Buildpacks

v0.40.9CI/CD & App Delivery

Aug 9, 2026

This release updates dependencies associated with published security advisories. Builders created with the pack CLI from this release contain lifecycle v0.21.0 by default.

Action needed (3)

securityhighThe github.com/go-git/go-git/v5 dependency update
github.com/go-git/go-git/v5 updates from v5.19.1 to v5.19.2 in buildpacks v0.40.9. The release note cites GHSA-hc8v-wwc9-vgxm.
securitymediumThe go.opentelemetry.io/otel dependency update
go.opentelemetry.io/otel updates from v1.43.0 to v1.44.0 in buildpacks v0.40.9. The release note cites GO-2026-5158 and CVE-2026-41178 for a baggage header that was not length-capped.
securityThe github.com/klauspost/compress dependency update
github.com/klauspost/compress updates from v1.18.6 to v1.18.7 in buildpacks v0.40.9. The release note cites GO-2026-5841 and GHSA-259r-337f-4rfw for an out-of-bounds read in s2.

All 1 other recorded changesvalue changes 1

value changes (1)

Builders created with this release of the pack CLI contain [lifecycle v0.21.0](https://github.com/buildpack/lifecycle/releases/tag/v0.21.0) by default.

Add Buildpacks to your stack

A weekly email arrives when a release needs action. Like the security patches in this release.

Add to stack →

Official release note ↗All Buildpacks releases →