Skip to content

🚨 Update go modules (main) (major)#3133

Open
renovate[bot] wants to merge 1 commit intomainfrom
renovate/main-major-go-modules
Open

🚨 Update go modules (main) (major)#3133
renovate[bot] wants to merge 1 commit intomainfrom
renovate/main-major-go-modules

Conversation

@renovate
Copy link
Contributor

@renovate renovate bot commented Feb 27, 2026

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Adoption Passing Confidence
github.com/MakeNowJust/heredoc v1.0.0v2.0.1 age adoption passing confidence
github.com/golangci/golangci-lint v1.63.4v2.10.1 age adoption passing confidence
github.com/santhosh-tekuri/jsonschema/v5 v5.3.1v6.0.2 age adoption passing confidence
github.com/tektoncd/pipeline v0.70.0v1.10.0 age adoption passing confidence
gopkg.in/go-jose/go-jose.v2 v2.6.3v4.1.3 age adoption passing confidence
helm.sh/helm/v3 v3.18.5v4.1.1 age adoption passing confidence

Release Notes

MakeNowJust/heredoc (github.com/MakeNowJust/heredoc)

v2.0.1

Compare Source

Version 2.0.1

Fixes

  • Correct import path for Go modules

v2.0.0

Compare Source

Version 2.0.0

Breaking Changes

  • Treats only white space (U+0020) and horizontal tabs (U+000D) as space characters. (#​6)
golangci/golangci-lint (github.com/golangci/golangci-lint)

v2.10.1

Compare Source

Released on 2026-02-17

  1. Fixes
    • buildssa panic

v2.10.0

Compare Source

Released on 2026-02-17

  1. Linters new features or changes
    • ginkgolinter: from 0.22.0 to 0.23.0
    • gosec: from 2.22.11 to 2.23.0 (new rules: G117, G602, G701, G702, G703, G704, G705, G706)
    • staticcheck: from 0.6.1 to 0.7.0
  2. Linters bug fixes
    • godoclint: from 0.11.1 to 0.11.2

v2.9.0

Compare Source

Released on 2026-02-10

  1. Enhancements
    • 🎉 go1.26 support
  2. Linters new features or changes
    • arangolint: from 0.3.1 to 0.4.0 (new rule: detect potential query injections)
    • ginkgolinter: from 0.21.2 to 0.22.0 (support for wrappers)
    • golines: from 0.14.0 to 0.15.0
    • misspell: from 0.7.0 to 0.8.0
    • unqueryvet: from 1.4.0 to 1.5.3 (new options: check-n1, check-sql-injection, check-tx-leaks, allow, custom-rules)
    • wsl: from 5.3.0 to 5.6.0 (new rule: after-block)
  3. Linters bug fixes
    • modernize: from 0.41.0 to 0.42.0
    • prealloc: from 1.0.1 to 1.0.2
    • protogetter: from 0.3.18 to 0.3.20
  4. Misc.
    • Log information about files when configuration verification
    • Emit an error when no linters enabled
    • Do not collect VCS information when loading code

v2.8.0

Compare Source

Released on 2026-01-07

  1. Linters new features or changes
    • godoc-lint: from 0.10.2 to 0.11.1 (new rule: require-stdlib-doclink)
    • golines: from 442fd00 to 0.14.0
    • gomoddirectives: from 0.7.1 to 0.8.0
    • gosec: from daccba6 to 2.22.11 (new rule: G116)
    • modernize: from 0.39.0 to 0.40.0 (new analyzers: stringscut, unsafefuncs)
    • prealloc: from 1.0.0 to 1.0.1 (message changes)
    • unqueryvet: from 1.3.0 to 1.4.0 (new options: check-aliased-wildcard, check-string-concat, check-format-strings, check-string-builder, check-subqueries, ignored-functions, sql-builders)
  2. Linters bug fixes
    • go-critic: from 0.14.2 to 0.14.3
    • go-errorlint: from 1.8.0 to 1.9.0
    • govet: from 0.39.0 to 0.40.0
    • protogetter: from 0.3.17 to 0.3.18
    • revive: add missing enable-default-rules setting
  3. Documentation
    • docs: split installation page

v2.7.2

Compare Source

Released on 2025-12-07

  1. Linter bug fixes

v2.7.1

Compare Source

Released on 2025-12-04

  1. Linter bug fixes
    • modernize: disable stringscut analyzer

v2.7.0

Compare Source

  1. Bug fixes
    • fix: clone args used by custom command
  2. Linters new features or changes
    • no-sprintf-host-port: from 0.2.0 to 0.3.1 (ignore string literals without a colon)
    • unqueryvet: from 1.2.1 to 1.3.0 (handles const and var declarations)
    • revive: from 1.12.0 to 1.13.0 (new option: enable-default-rules, new rules: forbidden-call-in-wg-go, unnecessary-if, inefficient-map-lookup)
    • modernize: from 0.38.0 to 0.39.0 (new analyzers: plusbuild, stringscut)
  3. Linters bug fixes
    • perfsprint: from 0.10.0 to 0.10.1
    • wrapcheck: from 2.11.0 to 2.12.0
    • godoc-lint: from 0.10.1 to 0.10.2
  4. Misc.
    • Add some flags to the custom command
  5. Documentation
    • docs: split changelog v1 and v2

v2.6.2

Compare Source

Released on 2025-11-14

  1. Bug fixes
    • fmt command with symlinks
    • use file depending on build configuration to invalidate cache
  2. Linters bug fixes
    • testableexamples: from 1.0.0 to 1.0.1
    • testpackage: from 1.1.1 to 1.1.2

