## 1.17.0-alpha20260729 (July 29, 2026) ENHANCEMENTS: * command/init: Enrich log messages with provider versions ([#38918](https://github.com/hashicorp/terraform/issues/38918)) BUG FIXES: * funcs: pow and log no longer panic when result is not a number ([#38912](https://github.com/hashicorp/terraform/issues/38912)) EXPERIMENTS: Experiments are only enabled in alpha releases of Terraform CLI. The following features are not yet available in stable releases.
## 1.16.0-beta1 (July 23, 2026) NEW FEATURES: * Terraform now stores planned private data for providers, allowing provider-specific state to be preserved across plan and apply. ([#37986](https://github.com/hashicorp/terraform/issues/37986)) * `terraform_data`: The new `store` block can hold ephemeral and sensitive values across plan and apply.
## 1.15.8 (July 8, 2026) BUG FIXES: * Fix `terraform init` error when installing providers sourced from a service-discovery alias advertised by the configured backend (such as `localterraform.com`) NOTES: * command/init: Provider installation was changed to enable future enhancements in the area. This effectively reverses the log message changes from v1.15.
## 1.15.7 (June 24, 2026) BUG FIXES: * Add concurrency safety to configs.Parser and SourceBundleParser ([#38745](https://github.com/hashicorp/terraform/issues/38745)) * Fix submodule variable validation during init ([#38770](https://github.com/hashicorp/terraform/issues/38770))
Terraform version 1.0.8 through 1.5.6 allows arbitrary file write during the `init` operation if run on maliciously crafted Terraform configuration. This vulnerability is fixed in Terraform 1.5.7.
When using the Azure backend with a shared access signature (SAS), Terraform versions prior to 0.12.17 may transmit the token and state snapshot using cleartext HTTP. ### Specific Go Packages Affected github.com/hashicorp/terraform/backend/remote-state/azure