[DNM] Release v0.37.8#2727
Open
theakshaypant wants to merge 4 commits into
Open
Conversation
Commit 6e36620 broke relative task path resolution for repository file paths by only allowing HTTP(S) URLs. This caused paths containing '..' to be passed unresolved to the GitHub API, which rejects them with "path must not contain '..' due to auth vulnerability issue". This fix restores the original behavior by allowing both HTTP(S) URLs and repository file paths (e.g., .tekton/pipelines/build.yaml) to have their relative paths resolved, while still excluding catalog/hub references (catalog://, hub://). Fixes: #2549 Signed-off-by: Akshay Pant <akpant@redhat.com>
Upgrade google.golang.org/grpc to v1.79.3 to fix CVE-2026-33186 (GHSA-p77j-4mvh-x3m3), a critical HTTP/2 :path validation flaw that allows bypassing authorization rules in gRPC interceptors. Upgrade github.com/tektoncd/pipeline to v1.0.1 to address CVE-2026-33211 (GHSA-j5q5-j9gm-2w5c), a path traversal in the git resolver that could expose ServiceAccount tokens. Signed-off-by: Akshay Pant <akpant@redhat.com>
Update go-jose v3 and v4 to patch security vulnerability in JWE and JWS handling. Signed-off-by: Akshay Pant <akpant@redhat.com>
Upgrade github.com/tektoncd/pipeline to v1.0.2 to fix CVE-2026-40161 (GHSA-wjxp-xrpv-xpff), a high-severity credential exposure flaw in the git resolver API mode that leaks configured Git API tokens to attacker-controlled endpoints when users omit the token parameter with a custom serverURL. Signed-off-by: Akshay Pant <akpant@redhat.com>
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request updates the Go version to 1.24.0 and upgrades several core dependencies, including Tekton pipelines and various golang.org/x libraries. A significant functional change is made to the remote task resolution logic, which now supports resolving relative task paths from repository file paths in addition to HTTP/S URLs. This is supported by updated unit tests and a new integration test for Gitea. I have no feedback to provide as there were no review comments to assess.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📝 Description of the Change
f4d3f2d chore(deps): update tektoncd/pipeline to v1.0.2
ddeeb41 chore(deps): update go-jose to fix GHSA-78h2-9frx-2jm8
8122f6e chore(deps): update grpc and tektoncd/pipeline
cf22bd5 fix(resolve): restore relative task path resolution for repository paths
🔗 Linked GitHub Issue
Fixes #
🧪 Testing Strategy
🤖 AI Assistance
AI assistance can be used for various tasks, such as code generation,
documentation, or testing.
Please indicate whether you have used AI assistance
for this PR and provide details if applicable.
Important
Slop will be simply rejected, if you are using AI assistance you need to make sure you
understand the code generated and that it meets the project's standards. you
need at least know how to run the code and deploy it (if needed). See
startpaac to make it easy
to deploy and test your code changes.
If the majority of the code in this PR was generated by an AI, please add a
Co-authored-bytrailer to your commit message.For example:
Co-authored-by: Claude noreply@anthropic.com
✅ Submitter Checklist
fix:,feat:) matches the "Type of Change" I selected above.make testandmake lintlocally to check for and fix anyissues. For an efficient workflow, I have considered installing
pre-commit and running
pre-commit installtoautomate these checks.