What's Changed

Enhancements

• build(deps): Bump github.com/terraform-linters/tflint-ruleset-terraform from 0.12.0 to 0.13.0 by @dependabot[bot] in #2351
• json: add fixed, fixable by @bendrucker in #2355

Bug Fixes

• format(sarif): Add tflint-errors rules for errors by @wata727 in #2373

Chores

• build(deps): Bump github.com/sigstore/sigstore-go from 1.0.0 to 1.1.0 by @dependabot[bot] in #2343
• build(deps): Bump golang.org/x/net from 0.41.0 to 0.42.0 in the go-x group across 1 directory by @dependabot[bot] in #2346
• build(deps): Bump sigstore/cosign-installer from 3.9.1 to 3.9.2 by @dependabot[bot] in #2347
• workflow: validate issues by @bendrucker in #2348
• build(deps): Bump google.golang.org/grpc from 1.73.0 to 1.74.2 by @dependabot[bot] in #2349
• build(deps): Bump docker/login-action from 3.4.0 to 3.5.0 by @dependabot[bot] in #2350
• build(deps): Bump mislav/bump-homebrew-formula-action from 3.4 to 3.5 by @dependabot[bot] in #2353
• dependabot: allow actions writes by @bendrucker in #2356
• build(deps): Bump docker/metadata-action from 5.7.0 to 5.8.0 by @dependabot[bot] in #2352
• build(deps): Bump actions/checkout from 4.2.2 to 5.0.0 by @dependabot[bot] in #2357
• build(deps): Bump the go-x group with 3 updates by @dependabot[bot] in #2358
• build(deps): Bump github.com/sigstore/sigstore-go from 1.1.0 to 1.1.1 by @dependabot[bot] in #2359
• build(deps): Bump github.com/hashicorp/go-plugin from 1.6.3 to 1.7.0 by @dependabot[bot] in #2360
• build(deps): Bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by @dependabot[bot] in #2361
• build(deps): Bump golang from 1.24-alpine3.21 to 1.25-alpine3.21 by @dependabot[bot] in #2362
• build(deps): Bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 by @dependabot[bot] in #2363
• build(deps): Bump github.com/hashicorp/go-getter from 1.7.8 to 1.7.9 by @dependabot[bot] in #2364
• build(deps): Bump google.golang.org/grpc from 1.74.2 to 1.75.0 by @dependabot[bot] in #2365
• build(deps): Bump github.com/zclconf/go-cty from 1.16.3 to 1.16.4 by @dependabot[bot] in #2366
• build(deps): Bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 by @dependabot[bot] in #2371
• Add support for Terraform v1.13 by @wata727 in #2372
• deps: Bump Go version to 1.25 by @wata727 in #2374
• Bump github.com/ulikunitz/xz to v0.5.15 by @wata727 in #2375

Full Changelog: v0.58.1...v0.59.1

What's Changed

Bug Fixes

• Allow calling provider-defined functions with variadic arguments by @wata727 in #2340

Chores

• build(deps): Bump google.golang.org/grpc from 1.72.1 to 1.72.2 by @dependabot[bot] in #2322
• build(deps): Bump mislav/bump-homebrew-formula-action from 3.2 to 3.3 by @dependabot[bot] in #2324
• build(deps): Bump docker/build-push-action from 6.17.0 to 6.18.0 by @dependabot[bot] in #2326
• build(deps): Bump alpine from 3.21 to 3.22 by @dependabot[bot] in #2325
• build(deps): Bump mislav/bump-homebrew-formula-action from 3.3 to 3.4 by @dependabot[bot] in #2327
• build(deps): Bump the go-x group with 3 updates by @dependabot[bot] in #2328
• build(deps): Bump google.golang.org/grpc from 1.72.2 to 1.73.0 by @dependabot[bot] in #2329
• build(deps): Bump actions/attest-build-provenance from 2.3.0 to 2.4.0 by @dependabot[bot] in #2332
• build(deps): Bump docker/setup-buildx-action from 3.10.0 to 3.11.0 by @dependabot[bot] in #2333
• build(deps): Bump docker/setup-buildx-action from 3.11.0 to 3.11.1 by @dependabot[bot] in #2335
• build(deps): Bump sigstore/cosign-installer from 3.8.2 to 3.9.1 by @dependabot[bot] in #2336
• build(deps): Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 by @dependabot[bot] in #2337
• build(deps): Bump github.com/hashicorp/hcl/v2 from 2.23.1-0.20250203194505-ba0759438da2 to 2.24.0 by @dependabot[bot] in #2338
• Bump GoReleaser to v2.11.0 by @wata727 in #2342

