Script 'mail_helper' called by obssrc
Hello community,
here is the log from the commit of package buildpacks-cli for openSUSE:Factory
checked in at 2026-10-24 22:05:10
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Comparing /work/SRC/openSUSE:Factory/buildpacks-cli (Old)
and /work/SRC/openSUSE:Factory/.buildpacks-cli.new.2252680 (New)
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "buildpacks-cli"
Sat Oct 24 22:05:10 2026 rev:23 rq:1392195 version:0.40.10
Changes:
--------
--- /work/SRC/openSUSE:Factory/buildpacks-cli/buildpacks-cli.changes
2026-08-11 17:11:54.632763509 +0200
+++
/work/SRC/openSUSE:Factory/.buildpacks-cli.new.2252680/buildpacks-cli.changes
2026-10-24 22:06:59.737569084 +0200
@@ -1,0 +2,33 @@
+Fri Oct 23 15:57:12 UTC 2026 - Johannes Kastl
<[email protected]>
+
+- Update to version 0.40.10:
+ * test: don't assert temp-dir cleanup on Windows in the registry
+ buildpack test (#2722)
+ * deps: ignore two advisories whose code paths pack does not link
+ (#2721)
+ * build(deps): bump Go to 1.26.10 for CVE-2026-111943 (#2720)
+ * test: assert the annotation we set, not the total annotation
+ count (#2717)
+ * fix: propagate the Go 1.26 bump to the hard-coded Go pins
+ (#2715)
+ * ci: fix duplicate-issue search in the release canary (#2716)
+ * build(deps): bump Go to 1.26.9 and security-relevant deps
+ (#2713)
+ * fix: pass the format string directly to Debugf (#2712)
+ * Dependency updates
+ - golang.org/x/crypto v0.54.0 → v0.57.0
+ CVE-2026-78662, CVE-2026-56855
+ DoS on deadlocked ssh channels
+ - golang.org/x/net (indirect) v0.56.0 → v0.60.0
+ CVE-2026-78659/78660/78663/78669/97032
+ HTTP/2 memory exhaustion, malformed framing headers, double
+ flow-control refund, HPACK encoder race
+ - github.com/moby/go-archive v0.2.0 → v0.3.3
+ GHSA-hfg8-hc9c-6c3h / CVE-2026-17106
+ crafted tar can write outside the extraction directory
+ - github.com/moby/sys/user v0.4.0 → v0.4.1
+ GHSA-mjcv-p78q-w5fw / CVE-2026-61801
+ DoS via unbounded parsing of user/group files
+
+
+-------------------------------------------------------------------
Old:
----
buildpacks-cli-0.40.9.obscpio
New:
----
buildpacks-cli-0.40.10.obscpio
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Other differences:
------------------
++++++ buildpacks-cli.spec ++++++
--- /var/tmp/diff_new_pack.b02JIO/_old 2026-10-24 22:07:00.690609194 +0200
+++ /var/tmp/diff_new_pack.b02JIO/_new 2026-10-24 22:07:00.691609237 +0200
@@ -19,7 +19,7 @@
%define executable_name pack
Name: buildpacks-cli
-Version: 0.40.9
+Version: 0.40.10
Release: 0
Summary: CLI for building apps using Cloud Native Buildpacks
License: Apache-2.0
@@ -28,7 +28,7 @@
Source1: vendor.tar.gz
BuildRequires: bash-completion
BuildRequires: fish
-BuildRequires: go1.25 >= 1.25.12
+BuildRequires: go1.26 >= 1.26.10
BuildRequires: zsh
Requires: (podman or docker)
Provides: pack = %{version}
++++++ _service ++++++
--- /var/tmp/diff_new_pack.b02JIO/_old 2026-10-24 22:07:00.728610794 +0200
+++ /var/tmp/diff_new_pack.b02JIO/_new 2026-10-24 22:07:00.731610920 +0200
@@ -3,7 +3,7 @@
<param name="url">https://github.com/buildpacks/pack.git</param>
<param name="scm">git</param>
<param name="exclude">.git</param>
- <param name="revision">refs/tags/v0.40.9</param>
+ <param name="revision">refs/tags/v0.40.10</param>
<param name="versionformat">@PARENT_TAG@</param>
<param name="versionrewrite-pattern">v(.*)</param>
<param name="changesgenerate">enable</param>
++++++ _servicedata ++++++
--- /var/tmp/diff_new_pack.b02JIO/_old 2026-10-24 22:07:00.752611804 +0200
