CVE(s) found

[github-actions]

Latest buildpacksio/pack v0.33.2 triggered CVE(s) from Grype. For further details, see: https://github.com/buildpacks/pack/actions/runs/8461426079

[vivekcode101]

I did the scan of the pack cli
getting the same CVE's
also , how do I create the pack cli through this repo on my local machine so that I can contribute more in it.

[jjbustamante]

Hi @vivekcode101

Thanks for being interested in this issue, we merged the dependencies already and it will be fixed with pack 0.34.0. If you want to compile the binaries locally follow the steps here and you can look for issues with the label good-first-issue to pick something that you find interesting to work on.

[vivekcode101]

Thanks for the response @jjbustamante .
Just a quick side note, are the stdlib CVE's which were found in the scan also removed . Because the merged pr only shows for the protobuf and anchore/stereoscope.
And if they are removed can you provide any reference how did you guys resolved that issue.

[jjbustamante]

The standard libraries are related to go version used to compile pack during the release. We are using golang 1.21.x but I will check before releasing 0.34.0

Locally I can double check in this way

• I'm using go 1.22.2
• Latest pack binary was compiled using go 1.21.7
• Compiling pack with go 1.22.2 and current dependencies is free of CVEs

pack image artifacts are created using distroless and ubuntu jammy see the workflow here

[jjbustamante]

Fixed with 0.34.0 and 0.34.1 (docker hub)