Skip to content

chore(deps): update gruntwork-io/terragrunt to 1.0.0#100

Merged
BenediktFloeser merged 2 commits intomainfrom
renovate/gruntwork-io-terragrunt-0.x
Apr 7, 2026
Merged

chore(deps): update gruntwork-io/terragrunt to 1.0.0#100
BenediktFloeser merged 2 commits intomainfrom
renovate/gruntwork-io-terragrunt-0.x

Conversation

@zon-renovate
Copy link
Copy Markdown
Collaborator

@zon-renovate zon-renovate commented Mar 7, 2026 •
edited by BenediktFloeser
Loading

This PR contains the following updates:

Package Update Change
gruntwork-io/terragrunt minor 0.97.2 → 1.0.0

Release Notes

gruntwork-io/terragrunt (gruntwork-io/terragrunt)

v0.99.5

Compare Source

🐛 Bug Fixes

--working-dir interaction with exit codes fixed

A bug in the logic for tracking exit codes for plan -detailed-exitcode when users supply the --working-dir flag has been fixed.

Authentication during queue construction fixed

A bug in the logic for parsing configurations during discovery for use-cases like --filter 'reading=*' where configurations need to be parsed to determine whether or not they end up in the final run queue has been fixed. Configurations will now properly call any configured --auth-provider-cmd authenticator before parsing configurations, preventing errors for HCL functions like sops_decrypt_file that require authentication.

What's Changed

Full Changelog: gruntwork-io/terragrunt@v0.99.4...v0.99.5

v0.99.4

Compare Source

🏎️ Performance Improvements

Discovery performance improved

The way in which Terragrunt discovers and filters units and stacks for runs has improved significantly.

Screenshot 2026-02-17 at 17 43 55 Screenshot 2026-02-17 at 17 44 29 Screenshot 2026-02-17 at 17 44 48

Terragrunt is now better at avoiding parsing units/stacks unnecessarily, based on the filter you use. Previously, the logic used was more coarse, and could result in a requirement to parse some configurations (e.g. presence of a dependency graph expression to result in parsing all configurations. Discovery has been refactored to allow for much more careful opt-in parsing based on the need to support the filter used by users (or lack thereof).

This will also result in improvements to Terragrunt’s ability to ignore broken parts of infrastructure estates when Terragrunt can predictably determine that it won’t impact a run.

🐛 Bug Fixes

Invalid unit configurations cause explicit errors instead of silently being excluded during runs

A bug in discovery logic resulted in units with invalid HCL configurations being silently excluded from runs with a warning. This bug has been fixed, and attempting to parse invalid HCL configurations during a run will result in an error.

What's Changed

Full Changelog: gruntwork-io/terragrunt@v0.99.3...v0.99.4

v0.99.3

Compare Source

🐛 Bug Fixes

Over-warning on strict controls prevented

Using --strict-mode resulted in over-warning on completed controls. Those warnings will no longer appear when using strict mode.

What's Changed

Full Changelog: gruntwork-io/terragrunt@v0.99.2...v0.99.3

v0.99.2

Compare Source

🐛 Bug Fixes

Interrupt signal propagation to OpenTofu/Terraform fixed

The mechanism by which Terragrunt sends interrupt signals to OpenTofu/Terraform processes it started has been made more robust. Terragrunt will now send the interrupt signal in the event that a user explicitly sends an interrupt signal to Terragrunt in addition to scenarios where Terragrunt’s context cancellation is triggered (e.g. in the event of a timeout).

SOPS decryption race condition fixed

A race condition in the concurrent access to SOPS decrypted secrets in different environments combined with usage of the --auth-provider-cmd flag resulted in authentication failures. Synchronization controls have been introduced to ensure authentication proceeds correctly for each environment independently.

What's Changed

Full Changelog: gruntwork-io/terragrunt@v0.99.1...v0.99.2

v0.99.1

Compare Source

🐛 Bug Fixes

Pass through null inputs

Fixes a bug where null inputs weren't being passed through correctly to OpenTofu/Terraform.

What's Changed

Full Changelog: gruntwork-io/terragrunt@v0.99.0...v0.99.1

v0.99.0

Compare Source

🛠️ Breaking Changes

Undocumented behavior removed

We have removed several undocumented features that served as temporary stop-gaps to facilitate experimentation.

The following environment variables no longer affect Terragrunt behavior:

  • TERRAGRUNT_TEMP_QUOTE_NULL
  • TMP_UNDOCUMENTED_REPORT_PADDER
  • TMP_UNDOCUMENTED_REPORT_UNIT_COLORIZE
  • TMP_UNDOCUMENTED_COLORIZE_DEFAULT_SUMMARY_PADDING
Internal tflint deprecated

Terragrunt has been shipping with a version of tflint compiled into the binary to allow for more convenient usage without installing tflint directly. However due to the adoption of a BUSL license in tflint, the version included in Terragrunt was frozen.

