for more information.
https://terragrunt.gruntwork.io/docs/reference/cli/commands/hcl/fmt/#parallelism
* What's Changed
- docs: Documenting support for `--parallelism` flag in `hcl
fmt` (#5031)
- chore: Refactoring Component (#5017)
- feat: Adding support for `--parallelism` to `hcl fmt` (#5020)
- build(deps): bump actions/download-artifact from 4 to 6
(#5023)
- build(deps): bump actions/upload-artifact from 4 to 5 (#5024)
- build(deps): bump the js-dependencies group across 1
directory with 5 updates (#5025)
* Tue Oct 28 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.92.0:
For more details and code exmaples, please see the release notes:
https://github.com/gruntwork-io/terragrunt/releases/tag/v0.92.0
* Breaking Changes
- Internal boilerplate dependency upgraded to v0.10.1
The templating engine (Boilerplate) used by the Terragrunt
catalog and scaffold commands has been upgraded to v0.10.1.
As a consequence, the default behavior of scaffolding when
using the catalog and scaffold commands has changed to allow
for the use of Boilerplate hooks and shell commands (see
hooks and helpers in Boilerplate documentation) by default.
Note that Boilerplate will ask for permission interactively
by default to run said hooks and shell commands, and that the
interactive prompt will propagate to Terragrunt users.
* Experiments Updated
- filter-flag experiment now supported in hcl commands
The --filter flag is now supported in hcl commands (validate
and fmt) (remember that you must use the filter-flag
experiment to try this).
When using the --filter flag for hcl fmt, filtering applies
to files instead of units / stacks. Only file path filters
are supported for the hcl fmt command.
* Performance Improvements
- hcl fmt Performance Improved
The performance of the hcl fmt command has been improved
substantially.
Formatting files is now roughly twice as fast due to
parallelization of file formatting, and optimizations used in
file exclusion.
* What's Changed
- docs: Documenting support for `--filter` in `hcl` commands
(#5010)
- chore: Bumping boilerplate (#4805)
- feat: Adding support for `--filter` in `hcl` commands (#5006)
- docs: Documenting the relationship between `--external` and
`--dependencies` (#5014)
* Mon Oct 27 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.91.5:
* Experiments Updated
- filter-flag updated with run support
The --filter flag is now supported on the run command
(remember that you must use the filter-flag experiment to try
this).
e.g.
[#] Filter by path with glob patterns
terragrunt run --all --filter 'prod/**' -- plan
[#] Filter by name
terragrunt run --all --filter 'app*' -- apply
[#] Exclude specific configurations
terragrunt run --all --filter '!./test/**' -- plan
[#] Combine filters with intersection (refinement)
terragrunt run --all --filter './prod/** | !name=legacy' -- apply
[#] Multiple filters with union
terragrunt run --all --filter 'app1' --filter 'app2' -- plan
For more information, see the documentation on Filtering
Units.
https://terragrunt-docs-git-docs-documenting-support-f-b0699d-gruntwork.vercel.app/docs/reference/cli/commands/run/#filtering-units
If you give this feature a try, make sure to share your
feedback on the Filter Flag RFC
https://github.com/gruntwork-io/terragrunt/issues/4060
* What's Changed
- docs: Documenting support for `--filter` in the `run` command
(#5015)
- feat: Adding support for `--filter` flag in `run` (#4981)
- chore: fixes for periodically failing tests (#5011)
* Fri Oct 24 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.91.4:
* Experiments Updated
- filter-flag updated with reading= support
The --filter flag now supports usage of the reading=
attribute to filter on components that read particular shared
infrastructure configurations.
e.g.
terragrunt find --filter 'reading=shared.hcl'
terragrunt find --filter 'reading=common/*.hcl' # Globs supported!
terragrunt find --filter 'reading=config/**' # Double-wildcard globs are required filtering on files nested in subdirectories.
terragrunt find --filter 'reading=config/vars.tfvars'
This behavior is similar to that provided by the
- -queue-include-units-reading flag, with additional support
for globs, negation and filter chaining supported in the
- -filter flag more generally.
For more information, see the documentation on
Attribute-Based Filtering.
https://terragrunt.gruntwork.io/docs/reference/cli/commands/find/#attribute-based-filtering
If you give this feature a try, make sure to share your
feedback on the Filter Flag RFC
https://github.com/gruntwork-io/terragrunt/issues/4060
* What's Changed
- docs: Documenting the new `reading` attribute (#5005)
- feat: Adding support for `reading=` in `--filter` (#5004)
- Docs: Small fixes in the Provider Cache Server documentation
(#4959)
- docs: documenting how to exclude files from modules (#5008)
* Fri Oct 24 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.91.3:
* New Features
- --reading flag added to the find command
The find command now supports the --reading flag, which
allows you to discover the shared configurations read by
units and stacks when using the --json format.
$ terragrunt find --reading --json
[
{
"type": "unit",
"path": "aws-account-1",
"reading": [
"aws-data.yml"
]
},
{
"type": "unit",
"path": "aws-account-2",
"reading": [
"aws-data.yml"
]
},
{
"type": "unit",
"path": "gcp-project-1",
"reading": [
"gcp-data.hcl"
]
}
]
You can use this information to drive custom logic in your
workflows based on the changes related to particular files.
e.g.
$ terragrunt find --reading --json | jq '[.[] | select(.reading[]? | contains("aws-data.yml"))| .path]'
[
"aws-account-1",
"aws-account-2"
]
$ terragrunt find --reading --json | jq '[.[] | select(.reading[]? | contains("gcp-data.hcl"))| .path]'
[
"gcp-project-1"
]
You can learn more about the --reading flag in the find
documentation.
https://terragrunt.gruntwork.io/docs/reference/cli/commands/find/#reading-files
* Bug Fixes
- Empty stacks no longer throw errors
Previously, a bug in the logic used for making sure that
users didn’t accidentally run on empty stacks resulted in
users getting a non-zero exit code when all units in a stack
were excluded (e.g. via the exclude block).
That bug has been fixed.
- Dependency outputs can now be used in generate blocks
Previously, a bug in the way HCL parsing was done during
discovery resulted in errors being thrown for users when
dependency outputs were used in generate blocks. That error
has since been resolved.
That bug has been fixed.
* What's Changed
- docs: Documenting new `--reading` flag for `find` (#5003)
- bug: reference of dependency outputs in generate (#4994)
- feat: Adding reading support in `find` (#5002)
- chore: Updating language in discovery commands (#5001)
- chore: Tracking reads in components (#5000)
- chore: Tracking DAG nodes in components (#4998)
- fix: Using a standard shell string parsing library instead of handling it ourselves (#4991)
- build(deps): bump vite from 6.3.6 to 6.4.1 in /docs-starlight (#4999)
- fix: Removing filter enabled check on empty stacks (#4992)
- docs: Fixing `Filters` docs (#4996)
- Fix --source-map explanation (#4997)
- build(deps): bump the js-dependencies group across 1 directory with 5 updates (#4993)
* Tue Oct 21 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.91.2:
* Experiments Introduced
- filter-flag introduced
A new experiment named filter-flag has been introduced,
allowing for experimental usage of the new --filter flag
described in RFC #4060. The filter-flag experiment is
incomplete, and minimal support for the --filter flag has
been added exclusively to the find and list commands.
The filter flag allows for sophisticated querying of
particular Terragrunt stacks and units in a way that is
currently only possible using a combination of —queue-
prefixed flags.
Example filter usage might look like the following:
$ terragrunt find --filter './prod/** | name=web'
prod/services/web
Important
While the filter-flag experiment is active, you will need to
enable the filter-flag experiment for any command that uses
the filter-flag. See Controlling Experiment Mode for more
details.
e.g.
terragrunt find --experiment filter-flag --filter './prod/** | name=web'
You can learn more about filters, including documentation on
the syntax and examples of each type of filter in the
dedicated feature documentation for filters.
* What's Changed
- docs: Documenting `filter-flag` experiment (#4973)
- feat: Introduce `filter-flag` experiment (#4969)
- chore: Adding checkbox for reproduction (#4980)
- fix: Use special dark/light mode for Terragrunt logos (#4975)
- fix: Fixing Flag Card icons (#4974)
- Fixes overflow issue on the right sidebar (#4972)
* Fri Oct 17 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.91.1:
* Chores
- Updated dependencies
Upgraded multiple Golang dependencies to the latest stable
versions:
- Updated cloud.google.com/go/storage to v1.57.0
- Updated github.com/aws/aws-sdk-go-v2 to v1.39.2
- Updated github.com/getsops/sops/v3 to v3.11.0
- Updated github.com/gofrs/flock to v0.13.0
- Updated github.com/gruntwork-io/terratest to v0.51.0
- Updated github.com/hashicorp/go-getter to v1.8.2
- Updated golang.org/x/mod to v0.29.0
- Updated golang.org/x/oauth2 to v0.32.0
- Updated golang.org/x/sys to v0.37.0
- Updated golang.org/x/term to v0.36.0
- Updated golang.org/x/text to v0.30.0
- Updated google.golang.org/api to v0.252.0
- Updated google.golang.org/grpc to v1.76.0
- Updated google.golang.org/protobuf to v1.36.10
* What's Changed
- chore: multiple dependencies update (#4968)
- feat: Adding `filter` package (#4958)
- chore: Refactor out `component` package (#4963)
- chore: Bump Bun dependencies (#4965)
- chore: Undo Starlight patch (#4964)
* Fri Oct 17 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.91.0:
* Breaking Changes
- Removal of behavior where inputs are read from dependencies
Terragrunt no longer exposes dependency inputs as accessible
values.
This change improves performance and simplifies dependency
handling by removing a feature that significantly slowed
configuration parsing due to a requirement for recursive
parsing of dependencies of dependencies for every dependent.
If your configurations currently access dependency inputs
like this:
dependency "foo" {
config_path = "../foo"
}
inputs = {
my_input = dependency.foo.inputs.an_input_from_foo
}
You’ll need to update them to reference outputs instead:
dependency "foo" {
config_path = "../foo"
}
inputs = {
my_input = dependency.foo.outputs.an_output_from_foo
}
Accessing outputs remains the supported and recommended way
to share data between modules.
* What's Changed
- feat: removal of behavior where inputs are read from
dependencies (#4960)
* Fri Oct 17 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.90.2:
* New Features
- Added --terragrunt-no-cache flag for run_cmd
The run_cmd command now supports a new flag,
- -terragrunt-no-cache, which disables caching of command
execution output.
This option is useful when you want to ensure that each
command run produces fresh results, especially in dynamic
environments or when working with frequently changing
external data.
* What's Changed
- feat: add `--terragrunt-no-cache` parameter for `run_cmd`
(#4951)
* Fri Oct 17 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.90.1:
* New Features
- hcl fmt now supports --queue flags
The hcl fmt command now supports --queue- prefixed flags
(e.g. --queue-exclude-dir).
* Bug Fixes
- Discovery in run command discovers hidden directories
When discovering units for the run command, Terragrunt will
now search through (most) hidden directories.
It will still avoid performing discovery in the following
hidden directories:
.git
.terraform
.terragrunt-cache
To manually force or suppress discovery, use
- -queue-include-dir and --queue-exclude-dir respectively.
- --queue-ignore-errors no longer breaks DAG resolution
A bug in the implementation of --queue-ignore-errors resulted
in the flag also preventing the proper resolution of the
Directed Acyclic Graph (DAG) when suppressing errors.
This has been fixed.
- --tf-path respected through dependencies
A bug in the precedence resolution of the terraform_binary
HCL attribute and the --tf-path flag resulted in the default
value of terraform_binary taking affect (tofu if both tofu
and terraform are installed) when terraform_binary was not
specified in dependencies.
This bug has been resolved, and the --tf-path flag will be
respected in dependencies as well.
- Spurious errors resolved in read_terragrunt_config()
A bug caused the read_terragrunt_config() HCL function to
return spurious errors when used in a configuration parsed
during the discovery phase of configuration resolution of a
run.
This has been fixed.
* What's Changed
- fix: Prevent parse errors when using
`read_terragrunt_config()` during discovery (#4956)
- docs: Updating docs for `--out-dir` and `--json-out-dir`
(#4957)
- fix: Ensure `--tf-path` is used in dependencies (#4955)
- fix: Fixing `--queue-ignore-errors` resulting in ignored DAG
order (#4953)
- fix: discovery of hidden directories (#4945)
- Fixing form (#4954)
- chore: failing tests fixes (#4944)
- feat: Adding queue flags to `hcl fmt` (#4950)
- Pipelines won't bite landing page (#4948)
* Mon Oct 13 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.90.0:
* Removal of deprecated commands
This is the next step on the road to Terragrunt 1.0, completing
the Terragrunt CLI Redesign. Read the CLI Redesign migration
guide for guidance on adapting to these breaking changes.
We anticipate no further breaking changes to the CLI prior to
the release of Terragrunt 1.0, where the CLI will remain stable
without breaking changes until at least Terragrunt 2.0.
For a full list of deprecated features that will be removed
prior to the release of Terragrunt 1.0, see the removal
schedule.
* Breaking Changes
- Removal of Deprecated Commands
The following deprecated CLI commands have been removed to
streamline the command line API ahead of 1.0.
Use the new commands introduced during the CLI redesign that
replace them:
- terragrunt terragrunt-info → terragrunt info print
- terragrunt hclfmt → terragrunt hcl fmt
- terragrunt hclvalidate → terragrunt hcl validate
- terragrunt validate-inputs → terragrunt hcl validate --inputs
- terragrunt render-json → terragrunt render --json -w
- terragrunt graph-dependencies → terragrunt dag graph
- terragrunt output-module-groups → terragrunt find --dag --json
* What's Changed
- chore: removal of deprecated commands by @denis256 in #4918
- chore: Removal of output-module-groups cli command by
@denis256 in #4937
* Fri Oct 10 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.89.4:
* Bug Fixes
- Collection of exit code for -detailed-exitcode behavior in
run --all
Improved run-all plan -detailed-exitcode aggregation to
correctly return 2 when any unit has drift, even if another
unit hits a retryable error.
* What's Changed
- fix(run-all): corrected -detailed-exitcode aggregation
(#4932)
- Fixing up signup form (#4933)
- Form updates (#4911)
- docs: stack generate documentation update (#4930)
* Thu Oct 09 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.89.3:
* fix: Adding missing flags to the `hcl` command (#4927)
* Wed Oct 08 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.89.2:
* fix: Fixing external dependency resolution (#4926)
* fix: Fixing Terralith to Terragrunt integration test (#4909)
* Wed Oct 08 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.89.1:
* fix: Fixed bug where discovery warned that outputs were mocked.
(#4923)
* Tue Oct 07 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.89.0:
* Breaking Changes
- Runner-pool
Terragrunt now supports the Runner Pool concurrency model,
replacing the traditional group-based concurrency model with
a dynamic scheduler by default.
Instead of waiting for groups of units that block downstream
units to complete their runs, the Runner Pool executes each
unit as soon as its dependencies (or dependents for destroys)
are resolved. This improves efficiency, reduces bottlenecks,
and limits the impact of individual failures on the run of
the entire queue.
New Features
- Dynamically schedules Units as soon as dependencies (or
dependents) are satisfied
- Improves throughput for large stacks
- Provides better fault-isolation for failed units
- Report
The experimental Report feature is now stable and enabled by
default.
Every Terragrunt run will now emit a short summary at the end
of the run that looks like the following by default:
$ terragrunt run --all plan
[#] Omitted for brevity...
❯❯ Run Summary 3 units 62ms
────────────────────────────
Succeeded 3
This summary will give a high-level overview of the run
results for units in a given Terragrunt run.
You can optionally request a CSV or JSON report of runs as
well, giving you detailed insights as to the performance of
each run using the --report flag:
$ terragrunt run --all plan --report-schema-file report.schema.csv
Name,Started,Ended,Result,Reason,Cause
first-exclude,2025-06-05T16:28:41-04:00,2025-06-05T16:28:41-04:00,excluded,exclude block,
second-exclude,2025-06-05T16:28:41-04:00,2025-06-05T16:28:41-04:00,excluded,exclude block,
first-failure,2025-06-05T16:28:41-04:00,2025-06-05T16:28:42-04:00,failed,run error,
first-success,2025-06-05T16:28:41-04:00,2025-06-05T16:28:41-04:00,succeeded,,
second-failure,2025-06-05T16:28:41-04:00,2025-06-05T16:28:42-04:00,failed,run error,
second-success,2025-06-05T16:28:41-04:00,2025-06-05T16:28:41-04:00,succeeded,,
second-early-exit,2025-06-05T16:28:42-04:00,2025-06-05T16:28:42-04:00,early exit,run error,
first-early-exit,2025-06-05T16:28:42-04:00,2025-06-05T16:28:42-04:00,early exit,run error,
$ terragrunt run --all plan --report-schema-file report.schema.json
[
{
"Name": "first-exclude",
"Started": "2025-06-05T16:28:41-04:00",
"Ended": "2025-06-05T16:28:41-04:00",
"Result": "excluded",
"Reason": "exclude block"
},
{
"Name": "first-success",
"Started": "2025-06-05T16:28:41-04:00",
"Ended": "2025-06-05T16:28:41-04:00",
"Result": "succeeded"
}
]
New Features
- Generates detailed run reports (CSV and JSON formats
supported)
- Displays run summaries directly in the CLI output
- Allows disabling summaries if desired
To learn more about the Run Report feature, read the
dedicated guide on Run Reports here.
https://terragrunt.gruntwork.io/docs/features/run-report/
Migration Guide
No action is required
To disable summary output explicitly, use
- -disable-report-summary:
terragrunt run --all plan --disable-report-summary
- Auto OpenTofu Provider Cache Directory
Terragrunt now automatically configures OpenTofu’s native
provider caching mechanism by default when running with
OpenTofu > = 1.10.
Note that if you are using Terraform, you will not be able to
take advantage of this new feature.
This feature is only possible in OpenTofu due to the hard
work and coordination with the OpenTofu team to ensure that
concurrent access to the provider cache directory is safe for
all OpenTofu users, regardless of whether they use
Terragrunt.
New Features
- Automatically sets the TF_PLUGIN_CACHE_DIR environment
variable
- Uses OpenTofu’s native provider cache instead of
Terragrunt’s internal cache server
- Provides improved concurrency safety in multi-runner and CI
environments
Migration Guide
No action is required if you’re running OpenTofu > = 1.10 —
provider caching will be configured automatically.
To disable this behavior, use the
- -no-auto-provider-cache-dir flag:
terragrunt run --all apply --no-auto-provider-cache-dir
* What's Changed
- chore: mark as completed runner-pool, reports and provider
cache (#4900)
- Fix docs flag name (#4908)
- fix: Properly sets discovery context so that `plan -destroy`
and `apply -destroy` work right (#4887)
- Visual updates to form (#4902)
- Implement view plans button (#4890)
* Tue Sep 30 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.88.1:
* feat: Use better parsing for --auth-provider-cmd by @yhakbar in
[#4881]
* fix: Fixing race condition for TestTerragruntExcludesFile by
@yhakbar in #4809
* fix: Fixing report flags by @yhakbar in #4899
* fix: Fixing .tf vs .tofu extension parity by @yhakbar in #4794
* chore: Add data.tf to iam directory in refactoring guide by
@vit100-trader in #4888
* chore: Refactoring GitHub client into dedicated package by
@yhakbar in #4879
* build(deps): bump the js-dependencies group across 1 directory
with 7 updates by @dependabot[bot] in #4878
* docs: Update 01-quick-start.mdx by @vit100 in #4883
* docs: CI for Terralith to Terragrunt Guide by @yhakbar in #4811
* docs: Update OG images by @karlcarstensen in #4889
* Sun Sep 28 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.88.0:
* Breaking Changes
- Default Command Forwarding Removed
Terragrunt no longer forwards unknown top‑level commands to
OpenTofu by default.
Invoking an unknown command now fails with guidance to use
the explicit run form.
