Skip to content

fix(deps): update module github.com/tektoncd/pipeline to v1.10.1 [security] (alauda-v0.43.0) - #79

Closed
alaudaa-renovate[bot] wants to merge 1 commit into
alauda-v0.43.0from
renovate/alauda-v0.43.0-go-github.com-tektoncd-pipeline-vulnerability
Closed

fix(deps): update module github.com/tektoncd/pipeline to v1.10.1 [security] (alauda-v0.43.0)#79
alaudaa-renovate[bot] wants to merge 1 commit into
alauda-v0.43.0from
renovate/alauda-v0.43.0-go-github.com-tektoncd-pipeline-vulnerability

Conversation

@alaudaa-renovate

@alaudaa-renovate alaudaa-renovate Bot commented Apr 6, 2026

Copy link
Copy Markdown

This PR contains the following updates:

Package Change Age Confidence
github.com/tektoncd/pipeline v1.6.1 -> v1.10.1 age confidence

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Tekton Pipelines controller panic via long resolver name in TaskRun/PipelineRun

CVE-2026-33022 / GHSA-cv4x-93xx-wgfj

More information

Details

Summary

A user with permission to create or update a TaskRun or PipelineRun can crash the Tekton Pipelines controller by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31 characters or more, causing a denial of service for all reconciliation.

Details

The controller panics in GenerateDeterministicNameFromSpec when building a deterministic ResolutionRequest name. The generated name has the format {resolver}-{hash} and, when the resolver name is long enough, the result exceeds the DNS-1123 label limit of 63 characters.

The truncation logic attempts to find a word boundary using strings.LastIndex(name, " "). Since the generated name never contains spaces (it is composed of the resolver name, a dash, and a hex-encoded hash), LastIndex returns -1, which is then used as a slice bound:

return name[:strings.LastIndex(name[:maxLength], " ")], nil
// strings.LastIndex returns -1 → panic: slice bounds out of range [:-1]

The panic crashes the controller. Because the offending TaskRun or PipelineRun is re-reconciled on restart, the controller enters a CrashLoopBackOff, blocking all TaskRun and PipelineRun reconciliation cluster-wide until the offending resource is manually deleted.

Built-in resolvers use short names (git, cluster, bundles, hub) and are not affected under normal usage. The vulnerability is exploitable by any user who can create TaskRuns or PipelineRuns with a custom resolver name.

Impact

Denial of service — A single malicious TaskRun or PipelineRun with a long resolver name is sufficient to crash the Tekton Pipelines controller into a restart loop, blocking all CI/CD reconciliation cluster-wide until the resource is removed.

Patches

(to be filled in: e.g. "Fixed in versions 1.10.1, 1.9.1, ...")

The fix computes the hash first, then truncates only the prefix (resolver name) to fit within the DNS-1123 label limit, preserving the full hash to maintain determinism and uniqueness of ResolutionRequest names.

Workarounds

Restrict who can create TaskRun and PipelineRun resources via Kubernetes RBAC. There is no validation-side workaround without patching.

Affected Versions

All releases from v0.60.0 through v1.10.0.

The vulnerable truncation logic was introduced in commit ea1fa7ad1fdc ("Remote Resolution Refactor"), first released in v0.60.0 (2024-05-22).

Currently supported affected releases:

  • v1.10.x (latest)
  • v1.9.x (LTS, EOL 2027-01-30)
  • v1.6.x (LTS, EOL 2026-10-31)
  • v1.3.x (LTS, EOL 2026-08-04)
  • v1.0.x (LTS, EOL 2026-04-29)

Releases prior to v0.60.0 are not affected — the truncation code did not exist.

Acknowledgments

This vulnerability was reported by Oleh Konko (@​1seal), who provided a thorough vulnerability analysis, proof-of-concept, and review of the fix. Thank you!

References
  • Fix: (link to merged PR/commit)
  • Introduced in: ea1fa7ad1fdc ("Remote Resolution Refactor")

Severity

  • CVSS Score: 6.5 / 10 (Medium)
  • Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

Release Notes

tektoncd/pipeline (github.com/tektoncd/pipeline)

v1.10.1: Tekton Pipeline release v1.10.1 "LaPerm Little Helper"

Compare Source

-Docs @​ v1.10.1
-Examples @​ v1.10.1

Installation one-liner
kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.10.1/release.yaml
Attestation

The Rekor UUID for this release is 108e9186e8c5677a8754062aee1bb73b992fe19d8c70544f16dd0bd502e19006c984c56928e9df4f

