Skip to content

Updated module github.com/buildpacks/pack from v0.40.2 to v0.40.10 - #615

Open
paketo-bot wants to merge 2 commits into
mainfrom
renovate/github.com-buildpacks-pack-0.x
Open

Updated module github.com/buildpacks/pack from v0.40.2 to v0.40.10#615
paketo-bot wants to merge 2 commits into
mainfrom
renovate/github.com-buildpacks-pack-0.x

Conversation

@paketo-bot

@paketo-bot paketo-bot commented Nov 2, 2026 •
edited by pacostas
Loading

Copy link
Copy Markdown
Member

This PR contains the following updates:

Package Type Update Change
github.com/buildpacks/pack require patch v0.40.2 → v0.40.10

Release Notes

buildpacks/pack (github.com/buildpacks/pack)

v0.40.10: pack v0.40.10

Compare Source

Prerequisites

  • A container runtime such as Docker or podman must be available to execute builds.

Install

For instructions on installing pack, see our installation docs.

Run

Run the command pack.

You should see the following output

CLI for building apps using Cloud Native Buildpacks

Usage:
  pack [command]

Available Commands:
  build                 Generate app image from source code
  builder               Interact with builders
  buildpack             Interact with buildpacks
  extension             Interact with extensions
  config                Interact with your local pack config file
  inspect               Show information about a built app image
  stack                 (deprecated) Interact with stacks
  rebase                Rebase app image with latest run image
  sbom                  Interact with SBoM
  completion            Outputs completion script location
  report                Display useful information for reporting an issue
  version               Show current 'pack' version
  help                  Help about any command

Flags:
      --force-color   Force color output
  -h, --help          Help for 'pack'
      --no-color      Disable color output
  -q, --quiet         Show less output
      --timestamps    Enable timestamps in output
  -v, --verbose       Show more output
      --version       Show current 'pack' version

Use "pack [command] --help" for more information about a command.

Info

Builders created with this release of the pack CLI contain lifecycle v0.21.0 by default.

Changelog

This is a security-only patch release. No feature work, no API change, no
intended behaviour change. If you are on v0.40.9, this is a drop-in upgrade.

Security

Measured with the same scanner and vulnerability database, no suppressions applied:

Image Findings Critical High Medium With a fix available
buildpacksio/pack:0.40.9 25 1 16 7 21
buildpacksio/pack:0.40.10 5 0 1 3 1
default lifecycle, before (0.21.0) 61 4 36 18 53
default lifecycle, after (0.21.25) 5 2 1 1 0
Toolchain
  • Bump Go to 1.26.9 and security-relevant dependencies (#​2713)
  • Bump Go to 1.26.10 for CVE-2026-111943 (#​2720)
Dependencies
Module Bump Advisory Severity
golang.org/x/crypto v0.54.0 → v0.57.0 CVE-2026-78662, CVE-2026-56855 — DoS on deadlocked ssh channels —
golang.org/x/net (indirect) v0.56.0 → v0.60.0 CVE-2026-78659/78660/78663/78669/97032 — HTTP/2 memory exhaustion, malformed framing headers, double flow-control refund, HPACK encoder race —
github.com/moby/go-archive v0.2.0 → v0.3.3 GHSA-hfg8-hc9c-6c3h / CVE-2026-17106 — crafted tar can write outside the extraction directory High
github.com/moby/sys/user v0.4.0 → v0.4.1 GHSA-mjcv-p78q-w5fw / CVE-2026-61801 — DoS via unbounded parsing of user/group files Moderate
Still outstanding, and why
Advisory Why it remains
GHSA-7236-3392-c5c6 (buildkit, Medium) The one finding with an available fix. It describes a custom BuildKit frontend disabling Seccomp/AppArmor during a solve. pack never runs a solve — it links only frontend/dockerfile/{command,instructions,linter,parser,shell} and util/{stack,suggest}; solver, executor, frontend/gateway, client and session are absent. The fix needs buildkit v0.31.1 → go-containerregistry v0.21.6 → an imgutil bump, so it is held for 0.41.0.
GO-2026-4883, GO-2026-4887 (docker/docker) Daemon-side code paths. pack only ever uses Docker as a client. Fixed only in moby/moby v2.
GHSA-685w-q87j-wqw3 (docker/distribution, Medium) Missing digest verification in registry/client.(*manifests).Get. No ManifestService is ever constructed — the only importer of that package in the whole linked set uses three HTTP error helpers. No fix exists for the v2 module.
GO-2026-6225 (docker-credential-acr-env) Unmaintained upstream, no fixed version. Severity Unknown. Left visible in scan output rather than suppressed.
Bugs
  • Pass the format string directly to Debugf (#​2712)
Maintenance
  • Propagate the Go 1.26 bump to the hard-coded Go pins (#​2715)
  • Fix the duplicate-issue search in the release canary (#​2716)
  • Assert the annotation we set, not the total annotation count (#​2717)
  • Don't assert temp-dir cleanup on Windows in the registry buildpack test (#​2722)
Breaking changes