This is the next step in the removal of deprecated features
in Terragrunt on the road to Terragrunt 1.0, with more to
follow. Read the CLI Redesign migration guide for guidance on
adapting to future breaking changes.
https://terragrunt.gruntwork.io/docs/migrate/cli-redesign/
For a full list of deprecated features that will be removed
prior to the release of Terragrunt 1.0, see the removal
schedule.
https://github.com/gruntwork-io/terragrunt/issues/3535
- Old Behavior (Deprecated)
terragrunt workspace ls
terragrunt graph
- New Behavior
terragrunt run -- workspace ls
terragrunt run -- graph
- Migration Guide
Keep using shortcuts for common commands:
terragrunt plan
terragrunt apply
Replace usage of any OpenTofu/Terraform command that isn’t
a supported shortcut with explicit usage of the run
command:
terragrunt workspace ls => terragrunt run -- workspace ls
terragrunt graph => terragrunt run -- graph
When mixing Terragrunt and OpenTofu flags, separate them
with --:
terragrunt run -- apply -auto-approve
terragrunt run -- output -json
terragrunt run --all -- plan -var foo=bar
- Command-specific flags must be used after their commands
As part of the changes to remove the deprecated behavior of
forwarding unknown commands to OpenTofu by default, users
can no longer treat flags as global flags unless they are
in-fact global flags.
For example, the following will still work:
terragrunt --log-level debug plan
terragrunt --no-color plan
But the following will no longer be supported:
terragrunt --provider-cache run --all plan
Instead, you must supply flags after the commands they are
used by:
terragrunt run --all --provider-cache plan
- Flag Scope Changes (backend + feature flags)
Backend migration and feature-related flags are now
command-scoped and should appear after the relevant
subcommand.
These flags are accepted on run, backend, scaffold, find, and
list
Affected flags:
backend-bootstrap
backend-require-bootstrap
disable-bucket-update
feature key=value
- Old Behavior (Deprecated)
Command-specific flags could be set anywhere in the
arguments for a command:
terragrunt --backend-bootstrap backend delete --all
terragrunt --feature stage=true plan
- New Behavior
Place flags after the respective command they control:
terragrunt backend bootstrap --backend-bootstrap
terragrunt plan --feature stage=true
terragrunt find --feature stage=true
- Migration Guide
Move these flags to follow the subcommand they apply to
terragrunt --feature stage=true plan => terragrunt plan --feature stage=true
* What's Changed
- chore: Removal of command forwarding by default by @denis256 in #4871
- docs: Fixed contact form toggle bug by @karlcarstensen in #4885
- docs: Terragrunt Scale Initial Checkout Page by @karlcarstensen in #4866
* Fri Sep 26 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.87.7:
* Bug Fixes
- Partial cache population fix
Resolved an issue that prevented the HCL partial cache from
being fully populated
* What's Changed
- chore: Fix for HclCache population in PartialParseConfigFile
by @denis256 in #4877
* Thu Sep 25 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.87.6:
* Bug Fixes
- Fixed S3 update prompt message
A typo in the prompt for backend bootstrap adjustment
resulted in the word "res" being used instead of "out".
Remote state S3 bucket is res of date. Would you like
Terragrunt to update it? (y/n)
The typo has been corrected like so:
Remote state S3 bucket is out of date. Would you like
Terragrunt to update it? (y/n)
- Added synchronization controls for queue and discovery
The queue and discovery packages used in find and list
commands and the runner-pool experiment were updated to
include additional synchronization controls to address rare
race conditions.
* What's Changed
- fix: Fixing S3 prompt message by @yhakbar in #4880
- fix: Adding synchronization controls to protect queue and
discovery by @yhakbar in #4873
- docs: Adds CTA for Terragrunt Scale on sidebar by
@karlcarstensen in #4860
- docs: out-dir flags docs by @denis256 in #4870
- docs: Convert buttons to components by @josh-padnick in #4850
- docs: runner pool docs update by @denis256 in #4875
- chore: Bun lock changes by @karlcarstensen in #4876
* Tue Sep 23 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.87.5:
* runner-pool experiment
- Runner Pool Performance: Optimized execution flow for faster
and more efficient unit scheduling
- Benchmarks: Introduced initial benchmark tests to measure
runner-pool performance under different scenarios
* What's Changed
- chore: runner-pool benchmarks (#4855)
- chore: Offboarding AJ (#4865)
- Cleanup (#4859)
- Adding social images (#4856)
- Update subhead (#4854)
- Adding meta tags (#4849)
- docs: updated runner-pool experiment status (#4852)
* Sun Sep 21 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.87.4:
* Bug Fixes
- Ensured awshelper prioritizes region from config over
environment variables
- Fixed constraint normalization in provider cache
* What's Changed
- fix: Fixed setting region in remote state config by
@pseudomorph / @denis256 in #4848
- fix: Fixed constraint normalization by @yhakbar in #4804
- chore: runner-pool HCL formatting tests fixes by @denis256 in
[#4844]
- docs: polish to the vimeo component by @karlcarstensen in
[#4841]
- docs: Abc imports to force deploy by @karlcarstensen in #4845
- docs: Fix wrong links in documentation (#4846) by
@CouscousPie in #4847
* Sun Sep 21 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.87.3:
* Bug Fixes
- Fixed handling of null stack values
Improved handling of null values in stacks
* What's Changed
- bug: Handling of null stack values by @denis256 in #4836
- docs: Adding vimeo component and video by @karlcarstensen in
[#4831]
* Sun Sep 21 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.87.2:
* New Features
- Runner pool experiment performance improvements
Enhanced runner pool performance for faster file detection.
* Updated dependencies
- Upgraded multiple dependencies to the latest stable versions:
- Updated cloud.google.com/go/storage to v1.56.1
- Updated aws-sdk-go-v2 to v1.39.0
- Updated go-getter to v1.8.0
- Updated go-cty to v1.17.0
- Updated testify to v1.11.1
- Updated golang.org/x/mod to v0.28.0
- Updated golang.org/x/oauth2 to v0.31.0
- Updated golang.org/x/sync to v0.17.0
- Updated golang.org/x/sys to v0.36.0
- Updated golang.org/x/term vv0.35.0
- Updated golang.org/x/text to v0.29.0
- Updated google.golang.org/api to v0.249.0
- Updated google.golang.org/grpc to v1.75.1
- Updated google.golang.org/protobuf to v1.36.9
* What's Changed
- perf: Improving Runner Pool Perf a bit by @yhakbar in #4824
- chore: runner-pool tests fixes by @denis256 in #4823
- chore(deps): Dependencies update by @denis256 in #4827
- docs: Adjustments to partytown scripts by @karlcarstensen in
[#4822]
- docs: Small updates to TS site by @karlcarstensen in #4819
- docs: Correct flag and environment variable names for AWS
OIDC authen… by @carchi1a in #4785
- fix: Adding docs back for -detailed-exitcode, etc. by
@yhakbar in #4803
* Sun Sep 21 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.87.1:
* Features
- Memory Leak Prevention
Updated the ulikunitz/xz dependency to mitigate potential
memory leaks.
* Bug Fixes
- Fixed merging of IAM fields
Added IamWebIdentityToken and IamAssumeRoleSessionName to
both Merge() and DeepMerge() functions
* What's Changed
- fix: Add missing IAM fields to include merge logic (#4812) by
@carchi1a in #4813
- chore: Bump ulikunitz/xz to avoid memory leak by @denis256 in
[#4816]
- chore: Bumping WSL to v5 by @yhakbar in #4788
- fix: runner-pool exclusions and summary tests fixes by
@denis256 in #4808
- fix: Resolving token usage for bucket cleanup by @yhakbar in
[#4789]
- docs: Additional website refinements by @josh-padnick in
[#4787]
- docs: Fix issue where global styles applied to some native
starlight styles. by @josh-padnick in #4795
- build(deps): bump actions/stale from 9 to 10 by
@dependabot[bot] in #4799
- build(deps): bump aws-actions/configure-aws-credentials from
4 to 5 by @dependabot[bot] in #4797
- build(deps): bump actions/github-script from 7 to 8 by
@dependabot[bot] in #4798
- docs: Add missing --terragrunt-tfpath flag to migration list
by @ChandlerSwift in #4802
- docs: Fix wrongly mentionned TG_DOWNLOAD instead of
TG_DOWNLOAD_DIR by @ajoga in #4801
- fix: Getting rid of unnecessary flaky test by @yhakbar in
[#4679]
- docs: Quick updates to TS page by @karlcarstensen in #4806
* Sun Sep 21 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.87.0:
* Breaking Changes
- Automatic Backend Provisioning Removed
Terragrunt no longer automatically provisions backend
resources.
If backend provisioning is required but not explicitly
enabled, Terragrunt will now exit with an error.
* Old Behavior (Deprecated)
- The following command would silently provision backend
resources before execution:
terragrunt plan --non-interactive
* New Behavior
- This behavior has been removed. Running the same command
without opting in will now produce an error if backend
bootstrapping is required.
To continue to automatically bootstrap backends, you must
explicitly enable backend provisioning with either the
- -backend-bootstrap flag or the TG_BACKEND_BOOTSTRAP
environment variable:
terragrunt plan --backend-bootstrap --non-interactive
or
export TG_BACKEND_BOOTSTRAP=true
terragrunt plan --non-interactive
* Migration Guide
- If you relied on automatic backend bootstrapping:
- Add --backend-bootstrap to your Terragrunt commands, or set
the TG_BACKEND_BOOTSTRAP environment variable.
- If you don’t require backend provisioning:
- No action needed — simply run Terragrunt commands without
the flag.
* Road to 1.0 Deprecated Feature Removal Schedule #3535
https://github.com/gruntwork-io/terragrunt/issues/3535
* What's Changed
- chore: Disabled automatic backend provisioning by @denis256
in #4703
- docs: Updated migration docs by @yhakbar in #4711
* Thu Sep 18 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.86.3:
* Bug Fixes
- Stacks now generate in topological order
A race condition caused by concurrent generation of nested
Terragrunt Stacks when a .terragrunt-stack directory already
exists has been remediated.
Stacks will now generate topologically regardless of whether
they are cleanly generated or generated when a
terragrunt-stack directory already exists, resulting in
parent stacks generating before child stacks.
- get_aws_account_id() interaction with --auth-provider-cmd
fixed
A bug introduced in the upgrade to AWS SDK v2 in v0.85.1
where get_aws_account_id() would not work properly when used
in conjunction with the --auth-provider-cmd flag has been
remediated.
- Custom API endpoints for backend resources are now set
correctly
A bug introduced in the upgrade to AWS SDK v2 in v0.85.1
where integration with the S3 and DynamoDB AWS SDK clients
did not properly respect the endpoint setting for backend
configurations has been remediated.
- ref properly handled in catalog urls
The use of the ref query string parameter in Catalog
go-getter URLs has been fixed, allowing users to explicitly
specify the ref they want to use for their catalog sources.
- dag graph updated to support all run flags
The dag graph command has been updated to support all flags
supported by the run command.
* Docs
- Terragrunt Scale page published
The Terragrunt Scale page has been published, showcasing a
new offering from Gruntwork to help customers scale up their
IaC usage. It showcases the integration Terragrunt has with
commercial offerings from Gruntwork to help organizations
scale their infrastructure management.
- The Terralith to Terragrunt has been published
A step-by-step guide to transitioning IaC configurations from
a Terralith (where all resources are in a single state file)
to a modern Terragrunt IaC configuration, using Terragrunt
Stacks has been published named Terralith to Terragrunt.
This is the first major guide in this style, with more to
come in the future to address specific pain points for
members of the community in a step-by-step guide, rather than
a reference or high level summary of features.
* What's Changed
- feat: Generate stacks in topological order by @yhakbar in
[#4786]
- fix: Fixing AWS Account ID w/ Provider CMD by @yhakbar in
[#4779]
- fix: ensure custom API endpoints are set correctly by
@wakeful in #4756
- fix: Properly handling ref when running terragrunt catalog
[#4777] by @rvelichkov in #4781
- fix: Bypass partytown by @karlcarstensen in #4783
- fix: Updated form link by @karlcarstensen in #4771
- fix: Fixed contact form by @karlcarstensen in #4761
- fix: Fixes for scale page by @karlcarstensen in #4767
- fix: Swap image for transparent png by @karlcarstensen in
[#4766]
- fix: Fixes for terragrunt scale page by @karlcarstensen in
[#4747]
- fix: Nav fixes by @karlcarstensen in #4750
- fix: Fixes for contact page by @karlcarstensen in #4746
- fix [#4613]: register additional flags in the DAG graph
subcommand by @wakeful in #4726
- fix: Adding select none to some text areas by @karlcarstensen
in #4743
- fix: Fix hero image by @karlcarstensen in #4749
- fix: Responsive fix for aws component by @karlcarstensen in
[#4742]
- fix: Section spacing to 150px by @karlcarstensen in #4741
- docs: Terragrunt Scale Pricing Page by @karlcarstensen in
[#4729]
- docs: Pricing Page Launch by @karlcarstensen in #4772
- docs: Add Terralith to Terragrunt guide by @yhakbar in #4709
- docs: Adding URLs by @karlcarstensen in #4740
- chore: experiments tests improvements by @denis256 in #4782
- chore: A collection of website polishing by @josh-padnick in
[#4784]
- chore: fix runner-pool experiment tests by @denis256 in #4770
- chore: Polish by @karlcarstensen in #4773
- chore: Polish to contact form by @karlcarstensen in #4769
- chore: Search polish by @karlcarstensen in #4755
- chore: added integration tests for experiment mode by
@denis256 in #4754
- chore: Cleanup and organization by @karlcarstensen in #4753
- chore: Nav polish by @karlcarstensen in #4748
* Tue Aug 26 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.86.2:
* chore: updated dependency github.com/aws/aws-sdk-go-v2 to
v1.38.1 by @denis256 in #4728
* chore: updated dependency github.com/hashicorp/go-plugin to
v1.7.0 by @denis256 in #4728
* chore: updated dependency github.com/zclconf/go-cty to v1.16.4
by @denis256 in #4728
* chore: updated dependency google.golang.org/api to v0.248.0 by
@denis256 in #4728
* chore: updated dependency google.golang.org/grpc to v1.75.0 by
@denis256 in #4728
* chore: updated dependency google.golang.org/protobuf to v1.36.8
by @denis256 in #4728
* chore: updated dependency go.uber.org/mock to v0.6.0 by
@denis256 in #4728
* chore: updated dependency github.com/aws/aws-sdk-go-v2/config
to v1.31.2 by @denis256 in #4728
* chore: updated dependency
github.com/aws/aws-sdk-go-v2/service/dynamodb to v1.49.1 by
@denis256 in #4728
* chore: updated dependency
github.com/aws/aws-sdk-go-v2/service/iam to v1.47.1 by
@denis256 in #4728
* chore: updated dependency
github.com/aws/aws-sdk-go-v2/service/s3 to v1.87.1 by @denis256
in #4728
* chore: updated dependency
github.com/aws/aws-sdk-go-v2/service/sts to v1.38.0 by
@denis256 in #4728
* chore: updated dependency github.com/aws/smithy-go to v1.22.5
by @denis256 in #4728
* Mon Aug 25 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.86.1:
* Handle trailing doublestar ** in --queue-include-dir and
- -queue-exclude-dir (#4683)
* Fri Aug 22 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.86.0:
* Features
- Terraform 1.13: We are now testing Terragrunt against
Terraform 1.13 and is confirmed to be working.
- Go 1.25: Build process now leverages Go 1.25 features and
improvements
NOTE: Although this release is marked as backward incompatible,
it is functionally compatible as nothing has been changed in
Terragrunt internals. The minor version release is useful to
mark the change in Terraform version that is being tested.
* What's Changed
- chore: Go and Terraform 1.13 updates (#4724)
- chore: add test for source-map in runner-pool (#4707)
* Fri Aug 22 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.85.1:
* Features
- Updated go-getter to fix CVE-2025-8959
- Dropped dependencies on aws-sdk-go v1
* Docs
- Switched to the new documentation site
* What's Changed
- chore: Bumping go-getter and dependencies (#4692)
- Tighten up Supercharge section (#4712)
- Remove unnecessary class (#4713)
- chore: rm old page deployment (#4721)
- fix: pass argument to version flag, e.g. `run -- version
- json` (#4720)
- fix: Adjusting `awshelper` (#4502)
- Swap classnames per feedback (#4710)
- chore: Removing Jekyll docs (#4705)
- chore: Tossing Jekyl docs (#4699)
- Cleaning animation (#4698)
- fix: Adding retry to ignore the flakiness of
`TestProviderCache` (#4676)
- Search polish (#4697)
- Lower padding margins (#4696)
- Bump versions (#4695)
- fix: Fixing text for search (#4693)
- fix: Adjusting patch (#4691)
- chore: Final pre-migration steps (#4688)
- fix: Adding social link info (#4677)
- fix: Removing Google feedback form (#4678)
- build(deps): bump actions/checkout from 4 to 5 (#4685)
- Web 818 (#4682)
- docs: Updating Terragrunt Homepage (#4550)
- Fix --report-file not created due to cross-device link
(#4675)
* Tue Aug 19 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.85.0:
* Breaking Changes
- Removal of legacy Terragrunt flags
All deprecated flags that start with --terragrunt- have been
removed in favor of their modern counterparts.
This is the next step in the removal of deprecated features
in
Terragrunt on the road to Terragrunt 1.0, with more to
follow. Read the CLI Redesign migration guide for future
breaking changes.
- Update of stack run directory context
The stack run command no longer assumes that users will have
a .terragrunt-stack directory present in the same directory
as the terragrunt.stack.hcl file. This caused issues for
users that were leveraging the no_dot_terragrunt_stack
attribute, as the run might have skipped over units generated
outside the .terragrunt-stack directory and thrown an error
if all units were generated without the .terragrunt-stack
directory.
(see example in the release notes)
https://github.com/gruntwork-io/terragrunt/releases/tag/v0.85.0
* Features
- The runner-pool experiment has been integrated with
OpenTelemetry
The runner-pool experiment has been updated to integrate
properly with OpenTelemetry.
* Bug Fixes
- stack output now respects no_dot_terragrunt_stack
Previously, when running the stack output command, Terragrunt
would incorrectly assume that all units were generated within
a .terragrunt-stack directory. This bug has been fixed, and
Terragrunt will know to look directly in the stack directory
for a given unit when supplied with no_dot_terragrunt_stack.
- The runner-pool experiment no longer parses stack files as
units during discovery
A bug in the logic for the discovery package resulted in
discovery errors due to terragrunt.stack.hcl files being
parsed as units. That bug has been fixed.
- Fixed filesystem context for find_in_parent_folders() when
used in terragrunt.stack.hcl
The use of find_in_parent_folders() now functions correctly
when run in the context of a terragrunt.stack.hcl file.
Previously, it relied on the current working directory of the
Terragrunt CLI, which incorrectly assumed that users would
always be generating terragrunt.stack.hcl files from the
current working directory.
- The discovery package now emits less false positive warnings
during parsing
The discovery package used by the find and list commands, and
the runner-pool experiment has been updated to emit less
unimportant warnings when parsing configurations. These
warnings were for early phase parsing that are known to be
safe to ignore.
- The discovery package no longer attempts to parse stack
configurations as units
A bug in the implementation of the discovery package resulted
in attempts from Terragrunt to parse terragrunt.stack.hcl
files as units. That has been remediated.
* Docs
- Edit Link Added
The terragrunt-v1.gruntwork.io docs now include an "Edit
page" button that conveniently allows the community to
contribute fixes to documentation from within their browsers,
using the GitHub UI.