v2.6.1

Compare Source

v2.6.0

Compare Source

  1. New linters
    • Add modernize analyzer suite
  2. Linters new features or changes
    • arangolint: from 0.2.0 to 0.3.1
    • dupword: from 0.1.6 to 0.1.7 (new option comments-only)
    • go-critic: from 0.13.0 to 0.14.0 (new rules/checkers: zeroByteRepeat, dupOption)
    • gofumpt: from 0.9.1 to 0.9.2 ("clothe" naked returns is now controlled by the extra-rules option)
    • perfsprint: from 0.9.1 to 0.10.0 (new options: concat-loop, loop-other-ops)
    • wsl: from 5.2.0 to 5.3.0
  3. Linters bug fixes
    • dupword: from 0.1.6 to 0.1.7
    • durationcheck: from 0.0.10 to 0.0.11
    • exptostd: from 0.4.4 to 0.4.5
    • fatcontext: from 0.8.1 to 0.9.0
    • forbidigo: from 2.1.0 to 2.3.0
    • ginkgolinter: from 0.21.0 to 0.21.2
    • godoc-lint: from 0.10.0 to 0.10.1
    • gomoddirectives: from 0.7.0 to 0.7.1
    • gosec: from 2.22.8 to 2.22.10
    • makezero: from 2.0.1 to 2.1.0
    • nilerr: from 0.1.1 to 0.1.2
    • paralleltest: from 1.0.14 to 1.0.15
    • protogetter: from 0.3.16 to 0.3.17
    • unparam: from 0df0534 to 5beb8c8
  4. Misc.
    • fix: ignore some files to hash the version for custom build

v2.5.0

Compare Source

  1. New linters
  2. Linters new features or changes
    • embeddedstructfieldcheck: from 0.3.0 to 0.4.0 (new option: empty-line)
    • err113: from aea10b5 to 0.1.1 (skip internals of Is methods for error type)
    • ginkgolinter: from 0.20.0 to 0.21.0 (new option: force-tonot)
    • gofumpt: from 0.8.0 to 0.9.1 (new rule is to "clothe" naked returns for the sake of clarity)
    • ineffassign: from 0.1.0 to 0.2.0 (new option: check-escaping-errors)
    • musttag: from 0.13.1 to 0.14.0 (support interface methods)
    • revive: from 1.11.0 to 1.12.0 (new options: identical-ifelseif-branches, identical-ifelseif-conditions, identical-switch-branches, identical-switch-conditions, package-directory-mismatch, unsecure-url-scheme, use-waitgroup-go, useless-fallthrough)
    • thelper: from 0.6.3 to 0.7.1 (skip t.Helper in functions passed to synctest.Test)
    • wsl: from 5.1.1 to 5.2.0 (improvements related to subexpressions)
  3. Linters bug fixes
    • asciicheck: from 0.4.1 to 0.5.0
    • errname: from 1.1.0 to 1.1.1
    • fatcontext: from 0.8.0 to 0.8.1
    • go-printf-func-name: from 0.1.0 to 0.1.1
    • godot: from 1.5.1 to 1.5.4
    • gosec: from 2.22.7 to 2.22.8
    • nilerr: from 0.1.1 to a temporary fork
    • nilnil: from 1.1.0 to 1.1.1
    • protogetter: from 0.3.15 to 0.3.16
    • tagliatelle: from 0.7.1 to 0.7.2
    • testifylint: from 1.6.1 to 1.6.4
  4. Misc.
    • fix: "no export data" errors are now handled as a standard typecheck error
  5. Documentation
    • Improve nolint section about syntax

v2.4.0

Compare Source

  1. Enhancements
    • 🎉 go1.25 support
  2. Linters new features or changes
    • exhaustruct: from v3.3.1 to 4.0.0 (new options: allow-empty, allow-empty-rx, allow-empty-returns, allow-empty-declarations)
  3. Linters bug fixes
    • godox: trim filepath from report messages
    • staticcheck: allow empty options
    • tagalign: from 1.4.2 to 1.4.3
  4. Documentation
    • 🌟 New website (with a search engine)

v2.3.1

Compare Source

  1. Linters bug fixes
    • gci: from 0.13.6 to 0.13.7
    • gosec: from 2.22.6 to 2.22.7
    • noctx: from 0.3.5 to 0.4.0
    • wsl: from 5.1.0 to 5.1.1
    • tagliatelle: force upper case for custom initialisms

v2.3.0

Compare Source

  1. Linters new features or changes
    • ginkgolinter: from 0.19.1 to 0.20.0 (new option: force-assertion-description)
    • iface: from 1.4.0 to 1.4.1 (report message improvements)
    • noctx: from 0.3.4 to 0.3.5 (new detections: log/slog, exec, crypto/tls)
    • revive: from 1.10.0 to 1.11.0 (new rule: enforce-switch-style)
    • wsl: from 5.0.0 to 5.1.0
  2. Linters bug fixes
    • gosec: from 2.22.5 to 2.22.6
    • noinlineerr: from 1.0.4 to 1.0.5
    • sloglint: from 0.11.0 to 0.11.1
  3. Misc.
    • fix: panic close of closed channel

v2.2.2

Compare Source

  1. Linters bug fixes
    • noinlineerr: from 1.0.3 to 1.0.4
  2. Documentation
    • Improve debug keys documentation
  3. Misc.
    • fix: panic close of closed channel
    • godot: add noinline value into the JSONSchema

