cloudposse
diff --git a/‎.github/workflows/dependency-review.yml‎
Lines changed: 39 additions & 16 deletions b/‎.github/workflows/dependency-review.yml‎
Lines changed: 39 additions & 16 deletions
diff --git a/‎docs/fixes/2026-07-30-dag-concurrent-map-crash.md‎
Lines changed: 70 additions & 0 deletions b/‎docs/fixes/2026-07-30-dag-concurrent-map-crash.md‎
Lines changed: 70 additions & 0 deletions
diff --git a/‎internal/exec/describe_stacks_component_processor.go‎
Lines changed: 11 additions & 0 deletions b/‎internal/exec/describe_stacks_component_processor.go‎
Lines changed: 11 additions & 0 deletions
diff --git a/‎internal/exec/process_stacks_builder_errors_test.go‎
Lines changed: 132 additions & 0 deletions b/‎internal/exec/process_stacks_builder_errors_test.go‎
Lines changed: 132 additions & 0 deletions
@@ -65,26 +65,49 @@ jobs:
           # currently the latest tagged v2 release. Remove after Helm/ORAS ships a
           # fixed version for GHSA-fxhp-mv3v-67qp.
           #
-          # Temporary allowlist: brace-expansion's advisory (GHSA-mh99-v99m-4gvg /
-          # CVE-2026-14257) lists "<=5.0.7" as vulnerable and "5.0.8" as the first
-          # patched version, but that range predates the maintainer's later
-          # backport of the same EXPANSION_MAX_LENGTH fix into the 1.x/2.x lines
-          # (verified by unpacking the exact 1.1.18/2.1.4 tarballs pinned -- no
-          # `^` range -- in website/package.json's pnpm overrides: the fix is
-          # present, and the `module.exports = expandTop` callable export is
-          # unchanged). Jumping to 5.0.8+ is not an option: its CommonJS build
-          # switched to a named `exports.expand` export, which breaks the
-          # `require('brace-expansion')` usage in minimatch@3.1.5/9.0.9.
+          # GHSA-mh99-v99m-4gvg (brace-expansion, CVE-2026-14257): the advisory's
+          # recorded vulnerable range ("<=5.0.7") doesn't distinguish between
+          # brace-expansion's parallel 1.x/2.x/5.x release lines, so it still flags
+          # our pinned 1.1.18/2.1.4 even though both contain the same
+          # EXPANSION_MAX_LENGTH bound backported from the 5.0.8 fix (verified by
+          # diffing the published tarballs). The only version the advisory
+          # recognizes as patched, 5.0.8+, is not a safe upgrade here: brace-expansion
+          # 5.x's CommonJS build changed from a callable default export
+          # (`module.exports = expand`) to a named export (`exports.expand`), which
+          # breaks minimatch@3.1.5's `require('brace-expansion')(...)` call
+          # convention (transitive via serve-handler/@docusaurus/core).
+          #
+          # This is a known, already-closed-as-wontfix situation upstream, not
+          # something fixable from this repo: see isaacs/minimatch#314 and #310.
+          # The ReDoS fix was backported into brace-expansion's 1.x/2.x lines, but
+          # minimatch's maintainer declined to bump the older 3.x/5.x/8.x/9.x
+          # release lines to brace-expansion 5.x, since those lines exist to
+          # support CJS-only consumers. minimatch's current release (10.2.6) does
+          # depend on brace-expansion ^5.0.8 (the patched line the advisory
+          # recognizes), but nothing in our tree can reach it: serve-handler@6.1.7
+          # (used by @docusaurus/core for `docusaurus serve`) still hard-pins
+          # minimatch to 3.1.5, and everything else here resolves minimatch@9.0.9,
+          # which depends on brace-expansion ^2.0.1.
           #
           # NOTE: allow-ghsas suppresses this GHSA for every resolved
           # brace-expansion version, not just 1.1.18/2.1.4 -- the action has no
           # package/version-scoped vulnerability exception (only
-          # allow-dependencies-licenses is purl-scoped, and that's license-only).
-          # The exact (non-`^`) pnpm override pins are what keep this exception
-          # scoped in practice: revisit this entry if those pins ever change.
