Highlights
Emergency security release for the eMudhra intermediate CA key compromise. The private keys of eight eMudhra (emSign) intermediate certificates were compromised; some of those intermediates are cross-signed by a root that every trust store includes. We recommend all users upgrade.
- Go 1.27.3: Atlantis is now built with go1.27.3, whose
crypto/x509rejects any certificate chain containing the eight compromised keys (CVE-2026-111943). Go does not check revocation, so Atlantis v0.48.1 and earlier, built with go1.27.1, would accept a certificate issued with those keys for any host, including the VCS APIs Atlantis sends credentials to. go1.27.3 also includes the standard library fixes from go1.27.2. - Trust store update in the images:
ca-certificatesis updated to Alpine20261020-r0and Debian20250419+deb13u1. Both removeemSign ECC Root CA - G3, and Debian also removes theComodo AAA Services rootthat cross-signed some of the affected intermediates. This covers the other TLS clients in the image (git, curl, Terraform/OpenTofu and conftest). - Runtime image refresh: Debian curl
8.14.1-2+deb13u7and openssl3.5.7-1~deb13u3security pins, Alpine 3.24.2, Terraform 1.16.5, conftest 0.70.1. - Dependency security updates:
golang.org/x/netv0.60.0 andvitev8.3.3.
If you build Atlantis yourself, rebuild with go1.27.3 or go1.26.10 or later. The terraform, tofu and conftest binaries are built by their own projects; update them when their releases with the Go fix are available.
What's Changed
Security changes
- fix(deps): update Go to 1.27.3 to distrust compromised eMudhra intermediates (release-0.48) by @jamengual in #7000
- chore(deps): update module golang.org/x/net to v0.60.0 [security] (release-0.48) by @renovate[bot] in #6976
- chore(deps): update dependency vite to v8.3.3 [security] (release-0.48) by @renovate[bot] in #7002
Full Changelog: v0.48.1...v0.48.2