Update dependency hashicorp/terraform to v1.15.8

[renovate]

This PR contains the following updates:

Package	Update	Change
hashicorp/terraform	minor	1.14.7 → 1.15.8

---

Release Notes

hashicorp/terraform (hashicorp/terraform)

v1.15.8

Compare Source

1.15.8 (July 8, 2026)

BUG FIXES:

• Fix terraform init error when installing providers sourced from a service-discovery alias advertised by the configured backend (such as localterraform.com)

NOTES:

• command/init: Provider installation was changed to enable future enhancements in the area. This effectively reverses the log message changes from v1.15. initializing_provider_plugin_message is being re-introduced to replace the short-lived two message types initializing_provider_plugin_from_config_message & initializing_provider_plugin_from_state_message. The change should not have any significant end-user impact aside from the command output. (#​38838)

• command/init: Provider installation was changed to enable future enhancements in the area. This partially reverses the init event order changes from v1.15; module installation will now occur after the backend is initialized. The change should not have any significant end-user impact aside from the command output. (#​38838)

v1.15.7

Compare Source

1.15.7 (June 24, 2026)

BUG FIXES:

• Add concurrency safety to configs.Parser and SourceBundleParser (#​38745)

• Fix submodule variable validation during init (#​38770)

v1.15.6

Compare Source

1.15.6 (June 10, 2026)

BUG FIXES:

• Fixed an issue where resources being removed from state via removed block were incorrectly listed under planned_values in json representations of the plan file. (#​38665)

• console: Fixed a panic caused by evaluating an expression involving deprecated values (#​38676)

• Fix exit code for plan, query, and refresh commands for variable-related errors (#​38685)

• Fix two module installation edge cases with null and sensitive/ephemeral module sources (#​38704)

v1.15.5

Compare Source

1.15.5 (May 27, 2026)

ENHANCEMENTS:

• Support for module version evaluating to null (in the context of dynamic module sources) (#​38632)

BUG FIXES:

• Fix crash on init for modules with empty source (#​38628)

v1.15.4

Compare Source

1.15.4 (May 20, 2026)

NEW FEATURES:

• We now produce builds for Linux s390x (zLinux) (#​38615)

BUG FIXES:

• init: Prevent provider binaries from being installed into symlinked directories (#​38611)

v1.15.3

Compare Source

1.15.3 (May 13, 2026)

BUG FIXES:

• stacks: Fixed a bug that prevented migrating resources under multiple layers of module nesting with implicit provider configuration. (#​38528)

• cloud backend will now forward -generate-config-out flag usage to query create request (#​38539)

• Fix crash during provider installation when there is no config (#​38560)

v1.15.2

Compare Source

1.15.2 (May 6, 2026)

ENHANCEMENTS:

• stacks: add ouput values to plan component instance change description (#​38360)

BUG FIXES:

• Avoid printing warnings from 'terraform output -json' (#​38530)

v1.15.1

Compare Source

1.15.1 (May 1, 2026)

BUG FIXES:

• Fixed crash when configuration has an invalid action_trigger nested block in data or ephemeral lifecycle blocks (#​38402)

• validate: Removed validation of attributes inside backend blocks due to incompatibility with workflows using the -backend-config flag. (#​38466)

• Fix non-const variable checks on init (#​38470)

• Avoid warnings in 'terraform output -raw' (#​38487)

• Ignore undeclared variable values from the cloud backend (#​38490)

• Fix panic for types modules with no expanded instances (#​38491)

• Fixed "unknown provider function" errors occurring during init (#​38472)

• init: Fixed a bug that impacted use of provider pre-releases during init (#​38496)

v1.15.0

Compare Source

1.15.0 (April 29, 2026)

NEW FEATURES:

• We now produce builds for Windows ARM64 (#​32719)

• You can set a deprecated attribute on variable and output blocks to indicate that they are deprecated. This will produce warnings when passing in a value for a deprecated variable or when referencing a deprecated output. (#​38001)

• backend/s3: Support authentication via aws login (#​37976)

• validate: The validate command now checks the backend block. This ensures the backend type exists, that all required attributes are present, and that the backend's own validation logic passes. (#​38021)

• convert function, which allows for precise inline type conversions (#​38160)

• Terraform now supports variables and locals in module source and version attributes (#​38217)

ENHANCEMENTS:

• config: output blocks now can have an explicit type constraints (#​36411)

• ssh-based provisioner (file + remote-exec): Re-enable support for PowerShell (#​37794)

• terraform init log timestamps include millisecond precision (#​37818)

• init: skip dependencies declared in development override. This allows you to use terraform init with developer overrides and install dependencies that are not declared in the override file. (#​37884)

• Terraform Test: Allow functions within mock blocks (#​34672)

• improve detection of deprecated resource attributes / blocks (#​38077)

• Deprecation messages providers set on resources / blocks / attributes are now part of the deprecation warning (#​38135)

• Include which attribute paths are marked as sensitive in list_start JSON logs (#​38197)

