✨ New Features

The --filter flag now implies --all

When using the --filter flag, it is now optional to also supply --all. Terragrunt will automatically set the --all flag when you use the --filter flag.

🐛 Bug Fixes

Plan files are now correctly passed as CLI arguments for destroy operations

A bug in the logic used for injecting plan files as arguments to the apply -destroy command resulted in the plan file argument being injected prior to the -auto-approve flag, which is disallowed in OpenTofu/Terraform. That bug has been fixed.

GCS bootstrap authentication fixed

A bug in the authentication logic for GCS backends prevented successful bootstrapping of backends when using the --auth-provider-cmd flag. That bug has been fixed.

Git-based and Graph-based combinations fixed

A bug in the discovery logic for Git worktrees prevented using a combination of Git-based and Graph-based filter expressions in the same filter from working correctly.

e.g.

 terragrunt find --filter '...^[HEAD^...HEAD]...'

That bug has been fixed.

Proper exit codes returned from -detailed-exitcode

A bug in the logic for handling retries combined with the OpenTofu/Terraform plan -detailed-exitcode and the Terragrunt --all flag resulted in the wrong exit code being returned when a failed run succeeded on a subsequent retry with a status code related to drift (exit code 2).

That logic has been corrected, and properly follows the rules outlined under the --all flag:

When not using -detailed-exitcode:

• Terragrunt will return the highest exit code of all runs performed.

When using -detailed-exitcode:

• If any run has an exit code that is 1, or greater than 2, run --all will return the highest exit code.
• Otherwise, if any run returns an exit code of 2, run --all will return an exit code of 2.
• Otherwise, run --all will return an exit code of 0.

OpenTelemetry traces in console mode fixed

A bug in OpenTelemetry trace exporting prevented traces from being exported when in console mode. That bug has been fixed.

Negation logic fixed

A bug in how negation logic was handled in filter expressions prevented successful exclusion of stacks from generation and over excluded units in runs when users only supplied negative filters.

⚙️ Process Improvements

GPG Signing

Release artifacts are now signed using both GPG and Cosign.

To start performing signature validation on assets, in addition to the asset you’re downloading from the GitHub releases page, you’ll want to download some of the following files:

VERSION="v0.XX.X"  # Replace with actual version of Terragrunt you are installing
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS"

# For GPG:
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS.gpgsig"

# For Cosign:
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS.sig"
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS.pem"

To verify with GPG:

curl -s https://gruntwork.io/.well-known/pgp-key.txt | gpg --import

gpg --verify SHA256SUMS.gpgsig SHA256SUMS

sha256sum -c SHA256SUMS --ignore-missing

To verify with Cosign:

cosign verify-blob SHA256SUMS \
  --signature SHA256SUMS.sig \
  --certificate SHA256SUMS.pem \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "github.com/gruntwork-io/terragrunt"

sha256sum -c SHA256SUMS --ignore-missing

Terragrunt installation documentation will be updated soon to recommend this on every installation, the Gruntwork maintained asdf plugin will be updated to do this automatically, and all Gruntwork recommended mechanisms for installing Terragrunt will support this going forward.

Upgrade to Go 1.25.5

The Golang toolchain used to build Terragrunt has been upgraded to v1.25.5.

Package reorganization

All top-level Golang packages in the Terragrunt project have been migrated to either internal or pkg. The distinction between the two indicates maintainer expectations as to whether either are being actively being consumed as libraries by third parties (with internal being impossible to import without vendoring in go modules).

Note that this does not indicate any backwards compatibility guarantee for usage of the Terragrunt as a library. It will remain unstable, and can change at any time.

What's Changed

• feat: Automatically enable -all when using -filter by @yhakbar in #5265
• fix: Fixed passing of existing destroy plan files by @denis256 in #5327
• fix: Fixing auth in GCS bootstrap by @yhakbar in #5342
• fix: Fixing Git-expression + Graph-expression filter combinations by @yhakbar in #5355
• fix: Fixing detailed-exitcode by @yhakbar in #5362
• fix: traces output in console mode by @denis256 in #5329
• fix: Cleanup from #5342 by @yhakbar in #5356
• fix: Fixing negation logic by @yhakbar in #5368
• docs: Adding ambassadors by @karlcarstensen in #5330
• docs: Typo by @karlcarstensen in #5331
• docs: Fix link to Dallas Slaughter by @karlcarstensen in #5370
• chore: Dropping more utils by @yhakbar in #5300
• chore: Lint everything when linting by @yhakbar in #5344
• chore: Remove RunTarget from options by @yhakbar in #5264
• chore: Undo -all and -graph wrap by @yhakbar in #5257
• chore: move engine to internal package by @denis256 in #5340
• chore: scripts directories cleanup by @denis256 in #5343
• chore: Addressing #5355 feedback by @yhakbar in #5363
• chore: release files signing by @denis256 in #5291
• chore: pkg packages organisation by @denis256 in #5358
• chore: internal packages update by @denis256 in #5360
• chore: moved cli package to internal/cli by @denis256 in #5345
• chore: go 1.25.5 version update by @denis256 in #5339
• build(deps): bump @smithy/config-resolver from 4.1.4 to 4.4.5 in /docs-starlight/src/fixtures/terralith-to-terragrunt/app/best-cat by @dependabot[bot] in #5328

