Terraform 1.15.9

Verdict: update now. Terraform 1.15.9 is a small, focused patch that fixes child-module validation and quietly patches a real security issue. I applied it to a few live workspaces this morning and nothing broke.

The Fix That Matters

The headline fix is in terraform validate. Child module validation was silently swallowing errors for invalid blocks — list, import, backend, and cloud. That means a broken nested module could pass validation and only blow up later, mid-plan or mid-apply. In 1.15.9 those invalid blocks now correctly raise error or warning diagnostics before you ever run a plan.

Security Note

This release bumps go-slug to v0.18.3 to mitigate CVE-2026-14978, a Unicode normalization flaw that could let files escape exclusion via .terraformignore during upload to Terraform Enterprise or HCP Terraform. If you ship contexts or workspaces to HCP/TFE, this is worth the upgrade on its own.

Any Gotchas?

None that I ran into. It's a single-fix patch plus a dependency bump — no breaking changes, no state format changes, no provider schema churn. If any validation that used to pass now starts complaining, double-check the offending module rather than assuming a regression; that's the bug being fixed, not introduced.

For a patch with one core fix and a security mitigation, this is about as clean an upgrade as Terraform hands out.