Atlantis v0.48.0

Highlights

• Safer plan/apply lifecycle. Atlantis now hashes the loaded apply plan, persists plan results before reporting success, and applies the verified managed-plan snapshot.
• New slim container images. Alpine and Debian slim images are available without bundled Terraform or OpenTofu, for deployments that provide their own tooling.
• Terraform and runtime compatibility. End-of-life Terraform versions without security support were removed from the standard images. The bundled versions, Debian and Alpine bases, Go toolchain, OpenTofu, Conftest, and Git LFS were refreshed.
• Operational and security hardening. GitLab webhook tokens are omitted from errors, and drainer and workflow-hook status handling is more reliable. The GHSA-rjh2-4xgw-p2hj shell-injection fix is retained from the mainline history; it was already shipped in v0.47.1 and is not presented as new here.
• Documentation and localization. Spanish documentation and translation infrastructure were expanded.

Runtime and compatibility changes

• Standard images now use Terraform 1.16.3 and 1.15.9, with older unsupported Terraform versions removed.
• Alpine and Debian base images were updated, along with the Go 1.27.1 runtime/toolchain, OpenTofu 1.12.6, Conftest 0.70.0, and Git LFS 3.8.0.
• New alpine-slim and debian-slim image targets do not bundle Terraform or OpenTofu.

What's Changed

Exciting New Features 🎉

• feat: Remove end-of-life Terraform versions with no security support by @adampie in #6826
• New slim Alpine and Debian images without bundled Terraform/OpenTofu by @jamengual in #6831

Provider GitLab

• fix(events): omit GitLab webhook tokens from errors by @chenrui333 in #6851

Bug fixes 🐛

• fix: hash apply plan after PlanStore.Load by @daanvinken in #6790

Security changes

• chore(deps): update module golang.org/x/crypto to v0.56.0 [security] (main) by @renovate[bot] in #6838

Documentation

• Spanish documentation and translation infrastructure by @jamengual in #6767, #6863, #6864, #6866, and #6867
• chore(deps): update dependency vue to v3.5.41 in package.json (main) by @renovate[bot] in #6745
• docs(adr): define when an ADR is required and how to propose changes by @ShankyJS in #6820
• chore(deps): update dependency @playwright/test to v1.62.1 in package.json (main) by @renovate[bot] in #6821
• chore(deps): update dependency vue to v3.5.42 in package.json (main) by @renovate[bot] in #6823
• chore(deps): update dependency mermaid to v11.17.2 in package.json (main) by @renovate[bot] in #6846
• chore(deps): Bump dompurify from 3.4.12 to 3.4.13 by @dependabot[bot] in #6749
• chore(deps-dev): Bump postcss from 8.5.14 to 8.5.26 by @dependabot[bot] in #6727
• chore(deps): update dependency @playwright/test to v1.63.0 in package.json (main) by @renovate[bot] in #6877
• chore(deps): update dependency vite to v8 in package.json (main) by @renovate[bot] in #6882

Dependencies

• chore(deps): update go module directive to v1.26.6 in go.mod (main) by @renovate[bot] in #6787
• chore(deps): update redis:8.6-alpine docker digest to 75934dd in docker-compose.yml (main) by @renovate[bot] in #6808
• chore(deps): update dependency opentofu/opentofu to v1.12.6 in dockerfile (main) by @renovate[bot] in #6814
• chore(deps): update debian docker tag to v13.6 in dockerfile (main) by @renovate[bot] in #6822
• chore(deps): update dependency hashicorp/terraform to v1.15.9 in testdrive/utils.go (main) by @renovate[bot] in #6841
• chore(deps): update dependency git-lfs/git-lfs to v3.8.0 in dockerfile (main) by @renovate[bot] in #6827
• chore(deps): update alpine docker tag to v3.24.1 in dockerfile (main) by @renovate[bot] in #6798
• fix(deps): update module github.com/go-playground/validator/v10 to v10.30.4 in go.mod (main) by @renovate[bot] in #6862
• fix(deps): update github.com/hashicorp/terraform-config-inspect digest to 75d64de in go.mod (main) by @renovate[bot] in #6874
• chore(deps): update gcr.io/oss-fuzz-base/base-builder-go docker digest to e5e5ecf in .clusterfuzzlite/dockerfile (main) by @renovate[bot] in #6885
• chore(deps): update dependency open-policy-agent/conftest to v0.69.0 in testing/dockerfile (main) by @renovate[bot] in #6892
• chore(deps): update go to v1.27.1 in go.mod (main) by @renovate[bot] in #6893
• chore(deps): update dependency open-policy-agent/conftest to v0.70.0 in dockerfile (main) by @renovate[bot] in #6890
• fix(deps): update module github.com/hashicorp/go-getter/v2 to v2.2.4 in go.mod (main) by @renovate[bot] in #6889
• fix(deps): update aws-sdk-go-v2 monorepo in go.mod (main) by @renovate[bot] in #6898
• fix(deps): update module golang.org/x/text to v0.42.0 in go.mod (main) by @renovate[bot] in #6901
• fix(deps): update module github.com/slack-go/slack to v0.29.0 in go.mod (main) by @renovate[bot] in #6899
• fix(deps): update module golang.org/x/term to v0.46.0 in go.mod (main) by @renovate[bot] in #6900
• chore(deps): update dependency hashicorp/terraform to v1.16.3 in testdrive/utils.go (main) by @renovate[bot] in #6878

Other Changes 🔄

• fix(docker): update Alpine curl pin to restore builds by @chenrui333 in #6856
• test(events): synchronize saturated pool cancellation by @chenrui333 in #6852
• fix(runtime): preserve workflow hook status read errors by @chenrui333 in #6853
• test(runtime): cover subprocess execution failures by @chenrui333 in #6854
• fix(events): synchronize drainer status reads by @chenrui333 in #6850
• fix: persist plan results before publishing success by @chenrui333 in #6848
• fix: apply the verified managed plan snapshot by @chenrui333 in #6849
• chore(renovate): track Dockerfile apk/apt pins with native apk and deb datasources by @jamengual in #6914

New Contributors

• @adampie made their first contribution in #6826

Full Changelog: v0.47.1...v0.48.0