terraform

Commit Graph

Author	SHA1	Message	Date
github-actions[bot]	f44c8af702	backport of commit `6d448fae2b` (#36871 ) Co-authored-by: Daniel Banck <daniel@dbanck.de>	1 year ago
Ricard Bejarano	200f4cabb0	Bump golang.org/x/net from 0.37.0 to 0.38.0 (fixes CVE-2025-22872) (#36800 ) * Bump golang.org/x/net from 0.37.0 to 0.38.0 (fixes CVE-2025-22872) Signed-off-by: Ricard Bejarano <ricard@bejarano.io> * add changelog entry * go mod tidy Signed-off-by: Ricard Bejarano <ricard@bejarano.io> * Revert "add changelog entry" This reverts commit `88219e78e9`. * make syncdeps Signed-off-by: Ricard Bejarano <ricard@bejarano.io> --------- Signed-off-by: Ricard Bejarano <ricard@bejarano.io>	1 year ago
Sarah French	6ef0498f9c	Update to Go 1.24.1, update dependencies (#36790 ) * go get github.com/hashicorp/go-azure-helpers@v0.72.0 * .go-version to 1.24.1 * Run `./scripts/syncdeps.sh` This propagates the Go version upgrade * gcs : go get google.golang.org/api@v0.155.0 * gcs: go mod tidy * Run `./scripts/syncdeps.sh` * make generate && make protobuf	1 year ago
Sarah French	53172a5f8a	Bump `golang.org/x/net` to v0.36.0 (#36691 ) * go get golang.org/x/net@v0.36.0 * go mod tidy * Run syncdeps.sh	1 year ago
James Bardin	bc45d60936	make syncdeps	1 year ago
Radek Simko	c40c9378a1	go: bump version to 1.24 (#36478 ) * go: bump version to 1.24 * add changelog entry	1 year ago
James Bardin	f9de7186ae	make syncdeps	1 year ago
Liam Cervante	270aaeb69a	update go-cty to latest patch release (#36376 ) * update go-cty to latest patch release * also fixes other bug	1 year ago
Sarah French	a8b126aeff	Upgrade hashicorp/go-getter dependency (#36326 ) * go get github.com/hashicorp/go-getter@v1.7.8 * Sync deps	1 year ago
dependabot[bot]	e538e0f228	build(deps): bump golang.org/x/net from 0.29.0 to 0.33.0 in /internal/backend/remote-state/s3 (#36298 ) * build(deps): bump golang.org/x/net in /internal/backend/remote-state/s3 Bumps [golang.org/x/net](https://github.com/golang/net) from 0.29.0 to 0.33.0. - [Commits](https://github.com/golang/net/compare/v0.29.0...v0.33.0) --- updated-dependencies: - dependency-name: golang.org/x/net dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore: make syncdeps --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Jared Baker <jared.baker@hashicorp.com>	1 year ago
Jan Harrie	b827ca459e	Upgraded github.com/hashicorp/go-slug v0.16.0 => v0.16.3 (#36273 ) * upgraded github.com/hashicorp/go-slug v0.16.0 => v0.16.3 * updated changelog * removed old entry from go-slug * upgraded github.com/hashicorp/go-slug v0.16.0 => v0.16.3 * upgraded github.com/hashicorp/go-slug v0.16.0 => v0.16.3 * Update CHANGELOG.md --------- Co-authored-by: Sarah French <15078782+SarahFrench@users.noreply.github.com>	1 year ago
Liam Cervante	fa27595fe3	Update go-cty to 1.16.0 (#36262 ) * Update go-cty to 1.16.0 * syndeps	1 year ago
dependabot[bot]	d2c0a0e992	Bump golang.org/x/crypto from 0.27.0 to 0.31.0 (#36203 ) * Bump golang.org/x/crypto from 0.27.0 to 0.31.0 Bumps [golang.org/x/crypto](https://github.com/golang/crypto) from 0.27.0 to 0.31.0. - [Commits](https://github.com/golang/crypto/compare/v0.27.0...v0.31.0) --- updated-dependencies: - dependency-name: golang.org/x/crypto dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * syncdeps --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Liam Cervante <liam.cervante@hashicorp.com>	2 years ago
James Bardin	762f9334de	make syncdeps	2 years ago
James Bardin	3a1324a811	make syncdeps	2 years ago
James Bardin	1699bc2658	sync deps	2 years ago
James Bardin	198ab3ec7b	update go version	2 years ago
Brandon Croft	18ca2d5a79	make syncdeps	2 years ago
Brandon Croft	2a9b79d423	make syncdeps	2 years ago
James Bardin	a34f51cb3f	update HCL to HEAD Includes a fix for this PR, we will update to a tagged version before release.	2 years ago
James Bardin	809fe73b84	update deps to match go1.23 Make sure tooling dependencies are updated to use go1.23, and get any closely related package updates, like golang.org/x/*	2 years ago
James Bardin	4b2380ca7c	update to go1.23 Release notes: https://go.dev/doc/go1.23	2 years ago
James Bardin	8b1f19d923	update go-cty@v1.15.0	2 years ago
Jamie Finnigan	bbd258bd93	move from Go 1.22.4 to 1.22.5 (#35494 )	2 years ago
Jamie Finnigan	54f937cc3c	upgrade github.com/hashicorp/go-retryablehttp & deps (#35473 )	2 years ago
Liam Cervante	0f0414d484	Fix partial address representation in plan for deferred actions (#34966 ) * Fix partial address representation in plan * reflect new type in stacks	2 years ago
Jamie Finnigan	68ceed40e1	move from Go 1.22.1 to 1.22.4 (#35335 )	2 years ago
