chore(release): release v0.25.0

[open-constructs-cdktn]

🤖 Release PR — merge to cut a new release. Kept open and rebased as commits land on main.

0.25.0

0.25.0 (2026-09-24)

⚠ BREAKING CHANGES

• lib: ValidateBinaryVersion and ValidateTerraformVersion are removed (they were only reachable through deep imports, not the cdktn package root). Synth no longer executes the terraform/tofu binary for feature validation; set validateInstalledBinary: true in cdktf.json to verify the installed binary before commands that run it.
• lib: resource moves (moved blocks) are now validated at synth against the project's declared targetVersions (default terraform >=1.5.7, opentofu >=1.6.0) instead of the locally installed binary. Projects that declare terraform targets below 1.5.0 now fail synth; projects whose installed binary is older than their declared targets should set validateInstalledBinary: true in cdktf.json.
• lib: import blocks (importFrom / ImportableResource) are now validated at synth against the project's declared targetVersions (default terraform >=1.5.7, opentofu >=1.6.0) instead of the locally installed binary. Projects that declare terraform targets below 1.5.0 now fail synth; projects whose installed binary is older than their declared targets should set validateInstalledBinary: true in cdktf.json.
• lib: terraform_data resources are now validated at synth against the project's declared targetVersions (default terraform >=1.5.7, opentofu >=1.6.0) instead of the locally installed binary. Projects that declare terraform targets below 1.4.0 now fail synth; projects whose installed binary is older than their declared targets should set
• lib: cloud backends (the cloud block) are now validated at synth against the project's declared targetVersions (default terraform >=1.5.7, opentofu >=1.6.0) instead of the locally installed binary. Projects that declare terraform targets below 1.1.0 now fail synth; projects whose installed binary is older than their declared targets should set validateInstalledBinary: true in cdktf.json.
• lib: IAssetPackaging gains a required member omitsDirectoryEntries; external implementations must add it. Custom TerraformAsset assetHash values are now validated against /^[A-Za-z0-9_.-]+$/ and throw if they contain other characters (e.g. "feature/my-branch").
• lib: add asset pipeline foundation types and hash utilities (#371)

Features

• cli: move the TypeScript template to tsx and TypeScript 6 (#396) (b50349d)
• deps: adopt jsii 6.0 and TypeScript 6 (#395) (26fa8fa)
• gha: Revert "run the affected unit tests against OpenTofu (#439)" (#446) (ae015ef)
• gha: run the affected unit tests against OpenTofu (#439) (823682d)
• lib: add asset pipeline foundation types and hash utilities (#371) (a008d12)
• lib: add asset staging core with no bundling (#433) (44d8bd1)
• tests: add per-test runtime pinning to the integration matrix (#405) (17c2278)

Bug Fixes

• cli: correct the constructs range comment in the TypeScript template hook (#408) (9fc0e43)
• cli: make cdktn get remove stale files for resources removed from a provider (#421) (d6e28dc)
• deps: move jsii-rosetta to 6.0.16 for stream-json 3 (#463) (f1ec16f)
• gha: don't fail the pnpm upgrade jobs on ignored dep builds (#399) (5b66342)
• gha: pass -R to gh pr edit in release_github relabel step (#372) (358edc7)
• lib: retry the staging install without --prefer-offline outside CI (#407) (7bb26e7)
• provider-generator: pick the docs registry from targetVersions (#443) (00f2884)
• provider-generator: satisfy module provider configuration aliases on get (#383) (54a8217)
• provider-generator: stop a provider_functions resource clobbering the functions submodule (#403) (cf19de9)
• tests: bound and retry the dist publish to the local registry (#425) (cc9f9e2)
• tests: drop unused ts-jest transform from shared jest preset (#382) (03f6e16)
• tests: mark the terraform-cloud target Terraform-only in the matrix (#430) (b0deefa)
• tools: make the workspace build, package, lint and test on Windows (#364) (8dcddbe)

Code Refactoring

• lib: Remove the ValidateBinaryVersion synth-time binary probe (#457) (e60142e)
• lib: Use declared targetVersions for synth-time validation of import blocks (#454) (c0097f4)
• lib: Use declared targetVersions for synth-time validation of resource moves (#453) (43edc1e)
• lib: Use declared targetVersions for synth-time validation of terraform_data (#455) (a1c125b)
• lib: Use declared targetVersions for synth-time validation of the cloud backend (#456) (4a83507)

Miscellaneous Chores

• add OpenTofu and current Terraform to the jsii-terraform image (#394) (2f29d5a)
• deps: move the remaining packages to TypeScript 6 (#406) (c55d360)
• deps: move the root TypeScript to 6 (#417) (3cae1e2)
• deps: Update xstate to v5.32.4 (#333) (5ebf74f)
• examples: move the TypeScript examples to tsx and TypeScript 6 (#419) (857e182)
• Flexible python version (#420) (955f62a)
• gha: adopt the new jsii-terraform image and test Terraform 1.5.7 + 1.16.1 (#398) (3ad760b)
• gha: gate dependency upgrades on release age (#418) (b611a87)
• gha: retire Docker Hub publishing of jsii-terraform (#388) (e53cddf)
• gha: select the CLI by binary name instead of concatenating a version (#438) (914da56)
• lib: stop publishing build state in the cdktn package (#397) (51e4a95)
• npm-check-updates && pnpm update (#326) (7095f6b)
• tests: add timeout handling to spawned commands (#432) (ddb4a8a)
• tests: run the function-binding scripts with tsx (#431) (fec67bf)

Tests

• lib: ensure TerraformAsset stage within stack own directory (#434) (9a80366)
• lib: move matcher Docker fixture to a provider version OpenTofu accepts (#429) (7b0da12)
• tests: move the python providers fixture to Docker provider 3.9.0 (#440) (a678473)
• tests: move the testing-matchers fixtures to Docker provider 3.x (#436) (8e2c60e)
• tests: re-enable the Python edge integration test (#404) (0a80626)

---

This PR was generated with Release Please. See documentation.