Update terraform monorepo to v1.15.6

[renovate]

This PR contains the following updates:

Package	Update	Change
hashicorp/terraform	minor	1.10.4 → 1.15.6

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

hashicorp/terraform (hashicorp/terraform)

v1.15.6

Compare Source

1.15.6 (June 10, 2026)

BUG FIXES:

• Fixed an issue where resources being removed from state via removed block were incorrectly listed under planned_values in json representations of the plan file. (#​38665)

• console: Fixed a panic caused by evaluating an expression involving deprecated values (#​38676)

• Fix exit code for plan, query, and refresh commands for variable-related errors (#​38685)

• Fix two module installation edge cases with null and sensitive/ephemeral module sources (#​38704)

v1.15.5

Compare Source

1.15.5 (May 27, 2026)

ENHANCEMENTS:

• Support for module version evaluating to null (in the context of dynamic module sources) (#​38632)

BUG FIXES:

• Fix crash on init for modules with empty source (#​38628)

v1.15.4

Compare Source

1.15.4 (May 20, 2026)

NEW FEATURES:

• We now produce builds for Linux s390x (zLinux) (#​38615)

BUG FIXES:

• init: Prevent provider binaries from being installed into symlinked directories (#​38611)

v1.15.3

Compare Source

1.15.3 (May 13, 2026)

BUG FIXES:

• stacks: Fixed a bug that prevented migrating resources under multiple layers of module nesting with implicit provider configuration. (#​38528)

• cloud backend will now forward -generate-config-out flag usage to query create request (#​38539)

• Fix crash during provider installation when there is no config (#​38560)

v1.15.2

Compare Source

1.15.2 (May 6, 2026)

ENHANCEMENTS:

• stacks: add ouput values to plan component instance change description (#​38360)

BUG FIXES:

• Avoid printing warnings from 'terraform output -json' (#​38530)

v1.15.1

Compare Source

1.15.1 (May 1, 2026)

BUG FIXES:

• Fixed crash when configuration has an invalid action_trigger nested block in data or ephemeral lifecycle blocks (#​38402)

• validate: Removed validation of attributes inside backend blocks due to incompatibility with workflows using the -backend-config flag. (#​38466)

• Fix non-const variable checks on init (#​38470)

• Avoid warnings in 'terraform output -raw' (#​38487)

• Ignore undeclared variable values from the cloud backend (#​38490)

• Fix panic for types modules with no expanded instances (#​38491)

• Fixed "unknown provider function" errors occurring during init (#​38472)

• init: Fixed a bug that impacted use of provider pre-releases during init (#​38496)

v1.15.0

Compare Source

v1.14.9

Compare Source

1.14.9 (April 20, 2026)

BUG FIXES:

• Fix Terraform Stacks plugin installation error (#​38406)

v1.14.8

Compare Source

1.14.8 (March 25, 2026)

BUG FIXES:

• Prevent crash in the display of relevant attributes after provider upgrades (#​38264)

v1.14.7

Compare Source

1.14.7 (March 11, 2026)

NOTES:

• Bump Go version to 1.25.8 to suppress security scanner false positives (#​38249)

v1.14.6

Compare Source

1.14.6 (February 25, 2026)

BUG FIXES:

• terraform test: return error when provider config is invalid (#​38084)

v1.14.5

Compare Source

1.14.5 (February 11, 2026)

BUG FIXES:

• Fixed an issue where terraform stacks validate was failing to resolve relative paths for modules (#​38025)

v1.14.4

Compare Source

1.14.4 (January 28, 2026)

BUG FIXES:

• backend: Fix nil pointer dereference crash during terraform init when the destination backend returns an error (#​38027)

• Fixes an issue where any warning diagnostics generated during terraform query execution failed to render in the cloud backend session (#​38040)

• actions in modules without instances failed the plan graph (#​38089)

v1.14.3

Compare Source

1.14.3 (December 17, 2025)

BUG FIXES:

• stacks: change absolute paths in path.module/path.root to be relative, as documented (#​37982)

v1.14.2

Compare Source

v1.14.1

Compare Source

1.14.1 (December 3, 2025)

BUG FIXES:

• test: allow ephemeral outputs in root modules (#​37813)

• Combinations of replace_triggered_by and -replace could result in some instances not being replaced (#​37833)

• providers lock: include providers required by terraform test (#​37851)

• Set state information in the proto request for the GenerateResourceConfig RPC (#​37896)

• actions: make after_create & after_update actions run after the resource has applied (#​37936)

v1.14.0

Compare Source

1.14.0 (November 19, 2025)

NEW FEATURES:

• List Resources: List resources can be defined in *.tfquery.hcl files and allow querying and filterting existing infrastructure.