+++ /var/tmp/diff_new_pack.b02JIO/_new 2026-10-24 22:07:00.756611972 +0200
@@ -3,6 +3,6 @@
<param name="url">https://github.com/buildpacks/pack</param>
<param
name="changesrevision">2df3b8c3b0955ea41aec010783ddfe70cbc17c56</param></service><service
name="tar_scm">
<param
name="url">https://github.com/buildpacks/pack.git</param>
- <param
name="changesrevision">8210eb15f191cad25a3f7745618417270ec07709</param></service></servicedata>
+ <param
name="changesrevision">9b483c2428d832957efc7fe3d96bbef1395ca001</param></service></servicedata>
(No newline at EOF)
++++++ buildpacks-cli-0.40.9.obscpio -> buildpacks-cli-0.40.10.obscpio ++++++
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/buildpacks-cli-0.40.9/.grype.yaml
new/buildpacks-cli-0.40.10/.grype.yaml
--- old/buildpacks-cli-0.40.9/.grype.yaml 2026-08-09 17:21:19.000000000
+0200
+++ new/buildpacks-cli-0.40.10/.grype.yaml 2026-10-21 18:32:52.000000000
+0200
@@ -25,3 +25,32 @@
# build tag and is not part of the shipped binary. Confirmed by govulncheck
("your code doesn't
# appear to call") and by `go list -deps ./...` showing no x/crypto/openpgp
package.
- vulnerability: GO-2026-5932 # x/crypto/openpgp unmaintained; not linked
into the pack binary
+ # moby/buildkit: the advisory describes a custom BuildKit *frontend* sending
a crafted build
+ # request that disables Seccomp/AppArmor for the build container during a
solve. pack never
+ # runs a BuildKit solve: it has no direct buildkit import at all, and the
only buildkit
+ # packages in `go list -deps ./...` are the Dockerfile parser
+ # (frontend/dockerfile/{command,instructions,linter,parser,shell}, pulled in
by
+ # lifecycle/buildpack for image extensions) plus the util/{stack,suggest}
error helpers.
+ # buildkit/solver, buildkit/executor, buildkit/frontend/gateway,
buildkit/client and
+ # buildkit/session are all absent, so the vulnerable code path is not in the
binary. Every
+ # govulncheck trace is a package init() of one of those parser packages.
+ # The fix is buildkit v0.31.1, which requires go-containerregistry v0.21.6.
ggcr v0.21.6
+ # changed mutate.image.Layers() to resolve manifest descriptors by digest,
which needs the
+ # daemon layer digests that imgutil only started reporting after our current
pin, so the bump
+ # is a three-step chain (imgutil -> ggcr -> buildkit) rather than a version
change.
+ - vulnerability: GHSA-7236-3392-c5c6 # buildkit custom-frontend
Seccomp/AppArmor bypass (GO-2026-6255)
+ - vulnerability: GO-2026-6255
+ # docker/distribution: registry/client.(*manifests).Get fetches a manifest
by digest but never
+ # hashes the response body back against the requested digest, so a malicious
registry or MITM
+ # can substitute content on a digest-pinned request. Not reachable from
pack: the vulnerable
+ # type is only constructible via client.NewRepository, and across the whole
linked package set
+ # exactly one package imports docker/distribution/registry/client --
+ # distribution/registry/client/auth -- which uses only client.Do,
client.HandleErrorResponse
+ # and client.SuccessStatus. No ManifestService is ever constructed. The
module is in our graph
+ # solely because lifecycle/auth calls registry.ConvertToHostname from
docker/docker/registry.
+ # No fix exists for this module: the v2 line ends at v2.8.3 and the fix
ships only in
+ # github.com/distribution/distribution/v3 v3.1.2, which would be a
migration, not a bump.
+ # Removal condition: lifecycle drops its docker/docker/registry import,
which also clears
+ # GO-2026-4883 and GO-2026-4887 above.