v2.2.1

Compare Source

  1. Linters bug fixes
  • varnamelen: fix configuration

v2.2.0

Compare Source

  1. New linters
  2. Linters new features or changes
    • errcheck: add verbose option
    • funcorder: from 0.2.1 to 0.5.0 (new option alphabetical)
    • gomoddirectives: from 0.6.1 to 0.7.0 (new option ignore-forbidden)
    • iface: from 1.3.1 to 1.4.0 (new option unexported)
    • noctx: from 0.1.0 to 0.3.3 (new report messages, and new rules related to database/sql)
    • noctx: from 0.3.3 to 0.3.4 (new SQL functions detection)
    • revive: from 1.9.0 to 1.10.0 (new rules: time-date, unnecessary-format, use-fmt-print)
    • usestdlibvars: from 1.28.0 to 1.29.0 (new option time-date-month)
    • wsl: deprecation
    • wsl_v5: from 4.7.0 to 5.0.0 (major version with new configuration)
  3. Linters bug fixes
    • dupword: from 0.1.3 to 0.1.6
    • exptostd: from 0.4.3 to 0.4.4
    • forbidigo: from 1.6.0 to 2.1.0
    • gci: consistently format the code
    • go-spancheck: from 0.6.4 to 0.6.5
    • goconst: from 1.8.1 to 1.8.2
    • gosec: from 2.22.3 to 2.22.4
    • gosec: from 2.22.4 to 2.22.5
    • makezero: from 1.2.0 to 2.0.1
    • misspell: from 0.6.0 to 0.7.0
    • usetesting: from 0.4.3 to 0.5.0
  4. Misc.
    • exclusions: fix path-expect
    • formatters: write the input to stdout when using stdin and there are no changes
    • migration: improve the error message when trying to migrate a migrated config
    • typecheck: deduplicate errors
    • typecheck: stops the analysis after the first error
    • Deprecate print-resources-usage flag
    • Unique version per custom build
  5. Documentation
    • Improves typecheck FAQ
    • Adds plugin systems recommendations
    • Add description for linters.default sets

v2.1.6

Compare Source

  1. Linters bug fixes
    • godot: from 1.5.0 to 1.5.1
    • musttag: from 0.13.0 to 0.13.1
  2. Documentation
    • Add note about golangci-lint v2 integration in VS Code

v2.1.5

Compare Source

Due to an error related to Snapcraft, some artifacts of the v2.1.4 release have not been published.

This release contains the same things as v2.1.3.

v2.1.4

Compare Source

Due to an error related to Snapcraft, some artifacts of the v2.1.3 release have not been published.

This release contains the same things as v2.1.3.

v2.1.3

Compare Source

  1. Linters bug fixes
    • fatcontext: from 0.7.2 to 0.8.0
  2. Misc.
    • migration: fix nakedret.max-func-lines: 0
    • migration: fix order of staticcheck settings
    • fix: add go.mod hash to the cache salt
    • fix: use diagnostic position for related information position

v2.1.2

Compare Source

  1. Linters bug fixes
    • exptostd: from 0.4.2 to 0.4.3
    • gofumpt: from 0.7.0 to 0.8.0
    • protogetter: from 0.3.13 to 0.3.15
    • usetesting: from 0.4.2 to 0.4.3

v2.1.1

Compare Source

The release process of v2.1.0 failed due to a regression inside goreleaser.

The binaries of v2.1.0 have been published, but not the other artifacts (AUR, Docker, etc.).

v2.1.0

Compare Source

  1. Enhancements
    • Add an option to display absolute paths (--path-mode=abs)
    • Add configuration path placeholder (${config-path})
    • Add warn-unused option for fmt command
    • Colored diff for fmt command (golangci-lint fmt --diff-colored)
  2. New linters
  3. Linters new features or changes
    • go-errorlint: from 1.7.1 to 1.8.0 (automatic error comparison and type assertion fixes)
    • ⚠️ goconst: ignore-strings is deprecated and replaced by ignore-string-values
    • goconst: from 1.7.1 to 1.8.1 (new options: find-duplicates, eval-const-expressions)
    • govet: add httpmux analyzer
    • nilnesserr: from 0.1.2 to 0.2.0 (detect more cases)
    • paralleltest: from 1.0.10 to 1.0.14 (checks only _test.go files)
    • revive: from 1.7.0 to 1.9.0 (support kebab case for setting names)
    • sloglint: from 0.9.0 to 0.11.0 (autofix, new option msg-style, suggest slog.DiscardHandler)
    • wrapcheck: from 2.10.0 to 2.11.0 (new option report-internal-errors)
    • wsl: from 4.6.0 to 4.7.0 (cgo files are always excluded)
  4. Linters bug fixes
    • fatcontext: from 0.7.1 to 0.7.2
    • gocritic: fix importshadow checker
    • gosec: from 2.22.2 to 2.22.3
    • ireturn: from 0.3.1 to 0.4.0
    • loggercheck: from 0.10.1 to 0.11.0
    • nakedret: from 2.0.5 to 2.0.6
    • nonamedreturns: from 1.0.5 to 1.0.6
    • protogetter: from 0.3.12 to 0.3.13
    • testifylint: from 1.6.0 to 1.6.1
    • unconvert: update to HEAD
  5. Misc.
    • Fixes memory leaks when using go1.(N) with golangci-lint built with go1.(N-X)
    • Adds golangci-lint-fmt pre-commit hook
  6. Documentation
    • Improvements
    • Updates section about vscode integration