• A new Terraform command terraform query: Executes list operations against existing infrastructure and displays the results. The command can optionally generate configuration for importing results into Terraform.

• A new GenerateResourceConfiguration RPC allows providers to create more precise configuration values during import. (#​37515)

• New top-level Actions block: Actions are provider defined and meant to codify use cases outside the normal CRUD model in your Terraform configuration. Providers can define Actions like aws_lambda_invoke or aws_cloudfront_create_invalidation that do something imparative outside of Terraforms normal CRUD model. You can configure such a side-effect with an action block and have actions triggered through the lifecycle of a resource or through passing the -invoke CLI flag. (#​37553)

ENHANCEMENTS:

• terraform test: expected diagnostics will be included in test output when running in verbose mode" (#​37362)

• terraform test: ignore prevent_destroy attribute during when cleaning up tests" (#​37364)

• terraform stacks command support for -help flag (#​37645)

• query: support offline validation of query files via -query flag in the validate command (#​37671)

• Updates to support the AWS European Sovereign Cloud (#​37721)

BUG FIXES:

• Retrieve all workspace variables while doing a terraform import, include variables inherited from variable sets but not overwritten by the workspace. (#​37241)

• Fix OSS backend proxy support by adding a proxy layer for OSS backend operations. Resolves #​36897. (#​36897)

• console and test: return explicit diagnostics when referencing resources that were not included in the most recent operation. (#​37663)

• query: generate unique resource identifiers for results of expanded list resources (#​37681)

• The CLI now summarizes the number of actions invoked during terraform apply, matching the plan output. (#​37689)

• Allow filesystem functions to return inconsistent results when evaluated within provider configuration (#​37854)

• query: improve error handling for missing identity schemas (#​37863)

UPGRADE NOTES:

• The parallelism of Terraform operations within container runtimes may be reduced depending on the CPU bandwidth limit setting. (#​37436)

• Building Terraform 1.14 requires macOS Monterey or later (due to being built on Go 1.25 which imposes these requirements) (#​37436)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

v1.13.5

Compare Source

1.13.5 (November 5, 2025)

BUG FIXES:

• impure functions could cause templatefile to incorrectly fail consistency checks (#​37807)

• Allow filesystem functions to return inconsistent results when evaluated within provider configuration (#​37854)

v1.13.4

Compare Source

1.13.4 (October 15, 2025)

BUG FIXES:

• Fix crash when showing a cloud plan without having a cloud backend (#​37751)

v1.13.3

Compare Source

1.13.3 (September 17, 2025)

BUG FIXES:

• variable validation: keep sensitive and ephemeral metadata when evaluating variable conditions. (#​37595)

v1.13.2

Compare Source

1.13.2 (September 10, 2025)

BUG FIXES:

• test: Fix the order of execution of cleanup nodes (#​37546)

• apply: hide sensitive inputs when values have changed between plan and apply (#​37582)

v1.13.1

Compare Source

1.13.1 (August 27, 2025)

BUG FIXES:

• Fix regression that caused terraform test with zero tests to return a non-zero exit code. (#​37477)

• terraform test: prevent panic when resolving incomplete references (#​37484)

v1.13.0

Compare Source

1.13.0 (August 20, 2025)

NEW FEATURES:

• The new command terraform stacks exposes some stack operations through the cli. Use terraform stacks -usage to see available commands. (#​36931)

ENHANCEMENTS:

• Filesystem functions are now checked for consistent results to catch invalid data during apply (#​37001)

• Allow successful init when provider constraint matches at least one valid version (#​37137)

• Performance fix for evaluating high cardinality resources (#​37154)

• TF Test: Allow parallel execution of teardown operations (#​37169)

• terraform test: Test authors can now specify definitions for external variables that are referenced within test files directly within the test file itself. (#​37195)

• terraform test: File-level variable blocks can now reference run outputs and other variables." (#​37205)

• skip redundant comparisons when comparing planned set changes (#​37280)

• type checking: improve error message on type mismatches. (#​37298)

BUG FIXES:

• Added a missing warning diagnostic that alerts users when child module contains an ignored cloud block. (#​37180)

• Nested module outputs could lose sensitivity, even when marked as such in the configuration (#​37212)

• workspace: Updated validation to reject workspaces named "" (#​37267)

• workspace: Updated the workspace delete command to reject "" as an invalid workspace name (#​37275)

• plan: truncate invalid or dynamic references in the relevant attributes (#​37290)

• Test run Parallelism of 1 should not result in deadlock (#​37292)

