v0.45.3 Release 🎉

This release includes security fixes, Go toolchain updates, dependency upgrades, and improvements to plugin security, bundle processing, and Tekton release handling.

Security Fixes

• Fix CVE-2026-84304 (gRPC-Go): Updated gRPC-Go dependencies to address the reported security vulnerability. (#3332, #3346)
• Update Go toolchain to address CVEs: Updated Go from 1.26.6 to 1.26.10 to address CVE-2026-111943. (#3370)
• Prevent excessive memory allocation: Fixed unbounded tar layer allocation during bundle processing. (#3229)
• Harden plugin directory validation: Reject relative plugin directories to prevent unintended current-working-directory fallback (CWE-426). (#3219)
• Improve bundle security: Gate name.Insecure behind the --remote-skip-tls flag to address CWE-319. (#3231)
• Improve plugin validation: Add an executable-bit check when locating plugins. (#3237)

Dependency Updates

• gRPC-Go: Updated google.golang.org/grpc from 1.82.1 to 1.82.2, followed by an update to v1.83.2. (#3194, #3346)
• Go JOSE: Updated github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5, followed by an update to 4.1.6. (#3216, #3363)
• Sigstore: Updated github.com/sigstore/sigstore from 1.10.9 to 1.10.11. (#3288)
• Kubernetes and Go dependencies: Updated dependencies in the Go/Kubernetes dependency group. (#3172, #3317)
• Additional dependencies: Updated two dependencies through the automated dependency update group. (#3347)

Improvements and Maintenance

• Version management: Updated the CLI version to the latest patch version. (#3202)
• Tekton release resolution: Updated Tekton release references and fixed a ConfigMap timing issue. (#3323)
• CI diagnostics: Updated chainguard-dev/actions/kind-diag through versions 1.6.32, 1.6.33, 1.6.34, 1.6.35, 1.6.36, 1.6.37, and 1.6.41. (#3168, #3191, #3213, #3250, #3286, #3308, #3364)
• Developer workflows: Added slash command workflows for rebasing and cherry-picking changes. (#3223)

Changelog

• 752f827 New version v0.45.3

Full Changelog: v0.45.2...v0.45.3

v0.46.2 Release 🎉

This release includes security fixes, Go toolchain updates, dependency upgrades, and improvements to Hub resource installation and Tekton release handling.

Security Fixes

• Fix CVE-2026-84304 (gRPC-Go): Updated gRPC-Go dependencies to address the reported security vulnerability. (#3331, #3339)
• Update Go toolchain to address CVEs: Updated Go from 1.26.6 to 1.26.10 to address CVE-2026-111943. (#3369)
• Restrict Hub installation resource fetching: Improved resource-fetching restrictions for tkn hub install. (#3320)

Dependency Updates

• Sigstore: Updated github.com/sigstore/sigstore from 1.10.9 to 1.10.11. (#3293)
• Testify: Updated github.com/stretchr/testify from 1.12.0 to 1.12.1. (#3316)
• Kubernetes and Go dependencies: Updated dependencies in the Go/Kubernetes dependency group. (#3315)
• gRPC-Go: Updated google.golang.org/grpc from 1.83.1 to 1.83.2. (#3339)
• Tekton Triggers: Updated github.com/tektoncd/triggers from 0.36.0 to 0.36.4. (#3344)
• Go JOSE: Updated github.com/go-jose/go-jose/v4 from 4.1.5 to 4.1.6. (#3359)
• Additional dependencies: Updated two dependencies through the automated dependency update group. (#3340)

Improvements and Maintenance

• Update to the latest patch version: Bumped the relevant version to the latest patch release. (#3277)
• Use the latest Tekton releases: Updated Tekton release references and fixed a ConfigMap timing issue. (#3322)
• Update CI diagnostics: Upgraded chainguard-dev/actions/kind-diag through versions 1.6.36, 1.6.37, and 1.6.41. (#3289, #3312, #3362)

Changelog

• 9ea027b New version v0.46.2

Full Changelog: v0.46.1...v0.46.2

v0.37.8 Release 🎉

This release includes security fixes, Go standard library updates, dependency upgrades, and improvements to plugin handling and bundle processing.