* What's Changed
- chore: Addressing review feedback (#4672)
- docs: Updating migration guide for `--terragrunt-` flag
removal (#4671)
- feat: Sequencing workflows so that faster workflows run
before slower ones (#4670)
- chore: Remove legacy terragrunt flags (#4650)
- fix: Addressing provider cache test flake (#4639)
- fix: Fixing `find_in_parent_folders` for
`terragrunt.stack.hcl` files (#4669)
- fix: Fixing `stack run` when there are only units with
`no_dot_terragrunt_stack` set (#4628)
- chore: Getting rid of strict lint workflow (#4651)
- fix: Fixing bad link to `stack output` command (#4652)
- ensure queue-include-dir includes stack paths that have not
yet been generated (#4649)
- fix: Improve error handling for missing includes and
dependencies (#4637)
- chore: Adding error message bug report (#4638)
- Fix broken screenshot in logging page (#4630)
- feat: Discovey false positive parsing errors (#4605)
- fix: Make `stack output` respect `no_dot_terragrunt_stack`
(#4606)
- fix: Adding edit link back (#4629)
- feat: runner-pool opntelemetry integration (#4616)
- fix: Fixing discovery parsing stacks as units (#4615)
* Tue Aug 05 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.84.1:
* build(deps): Bump cloud.google.com/go/storage to v1.56.0 by
@denis256 in #4603
* build(deps): Bump github.com/aws/aws-sdk-go-v2 to v1.36.6 by
@denis256 in #4603
* build(deps): Bump github.com/gruntwork-io/boilerplate to v0.8.1
by @denis256 in #4603
* build(deps): Bump google.golang.org/api to v0.244.0 by
@denis256 in #4603
* build(deps): Bump google.golang.org/grpc to v1.74.2 by
@denis256 in #4603
* chore: Upgrade to Tofu 1.10.5 in CICD tests by @denis256 in
[#4604]
* Sun Aug 03 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.84.0:
* Breaking Changes
- Removal of legacy-all commands
The following commands have been removed from the Terragrunt CLI:
- spin-up
- tear-down
- plan-all
- apply-all
- destroy-all
- output-all
- validate-all
If you have been using any of these commands, see the
migration guide under Removal of longstanding deprecated
commands here.
This is the first step in the removal of deprecated features
in Terragrunt on the road to Terragrunt 1.0, with more to
follow. You are also advised to read the CLI Redesign
migration documentation for future breaking changes.
See #3535 for more details.
* New Features
- Catalog/Scaffold now support --no-dependency-prompt
The catalog/scaffold commands now support a new
- -no-dependency-prompt flag that disables the Boilerplate
dependency prompt (equivalent of --disable-dependency-prompt
in Boilerplate).
This allows Boilerplate templates with dependencies to be
used non-interactively, even when called by Catalog and
Scaffold.
- exclude block now supports no_run
The exclude block now supports the no_run attribute, which
lets users prevent direct runs of a unit when the run matches
the configuration of an exclude block.
e.g. When users define an exclude block like the following:
[#] foo/terragrunt.hcl
exclude {
if = true
actions = ["plan"]
}
Terragrunt will only exclude the unit foo from the run queue
if the user supplies a command like run --all plan. If a user
uses the run plan command directly in the foo directory, it’s
assumed that they are doing so intentionally, and don’t want
the run to exit early.
Users can now specify no_run to explicitly tell Terragrunt
that it should never be run, even if a user attempts to
perform the run in the unit directory directly.
[#] foo/terragrunt.hcl
exclude {
if = true
no_run = true
actions = ["plan"]
}
* Enhancements
- Stacks are now fully regenerated when the --source-update
flag is set
The .terragrunt-stack directory is now fully regenerated when
the --source-update flag is set, similar to how the
.terragrunt-cache directory is regenerated when the flag is
set.
This addresses some edge-cases where changes to local sources
for units and stacks didn’t result in updates to generated
stack configurations.
* Bug Fixes
- Stack Outputs Are Now Sorted
To ensure consistency in the order in which outputs are
displayed when using the stack output command, outputs are
now sorted before they are displayed.
- Lockfiles With Strong Constraints Normalized
When manually generating lockfiles from the Provider Cache
Server for modules with strong constraints like the
following:
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "= 5.100.0"
}
}
}
Generated lockfiles now properly strip the = when generating
the lockfile, as = constraints aren’t supported in
.terraform.lock.hcl files.
* What's Changed
- chore: Adding gopls cron (#4594)
- feat: runner-pool destroy tests (#4537)
- feat: Supporting `no_run` in `exclude` block (#4574)
- fix: Fixing icon patch (#4576)
- chore: Removing `legacy-all` commands (#4572)
- build(deps): bump ruby/setup-ruby from 1.245.0 to 1.253.0
(#4570)
- build(deps): bump the js-dependencies group across 1
directory with 4 updates (#4545)
- chore: updated dependabot config to not update
charmbracelet/x/ansi (#4564)
- fix: Stripping equals sign from constraint (#4563)
- build(deps-dev): bump nokogiri from 1.18.8 to 1.18.9 in /docs
(#4553)
- fix: Fixing lint finding (#4561)
- feat: add `--no-dependency-prompt` option for scaffold
(#4420)
- sort output for writevalues in stack.go (#4552)
- chore: Adding `auto-provider-cache-dir` experiment
integration test (#4554)
- docs: minor stylistic change for better clarity (#4557)
- fix: Fixing links at the bottom of Jekyl stacks docs (#4549)
- docs: Updating stacks documentation (#4544)
- refactor: move `stacks.RunClean` logic into
`config.CleanStacks` to allow reuse and to call `CleanStacks`
before running the `stacks Generate` func when
`--source-update` flag is set. (#4446)
* Tue Jul 15 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.83.2:
* build(deps): bump the js-dependencies group across 1 directory
with 2 updates (#4536)
* chore: updated engine used in tests to 0.0.20 (#4532)
* chore: runner pool improvements (#4506)
* chore: Updated cloud-nuke config to remove dynamodb tables
(#4531)
* Sat Jul 12 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.83.1:
* Bug Fixes
- Adjusted lockfile handling when modules define constraints
* What's Changed
- fix: Adjusted lockfile handling when modules define
constraints by @yhakbar in #4514
- chore: Updated cicd to use tofu 1.10.2 by @denis256 in #4507
- chore: Added dependency grouping and type labels to
Dependabot config by @wakeful in #4518
- docs: Fixed getting started docs by @shahar1 in #4516
- chore: Configured dependabot to ignore buggy version of
charmbracelet/glamour by @wakeful in #4524
- build(deps): Bump the js-dependencies group across 1
directory with 9 updates by @dependabot[bot] in #4520
- chore: Removed npm dependencies, using only bun for docs
generation by @wakeful in #4527
- build(deps): Updated github.com/huandu/go-clone to v1.7.3 by
@wakeful in #4511
- build(deps): Updated google.golang.org/api to v0.240.0 by
@wakeful in #4511
- build(deps): Updated github.com/aws/aws-sdk-go-v2/service/s3
to v1.83.0 by @wakeful in #4511
- build(deps): Updated github.com/hashicorp/hcl/v2 to 2.24.0 by
@denis256 in #4528
- build(deps): Updated golang.org/x/mo to 0.26.0 by @denis256
in #4528
- build(deps): Updated golang.org/x/sync to 0.16.0 by @denis256
in #4528
- build(deps): Updated golang.org/x/sys to 0.34.0 by @denis256
in #4528
- build(deps): Updated golang.org/x/term to 0.33.0 by @denis256
in #4528
- build(deps): Updated golang.org/x/text to 0.27.0 by @denis256
in #4528
- build(deps): Updated google.golang.org/api to 0.241.0 by
@denis256 in #4528
* Mon Jul 07 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.83.0:
* New Features
- Added initial implementation of runner-pool to improve unit
apply performance. The feature can be enabled using the
- -experiment runner-pool flag.
RFC: #3629
* Breaking Changes
- Updated log messages to use "Unit" terminology instead of
"Module" for improved clarity and consistency.
* Bug Fixes
- Fixed flaky tests related to the provider cache.
- Added explicit check for user-defined --tf-path flag.
- Updated Dockerfile to support Starlight documentation
generation.
- Fixed incorrect lock file constraints generated by the
Terragrunt Provider Cache.
- Fixed discovery of Terragrunt files in runner-pool, ensuring
correct file resolution during execution.
* What's Changed
- feat: Runner pool implementation by @denis256 in #4434
- fix: Fixing TestProviderCache flake by @yhakbar in #4495
- fix: Adding explicit check to see if user set --tf-path by
@yhakbar in #4493
- fix: Adjusting Dockerfile for Starlight docs by @yhakbar in
[#4496]
- fix: Fix lock file constraints generated by Terragrunt
Provider Cache by @ajax-ryzhyi-r in #4380
- fix: Fixed discovery of Terragrunt files in runner-pool by
@denis256 in #4491
- docs: Updated documentation for fail-fast flag by @denis256
in #4503
- docs: Updated docs to reference default terragrunt.values.hcl
by @denis256 in #4490
* Thu Jul 03 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.82.4:
* New Features
- Support for OpenTofu 1.10 Native S3 Locking
The remote_state S3 backend now integrates natively with the
OpenTofu 1.10 feature of state locking via S3 without the
usage of DynamoDB using the new use_lockfile attribute.
[#] Configure OpenTofu/Terraform state to be stored in S3
with native S3 locking instead of DynamoDB.
[#] This uses S3 object conditional writes for state locking,
which requires OpenTofu >= 1.10.
remote_state {
backend = "s3"
config = {
bucket = "my-tofu-state"
key = "${path_relative_to_include()}/tofu.tfstate"
region = "us-east-1"
encrypt = true
use_lockfile = true
}
}
In previous releases, if users wanted to integrate with this
OpenTofu feature, they would have to use the generate
attribute, which opts users out of more advanced features of
Terragrunt remote state management like automatic
provisioning of state resources.
By using the native attribute in config, users can retain the
benefits of automatic backend bootstrapping in addition to
native integration with the new OpenTofu feature.
You can learn more about backend configurations in the HCL
docs.
https://terragrunt.gruntwork.io/docs/reference/config-blocks-and-attributes/#backend
* What's Changed
- feat: Adding support for native state locking (#4485)
- chore: update external dependencies (#4486)
- fix: Use a constant for min version of tofu for auto provider
cache dir (#4479)
- fix: resolve failing CAS & DAG tests (#4480)
* Mon Jun 30 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.82.3:
* Experiments Added
- Introduction of the auto-provider-cache-dir experiment
The new auto-provider-cache-dir experiment has been added to
automatically configure OpenTofu provider caching when
certain conditions are met:
- You are using OpenTofu
- You are using a version of OpenTofu >= 1.10
This leverages recent improvements in how OpenTofu handles
provider caching to allow for safe concurrent access to
provider plugins in OpenTofu 1.10.
In micro-benchmarks, the native provider cache directory
out-performs the Provider Cache Server, as the overhead of
starting and running the provider cache server is eliminated.
Once generally available, this feature will be enabled by
default, automatically providing performance improvements to
Terragrunt users using OpenTofu >= 1.10. If you are currently
using the Provider Cache Server, you are advised to
experiment with this feature, and share your feedback.
You can learn more about the feature in the dedicated feature
docs, including a comparison with the Provider Cache Server,
so you can learn if limitations in how the native OpenTofu
provider cache directory will result in a requirement to
continue using the Provider Cache Server going forward.
https://terragrunt.gruntwork.io/docs/features/provider-cache-server/
https://terragrunt.gruntwork.io/docs/features/auto-provider-cache-dir/
https://terragrunt.gruntwork.io/docs/features/auto-provider-cache-dir/#comparison-with-provider-cache-server
* New Features
- --version-manager-file-name Flag Added
During a run --all, Terragrunt memoizes the version of
OpenTofu/Terraform being run to determine if version
constraints are being satisfied, without doing unnecessary
work to repeatedly check the version of OpenTofu/Terraform
being run in each directory.
To ensure that users using tool managers are able to leverage
different versions of OpenTofu/Terraform in different
directories, the cache key for this memoization includes
calculations based on common version manager tools.
By default, the following are detected:
- .terraform-version
- .tool-versions
- .mise.toml
- mise.toml
To support the usage of any arbitrary tool manager, a new
- -version-manager-file-name flag has been introduced to allow
configurability over this list.
To learn more about --version-manager-file-name read the
docs.
https://terragrunt.gruntwork.io/docs/reference/cli-options/#version-manager-file-name
* What's Changed
- feat: Adding auto provider cache dir experiment (#4466)
- docs: Adding docs for local state to the side with stacks
(#4477)
- feat: add new `--version-cache-file` flag that allows users
to override previously hardcoded values used for the
`version` cache key; resolves #4326 (#4415)
* Mon Jun 30 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.82.2:
* Bug Fixes
- get_terragrunt_dir returns appropriate directory
The get_terragrunt_dir() HCL function now returns the
expected stack directory containing a terragrunt.stack.hcl
when used in a terragrunt.stack.hcl file.
- non-git default templates supported for Catalog/Scaffold
A bug in how the default_template attribute of the catalog
configuration block worked resulted in a requirement that the
default template be a Git repository. That bug has been
resolved, removing the restriction.
* What's Changed
- fix: Support non-git templates for Catalog/Scaffold (#4474)
- build(deps): bump github.com/gruntwork-io/terratest (#4457)
- build(deps): bump github.com/labstack/echo/v4 from 4.13.3 to
4.13.4 (#4456)
- Fix the inconsistent behaviour of get_terragrunt_dir function
(#4443)
* Mon Jun 30 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.82.1:
* Experiments Updated
- The cas experiment now supports terraform block source
attributes
The cas experiment now supports de-duplication of
OpenTofu/Terraform module source cloning during unit
initialization.
This both reduces time spent cloning OpenTofu/Terraform
module sources by reducing network bandwidth overhead, and
reduces disk utilization.
* Bugs Fixed
- The hcl validate command now returns an appropriate exit code
When using hcl validate, if any unit fails validation when
run against a stack of units, the final exit code will be
non-zero when any unit fails validation.
While this is technically a bugfix that is a 🛠️ breaking
change in behavior, maintainers have opted to release this as
part of a patch release, as it's what most users expect from
the command and it's how the command is documented. We are
also trying to reduce the number of minor releases on the
road to 1.0 to make it easier to focus on the big changes
that require significant adjustment in usage of Terragrunt,
and want to make sure that users take special note of
breaking removal of deprecated functionality.
Avoiding the breaking change is fairly simple:
terragrunt hcl validate || true
* What's Changed
- 4211 - fix: Setting correct exit code for `hcl validate`
(#4290)
- fix: Addressing review feedback from #4436 (#4472)
- feat: Expanding CAS support for OpenTofu/Terraform source
clones (#4436)
- fix: Fixing some 404s reported (#4467)
- docs: Updating `report` experiment docs (#4452)
- feat: Adding `EnsureRun` method (#4453)
- chore: Adding AJ as CODEOWNER (#4458)
* Wed Jun 25 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.82.0:
* OpenTofu 1.10 support: We are now testing Terragrunt against
OpenTofu 1.10, and is confirmed to be working.
NOTE: Although this release is marked as backward incompatible,
it is functionally compatible as nothing has been changed in
Terragrunt internals. The minor version release is useful to
mark the change in the OpenTofu version that is being tested.
* What's Changed
- Add support for OpenTofu 1.10 (#4465)
* Sat Jun 21 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.81.10:
* feat: Improved log messages for stack commands (#4363)
* chore(deps): Updated to Go 1.24.4 by @denis256 in #4454
* chore(deps): Updated to boilerplate v0.6.3 by @denis256 in
[#4454]
* chore(deps): Updated to aws-sdk-go-v2 v1.36.5 by @denis256 in
[#4454]
* chore(deps): Updated to cloud.google.com/go/storage v1.55.0 by
@denis256 in #4454
* chore(deps): Updated to go-cty v1.16.3 by @denis256 in #4454
* chore(deps): Updated to aws-sdk-go-v2/service/s3 v1.81.0 by
@denis256 in #4454
* Sat Jun 21 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.81.9:
- Styling for Run Summary Updated
Per design feedback, the styling for Run Summaries has been
updated slightly.The report is now considered feature complete.
Any further updates will be made to address community feedback.
* What's Changed
- fix: Fixing issue with ending runs from
`--queue-exclude-external` (#4451)
- feat: Updating styling for summary (#4441)
* Thu Jun 19 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.81.8:
* New Features
- Scaffold now supports Boilerplate dependencies and partials
The Scaffold feature now supports leveraging Boilerplate
dependencies and partials.
This was a missing feature in the integration between
Scaffold and Boilerplate, and Terragrunt users do not have to
change anything in how they invoke Scaffold to have custom
Boilerplate templates properly render using those Boilerplate
features.
* What's Changed
- fix: Add scaffold support for boilerplate dependencies and
partials (#4437)
- Improve error message when terragrunt.hcl file does not exist
(#4425)
- build(deps): bump ruby/setup-ruby from 1.242.0 to 1.245.0
(#4426)
- perf: Improving CAS performance a bit (#4439)
- fix: Fixing heading level for experiments (#4433)
- fix: Fixing usage of `dependencies` in discovery (#4429)
* Mon Jun 16 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.81.7:
* Experiments Updated
- --summary-unit-duration replaced with --summary-per-unit
Per design feedback, the flag --summary-unit-duration has
been replaced with --summary-per-unit in the report
experiment.
This was done to streamline the information conveyed by the
run summary, and to maximize leverage over the screen real
estate taken by the summary.
The report experiment is still ongoing, and community
feedback is encouraged. Please share any feedback you may
have before the design of Run Reports and Run Summaries are
finalized.
* What's Changed
- fix: Replace summary unit durations (#4418)
- fix: Adding E2E tests for catalog (#4424)
* Sat Jun 14 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.81.6:
* Bug Fixes
- The catalog command no longer panics during scaffolding
A mistake in a refactor of internal logging caused a panic
during scaffolding while using the Terragrunt Catalog
Terminal User Interface (TUI).
That bug has been fixed.
- IaC Engines now properly handle errors during init and
shutdown
Some missing error handling in IaC Engines has been
introduced to properly handle failed initialization and
shutdown by IaC Engines.
* What's Changed
- fix: Fixing log passthrough on logs (#4421)
- Dependencies update (#4417)
- fix: Adding error handling for engines (#4414)
- feat: Usage of discovery and queue to build stack modules
(#4393)
* Thu Jun 12 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.81.5:
* New Features
- Terragrunt now supports credentials stored in .terraformrc
files when fetching from private registries, in addition to
the fallback mechanism of using TG_TF_REGISTRY_TOKEN.
* What's Changed
- feat: support credential tokens for getter (#4047)
* Thu Jun 12 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.81.4:
* Experiments Updated
The reports experiment now supports the --summary-unit-duration
flag
As part of delivering #3628 , the reports experiment has been
updated to support optionally displaying unit-level duration
information in the Run Summary.
You can now optionally display the duration for each unit run
as part of the Run Summary by adding the
- -summary-unit-duration flag to your run commands:
$ terragrunt run --all plan --summary-unit-duration
[#] Omitted for brevity...
❯❯ Run Summary
Duration: 10m
long-running-unit: 10m
medium-running-unit: 12s
short-running-unit: 5ms
Units: 3
Succeeded: 3
By default, this information will be omitted.
For more information, see Showing unit durations in the docs.
* What's Changed
- feat: Adding `--summary-unit-duration` (#4410)
- feat: Improving testing & documentation (#4409)
* Wed Jun 11 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.81.3:
* Experiments Updated
- The reports experiment now supports generating reports in
JSON format
As part of delivering #3628 , the reports experiment has been
updated to support JSON report generation in addition to the
default of CSV report generation.
To generate a report using JSON formatting, either use the
- -report-format flag to explicitly set the format to one of
csv or json or provide a --report-file with a .csv or .json
file extension to implicitly select the report format.
- The reports experiment now supports generating a JSON schema
for reports
As part of delivering #3628 , the reports experiment has been
updated to support generating a JSON schema following the
JSON Schema specification in addition to generating reports.
To generate a schema, use the --report-schema-file flag.
* What's Changed
- feat: Adding `--report-schema-file` (#4408)
- feat: Add JSON support to `report` experiment (#4403)
- fix: Avoid using interface pointer (#4405)
- fix: Addressing gopls updates (#4406)
* Wed Jun 11 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.81.2:
* Experiments Updated
The reports experiment now supports generating reports
As part of delivering #3628 , the reports experiment has been
updated to support CSV report generation.
When the reports experiment is enabled, and the --report-file
argument is passed to a run --all / run --graph / stack run
command, Terragrunt will generate a CSV report of the run in
addition to the summary that is emitted by default.