v2.0.2

Compare Source

  1. Misc.
    • Fixes flags parsing for formatters
    • Fixes the filepath used by the exclusion source option
  2. Documentation
    • Adds a section about flags migration
    • Cleaning pages with v1 options

v2.0.1

Compare Source

  1. Linters/formatters bug fixes
    • golines: fix settings during linter load
  2. Misc.
    • Validates the version field before the configuration
    • forbidigo: fix migration

v2.0.0

Compare Source

  1. Enhancements
  2. New linters/formatters
  3. Linters new features
    • ⚠️ Merge staticcheck, stylecheck, gosimple into one linter (staticcheck) (cf. Migration guide)
    • go-critic: from 0.12.0 to 0.13.0
    • gomodguard: from 1.3.5 to 1.4.1 (block explicit indirect dependencies)
    • nilnil: from 1.0.1 to 1.1.0 (new option: only-two)
    • perfsprint: from 0.8.2 to 0.9.1 (checker name in the diagnostic message)
    • staticcheck: new quickfix set of rules
    • testifylint: from 1.5.2 to 1.6.0 (new options: equal-values, suite-method-signature, require-string-msg)
    • wsl: from 4.5.0 to 4.6.0 (new option: allow-cuddle-used-in-block)
  4. Linters bug fixes
    • bidichk: from 0.3.2 to 0.3.3
    • errchkjson: from 0.4.0 to 0.4.1
    • errname: from 1.0.0 to 1.1.0
    • funlen: fix ignore-comments option
    • gci: from 0.13.5 to 0.13.6
    • gosmopolitan: from 1.2.2 to 1.3.0
    • inamedparam: from 0.1.3 to 0.2.0
    • intrange: from 0.3.0 to 0.3.1
    • protogetter: from 0.3.9 to 0.3.12
    • unparam: from 8a5130c to 0df0534
  5. Misc.
    • 🧹 Configuration options renaming (cf. Migration guide)
    • 🧹 Remove options (cf. Migration guide)
    • 🧹 Remove flags (cf. Migration guide)
    • 🧹 Remove alternative names (cf. Migration guide)
    • 🧹 Remove or replace deprecated elements (cf. Migration guide)
    • Adds an option to display some commands as JSON:
      • golangci-lint config path --json
      • golangci-lint help linters --json
      • golangci-lint help formatters --json
      • golangci-lint linters --json
      • golangci-lint formatters --json
      • golangci-lint version --json
  6. Documentation

v1.64.8

Compare Source

  • Detects use of configuration files from golangci-lint v2

v1.64.7

Compare Source

  1. Linters bug fixes
    • depguard: from 2.2.0 to 2.2.1
    • dupl: from 3e9179a to f665c8d
    • gosec: from 2.22.1 to 2.22.2
    • staticcheck: from 0.6.0 to 0.6.1
  2. Documentation
    • Add GitLab documentation

v1.64.6

Compare Source

  1. Linters bug fixes
    • asciicheck: from 0.4.0 to 0.4.1
    • contextcheck: from 1.1.5 to 1.1.6
    • errcheck: from 1.8.0 to 1.9.0
    • exptostd: from 0.4.1 to 0.4.2
    • ginkgolinter: from 0.19.0 to 0.19.1
    • go-exhaustruct: from 3.3.0 to 3.3.1
    • gocheckcompilerdirectives: from 1.2.1 to 1.3.0
    • godot: from 1.4.20 to 1.5.0
    • perfsprint: from 0.8.1 to 0.8.2
    • revive: from 1.6.1 to 1.7.0
    • tagalign: from 1.4.1 to 1.4.2

v1.64.5

Compare Source

  1. Bug fixes
    • Add missing flag new-from-merge-base-flag
  2. Linters bug fixes
    • asciicheck: from 0.3.0 to 0.4.0
    • forcetypeassert: from 0.1.0 to 0.2.0
    • gosec: from 2.22.0 to 2.22.1

v1.64.4

Compare Source

  1. Linters bug fixes
    • gci: fix standard packages list for go1.24

v1.64.3

Compare Source

  1. Linters bug fixes
    • ginkgolinter: from 0.18.4 to 0.19.0
    • go-critic: from 0.11.5 to 0.12.0
    • revive: from 1.6.0 to 1.6.1
    • gci: fix standard packages list for go1.24
  2. Misc.
    • Build Docker images with go1.24

v1.64.2

Compare Source

This is the last minor release of golangci-lint v1.
The next release will be golangci-lint v2.

  1. Enhancements
    • 🎉 go1.24 support
    • New issues.new-from-merge-base option
    • New run.relative-path-mode option
  2. Linters new features
    • copyloopvar: from 1.1.0 to 1.2.1 (support suggested fixes)
    • exptostd: from 0.3.1 to 0.4.1 (handles golang.org/x/exp/constraints.Ordered)
    • fatcontext: from 0.5.3 to 0.7.1 (new option: check-struct-pointers)
    • perfsprint: from 0.7.1 to 0.8.1 (new options: integer-format, error-format, string-format, bool-format, and hex-format)
    • revive: from 1.5.1 to 1.6.0 (new rules: redundant-build-tag, use-errors-new. New option early-return.early-return)
  3. Linters bug fixes
    • go-errorlint: from 1.7.0 to 1.7.1
    • gochecknoglobals: from 0.2.1 to 0.2.2
    • godox: from 006bad1 to 1.1.0
    • gosec: from 2.21.4 to 2.22.0
    • iface: from 1.3.0 to 1.3.1
    • nilnesserr: from 0.1.1 to 0.1.2
    • protogetter: from 0.3.8 to 0.3.9
    • sloglint: from 0.7.2 to 0.9.0
    • spancheck: fix default StartSpanMatchersSlice values
    • staticcheck: from 0.5.1 to 0.6.0
  4. Deprecations
    • ⚠️ tenv is deprecated and replaced by usetesting.os-setenv: true.
    • ⚠️ exportloopref deprecation step 2
  5. Misc.
    • Sanitize severities by output format
    • Avoid panic with plugin without description
  6. Documentation
    • Clarify depguard configuration

v1.64.1

Compare Source

Cancelled due to CI failure.

