Terraform Provider 1.4.0

Updates

• KSM-1016: Added an optional parent_uid input on the secretsmanager_folder data source to scope a name lookup to folders that are direct children of a specific parent, disambiguating folders that share a name under different parents.

• KSM-970: Added the secretsmanager_metadata data source for reading non-sensitive record metadata (uid, type, title, notes, revision, folder_uid, is_editable) by UID or title. revision increments on every record change, so pairing this with ephemeral resources drives write-only attribute versioning on other providers automatically.

• KSM-990: Added a special_set attribute to the complexity block on every password-bearing resource, for constraining which special characters password generation draws from. Defaults to the SDK's own set when left empty, which begins with a literal double-quote character: "!@#$%()+;<>=?[]{}^.,.

• KSM-1305: Fixed terraform import followed by apply silently rotating a generated password while the plan reported the value as unchanged. Declaring generate for the first time on a record that already holds a value is now treated as adoption rather than a rotation request; a later change to the flag still rotates normally.

• KSM-989: Fixed special=0 in a complexity block being ignored when length exceeded the sum of the other category counts.

• KSM-1071: Clarified that caps, lowercase, digits, and special in the complexity block are minimum counts, not exact targets — the generator can produce more of a character class to satisfy the total length.

• Bumped golang.org/x/crypto to v0.54.0 (from v0.46.0), fixing CVE-2026-46595 (CRITICAL, CVSS 10.0) and 12 additional advisories (6 further CRITICAL at CVSS 9.1, 2 HIGH at CVSS 7.5, 4 MEDIUM ranging CVSS 5.3–6.5).

• Bumped golang.org/x/net to v0.57.0 (from v0.48.0), fixing the library half of CVE-2026-39821 (CRITICAL, CVSS 10.0) and CVE-2026-25680 (MEDIUM, CVSS 6.5).

• Built with Go 1.26.7 (up from 1.26.2), clearing the standard-library half of CVE-2026-39821 plus 7 additional stdlib advisories with no CVE assigned.

• Bumped google.golang.org/grpc to v1.82.1 (from v1.79.3), resolving 1 advisory (HIGH, CVSS 8.8) in gRPC-Go's xDS RBAC and HTTP/2 handling.

Resources

• Terraform Registry

• Terraform Provider Documentation