RATATOSKRATATOSK
Sign in

Tekton

v1.9.4CI/CD & App Delivery
Jun 15, 2026

ACTION 1CHECK 1OTHER 24

Release v1.9.4 contains correctness fixes, a security-related dependency update, and compatibility changes in resolver behavior. It also includes broader dependency maintenance and changes to metric behavior.

Action needed (1)

  • securitycriticalgoogle.golang.org/grpc update for CVE-2026-33186

    google.golang.org/grpc is updated from 1.77.0 to 1.79.3 to address CVE-2026-33186, a gRPC-Go authorization bypass involving a missing leading slash in the :path header.

Check if affected (1)

  • breakingTekton Resolvers object-type constraint

    Applies if you use custom resolvers or ResolutionRequest with the Resolver API for object types other than StepActions, Tasks, or Pipelines.

    Tekton Resolvers now reject ResolutionRequest objects that target non-Tekton object types. Resolvers are permitted to resolve only StepActions, Tasks, and Pipelines; requests for other object types fail.

All 24 other recorded changesvalue changes 17 · fixes 6 · additions 1

value changes (17)

  • build(deps): bump the all group in /tekton with 4 updates (#10262)
  • build(deps): bump the all group in /tekton with 4 updates (#10239)
  • build(deps): bump the all group across 1 directory with 4 updates (#10197)
  • build(deps): bump github.com/spiffe/spire-api-sdk from 1.14.6 to 1.14.7 (#10151)
  • build(deps): bump the all group in /tekton with 4 updates (#10131)
  • build(deps): bump the all group in /tekton with 4 updates (#10088)
  • build(deps): bump the all group in /tekton with 4 updates (#10043)
  • build(deps): bump k8s.io/apimachinery from 0.33.11 to 0.33.12 (#10015)
  • build(deps): bump the all group across 1 directory with 4 updates (#9988)
  • build(deps): bump github.com/spiffe/spire-api-sdk from 1.14.0 to 1.14.6 (#9929)
  • build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 (#9917)
  • build(deps): bump k8s.io/apimachinery from 0.33.7 to 0.33.11 (#9916)
  • build(deps): bump github.com/google/go-containerregistry from 0.20.6 to 0.20.8 (#9886)
  • build(deps): bump k8s.io/apiextensions-apiserver from 0.32.11 to 0.32.13 (#9884)
  • build(deps): bump k8s.io/api from 0.32.11 to 0.32.13 (#9879)
  • build(deps): bump k8s.io/client-go from 0.32.11 to 0.32.13 (#9876)
  • build(deps): bump the all group in /tekton with 4 updates (#9862)

fixes (6)

  • fix(resolvers): Allow ResolutionRequests to resolve all Tekton kinds (#10253) efore this change, ResolutionRequests could only resolve Pipelines, Tasks, and StepActions. After this change, ResolutionRequests can resolve PipelineRuns, Pipelines, TaskRuns, Tasks, Runs, CustomRuns, and StepActions.
  • Fix cross-arch platform command lookup in entrypoint (#10163) ix entrypoint command lookup when controller and worker nodes run on different CPU architectures (e.g., ARM controller with AMD64 workloads).
  • fix: surface clear errors when completed tasks miss referenced results (#9973) ipelineRun status now shows which specific results were missing when tasks are skipped due to uninitialized result references from completed tasks. A Warning event with reason ResultValidationFailed is also emitted for consistency with other failure modes.
  • fix: resolve goroutine leak from unbuffered channels in resolver reconcilers (#10112)
  • fix: convert pod latency metric to histogram and remove pod label (#10110)
  • fix(pipelinerun): use generateName for anonymous pipeline label (#10108)

additions (1)

  • fix: add automated draft release support to release pipeline (#10214)
Add Tekton to your stack

A weekly email arrives when a release needs action. Like the security patches and breaking changes in this release.

Add to stack →
Official release note ↗All Tekton releases →