TFLint: download ældre versioner

## What's Changed

### Security Fixes
• deps：Bump Go version to 1.26.10 by @wata727 in https://github.com/terraform-linters/tflint/pull/2672

### Enhancements
• formatter：make JUnit error testcase names unique by @Kunalbehbud in https://github.com/terraform-linters/tflint/pull/2592

### Changes
• terraform：iterate primary files in a deterministic order by @KetchupBomb in https://github.com/terraform-linters/tflint/pull/2633
• langserver：log request params only at trace level by @chernetskyi in https://github.com/terraform-linters/tflint/pull/2642

### Chores
• build(deps)：Bump golang from 1.26.4-alpine3.23 to 1.26.5-alpine3.23 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2601
• build(deps)：Bump the go-x group with 3 updates by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2602
• build(deps)：Bump github.com/klauspost/compress from 1.18.6 to 1.19.0 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2603
• build(deps)：Bump github.com/zclconf/go-cty from 1.18.1 to 1.19.0 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2604
• build(deps)：Bump docker/setup-buildx-action from 4.1.0 to 4.2.0 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2589
• build(deps)：Bump docker/login-action from 4.2.0 to 4.4.0 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2590
• build(deps)：Bump docker/metadata-action from 6.1.0 to 6.2.0 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2586
• Remove broken badges and charts from README by @wata727 in https://github.com/terraform-linters/tflint/pull/2605
• Postpone the deletion date for the installation script by @wata727 in https://github.com/terraform-linters/tflint/pull/2606
• build(deps)：Bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2610
• build(deps)：Bump actions/checkout from 7.0.0 to 7.0.1 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2611
• build(deps)：Bump github.com/klauspost/compress from 1.19.0 to 1.19.1 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2614
• build(deps)：Bump actions/setup-go from 6.5.0 to 7.0.0 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2612
• build(deps)：Bump actions/attest from 4.1.1 to 4.2.0 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2613
• Modernize the codebase with `go fix` by @bendrucker in https://github.com/terraform-linters/tflint/pull/2616
• build(deps)：Bump docker/login-action from 4.4.0 to 4.5.2 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2618
• build(deps)：Bump docker/login-action from 4.5.2 to 4.6.0 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2620
• build(deps)：Bump actions/attest from 4.2.0 to 4.2.1 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2619
• build(deps)：Bump github.com/sourcegraph/jsonrpc2 from 0.2.1 to 0.2.2 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2623
• build(deps)：Bump github.com/sigstore/sigstore-go from 1.2.2 to 1.3.0 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2622
• build(deps)：Bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2621
• Bump Go version to 1.26.5 by @apoiget in https://github.com/terraform-linters/tflint/pull/2626
• build(deps)：Bump golang from 1.26.5-alpine3.23 to 1.27rc2-alpine3.23 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2627
• build(deps)：Bump actions/attest from 4.2.1 to 4.2.2 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2629
• build(deps)：Bump github.com/klauspost/compress from 1.19.1 to 1.19.2 by @dependabot[bot] in https://github.com/terraform-linters/tflint/pull/2628
• build(deps)：Bump golang from 1.27rc2-alpine3.23 

What's Changed
Enhancements
- cmd: include worker dir for no-range recursive issues by @Zakharden in #2524
- config: add ignorable rule setting by @Zakharden in #2525
- formatter(junit): include range in testcase name by @Zakharden in #2538
Bug Fixes
- plugin: fetch attestation bundles from bundle_url by @Kunalbehbud in #2593
- Merged as #2600
Chores
- Refactor formatter dispatch into format adapters by @bendrucker in #2556
- Inline per-format print methods into their adapters by @bendrucker in #2557
- build(deps): Bump docker/setup-buildx-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #2559
- build(deps): Bump github.com/mattn/go-colorable from 0.1.14 to 0.1.15 by @dependabot[bot] in #2560
- build(deps): Bump golang from 1.26.3-alpine3.23 to 1.26.4-alpine3.23 by @dependabot[bot] in #2558
- release: Set branch name for Homebrew tap by @wata727 in #2561
- Extract the shared runner-setup pipeline by @bendrucker in #2555
- formatter: guard diagnostics with no source range by @bendrucker in #2562
- docs: add Go install instructions to README by @RoseSecurity in #2563
- build(deps): Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #2565
- build(deps): Bump alpine from 3.23.4 to 3.24.0 by @dependabot[bot] in #2566
- build(deps): Bump the go-x group with 2 updates by @dependabot[bot] in #2567
- build(deps): Bump github.com/sigstore/sigstore-go from 1.1.4 to 1.2.0 by @dependabot[bot] in #2568
- fix(install): close download and zip readers by @RoseSecurity in #2564
- build(deps): Bump alpine from 3.24.0 to 3.24.1 by @dependabot[bot] in #2570
- build(deps): Bump golang.org/x/net from 0.55.0 to 0.56.0 in the go-x group by @dependabot[bot] in #2571
- build(deps): Bump github.com/sigstore/sigstore-go from 1.2.0 to 1.2.1 by @dependabot[bot] in #2572
- build(deps): Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #2579
- build(deps): Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #2580
- build(deps): Bump golangci/golangci-lint-action from 9.2.1 to 9.3.0 by @dependabot[bot] in #2583
- build(deps): Bump goreleaser/goreleaser-action from 7.2.2 to 7.2.3 by @dependabot[bot] in #2582
- build(deps): Bump actions/attest from 4.1.0 to 4.1.1 by @dependabot[bot] in #2581
- build(deps): Bump docker/build-push-action from 7.2.0 to 7.3.0 by @dependabot[bot] in #2584
- build(deps): Bump golang.org/x/text from 0.38.0 to 0.39.0 in the go-x group by @dependabot[bot] in #2585
- build(deps): Bump github.com/sigstore/sigstore-go from 1.2.1 to 1.2.2 by @dependabot[bot] in #2588
- build(deps): Bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot[bot] in #2587
New Contributors
- @Zakharden made their first contribution in #2524
- @RoseSecurity made their first contribution in #2563
- @Kunalbehbud made their first contribution in #2593
Full Changelog: v0.63.1...v0.64.0

