OpenTofu v1.12.5 - ECH Privacy and State Upgrade Fixes

OpenTofu v1.12.5 was published on July 21, 2026. This stable maintenance release fixes an ECH privacy leak that could expose a server hostname and corrects provider state upgrade dispatch when an implicit move occurs with a provider address change.

The full release notes and downloads are on the GitHub release page.

Earlier releases in the v1.12 series inherited a problem in the Encrypted Client Hello implementation used by OpenTofu through the Go standard library. During a handshake, that implementation could expose pre shared key identities. A passive observer able to collect handshakes could use the exposed identities to deanonymize the hostname of the server, even though ECH was in use.

The correction is tracked in pull request 4363. The release notes do not describe remote code execution, credential theft, or modification of traffic. The stated problem is loss of hostname privacy to a passive network observer. That narrower scope still matters on networks where ECH is part of the confidentiality model.

The threat model is specific. The observer must be able to collect handshakes, but the notes do not require an active position on the connection. The reported leak concerns enough identity information to reveal the server hostname. It defeats the privacy property ECH was expected to provide without implying a broader transport compromise.

For operators already on v1.12, this is the security reason to move to v1.12.5. The exposure applies to previous releases in that series. Teams that do not use ECH avoid the named condition, but they still receive the provider state correction in the same build.

The second fix sits in resource state transition handling. When an implicit move coincided with a provider address change, an affected release could call providers.MovedResourceState where it should call providers.UpgradeResourceState. Pull request 4375 restores the intended dispatch.

This is an operator visible correctness fix, not an internal refactor. The failing condition combines two events: OpenTofu must infer a resource move, and the provider address must also change. Ordinary runs without that combination do not match the bug described in the notes.

The notes do not state that this bug caused state loss, plan drift, or a provider crash. They also do not prescribe a repair for state produced by an earlier run. The supported conclusion is more precise: the wrong provider method could be selected during that combined transition. Pipelines that reorganize modules while changing provider addresses should include that path in their upgrade validation.

A routine plan with no resource movement will not exercise the reported condition. A useful regression check needs the same combination named in the fix: an implicit move plus a provider address change. Run that check against disposable or copied state before promoting the binary into an automated production apply path.

OpenTofu v1.12.5 adds no listed CLI flags, configuration keys, or migration steps. It contains two targeted corrections: one for network privacy and one for provider state processing. There is no breaking change called out in the release notes.

That makes the review scope small. Security teams can assess whether ECH is used on relevant connections. Platform teams can concentrate plan and apply checks on configurations with implicit moves and provider address changes. The full comparison from v1.12.4 is available for teams that audit the exact patch before rollout.