RATATOSKRATATOSK
Sign in

Tekton

v1.17.0CI/CD & App Delivery
Oct 1, 2026

ACTION 1OTHER 28

A feature and maintenance release that adds opt-in observability and parameter support. It also corrects several issues, including a Windows script-injection defense gap, and refreshes dependencies.

Action needed (1)

  • securityThe placeScriptInContainer PowerShell here-string handling is corrected

    The Windows script-injection defense-in-depth gap is fixed: placeScriptInContainer now uses a non-expandable PowerShell here-string, so a script body containing a literal "@ line cannot terminate the generated command early. This correction ships in the release.

All 28 other recorded changesvalue changes 20 · fixes 4 · additions 2 · removals 1 · renames 1

value changes (20)

  • Add a reconcile.write_intent attribute (no-op, status-only, metadata-only, metadata-and-status) to PipelineRun and TaskRun reconcile spans so operators can distinguish reconciliations that intend an etcd write.
  • build(deps): bump the kubernetes group with 5 updates
  • build(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0
  • build(deps): bump github.com/spiffe/go-spiffe/v2 from 2.8.1 to 2.8.2
  • build(deps): bump the sigstore group with 5 updates
  • build(deps): bump github.com/jenkins-x/go-scm from … to …×2
  • build(deps): bump the all group in /tekton with 4 updates
  • build(deps): bump the all group in /tekton with 6 updates
  • build(deps): bump golang.org/x/crypto from … to …×2
  • build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/aws from 1.10.9 to 1.10.10
  • build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/gcp from 1.10.9 to 1.10.10
  • build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/hashivault from 1.10.9 to 1.10.10
  • build(deps): bump github.com/sigstore/sigstore from 1.10.9 to 1.10.10
  • build(deps): bump github.com/sigstore/sigstore/pkg/signature/kms/azure from 1.10.9 to 1.10.10
  • build(deps): bump golang.org/x/sync from 0.22.0 to 0.23.0
  • build(deps): bump github.com/prometheus/common from 0.70.1 to 0.71.0
  • build(deps): bump github.com/google/go-containerregistry from … to …×2

fixes (4)

  • Before this update, when resolver fails to get any task, controller showed the error message without containing the task name which was hard to detect which one is failed or having bad resolution config. Now task name is added to the error message from template.
  • Pipelines can now reference $(tt.params.<name>) in task params, when expressions, and matrix params/includes. This lets a PipelineSpec embedded by Tekton Triggers keep its tt.params.* substitutions without failing pipeline validation.
  • Resolvers no longer fail ResolutionRequests belonging to a different resolver after a leader election or a resolver pod restart.
  • Fixed controller startup panic messages that printed a malformed %!w(...) marker instead of the underlying error when an informer event handler failed to register.

additions (2)

  • Gated behind the new surface-pod-events alpha feature flag (disabled by default).
  • feat(tracing): tag TaskRun ReconcileKind span on cancel/timeout

removals (1)

  • Eliminate discontinued gopkg.in/yaml.v3 library

renames (1)

  • deps: use new import path for google/cel-go lib
Add Tekton to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →
Official release note ↗All Tekton releases →