Packer 1.16.1 Release Notes: Plugin Mirrors, WinRM Timeouts, and HCL2 User Variable Fix

Introduction

HashiCorp released Packer v1.16.1 on September 18, 2026. This is the first tracked release on terraformpilot.com for Packer, so there is no prior-version diff — the notes below summarize everything shipped in this release that matters to people building machine images with Packer: a new plugin installation source, WinRM connection tuning, an HCL2 bug fix for user variables, a security patch in gRPC, and a round of dependency bumps.

What Is New

Feature: install plugins from non-GitHub HTTPS sources

The plugin getter now supports installing plugins from HTTPS sources other than GitHub, including internal mirrors or artifact repositories that expose the HashiCorp release directory format (GH-13691). This is useful for air-gapped environments or organizations that proxy plugin binaries through an internal artifact store instead of pulling directly from GitHub releases.

Example required_plugins block pointing at a custom source, assuming your mirror exposes the standard HashiCorp release directory layout:

packer {
  required_plugins {
    amazon = {
      version = ">= 1.3.0"
      source  = "github.com/hashicorp/amazon"
    }
  }
}

Consult your internal mirror's documentation for the exact installation configuration Packer expects (environment variables or CLI flags controlling the plugin source), since the release notes do not specify additional config keys beyond the getter support itself.

Improvement: configurable WinRM timeout and retry interval

The winrm communicator gains configurable connection timeout and retry interval settings (GH-13701), useful for slow-booting Windows images or environments with flaky network paths to the WinRM endpoint.

source "amazon-ebs" "windows" {
  communicator   = "winrm"
  winrm_username = "Administrator"
  winrm_timeout  = "15m"
}

The release notes don't list the exact new field name for the retry interval; check packer plugins installed and the relevant builder/communicator docs for the plugin version you're using once it ships support for the new SDK.

Bug fix: HCL2 user variables restored for plugins

This release fixes a regression where user variable values were not passed to builders, provisioners, and post-processors as packer_user_variables, which broke legacy {{ user "name" }} interpolation in plugin-managed templates (GH-13686). If you maintain HCL2 templates that mix new variable syntax with legacy user interpolation inside plugin configuration, this fix restores expected behavior.

variable "image_tag" {
  type    = string
  default = "latest"
}
 
build {
  sources = ["source.amazon-ebs.example"]
 
  provisioner "shell" {
    inline = [
      "echo Building image tag: {{ user `image_tag` }}"
    ]
  }
}

Bug fix: shell-local ETXTBSY errors

The shell-local post-processor now executes inline scripts through the shell, avoiding intermittent ETXTBSY errors (GH-13701). Anyone who saw flaky text file busy failures on inline shell-local steps should see those disappear.

Bug fix: Apple M5 segfaults

github.com/shoenig/go-m1cpu is bumped to v0.2.2 to prevent segmentation faults on Apple M5 hardware (GH-13696). Relevant for anyone running Packer builds on the latest Apple Silicon laptops.

Security: gRPC header validation

google.golang.org/grpc is bumped to v1.83.2 in both Packer and the plugin tester to reject requests missing both the :authority and Host headers (GH-13704, GH-13707). This hardens the gRPC transport used for plugin communication against malformed requests.

Build and dependencies

• Go updated to 1.26.8 (GH-13701)
• packer-plugin-sdk bumped to v0.6.11
• go-getter/v2 bumped to v2.2.4
• hcp-sdk-go to v0.175.0, go-git/v5 to v5.19.2, klauspost/compress to v1.18.7 (GH-13689)
• golang.org/x/crypto to v0.56.0, golang.org/x/net to v0.58.0
• OpenTelemetry (otel, otel/metric, otel/trace) bumped to v1.45.0, go-logr/logr to v1.4.4 (GH-13710)

No deprecations or breaking changes are listed in this release.

Upgrade Steps

Packer binaries are typically managed outside of Terraform provider version constraints, but if you're pinning the Packer CLI version via a tool like tfenv-style wrappers, asdf, or a Docker image tag, update the pin:

# Using a direct binary download
curl -LO https://releases.hashicorp.com/packer/1.16.1/packer_1.16.1_linux_amd64.zip
unzip packer_1.16.1_linux_amd64.zip
sudo mv packer /usr/local/bin/packer

If you manage Packer plugins pinned via required_plugins, re-run plugin installation after upgrading the CLI, especially if you intend to test the new non-GitHub plugin source support:

packer init .

For projects using a version manager or CI image, bump the version string:

# asdf example
asdf install packer 1.16.1
asdf local packer 1.16.1

Verify

Confirm the installed version and that plugins resolve correctly after upgrading:

packer version
# Packer v1.16.1
 
packer validate .
packer plugins installed

If you rely on WinRM builds, re-run a build with the new timeout settings configured to confirm the behavior change takes effect, and check shell-local post-processor steps for the absence of intermittent ETXTBSY failures in CI logs.

Conclusion

Packer 1.16.1 is a maintenance release focused on reliability: it fixes a real HCL2 regression affecting legacy user variable interpolation in plugin templates, resolves flaky shell-local and Apple M5 build issues, adds practical WinRM timeout controls, and closes a gRPC header-validation gap. Teams running Windows builds or plugin-heavy HCL2 templates should prioritize this upgrade; everyone else gets the dependency and security bumps for free. Full details are on the release page.