GitHub

v0.46.0

v0.46.0 Release 🎉

This release internalizes Hub CLI functionality directly into tkn, adds the --log-failed flag to the pipelinerun logs command for filtering failed task logs, replaces cosign with sigstore and blang/semver with Masterminds/semver, removes the unused tektoncd/chains dependency, migrates from gotest.tools v2 to v3.
Updates Tekton Pipelines support to v1.14.1, enables Codecov coverage reporting in CI, and includes dependency updates to address CVE-2026-42505 and other critical security fixes.

Changelog

Deprecated ⚠️

  • [Hub CLI Migration] Hub is deprecated and internalize Hub CLI functionality into tkn by @divyansh42 in #2876

Features 🌟

  • Add --log-failed flag to pipelinerun logs command by @chmouel in #2920

Refactoring & Cleanup 🛠️

Dependency Updates

  • Bump github.com/sigstore/sigstore from 1.10.5 to 1.10.6 by @dependabot[bot] in #2866

  • Bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #2867

  • Bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in #2873

  • Bump step-security/harden-runner from 2.19.1 to 2.19.3 by @dependabot[bot] in #2874

  • Bump github/codeql-action from 4.35.3 to 4.35.5 by @dependabot[bot] in #2875

  • Bump github/codeql-action from 4.35.5 to 4.36.0 by @dependabot[bot] in #2885

  • Bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #2882

  • Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot[bot] in #2884

  • Fix(ci): Pin Tekton Pipelines to v1.12.0 in e2e tests by @divyansh42 in #2897

  • Add agentic workflow context files by @ngelman1 in #2890

  • Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #2891

  • Bump chainguard-dev/actions from 1.6.19 to 1.6.22 by @dependabot[bot] in #2898

  • Bump github/codeql-action from 4.36.0 to 4.36.2 by @dependabot[bot] in #2899

  • Bump the go-k8s-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2862

  • Bump github.com/docker/cli from 29.4.3+incompatible to 29.5.3+incompatible in the go-docker-dependencies group across 1 directory by @dependabot[bot] in #2865

  • Bump github.com/sigstore/sigstore from 1.10.6 to 1.10.8 by @dependabot[bot] in #2901

  • Bump goa.design/goa/v3 from 3.26.0 to 3.28.0 by @dependabot[bot] in #2902

  • Bump chainguard-dev/actions from 1.6.22 to 1.6.23 by @dependabot[bot] in #2906

  • Bump go.mongodb.org/mongo-driver from 1.17.6 to 1.17.7 by @dependabot[bot] in #2910

  • Bump ko-build/setup-ko from 0.9 to 0.10 by @dependabot[bot] in #2926

  • Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #2927

  • Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #2918

  • Bump github.com/docker/cli from 29.5.3+incompatible to 29.6.1+incompatible in the go-docker-dependencies group across 1 directory by @dependabot[bot] in #2914

  • Bump the go-k8s-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2915

  • Bump chainguard-dev/actions from 1.6.23 to 1.6.25 by @dependabot[bot] in #2917

  • Bump github.com/sigstore/timestamp-authority/v2 from 2.0.6 to 2.1.0 by @dependabot[bot] in #2928

  • fix(cve): bump Go stdlib to 1.25.11 and golang.org/x/net to v0.55.0 by @divyansh42 in #2911

  • chore(deps): add dependabot config for active release branches by @jkhelil in #2907

  • Bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 by @dependabot[bot] in #2881

  • CI: Group all GitHub Actions dependabot updates together by @vdemeester in #2985

  • chore(deps): bump github.com/tektoncd/triggers from 0.35.1-0.20260401091813-1aad8a1898ec to 0.36.0 by @dependabot[bot] in #2991

  • chore(deps): bump the all group with 5 updates by @dependabot[bot] in #2995

  • CI: Use goinstall mode for golangci-lint action by @vdemeester in #2984

  • chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 by @dependabot[bot] in #3008

  • chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot[bot] in #2931

  • refactor(release): use .x branches for releases by @divyansh42 in #3011

  • Add branch prefix to Dependabot PR titles for release branches by @divyansh42 in #3017

