Releases

AI-analyzed release notes for CNCF graduated and incubating projects.

URGENCY

All Action needed Check if affected Plan ahead

KIND

Category

All AI & ML CI/CD & App Delivery Kubernetes Core Networking & Messaging Observability Orchestration & Management Provisioning & Runtime Security Storage & Data

Project: BuildpacksClear ×

Buildpacksv0.40.9CI/CD & App DeliveryAug 9, 2026

ACTION 3OTHER 1View full analysis

This release updates dependencies associated with published security advisories. Builders created with the pack CLI from this release contain lifecycle v0.21.0 by default.

Action needed (3)

securityhighThe github.com/go-git/go-git/v5 dependency update
github.com/go-git/go-git/v5 updates from v5.19.1 to v5.19.2 in buildpacks v0.40.9. The release note cites GHSA-hc8v-wwc9-vgxm.
securitymediumThe go.opentelemetry.io/otel dependency update
go.opentelemetry.io/otel updates from v1.43.0 to v1.44.0 in buildpacks v0.40.9. The release note cites GO-2026-5158 and CVE-2026-41178 for a baggage header that was not length-capped.
securityThe github.com/klauspost/compress dependency update
github.com/klauspost/compress updates from v1.18.6 to v1.18.7 in buildpacks v0.40.9. The release note cites GO-2026-5841 and GHSA-259r-337f-4rfw for an out-of-bounds read in s2.

Source ↗

Buildpacksv0.40.8CI/CD & App DeliveryJul 13, 2026

CHECK 1OTHER 3View full analysis

A maintenance release rebuilds the pack on Go 1.25.12 to address two disclosed standard library security issues. It also updates several dependencies and includes a newer default lifecycle version.

Check if affected (1)

securityhighGo 1.25.12 standard library rebuild for GO-2026-4970 and GO-2026-5856
Applies if you use 1.25.11 -> 1.25.12.
Moving the directive from 1.25.11 to 1.25.12 is sufficient to rebuild the image with a patched Go standard library. This release addresses GO-2026-4970 and GO-2026-5856.

Source ↗

Browse by month