tektoncd/cli v0.47.0 on GitHub

v0.47.0 Release 🎉

This release brings significant improvements to make Tekton CLI more AI-agent-friendly, with structured JSON/YAML input and output, consistent exit codes, and improved resource management. It also includes security fixes, bug fixes, component upgrades, and dependency updates.

Features 🌟

Agentic AI and Machine-Readable CLI

This release brings important enhancements toward making Tekton CLI ready for the agentic AI era. With AI coding agents increasingly using command-line tools to interact with external systems, tkn is evolving to provide a more predictable, structured, and machine-readable interface.

Key improvements include:

Machine-readable JSON/YAML Output: Extended structured output support across CLI commands, making it easier for AI agents and automation tools to consume Tekton resource information without parsing human-readable tables.

Structured JSON Input: Added JSON input support for start commands, allowing AI agents to create and execute Tekton resources using structured data rather than complex combinations of command-line flags.

Consistent Exit Codes: Introduced consistent exit codes to help AI agents and automation workflows reliably identify command success and failure without relying on output parsing.

AI Agent Context: Added CONTEXT.md to provide AI agents with repository-specific context and guidance, improving their understanding of the Tekton CLI codebase.

Improved Resource Operations: Enhanced JSON/YAML support for operations such as listing, describing, cancelling, and deleting Tekton resources.

Other Enhancements

1. Security Enhancements

Several security improvements and vulnerability fixes are included in this release:

Updated the Go toolchain to address standard library security vulnerabilities, including CVE-2026-111943.
Updated klauspost/compress to version 1.20.2 to address CVE-2026-116591.
Fixed a plugin directory resolution vulnerability (CWE-426) by rejecting relative plugin directories.
Restricted insecure TLS behavior during bundle installation, requiring --remote-skip-tls for insecure bundle name resolution (CWE-319).
Prevented unbounded memory allocation when extracting tar layers to improve protection against resource exhaustion.
Updated security-related dependencies, including Sigstore and go-jose.

2. Bug Fixes and Improvements

Improved release tag detection and switched to a stable GoReleaser image.
Fixed tkn customrun describe --last to select the most recent CustomRun.
Improved CustomRun deletion to return an error when the requested resource is not found.
Improved TaskRun deletion to handle structured deletion safely.
Restricted resource fetching during tkn hub install operations.
Improved plugin discovery and validation by checking executable permissions.
Improved tkn logging to display only failed steps when using --log-failed.
Added Go formatting and documentation freshness checks to CI.
Improved release configuration and dependency management.

3. Component and Dependency Updates

Updated Tekton Pipelines to v1.18.0.
Updated Tekton Triggers to v0.38.0.
Updated OpenTelemetry dependencies.
Updated Docker CLI, Google go-containerregistry, gRPC, Go-Jose, and other dependencies.
Consolidated the vt10x dependency.
Updated Go linting and development tooling.

4. Maintenance

Marked the v0.42.x and v0.37.x release branches as End of Life (EOL).
Updated Dependabot configuration for supported release branches.
Added GitHub slash command workflows for rebase and cherry-pick operations.
Improved repository context documentation for AI agent consumption.

