Atlantis Updates & Release Notes

<!-- Release notes generated using configuration in .github/release.yml at release-0.48 -->

What's Changed

Security changes

• fix: anchor the prefix when a repo allowlist rule has a mid-string wildcard (GHSA-fwc4-2f3p-7qm7) by @jamengual in https://github.com/runatlantis/atlantis/pull/6962

Full Changelog: https://github.com/runatlantis/atlantis/compare/v0.48.0...v0.48.1

Thanks to @arpitjain099 for reporting and reviewing this fix, and to @pseudomorph for reviewing.

Atlantis v0.48.0

### Terraform and OpenTofu Binaries Removed from Debian and Alpine Images

Starting with Atlantis v0.49.0, the Debian- and Alpine-based Docker images will no longer include bundled Terraform or OpenTofu binaries.

Users can continue to use Atlantis' automatic binary download functionality to fetch and use the Terraform or OpenTofu versions required by their workflows.

This change allows the Atlantis project to focus its security and maintenance efforts on the Atlantis application and its container images, rather than taking responsibility for the security lifecycle, vulnerability management, and distribution of third-party Terraform and OpenTofu binaries.

Users who require pre-installed binaries can continue to build custom Atlantis images based on the official images.

Highlights

• Safer plan/apply lifecycle. Atlantis now hashes the loaded apply plan, persists plan results before reporting success, and applies the verified managed-plan snapshot.
• New slim container images. Alpine and Debian slim images are available without bundled Terraform or OpenTofu, for deployments that provide their own tooling.
• Terraform and runtime compatibility. End-of-life Terraform versions without security support were removed from the standard images. The bundled versions, Debian and Alpine bases, Go toolchain, OpenTofu, Conftest, and Git LFS were refreshed. …

<!-- Release notes generated using configuration in .github/release.yml at release-0.47 -->

What's Changed

Security changes

• fix: prevent pull request input from reaching a shell (GHSA-rjh2-4xgw-p2hj) by @jamengual in https://github.com/runatlantis/atlantis/pull/6792

Full Changelog: https://github.com/runatlantis/atlantis/compare/v0.47.0...v0.47.1

Thanks to @krewenki for the security review of this fix, and to @pseudomorph for reviewing.

<!-- Release notes generated using configuration in .github/release.yml at main -->

What's Changed

Exciting New Features 🎉

• feat(#303): include commit SHA in working directory lock errors by @ShankyJS in https://github.com/runatlantis/atlantis/pull/6646
• feat: Expose plan_output on POST /api/drift/detect and clarify drift API workflow docs by @albertorm95 in https://github.com/runatlantis/atlantis/pull/6709
• feat: add --plan-store-dir to decouple plan file storage from data-dir by @sakkiii in https://github.com/runatlantis/atlantis/pull/6636

Provider GitHub

• fix: handle malformed plans and VCS transport failures by @chenrui333 in https://github.com/runatlantis/atlantis/pull/6672
• fix: make GitHub token rotation concurrency-safe by @chenrui333 in https://github.com/runatlantis/atlantis/pull/6670

Bug fixes 🐛

• fix: wire SkipPRRequirements for no-PR API and drift remediation contexts by @albertorm95 in https://github.com/runatlantis/atlantis/pull/6664
• fix: exempt readiness probe from web authentication by @chenrui333 in https://github.com/runatlantis/atlantis/pull/6669
• fix: avoid nil terraform client dereference in NewServer by @Atul-Koundal in https://github.com/runatlantis/atlantis/pull/6697
• fix: accept 2xx responses as success in HTTP webhooks by @gautamrizwani in https://github.com/runatlantis/atlantis/pull/6648 …