github.com/hashicorp/packer

1.16.0 (July 24, 2026)

FEATURES:

• provenance: add new provenance post-processor and packer verify-attestation command for
  SLSA Build L1/L2 supply-chain attestations. Derives in-toto subjects from Packer artifacts,
  builds SLSA Provenance v1 predicates with Git/CI metadata, and signs via local PEM key, cloud
  KMS (awskms://, gcpkms://, azurekms://, hashivault://), or keyless Sigstore (Fulcio +
  optional Rekor transparency log). Reference CI workflows for L2 keyless and L3-compatible
  delegated-signing patterns are included under examples/ci/.
  GH-13667
• core/hcl2: add rfc3339_parse and unix_timestamp_parse template functions. Both accept
  RFC 3339 timestamps; unix_timestamp_parse additionally accepts Unix epoch integers.
  GH-13669
• core/hcl2: add continue_on_error meta-argument to provisioner blocks. When set to true,
  a provisioner failure is logged and the build continues rather than halting.
  GH-13674
• core/hcl2: variable object types now support optional() attribute modifiers, allowing
  object variables to declare per-attribute defaults and omit fields that have a default set.
  GH-13670

BUG FIXES:

• plugin/getter: prevent path traversal vulnerability in GitHub plugin getter filename handling.
  GH-13680
• build: update build constraints to support arm architecture on FreeBSD.
  GH-13650

SECURITY:

• security: drop x/crypto/openpgp by upgrading go-github v33 → v75.
  GH-13676
• security: suppress false positive for GO-2026-5932.
  GH-13677
• deps: bump golang.org/x/crypto to v0.54.0.
  GH-13672

DEPENDENCIES:

• deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.10.
  GH-13673
• deps: bump github.com/hashicorp/hcp-sdk-go to v0.174.0.
  GH-13673
• deps: bump github.com/zclconf/go-cty to v1.18.1.
  GH-13673
• deps: bump github.com/google/go-github v33 → v75.
  GH-13676
• deps: bump golang.org/x/net to v0.56.0.
  GH-13664
• deps: update various Go module dependencies.
  GH-13673

INTERNAL:

• ci: pin GitHub Action refs to latest verified SHAs.
  GH-13675
• chore: remove old website references.
  GH-13668

FEATURES:

• provenance: add new provenance post-processor and packer verify-attestation command for SLSA Build L1/L2 supply-chain attestations. Derives in-toto subjects from Packer artifacts, builds SLSA Provenance v1 predicates with Git/CI metadata, and signs via local PEM key, cloud KMS (awskms://, gcpkms://, azurekms://, hashivault://), or keyless Sigstore (Fulcio + optional Rekor transparency log). Reference CI workflows for L2 keyless and L3-compatible delegated-signing patterns are included under examples/ci/. GH-13667
• core/hcl2: add rfc3339_parse and unix_timestamp_parse template functions. Both accept RFC 3339 timestamps; unix_timestamp_parse additionally accepts Unix epoch integers. GH-13669
• core/hcl2: add continue_on_error meta-argument to provisioner blocks. When set to true, a provisioner failure is logged and the build continues rather than halting. GH-13674
• core/hcl2: variable object types now support optional() attribute modifiers, allowing object variables to declare per-attribute defaults and omit fields that have a default set. GH-13670

BUG FIXES:

• plugin/getter: prevent path traversal vulnerability in GitHub plugin getter filename handling. GH-13680
• build: update build constraints to support arm architecture on FreeBSD. GH-13650

SECURITY:

• security: drop x/crypto/openpgp by upgrading go-github v33 → v75. GH-13676
• security: suppress false positive for GO-2026-5932. GH-13677
• deps: bump golang.org/x/crypto to v0.54.0. GH-13672

DEPENDENCIES:

• deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.10. GH-13673
• deps: bump github.com/hashicorp/hcp-sdk-go to v0.174.0. GH-13673
• deps: bump github.com/zclconf/go-cty to v1.18.1. GH-13673
• deps: bump github.com/google/go-github v33 → v75. GH-13676
• deps: bump golang.org/x/net to v0.56.0. GH-13664
• deps: update various Go module dependencies. GH-13673

INTERNAL:

• ci: pin GitHub Action refs to latest verified SHAs. GH-13675
• chore: remove old website references. GH-13668

1.15.4 (June 3, 2026)

BUG FIXES:

• builder: update build constraints to support arm architecture on FreeBSD
  GH-13650

IMPROVEMENTS:

• hcp: removes Syft binary download/handling from the HCP SBOM provisioner
  GH-13636

SECURITY:

• deps: upgraded crypto version
  GH-13645
• deps: upgraded go-git version
  GH-13645
• deps: bump github.com/hashicorp/packer-plugin-sdk to 0.6.9
  GH-13640

INTERNAL:

• build: bump Go to 1.25.10 and refresh dependencies
  GH-13646
  GH-13647
• deps: update cloud.google.com/go and aws-sdk-go-v2 related dependencies
  GH-13610

DEPRECATIONS:

• hcp/sbom: removed Syft binary download and handling from the HCP SBOM provisioner; Syft binary management is now deprecated in favor of the native flow. GH-13636

BUG FIXES:

• security: addressed authorization-bypass related issues by upgrading go-git and golang.org/x/crypto. GH-13645
• sbom: bump CycloneDX dependency to improve BOM generation handling. GH-13638

