Atlantis v0.48.0

Highlights

• Safer plan/apply lifecycle. Atlantis now hashes the loaded apply plan, persists plan results before reporting success, and applies the verified managed-plan snapshot.
• New slim container images. Alpine and Debian slim images are available without bundled Terraform or OpenTofu, for deployments that provide their own tooling.
• Terraform and runtime compatibility. End-of-life Terraform versions without security support were removed from the standard images. The bundled versions, Debian and Alpine bases, Go toolchain, OpenTofu, Conftest, and Git LFS were refreshed.
• Operational and security hardening. GitLab webhook tokens are omitted from errors, and drainer and workflow-hook status handling is more reliable. The GHSA-rjh2-4xgw-p2hj shell-injection fix is retained from the mainline history; it was already shipped in v0.47.1 and is not presented as new here.
• Documentation and localization. Spanish documentation and translation infrastructure were expanded.

Runtime and compatibility changes

• Standard images now use Terraform 1.16.3 and 1.15.9, with older unsupported Terraform versions removed.
• Alpine and Debian base images were updated, along with the Go 1.27.1 runtime/toolchain, OpenTofu 1.12.6, Conftest 0.70.0, and Git LFS 3.8.0.
• New alpine-slim and debian-slim image targets do not bundle Terraform or OpenTofu.

What's Changed

Exciting New Features 🎉

• feat: Remove end-of-life Terraform versions with no security support by @adampie in https://github.com/runatlantis/atlantis/pull/6826
• New slim Alpine and Debian images without bundled Terraform/OpenTofu by @jamengual in https://github.com/runatlantis/atlantis/pull/6831

Provider GitLab

• fix(events): omit GitLab webhook tokens from errors by @chenrui333 in https://github.com/runatlantis/atlantis/pull/6851

Bug fixes 🐛

• fix: hash apply plan after PlanStore.Load by @daanvinken in https://github.com/runatlantis/atlantis/pull/6790

Security changes

• chore(deps): update module golang.org/x/crypto to v0.56.0 [security] (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6838

Documentation

• Spanish documentation and translation infrastructure by @jamengual in https://github.com/runatlantis/atlantis/pull/6767, https://github.com/runatlantis/atlantis/pull/6863, https://github.com/runatlantis/atlantis/pull/6864, https://github.com/runatlantis/atlantis/pull/6866, and https://github.com/runatlantis/atlantis/pull/6867
• chore(deps): update dependency vue to v3.5.41 in package.json (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6745
• docs(adr): define when an ADR is required and how to propose changes by @ShankyJS in https://github.com/runatlantis/atlantis/pull/6820
• chore(deps): update dependency @playwright/test to v1.62.1 in package.json (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6821
• chore(deps): update dependency vue to v3.5.42 in package.json (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6823
• chore(deps): update dependency mermaid to v11.17.2 in package.json (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6846
• chore(deps): Bump dompurify from 3.4.12 to 3.4.13 by @dependabot[bot] in https://github.com/runatlantis/atlantis/pull/6749
• chore(deps-dev): Bump postcss from 8.5.14 to 8.5.26 by @dependabot[bot] in https://github.com/runatlantis/atlantis/pull/6727
• chore(deps): update dependency @playwright/test to v1.63.0 in package.json (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6877
• chore(deps): update dependency vite to v8 in package.json (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6882

Dependencies

• chore(deps): update go module directive to v1.26.6 in go.mod (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6787
• chore(deps): update redis:8.6-alpine docker digest to 75934dd in docker-compose.yml (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6808
• chore(deps): update dependency opentofu/opentofu to v1.12.6 in dockerfile (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6814
• chore(deps): update debian docker tag to v13.6 in dockerfile (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6822
• chore(deps): update dependency hashicorp/terraform to v1.15.9 in testdrive/utils.go (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6841
• chore(deps): update dependency git-lfs/git-lfs to v3.8.0 in dockerfile (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6827
• chore(deps): update alpine docker tag to v3.24.1 in dockerfile (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6798
• fix(deps): update module github.com/go-playground/validator/v10 to v10.30.4 in go.mod (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6862
• fix(deps): update github.com/hashicorp/terraform-config-inspect digest to 75d64de in go.mod (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6874
• chore(deps): update gcr.io/oss-fuzz-base/base-builder-go docker digest to e5e5ecf in .clusterfuzzlite/dockerfile (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6885
• chore(deps): update dependency open-policy-agent/conftest to v0.69.0 in testing/dockerfile (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6892
• chore(deps): update go to v1.27.1 in go.mod (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6893
• chore(deps): update dependency open-policy-agent/conftest to v0.70.0 in dockerfile (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6890
• fix(deps): update module github.com/hashicorp/go-getter/v2 to v2.2.4 in go.mod (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6889
• fix(deps): update aws-sdk-go-v2 monorepo in go.mod (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6898
• fix(deps): update module golang.org/x/text to v0.42.0 in go.mod (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6901
• fix(deps): update module github.com/slack-go/slack to v0.29.0 in go.mod (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6899
• fix(deps): update module golang.org/x/term to v0.46.0 in go.mod (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6900
• chore(deps): update dependency hashicorp/terraform to v1.16.3 in testdrive/utils.go (main) by @renovate[bot] in https://github.com/runatlantis/atlantis/pull/6878

Other Changes 🔄

• fix(docker): update Alpine curl pin to restore builds by @chenrui333 in https://github.com/runatlantis/atlantis/pull/6856
• test(events): synchronize saturated pool cancellation by @chenrui333 in https://github.com/runatlantis/atlantis/pull/6852
• fix(runtime): preserve workflow hook status read errors by @chenrui333 in https://github.com/runatlantis/atlantis/pull/6853
• test(runtime): cover subprocess execution failures by @chenrui333 in https://github.com/runatlantis/atlantis/pull/6854
• fix(events): synchronize drainer status reads by @chenrui333 in https://github.com/runatlantis/atlantis/pull/6850
• fix: persist plan results before publishing success by @chenrui333 in https://github.com/runatlantis/atlantis/pull/6848
• fix: apply the verified managed plan snapshot by @chenrui333 in https://github.com/runatlantis/atlantis/pull/6849
• chore(renovate): track Dockerfile apk/apt pins with native apk and deb datasources by @jamengual in https://github.com/runatlantis/atlantis/pull/6914

New Contributors

• @adampie made their first contribution in https://github.com/runatlantis/atlantis/pull/6826

Full Changelog: https://github.com/runatlantis/atlantis/compare/v0.47.1...v0.48.0