Atlantis v0.49.0: Docker Image Changes, 12 Security Fixes, and Breaking Config Rules
Atlantis v0.49.0 drops bundled Terraform/OpenTofu from Docker images and fixes 12 CVEs with breaking behavior. Upgrade checklist and HCL/CLI examples.
Infrastructure as Code
terraform-aws-vpc v6.7.3 is a documentation patch clarifying Terraform/OpenTofu limitations. Upgrade steps, version pinning, and verification included.
terraform-aws-modules/vpc/aws is the most widely used community module for provisioning AWS VPCs, subnets, route tables, NAT gateways, and related networking resources. Version 6.7.3 was released on 2026-09-18. This is a patch release, and the release notes are limited to a single bug-fix entry. This article summarizes exactly what changed, based strictly on the published release notes, and gives a safe upgrade path.
The only change documented in the v6.7.3 release notes is:
a2a41d2).No new variables, outputs, resources, or breaking changes are listed. No deprecations are called out. This is a documentation-only correction in the module's README that clarifies behavior differences or known constraints when the module is used with Terraform versus OpenTofu.
The release notes do not specify the exact wording or scope of the limitations added to the README. If this matters to your use case (for example, if you run the module under OpenTofu rather than Terraform), read the current README directly in the repository rather than relying on a summary, since the specific limitation text is not reproduced in the release notes themselves.
Given the thin nature of this release, there is nothing else to report here. Check the release page for the authoritative, up-to-date content.
Because this is a docs-only patch, the upgrade is low-risk. Pin or update your module version constraint:
module "vpc" {
source = "terraform-aws-modules/vpc/aws"
version = "~> 6.7.3"
name = "my-vpc"
cidr = "10.0.0.0/16"
azs = ["us-east-1a", "us-east-1b", "us-east-1c"]
private_subnets = ["10.0.1.0/24", "10.0.2.0/24", "10.0.3.0/24"]
public_subnets = ["10.0.101.0/24", "10.0.102.0/24", "10.0.103.0/24"]
enable_nat_gateway = true
single_nat_gateway = true
}Then pull the new module version:
terraform init -upgradeIf you're on OpenTofu:
tofu init -upgradeSince no resource arguments, outputs, or variable defaults changed according to the release notes, a terraform plan should show no diff attributable to this module version bump.
Confirm the module version was pulled and that no unexpected plan changes appear:
terraform providers lock
terraform plan -no-color | grep -i "vpc"You can also inspect the .terraform/modules/modules.json file to confirm the resolved version:
grep -A2 '"vpc"' .terraform/modules/modules.jsonExpect "Version": "6.7.3" and an empty or no-op plan for the VPC module's resources.
v6.7.3 of the terraform-aws-vpc module is a low-impact, documentation-only patch that adds clarification about known Terraform/OpenTofu limitations to the README. There are no breaking changes, deprecations, or new features in this release per the published notes. Upgrading is safe and should not produce a plan diff; it's a good opportunity to pull the latest README guidance, especially for teams running mixed Terraform/OpenTofu environments. For full detail on the limitations text itself, consult the module's README directly rather than this summary.
Atlantis v0.49.0 drops bundled Terraform/OpenTofu from Docker images and fixes 12 CVEs with breaking behavior. Upgrade checklist and HCL/CLI examples.
tenv v4.15.1 fixes CVEs flagged by Trivy and bumps CI/Go dependencies. No new tenv/tofu/terragrunt features in this release.
Terratest v2.0.0 splits into 16 Go modules under /v2 import paths, trims dependencies, and changes two Kubernetes behaviors. Upgrade notes inside.
Terragrunt v1.2.1 patches a Go CVE, speeds up discovery and shared config parsing, and dedupes run_cmd calls. Upgrade notes inside.