Add object store support

[DamianZaremba]

No description provided.

[github-actions]

Trivy Security Scan

cnb/lifecycle/launcher

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	v1.26.0	1.25.8, 1.26.1	CVE-2026-25679	net/url: Incorrect parsing of IPv6 host literals in net/url
🟠 HIGH	stdlib	v1.26.0	1.26.1	CVE-2026-27137	crypto/x509: Incorrect enforcement of email constraints in crypto/x509
🟠 HIGH	stdlib	v1.26.0	1.25.9, 1.26.2	CVE-2026-32280	crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
🟠 HIGH	stdlib	v1.26.0	1.25.9, 1.26.2	CVE-2026-32281	crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation
🟠 HIGH	stdlib	v1.26.0	1.25.9, 1.26.2	CVE-2026-32283	crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
🟠 HIGH	stdlib	v1.26.0	1.26.2	CVE-2026-33810	crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-39826	If a trusted template author were to write a <script> tag containing a ...
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-39836	Panic in Dial and LookupPort when handling NUL byte on Windows in net
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.0	1.25.8, 1.26.1	CVE-2026-25679	net/url: Incorrect parsing of IPv6 host literals in net/url
🟠 HIGH	stdlib	1.26.0	1.26.1	CVE-2026-27137	crypto/x509: Incorrect enforcement of email constraints in crypto/x509
🟠 HIGH	stdlib	1.26.0	1.25.9, 1.26.2	CVE-2026-32280	crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
🟠 HIGH	stdlib	1.26.0	1.25.9, 1.26.2	CVE-2026-32281	crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation
🟠 HIGH	stdlib	1.26.0	1.25.9, 1.26.2	CVE-2026-32283	crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
🟠 HIGH	stdlib	1.26.0	1.26.2	CVE-2026-33810	crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39826	If a trusted template author were to write a <script> tag containing a ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39836	Panic in Dial and LookupPort when handling NUL byte on Windows in net
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.0	1.25.8, 1.26.1	CVE-2026-25679	net/url: Incorrect parsing of IPv6 host literals in net/url
🟠 HIGH	stdlib	1.26.0	1.26.1	CVE-2026-27137	crypto/x509: Incorrect enforcement of email constraints in crypto/x509
🟠 HIGH	stdlib	1.26.0	1.25.9, 1.26.2	CVE-2026-32280	crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
🟠 HIGH	stdlib	1.26.0	1.25.9, 1.26.2	CVE-2026-32281	crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation
🟠 HIGH	stdlib	1.26.0	1.25.9, 1.26.2	CVE-2026-32283	crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
🟠 HIGH	stdlib	1.26.0	1.26.2	CVE-2026-33810	crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39826	If a trusted template author were to write a <script> tag containing a ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39836	Panic in Dial and LookupPort when handling NUL byte on Windows in net
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...