We have now deprecated use of the internal tflint hook, and will be fully removing it in the future. We still do work to integrate with tflint; Including automatically running tflint init and passing through variables. For now using the internal version will only emit a warning, and you can opt in to the future behavior today in one of two ways:

  • The legacy-internal-tflint strict control (recommended)

  • Adding the --terragrunt-external-tflint flag to your hook usage (this also works in previous versions of Terragrunt); this flag is stripped prior to running the external tflint. Example:

    terraform {
    before_hook "tflint" {
    commands = ["apply", "plan"]
    execute = ["tflint", "--terragrunt-external-tflint", "--minimum-failure-severity=error", "--config", "custom.tflint.hcl"]
  }
}

✨ New Features

Depth control for dependency traversal

Graph-based expressions in the --filter flag now support limiting the depth of graph traversal they perform when discovering units. You can now append/prepend a number to the end of a graph expression ellipsis to control how deep in graph traversal Terragrunt will look for dependents/dependencies.

e.g.

# Find 'service' and only its direct dependencies (1 level deep)
terragrunt find --filter 'service...1'

# Find 'vpc' and only components that directly depend on it (1 level)
terragrunt find --filter '1...vpc'

# Find 'db' with 2 levels of dependencies and 1 level of dependents
terragrunt find --filter '1...db...2'

This delivers major performance gains for large dependency graphs.

Special thanks to @​sofianedjerbi for contributing this feature!

Run report schema extended

The run report has been extended to include the Ref, Cmd and Args fields when relevant to a run.

  • The Ref field will be populated for runs performed in Git worktrees due to their discovery from a Git-based expression in a filter.
  • The Cmd field will contain the sub command of OpenTofu/Terraform executed in a run (e.g. plan , apply) and the Args field will contain the arguments passed to that subcommand (e.g. -auto-approve, -destroy). These can differ between runs when using Git-based expressions, as additions or modifications of units between Git references can result in a plan or apply, whereas removal of units can result in plan -destroy or apply -destroy .

🧪 Experiments Updated

IaC Engines Updated to use v0.1.0 of terragrunt-engine-go

The iac-engine experiment has been updated to use v0.1.0 of the terragrunt-engine-go library.

Given that this is still experimental functionality, no effort has been made to maintain backwards compatibility with existing engines. If you are currently using the OpenTofu engine, you will need to upgrade to v0.1.0 of the engine. The Terraform engine will be updated in the near future.

This update pulls in changes to the protobuf schema used in communication between Terragrunt and IaC engines to give engines the ability to log messages in Terragrunt and reduces the overall size of messages passed to Terragrunt for stdout/stderr messages.

⚙️ Process Updates

Curl to Bash script available

In addition to all the other installation mechanisms available to install Terragrunt, a convenient curl to bash script has been added to minimize the friction in installing and getting started with Terragrunt, and removing any dependency on third party tools if you don’t want to use them.

curl -sL https://terragrunt.gruntwork.io/install | bash

The installation can be customized, with full customization options available via the --help flag.

curl -sL https://terragrunt.gruntwork.io/install | bash -s -- --help

In addition to providing this script, the ASDF plugin for Terragrunt has been updated to automatically perform signature verification on an opt-out basis for any version of Terragrunt equal or newer to v0.98.0. The Terragrunt entry in the Aqua registry has been updated to do the same, meaning mise users will automatically benefit from this as well.

If you don’t want to use the curl to bash script, or any of the other distribution methods available, the instructions for performing signature verification manually have been updated in the installation documentation as well.

📖 Documentation Updates

OpenTofu/Terraform compatibility matrix now available as API

In addition to providing a compatibility matrix in the Supported Versions documentation, compatibility verification is also available via an API endpoint here:

https://terragrunt.gruntwork.io/api/v1/compatibility

See the compatibility API documentation for more details, including availability of query string parameters for filtering responses.

JSON schema for --auth-provider-cmd published

A JSON schema has been published for the schema expected for the stdout of commands invoked using --auth-provider-cmd. You can access the schema here.

You can use tools like this JSON schema validator or other simple utilities to programmatically validate that the stdout of JSON responses in your commands invoked by --auth-provider-cmd obey the expected schema.

🐛 Bug Fixes

Exit Codes for run --all more consistent

Fixed an issue where run --all incorrectly returned a 0 exit code when individual units failed.

Automatic retry for provider queries

To address intermittent errors in queries to the OpenTofu/Terraform provider registries, we expanded the automatic retry logic to include timeouts from provider registries.

