Skip to content

Fix blocking CVEs: update RPM lockfiles and tektoncd/pipeline to v1.9.3 #3323

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jsmid1 wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Fix blocking CVEs: update RPM lockfiles and tektoncd/pipeline to v1.9.3 #3323

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
a6f7676
Refresh RPM lockfiles [SECURITY]
red-hat-konflux[bot] May 20, 2026
af341ae
Update module github.com/tektoncd/pipeline to v1.9.3
red-hat-konflux[bot] May 26, 2026
1979b50
Update ubi9/ubi-minimal base image to fix CVE-2026-4878
jsmid1 May 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ RUN /build/build.sh "${BUILD_LIST}" "${BUILD_SUFFIX}"

## Final image

FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:8d0a8fb39ec907e8ca62cdd24b62a63ca49a30fe465798a360741fde58437a23
FROM registry.access.redhat.com/ubi9/ubi-minimal:latest@sha256:5b74fce9d6e629942a0c6dc0f546c193e70d7f974d999a48c948c53dd3d36362

ARG TARGETOS
ARG TARGETARCH
Expand Down
2 changes: 1 addition & 1 deletion acceptance/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ require (
github.com/sigstore/sigstore-go v1.1.4
github.com/stretchr/testify v1.11.1
github.com/tektoncd/cli v0.44.1
github.com/tektoncd/pipeline v1.9.2
github.com/tektoncd/pipeline v1.9.3
github.com/testcontainers/testcontainers-go v0.34.0
github.com/transparency-dev/merkle v0.0.2
github.com/wiremock/go-wiremock v1.11.0
Expand Down
4 changes: 2 additions & 2 deletions acceptance/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -821,8 +821,8 @@ github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d h1:vfofYNRScrDd
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d/go.mod h1:RRCYJbIwD5jmqPI9XoAFR0OcDxqUctll6zUj/+B4S48=
github.com/tektoncd/cli v0.44.1 h1:UMI2xFt7MLTJdLuopzjAUTon8b1Ni4qbyboi2b4KWmQ=
github.com/tektoncd/cli v0.44.1/go.mod h1:q8IZV/HuGh/D4kbID0YVTfqkbV7dMX+T687I/hPIBL8=
github.com/tektoncd/pipeline v1.9.2 h1:uKEt6CGLmkeKLdKIZnel0gn8lfQ1P7+398yystdBuHU=
github.com/tektoncd/pipeline v1.9.2/go.mod h1:PTlIZ4Mhr8HZDx404O7spJtafiynetTMedCsXStjtHk=
github.com/tektoncd/pipeline v1.9.3 h1:7Z+V2VX5wjz9LoNa16E1RbgH9mpYy5B1KnAMm3H0czc=
github.com/tektoncd/pipeline v1.9.3/go.mod h1:pEruzPp4JM8JK8Nnnih46IPgdtxRPot/i9pUZo8lA9I=
github.com/tektoncd/triggers v0.35.0 h1:9Z5Cqn7RZTgyspWgWYFHz6AtWUUhd/awJeaisjZdF98=
github.com/tektoncd/triggers v0.35.0/go.mod h1:te1wPij1VJ/59wqpVKfwxZHRS/FOZSCMSbBTpKtLfz4=
github.com/testcontainers/testcontainers-go v0.34.0 h1:5fbgF0vIN5u+nD3IWabQwRybuB4GY8G2HHgCkbMzMHo=
Expand Down
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ require (
github.com/spf13/viper v1.21.0
github.com/stretchr/testify v1.11.1
github.com/stuart-warren/yamlfmt v0.2.0
github.com/tektoncd/pipeline v1.9.2
github.com/tektoncd/pipeline v1.9.3
github.com/testcontainers/testcontainers-go v0.34.1-0.20241204123437-72be13940122 // using unreleased version that contains the fix in https://github.com/testcontainers/testcontainers-go/pull/2899