• Add input variable validation for Stacks (#​38240)

• When comparing a container value to null, only top level marks are now considered for the result. (#​38270)

• As part of supporting variables in module sources, most commands now accept variable values (#​38276)

BUG FIXES:

• testing: File-level error diagnostics are now included in JUnit XML skipped test elements, ensuring CI/CD pipelines can detect validation failures (#​37801)

• A refresh-only plan could result in a non-zero exit code with no changes (#​37406)

• cli: Fixed crash in terraform show -json when plan contains ephemeral resources with preconditions or postconditions (#​37834)

• cli: Fixed terraform init -json to properly format all backend configuration messages as JSON instead of plain text (#​37911)

• state show: The state show command will now explicitly fail and return code 1 when it fails to render the named resources state (#​37933)

• apply: Terraform will raise an explicit error if a plan file intended for one workspace is applied against another workspace (#​37954)

• lifecycle: replace_triggered_by now reports an error when given an invalid attribute reference that does not exist in the target resource (#​36740)

• backend: Fix nil pointer dereference crash during terraform init when the destination backend returns an error (#​38027)

• stacks: send progress events if the plan fails for better UI integration (#​38039)

• stacks: component instances should report no-op plan/apply. This solves a UI inconsistency with convergence destroy plans (#​38049)

• backend/http: Return conflicting lock info from HTTP backend instead of the lock that failed to be taken (#​38144)

• states: fixed a bug that caused Terraform to be unable to identify when two states had different output values. This may have caused issues in specific circumstances like backend migrations. (#​38181)

• cloud: terraform cloud and registry discovery network requests are now more resilient, making temporary network or service related errors less common (#​38064)

• Enable formatting of .tfquery.hcl files by terraform fmt (#​38398)

• Fix validate not returning JSON for some early diagnostics (#​38400)

• Fix Terraform Stacks plugin installation error (#​38406)

NOTES:

• command/init: Provider installation was refactored to enable future enhancements in the area. This results in different order of operations during init and 2 new log messages replacing one (initializing_provider_plugin_message). The change should not have any end-user impact aside from the init command output. (#​38227)

UPGRADE NOTES:

• backend/s3: The AWS_USE_FIPS_ENDPOINT and AWS_USE_DUALSTACK_ENDPOINT environment variables now only respect true or false values, aligning with the AWS SDK for Go. This replaces the previous behavior which treated any non-empty value as true. (#​37601)

Previous Releases

For information on prior major and minor releases, refer to their changelogs:

• v1.14
• v1.13
• v1.12
• v1.11
• v1.10
• v1.9
• v1.8
• v1.7
• v1.6
• v1.5
• v1.4
• v1.3
• v1.2
• v1.1
• v1.0
• v0.15
• v0.14
• v0.13
• v0.12
• v0.11 and earlier

v1.14.9

Compare Source

1.14.9 (April 20, 2026)

BUG FIXES:

• Fix Terraform Stacks plugin installation error (#​38406)

v1.14.8

Compare Source

1.14.8 (March 25, 2026)

BUG FIXES:

• Prevent crash in the display of relevant attributes after provider upgrades (#​38264)

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • "after 7am and before 11am every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[hmcts-jenkins-cnp]

Plan Result (stg)

No changes. Your infrastructure matches the configuration.

[hmcts-jenkins-cnp]

Plan Result (prod)

⚠️ Resource Deletion will happen

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 2 to add, 1 to change, 2 to destroy.

• Update
  • module.postgresql_flexible.azurerm_log_analytics_workspace.pgsql_log_analytics_workspace[0]
• Replace
  • module.sdp_db_user[0].azurerm_key_vault_secret.sdp_vault_sdp_read_user_name
  • module.sdp_db_user[0].azurerm_key_vault_secret.sdp_vault_sdp_read_user_password

Change Result (Click me)

  # module.postgresql_flexible.azurerm_log_analytics_workspace.pgsql_log_analytics_workspace[0] will be updated in-place
  ~ resource "azurerm_log_analytics_workspace" "pgsql_log_analytics_workspace" {
        id                                      = "/subscriptions/5ca62022-6aa2-4cee-aaa7-e7536c8d566c/resourceGroups/juror-prod-rg/providers/Microsoft.OperationalInsights/workspaces/juror-api-prod-workspace"
        name                                    = "juror-api-prod-workspace"
      ~ tags                                    = {
          - "application"  = "juror" -> null
          - "builtFrom"    = "https://github.com/HMCTS/juror-shared-infrastructure.git" -> null
          - "businessArea" = "Cross-Cutting" -> null
          - "environment"  = "production" -> null
        }
        # (16 unchanged attributes hidden)
    }

