Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: TektonClear ×

Tektonv1.6.5CI/CD & App DeliveryJul 8, 2026

ACTION 1View full analysis

This is a maintenance release centered on a Go dependency update for CVE remediation. The change is operator-facing.

Action needed (1)

securityGo 1.25.10 dependency update
Go is updated to 1.25.10 for CVE remediation in this release.

Source ↗

Tektonv1.9.6CI/CD & App DeliveryJul 8, 2026

ACTION 3View full analysis

Tekton v1.9.6 contains dependency updates for CVE remediation. The release affects Go and two golang.org packages, with no specific advisory identifiers or vulnerability details in the note.

Action needed (3)

securityGo 1.25.10 update
Go is updated to 1.25.10 for CVE remediation in v1.9.6.
securitygolang.org/x/crypto v0.52.0 update
golang.org/x/crypto is updated to v0.52.0 for CVE remediation in v1.9.6.
securitygolang.org/x/net v0.55.0 update
golang.org/x/net is updated to v0.55.0 for CVE remediation in v1.9.6.

Source ↗

Tektonv1.14.0CI/CD & App DeliveryJun 30, 2026

ACTION 1OTHER 37View full analysis

Release v1.14.0 adds tracing and observability capabilities and broadens ResolutionRequest resolution support. It also includes correctness fixes, a Go security-related update, and shipped dependency updates.

Action needed (1)

securityGo 1.26.4 update
Go is updated to 1.26.4 in v1.14.0 for CVE remediation.

Source ↗

Tektonv1.9.4CI/CD & App DeliveryJun 15, 2026

ACTION 1CHECK 1OTHER 24View full analysis

A maintenance release with correctness fixes, a security-relevant dependency update, resolver compatibility constraints, metric behavior changes, and additional dependency upgrades. The changes include a restriction on the object types handled by Tekton Resolvers and an update to gRPC.

Action needed (1)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3 for CVE-2026-33186
The google.golang.org/grpc dependency is updated from 1.77.0 to 1.79.3 to fix CVE-2026-33186, an authorization bypass caused by a missing leading slash in the :path header.

Check if affected (1)

breakingTekton Resolvers, limited to supported object types
Applies if you use the Resolver API.
Resolving a non-Tekton object now causes ResolutionRequest to fail. Tekton Resolvers only resolve StepActions, Tasks, and Pipelines; custom resolvers or ResolutionRequest users of the Resolver API for other object types no longer function.

Source ↗

Tektonv1.6.3CI/CD & App DeliveryJun 15, 2026

ACTION 1CHECK 1OTHER 20View full analysis

Tekton v1.6.3 contains resolver validation and behavior corrections, along with fixes affecting cross-architecture execution and metrics. It also updates dependencies, including a gRPC change for CVE-2026-33186, so resolver users and dependency-sensitive deployments should review the release.

Action needed (1)

securitycriticalThe google.golang.org/grpc dependency fix for CVE-2026-33186
The google.golang.org/grpc dependency includes a fix for CVE-2026-33186 in v1.6.3.

Check if affected (1)

breakingTekton Resolver target restrictions
Applies if your ResolutionRequest objects use Tekton Resolvers.
Tekton Resolvers now permit ResolutionRequest objects to resolve only StepAction, Task, and Pipeline resources. This restriction ships in v1.6.3.

Source ↗

Browse by month