What's Changed
Note
This release contains only a fix for the release pipeline; the actual behavior remains unchanged from v0.63.0.
Chores
- Pass the GitHub App token as the step output by @wata727 in #2553
- Remove unneeded job dependency by @wata727 in #2554
Full Changelog: v0.63.0...v0.63.1

What's Changed
Enhancements
- Add support for Terraform v1.15 by @wata727 in #2521
- Bump tflint-ruleset-terraform to v0.15.0 by @wata727 in #2551
Chores
- Migrate homebrew-core to third-party tap by @wata727 in #2531
- Revise installation instructions in README.md by @wata727 in #2532
- build(deps): Bump sigstore/cosign-installer from 4.1.1 to 4.1.2 by @dependabot[bot] in #2535
- build(deps): Bump the go-x group with 3 updates by @dependabot[bot] in #2536
- Migrate homebrew auto bump action to GoReleaser by @wata727 in #2534
- Fix variable reference for client-id in release.yml by @wata727 in #2537
- build(deps): Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot[bot] in #2546
- build(deps): Bump docker/build-push-action from 7.1.0 to 7.2.0 by @dependabot[bot] in #2548
- build(deps): Bump docker/metadata-action from 6.0.0 to 6.1.0 by @dependabot[bot] in #2549
- build(deps): Bump docker/login-action from 4.1.0 to 4.2.0 by @dependabot[bot] in #2550
- build(deps): Bump the go-x group with 2 updates by @dependabot[bot] in #2547
- build(deps): Bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #2542
- build(deps): Bump goreleaser/goreleaser-action from 7.2.1 to 7.2.2 by @dependabot[bot] in #2540
- build(deps): Bump golang from 1.26-alpine3.23 to 1.26.3-alpine3.23 by @dependabot[bot] in #2541
- build(deps): Bump alpine from 3.23 to 3.23.4 by @dependabot[bot] in #2539
- Add warning message to installation script by @wata727 in #2533
Full Changelog: v0.62.1...v0.63.0

What's Changed
Bug Fixes
- plugin: Skip fetching artifact attestations in GHES by @wata727 in #2527
Chores
- build(deps): Bump github.com/zclconf/go-cty from 1.18.0 to 1.18.1 by @dependabot[bot] in #2511
- build(deps): Bump goreleaser/goreleaser-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #2512
- docs: deprecate curl pipe bash installation by @dbuaon in #2514
- build(deps): Bump goreleaser/goreleaser-action from 7.1.0 to 7.2.1 by @dependabot[bot] in #2516
- build(deps): Bump github.com/apparentlymart/go-cidr from 1.1.0 to 1.1.1 by @dependabot[bot] in #2517
- build(deps): Bump github.com/in-toto/in-toto-golang from 0.9.0 to 0.11.0 by @dependabot[bot] in #2518
- build(deps): Bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in #2519
- build(deps): Bump github.com/hashicorp/go-plugin from 1.7.0 to 1.8.0 by @dependabot[bot] in #2520
New Contributors
- @dbuaon made their first contribution in #2514
Full Changelog: v0.62.0...v0.62.1

