Atlantis

Atlantis v0.49.0 strips Terraform and OpenTofu binaries from its Docker images and patches 12 security advisories that alter existing command, workspace, and approval behavior, including a shell-injection fix carried over from v0.47.1. Because the images no longer ship a Terraform/OpenTofu binary, operators must set --default-tf-version (and --default-tf-distribution opentofu if used) or mount/copy a binary into the image, and review the documented behavior changes around comment arguments, workspace name validation, repo symlinks, and plan-to-apply hash binding before upgrading.

Matters for: Teams running Atlantis via Docker or Helm with GitHub, GHES, or Gitea integrations that rely on custom server-side workflows, comment-based plan/apply arguments, or approval-based policy gates.

Atlantis v0.48.2 is rebuilt with go1.27.3, so crypto/x509 now rejects any certificate chain signed with the eight compromised eMudhra intermediate CA keys (CVE-2026-111943), and the image's ca-certificates trust store is updated to remove the affected eMudhra and Comodo AAA roots used by git, curl, Terraform/OpenTofu and conftest. Previously, Atlantis v0.48.1 and earlier (built with go1.27.1) would accept a fraudulent certificate issued with those compromised keys for any host, including the VCS APIs Atlantis sends credentials to, so all users should upgrade and, if self-building, rebuild with go1.27.3 or go1.26.10+.

Matters for: Teams running self-hosted Atlantis servers that authenticate to VCS providers like GitHub, GitLab, or Bitbucket over TLS.

Atlantis now hashes the loaded apply plan and persists plan results before reporting success, applying only the verified managed-plan snapshot, and offers new alpine-slim and debian-slim images without bundled Terraform/OpenTofu for deployments that supply their own tooling. Starting in v0.49.0 the standard Debian and Alpine images will stop bundling Terraform and OpenTofu binaries entirely, so teams relying on the pre-installed binaries must switch to Atlantis' automatic binary download or build custom images based on the official ones; end-of-life Terraform versions have also been removed from the standard images.

Matters for: Teams running Atlantis in CI/CD pipelines that build custom Docker images or manage Terraform version compatibility across multiple projects.

Atlantis now exposes alpha APIs for drift detection, status checks, remediation, and remediation history, gated by API token authentication and repository allowlists, with Slack and HTTP webhook notifications for drift events. It also adds runtime localization (English and Spanish catalogs plus custom YAML overrides) and new automerge controls including a default merge method and a flag to disable automerge labels.

Matters for: Platform teams running Atlantis at scale who need to detect and remediate Terraform state drift across many repositories and projects, and teams operating Atlantis for non-English-speaking contributors.