OpenTofu v1.11.6 — Release Notes & Engineering Impact

Source available — automated, not human-reviewed

Component: opentofu · Channel: stable. Automated analysis, not a compatibility certification. How this works.

Analysis updated: 2026-11-01.

Compatibility not verified — check source notes

📄 .MD

🔧 Bug Fixes 6

⚡ Executive Summary (TL;DR)

OpenTofu v1.11.6. Source highlight: Running `tofu apply -refresh-only` with a configuration that contains ephemeral resources does not fail anymore because the refresh produced changes (#3776)

Visit OpenTofu Official Site ↗ Official Release Source ↗ All OpenTofu Releases 📡 OpenTofu RSS

Who Does This Impact? (Role-Based Analysis)

💻 Software Engineers & Devs

Check the source notes against the package and APIs you use before upgrading.

📊 Product & Engineering Leads

Use the documented changes to assess relevance to your product; release frequency alone is not a quality measure.

⚙️ DevOps & Security

Verify the target version, runtime requirements and rollback procedure in the official documentation.

🔧 Bug Fixes & Patches (6)

Running `tofu apply -refresh-only` with a configuration that contains ephemeral resources does not fail anymore because the refresh produced changes (#3776)
Fixed `tofu init` crashing when a module `version` uses a variable and the module is referenced from a test file. (#3686)
Fixed provider-defined functions in `import` block `id` expressions causing "BUG: Uninitialized function provider" error. (#3803)
`tofu test` no longer fails during cleanup when using a mocked version of a resource type with write-only attributes. (#3964)
A malicious remote TLS server can no longer deadlock OpenTofu by sending multiple key update messages in a single record. (#3966)
When installing module packages from "tar" archives, OpenTofu now accepts only a limited number of sparse file entries to avoid unbounded memory usage from maliciously-crafted archives containing many sparse regions. (#3966)

📄 View Raw Release Notes (Original Developer Log)

## BUG FIXES: * Running `tofu apply -refresh-only` with a configuration that contains ephemeral resources does not fail anymore because the refresh produced changes ([#3776](https://github.com/opentofu/opentofu/issues/3776)) * Fixed `tofu init` crashing when a module `version` uses a variable and the module is referenced from a test file. ([#3686](https://github.com/opentofu/opentofu/issues/3686)) * Fixed provider-defined functions in `import` block `id` expressions causing "BUG: Uninitialized function provider" error. ([#3803](https://github.com/opentofu/opentofu/issues/3803)) * `tofu test` no longer fails during cleanup when using a mocked version of a resource type with write-only attributes. ([#3964](https://github.com/opentofu/opentofu/issues/3964)) * A malicious remote TLS server can no longer deadlock OpenTofu by sending multiple key update messages in a single record. ([#3966](https://github.com/opentofu/opentofu/pull/3966)) * When installing module packages from "tar" archives, OpenTofu now accepts only a limited number of sparse file entries to avoid unbounded memory usage from maliciously-crafted archives containing many sparse regions. ([#3966](https://github.com/opentofu/opentofu/pull/3966)) **Full Changelog**: https://github.com/opentofu/opentofu/compare/v1.11.5...v1.11.6

← Older Version OpenTofu v1.11.5 Newer Version → OpenTofu v1.10.10