  # module.sdp_db_user[0].data.azurerm_key_vault.sdp_vault will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "azurerm_key_vault" "sdp_vault" {
      + access_policy                   = (known after apply)
      + enable_rbac_authorization       = (known after apply)
      + enabled_for_deployment          = (known after apply)
      + enabled_for_disk_encryption     = (known after apply)
      + enabled_for_template_deployment = (known after apply)
      + id                              = (known after apply)
      + location                        = (known after apply)
      + name                            = "mi-vault-prod"
      + network_acls                    = (known after apply)
      + public_network_access_enabled   = (known after apply)
      + purge_protection_enabled        = (known after apply)
      + rbac_authorization_enabled      = (known after apply)
      + resource_group_name             = "mi-prod-rg"
      + sku_name                        = (known after apply)
      + tags                            = (known after apply)
      + tenant_id                       = (known after apply)
      + vault_uri                       = (known after apply)
    }

  # module.sdp_db_user[0].data.azurerm_subscription.current will be read during apply
  # (depends on a resource or a module with changes pending)
 <= data "azurerm_subscription" "current" {
      + display_name          = (known after apply)
      + id                    = (known after apply)
      + location_placement_id = (known after apply)
      + quota_id              = (known after apply)
      + spending_limit        = (known after apply)
      + state                 = (known after apply)
      + subscription_id       = (known after apply)
      + tags                  = (known after apply)
      + tenant_id             = (known after apply)
    }

  # module.sdp_db_user[0].azurerm_key_vault_secret.sdp_vault_sdp_read_user_name must be replaced
-/+ resource "azurerm_key_vault_secret" "sdp_vault_sdp_read_user_name" {
      ~ id                      = "https://mi-vault-prod.vault.azure.net/secrets/juror-api-flexible-prod-read-user-name/15b1e55df9a4403aaf7d3833e9ee5516" -> (known after apply)
      ~ key_vault_id            = "/subscriptions/5ca62022-6aa2-4cee-aaa7-e7536c8d566c/resourceGroups/mi-prod-rg/providers/Microsoft.KeyVault/vaults/mi-vault-prod" -> (known after apply) # forces replacement
        name                    = "juror-api-flexible-prod-read-user-name"
      ~ resource_id             = "/subscriptions/5ca62022-6aa2-4cee-aaa7-e7536c8d566c/resourceGroups/mi-prod-rg/providers/Microsoft.KeyVault/vaults/mi-vault-prod/secrets/juror-api-flexible-prod-read-user-name/versions/15b1e55df9a4403aaf7d3833e9ee5516" -> (known after apply)
      ~ resource_versionless_id = "/subscriptions/5ca62022-6aa2-4cee-aaa7-e7536c8d566c/resourceGroups/mi-prod-rg/providers/Microsoft.KeyVault/vaults/mi-vault-prod/secrets/juror-api-flexible-prod-read-user-name" -> (known after apply)
      - tags                    = {} -> null
      - value_wo_version        = 0 -> null
      ~ version                 = "15b1e55df9a4403aaf7d3833e9ee5516" -> (known after apply)
      ~ versionless_id          = "https://mi-vault-prod.vault.azure.net/secrets/juror-api-flexible-prod-read-user-name" -> (known after apply)
        # (5 unchanged attributes hidden)
    }

  # module.sdp_db_user[0].azurerm_key_vault_secret.sdp_vault_sdp_read_user_password must be replaced
-/+ resource "azurerm_key_vault_secret" "sdp_vault_sdp_read_user_password" {
      ~ id                      = "https://mi-vault-prod.vault.azure.net/secrets/juror-api-flexible-prod-read-user-password/b38773226c1a474f99ffa3a6b6c9322a" -> (known after apply)
      ~ key_vault_id            = "/subscriptions/5ca62022-6aa2-4cee-aaa7-e7536c8d566c/resourceGroups/mi-prod-rg/providers/Microsoft.KeyVault/vaults/mi-vault-prod" -> (known after apply) # forces replacement
        name                    = "juror-api-flexible-prod-read-user-password"
      ~ resource_id             = "/subscriptions/5ca62022-6aa2-4cee-aaa7-e7536c8d566c/resourceGroups/mi-prod-rg/providers/Microsoft.KeyVault/vaults/mi-vault-prod/secrets/juror-api-flexible-prod-read-user-password/versions/b38773226c1a474f99ffa3a6b6c9322a" -> (known after apply)
      ~ resource_versionless_id = "/subscriptions/5ca62022-6aa2-4cee-aaa7-e7536c8d566c/resourceGroups/mi-prod-rg/providers/Microsoft.KeyVault/vaults/mi-vault-prod/secrets/juror-api-flexible-prod-read-user-password" -> (known after apply)
      - tags                    = {} -> null
      - value_wo_version        = 0 -> null
      ~ version                 = "b38773226c1a474f99ffa3a6b6c9322a" -> (known after apply)
      ~ versionless_id          = "https://mi-vault-prod.vault.azure.net/secrets/juror-api-flexible-prod-read-user-password" -> (known after apply)
        # (5 unchanged attributes hidden)
    }

Plan: 2 to add, 1 to change, 2 to destroy.