OpenTofu v1.13.1 Release: Ephemeral Resources Bug Fixes Explained

Introduction

OpenTofu v1.13.1 is a patch release that fixes two bugs related to ephemeral resources and outputs, a feature introduced in the OpenTofu 1.10/1.11 line. There are no new features, deprecations, or breaking changes in this release — it is a targeted bug-fix drop on top of the v1.13.x series.

What Is New

This release contains two bug fixes, both scoped to configurations that use ephemeral resources or ephemeral output values.

tofu show -json no longer fails with ephemeral resources

Previously, running tofu show -json against a plan file that included ephemeral resources in the configuration would error out instead of producing JSON output. This is fixed in PR #4623.

tofu plan -out=tfplan
tofu show -json tfplan > plan.json

This command now completes successfully even when the configuration declares ephemeral resources, which is useful for CI pipelines that parse plan JSON for policy checks or drift reporting.

Ephemeral output values are re-evaluated on apply

Ephemeral output values were sometimes reusing stale values computed during the plan phase instead of being freshly evaluated during apply, as tracked in issue #4582. This matters for configurations like the following, where an ephemeral output is meant to reflect a value generated at apply time (for example, a short-lived token or temporary credential):

ephemeral "random_password" "db_token" {
  length  = 20
  special = false
}
 
output "db_token" {
  value     = ephemeral.random_password.db_token.result
  ephemeral = true
}

With this fix, OpenTofu now consistently re-evaluates db_token during the apply phase rather than reusing a value cached during planning, which avoids returning an outdated or invalid ephemeral value to consumers of the output.

Upgrade Steps

Pin the OpenTofu version in your configuration and upgrade providers/modules as usual:

terraform {
  required_version = ">= 1.13.1"
}

Then run:

tofu init -upgrade

If you are installing or managing the CLI binary directly (for example via tenv, asdf, or a package manager), update it to v1.13.1 through your normal tooling before running init -upgrade.

Verify

Confirm the CLI version matches the patch release:

tofu version

Expected output should show OpenTofu v1.13.1. If your configuration uses ephemeral resources or ephemeral outputs, re-run a plan/apply cycle and confirm tofu show -json on the resulting plan file succeeds without errors.

Conclusion

v1.13.1 is a low-risk patch upgrade for anyone using ephemeral resources or ephemeral output values in OpenTofu, resolving a JSON-output crash and a stale-value bug during apply. Teams not yet using ephemeral resources will see no functional change from this release but should still track it as part of normal patch hygiene. For the full, unedited notes, see the release page.