That report offers details on the outcome of each run in the
Run Queue.
https://terragrunt.gruntwork.io/docs/features/run-queue/
For more information, read the documentation on the Run Report.
https://terragrunt.gruntwork.io/docs/features/run-report/#run-report
* What's Changed
- feat: Allow users to save reports during runs (#4396)
- fix: Avoid installing D2 in Vercel (#4404)
* Mon Jun 09 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.81.1:
* Experiments Added
The reports experiment has been added
As part of delivering #3628 , the reports experiment has been
added. When enabled, Terragrunt will emit summaries of runs at
the end of run --all commands.
e.g.
$ terragrunt run --all plan
[#] Omitted for brevity...
❯❯ Run Summary
Duration: 62ms
Units: 3
Succeeded: 3
The summary can also be disabled using the --summary-disable
flag, even when the experiment is active.
You can learn more about this feature here.
https://terragrunt.gruntwork.io/docs/features/run-report/
More will be added in the near future to allow for report
generation and customization. Stay tuned!
* What's Changed
- feat: Integrating report into runs (#4387)
- feat: Added configstack abstraction (#4385)
- feat: Adding `report` package (#4386)
- feat: github action for signing executables (#4369)
* Tue Jun 03 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.81.0:
* Breaking Changes
- Bare Includes Deprecated
Use of bare includes (include configuration blocks without a
label) are now deprecated.
For example:
include {
path = find_in_parent_folders("root.hcl")
}
Will now result in a deprecation warning, while the following usage of an include with a label added won't:
include "root" {
path = find_in_parent_folders("root.hcl")
}
Using labeled includes result in better performance, as
backwards compatibility requires that Terragrunt does
additional work during configuration processing. You are
advised to update your bare includes to use labels as early
as possible.
Note that although this deprecation won't be an immediate
breaking change. It will be a breaking change in the future.
To opt-in to this breaking change today, you can use the
bare-include strict control to mandate usage of the modern,
labelled include. Doing so will ensure that you and your
teammates are leveraging the most performant version of the
configuration block.
Backwards compatibility is guaranteed to remain present for
this functionality until at least Terragrunt 2.0.
- Logging Moved from Terragrunt Options
If you depend on Terragrunt as a Golang library, you'll want
to take note that this release introduces a breaking change
to public functions in multiple packages to adjust how the
logger is passed. The Terragrunt logger is no longer a member
of the TerragruntOptions struct in the options package, and
is instead passed explicitly as an argument to functions that
need the logger.
For example, the signature for the RunCommand function in the
shell package changed from this:
func RunCommand(ctx context.Context, opts *options.TerragruntOptions, command string, args ...string) error
To this:
func RunCommand(ctx context.Context, l log.Logger, opts *options.TerragruntOptions, command string, args ...string) error
You maybe need to manually construct a logger to pass into
public functions you are calling in Terragrunt packages as a
consequence.
* New Features
- Added constraint_check HCL Function
A new HCL function, constraint_check, has been added to
Terragrunt.
This HCL function allows you to drive logic in your
configurations based on constraints checked against arbitrary
semantic versions.
For example:
feature "module_version" {
default = "1.2.3"
}
locals {
module_version = feature.module_version.value
needs_v2_adjustments = constraint_check(local.module_version, ">= 2.0.0")
}
terraform {
source = "github.com/my-org/my-module.git//?ref=v${local.module_version}"
}
inputs = !local.needs_v2_adjustments ? {
old_module_input_name = "old_module_input_value"
} : {
new_module_input_name = "new_module_input_value"
}
Using this function, you can alter the behavior of units when
particular OpenTofu/Terraform module versions are used,
including changing inputs or altering error handling.
* What's Changed
- docs: Documenting `constraint_check` (#4384)
- Add constraint_check HCL function (#4376)
- OTEL dependencies update (#4370)
- chore: Deprecating bare includes (#4375)
- perf: Moving logger out of opts (#4367)
- fix: Fixing reference to `relative_path_to_include` (#4371)
- fix: Always run CI on push (#4372)
- feat: Added license check (#4368)
* Sat May 31 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.80.4:
* New Features
The exec command has gained support for use of the --tf-path
flag. This can be important when Terragrunt incidentally uses
OpenTofu/Terraform to do things like fetch outputs from
dependencies.
* What's Changed
- Add tf-path flag to exec command (#4343)
- fix: Optimizing CI cache keys (#4362)
- docs: gcp docs update (#4361)
* Thu May 29 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.80.3:
* Performance Improvements
- Significant performance improvements for run --all
The performance of run --all has been improved in two
significant ways:
1. Performance for named includes has improved.
Backwards compatibility for bare includes required that
Terragrunt do some inefficient work internally to handle
both named includes and bare includes by doing an
in-memory rewrite of Terragrunt configurations. An
optimization has been introduced to avoid this behavior
when users use named includes. This optimization does not
extend to users that are using bare includes.
Users are advised to avoid using bare includes whenever
possible for maximum performance. A strict control has
been introduced to enforce usage of named includes.
In a future minor release, a warning will be emitted,
instructing users to stop using bare includes. Maintainers
will avoid breaking support for bare includes until at
least 2.0.
For more information on how to benefit from this
optimization, see the migration guide.
2. The check for OpenTofu/Terraform code has been optimized.
To provide helpful error messages when users don't have
OpenTofu/Terraform code for Terragrunt to run, Terragrunt
checks for the presence of OpenTofu/Terraform
configuration files (e.g. *.tf, *.tofu). This check has
been optimized to improve performance.
In a micro-benchmark on an M3 Max, using the
BenchmarkManyEmptyTerragruntInits benchmark, which tests the
performance of a Terragrunt run --all init across 1000 inits,
the following performance gains were released:
42% speed improvement.
43% memory reduction.
More optimizations of this sort are planned for future
releases.
- Size reduction of compiled binaries
The size of compiled binaries will be reduced due to the
stripping of debug symbols from the final executable. As an
example, this drops the size of the compiled Linux AMD64
binary from 99MB to 70MB.
This can be a small improvement to download times for
environments where Terragrunt is downloaded frequently.
* Bug Fixes
- Fixed -detailed-exitcode behavior in run --all
An unintended side-effect of addressing a different bug for
Terragrunt’s handling of the -detailed-exitcode flag in
OpenTofu/Terraform in retries was that any run in a run --all
could override the exit code of the entire run --all.
This has been fixed. The exit code of the run --all -- plan
- detailed-exitcode command will now properly aggregate exit
codes from all runs in a run --all, only reseting the exit
code for an individual unit if it properly recovers after a
retry.
* What's Changed
- docs: Documenting deprecation of bare includes (#4346)
- fix: Fixing discrepency betwen Jekyl docs and Starlight docs
for validate (#4359)
- fix: Adjusting tf check so that it's easier to update (#4360)
- fix: Setting of right exit code in case of detailed-exitcode
(#4357)
- perf: Deprecating bare includes (#4340)
- perf: Adding optimized tf code check (#4339)
- fix: Removing unnecessary input on flake dispatch [skip ci]
(#4337)
- fix: Get way more aggressive with cleanup (#4342)
- fix: Reverting to defer (#4344)
- chore: reduce size of produced executable (#4341)
* Fri May 23 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.80.2:
* New Features
- find adds support for --include
The find command now supports the --include flag to allow for
fine grained control over the discovery of units that include
other partial configurations.
* Bug Fixes
- --tf-path now correctly overrides terraform_binary
A bug in the precedence logic for Terragrunt configuration
parsing resulted in the CLI flag --tf-path from being ignored
when the terraform_binary attribute was set.
Terragrunt will now correctly respect the terraform_binary
attribute when set, and allow --tf-path to override the value
when it is set.
* What's Changed
- fix: Cleaning up addition of `--include` on `find` (#4335)
- chore: migrated to golangci-lint v2 (#4333)
- fix: Fixing usage of `--tf-path` (#4332)
- feat: Adding flake test (#4334)
- add `--include` in `find --json` (#4330)
- feat: Adding basic benchmarks (#4325)
* Thu May 22 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.80.1:
* chore: Build process now leverages Go 1.24 features and
improvements by @denis256 in #4324
- Makefile adapted, upstream now uses mockgen instead of mockery
- add shell completion subpackages
* Thu May 22 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.80.0:
Terraform 1.12 support: We are now testing Terragrunt against
Terraform 1.12 and is confirmed to be working.
NOTE: Although this release is marked as backward incompatible,
it is functionally compatible as nothing has been changed in
Terragrunt internals. The minor version release is useful to mark
the change in Terraform version that is being tested.
* What's Changed
- chore: Add support for Terraform 1.12 (#4317)
- build(deps): bump golang.org/x/sys from 0.32.0 to 0.33.0
(#4268)
- build(deps): bump cloud.google.com/go/storage from 1.51.0 to
1.53.0 (#4269)
- build(deps): bump github.com/aws/aws-sdk-go from 1.55.6 to
1.55.7 (#4300)
* Thu May 22 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.79.3:
* Enhancements
- Limitation on Catalog URLs lifted
A limitation on only supporting recognized go-getter URL
patters has been lifted from the catalog command.
The reason this limitation existed in the past was to ensure
that users were able to have Terragrunt load module source
code in browsers from the catalog Terminal User Interface
(TUI). To support that, only a constrained set of sources
were supported, to ensure that a button was available to pop
open the link in the browser.
Terragrunt will now dynamically adjust the buttons available
after module selection to gracefully degrade the experience,
instead of completely rejecting repository sources that can't
be predictably converted to browser URLs.
This allows more users to adopt the Terragrunt Catalog, while
providing the same great user experience for users that are
on fully supported platforms, like GitHub, GitLab, BitBucket,
etc.
* What's Changed
- feat: Allow unknown catalog URLs (#4318)
- chore: Adjusting catalog implementation (#4315)
- Update 04-config-blocks-and-attributes.md (#4319)
* Thu May 22 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.79.2:
* Performance Improvements
- Improved overall performance by memoizing -version output in
each unit.
* What's Changed
- feat: performance improvement on -version execution (#4288)
* Wed May 21 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.79.1:
* Enhancements
- Recursive stack clean
Improved stack clean to recursively delete all nested stack
directories, ensuring thorough cleanup.
* What's Changed
- feat: improved `stack clean` to remove recursive stack
directories (#4313)
- Update QuickStart documentation with an additional example to
control the output directory (#4299)
- fix: Enabling disabled tests (#4312)
- feat: Switching to GitHub Actions OIDC role assumption for
OIDC test (#4305)
- fix: Correcting `legacy-all` strict control name in docs
(#4311)
* Wed May 21 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.79.0:
* Enhancements
The run --all command automatically generates Terragrunt Stacks
If you are using terragrunt.stack.hcl files in your codebase,
run --all commands will now automatically expand all
terragrunt.stack.hcl files into generated stack configurations,
as if you had run stack generate before running the run --all
command.
e.g.
terragrunt run --all plan
Is now equivalent to:
terragrunt stack generate
terragrunt run --all plan
If you would like to disable this new behavior, you can use the
- -no-stack-generate to opt out of automatic stack generation.
* What's Changed
- fix: Fixing install version (#4310)
- feat: Adjusting nav height (#4284)
- feat: Adding cloud-nuke cron (#4306)
- fix: Fixing `remote-relative-with-slash` fixture on ARM tests
(#4297)
- Improved error handling (#4303)
- Automatically stack generate in run --all or run --graph
command (#4283)
- build(deps): bump DavidAnson/markdownlint-cli2-action from 19
to 20 (#4302)
- build(deps): bump ruby/setup-ruby from 1.238.0 to 1.242.0
(#4301)
- build(deps): bump github.com/gruntwork-io/terratest (#4267)
- build(deps): bump ruby/setup-ruby from 1.233.0 to 1.238.0
(#4270)
- Enable back disable test (#4286)
- feat: Github Action tests migration (#4281)
- feat: Adding GTM (#4285)
- feat: Moving users over to terragrunt-v1.gruntwork.io docs
(#4202)
* Wed May 14 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.78.4:
* New Features
- OpenTelemetry Trace Propogation
In anticipation of the introduction of OpenTelemetry support
in OpenTofu 1.10, Terragrunt will now propagate the
TRACEPARENT environment variable to child processes to
support OpenTelemetry traces that maintain context across
Terragrunt and OpenTofu.
This work is based on @Yantrio 's PoC PR #4254, and is only
useful due to his work adding OpenTelemtry in OpenTofu. Thank
you!
* What's Changed
- feat: Add generation of opentelemtry parent traces to invoked
executables (#4278)
- feat: Adding homepage to Starlight docs (#4250)
- chore: Offboarding Levko (#4280)
- Add support for Terraform tests in Github Action (#4275)
* Mon May 12 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.78.3:
* Bug Fixes
When an error retry results in a plan succeeding when it
initially failed, usage of run --all -- plan -detailed-exitcode
will now properly take into account the final exit code, rather
than the first one, meaning that the exit code of the whole run
will be zero if no other units fail their plans.
* What's Changed
- fix #3845 set the correct exit code when a retry is
successful. by @wakeful in #3966
- docs: Improving Run Queue docs by @yhakbar in #4272
* Sat May 10 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.78.2:
* feat: enable GCP integration tests in GH Action by @denis256 in
[#4257]
* feat: fixed TestGcpWorksWithImpersonateBackend test by
@denis256 in #4261
* feat: Adding integration tests by @yhakbar in #4198
* feat: add Windows integration tests by @denis256 in #4262
* fix: Removing HTML font-size by @yhakbar in #4256
* docs: Adding Run Queue Docs by @yhakbar in #4249
* build(deps): bump github.com/gruntwork-io/boilerplate to v0.6.1
by @denis256 in #4263
* build(deps): bump github.com/gruntwork-io/terragrunt-engine-go
to v0.0.14 by @denis256 in #4263
* build(deps): bump golang.org/x/oauth2 to v0.30.0 by @denis256
in #4263
* build(deps): bump golang.org/x/sync to v0.14.0 by @denis256 in
[#4263]
* build(deps): bump google.golang.org/api to v0.232.0 by
@denis256 in #4263
* build(deps): bump google.golang.org/grpc to v1.72.0 by
@denis256 in #4263
* chore: dependencies update by @denis256 in #4263
* Tue May 06 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.78.1:
* fix: AWS S3 backend access logging bucket not versioning
(#4246)
* docs: Updating docs now that stacks are generally available
(#4243)
* Fri May 02 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.78.0:
* Experiments Completed
The stacks experiment is now complete.
If you were previously using the flag --experiment stacks to
opt in to experimental functionality, you no longer have to do
so. Note that if you are, you will simply get a warning that it
is no longer necessary.
* Breaking Changes
Legacy commands (as replaced by the CLI Redesign are now
deprecated, and will be phased out at a future date, which will
be scheduled in #3535. Make sure to subscribe to the issue if
you would like to be informed when these deprecated features
are no longer supported.
For instructions on migrating to the new commands provided
after the CLI Redesign, read the CLI Redesign Migration Guide.
The following are now deprecated:
- hclfmt (use hcl fmt instead)
- hclvalidate (use hcl validate instead)
- validate-inputs (use hcl validate --inputs and hcl validate
- -inputs --strict instead)
- terragrunt-info (use info print instead)
- output-module-groups (use find --dag --json instead)
- render-json (use render --json -w instead)
- graph-dependencies (use dag graph instead)
- run-all (use run --all instead)
- graph (use run --graph instead)
- The default command. e.g. terragrunt workspace list (use
terragrunt run -- workspace list instead)
- Default bootstrap (automatically provisioning backend
resources without additional flags). This is now opt in
behavior, and requires usage of the --backend-bootstrap flag
or explicitly running the new backend bootstrap command.
- aws-provider-patch (we are simply deprecating this command,
and removing it when the other commands are removed. It
served its purpose as a short term stopgap tool).
Note that this will not result in an immediate breaking change
for users, as we’ll have an initial deprecation window to give
users time to adjust to these changes. If you’d like to ensure
that you are prepared for the future removal of legacy
commands, you can take advantage of the cli-redesign strict
control to opt in to the future breaking change early.
* Enhancements
The logging for stack generation has been improved to make it
easier to determine at a glance the stack file that’s
generating a particular unit.
* What's Changed
- feat: improved stack logs generation by @denis256 in #4213
- feat: stacks expriment completion by @denis256 in #4222
- feat: Deprecating render-json command by @levkohimins in
[#4227]
- feat: Deprecating aws-provider-patch command by @levkohimins
in #4228
- feat: Deprecating output-module-groups command by
@levkohimins in #4229
- fix: Fixing base tests for macOS by @yhakbar in #4193
- fix: Fixing 404 in performance docs by @yhakbar in #4194
- fix: basic tests execution update by @denis256 in #4192
- fix: Throwing interrupt signal with --all flag by
@levkohimins in #4224
- fix: handling of errors in parsing base blocks by @denis256
in #4226
- fix: Cleaning up legacy -all usage by @yhakbar in #4239
- fix: Rename all the --terragrunt- flags by @yhakbar in #4203
- fix: Cleaning up run-all usage by @yhakbar in #4223
- fix: Updating environment variables for flags by @yhakbar in
[#4240]
- fix: Updating migration guide for CLI Redesign migration by
@yhakbar in #4207
- docs: Adding docs for cli-redesign strict control by @yhakbar
in #4238
- docs: Documenting CLI Redesign deprecations by @yhakbar in
[#4237]
- docs: updated stack links by @denis256 in #4201
- chore: Preserve tests with deprecated commands/flags by
@levkohimins in #4242
- chore: hclfmt hclvalidate validate-inputs as deprecated
commands (minor fixes) by @levkohimins in #4199
- chore: hclfmt hclvalidate validate-inputs as deprecated
commands by @levkohimins in #4196
- build(deps): bump github.com/getsops/sops/v3 from 3.10.1 to
3.10.2 by @dependabot in #4185
- build(deps): bump
go.opentelemetry.io/otel/exporters/stdout/stdouttrace from
1.34.0 to 1.35.0 by @dependabot in #4184
- build(deps): bump DavidAnson/markdownlint-cli2-action from 15
to 19 by @dependabot in #4187
- build(deps): bump ruby/setup-ruby from 1.230.0 to 1.233.0 by
@dependabot in #4186
- build(deps-dev): bump nokogiri from 1.18.4 to 1.18.8 in /docs
by @dependabot in #4195
* Fri Apr 25 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.22:
* Experiments Completed
The cli-redesign experiment is now complete.
If you were previously using the flag --experiment cli-redesign
to opt in to experimental functionality, you no longer have to
do so. Note that if you are, you will simply get a warning that
it is no longer necessary.
* What's Changed
- chore: Complete CLI Redesign experiment (#4189)
- feat: Adding base tests (#4176)
* Thu Apr 24 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.21:
* New Features
- Introduction of hcl commands
As part of the CLI Redesign experiment, the hcl commands have
been introduced.
The hcl commands allow users to directly interact with HCL
content independent of the underlying functionality they
support.
The functionality of the hcl commands replace existing
functionality that is soon to be deprecated:
hclfmt --> hcl fmt
hclvalidate --> hcl validate
validate-inputs --> hcl validate --inputs
validate-inputs --strict-validate --> hcl validate --inputs --strict
* What's Changed
- fix: Update status of cli-redesign experiment (#4188)
- feat: `hcl` commands docs (#4180)
- fix: Fix spelling (#4179)
- feat: Implementation of `hcl` commands (#4169)
- feat: add symbol link experiemnt in discovery process (#4177)
- fix: Adding redirect from /docs/reference/experiment-mode to
/docs/reference/experiments (#4178)
- build(deps): bump github.com/charmbracelet/bubbles from
0.20.0 to 0.21.0 (#4160)
* Fri Apr 18 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.20:
* build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3
(#4158)
* build(deps): bump golang.org/x/term from 0.30.0 to 0.31.0
(#4159)
* build(deps): bump github.com/ProtonMail/go-crypto from 1.1.6 to
1.2.0 (#4161)
* feat: Adding markdownlint v2 to GitHub Actions workflows
(#4175)
* feat: Adding codespell workflow (#4173)
* feat: Adding `lint.yml` and `strict-lint.yml` workflows for
GitHub Actions (#4172)
* fix: Improving getting started guide (#4174)
* feat: Adding `build-no-proxy.yml` workflow (#4171)
* Fri Apr 18 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.19:
* New Features
- OpenTelemetry traces are now integrated into find and list
commands
Please see the release for example screenshots
https://github.com/gruntwork-io/terragrunt/releases/tag/v0.77.19
* What's Changed
- feat: add telemetry for find/list (#4165)
* Fri Apr 18 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.18:
* New Features
- Support for HCL formatting with the render command
As part of the CLI Redesign experiment, the render command
now supports HCL formatting for rendered configurations,
which is the default output format.
