BUG FIXES:
- Running
tofu apply -refresh-onlywith a configuration that contains ephemeral resources does not fail anymore because the refresh produced changes (#3776) - Fixed
tofu initcrashing when a moduleversionuses a variable and the module is referenced from a test file. (#3686) - Fixed provider-defined functions in
importblockidexpressions causing "BUG: Uninitialized function provider" error. (#3803) tofu testno longer fails during cleanup when using a mocked version of a resource type with write-only attributes. (#3964)- A malicious remote TLS server can no longer deadlock OpenTofu by sending multiple key update messages in a single record. (#3966)
- When installing module packages from "tar" archives, OpenTofu now accepts only a limited number of sparse file entries to avoid unbounded memory usage from maliciously-crafted archives containing many sparse regions. (#3966)
Full Changelog: v1.11.5...v1.11.6