Update CHANGELOG.md

CHANGELOG.md

@@ -22,9 +22,10 @@ BREAKING CHANGES:
 
 NOTES:
 
-* backend/s3: Region validation now automatically supports the new `af-south-1` (Africa (Cape Town)) region. For AWS operations to work in the new region, the region must be explicitly enabled as outlined in the [AWS Documentation](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable). When the region is not enabled, the Terraform S3 Backend will return errors during credential validation (e.g. `error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid`). [GH-24744]
+* The `terraform plan` and `terraform apply` command will now detect and report changes to root module outputs as able to be applied even if there are no resource changes in the plan. This will be an improvement in behavior for most users, since it will now be possible to change `output` blocks and use `terraform apply` to apply those changes, but it may require some changes to unusual situations where a root module output value was _intentionally_ changing on every plan, which was not an intended usage pattern and is no longer supported.
 * Terraform CLI now supports TLS 1.3 and supports Ed25519 certificates when making outgoing connections to remote TLS servers. While both of these changes are backwards compatible in principle, certain legacy TLS server implementations can reportedly encounter problems when attempting to negotiate TLS 1.3. (These changes affects only requests made by Terraform CLI itself, such as to module registries or backends. Provider plugins have separate TLS implementations that will gain these features on a separate release schedule.)
 * On Unix systems where `use-vc` is set in `resolv.conf`, Terraform will now use TCP for DNS resolution. We don't expect this to cause any problem for most users, but if you find you are seeing DNS resolution failures after upgrading please verify that you can either reach your configured nameservers using TCP or that your resolver configuration does not include the `use-vc` directive.
+* backend/s3: Region validation now automatically supports the new `af-south-1` (Africa (Cape Town)) region. For AWS operations to work in the new region, the region must be explicitly enabled as outlined in the [AWS Documentation](https://docs.aws.amazon.com/general/latest/gr/rande-manage.html#rande-manage-enable). When the region is not enabled, the Terraform S3 Backend will return errors during credential validation (e.g. `error validating provider credentials: error calling sts:GetCallerIdentity: InvalidClientTokenId: The security token included in the request is invalid`). [GH-24744]
 
 ENHANCEMENTS:
 
@@ -34,11 +35,13 @@ ENHANCEMENTS:
 * cli: Display detailed trust signature information when installing providers from the Terraform Registry, including a link to more documentation on different levels of signature [GH-24932]
 * cli: It is now possible to optionally specify explicitly which installation methods can be used for different providers, such as forcing a particular provider to be loaded from a particular directory on local disk instead of consulting its origin provider registry. [GH-24728]
 * cli: Add state replace-provider subcommand to allow changing the provider source for existing resources [GH-24523]
+* cli: The `terraform plan` and `terraform apply` commands now recognize changes to root module outputs as side-effects to be approved and applied. This means you can apply root module output changes using the normal plan and apply workflow. [GH-25047]
 * config: The `merge` function now returns more precise type information, making it usable for values passed to `for_each` [GH-24032]
 * config: Add "sum" function, which takes a list or set of numbers and returns the sum of all elements [GH-24666]
 * config: added support for passing metadata from modules to providers using HCL [GH-22583]
 * core: Significant performance enhancements for graph operations, which will help with highly-connected graphs [GH-23811]
-* core: Data sources can now be evaluated during plan, allowing `depends_on` to work correctly, and allowing data sources to update immediately when their configuration changes. [GH-24904]
+* core: Data resources can now be evaluated during plan, allowing `depends_on` to work correctly, and allowing data sources to update immediately when their configuration changes. [GH-24904]
+* core: Data resource changes detected during planning will now always be reported in the plan output, to highlight a likely reason for effective configurationc changes elsewhere. Previously only data resources deferred to the apply phase would be shown. [GH-24904]
 * backend/azurerm: switching to use the Giovanni Storage SDK to communicate with Azure [GH-24669]
 * backend/remote: Now supports `terraform state push -force`. [GH-24696]
 * backend/remote: Can now accept `-target` options when creating a plan using _remote operations_, if supported by the target server. (Server-side support for this in Terraform Cloud and Terraform Enterprise will follow in forthcoming releases of each.) [GH-24834]