What's Changed
Enhancements
- plugin: Add signature mode to control plugin verifications by @wata727 in #2483
Bug Fixes
- plugin: Ignore forbidden attestation fetch errors by @wata727 in #2481
Chores
- build(deps): Bump the go-x group with 4 updates by @dependabot[bot] in #2461
- build(deps): Bump docker/build-push-action from 6.18.0 to 6.19.2 by @dependabot[bot] in #2463
- build(deps): Bump google.golang.org/grpc from 1.78.0 to 1.79.1 by @dependabot[bot] in #2464
- build(deps): Bump goreleaser/goreleaser-action from 6.4.0 to 7.0.0 by @dependabot[bot] in #2467
- build(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 by @dependabot[bot] in #2469
- build(deps): Bump actions/setup-go from 6.2.0 to 6.3.0 by @dependabot[bot] in #2470
- build(deps): Bump golang.org/x/net from 0.50.0 to 0.51.0 in the go-x group by @dependabot[bot] in #2472
- build(deps): Bump github.com/zclconf/go-cty from 1.17.0 to 1.18.0 by @dependabot[bot] in #2473
- build(deps): Bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by @dependabot[bot] in #2471
- build(deps): Bump docker/metadata-action from 5.10.0 to 6.0.0 by @dependabot[bot] in #2474
- build(deps): Bump sigstore/cosign-installer from 4.0.0 to 4.1.0 by @dependabot[bot] in #2476
- build(deps): Bump golang.org/x/oauth2 from 0.35.0 to 0.36.0 in the go-x group by @dependabot[bot] in #2479
- build(deps): Bump google.golang.org/grpc from 1.79.1 to 1.79.2 by @dependabot[bot] in #2480
- build(deps): Bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by @dependabot[bot] in #2475
- build(deps): Bump docker/build-push-action from 6.19.2 to 7.0.0 by @dependabot[bot] in #2477
- build(deps): Bump docker/login-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #2478
- deps: Bump Go version to 1.26 by @wata727 in #2482
- build(deps): Bump the go-x group with 3 updates by @dependabot[bot] in #2484
- build(deps): Bump google.golang.org/grpc from 1.79.2 to 1.79.3 by @dependabot[bot] in #2489
- build(deps): Bump mislav/bump-homebrew-formula-action from 3.6 to 4.1 by @dependabot[bot] in #2490
- build(deps): Bump github.com/terraform-linters/tflint-plugin-sdk from 0.23.1 to 0.24.0 by @dependabot[bot] in #2491
- build(deps): Bump github.com/fatih/color from 1.18.0 to 1.19.0 by @dependabot[bot] in #2492
- dependabot: Set cooldown period by @wata727 in #2493
- build(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #2495
- build(deps): Bump github.com/hashicorp/go-version from 1.8.0 to 1.9.0 by @dependabot[bot] in #2496
- build(deps): Bump actions/setup-go from 6.3.0 to 6.4.0 by @dependabot[bot] in #2498
- build(deps): Bump github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream from 1.7.4 to 1.7.8 by @dependabot[bot] in #2499
- build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3 from 1.95.0 to 1.97.3 by @dependabot[bot] in #2500
- build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 by @dependabot[bot] in #2501
- build(deps): Bump github.com/hashicorp/go-getter from 1.8.4 to 1.8.6 by @dependabot[bot] in #2502
- build(deps): Bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 by @dependabot[bot] in #2506
- build(deps): Bump google.golang.org/grpc from 1.79.3 to 1.80.0 by @dependabot[bot] in #2503
- build(deps): Bump sigstore/cosign-installer from 4.1.0 to 4.1.1 by @dependabot[bot] in #2497
- build(deps): Bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #2504
- build(deps): Bump docker/build-push-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #2507
- release: Migrate attest-build-provenance to attest by @wata727 in #2508
Full Changelog: v0.61.0...v0.62.0