None.

Upgrade notes
  • Contributors need Go 1.26.10+ locally. make verify builds golangci-lint with the system Go, so a system Go whose language version trails go.mod fails lint even though CI passes.
  • Builders rebuilt with this release pick up lifecycle 0.21.25. Existing builders are unaffected until rebuilt.

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@​jjbustamante

v0.40.9: pack v0.40.9

Compare Source

Prerequisites

  • A container runtime such as Docker or podman must be available to execute builds.

Install

For instructions on installing pack, see our installation docs.

Run

Run the command pack.

You should see the following output

CLI for building apps using Cloud Native Buildpacks

Usage:
  pack [command]

Available Commands:
  build                 Generate app image from source code
  builder               Interact with builders
  buildpack             Interact with buildpacks
  extension             Interact with extensions
  config                Interact with your local pack config file
  inspect               Show information about a built app image
  stack                 (deprecated) Interact with stacks
  rebase                Rebase app image with latest run image
  sbom                  Interact with SBoM
  completion            Outputs completion script location
  report                Display useful information for reporting an issue
  version               Show current 'pack' version
  help                  Help about any command

Flags:
      --force-color   Force color output
  -h, --help          Help for 'pack'
      --no-color      Disable color output
  -q, --quiet         Show less output
      --timestamps    Enable timestamps in output
  -v, --verbose       Show more output
      --version       Show current 'pack' version

Use "pack [command] --help" for more information about a command.

Info

Builders created with this release of the pack CLI contain lifecycle v0.21.0 by default.

Changelog

Security

  • Bump go-git, otel and klauspost/compress to fix CVEs (#​2666 by @​jjbustamante)

    Module Bump Vulnerability Severity
    github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 GHSA-hc8v-wwc9-vgxm High
    github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 GHSA-qgq7-7hm3-q39j Medium
    go.opentelemetry.io/otel v1.43.0 → v1.44.0 GO-2026-5158 / CVE-2026-41178 — baggage header not length-capped Medium
    github.com/klauspost/compress v1.18.6 → v1.18.7 GO-2026-5841 / GHSA-259r-337f-4rfw — OOB read in s2 —

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@​jjbustamante

v0.40.8: pack v0.40.8

Compare Source

Prerequisites

  • A container runtime such as Docker or podman must be available to execute builds.

Install

For instructions on installing pack, see our installation docs.

Run

Run the command pack.

You should see the following output

CLI for building apps using Cloud Native Buildpacks

Usage:
  pack [command]

Available Commands:
  build                 Generate app image from source code
  builder               Interact with builders
  buildpack             Interact with buildpacks
  extension             Interact with extensions
  config                Interact with your local pack config file
  inspect               Show information about a built app image
  stack                 (deprecated) Interact with stacks
  rebase                Rebase app image with latest run image
  sbom                  Interact with SBoM
  completion            Outputs completion script location
  report                Display useful information for reporting an issue
  version               Show current 'pack' version
  help                  Help about any command

Flags:
      --force-color   Force color output
  -h, --help          Help for 'pack'
      --no-color      Disable color output
  -q, --quiet         Show less output
      --timestamps    Enable timestamps in output
  -v, --verbose       Show more output
      --version       Show current 'pack' version

Use "pack [command] --help" for more information about a command.

Info

Builders created with this release of the pack CLI contain lifecycle v0.21.0 by default.

