OpenTofu v1.12.4 - Saved Plan And Provider Move Fixes

OpenTofu v1.12.4 was published on July 13, 2026. The main operator fix restores saved plan generation when a protected resource needs replacement, removing the invalid change action ForgetThenCreate error from tofu plan -out. The patch also corrects provider source address handling for moved resources.

The full release notes and downloads are on the GitHub release page.

The most visible correction affects a resource that has this lifecycle rule:

lifecycle {
  destroy = false
}

When such a resource needed replacement, tofu plan -out=plan.tfplan could fail before producing the requested plan file. The reported error was invalid change action ForgetThenCreate. OpenTofu v1.12.4 removes that failure, as tracked in issue 4324.

This matters in automation that treats a saved plan as the reviewed artifact. A data platform repository may generate a plan in one CI job, retain it for approval, then apply that exact file in a later job. If plan creation stops on an internal action value, the pipeline cannot reach policy checks, human review, or apply.

The lifecycle condition is important. destroy = false expresses an explicit refusal to destroy the object, while replacement normally requires removal of the old object at some point. The release notes do not describe a change to that lifecycle policy. They describe a fix to plan generation for the conflicting replacement case. Operators should still inspect the resulting action and confirm that it matches the intended protection policy before apply.

Two related fixes address provider identity during resource moves. A moved block now compares provider source addresses correctly, according to pull request 4280. OpenTofu also passes the correct source provider address into provider MoveResource requests, covered by pull request 4355.

These are separate points in the move path. The first affects how OpenTofu decides whether provider source addresses match. The second affects the source identity sent to the provider when it performs the move. Correcting both keeps the comparison and the provider request aligned.

That distinction matters during module refactoring or provider migration. A resource address move is not only a mapping between old and new configuration paths. Provider source identity is also part of the operation. An incorrect source address can make a valid configuration move fail or ask the provider to interpret the wrong origin.

The release notes do not claim broader state migration changes. There are no new move commands, configuration keys, or user facing migration steps in this patch. The scope is correctness in existing moved block and provider request behavior.

OpenTofu v1.12.4 contains three documented bug fixes and no announced features or breaking changes. The full changelog is limited to the comparison with v1.12.3.

Teams using saved plan files should rerun a representative replacement case with the same lifecycle protection used in production. Teams moving resources across modules or provider configurations should also inspect the planned state addresses before apply. Those checks target the exact paths changed here without turning a patch upgrade into a general migration exercise.