What's Changed
Enhancements
- version: add update notifications, json output by @bendrucker in #2421
- build(deps): Bump github.com/terraform-linters/tflint-ruleset-terraform from 0.13.0 to 0.14.1 by @dependabot[bot] in #2445
- plugin: Enable plugin keyless verification by default by @wata727 in #2453
Chores
- build(deps): Bump actions/checkout from 5.0.0 to 5.0.1 by @dependabot[bot] in #2414
- build(deps): Bump the go-x group with 3 updates by @dependabot[bot] in #2415
- build(deps): Bump golang.org/x/crypto from 0.44.0 to 0.45.0 by @dependabot[bot] in #2416
- build(deps): Bump google.golang.org/grpc from 1.76.0 to 1.77.0 by @dependabot[bot] in #2417
- build(deps): Bump golangci/golangci-lint-action from 9.0.0 to 9.1.0 by @dependabot[bot] in #2418
- build(deps): Bump actions/checkout from 5.0.1 to 6.0.0 by @dependabot[bot] in #2420
- build(deps): Bump actions/setup-go from 6.0.0 to 6.1.0 by @dependabot[bot] in #2419
- build(deps): Bump docker/metadata-action from 5.9.0 to 5.10.0 by @dependabot[bot] in #2422
- build(deps): Bump github.com/hashicorp/go-version from 1.7.0 to 1.8.0 by @dependabot[bot] in #2423
- build(deps): Bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #2425
- build(deps): Bump golang.org/x/oauth2 from 0.33.0 to 0.34.0 in the go-x group by @dependabot[bot] in #2428
- build(deps): Bump golangci/golangci-lint-action from 9.1.0 to 9.2.0 by @dependabot[bot] in #2426
- build(deps): Bump the go-x group with 3 updates by @dependabot[bot] in #2432
- build(deps): Bump github.com/sigstore/sigstore-go from 1.1.3 to 1.1.4 by @dependabot[bot] in #2433
- Add support for Terraform v1.14 by @wata727 in #2424
- build(deps): Bump alpine from 3.22 to 3.23 by @dependabot[bot] in #2427
- build(deps): Bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by @dependabot[bot] in #2437
- build(deps): Bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by @dependabot[bot] in #2438
- build(deps): Bump github.com/zclconf/go-cty-yaml from 1.1.0 to 1.2.0 by @dependabot[bot] in #2439
- Add an integration test for root only traversal by @wata727 in #2436
- build(deps): Bump google.golang.org/grpc from 1.77.0 to 1.78.0 by @dependabot[bot] in #2441
- build(deps): Bump the go-x group with 3 updates by @dependabot[bot] in #2444
- build(deps): Bump actions/setup-go from 6.1.0 to 6.2.0 by @dependabot[bot] in #2446
- docs: windows plugin development by @Netkracker in #2334
- build(deps): Bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1 by @dependabot[bot] in #2450
- build(deps): Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by @dependabot[bot] in #2451
- build(deps): Bump github.com/sigstore/sigstore from 1.10.3 to 1.10.4 by @dependabot[bot] in #2452
- build(deps): Bump actions/checkout from 6.0.1 to 6.0.2 by @dependabot[bot] in #2454
- build(deps): Bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by @dependabot[bot] in #2455
- build(deps): Bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 by @dependabot[bot] in #2456
- build(deps): Bump docker/login-action from 3.6.0 to 3.7.0 by @dependabot[bot] in #2458
New Contributors
- @Netkracker made their first contribution in #2334
Full Changelog: v0.60.0...v0.61.0

What's Changed
This release introduces a new configuration file format: .tflint.json. This is useful for workflows such as automatically generating configuration files.
Please note that in order to use the .tflint.json, enabled plugins must be built with SDK v0.23+.
From this release, Cosign signatures (checksums.txt.keyless.sig and checksums.txt.pem) are deprecated. They will not be included in future releases. If your installation scripts depend on them, please migrate to gh attestation verify.
Enhancements
- Add JSON configuration file support by @rorychatterton in #2391
- Report structured errors in JUnit and CheckStyle XML formatters by @bendrucker in #2407
Changes
- Alphabetize rulesets in version output by @bendrucker in #2404
- release: Pin Cosign version and deprecate Cosign signatures by @wata727 in #2405
Bug Fixes
- fix: only read TF_VAR for root module by @bendrucker in #2413
Chores
- build(deps): Bump actions/attest-build-provenance from 2.4.0 to 3.0.0 by @dependabot[bot] in #2376
- build(deps): Bump actions/setup-go from 5.5.0 to 6.0.0 by @dependabot[bot] in #2377
- build(deps): Bump the go-x group with 3 updates by @dependabot[bot] in #2378
- build(deps): Bump github.com/spf13/afero from 1.14.0 to 1.15.0 by @dependabot[bot] in #2380
- build(deps): Bump github.com/zclconf/go-cty from 1.16.4 to 1.17.0 by @dependabot[bot] in #2379
- build(deps): Bump golang.org/x/net from 0.43.0 to 0.44.0 in the go-x group by @dependabot[bot] in #2381
- build(deps): Bump google.golang.org/grpc from 1.75.0 to 1.75.1 by @dependabot[bot] in #2382
- build(deps): Bump github.com/sigstore/sigstore-go from 1.1.1 to 1.1.2 by @dependabot[bot] in #2383
- build(deps): Bump sigstore/cosign-installer from 3.9.2 to 3.10.0 by @dependabot[bot] in #2384
- build(deps): Bump mislav/bump-homebrew-formula-action from 3.5 to 3.6 by @dependabot[bot] in #2388
- fix(script): GitHub API rate limit by @Sander0542 in #2390
- Bump tflint-plugin-sdk to v0.23.0 by @wata727 in #2393
- build(deps): Bump github.com/sigstore/sigstore-go from 1.1.2 to 1.1.3 by @dependabot[bot] in #2394
- build(deps): Bump docker/login-action from 3.5.0 to 3.6.0 by @dependabot[bot] in #2395
- build(deps): Bump the go-x group with 4 updates by @dependabot[bot] in #2397
- build(deps): Bump google.golang.org/grpc from 1.75.1 to 1.76.0 by @dependabot[bot] in #2398
- build(deps): Bump sigstore/cosign-installer from 3.10.0 to 4.0.0 by @dependabot[bot] in #2399
- build(deps): Bump golang.org/x/net from 0.45.0 to 0.46.0 in the go-x group by @dependabot[bot] in #2400
- build(deps): Bump github.com/terraform-linters/tflint-plugin-sdk from 0.23.0 to 0.23.1 by @dependabot[bot] in #2402
- build(deps): Bump golangci/golangci-lint-action from 8.0.0 to 9.0.0 by @dependabot[bot] in #2408
- build(deps): Bump docker/metadata-action from 5.8.0 to 5.9.0 by @dependabot[bot] in #2409
- build(deps): Bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 in the go-x group by @dependabot[bot] in #2410
New Contributors
- @Sander0542 made their first contribution in #2390
- @rorychatterton made their first contribution in #2391
Full Changelog: v0.59.1...v0.60.0

