Update infrabits/ci-create-renovate-release digest to 690d358

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
infrabits/ci-create-renovate-release (changelog)	action	digest	99a3ddf → 690d358

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Trivy Security Scan

cnb/lifecycle/launcher

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	v1.26.0	1.25.8, 1.26.1	CVE-2026-25679	net/url: Incorrect parsing of IPv6 host literals in net/url
🟠 HIGH	stdlib	v1.26.0	1.26.1	CVE-2026-27137	crypto/x509: Incorrect enforcement of email constraints in crypto/x509
🟠 HIGH	stdlib	v1.26.0	1.25.9, 1.26.2	CVE-2026-32280	crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
🟠 HIGH	stdlib	v1.26.0	1.25.9, 1.26.2	CVE-2026-32281	crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation
🟠 HIGH	stdlib	v1.26.0	1.25.9, 1.26.2	CVE-2026-32283	crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
🟠 HIGH	stdlib	v1.26.0	1.26.2	CVE-2026-33810	crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-39826	If a trusted template author were to write a <script> tag containing a ...
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)
🟠 HIGH	stdlib	v1.26.0	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.0	1.25.8, 1.26.1	CVE-2026-25679	net/url: Incorrect parsing of IPv6 host literals in net/url
🟠 HIGH	stdlib	1.26.0	1.26.1	CVE-2026-27137	crypto/x509: Incorrect enforcement of email constraints in crypto/x509
🟠 HIGH	stdlib	1.26.0	1.25.9, 1.26.2	CVE-2026-32280	crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
🟠 HIGH	stdlib	1.26.0	1.25.9, 1.26.2	CVE-2026-32281	crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation
🟠 HIGH	stdlib	1.26.0	1.25.9, 1.26.2	CVE-2026-32283	crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
🟠 HIGH	stdlib	1.26.0	1.26.2	CVE-2026-33810	crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39826	If a trusted template author were to write a <script> tag containing a ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.0	1.25.8, 1.26.1	CVE-2026-25679	net/url: Incorrect parsing of IPv6 host literals in net/url
🟠 HIGH	stdlib	1.26.0	1.26.1	CVE-2026-27137	crypto/x509: Incorrect enforcement of email constraints in crypto/x509
🟠 HIGH	stdlib	1.26.0	1.25.9, 1.26.2	CVE-2026-32280	crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building
🟠 HIGH	stdlib	1.26.0	1.25.9, 1.26.2	CVE-2026-32281	crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation
🟠 HIGH	stdlib	1.26.0	1.25.9, 1.26.2	CVE-2026-32283	crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages
🟠 HIGH	stdlib	1.26.0	1.26.2	CVE-2026-33810	crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-33814	When processing HTTP/2 SETTINGS frames, transport will enter an infini ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39820	Well-crafted inputs reaching ParseAddress, ParseAddressList, and Parse ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39823	CVE-2026-27142 fixed a vulnerability in which URLs were not correctly ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39825	ReverseProxy can forward queries containing parameters not visible to ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39826	If a trusted template author were to write a <script> tag containing a ...
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-39836	ELSA-2026-22112: go-toolset:ol8 security update (IMPORTANT)
🟠 HIGH	stdlib	1.26.0	1.25.10, 1.26.3	CVE-2026-42499	Pathological inputs could cause DoS through consumePhrase when parsing ...