DEPENDENCIES:

• deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.9. GH-13640
• deps: update github.com/Azure/go-ntlmssp to v0.1.1. GH-13622
• deps: update go-git and golang.org/x/crypto. GH-13645
• build/deps: bump GitHub Actions dependencies group (7 updates). GH-13649

1.15.3 (April 27, 2026)

BUG FIXES:

• hcp: skip bucket update requests when description and labels already match, avoiding unnecessary updates for existing buckets.
  GH-13624

BUG FIXES:

• hcp: skip bucket update requests when description and labels already match, avoiding unnecessary updates for existing buckets. GH-13624

1.15.2 (April 21, 2026)

FEATURES:

• provisioner: added support for the enforced provisioner.
  GH-13591

SECURITY:

• deps: bump github.com/go-jose/go-jose/v4
  GH-13594
• deps: bump go.opentelemetry.io/otel/sdk
  GH-13606
• deps: update cloud.google.com/go and aws-sdk-go-v2 related dependencies
  GH-13610

INTERNAL:

• build: bump Go to 1.25.9 and refresh dependencies
  GH-13614
  GH-13615

FEATURES:

• provisioner: added support for the enforced provisioner. GH-13591

SECURITY:

• deps: bump github.com/go-jose/go-jose/v4 GH-13594
• deps: bump go.opentelemetry.io/otel/sdk GH-13606
• deps: update cloud.google.com/go and aws-sdk-go-v2 related dependencies GH-13610

INTERNAL:

• build: bump Go to 1.25.9 and refresh dependencies GH-13614 GH-13615

1.15.1 (March 26, 2026)

FEATURES:

• hcp: native sbom generation for hcp. Refer to the guide here for more information.
  GH-13566

BUG FIXES:

• core: Scrub multiline sensitive values from build output (including OS-specific multiline sensitive-value fixtures)
  GH-13582

SECURITY:

• deps: bump syft to v1.42.3 (fixes GO-2026-4809)
  GH-13581
• deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.7
  GH-13581
• deps: bump github.com/hashicorp/hcp-sdk-go from 0.136.0 to 0.167.0
  GH-13560
• deps: Updates OpenTelemetry dependencies to v1.41.0
  GH-13572
• deps: Upgrade go-git to v5.17.0 and grpc to 1.79.3
  GH-13570
• deps: Updates circl dependency to v1.6.3
  GH-13564

INTERNAL:

• ci: Adds grouped and scheduled updates for GitHub Actions (monthly, grouped PRs, ignore major bumps)
  GH-13575
• docs: remove docs validation from packer (docs changes move to web-unified-docs)
  GH-13577
• legal: Update LICENSE
  GH-13563

FEATURES:

• hcp: native sbom generation for hcp GH-13566

BUG FIXES:

• core: Scrub multiline sensitive values from build output (including OS-specific multiline sensitive-value fixtures) GH-13582

SECURITY:

• deps: bump syft to v1.42.3 (fixes GO-2026-4809) GH-13581
• deps: bump github.com/hashicorp/packer-plugin-sdk to v0.6.7 GH-13581
• deps: bump github.com/hashicorp/hcp-sdk-go from 0.136.0 to 0.167.0 GH-13560
• deps: Updates OpenTelemetry dependencies to v1.41.0 GH-13572
• deps: Upgrade go-git to v5.17.0 and grpc to 1.79.3 GH-13570
• deps: Updates circl dependency to v1.6.3 GH-13564

INTERNAL:

• ci: Adds grouped and scheduled updates for GitHub Actions (monthly, grouped PRs, ignore major bumps) GH-13575
• docs: remove docs validation from packer (docs changes move to web-unified-docs) GH-13577
• legal: Update LICENSE GH-13563

1.15.0 (February 4, 2026)

IMPROVEMENTS:

• core/hcp: add support for updating HCP Packer registry channels and bucket log UI metadata.
  GH-13532

• build: update Go to 1.24.12.
  GH-13553

• docker: remove vmware and vsphere from the packer full image.
  GH-13442

• docs: add comments to packer docs.
  GH-13534

• compliance: update copyright and license headers.
  GH-13540
  GH-13543
  GH-13545
  GH-13544

BUG FIXES:

• datasource/http: update acceptance test URL to avoid rate limiting.
  GH-13480

• provisioner/powershell: ensure LASTEXITCODE is set before checking its value in tests.
  GH-13539

SECURITY:

• Bump golang.org/x/crypto to 0.46.0
  GH-13546

IMPROVEMENTS:

• core/hcp: add support for updating HCP Packer registry channels and bucket log UI metadata. GH-13532

• build: update Go to 1.24.12. GH-13553

• docker: remove vmware and vsphere from the packer full image. GH-13442

• docs: add comments to packer docs. GH-13534

• compliance: update copyright and license headers. GH-13540 GH-13543 GH-13545 GH-13544

BUG FIXES:

• datasource/http: update acceptance test URL to avoid rate limiting. GH-13480

• provisioner/powershell: ensure LASTEXITCODE is set before checking its value in tests. GH-13539

SECURITY:

• Bump golang.org/x/crypto to 0.46.0 GH-13546

1.14.3 (November 18, 2025)

IMPROVEMENTS:

• core/hcp: added cicd metadata support for BitBucket and Jenkins pipelines.
  GH-13513
  GH-13505

• core: bump github.com/hashicorp/packer-plugin-sdk to 0.6.4
  GH-13494

• docs: fix typos and linguistic errors in documentation.
  GH-13496

SECURITY:

• Bump golang.org/x/crypto to 0.43.0
  GH-13518

IMPROVEMENTS:

• core/hcp: added cicd metadata support for BitBucket and Jenkins pipelines. GH-13513 GH-13505

• core: bump github.com/hashicorp/packer-plugin-sdk to 0.6.4 GH-13494

• docs: fix typos and linguistic errors in documentation. GH-13496

SECURITY:

• Bump golang.org/x/crypto to 0.43.0 GH-13518

1.14.2 (September 9, 2025)

✨ Features

• HCP Certificate Authentication Support – by @JenGoldstrich (#13435)
  Adds support for the HCP_CRED_FILE environment variable and removes restrictions on HCP_CLIENT_ID and HCP_CLIENT_SECRET when connecting builds to an HCP Packer registry.

• Upgrade Node.js to v22 – by @LeahMarieBush (#13450)
  Updates the Node.js version used for Packer website builds.

🐛 Bug Fixes

• fix(winrm): catch cmd err from winrm – by @anurag5sh in (#298)
  Improved reliability by catching WinRM remote shell failures during provisioning
• PowerShell wrapper cleanup – by @kp2099 (#13451)
  Removed the unused $result variable from the wrapper string.
• fix tests for shell and shell-local – by @kp2099 in (#300)
  Acceptance test fixes for shell and shell-local

🛠 Improvements

• Added workflow-dispatch and set PACKER_ACC_BUILDERS for acceptance tests – by @kp2099 (#13444)
• Improved spacing in hcl2template error messages – by @sbraz (#13453)
• Added callouts for HashiCorp-maintained plugins moving to releases.hashicorp.com – by @BrianMMcClain (#13438)

📦 Dependencies

• Bump github.com/ulikunitz/xz from 0.5.10 → 0.5.14 – by @dependabot (#13459)
• Bump golang.org/x/oauth2 from 0.13.0 → 0.27.0 – by @dependabot (#13460)
• Bump github.com/ulikunitz/xz from 0.5.10 → 0.5.15 – by @kp2099 (#13461)
• Bump github.com/hashicorp/packer-plugin-sdk from 0.6.2 → 0.6.3 – by @kp2099 (#13462)

👩‍💻 New Contributors

• @LeahMarieBush made their first contribution in #13450 🎉

1.14.1 (August 5, 2025)

BUG FIXES:

• core: Changes on the packer plugin installation process to ensure that the plugin is installed correctly.
  The releases binary from official site releases.hashicorp.com was not getting installed from a proxy server, which was addressed in this PR.
  GH-13439

BUG FIXES:

• core: Changes on the packer plugin installation process to ensure that the plugin is installed correctly. The releases binary from official site releases.hashicorp.com was not getting installed from a proxy server, which was addressed in this PR. GH-13439

IMPROVEMENTS:

• core: Changes to pull official packer plugins binaries from official site (releases.hashicorp.com). This change allows Packer to automatically download and install official plugins from the HashiCorp official release site. This change standardizes our release process and ensures a more secure and reliable pipeline for plugin delivery. GH-13431

• core: Updated the docs related to packer provisioners GH-13412

• core/HCP: This change corrects the example docs to move the registry block to the top level of the template file GH-13427

• core: This update adds a new section explaining conditional expressions in HCL, including syntax, usage examples, and best practices for clarity and maintainability. The documentation covers how to use conditionals for default values, dynamic argument omission, and recommends using locals for complex logic. GH-13429

BUG FIXES:

• core: Fixes the default execute command for script and scripts to its original behavior from v1.12.0. The recent change to use the -File operator for script execution required adjustments that are addressed in this PR. GH-13422

SECURITY:

• Bump go-git from v5.13.0 to v5.16.2 GH-13420

FEATURES:

• core: Enhanced the existing inline field in the shell provisioner to support any script with its own shebang (#!). Allows users to provide scripts directly in the inline field, making it possible to use scripts generated by functions like templatefile. Ensures that the shell provisioner executes the given script as intended, honoring the script's shebang line. GH-13313

• core: Added new built-in functions to Packer: sum startswith endswith These new functions expand the capabilities for template logic and variable handling in Packer builds. GH-13349

IMPROVEMENTS:

• hcl2: Added the ability for the packer fmt command to format multiple HCL files at once. This enhancement allows users to format several files in a single command invocation. GH-13362

• hcl2: Added top level hcp_packer_registry block (this configuration was previously nested inside the build block and is still valid but deprecated) GH-13314

BUG FIXES:

• core: Updated the documentation to explicitly state that a trailing slash is required when uploading directories, regardless of the guest OS. This clarification is intended to ensure consistent behavior and prevent confusion, especially for Windows users. GH-13309

• core: Fixed an error occurring when using the --use-sequential-evaluation flag with packer console. Updated the FlagSets to correctly include this flag, resolving the error. GH-13316

• core: added a wrapper around inline PowerShell commands executed by the provisioner to catch errors and ensure the Packer build fails if any command results in an error. GH-13334

• hcl2: Ensures that Packer now preserves the user-defined order of variable files as input by the user. This change maintains the intended precedence of variables, honoring the order specified on the command line. GH-13350