-          # Remove once GitHub's advisory data reflects the backport, or once
-          # minimatch ships a version compatible with brace-expansion 5.x's
-          # export shape.
+          # allow-dependencies-licenses is purl-scoped, and that's license-only),
+          # and dependency-review-action has no SARIF/code-scanning output either,
+          # so this is the only suppression mechanism it offers -- not a
+          # workaround chosen over some cleaner supported path. The scoping that
+          # exists is the exact override values in website/package.json's
+          # pnpm.overrides (`brace-expansion@^1`/`@^2` selectors pinned to the
+          # exact "1.1.18"/"2.1.4", not a range).
+          #
+          # Remove this entry once either: GHSA-mh99-v99m-4gvg's advisory data is
+          # corrected to distinguish brace-expansion's 1.x/2.x/5.x release lines
+          # (see https://github.com/advisories/GHSA-mh99-v99m-4gvg for a
+          # firstPatchedVersion per major line instead of one "<=5.0.7" range), or
+          # serve-handler and whatever still depends on minimatch@9.0.9 both move
+          # to a minimatch version that depends on brace-expansion ^5 -- at that
+          # point also remove the brace-expansion overrides in
+          # website/package.json.
           allow-ghsas: GHSA-fxhp-mv3v-67qp, GHSA-mh99-v99m-4gvg
 
           # Comment on PR with details
 
@@ -0,0 +1,70 @@
+# Fix: DAG-scheduled bulk terraform commands crash with `concurrent map iteration and map write`
+
+**Date:** 2026-07-30
+
+## Summary
+
+Users running DAG-scheduled bulk terraform commands (`terraform <cmd> --all`, `--affected`, `--query`) with
+`--max-concurrency` set above 1 could hit a fatal `concurrent map iteration and map write` crash. The crash
+went away at low concurrency, which was the tell: it was a data race, not a logic bug. Fixed by shallow-cloning
+the shared, cached component-config map before any downstream code mutates it.
+
+## Context
+
+`FindStacksMap` (`internal/exec/utils.go`) caches fully-processed stack config in a package-global map and,
+on a cache hit, returns the cached tree **by reference**. The guarding `RWMutex` protects only the cache
+lookup, not the nested maps it hands out.
+
+`ProcessComponentConfig` then extracted a component's section from that shared tree and assigned it (and its
+sub-sections) directly into the per-node `ConfigAndStacksInfo`, still aliasing the cache. Two things wrote into
+that shared section:
+
+- `ProcessStacks` injecting `atmos_component`, `atmos_stack`, `workspace`, `sources`, `deps`, `deps_all`, etc.
+- `mergeGlobalAuthConfig`, which installs the merged `auth` section — and runs once per candidate stack, not
+  just the eventual winner.
+
+Meanwhile, `findComponentInStacks` makes every DAG worker evaluate the target component in *every* stack
+(not just its own), iterating each candidate's shared section along the way (env-filter loop, `componentConfigsEqual`
+deep-compare, template-context range, `ConvertToYAMLPreservingDelimiters` walk). With `--max-concurrency > 1`,
+the scheduler (`pkg/scheduler`) runs these workers concurrently, so one worker's write into a shared section
+raced with another worker's read/iteration of that same section — the exact crash reported.
+
+The describe-stacks processor (`internal/exec/describe_stacks_component_processor.go`) already had one instance
+of the same class of bug fixed via a documented shallow clone; the audit for this fix found two further
+un-cloned in-place deletes there that corrupt the cache for later callers in the same process (not part of the
+crash itself, since describe runs during the serial planning phase, but a real bug once the cache is polluted).
+
+## Changes
+
+- `internal/exec/utils.go`: `ProcessComponentConfig` now shallow-clones (`maps.Clone`) the extracted component
+  section immediately after extraction, before any sub-section derivation, `mergeGlobalAuthConfig`, or later
+  mutation. All top-level writers now land on a private clone instead of the cache's own map. Documented the
+  sharing contract on `FindStacksMap`'s doc comment (returned maps are shared by reference on a cache hit and
+  must be treated as read-only).