Using the render command with HCL formatting allows users to
get a quick, minimal evaluation of Terragrunt unit
configurations with as much pre-processing done as possible.
Using the render command with HCL formatting offers a way to
resolve complex HCL function evaluation, include merging or
string interpolation, etc. to achieve equivalent Terragrunt
HCL configurations that are easier to reason about.
* What's Changed
- feat: Adding `render` with HCL formatting (#4164)
* Wed Apr 16 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.17:
* New Features
- Introduction of the render command
As part of the CLI Redesign experiment, the render command
has been introduced.
The render command allows users to easily render Terragrunt
unit configurations with reduced complexity, making it easier
to understand configurations at a glance.
The introduction of the render command is part of the
eventual deprecation of the existing render-json command,
which will be deprecated by the end of the CLI Redesign. The
render command is a higher level command, that offers the
ability to write to stdout, in addition to writing to files,
and will support HCL configurations in addition to JSON
(coming soon).
To learn more about the render command, read the official
documentation here.
https://terragrunt.gruntwork.io/docs/reference/cli-options/#render
* What's Changed
- feat: Adding docs for `backend migrate` (#4140)
- feat: Adding `render` command (#4145)
- build(deps): bump ruby/setup-ruby from 1.229.0 to 1.230.0 (#4162)
* Wed Apr 16 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.16:
* New Features
- Introduction of the backend migrate command
As part of the CLI Redesign experiment, the backend migrate
command has been introduced.
The backend migrate command allows you to simply migrate
state between different units (or renames of units) without
manually running OpenTofu/Terraform state migration commands.
To learn more about the backend migrate command, read the
official docs.
* What's Changed
- feat: Improve error explainer to catch stack values errors
(#4163)
- feat: Support state migration between different backends
(#4154)
- fix: disable tf rc file overwriting for non-cached commands
(#4155)
- fix: Deprecated flags msg for experimental command (#4146)
* Wed Apr 16 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.15:
* New Features
- Introduction of the dag graph command
As part of the CLI Redesign experiment, the dag graph command
has been introduced.
* What's Changed
- feat: add dag graph command (#4143)
- docs: Adding migration guide for adopting Terragrunt Stacks
(#4152)
* Sat Apr 12 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.14:
* New Features
Support for --exclude and --queue-construct-as in find and list
The find and list commands have been updated to leverage new
capabilities involving greater understanding of the Terragrunt
run queue.
Users can now leverage the --queue-construct-as (or just --as)
flag in the find and list commands to discover configurations
as if a particular Terragrunt command was being run (e.g. plan,
destroy).
The find and list commands will now construct the Terragrunt
run queue as if a particular command was being run, potentially
altering the position of elements in the run queue, based on
their dependencies (dependencies before dependents for plans,
applies, etc. and dependents before dependencies for destroys).
In addition, users can leverage the --exclude flag on the find
command to get information on the exclude block included in
results. The exclude block is also factored in to discovery
results when the --queue-construct-as flag is passed, allowing
users to dry-run behavior of the exclude block before
performing any Terragrunt runs.
* What's Changed
- feat: Adding exclude support to list and find (#4147)
* Fri Apr 11 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.13:
* build(deps): bump github.com/getsops/sops/v3 from 3.9.4 to
3.10.1 (#4130)
* build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.29.0
(#4131)
* build(deps): bump golang.org/x/sys from 0.31.0 to 0.32.0
(#4133)
* build(deps): bump google.golang.org/grpc from 1.71.0 to 1.71.1
(#4132)
* Fri Apr 11 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.12:
* New Features
Introduced no_validation attribute for stack and unit, allowing
users to bypass Terragrunt's validation checks when deploying
infrastructure. This is particularly useful in scenarios where
you need to deploy infrastructure that doesn't strictly adhere
to Terragrunt's validation rules, such as during emergency
deployments or when working with legacy infrastructure
patterns.
* What's Changed
- feat: add support for no_validation attribute for stack and
unit (#4149)
- feat: Adding a bit more docs for stacks (#4144)
* Wed Apr 09 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.11:
* New Features
Introduction of the info print command
As part of the CLI Redesign experiment, the info print command
has been introduced.
* What's changed
- feat: add info command (#4122)
* Wed Apr 09 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.10:
* fix: Back out migrate command pending resolution (#4142)
* fix: Fixing optional default template (#4141)
* feat: Implementation `backend migrate` command (#4135)
* feat: stack code improvements (#4136)
* fix: remove warning message for unimplemented backends (#4138)
* fix: Suppressing warning for catalog when determining default
file name (#4134)
* Tue Apr 08 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.9:
* Bug fixes
Fetching Outputs from Nested Stacks
Resolved an issue that prevented the correct retrieval of
outputs from nested stacks.
* What's Changed
- fix: corrected the logic for fetching outputs from nested
stacks by @denis256 in #4126
* Tue Apr 08 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.8:
* Documentation Updates
A new performance guide has been added to Terragrunt
documentation to offer guidance on how performance can be
improved when using Terragrunt or contributing to the
Terragrunt codebase.
https://terragrunt.gruntwork.io/docs/troubleshooting/performance/
This documentation will evolve over time, as more optional
optimizations become available, or are no longer necessary, as
they become default behavior.
* What's Changed
- feat: Add performance guide by @yhakbar in #4120
- build(deps): bump ruby/setup-ruby from 1.221.0 to 1.229.0 by
@dependabot in #4100
- fix: Addressing commas in external IDs by @yhakbar in #4128
* Thu Apr 03 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.7:
* New Features
Users can now configure a custom default template for scaffold
and catalog commands in their catalog configuration blocks like
so:
catalog {
default_template = "git@github.com/acme/example.git//path/to/template"
}
For more information, read the documentation in the catalog
feature.
* What's Changed
- fix: Updating docs after #4035 (#4117)
- feat: Adding custom default template (#3658) (#4035)
- feat: stacks improvements (#4114)
* Wed Apr 02 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.6:
* bug: added limitation on detection of stack files (#4113)
* fix: Ignoring lock table encryption setting (#4112)
* feat: added support for parsing stack config from string
(#4110)
* Tue Apr 01 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.5:
* feat: added support for OpenTelemetry in stack commands to
enable enhanced observability and tracing by @denis256 in #4109
* Tue Apr 01 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.4:
* Bug fixes
- Newlines reduced in Error Logging for Configuration Errors
Logging for configuration errors has been compacted to reduce
noise, and make errors easier to read.
- Improved Cycle Detection Logic for stack generate
On the default filesystem for macOS, path length was likely
to result in an error before internal cycle detection logic,
so cycle detection was updated to leverage a maximum path
length of 1024 characters as an earlier exit for all
operating systems.
- Excessive warning for bootstrap requirement resolved
Internal logic for determination that backends required
bootstrapping was adjusted to no longer leverage the value of
the OpenTofu state file.
While cheaper than making a network request to assess the
current state of backend resources, it also resulted in false
negatives, which triggered excessive backend bootstrap
warnings.
* What's Changed
- fix: New lines in TF diagnostic log by @levkohimins in #4108
- fix: Stack cycles detection improvements by @denis256 in
[#4106]
- fix: Fixing excessive warning for bootstrap by @yhakbar in
[#4107]
* Mon Mar 31 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.3:
* Enhancements
Error Handling for Discovery
The find and list commands now leverage improved error handling
when discovering configurations throughout Terragrunt projects.
When configurations require authentication due to usage of
functionality like get_aws_account_id(), have errors in their
configurations or cycles between dependencies, the commands
will do their best to return valid results, and warn the user
that the results are incomplete due to suppressed errors or cut
cycles.
This should allow for usage of the find and list commands in
more real-world use-cases, which frequently require this kind
of error handling.
* What's Changed
- feat: Adding error handling for discovery by @yhakbar in
[#4098]
* Mon Mar 31 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.2:
* New Features
The backend configuration block now supports
assume_role_with_web_identity for configuring the backend block
of the OpenTofu/Terraform terraform block.
This allows users separately authenticating to backends with a
different role to leverage role assumption with OIDC.
For more information, see the backend docs.
* What's Changed
- feat: Adding assume_role_with_web_identity for backend
configs by @yhakbar in #4097
- chore: simplified processing of errors block by @denis256 in
[#4046]
- build(deps): Updated google.golang.org/protobuf to 1.36.6 by
@denis256 in #4096
- build(deps): Updated github.com/charmbracelet/lipgloss to
v1.1.0 by @denis256 in #4096
- build(deps): Update
github.com/gruntwork-io/terragrunt-engine-go to v0.0.13 by
@denis256 in #4096
- build(deps): Update github.com/urfave/cli/v2 to v2.27.6 by
@denis256 in #4096
* Fri Mar 28 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 0.77.1:
* New Features
- Improved error handling by adding a test check for
non-existent stack and unit paths, ensuring clearer messages
when expected files are missing.
* What's Changed
- feat: added support for reading stack configuration and
values files by @denis256 in #4085
- feat: enhanced stack validation with improved checks and
error reporting by @denis256 in #4078
* Fri Mar 28 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.77.0:
* Breaking Changes
- Best Effort Parsing
Exported functions like ParseConfig and ParseConfigString now
perform best effort parsing instead of early returns.
Consumers of Terragrunt as a library should be aware of this
change, as it can result in partially parsed configurations
being returned instead of nil when errors are encountered
during parsing. As a consumer of these functions, you are
responsible for checking the errors being returned, and
handling the returned configuration value accordingly.
These changes are being introduced to support greater parsing
flexibility for usage in the find and list command, which
will be able to handle partial parse failures while still
returning valuable information, along with the Terragrunt
LSP, which needs the same adjustments to parsing.
- Struct Field Alignment
The fieldalignment govet lint has been introduced to the
codebase, and all structs that had less efficient struct
field alignment have been updated to minimize their memory
footprint. If you are consuming Terragrunt as a library, you
may have to make changes to how you are leveraging exported
structs from Terragrunt.
The simplest way to avoid any breakage related to this change
is to avoid usage of unkeyed composite literals.
See the release for details:
https://github.com/gruntwork-io/terragrunt/releases/tag/v0.77.0
- Telemetry Environment Variable Name Changes
The following environment variables now have new aliases:
- TERRAGRUNT_TELEMETRY_TRACE_EXPORTER --> TG_TELEMETRY_TRACE_EXPORTER
- TERRAGRUNT_TELEMETRY_TRACE_EXPORTER_HTTP_ENDPOINT --> TG_TELEMETRY_TRACE_EXPORTER_HTTP_ENDPOINT
- TERRAGRUNT_TELEMETRY_TRACE_EXPORTER_INSECURE_ENDPOINT --> TG_TELEMETRY_TRACE_EXPORTER_INSECURE_ENDPOINT
- TERRAGRUNT_TELEMETRY_METRIC_EXPORTER --> TG_TELEMETRY_METRIC_EXPORTER
- TERRAGRUNT_TELEMETRY_METRIC_EXPORTER_INSECURE_ENDPOINT --> TG_TELEMETRY_METRIC_EXPORTER_INSECURE_ENDPOINT
These environment variables have been renamed to align more
closely with the rest of the changes in the CLI Redesign.
Note that the TRACEPARENT environment variable has not
changed. This environment variable is semi-standard in the
OpenTelemetry space, so we've preserved it.
This is not a breaking change with this release, but will be
in the future. As with all the environment variable renames
that have taken place during the CLI Redesign, both the
legacy environment variable and the new environment variable
will be supported to give users time to make requisite
adjustments. If you would like to opt in to stricter behavior
that requires usage of the new environment variables,
leverage the terragrunt-prefix-env-vars strict control.
* New Features
- Introduction of backend bootstrap and backend delete
This release introduces two new commands named backend
bootstrap and backend delete.
These commands allow for manual control over the process by
which Terragrunt can manage backend state resources on behalf
of users.
- backend bootstrap
The backend bootstrap command allows users to explicitly
bootstrap resources like S3 buckets, GCS buckets, DynamoDB
tables, etc. used to manage state for OpenTofu/Terraform.
It is accompanied by a flag (--backend-bootstrap) which
explicitly enables this behavior by default before performing
any operation that might require backend resources (like the
run command).
The introduction of this command is part of the future
deprecation of provisioning backend resources by default when
using Terragrunt. You can learn more about this in the CLI
Redesign.
- backend delete
The backend delete command allows users to delete state
resources relevant to one or more units in remote state.
Terragrunt performs two safety checks to mitigate the risk of
accidentally removing the wrong backend state resource:
1. By default, Terragrunt will refuse to remove any backend
state file if versioning is not enabled for the backend S3
bucket or GCS bucket. To explicitly ignore this safety
check, users must provide the --force flag.
2. By default, Terragrunt will prompt users to confirm their
decision to remove a given backend state file. To
explicitly ignore this safety check, users must provide
the --non-interactive flag.
The introduction of this command is part of a larger effort
to provide users greater control over the full lifecycle of
backend state resources by Terragrunt. You can learn more
about this in the CLI Redesign.
* What's Changed
- feat: Adding best effort parsing by @yhakbar in #4044
- feat: Implementation of backend commands: bootstrap, delete
by @levkohimins in #4070
- feat: Backend delete prompt by @levkohimins in #4091
- feat: Adding backend docs by @yhakbar in #4087
- fix: Updating homepage title by @yhakbar in #4081
- fix: Addressing stricter lint findings by @yhakbar in #4090
- fix: Fixing visible flags by @yhakbar in #4088
- fix: Renaming telemetry envs prefix TERRAGRUNT_ with TG_ by
@levkohimins in #4084
- fix: Fixing backend delete safety features by @yhakbar in
[#4089]
- fix: Avoiding duplicate description in flag names by @yhakbar
in #4092
- fix: terraform_binary with run version command by
@levkohimins in #4095
- build(deps-dev): bump nokogiri from 1.18.3 to 1.18.4 in /docs
by @dependabot in #4069
* Tue Mar 25 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.76.8:
* New Features
OpenTofu file extension detection
OpenTofu-specific file extensions (*.tofu and *.tofu.json) are
detected by default, just like generic *.tf, *.tf.json files,
which are used by both OpenTofu and Terraform.
This ensures that future incompatibility between OpenTofu and
Terraform which specifically requires usage of the *.tofu file
extension will be supported without additional effort.
Thank you to @wazy for contributing this new feature.
* What's Changed
- Support *.tofu and .*tofu.json file detection by @wazy in
[#4062]
* Mon Mar 24 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.76.7:
* build(deps): bump github.com/golang-jwt/jwt/v5 from 5.2.1 to
5.2.2 (#4066)
* Sat Mar 22 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.76.6:
* feat: add error throwing in case of absolut path for stack
(#4055)
* feat: Adding `govet` alignment check (#4057)
* Fri Mar 21 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.76.5:
* fix(docs): Addressing some missed renames of terragrunt.hcl to
root.hcl in the docs by @yhakbar in #4058
* build(deps): Updated cloud.google.com/go/storage to 1.51.0 by
@denis256 in #4059
* build(deps): Updated
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric to
1.35.0 by @denis256 in #4059
* build(deps): Updated
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
to 1.35.0 by @denis256 in #4059
* build(deps): Updated golang.org/x/oauth2 to 0.28.0 by @denis256
in #4059
* build(deps): Updated
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
to 1.35.0 by @denis256 in #4059
* Fri Mar 21 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.76.4:
* feat: Introduced -a alias for the -all flag #4048 by
@levkohimins
* feat: Implemented detection of nested stacks #4052 by @denis256
* fix: Refactored list package structure #4050 by @yhakbar
* fix: Updated documentation for list usage #4051 by @yhakbar
* fix: Corrected .stack references in generated documentation
[#4053] by @yhakbar
* Thu Mar 20 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.76.3:
* Breaking Changes
- find --sort=dag changed to find --dag
The experimental find command no longer has a --sort flag.
Instead the ability to sort configurations according to their
position in the DAG has been replaced with the dedicated
- -dag flag, which puts the command in "DAG Mode". These
changes have been done to allow for closer parity in the
behavior of find and list.
[#] Before
terragrunt find --sort=dag
[#] After
terragrunt find --dag
* New Features
- Introduction of the list command
As part of the CLI Redesign experiment, the list command has
been introduced. As with other new features, usage requires
enabling the CLI Redesign experiment.
The list command helps you discover and display Terragrunt
configurations in your codebase. It provides various output
formats and options to help you understand the structure and
dependencies of your Terragrunt configurations.
The list command is very similar to the find command. It uses
the same backend logic for configuration discovery. It also
supports very similar flags and configuration options.
Generally, the list command is optimized for displaying
configurations in a format that is easy for a human to read
and understand, so there are more configuration options, and
the output is more verbose. Output from the list command can
vary significantly depending on the flags used, and the
output structure is more variable than that of the find
command.
Use the list command when you want to visualize your
Terragrunt configurations in a human-readable format. Use the
find command when you want to programmatically search for
configurations in your codebase.
Usage
Please see the description and screenshots in the release:
https://github.com/gruntwork-io/terragrunt/releases/tag/v0.76.3
* What's Changed
- feat: Adding `list` command (#4034)
* Thu Mar 20 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.76.2:
* New Features
- Added --no-stack-generate support in stack run and stack
output, allowing users to disable automatic stack
regeneration before executing commands. This provides greater
control over execution by enabling operations to run using
the existing .terragrunt-stack directory, improving
efficiency and avoiding unnecessary updates.
* What's Changed
- feat: Added --no-stack-generate cli flag to skip stack
generation by @denis256 in #4039
- chroe: Stack tests improvements by @denis256 in #4033
- chrore: Adding .cursor to .gitignore by @yhakbar in #4040
- docs: Adding docs for --all and --graph by @yhakbar in #4036
- docs: Move info to a better location by @yhakbar in #4037
* Mon Mar 17 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.76.1:
* New Features
Introduced no_dot_terragrunt_stack support in stack and unit,
allowing users to opt out of generating .terragrunt-stack
directories. This enables seamless adoption of
terragrunt.stack.hcl without requiring state migration for
existing infrastructure.
* What's Changed
- Stacks: add support for no_dot_terragrunt_stack (#4019)
* Mon Mar 17 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.76.0:
* New Features / Breaking Changes
- Catalog/Scaffold no longer requires --root-file-name root.hcl
The catalog and scaffold commands will now attempt to
discover a parent root.hcl file by default and use it as the
default root Terragrunt configuration when present to help
users adopt the changes in
migrating-from-root-terragrunt-hcl.
Users that have switched over to use root.hcl as the root of
their Terragrunt configurations instead of terragrunt.hcl
will no longer need to explicitly pass --root-file-name
root.hcl or use the root-terragrunt-hcl strict control to
automatically discover the root of their Terragrunt
configurations when using catalog or scaffold.
Note that this is technically a breaking change to the way
that catalog and scaffold work. With this change, users that
have both a root.hcl file and a terragrunt.hcl file at the
root of their repositories will have the root.hcl file used
instead of the terragrunt.hcl file for the catalog and
scaffold commands.
If you are not yet ready to rename the terragrunt.hcl file at
the root of your repository, use the --root-file-name flag to
explicitly provide terragrunt.hcl as the name of the
Terragrunt configuration at the root of your Terragrunt
project.
This change was made as most users are very unlikely to have
both root.hcl (the recommended root of Terragrunt
configurations) and terragrunt.hcl (the legacy root of
Terragrunt configurations in the same Terragrunt project) at
the root of their Terragrunt project. This configuration is
entirely CLI based, making it relatively easy to address for
users (as opposed to HCL configurations, which might take
more time for teams to address).
