denis256 notes and projects

Terragrunt v1.0.6 shipped on May 25, 2026. It is mostly a bug fix wave plus two new experiments and a TUI update for the catalog redesign. The download_dir hang on a non hidden subdirectory and the race in parallel stack parsing are the headline fixes.

The full release notes and downloads are on the GitHub release page.

Bug fixes that matter

Several of these are the kind of issues that quietly broke CI runs and were hard to attribute back to Terragrunt.

The download_dir hang. Setting download_dir (via the attribute, --download-dir, or TG_DOWNLOAD_DIR) to a subdirectory of the unit working directory whose name did not start with a dot caused apply, plan, and run to hang. Terragrunt would copy the source into the new directory, then see it on the next read of the unit and recurse into it. The default .terragrunt-cache was fine because the source copy step skips any directory whose name starts with a dot. These configurations now produce an immediate error that names the source and destination paths.

Stack output races. Running terragrunt stack output against a stack with several units could crash intermittently while units were parsed in parallel. The internal bookkeeping that tracks files read for the reading filter attribute was not thread safe. Parallel unit parsing now coordinates safely.

terraform_binary ignored when both tools were on PATH. A caching regression caused Terragrunt to over cache the result of tofu --version when both tofu and terraform were available and terraform_binary was set. The version recorded against the early default binary check then leaked into the later check against terraform_version_constraint. The per run cache is now scoped to the binary that produced each entry.

Spurious dependency errors. terragrunt plan and apply no longer print ERROR Error: Unknown variable "dependency" lines when a unit pulls in a shared include via find_in_parent_folders that references dependency.* outputs. The plans completed correctly, but CI logs filled with noise. Resolves #6036.

terragrunt render panic fixes

Two panics in the render pipeline are gone.

The exclude block setting no_run, or the catalog block setting default_template, no_shell, or no_hooks, previously produced a value has no attribute of that name panic before any output. These attributes now flow through render alongside the other fields on their respective blocks, so both blocks round trip cleanly.

Multiple errors.ignore blocks with a populated signals map on one block and absent or differently typed on another crashed with an inconsistent list element types panic. The same crash also showed up in dependency output evaluation because both paths build the same rendered representation. Each ignore block now renders with a uniform shape, so indexed access (errors.ignore[0]), length, and iteration all stay consistent, and the signals map is preserved as written.

The mark-many-as-read experiment also stopped missing local module files during discovery. A unit whose terraform { source = ... } pointed at a local module did not show up under --filter 'reading=' filters that referenced files inside that module. The module walk now runs on the discovery code path as well, so edits in a local module flow through to dependent units.

Two new experiments

The deep-merge experiment adds a deep_merge(map1, map2, ...) HCL function. Maps and objects merge recursively, later arguments win on overlapping keys, lists are appended, and null arguments are ignored. Useful when composing inputs from multiple decoded JSON, YAML, or HCL files. Calling deep_merge without enabling the experiment returns an error.

locals {
  config_json_files = sort(fileset(get_terragrunt_dir(), "*.json"))
  config = deep_merge([
    for file in local.config_json_files :
    jsondecode(file("${get_terragrunt_dir()}/${file}"))
  ]...)
}

inputs = local.config

The opt-out-auth experiment introduces --no-discovery-auth-provider-cmd (env TG_NO_DISCOVERY_AUTH_PROVIDER_CMD) to skip the auth provider command during discovery. On large repositories with run --all --filter='reading=', the auth command runs for every discovered unit even if only a small subset will actually execute, which dominates wall clock time. The auth provider command still runs normally when units run.

Caveat: units whose discovery relevant blocks depend on credentials produced by --auth-provider-cmd will fail to parse with the flag set. Use it only when parsing resolves without prior authentication.

Example invocation:

terragrunt run --all \
  --experiment=opt-out-auth \
  --no-discovery-auth-provider-cmd \
  --queue-include-units-reading=./changed-file.txt \
  plan

Catalog redesign TUI scaffold form

The catalog-redesign experiment got an interactive scaffold form. Pressing s from the catalog list or detail view opens a modal that prompts for every variable the selected component exposes. Navigate with j, k, or arrow keys, enter interacts with the focused field, esc returns to navigate mode. Required entries are flagged, optional entries show their default until the user opts in, and only fields the user actually changes are written to the generated file.

Upgrade notes

No breaking changes are called out. New flags are gated behind their experiments (deep-merge, opt-out-auth), so existing pipelines pick up the bug fixes without HCL or CLI changes. If you relied on the previous render output to suppress certain block attributes, expect them to appear now.

Where to get it

• Release page: https://github.com/gruntwork-io/terragrunt/releases/tag/v1.0.6
• Repo: https://github.com/gruntwork-io/terragrunt
• Tag: v1.0.6