Martin Atkins	91c88f4705	go.mod: go get github.com/apparentlymart/go-versions@v1.0.2 This includes a fix in the handling of conflicting constraints referring to prereleases, like "1.0.0-beta.1, !1.0.0-beta.1". Previously the library would incorrectly treat that as a positive match, rather than having the negative override the positive as happens in all other cases.	2 years ago
Jamie Finnigan	368ccbf63a	make syncdeps	2 years ago
James Bardin	b79589d2d5	udpate submodule deps	2 years ago
Sebastian Rivera	015f795ff0	Rebrand Terraform Cloud to HCP Terraform	2 years ago
Martin Atkins	84df5562f2	moduleaddrs: Terraform now owns module source address normalization We've been gradually chipping away at how much we use go-getter for source packages, because it's generally been a bit of a nightmare and sharing it with other codebases means that any time someone wants to change something we end up needing to find some way to prevent it breaking Terraform's compatibility promises. Here we make one further step: Terraform owns the "detectors" idea that deals with source address normalization, and now always produces fully-qualified addresses for go-getter to chew on only for the getting and decompressing steps. Retaining go-getter for the actual getting part is helpful because we can then benefit from security fixes upstream, but Terraform owning the first layer of parsing means that we can fix in place the definition of what "module source address" syntax means, and thus we can avoid having everything in this codebase indirectly depend on go-getter just because it wants to parse module source addresses. Now only the module installer actually depends indirectly on go-getter, which finally disconnects go-getter's subtree from all of the remote state backend dependency graphs.	2 years ago
Martin Atkins	78ae6af906	legacy/terraform: Minimize the contents of this legacy package At one point we were relying on this for a few different things, but now it's here exclusively to support legacy/helper/schema, the legacy SDK snapshot that is still being used by a few of the remote state backends. The SDK only really needs a tiny portion of the functionality from this package, and by deleting as much of the unused stuff as possible we can reduce the indirect dependencies of this package and thus, in turn, the indirect dependencies of the remote state backends. This also selectively deletes a few parts of the legacy SDK that are focused on providers and provisioners, because we know that we have this here only to support the backends that haven't yet been weaned off it, but we'll save a more adventurous purge of _that_ package for another day.	2 years ago
Martin Atkins	56006416ba	go.mod: go get golang.org/x/tools@v0.19.0 We use this just for development-time tools like "stringer", so this upgrade should not have any runtime impact.	2 years ago
Martin Atkins	c541757f4a	go.mod: go get golang.org/x/mod@v0.16.0 Aside from development tool dependencies we use this only for the directory hashing logic used to compute go module hashes, which we also use for Terraform provider hashes. There are no changes to the dirhash package in this update, so this should have no runtime impact.	2 years ago
Martin Atkins	b059985227	go.mod: go get golang.org/x/sync@v0.6.0 This update only changes a documentation comment, so cannot affect runtime behavior.	2 years ago
Martin Atkins	caa7a757bc	go.mod: go get golang.org/x/oauth2@v0.18.0 This only upgrades a Google-specific subpackage, and so the only potential impact is to the GCS backend.	2 years ago
Martin Atkins	9c7ece8ad4	go.mod: go get golang.org/x/net@v0.22.0 This update is largely focused on QUIC implementation changes, which do not directly affect Terraform. There is one fix for the HTTP2 implementation to terminate the stream if a sender recieves an out-of-bounds window update, which makes the implementation better match the specification. This seems unlikely to cause any practical problems for Terraform.	2 years ago
Martin Atkins	fad9c2a4cd	go.mod: go get golang.org/x/crypto@v0.21.0 This update is mostly internal changes that don't affect external behavior. The only update potentially significant to Terraform is the new exclusion of a particular root certificate that is used only for some specific names under the .tr CCTLD, but the certificate database doesn't specify that constraint in a way that the library can understand, so it's excluded to avoid making the trust for that certificate broader than intended.	2 years ago
Martin Atkins	b3f6a6230d	go.mod: go get golang.org/x/sys@v0.18.0 This small update does not directly affect any Terraform functionality.	2 years ago
Martin Atkins	61a5c1f57b	go.mod: go get github.com/hashicorp/terraform-registry-address@v0.2.3 This is really just a bunch of changes to the upstream go.mod for updates to its own dependencies, but Terraform already has new enough versions of those dependencies for other reasons and so this changes nothing.	2 years ago