Users looking to move from a root terragrunt.hcl file to a
root.hcl file will still need to read through the migration
guide to adjust all usages of find_in_parent_folders when
making the switch.
* What's Changed
- fix: Lookup root.hcl if present by @yhakbar in #4022
- fix: Improving logic for scaffold default root discovery by
@yhakbar in #4029
- fix: Fixing configuration parsing order link by @yhakbar in
[#4021]
* Fri Mar 14 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.75.10:
* Dependencies update (#4020)
* fix: Addressing `gopls` findings (#4018)
* build(deps): bump golang.org/x/net from 0.35.0 to 0.36.0
(#4013)
* Thu Mar 13 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.75.9:
* Bug fixes
- Using absolute paths for mark_as_read
The internal store for the values mark_as_read was tracking
now use absolute paths instead of "canonical paths". The
result of this is that even if you are using tooling like
run_cmd to dynamically discover files to mark as read, you
should still expect --queue-include-units-reading to work
correctly.
* What's Changed
- fix: Use abs path for mark_as_read by @yhakbar in #4015
* Thu Mar 13 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.75.8:
* Stacks: usage of source-map for sources (#4011)
* Thu Mar 13 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.75.7:
* New Features
- find supports dag sorting
The find command now supports the ability to sort results by
their relative positions in the Directed Acyclic Graph (DAG).
To use the find command, you must enable the cli-redesign
experiment.
- The stack run command now supports all run flags
The stack run command now supports all the same flags run
supports, including --queue-include-dir.
To use stack commands, you must enable the stacks experiment.
As an example of what's supported now:
terragrunt --experiment stacks stack run apply --queue-strict-include --queue-include-dir=./.terragrunt-stack/app1 --non-interactive
More information can be found in the stack run docs.
https://terragrunt.gruntwork.io/docs/reference/cli-options/#stack-run
* What's Changed
- feat: Adding DAG support to find (#4001)
- Stacks: run cli arguments (#4005)
- fix: Reducing noise for skipped dependency inputs (#4007)
- fix: Upgrading `golangci-lint` (#3987)
* Wed Mar 12 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.75.6:
* Stacks: parallel stacks generation (#3999)
* Addressing #3974 feedback (#4002)
* feat: add engine support to dependencies (#3974)
* Tue Mar 11 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.75.5:
* New Features
This release introduces experimental support for the Terragrunt
Content Addressable Store (CAS).
To enable this feature, you must use the cas experiment.
When using the CAS, the catalog command will store its contents
in a CAS to deduplicate repository contents, then construct the
resultant repo from the CAS.
You can use Git URLs for the catalog command normally, and when
the cas experiment is enabled, Terragrunt will leverage the CAS
to save you clone time and disk space:
catalog {
urls = [
"git@github.com:acme/modules.git"
]
}
There are more planned integration points for the CAS, but for
now only the catalog command is supported.
You can learn more about the CAS in the feature documentation.
https://terragrunt.gruntwork.io/docs/features/cas/
* feat: Adding cas support to catalog (#3929)
* feat: Adding integration testing to the `find` command. (#3997)
* Engine tests improvements (#3995)
* Mon Mar 10 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.75.4:
* feat: Adding `find` command (#3981)
* fix: Remove usage of template provider (#3986)
* Fixed failing circleci jobs (#3988)
* build(deps): bump github.com/gruntwork-io/terratest from 0.47.2
to 0.48.2 (#3858)
* fix: Adding docs from role assumption updates in Jekyll docs
(#3985)
* Fri Mar 07 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.75.3:
* chore: Bumping Dependencies as requested by Dependabot (#3984)
* Add support for all assume_role block arguments for s3 backend
(#3975)
* fix: Adjusting contribution docs (#3979)
* feat: update contributing.md with dev containers entry (#3977)
* Thu Mar 06 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.75.2:
* Stacks: stack values (#3961)
* Thu Mar 06 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.75.1:
* fix: Adding missing cautionary asides (#3970)
* Update mark_as_read example and docs (#3971)
* feat: Adding `.coderabbit.yaml` file (#3969)
* feat: Strict control for old deprecated env vars (#3964)
* build(deps-dev): bump uri from 0.13.0 to 0.13.2 in /docs
(#3963)
* fix: Replacing usage of `run-all` with `run --all` in starlight
docs (#3950)
* fix: updated failing engine tests (#3960)
* Tofu engine update to v0.0.16 (#3951)
* Wed Mar 05 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.75.0:
Terraform 1.11 support: We are now testing Terragrunt against
Terraform 1.11 and is confirmed to be working.
NOTE: Although this release is marked as backward incompatible,
it is functionally compatible as nothing has been changed in
Terragrunt internals. The minor version release is useful to mark
the change in Terraform version that is being tested.
* Add support for Terraform 1.11 (#3958)
* fix: Using `run -- graph` command (#3959)
* Wed Mar 05 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.74.0:
* Terraform 1.10 (#3605)
* feat: Implementation of `--all` `--graph` flags (#3944)
* Sat Mar 01 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.16:
* Stacks: nested stacks (#3900)
* build(deps): bump github.com/go-jose/go-jose/v4 from 4.0.4 to
4.0.5 (#3930)
* feat: Support new pre-release process (#3941)
* Thu Feb 27 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.15:
* fix: Caching the same provider with different versions from
various sources (#3935)
* Wed Feb 26 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.14:
* feat: Adding retry for clone errors (#3933)
* fix: Fixing more gaps in the docs (#3924)
* docs: Updating pre-release process (#3925)
* Tue Feb 25 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.13:
* fix #2072 make sure the `generated` code is formatted before
writing it to a file. (#3917)
* Mon Feb 24 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.12:
* Stacks: values generation (#3914)
* fix: More docs fixes (#3919)
- Update to version 0.73.11:
* fix: Preventing log enrichment for bare mode (#3916)
* fix: Adding explicit test for missing dependency (#3915)
* build(deps): bump github.com/puzpuzpuz/xsync/v3 from 3.5.0 to
3.5.1 (#3892)
* Fri Feb 21 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.10 (0.73.9 was broken):
* fix #3824 add `if` parameter to `hook` block. (#3913)
* feat: Adding auto-generated docs scaffold (#3876)
* Remove unnecessary slash (#3912)
* feat: Handling of incorrectly used flag (#3901)
* build(deps-dev): bump nokogiri from 1.16.5 to 1.18.3 in /docs
(#3905)
* Updated stack output help flags (#3899)
* Wed Feb 19 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.8:
* Added --output-folder flag to scaffold (#3805)
* build(deps): bump google.golang.org/api from 0.220.0 to 0.221.0
(#3893)
* Wed Feb 19 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.7:
* Stack unit path validation (#3897)
* feat: Clean up TF commands help (#3895)
* build(deps): bump ruby/setup-ruby from 1.215.0 to 1.221.0
(#3894)
* refactor: replace `golang.org/x/exp` with stdlib (#3881)
* Sun Feb 16 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.6:
* Stack: stack values (#3877)
* Sun Feb 16 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.5:
* feat: added self-hosted gitlab to catalog command (#3867)
* Sun Feb 16 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.4:
* Dependencies update (#3890)
* Sun Feb 16 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.3:
* Unit path check improvements (#3884)
* feat: Adding Incremental Static Regeneration to Starlight
rewrite (#3886)
* fix: Fixing some stacks docs (#3887)
* Fri Feb 14 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.2:
* fix: Correct displaying deprecated flag warnings (#3880)
* fix: Fixing excessive warning for dependency input usage
(#3879)
* Wed Feb 12 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.1:
* Stack: clean (#3871)
* feat: Redesign CLI help (#3870)
* Fix TestStacksGenerateRemote (#3865)
* feat: Adjusting icons for Terragrunt `.hcl` configs and
OpenTofu `.tf` configs in the FileTree component (#3868)
* fix: Fixing CLI option for `--queue-include-unit-reading`
(#3869)
* Tue Feb 11 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.73.0:
* Breaking Changes
- Removal of terragrunt- prefix in flags
All Terragrunt CLI flags no longer start with the terragrunt-
prefix. This will not immediately break workflows, but will
start to emit warnings for users.
We will announce removal of support for flags without the
terragrunt- prefix well in advance, and it will be done in a
future minor release before v1.0.
You can opt in to making this a breaking change today via
usage of the terragrunt-prefix-flags strict control.
- Rename of TERRAGRUNT_ prefixed environment variables
All Terragrunt environment variables are no longer prefixed
with TERRAGRUNT_, but are now instead prefixed with TG_. This
will not immediately break workflows, but will start to emit
warnings for users.
We do not currently have plans to remove support for
environment variables with the TERRAGRUNT_ prefix, and are
aiming to support them after the release of v1.0, as we know
this can be a more difficult configuration to change.
You can opt in to making this a breaking change today via
usage of the terragrunt-prefix-env-vars strict control.
- Removal of support for the Terragrunt default command
Prior to this release, Terragrunt would forward all commands
that were not defined in the Terragrunt CLI directly to
OpenTofu/Terraform. With the introduction of the new run
command, this behavior is no longer necessary, nor desirable.
In addition to supporting the new run command, Terragrunt now
also supports explicit OpenTofu shortcuts. You can learn more
about both below.
We will announce removal of support for the default command
of Terragrunt well in advance, and it will be done in a
future minor release before v1.0.
You can opt in to making this a breaking change today via
usage of the default-command strict control.
* New Features
All of the features released in this release require usage of
the cli-redesign experiment.
- New run command
This command replaces what used to be the responsibility of
the default command in Terragrunt. Going forward, when users
want to explicitly have Terragrunt run an OpenTofu/Terraform
command on their behalf, they'll use the run command.
In a future release, this command will also gain the two
following flags to replace the functionality of the run-all
and graph commands:
- -all: Replaces the run-all command.
- -graph: Replaces the graph command.
You can learn more about the run command here:
https://terragrunt.gruntwork.io/docs/reference/cli-options/#run
- New exec command
This command provides tooling to explicitly execute an
arbitrary command using Terragrunt (even if it's not related
to OpenTofu/Terraform). It users additional control over
exactly what Terragrunt does when it's executing a command,
and gives them additional flexibility they wouldn't have
otherwise.
You can learn more about the exec command here:
https://terragrunt.gruntwork.io/docs/reference/cli-options/#exec
- New info strict command
The new info strict command gives users a quick way to
determine which strict controls are available in the
Terragrunt CLI using the terminal.
We'll be making updates in the near future to update the
UI/UX of the command, but we've released an early version for
preview via the cli-redesign experiment flag.
* What's Changed
- fix: Fixing slug for `cli-redesign` migration guide (#3866)
- feat: `exec`, `run`, `info strict` commands implementation,
flags renaming. (#3723)
- fix: Closing gap from CLI Redesign (#3862)
* Sat Feb 08 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.72.9:
* Stacks: output (#3796)
* fix: Cleaning up docs bugs (#3856)
* feat: Adding version lookup to engine docs (#3854)
* feat: Updating TODO.md with reference to new custom domain for
site rewrite (#3853)
* feat: Adding site-wide banner to collect feedback (#3852)
* feat: Add broken link checking to Starlight docs (#3849)
* build(deps): bump ruby/setup-ruby from 1.207.0 to 1.215.0
(#3832)
* Fri Feb 07 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.72.8 (0.72.7 was not released):
* Dependencis update (#3855)
* feat: Adding Docker Compose for local dev (#3847)
* feat: Content parity with prod docs (#3844)
* feat: Add office hours banner (#3843)
* feat: Add incomplete Starlight rewrite of docs site (#3760)
* feat: Adding a `SECURITY.md` file (#3827)
* Fri Feb 07 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.72.6:
* Dependencies update (#3826)
* feat: Improve handling of ExcludeFromCopy configuration in
Terragrunt (#3816)
* Windows long path enable in CICD (#3819)
* Further document `--terragrunt-auth-provider-cmd` and redo the
contents. (#3798)
* docs: Adding OpenTofu/Terraform debugging guidance (#3813)
* docs: Adding more practical example of the exclude block
(#3812)
* No proxy build fix (#3801)
* fix: Adjusting testing for GCS bucket existence check (#3810)
* Mon Jan 27 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.72.5:
* Fix confusing error message gcp (#3756)
* Dependencies update (#3803)
* build(deps): bump github.com/zclconf/go-cty from 1.16.0 to
1.16.1 (#3790)
* build(deps): bump go.opentelemetry.io/otel from 1.33.0 to
1.34.0 (#3789)
* Thu Jan 23 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.72.4:
* Improved errors retry/ignore (#3795)
* Code spell issues fixes (#3799)
* Wed Jan 22 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.72.3:
* fix #3784 add support for using `h`,`j`,`k`,`l` in catalog
command. (#3797)
* feat: Adjusting Getting Started docs (#3788)
* build(deps): bump github.com/hashicorp/go-getter from 1.7.6 to
1.7.8 (#3786)
* build(deps): bump github.com/ProtonMail/go-crypto from 1.1.3 to
1.1.5 (#3785)
* docs: Adding testing docs for contributors (#3787)
* docs: Adding linting docs to the contribution page (#3783)
* build(deps): bump golang.org/x/oauth2 from 0.24.0 to 0.25.0
(#3754)
* build(deps): bump github.com/charmbracelet/bubbletea from 1.1.0
to 1.2.4 (#3755)
* fix: Fixing notification truncation (#3781)
* fix: Adding truncation to release announcement (#3780)
* Add stack run * documentation (#3778)
* fix: Revert accidental early removal of `--terragrunt` prefix
from log formatting (#3779)
* docs: Shuffling docs ordering with permalinks (#3777)
* Fri Jan 17 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.72.2:
* Fixed broken links on expermient pages (#3776)
* Revert "docs: Shuffling docs ordering (#3768)" (#3775)
* docs: Shuffling docs ordering (#3768)
* Update status of stacks experiment (#3774)
* fix: Addressing #3586 review feedback (#3773)
* Stacks: run (#3762)
* feat: add encryption to remote_state (#3586)
* Thu Jan 16 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.72.1:
* fix: set ExcludeFromCopy correctly (#3766)
* fix: Adjusting Discord invite link (#3761)
* fix(docs): correct typo in stacks.md (#3758)
* fix: Adjusting delay to reduce flakiness (#3748)
* Discord link update (#3747)
* Sat Jan 11 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.72.0:
* Tofu 1.9.0 support (#3746)
* fix: Adjusting docs for install (#3745)
* fix: Fixing race condition in
`TestDownloadTerraformSourceFromLocalFolderWithManifest` test
(#3744)
* Fri Jan 10 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.71.5:
* fix: Flush buffer early so that users still get streamed logs
(#3742)
* fix: Removing integrity check on hubspot script (#3739)
* Fri Jan 10 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.71.4:
* Added exclude_from_copy to config (#3543)
* Fri Jan 10 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.71.3:
* Updated stack version to point to main (#3743)
* Stacks: generate (#3627)
* Fixed discord link (#3740)
* build(deps): bump github.com/gruntwork-io/boilerplate (#3725)
* build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.32.5 to
1.32.7 (#3729)
* build(deps): bump ruby/setup-ruby from 1.204.0 to 1.207.0
(#3728)
* build(deps): bump golang.org/x/term from 0.27.0 to 0.28.0
(#3727)
* build(deps): bump github.com/zclconf/go-cty from 1.15.1 to
1.16.0 (#3726)
* fix: Fixing some broken links (#3736)
* Feat/add subscribe banner (#3731)
* Tue Jan 07 2025 opensuse_buildservice@ojkastl.de
- Update to version 0.71.2:
* fix: Use correct cache while parsing partial config (#3701)
* Update hclfmt documentation (#3702)
* Minor Code Improvements (#3718)
* Dependencies update (#3716)
* Feature flags concurrency fix (#3713)
* feat: Adding `%tf-command` log placeholder for custom format
(#3709)
* fix: Updating Discord link for website (#3697)
* fix: Rephrasing missing dependency a bit (#3695)
* Enhanced clarity of error messages for missing mock outputs
when using the dependencies block, fix #3567 (#3692)
* Sat Dec 21 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.71.1:
* feat: Adding `log-disable-error-summary` flag (#3687)
* Sat Dec 21 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.71.0:
* feat: Adding logging docs (#3688)
* fix: Split stdout and stderr streams even when using custom
logging (#3686)
* Thu Dec 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.70.4:
* fix: Fixing configurable `root` include (#3683)
* fix: Fixing `root-file-name` default (#3682)
* Thu Dec 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.70.3:
* build(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
(#3666)
* build(deps): bump
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric (#3664)
* build(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
(#3663)
* build(deps): bump go.opentelemetry.io/otel from 1.32.0 to
1.33.0 (#3662)
* build(deps): bump filippo.io/age from 1.2.0 to 1.2.1 (#3680)
* Thu Dec 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.70.2:
* fix: Adding `tf-command-args` support (#3679)
* Thu Dec 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.70.1:
* fix: Adding GitHub Enterprise support for catalog (#3678)
* Thu Dec 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.70.0:
* fix: Reintroduce symlink work behind experiment flag (#3672)
* feat: Deprecating `terragrunt.hcl` as root (#3588)
* fix: Adding redirect entries for all the pages that were
renamed (#3676)
* Lint fixes (#3670)
* Updated json formatting (#3668)
* chore: Reorganizing the features section of the docs (#3640)
* build(deps): bump google.golang.org/grpc from 1.68.0 to 1.68.1
(#3638)
* build(deps): bump ruby/setup-ruby from 1.202.0 to 1.204.0
(#3660)
* build(deps): bump github.com/stretchr/testify from 1.9.0 to
1.10.0 (#3634)
* build(deps): bump github.com/charmbracelet/lipgloss from 0.13.0
to 1.0.0 (#3635)
* build(deps): bump github.com/zclconf/go-cty from 1.14.2 to
1.15.1 (#3636)
* build(deps): bump golang.org/x/oauth2 from 0.23.0 to 0.24.0
(#3637)
* fix: `ProviderCacheWithProviderCacheDir` test (#3656)
* Sat Dec 14 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.69.13:
* Don't require HOME if TERRAGRUNT_PROVIDER_CACHE_DIR is set
(#3649)
* Add redirect for unused contact page. (#3653)
* feat: Incorporating user feedback on the Getting Started guide
(#3648)
* Fri Dec 13 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.69.12:
* fix #3169 allow `endpoints.s3` in `remote_state` block. (#3643)
* Fri Dec 13 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.69.11:
* build(deps): bump golang.org/x/crypto from 0.28.0 to 0.31.0
(#3650)
* Add missed close parenthesis (#3651)
* chore: Adding signature verification docs (#3647)
* Wed Dec 11 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.69.10:
* fix: TF output log level (#3646)
* feat: Add Discord logo (#3641)
* chore: Reorganize Getting Started Guide (#3632)
* fix: Deprecating legacy exclude and error configurations
(#3625)
* Sun Dec 08 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.69.9:
* zip archive extraction (#3630)
* build(deps): bump github.com/charmbracelet/bubbles from 0.16.1
to 0.20.0 (#3612)
* build(deps): bump github.com/creack/pty from 1.1.17 to 1.1.24
(#3613)
* Fri Dec 06 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.69.8:
* Improve negative error pattern handling (#3621)
* fix: Fixing some broken links in the docs (#3623)
* Thu Dec 05 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.69.7:
* add new built-in function get_aws_account_aliases(), fix #2483
(#3607)
* Wed Dec 04 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.69.6:
* Errors block (#3584)
* Wed Dec 04 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.69.5 (0.69.4 was not released):
* fix: Fixing concurrent access to read files map (#3615)
* build(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
(#3595)
* build(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
(#3597)
* build(deps): bump github.com/ProtonMail/go-crypto (#3598)
* add `--terragrunt-hclfmt-exclude-dir` parameter `hclfmt`
command. fix #3391 (#3609)
* Fri Nov 29 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.69.3:
* fix: `error_hook` processing (#3608)
* Fri Nov 29 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.69.2:
* fix: Wrap TF stdout and stderr in JSON (#3602)
* wrong environment name on document (#3600)
* build(deps): bump github.com/aws/aws-sdk-go-v2 from 1.30.3 to
1.32.5 (#3594)
* build(deps): bump cloud.google.com/go/storage from 1.46.0 to
1.47.0 (#3593)
* Tue Nov 26 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.69.1:
* feat: Adding test for slash in source name (#3591)
* fix: Adjusting `run-all` docs (#3589)
* feat: `-detailed-exitcode` with `run-all` commands (#3585)
* Wed Nov 20 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.69.0:
* chore: Pin tflint to `v0.50.3` (#3569)
* Wed Nov 20 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.17:
* feat: support discovery of symlinked modules (#3562)
* feat: Improving the quick start experience (#3568)
* fix: Adjusting docs for `feature` and `exclude` (#3581)
* Wed Nov 20 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.16:
* Add handling of empty feature blocks (#3580)
* fix: Fix spelling of `RenderJSONithMetadata` as
`RenderJSONWithMetadata` (#3579)
* Exclude block (#3551)
* Tue Nov 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.15:
* Custom Log Formatting (#3537)
* build(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
(#3576)
* build(deps): bump github.com/hashicorp/terraform-svchost
(#3577)
* build(deps): bump github.com/hashicorp/hcl/v2 from 2.22.0 to
2.23.0 (#3575)
* build(deps): bump google.golang.org/grpc from 1.67.1 to 1.68.0
(#3574)
* build(deps): bump github.com/hashicorp/go-plugin from 1.6.1 to
1.6.2 (#3573)
* Tue Nov 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.14:
* feat: Adding Terminology docs (#3559)
* feat: Integrate includes into units reading (#3563)
* chore: Cleaning up OIDC Work (#3554)
* Thu Nov 14 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.13:
* feat: Adding units-reading (#3550)
* feat: Adding Discord Markdown badge (#3539)
* docs: Adding documentation for release process (#3487)
* fix: Refactoring out helpers (#3465)
* fix: Re-introducing `--terragrunt-hclfmt-file` docs (#3552)
* Wed Nov 13 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.12 (0.68.11 does not exist):
* Allow hcl format from stdin (#3288)
* build(deps): bump
go.opentelemetry.io/otel/exporters/stdout/stdouttrace (#3546)
* build(deps): bump
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric (#3548)
* build(deps): bump golang.org/x/term from 0.25.0 to 0.26.0
(#3547)
* build(deps): bump github.com/hashicorp/go-getter/v2 from 2.2.1
to 2.2.3 (#3545)
* build(deps): bump ruby/setup-ruby from 1.199.0 to 1.202.0
(#3549)
* Tue Nov 12 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.10:
* Improved errors handling for HCL functions (#3544)
* Update config doc to fix terragrunt-diff typo (#3515)
* build(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc
(#3501)
* build(deps): bump github.com/charmbracelet/glamour from 0.6.0
to 0.8.0 (#3493)
* Tue Nov 12 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.9:
* Feature flags parsing (#3513)
* docs(cli-options): add a warning message about non-functionnal
glob curly braces expansion for TERRAGRUNT_INCLUDE_DIR and
TERRAGRUNT_EXCLUDE_DIR env variables (#3516)
* build(deps): bump
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc
from 1.23.0 to 1.31.0 (#3503)
* build(deps-dev): bump rexml from 3.3.6 to 3.3.9 in /docs
(#3522)
* Tue Nov 12 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.8:
* Implement terragrunt-dont-check-dependent-modules flag (#3534)
* build(deps): bump cloud.google.com/go/storage from 1.44.0 to
1.46.0 (#3530)
* build(deps): bump ruby/setup-ruby from 1.196.0 to 1.199.0
(#3531)
* Fri Nov 01 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.7:
* Add provider cache offline errors handling (#3527)
* Tue Oct 29 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.6:
* Updated --terragrunt-out-dir / --terragrunt-json-out-dir to
handle relative paths.