What's Changed
Enhancements
- build(deps): Bump github.com/terraform-linters/tflint-ruleset-terraform from 0.12.0 to 0.13.0 by @dependabot[bot] in #2351
- json: add fixed, fixable by @bendrucker in #2355
Bug Fixes
- format(sarif): Add tflint-errors rules for errors by @wata727 in #2373
Chores
- build(deps): Bump github.com/sigstore/sigstore-go from 1.0.0 to 1.1.0 by @dependabot[bot] in #2343
- build(deps): Bump golang.org/x/net from 0.41.0 to 0.42.0 in the go-x group across 1 directory by @dependabot[bot] in #2346
- build(deps): Bump sigstore/cosign-installer from 3.9.1 to 3.9.2 by @dependabot[bot] in #2347
- workflow: validate issues by @bendrucker in #2348
- build(deps): Bump google.golang.org/grpc from 1.73.0 to 1.74.2 by @dependabot[bot] in #2349
- build(deps): Bump docker/login-action from 3.4.0 to 3.5.0 by @dependabot[bot] in #2350
- build(deps): Bump mislav/bump-homebrew-formula-action from 3.4 to 3.5 by @dependabot[bot] in #2353
- dependabot: allow actions writes by @bendrucker in #2356
- build(deps): Bump docker/metadata-action from 5.7.0 to 5.8.0 by @dependabot[bot] in #2352
- build(deps): Bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #2357
- build(deps): Bump the go-x group with 3 updates by @dependabot[bot] in #2358
- build(deps): Bump github.com/sigstore/sigstore-go from 1.1.0 to 1.1.1 by @dependabot[bot] in #2359
- build(deps): Bump github.com/hashicorp/go-plugin from 1.6.3 to 1.7.0 by @dependabot[bot] in #2360
- build(deps): Bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by @dependabot[bot] in #2361
- build(deps): Bump golang from 1.24-alpine3.21 to 1.25-alpine3.21 by @dependabot[bot] in #2362
- build(deps): Bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 by @dependabot[bot] in #2363
- build(deps): Bump github.com/hashicorp/go-getter from 1.7.8 to 1.7.9 by @dependabot[bot] in #2364
- build(deps): Bump google.golang.org/grpc from 1.74.2 to 1.75.0 by @dependabot[bot] in #2365
- build(deps): Bump github.com/zclconf/go-cty from 1.16.3 to 1.16.4 by @dependabot[bot] in #2366
- build(deps): Bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 by @dependabot[bot] in #2371
- Add support for Terraform v1.13 by @wata727 in #2372
- deps: Bump Go version to 1.25 by @wata727 in #2374
- Bump github.com/ulikunitz/xz to v0.5.15 by @wata727 in #2375
Full Changelog: v0.58.1...v0.59.1

What's Changed
Bug Fixes
- Allow calling provider-defined functions with variadic arguments by @wata727 in #2340
Chores
- build(deps): Bump google.golang.org/grpc from 1.72.1 to 1.72.2 by @dependabot[bot] in #2322
- build(deps): Bump mislav/bump-homebrew-formula-action from 3.2 to 3.3 by @dependabot[bot] in #2324
- build(deps): Bump docker/build-push-action from 6.17.0 to 6.18.0 by @dependabot[bot] in #2326
- build(deps): Bump alpine from 3.21 to 3.22 by @dependabot[bot] in #2325
- build(deps): Bump mislav/bump-homebrew-formula-action from 3.3 to 3.4 by @dependabot[bot] in #2327
- build(deps): Bump the go-x group with 3 updates by @dependabot[bot] in #2328
- build(deps): Bump google.golang.org/grpc from 1.72.2 to 1.73.0 by @dependabot[bot] in #2329
- build(deps): Bump actions/attest-build-provenance from 2.3.0 to 2.4.0 by @dependabot[bot] in #2332
- build(deps): Bump docker/setup-buildx-action from 3.10.0 to 3.11.0 by @dependabot[bot] in #2333
- build(deps): Bump docker/setup-buildx-action from 3.11.0 to 3.11.1 by @dependabot[bot] in #2335
- build(deps): Bump sigstore/cosign-installer from 3.8.2 to 3.9.1 by @dependabot[bot] in #2336
- build(deps): Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 by @dependabot[bot] in #2337
- build(deps): Bump github.com/hashicorp/hcl/v2 from 2.23.1-0.20250203194505-ba0759438da2 to 2.24.0 by @dependabot[bot] in #2338
- Bump GoReleaser to v2.11.0 by @wata727 in #2342
Full Changelog: v0.58.0...v0.58.1