Martin Atkins	8603ee0ab5	go.mod: go get github.com/hashicorp/go-slug@v0.14.0 This has just some changes to the "sourcebundle" building API, which doesn't affect Terraform CLI or Terraform Core because they currently only consume source bundles, not build them.	2 years ago
Martin Atkins	545980d664	langrefs: Separate package for expression reference analysis Finding references in an expression is a static analysis operation, but we previously had it grouped in with "package lang" that primarily deals with dynamic evaluation of expressions. We need to do static analysis in far more locations than we do full expression evaluation, the static-analysis-only callers don't need anything else from package lang, and the reference-analysis functions are self-contained little wrappers around the address parsing logic in package addrs anyway. Splitting these into a separate package therefore minimizes which packages depend indirectly on package lang, and thus which packages depend indirectly on the implementations of the built-in functions. Some of the built-in functions rely on dependencies we don't use anywhere else, so cutting these out shrinks how many packages indirectly depend on those external dependencies. In particular, they are no longer in the indirect import chain for the "legacy" module.	2 years ago
Martin Atkins	5f2eab6944	providerreqs: Provider requirement/version types in their own package As we previously found with "package addrs", any package that contains types used as identifiers or addresses tends to get imported from all over, which means that if we mix real logic with those types in the same package then a lot more packages end up depending indirectly on our external dependencies. In this case, the getproviders package depends on various things we need only during provider installation, such as the library we use for GPG signature verification. Lots of different packages in Terraform need to talk about provider requirements, but only the CLI layer actually needs to do provider installation, and so this commit splits the types we use to talk about requirements into a new package "providerreqs", which package getproviders then depends on. To keep the size of this diff relatively small to start I've left forwarding aliases in package getproviders, which means that not all of the callers needed to be updated all at once. This commit does update all of the packages that the remote state backends depend on though, because that then allows us to reduce the set of indirect dependencies for each of those backends. The nested module go.mod files show that this has disconnected the indirect dependencies on github.com/ProtonMail/go-crypto and on github.com/cloudflare/circl , both of which Terraform CLI uses only for provider installation.	2 years ago
Martin Atkins	5811be26f8	go.mod: Separate modules at code ownership boundaries Historically it's been hard for us to keep on top of dependency upgrades as a matter of course because it's unclear which code owners might be affected by or responsible for an upgrade of each module. After trying a few different techniques to try to mitigate this, the most promising one seems to be to tell the Go toolchain that each of these components is a separate Go module, but then to stitch them all back together again using replace directives so that we can mostly ignore these module boundaries in everyday development. The one case where we _do_ need to pay attention to these boundaries is also the case where the separation is useful: upgrading a dependency of any one of these modules might potentially force upgrading it for another module too, and so the Go toolchain will help us notice that interaction and we can immediately which code owners might need to be involved in reviewing and testing that particular upgrade. To make that process less onerous, this adds a new makefile target "make syncdeps" which runs "go mod tidy" in all of the modules at once and thus forces the toolchain to align their dependencies to the extent required for them all to be linked together successfully, and to generate go.mod and/or go.sum diffs that will match our configured code ownership paths to trigger the appropriate code review requests. Hopefully before too long we'll be able to move all the backends out into provider plugins and delete the "legacy" module entirely and then this oddness won't be needed anymore, but as long as we're all trying to play together in this same sandbox this is a small amount of extra ceremony in return for hopefully reducing the level of anxiety involved in keeping the system's dependencies up to date more consistently.	2 years ago

45 Commits (f44c8af702e8fbe20eaf42fb5b38a141fd39e4d0)