Terrapod is a free, open-source, self-hosted platform replacement for Terraform Enterprise. This patch stops two sweeps deleting and cancelling things they should have left alone, clears a HIGH Go advisory, and finishes the MCP server's workspace-update tool.
Security
golang.org/x/text0.39.0 → 0.42.0, clearing CVE-2026-56851 (HIGH). The only Go binary inside a Terrapod image isterrapod-query, and its module still resolved 0.39.0 at v1.10.4, so that is what an image scan reported. Three of the seven Go modules depend on it; the other two were already at 0.42.0, andqueryis the one that reaches an image.
Bug Fixes
- A closed pull request deleted the plan somebody was reading. Both PR-closure sweeps asked for runs
notin(TERMINAL_STATES), andplannedis not terminal — so closing or merging a PR cancelled every run that had already finished planning. That is the speculative plan a reviewer had open, and, when a module's PR merged, the module-impact analysis on every workspace consuming it. A finished plan-only run is now kept; a finished apply-capable one is still cancelled, because it holds the workspace lock and this sweep is the only thing that releases one abandoned by a closed PR. Anything still in flight is still cancelled, and every cancellation now records a reason, so a legitimate one stops being byte-identical to a user's. - Three of seven per-run objects were never deleted, and the sweeps skipped most runs entirely. The cost estimate, the provider lock file and the plan-artifacts tarball had no reaper at all. Worse, both retention sweeps were keyed on the run reaching a terminal state — and a plan-only run never does: it finishes in
plannedand stays there, since nothing supersedes it, plan expiry excludes it, and no run rows are ever deleted. Measured on a real deployment, 18 of one workspace's 40 most recent runs were plan-only drift plans, each holding six objects for the life of the install. The module-override sweep was blind by construction: the only run carrying module overrides is the module-impact run, created plan-only, so that sweep could never match a row.run_artifacts_retention_daysandmodule_overrides_retention_daysgovern exactly as before — only eligibility widened. One consequence worth knowing, since it is a change and not only a saving: a plan-only run's log, plan JSON and tarball are now deleted once the run passesrun_artifacts_retention_days(90 by default), where before they persisted for ever. A three-month-old drift run's log will no longer open. terrapod_workspace_updateoffered 10 of this line's 32 settable workspace attributes, so an AI agent could read the other 22 through the MCP server and change none of them. Eighteen are now wired, derived from this line's own field map rather than copied from a newer one: the AI summary mode and context and the AI policy mode, drift detection with its interval and ignore rules, the security-scan engine, severity threshold and skip rules, the runner CPU and memory sizing, Terragrunt and its version, the VCS workflow and trigger prefixes, variable files, plan expiry, and the Slack channel. The four left out are deliberate and documented in mcp.md.- The log redactor holds back only what could be the start of a secret. Previously it cut at the last newline whenever no registered secret contained one — correct for every secret this line registers, and a property that holds only because nothing has yet registered a multi-line one. Nothing observable changes today; it closes the conditional rather than a live stall.
Status
Stable — a patch release on the 1.10 line. No schema changes, no API route or attribute changes, and no migrations.
Full Changelog: v1.10.4...v1.10.5