Tekton v1.15.0 adds configurable behavior, corrects defects across controllers and runtime components, and updates project dependencies. No security advisories or explicitly described vulnerabilities are present.
Source ↗Releases
AI-analyzed release notes for CNCF graduated and incubating projects.
Project: TektonClear ×
This release contains an operator-facing defect correction. The remaining release-note content consists of headings, installation guidance, or attestation instructions rather than additional software changes.
Source ↗A maintenance release fixes pipeline validation so $(results. references are accepted in Pipeline task parameters. Nothing else described requires operator attention.
This is a maintenance release centered on a Go dependency update for CVE remediation. The change is operator-facing.
Action needed (1)
security
Go1.25.10 dependency updateGois updated to1.for CVE remediation in this release.25. 10
Tekton v1.9.6 contains dependency updates for CVE remediation. The release affects Go and two golang. packages, with no specific advisory identifiers or vulnerability details in the note.
Action needed (3)
security
Go1.25.10 updateGois updated to1.for CVE remediation in v1.9.6.25. 10 security
golang.v0.52.0 updateorg/x/crypto golang.is updated toorg/x/crypto v0.for CVE remediation in v1.9.6.52. 0 security
golang.v0.55.0 updateorg/x/net golang.is updated toorg/x/net v0.for CVE remediation in v1.9.6.55. 0
Release v1.14.0 adds tracing and observability capabilities and broadens ResolutionRequest resolution support. It also includes correctness fixes, a Go security-related update, and shipped dependency updates.
Action needed (1)
security
Go1.update26. 4 Gois updated to1.in v1.14.0 for CVE remediation.26. 4
A maintenance release fixes the release pipeline by adding automated draft release support. It contains no other operator-facing product changes.
Source ↗A maintenance release updates k8s. from 0. to 0.. The remaining release material does not describe a distinct operator-facing change.
Tekton v1.3.6 contains dependency update batches, with no functional or security changes described. The release material also includes installation instructions and attestation or verification metadata.
Source ↗Nothing here needs operator attention. The release notes contain installation, attestation, and verification instructions, along with empty section headings, but no described product changes.
Source ↗A maintenance release with three dependency updates, including an update to k8s. from 0.33.12 to 0.33.13. Nothing else in the release requires operator attention.
A maintenance release with defect corrections and a behavior change affecting implicit resource settings for internal containers. No security advisories are disclosed.
Check if affected (1)
breakingDefault resource requirements for internal containers are removed
Applies if you do not set
default-container-resource-requirements.Tekton no longer applies default resource requests or limits to the internal containers
prepare,place-scripts,working-dir-initializer, andsidecar-tekton-log-resultswhendefault-container-resource-requirementsis unset.
A maintenance release with several correctness fixes and multiple dependency updates. Resolver behavior is narrowed so that only StepActions, Tasks, and Pipelines can be resolved, which requires review for users of Tekton Resolvers.
Check if affected (1)
breakingTekton Resolver object restrictions
Applies if you use
Tekton Resolvers.ResolutionRequestnow fails when a resolver targets a non-Tekton object or arbitrary data.Tekton Resolversare permitted to resolve onlyStepActions,Tasks, andPipelines.
Nothing here needs operator attention.
Source ↗A maintenance release with correctness fixes, a security-relevant dependency update, resolver compatibility constraints, metric behavior changes, and additional dependency upgrades. The changes include a restriction on the object types handled by Tekton Resolvers and an update to gRPC.
Action needed (1)
securitycritical
google.updated to 1.79.3 for CVE-2026-33186golang. org/grpc The
google.dependency is updated from 1.77.0 to 1.79.3 to fix CVE-2026-33186, an authorization bypass caused by a missing leading slash in thegolang. org/grpc :pathheader.
Check if affected (1)
breakingTekton Resolvers, limited to supported object types
Applies if you use the
Resolver API.Resolving a non-Tekton object now causes
ResolutionRequestto fail.Tekton Resolversonly resolveStepActions,Tasks, andPipelines; custom resolvers orResolutionRequestusers of theResolver APIfor other object types no longer function.
Tekton v1.6.3 contains resolver validation and behavior corrections, along with fixes affecting cross-architecture execution and metrics. It also updates dependencies, including a gRPC change for CVE-2026-33186, so resolver users and dependency-sensitive deployments should review the release.
Action needed (1)
securitycriticalThe
google.dependency fix for CVE-2026-33186golang. org/grpc The
google.dependency includes a fix for CVE-2026-33186 in v1.6.3.golang. org/grpc
Check if affected (1)
breakingTekton Resolver target restrictions
Applies if your
ResolutionRequestobjects use Tekton Resolvers.Tekton Resolvers now permit
ResolutionRequestobjects to resolve onlyStepAction,Task, andPipelineresources. This restriction ships in v1.6.3.
A correctness-focused release fixes resolver behavior and updates dependencies. It also narrows the resolver input contract and changes pod metrics and labels.
Action needed (1)
breakingPod label removal
The pod label is removed in this release.
Check if affected (1)
breakingThe
Resolver APIresolution scopeApplies if you use custom resolvers and the
Resolver API.Tekton Resolversnow resolve onlyStepActions,Tasks, andPipelines. Custom resolvers orResolutionRequestobjects that use theResolver APIfor other object types no longer function.
Nothing here needs operator attention. The release note contains installation and attestation information, with no described operator-facing changes.
Source ↗