v1.64.0

Compare Source

Cancelled due to CI failure.

santhosh-tekuri/jsonschema (github.com/santhosh-tekuri/jsonschema/v5)

v6.0.2

Compare Source

v6.0.1

Compare Source

Bug Fixes:

  • fix/schema: field RecursiveRef misspelled
  • fix/schema: missing Deprecated field

check https://redirect.github.com/santhosh-tekuri/jsonschema/discussions/172 to see notes for migrating from v5 to v6

v6.0.0

Compare Source

Improvements

  • mixed dialect support
  • custom $vocabulary support
  • sermver format
  • support for localisation for ValidationError
  • command jv
    • support stdin
    • --insecure and --cacert flag
    • --quiet flag

check https://redirect.github.com/santhosh-tekuri/jsonschema/discussions/172 to see notes for migrating from v5 to v6

tektoncd/pipeline (github.com/tektoncd/pipeline)

v1.10.0: Tekton Pipeline release v1.10.0 "LaPerm Little Helper"

Compare Source

🎉 Observability, evolved: Tekton Pipelines migrates to OpenTelemetry 🎉

-Docs @​ v1.10.0
-Examples @​ v1.10.0

Installation one-liner
kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.10.0/release.yaml
Attestation

The Rekor UUID for this release is 108e9186e8c5677a94dd58f7cfb4996ccce2c937681486ef690dab5e560e66c6c34aa9b446f32651

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a94dd58f7cfb4996ccce2c937681486ef690dab5e560e66c6c34aa9b446f32651
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.10.0/release.yaml
REKOR_UUID=108e9186e8c5677a94dd58f7cfb4996ccce2c937681486ef690dab5e560e66c6c34aa9b446f32651

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.10.0@​sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done
Upgrade Notices
  • 🚨 Metrics migration from OpenCensus to OpenTelemetry (#​9043)

    ACTION REQUIRED: Infrastructure metrics (Go runtime, Workqueue, K8s Client) have been renamed from the tekton_pipelines_controller_ prefix to standard OpenTelemetry/Knative namespaces. The reason label has been added to duration metrics (pipelinerun_duration_seconds, taskrun_duration_seconds). The reconcile_count and reconcile_latency metrics have been removed.

    Upgrade actions:

    1. Update Config: Ensure your config-observability ConfigMap uses metrics-protocol: prometheus (or grpc/http) instead of the old metrics.backend-destination. If prometheus was already being used, no changes are needed.
    2. Update Dashboards:
      • Replace tekton_pipelines_controller_workqueue_* queries with kn_workqueue_*
      • Replace tekton_pipelines_controller_go_* queries with standard go_* metrics
      • Check aggregations on pipelinerun_duration_seconds to account for the new reason label

    See the full migration table in PR #​9043 for complete details.

Changes
Features
  • ✨ feat: Add SHA-256 support for Git resolver revision validation (#​9278)

    Git resolver now supports SHA-256 commit hashes for revision validation.

  • ✨ feat(metrics): Migrate from OpenCensus to OpenTelemetry (#​9043)

    Migrated PipelineRun and TaskRun metrics to OpenTelemetry instruments (histograms, counters, gauges). Updated Knative to 1.19. See Upgrade Notices for breaking changes and required actions.

  • ✨ ci: add /rebase slash command workflow (#​9375)

Fixes
  • 🐛 fix: Remove redundant shortNames from ResolutionRequest CRD (#​9398)

    Remove redundant shortNames from ResolutionRequest CRD that caused ShortNamesConflict on Kubernetes 1.33+

  • 🐛 fix(pipelines): allow pipeline param defaults to use non-param variables (#​9386)

    Fixed a bug which caused PipelineRun validation to fail when a pipeline parameter's default value referenced a non-parameter variable (e.g. $(context.pipelineRun.name))

  • 🐛 fix: pipeline-level results not recorded from failed tasks (#​9367)

    Pipeline-level results now include results from failed, cancelled, and timed-out tasks, fixing cases where results referencing non-successful task outputs were left as unresolved variable strings.

  • 🐛 ci: replace e2e-only fan-in with unified CI summary job (#​9394)

  • 🐛 fix: Align cache configstore with framework implementation (#​9282)

  • 🐛 accept featureFlags.EnableTektonOCIBundles to fix unknown field error (#​8996)

