feat: update opentofu/opentofu to v1.11.5 #minor

[public-glueops-renovatebot]

This PR contains the following updates:

Package	Update	Change
opentofu/opentofu	minor	1.10.8 → 1.11.5

---

Release Notes

opentofu/opentofu (opentofu/opentofu)

v1.11.5

Compare Source

BUG FIXES:

• Add universe_domain option in the gcs backend to support sovereign GCP services (#​3758)
• The azurerm backend's MSI authentication method will now respect the provided client ID (#​3586)
• Using a network mirror for the providers source does not print debug logs without being asked for (#​3736)

Full Changelog: https://github.com/opentofu/opentofu/blob/67fe9db49b7dafd46470cf9ac7f437aaa95f5c40/CHANGELOG.md

v1.11.4

Compare Source

SECURITY ADVISORIES:

• Previous releases in the v1.11 series could potentially take an excessive amount of time processing a maliciously-crafted .zip archive during either provider or module installation during tofu init. (#​3689)

BREAKING CHANGES:

• Modules containing local provider configurations now also reject the enabled argument, matching existing behavior for count, for_each, and depends_on. (#​3680)

  This was an oversight in the original design of the enabled feature and was missed during the review process. Although our goal is to not introduce breaking changes in patch releases, in some cases it may be warranted. Anyone who has used the enabled feature in this particular way will have unintentionally introduced a foot-gun into their infrastructure and should remedy it post-haste.

BUG FIXES:

• In JSON syntax, the state encryption method configuration now allows specifying keys using both normal expression syntax and using template interpolation syntax. Previously only the template interpolation syntax was allowed, which was inconsistent with other parts of the encryption configuration. (#​3654)
• Providers are not configured anymore with DeferralAllowed capability of OpenTofu since having that created unwanted behaviour from some providers. (#​3676)
• Resources containing write-only attributes now are rendered consistently during planning. (#​3667)

Full Changelog: opentofu/opentofu@v1.11.3...v1.11.4

v1.11.3

Compare Source

BUG FIXES:

• Fix crash when the executed configuration contains an import block that points to unexisting configuration block (#​3616)
• Fixed tofu test with mock_provider failing during cleanup when lifecycle { ignore_changes } references a block. (#​3644)
• Fixed state lock not being released when tofu apply is interrupted with Ctrl+C while using the HTTP backend. (#​3624)
• azure backend: resolve OIDC token dynamically to support ADO refresh. (#​3594)

Full Changelog: opentofu/opentofu@v1.11.2...v1.11.3

v1.11.2

Compare Source

UPGRADE NOTES:

• The change from #​2643, that was announced previously in v1.11.0, has been reverted in this release. OpenTofu will no longer directly recommend using the -exclude= option to work around problems caused by unknown values in provider configurations.

  Unfortunately there are existing providers that spuriously report that they cannot plan due to unknown values even when planning would have been successful, and so we cannot rely on providers to accurately signal when unknown values are the cause of an error. Using -exclude is still a valid workaround for these problems even though OpenTofu cannot accurately detect when it's useful to make that suggestion.

BUG FIXES:

• Fix crash in plan -generate-config-out with read-only nested attributes (#​3553)
• It's now possible again to plan changes with the hashicorp/helm and hashicorp/kubernetes providers when the provider configuration contains unknown values, as long as the configuration is carefully written to avoid the plan phase actually depending on those values. (#​3592)
• When running tofu init on Windows with an azurerm backend, the subscription_id is quoted correctly allowing successful authentication. (#​3602)
• Fix serialization error in apply when using cloud backend (#​3611)

Full Changelog: opentofu/opentofu@v1.11.1...v1.11.2

v1.11.1

Compare Source

BUG FIXES:

• Fixed regression where import validation would incorrectly flag variables used in for_each statements within import blocks (#​3564)
• Fixed lifecycle enabled serialization in plan file (#​3566)
• Fixed regression when validating import.id expressions (#​3567)

Full Changelog: opentofu/opentofu@v1.11.0...v1.11.1

v1.11.0

Compare Source

OpenTofu 1.11.0

We're proud to announce that OpenTofu 1.11.0 is now officially available! 🎉

Highlights

This release cycle introduces major new capabilities and integrations:

Ephemeral Values and Write Only Attributes

Ephemeral resources allow you to work with confidential data, temporary credentials, and transient infrastructure without persisting them to your state.

ephemeral "aws_secretsmanager_random_password" "password" {

}

resource "kubernetes_secret_v1" "credentials" {
  metadata {
    name = "admin"
    namespace = "my-app"
  }
  data_wo = {
    username = "admin"
    password = ephemeral.aws_secretsmanager_random_password.password.random_password
  }

  data_wo_revision = 1
  type = "kubernetes.io/basic-auth"
}

The enabled Meta-Argument

If you want to conditionally deploy a resource, you no longer have to use count = var.create_my_resource ? 1 : 0, you can now add the new enabled meta-argument to your resource to conditionally deploy it.

resource "aws_instance" "web" {
  ami           = "ami-12345"
  instance_type = "t3.micro"

  lifecycle {
    enabled = var.create_instance  # Simple boolean condition
  }
}

Compatibility Notes

• macOS: Requires macOS 12 Monterey or later

• Azure Backend (azurerm):

  • The endpoint and ARM_ENDPOINT configuration options are no longer supported
  • The msi_endpoint and ARM_MSI_ENDPOINT options are no longer supported
  • The environment and metadata_host arguments are now mutually exclusive

• issensitive() Function: Now correctly returns unknown results when evaluating unknown values. Code that previously relied on the incorrect behavior may need updates.

• Testing with Mocks: Mock values generated during testing now strictly adhere to provider schemas. Test configurations with invalid mock values will need to be corrected.

• S3 Module Installation: When installing module packages from Amazon S3 buckets using S3 source addresses OpenTofu will use the same credentials as the AWS CLI and SDK.

• TLS and SSH Security:

  • SHA-1 signatures are no longer accepted for TLS or SSH connections
  • SSH certificates must comply with the draft-miller-ssh-cert-03 specification

• -var/-var-file during tofu apply <planfile>:

  • Since ephemeral variables values cannot be saved into the plan, now we allow using -var/-var-file during tofu apply <planfile> to pass again the values for ephemeral variables during apply
  • This new functionality allows -var/-var-file to be used with non-ephemeral variables too, but it will error if the values given for this type of variables is different from the ones given during the plan creation
  • TF_VAR values should stay consistent between plan and apply <planfile> to avoid the errors mentioned above

Reference

• Full Changelog
• Blog Post

Thank you for your continued support and testing of the OpenTofu project!

v1.10.9

Compare Source

SECURITY ADVISORIES:

This release contains fixes for some security advisories related to previous releases in this series.

• No limit on number of query string arguments in net/url's ParseQuery
  This release incorporates the upstream fixes for GO-2026-4341.

• crypto/tls handling of multiple messages that span across encryption level boundaries
  This release incorporates the upstream fixes for GO-2026-4340.

BUG FIXES:

Using a network mirror for the providers source does not print debug logs without being asked for (#​3736)

Full Changelog: https://github.com/opentofu/opentofu/blob/0de30e8050bc32dfada2c4c978e736239e0ab265/CHANGELOG.md

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.