Terragrunt 1.2.1

What's new in 1.2.1

⚙️ Process Updates
Go bumped to v1.27.3 for a security fix
The version of Golang used to compile the Terragrunt binary has been updated from v1.27.2 to v1.27.3.
Go v1.27.3 is a security release. It fixes CVE-2026-111943 in crypto/x509: certificate verification now rejects chains that contain a small set of untrusted intermediate certificates. Terragrunt uses this verification for every HTTPS connection it makes, including source downloads, provider registry lookups, and remote state backends. We recommend upgrading.
Terragrunt runs git, hg, and smbclient source downloads itself
Terragrunt downloaded git::, hg::, and smb:// sources through the getters built into the go-getter library, which started git, hg, and smbclient on their own. Terragrunt now implements these getters itself and starts those programs the same way it runs every other command.
Downloads should behave as they did before. If you find any functional difference, open an issue.
Because the downloads now go through Terragrunt's own command handling, Terragrunt's tests can cover them without a real git, hg, or smbclient install or a remote server, which makes regressions in source downloads easier to catch.
🏎️ Performance Improvements
Faster parsing of shared configuration
Repositories where every unit includes a root.hcl that loads shared files with read_terragrunt_config now parse much faster.
- Each unit used to parse those shared files itself, so a common.hcl that runs yamldecode(file(...)) on a large YAML file decoded it once per unit. Terragrunt now parses each file once and gives every unit the same result, and parses it again only when the file, or a file it reads, changes during the command. run --all parses it a second time when the run starts, after discovering units. A file whose result can differ between units, like one that calls get_original_terragrunt_dir() or has dependency blocks, is still parsed per unit.
- Since v1.1.2, discovery parsed every included configuration twice, once for its feature flag defaults and once to merge it. It parses each include once again, and skips includes with merge_strategy = "no_merge" that it would only have thrown away.
- Locals and inputs went through a JSON encoding round trip on their way into Terragrunt. Terragrunt now converts them directly.
In benchmarks on an Apple M3 Max, discovering units and their dependencies in a generated repository whose units read a 48 KB YAML file through read_terragrunt_config:
─────┬──────┬───── …

Full release notes »