SECURITY:

• Bump to go-crypto v0.36.0 GH-13369

FEATURES:

• core: add support for a DAG-based evaluation on locals and datasources. A long-standing odditiy of Packer has been the order of evaluation for locals and data sources. In previous versions of Packer, the data sources were evaluated first, then the local variables were, making it impossible to have a datasource that referenced a local variable as part of its configuration. This change introduces a Directed Acyclic Graph (DAG) to evaluate those resources, instead of the phased approach of old, which makes the order of evaluation not dependent on the type of resource, but instead of the detected dependencies between them. Note: While we are confident this should be robust enough for general use, we do recognise that it is possible some users might encounter issues. To give those users a way to continue using the old evaluation method, we introduced a -use-sequential-evaluation command-line flag to the build, validate, console and inspect subcommands, to force using the sequential evaluation approach for those entities. GH-13155

• core/hcp: support for uploading SBOMs to HCP Packer. Software Bill of Materials (SBOM) are a standardised way to export the various software packages linked to an artifact. As some users have expressed a need to produce and access those for images they build, we now add the feature to Packer itself. While the generation of the SBOM itself is not done directly by Packer, instead we recommend using known scanners to produce them, we add the capacity to upload this SBOM file to HCP Packer, and link it to a build artifact. GH-13171

• core: support for alternate serialisation formats for plugin communication. Packer relies on plugins to do most of the actual workload related to building and provisioing artifacts, while Packer is mostly an orchestrator for those plugins to perform their work. This separation of concerns implies that both entities have to communicate on multiple occasions during the course of a build. Before v1.12.0 of Packer, and v0.6.0 of the plugin SDK, we used Gob to do most of the serialisation for those steps. This is however a bit of a problem recently, as go-cty, the library we use for dynamic objects lifted from HCL templates, dropped support for this a while back. Therefore now, we introduce an alternative: protobuf/msgpack, which are both usable and maintained by the projects around Packer, so we can begin our transition away from gob with this change. Note: as with the introduction of the DAG for locals/datasources, this is a feature that we are reasonably confident you will not encounter bugs with, however we cannot rule-out this possibility, therefore we introduce a new environment variable: PACKER_FORCE_GOB, which if set to '1', forces the use of Gob instead of protobuf/msgpack. GH-13120

IMPROVEMENTS:

• hcl2/json: add aws_secretsmanager_raw funcion. When using the AWS secretsmanager function with a non-text secret, one could only get a secret once at a time. This could get cumbersome if wanting to get multiple through one request, which led people to encode their JSON/Object secrets as a big base64 encoded string that they could get once, and then manipulate through JSON functions. While the workaround works, it is one extra layer of manipulations to do so, therefore a new function to always get the raw textual version of a secret is now added to Packer. GH-13242
• hcl2: add alltrue and anytrue functions. As with Terraform, Packer now supports the HCL functions alltrue and anytrue, which returns whether or not a collection only consists of true values, or if any is. GH-13237
• hcl2: add strcontains function. As with Terraform, Packer now supports the HCL function strcontains, which returns whether or not a string contains a substring within it. GH-13217 GH-13222
• datasource/http: Support other methods than GET. The HTTP datasource used to always use GET requests for getting data from a remote HTTP server, which was not always enough since some endpoints may only support other methods. This change allows for most of the HTTP methods to perform those requests. GH-13190
• hcl2: add base64gzip function. In some cases, small blobs may need to be kept in memory, and injected in a template somewhere else, but if the blob needs to be minimised, the base64gzip function can be invoked to compress the blob and expose it as a valid HCL2 string for use later. GH-13142

BUG FIXES:

• hcl2: Fix duplicate error messages on top-level HCL violations. A parsing quirk for HCL templates caused Packer to produce the same parsing error multiple times if the error was caused by a top-level violation. GH-13245
• build: Include LC_UUID in Darwin binaries. A change in how Apple authorises a plugin to access the network caused Packer to break on recent (14.7 and above) macOS versions, as Packer uses the local network to communicate with plugins. The fix is to include an additional UUID into the metadata of the produced binary, so it is authorised by macOS to use the local network, which prompts an update to the version of Go used for building Packer (1.22.9), as it is when this addition is supported by an LDFLAG. GH-13214
• hcl2: Don't error on empty bucker slug. As reported by members of our community, using a hcp_packer_registry block without a bucket slug, even if provided by external means, would cause Packer to fail with an invalid bucket slug error. This is most definitely a bug, which is addressed in this release. GH-13210
• hcp: fix bug when trying to extract HEAD SHA from empty Git repo. GH-13165

SECURITY:

• Bump to go-crypto v0.31.0 GH-13233

NOTES:

• docs: fix UUIDv4 example. A community user has found discrepancies in the UUIDv4 examples which were used in our docs, as they do not match the standard. GH-13229
• hcl2: fix slice initialisation method during variable evaluation phase. GH-13175

FEATURES

• core/hcp: export Packer options, OS, CI and VCS metadata for a build. Following up on the introduction of metadata for builds in Packer 1.11.0, this version introduces more metadata. In addition to the version of Packer core, and the plugins used, we now capture CI-specific environment variables (gitlab-ci and github-actions for now), Git-specific information, OS details like architecture and kernel version, and the command-line options passed to packer build.

