Skip to content

[release-v0.44.x] bump github.com/tektoncd/pipeline from 1.9.8 to 1.9.9 - #3387

Open
dependabot[bot] wants to merge 1 commit into
release-v0.44.xfrom
dependabot/go_modules/release-v0.44.x/github.com/tektoncd/pipeline-1.9.9
Open

[release-v0.44.x] bump github.com/tektoncd/pipeline from 1.9.8 to 1.9.9#3387
dependabot[bot] wants to merge 1 commit into
release-v0.44.xfrom
dependabot/go_modules/release-v0.44.x/github.com/tektoncd/pipeline-1.9.9

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps github.com/tektoncd/pipeline from 1.9.8 to 1.9.9.

Release notes

Sourced from github.com/tektoncd/pipeline's releases.

Tekton Pipeline release v1.9.9 "Devon Rex Dreadnought"

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.9/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a0f42646894360aa79be006519746da77370648b0c01ebc341980a922a9faeef6

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a0f42646894360aa79be006519746da77370648b0c01ebc341980a922a9faeef6
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.9/release.yaml
REKOR_UUID=108e9186e8c5677a0f42646894360aa79be006519746da77370648b0c01ebc341980a922a9faeef6
Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.9.9@sha256:" + .digest.sha256')
Download the release file
curl -L "$RELEASE_FILE" > release.yaml
For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

... (truncated)

Commits
  • 3a17765 [release-v1.9.x] fix(release): copy vendor tarball into kodata instead of sym...
  • 78eab1f [release-v1.9.x] fix: bump plumbing ko image to Go 1.27.3
  • 261e61a [release-v1.9.x] bump the all group in /tekton with 4 updates
  • 27404d7 style: gofmt files flagged by Go 1.27 gofmt
  • 2899f55 fix: bump Go to 1.27.3 to fix CVE-2026-111943
  • 291a65f [release-v1.9.x] bump the all group in /tekton with 4 updates
  • 5d59ad3 [release-v1.9.x] bump the all group in /tekton with 4 updates
  • e2de594 build(deps): update Go security dependencies
  • ddc841c [release-v1.9.x] bump the all group in /tekton with 4 updates
  • 7eff93b [release-v1.9.x] bump agilepathway/label-checker from 1.6.98 to 1.6.115
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Used by dependabot - identifies all PRs created by dependabot kind/misc Categorizes issue or PR as a miscellaneuous one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesnt merit a release note. labels Oct 27, 2026
@tekton-robot tekton-robot added do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Oct 27, 2026
@tekton-robot

tekton-robot commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please assign vinamra28 after the PR has been reviewed.
You can assign the PR to them by writing /assign @vinamra28 in a comment when ready.

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@tekton-robot tekton-robot added the size/S Denotes a PR that changes 10-29 lines, ignoring generated files. label Oct 27, 2026
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/release-v0.44.x/github.com/tektoncd/pipeline-1.9.9 branch from 3d88f39 to f360c1d Compare November 2, 2026 06:42
@dependabot
[release-v0.44.x] bump github.com/tektoncd/pipeline from 1.9.8 to 1.9.9
413cc25 
Bumps [github.com/tektoncd/pipeline](https://github.com/tektoncd/pipeline) from 1.9.8 to 1.9.9.
- [Release notes](https://github.com/tektoncd/pipeline/releases)
- [Changelog](https://github.com/tektoncd/pipeline/blob/main/releases.md)
- [Commits](tektoncd/pipeline@v1.9.8...v1.9.9)

---
updated-dependencies:
- dependency-name: github.com/tektoncd/pipeline
  dependency-version: 1.9.9
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/release-v0.44.x/github.com/tektoncd/pipeline-1.9.9 branch from f360c1d to 413cc25 Compare November 2, 2026 10:06
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@divyansh42 divyansh42 Awaiting requested review from divyansh42
@pradeepitm12 pradeepitm12 Awaiting requested review from pradeepitm12

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies Used by dependabot - identifies all PRs created by dependabot kind/misc Categorizes issue or PR as a miscellaneuous one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesnt merit a release note. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tekton-robot