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a8754062aee1bb73b992fe19d8c70544f16dd0bd502e19006c984c56928e9df4f
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.10.1/release.yaml
REKOR_UUID=108e9186e8c5677a8754062aee1bb73b992fe19d8c70544f16dd0bd502e19006c984c56928e9df4f

##### Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.10.1@​sha256:" + .digest.sha256')

##### Download the release file
curl -L "$RELEASE_FILE" > release.yaml

##### For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done
Changes
Features
Fixes
  • 🐛 [cherry-pick: release-v1.10.x] fix: revert mistaken metadata changes in resolvers config-observability (#​9469)
Misc
Docs
Thanks

Thanks to these contributors who contributed to v1.10.1!

Extra shout-out for awesome release notes:

v1.10.0: Tekton Pipeline release v1.10.0 "LaPerm Little Helper"

Compare Source

🎉 Observability, evolved: Tekton Pipelines migrates to OpenTelemetry 🎉

-Docs @​ v1.10.0
-Examples @​ v1.10.0

Installation one-liner
kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.10.0/release.yaml
Attestation

The Rekor UUID for this release is 108e9186e8c5677a94dd58f7cfb4996ccce2c937681486ef690dab5e560e66c6c34aa9b446f32651

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a94dd58f7cfb4996ccce2c937681486ef690dab5e560e66c6c34aa9b446f32651
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.10.0/release.yaml
REKOR_UUID=108e9186e8c5677a94dd58f7cfb4996ccce2c937681486ef690dab5e560e66c6c34aa9b446f32651

##### Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.10.0@​sha256:" + .digest.sha256')

##### Download the release file
curl -L "$RELEASE_FILE" > release.yaml

##### For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done
Upgrade Notices

  • 🚨 Metrics migration from OpenCensus to OpenTelemetry (#​9043)

    ACTION REQUIRED: Infrastructure metrics (Go runtime, Workqueue, K8s Client) have been renamed from the tekton_pipelines_controller_ prefix to standard OpenTelemetry/Knative namespaces. The reason label has been added to duration metrics (pipelinerun_duration_seconds, taskrun_duration_seconds). The reconcile_count and reconcile_latency metrics have been removed.

    Upgrade actions:

    1. Update Config: Ensure your config-observability ConfigMap uses metrics-protocol: prometheus (or grpc/http) instead of the old metrics.backend-destination. If prometheus was already being used, no changes are needed.
    2. Update Dashboards:
      • Replace tekton_pipelines_controller_workqueue_* queries with kn_workqueue_*
      • Replace tekton_pipelines_controller_go_* queries with standard go_* metrics
      • Check aggregations on pipelinerun_duration_seconds to account for the new reason label

    See the full migration table in PR #​9043 for complete details.

Changes
Features

  • ✨ feat: Add SHA-256 support for Git resolver revision validation (#​9278)

    Git resolver now supports SHA-256 commit hashes for revision validation.

  • ✨ feat(metrics): Migrate from OpenCensus to OpenTelemetry (#​9043)

    Migrated PipelineRun and TaskRun metrics to OpenTelemetry instruments (histograms, counters, gauges). Updated Knative to 1.19. See Upgrade Notices for breaking changes and required actions.

  • ✨ ci: add /rebase slash command workflow (#​9375)

Fixes

  • 🐛 fix: Remove redundant shortNames from ResolutionRequest CRD (#​9398)

    Remove redundant shortNames from ResolutionRequest CRD that caused ShortNamesConflict on Kubernetes 1.33+

  • 🐛 fix(pipelines): allow pipeline param defaults to use non-param variables (#​9386)

    Fixed a bug which caused PipelineRun validation to fail when a pipeline parameter's default value referenced a non-parameter variable (e.g. $(context.pipelineRun.name))

  • 🐛 fix: pipeline-level results not recorded from failed tasks (#​9367)

    Pipeline-level results now include results from failed, cancelled, and timed-out tasks, fixing cases where results referencing non-successful task outputs were left as unresolved variable strings.

