Terragrunt v1.2.1: Security Fix, Faster Discovery, and Shared Config Parsing
Terragrunt v1.2.1 patches a Go CVE, speeds up discovery and shared config parsing, and dedupes run_cmd calls. Upgrade notes inside.
Infrastructure as Code
Terragrunt v1.1.6 patches a Windows-only bug where Git filters missed nested unit changes in find, list, and browse commands.
Terragrunt v1.1.6 is a patch release that ships a single, targeted bug fix for Windows users. It addresses a regression introduced in v1.1.5's worktree optimization for Git-based filters used by the find, list, and browse commands. There are no new features, deprecations, or breaking changes in this release.
In v1.1.5, Terragrunt introduced a worktree optimization for Git-based filters (e.g. --filter '[main...HEAD]') used by find, list, and browse. That optimization checks out only the directories of changed units instead of the full worktree.
On Windows, the changed-unit directories were built using \ path separators, but Git's internal file listing always uses /. The mismatch meant that when a diff touched only a unit configuration in a nested directory — for example:
nested\path\terragrunt.hcl— Terragrunt couldn't match it against Git's listing, checked out nothing, and the filter silently returned no results.
This is fixed in v1.1.6: Terragrunt now uses / separators consistently for these directory lookups on every platform, so Git-based filters work correctly on Windows for nested units, matching the behavior already seen on macOS and Linux.
Example command that was previously affected on Windows and now works as expected:
terragrunt find --filter '[main...HEAD]' --working-dir .terragrunt list --filter '[main...HEAD]'No HCL configuration changes are required to benefit from this fix — it's purely internal to how Terragrunt resolves Git diffs on disk.
If you pin Terragrunt versions per-repo (recommended for CI reproducibility), bump the constraint in your root terragrunt.hcl or wrapper tooling:
# root terragrunt.hcl
terraform_version_constraint = ">= 1.5"
terragrunt_version_constraint = ">= 1.1.6"If you manage the binary with a version manager such as tenv or tgswitch:
tenv terragrunt install 1.1.6
tenv terragrunt use 1.1.6Or download the binary directly from the release page for your platform:
# Windows (PowerShell), example for amd64
Invoke-WebRequest -Uri "https://github.com/gruntwork-io/terragrunt/releases/download/v1.1.6/terragrunt_windows_amd64.exe" -OutFile terragrunt.exeThere is no corresponding terraform init -upgrade step needed for this release since it only affects the Terragrunt binary, not the underlying Terraform/OpenTofu provider or module lock files.
Confirm the installed version, then re-run a Git-based filter on Windows against a branch with nested unit changes:
terragrunt --version
# should report v1.1.6
terragrunt list --filter '[main...HEAD]'The command should now return nested units correctly instead of an empty result set on Windows.
v1.1.6 is a small but important fix for any team running Terragrunt's find, list, or browse commands with Git-based filters on Windows CI runners or developer machines. Teams on Linux/macOS are unaffected by the bug itself but should still upgrade to stay aligned with the latest patch. Full details are available on the release page.
Terragrunt v1.2.1 patches a Go CVE, speeds up discovery and shared config parsing, and dedupes run_cmd calls. Upgrade notes inside.
OpenTofu v1.13.1 patches two ephemeral resource bugs: tofu show -json crashes and stale ephemeral output values during apply.
Terraform v1.16.5 patch release fixes a crash on tainted instance state and a nil resource identity bug during delete.
Compare Terraform with OpenTofu, Pulumi, Ansible, AWS CDK and CloudFormation, plus core concept guides like for_each vs count and plan vs apply.