OpenTofu 1.13 Lets Module Authors Reduce Unknown Values at Plan Time

OpenTofu released version 1.13 with functions that help module authors resolve more expressions during planning. Type and value hints can unblock plans when

count

or the keys used by

for_each

would otherwise remain unknown. The planner can determine how many resource instances to create without knowing all their eventual attributes, which can remain unknown until apply.

Martin Atkins, an OpenTofu maintainer, proposed the design in an RFC and merged the implementation in August. In an earlier issue, the reporter, csar398, wanted to retain YAML input but could not plan when the decoded value controlled

count

.

yamldecode

can return different types, including a null value, so an unknown input gives the planner neither a known type nor a non-null guarantee. Explaining the limitation, Atkins wrote: "... this is just too complex a situation for OpenTofu to infer automatically itself."

The

convert

function converts values to a specified type, giving a

yamldecode

result a known object type even when the YAML input is unknown. For conditional resources, combining that conversion with

assumenotnull

lets a

count

expression based on nullness resolve to zero or one while the object's contents remain unknown. The author must ensure that the generated YAML always represents an object of the specified type and never a null value. If a value unknown during planning later violates that guarantee, OpenTofu reports an error during apply.

Terraform shipped its equivalent

convert

function first, in version 1.15. Atkins later wrote in an OpenTofu issue that "Terraform has an equivalent feature with syntax exactly like what I proposed here", and the project decided to match its design.

Experimental linting runs four built-in warning rules, including

core:unused-variable

and

core:count-instead-enabled

. The

-lint=all

flag enables them with

tofu validate

,

tofu plan

or

tofu apply

. In their linting proposal, the maintainers describe the feature as their most-voted request; future work covers custom rules and broader policy checks. TFLint already offers plugin-based static analysis, including cloud-provider checks.

The opt-in Symbol Libraries experiment shares functions and type definitions through

*.sym.hcl

files. Libraries cannot directly access resources, data sources or provider functions, although callers can pass resource values into library functions. The team hopes to stabilise the feature in version 1.14.

Version 1.13 removes Windows Remote Management (WinRM) support from the

remote-exec

and

file

provisioners, changes

base64gzip

output bytes, requires macOS 13 Ventura or later, and is the last series with official 32-bit builds. It also adds Windows on ARM64 packages. Existing WinRM configurations need migration, and the Go library change behind

base64gzip

can trigger resource updates despite equivalent decompressed output.

OpenTofu shortened its development cycle to align with Go releases and supports the 1.13.x series until 1 August 2027. The project released version 1.13.2 on 21 October. Its two security changes address excessive CPU use during

tofu init

when connecting to an attacker-controlled HTTP/2 server and filter compromised intermediate certificates. The patch also fixes applying saved plans that use symbol libraries.