  • 🐛 ci: replace e2e-only fan-in with unified CI summary job (#​9394)

  • 🐛 fix: Align cache configstore with framework implementation (#​9282)

  • 🐛 accept featureFlags.EnableTektonOCIBundles to fix unknown field error (#​8996)

Misc
  • 🔨 build(deps): bump golang.org/x/crypto from 0.36.0 to 0.45.0 in /test/resolver-with-timeout (#​9426)
  • 🔨 Move v0.68 LTS to End of Life releases (#​9434)
  • 🔨 Assess several new gosec findings (#​9405)
  • 🔨 ci: Update cherry-pick command to latest plumbing (#​9400)
  • 🔨 build(deps): bump opentelemetry exporter packages to v1.39.0 (#​9332)
  • 🔨 build(deps): bump github.com/google/go-containerregistry from 0.21.0 to 0.21.1 (#​9433)
  • 🔨 build(deps): bump github/codeql-action from 4.32.3 to 4.32.4 (#​9431)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#​9430)
  • 🔨 build(deps): bump tj-actions/changed-files from 47.0.2 to 47.0.4 (#​9429)
  • 🔨 build(deps): bump actions/dependency-review-action from 4.8.2 to 4.8.3 (#​9428)
  • 🔨 build(deps): bump chainguard-dev/actions from 1.6.1 to 1.6.4 (#​9427)
  • 🔨 build(deps): bump github.com/sigstore/sigstore from 1.8.4 to 1.10.4 in /test/resolver-with-timeout (#​9425)
  • 🔨 build(deps): bump github.com/google/go-containerregistry from 0.20.7 to 0.21.0 (#​9418)
  • 🔨 build(deps): bump github.com/tektoncd/pipeline from 1.9.0 to 1.9.1 in /test/custom-task-ctrls/wait-task-beta (#​9417)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#​9397)
  • 🔨 build(deps): bump github/codeql-action from 4.32.2 to 4.32.3 (#​9396)
  • 🔨 build(deps): bump chainguard-dev/actions from 1.5.16 to 1.6.1 (#​9395)
  • 🔨 build(deps): bump google.golang.org/grpc from 1.79.0 to 1.79.1 (#​9392)
  • 🔨 build(deps): bump github.com/jenkins-x/go-scm from 1.15.16 to 1.15.17 (#​9391)
  • 🔨 build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.0 (#​9389)
  • 🔨 build(deps): bump k8s.io/code-generator from 0.32.11 to 0.32.12 (#​9388)
  • 🔨 build(deps): bump k8s.io/apiextensions-apiserver from 0.32.11 to 0.32.12 (#​9385)
  • 🔨 build(deps): bump k8s.io/apimachinery from 0.33.7 to 0.33.8 (#​9384)
  • 🔨 build(deps): bump k8s.io/client-go from 0.32.11 to 0.32.12 (#​9383)
  • 🔨 build(deps): bump k8s.io/client-go from 0.32.11 to 0.32.12 in /test/custom-task-ctrls/wait-task-beta (#​9382)
  • 🔨 build(deps): bump k8s.io/api from 0.32.11 to 0.32.12 in /test/custom-task-ctrls/wait-task-beta (#​9381)
  • 🔨 build(deps): bump k8s.io/apimachinery from 0.33.7 to 0.33.8 in /test/custom-task-ctrls/wait-task-beta (#​9380)
  • 🔨 build(deps): bump github/codeql-action from 4.32.1 to 4.32.2 (#​9374)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#​9373)
  • 🔨 build(deps): bump step-security/harden-runner from 2.14.1 to 2.14.2 (#​9372)
  • 🔨 build(deps): bump tj-actions/changed-files from 47.0.1 to 47.0.2 (#​9371)
  • 🔨 build(deps): bump chainguard-dev/actions from 1.5.14 to 1.5.16 (#​9370)
  • 🔨 build(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 (#​9369)
  • 🔨 build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.39.0 to 1.40.0 (#​9363)
  • 🔨 fix(ci): simplify e2e test health status result (#​9361)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#​9352)
  • 🔨 build(deps): bump chainguard-dev/actions from 1.5.13 to 1.5.14 (#​9351)
  • 🔨 build(deps): bump github/codeql-action from 4.32.0 to 4.32.1 (#​9350)
  • 🔨 build(deps): bump actions/cache from 4.2.3 to 5.0.3 (#​9348)
  • 🔨 build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.37.0 to 1.40.0 (#​9345)
  • 🔨 build(deps): bump github.com/tektoncd/pipeline from 1.7.0 to 1.9.0 in /test/custom-task-ctrls/wait-task-beta (#​9340)
  • 🔨 build(deps): bump google.golang.org/grpc from 1.77.0 to 1.78.0 (#​9337)
  • 🔨 build(deps): bump github.com/spiffe/spire-api-sdk from 1.14.0 to 1.14.1 (#​9336)
  • 🔨 build(deps): bump sigstore/sigstore from 1.9.5 to 1.10.4 (#​9331)
  • 🔨 build(deps): bump github.com/tektoncd/pipeline to v1.7.0 in wait-task-beta (#​9329)
Docs
  • 📖 docs: clarify flag availability across controller binaries (#​9390)
  • 📖 docs: update releases.md for v1.9.0 LTS (#​9339)
  • 📖 docs: Document roadmap project board workflows and best practices (#​9311)
  • 📖 Update examples in docs for changes in apiVersion v1 (#​9042)
Thanks

Thanks to these contributors who contributed to v1.10.0!