What's Changed
Enhancements
- Add support for Terraform v1.12 by @wata727 in #2321
Bug Fixes
- terraform: Cache resolved local values by @wata727 in #2301
- cmd: Apply format set in config file by @wata727 in #2320
Chores
- build(deps): Bump golang.org/x/oauth2 from 0.29.0 to 0.30.0 in the go-x group by @dependabot in #2296
- build(deps): Bump the go-x group with 3 updates by @dependabot in #2302
- build(deps): Bump actions/setup-go from 5.4.0 to 5.5.0 by @dependabot in #2304
- build(deps): Bump github.com/sigstore/sigstore-go from 0.7.2 to 0.7.3 by @dependabot in #2303
- go: modernize by @bendrucker in #2307
- docs: annotations cannot ignore errors by @bendrucker in #2311
- docs: tflint-ruleset GitHub topic by @bendrucker in #2312
- build(deps): Bump docker/build-push-action from 6.16.0 to 6.17.0 by @dependabot in #2313
- build(deps): Bump github.com/sourcegraph/jsonrpc2 from 0.2.0 to 0.2.1 by @dependabot in #2314
- build(deps): Bump google.golang.org/grpc from 1.72.0 to 1.72.1 by @dependabot in #2315
- build(deps): Bump golangci/golangci-lint-action from 7.0.0 to 8.0.0 by @dependabot in #2297
- build(deps): Bump github.com/zclconf/go-cty from 1.16.2 to 1.16.3 by @dependabot in #2317
- build(deps): Bump github.com/sigstore/sigstore-go from 0.7.3 to 1.0.0 by @dependabot in #2316
Full Changelog: v0.57.0...v0.58.0

What's Changed
Enhancements
- build(deps): Bump github.com/terraform-linters/tflint-ruleset-terraform from 0.11.0 to 0.12.0 by @dependabot in #2278
Bug Fixes
- plugin: Skip keyless verification for private third-party plugins by @ricardo-kh in #2292
- This bug was supposed to have been fixed in v0.55.1, but was not fully fixed so has been fixed again.
Chores
- build(deps): Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go-x group by @dependabot in #2277
- build(deps): Bump goreleaser/goreleaser-action from 6.2.1 to 6.3.0 by @dependabot in #2276
- build(deps): Bump google.golang.org/grpc from 1.71.0 to 1.71.1 by @dependabot in #2281
- build(deps): Bump the go-x group with 3 updates by @dependabot in #2282
- build(deps): Bump golang.org/x/net from 0.38.0 to 0.39.0 in the go-x group by @dependabot in #2285
- build(deps): Bump github.com/sigstore/sigstore-go from 0.7.0 to 0.7.2 by @dependabot in #2286
- build(deps): Bump google.golang.org/grpc from 1.71.1 to 1.72.0 by @dependabot in #2288
- Potential fix for code scanning alert no. 12: Incomplete regular expression for hostnames by @wata727 in #2289
- Potential fix for code scanning alert no. 11: Incomplete regular expression for hostnames by @wata727 in #2290
- Set explicit workflow permissions by @wata727 in #2291
- build(deps): Bump actions/attest-build-provenance from 2.2.3 to 2.3.0 by @dependabot in #2294
- build(deps): Bump docker/build-push-action from 6.15.0 to 6.16.0 by @dependabot in #2293
- build(deps): Bump sigstore/cosign-installer from 3.8.1 to 3.8.2 by @dependabot in #2295
New Contributors
- @ricardo-kh made their first contribution in #2292
Full Changelog: v0.56.0...v0.57.0

