pack v0.40.6 is a small patch fixing a trust detection bug in 'builder inspect' and adding Heroku's builder:26 to the trusted builders list.
breakingAudit pipelines that worked around the trust detection bug
If your CI scripts or automation added extra flags or workarounds because 'builder inspect' was misreporting trusted builders as untrusted, remove those workarounds now. Running with unnecessary trust overrides is a security smell worth cleaning up.
enhancementUse heroku/builder:26 without manual trust configuration
Teams targeting Heroku's stack 26 no longer need to manually mark the builder as trusted via '--trust-builder' or config file entries. Upgrade to v0.40.6 and clean up any explicit trust overrides you've added for this builder.
Key changes (3)
- Fixed 'builder inspect' incorrectly showing known/trusted builders as untrusted
- Added 'heroku/builder:26' to the built-in trusted builders list
- Bundles lifecycle v0.21.0 by default in builders created with this release