megachangelog
Fix1.15.9

Child module validation now raises errors for invalid blocks

Fixed child module validation to properly raise error or warning diagnostics for invalid blocks in list, import, backend, and cloud configurations. Additionally updated go-slug to v0.18.3 to mitigate a Unicode normalization vulnerability (CVE-2026-14978) that could cause files to be incorrectly included in uploads to Terraform Enterprise or HCP Terraform.

1.15.9 (August 19, 2026)

BUG FIXES:

  • validate: Child module validation has been fixed and will now raise errors or warning diagnostics for invalid blocks. (list, import, backend, and cloud) (#38994)

NOTES:

  • Update go-slug to v0.18.3 to mitigate CVE-2026-14978, which is a Unicode normalization issue that could lead to files not being correctly excluded via .terraformignore from upload to a Terraform Enterprise or HCP Terraform during a run (#39036)
validationmodulessecuritybug-fix

Source: original entry ↗