fix(migrations): upgrade atlas image to v1.3.2 to clear Go CVEs

Merged
MI
2mo ago
+6-6

Summary

  • Bump the pinned arigaio/atlas base image in app/controlplane/Dockerfile.migrations from v1.2.3-97b7881-canary to the v1.3.2 stable release (sha256:1e4fe2e2…), which is built with an updated Go toolchain and dependencies.
  • Clears all 15 High findings previously reported against the /atlas binary in the control-plane-migrations image, covering Go stdlib (CVE-2026-56862, CVE-2026-56864, CVE-2026-56865, CVE-2026-46600, CVE-2026-39822, GO-2026-6089, GO-2026-5942, GO-2026-4970), golang.org/x/net (GO-2026-5942), golang.org/x/text (GO-2026-5970), golang.org/x/mod (GO-2026-6179, GO-2026-6180) and google.golang.org/grpc (GHSA-hrxh-6v49-42gf).
  • Align the ATLAS_VERSION used to install the atlas CLI in common.mk and .github/workflows/test.yml with the same v1.3.2 release.

AI disclosure: this change was produced with the assistance of Claude Code.

🤖 Posted by Maximus bot (Claude Code) on behalf of @migmartri