Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Jun 2026Clear ×Project: TektonClear ×

Tektonv1.13.1CI/CD & App DeliveryJun 15, 2026

CHECK 1OTHER 3View full analysis

A maintenance release with defect corrections and a behavior change affecting implicit resource settings for internal containers. No security advisories are disclosed.

Check if affected (1)

breakingDefault resource requirements for internal containers are removed
Applies if you do not set default-container-resource-requirements.
Tekton no longer applies default resource requests or limits to the internal containers prepare, place-scripts, working-dir-initializer, and sidecar-tekton-log-results when default-container-resource-requirements is unset.

Source ↗

Tektonv1.12.1CI/CD & App DeliveryJun 15, 2026

CHECK 1OTHER 29View full analysis

A maintenance release with several correctness fixes and multiple dependency updates. Resolver behavior is narrowed so that only StepActions, Tasks, and Pipelines can be resolved, which requires review for users of Tekton Resolvers.

Check if affected (1)

breakingTekton Resolver object restrictions
Applies if you use Tekton Resolvers.
ResolutionRequest now fails when a resolver targets a non-Tekton object or arbitrary data. Tekton Resolvers are permitted to resolve only StepActions, Tasks, and Pipelines.

Source ↗

Tektonv1.9.4CI/CD & App DeliveryJun 15, 2026

ACTION 1CHECK 1OTHER 24View full analysis

A maintenance release with correctness fixes, a security-relevant dependency update, resolver compatibility constraints, metric behavior changes, and additional dependency upgrades. The changes include a restriction on the object types handled by Tekton Resolvers and an update to gRPC.

Action needed (1)

securitycriticalgoogle.golang.org/grpc updated to 1.79.3 for CVE-2026-33186
The google.golang.org/grpc dependency is updated from 1.77.0 to 1.79.3 to fix CVE-2026-33186, an authorization bypass caused by a missing leading slash in the :path header.

Check if affected (1)

breakingTekton Resolvers, limited to supported object types
Applies if you use the Resolver API.
Resolving a non-Tekton object now causes ResolutionRequest to fail. Tekton Resolvers only resolve StepActions, Tasks, and Pipelines; custom resolvers or ResolutionRequest users of the Resolver API for other object types no longer function.

Source ↗

Tektonv1.6.3CI/CD & App DeliveryJun 15, 2026

ACTION 1CHECK 1OTHER 20View full analysis

Tekton v1.6.3 contains resolver validation and behavior corrections, along with fixes affecting cross-architecture execution and metrics. It also updates dependencies, including a gRPC change for CVE-2026-33186, so resolver users and dependency-sensitive deployments should review the release.

Action needed (1)

securitycriticalThe google.golang.org/grpc dependency fix for CVE-2026-33186
The google.golang.org/grpc dependency includes a fix for CVE-2026-33186 in v1.6.3.

Check if affected (1)

breakingTekton Resolver target restrictions
Applies if your ResolutionRequest objects use Tekton Resolvers.
Tekton Resolvers now permit ResolutionRequest objects to resolve only StepAction, Task, and Pipeline resources. This restriction ships in v1.6.3.

Source ↗

Tektonv1.3.5CI/CD & App DeliveryJun 15, 2026

ACTION 1CHECK 1OTHER 22View full analysis

A correctness-focused release fixes resolver behavior and updates dependencies. It also narrows the resolver input contract and changes pod metrics and labels.

Action needed (1)

breakingPod label removal
The pod label is removed in this release.

Check if affected (1)

breakingThe Resolver API resolution scope
Applies if you use custom resolvers and the Resolver API.
Tekton Resolvers now resolve only StepActions, Tasks, and Pipelines. Custom resolvers or ResolutionRequest objects that use the Resolver API for other object types no longer function.

Source ↗

Browse by month