+- `internal/exec/describe_stacks_component_processor.go`: applied the same shallow-clone-before-mutate fix to
+  two adjacent sites that deleted keys (`imports`, `terraform_workspace_pattern`/`terraform_workspace_template`)
+  from cache-owned maps in place.
+- `internal/exec/process_stacks_shared_cache_test.go` (new): two regression tests —
+  `TestProcessStacksDoesNotMutateSharedStacksMapCache` (deterministic snapshot-equality check against the cache,
+  no race detector required) and `TestProcessStacksConcurrentSharedCacheAccess` (16 goroutines running
+  `ProcessStacks` across two stacks that share a component, reproducing the production interleaving under
+  `-race`).
+
+## Validation
+
+- `go test ./internal/exec -run TestProcessStacksDoesNotMutateSharedStacksMapCache -count=1` — confirmed FAIL
+  before the fix (cache polluted with `atmos_component`/`workspace`/etc.), PASS after.
+- `go test -race ./internal/exec -run TestProcessStacksConcurrentSharedCacheAccess -count=1` — confirmed FAIL
+  (data race reported) before the fix, PASS after.
+- `go build ./...` — clean.
+- `go test ./internal/exec ./pkg/scheduler/... -count=1` — all pass (includes existing describe-stacks golden
+  snapshot tests, confirming the two hardening clones don't change output).
+- `atmos lint --changed` — 0 issues.
+- `atmos test` (full suite): the `tests` package hit an unrelated, pre-existing local-only hang — this sandbox's
+  podman auto-boots a vfkit VM during an emulator-preflight CLI test when Docker isn't running, which doesn't
+  happen in CI (Docker present there). Verified pre-existing on this machine in a prior session; `pkg/container`
+  is untouched by this change.
+
+## Follow-ups
+
+None.
@@ -4,6 +4,7 @@ package exec
 import (
 	"errors"
 	"fmt"
+	"maps"
 	"slices"
 	"strings"
 
@@ -259,6 +260,11 @@ func (p *describeStacksProcessor) processStackFile(stackFileName string, stackMa
 	stackManifestName := getStackManifestName(stackMap)
 
 	// Delete the stack-wide imports section (not needed in output).
+	// Shallow-clone first: stackMap is owned by the shared FindStacksMap cache, and
+	// deleting from it in place would strip `imports` (and thus `deps`) from every
+	// subsequent ProcessStacks call in the same process (e.g., DAG-scheduled bulk
+	// commands, which run ExecuteDescribeStacks before executing components).
+	stackMap = maps.Clone(stackMap)
 	delete(stackMap, "imports")
 
 	// When includeEmptyStacks is true, pre-create an entry in the result map so that
@@ -974,6 +980,11 @@ func applyTerraformMetadataInheritance(
 	// regardless of whether an inherit list is present.  This matches the original behaviour:
 	// the cleanup ran unconditionally (outside the inheritList guard) in the old monolith.
 	if _, hasExplicitWorkspace := metadataSection["terraform_workspace"].(string); hasExplicitWorkspace {
+		// Shallow-clone first: unless the inheritance merge above already produced a
+		// fresh map, metadataSection aliases the nested metadata map owned by the
+		// shared FindStacksMap cache, and deleting from it in place would corrupt the
+		// cache for every subsequent caller in the same process.
+		metadataSection = maps.Clone(metadataSection)
 		delete(metadataSection, "terraform_workspace_pattern")
 		delete(metadataSection, "terraform_workspace_template")
 	}
 
@@ -0,0 +1,132 @@
+package exec
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	cfg "github.com/cloudposse/atmos/pkg/config"
+	"github.com/cloudposse/atmos/pkg/schema"
+)
+
+// writeMinimalStackFixture writes a minimal atmos.yaml plus a single stack
+// manifest into the current directory (expected to already be a t.TempDir()),
+// enough for ProcessStacks to resolve component config without needing real
+// component/terraform files.