What's Changed

Security Fixes

• Fix Go standard library CVEs: Updated Go from 1.25.13 to 1.26.10 to address CVEs. (#3137, #3371)
• Fix gRPC-Go security vulnerabilities: Updated gRPC-related dependencies to address security advisories. (#3133, #3330, #3372)
• Prevent insecure bundle handling: Gate name.Insecure behind the --remote-skip-tls flag to address CWE-319. (#3234)
• Harden plugin directory validation: Reject relative plugin directories to prevent unintended current-working-directory fallback (CWE-426). (#3226)
• Prevent excessive memory allocation: Fix unbounded tar layer allocation during bundle processing. (#3235)
• Improve plugin security: Add an executable-bit check when locating plugins. (#3239)

Dependency Updates

• Sigstore: Updated github.com/sigstore/sigstore from 1.10.8 to 1.10.9, and subsequently to 1.10.11. (#3104, #3292)
• Cosign: Updated github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5. (#3112)
• Go container registry: Updated github.com/google/go-containerregistry from 0.21.7 to 0.21.9. (#3113)
• gRPC-Go: Updated google.golang.org/grpc to v1.83.2 to address CVE-2026-84304. (#3372)
• Kubernetes and Go dependencies: Updated dependencies in the Go/Kubernetes dependency group. (#3173, #3310)

CI/CD and Developer Workflow Improvements

• Updated chainguard-dev/actions/kind-diag through versions 1.6.29, 1.6.30, 1.6.31, 1.6.32, 1.6.33, 1.6.34, 1.6.35, 1.6.36, 1.6.37, 1.6.40, and 1.6.41. (#3092, #3117, #3148, #3165, #3188, #3210, #3257, #3285, #3305, #3342, #3361)

• Added slash command workflows for rebasing and cherry-picking changes. (#3225)

• Updated Tekton release references and fixed a ConfigMap timing issue. (#3335)

Changelog

• 8e0f636 New version v0.37.8

Full Changelog: v0.37.7...v0.37.8

v0.46.1 Release 🎉

This patch release includes dependency updates and security fixes addressing multiple CVEs and improving dependency security. It also includes fixes for tar layer allocation, TLS handling, and plugin validation to improve overall security and reliability.

Changelog

• f88b13c New version v0.46.1

What's Changed

• [release-v0.46.x] bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 by @dependabot[bot] in #3150
• [release-v0.46.x] bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in #3147
• [release-v0.46.x] bump the all group with 4 updates by @dependabot[bot] in #3153
• [release-v0.46.x] bump the go-k8s-dependencies group with 3 updates by @dependabot[bot] in #3171
• [release-v0.46.x] bump the all group with 3 updates by @dependabot[bot] in #3175
• [release-v0.46.x] bump the all group with 3 updates by @dependabot[bot] in #3198
• [release-v0.46.x] bump google.golang.org/grpc from 1.82.1 to 1.82.2 by @dependabot[bot] in #3196
• [release-v0.46.x] bump the all group with 3 updates by @dependabot[bot] in #3217
• [release-v0.46.x] bump github.com/go-jose/go-jose/v4 from 4.1.4 to 4.1.5 by @dependabot[bot] in #3215
• [cherry-pick: release-v0.46.x] fix: prevent unbounded tar layer allocation by @tekton-robot in #3228
• [cherry-pick: release-v0.46.x] fix(bundle): gate name.Insecure behind --remote-skip-tls (CWE-319) by @tekton-robot in #3232
• [release-v0.46.x] fix(plugins): reject relative plugin dirs to prevent cwd fallback (CWE-426) by @divyansh42 in #3220
• [cherry-pick: release-v0.46.x] fix: add execute-bit check in FindPlugin by @tekton-robot in #3238
• [release-v0.46.x] bump chainguard-dev/actions/kind-diag from 1.6.34 to 1.6.35 in the all group by @dependabot[bot] in #3262
• [release-v0.46.x] chore: add rebase and cherry-pick slash command workflows by @divyansh42 in #3224
• chore(deps): update Go and deps to fix CVEs by @divyansh42 in #3276

Full Changelog: v0.46.0...v0.46.1

v0.45.2 Release 🎉

The Tekton CLI v0.45.x release primarily contains security fixes and dependency updates, including an upgrade to Go 1.26.6 and updates to Sigstore, gRPC, CEL, protobuf, and container registry dependencies.

Changelog

• 8777bc4 New version v0.45.2

What's Changed

• [release-v0.45.x] bump the go-k8s-dependencies group with 3 updates by @dependabot[bot] in #3080
• [release-v0.45.x] bump chainguard-dev/actions/kind-diag from 1.6.27 to 1.6.28 in the all group by @dependabot[bot] in #3077
• [release-v0.45.x] bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @dependabot[bot] in #3095
• [release-v0.45.x] bump github.com/sigstore/sigstore from 1.10.8 to 1.10.9 by @dependabot[bot] in #3100
• [release-v0.45.x] bump chainguard-dev/actions/kind-diag from 1.6.28 to 1.6.29 in the all group by @dependabot[bot] in #3093
• [release-v0.45.x] bump github.com/google/go-containerregistry from 0.21.8 to 0.21.9 by @dependabot[bot] in #3123
• [release-v0.45.x] bump github.com/sigstore/cosign/v2 from 2.6.4 to 2.6.5 by @dependabot[bot] in #3125
• [release-v0.45.x] bump chainguard-dev/actions/kind-diag from 1.6.29 to 1.6.30 in the all group across 1 directory by @dependabot[bot] in #3119
• [release-v0.45.x] Security: Fix GHSA-hrxh-6v49-42gf (google.golang.org/grpc) by @divyansh42 in #3131
• [release-v0.45.x] Security: Fix stdlib CVEs (go1.26.6) and sigstore-go v1.2.0 by @divyansh42 in #3134
• [release-v0.45.x] bump chainguard-dev/actions/kind-diag from 1.6.30 to 1.6.31 in the all group by @dependabot[bot] in #3145
• [release-v0.45.x] bump google.golang.org/protobuf from 1.36.12-0.20260120151049-f2248ac996af to 1.36.12 by @dependabot[bot] in #3139
• [release-v0.45.x] Security: Fix GHSA-gcjh-h69q-9w9g (github.com/google/cel-go) by @divyansh42 in #3156

Full Changelog: v0.45.1...v0.45.2

v0.46.0 Release 🎉

This release internalizes Hub CLI functionality directly into tkn, adds the --log-failed flag to the pipelinerun logs command for filtering failed task logs, replaces cosign with sigstore and blang/semver with Masterminds/semver, removes the unused tektoncd/chains dependency, migrates from gotest.tools v2 to v3.
Updates Tekton Pipelines support to v1.14.1, enables Codecov coverage reporting in CI, and includes dependency updates to address CVE-2026-42505 and other critical security fixes.

Changelog

• a5be122 New version v0.46.0

Deprecated ⚠️

• [Hub CLI Migration] Hub is deprecated and internalize Hub CLI functionality into tkn by @divyansh42 in #2876

Features 🌟

• Add --log-failed flag to pipelinerun logs command by @chmouel in #2920

Refactoring & Cleanup 🛠️

• chore(deps): replace gotest.tools v2 with v3 to reduce dependency by @arvindk-softwaredev in #3060
• chore(deps): replaced cosign with sigstore and replaced blang/semver … by @anwesha-palit-redhat in
• cleanup: removed chains dead code by @arvindk-softwaredev in #3039

Dependency Updates

• Bump github.com/sigstore/sigstore from 1.10.5 to 1.10.6 by @dependabot[bot] in #2866

• Bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #2867

• Bump github.com/google/go-containerregistry from 0.21.5 to 0.21.6 by @dependabot[bot] in #2873

• Bump step-security/harden-runner from 2.19.1 to 2.19.3 by @dependabot[bot] in #2874

• Bump github/codeql-action from 4.35.3 to 4.35.5 by @dependabot[bot] in #2875

• Bump github/codeql-action from 4.35.5 to 4.36.0 by @dependabot[bot] in #2885

• Bump golang.org/x/crypto from 0.51.0 to 0.52.0 by @dependabot[bot] in #2882

• Bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @dependabot[bot] in #2884

• Fix(ci): Pin Tekton Pipelines to v1.12.0 in e2e tests by @divyansh42 in #2897

• Add agentic workflow context files by @ngelman1 in #2890

• Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #2891

• Bump chainguard-dev/actions from 1.6.19 to 1.6.22 by @dependabot[bot] in #2898

• Bump github/codeql-action from 4.36.0 to 4.36.2 by @dependabot[bot] in #2899

• Bump the go-k8s-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2862

• Bump github.com/docker/cli from 29.4.3+incompatible to 29.5.3+incompatible in the go-docker-dependencies group across 1 directory by @dependabot[bot] in #2865