Full Changelog: v0.98.0-rc2026011501...v0.98.0-rc2026011601

✨ New Features

The --filter flag now implies --all

When using the --filter flag, it is now optional to also supply --all. Terragrunt will automatically set the --all flag when you use the --filter flag.

🐛 Bug Fixes

Plan files are now correctly passed as CLI arguments for destroy operations

A bug in the logic used for injecting plan files as arguments to the apply -destroy command resulted in the plan file argument being injected prior to the -auto-approve flag, which is disallowed in OpenTofu/Terraform. That bug has been fixed.

GCS bootstrap authentication fixed

A bug in the authentication logic for GCS backends prevented successful bootstrapping of backends when using the --auth-provider-cmd flag. That bug has been fixed.

Git-based and Graph-based combinations fixed

A bug in the discovery logic for Git worktrees prevented using a combination of Git-based and Graph-based filter expressions in the same filter from working correctly.

e.g.

 terragrunt find --filter '...^[HEAD^...HEAD]...'

That bug has been fixed.

Proper exit codes returned from -detailed-exitcode

A bug in the logic for handling retries combined with the OpenTofu/Terraform plan -detailed-exitcode and the Terragrunt --all flag resulted in the wrong exit code being returned when a failed run succeeded on a subsequent retry with a status code related to drift (exit code 2).

That logic has been corrected, and properly follows the rules outlined under the --all flag:

When not using -detailed-exitcode:

• Terragrunt will return the highest exit code of all runs performed.

When using -detailed-exitcode:

• If any run has an exit code that is 1, or greater than 2, run --all will return the highest exit code.
• Otherwise, if any run returns an exit code of 2, run --all will return an exit code of 2.
• Otherwise, run --all will return an exit code of 0.

⚙️ Process Improvements

GPG Signing

Release artifacts are now signed using both GPG and Cosign.

To start performing signature validation on assets, in addition to the asset you’re downloading from the GitHub releases page, you’ll want to download some of the following files:

VERSION="v0.XX.X"  # Replace with actual version of Terragrunt you are installing
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS"

# For GPG:
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS.gpgsig"

# For Cosign:
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS.sig"
curl -LO "https://github.com/gruntwork-io/terragrunt/releases/download/${VERSION}/SHA256SUMS.pem"

To verify with GPG:

curl -s https://gruntwork.io/.well-known/pgp-key.txt | gpg --import

gpg --verify SHA256SUMS.gpgsig SHA256SUMS

sha256sum -c SHA256SUMS --ignore-missing

To verify with Cosign:

cosign verify-blob SHA256SUMS \
  --signature SHA256SUMS.sig \
  --certificate SHA256SUMS.pem \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp "github.com/gruntwork-io/terragrunt"

sha256sum -c SHA256SUMS --ignore-missing

Terragrunt installation documentation will be updated soon to recommend this on every installation, the Gruntwork maintained asdf plugin will be updated to do this automatically, and all Gruntwork recommended mechanisms for installing Terragrunt will support this going forward.

Upgrade to Go 1.25.5

The Golang toolchain used to build Terragrunt has been upgraded to v1.25.5.

Package reorganization

All top-level Golang packages in the Terragrunt project have been migrated to either internal or pkg. The distinction between the two indicates maintainer expectations as to whether either are being actively being consumed as libraries by third parties (with internal being impossible to import without vendoring in go modules).

Note that this does not indicate any backwards compatibility guarantee for usage of the Terragrunt as a library. It will remain unstable, and can change at any time.