  • chore(deps): bump the all group with 2 updates by @dependabot[bot] in #3023

  • chore(deps): bump golang.org/x/text from 0.37.0 to 0.39.0 by @dependabot[bot] in #3021

  • chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot[bot] in #2929

  • chore(deps): bump go.opentelemetry.io/otel from 1.43.0 to 1.44.0 by @dependabot[bot] in #3022

  • chore(deps): bump github.com/tektoncd/chains from 0.26.3 to 0.27.2 and fix test failures by @dependabot[bot] in #2930

  • chore(deps): bump github.com/letsencrypt/boulder from 0.20260420.0 to 0.20260630.0 by @dependabot[bot] in #2953

  • docs: update README Tekton logo URL to CNCF artwork location by @afrittoli with @Copilot in #3025

  • chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @dependabot[bot] in #3027

  • chore(deps): bump github.com/tektoncd/pipeline from 1.12.0 to 1.14.0 by @dependabot[bot] in #3028

  • chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 in the all group by @dependabot[bot] in #3030

  • chore(deps): bump github.com/tektoncd/chains from 0.27.2 to 0.27.3 by @dependabot[bot] in #3029

  • chore(deps): bump the go-k8s-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #3038

  • chore(deps): bump github.com/jackc/pgx/v5 from 5.7.6 to 5.9.2 by @dependabot[bot] in #3041

  • ci(.github/workflows): enable Codecov coverage reporting by @enarha in #3040

  • chore(deps): bump github.com/docker/cli from 29.6.1+incompatible to 29.6.2+incompatible in the go-docker-dependencies group by @dependabot[bot] in #3042

  • chore(deps): bump github.com/letsencrypt/boulder from 0.20260630.0 to 0.20260713.0 by @dependabot[bot] in #3044

  • chore(deps): bump golang.org/x/term from 0.44.0 to 0.45.0 by @dependabot[bot] in #3046

  • chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot[bot] in #3045

  • fix(releaes): fix release script to fetch the correct previous tag by @pratap0007 in #3064
    #3062

  • Security: Fix CVE-2026-42505 - update Go to 1.26.5 (crypto/tls ECH privacy leak) by @divyansh42 in #3065

  • chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in #3043

  • chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.29.0 by @dependabot[bot] in #3069

  • chore(deps): bump the go-k8s-dependencies group with 3 updates by @dependabot[bot] in #3071

  • chore(deps): bump github.com/tektoncd/pipeline from 1.14.0 to 1.14.1 by @dependabot[bot] in #3072

  • chore(deps): bump github.com/letsencrypt/boulder from 0.20260713.0 to 0.20260720.0 by @dependabot[bot] in #3073

  • chore(deps): bump the all group across 1 directory with 5 updates by @dependabot[bot] in #3075

  • chore(deps): bump the all group with 3 updates by @dependabot[bot] in #3105

  • chore(deps): bump github.com/sigstore/sigstore from 1.10.8 to 1.10.9 by @dependabot[bot] in #3087

  • chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @depen...

Read more

v0.37.7

v0.37.7 Release 🎉

This patch release addresses the following CVEs: CVE-2026-33811, CVE-2026-39833, CVE-2026-42505, CVE-2026-39830, CVE-2026-25680, CVE-2026-22772, and CVE-2026-49835. It also updates the Go version to 1.25.12, which includes fixes for Go standard library vulnerabilities.

