mattrobinsonsre/terrapod v0.40.1

on GitHub

Terrapod is an open-source platform replacement for Terraform Enterprise. A small patch release.

Security

• OPA bundled Go CVEs — bumped OPA to 1.17.1 (built on go1.26.4), clearing the HIGH/CRITICAL Go stdlib CVEs in the embedded opa binary. The remaining golang.org/x/net / golang.org/x/crypto advisories are not reachable in Terrapod's usage (OPA runs only as opa eval/opa check over local plan JSON — no HTTP/2 server, no SSH/TLS transport) and are suppressed with rationale until OPA ships a rebuilt binary.

Bug Fixes

• Module impact analysis now runs on non-VCS consumer workspaces — a module PR's speculative impact plan and a module-publish-triggered run previously fired only on consumer workspaces that were themselves VCS-connected, silently skipping CLI-driven workspaces that consume a registry module via a cloud block. Non-VCS consumers now reuse their latest uploaded configuration version. (#537)

Status

Beta.

Full Changelog: v0.40.0...v0.40.1