Changelog

d79d3f2 New version v0.47.0

What's Changed

feat : add structured JSON input for start commands by @vikashkumar2020 in #2925
chore(deps): consolidate vt10x dependency by @anwesha-palit-redhat in #3085
fix(release): improve previous tag detection and use stable goreleaser image by @pratap0007 in #3070
chore(deps): bump go.opentelemetry.io/otel from 1.44.0 to 1.45.0 by @dependabot[bot] in #3107
chore(deps): bump github.com/tektoncd/pipeline from 1.14.1 to 1.15.0 by @dependabot[bot] in #3108
chore(deps): bump github.com/docker/cli from 29.6.2+incompatible to 29.7.1+incompatible in the go-docker-dependencies group by @dependabot[bot] in #3106
chore(deps): bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in #3110
chore(deps): bump github.com/letsencrypt/boulder from 0.20260728.0 to 0.20260729.0 by @dependabot[bot] in #3109
chore(deps): bump the all group with 4 updates by @dependabot[bot] in #3115
Security: Fix stdlib CVEs (go1.26.6) by @divyansh42 in #3135
feat: automate releases with Pipelines-as-Code by @vdemeester in #2795
chore(deps): add release-v0.46.x to dependabot config by @divyansh42 in #3138
chore(deps): bump github.com/letsencrypt/boulder from 0.20260729.0 to 0.20260804.0 by @dependabot[bot] in #3144
chore(deps): bump the all group with 2 updates by @dependabot[bot] in #3152
chore(deps): bump goa.design/goa/v3 from 3.28.0 to 3.29.1 by @dependabot[bot] in #3149
chore(deps): bump github.com/docker/cli from 29.7.1+incompatible to 29.7.2+incompatible in the go-docker-dependencies group by @dependabot[bot] in #3141
chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 by @dependabot[bot] in #3155
chore(deps): bump github.com/tektoncd/triggers from 0.36.0 to 0.37.0 by @dependabot[bot] in #3142
chore(deps): bump goa.design/goa/v3 from 3.29.1 to 3.29.2 by @dependabot[bot] in #3154
chore(deps): bump the go-k8s-dependencies group with 3 updates by @dependabot[bot] in #3160
chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 by @dependabot[bot] in #3162
chore(deps): bump github.com/stretchr/testify from 1.12.0 to 1.12.1 by @dependabot[bot] in #3161
chore(deps): bump github.com/letsencrypt/boulder from 0.20260804.0 to 0.20260817.0 by @dependabot[bot] in #3163
chore(deps): bump the all group with 4 updates by @dependabot[bot] in #3164
chore(docs): update version to v0.46.0 by @pratap0007 in #3179
Add CONTEXT.md for AI agent consumption by @Debashich in #2919
chore(deps): bump github.com/google/go-containerregistry from 0.21.9 to 0.22.0 by @dependabot[bot] in #3185
chore(deps): bump goa.design/goa/v3 from 3.29.2 to 3.30.0 by @dependabot[bot] in #3183
chore(deps): bump the all group with 3 updates by @dependabot[bot] in #3187
chore(deps): bump github.com/tektoncd/pipeline from 1.15.0 to 1.15.1 by @dependabot[bot] in #3182
chore(deps): bump github.com/golangci/golangci-lint/v2 from 2.12.2 to 2.13.1 in /tools by @dependabot[bot] in #3186
chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 by @dependabot[bot] in #3184
chore(deps): bump github.com/letsencrypt/boulder from 0.20260817.0 to 0.20260825.0 by @dependabot[bot] in #3181
fix(plugins): reject relative plugin dirs to prevent cwd fallback (CWE-426) by @divyansh42 in #3199
chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5 by @dependabot[bot] in #3204
chore(deps): bump github.com/golangci/golangci-lint/v2 from 2.13.1 to 2.13.2 in /tools by @dependabot[bot] in #3206
chore(deps): bump go.opentelemetry.io/otel from 1.45.0 to 1.46.0 by @dependabot[bot] in #3207
chore(deps): bump github.com/tektoncd/pipeline from 1.15.1 to 1.16.0 by @dependabot[bot] in #3205
chore(deps): bump github.com/google/go-containerregistry from 0.22.0 to 0.22.1 by @dependabot[bot] in #3208
chore(deps): bump the all group with 4 updates by @dependabot[bot] in #3209
fix: add execute-bit check in FindPlugin by @arvindk-softwaredev in #3203
chore: add rebase and cherry-pick slash command workflows by @divyansh42 in #3221
fix: prevent unbounded tar layer allocation by @anwesha-palit-redhat in #3201
fix(bundle): gate name.Insecure behind --remote-skip-tls (CWE-319) by @divyansh42 in #3200
ci: enforce gofmt and docs freshness checks by @divyansh42 in #3244
chore(deps): bump github.com/docker/cli from 29.7.2+incompatible to 29.8.0+incompatible in the go-docker-dependencies group by @dependabot[bot] in #3246
chore(deps): bump github.com/letsencrypt/boulder from 0.20260825.0 to 0.20260901.0 by @dependabot[bot] in #3249
chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @dependabot[bot] in #3248
chore(deps): bump chainguard-dev/actions/kind-diag from 1.6.34 to 1.6.35 in the all group by @dependabot[bot] in #3254
fix(log): show only failed steps with --log-failed by @chmouel in #3268
docs: add JSON/YAML output examples to list command help by @arvindk-softwaredev in #3269
docs: add JSON/YAML output examples to describe command help by @ankrsinha in #3270
chore(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 by @dependabot[bot] in #3272
chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.44.0 to 1.45.0 by @dependabot[bot] in #3273
chore(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc from 1.44.0 to 1.45.0 by @dependabot[bot] in #3274
chore(deps): bump the all group with 4 updates by @dependabot[bot] in #3295
chore(deps): bump github.com/letsencrypt/boulder from 0.20260901.0 to 0.20260908.0 by @dependabot[bot] in #3282
chore(deps): bump golang.org/x/crypto from 0.56.0 to 0.57.0 by @dependabot[bot] in #3280
chore(deps): bump github.com/docker/cli from 29.8.0+incompatible to 29.8.1+incompatible in the go-docker-dependencies group by @dependabot[bot] in #3278
feat: Support XDG base directory for bundle cache by @chmouel in #3296
fix: use latest Tekton releases and fix ConfigMap timing issue by @divyansh42 in #3298
feat: added support for --output json and --output yaml for cancel command for pipelinerun and taskrun by @anwesha-palit-redhat in #3241
feat: add -o yaml and -o json to tkn version by @anwesha-palit-redhat in #3299
chore(deps): bump the all group with 4 updates by @dependabot[bot] in #3314
chore(deps): bump github.com/tektoncd/triggers from 0.37.0 to 0.37.1 by @dependabot[bot] in #3303
fix(hub): restrict tkn hub install resources fetching by @pratap0007 in #3240
chore: mark release-v0.42.x as EOL by @divyansh42 in #3324
chore(deps): bump the all group with 2 updates by @dependabot[bot] in #3328
chore(deps): bump the go-k8s-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #3300
chore(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @dependabot[bot] in #3302
chore(deps): bump github.com/docker/cli from 29.8.1+incompatible to 29.8.2+incompatible in the go-docker-dependencies group by @dependabot[bot] in #3326
chore(deps): bump github.com/golangci/golangci-lint/v2 from 2.13.2 to 2.14.0 in /tools by @dependabot[bot] in #3325
feat: add structured JSON/YAML output for delete command by @ankrsinha in #3318
Regenerate dependabot.yml configuration by @tekton-robot in #3337
chore(deps): bump goa.design/goa/v3 from 3.30.0 to 3.32.0 by @dependabot[bot] in #3333
chore(deps): bump the all group with 3 updates by @dependabot[bot] in #3348
chore(deps): bump go.opentelemetry.io/otel from 1.46.0 to 1.47.0 by @dependabot[bot] in #3341
chore(deps): bump goa.design/goa/v3 from 3.32.0 to 3.34.0 by @dependabot[bot] in #3345
chore(deps): bump golang.org/x/text from 0.42.0 to 0.43.0 by @dependabot[bot] in #3360
chore(deps): bump the all group with 3 updates by @dependabot[bot] in #3365
chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6 by @dependabot[bot] in #3366
fix(customrun): describe --last picks the most recent CustomRun by @shubhamrai9122-creator in #3353
feat: add JSON output to taskrun delete by @Debashich in #3086
feat: support structured JSON/YAML output for bulk delete operations by @arvindk-softwaredev in #3334
fix(customrun): return error when customrun is not found during delete by @shubhamrai9122-creator in #3336
chore(deps): bump golang.org/x/term from 0.46.0 to 0.47.0 by @dependabot[bot] in #3356
chore(deps): bump github.com/docker/cli from 29.8.2+incompatible to 29.9.0+incompatible in the go-docker-dependencies group by @dependabot[bot] in #3354
chore: CVE-2026-111943 updating go version from 1.26.6 to 1.26.10 by @anwesha-palit-redhat in #3368
ci(e2e): raise inotify limits for ubuntu-26.04 runners by @divyansh42 in #3393
chore(deps): bump the all group across 1 directory with 4 updates by @dependabot[bot] in #3383
chore(deps): bump github.com/go-chi/chi/v5 from 5.3.2 to 5.4.0 by @dependabot[bot] in #3392
chore(deps): bump github.com/tektoncd/triggers from 0.37.1 to 0.37.2 by @dependabot[bot] in #3378
chore(release): mark v0.37.x as end of life by @divyansh42 in #3391
chore(deps): bump github.com/docker/cli from 29.9.0+incompatible to 29.9.2+incompatible in the go-docker-dependencies group across 1 directory by @dependabot[bot] in #3377
chore(deps): bump the all group across 1 directory with 2 updates by @dependabot[bot] in #3410
chore(deps): bump google.golang.org/grpc from 1.84.0 to 1.85.0 by @dependabot[bot] in #3413
chore(deps): bump the go-k8s-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #3400
fix: handle structured TaskRun deletion safely by @Debashich in #3367
chore(deps): bump the all group with 3 updates by @dependabot[bot] in #3418
chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.6 to 4.1.9 by @dependabot[bot] in #3416
chore(deps): bump github.com/docker/cli from 29.9.2+incompatible to 29.9.3+incompatible in the go-docker-dependencies group across 1 directory by @dependabot[bot] in #3415
chore: bump tektoncd/pipeline version to v1.18.0 by @pratap0007 in #3423
chore(deps): bump github.com/letsencrypt/boulder from 0.20260908.0 to 0.20261027.0 by @dependabot[bot] in #3411
chore(deps): bump github.com/golangci/golangci-lint/v2 from 2.14.0 to 2.15.0 in /tools by @dependabot[bot] in #3379
chore(deps): bump github.com/sigstore/sigstore from 1.11.0 to 1.11.3 by @dependabot[bot] in #3417
bump(deps): bump klauspost/compress to 1.20.2 to fix CVE-2026-116591 by @pratap0007 in #3426
bump(deps): bump tektoncd/triggers version from 0.37.2 to 0.38.0 by @pratap0007 in #3425
feat : add consistent exit codes by @vikashkumar2020 in #3130

Acknowledgements

Thank you to all contributors, maintainers, and community members who helped make this release possible!

New Contributors

@vikashkumar2020 made their first contribution in #2925
@Debashich made their first contribution in #2919
@ankrsinha made their first contribution in #3270
@shubhamrai9122-creator made their first contribution in #3353

Full Changelog: v0.46.0...v0.47.0