What's Changed

• feat: Automatically enable -all when using -filter by @yhakbar in #5265
• fix: Fixed passing of existing destroy plan files by @denis256 in #5327
• fix: Fixing auth in GCS bootstrap by @yhakbar in #5342
• fix: Fixing Git-expression + Graph-expression filter combinations by @yhakbar in #5355
• fix: Fixing detailed-exitcode by @yhakbar in #5362
• docs: Adding ambassadors by @karlcarstensen in #5330
• docs: Typo by @karlcarstensen in #5331
• chore: Dropping more utils by @yhakbar in #5300
• chore: Lint everything when linting by @yhakbar in #5344
• chore: Remove RunTarget from options by @yhakbar in #5264
• chore: Undo -all and -graph wrap by @yhakbar in #5257
• chore: move engine to internal package by @denis256 in #5340
• chore: scripts directories cleanup by @denis256 in #5343
• chore: Addressing #5355 feedback by @yhakbar in #5363
• chore: release files signing by @denis256 in #5291
• chore: pkg packages organisation by @denis256 in #5358
• chore: internal packages update by @denis256 in #5360
• chore: moved cli package to internal/cli by @denis256 in #5345
• chore: go 1.25.5 version update by @denis256 in #5339
• build(deps): bump @smithy/config-resolver from 4.1.4 to 4.4.5 in /docs-starlight/src/fixtures/terralith-to-terragrunt/app/best-cat by @dependabot[bot] in #5328

Full Changelog: v0.97.2...v0.98.0-rc2026011501

Full Changelog: alpha-2026011201...alpha-2026011301

What's Changed

• build(deps): bump @smithy/config-resolver from 4.1.4 to 4.4.5 in /docs-starlight/src/fixtures/terralith-to-terragrunt/app/best-cat by @dependabot[bot] in #5328
• Adding ambassadors by @karlcarstensen in #5330
• Typo by @karlcarstensen in #5331
• bug: Fixed passing of existing destroy plan files by @denis256 in #5327

Full Changelog: v0.97.2...alpha-2026011202

What's Changed

• build(deps): bump @smithy/config-resolver from 4.1.4 to 4.4.5 in /docs-starlight/src/fixtures/terralith-to-terragrunt/app/best-cat by @dependabot[bot] in #5328
• Adding ambassadors by @karlcarstensen in #5330
• Typo by @karlcarstensen in #5331
• bug: Fixed passing of existing destroy plan files by @denis256 in #5327

Full Changelog: v0.97.2...alpha-2026011201

🏎️ Performance Improvements

Partial parse used for get_working_dir()

To assess where Terragrunt is going to run OpenTofu, it needs partially parsed information from the relevant terragrunt.hcl file of the unit running the HCL get_working_dir() function. The function was performing a full parse of the terragrunt.hcl file, which can be slow for users with large HCL configurations.

Given that the parse only requires access to the value of source in the terraform block, a partial parse is now performed by the function, only looking at the contents of the terraform block, improving performance significantly.

🐛 Bug Fixes

False positive parsing errors suppressed

When parsing an include that defined dependencies, the HCL parser used by Terragrunt would emit spurious errors that are internally ignored. Those messages are now suppressed.

Signal propagation for interrupts fixed

A bug in how Terragrunt forwarded signals to processes it spawned (like running tofu) resulted in underlying processes receiving SIGKILL signals rather than the original signal (e.g. SIGINT) sent to the Terragrunt process. That has been fixed.

🧹 Chores

Avoiding contextcheck suppression

While not changing much functionally in Terragrunt, this release did involve quite a lot of changes to Terragrunt internals. The majority of these changes related to better propagation of the Golang [context](https://pkg.go.dev/context) object to better obey Golang best practices. These issues were reported by the contextcheck linter in the codebase, but the findings were suppressed due to the scope of work required to address them.

These changes should make it so that context is propagated correctly more reliably in the codebase, increasing the usefulness of things like OpenTelemetry tracing and reduced resource usage.

Note that some public function signatures have changed in the Terragrunt codebase, which may be a breaking change to users consuming Terragrunt as a library. Given that we do not offer any stability guarantees for usage of Terragrunt as a library, these changes are still to be included in a patch release.

What's Changed

• perf: Using a partial parse for get_working_dir() by @yhakbar in #5318
• fix: false positive parsing errors by @denis256 in #5258
• fix: Fixing signal propagation issues by @yhakbar in #5326
• fix: Locking during run ensure calls by @yhakbar in #5312
• chore: Avoiding contextcheck suppression by @yhakbar in #5320
• chore: Fixing flaky tests by @yhakbar in #5316
• chore: Adding flake utility by @yhakbar in #5311
• chore: Cleaning up HCL fn spans by @yhakbar in #5315
• build(deps): bump github.com/cloudflare/circl from 1.3.3 to 1.6.1 in /test/flake by @dependabot[bot] in #5324
• build(deps): bump golang.org/x/oauth2 from 0.25.0 to 0.27.0 in /test/flake by @dependabot[bot] in #5323
• build(deps): bump golang.org/x/crypto from 0.7.0 to 0.45.0 in /test/flake by @dependabot[bot] in #5322

Full Changelog: v0.97.1...v0.97.2

✨ New Features

All HCL functions instrumented with OpenTelemetry

All Terragrunt HCL functions now emit OpenTelemetry spans when they run, making it easier to understand HCL function usage and performance.

