What gruntwork-io/terragrunt shipped

This week: a new variables block behind an experiment with env and tfvar kinds, an inputs-read-not-tracked tip, and fixes for S3 backend bootstrap, provider cache temp dir permissions, scaffold paths and catalog clones.

This week in Terragrunt: a variables block is available behind the variables-block experiment, letting you set OpenTofu/Terraform variables like inputs while choosing whether they are passed as TF_VAR_ environment variables or tfvar files. A new inputs-read-not-tracked tip flags HCL read functions that will not register in inputs. Fixes landed for S3 backend bootstrap crashes on missing encryption or table description, provider cache permission errors on shared temp dirs, scaffold paths not respecting the working-dir flag, catalog clone directories, and stacks reading tracking for values. Work also continued on deferring dependency output resolution in the config rewrite and making telemetry log export more reliable.

This week in Terragrunt: a new no_dot_terragrunt_cache experiment, faster relationship discovery, memoized symlink resolution, flag env vars fixed to match the docs, and an OpenTofu encryption fallback for state migration.

This week in Terragrunt brings a new experiment, terraform.no_dot_terragrunt_cache, which runs a unit from its own directory instead of.terragrunt-cache. You can set it in a root config and it reaches every unit through include. Relationship discovery is now linear in unit count, and symlink resolution is memoized in discovery to cut wasted syscalls. Flag environment variables now match what the docs say, with tests pinning them. There is also a remote state encryption fallback for OpenTofu encrypted state migration, plus a contents based mtime check and size as a change indicator to reduce flakes on Windows. Test coverage went up in spinner, strict controls, git, hcl format and worktrees.

Terragrunt v1.2.0 is out with several experiments completed, followed by v1.2.1 on Go v1.27.3 for a crypto/x509 security fix. This week also brought engine auto mTLS, use_path_style for S3-compatible stores, run_cmd caching fixes and faster discovery and find --json.

Terragrunt v1.2.0 shipped this week, a big minor release that completes several experiments including block iteration, OCI, bounded discovery, catalog format and mutable generation. v1.2.1 followed, moving the build to Go v1.27.3 for a crypto/x509 security fix. Other changes include automatic mTLS for engines, use_path_style support for S3-compatible object stores, run_cmd cache keys that account for configured environment and exact argv with singleflight coalescing, faster discovery and find --json when root.hcl loads shared files, discovery walk narrowing, a plan per Git reference under --out-dir, and clearer hcl validate errors.

Terragrunt v1.2.0-rc3 is out: the final release candidate, with the same eleven experiments and nine bug fixes since rc2. Also this week: -destroy=true now behaves like -destroy, OpenTelemetry spans set status and error.type on failure, and provider locks with pessimistic constra

Terragrunt v1.2.0-rc3 is now available. It is the third and final release candidate for v1.2, completes the same eleven experiments as rc2, and adds nine bug fixes found since then. Unless a blocking issue is reported, v1.2.0 will ship with the contents of this candidate. Fixes landed this week include treating -destroy=true like -destroy, setting span status and error.type on failed operations for backends that classify errors that way, and resolving provider lockfile issues with pessimistic constraints. GCS dependency outputs can now be read directly under service account impersonation. On the maintenance side, slow tests were trimmed, test coverage was added for git server and S3 cleanup failure paths, and the contribution guidelines were updated.

V1.2.0-rc2 is out with fixes across CAS, catalog, Provider Cache Server and exclude blocks. Also landed:.terragrunt-stack excluded from CAS hashing, correct catalog scaffold messages, azurerm blob role principal type, nested autoinclude generation, and safer CAS git tree handling

This week we published v1.2.0-rc2, the second release candidate for Terragrunt v1.2, carrying the same eleven experiments as rc1 plus fixes mostly in CAS, the catalog, the Provider Cache Server, and exclude blocks. Alongside the release: the generated.terragrunt-stack directory is now excluded from CAS local source hashing; the catalog TUI now reports the files it actually generated instead of always naming terragrunt.hcl; azurerm role assignment sends a principal type for the auto-resolved blob data principal; nested stacks generated by a stack-level autoinclude are generated correctly; CAS git tree entries are confined to the download directory; and run --all with a git-range filter no longer crashes when a deleted unit directory is still referenced by a live unit.

Terragrunt improvements this week: faster locals resolution via topological sorting, CAS source rewrite fixes, OpenTofu 1.13 support, and fixes for null/unknown values in exclude blocks.

This week's Terragrunt updates bring performance and stability improvements. We optimized locals resolution by replacing iterative scanning with topological sorting, fixed CAS source rewrite evaluation, added OpenTofu 1.13 support, and resolved crashes when exclude blocks contain null or unknown values. Test coverage also increased across multiple packages.

Terragrunt v1.2.0-rc1 is out with block-iteration, catalog-format, azure-backend, and more experiments completed. v1.1.6 fixes Git filters on Windows. Get them now.

We shipped Terragrunt v1.2.0-rc1 completing 12 experiments including block-iteration, catalog-format, mutable-generate, and azure-backend support. We also released v1.1.6 with a critical fix for Windows Git filters in nested directories. The week included new --discovery-boundary controls, an experimental mcp command, and dozens of bug fixes for provider handling and configuration parsing. Try the RC today.

Terragrunt added portal authentication with the new login command, catalog API support, and fixed stack dependency bugs. Windows tests now run alongside existing test suites.

This week Terragrunt shipped portal integration features including a new login command and catalog API support for the Gruntwork developer portal. We fixed critical bugs in stack dependency discovery and Windows path handling, completed two experimental features, and expanded test coverage to Windows platforms. OpenTofu packages now replace pinned Terraform dependencies.