NOTES:

• Future Scaffolding: This release contains additional changes that allow Packer core to validate access a HCP Packer bucket before trying to publish to it. If the bucket does not exist and the associated service principle does not have permission to create the bucket Packer will fail the build.GH-13059

SECURITY:

• core: Bump github.com/hashicorp/go-retryablehttp to address CVE-2024-6104.GH-13081

IMPROVEMENTS:

• core/hcl2: The issue is that local variables in templates are evaluated in a non-deterministic order, leading to inconsistent behavior. To fix this, local variables will now build a list of direct dependencies, similar to datasources, and evaluate these dependencies recursively. A caveat is that there's a recursion cap of 10 to prevent infinite recursion; if this limit is reached, an error is returned, prompting the user to fix their template. GH-13039
• core: bump github.com/hashicorp/hcp-sdk-go from 0.96.0 to 0.99.0 GH-13063
• core: bump github.com/hashicorp/packer-plugin-sdk from 0.5.3 to 0.5.4 GH-13061

BUG FIXES:

• core/hcp: Change UpsertBucket to call GetBucket to address unauthorized error from ustream API. GH-13059

NOTES:

• A LICENSE.txt file has been added to the Packer release artifacts. GH-12931 GH-12940

• Breaking Change: Support for loading single-component plugins has been removed from Packer. GH-12785

• Breaking Change: Support for loading plugin binaries following the naming convention of packer-plugin-name has been dropped. Packer will now only load plugins stored under the Packer plugin directory using the expected namespaced directory and CHECKSUM files. This change drops support for loading plugin binaries in Packer's executable directory or a template's current working directory. GH-12828

/Users/dev/.packer.d/plugins
└── github.com
    └── hashicorp
        └── happycloud
            ├── packer-plugin-happycloud_v0.0.1_x5.0_darwin_arm64
            └── packer-plugin-happycloud_v0.0.1_x5.0_darwin_arm64_SHA256SUM

FEATURES:

• core: Add -ignore-prerelease-plugins flag to disable the use of development plugin binaries for the build and validate commands development plugin binaries. GH-12828 GH-12882
• Packer users can now track Packer version and plugin versions used for each build artifact in HCP Packer. GH-12866
• hcl2: add textencodebase64 and textdecodebase64 funcs For feature parity with Terraform, and since having access to strings encoded in something that is not UTF-8 is required in some cases, we add both the textencodebase64 and textdecodebase64 functions to HCL2 templates. Please note these functions return base64 encoded byte slices because of how cty/hcl defines strings (NFC normalised, UTF-8 encoded). GH-12997

SECURITY:

• Bump github.com/go-jose/go-jose/v3 to address GHSA-c5q2-7r4c-mv6g. GH-12880
• Bump golang.org/x/net to v0.24.0 to address GO-2024-2687. GH-12924

IMPROVEMENTS:

• core: Bump github.com/hashicorp/hcp-sdk-go from 0.90.0 to 0.96.0. GH-12935 GH-12942 GH-12960 GH-12979
• core: Bump github.com/hashicorp/packer-plugin-sdk from 0.5.2 to 0.5.3 GH-12932
• core: Bump go-getter/v2 from 2.2.1 to v2.2.2 GH-12988
• datasource/http: don't error on 2xx code Previous versions of Packer only supported 200 as a success case for the http datasource. This change makes any status code from 200 to 299 successful. GH-12989
• core: Move to predictable plugin loading schema - Packer will now only load plugins stored under the Packer plugin directory using the expected namespaced directory and CHECKSUM files. GH-12828
• core: Remove support loading single-component plugins. GH-12785
• core: Rename internal packer plugin command to packer execute to avoid user confusion with the plugins subcommand. GH-12865
• core: Packer now considers development binaries when evaluating plugin version constraints. This work allows users to use binaries with versions reported as "x.y.z-dev" to be used with the Packer required_plugins block. GH-12828
• core: Packer now supports local paths to plugins for the packer plugins remove command. This addition makes it possible to pipe commands like packer plugins installed with it for speedy cleanup of installed plugins. GH-12886
• core: Relax Packer source address URIs within the required_plugins block to support the installation of local plugin binary using a custom or internal source address (e.g. mycompany.com/plugins/happyorg/happycloud). Remote installation using packer init or packer plugins install does not support non-GitHub source URIs. Users using alternative hosts must install plugins manually using packer plugins install --path. GH-12911, [GH-12962] (https://github.com/hashicorp/packer/pull/12962)
• core: Remote plugins installed containing an internal version number that differs from the version number within the binary name can lead to confusion when tracking Packer plugin version information. To help track such discrepancies in the plugin version, packer init and packer plugin install have been updated to reject installation of such plugins. 1.0.0-dev). Users are encouraged to notify plugin maintainers of any version mismatches. GH-12915, GH-12953, GH-12972
• core: don't load plugins with metadata in name To avoid confusion with multiple plugins that report the same effective version, plugins installed need to have no metadata in their name. When installed through Packer commands, the metadata is scrubbed from the name of the installed plugin binary, but manually it may still be possible, so we enforce that scrubbing at load-time as well. GH-12980
• core: Error when multiple paths are specified for PACKER_PLUGIN_PATH Since Packer 1.11 removed the capability for PACKER_PLUGIN_PATH to specify multiple directories separated by : or ; (depending on the platform), we are explicitly erroring when this is discovered, with suggestions as to how to fix the problem. GH-12967
• core: Version metadata support for plugins. Plugins may now formally have metadata in their versions, Packer supports it, and applies the semver recommendations on them, i.e. they are ignored for comparison/sorting purposes, but allowed for adding extra information about a plugin. GH-12888

Given the specified version constraint only versions greater than or equal to 1.1.0 will be considered.

amazon = {
  source = "github.com/hashicorp/amazon"
  version = ">= 1.1.0"
}

If a development binary is installed, Packer will use it if:

1. It is the highest compatible version installed.
2. There is no final plugin version with the same version number installed alongside it.

