Skip to content

chore(deps): bump github.com/openshift-pipelines/pipelines-as-code from 0.34.0 to 0.37.8 in /e2e - #6

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/e2e/github.com/openshift-pipelines/pipelines-as-code-0.37.8
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/e2e/github.com/openshift-pipelines/pipelines-as-code-0.37.8

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Aug 20, 2026

Copy link
Copy Markdown

Bumps github.com/openshift-pipelines/pipelines-as-code from 0.34.0 to 0.37.8.

Release notes

Sourced from github.com/openshift-pipelines/pipelines-as-code's releases.

v0.37.8

Pipelines as Code version v0.37.8

Tekton Pipelines as Code v0.37.8 has been released 🥳

This is a security and stability patch release for the v0.37.x stream, backporting fixes from v0.48.0 along with dependency updates addressing multiple CVEs.

🐛 Bug Fixes

  • Backport app token safeguards: Derive enterprise host from repo spec URL instead of trusting the X-GitHub-Enterprise-Host header, validate webhook signature before minting GitHub App tokens, and scope tokens to the triggering repository ID.
  • Deep-copy cached remote resources: Prevent cross-run mutation where the first PipelineRun applying its task annotation could leak that task into subsequent runs sharing the same remote resource.
  • Redact query string from incoming webhook log: Prevent URL-based secret values from being written to stdout.
  • Restore relative task path resolution: Fix regression from commit 6e36620 that broke relative task path resolution for repository file paths by only allowing HTTP(S) URLs, causing paths containing '..' to be rejected by the GitHub API.

⚙️ Chores

Installation

To install this version you can install the release.yaml with kubectl for your platform :

Openshift

kubectl apply -f https://github.com/openshift-pipelines/pipelines-as-code/releases/download/v0.37.8/release.yaml

Kubernetes

</tr></table> 

... (truncated)

Commits
  • bdd5380 test: rename bitbucket DC env vars to match main
  • 668ef2b ci: rewrite e2e script for main's matrix
  • bb7f4aa build(lint): pin golangci toolchain
  • 7eb5613 fix(security): redact query string from incoming webhook log
  • 9b2afcb fix(resolve): deep-copy cached remote resources to prevent cross-run mutation
  • 4081397 fix(security): backport app token safeguards
  • 0dcb5f7 fix(ci): skip TLS verification for gosmee client in e2e tests
  • a913a1d ci: harden container workflow actions
  • 24f2c55 chore(deps): update tektoncd/pipeline to v1.0.2
  • 80ad3e9 chore(deps): update go-jose to fix GHSA-78h2-9frx-2jm8
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    You can disable automated security fix PRs for this repo from the Security Alerts page.

Bumps [github.com/openshift-pipelines/pipelines-as-code](https://github.com/openshift-pipelines/pipelines-as-code) from 0.34.0 to 0.37.8.
- [Release notes](https://github.com/openshift-pipelines/pipelines-as-code/releases)
- [Commits](tektoncd/pipelines-as-code@v0.34.0...v0.37.8)

---
updated-dependencies:
- dependency-name: github.com/openshift-pipelines/pipelines-as-code
  dependency-version: 0.37.8
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Aug 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file go Pull requests that update go code

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants