Latest lifecycle release v0.21.14 triggered CVE(s) from Grype. For further details, see: https://github.com/buildpacks/lifecycle/actions/runs/29713586594 json: {
"id": "GO-2026-5064",
"severity": "Critical",
"description": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd"
}
{
"id": "GO-2026-5338",
"severity": "Critical",
"description": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd"
}
{
"id": "GO-2026-5622",
"severity": "Medium",
"description": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd"
}
{
"id": "GO-2026-5932",
"severity": "Unknown",
"description": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package."
}
Latest lifecycle release v0.21.14 triggered CVE(s) from Grype. For further details, see: https://github.com/buildpacks/lifecycle/actions/runs/29713586594 json: {
"id": "GO-2026-5064",
"severity": "Critical",
"description": "containerd CRI checkpoint restore CDI annotation smuggling in github.com/containerd/containerd"
}
{
"id": "GO-2026-5338",
"severity": "Critical",
"description": "containerd: CRI checkpoint import allows local image tag poisoning in github.com/containerd/containerd"
}
{
"id": "GO-2026-5622",
"severity": "Medium",
"description": "Arbitrary host CRI log file read via symlink following in CRI checkpoint restore in github.com/containerd/containerd"
}
{
"id": "GO-2026-5932",
"severity": "Unknown",
"description": "The golang.org/x/crypto/openpgp package is unsafe by design, has numerous known security issues, is not maintained, and should not be used.\n\nIf you are required to interoperate with OpenPGP systems and need a maintained package, consider github.com/ProtonMail/go-crypto/openpgp which is a maintained fork that aims to be a drop-in replacement for this package."
}