Bump github.com/tektoncd/chains from 0.26.0 to 0.26.5

[dependabot]

Bumps github.com/tektoncd/chains from 0.26.0 to 0.26.5.

Release notes

Sourced from github.com/tektoncd/chains's releases.

Tekton Chains release v0.26.5 "Release v0.26.5"

-Docs @ v0.26.5 -Examples @ v0.26.5

Installation one-liner

kubectl apply -f https://infra.tekton.dev/tekton-releases/chains/previous/v0.26.5/release.yaml

Attestation

The Rekor UUID for this release is 108e9186e8c5677a349f2deb2e5f38833800ef9c33b284db5d2c2b4df8641b7b6fe629503b43089a

Obtain the attestation:

REKOR_UUID=108e9186e8c5677a349f2deb2e5f38833800ef9c33b284db5d2c2b4df8641b7b6fe629503b43089a
rekor-cli get --uuid $REKOR_UUID --format json | jq -r .Attestation | jq .

Verify that all container images in the attestation are in the release file:

RELEASE_FILE=https://infra.tekton.dev/tekton-releases/chains/previous/v0.26.5/release.yaml
REKOR_UUID=108e9186e8c5677a349f2deb2e5f38833800ef9c33b284db5d2c2b4df8641b7b6fe629503b43089a
Obtains the list of images with sha from the attestation
REKOR_ATTESTATION_IMAGES=$(rekor-cli get --uuid "$REKOR_UUID" --format json | jq -r .Attestation | jq -r '.subject[]|.name + ":v0.26.5@sha256:" + .digest.sha256')
Download the release file
curl -L "$RELEASE_FILE" > release.yaml
For each image in the attestation, match it to the release file
for image in $REKOR_ATTESTATION_IMAGES; do
printf $image; grep -q $image release.yaml && echo " ===> ok" || echo " ===> no match";
done

Changes

Features

... (truncated)

Commits

• 881f5e9 fix(deps): bump Go modules to address CVEs (#1703)
• dbad7be fix(cve): CVE-2026-33814 - golang.org/x/net HTTP/2 infinite loop (#1670)
• a51457d fix: update pipelines to v1.6.2 (#1649)
• 868c359 fix: CVE-2026-34986, CVE-2026-33211, & CVE-2026-33186 (#1630)
• 7d7d316 fix ci workflow to include CI summary (#1633)
• bee7519 chore(deps): fix stale deps (#1547)
• 6cad4e5 fix: upgrade cosign 2.6.0 to 2.6.2 (#1537)
• 2548d11 Revert "fix: updated cosign version to address cve-2025-66506" (#1523)
• 2018d81 fix: updated cosign version to address cve-2025-66506
• See full diff in compare view

[vdemeester]

/lgtm

[vdemeester]

/lgtm

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tekton-robot]

New changes are detected. LGTM label has been removed.

[tekton-robot]

@dependabot[bot]: rebase

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.