Terragrunt v1.1.5 - Shared CAS Probes and Dependency Checks

Terragrunt v1.1.5, published on 14 September 2026, shares one remote source probe across units that resolve the same module. The tag also warns when two dependency blocks use the same config_path, and that warning is an error if duplicate-dependency-labels is enabled.

The full release notes and downloads are on the GitHub release page.

run --all resolved a source once per unit. A hundred units on one module meant a hundred remote checks and a hundred reads of the same commit from the store.

Those units now share one probe, and they share the read into the content addressable store. Git commands over 100 units on one module:

100 units, one shared module                  Before   After
First run: git ls-remote                      100      1
First run: reading the commit into the store  202      4
First run: Git commands in total              304      7
Later run, source on a branch                 100      1
Later run, source on a version tag            100      0

Only the later version tag row needs offline-cas. A local Git server went from about 5 seconds to 0.3 on the first run, and from 1 second to 0.1 later. A real git ls-remote is a network round trip, so a remote saves more.

offline-cas stores each probe answer. A pinned revision keeps it for 24 hours: a semantic version tag, an S3 object version, an OCI manifest digest, an exact registry module version, or a full Mercurial changeset node. A Git branch or an OCI tag is probed on every run, so a push shows up immediately.

--cas-offline never contacts a remote and errors on a miss. --cas-refresh ignores recorded answers for one run. --cas-probe-ttl trusts a changeable source for a duration you set, such as 10m. See recorded probes and the offline-cas experiment.

The first ingest used one git process per file. One long lived git process now reads the clone and stores several files at a time, and only on a cache miss. A hit is unchanged.

Cold ingest benchmarks on an Apple M3 Max moved 200 files from 2.16s to 0.38s, 1,000 files from 10.41s to 0.74s, and 3,000 files from 34.25s to 1.69s. That is about 83 percent, 93 percent, and 95 percent less time.

The CAS no longer writes a lock file beside each object. One lock per cached file and per directory listing meant ~/.cache/terragrunt/cas held about twice as many entries as the content. Existing lock files stay until the store is deleted while no Terragrunt process is running.

Files kept from .git used to ride inside the stored commit, so the first command fixed the set for later ones. stack generate asks for none of them, and a commit it cached first left a later run without those files. Each file is now stored on its own.

A full commit SHA is fetched one commit deep, not every branch and tag. A remote that will not serve a commit by name still gets the full fetch. Micro benchmarks on a local Git server (500 commits, pin 100 behind the tip) dropped objects kept from 543 to 43 and time from 575ms to 482ms. A real remote saves more, because the skipped objects also cross the network.

A filter such as ...vpc finds dependents by walking the tree around the target and parsing each configuration. The walk reparsed files already seen in the same command, and it started again from each dependent.

Parsed configurations are reused, so each unit is read about once per query. Benchmarks on an Apple M3 Max, from the target directory: 10 units from 15.3ms to 10.0ms, 50 from 235ms to 150ms, 200 from 3.19s to 2.09s. From the repository root, a 1,024 unit tree went from 250ms to 131ms.

Two dependency blocks can use different labels and the same config_path. Both parse, the unit is declared twice, and the blocks drift when one sets mock_outputs or skip_outputs and the other does not.

dependency "vpc" {
  config_path = "../vpc"
}

dependency "network" {
  config_path = "../vpc"
}

The new warning sits beside the existing warning for a shared label. With duplicate-dependency-labels enabled, it is an error that names both addresses and the path:

/path/to/terragrunt.hcl: dependencies vpc and network both point at ../vpc; declare that dependency once and reference it under one name

Leave the control off and this stays a warning.

v1.1.5 is a stable tag, not a prerelease. The strict control and offline-cas stay off until you enable them.

  • duplicate-dependency-labels fails on a shared config_path, not only a shared label. Clear the warning before enabling it.
  • --cas-offline, --cas-refresh, and --cas-probe-ttl require offline-cas. A pinned revision is trusted for 24 hours. --cas-offline errors on a cold cache.
  • Delete ~/.cache/terragrunt/cas only while no Terragrunt process is running if you want the old lock files gone.
  • A SHA pin still fetches full history when the remote will not serve a commit by name.
  • A commit first cached by stack generate no longer omits .git files a later command expects.