+func writeMinimalStackFixture(t *testing.T, atmosYAML, stackYAML string) {
+	t.Helper()
+
+	require.NoError(t, os.WriteFile("atmos.yaml", []byte(atmosYAML), 0o644))
+	require.NoError(t, os.MkdirAll("stacks", 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join("components", "terraform", "mock"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join("stacks", "dev.yaml"), []byte(stackYAML), 0o644))
+}
+
+// TestProcessStacksPropagatesSpaceliftStackNameBuildError verifies that
+// ProcessStacks surfaces an error when BuildSpaceliftStackNameFromComponentConfig
+// fails, instead of silently ignoring it.
+//
+// The fixture needs a `name_pattern` (so the Directory-branch ContextPrefix
+// computation, which only consults the pattern, succeeds) and an `http` backend
+// (so BuildTerraformWorkspace short-circuits on `isWorkspacesEnabled` before its
+// own, separate `NameTemplate` check). `NameTemplate` is poisoned only after
+// InitCliConfig, so it never affects the stack file discovery that InitCliConfig
+// itself performs — only BuildSpaceliftStackNameFromComponentConfig's later,
+// independent `ProcessTmpl` call sees the malformed value.
+func TestProcessStacksPropagatesSpaceliftStackNameBuildError(t *testing.T) {
+	t.Chdir(t.TempDir())
+	t.Setenv("ATMOS_CLI_CONFIG_PATH", ".")
+
+	require.NoError(t, os.WriteFile("atmos.yaml", []byte(`
+base_path: "./"
+stacks:
+  base_path: stacks
+  included_paths:
+    - "**/*"
+  name_pattern: "{stage}"
+components:
+  terraform:
+    base_path: components/terraform
+`), 0o644))
+	require.NoError(t, os.MkdirAll(filepath.Join("stacks", "dev"), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join("components", "terraform", "mock"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join("stacks", "dev", "main.yaml"), []byte(`
+vars:
+  stage: dev
+components:
+  terraform:
+    mock:
+      backend_type: http
+      settings:
+        spacelift:
+          workspace_enabled: true
+      vars:
+        stage: dev
+`), 0o644))
+
+	info := schema.ConfigAndStacksInfo{
+		ComponentFromArg: "mock",
+		Stack:            "dev/main",
+		ComponentType:    cfg.TerraformComponentType,
+	}
+	atmosConfig, err := cfg.InitCliConfig(info, true)
+	require.NoError(t, err)
+	require.Equal(t, "Directory", atmosConfig.StackType)
+
+	atmosConfig.Stacks.NameTemplate = "{{ .vars.broken"
+
+	ClearFindStacksMapCache()
+	t.Cleanup(ClearFindStacksMapCache)
+
+	_, err = ProcessStacks(&atmosConfig, info, true, true, false, nil, nil)
+	require.ErrorContains(t, err, "unclosed action")
+}
+
+// TestProcessStacksPropagatesAtlantisProjectNameBuildError verifies that
+// ProcessStacks surfaces an error when BuildAtlantisProjectNameFromComponentConfig
+// fails to decode `settings.atlantis.project_template` (a string where a bool
+// field is expected), instead of silently ignoring it.
+func TestProcessStacksPropagatesAtlantisProjectNameBuildError(t *testing.T) {
+	t.Chdir(t.TempDir())
+	t.Setenv("ATMOS_CLI_CONFIG_PATH", ".")
+
+	writeMinimalStackFixture(t, `
+base_path: "./"
+stacks:
+  base_path: stacks
+  included_paths:
+    - "**/*"
+components:
+  terraform:
+    base_path: components/terraform
+`, `
+vars:
+  stage: dev
+components:
+  terraform:
+    mock:
+      settings:
+        atlantis:
+          project_template:
+            name: "mock-project"
+            delete_source_branch_on_merge: "not-a-bool"
+      vars:
+        stage: dev
+`)
+
+	info := schema.ConfigAndStacksInfo{
+		ComponentFromArg: "mock",
+		Stack:            "dev",
+		ComponentType:    cfg.TerraformComponentType,
+	}
+	atmosConfig, err := cfg.InitCliConfig(info, true)
+	require.NoError(t, err)
+
+	ClearFindStacksMapCache()
+	t.Cleanup(ClearFindStacksMapCache)
+
+	_, err = ProcessStacks(&atmosConfig, info, true, true, false, nil, nil)
+	require.ErrorContains(t, err, "delete_source_branch_on_merge")
+}