Terraform 1.16.5 Released: Bug Fixes for Tainted Instance Crash and Resource Identity Nil Delete

Introduction

HashiCorp shipped Terraform v1.16.5 on September 30, 2026. This is a narrow bug-fix patch release with no new features, deprecations, or breaking changes. The release notes list exactly two fixes, both addressing crash conditions encountered during apply/destroy operations. Anyone running 1.16.x in production should take this update to avoid the reported crashes.

What Is New

The release notes are thin — only two bug fixes are documented, with no accompanying HCL changes, provider protocol changes, or CLI flag additions. Both fixes are crash-prevention related:

• Tainted instance state crash fixed: Terraform could crash when it encountered a tainted resource instance whose status was not valid/recognized. This affected refresh/apply runs where state had a tainted instance in an unexpected shape (#39287).

• resource-identity: nil identity during delete fixed: Under the resource identity feature, Terraform could hit a nil resource identity when processing a delete operation, causing a failure. This is now handled correctly (#39285).

No other changes are listed in this release. For full details and any follow-up notes, see the release page.

Upgrade Steps

Pin the new version in the root module's required_version constraint (or relax it if already using a range) and re-run init:

terraform {
  required_version = "~> 1.16.5"
}

Upgrade the CLI binary itself. With tfenv:

tfenv install 1.16.5
tfenv use 1.16.5

Or via package manager (example for a direct binary swap):

terraform version
# confirm previous version, then replace binary with 1.16.5

After swapping the binary, refresh provider/module locks:

terraform init -upgrade

Verify

Confirm the CLI reports the new version and that plan/apply runs clean on an existing state file that previously triggered the issues (e.g., one containing a tainted resource):

terraform version
# Terraform v1.16.5
 
terraform plan

If the workspace has any tainted resources or uses resource identity on delete operations, run a targeted apply/destroy against a non-production workspace first to confirm the previous crash no longer occurs.

Conclusion

v1.16.5 is a maintenance patch: two targeted crash fixes, no new functionality, no migration work required. Teams on 1.16.x affected by crashes involving tainted instances or resource-identity deletes should upgrade promptly; everyone else can fold this into the normal update cadence.