Extra shout-out for awesome release notes:

v1.9.2: Tekton Pipeline release v1.9.2 "Devon Rex Dreadnought"

Compare Source

-Docs @​ v1.9.2
-Examples @​ v1.9.2

Installation one-liner
kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.2/release.yaml
Attestation

The Rekor UUID for this release is 108e9186e8c5677a6c7ee52741b34d7b7e9a3277e775365533a3669a49c3be92b372bcbda73ee439

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a6c7ee52741b34d7b7e9a3277e775365533a3669a49c3be92b372bcbda73ee439
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.2/release.yaml
REKOR_UUID=108e9186e8c5677a6c7ee52741b34d7b7e9a3277e775365533a3669a49c3be92b372bcbda73ee439

##### Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.9.2@​sha256:" + .digest.sha256')

##### Download the release file
curl -L "$RELEASE_FILE" > release.yaml

##### For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done
Changes
⚠️ Security Fixes

  • GHSA-j5q5-j9gm-2w5c (Critical): Path traversal in git resolver allows reading arbitrary files from the resolver pod. Fixed by validating the pathInRepo parameter to prevent directory traversal.

  • GHSA-cv4x-93xx-wgfj / CVE-2026-33022 (Medium): Controller panic via long resolver name in TaskRun/PipelineRun. A user with permission to create TaskRuns or PipelineRuns could crash the controller into a restart loop by setting a resolver name of 31+ characters, causing denial of service cluster-wide. Thanks to @​1seal for reporting this vulnerability.

Thanks

Thanks to these contributors who contributed to v1.9.2!

v1.9.1: Tekton Pipeline release v1.9.1 "Devon Rex Dreadnought"

Compare Source

-Docs @​ v1.9.1
-Examples @​ v1.9.1

Installation one-liner
kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.1/release.yaml
Attestation

The Rekor UUID for this release is 108e9186e8c5677a127d1213c2768a992b19df1a58983ef2336fc3ede3d6b9fdbd7e49431bdf3cc0

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a127d1213c2768a992b19df1a58983ef2336fc3ede3d6b9fdbd7e49431bdf3cc0
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.1/release.yaml
REKOR_UUID=108e9186e8c5677a127d1213c2768a992b19df1a58983ef2336fc3ede3d6b9fdbd7e49431bdf3cc0

##### Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.9.1@​sha256:" + .digest.sha256')

##### Download the release file
curl -L "$RELEASE_FILE" > release.yaml

##### For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done
Changes
Features
Fixes
  • 🐛 [release-v1.9.x] fix(pipelines): allow pipeline param defaults to use non-param variables (#​9387)
Misc
  • 🔨 [release-v1.9.x] ci: add CI summary fan-in job for branch protection (#​9407)
  • 🔨 [cherry-pick: release-v1.9.x] tekton: update plumbing ref to latest commit (#​9413)
  • 🔨 [cherry-pick: release-v1.9.x] tekton: update plumbing ref to include full image references fix (#​9401)
Docs
Thanks

Thanks to these contributors who contributed to v1.9.1!

Extra shout-out for awesome release notes:

v1.9.0: Tekton Pipeline release v1.9.0 LTS "Devon Rex Dreadnought"

Compare Source

🎉 hostUsers support and digest validation for http resolver 🎉

-Docs @​ v1.9.0
-Examples @​ v1.9.0

Installation one-liner
kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.0/release.yaml
Attestation

The Rekor UUID for this release is 108e9186e8c5677a692b1410db6e04e5e4a25aec2e361118647fe42c5ad8d7ef3e087b5cd11463d6

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a692b1410db6e04e5e4a25aec2e361118647fe42c5ad8d7ef3e087b5cd11463d6
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.0/release.yaml
REKOR_UUID=108e9186e8c5677a692b1410db6e04e5e4a25aec2e361118647fe42c5ad8d7ef3e087b5cd11463d6

##### Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.9.0@​sha256:" + .digest.sha256')

##### Download the release file
curl -L "$RELEASE_FILE" > release.yaml

##### For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done
Changes
Features

  • ✨ feat: add ServiceAccount inheritance to Affinity Assistants (#​9253)

