[anwesha-palit-redhat]

Changes

Updating go version from 1.26.6 to 1.26.10 - CVE-2026-111943

Submitter Checklist

These are the criteria that every PR should meet, please check them off as you
review them:

• Includes tests (if functionality changed/added)
• Run the code checkers with make check
• Regenerate the manpages, docs and go formatting with make generated
• Commit messages follow commit message best practices

See the contribution guide
for more details.

Release Notes

NONE

[divyansh42]

/lgtm

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: divyansh42

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [divyansh42]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[Copilot]

🟢 Approval recommended

The one-line toolchain update is compatible with existing version selection, and no blocking issues were identified.

No open issues 🎉

What changed in this PR

Updates the Tekton CLI’s minimum Go version from 1.26.6 to 1.26.10 to address the reported CVE-2026-111943.

Changes:

• Raises the Go version in go.mod, which existing CI and release tooling use to select the toolchain.

File	Description
go.mod	Updates the Go directive to 1.26.10.

_{Review effort: Balanced}

[divyansh42]

/retest

[divyansh42]

/cherry-pick release-v0.46.x

[tekton-robot]

✅ Cherry-pick to release-v0.46.x successful!

A new pull request has been created to cherry-pick this change to release-v0.46.x.

Please review and merge the cherry-pick PR.

[divyansh42]

/cherry-pick release-v0.45.x

[tekton-robot]

✅ Cherry-pick to release-v0.45.x successful!

A new pull request has been created to cherry-pick this change to release-v0.45.x.

Please review and merge the cherry-pick PR.

[divyansh42]

/cherry-pick release-v0.37.x

[tekton-robot]

❌ Cherry-pick to release-v0.37.x failed!

The automatic cherry-pick to release-v0.37.x failed.

Output:

🤖 Starting cherry-pick process...
Fetching PR #3368 information...
Found merge commit: a4bd7cc1efba14819e50d6b182a8cf7e106019e4
PR title: chore: CVE-2026-111943 updating go version from 1.26.6 to 1.26.10
Fetching target branch: release-v0.37.x...
From https://github.com/tektoncd/cli
 * branch                release-v0.37.x -> FETCH_HEAD
Checking for existing cherry-pick PR...
Creating cherry-pick branch: cherry-pick-3368-to-release-v0.37.x...
Switched to a new branch 'cherry-pick-3368-to-release-v0.37.x'
branch 'cherry-pick-3368-to-release-v0.37.x' set up to track 'origin/release-v0.37.x'.
Cherry-picking commit a4bd7cc1efba14819e50d6b182a8cf7e106019e4...
Auto-merging go.mod
CONFLICT (content): Merge conflict in go.mod
error: could not apply a4bd7cc1e... chore: updating go version from 1.26.6 to 1.26.10
hint: After resolving the conflicts, mark them with
hint: "git add/rm <pathspec>", then run
hint: "git cherry-pick --continue".
hint: You can instead skip this commit with "git cherry-pick --skip".
hint: To abort and get back to the state before "git cherry-pick",
hint: run "git cherry-pick --abort".
hint: Disable this message with "git config set advice.mergeConflict false"
❌ ERROR: Cherry-pick failed due to conflicts or other errors.

Next steps:

• Check the action logs for complete details
• If the PR is not merged, merge it first and try again
• If there are conflicts, you'll need to manually cherry-pick this PR