Terragrunt: baixar versions anteriors

⚙️ Process Updates
Go bumped to v1.27.3 for a security fix
The version of Golang used to compile the Terragrunt binary has been updated from v1.27.2 to v1.27.3.
Go v1.27.3 is a security release. It fixes CVE-2026-111943 in crypto/x509: certificate verification now rejects chains that contain a small set of untrusted intermediate certificates. Terragrunt uses this verification for every HTTPS connection it makes, including source downloads, provider registry lookups, and remote state backends. We recommend upgrading.
Terragrunt runs git, hg, and smbclient source downloads itself
Terragrunt downloaded git::, hg::, and smb:// sources through the getters built into the go-getter library, which started git, hg, and smbclient on their own. Terragrunt now implements these getters itself and starts those programs the same way it runs every other command.
Downloads should behave as they did before. If you find any functional difference, open an issue.
Because the downloads now go through Terragrunt's own command handling, Terragrunt's tests can cover them without a real git, hg, or smbclient install or a remote server, which makes regressions in source downloads easier to catch.
🏎️ Performance Improvements
Faster parsing of shared configuration
Repositories where every unit includes a root.hcl that loads shared files with read_terragrunt_config now parse much faster.
- Each unit used to parse those shared files itself, so a common.hcl that runs yamldecode(file(...)) on a large YAML file decoded it once per unit. Terragrunt now parses each file once and gives every unit the same result, and parses it again only when the file, or a file it reads, changes during the command. run --all parses it a second time when the run starts, after discovering units. A file whose result can differ between units, like one that calls get_original_terragrunt_dir() or has dependency blocks, is still parsed per unit.
- Since v1.1.2, discovery parsed every included configuration twice, once for its feature flag defaults and once to merge it. It parses each include once again, and skips includes with merge_strategy = "no_merge" that it would only have thrown away.
- Locals and inputs went through a JSON encoding round trip on their way into Terragrunt. Terragrunt now converts them directly.
In benchmarks on an Apple M3 Max, discovering units and their dependencies in a generated repository whose units read a 48 KB YAML file through read_terragrunt_config:
─────┬──────┬─────
units│before│after
─────┼──────┼─────
100 │819ms │59ms
─────┼──────┼─────
500 │3.60s │201ms
─────┼──────┼─────
1,000│7.01s │379ms
─────┼──────┼─────
5,000│34.2s │1.88s
─────┴──────┴─────
Memory allocated during discovery dropped by about 95%.
Faster discovery with path filters
Terragrunt now analyzes --filter expressions before discovery starts and uses them to narrow the filesystem walk it does during discovery. Filters that name specific paths let Terragrunt skip most of the walk, or walk only the directories those paths can match.
On a repository of 10,000 units, discovery with a filter like --filter './doublestar/glob/**', matching 1,250 of those units, took 27 ms instead of 224 ms. A filter like --filter './path/to/specific/unit', which names a single unit, took under 1 ms instead of 215 ms. Discovery selects the same units as before. It still walks the whole working directory when there is no filter, when every filter is negated, or when any filter can select a unit anywhere, such as name=vpc or ...vpc.
Units that share a run_cmd result run the command once
Units share a run_cmd result when the call uses --terragrunt-global-cache, or when it is in a file they read with read_terragrunt_config. Discovery parses units concurrently, so several of them could start the command before any had cached its result, and run --all could run a shared command once per unit.
Units now wait for the first run and reuse its result. If that run fails, the next unit runs the command itself.
📖 Documenta

🐛 Bug Fixes
Chained role assumption for the S3 backend
When AWS credentials were supplied through --auth-provider-cmd or environment variables, Terragrunt ignored the assume_role attribute of the remote_state block for its own backend operations, such as bootstrapping the state bucket. In cross-account setups this caused access errors, even though OpenTofu/Terraform itself assumed the role correctly during runs.
Terragrunt now uses the supplied credentials as the source identity and assumes the configured role on top of them. The same applies to roles configured via the iam_role attribute or the --iam-assume-role flag, and to fetching dependency outputs directly from S3 state.
Safer temporary clone directories for terragrunt catalog
Terragrunt now creates a fresh temporary clone directory for each catalog load, rejects symlinked clone roots, and removes catalog clones when the TUI session exits.
Resolve dependency outputs for units that reference a dependency in a hook, extra_arguments, or remote_state block
Resolving a unit's dependency outputs for a downstream unit no longer fails when that unit references its own dependency in:
- a before_hook, after_hook, or error_hook
- an extra_arguments block
- a remote_state block
Previously these raised There is no variable named "dependency" on the downstream unit, and a remote_state reference could crash Terragrunt.
Limit IaC engine archive extraction
Terragrunt now protects developer machines and CI runners from engine archives that expand into unexpectedly large amounts of data. If an IaC engine package is unusually large or contains too many files, Terragrunt stops processing it before it can consume excessive disk space.
--filter-allow-destroy with ...[] dependent-traversal filters no longer fails
--filter-allow-destroy --filter '...[HEAD~1...HEAD]' failed with "Too many command line arguments" or hung when the deleted unit had dependents. Terragrunt now correctly plans and destroys deleted units regardless of whether dependents are included in the run.
Fix find and list missing units inside generated stacks for Git-based filters
terragrunt find and terragrunt list with a Git-based filter (for example --filter '[HEAD^1...HEAD]') now detect units inside generated stacks. Previously they did not generate stacks in the worktrees they create for the comparison, so no unit nested in a generated stack was ever surfaced, while terragrunt run --all with the same filter targeted those units correctly.
This affected every change that lands inside a generated stack, including a modified terragrunt.stack.hcl, a change to a unit's own files, and a change to a file the stack reads via read_terragrunt_config or mark_glob_as_read.
Stacks are generated only inside the comparison worktrees; find and list still do not generate stacks in your current working directory by default.
Treat Git source ref values strictly as references
Terragrunt now passes the ref from a Git module source to git strictly as a reference when downloading through content-addressable storage. Previously a source whose ref began with a git option (for example a value starting with --) could be interpreted by git as an option rather than a reference while fetching the source.
Terragrunt now terminates git option parsing before the repository and reference arguments in its fetch, clone, and ls-remote invocations, so these values can only ever be read as the repository and reference they are meant to be. Normal refs, branches, tags, and commit SHAs continue to work unchanged.
hcl validate resolves get_original_terragrunt_dir() to the discovered unit
terragrunt hcl validate and terragrunt hcl validate --inputs now resolve get_original_terragrunt_dir() to each discovered unit's own directory instead of the directory the command was launched from. Previously, when the command ran from a parent directory that discovered units in subdirectories, any read_terragrunt_config() call that built a path relative to get_original_terragrunt

✨ New Features
Stack dependencies
A stack generates a tree of units from a single terragrunt.stack.hcl file. Wiring one of those units to another used to mean defining dependency blocks in your catalog and threading dependency paths through values. Stack dependencies let you declare those relationships up front instead.
Add an autoinclude block inside a unit or stack block, and Terragrunt generates a partial configuration (a terragrunt.autoinclude.hcl file) next to the generated terragrunt.hcl or terragrunt.stack.hcl that's automatically merged into the unit or stack definition. The new unit.<name>.path and stack.<name>.path references resolve to generated paths, so you don't have to hardcode them:
# terragrunt.stack.hcl
unit "vpc" {
source = "github.com/acme/catalog//units/vpc"
path = "vpc"
}
unit "app" {
source = "github.com/acme/catalog//units/app"
path = "app"
autoinclude {
dependency "vpc" {
config_path = unit.vpc.path
}
inputs = {
vpc_id = dependency.vpc.outputs.vpc_id
}
}
}
Anything that's valid in a unit configuration is valid in its autoinclude block, so you can also patch catalog units with configuration they don't ship with, like retry rules:
# terragrunt.stack.hcl
unit "app" {
source = "github.com/acme/catalog//units/app"
path = "app"
autoinclude {
errors {
retry "transient_errors" {
retryable_errors = [".*Error: transient network issue.*"]
max_attempts = 3
sleep_interval_sec = 5
}
}
}
}
The same works for nested stacks: an autoinclude block inside a stack block patches the generated terragrunt.stack.hcl, so you can, for example, add an extra unit to one environment without forking the stack in your catalog.
Stack configurations also gained two capabilities along the way:
- include blocks now work in terragrunt.stack.hcl files, so shared stack configuration can live in a parent folder.
- dependency blocks can target stack directories, and the run queue expands them to the units inside. Note that this relationship only goes one way: units can depend on stacks, but stacks cannot depend on stacks or units.
See the stacks documentation for the full reference. Previously gated behind the stack-dependencies experiment, all of this is now enabled by default.
Content Addressable Store (CAS)
The Content Addressable Store (CAS) deduplicates source downloads across configurations. It addresses repositories and modules by their content, stores them locally, and serves later requests from that local store instead of repeating the fetch. This speeds up catalog cloning, OpenTofu/Terraform source fetching, and stack generation, and identical files occupy disk space once regardless of how many configurations use them.
The CAS is no longer limited to Git. It also deduplicates HTTP, Amazon S3, Google Cloud Storage, Mercurial, and SMB sources, along with OpenTofu/Terraform registry sources fetched via tfr://. See supported sources for how each one resolves and deduplicates content.
CAS is enabled by default. Use the --no-cas flag (or TG_NO_CAS=true) to opt out of it for a run:
terragrunt run --all --no-cas -- plan
Two new attributes give you finer control, and both default to off:
- update_source_with_cas makes a generated stack self-contained. Set it on a unit, stack, or terraform block with a relative source, and terragrunt stack generate rewrites that source into a content-addressed cas:: reference, so the generated tree no longer depends on the surrounding repository layout. Catalog authors can keep relative paths in their sources and still ship a portable, reproducible stack:
# stacks/networking/terragrunt.stack.hcl
unit "vpc" {
source = "../..//units/vpc"
path = "vpc"
update_source_with_cas = true
}
After terragrunt stack generate, the relative path is replaced by a reference to the exact tree the CAS stored:
# Generated output
unit "vpc" {
source = "cas::sha1:f39ea0ebf891c9954c89d07b73b487ff938ef08b"
path = "vpc"
update_source_with_cas = true
}
- mutable controls how the CAS places fetched content on disk. By default, the CAS h

🏎️ Performance Improvements
Faster read-file tracking with the mark-many-as-read experiment
With the mark-many-as-read experiment enabled, Terragrunt records every module file it marks as read during parsing. The bookkeeping for that record scaled quadratically: each new path was checked against every path recorded so far, which got expensive for units with large local module sources, and monorepos paid that cost again for every unit and every command.
Recording a path now takes constant time no matter how many paths came before it, and re-marking already-recorded files is cheaper still. The reading lists reported by find and list are unchanged.
🐛 Bug Fixes
assume_role: preserve commas inside list expressions
Terragrunt previously failed to correctly parse assume_role attributes containing list values such as transitive_tag_keys or policy_arns. Commas inside nested list expressions were incorrectly treated as top-level separators, causing generated configurations to fail with parsing errors.
assume_role = {
role_arn = "arn:aws:iam::123456789012:role/test-role"
transitive_tag_keys = ["Project", "Projects"]
}
This resulted in errors similar to:
Missing item separator; Expected a comma to mark the beginning of the next item.
Terragrunt now preserves commas inside nested list and object expressions when parsing assume_role blocks, allowing configurations containing array attributes to be processed correctly.
Thanks to @Rahul-Kumar-prog for contributing this fix!
Completed experiments now evaluate as permanently enabled
Features gated behind a completed experiment were treated as disabled instead of permanently enabled, so functionality that graduated out of experiment status could silently stop working.
The one affected code path was hcl validate --inputs with a git filter expression such as --filter '[HEAD~1...HEAD]': after the filter-flag experiment completed, the command stopped preparing git worktrees for the filter. Git filter expressions now work with hcl validate --inputs again, matching find, list, and the other commands that accept filters.
Exposed-include resolution errors now name the include block, file, and failing field
When resolving an include block with expose = true, Terragrunt surfaced low-level parsing or conversion errors with no indication of which include block, file, or field was at fault. This was especially hard to debug for errors that carry no source location, such as:
unsuitable value: a bool is required
The error is now annotated with the include block name, the included (parent) file path, and a single dotted locator for the failing field — the top-level config field (dependency, inputs, locals, or feature) plus the attribute path within it when go-cty can determine one:
exposed include "root" (/path/to/root.hcl): dependency.outputs["enabled"]: unsuitable value: a bool is required
When go-cty cannot resolve a precise attribute path, the locator degrades to just the field name:
exposed include "root" (/path/to/root.hcl): dependency: unsuitable value: a bool is required
Errors that originate in HCL parsing already carry a source range (file:line:column) and are preserved unchanged. This narrows the search from the entire configuration tree to a specific file and field.
Intersecting a graph traversal with another filter no longer drops the traversed components
A graph traversal combined with an intersected filter dropped the components reached in discovery.
e.g., ...a-dependent | type=unit (the dependents of a-dependent, intersected with type of units) returned only a-dependent itself instead of its dependents, and git-change traversals such as ...[HEAD~1...HEAD] | type=unit lost the dependents of the changed units.
A component that matched both a graph expression target and a positive filesystem or git filter was classified as discovered before the graph traversal ran, so the traversal never expanded from it. Terragrunt now checks graph expression targets first, so intersecting a traversal with anoth

✨ New Features
tfr:// source URLs accept an optional version
The version query parameter on tfr:// source URLs is now optional. When omitted, Terragrunt queries the registry's list-versions endpoint and downloads the latest stable version, matching how OpenTofu and Terraform resolve a module reference that has no version constraint.
terraform {
source = "tfr:///terraform-aws-modules/vpc/aws"
}
Prereleases are excluded from resolution, so a registry that only publishes 4.0.0-rc1 alongside 3.3.0 will pin to 3.3.0. Pin a version explicitly with ?version= when you need reproducible builds or want to opt into a prerelease.
Thanks to @raman1236 for contributing this feature!
🐛 Bug Fixes
update_source_with_cas: preserve //subdir on a unit's terraform.source
When a unit's terraform.source used the // subdir convention (for example, source = "../..//modules/foo") and opted into update_source_with_cas, the rewritten source dropped the //subdir tail and the synthetic tree contained only the leaf module's files. A module that referenced a sibling via a relative path (source = "../bar") could not resolve that reference after materialization.
Rewrites now preserve the original //subdir (for example, cas::sha1:<hash>//modules/foo), and the synthetic tree is rooted at the path before //, so sibling files reachable via relative paths land in the materialized working directory.
Sources without // are unchanged: the tree stays scoped to the leaf module, and the rewritten reference has no //subdir tail.
--filter now detects affected units on Windows
On Windows, terragrunt find --filter '[origin/main...HEAD]' (and its variants) returned no affected units even when git diff reported changed files. The source= and reading= filters were affected by the same problem.
Filter glob patterns are always written with forward slashes, but the affected-unit comparison was being made with Windows backslash separators, so nothing matched. Terragrunt now compares paths consistently with forward slashes on every platform, and the filter detects changed units on Windows as it already did on Linux and macOS.
Reported in #6214.
startswith, endswith, strcontains, and run_cmd no longer panic on malformed calls
Calling startswith, endswith, or strcontains with the wrong number of arguments (for example a single argument instead of two) crashed Terragrunt instead of reporting a configuration error. Calling run_cmd with only option flags and no command (for example run_cmd("--terragrunt-quiet")) crashed the same way.
These calls now return a clear error: a wrong-number-of-parameters error for the string functions, and an empty-command error for run_cmd.
The --parallelism flag no longer accepts non-positive numbers
Previously, terragrunt commands that accept the --parallelism flag (or equivalently the $TG_PARALLELISM environment variable) used to hang indefinitely when invoked with --parallelism=0.
Terragrunt now validates that the value is positive and exits with an error otherwise.
Reported in #6211
🧪 Experiments Updated
cas — content-addressing for non-git sources
CAS now covers module sources beyond git: http(s), Amazon S3, Google Cloud Storage, and Mercurial. Repeat runs against an unchanged remote reuse the cached tree instead of downloading the bytes again.
Before fetching, CAS issues a cheap remote probe (an HTTP HEAD, an S3 object-attributes lookup, a GCS metadata read, or hg identify) to derive a cache key without pulling the source. On a hit, the cached tree is linked directly; on a miss, or when the remote exposes no usable signal, CAS downloads the source, ingests it, and keys the resulting tree by its content hash. A remote that publishes a new version under the same address pins to a new entry, so a stale cache cannot serve outdated bytes.
cas — OpenTofu/Terraform registry sources
Module sources of the form tfr://... are now content-addressed in CAS. Repeat runs against the same pinned registry version reuse the cached module instead of re-downloading the

🐛 Bug Fixes
terragrunt no longer hangs when download_dir is a non-hidden subdirectory of the unit
Setting download_dir (via the attribute, --download-dir, or TG_DOWNLOAD_DIR) to a subdirectory of the unit's working directory whose name did not start with a dot caused commands that prepare the OpenTofu or Terraform source (apply, plan, run, and similar) to hang.
For example:
# /infra/web/terragrunt.hcl
download_dir = "cache"
terraform {
source = "./mod"
}
Here terragrunt apply would copy ./mod into cache/, see the new cache/ directory on the next read of the unit, and recurse into it. The default .terragrunt-cache was unaffected because Terragrunt's source-copy step skips any directory whose name starts with a dot.
These configurations now produce an immediate error identifying the source and destination paths.
mark-many-as-read experiment now triggers during discovery
With the mark-many-as-read experiment enabled, a unit whose terraform { source = ... } pointed at a local module did not show up under --filter 'reading=' filters that referenced files inside that module. Discovery would parse the unit, but the module files were never recorded as read, so the reading filter attribute could not match and the queue came back empty.
The module walk now runs on the discovery code path as well, so changes to files in a local module source flow through to the units that depend on them.
terragrunt render no longer crashes on exclude or catalog blocks with certain attributes
Rendering a config crashed with a value has no attribute of that name panic before any output could be produced when:
- the exclude block set no_run, or
- the catalog block set default_template, no_shell, or no_hooks.
These attributes are now carried through the render pipeline alongside the other fields on their respective blocks, so both blocks round-trip cleanly.
terragrunt render no longer crashes on multiple errors.ignore blocks with mismatched signals
Rendering a config that defined more than one errors.ignore block crashed with an inconsistent list element types panic when the signals map was populated on one block and absent (or differently typed) on another. The same crash showed up in dependency-output evaluation, since both paths build the same rendered representation of the config.
Each ignore block is now rendered with a uniform shape. Indexed access (errors.ignore[0]), length, and iteration still work, and the signals map on each block is preserved as written.
Suppress spurious Unknown variable: dependency errors during dependency resolution
terragrunt plan and apply no longer print ERROR Error: Unknown variable "dependency" lines when a unit pulls in a shared include (e.g. via find_in_parent_folders) that references dependency.* outputs. The plans completed correctly, but the error lines cluttered CI logs.
Resolves #6036.
terragrunt stack commands no longer crash on stacks with multiple units
Running terragrunt stack output (or any command that resolves concurrently parsing multiple configuration files) against a stack with several units could intermittently crash while the units were being parsed in parallel due to a race on internal bookkeeping of files read (used in the reading filter attribute).
Parallel unit parsing now coordinates safely when recording which source files were read, preventing crashes.
terraform_binary properly respected when both tofu and terraform are on PATH
A regression in command execution caching resulted in over-caching the STDOUT result of tofu --version when both tofu and terraform were available on PATH and terraform_binary was set. Early on in the execution flow, Terragrunt checks if OpenTofu is installed what its version is to determine if it supports setting of the automatic provider cache directory. This resulted in the value of terraform_binary being ignored for later version checks to assess compliance with terraform_version_constraint.
The version-detection cache used per run is now scoped to the binary that prod

✨ New Features
Full .terraform.lock.hcl files from the provider cache server
When the provider cache server is used against the OpenTofu provider registry, Terragrunt now writes .terraform.lock.hcl files containing h1: hashes for every platform the registry supports. A single terragrunt init produces a lock file that works on every platform, removing the need to run tofu providers lock -platform=... separately for each target architecture.
provider "registry.opentofu.org/hashicorp/null" {
version = "3.2.2"
constraints = "3.2.2"
hashes = [
"h1:+1mRmfyz6oA00IhrrSkHK3h/Mdh032x2p0F6OMdMo5s=",
"h1:FjLTqvaaYo+vHN8pHZB1cOwEGiNzOj+I9kQyHmr9/7o=",
# ... one entry per supported platform ...
"zh:00e5877d19fb1c1d8c4b3536334a46a5c86f57146fd115c7b7b4b5d2bf2de86d",
# ... one entry per supported platform ...
]
}
The hashes come from the registry's per-platform download response. When the registry does not supply them (for example, a third-party registry that has not adopted the field), Terragrunt falls back to its previous behavior of writing an h1: hash for the current platform plus zh: hashes for every platform listed in the shasums document.
Tip
Thanks to the OpenTofu team
This feature builds on work done by the OpenTofu team to expose per-platform hashes directly from the OpenTofu provider registry. Starting with OpenTofu 1.12, tofu init populates .terraform.lock.hcl with hashes for every supported platform out of the box, with no tofu providers lock invocation required. Users on older OpenTofu versions still get the same lock files when running through Terragrunt's provider cache server, but upgrading to 1.12 is the easiest way to get the same behavior everywhere, including when using the automatic provider cache dir.
🏎️ Performance Improvements
stack output fetches unit outputs in parallel
terragrunt stack output now fetches outputs from multiple units at the same time, which is noticeably faster on larger stacks. Use the existing --parallelism flag (or TG_PARALLELISM) to lower concurrency if you need to.
terragrunt stack output --parallelism 4
💡 Tips Added
Stack-target hint when --filter is missing | type=stack
run and stack generate now emit a tip when a --filter path resolves to a directory containing terragrunt.stack.hcl but the filter is not restricted to stacks. Without | type=stack, stack generate ignores the filter and run does not generate that stack.
The tip prints the offending filter, the suggested rewrite, and a link to the filter docs. Suppress it with --no-tip stack-target-missing-type-stack or --no-tips.
🐛 Bug Fixes
Auth provider command returning null no longer crashes Terragrunt
If the command configured via --auth-provider-cmd wrote the JSON value null to stdout, Terragrunt crashed with a nil pointer dereference before it could obtain credentials.
A null response is now treated as an empty response: no environment variables and no credentials are applied, and the run continues.
Auto-init now re-runs after a source change when modules are already cached
terragrunt plan/apply could fail with Error: Required plugins are not installed after a source-version change in any unit with a module "" block. The .terragrunt-init-required marker written on source change was being ignored because modulesNeedInit short-circuited as soon as .terraform/modules/ existed.
The marker check now lives at the top of needsInitRunCfg and is honored regardless of cached .terraform/modules/ contents.
Thanks to @arnaud-dezandee for contributing this fix!
--download-dir is now respected through dependency blocks and read_terragrunt_config
A custom download directory set via --download-dir (or TG_DOWNLOAD_DIR) was honored for the unit being run, but lost as soon as parsing crossed into another config. dependency blocks and read_terragrunt_config() would fall back to the dependency's local .terragrunt-cache next to its terragrunt.hcl, ignoring the user-set path.
TG_DOWNLOAD_DIR=/tmp/tg-cache terragrunt run --all plan
# Root unit: outputs landed i