/Users/dev/.packer.d/plugins
└─ github.com
   └─ hashicorp
    	└── amazon
          ├── packer-plugin-amazon_v1.1.0_x5.0_darwin_arm64
          ├── packer-plugin-amazon_v1.1.0_x5.0_darwin_arm64_SHA256SUM
          ├── packer-plugin-amazon_v1.1.1-dev_x5.0_darwin_arm64
          └── packer-plugin-amazon_v1.1.1-dev_x5.0_darwin_arm64_SHA256SUM

Version 1.1.1-dev of the Amazon plugin will match the specified version constraint and be used for executing the Packer build.

If, however, a 1.1.1 release version of the plugin is available, it will have precedence over the development binary.

/Users/dev/.packer.d/plugins
└─ github.com
   └─ hashicorp
    	└── amazon
          ├── packer-plugin-amazon_v1.1.1-dev_x5.0_darwin_arm64
          ├── packer-plugin-amazon_v1.1.1-dev_x5.0_darwin_arm64_SHA256SUM
          ├── packer-plugin-amazon_v1.1.1_x5.0_darwin_arm64
          └── packer-plugin-amazon_v1.1.1_x5.0_darwin_arm64_SHA256SUM

BUG FIXES:

• core: fix plugin version ordering to not be lexicographic. This fixes an issue with how plugins are discovered by Packer, and ensures proper version ordering. This means that with this change, versions that are semantically greater, but lexicographically inferior will be loaded. Ex: 1.0.9 vs. 1.0.10; 1.0.9 > 1.0.10 lexicographically, but semantically 1.0.10 > 1.0.9
• core/hcp: fix potential race condition when storing plugin details to the HCP Packer metadata storage map. GH-12936
• core: fix plugin listing on Windows This fix addresses bugs present in the alpha releases of 1.11, where the discovery of Windows binaries were not matching against the filename extension (.exe). GH-12981

NOTES

• A LICENSE.txt file has been added to the Packer release artifacts. GH-12931

FEATURES

• Packer users can now track Packer version and plugin versions used for each build artifact in HCP Packer. GH-12891 GH-12910 GH-12923 GH-12926

SECURITY

• Bump github.com/go-jose/go-jose/v3 to address GHSA-c5q2-7r4c-mv6g. GH-12928
• Bump golang.org/x/net to v0.24.0 to address GO-2024-2687. GH-12924

BUG FIXES

• cmd/fmt: Display information error when Packer fmt fails due to HCL2 parsing error. GH-12870

NOTES:

• Continuing the work in in Packer v1.10.0 we introduced the ability to install a locally sourced plugin using packer plugins install --path, this release extends support to development plugin binaries - binaries that report "dev" as part of their plugin version. Instead of manually placing a downloaded binary into the executable or current working directory we encourage you to run the command packer plugins install –path <path-to- downloaded-extracted-binary> github.com/hashicorp/happycloud to install the binary into a Packer compatible path. GH-12855

IMPROVEMENTS:

• cmd/plugins: Add support for installing local development binaries to packer plugins install. GH-12855
• core: Validate bucket name when using hcp_packer_registry block. GH-12820
• core: Update github.com/hashicorp/hcp-sdk-go from 0.83.0 to 0.85.0. GH-12850 GH-12827

BUG FIXES:

• core/hcp: HCP Packer build failures properly distinguish between incompatible plugins and general publishing errors. GH-12854 GH-12835

NOTES:

• HCP Packer has been updated to follow an artifact-agnostic approach for publishing and consuming built artifacts. To best support the new approach, HCP Packer components within Packer have been updated to use the v2 nomenclature when publishing build metadata to HCP Packer. These changes include data source components for consuming HCP Packer stored artifacts. The data source components hcp-packer-version and hcp-packer-artifact respectively replace, the now deprecated, hcp-packer-iteration and hcp-packer-image component data sources. The added changes are compatible with all existing HCP Packer workflows and do not warrant any immediate template changes by the user. However, we encourage all HCP Packer users to visit the updated HCP Packer CHANGELOG to familiarize themselves with the nomenclature changes. GH-12794 GH-12799
• The hcp-packer-image data source has been deprecated, please use HCP Packer Artifact data source instead. GH-12794
• The hcp-packer-iteration data source has been deprecated, please use HCP Packer Version data source instead. GH-12794
• The contextual variable packer.iterationID has been deprecated, please use the new contextual variable packer.versionFingerprint. The iterationID represents the HCP Packer iteration that build metadata has been publish to, with this release an Iteration is now referred to as a Version and the ID has been replaced by the Version Fingerprint. GH-12803

FEATURES:

• New Data source hcp-packer-artifact The HCP Packer Artifact Data Source retrieves information about an artifact from the HCP Packer Registry. GH-12794
• New Data source hcp-packer-version The HCP Packer Version Data Source retrieves information about HCP Packer Version from the HCP Packer. Registry. GH-12794

SECURITY:

• core: Bump Go dependencies to address various CVEs. GH-12777
• core: Bump github.com/cloudflare/circl to address GHSA-9763-4f94-gfch. GH-12781

IMPROVEMENTS:

• core: Bump github.com/hashicorp/hcp-sdk-go from 0.79.0 to 0.81.0 GH-12792 GH-12764
• core: Update error messaging for HCP incompatible plugin builds. GH-12800
• core: Update HCP Packer integration to use HCP Packer v2 nomenclature, with this change HCP Packer iterations are now referred to as Versions, and Images are now referred to as Artifacts. The data sources for interacting with HCP Packer have been respectively renamed to align with the terminology of Version and Artifact. GH-12794 GH-12799
• core: Update spacing for flags within Help text. GH-12742 GH-12743

NOTES:

This release contains breaking changes for practitioner relying on plugins previously bundled into Packer. As specified in the Bundled Plugins Removal announcement HashiCorp maintained plugins will no longer be shipped with Packer. Users are encouraged to use packer init or packer plugins [...] when managing required plugins needed for executing their builds. GH-12660

The affected plugins include:

• packer-plugin-amazon
• packer-plugin-ansible
• packer-plugin-azure
• packer-plugin-docker
• packer-plugin-googlecompute
• packer-plugin-qemu
• packer-plugin-vagrant
• packer-plugin-virtualbox
• packer-plugin-vmware
• packer-plugin-vsphere

SECURITY:

• Bump github.com/go-jose/go-jose/v3 to address GO-2023-2334. There have been no reported issues with Packer but we are bumping given that it is a secondary dependency. GH-12723
• Bump Go to 1.20.10 to Address CVE-2023-44487 / CVE-2023-39325. GH-12661
• Bump Go to 1.20.11 CVE-2023-45283. There have been no reported issues with Packer but we are bumping given its usage of the path/filepath pkg. GH-12690
• Bump Packer Plugin SDK to v0.5.2. GH-12717

PLUGINS:

• Removed all HashiCorp vendored plugins from being bundled into the Packer binary. GH-12660, GH-12720
• packer-plugin-hcloud: The Hetzner Cloud plugin has been handed over to the Hetzner integrations team. New releases for this plugin are available at https://github.com/hetznercloud/packer-plugin-hcloud. Existing references to the plugin will continue to work but users are advised to update the required_plugins block to use the new plugin source address.

  required_plugins {
     parallels = {
       source  =  "github.com/hetznercloud/hcloud"
       version =  "~> 1"
     }
  }
  

IMPROVEMENTS:

• cmd/init: Warn users running packer init on configuration templates with a missing required_plugins blocks. GH-12638
• cmd/plugins: Add --path flag to packer plugins install subcommand to support installation of plugins from a local binary rather than from GitHub. GH-12643
• cmd/plugins: Install SHA256SUM file with 0644 perms. GH-12665
• cmd/plugins: Remove SHA256SUM file on plugin removal. GH-12666
• cmd/plugins: Remove will error if it fails to find the plugin being selected for removal. GH-12669
• core/hcl2: Remove empty source file reference on unset variable errors. GH-12712
• core/hcl: Improve the recursive execution of data sources with other data source dependencies. GH-12608
• core: Bump github.com/hashicorp/hcp-sdk-go from 0.73.0 to 0.74.0 - GH-12704
• core: Bump Packer Plugin SDK to v0.5.2. GH-12717
• core: Provide integration link as hint in error message if a plugin component is unknown. GH-12705
• core: Update version output for packer -v and packer --version to match packer version. GH-12569
• docs: Update plugin installation guides with supported methods for 1.10.0 and above. GH-12713

BUG FIXES:

• cmd/plugins: Update packer plugin installed to show all installed plugin binaries, including any duplicate versions or binaries copied from a different source URI. GH-12731

SECURITY

• Bump github.com/go-jose/go-jose/v3 to address GO-2023-2334. GH-12723

BUG FIXES:

• Add VirtualBox as known plugin prefix to prevent endless bundled plugin warning. GH-12719

BUG FIXES:

• core: When invoking Packer with the CHECKPOINT_DISABLE environment variable the telemetry reporter is left uninitialized in order to disable telemetry reporting. Any method calls on the nil reporter is expected to check if the reporter is active or in NOOP mode. The SetBundledUsage function, introduced in Packer 1.9.2, failed to perform a nil check before attempting to modify an attribute, causing Packer to fail when telemetry is disabled. This release fixes this issue by introducing such a check.