• static validation: detect invalid static references via indexes on objects. (#​37298)

• Fixes resource identity being dropped from state in certain cases (#​37396)

NOTES:

• The command terraform rpcapi is now generally available. It is not intended for public consumption, but exposes certain Terraform operations through an RPC interface compatible with go-plugin. (#​37067)

UPGRADE NOTES:

• terraform test: External variables referenced within test files should now be accompanied by a variable definition block within the test file. This is optional, but users with complex external variables may see error diagnostics without the additional variable definition. (#​37195)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

v1.12.2

Compare Source

1.12.2 (June 11, 2025)

BUG FIXES:

• partial ephemeral values were rejected in ephemeral outputs (#​37210)

v1.12.1

Compare Source

1.12.1 (May 21, 2025)

BUG FIXES:

• Include resource identity in import apply UI output (#​37044)

• Fix regression during provider installation by reverting back to not sending HEAD requests. (#​36998)

• Avoid crash on test failure in comparison in function call (#​37071)

v1.12.0

Compare Source

1.12.0 (May 14, 2025)

NEW FEATURES:

• Added Terraform backend implementation for OCI Object Storage (#​34465)

ENHANCEMENTS:

• Terraform Test command now accepts a -parallelism=n option, which sets the number of parallel operations in a test run's plan/apply operation. (#​34237)

• Logical binary operators can now short-circuit (#​36224)

• Terraform Test: Runs can now be annotated for possible parallel execution. (#​34180)

• Allow terraform init when tests are present but no configuration files are directly inside the current directory (#​35040)

• Terraform Test: Continue subsequent test execution when an expected failure is not encountered. (#​34969)

• Produce detailed diagnostic objects when test run assertions fail (#​34428)

• backend/oss: Supports more standard environment variables to keep same with provider setting (#​36581)

• Improved elapsed time display in UI Hook to show minutes and seconds in mm:ss format. (#​36368)

• Update legacy term used in error messages. (Terraform Cloud agent => HCP Terraform Agent) (#​36706)

• import blocks: Now support importing a resource via a new identity attribute. This is mutually exclusive with the id attribute (#​36703)

BUG FIXES:

• Refreshed state was not used in the plan for orphaned resource instances (#​36394)

• Fixes malformed Terraform version error when the remote backend reads a remote workspace that specifies a Terraform version constraint. (#​36356)

• Changes to the order of sensitive attributes in the state format would erroneously indicate a plan contained changes when there were none. (#​36465)

• Avoid reporting duplicate attribute-associated diagnostics, such as "Available Write-only Attribute Alternative" (#​36579)

• for_each expressions in import blocks should not be able to reference the import target (#​36801)

UPGRADE NOTES:

• On Linux, Terraform now requires Linux kernel version 3.2 or later; support for previous versions has been discontinued. (#​36478)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

v1.11.4

Compare Source

1.11.4 (April 9, 2025)

BUG FIXES:

• disable X25519Kyber768Draft00 in TLS to prevent timouts with some AWS network firewalls (#​36791)

• write-only attributes: internal providers should set write-only attributes to null (#​36824)

v1.11.3

Compare Source

1.11.3 (March 26, 2025)

BUG FIXES:

• Fixes unintended exit of CLI when using the remote backend and applying with post-plan tasks configured in HCP Terraform (#​36686)

• Modules with zero instances that contain ephemeral resources could produce an error during apply (#​36719)

v1.11.2

Compare Source

1.11.2 (March 12, 2025)

ENHANCEMENTS:

• Azure Backend supports ADO Pipelines OIDC token refresh by using the oidc_request_url, oidc_request_token and (the new) ado_pipeline_service_connection_id. (#​36458)

BUG FIXES:

• Return error when the templatestring function contains only a single interpolation that evaluates to a null value (#​36652)

• Backend/azure: subscription_id be optional & skip unnecessary management plane API call in some setup (#​36595)

NOTES:

• Updated dependency github.com/hashicorp/aws-sdk-go-base/v2 to v2.0.0-beta.62 to support newly added AWS regions (#​36625)

v1.11.1

Compare Source

1.11.1 (March 5, 2025)

BUG FIXES:

• Temporarily revert updated Windows symlink handling until we can account for known existing configurations using non-symlink junctions. (#​36575)

• terraform test: Fix crash when a run block attempts to cleanup after a non-applyable plan. (#​36582)

• Updated dependency golang.org/x/oauth2 from v0.23.0 => v0.27.0 to integrate latest changes (fix for CVE-2025-22868) (#​36584)

• lang/funcs/transpose: Avoid crash due to map with null values (#​36611)