Changelog

What's Changed

  • [release-v0.37.x] CI: Use goinstall mode for golangci-lint action by @vdemeester in #2990
  • [release-v0.37.x] cherry-pick: OWNERS, CI summary, Dockerfile fix by @divyansh42 in #3013
  • chore(deps): bump the all group across 1 directory with 3 updates by @dependabot[bot] in #3001
  • [release-v0.37.x] cherry-pick: fix alibabacloud-go/cr-20160607 license by @divyansh42 in #3018
  • [release-v0.37.x] bump github.com/docker/cli from 29.0.3+incompatible to 29.0.4+incompatible in the go-docker-dependencies group across 1 directory by @dependabot[bot] in #2946
  • [release-v0.37.x] fix: resolve golangci-lint errors (cherry-pick from main) by @divyansh42 in #3024
  • fix(cve): CVE-2026-42499, CVE-2026-39820 - update Go 1.25.9 to 1.25.10 [release-v0.37.x] by @divyansh42 in #2922
  • fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update golang.org/x/crypto to v0.52.0 [release-v0.37.x] by @divyansh42 in #2909
  • fix(cve): CVE-2026-33811, CVE-2026-39833 - update Go stdlib and x/crypto [release-v0.37.x] by @divyansh42 in #2923
  • [release-v0.37.x] bump github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3 by @dependabot[bot] in #2975
  • [release-v0.37.x] bump github.com/creack/pty from 1.1.21 to 1.1.24 by @dependabot[bot] in #2963
  • [release-v0.37.x] bump the go-k8s-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2957
  • [release-v0.37.x] bump github.com/google/go-containerregistry from 0.20.7 to 0.20.8 by @dependabot[bot] in #2969
  • [release-v0.37.x] bump github.com/tektoncd/hub from 1.17.0 to 1.17.3 by @dependabot[bot] in #3032
  • [release-v0.37.x] bump github.com/tektoncd/pipeline from 0.59.5 to 0.59.6 by @dependabot[bot] in #3033
  • [release-v0.37.x] bump github.com/sigstore/sigstore from 1.10.3 to 1.10.8 by @dependabot[bot] in #3035
  • [release-v0.37.x] bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 by @dependabot[bot] in #3050
  • [release-v0.37.x] bump chainguard-dev/actions/kind-diag from 1.6.26 to 1.6.27 in the all group by @dependabot[bot] in #3053
  • [release-v0.37.x] Security: Fix CVE-2026-42505 - update Go to 1.25.12 (crypto/tls ECH privacy leak) by @divyansh42 in #3067
  • fix(cve): fix few critical CVEs by @pratap0007 in #3058
  • [release-v0.37.x] bump the go-k8s-dependencies group with 3 updates by @dependabot[bot] in #3082
  • [release-v0.37.x] bump chainguard-dev/actions/kind-diag from 1.6.27 to 1.6.28 in the all group by @dependabot[bot] in #3076

Full Changelog: v0.37.6...v0.37.7

v0.45.1

v0.45.1 Release 🎉

This patch release addresses the following CVEs: CVE-2026-48702, CVE-2026-49835, CVE-2026-39395, CVE-2026-49835. It also upgrades Go to v1.25.6 to remediate vulnerabilities in the Go standard library.

Changelog

What's Changed

  • Bump the go-k8s-dependencies group with 3 updates by @dependabot[bot] in #2942
  • Bump step-security/harden-runner from 2.19.1 to 2.19.4 by @dependabot[bot] in #2935
  • Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #2936
  • Bump chainguard-dev/actions/kind-diag from 1.6.19 to 1.6.25 by @dependabot[bot] in #2937
  • Bump github/codeql-action/analyze from 4.35.3 to 4.35.5 by @dependabot[bot] in #2965
  • [release-v0.45.x] CI: Use goinstall mode for golangci-lint action by @vdemeester in #2986
  • chore(deps): bump github.com/sigstore/sigstore from 1.10.5 to 1.10.8 by @dependabot[bot] in #2993
  • chore(deps): bump the all group across 1 directory with 2 updates by @dependabot[bot] in #3004
  • chore(deps): bump github.com/tektoncd/pipeline from 1.12.0 to 1.12.2 by @dependabot[bot] in #2973
  • chore(deps): bump github.com/tektoncd/chains from 0.26.3 to 0.26.5 by @dependabot[bot] in #2958
  • chore(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #2944
  • chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot[bot] in #2964
  • [release-v0.45.x] bump github.com/tektoncd/chains from 0.26.5 to 0.26.6 by @dependabot[bot] in #3034
  • [release-v0.45.x] bump chainguard-dev/actions/kind-diag from 1.6.26 to 1.6.27 in the all group by @dependabot[bot] in #3047
  • [release-v0.45.x] bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 by @dependabot[bot] in #3051
  • [release-v0.45.x] chore(deps): remove unused tektoncd/chains dependency by @pratap0007 in #3061
  • fix(cve): fix few critical CVEs by @pratap0007 in #3063