🏎️ Performance Improvements
run_cmd and Git repo-root results memoized without the Provider Cache Server
Within a single command, repeated run_cmd(...) calls and repeated Git repo-root lookups across units used to share their cached results only when the Provider Cache Server was running. Commands invoked without --provider-cache (the common case for find, list, and run --all against estates that do not need provider caching) re-evaluated each run_cmd and re-shelled to git rev-parse --show-toplevel for every unit.
Both caches are now active for every command, so identical run_cmd arguments and repeated repo-root lookups are reused across units regardless of whether the Provider Cache Server is enabled.
fast-copy strict control
With the new fast-copy strict control enabled, Terragrunt compiles each include_in_copy and exclude_from_copy pattern once and evaluates it inline during a single copy walk. This avoids re-walking subdirectories for every pattern, which should result in noticeable speed improvements for large source modules.
terragrunt run plan --strict-control fast-copy
The new matcher does not collapse ** to zero path segments when a neighbor is a wildcard, so a/**/*.tf matches a/sub/main.tf but not a/main.tf. Patterns that relied on the old collapsing behavior should use brace alternation like {*.tf,**/*.tf} to cover both depths.
Fewer git rev-parse invocations on large estates
The get_repo_root() HCL function, the runner, and the find and list discovery commands all ask Git for the enclosing repository root. Previously, two units in the same repository each triggered their own git rev-parse --show-toplevel, even when the answer was identical. On large estates this added up to one fork per unit (and sometimes more) for a value that never changed.
A repository discovered for one working directory is now reused for any other working directory inside it, for the duration of the command. Nested repositories (a checkout vendored inside another) still resolve to their own root.
🐛 Bug Fixes
--auth-provider-cmd no longer runs once per dependency cache directory
Resolving dependency outputs ran the configured --auth-provider-cmd again from inside each .terragrunt-cache working directory, on top of the call already made for the unit.
Terragrunt now reuses the credentials already obtained for the dependency when reading outputs from a cached working directory, so --auth-provider-cmd is invoked once per dependency instead of twice.
Fixed exclude block being dropped when defined only in an included parent
A unit that pulled in an exclude block from an include that did not declare its own exclude block saw the include's exclude configurations ignored.
Included exclude blocks now get properly merged into unit configurations.
Reported in #5089. Thanks to @HeikoNeblung for contributing this fix!
Fixed terragrunt find --include failing on relative include paths
Running terragrunt find --include against units whose include blocks reference parent configs with relative paths (../root.hcl, ./common.hcl, bare filenames, etc.) emitted errors like Rel: can't make ../root.hcl relative to /abs/working-dir and dropped those entries from the output.
Relative include paths are now resolved against the unit's directory before being made relative to the working directory, matching how the rest of Terragrunt interprets the path attribute on an include block.
find and list no longer hard-fail when a path cannot be made relative to its base. The condition is logged as a warning and the path is emitted as-is, so output stays complete and the command exits zero.
Tolerate non-JSON warnings in tofu/terraform output -json
Resolving dependency outputs no longer fails when the underlying tofu/terraform output -json invocation prints a deprecation warning to stdout alongside the JSON payload. Terraform 1.15.0 introduced a backend deprecation warning for the S3 dynamodb_table parameter that is emitted on stdout after the JSON object, which broke parsing with

✨ New Features
--no-cas flag for disabling CAS per command
The new --no-cas flag disables the CAS for a single invocation, even when the cas experiment is enabled. It is available on run, stack generate, and stack run.
terragrunt stack generate --experiment cas --no-cas
This is useful when you want to fall back to the standard getter path without unwinding experiment configuration.
Generation and runs error when --no-cas is combined with update_source_with_cas = true on any reachable unit, stack, or terraform block, since relative sources in catalog repositories cannot be resolved without the CAS.
🐛 Bug Fixes
hcl fmt --diff no longer requires the diff binary
Previously, terragrunt hcl fmt --diff spawned a diff process discovered in $PATH to render its output. This made it incompatible with minimal container images and Windows installations where that binary was unavailable.
The flag now produces unified diff output without depending on any external binary.
Note that the output is not byte-identical to GNU diff -u. Each file diff is now preceded by a diff old/<path> new/<path> header line, and the ---/+++ lines no longer include a trailing timestamp. Scripts that parsed the previous output may need small adjustments.
Fixed crash when include and locals with read_terragrunt_config coexist
A unit that combined an include block with a locals block calling read_terragrunt_config(...) could crash during discovery, surfacing as a misleading Call to function "read_terragrunt_config" failed error pointed at the locals expression.
Discovery now reports the underlying error instead of crashing.
Reported in #5949.
Fixed crash when a root.hcl declares no remote_state block
A root.hcl that only declared locals (or otherwise omitted a remote_state block) could trigger a nil pointer dereference inside Terragrunt's remote-state initialization. Downstream tools that embed the Terragrunt config parser, such as terragrunt-ls, crashed on every such file.
A missing remote_state block now initializes an empty remote-state value instead of panicking, so parsing proceeds normally when no backend is configured.
Reported in terragrunt-ls#134.
Thanks to @SAY-5 for contributing this fix!
Fixed a race condition in terragrunt stack generate
Fixed a race condition in terragrunt stack generate that could produce non-deterministic file errors on nested stack hierarchies. The same stack file could reach the worker pool twice through different path forms and cause the duplicate writes to conflict with each other. Paths are now normalized before dispatch so each stack file is generated exactly once per invocation.
When a stack file is legitimately claimed by more than one parent during generation, Terragrunt now logs a warning that names the contending parents and records the latest claimant, so the configuration can be corrected before it causes silent overwrites.
Fixed data race in --version flag parsing under concurrent CLI invocations
When multiple Terragrunt CLI invocations ran concurrently in the same process, urfave/cli/v2's package-level VersionFlag singleton was mutated concurrently by each invocation's flag-parsing path, producing a WARNING: DATA RACE on shared flag state.
Terragrunt now sets cli.App.HideVersion = true at construction, which prevents urfave from auto-appending its shared VersionFlag into each App's flag set. The --version / -v flag is unchanged from the user's perspective — it is handled by Terragrunt's own flag registered in internal/cli/flags/global.NewHelpVersionFlags.
🧪 Experiments Added
mark-many-as-read — Mark many files as read in one step
Enable the new mark-many-as-read experiment to turn on two behaviors that each mark many files as read in a single call: automatic marking of files inside a local terraform { source = "..." } block, and the new mark_glob_as_read HCL function.
With the experiment on, a unit like this:
# live/unit/terragrunt.hcl
terraform {
source = "../../modules/service"
}
records every *.tf, *.tf.json, *.hcl

🐛 Bug Fixes
shared_credentials_files and other list/map backend config values were serialized incorrectly
Setting shared_credentials_files (or any other list-valued key) in the remote_state.config block produced a broken -backend-config argument:
-backend-config=shared_credentials_files=[/a/creds /b/creds]
OpenTofu and Terraform both failed to parse this. The same problem affected map-valued keys. Lists and maps are now written as single-line HCL (["/a/creds","/b/creds"] and {key="value"}), and strings inside them are quoted so embedded quotes, newlines, and tabs survive the round trip.
Thanks to @Rahul-Kumar-prog for contributing this fix!
Panic in get_repo_root() when OpenTelemetry tracing is enabled with TRACEPARENT
Running terragrunt stack generate (or any command that invoked shell commands like git rev-parse) with OpenTelemetry trace exporting enabled (TG_TELEMETRY_TRACE_EXPORTER=http) caused a nil pointer panic:
Call to function "get_repo_root" failed: panic in function implementation:
runtime error: invalid memory address or nil pointer dereference
The root cause of the panic was fixed, and telemetry codepaths have been hardened against future panics.
stack output now respects the exclude block
terragrunt stack output previously ignored the exclude block on units, attempting to fetch outputs (including directly from S3 state when using --dependency-fetch-output-from-state) for units that should have been excluded.
The fix uses Terragrunt discovery to identify excluded units before reading outputs. Excluded units are now omitted from the stack output entirely, consistent with how they are handled during stack run.
To exclude a unit from stack output, add "output" to the actions list in the exclude block:
exclude {
if = true
actions = ["plan", "apply", "destroy", "output"]
}
Special action values "all" and "all_except_output" are also supported.
🧪 Experiments Added
catalog-redesign — Reworked terragrunt catalog TUI
A new catalog-redesign experiment reworks the design of the terragrunt catalog TUI.
terragrunt catalog now launches the TUI right away and runs discovery in the background instead of waiting for discovery to complete before launching the TUI. As a consequence, terragrunt catalog users with large catalogs should see significant speed improvements as they launch the terragrunt catalog TUI.
Modules now stream into the list view of the catalog as they are discovered, so you'll be able to select and use a module even if your entire catalog hasn't been discovered yet.
If catalog.urls is not configured in root.hcl, terragrunt catalog no longer errors. A welcome screen explains how to populate the catalog and can open the catalog documentation on a keypress. In addition, terraform.source values from existing units are automatically included in the set of URLs used for discovery, so users with existing units get a populated catalog pointing to other modules that can be pulled from the same module source without any additional configuration.
This experiment is subject to change, and core elements of the design are being iterated on rapidly.
To try it out, run:
terragrunt catalog --experiment catalog-redesign
To learn more, see the experiment documentation.
🧪 Experiments Updated
stack-dependencies — Cross-stack dependency support and autoinclude improvements
The stack-dependencies experiment now supports cross-stack and nested-stack dependency patterns, expanding the autoinclude block capabilities in terragrunt.stack.hcl files.
New features:
- stack.<name>.path references for depending on an entire stack. The DAG expands the stack into its constituent units so that all units in the stack complete before the dependent unit runs
- stack.<name>.<unit_name>.path references for depending on a specific unit within a nested stack (fine-grained cross-stack dependencies)
- dependency blocks targeting stack directories — aggregated outputs from all units in the stack are accessible as dependency.stack_name.outputs.unit_name.out

🧪 Experiments Added
dag-queue-display — DAG tree visualization for the run queue
A new dag-queue-display experiment renders the run queue as a dependency tree instead of a flat list, making it easier to understand execution order and dependency relationships at a glance.
$ terragrunt run --all --experiment dag-queue-display -- plan
19:06:59.108 INFO The following units will be run, starting with dependencies and then their dependents:
.
├── monitoring
╰── vpc
╰── database
╰── backend-app
╰── frontend-app
To learn more, see the experiment documentation.
slow-task-reporting — Progress reporting for long-running operations
A new slow-task-reporting experiment displays animated progress spinners for operations that take longer than 1 second, such as source downloads, Git worktree creation, and catalog repository cloning. In non-interactive environments (CI/CD, piped output), spinners are replaced with periodic INFO log lines every 30 seconds to prevent CI systems from killing jobs due to output inactivity.
$ terragrunt run --all --experiment slow-task-reporting -- plan
INFO Downloading source from git::https://github.com/example/module.git...
INFO Downloaded source from git::https://github.com/example/module.git (3.2s)
To learn more, see the experiment documentation.
stack-dependencies — Dependency wiring between units in stacks
A new stack-dependencies experiment enables the autoinclude block in terragrunt.stack.hcl files, allowing units and stacks to define dependency relationships and arbitrary configuration overrides during stack generation. This implements RFC #5663.
unit "vpc" {
source = "../catalog/units/vpc"
path = "vpc"
}
unit "app" {
source = "../catalog/units/app"
path = "app"
autoinclude {
dependency "vpc" {
config_path = unit.vpc.path
}
inputs = {
vpc_id = dependency.vpc.outputs.vpc_id
}
}
}
terragrunt run --all --experiment stack-dependencies -- plan
To learn more, see the experiment documentation.
💡 Tip Added
Windows symlink warning for provider cache users
Terragrunt now warns Windows users when symlink creation fails and provider caching is enabled. OpenTofu and Terraform may silently fall back to copying provider plugins instead of symlinking, which can increase disk usage and slow down operations. For OpenTofu >= 1.12.0, the tip includes guidance on using TF_LOG=warn to detect the fallback.
Thank you to the OpenTofu team for introducing this warning to ensure that Windows users are aware of the fallback behavior.
🐛 Bug Fixes
hcl validate no longer fails on dependency.outputs references
terragrunt hcl validate previously failed with "Unsupported attribute" when a configuration referenced dependency.<name>.outputs.<key> without mock_outputs.
During validation, output resolution is skipped, but the outputs attribute was never added to the dependency evaluation context, causing any output reference to error. The fix provides a dynamic placeholder for dependency outputs (and inputs) during validation so that attribute access evaluates to unknown rather than failing. Additionally, the dependency resolution pipeline is now more resilient during validation. Dependencies with unresolvable config_path values or nonexistent targets no longer cause the entire dependency namespace to disappear from the evaluation context.
Destroy queue now displays units in correct order
Previously, the run queue display showed units in apply order even for destroy commands. The queue now correctly shows dependents before their dependencies when running destroy, matching the actual execution order.
Dependent discovery fixed in worktrees
Dependents are now correctly discovered when units are discovered in worktrees. Previously, dependent discovery could fail to find related units when operating within a git worktree.
Filter exclusions now respected in worktree sub-discoveries
Negated filters (e.g., !./catalog/** from .terragrunt-filters or --filter) are now propagated to worktree sub-discoveries used by git-based filtering (--filter-affect

🎉 v1.0.0 Release
Terragrunt is now v1!
This means that Terragrunt will no longer have any breaking changes in minor releases, with all future breaking changes taking place in (infrequent) future major releases.
For a list of guarantees that will be observed by maintainers for the duration of Terragrunt 1.0, see the Terragrunt 1.0 Guarantees page in the docs.
🛠️ Breaking Changes
Consistent .terragrunt-cache directory generation
Terragrunt now creates a .terragrunt-cache directory for every run, regardless of whether the terragrunt.hcl file defines a terraform block with a source attribute.
This change improves consistency across all Terragrunt executions, as OpenTofu/Terraform will now always run within the .terragrunt-cache directory. This standardized behavior simplifies troubleshooting and makes the execution model more predictable.
Removal of tflint
Terragrunt has been shipping with a version of tflint compiled into the binary to allow for more convenient usage without installing tflint directly. However due to the adoption of a BUSL license in tflint, the version included in Terragrunt was frozen.
The dependency on tflint is now fully removed from Terragrunt. If you want to call tflint using a before_hook using Terragrunt, you will have to have tflint installed locally to do so.
To reduce the burden of this breaking change, Terragrunt will continue to provide conveniences like automatically running tflint init on behalf of users, although it no longer ships with a compiled version of tflint in the terragrunt binary.
To learn more, read the documentation on the integration with tflint.
Discovery commands discover hidden configurations by default
The find and list commands now discover units/stacks in hidden directories by default (this previously required usage of the --hidden flag), notably this now discovers .terragrunt-stack directories by default. The commands also now support an opt-in --no-hidden flag to avoid discovery in hidden directories.
The --hidden flag has been deprecated, and will not be removed in 1.0. Using the flag no longer does anything.
render --format=json no longer discovers dependents by default
Prior to this release, the render --format=json command would automatically start to perform dependent discovery on other units related to the unit being rendered. Avoiding this required usage of the --disable-dependent-modules flag. That behavior has been removed. HCL and JSON rendering of unit configurations will now proceed without the additional overhead of dependent discovery by default.
This functionality is better served by a combination of find and graph-based filters.
e.g. If you want to detect all the dependents of a given unit foo, expecting to find the dependent unit bar you can run the following:
$ terragrunt find --filter '...^foo'
bar
If you aren't familiar with filters, this reads as "find all dependents of foo, not foo itself"
Windows compatibility in file paths improved
All HCL functions now return operating system native file paths without forward slash normalization.
- get_terragrunt_dir()
- get_original_terragrunt_dir()
- get_parent_terragrunt_dir()
- get_path_from_repo_root()
- get_path_to_repo_root()
- find_in_parent_folders()
- path_relative_to_include()
- path_relative_from_include()
If you and your team do not work in Windows environments, you are unlikely to see any change as a consequence of this. If you do use Terragrunt in a Windows environment, Terragrunt will now return appropriate Windows file paths, with backslashes as file path separators instead of Unix-like forward slashes.
If you need to normalize paths, you can use the replace function to achieve this.
# root.hcl
remote_state {
backend = "s3"
generate = {
path = "backend.tf"
if_exists = "overwrite_terragrunt"
}
config = {
bucket = "my-tofu-state"
key = "${replace(path_relative_to_include(), "\\", "/")}/tofu.tfstate"
region = "us-east-1"
encrypt = true
dynamodb_table = "my-lock-table"
}
}
Ambiguous unit/stack components

🐛 Bug Fixes
--working-dir interaction with exit codes fixed
A bug in the logic for tracking exit codes for plan -detailed-exitcode when users supply the --working-dir flag has been fixed.
Authentication during queue construction fixed
A bug in the logic for parsing configurations during discovery for use-cases like --filter 'reading=*' where configurations need to be parsed to determine whether or not they end up in the final run queue has been fixed. Configurations will now properly call any configured --auth-provider-cmd authenticator before parsing configurations, preventing errors for HCL functions like sops_decrypt_file that require authentication.
What's Changed
- chore: Backporting #5590 by @yhakbar in #5593
- chore: Backporting #5722 by @yhakbar in #5731
Full Changelog: v0.99.4...v0.99.5

🏎️ Performance Improvements
Discovery performance improved
The way in which Terragrunt discovers and filters units and stacks for runs has improved significantly.
Screenshot 2026-02-17 at 17 43 55 Screenshot 2026-02-17 at 17 44 29 Screenshot 2026-02-17 at 17 44 48
Terragrunt is now better at avoiding parsing units/stacks unnecessarily, based on the filter you use. Previously, the logic used was more coarse, and could result in a requirement to parse some configurations (e.g. presence of a dependency graph expression to result in parsing all configurations. Discovery has been refactored to allow for much more careful opt-in parsing based on the need to support the filter used by users (or lack thereof).
This will also result in improvements to Terragrunt’s ability to ignore broken parts of infrastructure estates when Terragrunt can predictably determine that it won’t impact a run.
🐛 Bug Fixes
Invalid unit configurations cause explicit errors instead of silently being excluded during runs
A bug in discovery logic resulted in units with invalid HCL configurations being silently excluded from runs with a warning. This bug has been fixed, and attempting to parse invalid HCL configurations during a run will result in an error.
What's Changed
- chore: Backporting #5477 by @yhakbar in #5567
Full Changelog: v0.99.3...v0.99.4

🐛 Bug Fixes
Over-warning on strict controls prevented
Using --strict-mode resulted in over-warning on completed controls. Those warnings will no longer appear when using strict mode.
What's Changed
- chore: Backport #5501 by @yhakbar in #5566
Full Changelog: v0.99.2...v0.99.3

🐛 Bug Fixes
Interrupt signal propagation to OpenTofu/Terraform fixed
The mechanism by which Terragrunt sends interrupt signals to OpenTofu/Terraform processes it started has been made more robust. Terragrunt will now send the interrupt signal in the event that a user explicitly sends an interrupt signal to Terragrunt in addition to scenarios where Terragrunt’s context cancellation is triggered (e.g. in the event of a timeout).
SOPS decryption race condition fixed
A race condition in the concurrent access to SOPS decrypted secrets in different environments combined with usage of the --auth-provider-cmd flag resulted in authentication failures. Synchronization controls have been introduced to ensure authentication proceeds correctly for each environment independently.
What's Changed
- chore: Backporting #5518 to v0.99 by @yhakbar in #5547
- chore: SOPS decode improvements by @denis256 in #5549
Full Changelog: v0.99.1...v0.99.2

🐛 Bug Fixes
Pass through null inputs
Fixes a bug where null inputs weren't being passed through correctly to OpenTofu/Terraform.
What's Changed
- fix: Backport null input passing fix by @yhakbar in #5458
Full Changelog: v0.99.0...v0.99.1

🛠️ Breaking Changes
Undocumented behavior removed
We have removed several undocumented features that served as temporary stop-gaps to facilitate experimentation.
The following environment variables no longer affect Terragrunt behavior:
- TERRAGRUNT_TEMP_QUOTE_NULL
- TMP_UNDOCUMENTED_REPORT_PADDER
- TMP_UNDOCUMENTED_REPORT_UNIT_COLORIZE
- TMP_UNDOCUMENTED_COLORIZE_DEFAULT_SUMMARY_PADDING
Internal tflint deprecated
Terragrunt has been shipping with a version of tflint compiled into the binary to allow for more convenient usage without installing tflint directly. However due to the adoption of a BUSL license in tflint, the version included in Terragrunt was frozen.
We have now deprecated use of the internal tflint hook, and will be fully removing it in the future. We still do work to integrate with tflint; Including automatically running tflint init and passing through variables. For now using the internal version will only emit a warning, and you can opt in to the future behavior today in one of two ways:
- The legacy-internal-tflint strict control (recommended)
- Adding the --terragrunt-external-tflint flag to your hook usage (this also works in previous versions of Terragrunt); this flag is stripped prior to running the external tflint. Example:
terraform {
before_hook "tflint" {
commands = ["apply", "plan"]
execute = ["tflint", "--terragrunt-external-tflint", "--minimum-failure-severity=error", "--config", "custom.tflint.hcl"]
}
}
✨ New Features
Depth control for dependency traversal
Graph-based expressions in the --filter flag now support limiting the depth of graph traversal they perform when discovering units. You can now append/prepend a number to the end of a graph expression ellipsis to control how deep in graph traversal Terragrunt will look for dependents/dependencies.
e.g.
# Find 'service' and only its direct dependencies (1 level deep)
terragrunt find --filter 'service...1'
# Find 'vpc' and only components that directly depend on it (1 level)
terragrunt find --filter '1...vpc'
# Find 'db' with 2 levels of dependencies and 1 level of dependents
terragrunt find --filter '1...db...2'
This should result in significant performance and usability improvements for users with large dependency graphs.
Special thanks to @sofianedjerbi for contributing this feature!
Run report schema extended
The run report has been extended to include the Ref, Cmd and Args fields when relevant to a run.
- The Ref field will be populated for runs performed in Git worktrees due to their discovery from a Git-based expression in a filter.
- The Cmd field will contain the sub command of OpenTofu/Terraform executed in a run (e.g. plan , apply) and the Args field will contain the arguments passed to that subcommand (e.g. -auto-approve, -destroy). These can differ between runs when using Git-based expressions, as additions or modifications of units between Git references can result in a plan or apply, whereas removal of units can result in plan -destroy or apply -destroy .
🧪 Experiments Updated
IaC Engines Updated to use v0.1.0 of terragrunt-engine-go
The iac-engine experiment has been updated to use v0.1.0 of the terragrunt-engine-go library.
Given that this is still experimental functionality, no effort has been made to maintain backwards compatibility with existing engines. If you are currently using the OpenTofu engine, you will need to upgrade to v0.1.0 of the engine. The Terraform engine will be updated in the near future.
This update pulls in changes to the protobuf schema used in communication between Terragrunt and IaC engines to give engines the ability to log messages in Terragrunt and reduces the overall size of messages passed to Terragrunt for stdout/stderr messages.
⚙️ Process Updates
Curl to Bash script available
In addition to all the other installation mechanisms available to install Terragrunt, a convenient curl to bash script has been added to minimize the friction in installing and getting started with Terragrunt, and removing a