- Update to version 0.68.5:
* Added strict flag for improved performance in dependency
processing
* You can now enhance performance by setting the environment
variable:
TERRAGRUNT_STRICT_CONTROL="skip-dependencies-inputs"
This will skip input processing for dependencies, leading to
faster execution times when running Terragrunt.
* Improved CI/CD pipeline to build without Go proxy and detect
checksum changes.
* Enhanced error messages for invalid strict control flags.
* Updated dependencies for better performance and stability.
* Refined scaffold documentation.
* Fixed panic issue in Sops decryption.
* Corrected handling of pseudo-tty commands.
* Thu Oct 17 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.4:
* chore: Updating deps (#3480)
* CICD updates (#3467)
* feat: Upgrading `go-getter` to v2 in scaffold (#3455)
* Wed Oct 16 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.3:
* feat: Adding Strict Package (#3424)
* Wed Oct 16 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.2:
* Fixing modules output corruption (#3459)
* Redirect engine messages to stderr (#3468)
* Fri Oct 11 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.1:
* fix: Removing non non-interactive logic in err stream redirect
(#3464)
* Fri Oct 11 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.68.0:
* Suppressing `423` error in Terragrunt Provider Cache (#3453)
* Fix concurrent map write due to read lock and delete (#3457)
* fix(init): do not require re-init after explicit init on clean
directory (#2949)
* feat: support merging the "skip" attribute from included files.
(#3225)
* build(deps): bump webrick from 1.8.1 to 1.8.2 in /docs (#3436)
* Sun Oct 06 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.16:
* Handling of redirected input (#3451)
* Wed Oct 02 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.15:
* Engine log level propagation (#3443)
* Fri Sep 27 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.14:
* fix: Use env vars for `sops_decrypt_file` (#3439)
* Fri Sep 27 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.13:
* CVE fixes and dependencies update (#3435)
* Fri Sep 27 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.12:
* Fixing registry host discovery (Terragrunt Provider Cache)
(#3432)
* Fixing converting absolute paths to relative in logs (#3433)
* Wed Sep 25 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.11:
* feat: introducing "copy_terraform_lock_file" to fine tune Lock
File Handling (#2889)
* Sat Sep 21 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.10:
* Improved errors printing in case of terraform/tofu invocation
(#3423)
* feat: Adding release announcement workflow (#3419)
* Sat Sep 21 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.9:
* fix: update repository for catalog command (#3415)
* feat: Adding issue templates (#3416)
* feat: Adding `codespell` to Automatically Check Spelling
(#3413)
* Sat Sep 21 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.8:
* User-friendly error for invalid envs/flags (#3414)
* Sat Sep 21 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.7:
* Downloading of latest engine (#3412)
* feat: Adding `stylecheck` lint (#3354)
* Sat Sep 21 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.6:
* Fixing output STDOUT logs to `stdout` (#3409)
* Allow pre-release versions to pass version constraints (#3405)
* Sat Sep 14 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.5:
* Fix various logging issues. Log package refactoring. (#3400)
* feat: Adding `preserved` label exemption to stale check (#3392)
* Fixed scafold tests (#3396)
* Fri Sep 13 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.4:
* Added handling of TERRAGRUNT_TEMP_QUOTE_NULL (#3395)
* Updated download test to fetch changes from main (#3386)
* TG-251 Test fixtures organisation (#3380)
* Fri Sep 13 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.3:
* fix: Reverting changes in #3383 (#3385)
* Fri Sep 13 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.2:
* 3364 - Update Remote State Encryption When Configurations Are
Updated (#3383)
* Migration from master to main (#3379)
* build(deps-dev): bump rexml from 3.3.3 to 3.3.6 in /docs (#3359)
* Tests simplification (#3365)
* Fri Sep 13 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.1:
* Dependencies upgrade (#3374)
* Fri Sep 13 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.67.0:
* Log improvements (#3338)
* Locals doc: Fix/improve 'Reading from other HCL files' (#3361)
* feat: Adding `thelpher` and `wastedassign` lints (#3352)
* feat: Split out unessential jobs (#3357)
* feat: Adding strict lint (#3348)
* Engine documentation update (#3355)
* feat: Adding `wsl` lint (#3351)
* Tue Aug 20 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.66.9:
* fix: make `terragrunt-fetch-dependency-output-from-state` to
work with not applied dependencies (#3350)
* Fri Aug 16 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.66.8:
* chore: Bumping go to `1.22` (#3346)
* Fri Aug 16 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.66.7:
* fix: Fixing remote state init skip (#3345)
* Adding `test` Lint Presets (#3340)
* Updated documentation for --terragrunt-graph-root (#3344)
* fix: Reverting to asserts for non error checking assertions
(#3341)
* Wed Aug 14 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.66.6:
* Engine output handling (#3339)
* Tue Aug 13 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.66.5:
* chore: Adding `performance` Lint Preset (#3336)
* chore: Adding `bugs` Lint Preset (#3334)
* Mon Aug 12 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.66.4:
* chore: Bumping `golangci-lint` to `v1.59.1` (#3333)
* Fix CICD tests for mocks (#3335)
* chore: Hiding Mocks Tests (#3331)
* fix: Fixing stale action (#3332)
* fix: Fixing command not found error (#3330)
* Add configuration options for AWS S3 server access logging
(#3006)
* feat: Add stale issue workflow (#3329)
* Wed Aug 07 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.66.3:
* Terragrunt performance improvements (#3307)
* Wed Aug 07 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.66.2:
* feat: Adding `TG_CTX_TF_PATH` to hook context (#3323)
* build(deps-dev): bump rexml from 3.3.1 to 3.3.3 in /docs
(#3316)
* build(deps-dev): bump nokogiri from 1.16.3 to 1.16.5 in /docs
(#3135)
* add env TERRAGRUNT_EXCLUDE_DIR to docs (#3320)
* fix: Reference OpenTofu Everywhere We Can (#3319)
* Sat Aug 03 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.66.1:
* Adding resolving relative urls to Terragrunt Provider Cache
(#3318)
* Fixing interpreting empty list as null value (#3317)
* Fri Aug 02 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.66.0:
* chore: Bumping OpenTofu to `v1.8.0` (#3315)
* Fri Aug 02 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.65.0:
* `sops_decrypt_file()`: resolve path argument relative to
`terragrunt.hcl` (#2752)
* chore: Bumping `gruntwork-io/pre-commit` to `v0.1.23` (#3311)
* Thu Aug 01 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.64.5:
* Sorting output and fixing minor bugs in `hclvalidate` command
(#3309)
* fix: Adjusting docs for engines (#3306)
* Thu Aug 01 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.64.4:
* Fixing "dependency cycle between modules" when using
`hclvalidate` command with undefined `config_path` attribute
(#3305)
* Thu Aug 01 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.64.3:
* Engine verification (#3300)
* Tue Jul 30 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.64.2:
* Adding supply credentials for a third-party registry when using
Terragrunt Provider Cache (#3303)
* Sat Jul 27 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.64.1:
* Adding registry url discovery for Terragrunt Provider Cache
(#3299)
* Thu Jul 25 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.64.0:
* Upgrade to Sops 3.9.0 (#3297)
* Thu Jul 25 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.63.8:
* fix: Fixing dynamic auth for deps (#3293)
* Thu Jul 25 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.63.7:
* Open Telemetry update (#3291)
* Thu Jul 25 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.63.6:
* Fixing generation of `provider_installation` block used for
provider caching (#3290)
* Wed Jul 24 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.63.5:
* Add support for engine downloading (#3281)
* Wed Jul 24 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.63.4:
* 3274 - fix: Include nothing when value for
`terragrunt-include-dir` doesn't exist on the filesystem
(#3286)
* Tue Jul 23 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.63.3:
* Fixing generation of `provider_installation` block used for
provider caching (#3280)
* Updated links to provider caching (#3282)
* Fri Jul 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.63.2:
* fix: getting dynamic credentials before parsing locals block
(#3279)
* Thu Jul 18 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.63.1:
* chore: add log before executing external command (#3276)
* Thu Jul 18 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.63.0:
* fix: Reducing the number of Rs in
`TERRRAGRUNT_IAM_ASSUME_ROLE_WEB_IDENTITY_TOKEN` (#3272)
* Wed Jul 17 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.62.3:
* Add handling of multi line variables description (#3269)
* Tue Jul 16 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.62.2:
* fix: diags error when parse remote_state (#3268)
* Tue Jul 16 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.62.1:
* Dependencies update (#3266)
* Fri Jul 12 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.62.0:
* IaC engine support (#3218)
* Fri Jul 12 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.61.1:
* Added passing of extra ENVs to the hook executed command
(#3263)
* feat: Adding more documentation on validation (#3262)
* fix: Fixing Pages Build (#3260)
* feat: Adding pages GHA build (#3259)
* Thu Jul 11 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.61.0:
* Added `hclvalidate` command (#3248)
* Added `--terragrunt-excludes-file` flag (#3255)
* fix: Adjusting CODEOWNERS file so that all are recognized as
codeowners, instead of only the last entry (#3251)
* Wed Jul 10 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.60.1:
* Concurrent access write fixes (#3245)
* Wed Jul 10 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.60.0:
* Add support for Terraform 1.9 (#3239)
* Wed Jul 10 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.59.7:
* Fixed using authentication provider credentials with
`get_aws_account_id` (#3243)
* chore: Updating `CODEOWNERS` to include current Terragrunt
maintainers (#3233)
* fix: Fixing quick start docs (#3232)
* chore: switch to gtm for docs site (#3229)
* Wed Jul 03 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.59.6:
* build(deps): bump github.com/hashicorp/go-retryablehttp (#3226)
* build(deps): bump github.com/hashicorp/go-getter from 1.7.4 to
1.7.5 (#3227)
* Add script to check GH release assets (#3223)
* Fri Jun 21 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.59.5:
* Fixed using dynamic AWS credentials for `remote_state` (#3219)
* fix: Adjusting language for `--terragrunt-non-interactive` in
the docs so that it's clearer what it does for users (#3216)
* feat: Adding more context on why caching partial parsing of
configs can be useful (#3214)
* Updated resource class to avoid killing build process (#3213)
* fix: Fixing cookie policy link (#3212)
* Mon Jun 17 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.59.4:
* Fixed fetching compressed data from a network mirror server
(#3208)
* Remove TERRAGRUNT_PROVIDER_CACHE_DISABLE_PARTIAL_LOCK_FILE
reference (#3206)
* Thu Jun 13 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.59.3:
* Add support for AssumeRoleWithWebIdentity (#2997)
* Thu Jun 13 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.59.2:
* build(deps): bump
github.com/Azure/azure-sdk-for-go/sdk/azidentity (#3199)
* chore: Updating copy on README.md (#3200)
* Wed Jun 12 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.59.1:
* feat: Adding caching for role assumptions (#3197)
* feat: Adding initialization check caching (#3193)
* chore: Updating mac release machine to `macos.m1.medium.gen1`
(#3186)
* Wed Jun 12 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.59.0:
* feat: Moving `cache` to `internal` (#3192)
* feat: dynamic authentication (#3194)
* Mon Jun 10 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.15:
* feat: log verbose improvements (#3189)
* Tue Jun 04 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.14:
* Terragrunt Provider Cache with `providers lock` command (#3176)
* Sat Jun 01 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.13:
* Improved errors printing returned from Sops (#3174)
* fix: Correcting docs on default binary used by Terragrunt
(#3173)
* s/trragrunt/terragrunt/ (#3170)
* feat: Adding binary signing test (#3166)
* Thu May 30 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.12:
* fix: init command on every run (#3167)
* Thu May 30 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.11:
* fix: Revert resource class update (#3164)
* chore: Bumping CircleCI configs (#3160)
* Fixed flaky test `TestTerragruntProviderCache` (#3161)
* Fri May 24 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.10:
* Fixed ignoring `TERRAGRUNT_DOWNLOAD` for dependent modules
(#3158)
* fix: Fixing `TestTerraformHelp` (#3154)
* fix: Fixing some malformed cli-options in docs (#3152)
* fix: get rid of testdata archives (#3155)
* Wed May 22 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.9:
* Improved logging for S3 bucket encryption (#3147)
* Fixed subcommand actions wrapping (#3144)
* Cleaning up docs (#3149)
* feat: Improving `locals` documentation (#3148)
* Tue May 21 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.8:
* fix: s3 source handling (#3146)
* Sun May 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.7:
* Support all `provider_installation` methods with provider cache
(#3133)
* Sat May 18 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.6:
* fix: terraform source url handling (#3142)
* Sat May 18 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.5:
* Docs and tests fixes (#3136)
* Sat May 11 2024 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- add Makefile and PACKAGING_README.md, remove services from
`_service`. Upstream changes break the go module vendoring, so we
can no longer use the go_modules service
* Fri May 10 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.4:
* Updated makefile to generate mocks before build (#3126)
* Usage of locks when copy metadata fields (#3124)
* Wed May 08 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.3:
* Added Terraform lock file generation with provider caching (#3108)
* Fri May 03 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.2:
* Fixed handling of module prefixes (#3104)
* Bump CI image (#3116)
* Get rid of third party code (#3114)
* Thu May 02 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.1:
* Added `if_disabled` attribute for `generate` block (#3110)
* Thu May 02 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.58.0:
* OpenTofu 1.7 (#3111)
* LIB-75: Replace tfenv and tgswitch with mise (#3094)
* Mon Apr 29 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.13:
* fix(provider_cache): Use more permissive regex search for
Status Locked (#3105)
* fix: unit test (#3106)
* Sat Apr 27 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.12:
* Use OpenTofu by default if available in environment (#3097)
* Fri Apr 26 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.11:
* fix: sync Terraform CLI args for 'show' command (#3075)
* Fri Apr 26 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.10:
* Open Telemetry context propagation (#3098)
* feat: Adding RFC Form (#3099)
* Wed Apr 24 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.9:
* Check hash and signature of cached providers (#3055)
* fix: copyright text (#3091)
* Tue Apr 23 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.8:
* Add support for JSON directory output (#3084)
* Tue Apr 23 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.7:
* Bump github.com/hashicorp/go-getter to 1.7.4 (#3088)
* Tue Apr 23 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.6:
* Get rid of code under BUSL license (#3085)
* Moved destroy operation to separated section (#3074)
* Fri Apr 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.5:
* build(deps): bump golang.org/x/net from 0.19.0 to 0.23.0
(#3072)
* Fri Apr 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.4:
* Add support for saving output plan (#3073)
* Fri Apr 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.3:
* Fixes getting output from multiple nested dependencies (#3071)
* Wed Apr 17 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.2:
* Fixed handling of dependency outputs when json log format is
enabled (#3049)
* Fixed 'inputs' typo in docs (#3061)
* Mon Apr 15 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.1:
* Fixes module requests routing with provider caching (#3057)
* Improved test for checking aws errors (#3058)
* Updated terragrunt command execution in parallel tests (#3054)
* Sat Apr 13 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.57.0:
* Support for Terraform 1.8 (#3052)
* docs: update terragrunt supported versions table (#3038)
* Thu Apr 11 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.56.5:
* Fixes destroy order for `apply -destroy` alias (#3011)
* build(deps): bump github.com/docker/docker (#3046)
* install.md: add for Gentoo, link to Repology (#3044)
* Wed Apr 10 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.56.4:
* Caching Terraform providers (#3001)
* chore: fix function names in comment (#3042)
* Fix TestTerragruntParallelism (#3045)
* Flaky tests fixes (#3041)
* Mon Apr 08 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.56.3:
* Fixes slow destroy of config deeply nested in config hierarchy
(#3015)
* Fri Apr 05 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.56.2:
* Conditionally set log level of s3 bucket encryption warning
(#2878)
* Add flag for disabling dependent modules identification in
json-render (#2918)
* Fri Apr 05 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.56.1:
* terragrunt-info parsing improvement (#2901)
* Fri Apr 05 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.56.0:
* Add step to test terragrunt with latest terraform version
(#3035)
* Downgrading latest officially supported version of Terraform to
1.5.x (#2936)
* Wed Apr 03 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.21:
* Remote state errors improvement (#3032)
* Tue Mar 26 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.20:
* fix: regexp (#3027)
* terragrunt issue 3017: expand docs for find_in_parent_folder()
(#3018)
* Sat Mar 23 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.19:
* MacOS binary signer update (#3023)
* Updated module ci version (#3021)
* Updated sign binaries parameters for MacOS (#3020)
* Updated gon version to v0.2.5 (#3019)
* Scaffold command, fix unable to handle https URL (#3005)
* Fix grammar in feature text (#3010)
* Tue Mar 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.18:
* build(deps-dev): bump nokogiri and mini_portile2 in /docs
(#3009)
* build(deps): bump google.golang.org/protobuf from 1.32.0 to
1.33.0 (#3000)
* build(deps-dev): bump nokogiri from 1.10.4 to 1.10.10 in /docs
(#2929)
* build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.0 to
3.0.3 (#2996)
* build(deps): bump github.com/cloudflare/circl from 1.3.3 to
1.3.7 (#2995)
* Tue Mar 19 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.17:
* Add support for opentofu registry (#2961)
* Sun Mar 17 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.16:
* Terragrunt performance improvements (#2983)
* Sun Mar 17 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.15:
* Catalog TUI Improvements (#2993)
* Sun Mar 17 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.14:
* Upgrade sops to v3.8.1 (#2991)
* Include "modules" path in the module url used in docs for
scaffold command (#2985)
* Sun Mar 17 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.13:
* MacOS catalog terminal reset (#2984)
* Sun Mar 17 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.12:
* Scaffold execution in Windows (#2982)
* Sun Mar 17 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.11:
* Catalog screen freeze on MacOS (#2978)
* Sun Mar 17 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.10:
* Catalog terminal freeze (#2962)
* Sat Feb 24 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.9:
* Fix data race accessing shared slice from goroutines in
dependency computation. (#2942)
* Recommending pre-release as a way to mitigate the risk of
failed releases (#2964)
* Test for tracking that no errors are printed in HCL files
parsing (#2947)
* Sat Feb 24 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.8:
* Fixing typo in the log message when using catalog (#2960)
* Sat Feb 24 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.7:
* Update go version to 1.21.7 to fix CVEs (#2951)
- BuildRequire go1.21.7 or higher
* Sat Feb 24 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.6:
* Fix nested dependency parsing (#2957)
* Sat Feb 24 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.5:
* Add support for OpenTelemetry (#2921)
* Tue Feb 20 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.4:
* Reference to dependency inputs (#2945)
* Tue Feb 20 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.3:
* Improved identification of remote state changes (#2939)
* Wed Feb 14 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.2:
* Improved handling of disabled modules (#2938)
* Tue Feb 06 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.1:
* build(deps): bump github.com/opencontainers/runc from 1.1.9 to
1.1.12 (#2924)
* Fri Feb 02 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.55.0:
* Add graph command to terragrunt (#2871)
* Fri Jan 26 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.54.22:
* Updated AWS SDK to 1.50.0 (#2906)
* Tue Jan 23 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.54.21:
* Enhanced Missing Executable Error Messages for Terraform & Tofu
(#2905)
* Sat Jan 20 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.54.20:
* Add support for JSON output format (#2863)
* Thu Jan 18 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.54.19:
* Improved parsing of empty tfvars files (#2896)
* Wed Jan 17 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.54.18:
* Fix cloning repos for the catalog command. (#2888)
* Mon Jan 15 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.54.17:
* Fixed identification of terragrunt cache dir (#2874)
* Updated CICD to use release version of OpenTofu 1.6.0 (#2887)
* Mon Jan 15 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.54.16:
* Fix reading `catalog` configuration (#2884)
* Mon Jan 15 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.54.15:
* Manifest file removal in Windows (#2875)
* Mon Jan 15 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.54.14:
* Add handling for missing policy bucket (#2881)
* Mon Jan 15 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.54.13:
* AWS SDK version upgrade (#2883)
* Thu Jan 04 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.54.12:
* Fix built-in `find_in_parent_folders` func (#2869)
* Usage of tofu 1.6.0-rc1 in tests (#2790)
* Thu Jan 04 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.54.11:
* build(deps): bump golang.org/x/crypto from 0.14.0 to 0.17.0
(#2858)
* Thu Jan 04 2024 opensuse_buildservice@ojkastl.de
- Update to version 0.54.10:
* fix: findInParentFolders func (#2866)
* Thu Dec 21 2023 opensuse_buildservice@ojkastl.de
- Update to version 0.54.9:
* Fix catalog configuration file search. (#2862)
* Wed Dec 20 2023 opensuse_buildservice@ojkastl.de
- Update to version 0.54.8:
* Speed up repo cloning for the `catalog` command (#2857)
* Tue Dec 19 2023 opensuse_buildservice@ojkastl.de
- Update to version 0.54.7:
* feat: update the log level from debug to info (#2820)
* Tue Dec 19 2023 opensuse_buildservice@ojkastl.de
- Update to version 0.54.6:
* Fixed passing assume_role generation (#2853)
* Sat Dec 16 2023 kastl@b1-systems.de
- Update to version 0.54.5:
* Read the list of repositories for the `catalog` command from
* the terragrunt configuration file (#2852)
* Fri Dec 15 2023 kastl@b1-systems.de
- Update to version 0.54.4:
* Non interactive state initialization (#2840)
* Thu Dec 14 2023 kastl@b1-systems.de
- Update to version 0.54.3:
* Catalog handling https urls (#2850)
* Wed Dec 13 2023 kastl@b1-systems.de
- Update to version 0.54.2:
* Parse frontmatter data in the `catalog` command (#2843)
* Mon Dec 11 2023 kastl@b1-systems.de
- Update to version 0.54.1:
* Fixed passing of module URL from catalog to scaffold (#2842)
* scaffold blank spaces fix (#2839)
* Scaffold and catalog documentation fixes (#2838)
* Sat Dec 09 2023 kastl@b1-systems.de
- Update to version 0.54.0:
* Initial catalog implementation (#2815)
* Fixed scaffold docs (#2829)
* Terragrunt scaffold (#2821)
* Update regex for version check (#2817)
* Tue Nov 28 2023 kastl@b1-systems.de
- Update to version 0.53.8:
* Add handling of backend configs (#2810)
* Mon Nov 27 2023 kastl@b1-systems.de
- Update to version 0.53.7:
* Updated jw v4 dependency version (#2805)
* Thu Nov 23 2023 kastl@b1-systems.de
- Update to version 0.53.6:
* feat: Support assume_role in s3 backend config. Starting with
TF1.6 (#2800)
* Update Arch Linux package URL in install.md (#2802)
* Tue Nov 21 2023 kastl@b1-systems.de
- Update to version 0.53.5:
* Reverted function name, added test to track usage of function
(#2801)
* feat: disallow undefined flags (#2799)
* Fri Nov 17 2023 kastl@b1-systems.de
- Update to version 0.53.4:
* Add a new built-in function `get_working_dir()` (#2791)
* Fix TestErrorExplaining (#2793)
* Add shell completion (#2788)
* Thu Nov 16 2023 kastl@b1-systems.de
- Update to version 0.53.3:
* Improved explanation of missing aws creds (#2787)
* Update usage of private repo docs (#2784)
* Add missing terraform commands (#2780)
* Mon Nov 06 2023 kastl@b1-systems.de
- Update to version 0.53.2:
* GCP dependencies update (#2775)
* Thu Nov 02 2023 kastl@b1-systems.de
- Update to version 0.53.1:
* Update aws-sdk to support SSO (#2774)
* Add Default Retryable Error List to Docs (#2771)
* test: use `T.Setenv` to set env vars in tests (#2205)
* Mon Oct 30 2023 kastl@b1-systems.de
- Update to version 0.53.0:
* Terraform 1.6 (#2754)
* Fri Oct 27 2023 kastl@b1-systems.de
- Update to version 0.52.7:
* Bump google.golang.org/grpc from 1.55.0 to 1.56.3 (#2767)
* Fri Oct 27 2023 kastl@b1-systems.de
- Update to version 0.52.6:
* fix!: output-module-groups to work like run-all (#2769)
* Update tofu version to 1.6.0-alpha3 (#2766)
* Wed Oct 25 2023 kastl@b1-systems.de
- Update to version 0.52.5:
* feat: add read_tfvars_file function (#2757)
* Sat Oct 21 2023 kastl@b1-systems.de
- Update to version 0.52.4:
* Add linting of source code (#2743)
* Sat Oct 14 2023 kastl@b1-systems.de
- Update to version 0.52.3:
* Bump golang.org/x/net from 0.15.0 to 0.17.0 (#2755)
* Fri Oct 13 2023 kastl@b1-systems.de
- Update to version 0.52.2:
* Add option to skip S3 credentials validation (#2753)
* Sun Oct 08 2023 kastl@b1-systems.de
- Update to version 0.52.1:
* Dependent modules scanning improvements (#2749)
* Add opentofu notice (#2738)
* Fri Oct 06 2023 kastl@b1-systems.de
- Update to version 0.52.0:
* Add OpenTofu support (#2745)
* Thu Oct 05 2023 kastl@b1-systems.de
- Update to version 0.51.9:
* Update render-json to include list of dependent modules (#2740)
* refactor: fix usage of deprecated calls to io/ioutil package
(#2742)
* Wed Oct 04 2023 kastl@b1-systems.de
- Update to version 0.51.8:
* Add check for aws session before checking S3 bucket (#2739)
* docs: removes two errors in the markdown (#2741)
* Fri Sep 29 2023 kastl@b1-systems.de
- Update to version 0.51.7:
* State file handling improvements (#2735)
* Thu Sep 28 2023 kastl@b1-systems.de
- Update to version 0.51.6:
* Updated dependencies to fix security issues (#2733)
* Wed Sep 27 2023 kastl@b1-systems.de
- Update to version 0.51.5:
* #2280 Add validation of generate blocks from includes (#2281)
* Thu Sep 21 2023 kastl@b1-systems.de
- Update to version 0.51.4:
* fix: make `auto-init` respect `-no-color` flag (#2722)
* Add built-in function `get_default_retryable_errors` (#2725)
* Wed Sep 20 2023 kastl@b1-systems.de
- Update to version 0.51.3:
* Add debug log message to print chdir option (#2724)
* Wed Sep 20 2023 kastl@b1-systems.de
- Update to version 0.51.2:
* S3 bucket errors handling (#2721)
* Tue Sep 19 2023 kastl@b1-systems.de
- Update to version 0.51.1:
* Removes trailing slash appended to the end of
`get_path_to_repo_root()` (#2719)
* Mon Sep 18 2023 kastl@b1-systems.de
- Update to version 0.51.0:
* Updated to go 1.21 (#2715)
* Fri Sep 15 2023 kastl@b1-systems.de
- Update to version 0.50.17:
* Add enabled property for dependency (#2712)
* Wed Sep 13 2023 kastl@b1-systems.de
- Update to version 0.50.16:
* Improved checking of windows console errors (#2711)
* Wed Sep 13 2023 kastl@b1-systems.de
- Update to version 0.50.15:
* Fixed searching for configs with non-default names #2704.
(#2704)
* Updating link to before-and-after-hooks (#2708)
* Thu Sep 07 2023 kastl@b1-systems.de
- Update to version 0.50.14:
* Terragrunt version in AWS API Calls (#2701)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.13:
* Module path checking improvements (#2700)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.12:
* Updated setting of fetch depednency flag (#2699)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.11:
* feat: disable terraform command validation (#2697)
* Prevent `init` command from parallel running if plugin cache is
used (#2698)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.10:
* GCS remote state configuration prefix (#2695)
* Move shared libraries to go-commons repository (#2688)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.9:
* Improved handling of errors from AWS API (#2684)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.8:
* TFLint configuration loading from hook parameters (#2683)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.7:
* fix: terraform console command in non-interactive mode (#2686)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.6:
* Google Cloud impersonate fixes (#2679)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.5:
* Add terraform command validation (#2676)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.4:
* Null vars file cleanup (#2672)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.3:
* Logrus dependency update (#2665)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.2:
* fix: "null" values in json for aws policy (#2667)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.1:
* Prevent parsing of excluded modules (#2664)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.50.0:
* Pass null values in Terraform inputs (#2663)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.49.1:
* Update CircleCI config to sign MacOS binaries (#2661)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.49.0:
* TFLint variables and arguments (#2645)
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 0.48.7:
* Refactoring cli related code (#2608)
* Thu Aug 03 2023 kastl@b1-systems.de
- Update to version 0.48.6:
* Simplified run-all confirmation dialog (#2653)
* Tue Aug 01 2023 kastl@b1-systems.de
- Update to version 0.48.5:
* Add a "output-module-groups" command (#2130)
* Updated CLI flag wording (#2647)
* Bump tzinfo from 1.2.7 to 1.2.10 in /docs (#2207)
* Bump nokogiri from 1.13.6 to 1.14.3 in /docs (#2526)
* Thu Jul 20 2023 kastl@b1-systems.de
- Update to version 0.48.4:
* Add CLI flags to set handling state buckets (#2644)
* Tue Jul 18 2023 kastl@b1-systems.de
- Update to version 0.48.3:
* Added handling of no outputs in render-json execution (#2635)
* Tue Jul 18 2023 kastl@b1-systems.de
- Update to version 0.48.2:
* fix: include missing param in parsing cache key construction
(#2518)
* [skip ci] Removing former Grunts (#2640)
* Update scripts.html (#2638)
* Thu Jul 06 2023 kastl@b1-systems.de
- Update to version 0.48.1:
* Updated source version identification (#2630)
* Update documentation to reference Terragrunt Github action
(#2628)
* [skip ci] git-xargs programmatic commit (#2623)
* Tue Jun 27 2023 kastl@b1-systems.de
- Update to version 0.48.0:
* Add support for Terraform 1.5 (#2616)
* Circleci resource_class update (#2609)
* Fri Jun 16 2023 kastl@b1-systems.de
- Update to version 0.47.0:
* Go upgrade to 1.20 (#2605)
- BuildRequire go1.20
* Mon Jun 12 2023 kastl@b1-systems.de
- Update to version 0.46.3:
* #2595 Fix for fetching reference value with slashes (#2597)
* Mon Jun 12 2023 kastl@b1-systems.de
- Update to version 0.46.2:
* feat: support git tag in `--terragrunt-source-map` option
(#2586)
* Fri Jun 02 2023 kastl@b1-systems.de
- Update to version 0.46.1:
* Fixed reading of outputs during destroy (#2589)
* Fri Jun 02 2023 kastl@b1-systems.de
- Update to version 0.46.0:
* fix: redirecting stdout to stderr in hook commands (#2587)
* Wed May 31 2023 kastl@b1-systems.de
- Update to version 0.45.18:
* feat: implement hclfmt diff output (#2570)
* Wed May 31 2023 kastl@b1-systems.de
- Update to version 0.45.17:
* fix: checking dependent modules in `destroy` command (#2581)
* Thu May 25 2023 kastl@b1-systems.de
- Update to version 0.45.16:
* Add support for Disable field in generate blocks (#2497)
* Mon May 22 2023 kastl@b1-systems.de
- Update to version 0.45.15:
* Simplified source code locking/unlocking (#2576)
* Fri May 19 2023 kastl@b1-systems.de
- Update to version 0.45.14:
* #2566 Update error message to include module directory (#2574)
* Wed May 17 2023 kastl@b1-systems.de
- Update to version 0.45.13:
* feat: add `timecmp` config function (#2571)
* Wed May 17 2023 kastl@b1-systems.de
- Update to version 0.45.12:
* Handle provider lock file when fetching dependency outputs
(#2568)
* Update aws-auth.md (#2563)
* Add missing IAM Permissions s3:PutBucketOwnershipControls to
docs this is required now with TG versions starting from
v0.45.4 (#2562)
* Thu May 11 2023 kastl@b1-systems.de
- Update to version 0.45.11:
* fix: disable sending a second interrupt signal to `terraform`
(#2559)
* Tue May 09 2023 kastl@b1-systems.de
- Update to version 0.45.10:
* fix: avoid double-rendering `terraform init` output (#2558)
* Fri May 05 2023 kastl@b1-systems.de
- Update to version 0.45.9:
* Fix parsing output when AWS CSM is enabled (#2554)
* Moved issue template files to ISSUE_TEMPLATE directory (#2555)
* Add issues templates (#2553)
* Tue May 02 2023 kastl@b1-systems.de
- Update to version 0.45.8:
* Lazily evaluate the IAM Role (#2507)
* Tue May 02 2023 kastl@b1-systems.de
- Update to version 0.45.7:
* Mozilla sops upgrade to v3.7.3 (#2549)
* Sun Apr 30 2023 kastl@b1-systems.de
- Update to version 0.45.6:
* JSON output prefix update (#2548)
* Fri Apr 28 2023 kastl@b1-systems.de
- Update to version 0.45.5:
* Add explanation for terraform errors (#2547)
* Thu Apr 20 2023 kastl@b1-systems.de
- Update to version 0.45.4:
* Update S3 bucket creation to pass ObjectOwnership (#2540)
* ~ aws-auth docs - iam remove object level actions from the
bucket resource (#2533)
* Tue Apr 18 2023 kastl@b1-systems.de
- Update to version 0.45.3:
* #2512 Improve reporting errors on modules (#2527)
* Thu Apr 06 2023 kastl@b1-systems.de
- Update to version 0.45.2:
* #2515 Add option to disable module output (#2516)
* Tue Apr 04 2023 kastl@b1-systems.de
- Update to version 0.45.1:
* Add --terragrunt-include-module-prefix option (#2493)
* [skip ci] Refactor contexts (#2503)
* Update v0.45.0 link title (#2491)
* Fri Mar 17 2023 kastl@b1-systems.de
- Update to version 0.45.0:
* #2488 Terraform dependencies upgrade (#2489)
* Add automatic lock release (#2487)
* Add comment for sourceChangeLocks variable (#2476)
* Wed Mar 08 2023 kastl@b1-systems.de
- Update to version 0.44.5:
* #2471 Include in download directory tflint config (#2474)
* Fri Mar 03 2023 kastl@b1-systems.de
- Update to version 0.44.4:
* chore: Add access_token support for the GCS remote state
backend config (#2463)
* Fri Mar 03 2023 kastl@b1-systems.de
- Update to version 0.44.3:
* Bump golang.org/x/net from 0.5.0 to 0.7.0 (#2455)
* Thu Mar 02 2023 kastl@b1-systems.de
- Update to version 0.44.2:
* Bump github.com/hashicorp/go-getter from 1.6.2 to 1.7.0 (#2454)
* Tue Feb 28 2023 kastl@b1-systems.de
- Update to version 0.44.1:
* #2467 Parallel TFLint execution errors (#2469)
* Thu Feb 23 2023 kastl@b1-systems.de
- Update to version 0.44.0:
* isRetryable also checks the stdout (#2464)
* Wed Feb 22 2023 kastl@b1-systems.de
- Update to version 0.43.3:
* #2450 Improved loading of TFLint configuration (#2456)
* #2417 Add handling of intermittent errors in fixture-stack tests (#2439)
* Sat Feb 04 2023 kastl@b1-systems.de
- Update to version 0.43.2:
* Improved handling of default value for sse_algorithm (#2438)
* Thu Feb 02 2023 kastl@b1-systems.de
- Update to version 0.43.1:
* fix AES256 encryption validation (#2337)
* Fix typos (#2406)
* [skip ci] Added FUNDING.yml (#2429)
* Flaky TestInputsToTflintVar fix (#2427)
* Fri Jan 20 2023 kastl@b1-systems.de
- Update to version 0.43.0:
* feat: update tflint to v0.44.1 (#2422)
* Remove GITHUB_OAUTH_TOKEN from tflint + update docs (#2424)
* Fri Jan 13 2023 kastl@b1-systems.de
- Update to version 0.42.8:
* Updated golang.org/x/crypto dependency (#2412)
* Fri Jan 06 2023 kastl@b1-systems.de
- Update to version 0.42.7:
* #2377 MockOutputs validation before merge (#2379)
* Thu Jan 05 2023 kastl@b1-systems.de
- Update to version 0.42.6:
* Update error message (#2404)
/usr/bin/terragrunt /usr/share/doc/packages/terragrunt /usr/share/doc/packages/terragrunt/README.md /usr/share/licenses/terragrunt /usr/share/licenses/terragrunt/LICENSE.txt
Generated by rpm2html 1.8.1
Fabrice Bellet, Mon Aug 3 00:14:01 2026