What's Changed
Enhancements
- Add support for tflint-ignore-file annotations in JSON by @isobit in #2230
- build(deps): Bump github.com/terraform-linters/tflint-ruleset-terraform from 0.10.0 to 0.11.0 by @dependabot in #2264
- Add support for Terraform v1.11 by @wata727 in #2258
Bug Fixes
- Exclude expression context from marked for_each diagnostics by @wata727 in #2256
Chores
- Remove dependency on dpkg in install_linux.sh by @jimmydavies in #2229
- build(deps): Bump golang.org/x/crypto from 0.32.0 to 0.33.0 by @dependabot in #2237
- build(deps): Bump sigstore/cosign-installer from 3.7.0 to 3.8.0 by @dependabot in #2233
- dependabot: group golang.org/x/* deps by @bendrucker in #2238
- build(deps): Bump golang.org/x/oauth2 from 0.25.0 to 0.26.0 by @dependabot in #2236
- build(deps): Bump docker/setup-buildx-action from 3.8.0 to 3.9.0 by @dependabot in #2232
- build(deps): Bump golangci/golangci-lint-action from 6.2.0 to 6.3.2 by @dependabot in #2231
- build(deps): Bump golang.org/x/net from 0.34.0 to 0.35.0 by @dependabot in #2235
- feat: bump to build with go1.24 by @chenrui333 in #2239
- build(deps): Bump goreleaser/goreleaser-action from 6.1.0 to 6.2.1 by @dependabot in #2241
- build(deps): Bump golangci/golangci-lint-action from 6.3.2 to 6.5.0 by @dependabot in #2240
- docs: add docker example with --init by @coolapso in #2242
- build(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.5 by @dependabot in #2244
- build(deps): Bump docker/metadata-action from 5.6.1 to 5.7.0 by @dependabot in #2247
- build(deps): Bump docker/build-push-action from 6.13.0 to 6.15.0 by @dependabot in #2248
- build(deps): Bump sigstore/cosign-installer from 3.8.0 to 3.8.1 by @dependabot in #2249
- build(deps): Bump docker/setup-buildx-action from 3.9.0 to 3.10.0 by @dependabot in #2250
- build(deps): Bump actions/attest-build-provenance from 2.2.0 to 2.2.2 by @dependabot in #2251
- build(deps): Bump github.com/google/go-cmp from 0.6.0 to 0.7.0 by @dependabot in #2253
- build(deps): Bump the go-x group with 2 updates by @dependabot in #2252
- go: use testing.T helpers by @bendrucker in #2254
- Fix broken GitHub Actions badge by @wata727 in #2255
- build(deps): Bump actions/attest-build-provenance from 2.2.2 to 2.2.3 by @dependabot in #2261
- build(deps): Bump google.golang.org/grpc from 1.70.0 to 1.71.0 by @dependabot in #2260
- build(deps): Bump the go-x group with 4 updates by @dependabot in #2259
- build(deps): Bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by @dependabot in #2262
- build(deps): Bump docker/login-action from 3.3.0 to 3.4.0 by @dependabot in #2263
- build(deps): Bump github.com/spf13/afero from 1.12.0 to 1.14.0 by @dependabot in #2265
- go: 1.24.1 by @bendrucker in #2266
- Update pinned GitHub Action versions by @wata727 in #2268
- Enable Dependabot auto-merge by @wata727 in #2269
- build(deps): Bump actions/checkout from 4.1.7 to 4.2.2 by @dependabot in #2270
- golangci-lint v2 by @bendrucker in #2273
- build(deps): Bump actions/setup-go from 5.0.2 to 5.4.0 by @dependabot in #2272
- go: use govulncheck to detect security issues by @bendrucker in #2274
New Contributors
- @jimmydavies made their first contribution in #2229
- @coolapso made their first contribution in #2242
- @isobit made their first contribution in #2230
Full Changelog: v0.55.1...v0.56.0

What's Changed
Breaking Changes
- Remove deprecated --module/--no-module and module attribute by @wata727 in #2036
Enhancements
- Update to owenrumney/go-sarif/v2 by @oWretch in #2111
- build(deps): Bump github.com/terraform-linters/tflint-ruleset-terraform from 0.9.1 to 0.10.0 by @dependabot in #2152
Bug Fixes
- Override exactly according to the Terraform spec by @wata727 in #2124
Chores
- build(deps): Bump google.golang.org/grpc from 1.65.0 to 1.66.0 by @dependabot in #2112
- build(deps): Bump github.com/hashicorp/hcl/v2 from 2.21.0 to 2.22.0 by @dependabot in #2109
- build(deps): Bump actions/attest-build-provenance from to by @dependabot in #2103
- plugin: Introduce explicit locking on the root runner operations by @wata727 in #2115
- build(deps): Bump google.golang.org/grpc from 1.66.0 to 1.66.2 by @dependabot in #2125
- build(deps): Bump google.golang.org/grpc from 1.66.2 to 1.67.0 by @dependabot in #2129
- build(deps): Bump golang.org/x/oauth2 from 0.22.0 to 0.23.0 by @dependabot in #2117
- build(deps): Bump golang.org/x/text from 0.17.0 to 0.18.0 by @dependabot in #2120
- build(deps): Bump golang.org/x/net from 0.28.0 to 0.29.0 by @dependabot in #2119
- build(deps): Bump docker/build-push-action from 6.7.0 to 6.9.0 by @dependabot in #2131
- Update config.md by @rquadling in #2130
- build(deps): Bump actions/attest-build-provenance from 1.4.1 to 1.4.3 by @dependabot in #2121
- build(deps): Bump docker/setup-buildx-action from 3.6.1 to 3.7.1 by @dependabot in #2134
- build(deps): Bump sigstore/cosign-installer from 3.6.0 to 3.7.0 by @dependabot in #2136
- build(deps): Bump golang.org/x/text from 0.18.0 to 0.19.0 by @dependabot in #2137
- build(deps): Bump github.com/zclconf/go-cty-yaml from 1.0.3 to 1.1.0 by @dependabot in #2138
- build(deps): Bump golang.org/x/crypto from 0.27.0 to 0.28.0 by @dependabot in #2139
- build(deps): Bump google.golang.org/grpc from 1.67.0 to 1.67.1 by @dependabot in #2140
- build(deps): Bump golang.org/x/net from 0.29.0 to 0.30.0 by @dependabot in #2141
- build(deps): Bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 by @dependabot in #2135
- build(deps): Bump github.com/hashicorp/go-plugin from 1.6.1 to 1.6.2 by @dependabot in #2147
- build(deps): Bump github.com/fatih/color from 1.17.0 to 1.18.0 by @dependabot in #2148
- go: Remove patch version from go.mod by @wata727 in #2156
- Bump GoReleaser to v2 by @wata727 in #2157
- Fix FromAsCasting build check failure by @wata727 in #2158
New Contributors
- @oWretch made their first contribution in #2111
- @rquadling made their first contribution in #2130
Full Changelog: https://github.com/terraform-linters/tflint/compare/v0.53.0...v0.54.0