NOTES:

• New Docker Image: As part of the bundled plugin removal effort, a new Docker target called release-full has been added to the Packer release artifacts. The release-full image includes Packer and all the official plugins pre-installed in its environment. This image is being offered as an alternative option for those users who may still be relying on the plugin versions bundled into the Packer binary. GH-12532

IMPROVEMENTS:

• core/docs: Clarify the expected usage of the packer init command for HCL2 template builds.GH-12535
• core/hcp: Add support for project-level service principals. A user connecting with a project level service principals must provide a valid HCP_PROJECT_ID in order to connect. GH-12520 GH-12576
• core: A new Docker image packer:release-full has been added for all supported architectures. The release-full image includes Packer and all the official plugins pre-installed in its environment. GH-12532
• core: Add enhanced support to Packer telemetry for bundle plugins usage. GH-12536

BUG FIXES:

• core: Bump golang.org/x/net to v0.13.0 to address CVE GO-2023-1988. Packer itself is not vulnerable to the CVE as we don't render web pages, but security checks do point it as an issue that needs to be addressed. GH-12561
• core: Fix custom plugin loading in current working directory regression. GH-12544

NOTES:

• Vendored plugins within Packer have not been updated. Plugin releases occur on a regular basis to address issues and feature requests. Please note that in an upcoming version of Packer, we will remove the last bundled plugins from Packer. Users are encouraged to use packer init for HCL2 templates or packer plugins install with legacy JSON templates for installing external plugins.

• Packer will now warn when using bundled plugins. This feature will be removed in a future version of the tool, so this warning is meant to bring awareness of the upcoming change, and help users update their templates. GH-12495

BUG FIXES:

• Fixed a bug with how Packer was discovering plugins: in order to load plugins, Packer would recursively scan all the known directories in which we could have installed plugins. This caused unnecessary directory walks and slowdowns upon invocation. Packer will now only check for nested plugins within the directories used by commands such as packer init, or packer plugins install, or as defined in PACKER_PLUGIN_PATH. Refer to Packer's plugin directory documentation for details on how loading works. GH-12414

• The packer init subcommand now bundles all the missing installed plugins into one condensed warning, as opposed to one warning per missing plugin. GH-12506

PLUGINS:

• packer-plugin-parallels: The Parallels plugin has been handed over to the Parallels team. New releases for this plugin are available at https://github.com/parallels/packer-plugin-parallels. This plugin is no longer being bundled in the Packer binary release. Existing references to the plugin will continue to work but users are advised to update the required_plugins block to use the new plugin source address. GH-12476

   required_plugins {
     parallels = {
       source  =  "github.com/parallels/parallels"
       version =  "~> 1"
      }
  }
  

IMPROVEMENTS:

• The hcl2_upgrade sub-command will now add required_plugins to the template generated from JSON for official plugins. GH-12504

BUG FIXES:

• On May 16th 2023, HCP introduced multi-project support to the platform. In order to use multiple projects in your organization, you will need to update Packer to version 1.9.1 or above. Starting with 1.9.1, you may specify a project ID to push builds to with the HCP_PROJECT_ID environment variable. If no project ID is specified, Packer will pick the project with the oldest creation date. Older versions of Packer are incompatible with multi-project support on HCP, and builds will fail for HCP organizations with multiple projects on versions before 1.9.1. GH-12453

NOTES:

• Breaking Change: Iteration fingerprints used to be computed from the Git SHA of the repository where the template is located when running packer build. This changes with this release, and now fingerprints are automatically generated as a ULID. This implies that continuing an existing iteration will require users to define the fingerprint in the environment manually in order to adopt this behaviour, otherwise, by default, a new iteration will be created. This does not impact workflows where the fingerprint was defined through the HCP_PACKER_ITERATION_FINGERPRINT environment variable, and these builds will work exactly as they did before. GH-12172

• Breaking Change: Community-maintained plugins bundled with the Packer binary have been removed. These external plugin components are released independently of Packer core and can be installed directly by the user. Users relying on the external plugin components listed below should refer to the packer plugins sub-command and, if using HCL2, a required_plugins block to define a list of plugins for building a template.

PLUGINS

• Remove provisioner plugins for Chef, Converge, Puppet, Salt, and Inspec as vendored plugins. These plugins have been previously archived and not updated in release since being archived. These plugins can be installed using packer init or with the Packer plugins sub-command packer plugins install github.com/hashicorp/chef. GH-12374

• The following community plugins won't be bundled with Packer anymore:

  • Alicloud
  • CloudStack
  • HCloud
  • HyperOne
  • Hyper-V
  • JDCloud
  • LXC
  • LXD
  • NCloud
  • OpenStack
  • Proxmox
  • TencentCloud
  • Triton
  • Yandex

  GH-12436

Users relying on these external plugin components should refer to the packer plugins sub-command and, if using HCL2, a required_plugins block to define a list of plugins to use for building a template.

IMPROVEMENTS:

• core/hcp: Now, fingerprints used by HCP Packer are randomly generated ULIDs instead of a Git SHA, and a new one is always generated, unless one is specified in the environment. GH-12172

BUG FIXES:

• Fix LDFLAGS for release pipelines: Between Packer 1.8.5 and Packer 1.8.7, changes to the LDFLAGS in use for building the binaries for Packer had mistakenly removed some compilation flags, leading to the final binaries not being stripped. This change raised the size of the built binaries by as much as 45%. In this release, we fixed the LDFLAGS during compilation, yielding leaner binaries.

• Bumped gopsutil to v3. This fixes a macOS intermittent crash reported by the community GH-12430

HCP Packer -- Multi project support advisory

If using HCP Packer to store metadata on your builds, please be aware that Packer does not support this feature yet, and as such, having multiple projects in your organization will make it impossible to use HCP Packer in this release.

We are actively working on supporting this feature, which will be available in a subsequent release.