v0.60.0

What's Changed

This release introduces a new configuration file format: .tflint.json. This is useful for workflows such as automatically generating configuration files.
Please note that in order to use the .tflint.json, enabled plugins must be built with SDK v0.23+.

From this release, Cosign signatures (checksums.txt.keyless.sig and checksums.txt.pem) are deprecated. They will not be included in future releases. If your installation scripts depend on them, please migrate to gh attestation verify.

Enhancements

• Add JSON configuration file support by @​rorychatterton in #​2391
• Report structured errors in JUnit and CheckStyle XML formatters by @​bendrucker in #​2407

Changes

• Alphabetize rulesets in version output by @​bendrucker in #​2404
• release: Pin Cosign version and deprecate Cosign signatures by @​wata727 in #​2405

Bug Fixes

• fix: only read TF_VAR for root module by @​bendrucker in #​2413

Chores

• build(deps): Bump actions/attest-build-provenance from 2.4.0 to 3.0.0 by @​dependabot[bot] in #​2376
• build(deps): Bump actions/setup-go from 5.5.0 to 6.0.0 by @​dependabot[bot] in #​2377
• build(deps): Bump the go-x group with 3 updates by @​dependabot[bot] in #​2378
• build(deps): Bump github.com/spf13/afero from 1.14.0 to 1.15.0 by @​dependabot[bot] in #​2380
• build(deps): Bump github.com/zclconf/go-cty from 1.16.4 to 1.17.0 by @​dependabot[bot] in #​2379
• build(deps): Bump golang.org/x/net from 0.43.0 to 0.44.0 in the go-x group by @​dependabot[bot] in #​2381
• build(deps): Bump google.golang.org/grpc from 1.75.0 to 1.75.1 by @​dependabot[bot] in #​2382
• build(deps): Bump github.com/sigstore/sigstore-go from 1.1.1 to 1.1.2 by @​dependabot[bot] in #​2383
• build(deps): Bump sigstore/cosign-installer from 3.9.2 to 3.10.0 by @​dependabot[bot] in #​2384
• build(deps): Bump mislav/bump-homebrew-formula-action from 3.5 to 3.6 by @​dependabot[bot] in #​2388
• fix(script): GitHub API rate limit by @​Sander0542 in #​2390
• Bump tflint-plugin-sdk to v0.23.0 by @​wata727 in #​2393
• build(deps): Bump github.com/sigstore/sigstore-go from 1.1.2 to 1.1.3 by @​dependabot[bot] in #​2394
• build(deps): Bump docker/login-action from 3.5.0 to 3.6.0 by @​dependabot[bot] in #​2395
• build(deps): Bump the go-x group with 4 updates by @​dependabot[bot] in #​2397
• build(deps): Bump google.golang.org/grpc from 1.75.1 to 1.76.0 by @​dependabot[bot] in #​2398
• build(deps): Bump sigstore/cosign-installer from 3.10.0 to 4.0.0 by @​dependabot[bot] in #​2399
• build(deps): Bump golang.org/x/net from 0.45.0 to 0.46.0 in the go-x group by @​dependabot[bot] in #​2400
• build(deps): Bump github.com/terraform-linters/tflint-plugin-sdk from 0.23.0 to 0.23.1 by @​dependabot[bot] in #​2402
• build(deps): Bump golangci/golangci-lint-action from 8.0.0 to 9.0.0 by @​dependabot[bot] in #​2408
• build(deps): Bump docker/metadata-action from 5.8.0 to 5.9.0 by @​dependabot[bot] in #​2409
• build(deps): Bump golang.org/x/oauth2 from 0.32.0 to 0.33.0 in the go-x group by @​dependabot[bot] in #​2410

New Contributors

• @​Sander0542 made their first contribution in #​2390
• @​rorychatterton made their first contribution in #​2391

Full Changelog: terraform-linters/tflint@v0.59.1...v0.60.0

v0.59.1

What's Changed

Enhancements

• build(deps): Bump github.com/terraform-linters/tflint-ruleset-terraform from 0.12.0 to 0.13.0 by @​dependabot[bot] in #​2351
• json: add fixed, fixable by @​bendrucker in #​2355

Bug Fixes

• format(sarif): Add tflint-errors rules for errors by @​wata727 in #​2373

Chores

• build(deps): Bump github.com/sigstore/sigstore-go from 1.0.0 to 1.1.0 by @​dependabot[bot] in #​2343
• build(deps): Bump golang.org/x/net from 0.41.0 to 0.42.0 in the go-x group across 1 directory by @​dependabot[bot] in #​2346
• build(deps): Bump sigstore/cosign-installer from 3.9.1 to 3.9.2 by @​dependabot[bot] in #​2347
• workflow: validate issues by @​bendrucker in #​2348
• build(deps): Bump google.golang.org/grpc from 1.73.0 to 1.74.2 by @​dependabot[bot] in #​2349
• build(deps): Bump docker/login-action from 3.4.0 to 3.5.0 by @​dependabot[bot] in #​2350
• build(deps): Bump mislav/bump-homebrew-formula-action from 3.4 to 3.5 by @​dependabot[bot] in #​2353
• dependabot: allow actions writes by @​bendrucker in #​2356
• build(deps): Bump docker/metadata-action from 5.7.0 to 5.8.0 by @​dependabot[bot] in #​2352
• build(deps): Bump actions/checkout from 4.2.2 to 5.0.0 by @​dependabot[bot] in #​2357
• build(deps): Bump the go-x group with 3 updates by @​dependabot[bot] in #​2358
• build(deps): Bump github.com/sigstore/sigstore-go from 1.1.0 to 1.1.1 by @​dependabot[bot] in #​2359
• build(deps): Bump github.com/hashicorp/go-plugin from 1.6.3 to 1.7.0 by @​dependabot[bot] in #​2360
• build(deps): Bump goreleaser/goreleaser-action from 6.3.0 to 6.4.0 by @​dependabot[bot] in #​2361
• build(deps): Bump golang from 1.24-alpine3.21 to 1.25-alpine3.21 by @​dependabot[bot] in #​2362
• build(deps): Bump github.com/go-viper/mapstructure/v2 from 2.3.0 to 2.4.0 by @​dependabot[bot] in #​2363
• build(deps): Bump github.com/hashicorp/go-getter from 1.7.8 to 1.7.9 by @​dependabot[bot] in #​2364
• build(deps): Bump google.golang.org/grpc from 1.74.2 to 1.75.0 by @​dependabot[bot] in #​2365
• build(deps): Bump github.com/zclconf/go-cty from 1.16.3 to 1.16.4 by @​dependabot[bot] in #​2366
• build(deps): Bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 by @​dependabot[bot] in #​2371
• Add support for Terraform v1.13 by @​wata727 in #​2372
• deps: Bump Go version to 1.25 by @​wata727 in #​2374
• Bump github.com/ulikunitz/xz to v0.5.15 by @​wata727 in #​2375

Full Changelog: terraform-linters/tflint@v0.58.1...v0.59.1