TFLint v0.64.0 Release Notes: What's New and How to Upgrade

Introduction

TFLint v0.64.0 is out, following v0.63.0/v0.63.1. This release is mostly incremental: a new config option for marking rules as ignorable, improved diagnostics output for recursive linting and JUnit reports, a fix for plugin attestation bundle fetching, and a batch of dependency bumps. There are no breaking changes called out in the release notes. Full details: v0.64.0 release page.

What Is New

Ignorable rule setting in config (#2525)

The config loader now supports marking a rule as ignorable. This is aimed at setups where a rule should be allowed to fail without blocking CI (as opposed to fully disabling it with enabled = false). The release notes don't spell out the exact HCL key/value syntax beyond the PR title, so check PR #2525 for the precise .tflint.hcl block before relying on it in production configs. A typical rule block you'd be extending looks like this:

rule "terraform_deprecated_interpolation" {
  enabled = true
}

If you want to use the new ignorable behavior, confirm the exact attribute name against the PR/CHANGELOG before rolling it into shared .tflint.hcl files used across teams.

Better diagnostics in recursive mode (#2524)

When running tflint --recursive (or --chdir in CI matrices) and a rule produces an issue with no source range, the CLI now includes the worker directory in the output, making it easier to tell which module/directory a no-range issue came from:

tflint --recursive --format=compact

This is a diagnostics-only change — no new flags to learn.

JUnit formatter includes range in testcase name (#2538)

If you consume TFLint output as JUnit XML in CI (GitLab, Jenkins, Azure DevOps, etc.), the junit formatter now includes the source range in the testcase name, making it easier to pinpoint failures without opening the raw log:

tflint --format=junit --recursive > tflint-results.xml

Bug fix: plugin attestation bundle fetching (#2593, merged as #2600)

TFLint plugins installed with signature verification previously could fail to fetch attestation bundles from a bundle_url. This is fixed in v0.64.0. If your plugin config uses signature/source verification, re-run plugin install after upgrading:

plugin "aws" {
  enabled = true
  version = "0.40.0"
  source  = "github.com/terraform-linters/tflint-ruleset-aws"
}

tflint --init

Other chores worth knowing about

• Formatter dispatch was refactored into format adapters (#2556, #2557) and now guards diagnostics with no source range (#2562) — internal cleanup, but relevant if you maintain a custom formatter or script around TFLint's output.
• fix(install): download and zip readers are now properly closed during plugin install (#2564), avoiding resource leaks on repeated tflint --init runs.
• README now documents Go install instructions (#2563) for anyone building TFLint from source instead of using the installer script or Homebrew.
• Dependency bumps: Go toolchain, sigstore-go, golang.org/x/net, golang.org/x/text, gRPC, Alpine base image, and several GitHub Actions — routine maintenance with no action required on your side.

Upgrade Steps

Pin or bump your TFLint version depending on how you install it.

If you manage TFLint via a version file or CI pin:

# Homebrew
brew upgrade tflint
 
# Manual install script
curl -s https://raw.githubusercontent.com/terraform-linters/tflint/master/install_linux.sh | bash
 
# Go install
go install github.com/terraform-linters/tflint@v0.64.0

If you pin the version in a Dockerfile or CI config, bump the tag:

FROM ghcr.io/terraform-linters/tflint:v0.64.0

After upgrading the binary, reinstall any ruleset plugins (especially relevant given the attestation bundle fix):

tflint --init

Verify

Confirm the binary version and that plugins still load correctly:

tflint --version
# TFLint version 0.64.0
 
tflint --recursive --format=compact

If you use the JUnit formatter in CI, regenerate a report and check that testcase names now include the source range:

tflint --format=junit --recursive > tflint-results.xml
cat tflint-results.xml | grep testcase

Conclusion

v0.64.0 is a maintenance-focused release: a new ignorable rule config option, clearer diagnostics for recursive runs and JUnit output, and a plugin installation bug fix around attestation bundles. No deprecations or breaking changes are documented. Upgrade the binary, re-run tflint --init to refresh plugins, and confirm the version with tflint --version before relying on the new config option in shared .tflint.hcl files.