OpenTofu v1.11.13 - Provider State Upgrade And ECH Fixes

OpenTofu v1.11.13, published on July 21, 2026, corrects provider state upgrade routing when an implicit move is combined with a provider address change. The release also fixes an Encrypted Client Hello handshake disclosure inherited through the Go standard library.

The full release notes and downloads are on the GitHub release page.

The main correctness fix concerns a specific state transition. In previous behavior, the combination of an implicit resource move and a provider address change could cause OpenTofu to call providers.MovedResourceState where it should call providers.UpgradeResourceState. The correction is tracked in pull request 4375.

That distinction matters in automated infrastructure runs because a move and a provider state upgrade represent different work. The provider needs the upgrade operation when state must be interpreted for the changed provider address. Sending that state through the move operation selects the wrong provider path, even if the configuration itself is otherwise valid.

The trigger is narrow. The notes require both an implicit move and a provider address change. They do not say that every resource move or every provider upgrade was affected. Operators should therefore focus review on configurations where those two events occur together, including module reorganizations that also change which provider address owns the resource.

The release notes do not describe a new state format, a new configuration key, or a manual migration command. This is a routing correction inside OpenTofu. Even so, teams with affected plans should compare the planned resource actions before and after the upgrade. A state backup remains sensible before applying any infrastructure change that alters resource ownership.

The security fix covers the Encrypted Client Hello implementation used by OpenTofu through the Go standard library. Earlier releases in the v1.11 series could leak pre-shared key identities during the handshake. A passive network observer able to collect those handshakes could then identify the server hostname, despite ECH being enabled.

This is a confidentiality problem in handshake metadata. The disclosed issue is loss of hostname anonymity; the notes do not report exposure of OpenTofu state contents or plan data. The fix landed through pull request 4363.

The operational relevance depends on whether a deployment uses ECH and relies on it to hide the destination hostname from passive observers. In that case, staying on an earlier v1.11 build preserves the behavior described by the advisory. Moving to v1.11.13 removes the implementation flaw identified in these release notes.

This release contains two operator visible corrections rather than a broad feature set. The notes include no breaking change notice and no migration procedure. That keeps the rollout surface small, but it does not remove the need to inspect plans that exercise the provider state condition.

For validation, run the normal plan checks against a representative workspace that contains implicit moves and provider address changes. Confirm that the resulting actions match the intended resource ownership. For the security change, confirm that the OpenTofu binary in runners and operator images is actually v1.11.13; updating a local workstation alone does not update remote execution environments.

The GitHub release page is the source for the published notes and binaries.