Tekton
v1.9.4CI/CD & App Delivery2026年6月15日
v1.9.4は、リゾルバーの動作条件と依存関係を見直したリリースです。Resolver APIの利用形態や、`google.golang.org/grpc`のバージョンに関係する環境が対象になります。
要対応 (1)
securitycritical
google.を1.79.3へ更新golang. org/grpc google.を1.77.0から1.79.3へ更新しました。CVE-2026-33186で報告された、golang. org/grpc :pathヘッダーの先頭スラッシュ欠落に起因するgRPC-Goの認可回避に対応しています。
影響確認 (1)
breakingTekton Resolversの解決対象を制限
StepActions、Tasks、Pipelines以外のオブジェクト型に対して、カスタムリゾルバーまたはResolutionRequestでResolver APIを使用している場合に該当します。Tekton以外のオブジェクトや任意のデータを解決できていた不具合を修正しました。非Tektonオブジェクトの解決は
ResolutionRequestの失敗となり、Tekton Resolversが解決できる対象はStepActions、Tasks、Pipelinesだけになります。その他のオブジェクト型を使うカスタムリゾルバーやResolutionRequestは動作しなくなります。
その他の記録済み変更 24 件すべてvalue changes 17 · fixes 6 · additions 1
value changes (17)
- build(deps): bump the all group in /tekton with 4 updates (#10262)
- build(deps): bump the all group in /tekton with 4 updates (#10239)
- build(deps): bump the all group across 1 directory with 4 updates (#10197)
- build(deps): bump github.com/spiffe/spire-api-sdk from 1.14.6 to 1.14.7 (#10151)
- build(deps): bump the all group in /tekton with 4 updates (#10131)
- build(deps): bump the all group in /tekton with 4 updates (#10088)
- build(deps): bump the all group in /tekton with 4 updates (#10043)
- build(deps): bump k8s.io/apimachinery from 0.33.11 to 0.33.12 (#10015)
- build(deps): bump the all group across 1 directory with 4 updates (#9988)
- build(deps): bump github.com/spiffe/spire-api-sdk from 1.14.0 to 1.14.6 (#9929)
- build(deps): bump github.com/go-jose/go-jose/v3 from 3.0.4 to 3.0.5 (#9917)
- build(deps): bump k8s.io/apimachinery from 0.33.7 to 0.33.11 (#9916)
- build(deps): bump github.com/google/go-containerregistry from 0.20.6 to 0.20.8 (#9886)
- build(deps): bump k8s.io/apiextensions-apiserver from 0.32.11 to 0.32.13 (#9884)
- build(deps): bump k8s.io/api from 0.32.11 to 0.32.13 (#9879)
- build(deps): bump k8s.io/client-go from 0.32.11 to 0.32.13 (#9876)
- build(deps): bump the all group in /tekton with 4 updates (#9862)
fixes (6)
- fix(resolvers): Allow ResolutionRequests to resolve all Tekton kinds (#10253) efore this change, ResolutionRequests could only resolve Pipelines, Tasks, and StepActions. After this change, ResolutionRequests can resolve PipelineRuns, Pipelines, TaskRuns, Tasks, Runs, CustomRuns, and StepActions.
- Fix cross-arch platform command lookup in entrypoint (#10163) ix entrypoint command lookup when controller and worker nodes run on different CPU architectures (e.g., ARM controller with AMD64 workloads).
- fix: surface clear errors when completed tasks miss referenced results (#9973) ipelineRun status now shows which specific results were missing when tasks are skipped due to uninitialized result references from completed tasks. A Warning event with reason ResultValidationFailed is also emitted for consistency with other failure modes.
- fix: resolve goroutine leak from unbuffered channels in resolver reconcilers (#10112)
- fix: convert pod latency metric to histogram and remove pod label (#10110)
- fix(pipelinerun): use generateName for anonymous pipeline label (#10108)
additions (1)
- fix: add automated draft release support to release pipeline (#10214)
Tektonをスタックに追加
対応が必要なリリースが出たときに、週次メールでお知らせします。 今回のセキュリティパッチと破壊的変更も、その一例です。