Terraform v1.16.5 - Tainted State Crash and Resource Identity Fix

Terraform v1.16.5 is a small patch release published on October 2, 2026. It fixes two crashes in the core state handling path: a panic when a tainted instance shows up without a valid status, and a nil resource-identity during delete. There are no new features and no deprecations in this tag.

The full release notes and downloads are on the GitHub release page.

The first fix targets a crash in state handling. Terraform tracks tainted instances with a status field, and if an instance appeared in state without a valid status value, the core panicked during plan or apply. The fix accepts the degraded state and handles the instance normally instead of aborting the run.

This is the kind of state that gets written when a run was interrupted partway or when state was assembled from a less than clean source. You tend to meet it while recovering a stuck pipeline, not during a normal day two apply. If you run Terraform in a CI pipeline with retry and timeout logic, a crash on degraded state can turn a simple recovery into a lock cleanup session. This patch removes one failure mode from that path. The change is tracked in #39287.

Operators can take two things from this. First, a crash during state read is not a hint that state is corrupt; after upgrading, a plan against the same state should tell you more. Second, an interrupted apply can leave statuses that older patch versions choke on, so it is worth upgrading the Terraform binary used by your pipeline runner, not just your workstation.

The second fix is in resource identity handling. Terraform now writes a resource identity alongside the instance address for remote objects, which lets it find resources when the configuration changes. The bug: during delete, the identity could be nil, and the delete path dereferenced it anyway. The result was a crash instead of a clean destroy. The fix is in #39285.

Delete paths matter more than people assume. A crash during destroy can leave state half applied with objects already gone from the provider. You then need refresh and import work to reconcile the difference. Removing a nil identity path from destroy is a small change that avoids an awkward reconciliation session.

Both fixes share a theme: state that a normal run should never have produced, but that real clusters and interrupted runs do produce. Defensive parsing of state is a good trade for a tool that people rely on during incidents.

To be plain about scope: this tag contains exactly the two bug fixes above. There are no backend changes, no provider protocol changes, and no CLI flags added or removed. The release notes list nothing else. If you were hoping for features scheduled for this patch, they are not in it; feature work lands on minor releases, not on this one.

No breaking changes in the notes, and no config changes are needed. The patch is a drop in binary swap. The one operational note: the tainted state crash means some workflows previously could not complete against affected state, so any playbooks or runbooks you wrote to work around the panic, for example manual state edits to attach a status, can be revisited after the upgrade. Prefer planning against the unchanged state after upgrading before touching it.