  • ✨ Add hostUsers field support to PodTemplate (#​9227)

  • ✨ feat: Add digest validation support to HTTP resolver (#​9171)

  • ✨ taskrun: include actual result size in error when exceeding maxResultSize (#​8869)

Fixes

  • 🐛 fix(pipelinerun): fix the issue of massive invalid status updates caused by unordered arrays, which will greatly impact the resource load and stability of the apiserver. (#​9295)

  • 🐛 Fix parameter resolution for defaults with references (#​9271)

  • 🐛 Fix duplicated protobuf tag in pod.Template struct (#​9229)

  • 🐛 fix: Prevent excessive reconciliation when timeout disabled (#​9202)

  • 🐛 fix: Detect pod configuration errors early instead of timeout (#​9197)

  • 🐛 chore(ci): update cherry-pick workflow to fix multi-commit PRs (#​9320)

  • 🐛 fix: validate taskRef.apiVersion format for custom tasks (#​9045)

  • 🐛 test(e2e): move flaky retry/matrix tests to no-ci temporarily (#​9242)

  • 🐛 fix(e2e): improve dind-sidecar probe configuration for reliability (#​9241)

Misc
  • 🔨 fix: reduce CRD size by shortening verbose descriptions (#​9252)
  • 🔨 ci: add KOCACHE to speed up ko builds in GitHub Actions (#​9319)
  • 🔨 Improve code consistency and fix missing test annotation (#​9266)
  • 🔨 Remove the GHCR migration notice from the readme (#​9237)
  • 🔨 fix: release pipeline feedback (#​9210)
  • 🔨 build(deps): bump go.uber.org/zap from 1.27.0 to 1.27.1 (#​9333)
  • 🔨 build(deps): bump github.com/google/cel-go from 0.26.0 to 0.27.0 (#​9330)
  • 🔨 build(deps): bump github/codeql-action from 4.31.9 to 4.32.0 (#​9310)
  • 🔨 build(deps): bump the all group in /tekton with 3 updates (#​9309)
  • 🔨 build(deps): bump chainguard-dev/actions from 1.5.12 to 1.5.13 (#​9308)
  • 🔨 build(deps): bump actions/checkout from 6.0.1 to 6.0.2 (#​9307)
  • 🔨 build(deps): bump step-security/harden-runner from 2.14.0 to 2.14.1 (#​9306)
  • 🔨 build(deps): bump the all group in /tekton with 2 updates (#​9299)
  • 🔨 build(deps): bump chainguard-dev/actions from 1.5.11 to 1.5.12 (#​9298)
  • 🔨 build(deps): bump actions/setup-go from 6.1.0 to 6.2.0 (#​9297)
  • 🔨 build(deps): bump actions/cache from 5.0.1 to 5.0.2 (#​9296)
  • 🔨 build(deps): bump golang.org/x/sync from 0.18.0 to 0.19.0 (#​9293)
  • 🔨 build(deps): bump the all group in /tekton with 2 updates (#​9291)
  • 🔨 build(deps): bump chainguard-dev/actions from 1.5.10 to 1.5.11 (#​9290)
  • 🔨 build(deps): bump github.com/hashicorp/go-version from 1.7.0 to 1.8.0 (#​9288)
  • 🔨 build(deps): bump k8s.io/apiextensions-apiserver from 0.32.8 to 0.32.11 (#​9286)
  • 🔨 build(deps): bump the all group in /tekton with 2 updates (#​9281)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#​9268)
  • 🔨 build(deps): bump chainguard/go from 2f71c4d to 0cd4986 in /tekton in the all group (#​9264)
  • 🔨 build(deps): bump peter-evans/slash-command-dispatch from 5.0.1 to 5.0.2 (#​9263)
  • 🔨 build(deps): bump github.com/spiffe/spire-api-sdk from 1.12.4 to 1.14.0 (#​9261)
  • 🔨 build(deps): bump go.opentelemetry.io/otel/sdk from 1.38.0 to 1.39.0 (#​9259)
  • 🔨 build(deps): bump github.com/cloudevents/sdk-go/v2 from 2.16.1 to 2.16.2 (#​9258)
  • 🔨 build(deps): bump k8s.io/client-go from 0.32.8 to 0.32.11 (#​9256)
  • 🔨 build(deps): bump google.golang.org/protobuf from 1.36.10 to 1.36.11 (#​9254)
  • 🔨 .github/workflows: Add a comment to main for plumbing's shared workflows (#​9248)
  • 🔨 build(deps): bump github/codeql-action from 4.31.8 to 4.31.9 (#​9247)
  • 🔨 build(deps): bump the all group in /tekton with 2 updates (#​9246)
  • 🔨 build(deps): bump go.opentelemetry.io/otel/trace from 1.37.0 to 1.39.0 (#​9245)