Full Changelog: v0.58.0...v0.58.1

What's Changed

Enhancements

• Add support for Terraform v1.12 by @wata727 in #2321

Bug Fixes

• terraform: Cache resolved local values by @wata727 in #2301
• cmd: Apply format set in config file by @wata727 in #2320

Chores

• build(deps): Bump golang.org/x/oauth2 from 0.29.0 to 0.30.0 in the go-x group by @dependabot in #2296
• build(deps): Bump the go-x group with 3 updates by @dependabot in #2302
• build(deps): Bump actions/setup-go from 5.4.0 to 5.5.0 by @dependabot in #2304
• build(deps): Bump github.com/sigstore/sigstore-go from 0.7.2 to 0.7.3 by @dependabot in #2303
• go: modernize by @bendrucker in #2307
• docs: annotations cannot ignore errors by @bendrucker in #2311
• docs: tflint-ruleset GitHub topic by @bendrucker in #2312
• build(deps): Bump docker/build-push-action from 6.16.0 to 6.17.0 by @dependabot in #2313
• build(deps): Bump github.com/sourcegraph/jsonrpc2 from 0.2.0 to 0.2.1 by @dependabot in #2314
• build(deps): Bump google.golang.org/grpc from 1.72.0 to 1.72.1 by @dependabot in #2315
• build(deps): Bump golangci/golangci-lint-action from 7.0.0 to 8.0.0 by @dependabot in #2297
• build(deps): Bump github.com/zclconf/go-cty from 1.16.2 to 1.16.3 by @dependabot in #2317
• build(deps): Bump github.com/sigstore/sigstore-go from 0.7.3 to 1.0.0 by @dependabot in #2316

Full Changelog: v0.57.0...v0.58.0

What's Changed

Enhancements

• build(deps): Bump github.com/terraform-linters/tflint-ruleset-terraform from 0.11.0 to 0.12.0 by @dependabot in #2278

Bug Fixes

• plugin: Skip keyless verification for private third-party plugins by @ricardo-kh in #2292
  • This bug was supposed to have been fixed in v0.55.1, but was not fully fixed so has been fixed again.

Chores

• build(deps): Bump golang.org/x/net from 0.37.0 to 0.38.0 in the go-x group by @dependabot in #2277
• build(deps): Bump goreleaser/goreleaser-action from 6.2.1 to 6.3.0 by @dependabot in #2276
• build(deps): Bump google.golang.org/grpc from 1.71.0 to 1.71.1 by @dependabot in #2281
• build(deps): Bump the go-x group with 3 updates by @dependabot in #2282
• build(deps): Bump golang.org/x/net from 0.38.0 to 0.39.0 in the go-x group by @dependabot in #2285
• build(deps): Bump github.com/sigstore/sigstore-go from 0.7.0 to 0.7.2 by @dependabot in #2286
• build(deps): Bump google.golang.org/grpc from 1.71.1 to 1.72.0 by @dependabot in #2288
• Potential fix for code scanning alert no. 12: Incomplete regular expression for hostnames by @wata727 in #2289
• Potential fix for code scanning alert no. 11: Incomplete regular expression for hostnames by @wata727 in #2290
• Set explicit workflow permissions by @wata727 in #2291
• build(deps): Bump actions/attest-build-provenance from 2.2.3 to 2.3.0 by @dependabot in #2294
• build(deps): Bump docker/build-push-action from 6.15.0 to 6.16.0 by @dependabot in #2293
• build(deps): Bump sigstore/cosign-installer from 3.8.1 to 3.8.2 by @dependabot in #2295