Changelog

Contributors

Security

  • Bump Go to 1.25.12 and safe x/* deps to fix CVEs (#​2653 by @​jjbustamante)

    Rebuilds the release on a patched stdlib, which is what actually clears the findings:

    Vulnerability Severity Component
    GO-2026-4970 High os — root escape via symlink plus trailing slash
    GO-2026-5856 Medium crypto/tls — Encrypted Client Hello privacy leak
Chores and Dependencies

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@​fossabot, @​jjbustamante

v0.40.7: pack v0.40.7

Compare Source

Prerequisites

  • A container runtime such as Docker or podman must be available to execute builds.

Install

For instructions on installing pack, see our installation docs.

Run

Run the command pack.

You should see the following output

CLI for building apps using Cloud Native Buildpacks

Usage:
  pack [command]

Available Commands:
  build                 Generate app image from source code
  builder               Interact with builders
  buildpack             Interact with buildpacks
  extension             Interact with extensions
  config                Interact with your local pack config file
  inspect               Show information about a built app image
  stack                 (deprecated) Interact with stacks
  rebase                Rebase app image with latest run image
  sbom                  Interact with SBoM
  completion            Outputs completion script location
  report                Display useful information for reporting an issue
  version               Show current 'pack' version
  help                  Help about any command

Flags:
      --force-color   Force color output
  -h, --help          Help for 'pack'
      --no-color      Disable color output
  -q, --quiet         Show less output
      --timestamps    Enable timestamps in output
  -v, --verbose       Show more output
      --version       Show current 'pack' version

Use "pack [command] --help" for more information about a command.

Info

Builders created with this release of the pack CLI contain lifecycle v0.21.0 by default.

Changelog

Features

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@​MD-Mushfiqur123, @​jjbustamante, @​runesoerensen

v0.40.6: pack v0.40.6

Compare Source

Prerequisites

  • A container runtime such as Docker or podman must be available to execute builds.

Install

For instructions on installing pack, see our installation docs.

Run

Run the command pack.

You should see the following output

CLI for building apps using Cloud Native Buildpacks

Usage:
  pack [command]

Available Commands:
  build                 Generate app image from source code
  builder               Interact with builders
  buildpack             Interact with buildpacks
  extension             Interact with extensions
  config                Interact with your local pack config file
  inspect               Show information about a built app image
  stack                 (deprecated) Interact with stacks
  rebase                Rebase app image with latest run image
  sbom                  Interact with SBoM
  completion            Outputs completion script location
  report                Display useful information for reporting an issue
  version               Show current 'pack' version
  help                  Help about any command

Flags:
      --force-color   Force color output
  -h, --help          Help for 'pack'
      --no-color      Disable color output
  -q, --quiet         Show less output
      --timestamps    Enable timestamps in output
  -v, --verbose       Show more output
      --version       Show current 'pack' version

Use "pack [command] --help" for more information about a command.

Info

Builders created with this release of the pack CLI contain lifecycle v0.21.0 by default.

Changelog

Features

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@​runesoerensen

v0.40.5: pack v0.40.5

Compare Source

Prerequisites

  • A container runtime such as Docker or podman must be available to execute builds.

Install

For instructions on installing pack, see our installation docs.

Run

Run the command pack.

You should see the following output

CLI for building apps using Cloud Native Buildpacks

Usage:
  pack [command]

Available Commands:
  build                 Generate app image from source code
  builder               Interact with builders
  buildpack             Interact with buildpacks
  extension             Interact with extensions
  config                Interact with your local pack config file
  inspect               Show information about a built app image
  stack                 (deprecated) Interact with stacks
  rebase                Rebase app image with latest run image
  sbom                  Interact with SBoM
  completion            Outputs completion script location
  report                Display useful information for reporting an issue
  version               Show current 'pack' version
  help                  Help about any command

Flags:
      --force-color   Force color output
  -h, --help          Help for 'pack'
      --no-color      Disable color output
  -q, --quiet         Show less output
      --timestamps    Enable timestamps in output
  -v, --verbose       Show more output
      --version       Show current 'pack' version

Use "pack [command] --help" for more information about a command.

Info

Builders created with this release of the pack CLI contain lifecycle v0.21.0 by default.

Changelog

Dependencies

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@​dependabot[bot], @​jjbustamante

v0.40.4: pack v0.40.4

Compare Source

Prerequisites

  • A container runtime such as Docker or podman must be available to execute builds.