• Combining ephemeral and sensitive marks could fail when serializing planned changes (#​36619)

v1.11.0

Compare Source

1.11.0 (February 27, 2025)

NEW FEATURES:

• Add write-only attributes to resources. Providers can specify that certain attributes are write-only. They are not persisted in state. You can use ephemeral values in write-only attributes. (#​36031)

• terraform test: The -junit-xml option for the terraform test command is now generally available. This option allows the command to create a test report in JUnit XML format. Feedback during the experimental phase helped map terraform test concepts to the JUnit XML format, and new additons may happen in future releases. (#​36324)

• S3 native state locking is now generally available. The use_lockfile argument enables users to adopt the S3-native mechanism for state locking. As part of this change, we've deprecated the DynamoDB-related arguments in favor of this new locking mechanism. While you can still use DynamoDB alongside S3-native state locking for migration purposes, we encourage migrating to the new state locking mechanism. (#​36338)

ENHANCEMENTS:

• init: Provider installation will utilise credentials configured in a .netrc file for the download and shasum URLs returned by provider registries. (#​35843)

• terraform test: Test runs now support using mocked or overridden values during unit test runs (e.g., with command = "plan"). Set override_during = plan in the test configuration to use the overridden values during the plan phase. The default value is override_during = apply. (#​36227)

• terraform test: Add new state_key attribute for run blocks, allowing test authors control over which internal state file should be used for the current test run. (#​36185)

• Updates the azure backend authentication to match the terraform-provider-azurermprovider authentication, in several ways:

  • github.com/hashicorp/go-azure-helpers: v0.43.0 -> v0.71.0
  • github.com/hashicorp/go-azure-sdk/[resource-manager/sdk]: v0.20241212.1154051. This replaces the deprecated Azure SDK used before
  • github.com/jackofallops/giovanni: v0.15.1 -> v0.27.0. Meanwhile, updating the azure storage API version from 2018-11-09 to 2023-11-03
  • Following new properties are added for the azure backend configuration:
    • use_cli
    • use_aks_workload_identity
    • client_id_file_path
    • client_certificate
    • client_id_file_path
    • client_secret_file_path
      (#​36258)

• Include ca-certificates package in our official Docker image to help with certificate handling by downstream (#​36486)

BUG FIXES:

• ephemeral values: correct error message when ephemeral values are included in provisioner output (#​36427)

• Attempting to override a variable during apply via TF_VAR_ environment variable will now yield warning instead of misleading error. (#​36435)

• backends: Fix crash when interrupting during interactive prompt for values (#​36448)

• Fixes hanging behavior seen when applying a saved plan with -auto-approve using the cloud backend (#​36453)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

v1.10.5

Compare Source

1.10.5 (January 22, 2025)

BUG FIXES:

• element(...): no longer crashes when asked for a negative index into a tuple. (#​36376)

• Updated dependency github.com/hashicorp/go-slug v0.16.0 => v0.16.3 to integrate latest changes (fix for CVE-2025-0377) (#​36273)

• jsondecode(...): improved error message when objects contain duplicate keys (#​36376)

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • "after 7am and before 11am every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hmcts-jenkins-a-to-c]

Plan Result (aat)

Plan: 0 to add, 1 to change, 0 to destroy.

• Update
  • module.adoption-web-session-storage.azurerm_redis_cache.redis

Change Result (Click me)

  # module.adoption-web-session-storage.azurerm_redis_cache.redis will be updated in-place
  ~ resource "azurerm_redis_cache" "redis" {
        id                                 = "/subscriptions/1c4f0704-a29e-403d-b719-b90c34ef14c9/resourceGroups/adoption-web-session-storage-cache-aat/providers/Microsoft.Cache/redis/adoption-web-session-storage-aat"
        name                               = "adoption-web-session-storage-aat"
        tags                               = {
            "application"         = "adoption"
            "autoShutdown"        = "true"
            "builtFrom"           = "https://github.com/HMCTS/adoption-web.git"
            "businessArea"        = "CFT"
            "contactSlackChannel" = "#adoption-tech"
            "environment"         = "staging"
            "managedBy"           = "Adoption"
        }
        # (24 unchanged attributes hidden)

      ~ redis_configuration {
          ~ maxfragmentationmemory_reserved         = 125 -> 642
          ~ maxmemory_delta                         = 125 -> 642
          ~ maxmemory_reserved                      = 125 -> 642
            # (14 unchanged attributes hidden)
        }
    }

Plan: 0 to add, 1 to change, 0 to destroy.

[hmcts-jenkins-a-to-c]

Plan Result (prod)

No changes. Your infrastructure matches the configuration.