+ - vulnerability: GHSA-685w-q87j-wqw3 # distribution client does not verify
returned digest (CVE-2026-85747)
+ - vulnerability: CVE-2026-85747
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/buildpacks-cli-0.40.9/Dockerfile
new/buildpacks-cli-0.40.10/Dockerfile
--- old/buildpacks-cli-0.40.9/Dockerfile 2026-08-09 17:21:19.000000000
+0200
+++ new/buildpacks-cli-0.40.10/Dockerfile 2026-10-21 18:32:52.000000000
+0200
@@ -1,7 +1,7 @@
# syntax=docker/dockerfile:1
ARG base_image=gcr.io/distroless/static
-FROM golang:1.25 as builder
+FROM golang:1.26 AS builder
ARG pack_version
ENV PACK_VERSION=$pack_version
WORKDIR /app
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/buildpacks-cli-0.40.9/acceptance/acceptance_test.go
new/buildpacks-cli-0.40.10/acceptance/acceptance_test.go
--- old/buildpacks-cli-0.40.9/acceptance/acceptance_test.go 2026-08-09
17:21:19.000000000 +0200
+++ new/buildpacks-cli-0.40.10/acceptance/acceptance_test.go 2026-10-21
18:32:52.000000000 +0200
@@ -933,7 +933,12 @@
index := h.ReadIndexManifest(t,
indexLocalPath)
h.AssertEq(t, len(index.Manifests), 1)
- h.AssertEq(t,
len(index.Manifests[0].Annotations), 1)
+ // Assert the annotation we asked for
is present, rather than the total
+ // count. The descriptor may also carry
annotations inherited from the
+ // source manifest
(go-containerregistry >= v0.21.6 propagates the
+ // manifest's own annotations, e.g.
org.opencontainers.image.version),
+ // which is not something this command
controls.
+ h.AssertEq(t,
index.Manifests[0].Annotations["foo"], "bar")
})
})
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/buildpacks-cli-0.40.9/go.mod
new/buildpacks-cli-0.40.10/go.mod
--- old/buildpacks-cli-0.40.9/go.mod 2026-08-09 17:21:19.000000000 +0200
+++ new/buildpacks-cli-0.40.10/go.mod 2026-10-21 18:32:52.000000000 +0200
@@ -21,7 +21,7 @@
github.com/hectane/go-acl v0.0.0-20190604041725-da78bae5fc95
github.com/heroku/color v0.0.6
github.com/mitchellh/ioprogress v0.0.0-20180201004757-6a23b12fa88e
- github.com/moby/go-archive v0.2.0
+ github.com/moby/go-archive v0.3.3
github.com/moby/moby/api v1.54.2
github.com/moby/moby/client v0.4.1
github.com/onsi/gomega v1.42.1
@@ -33,13 +33,13 @@
github.com/sabhiram/go-gitignore v0.0.0-20210923224102-525f6e181f06
github.com/sclevine/spec v1.4.0
github.com/spf13/cobra v1.10.2
- golang.org/x/crypto v0.54.0
- golang.org/x/mod v0.38.0
+ golang.org/x/crypto v0.57.0
+ golang.org/x/mod v0.41.0
golang.org/x/oauth2 v0.36.0
- golang.org/x/sync v0.22.0
- golang.org/x/sys v0.47.0
- golang.org/x/term v0.45.0
- golang.org/x/text v0.40.0
+ golang.org/x/sync v0.23.0
+ golang.org/x/sys v0.48.0
+ golang.org/x/term v0.46.0
+ golang.org/x/text v0.42.0
gopkg.in/yaml.v3 v3.0.1
)
@@ -118,8 +118,8 @@
github.com/moby/buildkit v0.30.0 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
github.com/moby/patternmatcher v0.6.1 // indirect
- github.com/moby/sys/sequential v0.6.0 // indirect
- github.com/moby/sys/user v0.4.0 // indirect
+ github.com/moby/sys/sequential v0.7.0 // indirect
+ github.com/moby/sys/user v0.4.1 // indirect
github.com/moby/sys/userns v0.1.0 // indirect
github.com/moby/term v0.5.2 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 //
indirect
@@ -148,11 +148,11 @@
go.opentelemetry.io/otel/trace v1.44.0 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
- golang.org/x/net v0.56.0 // indirect
+ golang.org/x/net v0.60.0 // indirect
google.golang.org/protobuf v1.36.11 // indirect
gopkg.in/warnings.v0 v0.1.2 // indirect
)
replace github.com/BurntSushi/toml => github.com/BurntSushi/toml v1.3.2
-go 1.25.12
+go 1.26.10
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/buildpacks-cli-0.40.9/go.sum
new/buildpacks-cli-0.40.10/go.sum
--- old/buildpacks-cli-0.40.9/go.sum 2026-08-09 17:21:19.000000000 +0200
+++ new/buildpacks-cli-0.40.10/go.sum 2026-10-21 18:32:52.000000000 +0200
@@ -270,18 +270,22 @@
github.com/moby/buildkit v0.30.0/go.mod