What's Changed

New Contributors

Full Changelog: gruntwork-io/terragrunt@v0.98.0...v0.99.0

v0.98.0

Compare Source

✨ New Features

The --filter flag now implies --all

When using the --filter flag, it is now optional to also supply --all. Terragrunt will automatically set the --all flag when you use the --filter flag.

🐛 Bug Fixes

Plan files are now correctly passed as CLI arguments for destroy operations

A bug in the logic used for injecting plan files as arguments to the apply -destroy command resulted in the plan file argument being injected prior to the -auto-approve flag, which is disallowed in OpenTofu/Terraform. That bug has been fixed.

GCS bootstrap authentication fixed

A bug in the authentication logic for GCS backends prevented successful bootstrapping of backends when using the --auth-provider-cmd flag. That bug has been fixed.

Git-based and Graph-based combinations fixed

A bug in the discovery logic for Git worktrees prevented using a combination of Git-based and Graph-based filter expressions in the same filter from working correctly.

e.g.

 terragrunt find --filter '...^[HEAD^...HEAD]...'

That bug has been fixed.

Proper exit codes returned from -detailed-exitcode

A bug in the logic for handling retries combined with the OpenTofu/Terraform plan -detailed-exitcode and the Terragrunt --all flag resulted in the wrong exit code being returned when a failed run succeeded on a subsequent retry with a status code related to drift (exit code 2).

That logic has been corrected, and properly follows the rules outlined under the --all flag:

When not using -detailed-exitcode:

  • Terragrunt will return the highest exit code of all runs performed.

When using -detailed-exitcode:

  • If any run has an exit code that is 1, or greater than 2, run --all will return the highest exit code.
  • Otherwise, if any run returns an exit code of 2, run --all will return an exit code of 2.
  • Otherwise, run --all will return an exit code of 0.
OpenTelemetry traces in console mode fixed

A bug in OpenTelemetry trace exporting prevented traces from being exported when in console mode. That bug has been fixed.

Negation logic fixed

A bug in how negation logic was handled in filter expressions prevented successful exclusion of stacks from generation and over excluded units in runs when users only supplied negative filters.

⚙️ Process Improvements

GPG Signing

Release artifacts are now signed using both GPG and Cosign.

To start performing signature validation on assets, in addition to the asset you’re downloading from the GitHub releases page, you’ll want to download some of the following files:

VERSION="v0.XX.X"  # Replace with actual version of Terragrunt you are installing
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS"

# For GPG:
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS.gpgsig"

# For Cosign:
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS.sig"
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS.pem"

To verify with GPG:

curl -s https://gruntwork.io/.well-known/pgp-key.txt | gpg --import

gpg --verify SHA256SUMS.gpgsig SHA256SUMS

sha256sum -c SHA256SUMS --ignore-missing

To verify with Cosign:

cosign verify-blob SHA256SUMS \
  --signature SHA256SUMS.sig \
  --certificate SHA256SUMS.pem \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "github.com/gruntwork-io/terragrunt"

sha256sum -c SHA256SUMS --ignore-missing

Terragrunt installation documentation will be updated soon to recommend this on every installation, the Gruntwork maintained asdf plugin will be updated to do this automatically, and all Gruntwork recommended mechanisms for installing Terragrunt will support this going forward.

Upgrade to Go 1.25.5

The Golang toolchain used to build Terragrunt has been upgraded to v1.25.5.

Package reorganization

All top-level Golang packages in the Terragrunt project have been migrated to either internal or pkg. The distinction between the two indicates maintainer expectations as to whether either are being actively being consumed as libraries by third parties (with internal being impossible to import without vendoring in go modules).

Note that this does not indicate any backwards compatibility guarantee for usage of the Terragrunt as a library. It will remain unstable, and can change at any time.

What's Changed

Full Changelog: gruntwork-io/terragrunt@v0.97.2...v0.98

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@zon-renovate zon-renovate force-pushed the renovate/gruntwork-io-terragrunt-0.x branch from 2270cf0 to 2fa6047 Compare March 26, 2026 14:20
@zon-renovate zon-renovate changed the title chore(deps): update gruntwork-io/terragrunt to 0.99.4 chore(deps): update gruntwork-io/terragrunt to 0.99.5 Mar 26, 2026
@BenediktFloeser BenediktFloeser changed the title chore(deps): update gruntwork-io/terragrunt to 0.99.5 chore(deps): update gruntwork-io/terragrunt to 1.0.0 Apr 7, 2026
@BenediktFloeser BenediktFloeser merged commit a037e8b into main Apr 7, 2026
@BenediktFloeser BenediktFloeser deleted the renovate/gruntwork-io-terragrunt-0.x branch April 7, 2026 09:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies tool-binaries

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@zon-renovate @BenediktFloeser