New Contributors

• @ricardo-kh made their first contribution in #2292

Full Changelog: v0.56.0...v0.57.0

What's Changed

Enhancements

• Add support for tflint-ignore-file annotations in JSON by @isobit in #2230
• build(deps): Bump github.com/terraform-linters/tflint-ruleset-terraform from 0.10.0 to 0.11.0 by @dependabot in #2264
• Add support for Terraform v1.11 by @wata727 in #2258

Bug Fixes

• Exclude expression context from marked for_each diagnostics by @wata727 in #2256

Chores

• Remove dependency on dpkg in install_linux.sh by @jimmydavies in #2229
• build(deps): Bump golang.org/x/crypto from 0.32.0 to 0.33.0 by @dependabot in #2237
• build(deps): Bump sigstore/cosign-installer from 3.7.0 to 3.8.0 by @dependabot in #2233
• dependabot: group golang.org/x/* deps by @bendrucker in #2238
• build(deps): Bump golang.org/x/oauth2 from 0.25.0 to 0.26.0 by @dependabot in #2236
• build(deps): Bump docker/setup-buildx-action from 3.8.0 to 3.9.0 by @dependabot in #2232
• build(deps): Bump golangci/golangci-lint-action from 6.2.0 to 6.3.2 by @dependabot in #2231
• build(deps): Bump golang.org/x/net from 0.34.0 to 0.35.0 by @dependabot in #2235
• feat: bump to build with go1.24 by @chenrui333 in #2239
• build(deps): Bump goreleaser/goreleaser-action from 6.1.0 to 6.2.1 by @dependabot in #2241
• build(deps): Bump golangci/golangci-lint-action from 6.3.2 to 6.5.0 by @dependabot in #2240
• docs: add docker example with --init by @coolapso in #2242
• build(deps): Bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.5 by @dependabot in #2244
• build(deps): Bump docker/metadata-action from 5.6.1 to 5.7.0 by @dependabot in #2247
• build(deps): Bump docker/build-push-action from 6.13.0 to 6.15.0 by @dependabot in #2248
• build(deps): Bump sigstore/cosign-installer from 3.8.0 to 3.8.1 by @dependabot in #2249
• build(deps): Bump docker/setup-buildx-action from 3.9.0 to 3.10.0 by @dependabot in #2250
• build(deps): Bump actions/attest-build-provenance from 2.2.0 to 2.2.2 by @dependabot in #2251
• build(deps): Bump github.com/google/go-cmp from 0.6.0 to 0.7.0 by @dependabot in #2253
• build(deps): Bump the go-x group with 2 updates by @dependabot in #2252
• go: use testing.T helpers by @bendrucker in #2254
• Fix broken GitHub Actions badge by @wata727 in #2255
• build(deps): Bump actions/attest-build-provenance from 2.2.2 to 2.2.3 by @dependabot in #2261
• build(deps): Bump google.golang.org/grpc from 1.70.0 to 1.71.0 by @dependabot in #2260
• build(deps): Bump the go-x group with 4 updates by @dependabot in #2259
• build(deps): Bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by @dependabot in #2262
• build(deps): Bump docker/login-action from 3.3.0 to 3.4.0 by @dependabot in #2263
• build(deps): Bump github.com/spf13/afero from 1.12.0 to 1.14.0 by @dependabot in #2265
• go: 1.24.1 by @bendrucker in #2266
• Update pinned GitHub Action versions by @wata727 in #2268
• Enable Dependabot auto-merge by @wata727 in #2269
• build(deps): Bump actions/checkout from 4.1.7 to 4.2.2 by @dependabot in #2270
• golangci-lint v2 by @bendrucker in #2273
• build(deps): Bump actions/setup-go from 5.0.2 to 5.4.0 by @dependabot in #2272
• go: use govulncheck to detect security issues by @bendrucker in #2274

