Repository: runatlantis/atlantis (language: go)

Issue:
Trivy reporting vulnerabilities in Debian-based image `v0.33.0-debian`
We're running Atlantis internally and have a policy to scan all of our images for vulnerabilities.

This is the `trivy` command we're using.
```
docker run --rm aquasec/trivy image \
  --report all \
  --table-mode summary \
  --db-repository public.ecr.aws/aquasecurity/trivy-db \
  --java-db-repository public.ecr.aws/aquasecurity/trivy-java-db \
  --checks-bundle-repository ghcr.io/aquasecurity/trivy-checks\
  ghcr.io/runatlantis/atlantis:v0.33.0-debian
```

These are the results. This is a summary view, but there is a more detailed view with specific CVEs.
```
┌───────────────────────────────────────────────────────────┬──────────┬─────────────────┬─────────┐
│                          Target                           │   Type   │ Vulnerabilities │ Secrets │
├───────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ ghcr.io/runatlantis/atlantis:v0.33.0-debian (debian 12.8) │  debian  │       184       │    -    │
├───────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/bin/git-lfs                                           │ gobinary │        5        │    -    │
├───────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/atlantis                                    │ gobinary │        1        │    -    │
├───────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/conftest                                    │ gobinary │        5        │    -    │
├───────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/terraform                                   │ gobinary │        5        │    -    │
├───────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/terraform1.10.5                             │ gobinary │        5        │    -    │
├───────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/terraform1.8.5                              │ gobinary │       18        │    -    │
├───────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/terraform1.9.8                              │ gobinary │        7        │    -    │
├───────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/tofu                                        │ gobinary │        5        │    -    │
├───────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ usr/local/bin/tofu1.8.8                                   │ gobinary │        5        │    -    │
├───────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ /etc/ssh/ssh_host_ecdsa_key                               │   text   │        -        │    1    │
├───────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ /etc/ssh/ssh_host_ed25519_key                             │   text   │        -        │    1    │
├───────────────────────────────────────────────────────────┼──────────┼─────────────────┼─────────┤
│ /etc/ssh/ssh_host_rsa_key                                 │   text   │        -        │    1    │
└───────────────────────────────────────────────────────────┴──────────┴─────────────────┴─────────┘
```

I'm aware that most of the Debian-based vulnerabilities are dependent on your upstream (i.e., Debian) fixing them. Internally, we're required to open tickets to our upstream (i.e., here) for vulnerabilities.

There is a newer 12.9 version of Debian than the one being used [here](https://github.com/runatlantis/atlantis/blob/main/Dockerfile#L4), which is from [December 2024](https://hub.docker.com/layers/library/debian/12.8-slim/images/sha256-04ff2dd0c6a3a6e55a7b4b90b43b8ec601efc448965bbd4cd2d5200711713d4d?context=explore). Can this be updated?



Discussion / hints:
This is a community project @lmarchione-r7. You are more than welcome to investigate what would be required to update this and raise a PR yourself rather than expecting somebody else to do it. 

Fix patch:
diff --git a/Dockerfile b/Dockerfile
index aa361369c0..f1db5f562b 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile:1@sha256:4c68376a702446fc3c79af22de146a148bc3367e73c25a5803d453b6b3f722fb
 # what distro is the image being built for
 ARG ALPINE_TAG=3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c
-ARG DEBIAN_TAG=12.8-slim@sha256:d365f4920711a9074c4bcd178e8f457ee59250426441ab2a5f8106ed8fe948eb
+ARG DEBIAN_TAG=12.9-slim@sha256:12c396bd585df7ec21d5679bb6a83d4878bc4415ce926c9e5ea6426d23c60bdc
 ARG GOLANG_TAG=1.24.1-alpine@sha256:43c094ad24b6ac0546c62193baeb3e6e49ce14d3250845d166c77c25f64b0386
 
 # renovate: datasource=github-releases depName=hashicorp/terraform versioning=hashicorp


Test patch: