# Tekton v1.17.0

> CI/CD & App Delivery · 2026-10-01

A feature and maintenance release that adds opt-in observability and parameter support. It also corrects several issues, including a Windows script-injection defense gap, and refreshes dependencies.

## Action needed
- **[security]** The `placeScriptInContainer` PowerShell here-string handling is corrected
  - The Windows script-injection defense-in-depth gap is fixed: `placeScriptInContainer` now uses a non-expandable PowerShell here-string, so a script body containing a literal `"@` line cannot terminate the generated command early. This correction ships in the release.

## Other recorded changes
- 28 (value_changed 20, defect_corrected 4, added 2, removed 1, renamed 1)

[Full analysis](https://ratatosk.io/en/releases/tekton/v1.17.0)

[Original release notes](https://github.com/tektoncd/pipeline/releases/tag/v1.17.0)