⚙️ Process Updates Go bumped to v1.27.3 for a security fix The version of Golang used to compile the Terragrunt binary has been updated from v1.27.2 to v1.27.3. Go v1.27.3 is a security release. It fixes CVE-2026-111943 in crypto/x509: certificate verification now rejects chains that contain a small set of untrusted intermediate certificates. Terragrunt uses this verification for every HTTPS conne…
🎉 Release v1.2.0 This is a big minor release, and it introduces significant new capabilities in Terragrunt. For a brief overview of the changes in this release, read the blog post. This release completes the following experiments: block-iteration oci bounded-discovery catalog-format mutable-generate optional-dependency-outputs optional-hooks azure-backend version-attribute profiling dependency-fet…
🎉 v1.2.0 Release Candidate This is the third and final release candidate for Terragrunt v1.2. It completes the same eleven experiments as v1.2.0-rc2, and adds nine bug fixes found since then. Unless someone reports a blocking issue, v1.2.0 will ship with the contents of this release candidate. Only fixes for regressions or other urgent bugs will land before then. Please try out this release candid…
🎉 v1.2.0 Release Candidate This is the second release candidate for Terragrunt v1.2. It completes the same eleven experiments as v1.2.0-rc1, and adds bug fixes found since then, most of them in the CAS, the catalog, the Provider Cache Server, and exclude blocks. Future release candidates for v1.2.0 will include bug fixes related to these experiments or other urgent bug fixes as necessary, and docu…
🎉 v1.2.0 Release Candidate This is the first release candidate for Terragrunt v1.2. This release completes the following experiments: block-iteration oci bounded-discovery catalog-format mutable-generate optional-dependency-outputs optional-hooks azure-backend version-attribute profiling dependency-fetch-output-from-state Future release candidates for v1.2.0 will include bug fixes related to these…
🐛 Bug Fixes Git filters find nested units on Windows again On Windows, find, list and browse returned nothing for a Git-based filter such as --filter '[main...HEAD]' when the diff changed only unit configurations in nested directories, like nested\path\terragrunt.hcl. The worktree optimization in v1.1.5 checks out only the directories of changed units for these commands. On Windows, it spelled tho…
✨ New Features duplicate-dependency-labels also catches a shared config_path Two dependency blocks with different labels can point at the same config_path. Both parse, so the same unit is declared twice, and the two blocks drift apart as soon as one gains a mock_outputs or skip_outputs the other lacks: dependency "vpc" { config_path = "../vpc" } dependency "network" { config_path = "../vpc" } Terr…
✨ New Features duplicate-dependency-labels strict control Declaring two dependency blocks with the same label in one terragrunt.hcl configuration file parsed without error, and then quietly resolved every reference to that label to whichever block came last. The blocks before it were silently overridden: dependency "vpc" { config_path = "../vpc-us-east-1" } dependency "vpc" { config_path = "../vpc…
🐛 Bug Fixes Fixed Unsupported attribute errors for values.* inputs that autoinclude overrides A unit input referencing a values.* key that the unit's values file doesn't define no longer fails with Unsupported attribute when an autoinclude block supplies that input. The autoinclude value is applied as intended. # stacks/terragrunt.stack.hcl unit "subnet" { source = "../units/subnet" path = "subnet…
✨ New Features Scaffold straight from the catalog README view with ctrl+d In the terragrunt catalog TUI, pressing ctrl+d while reading a component's README now scaffolds it immediately, skipping the interactive form. Module and template inputs are written as # TODO placeholders, and unit/stack copies get a fully placeholder terragrunt.values.hcl. The hint bar at the bottom of the README view adver…
🐛 Bug Fixes Chained role assumption for the S3 backend When AWS credentials were supplied through --auth-provider-cmd or environment variables, Terragrunt ignored the assume_role attribute of the remote_state block for its own backend operations, such as bootstrapping the state bucket. In cross-account setups this caused access errors, even though OpenTofu/Terraform itself assumed the role correct…
✨ New Features Stack dependencies A stack generates a tree of units from a single terragrunt.stack.hcl file. Wiring one of those units to another used to mean defining dependency blocks in your catalog and threading dependency paths through values. Stack dependencies let you declare those relationships up front instead. Add an autoinclude block inside a unit or stack block, and Terragrunt generate…
🎉 v1.1.0 Release Candidate This is the third release candidate for Terragrunt v1.1. It carries the same six completed experiments as v1.1.0-rc2, plus bug fixes for those experiments and improvements to how releases are published and verified. This release completes the following experiments: stack-dependencies cas catalog-redesign mark-many-as-read opt-out-auth dag-queue-display Future release can…
🎉 v1.1.0 Release Candidate This is the second release candidate for Terragrunt v1.1. It carries the same six completed experiments as v1.1.0-rc1, plus bug fixes for those experiments and improvements to how releases are published and verified. This release completes the following experiments: stack-dependencies cas catalog-redesign mark-many-as-read opt-out-auth dag-queue-display Future release ca…
🎉 v1.1.0 Release Candidate This is the first release candidate for Terragrunt v1.1. This release completes the following experiments: stack-dependencies cas catalog-redesign mark-many-as-read opt-out-auth dag-queue-display Future release candidates for v1.1.0 will include bug fixes related to these experiments or other urgent bug fixes as necessary, and documentation improvements. Please try out t…
🏎️ Performance Improvements Faster read-file tracking with the mark-many-as-read experiment With the mark-many-as-read experiment enabled, Terragrunt records every module file it marks as read during parsing. The bookkeeping for that record scaled quadratically: each new path was checked against every path recorded so far, which got expensive for units with large local module sources, and monorepo…
✨ New Features tfr:// source URLs accept an optional version The version query parameter on tfr:// source URLs is now optional. When omitted, Terragrunt queries the registry's list-versions endpoint and downloads the latest stable version, matching how OpenTofu and Terraform resolve a module reference that has no version constraint. terraform { source = "tfr:///terraform-aws-modules/vpc/aws" } Pre…
🐛 Bug Fixes terragrunt no longer hangs when download_dir is a non-hidden subdirectory of the unit Setting download_dir (via the attribute, --download-dir, or TG_DOWNLOAD_DIR) to a subdirectory of the unit's working directory whose name did not start with a dot caused commands that prepare the OpenTofu or Terraform source (apply, plan, run, and similar) to hang. For example: # /infra/web/terragrunt…
✨ New Features Full .terraform.lock.hcl files from the provider cache server When the provider cache server is used against the OpenTofu provider registry, Terragrunt now writes .terraform.lock.hcl files containing h1: hashes for every platform the registry supports. A single terragrunt init produces a lock file that works on every platform, removing the need to run tofu providers lock -platform=.…
🏎️ Performance Improvements run_cmd and Git repo-root results memoized without the Provider Cache Server Within a single command, repeated run_cmd(...) calls and repeated Git repo-root lookups across units used to share their cached results only when the Provider Cache Server was running. Commands invoked without --provider-cache (the common case for find, list, and run --all against estates that…
✨ New Features --no-cas flag for disabling CAS per command The new --no-cas flag disables the CAS for a single invocation, even when the cas experiment is enabled. It is available on run, stack generate, and stack run. terragrunt stack generate --experiment cas --no-cas This is useful when you want to fall back to the standard getter path without unwinding experiment configuration. Generation and…