github.com/testcontainers/testcontainers-go/modules/registry v0.34.0
golang.org/x/benchmarks v0.0.0-20241115175113-a2b48b605b42
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1227,8 +1227,8 @@ github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d h1:vfofYNRScrDd
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d/go.mod h1:RRCYJbIwD5jmqPI9XoAFR0OcDxqUctll6zUj/+B4S48=
github.com/tchap/go-patricia/v2 v2.3.3 h1:xfNEsODumaEcCcY3gI0hYPZ/PcpVv5ju6RMAhgwZDDc=
github.com/tchap/go-patricia/v2 v2.3.3/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
github.com/tektoncd/pipeline v1.9.2 h1:uKEt6CGLmkeKLdKIZnel0gn8lfQ1P7+398yystdBuHU=
github.com/tektoncd/pipeline v1.9.2/go.mod h1:PTlIZ4Mhr8HZDx404O7spJtafiynetTMedCsXStjtHk=
github.com/tektoncd/pipeline v1.9.3 h1:7Z+V2VX5wjz9LoNa16E1RbgH9mpYy5B1KnAMm3H0czc=
github.com/tektoncd/pipeline v1.9.3/go.mod h1:pEruzPp4JM8JK8Nnnih46IPgdtxRPot/i9pUZo8lA9I=
github.com/terminalstatic/go-xsd-validate v0.1.6 h1:TenYeQ3eY631qNi1/cTmLH/s2slHPRKTTHT+XSHkepo=
github.com/terminalstatic/go-xsd-validate v0.1.6/go.mod h1:18lsvYFofBflqCrvo1umpABZ99+GneNTw2kEEc8UPJw=
github.com/testcontainers/testcontainers-go v0.34.1-0.20241204123437-72be13940122 h1:dsnk0a/bMsSQzsfrFCvXkbp9arGuAVgike7POsCRXOg=
Expand Down
42 changes: 20 additions & 22 deletions rpms.lock.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,6 @@
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
#
# This file is generated by hack/update-rpm-lock.sh
---
lockfileVersion: 1
lockfileVendor: redhat
Expand All @@ -35,13 +33,13 @@ arches:
name: gzip
evr: 1.12-1.el9
sourcerpm: gzip-1.12-1.el9.src.rpm
- url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/j/jq-1.6-19.el9_7.0.2.aarch64.rpm
- url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/aarch64/baseos/os/Packages/j/jq-1.6-19.el9_8.2.aarch64.rpm
repoid: ubi-9-for-aarch64-baseos-rpms
size: 191129
checksum: sha256:8b48c0648debd490cac3ff6c7ad446a3c87e109e8793bd17d195e19904a7c24d
size: 191195
checksum: sha256:633aaf3e87b19d4a591bd9f47cd81fde8ec49629d3f58932addfc8a134b7949d
name: jq
evr: 1.6-19.el9_7.0.2
sourcerpm: jq-1.6-19.el9_7.0.2.src.rpm
evr: 1.6-19.el9_8.2
sourcerpm: jq-1.6-19.el9_8.2.src.rpm
source: []
module_metadata: []
- arch: ppc64le
Expand All @@ -60,13 +58,13 @@ arches:
name: gzip
evr: 1.12-1.el9
sourcerpm: gzip-1.12-1.el9.src.rpm
- url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/os/Packages/j/jq-1.6-19.el9_7.0.2.ppc64le.rpm
- url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/ppc64le/baseos/os/Packages/j/jq-1.6-19.el9_8.2.ppc64le.rpm
repoid: ubi-9-for-ppc64le-baseos-rpms
size: 210471
checksum: sha256:4c8edf2a8d254b43c936bd712dec6ef0285200634b1f700f2e728bc27cfdd16f
size: 210467
checksum: sha256:bd22f9b12aaae090e7d6d6a94eae6cd2a0de75b1f983696066b5c8691075012e
name: jq
evr: 1.6-19.el9_7.0.2
sourcerpm: jq-1.6-19.el9_7.0.2.src.rpm
evr: 1.6-19.el9_8.2
sourcerpm: jq-1.6-19.el9_8.2.src.rpm
source: []
module_metadata: []
- arch: s390x
Expand All @@ -85,13 +83,13 @@ arches:
name: gzip
