Update module github.com/buildpacks/pack to v0.40.9

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/buildpacks/pack	v0.40.8 → v0.40.9

---

Release Notes

buildpacks/pack (github.com/buildpacks/pack)

v0.40.9: pack v0.40.9

Compare Source

Prerequisites

• A container runtime such as Docker or podman must be available to execute builds.

Install

For instructions on installing pack, see our installation docs.

Run

Run the command pack.

You should see the following output

CLI for building apps using Cloud Native Buildpacks

Usage:
  pack [command]

Available Commands:
  build                 Generate app image from source code
  builder               Interact with builders
  buildpack             Interact with buildpacks
  extension             Interact with extensions
  config                Interact with your local pack config file
  inspect               Show information about a built app image
  stack                 (deprecated) Interact with stacks
  rebase                Rebase app image with latest run image
  sbom                  Interact with SBoM
  completion            Outputs completion script location
  report                Display useful information for reporting an issue
  version               Show current 'pack' version
  help                  Help about any command

Flags:
      --force-color   Force color output
  -h, --help          Help for 'pack'
      --no-color      Disable color output
  -q, --quiet         Show less output
      --timestamps    Enable timestamps in output
  -v, --verbose       Show more output
      --version       Show current 'pack' version

Use "pack [command] --help" for more information about a command.

Info

Builders created with this release of the pack CLI contain lifecycle v0.21.0 by default.

Changelog

Security

• Bump go-git, otel and klauspost/compress to fix CVEs (#​2666 by @​jjbustamante)

  Module	Bump	Vulnerability	Severity
  github.com/go-git/go-git/v5	v5.19.1 → v5.19.2	GHSA-hc8v-wwc9-vgxm	High
  github.com/go-git/go-git/v5	v5.19.1 → v5.19.2	GHSA-qgq7-7hm3-q39j	Medium
  go.opentelemetry.io/otel	v1.43.0 → v1.44.0	GO-2026-5158 / CVE-2026-41178 — baggage header not length-capped	Medium
  github.com/klauspost/compress	v1.18.6 → v1.18.7	GO-2026-5841 / GHSA-259r-337f-4rfw — OOB read in s2	—

Contributors

We'd like to acknowledge that this release wouldn't be as good without the help of the following amazing contributors:

@​jjbustamante

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
go.opentelemetry.io/otel	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/metric	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/trace	v1.43.0 -> v1.44.0