What's Changed
Enhancements
- cmd: Allow --chdir and --recursive to be used together by @wata727 in #2079
- terraform: Add support for Terraform v1.9 by @wata727 in #2077
- Bump bundled terraform ruleset to v0.8.0 by @wata727 in #2085
Bug Fixes
- formatter: Add source attribute in the checkstyle format by @wata727 in #2078
Chores
- deps: Go 1.22.5 by @wata727 in #2084
Full Changelog: https://github.com/terraform-linters/tflint/compare/v0.51.2...v0.52.0

Breaking Changes
- Call local modules by default by @wata727 in #1918
- Module inspection is now enabled by default for modules whose source is a relative path.
Note that "module inspection" will be called "calling modules" after this change.
See also #1066
- CLI flag --module has been changed to --call-module-type. For backward compatibility, --module will continue to work, but it will be removed in a future version, so we recommend migrating early.
The same applies to the module attribute of the configuration file.
- --module flag is replaced by --call-module-type=all and --no-module (previous default) is replaced by --call-module-type=none
- For modules with many local module calls, this change may result in performance degradation.
If this is not acceptable, you can keep the previous default by specifying --call-module-type=none.
- Make assignments to undeclared variables an error by @wata727 in #1941
- In line with Terraform behavior, assignments using the --var flag etc. to undeclared variables now result in an error.
To avoid this, remove unnecessary variable assignments.
Enhancements
- Print the working directory on error in recursive inspection by @wata727 in #1933
- Enable per-runner parallelism by @wata727 in #1944
BugFixes
- Exit with an error if the explicitly passed .tflint.hcl does not exist by @wata727 in #1940
Chores
- build(deps): Bump golang.org/x/oauth2 from 0.13.0 to 0.14.0 by @dependabot in #1913
- build(deps): Bump sigstore/cosign-installer from 3.1.2 to 3.2.0 by @dependabot in #1915
- build(deps): Bump github.com/hashicorp/go-plugin from 1.5.2 to 1.6.0 by @dependabot in #1917
- docs: Remove mention of directory arguments by @wata727 in #1921
- build(deps): Bump golang.org/x/crypto from 0.15.0 to 0.16.0 by @dependabot in #1923
- build(deps): Bump golang.org/x/oauth2 from 0.14.0 to 0.15.0 by @dependabot in #1931
- build(deps): Bump github.com/spf13/afero from 1.10.0 to 1.11.0 by @dependabot in #1932
- build(deps): Bump actions/setup-go from 4 to 5 by @dependabot in #1936
- build(deps): Bump sigstore/cosign-installer from 3.2.0 to 3.3.0 by @dependabot in #1937
- build(deps): Bump alpine from 3.18 to 3.19 by @dependabot in #1938
- Stop using backticks for emphasis by @wata727 in #1934
- Avoid escaping newlines by @wata727 in #1942
- build(deps): Bump golang.org/x/crypto from 0.16.0 to 0.17.0 by @dependabot in #1945
- build(deps): Bump github.com/google/uuid from 1.4.0 to 1.5.0 by @dependabot in #1947
- build(deps): Bump google.golang.org/grpc from 1.59.0 to 1.60.1 by @dependabot in #1948

0.44.1 (2022-12-30)

BugFixes
- PR#1635: terraform: Fix path.module when using --chdir/--recursive (@wata727)
- PR#1636: cmd: Fix file arguments handling when using --chdir (@wata727)