Community Edition binaries (through v1.3.2) still ship the Go module vulnerabilities reported fixed in #3783

Summary

The Community Edition atlas binaries still ship Go modules with known, upstream-fixed vulnerabilities, through the newest community build (v1.3.2). Issue #3783 reported this same set against the 1.3.0 binary and was closed as "resolved with v1.3.2" — but that resolution does not appear in the community binaries. An unanswered follow-up comment on #3783 raised the same observation (grpc still at v1.79.3 in the community image); this issue records it with verified evidence.

What was measured

Scanner: Trivy 0.73.0, trivy rootfs against the standalone binary (vuln scanner only).

Binaries verified by SHA-256 against the co-published .sha256:

• atlas-community-linux-amd64-v1.3.0 → 10d7913e3dce43ab99b8d71534a4cbadaf11a16dc293adf3b91d10e83a0ac70b
• atlas-community-linux-amd64-v1.3.2 → bdae7d2b6b903fdc4c40313fedfdf87f8a08ce1f2a4fd5c62fea2308419d526e (self-reports atlas community version v1.3.2)

Both carry the identical 14 findings. No v1.3.3+ community binary is published (release CDN returns 403). Note: GitHub Releases marks v1.3.0 as latest because patch versions are not cut as GitHub releases (per #3710), so the newest community binary is v1.3.2, not what the Releases page shows.

Findings (community v1.3.2)

Module	Installed	Fixed	Advisories
golang.org/x/mod	v0.35.0	0.40.0	CVE-2026-56864, CVE-2026-56865
golang.org/x/net	v0.55.0	0.56.0	CVE-2026-46600
golang.org/x/text	v0.37.0	0.39.0	CVE-2026-56852
google.golang.org/grpc	v1.79.3	1.82.1	GHSA-hrxh-6v49-42gf
stdlib	v1.26.4	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822
stdlib	v1.26.4	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-33818, CVE-2026-39821, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862
stdlib	v1.26.4	1.26.6, 1.27.0-rc.3	CVE-2026-46600

The binary is built with Go stdlib v1.26.4; the stdlib advisories are fixed in 1.26.5/1.26.6.

Ask

Please rebuild and publish the Community Edition binaries with a refreshed Go toolchain (≥ 1.26.6) and updated golang.org/x/mod, golang.org/x/net, golang.org/x/text, and google.golang.org/grpc — i.e. carry the same dependency refresh that #3783 received, into the community build. Downstream users pinning atlas-community-* cannot clear these by moving to the newest community release, since v1.3.2 still carries them.

Thanks for maintaining Atlas.