• Bump github.com/sigstore/sigstore from 1.10.6 to 1.10.8 by @dependabot[bot] in #2901

• Bump goa.design/goa/v3 from 3.26.0 to 3.28.0 by @dependabot[bot] in #2902

• Bump chainguard-dev/actions from 1.6.22 to 1.6.23 by @dependabot[bot] in #2906

• Bump go.mongodb.org/mongo-driver from 1.17.6 to 1.17.7 by @dependabot[bot] in #2910

• Bump ko-build/setup-ko from 0.9 to 0.10 by @dependabot[bot] in #2926

• Bump actions/setup-go from 6.4.0 to 6.5.0 by @dependabot[bot] in #2927

• Bump actions/checkout from 6.0.3 to 7.0.0 by @dependabot[bot] in #2918

• Bump github.com/docker/cli from 29.5.3+incompatible to 29.6.1+incompatible in the go-docker-dependencies group across 1 directory by @dependabot[bot] in #2914

• Bump the go-k8s-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2915

• Bump chainguard-dev/actions from 1.6.23 to 1.6.25 by @dependabot[bot] in #2917

• Bump github.com/sigstore/timestamp-authority/v2 from 2.0.6 to 2.1.0 by @dependabot[bot] in #2928

• fix(cve): bump Go stdlib to 1.25.11 and golang.org/x/net to v0.55.0 by @divyansh42 in #2911

• chore(deps): add dependabot config for active release branches by @jkhelil in #2907

• Bump github.com/Masterminds/semver/v3 from 3.4.0 to 3.5.0 by @dependabot[bot] in #2881

• CI: Group all GitHub Actions dependabot updates together by @vdemeester in #2985

• chore(deps): bump github.com/tektoncd/triggers from 0.35.1-0.20260401091813-1aad8a1898ec to 0.36.0 by @dependabot[bot] in #2991

• chore(deps): bump the all group with 5 updates by @dependabot[bot] in #2995

• CI: Use goinstall mode for golangci-lint action by @vdemeester in #2984

• chore(deps): bump golang.org/x/term from 0.43.0 to 0.44.0 by @dependabot[bot] in #3008

• chore(deps): bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @dependabot[bot] in #2931

• refactor(release): use .x branches for releases by @divyansh42 in #3011

• Add branch prefix to Dependabot PR titles for release branches by @divyansh42 in #3017

• chore(deps): bump the all group with 2 updates by @dependabot[bot] in #3023

• chore(deps): bump golang.org/x/text from 0.37.0 to 0.39.0 by @dependabot[bot] in #3021

• chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot[bot] in #2929

• chore(deps): bump go.opentelemetry.io/otel from 1.43.0 to 1.44.0 by @dependabot[bot] in #3022

• chore(deps): bump github.com/tektoncd/chains from 0.26.3 to 0.27.2 and fix test failures by @dependabot[bot] in #2930

• chore(deps): bump github.com/letsencrypt/boulder from 0.20260420.0 to 0.20260630.0 by @dependabot[bot] in #2953

• docs: update README Tekton logo URL to CNCF artwork location by @afrittoli with @Copilot in #3025

• chore(deps): bump golang.org/x/crypto from 0.52.0 to 0.53.0 by @dependabot[bot] in #3027

• chore(deps): bump github.com/tektoncd/pipeline from 1.12.0 to 1.14.0 by @dependabot[bot] in #3028

• chore(deps): bump step-security/harden-runner from 2.19.4 to 2.20.0 in the all group by @dependabot[bot] in #3030

• chore(deps): bump github.com/tektoncd/chains from 0.27.2 to 0.27.3 by @dependabot[bot] in #3029

• chore(deps): bump the go-k8s-dependencies group across 1 directory with 2 updates by @dependabot[bot] in #3038

• chore(deps): bump github.com/jackc/pgx/v5 from 5.7.6 to 5.9.2 by @dependabot[bot] in #3041

• ci(.github/workflows): enable Codecov coverage reporting by @enarha in #3040

• chore(deps): bump github.com/docker/cli from 29.6.1+incompatible to 29.6.2+incompatible in the go-docker-dependencies group by @dependabot[bot] in #3042