Full Changelog: v0.45.0...v0.45.1

v0.44.2

v0.43.2

v0.45.0

v0.45.0 Release 🎉

This release adds the describe subcommand for customrun, migrates tracing from OpenCensus to OpenTelemetry, removes the deprecated chains command, adds support for Pipelines v1.12.0, and includes dependency updates to address multiple critical CVEs.

Changelog 📋

What's Changed

  • Bump chainguard-dev/actions from 1.6.1 to 1.6.3 by @dependabot[bot] in #2742
  • Bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 by @dependabot[bot] in #2753
  • chore: referencing the setup-kind script from the plumbing repo instead of copying it by @infernus01 in #2590
  • Nominate divyansh42 as cli approver by @vdemeester in #2761
  • Move piyush-garg to alumni by @vdemeester in #2760
  • docs: Update CLI docs for v0.44.0 release by @pratap0007 in #2748
  • Bump github/codeql-action from 4.32.3 to 4.32.5 by @dependabot[bot] in #2755
  • Bump step-security/harden-runner from 2.14.2 to 2.15.0 by @dependabot[bot] in #2757
  • Bump actions/setup-go from 6.2.0 to 6.3.0 by @dependabot[bot] in #2754
  • Bump github.com/google/go-containerregistry from 0.21.0 to 0.21.2 by @dependabot[bot] in #2759
  • Bump github.com/docker/cli from 29.2.1+incompatible to 29.3.0+incompatible in the go-docker-dependencies group by @dependabot[bot] in #2763
  • Bump golang.org/x/term from 0.40.0 to 0.41.0 by @dependabot[bot] in #2766
  • Bump github.com/golangci/golangci-lint/v2 from 2.10.1 to 2.11.3 in /tools by @dependabot[bot] in #2765
  • Add CI summary fan-in job to presubmit CI by @vdemeester in #2741
  • feat: add cherry-pick command workflow by @vdemeester in #2682
  • Bump chainguard-dev/actions from 1.6.3 to 1.6.5 by @dependabot[bot] in #2756
  • Bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #2758
  • Bump the go-k8s-dependencies group with 3 updates by @dependabot[bot] in #2752
  • Change all occurences of GCS buckets with OCI buckets by @adityavshinde in #2768
  • Add long flag --display-name to display the log of pipelinerun by @icloudnote in #2450
  • feat: add describe subcommand in customrun command by @pratap0007 in #2712
  • Cleanup/remove deprecate chains cmd by @adityavshinde in #2769
  • Bump google.golang.org/grpc from 1.78.0 to 1.79.3 by @dependabot[bot] in #2775
  • Bump github.com/tektoncd/pipeline from 1.9.1 to 1.9.2 by @dependabot[bot] in #2781
  • Bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 by @dependabot[bot] in #2789
  • Bump knative and components version by @khrm in #2788
  • Migrate tracing from OpenCensus to OpenTelemetry by @khrm in #2799
  • Bump go.opentelemetry.io/otel/sdk from 1.42.0 to 1.43.0 by @dependabot[bot] in #2800
  • Bump github.com/docker/cli from 29.3.0+incompatible to 29.3.1+incompatible in the go-docker-dependencies group across 1 directory by @dependabot[bot] in #2783
  • Bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.42.0 to 1.43.0 by @dependabot[bot] in #2801
  • Bump github.com/letsencrypt/boulder from 0.20251110.0 to 0.20260406.0 by @dependabot[bot] in #2796
  • (deps) Bump go version to 1.25.8 to fix CVE-2026-25679 by @divyansh42 in #2803
  • Bump github.com/google/go-containerregistry from 0.21.3 to 0.21.4 by @dependabot[bot] in #2797
