TFLint v0.65.0 Release Notes: Go 1.26.10 Security Fix, Deterministic File Order, and Install Script Removal

Introduction

TFLint v0.65.0 is out, following v0.64.0. It is primarily a maintenance release: a security-relevant Go runtime bump, a couple of small behavioral changes, one formatter enhancement, and a long tail of dependency updates. There are no new rules or new CLI flags called out in the release notes. Full details: v0.65.0 release notes.

What Is New

Security fix: Go bumped to 1.26.10

TFLint binaries are now built with Go 1.26.10 (#2672), listed under "Security Fixes" in the release notes. No CVE identifier or additional detail is provided beyond the version bump — if you track TFLint for compliance/SBOM purposes, this is the entry to record for this release.

Enhancement: unique JUnit testcase names

The JUnit formatter now generates unique testcase names for errors (#2592). If you consume tflint --format junit output in a CI dashboard (GitLab, Jenkins, Azure DevOps, etc.), duplicate testcase names that previously collapsed or confused test reporters should now render as distinct entries:

tflint --format junit > tflint-results.xml

Change: deterministic primary file iteration order

TFLint now iterates primary Terraform files in a deterministic order (#2633). This mainly affects the ordering of diagnostics in output and should make tflint runs more reproducible across environments (useful when diffing lint output between CI runs or comparing local vs. CI results).

Change: language server logging reduced

The language server (tflint --langserver) now logs request parameters only at trace level instead of a more verbose default (#2642). If you rely on request-parameter logging for debugging editor integrations, raise the log level explicitly:

TFLINT_LOG=trace tflint --langserver

Install script changes

The release history for this cycle includes two related chores: postponing the deletion date for the installation script (#2606) and then removing the auto installation script (#2607). If your CI pipelines use the legacy curl-based install script, switch to a pinned binary download or a package manager instead:

VERSION="v0.65.0"
curl -sSLo tflint.zip \
  "https://github.com/terraform-linters/tflint/releases/download/${VERSION}/tflint_linux_amd64.zip"
unzip tflint.zip
sudo mv tflint /usr/local/bin/

Chores

The rest of the changelog is dependency maintenance: the Docker base image moved through several golang:*-alpine3.23 tags, github.com/klauspost/compress, github.com/zclconf/go-cty, google.golang.org/grpc, github.com/sigstore/sigstore-go, github.com/sourcegraph/jsonrpc2, go.opentelemetry.io/otel/sdk, and various GitHub Actions (actions/checkout, actions/setup-go, actions/attest, docker/login-action, docker/setup-buildx-action, docker/metadata-action, docker/build-push-action) were bumped. README badges/charts that were broken were also removed (#2605). None of these require action from TFLint users.

Upgrade Steps

No breaking changes are documented for this release, so the upgrade is low-risk. Pin the version in your CI/tooling config where applicable, for example in a .tflint.hcl plugin block or your Dockerfile:

plugin "terraform" {
  enabled = true
  preset  = "recommended"
}

Update the binary directly instead of relying on the removed install script:

# Homebrew
brew upgrade tflint
 
# Docker
docker pull ghcr.io/terraform-linters/tflint:v0.65.0
 
# Manual binary
curl -sSLo tflint.zip \
  https://github.com/terraform-linters/tflint/releases/download/v0.65.0/tflint_linux_amd64.zip \
  && unzip tflint.zip && sudo mv tflint /usr/local/bin/

If TFLint is invoked alongside Terraform in a module, re-run plugin initialization afterward:

tflint --init
terraform init -upgrade

Verify

Confirm the installed version and run a quick lint pass to make sure nothing in your ruleset regressed:

tflint --version
# TFLint version 0.65.0
 
tflint --recursive

If you use the JUnit formatter in CI, re-run it once and check that testcase names in the generated XML are no longer duplicated:

tflint --format junit --recursive > tflint-results.xml

Conclusion

TFLint v0.65.0 is a low-risk upgrade: a Go 1.26.10 security bump, deterministic file ordering, a JUnit formatter fix, reduced langserver log verbosity, and the removal of the legacy auto-install script. Teams relying on the old curl install script should switch to a pinned binary, Homebrew, or the Docker image. Everything else in this release is dependency hygiene with no action required beyond a routine upgrade.