HCL parsing telemetry improved

Additional fidelity has been added to traces emitted during parsing to give insight as to why configuration parsing is being performed, and how.

🐛 Bug Fixes

plan -destroy called correctly for --filter-affected

A bug in the logic for --filter-affected resulted in removed units getting planned/applied instead of being destroyed when users supplied --filter-allow-destroy. That bug has been fixed.

Nested spans in track parents appropriately even when the TRACEPARENT environment variable is used.

A bug in the logic for propagating TRACEPARENT as the ultimate parent of traces started in Terragrunt prevented child traces from properly tracking parent spans. That bug has been fixed.

Reports on runs in worktrees now use relative directories to worktree root

Instead of displaying runs of units in Git worktrees during Git-based filter expression runs with the absolute path of their directories in a temporary directory, they now display with the path to the unit relative to the root of the worktree.

Unnecessary relationship discovery prevented

Discovery of relationships between units has been made opt-in in the discovery process. This will result in no changes to usage of commands like run --all, but will significantly improve the performance of commands like list and stack generate.

What's Changed

• feat: Adding spans for HCL functions by @yhakbar in #5306
• feat: Increasing volume and fidelity of config parse telemetry by @yhakbar in #5309
• fix: Fixing nested spans by @yhakbar in #5305
• fix: Fixing plan -destroy for --filter-affected by @yhakbar in #5295
• fix: Fixing worktree reports by @yhakbar in #5308
• fix: Avoiding unnecessary relationship discovery by @yhakbar in #5313
• chore: Dropping usage of MapToSlice and StringListInsert by @yhakbar in #5297
• docs: Adding ambassadors by @karlcarstensen in #5296
• docs: Ambassador Lorelei by @karlcarstensen in #5302

Full Changelog: v0.97.0...v0.97.1

⚒️ Breaking Changes

The --queue-strict-include flag is deprecated

Terragrunt no longer automatically includes dependencies of included units. As such the --queue-strict-include flag is no longer useful in the Terragrunt CLI.

The flag has been deprecated, and no longer does anything. This flag will not be removed before 2.0.

Run report no longer reports --queue-exclude-dir as a reason for exclusion

Run reports no longer report on units excluded from runs as a consequence of the --queue-exclude-dir flag.

The --units-that-include flag is deprecated

The --units-that-include flag is now an alias for the reading= attribute filter, just like the --queue-include-units-reading flag.

Given that the two flags no longer differ in functionality, and that the functionality of the --units-that-include is no longer strictly including units that are included, the flag has been deprecated.

The double-star strict control is complete

The globbing behavior of Terragrunt in CLI flags has been updated to match all paths when ending with a trailing ** .

🧪 Experiments Completed

The filter-flag experiment is completed

The filter-flag experiment is completed, and the --filter flag is now generally available.

You can use filter expressions as a single unified API for controlling the Run Queue, replacing the need to use the following CLI flags:

• Note that the file used for the --queue-excludes-file does not directly translate to the kind of file you can use for a --filters-file. To learn more, see the documentation.

The table above also explains the aliasing that has been done internally to replace queue flags with their filter equivalents. The aliasing for these queue flags is present purely for backwards compatibility purposes, but they are not going to emit deprecation warnings, and will not be removed before the Terragrunt 1.0 release.

You are heavily encouraged to adopt the new --filter flag for your infrastructure targeting needs as soon as feasible in your workflows. It will offer a significantly more flexible and powerful experience.

To learn more see the Filters feature documentation.

🐛 Bug Fixes

The get_original_terragrunt_dir() function is now supported in terragrunt.stack.hcl files

When authoring explicit stacks, using the get_original_terragrunt_dir() HCL function in terragrunt.stack.hcl files will now return the directory where the terragrunt.stack.hcl file lives, even when the configuration is read from another stack/unit using read_terragrunt_config().

Using Git-based expressions with the --out-dir flag is fixed

When using Git-based expressions using the --filter flag, the relative path of units relative to their respective Git worktree roots is used for determining where the plan file will be saved, rather than a path in the relevant Git worktree.