New Contributors

• @jimmydavies made their first contribution in #2229
• @coolapso made their first contribution in #2242
• @isobit made their first contribution in #2230

Full Changelog: v0.55.1...v0.56.0

What's Changed

Fixes

• plugin: Skip keyless verification for private third-party plugins by @wata727 in #2223

Chores

• build(deps): Bump docker/build-push-action from 6.10.0 to 6.11.0 by @dependabot in #2205
• Refactor plugin verifications by @wata727 in #2224
• build(deps): Bump golangci/golangci-lint-action from 6.1.1 to 6.2.0 by @dependabot in #2211
• build(deps): Bump github.com/mattn/go-colorable from 0.1.13 to 0.1.14 by @dependabot in #2214
• build(deps): Bump github.com/spf13/afero from 1.11.0 to 1.12.0 by @dependabot in #2216
• build(deps): Bump docker/build-push-action from 6.11.0 to 6.13.0 by @dependabot in #2217
• build(deps): Bump actions/attest-build-provenance from 2.1.0 to 2.2.0 by @dependabot in #2218
• build(deps): Bump github.com/hashicorp/go-plugin from 1.6.2 to 1.6.3 by @dependabot in #2220
• build(deps): Bump github.com/zclconf/go-cty from 1.16.0 to 1.16.2 by @dependabot in #2222
• build(deps): Bump github.com/sigstore/sigstore-go from 0.6.2 to 0.7.0 by @dependabot in #2219
• build(deps): Bump google.golang.org/grpc from 1.69.2 to 1.70.0 by @dependabot in #2221

Full Changelog: v0.55.0...v0.55.1

What's Changed

Breaking Changes

• plugin: Drop support for plugin SDK v0.14/v0.15 by @wata727 in #2203
  • Plugins built with SDKs v0.14/v0.15 are no longer supported. If you get "SDK version is incompatible" error, you need to update the plugin to use SDK v0.16+.

Enhancements

• Move recursive init output to debug when there are no changes by @pvickery-ParamountCommerce in #2150
• Introduce plugin keyless verification by @wata727 in #2159
  • For third-party plugins that are not PGP signed and have uploaded artifact attestations, TFLint will now attempt to verify them via the Sigstore ecosystem.
• Add support for Terraform v1.10 by @wata727 in #2178
• cmd: Simplify recursive init outputs by @wata727 in #2204

