OpenTofu 1.13: Symbol Libraries, Linting Experiment, and Fewer Unknowns in Planning

On September 30, 2026, the OpenTofu project released version 1.13.0 — deliberately as a leaner release: The development time was shortened to align with the Go release cycle, which keeps the series under security support longer (until August 2027). Precisely because of the reduced feature load, two experiments are all the more remarkable, as they show where things are heading: built-in linting and a new artifact called “Symbol Libraries.” In addition, there are new functions for more precise plans, official Windows ARM64 packages, and some breaking changes to consider when upgrading. For IaC teams, the release is also a good opportunity to review the project’s position: OpenTofu is now the established Terraform fork hosted under the Linux Foundation and has been a CNCF sandbox project since April 2025.

Less “(known after apply)” with convert and assume

OpenTofu’s core workflow depends on predicting the apply as accurately as possible. Values that cannot be determined during planning appear in the plan as “(known after apply)” — practical, but problematic: The meta-arguments enabled, for_each, and count reject unknown values, and automatic policy checks that evaluate the machine-readable plan output are practically blinded by unknowns.

OpenTofu 1.13 therefore introduces two families of tools with which module authors can give the tool additional hints:

• convert() specifies an expected type, for example when an unknown string is parsed via jsondecode: The result remains unknown, but OpenTofu then knows that accessing id yields a string.
• The assume... functions (e.g., assumenotnull, assumestringprefix) make statements about the value itself.

A typical example: The id of an AWS resource object is unknown at plan time. With a hint, the comparison with null can be turned into a known false:

output "vpc_id" {
  value = assumenotnull(
    assumestringprefix(
      aws_vpc.example.id,
      "vpc-",
    )
  )
}

The decisive condition: The hints must actually hold true at apply time. If the promised prefix does not match, the function fails during apply. Where provider or API documentation provides a guarantee, such assumptions can be cleanly encapsulated in a shared module.

Two experiments: Linting and Symbol Libraries

Version 1.13 contains very early work on built-in linting: initial infrastructure to enable lint rules and report results as warnings, plus some built-in example rules for the OpenTofu language. The project intends to develop this into a comprehensive feature long-term that also covers policy enforcement.

The second experiment is “Symbol Libraries”: reusable collections of values, functions, and type aliases that can be imported from all source types also supported for modules. This allows, for example, an organization-wide convention for DNS records to be defined centrally:

typedef "recordset" {
  type = set({
    name    = string
    type    = string
    ttl     = number
    records = set(string)
  })
}

function "a_records" {
  type = symbols::dns_recordset()
  parameter "records" {
    type = map(set(string))
  }
  parameter "ttl" {
    type = number
  }
  return = [
    for name, ip_addrs in param.records : {
      name    = name
      type    = "A"
      ttl     = param.ttl
      records = ip_addrs
    }
  ]
}

Both experiments are deliberately marked as immature and are not intended for production use — the project is explicitly seeking early feedback from the community.

Windows on ARM64 and the farewell to WinRM

New is official support for Windows on ARM64: The major cloud providers have corresponding windows_arm64 packages; with third-party providers, a provider upgrade may be necessary. On the removal list, on the other hand, is WinRM: The connection types of the remote-exec and file provisioners are no longer supported because the underlying Go libraries are unmaintained. Affected configurations should migrate to OpenSSH for Windows.

Further breaking changes when upgrading

• base64gzip now produces equivalent but no longer byte-identical results due to a new DEFLATE implementation — OpenTofu may therefore suggest resource changes; the ignore_changes meta-argument serves as a transition.
• macOS builds require at least macOS 13 Ventura.
• v1.13 is the last series with official 32-bit packages (386, arm); calling tofu init warns about this, and v1.14 will remove them entirely.
• The first patch, v1.13.1 from October 1, fixes among other things tofu show -json with ephemeral resources.

Where OpenTofu stands in 2026

The fork was created in August 2023 after HashiCorp converted Terraform from MPL 2.0 to the Business Source License; since September 2023 the project lives under the Linux Foundation, the first stable version 1.6.0 was released in January 2024, and CNCF acceptance as a sandbox project followed in April 2025. In 2026, OpenTofu continues to introduce features that Terraform does not offer — such as built-in state encryption (1.7), early variable evaluation (1.8), and dynamic prevent_destroy (1.12); provider for_each (1.9) and ephemeral values (1.11) also came first in OpenTofu. Currently, the 1.11, 1.12, and 1.13 lines are maintained; patch 1.12.7 most recently closed security gaps in the SSH provisioner (CVE-2026-78662, CVE-2026-56855). Major companies are also migrating: Fidelity Investments documented its migration from Terraform to OpenTofu in the official blog.

Conclusion

OpenTofu 1.13 is a signal release: With the assume... functions, planning becomes more precise, and the experiments on linting and symbol libraries point to the next evolutionary stage of the tool — quality assurance and reusable logic directly in the core instead of in external tools. Teams should plan for WinRM removal, base64gzip changes, and the 32-bit deprecation when upgrading. Looking at v1.14 (without 32-bit packages) and the 1.13 series supported until August 2027 is worthwhile for every IaC roadmap — OpenTofu is no longer a side project in 2026, but an independent force in the IaC ecosystem.

Sources

• OpenTofu v1.13.0 (official blog post) — feature details, experiments, breaking changes
• opentofu/opentofu Releases (GitHub) — v1.13.0/v1.13.1/v1.12.7, support periods, CVEs
• OpenTofu Blog — incl. “An Introduction to OpenTofu Symbol Libraries” (09/17/2026), “A Vision for Built-in Linting” (09/03/2026), Fidelity migration report
• Spacelift: OpenTofu – The Open-Source Alternative to Terraform — project history, release cadence, feature timeline
• env.dev: OpenTofu in 2026 — Terraform comparison, migration path