buildpacks/pack v0.40.10 on GitHub

Prerequisites

A container runtime such as Docker or podman must be available to execute builds.

Install

For instructions on installing pack, see our installation docs.

Run

Run the command pack.

You should see the following output

CLI for building apps using Cloud Native Buildpacks

Usage:
  pack [command]

Available Commands:
  build                 Generate app image from source code
  builder               Interact with builders
  buildpack             Interact with buildpacks
  extension             Interact with extensions
  config                Interact with your local pack config file
  inspect               Show information about a built app image
  stack                 (deprecated) Interact with stacks
  rebase                Rebase app image with latest run image
  sbom                  Interact with SBoM
  completion            Outputs completion script location
  report                Display useful information for reporting an issue
  version               Show current 'pack' version
  help                  Help about any command

Flags:
      --force-color   Force color output
  -h, --help          Help for 'pack'
      --no-color      Disable color output
  -q, --quiet         Show less output
      --timestamps    Enable timestamps in output
  -v, --verbose       Show more output
      --version       Show current 'pack' version

Use "pack [command] --help" for more information about a command.

Info

Builders created with this release of the pack CLI contain lifecycle v0.21.0 by default.

Changelog

This is a security-only patch release. No feature work, no API change, no
intended behaviour change. If you are on v0.40.9, this is a drop-in upgrade.

Security

Measured with the same scanner and vulnerability database, no suppressions applied:

Image	Findings	Critical	High	Medium	With a fix available
`buildpacksio/pack:0.40.9`	25	1	16	7	21
`buildpacksio/pack:0.40.10`	5	0	1	3	1
default lifecycle, before (`0.21.0`)	61	4	36	18	53
default lifecycle, after (`0.21.25`)	5	2	1	1	0

Toolchain

Bump Go to 1.26.9 and security-relevant dependencies (#2713)
Bump Go to 1.26.10 for CVE-2026-111943 (#2720)

Dependencies

Module	Bump	Advisory	Severity
`golang.org/x/crypto`	v0.54.0 → v0.57.0	`CVE-2026-78662`, `CVE-2026-56855` — DoS on deadlocked `ssh` channels	—
`golang.org/x/net` (indirect)	v0.56.0 → v0.60.0	`CVE-2026-78659/78660/78663/78669/97032` — HTTP/2 memory exhaustion, malformed framing headers, double flow-control refund, HPACK encoder race	—
`github.com/moby/go-archive`	v0.2.0 → v0.3.3	`GHSA-hfg8-hc9c-6c3h` / `CVE-2026-17106` — crafted tar can write outside the extraction directory	High
`github.com/moby/sys/user`	v0.4.0 → v0.4.1	`GHSA-mjcv-p78q-w5fw` / `CVE-2026-61801` — DoS via unbounded parsing of user/group files	Moderate

Still outstanding, and why

Advisory	Why it remains
`GHSA-7236-3392-c5c6` (buildkit, Medium)	The one finding with an available fix. It describes a custom BuildKit frontend disabling Seccomp/AppArmor during a solve. `pack` never runs a solve — it links only `frontend/dockerfile/{command,instructions,linter,parser,shell}` and `util/{stack,suggest}`; `solver`, `executor`, `frontend/gateway`, `client` and `session` are absent. The fix needs buildkit v0.31.1 → go-containerregistry v0.21.6 → an imgutil bump, so it is held for 0.41.0.
`GO-2026-4883`, `GO-2026-4887` (docker/docker)	Daemon-side code paths. `pack` only ever uses Docker as a client. Fixed only in `moby/moby` v2.
`GHSA-685w-q87j-wqw3` (docker/distribution, Medium)	Missing digest verification in `registry/client.(*manifests).Get`. No `ManifestService` is ever constructed — the only importer of that package in the whole linked set uses three HTTP error helpers. No fix exists for the v2 module.
`GO-2026-6225` (`docker-credential-acr-env`)	Unmaintained upstream, no fixed version. Severity Unknown. Left visible in scan output rather than suppressed.

Bugs

Pass the format string directly to Debugf (#2712)

Maintenance

Propagate the Go 1.26 bump to the hard-coded Go pins (#2715)
Fix the duplicate-issue search in the release canary (#2716)
Assert the annotation we set, not the total annotation count (#2717)
Don't assert temp-dir cleanup on Windows in the registry buildpack test (#2722)

Breaking changes

None.

Upgrade notes

Contributors need Go 1.26.10+ locally. make verify builds golangci-lint with the system Go, so a system Go whose language version trails go.mod fails lint even though CI passes.
Builders rebuilt with this release pick up lifecycle 0.21.25. Existing builders are unaffected until rebuilt.

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@jjbustamante

buildpacks/pack v0.40.10 pack v0.40.10 on GitHub