  • 🔨 build(deps): bump k8s.io/apimachinery from 0.33.3 to 0.33.7 (#​9244)
  • 🔨 fix(codegen): Correct JSON tags for streaming lists (#​9240)
  • 🔨 Fix golangci-lint action step for large diff (#​9239)
  • 🔨 Fix: CI job incorrectly skipped by file change detection (#​9238)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#​9236)
  • 🔨 build(deps): bump step-security/harden-runner from 2.13.3 to 2.14.0 (#​9235)
  • 🔨 build(deps): bump github/codeql-action from 4.31.7 to 4.31.8 (#​9234)
  • 🔨 build(deps): bump actions/cache from 4.3.0 to 5.0.1 (#​9233)
  • 🔨 build(deps): bump tj-actions/changed-files from abdd2f6 to e002140 (#​9232)
  • 🔨 build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 (#​9231)
  • 🔨 Add twoGiants as pipeline maintainers (#​9230)
  • 🔨 fix: Add permissions to cherry-pick workflow (#​9225)
  • 🔨 Proposal: test: implement parallel/serial test categorization system (#​9224)
  • 🔨 github/workflows: use cherry-pick workflows from plumbing (#​9222)
  • 🔨 .github/workflows: fixing go-coverage token issues (#​9221)
  • 🔨 build(deps): bump the all group across 1 directory with 4 updates (#​9220)
  • 🔨 build(deps): bump actions/checkout from 6.0.0 to 6.0.1 (#​9219)
  • 🔨 build(deps): bump golangci/golangci-lint-action from 9.1.0 to 9.2.0 (#​9218)
  • 🔨 build(deps): bump peter-evans/slash-command-dispatch from 4.0.0 to 5.0.1 (#​9217)
  • 🔨 build(deps): bump step-security/harden-runner from 2.13.2 to 2.13.3 (#​9216)
  • 🔨 build(deps): bump github/codeql-action from 4.31.6 to 4.31.7 (#​9215)
  • 🔨 chore: enhance cherry-pick PR format with original context (#​9214)
  • 🔨 Fix commit SHA of github-script action (#​9203)
  • 🔨 test: limit examples test parallelism to 2 to prevent timeouts (#​9200)
  • 🔨 .github/workflows: use CHATOPS_TOKEN for coverage comments (#​9198)
  • 🔨 build(deps): bump actions/github-script from 7.0.1 to 8.0.0 (#​9195)
  • 🔨 build(deps): bump github/codeql-action from 4.31.5 to 4.31.6 (#​9194)
  • 🔨 .github/workflows: use plumbing workflow for chatops_retest (#​9192)
  • 🔨 build(deps): bump github.com/jenkins-x/go-scm from 1.15.4 to 1.15.16 (#​9183)
  • 🔨 build(deps): bump google.golang.org/grpc from 1.75.0 to 1.77.0 (#​9177)
Docs
  • 📖 chore: fix YAML indentation in release cheat sheet (#​9226)
  • 📖 Remove beta note from projected workspaces and csi as they are stable (#​9208)
  • 📖 Update releases.md for 1.7 (#​9205)
Thanks

Thanks to these contributors who contributed to v1.9.0!

Extra shout-out for awesome release notes:

v1.7.0: Tekton Pipeline release v1.7.0 "LaPerm Little Helper"

Compare Source

🎉 Bug fixes, stability improvements and dependency updates 🎉

-Docs @​ v1.7.0
-Examples @​ v1.7.0

Installation one-liner
kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.7.0/release.yaml
Attestation

The Rekor UUID for this release is 108e9186e8c5677a0af3ff47db2d68605b227b75af0aa40d87262257e2b9295f35454fe3d050ed38

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a0af3ff47db2d68605b227b75af0aa40d87262257e2b9295f35454fe3d050ed38
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.7.0/release.yaml
REKOR_UUID=108e9186e8c5677a0af3ff47db2d68605b227b75af0aa40d87262257e2b9295f35454fe3d050ed38

##### Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.7.0@​sha256:" + .digest.sha256')

##### Download the release file
curl -L "$RELEASE_FILE" > release.yaml

##### For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done
Changes
Fixes
  • 🐛 fix: Populate step statuses before TaskRun timeout handling (#​9184)

Fix a race condition on timeout that would result in a TaskRun status without steps statuses.