evr: 1.12-1.el9
sourcerpm: gzip-1.12-1.el9.src.rpm
- url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/os/Packages/j/jq-1.6-19.el9_7.0.2.s390x.rpm
- url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/s390x/baseos/os/Packages/j/jq-1.6-19.el9_8.2.s390x.rpm
repoid: ubi-9-for-s390x-baseos-rpms
size: 206799
checksum: sha256:3bee62cdc4891f5e474431d539bccb8cc3f3c3a2687815988496d1ddd24869a4
size: 206781
checksum: sha256:0d4d0ea445c687665a70906d2ed4c5e959fc8cd82f7e961d19317881ce26851e
name: jq
evr: 1.6-19.el9_7.0.2
sourcerpm: jq-1.6-19.el9_7.0.2.src.rpm
evr: 1.6-19.el9_8.2
sourcerpm: jq-1.6-19.el9_8.2.src.rpm
source: []
module_metadata: []
- arch: x86_64
Expand All @@ -110,12 +108,12 @@ arches:
name: gzip
evr: 1.12-1.el9
sourcerpm: gzip-1.12-1.el9.src.rpm
- url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/j/jq-1.6-19.el9_7.0.2.x86_64.rpm
- url: https://cdn-ubi.redhat.com/content/public/ubi/dist/ubi9/9/x86_64/baseos/os/Packages/j/jq-1.6-19.el9_8.2.x86_64.rpm
repoid: ubi-9-for-x86_64-baseos-rpms
size: 197456
checksum: sha256:c6516f674a43c89c2a54bcffa7b8e1d65c553042d6aed94ccc08c443ed1efdfa
size: 197453
checksum: sha256:9793a39a4746a09ba89c3d9ccc70150ac6c878286deee26d7e3aabede4666417
name: jq
evr: 1.6-19.el9_7.0.2
sourcerpm: jq-1.6-19.el9_7.0.2.src.rpm
evr: 1.6-19.el9_8.2
sourcerpm: jq-1.6-19.el9_8.2.src.rpm
source: []
module_metadata: []
2 changes: 1 addition & 1 deletion tools/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -507,7 +507,7 @@ require (
github.com/syndtr/goleveldb v1.0.1-0.20220721030215-126854af5e6d // indirect
github.com/tchap/go-patricia/v2 v2.3.3 // indirect
github.com/tektoncd/hub v1.23.6 // indirect
github.com/tektoncd/pipeline v1.9.2 // indirect
github.com/tektoncd/pipeline v1.9.3 // indirect
github.com/tektoncd/triggers v0.35.0 // indirect
github.com/tetafro/godot v1.5.4 // indirect
github.com/thales-e-security/pool v0.0.2 // indirect
Expand Down
4 changes: 2 additions & 2 deletions tools/go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1515,8 +1515,8 @@ github.com/tektoncd/cli v0.44.1 h1:UMI2xFt7MLTJdLuopzjAUTon8b1Ni4qbyboi2b4KWmQ=
github.com/tektoncd/cli v0.44.1/go.mod h1:q8IZV/HuGh/D4kbID0YVTfqkbV7dMX+T687I/hPIBL8=
github.com/tektoncd/hub v1.23.6 h1:cduhbCJkwNDjAeiZf5iXyM8HpPsS18bJtjrc829+xrw=
github.com/tektoncd/hub v1.23.6/go.mod h1:avuMaqxKD3ihAOT6ttocG6DvHC3HxSWSalBm7p1dXKc=
github.com/tektoncd/pipeline v1.9.2 h1:uKEt6CGLmkeKLdKIZnel0gn8lfQ1P7+398yystdBuHU=
github.com/tektoncd/pipeline v1.9.2/go.mod h1:PTlIZ4Mhr8HZDx404O7spJtafiynetTMedCsXStjtHk=
github.com/tektoncd/pipeline v1.9.3 h1:7Z+V2VX5wjz9LoNa16E1RbgH9mpYy5B1KnAMm3H0czc=
github.com/tektoncd/pipeline v1.9.3/go.mod h1:pEruzPp4JM8JK8Nnnih46IPgdtxRPot/i9pUZo8lA9I=
github.com/tektoncd/triggers v0.35.0 h1:9Z5Cqn7RZTgyspWgWYFHz6AtWUUhd/awJeaisjZdF98=
github.com/tektoncd/triggers v0.35.0/go.mod h1:te1wPij1VJ/59wqpVKfwxZHRS/FOZSCMSbBTpKtLfz4=
github.com/tenntenn/modver v1.0.1 h1:2klLppGhDgzJrScMpkj9Ujy3rXPUspSjAcev9tSEBgA=
Expand Down
Loading