OpenTofu v1.13.1 Fixes Ephemeral Resources in Plan JSON and Apply

OpenTofu v1.13.1 was published on October 1, 2026 as a patch release with two bug fixes, both about ephemeral resources. The more visible one restores tofu show -json for saved plan files when the configuration contains ephemeral resources. This is a stable release, not a prerelease.

The full release notes and downloads are on the GitHub release page.

  • tofu show -json <planfile> works again when ephemeral resources are in the configuration.
  • Ephemeral output values are always evaluated again during apply.
  • No breaking changes are listed. There are no new features.

The release notes contain exactly two entries. Both sit under the BUG FIXES heading. That keeps the review short, but the two fixes touch parts of a pipeline that many teams build around.

Many teams do not run tofu apply straight from a terminal. They run tofu plan -out=<file>, then convert that plan with tofu show -json <planfile> and feed the JSON to something else. That something is often a policy check, a cost estimator, a drift report, or a change review bot that comments on a pull request.

The release notes say that this command “now works again” when ephemeral resources are present in the configuration. The wording tells us it was a regression. Before v1.13.1, a configuration with an ephemeral resource could make the JSON rendering step fail. The notes do not describe the exact error, and this post will not guess at it.

The symptom is easy to place anyway. A plan job succeeds, and the step that renders the plan as JSON fails. The blast radius is every pipeline that parses plan JSON for configurations using ephemeral resources. Pipelines that apply the plan file directly without rendering it would not have noticed.

The fix is tracked in pull request 4623. The notes link to it without further detail.

If you hold your pipeline on an older tag because of this, v1.13.1 is the reason to move. If you worked around the failure by skipping the JSON step for affected configurations, you can put the step back and check that it passes.

The second fix concerns ephemeral output values. The notes say they are now “always re-evaluated during the apply phase, instead of sometimes using stale values from the planning phase.”

Ephemeral values exist so that secrets and short lived data stay out of state and out of plan files. A value that comes from a token, a credential, or a lease is only valid for a limited time. Plan and apply can be minutes or hours apart, particularly when a human approval gate sits between them. An ephemeral output that carried its plan time value into apply could hand a consumer a value that is already expired or revoked.

The word “sometimes” in the notes matters here. The bug was not constant. A stale value was used in some cases only, which is the harder kind to debug. A job that works on most runs and fails on a few with an authentication error is the sort of thing that costs an on call engineer an hour.

After the fix, the apply phase evaluates these outputs again. The tradeoff is simple. Apply now does the work of producing the value when it runs. That is what you want for credentials, but it means the source of the value must be reachable at apply time, not only at plan time. If your apply runner has narrower network access or different identity than your plan runner, check it.

The issue behind this change is issue 4582, which the notes cite.

The notes do not mention new flags, config keys, provider protocol changes, or state format changes. They do not list dependency updates or security fixes. Do not read more into a patch release than it says.

The notes list no breaking changes and no migration steps. A reasonable rollout looks like this:

  1. Pin the new tag in your CI image or your tool version manager.
  2. Run a plan on one configuration that uses ephemeral resources.
  3. Run tofu show -json on the saved plan file and confirm it exits cleanly.
  4. Apply that plan and confirm that ephemeral outputs consumed downstream carry fresh values.

Steps 3 and 4 map directly to the two fixes. If you have no ephemeral resources in your configurations, neither fix changes your behavior, and the upgrade is optional.