h1:k2wuw5ddaOqzh58RLt+mBn2XhK34gi6+gd0faONQ1xU=
github.com/moby/docker-image-spec v1.3.1
h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3Nl2EsFP0=
github.com/moby/docker-image-spec v1.3.1/go.mod
h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
-github.com/moby/go-archive v0.2.0
h1:zg5QDUM2mi0JIM9fdQZWC7U8+2ZfixfTYoHL7rWUcP8=
-github.com/moby/go-archive v0.2.0/go.mod
h1:mNeivT14o8xU+5q1YnNrkQVpK+dnNe/K6fHqnTg4qPU=
+github.com/moby/go-archive v0.3.3
h1:OxxR9paxsluYi+zDUEXTTaIxtkK3viymW+Ka7vRhhME=
+github.com/moby/go-archive v0.3.3/go.mod
h1:Npdv43fFqlhZW7Xo8fbm3ZMYFvAGNviUPqX21VERbcE=
github.com/moby/moby/api v1.54.2
h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg=
github.com/moby/moby/api v1.54.2/go.mod
h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs=
github.com/moby/moby/client v0.4.1
h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY=
github.com/moby/moby/client v0.4.1/go.mod
h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ=
github.com/moby/patternmatcher v0.6.1
h1:qlhtafmr6kgMIJjKJMDmMWq7WLkKIo23hsrpR3x084U=
github.com/moby/patternmatcher v0.6.1/go.mod
h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
-github.com/moby/sys/sequential v0.6.0
h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=
-github.com/moby/sys/sequential v0.6.0/go.mod
h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko=
-github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs=
-github.com/moby/sys/user v0.4.0/go.mod
h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs=
+github.com/moby/sys/mount v0.3.5
h1:eS3fsZTjHaBihwjp4/+5Z3jxqLXYsbwxqpVSfFv3M00=
+github.com/moby/sys/mount v0.3.5/go.mod
h1:WUQDO+/uCiCIkIztx8SrwIDVn2dtMFRBebRhpDFT71M=
+github.com/moby/sys/mountinfo v0.7.2
h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg=
+github.com/moby/sys/mountinfo v0.7.2/go.mod
h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4=
+github.com/moby/sys/sequential v0.7.0
h1:ASQNGNROJSuOO6LL6bPHbKvuZu6NU8P4ldPWk31zj/8=
+github.com/moby/sys/sequential v0.7.0/go.mod
h1:NfSTAp6V3fw4tmkD62PEcOKeZKquXT8VKCkf7aVR79o=
+github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0=
+github.com/moby/sys/user v0.4.1/go.mod
h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y=
github.com/moby/sys/userns v0.1.0
h1:tVLXkFOxVu9A64/yh59slHVv9ahO9UIev4JZusOLG/g=
github.com/moby/sys/userns v0.1.0/go.mod
h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28=
github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ=
@@ -430,15 +434,15 @@
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod
h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/crypto v0.0.0-20220722155217-630584e8d5aa/go.mod
h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
golang.org/x/crypto v0.17.0/go.mod
h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
-golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=
-golang.org/x/crypto v0.54.0/go.mod
h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk=
+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+golang.org/x/crypto v0.57.0/go.mod
h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod
h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
-golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=
-golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40=
+golang.org/x/mod v0.41.0 h1:qJmnOUb4YB+FsEuM3HcWucdZASCPGhsX6uljO6pog0c=
+golang.org/x/mod v0.41.0/go.mod h1:Ek9pY8RKWXwsWvd3rQiHYtMqkjSUV+s1Rj7j4H5Ur6o=
golang.org/x/net v0.0.0-20180906233101-161cd47e91fd/go.mod
h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20181114220301-adae6a3d119a/go.mod
h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod
h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
@@ -453,8 +457,8 @@
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod
h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg=
-golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
-golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod
h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
golang.org/x/oauth2 v0.36.0/go.mod
h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
@@ -467,8 +471,8 @@
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod
h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod
h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod
h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
+golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+golang.org/x/sync v0.23.0/go.mod
h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod
h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20180909124046-d0be0721c37e/go.mod
h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
golang.org/x/sys v0.0.0-20181116152217-5ac8a444bdc5/go.mod
h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
@@ -493,15 +497,15 @@
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
+golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod
h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod
h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
golang.org/x/term v0.15.0/go.mod
h1:BDl952bC7+uMoWR75FIrCDx79TPU9oHkTZ9yRbYOrX0=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod
h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+golang.org/x/term v0.46.0/go.mod
h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
@@ -510,8 +514,8 @@
golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8=
golang.org/x/text v0.14.0/go.mod
h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod
h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+golang.org/x/text v0.42.0/go.mod
h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod
h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod
h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod
h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/buildpacks-cli-0.40.9/pkg/client/build_test.go
new/buildpacks-cli-0.40.10/pkg/client/build_test.go
--- old/buildpacks-cli-0.40.9/pkg/client/build_test.go 2026-08-09
17:21:19.000000000 +0200
+++ new/buildpacks-cli-0.40.10/pkg/client/build_test.go 2026-10-21
18:32:52.000000000 +0200
@@ -1795,7 +1795,12 @@
it.After(func() {
os.Unsetenv("PACK_HOME")
- h.AssertNil(t,
os.RemoveAll(tmpDir))
+ err := os.RemoveAll(tmpDir)
+ if runtime.GOOS != "windows" {
+ // avoid "The process
cannot access the file because it is being used by another process"
+ // error on Windows
+ h.AssertNil(t, err)
+ }
})
it("all buildpacks are added to
ephemeral builder", func() {
diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn'
'--exclude=.svnignore' old/buildpacks-cli-0.40.9/pkg/image/fetcher.go
new/buildpacks-cli-0.40.10/pkg/image/fetcher.go
--- old/buildpacks-cli-0.40.9/pkg/image/fetcher.go 2026-08-09
17:21:19.000000000 +0200
+++ new/buildpacks-cli-0.40.10/pkg/image/fetcher.go 2026-10-21
18:32:52.000000000 +0200
@@ -124,7 +124,7 @@
// `image with reference <image> was found but does not match
the specified platform: wanted linux/amd64, actual: linux` or
// `image with reference <image> was found but its platform
(linux) does not match the specified platform (linux/amd64)`
if strings.Contains(err.Error(), "does not match the specified
platform") {
- f.logger.Debugf(fmt.Sprintf("Pulling image %s",
style.Symbol(name)))
+ f.logger.Debugf("Pulling image %s", style.Symbol(name))
err = f.pullImage(ctx, name, nil)
}
}
++++++ buildpacks-cli.obsinfo ++++++
--- /var/tmp/diff_new_pack.b02JIO/_old 2026-10-24 22:07:05.207799309 +0200
+++ /var/tmp/diff_new_pack.b02JIO/_new 2026-10-24 22:07:05.214799604 +0200
@@ -1,5 +1,5 @@
name: buildpacks-cli
-version: 0.40.9
-mtime: 1786288879
-commit: 8210eb15f191cad25a3f7745618417270ec07709
+version: 0.40.10
+mtime: 1792600372
+commit: 9b483c2428d832957efc7fe3d96bbef1395ca001
++++++ vendor.tar.gz ++++++
/work/SRC/openSUSE:Factory/buildpacks-cli/vendor.tar.gz
/work/SRC/openSUSE:Factory/.buildpacks-cli.new.2252680/vendor.tar.gz differ:
char 62, line 1