✨ New Features
The --filter flag now implies --all
When using the --filter flag, it is now optional to also supply --all. Terragrunt will automatically set the --all flag when you use the --filter flag.
🐛 Bug Fixes
Plan files are now correctly passed as CLI arguments for destroy operations
A bug in the logic used for injecting plan files as arguments to the apply -destroy command resulted in the plan file argument being injected prior to the -auto-approve flag, which is disallowed in OpenTofu/Terraform. That bug has been fixed.
GCS bootstrap authentication fixed
A bug in the authentication logic for GCS backends prevented successful bootstrapping of backends when using the --auth-provider-cmd flag. That bug has been fixed.
Git-based and Graph-based combinations fixed
A bug in the discovery logic for Git worktrees prevented using a combination of Git-based and Graph-based filter expressions in the same filter from working correctly.
e.g.
terragrunt find --filter '...^[HEAD^...HEAD]...'
That bug has been fixed.
Proper exit codes returned from -detailed-exitcode
A bug in the logic for handling retries combined with the OpenTofu/Terraform plan -detailed-exitcode and the Terragrunt --all flag resulted in the wrong exit code being returned when a failed run succeeded on a subsequent retry with a status code related to drift (exit code 2).
That logic has been corrected, and properly follows the rules outlined under the --all flag:
When not using -detailed-exitcode:
- Terragrunt will return the highest exit code of all runs performed.
When using -detailed-exitcode:
- If any run has an exit code that is 1, or greater than 2, run --all will return the highest exit code.
- Otherwise, if any run returns an exit code of 2, run --all will return an exit code of 2.
- Otherwise, run --all will return an exit code of 0.
OpenTelemetry traces in console mode fixed
A bug in OpenTelemetry trace exporting prevented traces from being exported when in console mode. That bug has been fixed.
Negation logic fixed
A bug in how negation logic was handled in filter expressions prevented successful exclusion of stacks from generation and over excluded units in runs when users only supplied negative filters.
⚙️ Process Improvements
GPG Signing
Release artifacts are now signed using both GPG and Cosign.
To start performing signature validation on assets, in addition to the asset you’re downloading from the GitHub releases page, you’ll want to download some of the following files:
VERSION="v0.XX.X" # Replace with actual version of Terragrunt you are installing
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS"
# For GPG:
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS.gpgsig"
# For Cosign:
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS.sig"
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS.pem"
To verify with GPG:
curl -s https://gruntwork.io/.well-known/pgp-key.txt | gpg --import
gpg --verify SHA256SUMS.gpgsig SHA256SUMS
sha256sum -c SHA256SUMS --ignore-missing
To verify with Cosign:
cosign verify-blob SHA256SUMS \
--signature SHA256SUMS.sig \
--certificate SHA256SUMS.pem \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
--certificate-identity-regexp "github.com/gruntwork-io/terragrunt"
sha256sum -c SHA256SUMS --ignore-missing
Terragrunt installation documentation will be updated soon to recommend this on every installation, the Gruntwork maintained asdf plugin will be updated to do this automatically, and all Gruntwork recommended mechanisms for installing Terragrunt will support this going forward.
Upgrade to Go 1.25.5
The Golang toolchain used to build Terragrunt has been upgraded to v1.25.5.
Package reorganization
All top-level Golang packages in the Terragrunt project have been migrated to either internal or pkg. The distinction between the two indicates m

🏎️ Performance Improvements
Partial parse used for get_working_dir()
To assess where Terragrunt is going to run OpenTofu, it needs partially parsed information from the relevant terragrunt.hcl file of the unit running the HCL get_working_dir() function. The function was performing a full parse of the terragrunt.hcl file, which can be slow for users with large HCL configurations.
Given that the parse only requires access to the value of source in the terraform block, a partial parse is now performed by the function, only looking at the contents of the terraform block, improving performance significantly.
🐛 Bug Fixes
False positive parsing errors suppressed
When parsing an include that defined dependencies, the HCL parser used by Terragrunt would emit spurious errors that are internally ignored. Those messages are now suppressed.
Signal propagation for interrupts fixed
A bug in how Terragrunt forwarded signals to processes it spawned (like running tofu) resulted in underlying processes receiving SIGKILL signals rather than the original signal (e.g. SIGINT) sent to the Terragrunt process. That has been fixed.
🧹 Chores
Avoiding contextcheck suppression
While not changing much functionally in Terragrunt, this release did involve quite a lot of changes to Terragrunt internals. The majority of these changes related to better propagation of the Golang [context](https://pkg.go.dev/context) object to better obey Golang best practices. These issues were reported by the contextcheck linter in the codebase, but the findings were suppressed due to the scope of work required to address them.
These changes should make it so that context is propagated correctly more reliably in the codebase, increasing the usefulness of things like OpenTelemetry tracing and reduced resource usage.
Note that some public function signatures have changed in the Terragrunt codebase, which may be a breaking change to users consuming Terragrunt as a library. Given that we do not offer any stability guarantees for usage of Terragrunt as a library, these changes are still to be included in a patch release.
What's Changed
- perf: Using a partial parse for get_working_dir() by @yhakbar in #5318
- fix: false positive parsing errors by @denis256 in #5258
- fix: Fixing signal propagation issues by @yhakbar in #5326
- fix: Locking during run ensure calls by @yhakbar in #5312
- chore: Avoiding contextcheck suppression by @yhakbar in #5320
- chore: Fixing flaky tests by @yhakbar in #5316
- chore: Adding flake utility by @yhakbar in #5311
- chore: Cleaning up HCL fn spans by @yhakbar in #5315
- build(deps): bump github.com/cloudflare/circl from 1.3.3 to 1.6.1 in /test/flake by @dependabot[bot] in #5324
- build(deps): bump golang.org/x/oauth2 from 0.25.0 to 0.27.0 in /test/flake by @dependabot[bot] in #5323
- build(deps): bump golang.org/x/crypto from 0.7.0 to 0.45.0 in /test/flake by @dependabot[bot] in #5322
Full Changelog: v0.97.1...v0.97.2

✨ New Features
All HCL functions instrumented with OpenTelemetry
All Terragrunt HCL functions are now instrumented to emit telemetry when they run, giving more insight into HCL function performance, and usage.
HCL parsing telemetry improved
Additional fidelity has been added to traces emitted during parsing to give insight as to why configuration parsing is being performed, and how.
🐛 Bug Fixes
plan -destroy called correctly for --filter-affected
A bug in the logic for --filter-affected resulted in removed units getting planned/applied instead of being destroyed when users supplied --filter-allow-destroy. That bug has been fixed.
Nested spans in track parents appropriately even when the TRACEPARENT environment variable is used.
A bug in the logic for propagating TRACEPARENT as the ultimate parent of traces started in Terragrunt prevented child traces from properly tracking parent spans. That bug has been fixed.
Reports on runs in worktrees now use relative directories to worktree root
Instead of displaying runs of units in Git worktrees during Git-based filter expression runs with the absolute path of their directories in a temporary directory, they now display with the path to the unit relative to the root of the worktree.
Unnecessary relationship discovery prevented
Discovery of relationships between units has been made opt-in in the discovery process. This will result in no changes to usage of commands like run --all, but will significantly improve the performance of commands like list and stack generate.
What's Changed
- feat: Adding spans for HCL functions by @yhakbar in #5306
- feat: Increasing volume and fidelity of config parse telemetry by @yhakbar in #5309
- fix: Fixing nested spans by @yhakbar in #5305
- fix: Fixing plan -destroy for --filter-affected by @yhakbar in #5295
- fix: Fixing worktree reports by @yhakbar in #5308
- fix: Avoiding unnecessary relationship discovery by @yhakbar in #5313
- chore: Dropping usage of MapToSlice and StringListInsert by @yhakbar in #5297
- docs: Adding ambassadors by @karlcarstensen in #5296
- docs: Ambassador Lorelei by @karlcarstensen in #5302
Full Changelog: v0.97.0...v0.97.1

⚒️ Breaking Changes
The --queue-strict-include flag is deprecated
Terragrunt no longer automatically includes dependencies of included units. As such the --queue-strict-include flag is no longer useful in the Terragrunt CLI.
The flag has been deprecated, and no longer does anything. This flag will not be removed before 2.0.
Run report no longer reports --queue-exclude-dir as a reason for exclusion
Run reports no longer report on units excluded from runs as a consequence of the --queue-exclude-dir flag.
The --units-that-include flag is deprecated
The --units-that-include flag is now an alias for the reading= attribute filter, just like the --queue-include-units-reading flag.
Given that the two flags no longer differ in functionality, and that the functionality of the --units-that-include is no longer strictly including units that are included, the flag has been deprecated.
The double-star strict control is complete
The globbing behavior of Terragrunt in CLI flags has been updated to match all paths when ending with a trailing ** .
🧪 Experiments Completed
The filter-flag experiment is completed
The filter-flag experiment is completed, and the --filter flag is now generally available.
You can use filter expressions as a single unified API for controlling the Run Queue, replacing the need to use the following CLI flags:
──────────────────────────────────────┬──────────────────────────────
Legacy —queue flag │Equivalent —filter expression
──────────────────────────────────────┼──────────────────────────────
—-queue-include-dir=path │—-filter='{./path}'
──────────────────────────────────────┼──────────────────────────────
—-queue-exclude-dir=path │—-filter='!{./path}'
──────────────────────────────────────┼──────────────────────────────
--queue-include-units-reading=root.hcl│--filter='reading=root.hcl'
──────────────────────────────────────┼──────────────────────────────
--units-that-include=root.hcl │--filter='reading=root.hcl'
──────────────────────────────────────┼──────────────────────────────
--queue-include-external-dependencies │--filter='{./**}...'
──────────────────────────────────────┼──────────────────────────────
--queue-excludes-file=excludes.txt │--filters-file='filters.txt' *
──────────────────────────────────────┼──────────────────────────────
--graph │--filter='...{.}'
──────────────────────────────────────┴──────────────────────────────
- Note that the file used for the --queue-excludes-file does not directly translate to the kind of file you can use for a --filters-file. To learn more, see the documentation.
The table above also explains the aliasing that has been done internally to replace queue flags with their filter equivalents. The aliasing for these queue flags is present purely for backwards compatibility purposes, but they are not going to emit deprecation warnings, and will not be removed before the Terragrunt 1.0 release.
You are heavily encouraged to adopt the new --filter flag for your infrastructure targeting needs as soon as feasible in your workflows. It will offer a significantly more flexible and powerful experience.
To learn more see the Filters feature documentation.
🐛 Bug Fixes
The get_original_terragrunt_dir() function is now supported in terragrunt.stack.hcl files
When authoring explicit stacks, using the get_original_terragrunt_dir() HCL function in terragrunt.stack.hcl files will now return the directory where the terragrunt.stack.hcl file lives, even when the configuration is read from another stack/unit using read_terragrunt_config().
Using Git-based expressions with the --out-dir flag is fixed
When using Git-based expressions using the --filter flag, the relative path of units relative to their respective Git worktree roots is used for determining where the plan file will be saved, rather than a path in the relevant Git worktree.
Color for output fetching is suppressed more reliably
Terragrunt will use tofu output -json / terraform output -json more reliably when users expect a lack of

🧪 Experiments Updated
The --filter-affected flag has more robust determination of the default branch in a Git repository
The --filter-affected flag will now use Git plumbing to interrogate the default branch as considered by the remote repository before falling back to interrogating local configurations for determination of a default branch (remember that you must use the filter-flag experiment to try this out).
# This is checked first
$ git rev-parse --abbrev-ref origin/HEAD
# Followed by this
$ git ls-remote --symref origin HEAD
# Followed with this
$ git config init.defaultBranch
# If none of the above succeed, the default branch is assumed to be `main`.
Git-based filter expressions now warn users when using local state
Usage of --filter Git-based expressions in combination with local state will now emit a warning, recommending usage of remote states (remember that you must use the filter-flag experiment to try this out).
$ terragrunt run --all --filter '[HEAD~1...HEAD]' -- plan
09:30:38.017 WARN One or more units discovered using Git-based filter expressions (e.g. [HEAD~1...HEAD]) do not have a remote_state configuration. This may result in unexpected outcomes, such as outputs for dependencies returning empty. It is strongly recommended to use remote state when working with Git-based filter expressions.
See the warning at the bottom of Git-based expressions documentation for more information.
OpenTelemetry traces added for filter evaluation
Filter evaluation now emits OpenTelemetry spans and metrics, including filter resolution details, evaluation duration, and filtering scope. This helps teams analyze performance and pinpoint bottlenecks in filtering with large Terragrunt repositories.
filter-otel-traces
🐛 Bug Fixes
Path-based filters targeting external paths fixed
A bug in the parsing of path-based filter expressions in the --filter flag of the filter-flag experiment prevented parsing of path-based filters for external paths (e.g. --filter ../external-dir). This bug has been fixed.
HTTPS Git CAS URLs fixed
A bug in the parsing of source URLs with forced usage of the Git protocol (e.g. git::https://github.com/acme/catalog) prevented using the cas experiment with HTTPS Git URLs with forced usage of the Git protocol. This bug has been fixed.
Regression of support for root terragrunt.hcl fixed
A bug in the processing of --queue-exclude-dir resulted in prefix based matching of non-glob expressions in --queue-exclude-dir values. This broke backwards compatibility for users with a root terragrunt.hcl file instead of a differently named file for the root include (e.g. root.hcl). This bug has been fixed.
Note that you are still advised to migrate away from using a root terragrunt.hcl as soon as possible for your team. We will maintain backwards compatibility until at least 2.0, however.
What's Changed
- feat: add opentelemtry integration in filter flag by @denis256 in #5247
- feat: Adding warnings for local state usage with Git-based expressions by @yhakbar in #5245
- feat: Use more robust default branch detection in Git-based expressions by @yhakbar in #5243
- fix: Fixing parsing of external filters by @yhakbar in #5238
- fix: Fixing HTTPS CAS URLs by @yhakbar in #5240
- fix: Fixing warnings for how to reproduce tofu runs by @yhakbar in #5246
- fix: Fixing regression with support for include of root terragrunt.hcl by @yhakbar in #5249
- chore: Verify --queue-include-external isn't necessary when using the --filter flag by @yhakbar in #5216
- chore: Verify --filter results in minimal parsing by @yhakbar in #5229
- chore: Dropping util.JoinPath by @yhakbar in #5219
- docs: Cleaning up some docs by @yhakbar in #5239
Full Changelog: v0.96.0...v0.96.1

🛠️ Breaking Changes
The --no-destroy-dependencies-check flag has been deprecated
The default behavior of Terragrunt with respect to checking dependents during destroys has been inverted. As a consequence the --no-destroy-dependencies-check has been deprecated, and a new --destroy-dependencies-check flag has been introduced.
Previously, Terragrunt would automatically parse all configurations that might depend on a unit being destroyed to warn users that the destroyed configuration might orphan other units that depend on it. This was frequently undesirable behavior due to the fact that it introduced additional unnecessary work (parsing all HCL configurations unnecessarily), and could introduce errors if users had unrelated invalid HCL configurations.
Terragrunt now requires that users opt-in to this behavior via the new --destroy-dependencies-check flag, which enables the destroy check, and will not perform the destroy check by default.
terragrunt run --destroy-dependencies-check -- destroy
To learn more, see the no-destroy-dependencies-check strict control.
The --disable-command-validation flag has been deprecated
Terragrunt no longer performs command name validation when passing commands to OpenTofu/Terraform from Terragrunt when using the run command. This makes the --disable-command-validation flag unnecessary, as the lack of validation is now the default behavior.
Previously, Terragrunt had no way to explicitly indicate that a command being used on the Terragrunt CLI was intended as a passthrough to the OpenTofu/Terraform CLI, so it was important that validation be done on the command being supplied on the Terragrunt CLI.
Since completion of the CLI Redesign, this has changed significantly. Users now have explicit shortcuts on the Terragrunt CLI for common OpenTofu/Terraform commands and an explicit interface for passing through OpenTofu/Terraform commands to the OpenTofu/Terraform CLIs using the run command. By removing this validation, Terragrunt will now automatically support new OpenTofu/Terraform commands in future versions of the tools and allow for greater flexibility in IaC Engines, as novel commands can be introduced.
To learn more, see the disable-command-validation strict control.
The --experimental-engine flag now enables the iac-engine experiment
The experimental IaC Engine feature was introduced in Terragrunt prior to the introduction of the experiment system. As such, it wasn’t enabled when users enabled experiment mode, and didn’t have a dedicated section in the experiments docs.
The --experimental-engine flag is now an alias for explicitly enabling the iac-engine experiment, and using IaC Engines will be allowed when using Terragrunt in experiment mode. This increases consistency with how experimental features are managed in Terragrunt, and reduces the surface area users have to be aware of in the Terragrunt CLI.
terragrunt run --experiment=iac-engine
Note that you can explicitly disable usage of engines now with the --no-engine flag, even when the experiment is active.
terragrunt run --experiment=iac-engine --no-engine
To learn more, see the iac-engine experiment.
The --dependency-fetch-output-from-state flag now enables the dependency-fetch-output-from-state experiment
The experimental —dependency-fetch-output-from-state flag was introduced in Terragrunt prior to the introduction of the experiment system. As such, it wasn’t enabled when users enabled experiment mode, and didn’t have a dedicated section in the experiments docs.
The --dependency-fetch-output-from-state flag is now an alias for explicitly enabling the dependency-fetch-output-from-state experiment, and Terragrunt will automatically attempt to fetch outputs from backend state when in experiment mode. This increases consistency with how experimental features are managed in Terragrunt, and reduces the surface area users have to be aware of in the Terragrunt CLI.
terragrunt run --experiment=dependency-fetch-output-from-state
Note that you can ex

🧪 Experiments Updated
The filter-flag experiment now supports the --filter-affected flag
The --filter-affected flag has been introduced as an convenience alias for --filter [main...HEAD] (remember that you must use the filter-flag experiment to try this).
terragrunt find --filter-affected
Note that if you have local Git configurations that results in a different branch being your default branch, that branch will be used instead of main.
🐛 Bug Fixes
Integration of --queue-strict-include with --queue-include-units-reading fixed
A regression in --queue-strict-include resulted in empty run queues when using a combination of --queue-strict-include with --queue-include-units-reading. That bug has been resolved.
Integration of --source with run --all fixed
A regression in --source prevented it from working correctly in combination with run --all , resulting in empty run queues. That bug has been resolved.
Integration of Git-expressions with explicit stacks
A bug in the implementation of explicit stack generation for Git-expressions prevented stacks from being generated in Git worktrees when using Git-expressions in the filter-flag experiment. That bug has been resolved.
🧹 Chores
Dependencies updates
- cloud.google.com/go/storage —> v1.58.0
- github.com/aws/aws-sdk-go-v2 —> v1.41.0
- github.com/hashicorp/go-version —> v1.8.0
- github.com/aws/smithy-go —> v1.24.0
What's Changed
- feat: Adding --filter-affected flag by @yhakbar in #5109
- fix: Cleaning up TestExcludeDirs tests by @yhakbar in #5215
- fix: worktree tests simplification by @denis256 in #5217
- chore: Re-enabling TestAwsDocsTerralithToTerragruntGuide test by @yhakbar in #5220
- fix: Fixing integration of run --all with --source by @yhakbar in #5209
- fix: Fixing Git expressions with explicit stacks by @yhakbar in #5223
- fix: Fixing --queue-strict-include integration with --queue-include-units-reading by @yhakbar in #5222
- fix: improved dependency config path validation by @denis256 in #5212
- docs: Documenting --filter-affected by @yhakbar in #5110
- docs: Fixing Git-based docs by @yhakbar in #5218
- chore: go cloud dependencies update by @denis256 in #5183
Full Changelog: v0.95.0...v0.95.1

🛠️ Breaking Changes
The --queue-exclude-external flag has been deprecated
Previously, Terragrunt would automatically pull in external dependencies (dependencies outside the current working directory when running terragrunt run --all) into the run queue.
To prevent this behavior, users had to manually supply the --queue-exclude-external flag. This has caused significant confusion and unexpected behavior for users over the duration of it’s existence in the Terragrunt CLI. To prevent this unexpected behavior for users and follow the principle of least surprise, this flag has been deprecated and its behavior is now the default in Terragrunt.
To explicitly request inclusion of external dependencies in the run queue, use the —queue-include-external flag.
⚙️ Process Updates
OpenTofu 1.11.x added to compatibility matrix
We are now continuously testing against OpenTofu 1.11.1 in our Continuous Integration testing, and have updated the compatibility matrix to reflect that.
🧪 Updated Experiments
The filter-flag experiment now supports Git-based expressions
The --filter flag can now be used to filter units based on changes in Git history (remember that you must use the filter-flag experiment to try this).
# Compare between two references
terragrunt find --filter '[main...HEAD]'
# Shorthand: compare reference to HEAD
terragrunt find --filter '[main]'
# Compare between specific commits
terragrunt find --filter '[abc123...def456]'
# Compare between tags
terragrunt find --filter '[v1.0.0...v2.0.0]'
# Compare using relative references
terragrunt find --filter '[HEAD~1...HEAD]'
# Compare between branches
terragrunt find --filter '[feature-branch...main]'
For more information, see the dedicated documentation on Git-Based Filtering.
🐛 Bug Fixes
Units now properly flush stdout in run --all
A regression in unit stdout flushing caused stdout for unit logs to hang pending resolution of run --all runs. This regression has been fixed to ensure that logs are streamed in real time again.
Queue entries now properly run, even if dependent units are excluded
A bug in run queue optimization made it so that excluding the dependent of a unit within a multi-unit run queue would incorrectly exclude the dependency unit from the run queue. This bug has been resolved, and units are now properly included, even if their dependents are excluded.
Provider cache server only contacts relevant registries
The provider cache server was incorrectly establishing a connection with multiple registries even though only one registry for a given IaC tool run by Terragrunt. For users with network-restricted environments, this could cause problems. Terragrunt will now only contact the relevant registry for a given IaC tool unless users explicitly request for usage of multiple registries.
📖 Documentation Updates
Provider cache server no longer documented as experimental
The Provider Cache Server has been used in production by a good portion of the Terragrunt community based on voluntary community reporting. The need for the feature is also mitigated by advances in OpenTofu that makes the Automatic Provider Cache Dir the default solution all Terragrunt users using OpenTofu ≥ v1.10.0.
As such, the Provider Cache Server has been promoted to a generally available feature that is exclusively opt-in for users that cannot benefit from the Automatic Provider Cache Dir feature, or are better served by the Provider Cache Server due to scale or platform limitations.
What's Changed
- feat: Adding --filter Git support by @denis256 in #5166
- feat: Adding --filter-allow-destroy flag by @yhakbar in #5210
- fix: filter git improvements by @denis256 in #5184
- fix: Remove outdated Bun/Node locking by @yhakbar in #5186
- fix: unit output flushing by @denis256 in #5193
- fix: Only call necessary registries based on OpenTofu/Terraform usage by @yhakbar in #5196
- fix: Ensure queue entries are still marked as ready if they have dependencies/dependents that are excluded by @yhakbar in #5194
- fix: Tem