Color for output fetching is suppressed more reliably

Terragrunt will use tofu output -json / terraform output -json more reliably when users expect a lack of colors (like when colors are suppressed for Terragrunt).

What's Changed

• fix: Using testing/synctest to make TestWriteUnitLevelSummary more reliable by @yhakbar in #5253
• fix: Fixing report run duplication error by @yhakbar in #5252
• fix: improved log error messages by @denis256 in #5256
• fix: get_original_terragrunt_dir during stack generate by @philipmckenna-symphony in #5176
• fix: saving of plan in git based filtering by @denis256 in #5288
• fix: add no color for dependency fetching by @denis256 in #5285
• fix: added git worktree cleanup on errors by @denis256 in #5254
• docs: Adding ambassador by @karlcarstensen in #5261
• docs: Adding ambassador by @karlcarstensen in #5259
• docs: Adding announcement banner by @karlcarstensen in #5260
• docs: Documenting backport of queue flags into filter flags by @yhakbar in #5263
• docs: Adding ambassador by @karlcarstensen in #5266
• chore: Cleaning up test symlinks resolution by @yhakbar in #5251
• chore: Dropping ListContains and ListEquals and using standard library instead by @yhakbar in #5221
• chore: Adding debug log for assume already applied by @yhakbar in #5198
• chore: Removing latest Terraform OSS workflows by @yhakbar in #5262
• chore: Backporting queue flags into filter flags by @yhakbar in #5241
• chore: on demand no proxy build execution by @denis256 in #5277
• chore: opentelemetry and aws dependencies update by @denis256 in #5279

New Contributors

• @philipmckenna-symphony made their first contribution in #5176

Full Changelog: https://github.com/gruntwork-io/terragrunt/compare/v0.96.1..v.0.97.0

⚒️ Breaking Changes

The --queue-strict-include flag is deprecated

Terragrunt no longer automatically includes dependencies of included units. As such the --queue-strict-include flag is no longer useful in the Terragrunt CLI.

The flag has been deprecated, and no longer does anything. This flag will not be removed before 2.0.

Run report no longer reports --queue-exclude-dir as a reason for exclusion

Run reports no longer report on units excluded from runs as a consequence of the --queue-exclude-dir flag.

The --units-that-include flag is deprecated

The --units-that-include flag is now an alias for the reading= attribute filter, just like the --queue-include-units-reading flag.

Given that the two flags no longer differ in functionality, and that the functionality of the --units-that-include is no longer strictly including units that are included, the flag has been deprecated.

The double-star strict control is complete

The globbing behavior of Terragrunt in CLI flags has been updated to match all paths when ending with a trailing ** .

🧪 Experiments Completed

The filter-flag experiment is completed

The filter-flag experiment is completed, and the --filter flag is now generally available.

You can use filter expressions as a single unified API for controlling the Run Queue, replacing the need to use the following CLI flags:

• Note that the file used for the --queue-excludes-file does not directly translate to the kind of file you can use for a --filters-file. To learn more, see the documentation.

The table above also explains the aliasing that has been done internally to replace queue flags with their filter equivalents. The aliasing for these queue flags is present purely for backwards compatibility purposes, but they are not going to emit deprecation warnings, and will not be removed before the Terragrunt 1.0 release.

You are heavily encouraged to adopt the new --filter flag for your infrastructure targeting needs as soon as feasible in your workflows. It will offer a significantly more flexible and powerful experience.

To learn more see the Filters feature documentation.

What's Changed

• fix: Using testing/synctest to make TestWriteUnitLevelSummary more reliable by @yhakbar in #5253
• chore: Cleaning up test symlinks resolution by @yhakbar in #5251
• fix: Fixing report run duplication error by @yhakbar in #5252
• fix: improved log error messages by @denis256 in #5256
• chore: Dropping ListContains and ListEquals and using standard library instead by @yhakbar in #5221
• chore: Adding debug log for assume already applied by @yhakbar in #5198
• Adding ambassador by @karlcarstensen in #5261
• Adding ambassador by @karlcarstensen in #5259
• Adding announcement banner by @karlcarstensen in #5260
• chore: Removing latest Terraform OSS workflows by @yhakbar in #5262
• chore: Backporting queue flags into filter flags by @yhakbar in #5241
• docs: Documenting backport of queue flags into filter flags by @yhakbar in #5263

Full Changelog: v0.96.1...v0.97.0-rc2025121901

⚠️ Alpha Release

Alpha release of the changes in #5252

Do not use in production.

Full Changelog: v0.96.1...alpha2025121801