Install

For instructions on installing pack, see our installation docs.

Run

Run the command pack.

You should see the following output

CLI for building apps using Cloud Native Buildpacks

Usage:
  pack [command]

Available Commands:
  build                 Generate app image from source code
  builder               Interact with builders
  buildpack             Interact with buildpacks
  extension             Interact with extensions
  config                Interact with your local pack config file
  inspect               Show information about a built app image
  stack                 (deprecated) Interact with stacks
  rebase                Rebase app image with latest run image
  sbom                  Interact with SBoM
  completion            Outputs completion script location
  report                Display useful information for reporting an issue
  version               Show current 'pack' version
  help                  Help about any command

Flags:
      --force-color   Force color output
  -h, --help          Help for 'pack'
      --no-color      Disable color output
  -q, --quiet         Show less output
      --timestamps    Enable timestamps in output
  -v, --verbose       Show more output
      --version       Show current 'pack' version

Use "pack [command] --help" for more information about a command.

Info

Builders created with this release of the pack CLI contain lifecycle v0.21.0 by default.

Changelog

Features

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@​JamBalaya56562, @​ddusht, @​dependabot[bot]

v0.40.3: pack v0.40.3

Compare Source

Prerequisites

  • A container runtime such as Docker or podman must be available to execute builds.

Install

For instructions on installing pack, see our installation docs.

Run

Run the command pack.

You should see the following output

CLI for building apps using Cloud Native Buildpacks

Usage:
  pack [command]

Available Commands:
  build                 Generate app image from source code
  builder               Interact with builders
  buildpack             Interact with buildpacks
  extension             Interact with extensions
  config                Interact with your local pack config file
  inspect               Show information about a built app image
  stack                 (deprecated) Interact with stacks
  rebase                Rebase app image with latest run image
  sbom                  Interact with SBoM
  completion            Outputs completion script location
  report                Display useful information for reporting an issue
  version               Show current 'pack' version
  help                  Help about any command

Flags:
      --force-color   Force color output
  -h, --help          Help for 'pack'
      --no-color      Disable color output
  -q, --quiet         Show less output
      --timestamps    Enable timestamps in output
  -v, --verbose       Show more output
      --version       Show current 'pack' version

Use "pack [command] --help" for more information about a command.

Info

Builders created with this release of the pack CLI contain lifecycle v0.21.0 by default.

Changelog

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@​dependabot[bot], @​jjbustamante

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

@paketo-bot paketo-bot added dependencies go semver:patch A change requiring a patch version bump labels Nov 2, 2026
@paketo-bot
paketo-bot requested review from a team as code owners November 2, 2026 18:50
@paketo-bot

paketo-bot commented Nov 2, 2026

Copy link
Copy Markdown
Member Author

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

  • 4 additional dependencies were updated

Details:

Package Change
github.com/moby/buildkit v0.26.3 -> v0.30.0
github.com/morikuni/aec v1.0.0 -> v1.1.0
github.com/tonistiigi/fsutil v0.0.0-20250605211040-586307ad452f -> v0.0.0-20251211185533-a2aa163d723f
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.61.0 -> v0.68.0

@paketo-bot
paketo-bot force-pushed the renovate/github.com-buildpacks-pack-0.x branch from 65b687f to bef80e4 Compare November 2, 2026 19:09
@paketo-bot
paketo-bot force-pushed the renovate/github.com-buildpacks-pack-0.x branch from bef80e4 to 5dde333 Compare November 3, 2026 04:33
@paketo-bot

paketo-bot commented Nov 6, 2026

Copy link
Copy Markdown
Member Author

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

@pacostas

pacostas commented Nov 6, 2026

Copy link
Copy Markdown
Member

@dependabot recreate

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@pacostas pacostas Awaiting requested review from pacostas pacostas is a code owner automatically assigned from paketo-buildpacks/tooling-maintainers
@paketo-bot-reviewer paketo-bot-reviewer Awaiting requested review from paketo-bot-reviewer paketo-bot-reviewer is a code owner automatically assigned from paketo-buildpacks/tooling-maintainers

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

dependencies go semver:patch A change requiring a patch version bump

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@paketo-bot @pacostas @dmikusa