Skip to main content

What's new in OpenTofu 1.12?

Here are some highlights from the new features in this release:

  • Dynamic prevent_destroy: The prevent_destroy argument in a resource's lifecycle block can now refer to other symbols within the same module, such as input variables.
  • Improved provider checksum handling: tofu init now automatically includes a full set of checksums for all platforms using both zh: and h1: hashes, reducing the need for manually running tofu providers lock.
  • Simultaneous output formats: The new -json-into=FILENAME CLI option allows saving machine-readable output to a separate file while still producing human-readable output in the terminal.
  • New destroy lifecycle meta-argument: The new destroy = false lifecycle option for managed resources allows removing an object from the state without first destroying the remote object.
  • Provider installer performance: Provider installation now performs concurrent requests for faster tofu init completion when many providers are needed.

For more information, refer to the v1.12.0 release announcement and the v1.12 series changelog.

Compatibility Notes​

  • New h1: checksums in dependency lock file: Due to the improved provider checksum handling in this release, the first time you run tofu init after upgrading you are likely to find additional h1: checksums have been added for any providers that were already tracked in your dependency lock file.

    This behavior is an example of what's described in New provider package checksums: the newly-added checksums each match one of the zh: checksums previously recorded and represent the same information in a different way. In OpenTofu v1.12 this is now a one-time backfill of all of the official checksums, rather than "upgrading" them one-by-one as in earlier versions.

  • WinRM connections for provisioners are deprecated: Provisioner connection blocks with type = "winrm" will now cause warnings in this release, and will no longer be supported at all in OpenTofu v1.13.

    We recommend migrating to OpenSSH for Windows.

  • Phasing out support for 32-bit CPU architectures: In a future release we plan to stop providing official release builds for the 32-bit 386 and arm CPU architectures. Support for amd64 and arm64 is unaffected.

    There is no immediate change to supported platforms in the v1.12 series, but we expect to introduce a deprecation warning in v1.13 and then stop providing official builds for these architectures completely in a future release series. If you don't expect that you'll be able to complete a migration to running on a 64-bit architecture in the next year, please tell us about your situation in issue #3912..