  • Bump github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3 by @dependabot[bot] in #2798
  • Bump step-security/harden-runner from 2.15.0 to 2.17.0 by @dependabot[bot] in #2808
  • Bump github.com/fatih/color from 1.18.0 to 1.19.0 by @dependabot[bot] in #2777
  • Bump github.com/golangci/golangci-lint/v2 from 2.11.3 to 2.11.4 in /tools by @dependabot[bot] in #2778
  • Bump github/codeql-action from 4.32.5 to 4.35.1 by @dependabot[bot] in #2784
  • Bump actions/setup-go from 6.3.0 to 6.4.0 by @dependabot[bot] in #2786
  • Bump github.com/sigstore/sigstore from 1.10.4 to 1.10.5 by @dependabot[bot] in #2805
  • Bump github.com/sigstore/timestamp-authority/v2 from 2.0.3 to 2.0.6 by @dependabot[bot] in #2809
  • Bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.42.0 to 1.43.0 by @dependabot[bot] in #2802
  • Bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #2816
  • Bump step-security/harden-runner from 2.17.0 to 2.19.0 by @dependabot[bot] in #2815
  • Bump the go-k8s-dependencies group with 3 updates by @dependabot[bot] in #2811
  • Bump github.com/letsencrypt/boulder from 0.20260406.0 to 0.20260413.0 by @dependabot[bot] in #2812
  • Bump github.com/google/go-containerregistry from 0.21.4 to 0.21.5 by @dependabot[bot] in #2813
  • Bump chainguard-dev/actions from 1.6.5 to 1.6.15 by @dependabot[bot] in #2814
  • Bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #2817
  • Bump github.com/docker/cli from 29.4.0+incompatible to 29.4.1+incompatible in the go-docker-dependencies group by @dependabot[bot] in #2820
  • Bump github.com/tektoncd/pipeline from 1.11.0 to 1.11.1 by @dependabot[bot] in #2823
  • Bump github.com/tektoncd/chains from 0.26.2 to 0.26.3 by @dependabot[bot] in #2827
  • Bump chainguard-dev/actions from 1.6.15 to 1.6.16 by @dependabot[bot] in #2829
  • Bump go.uber.org/zap from 1.27.1 to 1.28.0 by @dependabot[bot] in #2830
  • Bump github.com/letsencrypt/boulder from 0.20260413.0 to 0.20260420.0 by @dependabot[bot] in #2821
  • Bump github.com/tektoncd/pipeline from 1.11.1 to 1.12.0 by @dependabot[bot] in #2836
  • Bump google.golang.org/grpc from 1.80.0 to 1.81.0 by @dependabot[bot] in #2837
  • Bump chainguard-dev/actions from 1.6.16 to 1.6.19 by @dependabot[bot] in #2839
  • Bump github.com/golangci/golangci-lint/v2 from 2.11.4 to 2.12.1 in /tools by @dependabot[bot] in #2834
  • Bump step-security/harden-runner from 2.19.0 to 2.19.1 by @dependabot[bot] in #2840
  • Strip Go symbol table from release binaries by @alliasgher in #2843
  • Bump github/codeql-action from 4.35.2 to 4.35.3 by @dependabot[bot] in #2838
  • Bump github.com/golangci/golangci-lint/v2 from 2.12.1 to 2.12.2 in /tools by @dependabot[bot] in #2842
  • Bump github.com/in-toto/in-toto-golang from 0.10.0 to 0.11.0 by @dependabot[bot] in #2844
  • Bump github.com/docker/cli from 29.4.1+incompatible to 29.4.3+incompatible in the go-docker-dependencies group across 1 directory by @dependabot[bot] in #2833
  • Update tekton hub to 1.24.0 by @divyansh42 in #2845
  • Bump golang.org/x/crypto from 0.50.0 to 0.51.0 by @dependabot[bot] in #2847

New Contributors

Full Changelog: v0.44.0...v0.45.0

v0.42.2

v0.37.6

v0.37.5

v0.44.1

Read the original on github.com ↗