OpenTofu 1.12 makes lifecycle policy and CLI output more adaptable

OpenTofu released version 1.12.0 on May 14 with changes aimed at reusable modules and automation around the command line. The project announcement highlights dynamic lifecycle settings, improved provider checksums, simultaneous human and machine output, and faster provider installation.

Modules gain environment-aware safeguards

A resource’s prevent_destroy value can now refer to variables and other symbols in the same module. A shared database module can therefore reject deletion by default while allowing a caller to relax the rule in a disposable development environment. The safeguard still needs a conservative default and review: making the value dynamic also creates another input that can weaken it.

The new destroy = false lifecycle option removes an object from state without deleting the remote object. That is useful for handing management elsewhere, but it intentionally leaves infrastructure behind. Teams should pair it with an ownership record so an unmanaged resource does not become invisible.

Initialization and output change too

The OpenTofu Registry now supplies both zh: and h1: checksums across platforms. A normal tofu init can populate the complete lock information needed by shared plugin caches and local mirrors, while provider downloads run concurrently. The new -json-into=FILENAME option preserves normal terminal output while writing machine-readable events separately.

An upgrade rehearsal should review the lock-file diff, test any mirror or cache configuration, and verify tools consuming JSON events. OpenTofu 1.12 also begins deprecating WinRM provisioner connections and warns that support is planned for removal in 1.13; official 32-bit builds are being phased out. Those notices turn an otherwise incremental update into a planning deadline for teams that still depend on those paths.