Misc
  • 🔨 build(deps): bump golang.org/x/crypto from 0.36.0 to 0.45.0 in /test/resolver-with-timeout (#​9426)
  • 🔨 Move v0.68 LTS to End of Life releases (#​9434)
  • 🔨 Assess several new gosec findings (#​9405)
  • 🔨 ci: Update cherry-pick command to latest plumbing (#​9400)
  • 🔨 build(deps): bump opentelemetry exporter packages to v1.39.0 (#​9332)
  • 🔨 build(deps): bump github.com/google/go-containerregistry from 0.21.0 to 0.21.1 (#​9433)
  • 🔨 build(deps): bump github/codeql-action from 4.32.3 to 4.32.4 (#​9431)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#​9430)
  • 🔨 build(deps): bump tj-actions/changed-files from 47.0.2 to 47.0.4 (#​9429)
  • 🔨 build(deps): bump actions/dependency-review-action from 4.8.2 to 4.8.3 (#​9428)
  • 🔨 build(deps): bump chainguard-dev/actions from 1.6.1 to 1.6.4 (#​9427)
  • 🔨 build(deps): bump github.com/sigstore/sigstore from 1.8.4 to 1.10.4 in /test/resolver-with-timeout (#​9425)
  • 🔨 build(deps): bump github.com/google/go-containerregistry from 0.20.7 to 0.21.0 (#​9418)
  • 🔨 build(deps): bump github.com/tektoncd/pipeline from 1.9.0 to 1.9.1 in /test/custom-task-ctrls/wait-task-beta (#​9417)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#​9397)
  • 🔨 build(deps): bump github/codeql-action from 4.32.2 to 4.32.3 (#​9396)
  • 🔨 build(deps): bump chainguard-dev/actions from 1.5.16 to 1.6.1 (#​9395)
  • 🔨 build(deps): bump google.golang.org/grpc from 1.79.0 to 1.79.1 (#​9392)
  • 🔨 build(deps): bump github.com/jenkins-x/go-scm from 1.15.16 to 1.15.17 (#​9391)
  • 🔨 build(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.0 (#​9389)
  • 🔨 build(deps): bump k8s.io/code-generator from 0.32.11 to 0.32.12 (#​9388)
  • 🔨 build(deps): bump k8s.io/apiextensions-apiserver from 0.32.11 to 0.32.12 (#​9385)
  • 🔨 build(deps): bump k8s.io/apimachinery from 0.33.7 to 0.33.8 (#​9384)
  • 🔨 build(deps): bump k8s.io/client-go from 0.32.11 to 0.32.12 (#​9383)
  • 🔨 build(deps): bump k8s.io/client-go from 0.32.11 to 0.32.12 in /test/custom-task-ctrls/wait-task-beta (#​9382)
  • 🔨 build(deps): bump k8s.io/api from 0.32.11 to 0.32.12 in /test/custom-task-ctrls/wait-task-beta (#​9381)
  • 🔨 build(deps): bump k8s.io/apimachinery from 0.33.7 to 0.33.8 in /test/custom-task-ctrls/wait-task-beta (#​9380)
  • 🔨 build(deps): bump github/codeql-action from 4.32.1 to 4.32.2 (#​9374)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#​9373)
  • 🔨 build(deps): bump step-security/harden-runner from 2.14.1 to 2.14.2 (#​9372)
  • 🔨 build(deps): bump tj-actions/changed-files from 47.0.1 to 47.0.2 (#​9371)
  • 🔨 build(deps): bump chainguard-dev/actions from 1.5.14 to 1.5.16 (#​9370)
  • 🔨 build(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 (#​9369)
  • 🔨 build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.39.0 to 1.40.0 (#​9363)
  • 🔨 fix(ci): simplify e2e test health status result (#​9361)
  • 🔨 build(deps): bump the all group in /tekton with 4 updates (#​9352)
  • 🔨 build(deps): bump chainguard-dev/actions from 1.5.13 to 1.5.14 (#​9351)
  • 🔨 build(deps): bump github/codeql-action from 4.32.0 to 4.32.1 (#​9350)
  • 🔨 build(deps): bump actions/cache from 4.2.3 to 5.0.3 (#​9348)
  • 🔨 build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.37.0 to 1.40.0 (#​9345)
  • 🔨 build(deps): bump github.com/tektoncd/pipeline from 1.7.0 to 1.9.0 in /test/custom-task-ctrls/wait-task-beta (#​9340)
  • 🔨 build(deps): bump google.golang.org/grpc from 1.77.0 to 1.78.0 (#​9337)
  • 🔨 build(deps): bump github.com/spiffe/spire-api-sdk from 1.14.0 to 1.14.1 (#​9336)
  • 🔨 build(deps): bump sigstore/sigstore from 1.9.5 to 1.10.4 (#​9331)
  • 🔨 build(deps): bump github.com/tektoncd/pipeline to v1.7.0 in wait-task-beta (#​9329)
Docs
  • 📖 docs: clarify flag availability across controller binaries (#​9390)
  • 📖 docs: update releases.md for v1.9.0 LTS (#​9339)
  • 📖 docs: Document roadmap project board workflows and best practices (#​9311)
  • 📖 Update examples in docs for changes in apiVersion v1 (#​9042)
Thanks

Thanks to these contributors who contributed to v1.10.0!

Extra shout-out for awesome release notes:

v1.9.1: Tekton Pipeline release v1.9.1 "Devon Rex Dreadnought"

Compare Source

-Docs @​ v1.9.1
-Examples @​ v1.9.1

Installation one-liner
kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.1/release.yaml
Attestation

The Rekor UUID for this release is 108e9186e8c5677a127d1213c2768a992b19df1a58983ef2336fc3ede3d6b9fdbd7e49431bdf3cc0

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a127d1213c2768a992b19df1a58983ef2336fc3ede3d6b9fdbd7e49431bdf3cc0
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.1/release.yaml
REKOR_UUID=108e9186e8c5677a127d1213c2768a992b19df1a58983ef2336fc3ede3d6b9fdbd7e49431bdf3cc0

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.9.1@​sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done
Changes
Features
Fixes
  • 🐛 [release-v1.9.x] fix(pipelines): allow pipeline param defaults to use non-param variables (#​9387)
Misc
  • 🔨 [release-v1.9.x] ci: add CI summary fan-in job for branch protection (#​9407)
  • 🔨 [cherry-pick: release-v1.9.x] tekton: update plumbing ref to latest commit (#​9413)
  • 🔨 [cherry-pick: release-v1.9.x] tekton: update plumbing ref to include full image references fix (#​9401)
Docs
Thanks

Thanks to these contributors who contributed to v1.9.1!

