✓ No known CVEs patched in this version
Topics
Affected surfaces
ReleasePort's take
Light signalTaskRun now recovers correctly when an init container is OOMKilled with enableKubernetesSidecar enabled.
Why it matters: Fixes TaskRun stuck in Running state after init‑container OOMKill; critical for reliable pipeline execution under default settings.
Summary
AI summaryTaskRun no longer gets stuck in Running when an init container is OOMKilled with enableKubernetesSidecar enabled.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Breaking | High |
Tekton no longer applies default resource requests or limits to internal containers when `default-container-resource-requirements` is unset. Tekton no longer applies default resource requests or limits to internal containers when `default-container-resource-requirements` is unset. Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Bugfix | Medium |
ResolutionRequests can now resolve PipelineRuns, TaskRuns, Runs, CustomRuns, and StepActions in addition to Pipelines, Tasks, and StepActions. ResolutionRequests can now resolve PipelineRuns, TaskRuns, Runs, CustomRuns, and StepActions in addition to Pipelines, Tasks, and StepActions. Source: llm_adapter@2026-06-15 Confidence: high |
— |
| Bugfix | Medium |
TaskRun no longer gets stuck in Running when an init container is OOMKilled with enableKubernetesSidecar enabled. TaskRun no longer gets stuck in Running when an init container is OOMKilled with enableKubernetesSidecar enabled. Source: llm_adapter@2026-06-15 Confidence: low |
— |
| Bugfix | Low |
Eliminates spurious step log warnings about parsing termination messages when compression is disabled. Eliminates spurious step log warnings about parsing termination messages when compression is disabled. Source: llm_adapter@2026-06-15 Confidence: high |
— |
Full changelog
-Docs @ v1.13.1
-Examples @ v1.13.1
Installation one-liner
kubectl apply -f https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.13.1/release.yaml
Attestation
The Rekor UUID for this release is 7e8b48508ad51cc71249bf7da0e6fbd511ef626cbbd1ced5beb74f2cbc3750d6
Obtain the attestation:
REKOR_UUID=7e8b48508ad51cc71249bf7da0e6fbd511ef626cbbd1ced5beb74f2cbc3750d6
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .
Verify that all container images in the attestation are in the release file:
RELEASE_FILE=https://infra.tekton.dev/tekton-releases/pipeline/previous/v1.13.1/release.yaml
REKOR_UUID=7e8b48508ad51cc71249bf7da0e6fbd511ef626cbbd1ced5beb74f2cbc3750d6
# Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v1.13.1@sha256:" + .digest.sha256')
# Download the release file
curl -L "$RELEASE_FILE" > release.yaml
# For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done
Changes
Features
Fixes
- :bug: [cherry-pick: release-v1.13.x] fix(resolvers): Allow ResolutionRequests to resolve all Tekton kinds (#10251)
Before this change, ResolutionRequests could only resolve Pipelines, Tasks, and StepActions. After this change, ResolutionRequests can resolve PipelineRuns, Pipelines, TaskRuns, Tasks, Runs, CustomRuns, and StepActions.
- :bug: [cherry-pick: release-v1.13.x] fix: TaskRun stuck in Running when init container is OOMKilled with enableKubernetesSidecar (#10183)
Fix: TaskRun no longer gets stuck in Running when an init container (e.g. prepare) is OOMKilled while enableKubernetesSidecar is enabled. The TaskRun is now correctly marked as Failed immediately.
- :bug: [cherry-pick: release-v1.13.x] fix: avoid spurious termination parse warning (#10182)
Fixed spurious step log warnings about parsing existing termination messages when termination message compression is disabled.
- :bug: [cherry-pick: release-v1.13.x] fix: make internal container resources opt-in (#10173)
Action required: Tekton no longer applies default resource requests or limits to internal containers (prepare, place-scripts, working-dir-initializer, and sidecar-tekton-log-results) when default-container-resource-requirements is unset. Clusters that rely on these defaults for ResourceQuota compatibility must configure explicit internal container resources in the config-defaults ConfigMap.
- :bug: [release-v1.13.x] fix: replace symlinks with subpath params and fix Rekor UUID in release pipeline (#10217)
Misc
Docs
Thanks
Thanks to these contributors who contributed to v1.13.1!
- :heart: @tekton-robot
- :heart: @vdemeester
- :heart: @waveywaves
Extra shout-out for awesome release notes:
- :heart_eyes: @tekton-robot
- :heart_eyes: @waveywaves
Breaking Changes
- make internal container resources opt-in: Tekton no longer applies default resource requests or limits to internal containers (`prepare`, `place-scripts`, `working-dir-initializer`, and `sidecar-tekton-log-results`) when `default-container-resource-requirements` is unset; clusters relying on these defaults must configure explicit resources in the `config-defaults` ConfigMap
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
Related context
Related tools
Beta — feedback welcome: [email protected]