tenv v4.15.1: Security Patch and Dependency Updates for the Terraform/OpenTofu Version Manager

Introduction

tenv is the version manager that lets teams install and switch between Terraform, OpenTofu, Terragrunt (and Atmos) binaries per project, similar in spirit to tfenv/tgenv but unified into a single Go binary. Version v4.15.1 was just published. This article summarizes what actually changed based on the published changelog — this is a maintenance release, not a feature release, and the notes below reflect exactly what is documented, nothing more.

What Is New

The changelog for v4.15.1 is thin and contains no new CLI flags, no new commands, and no behavior changes for tenv tf, tenv tofu, tenv tg, or .terraform-version / .opentofu-version handling. The three notable items are:

• Security fix: PR #620 (fix: cves detected by trivy) addresses CVEs flagged by the Trivy scanner. The release notes do not list specific CVE identifiers or which dependency/component was affected — if that detail matters for your compliance tracking, check the diff on PR #620 directly.
• CI dependency bump: PR #608 bumps actions/checkout from 6.0.3 to 7.0.0 in GitHub Actions workflows. This is a build/CI-only change and does not affect the released binary's runtime behavior.
• Go dependency bump: PR #607 bumps github.com/bradleyfalzon/ghinstallation/v2, a library used for GitHub App authentication (relevant to tenv's GitHub API calls when resolving release metadata/rate limits).

No deprecations or breaking changes are mentioned in the notes. Given the trivy fix touches security-scanned CVEs, treat this as a recommended upgrade even though there's no feature payoff — it's the kind of release you apply because it's a patch, not because it unlocks new workflow.

If you were expecting a feature changelog, there isn't one here beyond what's listed above; consult the release page for the full, auto-generated commit list.

Upgrade Steps

If you installed tenv via its install script, Homebrew, or a package manager, re-run the same installer to pick up v4.15.1. For example, via the official install script:

curl -s https://raw.githubusercontent.com/tofuutils/tenv/main/install.sh | bash -s -- v4.15.1

Or via Homebrew:

brew upgrade tenv

If you manage tenv's version in a CI pipeline or Dockerfile, pin it explicitly so the security fix lands deterministically:

TENV_VERSION=4.15.1
curl -LO "https://github.com/tofuutils/tenv/releases/download/v${TENV_VERSION}/tenv_${TENV_VERSION}_amd64.deb"
sudo dpkg -i "tenv_${TENV_VERSION}_amd64.deb"

tenv itself manages Terraform/OpenTofu/Terragrunt versions declared per project, so no change is needed to your existing version pin files:

# .terraform-version (unchanged by this tenv release)
1.9.5

# .opentofu-version (unchanged by this tenv release)
1.8.3

After upgrading the tenv binary, refresh any installed tool versions as usual:

tenv tf install
tenv tofu install
tenv tg install

Verify

Confirm the binary reports the new version:

tenv --version
# expect: tenv version v4.15.1

Then confirm it still resolves and runs your pinned IaC tool correctly:

cd your-terraform-project/
terraform version

The output should match the version declared in .terraform-version (or the OpenTofu/Terragrunt equivalent), confirming tenv's resolution logic is unaffected by the patch.

Conclusion

tenv v4.15.1 is a maintenance release: a Trivy-flagged CVE fix plus routine CI and Go dependency bumps. There are no new features, no deprecations, and no breaking changes documented. Teams running tenv in CI or on developer machines should still apply it promptly for the security fix, but no workflow or HCL changes are required beyond re-installing the binary.