Extra shout-out for awesome release notes:

v1.9.0: Tekton Pipeline release v1.9.0 LTS "Devon Rex Dreadnought"

Compare Source

🎉 hostUsers support and digest validation for http resolver 🎉

-Docs @​ v1.9.0
-Examples @​ v1.9.0

Installation one-liner
kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.0/release.yaml
Attestation

The Rekor UUID for this release is 108e9186e8c5677a692b1410db6e04e5e4a25aec2e361118647fe42c5ad8d7ef3e087b5cd11463d6

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a692b1410db6e04e5e4a25aec2e361118647fe42c5ad8d7ef3e087b5cd11463d6
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.9.0/release.yaml
REKOR_UUID=108e9186e8c5677a692b1410db6e04e5e4a25aec2e361118647fe42c5ad8d7ef3e087b5cd11463d6

# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.9.0@​sha256:" + .digest.sha256')

# Download the release file
curl -L "$RELEASE_FILE" > release.yaml

# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
  printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done
Changes
Features
  • ✨ feat: add ServiceAccount inheritance to Affinity Assistants (#​9253)

  • ✨ Add hostUsers field support to PodTemplate (#​9227)

  • ✨ feat: Add digest validation support to HTTP resolver (#​9171)

  • ✨ taskrun: include actual result size in error when exceeding maxResultSize (#​8869)

Fixes
  • 🐛 fix(pipelinerun): fix the issue of massive invalid status updates caused by unordered arrays, which will greatly impact the resource load and stability of the apiserver. (#​9295)

  • 🐛 Fix parameter resolution for defaults with references (#​9271)

  • 🐛 Fix duplicated protobuf tag in pod.Template struct (#​9229)

  • 🐛 fix: Prevent excessive reconciliation when timeout disabled (#​9202)

  • 🐛 fix: Detect pod configuration errors early instead of timeout (#​9197)

  • 🐛 chore(ci): update cherry-pick workflow to fix multi-commit PRs (#​9320)

  • 🐛 fix: validate taskRef.apiVersion format for custom tasks (#​9045)

  • 🐛 test(e2e): move flaky retry/matrix tests to no-ci temporarily (#​9242)

  • 🐛 fix(e2e): improve dind-sidecar probe configuration for reliability (#​9241)

Misc
  • 🔨 fix: reduce CRD size by shortening verbose descriptions (#​9252)
  • 🔨 ci: add KOCACHE to speed up ko builds in GitHub Actions (#​9319)
  • 🔨 Improve code consistency and fix missing test annotation (#​9266)
  • 🔨 Remove the GHCR migration notice from the readme (#​9237)
  • 🔨 fix: release pipeline feedback (#​9210)
  • 🔨 build(deps): bump go.uber.org/zap from 1.27.0 to 1.27.1 (#​9333)
  • 🔨 build(deps): bump github.com/google/cel-go from 0.26.0 to 0.27.0 (#​9330)
  • 🔨 build(deps): bump github/codeql-action from 4.31.9 to 4.32.0 ([#​9310](https://redirect.github.com/tektoncd/pipeline/i

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM ( * 0-3 * * * ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate renovate bot force-pushed the renovate/main-major-go-modules branch from 3061ab1 to ad5b351 Compare February 27, 2026 09:54
@renovate
Copy link
Contributor Author

renovate bot commented Feb 27, 2026

⚠️ Artifact update problem

Renovate failed to update artifacts related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: acceptance/go.sum
Command failed: go get -t ./...
go: module github.com/tektoncd/pipeline@v1.10.0 requires go >= 1.25.6; switching to go1.25.7
go: gopkg.in/go-jose/go-jose.v4@v4.1.3: parsing go.mod:
	module declares its path as: github.com/go-jose/go-jose/v4
	        but was required as: gopkg.in/go-jose/go-jose.v4

