Update dependency opentofu/opentofu to v1.12.5

GitLab Dependency Botrequested to merge
gitlab-renovate-forks/opentofu:renovate/opentofu-opentofu-1.x into main

This MR contains the following updates:

Package Update Change
opentofu/opentofu patch 1.12.1 -> 1.12.5

⚠️ Warning

Some dependencies could not be looked up. Check the warning logs for more information.

MR created with the help of gitlab-org/frontend/renovate-gitlab-bot

Release Notes

opentofu/opentofu (opentofu/opentofu)

v1.12.5

Compare Source

SECURITY ADVISORIES:

  • Previous releases in the v1.12 series could be affected by several vulnerabilities:

    • The Encrypted Client Hello implementation (which is used by OpenTofu through the go stdlib) would leak the pre-shared key identities during the handshake, allowing a passive network observer who can collect handshakes to de-anonymize the hostname of the server, even when ECH was being used.

    This is fixed now by (#​4363)

BUG FIXES:

  • Fixed bug where implicit moves and provider address changes would incorrectly cause providers.MovedResourceState to be used in place of providers.UpgradeResourceState (#​4375)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.4...v1.12.5

v1.12.4

Compare Source

BUG FIXES:

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.3...v1.12.4

v1.12.3

Compare Source

BUG FIXES:
  • Properly handle TF_ENCRYPTION with only blank spaces. (#​4265)
  • The value resulted from the lifecycle.enabled evaluation now has its deprecation marks processed correctly (#​4162)
  • Update documentation to clarify the usage restriction of ephemeral values in lifecycle.enabled. (#​4220)
  • tofu console -lock=false now works as intended. (#​4291)
SECURITY ADVISORIES:

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.2...v1.12.3

v1.12.2

Compare Source

1.12.2

SECURITY ADVISORIES:

  • Previous releases in the v1.12 series could be affected by several vulnerabilities:

    • If for state encryption, OpenBao key provider is used with wrapping algorithms, it could generate panics or hangs on compromised systems where the JWE is specifically crafted.

    This is fixed now by (#​4177)

  • Previous releases in the v1.12 series could be affected by several vulnerabilities:

    • When using SSH connections through OpenTofu, the errors that were returned from attempting a connection could include unescaped input bytes.
    • If using an attacker-controlled server to run tofu against, it might end up in high CPU consumption. These are now fixed by (#​4247)

BUG FIXES:

  • Properly handle EDEADLK during provider installation. On Unix systems, the kernel may erroneously detect a deadlock between tofu processes using the global plugin cache. (#​4166)
  • Fix race condition while handling closing signals during tofu login, both when the signal is sent by the user and when the browser fails to successfully connect. (4016)
  • Prevent panic when using ephemeral resources during tofu test`. (#​4254)

Full Changelog: https://github.com/opentofu/opentofu/compare/v1.12.1...v1.12.2

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻️ Rebasing: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this MR and you won't be reminded about this update again.

  • If you want to rebase/retry this MR, check this box

This MR has been generated by Renovate Bot.

Edited by Timo Furrer

Merge request reports