This is a maintenance release centered on a Go dependency update for CVE remediation. The change is operator-facing.
Action needed (1)
security
Go1.25.10 dependency updateGois updated to1.for CVE remediation in this release.25. 10
Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
Jul 2026Clear ×
Tekton v1.9.6 contains dependency updates for CVE remediation. The release affects Go and two golang. packages, with no specific advisory identifiers or vulnerability details in the note.
Action needed (3)
security
Go1.25.10 updateGois updated to1.for CVE remediation in v1.9.6.25. 10 security
golang.v0.52.0 updateorg/x/crypto golang.is updated toorg/x/crypto v0.for CVE remediation in v1.9.6.52. 0 security
golang.v0.55.0 updateorg/x/net golang.is updated toorg/x/net v0.for CVE remediation in v1.9.6.55. 0
A maintenance release with a forced internal PostgreSQL major-version upgrade, a redis to valkey cache backend replacement, dependency and component updates, and defect corrections. Token and blob-mount validation is hardened.
Action needed (1)
securityToken and blob-mount source validation
Blob-mount source projects are validated, and tokens without
iatare rejected.
Check if affected (2)
breakingThe bundled
PostgreSQLversion, upgradedApplies if you use
PostgreSQL.breakingThe cache backend, changed from
redistovalkeyApplies if you use
redis.
A maintenance release with authentication and certificate-revocation enforcement fixes, Go toolchain and dependency updates, and a new v2 deprecation option. The security-related changes include fixes and dependency updates associated with the listed advisories.
Action needed (2)
securityhigh
go.dependencies, updated toopentelemetry. io/otel v1.43. 0 The
go.andopentelemetry. io/otel go.dependencies are updated fromopentelemetry. io/otel/sdk v1.to40. 0 v1.. The updates address CVE-2026-29181 and CVE-2026-39883.43. 0 securityhigh
golang., updated toorg/x/crypto v0.52. 0 The
golang.dependency is updated toorg/x/crypto v0.. The change is associated with CVE-2026-39828, CVE-2026-39835, CVE-2026-46597, and CVE-2026-46598.52. 0
Check if affected (1)
securityCRL enforcement bypass on the gRPC listener, fixed
Applies if
--listen-client-http-urlsis configured.
A maintenance release with server configuration, access control, authentication, validation, logging, and dependency updates. Deployments using the affected listener configuration or OpenTelemetry dependencies are directly concerned by the included fixes.
Action needed (1)
securityhighOpenTelemetry dependencies updated for CVE-2026-29181 and CVE-2026-39883
go.andopentelemetry. io/otel go.were updated fromopentelemetry. io/otel/sdk v1.to40. 0 v1.. The updates address CVE-2026-29181 and CVE-2026-39883.43. 0
Check if affected (1)
securityCRL enforcement with
--listen-client-http-urlsApplies if
--listen-client-http-urlsis configured.
A long-term support release with security-related dependency updates, PromQL changes, new APIs and configuration controls, and bug fixes. It also replaces a shipped license artifact and includes performance improvements.
Action needed (2)
securitycriticalThe
sanitize-htmldependency updateThe UI updates
sanitize-htmlto address a cross-site scripting vulnerability, identified as CVE-2026-44990.breakingThe third-party license artifact
Third-party npm dependency licenses are embedded in the Prometheus binary and served at
/assets/third-party-licenses.. This replaces thetxt npm_licenses.archive previously shipped in release tarballs and container images.tar. bz2
Check if affected (2)
securitymediumRedirect credential forwarding
Applies if you use scraping, remote read/write, alerting, or service discovery.
breakingPromQL duration-expression function names
Applies if you enable
experimental-duration-exprand usemin()andmax().
← NewerJul 8, 2026 – Jul 1, 2026