  • 🐛 fix: panic in v1beta1 matrix validation for invalid result refs (#​9135)

Resolved an issue where Pipelines with invalid result references in matrix parameters would cause a panic during validation (v1beta1 API)

  • 🐛 Use patch instead of update to replace sidecars with nop image (#​9128)

Fixed race condition causing TaskRuns to fail with 409 conflict error when stopping sidecars.
StopSidecars now uses Patch instead of Update to avoid conflicts with concurrent kubelet pod status updates.

  • 🐛 fix: Add missing comma in slash commands workflow (#​9157)
  • 🐛 Fix tekton/publish sed for combined-based-image digest replacement (#​9119)
  • 🐛 examples: reduce the size of the matrix to reduce flakiness (#​9187)
Misc
  • 🔨 Migrate tests images out of dockerhub. (#​9158)
  • 🔨 refactor: add clock injection to cache for testing (#​9142)
  • 🔨 Remove deprecated // +build directive from most files (#​9118)
  • 🔨 build(deps): bump tj-actions/changed-files from 6da3c88 to abdd2f6 (#​9196)
  • 🔨 chore(release-pipeline): update references to oci bucket (#​9189)
  • 🔨 .github/workflows: fix e2e-matrix-extras (#​9185)
  • 🔨 build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 (#​9181)
  • 🔨 build(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#​9180)
  • 🔨 build(deps): bump golangci/golangci-lint-action from 9.0.0 to 9.1.0 (#​9179)
  • 🔨 .github: add a dependabot configuration to monitor .ko.yaml (#​9173)
  • 🔨 feat: Add GitHub Actions cherry-pick slash command (#​9172)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#​9170)
  • 🔨 build(deps): bump actions/dependency-review-action from 4.8.1 to 4.8.2 (#​9169)
  • 🔨 build(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#​9168)
  • 🔨 build(deps): bump tj-actions/changed-files from 7006987 to 6da3c88 (#​9167)
  • 🔨 build(deps): bump chainguard-dev/actions from 1.5.3 to 1.5.10 (#​9166)
  • 🔨 build(deps): bump github/codeql-action from 4.31.0 to 4.31.5 (#​9165)
  • 🔨 Fix commit SHA of actions/github-script in e2e-extras workflow (#​9161)
  • 🔨 Fix the e2e-extras slash command (#​9160)
  • 🔨 examples: make sure we use the same image for sidecar and step (#​9139)
  • 🔨 fix(ci): correct grep patterns in detect job (#​9137)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#​9134)
  • 🔨 build(deps): bump chainguard-dev/actions from 1.5.7 to 1.5.8 (#​9133)
  • 🔨 build(deps): bump tj-actions/changed-files from 0ff001d to 7006987 (#​9132)
  • 🔨 build(deps): bump step-security/harden-runner from 2.13.1 to 2.13.2 (#​9131)
  • 🔨 build(deps): bump golangci/golangci-lint-action from 8.0.0 to 9.0.0 (#​9130)
  • 🔨 fix: label checker action reference (#​9129)
  • 🔨 Update releases.md after 1.6.0 release (#​9127)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#​9124)
  • 🔨 build(deps): bump tj-actions/changed-files from dbf178c to 0ff001d (#​9122)
  • 🔨 feat: upload release manifests to oracle cloud (#​9121)
  • 🔨 test: reduce the number of examples tests running in parallel (#​9114)
  • 🔨 Run less e2e matrix by default (#​9109)
  • 🔨 ci: skip running builds and tests if no code changed (#​8768)
  • 🔨 fix: update tekton setup action (#​9126)
  • 🔨 build(deps): bump github.com/docker/docker from 26.1.5+incompatible to 28.0.0+incompatible in /test/resolver-with-timeout (#​9182)
Thanks

Thanks to these contributors who contributed to v1.7.0!

