- Added support for sensitive input variables and lock file generation, plus hardened TLS verification and client‑side downgrade protection.
- Introduced new functions (alltrue, anytrue, textencodebase64/decode), concise diff rendering, a global chdir option, and backend enhancements like Consul state chunking and GCS service‑account impersonation.
- Deprecated the provider version argument, removed the 0.13upgrade subcommand and debug command, and added experiments for optional module variable attributes and provider‑sensitive attributes.