OpenTofu v1.10.7 — Release Notes & Engineering Impact

Source available — automated, not human-reviewed

Component: opentofu · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified — check source notes

📄 .MD

🔧 Bug Fixes 2

⚡ Executive Summary (TL;DR)

OpenTofu v1.10.7. Source highlight: SECURITY ADVISORIES:

Visit OpenTofu Official Site ↗ Official Release Source ↗ All OpenTofu Releases 📡 OpenTofu RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

🔧 Bug Fixes & Patches (2)

Fix crash in tofu test when using deprecated outputs (#3249)
Fix missing provider functions when parentheses are used (#3402)

📄 View Raw Release Notes (Original Developer Log)

SECURITY ADVISORIES: This release contains fixes for some security advisories related to previous releases in this series. - `tofu init` in OpenTofu v1.10.6 and earlier could potentially use unbounded memory if there is a direct or indirect dependency on a maliciously-crafted module package distributed as a "tar" archive. This would require the attacker to coerce a root module author to depend (directly or indirectly) on a module package they control, using the HTTP, Amazon S3, or Google Cloud Storage source types to refer to a tar archive. This release incorporates the upstream fixes for [CVE-2025-58183](https://www.cve.org/CVERecord?id=CVE-2025-58183). - When making requests to HTTPS servers, OpenTofu v1.10.6 and earlier could potentially use unbounded memory or crash with a "panic" error if TLS verification involves an excessively-long certificate chain or a chain including DSA public keys. This affected all outgoing HTTPS requests made by OpenTofu itself, including requests to HTTPS-based state storage backends, module registries, and provider registries. For example, an attacker could coerce a root module author to depend (directly or indirectly) on a module they control which then refers to a module or provider from an attacker-controlled registry. That mode of attack would cause failures in `tofu init`, at module or provider installation time. Provider plugins contain their own HTTPS client code, which may have similar problems. OpenTofu v1.10.7 cannot address similar problems within provider plugins, and so we recommend checking for similar advisories and fixes in the provider plugins you use. This release incorporates upstream fixes for [CVE-2025-58185](https://www.cve.org/CVERecord?id=CVE-2025-58185), [CVE-2025-58187](https://www.cve.org/CVERecord?id=CVE-2025-58187), and [CVE-2025-58188](https://www.cve.org/CVERecord?id=CVE-2025-58188). BUG FIXES: * Fix crash in tofu test when using deprecated outputs ([#3249](https://github.com/opentofu/opentofu/pull/3249)) * Fix missing provider functions when parentheses are used ([#3402](https://github.com/opentofu/opentofu/pull/3402)) * `for_each` inside `dynamic` blocks can now call provider-defined functions. ([#3429](https://github.com/opentofu/opentofu/issues/3429)) **Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.10.6...v1.10.7

← Older Version OpenTofu v1.10.6 Newer Version → OpenTofu v1.10.8