File name: tools/go.sum
Command failed: go get -t ./...
go: downloading github.com/golangci/golangci-lint v1.57.2
go: downloading github.com/tektoncd/chains v0.22.2
go: downloading github.com/tektoncd/cli v0.38.0
go: downloading gotest.tools/gotestsum v1.12.1
go: downloading k8s.io/kubernetes v1.34.2
go: downloading golang.org/x/exp v0.0.0-20250620022241-b7579e27df2b
go: downloading github.com/go-openapi/swag v0.23.1
go: downloading github.com/tektoncd/triggers v0.29.0
go: downloading sigs.k8s.io/kustomize/kyaml v0.21.0
go: downloading github.com/go-viper/mapstructure/v2 v2.5.0
go: downloading github.com/ldez/gomoddirectives v0.8.0
go: downloading github.com/golangci/plugin-module-register v0.1.2
go: downloading github.com/mailru/easyjson v0.9.0
go: downloading github.com/go-openapi/jsonpointer v0.21.1
go: downloading cloud.google.com/go/kms v1.22.0
go: downloading cloud.google.com/go v0.121.2
go: downloading google.golang.org/api v0.239.0
go: downloading cloud.google.com/go/storage v1.53.0
go: downloading google.golang.org/genproto v0.0.0-20250603155806-513f23925822
go: downloading github.com/ldez/grignotin v0.10.1
go: downloading github.com/4meepo/tagalign v1.4.3
go: downloading github.com/Abirdcfly/dupword v0.1.7
go: downloading github.com/Antonboom/errname v1.1.1
go: downloading github.com/Antonboom/nilnil v1.1.1
go: downloading github.com/Antonboom/testifylint v1.6.4
go: downloading github.com/Djarvur/go-err113 v0.1.1
go: downloading github.com/alexkohler/nakedret/v2 v2.0.6
go: downloading github.com/alexkohler/prealloc v1.0.2
go: downloading github.com/bombsimon/wsl/v4 v4.7.0
go: downloading github.com/breml/bidichk v0.3.3
go: downloading github.com/breml/errchkjson v0.4.1
go: downloading github.com/butuzov/ireturn v0.4.0
go: downloading github.com/catenacyber/perfsprint v0.10.1
go: downloading github.com/charithe/durationcheck v0.0.11
go: downloading github.com/ckaznocha/intrange v0.3.1
go: downloading github.com/firefart/nonamedreturns v1.0.6
go: downloading github.com/ghostiam/protogetter v0.3.20
go: downloading github.com/go-critic/go-critic v0.14.3
go: downloading github.com/golangci/misspell v0.8.0
go: downloading github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e
go: downloading github.com/gordonklaus/ineffassign v0.2.0
go: downloading github.com/gostaticanalysis/nilerr v0.1.2
go: downloading github.com/jgautheron/goconst v1.8.2
go: downloading github.com/jirfag/go-printf-func-name v0.0.0-20200119135958-7558a9eaa5af
go: downloading github.com/jjti/go-spancheck v0.6.5
go: downloading github.com/karamaru-alpha/copyloopvar v1.2.2
go: downloading github.com/kulti/thelper v0.7.1
go: downloading github.com/kunwardeep/paralleltest v1.0.15
go: downloading github.com/ldez/tagliatelle v0.7.2
go: downloading github.com/lufeee/execinquery v1.2.1
go: downloading github.com/macabu/inamedparam v0.2.0
go: downloading github.com/maratori/testableexamples v1.0.1
go: downloading github.com/maratori/testpackage v1.1.2
go: downloading github.com/mgechev/revive v1.14.0
go: downloading github.com/nunnatsa/ginkgolinter v0.23.0
go: downloading github.com/ryancurrah/gomodguard v1.4.1
go: downloading github.com/sashamelentyev/usestdlibvars v1.29.0
go: downloading github.com/securego/gosec/v2 v2.23.0
go: downloading github.com/sonatard/noctx v0.4.0
go: downloading github.com/stbenjam/no-sprintf-host-port v0.3.1
go: downloading github.com/tetafro/godot v1.5.4
go: downloading github.com/timakin/bodyclose v0.0.0-20241222091800-1db5c5ca4d67
go: downloading github.com/timonwong/loggercheck v0.11.0
go: downloading github.com/tomarrell/wrapcheck/v2 v2.12.0
go: downloading github.com/xen0n/gosmopolitan v1.3.0
go: downloading go-simpler.org/musttag v0.14.0
go: downloading go-simpler.org/sloglint v0.11.1
go: downloading honnef.co/go/tools v0.7.0
go: downloading mvdan.cc/gofumpt v0.9.2
go: downloading mvdan.cc/unparam v0.0.0-20251027182757-5beb8c8f8f15
go: downloading cloud.google.com/go/iam v1.5.2
go: downloading cloud.google.com/go/longrunning v0.6.7
go: downloading github.com/googleapis/gax-go/v2 v2.15.0
go: downloading cloud.google.com/go/auth v0.16.5
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20250818200422-3122310a409c
go: downloading cloud.google.com/go/firestore v1.18.0
go: downloading cloud.google.com/go/compute/metadata v0.8.0
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.51.0
go: downloading github.com/alfatraining/structtag v1.0.0
go: downloading github.com/quasilyte/go-ruleguard v0.4.5
go: downloading github.com/ccojocar/zxcvbn-go v1.0.4
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0
go: downloading cloud.google.com/go/monitoring v1.24.2
go: downloading github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.51.0
go: downloading golang.org/x/exp/typeparams v0.0.0-20260209203927-2842357ff358
go: downloading codeberg.org/chavacava/garif v0.2.0
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.6
go: downloading github.com/golangci/gofmt v0.0.0-20251215234548-e7be49a5ab4d
go: downloading helm.sh/helm v2.17.0+incompatible
go: downloading github.com/lib/pq v1.11.1
go: github.com/conforma/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/golangci/gofmt/goimports: cannot find module providing package github.com/golangci/gofmt/goimports
go: github.com/conforma/cli/tools imports
	github.com/golangci/golangci-lint/cmd/golangci-lint imports
	github.com/golangci/golangci-lint/pkg/commands imports
	github.com/golangci/golangci-lint/pkg/lint/lintersdb imports
	github.com/golangci/golangci-lint/pkg/golinters imports
	github.com/nunnatsa/ginkgolinter/types: cannot find module providing package github.com/nunnatsa/ginkgolinter/types
go: warning: github.com/klauspost/compress@v1.18.1: retracted by module author: https://github.com/klauspost/compress/issues/1114
go: to switch to the latest unretracted version, run:
	go get github.com/klauspost/compress@latest

@github-actions github-actions bot added size: L and removed size: S labels Feb 27, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants