[renovate]

This PR contains the following updates:

Package	Update	Change
hashicorp/terraform	minor	1.16.5 → 1.17.0

---

Release Notes

hashicorp/terraform

v1.17.0

Compare Source

1.17.0 (October 21, 2026)

NEW FEATURES:

• Terraform now supports variables and locals in provider requirements (#​39153)

• A new -minimal-refresh planning option has been added, which will only refresh resources that have proposed changes. (#​35290)

• policy: Terraform Policy is now generally available. The -policies flag for plan, apply, and query no longer requires an experimental build or the -allow-experimental-features flag. Query policies evaluate resources discovered by list blocks and report human-readable or JSON results. See https://developer.hashicorp.com/terraform/policy for more information. (#​38970)

ENHANCEMENTS:

• command/init: Enrich log messages with provider versions (#​38918)

• test: Add mock_provider support for ephemeral resources (#​38928)

• command/login: display warning after successful login if user is subject to an organization's TTL policy

BUG FIXES:

• funcs: pow and log no longer panic when result is not a number (#​38912)

• ephemeral: Terraform will now use and display diagnostics raised when renewing an ephemeral resource. This may cause warnings to appear that previously were lost. We expect that any error diagnostics that were previously lost would have caused confusing downstream errors, so we do not anticipate this change to be breaking. (#​38989)

• test: Deterministic dependency ordering in cleanup graph (#​38247)

• query: report Unknown and N/A results for policy evaluations of discovered resources (#​39058)

• query: terraform query -policies now rejects a path that is not a directory, instead of passing it on to the policy engine (#​39238)

• funcs: The log and pow functions now raise errors when they return +/- Infinity, as this result is not usable in downstream code. (#​39304)

• show: Read variable values from the plan file when showing a local plan (#​39362)

NOTES:

• version: JSON output now includes a new format_version field, which will enable safer future changes of the command's JSON output format. It is assumed existing tooling ignores unknown fields and therefore this change should not be breaking in itself but we advice consumers to pay attention to format_version in future releases and/or use latest version of hashicorp/terraform-json & hashicorp/terraform-exec which does. (#​38930)

• Terraform is now built with Go 1.26.10, which no longer trusts certificates issued through a set of compromised eMudhra intermediate CAs (CVE-2026-111943) (#​39417)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.16
• v1.15
• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

v1.16.7

Compare Source

1.16.7 (October 22, 2026)

BUG FIXES:

• command/test: Avoid panic when testing schema w/ deprecated values (#​39406)

NOTES:

• Terraform is now built with Go 1.26.10, which no longer trusts certificates issued through a set of compromised eMudhra intermediate CAs (CVE-2026-111943) (#​39417)

v1.16.6

Compare Source

1.16.6 (October 14, 2026)

BUG FIXES:

• cloud: terraform init can now find workspaces selected by key/value tags whose keys contain uppercase letters. (#​39306)

• test: Allow module under test to use deprecated outputs. (#​39207)

NOTES:

• Prevent a HTTP/2 resource exhaustion via CVE-2026-78669. Exploitation would require a compromised (untrusted) provider/module registry. Such a threat is considered to be outside the perimeter of Terraform core security guarantees. (#​39375)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.