Skip to content

pipecd

v0.57.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Pipelines
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 1 known CVE

Topics

ci-cd cloudrun cncf cncf-project devops ecs
+10 more
fargate gitops infrastructure istio kubernetes lambda pipecd sandbox serverless terraform

Affected surfaces

auth deps

Summary

AI summary

Broad release touches Internal Changes, deps, deps-dev, and kubernetes_multicluster.

Full changelog

Release v0.57.0 with changes since v0.56.0

Notable Changes

  • Update extract cookie logic to allow cookie contains equal sign (#6933)

Internal Changes

  • Release v0.57.0
  • build(deps): bump github.com/coreos/go-oidc/v3 from 3.11.0 to 3.18.0 (#6864)
  • build(deps-dev): bump @testing-library/react in /web (#6865)
  • build(deps-dev): bump babel-loader from 9.1.0 to 10.1.1 in /web (#6866)
  • build(deps-dev): bump ts-jest from 29.1.0 to 29.4.11 in /web (#6867)
  • build(deps-dev): bump eslint-config-prettier in /web (#6869)
  • build(deps): bump github.com/slack-go/slack from 0.23.1 to 0.24.0 (#6875)
  • build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.1 (#6870)
  • build(deps): bump docker/setup-qemu-action from 3.2.0 to 4.0.0 (#6871)
  • build(deps): bump docker/build-push-action from 5.0.0 to 7.2.0 (#6872)
  • build(deps): bump actions/stale from 8 to 10 (#6873)
  • build(deps): bump peaceiris/actions-hugo from 3.0.0 to 3.2.1 (#6874)
  • [Snyk] Security upgrade react-router-dom from 6.30.2 to 6.30.4 (#6896)
  • build(deps-dev): bump postcss-cli from 8.3.1 to 11.0.1 in /docs (#6889)
  • build(deps-dev): bump postcss from 8.5.12 to 8.5.15 in /docs (#6890)
  • build(deps): bump launch-editor from 2.9.1 to 2.14.1 in /web (#6920)
  • build(deps-dev): bump webpack-dev-server from 5.2.1 to 5.2.5 in /web (#6922)
  • build(deps): bump http-proxy-middleware from 2.0.9 to 2.0.10 in /web (#6935)
  • add version selector to mobile (#6925)
  • build(deps): bump github.com/pipe-cd/piped-plugin-sdk-go (#6892)
  • build(deps): bump github.com/pipe-cd/piped-plugin-sdk-go (#6891)
  • build(deps): bump github.com/pipe-cd/pipecd in /pkg/plugin/sdk (#6839)
  • build(deps): bump github.com/pipe-cd/piped-plugin-sdk-go (#6858)
  • build(deps): bump github.com/opencontainers/runc from 1.2.8 to 1.3.6 (#6934)
  • build(deps): bump go.opentelemetry.io/otel (#6862)
  • build(deps): bump go.opentelemetry.io/otel (#6887)
  • build(deps): bump go.opentelemetry.io/otel (#6886)
  • build(deps): bump go.opentelemetry.io/otel (#6885)
  • build(deps): bump shell-quote from 1.8.2 to 1.8.4 in /web (#6907)
  • build(deps): bump github.com/pipe-cd/piped-plugin-sdk-go (#6895)
  • build(deps): bump form-data from 4.0.4 to 4.0.6 in /web (#6923)
  • build(deps): bump @babel/core from 7.22.5 to 7.29.7 in /web (#6924)
  • ci: add read-only permissions to validation workflows (#6901)
  • ci: add concurrency groups to build workflows (#6908)
  • docs: move CI overview and update link (#6649)
  • Refactors the contributor thank you workflow for quick fixes (#6897)
  • Disable branch deletion for stale pull requests (#6898)
  • chore: add new maintainers (#6888)
  • Introduce piped plugins approvers group to CODEOWNER (#6876)
  • build(deps): bump github.com/slack-go/slack from 0.12.2 to 0.23.1 (#6772)
  • build(deps-dev): bump postcss from 8.4.40 to 8.5.12 in /docs (#6720)
  • build(deps): bump fast-uri from 3.0.6 to 3.1.2 in /web (#6753)
  • Update codegen image (#6884)
  • Update go to v1.26.2 (#6711)
  • [Multi_K8s-Plugin] rename stages to avoid conflicts with kubernetes plugin (#6880)
  • [Multi_K8s-Plugin]: extend ExecuteStageResponse with per-target deploy statuses (#6812)
  • [Multi_K8s-Plugin] Prune orphaned resources on rollback (#6748)
  • [ECS-Plugin]: Shorter taskset and task name showed in livestate panel (#6804)
  • [Pipedv1] Scan preinstalled tools (#6710)
  • feat(plugin/sdk): add DeployTargetStatus and extend ExecuteStageResponse (#6861)
  • [Multi_K8s-Plugin] Implement plan preview (#6685)
  • build(deps): bump go.opentelemetry.io/otel from 1.39.0 to 1.41.0 in /pkg/app/pipedv1/plugin/waitapproval (#6774)
  • build(deps): bump go.opentelemetry.io/otel from 1.39.0 to 1.41.0 in /pkg/plugin/sdk (#6773)
  • build(deps): bump google.golang.org/grpc from 1.64.1 to 1.79.3 in /pkg/app/pipedv1/plugin/terraform (#6719)
  • [Multi_K8s-Plugin] Add unit tests for traffic routing config and liveresources (#6809)
  • [Multi_K8s-Plugin] Add per-stage multiTarget filtering (#6757)
  • fix(kubernetes_multicluster): implement health status for DaemonSet, ReplicaSet and Pod (#6807)
  • [CI] Add dependabot and govulncheck checks (#6435)
  • [Multi_K8s-Plugin] Add initializer hook for Helm repo and OCI registry auth (#6723)
  • [Multi_K8s-Plugin] Add config validation for KubernetesApplicationSpec (#6747)
  • [Multi_K8s-Plugin] Add per-target kustomizeVersion and kustomizeOptions (#6749)
  • fix(kubernetes_multicluster): surface partial deletion errors in deleteResources (#6781)
  • [Multi_K8s-Plugin] Extract duplicated target-building pattern into shared helpers (#6782)
  • fix(kubernetes_multicluster): stamp tracking labels and honour kustomizeDir in livestate loadManifests (#6783)
  • fix(kubernetes_multicluster): pin Is* methods to exact Kubernetes API groups (#6784)
  • fix(kubernetes_multicluster): extract images from initContainers and CronJob templates (#6808)
  • fix(kubernetes_multicluster): remove stale TODO comment in sync.go (#6810)
  • Remove event registration for demo environment update (#6716)
  • ci: add automated thank you workflow for merged PRs (#6569)
  • Add docs for pipectl transfer command (#6768)
  • [PipeCD-Web]: Fix livestate UI for non-k8s plugins (#6803)
  • feat: implement copy button for code snippets (#6530)
  • [bot] Publish quickstart manifests (#6767)

Security Fixes

  • [Snyk] Security upgrade react-router-dom from 6.30.2 to 6.30.4

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track pipecd

Get notified when new releases ship.

Sign up free

About pipecd

The One CD for All {applications, platforms, operations}

All releases →

Related context

Beta — feedback welcome: [email protected]