Extra shout-out for awesome release notes:

Configuration

📅 Schedule: Branch creation - "" in timezone Asia/Shanghai, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@alaudaa-renovate

alaudaa-renovate Bot commented Apr 6, 2026

Copy link
Copy Markdown
Author

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: downloading knative.dev/pkg v0.0.0-20260329160701-396dbaacd652
go: github.com/tektoncd/cli/pkg/test imports
	github.com/tektoncd/triggers/test imports
	github.com/tektoncd/triggers/pkg/reconciler/eventlistener/resources imports
	knative.dev/eventing/pkg/reconciler/source imports
	knative.dev/pkg/metrics: cannot find module providing package knative.dev/pkg/metrics
go: github.com/tektoncd/cli/pkg/test imports
	github.com/tektoncd/triggers/test imports
	github.com/tektoncd/triggers/pkg/reconciler/eventlistener/resources imports
	knative.dev/eventing/pkg/reconciler/source imports
	knative.dev/pkg/tracing/config: cannot find module providing package knative.dev/pkg/tracing/config

alaudabot
alaudabot reviewed Apr 6, 2026
View reviewed changes

@alaudabot alaudabot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This PR correctly addresses CVE-2026-33022 (GHSA-cv4x-93xx-wgfj), a critical security vulnerability that could crash the Tekton Pipelines controller. The dependency update from v1.6.1 to v1.10.1 is appropriate.

Minor Suggestion: The Go version directive (go 1.12) may need updating for compatibility with tektoncd/pipeline v1.10.1 - please verify.

Overall, this PR is ready to merge.

@alaudabot

alaudabot commented Apr 6, 2026

Copy link
Copy Markdown

🤖 AI Code Review

Property Value
Model opencode/minimax-m2.5-free
Style strict
Issues Found 0
Config Source centralized
Profile ❌ Not Found
Personalized Prompt ❌ No
Prompt Path .github/review/profiles/alaudadevops/tektoncd-cli/pr-review.md
Alauda Skills ✅ base-sample-email-draft, base-skill-setup, builders-confluence, builders-jira, builders-sample-code-review, connectors-explore, connectors-review, connectors-unit-test, connectors-write-user-docs, devops-autodns, devops-bulk-string-replace, devops-candidate-version-supervisor, devops-docker-keyword-modify, devops-task-overview-template, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-task-generator, devops-tekton-task-version-upgrade, devops-tektoncd-vuln-fix, devops-upgrade-go
Reviewed at 2026-04-06 19:47:28 UTC

Summary

This PR updates the github.com/tektoncd/pipeline dependency from v1.6.1 to v1.10.1 to address CVE-2026-33022 (GHSA-cv4x-93xx-wgfj), a security vulnerability that allows a malicious TaskRun/PipelineRun with a long resolver name (31+ characters) to crash the Tekton Pipelines controller via panic. This is a critical security fix that should be merged promptly.

Review Statistics

Category Count
Critical Issues 0
Warnings 0
Suggestions 1
Files Reviewed 1

Critical Issues

Issues that MUST be addressed before merging (security, bugs, breaking changes)

(None)

Warnings

Issues that SHOULD be addressed but are not blocking

(None)

Suggestions

Recommendations for improvement (nice to have)

  • [go.mod:27] (style/naming): The Go version directive at line 3 specifies go 1.12, but v1.10.1 of tektoncd/pipeline may require a newer Go version. Verify compatibility and consider updating the Go version directive if needed.

Positive Feedback

  • The PR correctly addresses a critical security vulnerability (CVE-2026-33022) that could lead to denial of service
  • The update follows standard dependency update practices using Renovate
  • The PR body provides detailed information about the security vulnerability including CVSS score, impact, and affected versions
  • Minimal, focused change - only the necessary version bump in go.mod
ℹ️ About this review

This review was automatically generated using the run-actions workflow.

  • Shared prompt: .github/prompts/code-review.md
  • Config source: centralized
  • Profile path: Not Found
  • Profile ref: 5ddff01c20115d1eda993ffe2bc71a0026ae3edb
  • No repository-specific prompt configured
  • Alauda skills: base-sample-email-draft, base-skill-setup, builders-confluence, builders-jira, builders-sample-code-review, connectors-explore, connectors-review, connectors-unit-test, connectors-write-user-docs, devops-autodns, devops-bulk-string-replace, devops-candidate-version-supervisor, devops-docker-keyword-modify, devops-task-overview-template, devops-tekton-dynamic-form-optimizer, devops-tekton-operator-task-e2e, devops-tekton-task-generator, devops-tekton-task-version-upgrade, devops-tektoncd-vuln-fix, devops-upgrade-go

@l-qing l-qing closed this Apr 10, 2026
@alaudaa-renovate
alaudaa-renovate Bot deleted the renovate/alauda-v0.43.0-go-github.com-tektoncd-pipeline-vulnerability branch April 10, 2026 13:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@alaudabot alaudabot alaudabot left review comments

Assignees

@yuzichen12123 yuzichen12123

Labels

dependencies

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@alaudabot @l-qing @yuzichen12123