Shipped · DevOps and infrastructure

What tektoncd/pipeline shipped

The public repository of Tekton · github.com/tektoncd/pipeline

Written by FoxPlug from the repository's own releases; not affiliated with Tekton. Paste your own repository in the box below and FoxPlug writes the same weekly update for your product. This page is an automatic summary of the releases, pull requests and commits in github.com/tektoncd/pipeline; Tekton did not write it and does not use or endorse FoxPlug. Every line links to the change it describes.

Get a weekly update like this for your product, free

Or Use it as a GitHub Action

See the update FoxPlug writes for pipeline, free

Week of October 19, 2026

What shipped

Why it matters

This week was mostly about getting patch releases out safely: a Go update for CVE-2026-111943, a ko image bump it required, and a vendor tarball copy fix in the release plumbing landed across the release branches. Releases went out on several maintained lines, including the LTS lines, plus a dependency bump for two ssh denial-of-service issues. For users, the fixes concern certificate chain validation, dependency bumps and one annotation bug that caused child PVCs to be deleted.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Patch releases are out on several lines, including the LTS lines. This week brought a Go 1.27.3 bump for CVE-2026-111943, the release plumbing changes it needed, and a golang.org/x/crypto bump fixing two ssh denial-of-service issues. The auto-cleanup-pvc annotation no longer leak

Post for LinkedIn

This week Tekton Pipeline shipped patch releases across several maintained lines, including the LTS lines. The main fixes: Go was bumped to 1.27.3 to address CVE-2026-111943, where crypto/x509 now distrusts certificate chains relying on compromised eMudhra intermediate CA keys; the release plumbing ko image was updated to a Go 1.27.3 build, and a vendor tarball is now copied into kodata instead of symlinked, which unblocked the patch releases. golang.org/x/crypto moved to v0.58.0, fixing two ssh denial-of-service issues where a peer could deadlock a connection by flooding channel requests. Separately, a parent PipelineRun's auto-cleanup-pvc annotation no longer propagates to child PipelineRuns, so child VolumeClaimTemplate PVCs are not deleted on completion.

Week of October 5, 2026

What shipped

Why it matters

This week fixes behavior people run into in real pipelines: retry-count substitution with taskRef is now documented, OCI bundles read reliably, steps can continue after a failure and the labels the reconciler trusts can no longer be changed by hand. Users who depend on Pipeline-in-Pipeline cycle detection and other label-based logic get a more dependable controller, and both maintained release branches pick up the same crypto dependency update.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

This week: controller-managed labels are now immutable via webhook, step onError gains continueAndFail, OCI bundle tar layers read reliably, and retry-count substitution with taskRef is documented. The crypto bump also landed on both release branches.

Post for LinkedIn

This week in Tekton Pipelines: controller-managed labels (tekton.dev/pipeline, tekton.dev/pipelineTask, tekton.dev/pipelineRun) are now immutable through the webhook, so reconciler logic such as Pipelines-in-Pipelines cycle detection can keep trusting them. Step onError accepts a third value, continueAndFail, which runs the remaining steps after a step exits with a non-zero code. OCI bundle tar layers are read with io.ReadFull, avoiding truncated reads from the streaming gunzip reader. The docs now explain that the retry-count variable is substituted on the PipelineTask before the TaskRun is created, so with taskRef it must be passed through PipelineTask params. The golang.org/x/crypto 0.55.0 update was also backported to release-v1.9.x and release-v1.12.x.

Week of September 28, 2026

What shipped

Why it matters

V1.17.0 delivers clearer failure messages and improved observability through enhanced tracing, along with bug fixes for Windows script handling and better error context for task resolution failures. These changes make it easier for users to diagnose and resolve pipeline issues.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Tekton Pipeline v1.17.0 is out with clearer failure messages, sharper traces, and Windows script fixes. Better debugging, better observability.

Post for LinkedIn

Tekton Pipeline v1.17.0 'Egyptian Mau Robocop' is now available. This release brings clearer failure diagnostics with reconcile.write_intent span attributes for improved tracing, fixes for Windows script handling when containing special characters, and task resolution errors now include task names. Pod events surface when containers get stuck, making it easier to diagnose infrastructure issues.

Week of September 14, 2026

What shipped

Why it matters

This week included resolver efficiency improvements, tracing consistency across TaskRun and PipelineRun, maintenance of unmaintained dependencies, and fixes to testing infrastructure and documentation.

Changelog entry

Example posts FoxPlug drafted from these changes. Not written or posted by the project.

Post for X

Tekton Pipeline updates: resolver efficiency gains, TaskRun tracing parity with PipelineRun, unmaintained dependency replacement, and documentation fixes.

Post for LinkedIn

Tekton Pipeline shipped improvements this week: resolvers now handle requests more efficiently during leader promotion, TaskRun tracing is consistent with PipelineRun across cancellation and timeout scenarios, we replaced an unmaintained YAML library with its maintained fork, and fixed testing infrastructure and documentation issues.

Weeks with too little public activity are left out rather than filled in. Last updated 2026-10-27.

Is this your repo? Ask us to remove this page.