• chore(deps): bump github.com/letsencrypt/boulder from 0.20260630.0 to 0.20260713.0 by @dependabot[bot] in #3044

• chore(deps): bump golang.org/x/term from 0.44.0 to 0.45.0 by @dependabot[bot] in #3046

• chore(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @dependabot[bot] in #3045

• fix(releaes): fix release script to fetch the correct previous tag by @pratap0007 in #3064
  #3062

• Security: Fix CVE-2026-42505 - update Go to 1.26.5 (crypto/tls ECH privacy leak) by @divyansh42 in #3065

• chore(deps): bump golang.org/x/crypto from 0.53.0 to 0.54.0 by @dependabot[bot] in #3043

• chore(deps): bump github.com/google/cel-go from 0.28.1 to 0.29.0 by @dependabot[bot] in #3069

• chore(deps): bump the go-k8s-dependencies group with 3 updates by @dependabot[bot] in #3071

• chore(deps): bump github.com/tektoncd/pipeline from 1.14.0 to 1.14.1 by @dependabot[bot] in #3072

• chore(deps): bump github.com/letsencrypt/boulder from 0.20260713.0 to 0.20260720.0 by @dependabot[bot] in #3073

• chore(deps): bump the all group across 1 directory with 5 updates by @dependabot[bot] in #3075

• chore(deps): bump the all group with 3 updates by @dependabot[bot] in #3105

• chore(deps): bump github.com/sigstore/sigstore from 1.10.8 to 1.10.9 by @dependabot[bot] in #3087

• chore(deps): bump github.com/google/go-containerregistry from 0.21.7 to 0.21.8 by @depen...

v0.37.7 Release 🎉

This patch release addresses the following CVEs: CVE-2026-33811, CVE-2026-39833, CVE-2026-42505, CVE-2026-39830, CVE-2026-25680, CVE-2026-22772, and CVE-2026-49835. It also updates the Go version to 1.25.12, which includes fixes for Go standard library vulnerabilities.

Changelog

• 05822dd New version v0.37.

What's Changed

• [release-v0.37.x] CI: Use goinstall mode for golangci-lint action by @vdemeester in #2990
• [release-v0.37.x] cherry-pick: OWNERS, CI summary, Dockerfile fix by @divyansh42 in #3013
• chore(deps): bump the all group across 1 directory with 3 updates by @dependabot[bot] in #3001
• [release-v0.37.x] cherry-pick: fix alibabacloud-go/cr-20160607 license by @divyansh42 in #3018
• [release-v0.37.x] bump github.com/docker/cli from 29.0.3+incompatible to 29.0.4+incompatible in the go-docker-dependencies group across 1 directory by @dependabot[bot] in #2946
• [release-v0.37.x] fix: resolve golangci-lint errors (cherry-pick from main) by @divyansh42 in #3024
• fix(cve): CVE-2026-42499, CVE-2026-39820 - update Go 1.25.9 to 1.25.10 [release-v0.37.x] by @divyansh42 in #2922
• fix(cve): CVE-2026-39828, CVE-2026-39829, CVE-2026-39830 - update golang.org/x/crypto to v0.52.0 [release-v0.37.x] by @divyansh42 in #2909
• fix(cve): CVE-2026-33811, CVE-2026-39833 - update Go stdlib and x/crypto [release-v0.37.x] by @divyansh42 in #2923
• [release-v0.37.x] bump github.com/sigstore/cosign/v2 from 2.6.2 to 2.6.3 by @dependabot[bot] in #2975
• [release-v0.37.x] bump github.com/creack/pty from 1.1.21 to 1.1.24 by @dependabot[bot] in #2963
• [release-v0.37.x] bump the go-k8s-dependencies group across 1 directory with 3 updates by @dependabot[bot] in #2957
• [release-v0.37.x] bump github.com/google/go-containerregistry from 0.20.7 to 0.20.8 by @dependabot[bot] in #2969
• [release-v0.37.x] bump github.com/tektoncd/hub from 1.17.0 to 1.17.3 by @dependabot[bot] in #3032
• [release-v0.37.x] bump github.com/tektoncd/pipeline from 0.59.5 to 0.59.6 by @dependabot[bot] in #3033
• [release-v0.37.x] bump github.com/sigstore/sigstore from 1.10.3 to 1.10.8 by @dependabot[bot] in #3035
• [release-v0.37.x] bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 by @dependabot[bot] in #3050
• [release-v0.37.x] bump chainguard-dev/actions/kind-diag from 1.6.26 to 1.6.27 in the all group by @dependabot[bot] in #3053
• [release-v0.37.x] Security: Fix CVE-2026-42505 - update Go to 1.25.12 (crypto/tls ECH privacy leak) by @divyansh42 in #3067
• fix(cve): fix few critical CVEs by @pratap0007 in #3058
• [release-v0.37.x] bump the go-k8s-dependencies group with 3 updates by @dependabot[bot] in #3082
• [release-v0.37.x] bump chainguard-dev/actions/kind-diag from 1.6.27 to 1.6.28 in the all group by @dependabot[bot] in #3076

