# Buildpacks v0.40.10

> CI/CD & App Delivery · 2026-10-21

A security-only maintenance release updates Go and vulnerable dependencies. Rebuilt builders also receive refreshed lifecycle content, while existing builders and intended APIs and behavior remain unchanged.

## Action needed
- **[security · critical]** `golang.org/x/net` v0.60.0
  - The indirect dependency `golang.org/x/net` is updated from `v0.56.0` to `v0.60.0` for `CVE-2026-78659`, `CVE-2026-78660`, `CVE-2026-78663`, `CVE-2026-78669`, and `CVE-2026-97032`, covering HTTP/2 memory exhaustion, malformed framing headers, double flow-control refunds, and an HPACK encoder race.
- **[security · high]** `golang.org/x/crypto` v0.57.0
  - `golang.org/x/crypto` is updated from `v0.54.0` to `v0.57.0` for `CVE-2026-78662` and `CVE-2026-56855`, which affect deadlocked `ssh` channels.
- **[security · high]** `github.com/moby/go-archive` v0.3.3
  - `github.com/moby/go-archive` is updated from `v0.2.0` to `v0.3.3` for `GHSA-hfg8-hc9c-6c3h` and `CVE-2026-17106`, which address crafted tar archives writing outside the extraction directory.
- **[security · medium]** `github.com/moby/sys/user` v0.4.1
  - `github.com/moby/sys/user` is updated from `v0.4.0` to `v0.4.1` for `GHSA-mjcv-p78q-w5fw` and `CVE-2026-61801`, which address unbounded parsing of user and group files.
- **[security]** `Go` 1.26.10
  - `Go` is updated to `1.26.10` to address `CVE-2026-111943`.

## Other recorded changes
- 3 (value_changed 3)

[Full analysis](https://ratatosk.io/en/releases/buildpacks/v0.40.10)

[Original release notes](https://github.com/buildpacks/pack/releases/tag/v0.40.10)