✨ Features
- Terraform 1.14: We are now testing Terragrunt against Terraform 1.14 and is confirmed to be working.
NOTE: Although this release is marked as backward incompatible, it is functionally compatible as nothing has been changed in Terragrunt internals. The minor version release is useful to mark the change in Terraform version that is being tested.
What's Changed
- chore: add support for Terraform 1.14 by @denis256 in #5180
- feat: use common logic for discovery and runner pool by @denis256 in #5100
Full Changelog: v0.93.13...v0.94.0

🐛 Bug Fixes
Catalog module source URL construction
Fixed malformed version-pinned catalog module URLs where TerraformSourcePath() incorrectly placed //moduleDir after ?ref=, ensuring correct root and submodule URL formatting.
What's Changed
- fix(catalog): build valid module source URLs for version-pinned modules by @rvelichkov in #5174
- docs: add two additional ambassadors by @karlcarstensen in #5164
Full Changelog: v0.93.12...v0.93.13

🐛 Bug Fixes
False positive errors during dependent units discovery
Reduced false-positive log messages emitted while discovering dependent units during destroy operations.
What's Changed
- Terragrunt Ambassadors by @karlcarstensen in #5138
- Adding Terragrunt Scale FAQ by @karlcarstensen in #5147
- chore: cloud dependencies update by @denis256 in #5150
- fix: false positive errors during dependent units discovery by @denis256 in #5137
Full Changelog: v0.93.11...v0.93.12

🐛 Bug Fixes
Stack files matching
Fixed stack detection so only files whose base name exactly matches the default stack name are treated as stack files.
What's Changed
- fix: exact matching of stack files by @denis256 in #5129
Full Changelog: v0.93.10...v0.93.11

🐛 Bug Fixes
Handling of disabled units in discovery
Discovery now skips units that are marked as disabled.
What's Changed
- fix: Avoid discovering dependencies if they are disabled by @yhakbar in #5119
- build(deps): bump js-yaml in /docs-starlight by @dependabot[bot] in #5117
- docs: Documenting how CAS works by @yhakbar in #5115
Full Changelog: v0.93.9...v0.93.10

✨ New Features
Added support for Openbao encryption provider
Key provider now supports openbao
🐛 Bug Fixes
Fixed error in calling sensitive() function in HCL
HCL sensitive() function now correctly handles values and calls without errors.
What's Changed
- feat: Added support for Openbao as an encryption provider by @ThisGuyCodes in #5048
- bug: sensitive() values handling in HCL by @denis256 in #5097
- deps: updated AWS and GCP dependencies by @denis256 in #5107
- deps: updated go-getter to v1.8.3 by @denis256 in #5107
Full Changelog: v0.93.8...v0.93.9

⚙️ Process Improvements
Terragrunt static executables
- Release pipeline now publishes statically linked executables
What's Changed
- chore: Re-enable units reading with filter test by @yhakbar in #5077
- chore: static executables building by @denis256 in #5093
- docs: installation steps update by @denis256 in #5091
Full Changelog: v0.93.7...v0.93.8

What's Changed
- fix: add OriginalTerragruntConfigPath to parse options by @kazsakke in #5090
- chore: release scripts simplification by @denis256 in #5085
New Contributors
- @kazsakke made their first contribution in #5090
Full Changelog: v0.93.6...v0.93.7

⚙️ Process Improvements
Terragrunt release automation moved to GitHub Actions
The release automation for Terragrunt has moved to GitHub Actions. With this move, Terragrunt releases now support:
- Windows binary signing
- Additional packaging for artifacts (.zip and .tar.gz release artifacts)
You can still download standalone executables from release assets for backward compatibility.
🧪 Experiments Updated
The filter-flag experiment now supports the source= attribute
The --filter flag can now be used to filter units by their usage of particular OpenTofu/Terraform modules in their terraform source blocks (remember that you must use the filter-flag experiment to try this).
# Filter by exact source match
terragrunt find --filter 'source=github.com/acme/foo'
terragrunt find --filter 'source=gitlab.com/example/baz'
terragrunt find --filter 'source=./module'
# Filter by source using glob patterns
terragrunt find --filter 'source=*github.com**acme/*'
terragrunt find --filter 'source=git::git@github.com:acme/**'
terragrunt find --filter 'source=**github.com**'
terragrunt find --filter 'source=gitlab.com/**'
For more information, see the filter feature documentation.
What's Changed
- feat: Adding --filter source= support by @yhakbar in #5075
- chore: Switching to mise for go install in tidy check by @yhakbar in #5082
- chore: Github action release improvements by @denis256 in #5066
- docs: Documenting --filter for source= attribute by @yhakbar in #5076
Full Changelog: v0.93.5...v0.93.6

🧪 Experiments Updated
The filter-flag experiment now supports --filter in stack generate
The --filter flag can now be used in the stack generate command, and any command that performs stack generation, e.g. run --all (remember that you must use the filter-flag experiment to try this).
The --filter flag works in a slightly unique way when used to control stack generation in that it needs to be explicitly restricted to stacks for it to impact stack generation using the type=stack attribute filter.
e.g.
# Supported: Only generate the stacks that match the filter, as we are explicitly indicating that we are targeting stacks.
terragrunt stack generate --filter 'name=prod | type=stack'
# Not supported: This filter will be ignored, as we are not explicitly indicating that we are targeting stacks.
terragrunt stack generate --filter 'name=prod' # This will not work
The reason for this is that stack generation can also be done automatically as part of other commands, like run, and thus we need to make it clear that we’re trying to control stack generation rather than run behavior.
# This will run any unit named 'vpc'
terragrunt run --all --filter 'vpc' -- plan
# This will run any unit named 'vpc', and prevent stack generation in any stack not named 'dev' (including any stacks named 'vpc')
terragrunt stack run --filter 'vpc' --filter 'name=dev | type=stack' -- apply
For more information, see the filter feature documentation
What's Changed
- feat: Adding support for -filter in stack generate by @yhakbar in #5073
- docs: Documenting -filter for stack generate by @yhakbar in #5084
Full Changelog: v0.93.4...v0.93.5

🧪 Updated Experiments
The filter-flag experiment now supports graph expressions
The --filter flag now supports usage of graph expressions, allowing users to filter based on the dependency relationship of units discovered by Terragrunt (remember that you must use the filter-flag experiment to try this).
e.g.
# Find 'service' and everything it depends on
terragrunt find --filter 'service...'
# Find 'vpc' and everything that depends on it
terragrunt find --filter '...vpc'
# Find 'db' and its complete dependency graph
terragrunt find --filter '...db...'
# Find all dependents of 'vpc' but exclude 'vpc' itself
terragrunt find --filter '...^vpc'
You can learn more about graph-based filtering in the filter feature documentation.
What's Changed
- feat: Integrating filters into discovery by @yhakbar in #5034
- feat: Adding support for graph expressions in --filter by @yhakbar in #5049
- fix: Avoiding panic on missing if_exists by @yhakbar in #5072
- fix: discovery parsing errors handling by @denis256 in #5037
- docs: Documenting filter graph expressions by @yhakbar in #5050
- chore: Refactor logic for run into dedicated internal package by @yhakbar in #5060
- chore: Refactor direct access of run command flags to access in shared package by @yhakbar in #5062
- chore: Adding Travis as a code owner by @yhakbar in #5067
Full Changelog: v0.93.3...v0.93.4

🐛 Bug Fixes
hcl validate --inputs regression on validation blocks resolved
A bug introduced in v0.93.1 preventing hcl validate --inputs from succeeding on OpenTofu/Terraform modules with variables containing validation blocks. This was caused by an error in the update to OpenTofu/Terraform .tf file parsing by Terragrunt in the hcl validate command.
That bug has been resolved.
What's Changed
- fix: Allow validation blocks in inputs by @ThisGuyCodes in #5063
- chore: Updating pin to v0.93.2 for remote references by @yhakbar in #5058
- build(deps): bump tar from 7.5.1 to 7.5.2 in /docs-starlight by @dependabot[bot] in #5057
Full Changelog: v0.93.2...v0.93.3

✨ New Features
The list command now supports the dot fomat
The list command can now render its output in the Graphviz DOT language:
$ terragrunt list --format=dot --dependencies
digraph {
"live/dev/vpc" ;
"live/dev/db" ;
"live/dev/ec2" ;
"live/dev/db" -> "live/dev/vpc";
"live/dev/ec2" -> "live/dev/db";
"live/dev/ec2" -> "live/dev/vpc";
"live/prod/vpc" ;
"live/prod/db" ;
"live/prod/ec2" ;
"live/prod/db" -> "live/prod/vpc";
"live/prod/ec2" -> "live/prod/db";
"live/prod/ec2" -> "live/prod/vpc";
}
This was previously only possible using the dag graph command, but that command has been refactored to be an alias for the list --format=dot --dependencies command, to provide greater flexibility in how graphs are rendered in the DOT language. This includes integration with the experimental Filter feature.
You can learn more about this in the list command documentation
What's Changed
- feat: Moving dag graph command to list --format=dot by @yhakbar in #5013
- docs: Documenting dot format for the list command by @yhakbar in #5042
- chore: CICD updates by @denis256 in #5056
- chore: Disable experimental tests ignore in CI by @yhakbar in #5021
- chore: Refactor find & list so that they use a single write instead of intermediate writes by @yhakbar in #5027
Full Changelog: v0.93.1...v0.93.2

🏎️ Performance Improvements
- Reduced redundant --auth-provider-cmd invocations during run-all
- This cuts down on external credential calls and lowers authentication overhead for large runs.
- Updated the unit resolver to reuse the configuration parsed during discovery instead of re-parsing each terragrunt.hcl.
- This reduces HCL parses and allocations, shortening execution time on complex stacks.
In our internal “Run all with Auth Provider” benchmark (10 runs, ~10 ms on auth command), these changes reduced average runtime from ~235 ms to ~213 ms (about 9% faster) compared to v0.93.0.
Benchmarks of "BenchmarkDependencyPairwiseOddDependsOnPrevEvenRandomWait" release changes vs main
509178299-daaabc37-3834-40a4-95b3-19a2fb5f2c6d
What's Changed
- perf: unit resolver performance improvements by @denis256 in #5040
- feat: allow input validation with variable in source or version by @ThisGuyCodes in #5041
- perf: More useful benchmark for determining impact of hcl fmt optimization by @yhakbar in #5026
- chore: Add beta releases by @Resonance1584 in #5052
New Contributors
- @ThisGuyCodes made their first contribution in #5041
Full Changelog: v0.93.0...v0.93.1

🛠️ Breaking Changes
Removal of deprecated HCL attributes
The skip, retryable_errors, retry_max_attempts and retry_sleep_interval_sec have all been removed from Terragrunt.
This is the final planned breaking change on the road to Terragrunt 1.0 related to removal of deprecated functionality. Breaking changes will be minimized before Terragrunt 1.0, but may still occur based on user feedback, or based on the need to stabilize parts of Terragrunt before 1.0.
If you are currently using the skip attribute, you'll want to adjust your usage to leverage the exclude block instead:
Before:
# terragrunt.hcl
skip = true
After:
# terragrunt.hcl
exclude {
if = true
actions = ["all"]
}
If you are currently using the retryable_errors attribute, you'll want to adjust your usage to leverage the errors block instead:
Before:
# terragrunt.hcl
retryable_errors = [
".*Error: transient network issue.*",
".*Error: timeout.*"
]
retry_max_attempts = 3
retry_sleep_interval_sec = 5
After:
# terragrunt.hcl
errors {
retry "transient_errors" {
retryable_errors = [
".*Error: transient network issue.*",
".*Error: timeout.*"
]
max_attempts = 3
sleep_interval_sec = 5
}
}
Read the detailed migration guide for more information.
What's Changed
- chore: removal of deprecated hcl attributes skip, retryable_errors by @denis256 in #5033
- bug: empty paths handling in dependencies by @denis256 in #5016
Full Changelog: v0.92.1...v0.93.0

✨ New Features
hcl fmt supports --parallelism for controlling concurrency
The hcl fmt command now supports the --parallelism flag for controlling the number of concurrent files getting formatted. By default, the number of concurrent file formats will be determined by the number of CPU cores detected on the system running Terragrunt.
See hcl fmt documentation for more information.
What's Changed
- feat: Adding support for --parallelism to hcl fmt by @yhakbar in #5020
- docs: Documenting support for --parallelism flag in hcl fmt by @yhakbar in #5031
- build(deps): bump the js-dependencies group across 1 directory with 5 updates by @dependabot[bot] in #5025
- build(deps): bump actions/upload-artifact from 4 to 5 by @dependabot[bot] in #5024
- build(deps): bump actions/download-artifact from 4 to 6 by @dependabot[bot] in #5023
- chore: Refactoring Component by @yhakbar in #5017
Full Changelog: v0.92.0...v0.92.1

🛠️ Breaking Changes
Internal boilerplate dependency upgraded to v0.10.1
The templating engine (Boilerplate) used by the Terragrunt catalog and scaffold commands has been upgraded to v0.10.1.
As a consequence, the default behavior of scaffolding when using the catalog and scaffold commands has changed to allow for the use of Boilerplate hooks and shell commands (see hooks and helpers in Boilerplate documentation) by default.
Note that Boilerplate will ask for permission interactively by default to run said hooks and shell commands, and that the interactive prompt will propagate to Terragrunt users.
e.g.
$ terragrunt scaffold github.com/gruntwork-io/terragrunt//test/fixtures/scaffold/with-shell-commands
...
[boilerplate] 2025/10/24 13:44:56 Shell command details:
[boilerplate] 2025/10/24 13:44:56 Command: echo
[boilerplate] 2025/10/24 13:44:56 Arguments: [-n SHELL_EXECUTED_VALUE_1]
[boilerplate] 2025/10/24 13:44:56 Working Directory: /var/folders/x3/j561187d7bn7j25xf6hs73wr0000gn/T/scaffold3587887181/.boilerplate
Execute shell command? (y/a/n) :
$ terragrunt scaffold github.com/gruntwork-io/terragrunt//test/fixtures/scaffold/with-hooks
...
[boilerplate] 2025/10/24 13:48:27 Hook details:
[boilerplate] 2025/10/24 13:48:27 Command: echo
[boilerplate] 2025/10/24 13:48:27 Arguments: [BEFORE_HOOK_EXECUTED]
[boilerplate] 2025/10/24 13:48:27 Working Directory: /var/folders/x3/j561187d7bn7j25xf6hs73wr0000gn/T/scaffold4203613613/.boilerplate
Execute hook? (y/a/n) :
When using the --non-interactive flag, Terragrunt will skip prompts and allow hooks and shell commands automatically by default.
$ terragrunt scaffold github.com/gruntwork-io/terragrunt//test/fixtures/scaffold/with-hooks --non-interactive
...
[boilerplate] 2025/10/24 13:50:56 Executing hook (previously confirmed or all confirmed)
[boilerplate] 2025/10/24 13:50:56 Running command: echo BEFORE_HOOK_EXECUTED
BEFORE_HOOK_EXECUTED
...
[boilerplate] 2025/10/24 13:50:56 Executing hook (previously confirmed or all confirmed)
[boilerplate] 2025/10/24 13:50:56 Running command: echo AFTER_HOOK_EXECUTED
AFTER_HOOK_EXECUTED
If you would like to explicitly prevent this behavior, you can use the --no-hooks and --no-shell flags added to catalog and scaffold to explicitly prevent usage of these features:
$ terragrunt scaffold github.com/gruntwork-io/terragrunt//test/fixtures/scaffold/with-hooks --non-interactive --no-hooks --no-shell
...
[boilerplate] 2025/10/24 13:53:40 Hooks are disabled, skipping 1 hook(s)
...
[boilerplate] 2025/10/24 13:53:40 Hooks are disabled, skipping 1 hook(s)
13:53:40.141 INFO Running fmt on generated code .
13:53:40.143 INFO Scaffolding completed
$ terragrunt scaffold github.com/gruntwork-io/terragrunt//test/fixtures/scaffold/with-shell-commands --non-interactive --no-hooks --no-shell
...
[boilerplate] 2025/10/24 13:54:47 Shell helpers are disabled. Will not execute shell command '[echo -n SHELL_EXECUTED_VALUE_1]'. Returning placeholder value 'replace-me'.
[boilerplate] 2025/10/24 13:54:47 Shell helpers are disabled. Will not execute shell command '[echo -n SHELL_EXECUTED_VALUE_2]'. Returning placeholder value 'replace-me'.
[boilerplate] 2025/10/24 13:54:47 Hooks are disabled, skipping 0 hook(s)
13:54:47.356 INFO Running fmt on generated code .
13:54:47.356 INFO ./terragrunt.hcl was updated
13:54:47.356 INFO Scaffolding completed
You can also set the no_hooks and no_shell attributes in your catalog config to have these set by default for all users of your project:
# root.hcl
catalog {
no_shell = true
no_hooks = true
}
⚠️ Remember that IaC configurations are inherently powerful, and should not be trusted blindly. Make sure that you review and trust template sources when generating templates using Terragrunt.
🧪 Experiments Updated
filter-flag experiment now supported in hcl commands
The --filter flag is now supported in hcl commands (validate and fmt) (remember that you must use the filter-flag experiment to try this).
e.g.
# Filter by path with glob patterns
terragru

🧪 Experiments Updated
filter-flag updated with run support
The --filter flag is now supported on the run command (remember that you must use the filter-flag experiment to try this).
e.g.
# Filter by path with glob patterns
terragrunt run --all --filter 'prod/**' -- plan
# Filter by name
terragrunt run --all --filter 'app*' -- apply
# Exclude specific configurations
terragrunt run --all --filter '!./test/**' -- plan
# Combine filters with intersection (refinement)
terragrunt run --all --filter './prod/** | !name=legacy' -- apply
# Multiple filters with union
terragrunt run --all --filter 'app1' --filter 'app2' -- plan
For more information, see the documentation on Filtering Units.
If you give this feature a try, make sure to share your feedback on the Filter Flag RFC
What's Changed
- feat: Adding support for --filter flag in run by @yhakbar in #4981
- docs: Documenting support for --filter in the run command by @yhakbar in #5015
- chore: fixes for periodically failing tests by @denis256 in #5011
Full Changelog: v0.91.4...v0.91.5

🧪 Experiments Updated
filter-flag updated with reading= support
The --filter flag now supports usage of the reading= attribute to filter on components that read particular shared infrastructure configurations.
e.g.
terragrunt find --filter 'reading=shared.hcl'
terragrunt find --filter 'reading=common/*.hcl' # Globs supported!
terragrunt find --filter 'reading=config/**' # Double-wildcard globs are required filtering on files nested in subdirectories.
terragrunt find --filter 'reading=config/vars.tfvars'
This behavior is similar to that provided by the --queue-include-units-reading flag, with additional support for globs, negation and filter chaining supported in the --filter flag more generally.
For more information, see the documentation on Attribute-Based Filtering.
If you give this feature a try, make sure to share your feedback on the Filter Flag RFC
What's Changed
- feat: Adding support for reading= in -filter by @yhakbar in #5004
- docs: Documenting the new reading attribute by @yhakbar in #5005
- docs: documenting how to exclude files from modules by @cebidhem in #5008
- docs: Small fixes in the Provider Cache Server documentation by @RafaelWO in #4959
New Contributors
- @cebidhem made their first contribution in #5008
- @RafaelWO made their first contribution in #4959
Full Changelog: v0.91.3...v0.91.4

✨ New Features
--reading flag added to the find command
The find command now supports the --reading flag, which allows you to discover the shared configurations read by units and stacks when using the --json format.
$ terragrunt find --reading --json
[
{
"type": "unit",
"path": "aws-account-1",
"reading": [
"aws-data.yml"
]
},
{
"type": "unit",
"path": "aws-account-2",
"reading": [
"aws-data.yml"
]
},
{
"type": "unit",
"path": "gcp-project-1",
"reading": [
"gcp-data.hcl"
]
}
]
You can use this information to drive custom logic in your workflows based on the changes related to particular files.
e.g.
$ terragrunt find --reading --json | jq '[.[] | select(.reading[]? | contains("aws-data.yml"))| .path]'
[
"aws-account-1",
"aws-account-2"
]
$ terragrunt find --reading --json | jq '[.[] | select(.reading[]? | contains("gcp-data.hcl"))| .path]'
[
"gcp-project-1"
]
You can learn more about the --reading flag in the find documentation.
🐛 Bug Fixes
Empty stacks no longer throw errors
Previously, a bug in the logic used for making sure that users didn’t accidentally run on empty stacks resulted in users getting a non-zero exit code when all units in a stack were excluded (e.g. via the exclude block).
That bug has been fixed.
Dependency outputs can now be used in generate blocks
Previously, a bug in the way HCL parsing was done during discovery resulted in errors being thrown for users when dependency outputs were used in generate blocks. That error has since been resolved.
That bug has been fixed.
What's Changed
- feat: Adding reading support in find by @yhakbar in #5002
- fix: Removing filter enabled check on empty stacks by @yhakbar in #4992
- fix: reference of dependency outputs in generate by @denis256 in #4994
- docs: Documenting new -reading flag for find by @yhakbar in #5003
- docs: Fixing --source-map explanation by @atheiman in #4997
- docs: Fixing Filters docs by @yhakbar in #4996
- chore: Tracking DAG nodes in components by @yhakbar in #4998
- chore: Tracking reads in components by @yhakbar in #5000
- chore: Updating language in discovery commands by @yhakbar in #5001
- chore: Using a standard shell string parsing library instead of handling it ourselves by @yhakbar in #4991
- build(deps): bump the js-dependencies group across 1 directory with 5 updates by @dependabot[bot] in #4993
- build(deps): bump vite from 6.3.6 to 6.4.1 in /docs-starlight by @dependabot[bot] in #4999
New Contributors
- @atheiman made their first contribution in #4997
Full Changelog: v0.91.2...v0.91.3

