[renovate]

This PR contains the following updates:

Package	Update	Change
buildpacks/pack	patch	0.40.8 → 0.40.10

---

Release Notes

buildpacks/pack

v0.40.10: pack v0.40.10

Compare Source

Prerequisites

• A container runtime such as Docker or podman must be available to execute builds.

Install

For instructions on installing pack, see our installation docs.

Run

Run the command pack.

You should see the following output

CLI for building apps using Cloud Native Buildpacks

Usage:
  pack [command]

Available Commands:
  build                 Generate app image from source code
  builder               Interact with builders
  buildpack             Interact with buildpacks
  extension             Interact with extensions
  config                Interact with your local pack config file
  inspect               Show information about a built app image
  stack                 (deprecated) Interact with stacks
  rebase                Rebase app image with latest run image
  sbom                  Interact with SBoM
  completion            Outputs completion script location
  report                Display useful information for reporting an issue
  version               Show current 'pack' version
  help                  Help about any command

Flags:
      --force-color   Force color output
  -h, --help          Help for 'pack'
      --no-color      Disable color output
  -q, --quiet         Show less output
      --timestamps    Enable timestamps in output
  -v, --verbose       Show more output
      --version       Show current 'pack' version

Use "pack [command] --help" for more information about a command.

Info

Builders created with this release of the pack CLI contain lifecycle v0.21.0 by default.

Changelog

This is a security-only patch release. No feature work, no API change, no
intended behaviour change. If you are on v0.40.9, this is a drop-in upgrade.

Security

Measured with the same scanner and vulnerability database, no suppressions applied:

Image	Findings	Critical	High	Medium	With a fix available
buildpacksio/pack:0.40.9	25	1	16	7	21
buildpacksio/pack:0.40.10	5	0	1	3	1
default lifecycle, before (0.21.0)	61	4	36	18	53
default lifecycle, after (0.21.25)	5	2	1	1	0

Toolchain

• Bump Go to 1.26.9 and security-relevant dependencies (#​2713)
• Bump Go to 1.26.10 for CVE-2026-111943 (#​2720)

Dependencies

Module	Bump	Advisory	Severity
golang.org/x/crypto	v0.54.0 → v0.57.0	CVE-2026-78662, CVE-2026-56855 — DoS on deadlocked ssh channels	—
golang.org/x/net (indirect)	v0.56.0 → v0.60.0	CVE-2026-78659/78660/78663/78669/97032 — HTTP/2 memory exhaustion, malformed framing headers, double flow-control refund, HPACK encoder race	—
github.com/moby/go-archive	v0.2.0 → v0.3.3	GHSA-hfg8-hc9c-6c3h / CVE-2026-17106 — crafted tar can write outside the extraction directory	High
github.com/moby/sys/user	v0.4.0 → v0.4.1	GHSA-mjcv-p78q-w5fw / CVE-2026-61801 — DoS via unbounded parsing of user/group files	Moderate

Still outstanding, and why

Advisory	Why it remains
GHSA-7236-3392-c5c6 (buildkit, Medium)	The one finding with an available fix. It describes a custom BuildKit frontend disabling Seccomp/AppArmor during a solve. pack never runs a solve — it links only frontend/dockerfile/{command,instructions,linter,parser,shell} and util/{stack,suggest}; solver, executor, frontend/gateway, client and session are absent. The fix needs buildkit v0.31.1 → go-containerregistry v0.21.6 → an imgutil bump, so it is held for 0.41.0.
GO-2026-4883, GO-2026-4887 (docker/docker)	Daemon-side code paths. pack only ever uses Docker as a client. Fixed only in moby/moby v2.
GHSA-685w-q87j-wqw3 (docker/distribution, Medium)	Missing digest verification in registry/client.(*manifests).Get. No ManifestService is ever constructed — the only importer of that package in the whole linked set uses three HTTP error helpers. No fix exists for the v2 module.
GO-2026-6225 (docker-credential-acr-env)	Unmaintained upstream, no fixed version. Severity Unknown. Left visible in scan output rather than suppressed.

Bugs

• Pass the format string directly to Debugf (#​2712)

Maintenance

• Propagate the Go 1.26 bump to the hard-coded Go pins (#​2715)
• Fix the duplicate-issue search in the release canary (#​2716)
• Assert the annotation we set, not the total annotation count (#​2717)
• Don't assert temp-dir cleanup on Windows in the registry buildpack test (#​2722)

Breaking changes

None.

Upgrade notes

• Contributors need Go 1.26.10+ locally. make verify builds golangci-lint with the system Go, so a system Go whose language version trails go.mod fails lint even though CI passes.
• Builders rebuilt with this release pick up lifecycle 0.21.25. Existing builders are unaffected until rebuilt.

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@​jjbustamante

v0.40.9: pack v0.40.9

Compare Source

Prerequisites

• A container runtime such as Docker or podman must be available to execute builds.

Install

For instructions on installing pack, see our installation docs.

Run

Run the command pack.

You should see the following output

CLI for building apps using Cloud Native Buildpacks

Usage:
  pack [command]

Available Commands:
  build                 Generate app image from source code
  builder               Interact with builders
  buildpack             Interact with buildpacks
  extension             Interact with extensions
  config                Interact with your local pack config file
  inspect               Show information about a built app image
  stack                 (deprecated) Interact with stacks
  rebase                Rebase app image with latest run image
  sbom                  Interact with SBoM
  completion            Outputs completion script location
  report                Display useful information for reporting an issue
  version               Show current 'pack' version
  help                  Help about any command

Flags:
      --force-color   Force color output
  -h, --help          Help for 'pack'
      --no-color      Disable color output
  -q, --quiet         Show less output
      --timestamps    Enable timestamps in output
  -v, --verbose       Show more output
      --version       Show current 'pack' version

Use "pack [command] --help" for more information about a command.

Info

Builders created with this release of the pack CLI contain lifecycle v0.21.0 by default.

Changelog

Security

• Bump go-git, otel and klauspost/compress to fix CVEs (#​2666 by @​jjbustamante)

  Module	Bump	Vulnerability	Severity
  github.com/go-git/go-git/v5	v5.19.1 → v5.19.2	GHSA-hc8v-wwc9-vgxm	High
  github.com/go-git/go-git/v5	v5.19.1 → v5.19.2	GHSA-qgq7-7hm3-q39j	Medium
  go.opentelemetry.io/otel	v1.43.0 → v1.44.0	GO-2026-5158 / CVE-2026-41178 — baggage header not length-capped	Medium
  github.com/klauspost/compress	v1.18.6 → v1.18.7	GO-2026-5841 / GHSA-259r-337f-4rfw — OOB read in s2	—

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@​jjbustamante

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.