Chores

• build(deps): Bump goreleaser/goreleaser-action from 6.0.0 to 6.1.0 by @dependabot in #2165
• build(deps): Bump actions/attest-build-provenance from 1.4.3 to 1.4.4 by @dependabot in #2166
• build(deps): Bump golang.org/x/net from 0.30.0 to 0.31.0 by @dependabot in #2164
• build(deps): Bump google.golang.org/grpc from 1.67.1 to 1.68.0 by @dependabot in #2160
• build(deps): Bump golang.org/x/oauth2 from 0.23.0 to 0.24.0 by @dependabot in #2163
• build(deps): Bump github.com/zclconf/go-cty from 1.15.0 to 1.15.1 by @dependabot in #2174
• build(deps): Bump docker/build-push-action from 6.9.0 to 6.10.0 by @dependabot in #2173
• build(deps): Bump mislav/bump-homebrew-formula-action from 3.1 to 3.2 by @dependabot in #2171
• build(deps): Bump docker/metadata-action from 5.5.1 to 5.6.1 by @dependabot in #2170
• build(deps): Bump github.com/hashicorp/hcl/v2 from 2.22.0 to 2.23.0 by @dependabot in #2168
• build(deps): Bump github.com/theupdateframework/go-tuf/v2 from 2.0.0 to 2.0.1 by @dependabot in #2177
• install: handle GitHub API JSON without newlines by @bendrucker in #2176
• build(deps): Bump alpine from 3.20 to 3.21 by @dependabot in #2180
• build(deps): Bump google.golang.org/grpc from 1.68.0 to 1.68.1 by @dependabot in #2181
• build(deps): Bump actions/attest-build-provenance from 1.4.4 to 2.0.1 by @dependabot in #2185
• build(deps): Bump golang.org/x/crypto from 0.29.0 to 0.30.0 by @dependabot in #2183
• build(deps): Bump golang.org/x/net from 0.31.0 to 0.32.0 by @dependabot in #2184
• build(deps): Bump alpine to 3.21 and golangci-lint to 1.62.2 by @chenrui333 in #2188
• build(deps): Bump golang.org/x/crypto from 0.30.0 to 0.31.0 by @dependabot in #2189
• build(deps): Bump actions/attest-build-provenance from 2.0.1 to 2.1.0 by @dependabot in #2190
• build(deps): Bump docker/setup-buildx-action from 3.7.1 to 3.8.0 by @dependabot in #2191
• build(deps): Bump google.golang.org/grpc from 1.68.1 to 1.69.0 by @dependabot in #2192
• build(deps): Bump google.golang.org/grpc from 1.69.0 to 1.69.2 by @dependabot in #2196
• build(deps): Bump golang.org/x/net from 0.32.0 to 0.33.0 by @dependabot in #2195
• chore: fix typos by @chenrui333 in #2198
• build(deps): Bump github.com/zclconf/go-cty from 1.15.1 to 1.16.0 by @dependabot in #2199
• build(deps): Bump golang.org/x/crypto from 0.31.0 to 0.32.0 by @dependabot in #2200
• build(deps): Bump golang.org/x/oauth2 from 0.24.0 to 0.25.0 by @dependabot in #2202

New Contributors

• @pvickery-ParamountCommerce made their first contribution in #2150

Full Changelog: v0.54.0...v0.55.0

What's Changed

Breaking Changes

• Remove deprecated --module/--no-module and module attribute by @wata727 in #2036

Enhancements

• Update to owenrumney/go-sarif/v2 by @oWretch in #2111
• build(deps): Bump github.com/terraform-linters/tflint-ruleset-terraform from 0.9.1 to 0.10.0 by @dependabot in #2152

Bug Fixes

• Override exactly according to the Terraform spec by @wata727 in #2124

Chores

• build(deps): Bump google.golang.org/grpc from 1.65.0 to 1.66.0 by @dependabot in #2112
• build(deps): Bump github.com/hashicorp/hcl/v2 from 2.21.0 to 2.22.0 by @dependabot in #2109
• build(deps): Bump actions/attest-build-provenance from d6e56129ac57db21eabf33778e4aa20e800eb5cb to 310b0a4a3b0b78ef57ecda988ee04b132db73ef8 by @dependabot in #2103
• plugin: Introduce explicit locking on the root runner operations by @wata727 in #2115
• build(deps): Bump google.golang.org/grpc from 1.66.0 to 1.66.2 by @dependabot in #2125
• build(deps): Bump google.golang.org/grpc from 1.66.2 to 1.67.0 by @dependabot in #2129
• build(deps): Bump golang.org/x/oauth2 from 0.22.0 to 0.23.0 by @dependabot in #2117
• build(deps): Bump golang.org/x/text from 0.17.0 to 0.18.0 by @dependabot in #2120
• build(deps): Bump golang.org/x/net from 0.28.0 to 0.29.0 by @dependabot in #2119
• build(deps): Bump docker/build-push-action from 6.7.0 to 6.9.0 by @dependabot in #2131
• Update config.md by @rquadling in #2130
• build(deps): Bump actions/attest-build-provenance from 1.4.1 to 1.4.3 by @dependabot in #2121
• build(deps): Bump docker/setup-buildx-action from 3.6.1 to 3.7.1 by @dependabot in #2134
• build(deps): Bump sigstore/cosign-installer from 3.6.0 to 3.7.0 by @dependabot in #2136
• build(deps): Bump golang.org/x/text from 0.18.0 to 0.19.0 by @dependabot in #2137
• build(deps): Bump github.com/zclconf/go-cty-yaml from 1.0.3 to 1.1.0 by @dependabot in #2138
• build(deps): Bump golang.org/x/crypto from 0.27.0 to 0.28.0 by @dependabot in #2139
• build(deps): Bump google.golang.org/grpc from 1.67.0 to 1.67.1 by @dependabot in #2140
• build(deps): Bump golang.org/x/net from 0.29.0 to 0.30.0 by @dependabot in #2141
• build(deps): Bump golangci/golangci-lint-action from 6.1.0 to 6.1.1 by @dependabot in #2135
• build(deps): Bump github.com/hashicorp/go-plugin from 1.6.1 to 1.6.2 by @dependabot in #2147
• build(deps): Bump github.com/fatih/color from 1.17.0 to 1.18.0 by @dependabot in #2148
• go: Remove patch version from go.mod by @wata727 in #2156
• Bump GoReleaser to v2 by @wata727 in #2157
• Fix FromAsCasting build check failure by @wata727 in #2158

New Contributors

• @oWretch made their first contribution in #2111
• @rquadling made their first contribution in #2130

Full Changelog: v0.53.0...v0.54.0

What's Changed

Enhancements

• build(deps): Bump github.com/terraform-linters/tflint-ruleset-terraform from 0.8.0 to 0.9.1 by @dependabot in #2093

Bug Fixes

• Fix a race condition when evaluating on the root context by @wata727 in #2096

Chores

• build(deps): Bump golang.org/x/net from 0.26.0 to 0.27.0 by @dependabot in #2086
• build(deps): Bump google.golang.org/grpc from 1.64.0 to 1.65.0 by @dependabot in #2088
• build(deps): Bump github.com/terraform-linters/tflint-plugin-sdk from 0.20.0 to 0.21.0 by @dependabot in #2090
• build(deps): Bump github.com/zclconf/go-cty from 1.14.4 to 1.15.0 by @dependabot in #2089
• build(deps): Bump golang.org/x/text from 0.16.0 to 0.17.0 by @dependabot in #2098
• build(deps): Bump sigstore/cosign-installer from 3.5.0 to 3.6.0 by @dependabot in #2097
• build(deps): Bump golang.org/x/oauth2 from 0.21.0 to 0.22.0 by @dependabot in #2092
• build(deps): Bump golang.org/x/crypto from 0.25.0 to 0.26.0 by @dependabot in #2099
• build(deps): Bump golang.org/x/net from 0.27.0 to 0.28.0 by @dependabot in #2100
• build(deps): Bump golangci/golangci-lint-action from 6.0.1 to 6.1.0 by @dependabot in #2091
• chore: bump to use go 1.23.0 by @chenrui333 in #2101
• chore: pin workflow action sha by @chenrui333 in #2102

Full Changelog: v0.52.0...v0.53.0

What's Changed

Enhancements

• cmd: Allow --chdir and --recursive to be used together by @wata727 in #2079
• terraform: Add support for Terraform v1.9 by @wata727 in #2077
• Bump bundled terraform ruleset to v0.8.0 by @wata727 in #2085

Bug Fixes

• formatter: Add source attribute in the checkstyle format by @wata727 in #2078

Chores

• deps: Go 1.22.5 by @wata727 in #2084

Full Changelog: v0.51.2...v0.52.0