🧪 Experiments Introduced
filter-flag introduced
A new experiment named filter-flag has been introduced, allowing for experimental usage of the new --filter flag described in RFC #4060. The filter-flag experiment is incomplete, and minimal support for the --filter flag has been added exclusively to the find and list commands.
The filter flag allows for sophisticated querying of particular Terragrunt stacks and units in a way that is currently only possible using a combination of —queue- prefixed flags.
Example filter usage might look like the following:
$ terragrunt find --filter './prod/** | name=web'
prod/services/web
Important
While the filter-flag experiment is active, you will need to enable the filter-flag experiment for any command that uses the filter-flag. See Controlling Experiment Mode for more details.
e.g.
terragrunt find --experiment filter-flag --filter './prod/** | name=web'
You can learn more about filters, including documentation on the syntax and examples of each type of filter in the dedicated feature documentation for filters.
What's Changed
- feat: Introduce filter-flag experiment by @yhakbar in #4969
- chore: Adding checkbox for reproduction by @yhakbar in #4980
- docs: Use special dark/light mode for Terragrunt logos by @yhakbar in #4975
- docs: Fixes overflow issue on the right sidebar by @karlcarstensen in #4972
- docs: Documenting filter-flag experiment by @yhakbar in #4973
- docs: Fixing Flag Card icons by @yhakbar in #4974
Full Changelog: v0.91.1...v0.91.2

✨ New Features
Updated dependencies
Upgraded multiple dependencies to the latest stable versions:
- Updated cloud.google.com/go/storage to v1.57.0
- Updated github.com/aws/aws-sdk-go-v2 to v1.39.2
- Updated github.com/getsops/sops/v3 to v3.11.0
- Updated github.com/gofrs/flock to v0.13.0
- Updated github.com/gruntwork-io/terratest to v0.51.0
- Updated github.com/hashicorp/go-getter to v1.8.2
- Updated golang.org/x/mod to v0.29.0
- Updated golang.org/x/oauth2 to v0.32.0
- Updated golang.org/x/sys to v0.37.0
- Updated golang.org/x/term to v0.36.0
- Updated golang.org/x/text to v0.30.0
- Updated google.golang.org/api to v0.252.0
- Updated google.golang.org/grpc to v1.76.0
- Updated google.golang.org/protobuf to v1.36.10
What's Changed
- chore: Undo Starlight patch by @yhakbar in #4964
- chore: Bump Bun dependencies by @yhakbar in #4965
- chore: Refactor out component package by @yhakbar in #4963
- feat: Adding filter package by @yhakbar in #4958
- chore: multiple dependencies update by @denis256 in #4968
Full Changelog: v0.91.0...v0.91.1

Removal of behavior where inputs are read from dependencies
🛠️ Breaking Changes
Removal of behavior where inputs are read from dependencies
Terragrunt no longer exposes dependency inputs as accessible values.
This change improves performance and simplifies dependency handling by removing a feature that significantly slowed configuration parsing due to a requirement for recursive parsing of dependencies of dependencies for every dependent.
If your configurations currently access dependency inputs like this:
dependency "foo" {
config_path = "../foo"
}
inputs = {
my_input = dependency.foo.inputs.an_input_from_foo
}
You’ll need to update them to reference outputs instead:
dependency "foo" {
config_path = "../foo"
}
inputs = {
my_input = dependency.foo.outputs.an_output_from_foo
}
Accessing outputs remains the supported and recommended way to share data between modules.
What's Changed
- feat: removal of behavior where inputs are read from dependencies by @denis256 in #4960
Full Changelog: v0.90.2...v0.91.0

✨ New Features
Added --terragrunt-no-cache flag for run_cmd
The run_cmd command now supports a new flag, --terragrunt-no-cache, which disables caching of command execution output.
This option is useful when you want to ensure that each command run produces fresh results, especially in dynamic environments or when working with frequently changing external data.
What's Changed
- feat: add --terragrunt-no-cache parameter for run_cmd by @denis256 in #4951
Full Changelog: v0.90.1...v0.90.2

Removal of deprecated commands
This is the next step on the road to Terragrunt 1.0, completing the Terragrunt CLI Redesign. Read the CLI Redesign migration guide for guidance on adapting to these breaking changes.
We anticipate no further breaking changes to the CLI prior to the release of Terragrunt 1.0, where the CLI will remain stable without breaking changes until at least Terragrunt 2.0.
For a full list of deprecated features that will be removed prior to the release of Terragrunt 1.0, see the removal schedule.
🛠️ Breaking Changes
Removal of Deprecated Commands
The following deprecated CLI commands have been removed to streamline the command line API ahead of 1.0.
Use the new commands introduced during the CLI redesign that replace them:
- terragrunt terragrunt-info → terragrunt info print
- terragrunt hclfmt → terragrunt hcl fmt
- terragrunt hclvalidate → terragrunt hcl validate
- terragrunt validate-inputs → terragrunt hcl validate --inputs
- terragrunt render-json → terragrunt render --json -w
- terragrunt graph-dependencies → terragrunt dag graph
- terragrunt output-module-groups → terragrunt find --dag --json
What's Changed
- chore: removal of deprecated commands by @denis256 in #4918
- chore: Removal of output-module-groups cli command by @denis256 in #4937
Full Changelog: v0.89.4...v0.90.0

🐛 Bug Fixes
Collection of exit code for -detailed-exitcode behavior in run --all
Improved run-all plan -detailed-exitcode aggregation to correctly return 2 when any unit has drift, even if another unit hits a retryable error.
What's Changed
- fix(run-all): corrected -detailed-exitcode aggregation by @denis256 in #4932
- docs: stack generate documentation update by @denis256 in #4930
- docs: Form updates by @karlcarstensen in #4911
- docs: Fixing up signup form by @karlcarstensen in #4933
Full Changelog: v0.89.3...v0.89.4

What's Changed
- fix: Added missing flags to the hcl command by @yhakbar in #4927
Full Changelog: v0.89.2...v0.89.3

What's Changed
- fix: Fixing Terralith to Terragrunt integration test by @yhakbar in #4909
- fix: Fixing external dependency resolution by @yhakbar in #4926
Full Changelog: v0.89.1...v0.89.2

What's Changed
- fix: Fixed bug where discovery warned that outputs were mocked. by @yhakbar in #4923
Full Changelog: v0.89.0...v0.89.1

Several experimental features have been made generally available.
🛠️ Breaking Changes
Runner-pool
Terragrunt now supports the Runner Pool concurrency model, replacing the traditional group-based concurrency model with a dynamic scheduler by default.
Instead of waiting for groups of units that block downstream units to complete their runs, the Runner Pool executes each unit as soon as its dependencies (or dependents for destroys) are resolved. This improves efficiency, reduces bottlenecks, and limits the impact of individual failures on the run of the entire queue.
✨New Features
- Dynamically schedules Units as soon as dependencies (or dependents) are satisfied
- Improves throughput for large stacks
- Provides better fault-isolation for failed units
image
Report
The experimental Report feature is now stable and enabled by default.
Every Terragrunt run will now emit a short summary at the end of the run that looks like the following by default:
$ terragrunt run --all plan
# Omitted for brevity...
❯❯ Run Summary 3 units 62ms
────────────────────────────
Succeeded 3
This summary will give a high-level overview of the run results for units in a given Terragrunt run.
You can optionally request a CSV or JSON report of runs as well, giving you detailed insights as to the performance of each run using the --report flag:
terragrunt run --all plan --report-schema-file report.schema.csv
Name,Started,Ended,Result,Reason,Cause
first-exclude,2025-06-05T16:28:41-04:00,2025-06-05T16:28:41-04:00,excluded,exclude block,
second-exclude,2025-06-05T16:28:41-04:00,2025-06-05T16:28:41-04:00,excluded,exclude block,
first-failure,2025-06-05T16:28:41-04:00,2025-06-05T16:28:42-04:00,failed,run error,
first-success,2025-06-05T16:28:41-04:00,2025-06-05T16:28:41-04:00,succeeded,,
second-failure,2025-06-05T16:28:41-04:00,2025-06-05T16:28:42-04:00,failed,run error,
second-success,2025-06-05T16:28:41-04:00,2025-06-05T16:28:41-04:00,succeeded,,
second-early-exit,2025-06-05T16:28:42-04:00,2025-06-05T16:28:42-04:00,early exit,run error,
first-early-exit,2025-06-05T16:28:42-04:00,2025-06-05T16:28:42-04:00,early exit,run error,
terragrunt run --all plan --report-schema-file report.schema.json
[
{
"Name": "first-exclude",
"Started": "2025-06-05T16:28:41-04:00",
"Ended": "2025-06-05T16:28:41-04:00",
"Result": "excluded",
"Reason": "exclude block"
},
{
"Name": "first-success",
"Started": "2025-06-05T16:28:41-04:00",
"Ended": "2025-06-05T16:28:41-04:00",
"Result": "succeeded"
}
]
✨New Features
- Generates detailed run reports (CSV and JSON formats supported)
- Displays run summaries directly in the CLI output
- Allows disabling summaries if desired
To learn more about the Run Report feature, read the dedicated guide on Run Reports here.
🔧 Migration Guide
No action is required
To disable summary output explicitly, use --disable-report-summary:
terragrunt run --all plan --disable-report-summary
Auto OpenTofu Provider Cache Directory
Terragrunt now automatically configures OpenTofu’s native provider caching mechanism by default when running with OpenTofu > = 1.10.
Note that if you are using Terraform, you will not be able to take advantage of this new feature.
This feature is only possible in OpenTofu due to the hard work and coordination with the OpenTofu team to ensure that concurrent access to the provider cache directory is safe for all OpenTofu users, regardless of whether they use Terragrunt.
Screenshot 2025-06-25 at 12 38 05 PM
✨New Features
- Automatically sets the TF_PLUGIN_CACHE_DIR environment variable
- Uses OpenTofu’s native provider cache instead of Terragrunt’s internal cache server
- Provides improved concurrency safety in multi-runner and CI environments
🔧 Migration Guide
No action is required if you’re running OpenTofu > = 1.10 — provider caching will be configured automatically.
To disable this behavior, use the --no-auto-provider-cache-dir flag:
terragrunt run --all apply --no-auto-provider-cache-dir
What's Changed
- chore: Marked as completed runne

What's Changed
- feat: Use better parsing for --auth-provider-cmd by @yhakbar in #4881
- fix: Fixing race condition for TestTerragruntExcludesFile by @yhakbar in #4809
- fix: Fixing report flags by @yhakbar in #4899
- fix: Fixing .tf vs .tofu extension parity by @yhakbar in #4794
- chore: Add data.tf to iam directory in refactoring guide by @vit100-trader in #4888
- chore: Refactoring GitHub client into dedicated package by @yhakbar in #4879
- build(deps): bump the js-dependencies group across 1 directory with 7 updates by @dependabot[bot] in #4878
- docs: Update 01-quick-start.mdx by @vit100 in #4883
- docs: CI for Terralith to Terragrunt Guide by @yhakbar in #4811
- docs: Update OG images by @karlcarstensen in #4889
New Contributors
- @vit100 made their first contribution in #4883
- @vit100-trader made their first contribution in #4888
Full Changelog: v0.88.0...v0.88.1

🛠️ Breaking Changes
Default Command Forwarding Removed
Terragrunt no longer forwards unknown top‑level commands to OpenTofu by default.
Invoking an unknown command now fails with guidance to use the explicit run form.
This is the next step in the removal of deprecated features in Terragrunt on the road to Terragrunt 1.0, with more to follow. Read the CLI Redesign migration guide for guidance on adapting to future breaking changes.
For a full list of deprecated features that will be removed prior to the release of Terragrunt 1.0, see the removal schedule.
❌ Old Behavior (Deprecated)
terragrunt workspace ls
terragrunt graph
✅ New Behavior
terragrunt run -- workspace ls
terragrunt run -- graph
🔧 Migration Guide
Keep using shortcuts for common commands:
terragrunt plan
terragrunt apply
Replace usage of any OpenTofu/Terraform command that isn’t a supported shortcut with explicit usage of the run command:
terragrunt workspace ls => terragrunt run -- workspace ls
terragrunt graph => terragrunt run -- graph
When mixing Terragrunt and OpenTofu flags, separate them with --:
terragrunt run -- apply -auto-approve
terragrunt run -- output -json
terragrunt run --all -- plan -var foo=bar
Command-specific flags must be used after their commands
As part of the changes to remove the deprecated behavior of forwarding unknown commands to OpenTofu by default, users can no longer treat flags as global flags unless they are in-fact global flags.
For example, the following will still work:
terragrunt --log-level debug plan
terragrunt --no-color plan
But the following will no longer be supported:
terragrunt --provider-cache run --all plan
Instead, you must supply flags after the commands they are used by:
terragrunt run --all --provider-cache plan
Flag Scope Changes (backend + feature flags)
Backend migration and feature-related flags are now command-scoped and should appear after the relevant subcommand.
These flags are accepted on run, backend, scaffold, find, and list
Affected flags:
- backend-bootstrap
- backend-require-bootstrap
- disable-bucket-update
- feature key=value
❌ Old Behavior (Deprecated)
Command-specific flags could be set anywhere in the arguments for a command:
terragrunt --backend-bootstrap backend delete --all
terragrunt --feature stage=true plan
✅ New Behavior
Place flags after the respective command they control:
terragrunt backend bootstrap --backend-bootstrap
terragrunt plan --feature stage=true
terragrunt find --feature stage=true
🔧 Migration Guide
Move these flags to follow the subcommand they apply to
terragrunt --feature stage=true plan => terragrunt plan --feature stage=true
What's Changed
- chore: Removal of command forwarding by default by @denis256 in #4871
- docs: Fixed contact form toggle bug by @karlcarstensen in #4885
- docs: Terragrunt Scale Initial Checkout Page by @karlcarstensen in #4866
Full Changelog: v0.87.7...v0.88.0

🐛 Bug Fixes
Partial cache population fix
Resolved an issue that prevented the HCL partial cache from being fully populated
What's Changed
- chore: Fix for HclCache population in PartialParseConfigFile by @denis256 in #4877
Full Changelog: v0.87.6...v0.87.7

🐛 Bug Fixes
Fixed S3 update prompt message
A typo in the prompt for backend bootstrap adjustment resulted in the word "res" being used instead of "out".
> Remote state S3 bucket is res of date. Would you like Terragrunt to update it? (y/n)
The typo has been corrected like so:
> Remote state S3 bucket is out of date. Would you like Terragrunt to update it? (y/n)
Added synchronization controls for queue and discovery
The queue and discovery packages used in find and list commands and the runner-pool experiment were updated to include additional synchronization controls to address rare race conditions.
What's Changed
- fix: Fixing S3 prompt message by @yhakbar in #4880
- fix: Adding synchronization controls to protect queue and discovery by @yhakbar in #4873
- docs: Adds CTA for Terragrunt Scale on sidebar by @karlcarstensen in #4860
- docs: out-dir flags docs by @denis256 in #4870
- docs: Convert buttons to components by @josh-padnick in #4850
- docs: runner pool docs update by @denis256 in #4875
- chore: Bun lock changes by @karlcarstensen in #4876
Full Changelog: v0.87.5...v0.87.6

🧪 runner-pool experiment
- Runner Pool Performance: Optimized execution flow for faster and more efficient unit scheduling
- Benchmarks: Introduced initial benchmark tests to measure runner-pool performance under different scenarios
runner-pool
What's Changed
- chore: Performance improvements runner-pool by @denis256 in #4855
- docs: Updated runner-pool experiment status by @denis256 in #4852
- docs: Adding meta tags by @karlcarstensen in #4849
- docs: Update subhead by @karlcarstensen in #4854
- docs: Adding social images by @karlcarstensen in #4856
- docs: Documentation cleanup by @karlcarstensen in #4859
- chore: Offboarding AJ by @yhakbar in #4865
Full Changelog: v0.87.4...v0.87.5

🐛 Bug Fixes
- Ensured awshelper prioritizes region from config over environment variables
- Fixed constraint normalization in provider cache
What's Changed
- fix: Fixed setting region in remote state config by @pseudomorph / @denis256 in #4848
- fix: Fixed constraint normalization by @yhakbar in #4804
- chore: runner-pool HCL formatting tests fixes by @denis256 in #4844
- docs: polish to the vimeo component by @karlcarstensen in #4841
- docs: Abc imports to force deploy by @karlcarstensen in #4845
- docs: Fix wrong links in documentation (#4846) by @CouscousPie in #4847
New Contributors
- @pseudomorph made their first contribution in #4848
- @CouscousPie made their first contribution in #4847
Full Changelog: v0.87.3...v0.87.4

🐛 Bug Fixes
Fixed handling of null stack values
Improved handling of null values in stacks
What's Changed
- bug: Handling of null stack values by @denis256 in #4836
- docs: Adding vimeo component and video by @karlcarstensen in #4831
Full Changelog: v0.87.2...v0.87.3

✨ New Features
Runner pool experiment performance improvements
- Enhanced runner pool performance for faster file detection.
Updated dependencies
Upgraded multiple dependencies to the latest stable versions:
- Updated cloud.google.com/go/storage to v1.56.1
- Updated aws-sdk-go-v2 to v1.39.0
- Updated go-getter to v1.8.0
- Updated go-cty to v1.17.0
- Updated testify to v1.11.1
- Updated golang.org/x/mod to v0.28.0
- Updated golang.org/x/oauth2 to v0.31.0
- Updated golang.org/x/sync to v0.17.0
- Updated golang.org/x/sys to v0.36.0
- Updated golang.org/x/term vv0.35.0
- Updated golang.org/x/text to v0.29.0
- Updated google.golang.org/api to v0.249.0
- Updated google.golang.org/grpc to v1.75.1
- Updated google.golang.org/protobuf to v1.36.9
What's Changed
- perf: Improving Runner Pool Perf a bit by @yhakbar in #4824
- chore: runner-pool tests fixes by @denis256 in #4823
- chore(deps): Dependencies update by @denis256 in #4827
- docs: Adjustments to partytown scripts by @karlcarstensen in #4822
- docs: Small updates to TS site by @karlcarstensen in #4819
- docs: Correct flag and environment variable names for AWS OIDC authen… by @carchi1a in #4785
- fix: Adding docs back for -detailed-exitcode, etc. by @yhakbar in #4803
Full Changelog: v0.87.1...v0.87.2

🛠️ Breaking Changes
Automatic Backend Provisioning Removed
Terragrunt no longer automatically provisions backend resources.
If backend provisioning is required but not explicitly enabled, Terragrunt will now exit with an error.
❌ Old Behavior (Deprecated)
The following command would silently provision backend resources before execution:
terragrunt plan --non-interactive
✅ New Behavior
This behavior has been removed. Running the same command without opting in will now produce an error if backend bootstrapping is required.
To continue to automatically bootstrap backends, you must explicitly enable backend provisioning with either the --backend-bootstrap flag or the TG_BACKEND_BOOTSTRAP environment variable:
terragrunt plan --backend-bootstrap --non-interactive
or
export TG_BACKEND_BOOTSTRAP=true
terragrunt plan --non-interactive
🔧 Migration Guide
- If you relied on automatic backend bootstrapping:
Add --backend-bootstrap to your Terragrunt commands, or set the TG_BACKEND_BOOTSTRAP environment variable.
- If you don’t require backend provisioning:
No action needed — simply run Terragrunt commands without the flag.
Road to 1.0 Deprecated Feature Removal Schedule #3535
What's Changed
- chore: Disabled automatic backend provisioning by @denis256 in #4703
- docs: Updated migration docs by @yhakbar in #4711
Full Changelog: v0.86.3...v0.87.0

🐛 Bug Fixes
Stacks now generate in topological order
A race condition caused by concurrent generation of nested Terragrunt Stacks when a .terragrunt-stack directory already exists has been remediated.
Stacks will now generate topologically regardless of whether they are cleanly generated or generated when a terragrunt-stack directory already exists, resulting in parent stacks generating before child stacks.
get_aws_account_id() interaction with --auth-provider-cmd fixed
A bug introduced in the upgrade to AWS SDK v2 in v0.85.1 where get_aws_account_id() would not work properly when used in conjunction with the --auth-provider-cmd flag has been remediated.
Custom API endpoints for backend resources are now set correctly
A bug introduced in the upgrade to AWS SDK v2 in v0.85.1 where integration with the S3 and DynamoDB AWS SDK clients did not properly respect the endpoint setting for backend configurations has been remediated.
ref properly handled in catalog urls
The use of the ref query string parameter in Catalog go-getter URLs has been fixed, allowing users to explicitly specify the ref they want to use for their catalog sources.
dag graph updated to support all run flags
The dag graph command has been updated to support all flags supported by the run command.
📖 Docs
Terragrunt Scale page published
The Terragrunt Scale page has been published, showcasing a new offering from Gruntwork to help customers scale up their IaC usage. It showcases the integration Terragrunt has with commercial offerings from Gruntwork to help organizations scale their infrastructure management.
The Terralith to Terragrunt has been published
A step-by-step guide to transitioning IaC configurations from a Terralith (where all resources are in a single state file) to a modern Terragrunt IaC configuration, using Terragrunt Stacks has been published named Terralith to Terragrunt.
This is the first major guide in this style, with more to come in the future to address specific pain points for members of the community in a step-by-step guide, rather than a reference or high level summary of features.
What's Changed
- feat: Generate stacks in topological order by @yhakbar in #4786
- fix: Fixing AWS Account ID w/ Provider CMD by @yhakbar in #4779
- fix: ensure custom API endpoints are set correctly by @wakeful in #4756
- fix: Properly handling ref when running terragrunt catalog #4777 by @rvelichkov in #4781
- fix: Bypass partytown by @karlcarstensen in #4783
- fix: Updated form link by @karlcarstensen in #4771
- fix: Fixed contact form by @karlcarstensen in #4761
- fix: Fixes for scale page by @karlcarstensen in #4767
- fix: Swap image for transparent png by @karlcarstensen in #4766
- fix: Fixes for terragrunt scale page by @karlcarstensen in #4747
- fix: Nav fixes by @karlcarstensen in #4750
- fix: Fixes for contact page by @karlcarstensen in #4746
- fix [#4613]: register additional flags in the DAG graph subcommand by @wakeful in #4726
- fix: Adding select none to some text areas by @karlcarstensen in #4743
- fix: Fix hero image by @karlcarstensen in #4749
- fix: Responsive fix for aws component by @karlcarstensen in #4742
- fix: Section spacing to 150px by @karlcarstensen in #4741
- docs: Terragrunt Scale Pricing Page by @karlcarstensen in #4729
- docs: Pricing Page Launch by @karlcarstensen in #4772
- docs: Add Terralith to Terragrunt guide by @yhakbar in #4709
- docs: Adding URLs by @karlcarstensen in #4740
- chore: experiments tests improvements by @denis256 in #4782
- chore: A collection of website polishing by @josh-padnick in #4784
- chore: fix runner-pool experiment tests by @denis256 in #4770
- chore: Polish by @karlcarstensen in #4773
- chore: Polish to contact form by @karlcarstensen in #4769
- chore: Search polish by @karlcarstensen in #4755
- chore: added integration tests for experiment mode by @denis256 in #4754
- chore: Cleanup and organization by @karlcarstensen in #4753
- chore: Nav polish by @karlcarstensen in #4748
New Contributors
- @r

