Tekton

v1.6.3CI/CD & App Delivery

Jun 15, 2026

Tekton v1.6.3 contains resolver validation and behavior corrections, along with fixes affecting cross-architecture execution and metrics. It also updates dependencies, including a gRPC change for `CVE-2026-33186`, so resolver users and dependency-sensitive deployments should review the release.

Action needed (1)

securitycriticalThe google.golang.org/grpc dependency fix for CVE-2026-33186
The google.golang.org/grpc dependency includes a fix for CVE-2026-33186 in v1.6.3.

Check if affected (1)

breakingTekton Resolver target restrictions
Applies if your ResolutionRequest objects use Tekton Resolvers.
Tekton Resolvers now permit ResolutionRequest objects to resolve only StepAction, Task, and Pipeline resources. This restriction ships in v1.6.3.

All 20 other recorded changesvalue changes 15 · fixes 4 · constraints 1

value changes (15)

build(deps): bump the all group in /tekton with 4 updates×6
build(deps): bump the all group across 1 directory with 4 updates×2
bump google.golang.org/grpc from 1.75.0 to 1.75.1
bump go.uber.org/zap from 1.27.0 to 1.27.1
bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5
bump google.golang.org/protobuf from 1.36.10 to 1.36.11
bump github.com/google/cel-go from 0.26.0 to 0.26.1
bump k8s.io/apiextensions-apiserver from 0.32.8 to 0.32.13
bump github.com/cloudevents/sdk-go/v2 from 2.16.1 to 2.16.2

fixes (4)

Fix cross-arch platform command lookup in entrypoint
fix: resolve goroutine leak from unbuffered channels in resolver reconcilers
fix: convert pod latency metric to histogram and remove pod label
fix(pipelinerun): use generateName for anonymous pipeline label

constraints (1)

Allow ResolutionRequests to resolve all Tekton kinds

Add Tekton to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →

Official release note ↗All Tekton releases →