v0.46.2 Release 🎉
This release includes security fixes, Go toolchain updates, dependency upgrades, and improvements to Hub resource installation and Tekton release handling.
Security Fixes
- Fix CVE-2026-84304 (gRPC-Go): Updated gRPC-Go dependencies to address the reported security vulnerability. (#3331, #3339)
- Update Go toolchain to address CVEs: Updated Go from 1.26.6 to 1.26.10 to address CVE-2026-111943. (#3369)
- Restrict Hub installation resource fetching: Improved resource-fetching restrictions for tkn hub install. (#3320)
Dependency Updates
- Sigstore: Updated github.com/sigstore/sigstore from 1.10.9 to 1.10.11. (#3293)
- Testify: Updated github.com/stretchr/testify from 1.12.0 to 1.12.1. (#3316)
- Kubernetes and Go dependencies: Updated dependencies in the Go/Kubernetes dependency group. (#3315)
- gRPC-Go: Updated google.golang.org/grpc from 1.83.1 to 1.83.2. (#3339)
- Tekton Triggers: Updated github.com/tektoncd/triggers from 0.36.0 to 0.36.4. (#3344)
- Go JOSE: Updated github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6. (#3359)
- Additional dependencies: Updated two dependencies through the automated dependency update group. (#3340)
Improvements and Maintenance
- Update to the latest patch version: Bumped the relevant version to the latest patch release. (#3277)
- Use the latest Tekton releases: Updated Tekton release references and fixed a ConfigMap timing issue. (#3322)
- Update CI diagnostics: Upgraded chainguard-dev/actions/kind-diag through versions 1.6.36, 1.6.37, and 1.6.41. (#3289, #3312, #3362)
Changelog
- 9ea027b New version v0.46.2
Full Changelog: v0.46.1...v0.46.2