What's Changed
- chore: updated dependency github.com/aws/aws-sdk-go-v2 to v1.38.1 by @denis256 in #4728
- chore: updated dependency github.com/hashicorp/go-plugin to v1.7.0 by @denis256 in #4728
- chore: updated dependency github.com/zclconf/go-cty to v1.16.4 by @denis256 in #4728
- chore: updated dependency google.golang.org/api to v0.248.0 by @denis256 in #4728
- chore: updated dependency google.golang.org/grpc to v1.75.0 by @denis256 in #4728
- chore: updated dependency google.golang.org/protobuf to v1.36.8 by @denis256 in #4728
- chore: updated dependency go.uber.org/mock to v0.6.0 by @denis256 in #4728
- chore: updated dependency github.com/aws/aws-sdk-go-v2/config to v1.31.2 by @denis256 in #4728
- chore: updated dependency github.com/aws/aws-sdk-go-v2/service/dynamodb to v1.49.1 by @denis256 in #4728
- chore: updated dependency github.com/aws/aws-sdk-go-v2/service/iam to v1.47.1 by @denis256 in #4728
- chore: updated dependency github.com/aws/aws-sdk-go-v2/service/s3 to v1.87.1 by @denis256 in #4728
- chore: updated dependency github.com/aws/aws-sdk-go-v2/service/sts to v1.38.0 by @denis256 in #4728
- chore: updated dependency github.com/aws/smithy-go to v1.22.5 by @denis256 in #4728
Full Changelog: v0.86.1...v0.86.2

What's Changed
- Fix handling of trailing ** in --queue-include-dir and --queue-exclude-dir by @Resonance1584 in #4683
Full Changelog: v0.86.0...v0.86.1

✨ Features
- Terraform 1.13: We are now testing Terragrunt against Terraform 1.13 and is confirmed to be working.
- Go 1.25: Build process now leverages Go 1.25 features and improvements
NOTE: Although this release is marked as backward incompatible, it is functionally compatible as nothing has been changed in Terragrunt internals. The minor version release is useful to mark the change in Terraform version that is being tested.
What's Changed
- chore: Added test for source-map in runner-pool by @denis256 in #4707
- chore: Go and Terraform 1.13 updates by @denis256 in #4724
Full Changelog: v0.85.1...v0.86.0

✨ Features
- Updated go-getter to fix CVE-2025-8959
- Dropped dependencies on aws-sdk-go v1
📖 Docs
- Switched to the new documentation site
What's Changed
- chore: Bumping go-getter and dependencies to fix CVE-2025-8959 by @yhakbar in #4692
- Fix --report-file not created due to cross-device link by @Resonance1584 in #4675
- docs: Updating Terragrunt Homepage by @yhakbar in #4550
- Web 818 by @karlcarstensen in #4682
- build(deps): bump actions/checkout from 4 to 5 by @dependabot[bot] in #4685
- fix: Removing Google feedback form by @yhakbar in #4678
- fix: Adding social link info by @yhakbar in #4677
- chore: Final pre-migration steps by @yhakbar in #4688
- fix: Adjusting patch by @yhakbar in #4691
- fix: Fixing text for search by @yhakbar in #4693
- Bump versions by @karlcarstensen in #4695
- Lower padding margins by @karlcarstensen in #4696
- Search polish by @karlcarstensen in #4697
- fix: Adding retry to ignore the flakiness of TestProviderCache by @yhakbar in #4676
- Cleaning animation by @karlcarstensen in #4698
- chore: Tossing Jekyl docs by @yhakbar in #4699
- chore: Removing Jekyll docs by @yhakbar in #4705
- Swap classnames per feedback by @karlcarstensen in #4710
- fix: Adjusting awshelper by @yhakbar in #4502
- fix: pass argument to version flag, e.g. run -- version -json by @wakeful in #4720
- chore: rm old page deployment by @wakeful in #4721
- Remove unnecessary class by @karlcarstensen in #4713
- Tighten up Supercharge section by @karlcarstensen in #4712
Full Changelog: v0.85.0...v0.85.1

🛠️ Breaking Changes
Removal of legacy Terragrunt flags
All deprecated flags that start with --terragrunt- have been removed in favor of their modern counterparts.
This is the next step in the removal of deprecated features in
Terragrunt on the road to Terragrunt 1.0, with more to follow. Read the CLI Redesign migration guide for future breaking changes.
Update of stack run directory context
The stack run command no longer assumes that users will have a .terragrunt-stack directory present in the same directory as the terragrunt.stack.hcl file. This caused issues for users that were leveraging the no_dot_terragrunt_stack attribute, as the run might have skipped over units generated outside the .terragrunt-stack directory and thrown an error if all units were generated without the .terragrunt-stack directory.
For the following terragrunt.stack.hcl file:
unit "foo" {
source = "../units/foo"
path = "foo"
no_dot_terragrunt_stack = true
}
unit "bar" {
source = "../units/bar"
path = "bar"
}
Users would experience the following stack run output:
tg-stack-run-before
They will now get the following:
tg-stack-run-after
✨ Features
The runner-pool experiment has been integrated with OpenTelemetry
The runner-pool experiment has been updated to integrate properly with OpenTelemetry.
🐛 Bug Fixes
stack output now respects no_dot_terragrunt_stack
Previously, when running the stack output command, Terragrunt would incorrectly assume that all units were generated within a .terragrunt-stack directory. This bug has been fixed, and Terragrunt will know to look directly in the stack directory for a given unit when supplied with no_dot_terragrunt_stack.
The runner-pool experiment no longer parses stack files as units during discovery
A bug in the logic for the discovery package resulted in discovery errors due to terragrunt.stack.hcl files being parsed as units. That bug has been fixed.
Fixed filesystem context for find_in_parent_folders() when used in terragrunt.stack.hcl
The use of find_in_parent_folders() now functions correctly when run in the context of a terragrunt.stack.hcl file. Previously, it relied on the current working directory of the Terragrunt CLI, which incorrectly assumed that users would always be generating terragrunt.stack.hcl files from the current working directory.
The discovery package now emits less false positive warnings during parsing
The discovery package used by the find and list commands, and the runner-pool experiment has been updated to emit less unimportant warnings when parsing configurations. These warnings were for early phase parsing that are known to be safe to ignore.
The discovery package no longer attempts to parse stack configurations as units
A bug in the implementation of the discovery package resulted in attempts from Terragrunt to parse terragrunt.stack.hcl files as units. That has been remediated.
📖 Docs
Edit Link Added
The terragrunt-v1.gruntwork.io docs now include an "Edit page" button that conveniently allows the community to contribute fixes to documentation from within their browsers, using the GitHub UI.
image
What's Changed
- feat: runner-pool OpenTelemetry integration by @denis256 in #4616
- fix: Discovery false positive parsing errors by @denis256 in #4605
- fix: Adding edit link back by @yhakbar in #4629
- fix: Make stack output respect no_dot_terragrunt_stack by @yhakbar in #4606
- fix: Fix broken screenshot in logging page by @josh-padnick in #4630
- fix: Improve error handling for missing includes and dependencies by @yhakbar in #4637
- fix: ensure --queue-include-dir includes stack paths that have not yet been generated by @wakeful in #4649
- fix: Fixing bad link to stack output command by @yhakbar in #4652
- fix: Fixing stack run when there are only units with no_dot_terragrunt_stack set by @yhakbar in #4628
- fix: Fixing find_in_parent_folders for terragrunt.stack.hcl files by @yhakbar in #4669
- fix: Addressing provider cache test flake by @yhakbar in #4639
- fix: Fixing discovery par

What's Changed
- build(deps): Bump cloud.google.com/go/storage to v1.56.0 by @denis256 in #4603
- build(deps): Bump github.com/aws/aws-sdk-go-v2 to v1.36.6 by @denis256 in #4603
- build(deps): Bump github.com/gruntwork-io/boilerplate to v0.8.1 by @denis256 in #4603
- build(deps): Bump google.golang.org/api to v0.244.0 by @denis256 in #4603
- build(deps): Bump google.golang.org/grpc to v1.74.2 by @denis256 in #4603
- chore: Upgrade to Tofu 1.10.5 in CICD tests by @denis256 in #4604
Full Changelog: v0.84.0...v0.84.1

🛠️ Breaking Changes
Removal of legacy-all commands
The following commands have been removed from the Terragrunt CLI:
- spin-up
- tear-down
- plan-all
- apply-all
- destroy-all
- output-all
- validate-all
If you have been using any of these commands, see the migration guide under Removal of longstanding deprecated commands here.
This is the first step in the removal of deprecated features in Terragrunt on the road to Terragrunt 1.0, with more to follow. You are also advised to read the CLI Redesign migration documentation for future breaking changes.
See #3535 for more details.
✨ New Features
Catalog/Scaffold now support --no-dependency-prompt
The catalog/scaffold commands now support a new --no-dependency-prompt flag that disables the Boilerplate dependency prompt (equivalent of --disable-dependency-prompt in Boilerplate).
This allows Boilerplate templates with dependencies to be used non-interactively, even when called by Catalog and Scaffold.
exclude block now supports no_run
The exclude block now supports the no_run attribute, which lets users prevent direct runs of a unit when the run matches the configuration of an exclude block.
e.g. When users define an exclude block like the following:
# foo/terragrunt.hcl
exclude {
if = true
actions = ["plan"]
}
Terragrunt will only exclude the unit foo from the run queue if the user supplies a command like run --all plan. If a user uses the run plan command directly in the foo directory, it’s assumed that they are doing so intentionally, and don’t want the run to exit early.
Users can now specify no_run to explicitly tell Terragrunt that it should never be run, even if a user attempts to perform the run in the unit directory directly.
# foo/terragrunt.hcl
exclude {
if = true
no_run = true
actions = ["plan"]
}
💪🏽 Enhancements
Stacks are now fully regenerated when the --source-update flag is set
The .terragrunt-stack directory is now fully regenerated when the --source-update flag is set, similar to how the .terragrunt-cache directory is regenerated when the flag is set.
This addresses some edge-cases where changes to local sources for units and stacks didn’t result in updates to generated stack configurations.
🐛 Bug Fixes
Stack Outputs Are Now Sorted
To ensure consistency in the order in which outputs are displayed when using the stack output command, outputs are now sorted before they are displayed.
Lockfiles With Strong Constraints Normalized
When manually generating lockfiles from the Provider Cache Server for modules with strong constraints like the following:
terraform {
required_providers {
aws = {
source = "hashicorp/aws"
version = "= 5.100.0"
}
}
}
Generated lockfiles now properly strip the = when generating the lockfile, as = constraints aren’t supported in .terraform.lock.hcl files.
What's Changed
- feat: add --no-dependency-prompt option for scaffold by @markoeremija in #4420
- feat: Supporting no_run in exclude block by @yhakbar in #4574
- feat: runner-pool destroy tests by @denis256 in #4537
- fix: sort output for writevalues in stack.go by @pseudomorph in #4552
- fix: Fixing links at the bottom of Jekyl stacks docs by @yhakbar in #4549
- fix: Fixing lint finding by @yhakbar in #4561
- fix: Stripping equals sign from constraint by @yhakbar in #4563
- fix: Fixing icon patch by @yhakbar in #4576
- docs: Updating stacks documentation by @yhakbar in #4544
- docs: minor stylistic change for better clarity by @Kairixir in #4557
- refactor: call CleanStacks before running the stacks Generate func. by @wakeful in #4446
- build(deps): bump the js-dependencies group across 1 directory with 4 updates by @dependabot[bot] in #4545
- build(deps-dev): bump nokogiri from 1.18.8 to 1.18.9 in /docs by @dependabot[bot] in #4553
- build(deps): bump ruby/setup-ruby from 1.245.0 to 1.253.0 by @dependabot[bot] in #4570
- chore: Adding auto-provider-cache-dir experiment integration test by @yhakbar in #4554
- chore: updated dependabot config to not update charmbracelet/x/ansi by @denis256 in

What's Changed
- chore: Improved construction logic for runner pool queues by @denis256 in #4506
- chore: Updated cloud-nuke config to remove dynamodb integration tests tables by @denis256 in #4531
- chore: Updated tofu engine used in tests to 0.0.20 by @denis256 in #4532
- build(deps): bump the js-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #4536
Full Changelog: v0.83.1...v0.83.2

🐛 Bug Fixes
- Adjusted lockfile handling when modules define constraints
What's Changed
- fix: Adjusted lockfile handling when modules define constraints by @yhakbar in #4514
- chore: Updated cicd to use tofu 1.10.2 by @denis256 in #4507
- chore: Added dependency grouping and type labels to Dependabot config by @wakeful in #4518
- docs: Fixed getting started docs by @shahar1 in #4516
- chore: Configured dependabot to ignore buggy version of charmbracelet/glamour by @wakeful in #4524
- build(deps): Bump the js-dependencies group across 1 directory with 9 updates by @dependabot[bot] in #4520
- chore: Removed npm dependencies, using only bun for docs generation by @wakeful in #4527
- build(deps): Updated github.com/huandu/go-clone to v1.7.3 by @wakeful in #4511
- build(deps): Updated google.golang.org/api to v0.240.0 by @wakeful in #4511
- build(deps): Updated github.com/aws/aws-sdk-go-v2/service/s3 to v1.83.0 by @wakeful in #4511
- build(deps): Updated github.com/hashicorp/hcl/v2 to 2.24.0 by @denis256 in #4528
- build(deps): Updated golang.org/x/mo to 0.26.0 by @denis256 in #4528
- build(deps): Updated golang.org/x/sync to 0.16.0 by @denis256 in #4528
- build(deps): Updated golang.org/x/sys to 0.34.0 by @denis256 in #4528
- build(deps): Updated golang.org/x/term to 0.33.0 by @denis256 in #4528
- build(deps): Updated golang.org/x/text to 0.27.0 by @denis256 in #4528
- build(deps): Updated google.golang.org/api to 0.241.0 by @denis256 in #4528
New Contributors
- @shahar1 made their first contribution in #4516
Full Changelog: v0.83.0...v0.83.1

✨ New Features
- Added initial implementation of runner-pool to improve unit apply performance. The feature can be enabled using the --experiment runner-pool flag.
RFC: #3629
🛠️ Breaking Changes
- Updated log messages to use "Unit" terminology instead of "Module" for improved clarity and consistency.
🐛 Bug Fixes
- Fixed flaky tests related to the provider cache.
- Added explicit check for user-defined --tf-path flag.
- Updated Dockerfile to support Starlight documentation generation.
- Fixed incorrect lock file constraints generated by the Terragrunt Provider Cache.
- Fixed discovery of Terragrunt files in runner-pool, ensuring correct file resolution during execution.
What's Changed
- feat: Runner pool implementation by @denis256 in #4434
- fix: Fixing TestProviderCache flake by @yhakbar in #4495
- fix: Adding explicit check to see if user set --tf-path by @yhakbar in #4493
- fix: Adjusting Dockerfile for Starlight docs by @yhakbar in #4496
- fix: Fix lock file constraints generated by Terragrunt Provider Cache by @ajax-ryzhyi-r in #4380
- fix: Fixed discovery of Terragrunt files in runner-pool by @denis256 in #4491
- docs: Updated documentation for fail-fast flag by @denis256 in #4503
- docs: Updated docs to reference default terragrunt.values.hcl by @denis256 in #4490
New Contributors
- @ajax-ryzhyi-r made their first contribution in #4380
Full Changelog: v0.82.4...v0.83.0

✨ New Features
Support for OpenTofu 1.10 Native S3 Locking
The remote_state S3 backend now integrates natively with the OpenTofu 1.10 feature of state locking via S3 without the usage of DynamoDB using the new use_lockfile attribute.
# Configure OpenTofu/Terraform state to be stored in S3 with native S3 locking instead of DynamoDB.
# This uses S3 object conditional writes for state locking, which requires OpenTofu >= 1.10.
remote_state {
backend = "s3"
config = {
bucket = "my-tofu-state"
key = "${path_relative_to_include()}/tofu.tfstate"
region = "us-east-1"
encrypt = true
use_lockfile = true
}
}
In previous releases, if users wanted to integrate with this OpenTofu feature, they would have to use the generate attribute, which opts users out of more advanced features of Terragrunt remote state management like automatic provisioning of state resources.
By using the native attribute in config, users can retain the benefits of automatic backend bootstrapping in addition to native integration with the new OpenTofu feature.
You can learn more about backend configurations in the HCL docs.
What's Changed
- feat: Adding support for native state locking by @yhakbar in #4485
- fix: resolve failing CAS & DAG tests by @wakeful in #4480
- fix: Use a constant for min version of tofu for auto provider cache dir by @yhakbar in #4479
- chore: update external dependencies by @wakeful in #4486
Full Changelog: v0.82.3...v0.82.4

🧪 Experiments Added
Introduction of the auto-provider-cache-dir experiment
The new auto-provider-cache-dir experiment has been added to automatically configure OpenTofu provider caching when certain conditions are met:
- You are using OpenTofu
- You are using a version of OpenTofu >= 1.10
This leverages recent improvements in how OpenTofu handles provider caching to allow for safe concurrent access to provider plugins in OpenTofu 1.10.
In micro-benchmarks, the native provider cache directory out-performs the Provider Cache Server, as the overhead of starting and running the provider cache server is eliminated.
Screenshot 2025-06-25 at 12 38 05 PM
Once generally available, this feature will be enabled by default, automatically providing performance improvements to Terragrunt users using OpenTofu >= 1.10. If you are currently using the Provider Cache Server, you are advised to experiment with this feature, and share your feedback.
You can learn more about the feature in the dedicated feature docs, including a comparison with the Provider Cache Server, so you can learn if limitations in how the native OpenTofu provider cache directory will result in a requirement to continue using the Provider Cache Server going forward.
Special thanks to @cam72cam for coordinating with us to get this long-awaited feature supported in OpenTofu to meet the needs of the IaC community.
✨ New Features
--version-manager-file-name Flag Added
During a run --all, Terragrunt memoizes the version of OpenTofu/Terraform being run to determine if version constraints are being satisfied, without doing unnecessary work to repeatedly check the version of OpenTofu/Terraform being run in each directory.
To ensure that users using tool managers are able to leverage different versions of OpenTofu/Terraform in different directories, the cache key for this memoization includes calculations based on common version manager tools.
By default, the following are detected:
- .terraform-version
- .tool-versions
- .mise.toml
- mise.toml
To support the usage of any arbitrary tool manager, a new --version-manager-file-name flag has been introduced to allow configurability over this list.
To learn more about --version-manager-file-name read the docs.
What's Changed
- feat: Adding auto provider cache dir experiment by @yhakbar in #4466
- feat: add new --version-manager-file-name flag that allows users to overri… by @wakeful in #4415
- docs: Adding docs for local state to the side with stacks by @yhakbar in #4477
Full Changelog: v0.82.2...v0.82.3

🐛 Bug Fixes
get_terragrunt_dir returns appropriate directory
The get_terragrunt_dir() HCL function now returns the expected stack directory containing a terragrunt.stack.hcl when used in a terragrunt.stack.hcl file.
# terragrunt.stack.hcl
unit "unit_a" {
source = "../../unit_a"
path = "unit_a"
values = {
terragrunt_dir = get_terragrunt_dir()
}
}
non-git default templates supported for Catalog/Scaffold
A bug in how the default_template attribute of the catalog configuration block worked resulted in a requirement that the default template be a Git repository. That bug has been resolved, removing the restriction.
catalog {
urls = ["../local-catalog"]
default_template = "../not-a-git-repo"
}
What's Changed
- fix get_terragrunt_dir when using stack by @james03160927 in #4443
- fix: Support non-git templates for Catalog/Scaffold by @yhakbar in #4474
- build(deps): bump github.com/labstack/echo/v4 from 4.13.3 to 4.13.4 by @dependabot in #4456
- build(deps): bump github.com/gruntwork-io/terratest from 0.49.0 to 0.50.0 by @dependabot in #4457
Full Changelog: v0.82.1...v0.82.2

🧪 Experiments Updated
The cas experiment now supports terraform block source attributes
The cas experiment now supports de-duplication of OpenTofu/Terraform module source cloning during unit initialization.
This both reduces time spent cloning OpenTofu/Terraform module sources by reducing network bandwidth overhead, and reduces disk utilization.
Screenshot 2025-06-26 at 7 01 38 AM
You can learn more about the CAS feature in the dedicated feature documentation.
🐛 Bugs Fixed
The hcl validate command now returns an appropriate exit code
When using hcl validate, if any unit fails validation when run against a stack of units, the final exit code with be non-zero when any unit fails validation.
While this is technically a bugfix that is a 🛠️ breaking change in behavior, maintainers have opted to release this as part of a patch release, as it's what most users expect from the command, it's how the command is documented, and avoiding the breaking change is fairly simple:
terragrunt hcl validate || true
We are also trying to reduce the number of minor releases on the road to 1.0 to make it easier to focus on the big changes that require significant adjustment in usage of Terragrunt, and want to make sure that users take special note of breaking removal of deprecated functionality.
What's Changed
- feat: Expanding CAS support for OpenTofu/Terraform source clones by @yhakbar in #4436
- fix: Setting correct exit code for hcl validate by @yhakbar in #4290
- docs: Updating report experiment docs by @yhakbar in #4452
- docs: Fixing some 404s reported by @yhakbar in #4467
- chore: Addressing review feedback from #4436 by @yhakbar in #4472
- chore: Adding EnsureRun method by @yhakbar in #4453
- chore: Adding AJ as CODEOWNER by @yhakbar in #4458
Full Changelog: v0.82.0...v0.82.1