Full Changelog: v0.37.6...v0.37.7

v0.45.1 Release 🎉

This patch release addresses the following CVEs: CVE-2026-48702, CVE-2026-49835, CVE-2026-39395, CVE-2026-49835. It also upgrades Go to v1.25.6 to remediate vulnerabilities in the Go standard library.

Changelog

• 4b7251b New version v0.45.1

What's Changed

• Bump the go-k8s-dependencies group with 3 updates by @dependabot[bot] in #2942
• Bump step-security/harden-runner from 2.19.1 to 2.19.4 by @dependabot[bot] in #2935
• Bump actions/checkout from 6.0.2 to 6.0.3 by @dependabot[bot] in #2936
• Bump chainguard-dev/actions/kind-diag from 1.6.19 to 1.6.25 by @dependabot[bot] in #2937
• Bump github/codeql-action/analyze from 4.35.3 to 4.35.5 by @dependabot[bot] in #2965
• [release-v0.45.x] CI: Use goinstall mode for golangci-lint action by @vdemeester in #2986
• chore(deps): bump github.com/sigstore/sigstore from 1.10.5 to 1.10.8 by @dependabot[bot] in #2993
• chore(deps): bump the all group across 1 directory with 2 updates by @dependabot[bot] in #3004
• chore(deps): bump github.com/tektoncd/pipeline from 1.12.0 to 1.12.2 by @dependabot[bot] in #2973
• chore(deps): bump github.com/tektoncd/chains from 0.26.3 to 0.26.5 by @dependabot[bot] in #2958
• chore(deps): bump google.golang.org/grpc from 1.81.0 to 1.81.1 by @dependabot[bot] in #2944
• chore(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.21.7 by @dependabot[bot] in #2964
• [release-v0.45.x] bump github.com/tektoncd/chains from 0.26.5 to 0.26.6 by @dependabot[bot] in #3034
• [release-v0.45.x] bump chainguard-dev/actions/kind-diag from 1.6.26 to 1.6.27 in the all group by @dependabot[bot] in #3047
• [release-v0.45.x] bump github.com/sigstore/cosign/v2 from 2.6.3 to 2.6.4 by @dependabot[bot] in #3051
• [release-v0.45.x] chore(deps): remove unused tektoncd/chains dependency by @pratap0007 in #3061
• fix(cve): fix few critical CVEs by @pratap0007 in #3063

Full Changelog: v0.45.0...v0.45.1

v0.44.2 Release 🎉

This patch release addresses the following CVEs: CVE-2026-40938, CVE-2026-40161, CVE-2026-24051, CVE-2026-24051 and CVE-2026-34986.

Changelog

• 17a7599 New version v0.44.2

Full Changelog: v0.44.1...v0.44.2

v0.43.2 Release 🎉

This patch release addresses the following CVEs: GHSA-78h2-9frx-2jm8, GHSA-mh2q-q3fh-2475, GHSA-hfvc-g4fc-pqhx, GHSA-w2q5-6q6x-x959, GHSA-m9x8-m34x-fj9q, GHSA-w9p8-pvxh-rxpj, GHSA-wrh2-89vg-4j9g
GHSA-4279-q6mj-392r, GHSA-h524-452v-82p9, GHSA-h3gm-q7m7-mp28

Changelog

• db2b9a1 New version v0.43.2

Full Changelog: v0.43.1...v0.43.2