Bump github.com/tektoncd/pipeline from 0.66.0 to 1.0.2

[dependabot]

Bumps github.com/tektoncd/pipeline from 0.66.0 to 1.0.2.

Release notes

Sourced from github.com/tektoncd/pipeline's releases.

Tekton Pipeline release v1.0.2 "Oriental Omnidroid"

-Docs @ v1.0.2 -Examples @ v1.0.2

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.0.2/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677afa1ff2410a8f5280de7f95a693172273a1c52b90177e7687fc72cf2607c8e332

Obtain the attestation:

REKOR_UUID=108e9186e8c5677afa1ff2410a8f5280de7f95a693172273a1c52b90177e7687fc72cf2607c8e332
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.0.2/release.yaml
REKOR_UUID=108e9186e8c5677afa1ff2410a8f5280de7f95a693172273a1c52b90177e7687fc72cf2607c8e332
Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.0.2@sha256:" + .digest.sha256')
Download the release file
curl -L "$RELEASE_FILE" > release.yaml
For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

⚠️ Security Fixes

• GHSA-wjxp-xrpv-xpff / CVE-2026-40161 (HIGH): Git resolver API mode leaks system-configured API token to user-controlled serverURL. A user who can create TaskRuns can exfiltrate the system Git API token by pointing the resolver at an attacker-controlled server.

• GHSA-94jr-7pqp-xhcq / CVE-2026-40938 (HIGH): Git resolver unsanitized revision parameter enables argument injection. A malicious revision value can inject arbitrary flags into the git CLI, potentially leading to remote code execution on the resolver pod.

• GHSA-rx35-6rhx-7858 / CVE-2026-40923 (Medium): VolumeMount path restriction bypass via missing filepath normalization. Paths like /tekton/../sensitive bypass the /tekton/ prefix restriction check.

• GHSA-rmx9-2pp3-xhcr / CVE-2026-25542 (Medium): VerificationPolicy regex pattern bypass via substring matching. Unanchored patterns allow partial matches, letting unsigned resources pass verification.

• GHSA-m2cx-gpqf-qf74 / CVE-2026-40924 (Medium): HTTP resolver unbounded response body read enables OOM denial of service. A malicious URL returning a very large response can exhaust the resolver pod's memory. Response body is now limited to 1 MiB.

... (truncated)

Changelog

Sourced from github.com/tektoncd/pipeline's changelog.

Tekton Pipeline Releases

Release Frequency

Tekton Pipelines follows the Tekton community [release policy][release-policy] as follows:

• Versions are numbered according to semantic versioning: vX.Y.Z
• A new release is produced on a monthly basis
• Four releases a year are chosen for long term support (LTS). All remaining releases are supported for approximately 1 month (until the next release is produced)
  • LTS releases take place in January, April, July and October every year
  • The first Tekton Pipelines LTS release will be v0.41.0 in October 2022
  • Releases happen towards the middle of the month, between the 13th and the 20th, depending on week-ends and readiness

Tekton Pipelines produces nightly builds, publicly available on gcr.io/tekton-nightly.

Transition Process

Before release v0.41 Tekton Pipelines has worked on the basis of an undocumented support period of four months, which will be maintained for the releases between v0.37 and v0.40.

Release Process

Tekton Pipeline releases are made of YAML manifests and container images. Manifests are published to cloud object-storage as well as [GitHub][tekton-pipeline-releases]. Container images are signed by [Sigstore][sigstore] via [Tekton Chains][tekton-chains]; signatures can be verified through the [public key][chains-public-key] hosted by the Tekton Chains project.

Further documentation available:

• The Tekton Pipeline [release process][tekton-releases-docs]
• [Installing Tekton][tekton-installation]
• Standard for [release notes][release-notes-standards]

Release

v1.14

• Latest Release: [v1.14.0][v1.14-0] (2026-06-30) ([docs][v1.14-0-docs], [examples][v1.14-0-examples])
• Initial Release: [v1.14.0][v1.14-0] (2026-06-30)
• End of Life: 2026-07-30
• Patch Releases: [v1.14.0][v1.14-0]

v1.12 (LTS)

... (truncated)

Commits

• 0be1b69 fix: trim whitespace from source URI before pattern matching
• 0869f07 fix: limit HTTP resolver response body size to prevent OOM DoS
• d381153 fix: strip resolver prefixes and use non-capturing group for pattern anchoring
• d48bff5 fix: normalize VolumeMount paths before /tekton/ restriction check
• 8d8e401 fix: prevent git argument injection via revision parameter (GHSA-94jr-7pqp-xhcq)
• 48d9916 Security: reject system API token with user-controlled serverURL
• 503fdf3 Re-enable pipeline-api.md generation
• d59443c fix(pipelinerun): sort childReferences to prevent spurious status updates
• c04aaab chore(pipelinerun): remove cmpopts.SortSlices from pkg/reconciler/pipelinerun...
• ec77550 fix: prevent path traversal in git resolver pathInRepo parameter
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[istio-testing]

@dependabot[bot]: The following test failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
gencheck_test-infra	2bcbdbc	link	true	/test gencheck

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.