Description
OpenTofu 1.10 support: We are now testing Terragrunt against OpenTofu 1.10, and is confirmed to be working.
NOTE: Although this release is marked as backward incompatible, it is functionally compatible as nothing has been changed in Terragrunt internals. The minor version release is useful to mark the change in the OpenTofu version that is being tested.
What's Changed
- Add support for OpenTofu 1.10 by @denis256 in #4465
Full Changelog: v0.81.10...v0.82.0

What's Changed
- feat: Improved log messages for stack commands by @denis256 in #4363
- chore(deps): Updated to Go 1.24.4 by @denis256 in #4454
- chore(deps): Updated to boilerplate v0.6.3 by @denis256 in #4454
- chore(deps): Updated to aws-sdk-go-v2 v1.36.5 by @denis256 in #4454
- chore(deps): Updated to cloud.google.com/go/storage v1.55.0 by @denis256 in #4454
- chore(deps): Updated to go-cty v1.16.3 by @denis256 in #4454
- chore(deps): Updated to aws-sdk-go-v2/service/s3 v1.81.0 by @denis256 in #4454
Full Changelog: v0.81.9...v0.81.10

🧪 Experiments Updated
Styling for Run Summary Updated
Per design feedback, the styling for Run Summaries has been updated slightly.
summary-styling
The report is now considered feature complete. Any further updates will be made to address community feedback.
What's Changed
- feat: Updating styling for summary by @yhakbar in #4441
- fix: Fixing issue with ending runs from --queue-exclude-external by @yhakbar in #4451
Full Changelog: v0.81.8...v0.81.9

✨ New Features
Scaffold now supports Boilerplate dependencies and partials
The Scaffold feature now supports leveraging Boilerplate dependencies and partials.
This was a missing feature in the integration between Scaffold and Boilerplate, and Terragrunt users do not have to change anything in how they invoke Scaffold to have custom Boilerplate templates properly render using those Boilerplate features.
Special thanks to @tgeijg for contributing this feature!
What's Changed
- feat: Add scaffold support for boilerplate dependencies and partials by @tgeijg in #4437
- fix: Improve error message when terragrunt.hcl file does not exist by @james03160927 in #4425
- fix: Fixing usage of dependencies in discovery by @yhakbar in #4429
- fix: Fixing heading level for experiments by @yhakbar in #4433
- perf: Improving CAS performance a bit by @yhakbar in #4439
- build(deps): bump ruby/setup-ruby from 1.242.0 to 1.245.0 by @dependabot in #4426
Full Changelog: v0.81.7...v0.81.8

🧪 Experiments Updated
--summary-unit-duration replaced with --summary-per-unit
Per design feedback, the flag --summary-unit-duration has been replaced with --summary-per-unit in the report experiment.
The final summary at the end of runs was updated from looking like this by default:
$ terragrunt run --all plan
# Omitted for brevity...
❯❯ Run Summary
Duration: 62ms
Units: 3
Succeeded: 3
To looking like this:
$ terragrunt run --all plan
# Omitted for brevity...
❯❯ Run Summary 3 units 62ms
────────────────────────────
Succeeded 3
In addition, the flag --summary-unit-duration that resulted in summaries that looked like this:
$ terragrunt run --all plan --summary-unit-duration
# Omitted for brevity...
❯❯ Run Summary
Duration: 10m
long-running-unit: 10m
medium-running-unit: 12s
short-running-unit: 5ms
Units: 3
Succeeded: 3
Was replaced with the --summary-per-unit flag that results in summaries that look like this:
$ terragrunt run --all plan --summary-per-unit
# Omitted for brevity...
❯❯ Run Summary 3 units 10m
──────────────────────────────
Succeeded (3)
long-running-unit 10m
medium-running-unit 12s
short-running-unit 5ms
This was done to streamline the information conveyed by the run summary, and to maximize leverage over the screen real estate taken by the summary.
The report experiment is still ongoing, and community feedback is encouraged. Please share any feedback you may have before the design of Run Reports and Run Summaries are finalized.
What's Changed
- fix: Adding E2E tests for catalog by @yhakbar in #4424
- fix: Replace summary unit durations by @yhakbar in #4418
Full Changelog: v0.81.6...v0.81.7

🐛 Bug Fixes
The catalog command no longer panics during scaffolding
A mistake in a refactor of internal logging caused a panic during scaffolding while using the Terragrunt Catalog Terminal User Interface (TUI).
That bug has been fixed.
IaC Engines now properly handle errors during init and shutdown
Some missing error handling in IaC Engines has been introduced to properly handle failed initialization and shutdown by IaC Engines.
What's Changed
- feat: Usage of discovery and queue to build stack modules by @denis256 in #4393
- fix: Fixing log passthrough for catalog by @yhakbar in #4421
- fix: Adding error handling for engines by @yhakbar in #4414
- chore: Dependencies update by @denis256 in #4417
Full Changelog: v0.81.5...v0.81.6

✨ New Features
Terragrunt now supports using credentials in .terraformrc files
Terragrunt now supports credentials stored in .terraformrc files when fetching from private registries, in addition to the fallback mechanism of using TG_TF_REGISTRY_TOKEN.
Special thanks to @dlundgren for contributing this feature!
What's Changed
- feat: support credential tokens for getter by @dlundgren in #4047
New Contributors
- @dlundgren made their first contribution in #4047
Full Changelog: v0.81.4...v0.81.5

🧪 Experiments Updated
The reports experiment now supports the --summary-unit-duration flag
As part of delivering #3628 , the reports experiment has been updated to support optionally displaying unit-level duration information in the Run Summary.
You can now optionally display the duration for each unit run as part of the Run Summary by adding the --summary-unit-duration flag to your run commands:
e.g.
$ terragrunt run --all plan --summary-unit-duration
# Omitted for brevity...
❯❯ Run Summary
Duration: 10m
long-running-unit: 10m
medium-running-unit: 12s
short-running-unit: 5ms
Units: 3
Succeeded: 3
By default, this information will be omitted.
For more information, see Showing unit durations in the docs.
What's Changed
- feat: Improving testing & documentation by @yhakbar in #4409
- feat: Adding --summary-unit-duration by @yhakbar in #4410
Full Changelog: v0.81.3...v0.81.4

🧪 Experiments Updated
The reports experiment now supports generating reports in JSON format
As part of delivering #3628 , the reports experiment has been updated to support JSON report generation in addition to the default of CSV report generation.
To generate a report using JSON formatting, either use the --report-format flag to explicitly set the format to one of csv or json or provide a --report-file with a .csv or .json file extension to implicitly select the report format.
The JSON version of report summaries look like this:
[
{
"name": "second-exclude",
"started": "2025-06-09T12:50:02.59688-04:00",
"ended": "2025-06-09T12:50:02.596881-04:00",
"result": "excluded",
"reason": "exclude block"
},
{
"name": "first-exclude",
"started": "2025-06-09T12:50:02.596882-04:00",
"ended": "2025-06-09T12:50:02.596882-04:00",
"result": "excluded",
"reason": "exclude block"
},
{
"name": "error-ignore",
"started": "2025-06-09T12:50:02.597139-04:00",
"ended": "2025-06-09T12:50:02.742775-04:00",
"result": "succeeded"
}
]
For more information, read the documentation on the Run Report.
The reports experiment now supports generating a JSON schema for reports
As part of delivering #3628 , the reports experiment has been updated to support generating a JSON schema following the JSON Schema specification in addition to generating reports.
To generate a schema, use the --report-schema-file flag.
The schema looks like this:
{
"items": {
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://terragrunt.gruntwork.io/schemas/run/report/v1/schema.json",
"properties": {
"Started": {
"type": "string",
"format": "date-time"
},
"Ended": {
"type": "string",
"format": "date-time"
},
"Reason": {
"type": "string",
"enum": [
"retry succeeded",
"error ignored",
"run error",
"--queue-exclude-dir",
"exclude block",
"ancestor error"
]
},
"Cause": {
"type": "string"
},
"Name": {
"type": "string"
},
"Result": {
"type": "string",
"enum": [
"succeeded",
"failed",
"early exit",
"excluded"
]
}
},
"additionalProperties": false,
"type": "object",
"required": [
"Started",
"Ended",
"Name",
"Result"
],
"title": "Terragrunt Run Report Schema",
"description": "Schema for Terragrunt run report"
},
"type": "array",
"title": "Terragrunt Run Report Schema",
"description": "Array of Terragrunt runs"
}
For more information, read the documentation on the Run Report.
What's Changed
- fix: Addressing gopls updates by @yhakbar in #4406
- fix: Avoid using interface pointer by @yhakbar in #4405
- feat: Add JSON support to report experiment by @yhakbar in #4403
- feat: Adding --report-schema-file by @yhakbar in #4408
Full Changelog: v0.81.2...v0.81.3

🧪 Experiments Added
The reports experiment has been added
As part of delivering #3628 , the reports experiment has been added.
When enabled, Terragrunt will emit summaries of runs at the end of run --all commands.
e.g.
$ terragrunt run --all plan
# Omitted for brevity...
❯❯ Run Summary
Duration: 62ms
Units: 3
Succeeded: 3
The summary can also be disabled using the --summary-disable flag, even when the experiment is active.
You can learn more about this feature here.
More will be added in the near future to allow for report generation and customization. Stay tuned!
What's Changed
- feat: github action for signing executables by @denis256 in #4369
- feat: Adding report package by @yhakbar in #4386
- feat: Added configstack abstraction by @denis256 in #4385
- feat: Integrating report into runs by @yhakbar in #4387
Full Changelog: v0.81.0...v0.81.1

🛠️ Breaking Changes
Bare Includes Deprecated
Use of bare includes (include configuration blocks without a label) are now deprecated.
For example:
include {
path = find_in_parent_folders("root.hcl")
}
Will now result in a deprecation warning, while the following usage of an include with a label added won't:
include "root" {
path = find_in_parent_folders("root.hcl")
}
Using labeled includes result in better performance, as backwards compatibility requires that Terragrunt does additional work during configuration processing. You are advised to update your bare includes to use labels as early as possible.
Note that although this deprecation won't be an immediate breaking change. It will be a breaking change in the future. To opt-in to this breaking change today, you can use the bare-include strict control to mandate usage of the modern, labelled include. Doing so will ensure that you and your teammates are leveraging the most performant version of the configuration block.
Backwards compatibility is guaranteed to remain present for this functionality until at least Terragrunt 2.0.
Logging Moved from Terragrunt Options
If you depend on Terragrunt as a Golang library, you'll want to take note that this release introduces a breaking change to public functions in multiple packages to adjust how the logger is passed. The Terragrunt logger is no longer a member of the TerragruntOptions struct in the options package, and is instead passed explicitly as an argument to functions that need the logger.
For example, the signature for the RunCommand function in the shell package changed from this:
func RunCommand(ctx context.Context, opts *options.TerragruntOptions, command string, args ...string) error
To this:
func RunCommand(ctx context.Context, l log.Logger, opts *options.TerragruntOptions, command string, args ...string) error
You maybe need to manually construct a logger to pass into public functions you are calling in Terragrunt packages as a consequence.
✨ New Features
Added constraint_check HCL Function
A new HCL function, constraint_check, has been added to Terragrunt.
This HCL function allows you to drive logic in your configurations based on constraints checked against arbitrary semantic versions.
For example:
feature "module_version" {
default = "1.2.3"
}
locals {
module_version = feature.module_version.value
needs_v2_adjustments = constraint_check(local.module_version, ">= 2.0.0")
}
terraform {
source = "github.com/my-org/my-module.git//?ref=v${local.module_version}"
}
inputs = !local.needs_v2_adjustments ? {
old_module_input_name = "old_module_input_value"
} : {
new_module_input_name = "new_module_input_value"
}
Using this function, you can alter the behavior of units when particular OpenTofu/Terraform module versions are used, including changing inputs or altering error handling.
What's Changed
- feat: Add constraint_check HCL function by @james03160927 in #4376
- feat: Added license check by @denis256 in #4368
- fix: Always run CI on push by @yhakbar in #4372
- fix: Fixing reference to relative_path_to_include by @yhakbar in #4371
- perf: Moving logger out of opts by @yhakbar in #4367
- chore: Deprecating bare includes by @yhakbar in #4375
- build(deps): Updated Opentelemetry dependencies to 1.36.0 by @denis256 in #4370
- docs: Documenting constraint_check by @yhakbar in #4384
Full Changelog: v0.80.4...v0.80.5

✨ New Features
The exec command now supports --tf-path
The exec command has gained support for use of the --tf-path flag. This can be important when Terragrunt incidentally uses OpenTofu/Terraform to do things like fetch outputs from dependencies.
Thanks to @erpel for contributing this feature!
What's Changed
- feat: Add tf-path flag to exec command by @erpel in #4343
- fix: Optimizing CI cache keys by @yhakbar in #4362
- docs: gcp docs update by @denis256 in #4361
Full Changelog: v0.80.3...v0.80.4

🏎️ Performance Improvements
Significant performance improvements for run --all
The performance of run --all has been improved in two significant ways:
1. Performance for named includes has improved.
Backwards compatibility for bare includes required that Terragrunt do some inefficient work internally to handle both named includes and bare includes by doing an in-memory rewrite of Terragrunt configurations. An optimization has been introduced to avoid this behavior when users use named includes. This optimization does not extend to users that are using bare includes.
Users are advised to avoid using bare includes whenever possible for maximum performance. A strict control has been introduced to enforce usage of named includes.
In a future minor release, a warning will be emitted, instructing users to stop using bare includes. Maintainers will avoid breaking support for bare includes until at least 2.0.
For more information on how to benefit from this optimization, see the migration guide.
2. The check for OpenTofu/Terraform code has been optimized.
To provide helpful error messages when users don't have OpenTofu/Terraform code for Terragrunt to run, Terragrunt checks for the presence of OpenTofu/Terraform configuration files (e.g. *.tf, *.tofu). This check has been optimized to improve performance.
In a micro-benchmark on an M3 Max, using the BenchmarkManyEmptyTerragruntInits benchmark, which tests the performance of a Terragrunt run --all init across 1000 inits, the following performance gains were released:
- 42% speed improvement.
- 43% memory reduction.
More optimizations of this sort are planned for future releases.
Size reduction of compiled binaries
The size of compiled binaries will be reduced due to the stripping of debug symbols from the final executable. As an example, this drops the size of the compiled Linux AMD64 binary from 99MB to 70MB.
This can be a small improvement to download times for environments where Terragrunt is downloaded frequently.
🐛 Bug Fixes
Fixed -detailed-exitcode behavior in run --all
An unintended side-effect of addressing a different bug for Terragrunt’s handling of the -detailed-exitcode flag in OpenTofu/Terraform in retries was that any run in a run --all could override the exit code of the entire run --all.
This has been fixed. The exit code of the run --all -- plan -detailed-exitcode command will now properly aggregate exit codes from all runs in a run --all, only reseting the exit code for an individual unit if it properly recovers after a retry.
What's Changed
- fix: Reverting to defer on cleanup for docs test by @yhakbar in #4344
- fix: Get way more aggressive with cleanup by @yhakbar in #4342
- fix: Removing unnecessary input on flake dispatch by @yhakbar in #4337
- fix: Setting of right exit code in case of -detailed-exitcode by @denis256 in #4357
- fix: Adjusting tf check so that it's easier to update by @yhakbar in #4360
- fix: Fixing discrepancy between Jekyll docs and Starlight docs for validate by @yhakbar in #4359
- perf: Adding optimized tf code check by @yhakbar in #4339
- perf: Deprecating bare includes by @yhakbar in #4340
- docs: Documenting deprecation of bare includes by @yhakbar in #4346
- chore: Reduced size of produced executable by @denis256 in #4341
Full Changelog: v0.80.2...v0.80.3

✨ New Features
find adds support for --include
The find command now supports the --include flag to allow for fine grained control over the discovery of units that include other partial configurations.
e.g.
$ terragrunt find --include --format=json | jq
[
{
"type": "unit",
"path": "bar",
"include": {
"cloud": "cloud.hcl"
}
},
{
"type": "unit",
"path": "foo"
}
]
Combining the flag with tools like jq allows for simple discovery of configurations that include other partial configurations.
$ terragrunt find --include --format=json | jq '[.[] | select(.include.cloud == "cloud.hcl")]'
[
{
"type": "unit",
"path": "bar",
"include": {
"cloud": "cloud.hcl"
}
}
]
🐛 Bug Fixes
--tf-path now correctly overrides terraform_binary
A bug in the precedence logic for Terragrunt configuration parsing resulted in the CLI flag --tf-path from being ignored when the terraform_binary attribute was set.
Terragrunt will now correctly respect the terraform_binary attribute when set, and allow --tf-path to override the value when it is set.
What's Changed
- feat: Adding basic benchmarks by @yhakbar in #4325
- feat: Add support for displaying include configurations in the terragrunt find command by @james03160927 in #4330
- feat: Adding flake test by @yhakbar in #4334
- fix: Fixing usage of --tf-path by @yhakbar in #4332
- fix: Cleaning up addition of --include on find by @yhakbar in #4335
- chore: migrated to golangci-lint v2 by @denis256 in #4333
Full Changelog: v0.80.1...v0.80.2

What's Changed
- chore: Build process now leverages Go 1.24 features and improvements by @denis256 in #4324
Full Changelog: v0.80.0...v0.80.1

Terraform 1.12 support: We are now testing Terragrunt against Terraform 1.12 and is confirmed to be working.
NOTE: Although this release is marked as backward incompatible, it is functionally compatible as nothing has been changed in Terragrunt internals. The minor version release is useful to mark the change in Terraform version that is being tested.
What's Changed
- chore: Added support for Terraform 1.12 by @denis256 in #4317
- build(deps): bump github.com/aws/aws-sdk-go from 1.55.6 to 1.55.7 by @dependabot in #4300
- build(deps): bump cloud.google.com/go/storage from 1.51.0 to 1.53.0 by @dependabot in #4269
- build(deps): bump golang.org/x/sys from 0.32.0 to 0.33.0 by @dependabot in #4268
Full Changelog: v0.79.3...v0.80.0

💪🏽 Enhancements
Limitation on Catalog URLs lifted
A limitation on only supporting recognized go-getter URL patters has been lifted from the catalog command.
The reason this limitation existed in the past was to ensure that users were able to have Terragrunt load module source code in browsers from the catalog Terminal User Interface (TUI). To support that, only a constrained set of sources were supported, to ensure that a button was available to pop open the link in the browser.
image image
Terragrunt will now dynamically adjust the buttons available after module selection to gracefully degrade the experience, instead of completely rejecting repository sources that can't be predictably converted to browser URLs.
image
This allows more users to adopt the Terragrunt Catalog, while providing the same great user experience for users that are on fully supported platforms, like GitHub, GitLab, BitBucket, etc.
What's Changed
- feat: Allow unknown catalog URLs by @yhakbar in #4318
- docs: Clarify ambiguous documentation on variable precedence by @owattley-rotageek in #4319
- chore: Adjusting catalog implementation by @yhakbar in #4315
New Contributors
- @owattley-rotageek made their first contribution in #4319
Full Changelog: v0.79.2...v0.79.3

🚗 Performance Improvements
Improved overall performance by memoizing -version output in each unit.
What's Changed
- feat: Improved performance by memoizing -version output by @denis256 in #4288
Full Changelog: v0.79.1...v0.79.2

💪🏽 Enhancements
The run --all command automatically generates Terragrunt Stacks
If you are using terragrunt.stack.hcl files in your codebase, run --all commands will now automatically expand all terragrunt.stack.hcl files into generated stack configurations, as if you had run stack generate before running the run --all command.
e.g.
terragrunt run --all plan
Is now equivalent to:
terragrunt stack generate
terragrunt run --all plan
If you would like to disable this new behavior, you can use the --no-stack-generate to opt out of automatic stack generation.
📖 Docs Updates
The Terragrunt v1 docs are open for feedback!
These docs will undergo significant adjustments, both stylistically, and functionality on the road to 1.0.
They are a full rewrite of the existing Terragrunt Docs site written in Jekyll to one using Starlight.
Your feedback is requested! If you are reading these release notes relatively soon after release, you should see a link at the top of the site where you can provide your feedback on the new docs.
What's Changed
- feat: Moving users over to terragrunt-v1.gruntwork.io docs by @yhakbar in #4202
- feat: Adding GTM by @yhakbar in #4285
- feat: Github Action tests migration by @denis256 in #4281
- feat: Automatically stack generate in run --all or run --graph command by @james03160927 in #4283
- feat: Adding cloud-nuke cron by @yhakbar in #4306
- feat: Adjusting nav height by @yhakbar in #4284
- fix: Fixing remote-relative-with-slash fixture on ARM tests by @yhakbar in #4297
- fix: Fixing install version by @yhakbar in #4310
- fix: Improved error handling in AWS docs by @denis256 in #4303
- chore: enable TestRemoteDownloadWithRelativePathAndSlashInBranch test by @denis256 in #4286
- build(deps): bump ruby/setup-ruby from 1.233.0 to 1.238.0 by @dependabot in #4270
- build(deps): bump github.com/gruntwork-io/terratest from 0.48.2 to 0.49.0 by @dependabot in #4267
- build(deps): bump ruby/setup-ruby from 1.238.0 to 1.242.0 by @dependabot in #4301
- build(deps): bump DavidAnson/markdownlint-cli2-action from 19 to 20 by @dependabot in #4302
New Contributors
- @james03160927 made their first contribution in #4283
Full Changelog: v0.78.4...v0.79.0

✨ New Features
OpenTelemetry Trace Propogation
In anticipation of the introduction of OpenTelemetry support in OpenTofu 1.10, Terragrunt will now propagate the TRACEPARENT environment variable to child processes to support OpenTelemetry traces that maintain context across Terragrunt and OpenTofu.
This work is based on @Yantrio 's PoC PR #4254, and is only useful due to his work adding OpenTelemtry in OpenTofu. Thank you!
What's Changed
- feat: Added generation of opentelemetry parent traces to invoked executables by @denis256 in #4278
- feat: Added support for Terraform tests in Github Action by @denis256 in #4275
- docs: Added homepage to Starlight docs by @yhakbar in #4250
Full Changelog: v0.78.3...v0.78.4

🐛 Bug Fixes
When an error retry results in a plan succeeding when it initially failed, usage of run --all -- plan -detailed-exitcode will now properly take into account the final exit code, rather than the first one, meaning that the exit code of the whole run will be zero if no other units fail their plans.
Thanks to @wakeful for contributing this fix!
What's Changed
- fix #3845 set the correct exit code when a retry is successful. by @wakeful in #3966
- docs: Improving Run Queue docs by @yhakbar in #4272
Full Changelog: v0.78.2...v0.78.3

