mattrobinsonsre/terrapod v1.9.5

on GitHub

Terrapod is a free, open-source, self-hosted platform replacement for Terraform Enterprise. This patch clears a HIGH Go advisory and stops two sweeps deleting and cancelling things they should have left alone.

Security

• golang.org/x/text 0.39.0 → 0.42.0, clearing CVE-2026-56851 (HIGH). The only Go binary inside a Terrapod image is terrapod-query, and its module still resolved 0.39.0 at v1.9.4, so that is what an image scan reported. Three of the seven Go modules depend on it; the other two were already at 0.42.0, and query is the one that reaches an image.

Bug Fixes

• A closed pull request deleted the plan somebody was reading. Both PR-closure sweeps asked for runs notin(TERMINAL_STATES), and planned is not terminal — so closing or merging a PR cancelled every run that had already finished planning. That is the speculative plan a reviewer had open, and, when a module's PR merged, the module-impact analysis on every workspace consuming it. A finished plan-only run is now kept; a finished apply-capable one is still cancelled, because it holds the workspace lock and this sweep is the only thing that releases one abandoned by a closed PR. Anything still in flight is still cancelled, and every cancellation now records a reason.
• Three of the seven per-run objects were never deleted, and the sweeps skipped most runs entirely. The cost estimate, the provider lock file and the plan-artifacts tarball had no reaper at all. Both retention sweeps were keyed on the run reaching a terminal state — and a plan-only run never does: it finishes in planned and stays there, since nothing supersedes it, plan expiry excludes it, and no run rows are ever deleted. So drift-detection plans, speculative pull-request plans and CLI plans were never swept at all, and the module-override sweep was blind by construction, because the only run carrying module overrides is the module-impact run, created plan-only. run_artifacts_retention_days and module_overrides_retention_days govern exactly as before — only eligibility widened. One consequence worth knowing, since it is a change and not only a saving: a plan-only run's log, plan JSON and tarball are now deleted once the run passes run_artifacts_retention_days (90 by default), where before they persisted for ever. A three-month-old drift run's log will no longer open.

Status

Stable — a patch release on the 1.9 line, which per SECURITY.md receives security fixes and obvious bug fixes. No schema changes, no API route or attribute changes, and no migrations.

Two fixes that went to the 1.10 line are deliberately not here. The MCP server's missing workspace-update attributes are a capability gap rather than an obvious defect in behaviour, so they sit outside what this line promises; and the log-redaction change is structurally inapplicable, since the redactor arrived with cloud identity in v1.10.1 and cloud identity does not exist on 1.9.

Full Changelog: v1.9.4...v1.9.5