What's Changed
- build(deps): bump github.com/gruntwork-io/boilerplate to v0.6.1 by @denis256 in #4263
- build(deps): bump github.com/gruntwork-io/terragrunt-engine-go to v0.0.14 by @denis256 in #4263
- build(deps): bump golang.org/x/oauth2 to v0.30.0 by @denis256 in #4263
- build(deps): bump golang.org/x/sync to v0.14.0 by @denis256 in #4263
- build(deps): bump google.golang.org/api to v0.232.0 by @denis256 in #4263
- build(deps): bump google.golang.org/grpc to v1.72.0 by @denis256 in #4263
- docs: Adding Run Queue Docs by @yhakbar in #4249
- feat: Adding integration tests by @yhakbar in #4198
- fix: Removing HTML font-size by @yhakbar in #4256
- feat: enable GCP integration tests in GH Action by @denis256 in #4257
- feat: fixed TestGcpWorksWithImpersonateBackend test by @denis256 in #4261
- feat: add Windows integration tests by @denis256 in #4262
- chore: dependencies update by @denis256 in #4263
Full Changelog: v0.78.1...v0.78.2

What's Changed
- docs: Updating docs now that stacks are generally available by @yhakbar in #4243
- fix: AWS S3 backend access logging bucket not versioning by @levkohimins in #4246
Full Changelog: v0.78.0...v0.78.1

🧪 Experiments Completed
The stacks experiment is now complete.
If you were previously using the flag --experiment stacks to opt in to experimental functionality, you no longer have to do so. Note that if you are, you will simply get a warning that it is no longer necessary.
🛠️ Breaking Changes
Legacy commands (as replaced by the CLI Redesign are now deprecated, and will be phased out at a future date, which will be scheduled in #3535. Make sure to subscribe to the issue if you would like to be informed when these deprecated features are no longer supported.
For instructions on migrating to the new commands provided after the CLI Redesign, read the CLI Redesign Migration Guide.
The following are now deprecated:
- hclfmt (use hcl fmt instead)
- hclvalidate (use hcl validate instead)
- validate-inputs (use hcl validate --inputs and hcl validate --inputs --strict instead)
- terragrunt-info (use info print instead)
- output-module-groups (use find --dag --json instead)
- render-json (use render --json -w instead)
- graph-dependencies (use dag graph instead)
- run-all (use run --all instead)
- graph (use run --graph instead)
- The default command. e.g. terragrunt workspace list (use terragrunt run -- workspace list instead)
- Default bootstrap (automatically provisioning backend resources without additional flags). This is now opt in behavior, and requires usage of the --backend-bootstrap flag or explicitly running the new backend bootstrap command.
- aws-provider-patch (we are simply deprecating this command, and removing it when the other commands are removed. It served its purpose as a short term stopgap tool).
Note that this will not result in an immediate breaking change for users, as we’ll have an initial deprecation window to give users time to adjust to these changes. If you’d like to ensure that you are prepared for the future removal of legacy commands, you can take advantage of the cli-redesign strict control to opt in to the future breaking change early.
💪🏽 Enhancements
The logging for stack generation has been improved to make it easier to determine at a glance the stack file that’s generating a particular unit.
stacks-generation
What's Changed
- feat: improved stack logs generation by @denis256 in #4213
- feat: stacks expriment completion by @denis256 in #4222
- feat: Deprecating render-json command by @levkohimins in #4227
- feat: Deprecating aws-provider-patch command by @levkohimins in #4228
- feat: Deprecating output-module-groups command by @levkohimins in #4229
- fix: Fixing base tests for macOS by @yhakbar in #4193
- fix: Fixing 404 in performance docs by @yhakbar in #4194
- fix: basic tests execution update by @denis256 in #4192
- fix: Throwing interrupt signal with --all flag by @levkohimins in #4224
- fix: handling of errors in parsing base blocks by @denis256 in #4226
- fix: Cleaning up legacy -all usage by @yhakbar in #4239
- fix: Rename all the --terragrunt- flags by @yhakbar in #4203
- fix: Cleaning up run-all usage by @yhakbar in #4223
- fix: Updating environment variables for flags by @yhakbar in #4240
- fix: Updating migration guide for CLI Redesign migration by @yhakbar in #4207
- docs: Adding docs for cli-redesign strict control by @yhakbar in #4238
- docs: Documenting CLI Redesign deprecations by @yhakbar in #4237
- docs: updated stack links by @denis256 in #4201
- chore: Preserve tests with deprecated commands/flags by @levkohimins in #4242
- chore: hclfmt hclvalidate validate-inputs as deprecated commands (minor fixes) by @levkohimins in #4199
- chore: hclfmt hclvalidate validate-inputs as deprecated commands by @levkohimins in #4196
- build(deps): bump github.com/getsops/sops/v3 from 3.10.1 to 3.10.2 by @dependabot in #4185
- build(deps): bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.34.0 to 1.35.0 by @dependabot in #4184
- build(deps): bump DavidAnson/markdownlint-cli2-action from 15 to 19 by @dependabot in #4187
- build(deps): bump ruby/setup-ruby from 1.230.0 to 1.233.0

🧪 Experiments Completed
The cli-redesign experiment is now complete
The cli-redesign experiment is now complete.
If you were previously using the flag --experiment cli-redesign to opt in to experimental functionality, you no longer have to do so. Note that if you are, you will simply get a warning that it is no longer necessary.
What's Changed
- feat: Adding base tests by @yhakbar in #4176
- chore: Complete CLI Redesign experiment by @yhakbar in #4189
Full Changelog: v0.77.21...v0.77.22

✨ New Features
Introduction of hcl commands
As part of the CLI Redesign experiment, the hcl commands have been introduced.
The hcl commands allow users to directly interact with HCL content independent of the underlying functionality they support.
The functionality of the hcl commands replace existing functionality that is soon to be deprecated:
- hclfmt --> hcl fmt
- hclvalidate --> hcl validate
- validate-inputs --> hcl validate --inputs
- validate-inputs --strict-validate --> hcl validate --inputs --strict
What's Changed
- feat: hcl commands docs by @levkohimins in #4180
- feat: add symbol link experiemnt in discovery process by @denis256 in #4177
- feat: Implementation of hcl commands by @levkohimins in #4169
- fix: Adding redirect from /docs/reference/experiment-mode to /docs/reference/experiments by @yhakbar in #4178
- fix: Fix spelling by @hpe-noinarisak in #4179
- fix: Update status of cli-redesign experiment by @yhakbar in #4188
- build(deps): bump github.com/charmbracelet/bubbles from 0.20.0 to 0.21.0 by @dependabot in #4160
New Contributors
- @hpe-noinarisak made their first contribution in #4179
Full Changelog: v0.77.20...v0.77.21

What's Changed
- build: Added build-no-proxy.yml workflow by @yhakbar in #4171
- build: Added lint.yml and strict-lint.yml workflows for GitHub Actions by @yhakbar in #4172
- build: Added codespell workflow by @yhakbar in #4173
- build: Added markdownlint v2 to GitHub Actions workflows by @yhakbar in #4175
- docs: Improved getting started guide by @yhakbar in #4174
- build(deps): bump github.com/ProtonMail/go-crypto from 1.1.6 to 1.2.0 by @dependabot in #4161
- build(deps): bump golang.org/x/term from 0.30.0 to 0.31.0 by @dependabot in #4159
- build(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.78.2 to 1.79.2 by @dependabot in #4158
Full Changelog: v0.77.19...v0.77.20

✨ New Features
OpenTelemetry traces are now integrated into find and list commands
find telemetry:
image
list telemetry:
image
What's Changed
- feat: Implemented telemetry for find/list by @denis256 in #4165
Full Changelog: v0.77.18...v0.77.19

✨ New Features
Support for HCL formatting with the render command
As part of the CLI Redesign experiment, the render command now supports HCL formatting for rendered configurations, which is the default output format.
Using the render command with HCL formatting allows users to get a quick, minimal evaluation of Terragrunt unit configurations with as much pre-processing done as possible.
For example, the following terragrunt.hcl file:
# terragrunt.hcl
locals {
aws_region = "us-east-1"
}
inputs = {
aws_region = local.aws_region
}
Renders to the following HCL:
$ terragrunt render
locals {
aws_region = "us-east-1"
}
inputs = {
aws_region = "us-east-1"
}
Using the render command with HCL formatting offers a way to resolve complex HCL function evaluation, include merging or string interpolation, etc. to achieve equivalent Terragrunt HCL configurations that are easier to reason about.
What's Changed
- feat: Adding render with HCL formatting by @yhakbar in #4164
Full Changelog: v0.77.17...v0.77.18

✨ New Features
Introduction of the render command
As part of the CLI Redesign experiment, the render command has been introduced.
The render command allows users to easily render Terragrunt unit configurations with reduced complexity, making it easier to understand configurations at a glance.
For example, the following terragrunt.hcl file:
# terragrunt.hcl
locals {
aws_region = "us-east-1"
}
inputs = {
aws_region = local.aws_region
}
Renders to the following JSON:
$ terragrunt render --format json
{
"locals": { "aws_region": "us-east-1" },
"inputs": { "aws_region": "us-east-1" }
// NOTE: other attributes are omitted for brevity
}
The introduction of the render command is part of the eventual deprecation of the existing render-json command, which will be deprecated by the end of the CLI Redesign. The render command is a higher level command, that offers the ability to write to stdout, in addition to writing to files, and will support HCL configurations in addition to JSON (coming soon).
To learn more about the render command, read the official documentation here.
What's Changed
- feat: Adding render command by @yhakbar in #4145
- feat: Adding docs for backend migrate by @yhakbar in #4140
- build(deps): bump ruby/setup-ruby from 1.229.0 to 1.230.0 by @dependabot in #4162
Full Changelog: v0.77.16...v0.77.17

What's Changed
- fix: Improved the deprecation message for experimental command flags by @levkohimins in #4146
- fix: Prevent TF_CLI_CONFIG_FILE environment variable from being overwritten, except during init and providers commands by @levkohimins in #4155
- feat: Added support for migrating state between different backends by @levkohimins in #4154
- feat: Enhanced error explainer to detect and report issues related to stack values by @denis256 in #4163
Full Changelog: v0.77.15...v0.77.16

✨ New Features
Introduction of the dag graph command
As part of the CLI Redesign experiment, the dag graph command has been introduced.
dag
dag-help
dag-graph-help
What's Changed
- docs: Added migration guide for adopting Terragrunt Stacks by @yhakbar in #4152
- feat: Added dag graph command by @denis256 in #4143
Full Changelog: v0.77.14...v0.77.15

✨ New Features
Support for --exclude and --queue-construct-as in find and list
The find and list commands have been updated to leverage new capabilities involving greater understanding of the Terragrunt run queue.
Users can now leverage the --queue-construct-as (or just --as) flag in the find and list commands to discover configurations as if a particular Terragrunt command was being run (e.g. plan, destroy).
For example:
$ terragrunt find --queue-construct-as=plan
stacks/live/dev
stacks/live/prod
units/live/dev/vpc
units/live/prod/vpc
units/live/dev/db
units/live/prod/db
units/live/dev/ec2
units/live/prod/ec2
$ terragrunt find --as=destroy
stacks/live/dev
stacks/live/prod
units/live/dev/ec2
units/live/prod/ec2
units/live/dev/db
units/live/prod/db
units/live/dev/vpc
units/live/prod/vpc
The find and list commands will now construct the Terragrunt run queue as if a particular command was being run, potentially altering the position of elements in the run queue, based on their dependencies (dependencies before dependents for plans, applies, etc. and dependents before dependencies for destroys).
In addition, users can leverage the --exclude flag on the find command to get information on the exclude block included in results. The exclude block is also factored in to discovery results when the --queue-construct-as flag is passed, allowing users to dry-run behavior of the exclude block before performing any Terragrunt runs.
What's Changed
- feat: Adding exclude support to list and find by @yhakbar in #4147
Full Changelog: v0.77.13...v0.77.14

What's Changed
- build(deps): bump google.golang.org/grpc from 1.71.0 to 1.71.1 by @dependabot in #4132
- build(deps): bump golang.org/x/sys from 0.31.0 to 0.32.0 by @dependabot in #4133
- build(deps): bump golang.org/x/oauth2 from 0.28.0 to 0.29.0 by @dependabot in #4131
- build(deps): bump github.com/getsops/sops/v3 from 3.9.4 to 3.10.1 by @dependabot in #4130
Full Changelog: v0.77.12...v0.77.13

✨ New Features
Introduced no_validation attribute for stack and unit, allowing users to bypass Terragrunt's validation checks when deploying infrastructure. This is particularly useful in scenarios where you need to deploy infrastructure that doesn't strictly adhere to Terragrunt's validation rules, such as during emergency deployments or when working with legacy infrastructure patterns.
What's Changed
- docs: added more docs for stacks by @yhakbar in #4144
- feat: added support for no_validation attribute for stack and unit by @denis256 in #4149
RFC: #3313
Full Changelog: v0.77.11...v0.77.12

✨ New Features
Introduction of the info print command
As part of the CLI Redesign experiment, the info print command has been introduced.
help
out
What's Changed
- feat: Introduced the info print command to output Terragrunt context as a structured JSON object by @denis256 in #4122
Full Changelog: v0.77.10...v0.77.11

What's Changed
- fix: Suppressing warning for catalog when determining default file name by @yhakbar in #4134
- fix: Remove warning message for unimplemented backends by @levkohimins in #4138
- fix: Fixing optional default template by @yhakbar in #4141
- chore: stack code improvements by @denis256 in #4136
Full Changelog: v0.77.9...v0.77.10

🐛 Bug fixes
Fetching Outputs from Nested Stacks
Resolved an issue that prevented the correct retrieval of outputs from nested stacks.
What's Changed
- fix: corrected the logic for fetching outputs from nested stacks by @denis256 in #4126
Full Changelog: v0.77.8...v0.77.9

✨ New Features
Users can now configure a custom default template for scaffold and catalog commands in their catalog configuration blocks like so:
catalog {
default_template = "git@github.com/acme/example.git//path/to/template"
}
For more information, read the documentation in the catalog feature.
Special thanks to @tgeijg for contributing this feature!
What's Changed
- feat: Adding custom default template #3658 by @tgeijg in #4035
- fix: Updating docs after #4035 by @yhakbar in #4117
- chore: stacks documentation improvements by @denis256 in #4114
New Contributors
- @tgeijg made their first contribution in #4035
Full Changelog: v0.77.6...v0.77.7

What's Changed
- feat: Clean up TF commands help by @levkohimins in #3895
- feat: Stack unit path validation by @denis256 in #3897
- chore: Replace golang.org/x/exp with stdlib by @Juneezee in #3881
- build(deps): bump ruby/setup-ruby from 1.215.0 to 1.221.0 by @dependabot in #3894
Full Changelog: v0.73.6...v0.73.7

Updated CLI args, config attributes and blocks
--feature
feature
TERRAGRUNT_FEATURE
What's Changed
Introduced a new HCL block and additional CLI options to enable feature flag management
Updated otlptracegrpc dependency from 1.23.0 to 1.31.0

What's Changed
build(deps): bump ruby/setup-ruby from 1.196.0 to 1.199.0 by @dependabot in #3531
build(deps): bump cloud.google.com/go/storage from 1.44.0 to 1.46.0 by @dependabot in #3530
feat: Implement terragrunt-dont-check-dependent-modules flag by @kbcz1989 in #3534
New Contributors
@kbcz1989 made their first contribution in #3534

Updated CLI args, config attributes and blocks
--terragrunt-provider-cache
What's Changed
Improved offline error detection in the provider cache to handle air-gapped environments.

Updated CLI args, config attributes and blocks
--terragrunt-out-dir
--terragrunt-json-out-dir
What's Changed
Updated --terragrunt-out-dir / --terragrunt-json-out-dir to handle relative paths.

Updated CLI args, config attributes and blocks
dependency
What's Changed
Added strict flag for improved performance in dependency processing
You can now enhance performance by setting the environment variable:
TERRAGRUNT_STRICT_CONTROL="skip-dependencies-inputs"
This will skip input processing for dependencies, leading to faster execution times when running Terragrunt.
Improved CI/CD pipeline to build without Go proxy and detect checksum changes.
Enhanced error messages for invalid strict control flags.
Updated dependencies for better performance and stability.
Refined scaffold documentation.
Fixed panic issue in Sops decryption.
Corrected handling of pseudo-tty commands.

What's Changed
feat: Upgrading go-getter to v2 in scaffold by @yhakbar in #3455
CICD updates by @denis256 in #3467
chore: Updating deps by @yhakbar in #3480

New Features
This release introduces the availability of Strict Mode, a new pattern that is going to be used for deprecation of functionality going forward in Terragrunt.
Starting with this release, any deprecated functionality will be deprecated using what are called Strict Controls. These controls will allow you to opt-in to having any deprecated functionality break immediately. This mechanism is being introduced to provide a way for users to future proof their codebase, and know that they can safely upgrade to new versions of Terragrunt.
This will be especially important to address the changes listed in #3445.
To learn more, click here.
What's Changed
feat: Adding Strict Package by @yhakbar in #3424

What's Changed
Redirect log engine messages to stderr by @denis256 in #3468
Fixing modules output corruption by @levkohimins in #3459

What's Changed
fix: Removing non non-interactive logic in err stream redirect by @yhakbar in #3464

New Behavior
This release includes multiple behavioral changes including the following:
- The skip attribute is now merged in from included files.
- A secondary init is no longer marked as required after an explicit init in a clean directory.
- The usage of go-getter in the scaffold command was upgraded to leverage v2.
What's Changed
build(deps): bump webrick from 1.8.1 to 1.8.2 in /docs by @dependabot in #3436
feat: support merging the "skip" attribute from included files. by @rodrigorfk in #3225
fix(init): do not require re-init after explicit init on clean directory by @jaymecd in #2949
fix: Fix concurrent map write due to read lock and delete by @Resonance1584 in #3457
fix: Suppressing 423 error in Terragrunt Provider Cache by @levkohimins in #3453
New Contributors
@jaymecd made their first contribution in #2949

Updated CLI args, config attributes and blocks
console
What's Changed
Fixed issue with console redirection input handling.
Related links
#3451

What's Changed
Added support for Terragrunt log-level propagation to the Terragrunt Engine.

What's Changed
fix: Support terragrunt-auth-provider-cmd flag for the sops_decrypt_file function by @yhakbar in #3439

What's Changed
Updated Go version used during builds to 1.23

What's Changed
Fixing converting absolute paths to relative in logs by @levkohimins in #3433
Fixing registry host discovery (Terragrunt Provider Cache) by @levkohimins in #3432

What's Changed
feat: introducing "copy_terraform_lock_file" to fine tune Lock File Handling by @rodrigorfk in #2889

Updated CLI args, config attributes and blocks
terraform
What's Changed
Improved process error handling to provide detailed output for caught errors.
Related links
#3423

Updated CLI args, config attributes and blocks
catalog
What's Changed
feat: Adding codespell to Automatically Check Spelling.
feat: Adding issue templates.
bug: Fixing repository update for catalog command.
Related links
#3413
#3416
#3415

What's Changed
Allow pre-release versions to pass version constraints.
Fixing output STDOUT logs to stdout. Without the --terragrunt-forward-tf-stdout flag, STDOUT level log entries were sent to stdout. They mixed with the JSON output and could cause parsing issues in the user's workflow.
Related links
#3405
#3409

Updated CLI args, config attributes and blocks
--terragrunt-log-show-abs-paths
--terragrunt-log-disable
What's Changed
Fixing various logging issues.
Removing panic, fatal log levels.
Adding stderr, stdout log levels to control Terraform/OpenTofu output in the Terragrunt log.
Adding --terragrunt-log-show-abs-paths flag to show absolute paths in logs.
Adding --terragrunt-log-disable flag to disable logging.
Adding preserved label exemption to stale check.
Related links
#3396
#3392
#3400

Updated CLI args, config attributes and blocks
terraform
Description
feat: Added TERRAGRUNT_TEMP_QUOTE_NULL environment variable to change the handling of null values.
TERRAGRUNT_TEMP_QUOTE_NULL
Setting the value of this undocumented feature flag to 1 allows users to temporarily revert the breaking change in release v0.50.0, preventing the sending of string "null" as the value of an input to OpenTofu/Terraform instead of not set an input at all.

The flag is being introduced into the codebase for a temporary duration to support Enterprise customers that have asked for this as a stop gap while they update their codebase to no longer need it.

Terragrunt will not support this flag in the future. Do not rely on it.

We will be coordinating closely with Enterprise customers to determine when they no longer need it supported. At that time, removal of the feature flag will be scheduled, then removed.

Related links
#3395

What's Changed
fix: Reverting changes in #3383 by @yhakbar in #3385

What's Changed
chore: Tests simplification by @denis256 in #3365
build(deps-dev): bump rexml from 3.3.3 to 3.3.6 in /docs by @dependabot in #3359
chore: Migration from master to main by @denis256 in #3379
fix: Update Remote State Encryption When Configurations Are Updated by @yhakbar in #3383

Description
Updated go-getter to v1.7.6
Updated aws-sdk-go to v1.55.5
Related links
#3374

Updated CLI args, config attributes and blocks
--terragrunt-forward-tf-stdout
--terragrunt-disable-log-formatting
Breaking Changes
--terragrunt-include-module-prefix flag is deprecated, use --terragrunt-forward-tf-stdout instead

Updated CLI args, config attributes and blocks
--terragrunt-fetch-dependency-output-from-state
Description
Fixed the --terragrunt-fetch-dependency-output-from-state feature flag to work correctly with non-applied dependencies.
Special thanks
Special thanks to @rodrigorfk for their contribution!
Related links
#3350

Updated CLI args, config attributes and blocks
hclvalidate
Description
Fixing "dependency cycle between modules" when using hclvalidate command with undefined config_path attribute.
Related links
#3305

Updated CLI args, config attributes and blocks
run-all
--terragrunt-out-dir
--terragrunt-json-out-dir
Description
Updated --terragrunt-out-dir to use plan from directory hierarchy.
Added new flag --terragrunt-json-out-dir to save plan in JSON format.
Related links
#3084

Description
Fixed getting output from multiple nested dependencies
Related links
#3071

Updated CLI args, config attributes and blocks
--terragrunt-json-log
--terragrunt-tf-logs-to-json
Description
- Fixed handling of dependency outputs when JSON log format is enabled
Related links
- #3049

Updated CLI args, config attributes and blocks
- apply -destroy
Description
- Fixes destroy order for apply -destroy alias command
Related links
- #3011

Updated CLI args, config attributes and blocks
- terraform
Related links
- #2576