CVE(s) found

[github-actions]

Latest docker.io/buildpacksio/pack v0.40.2 triggered CVE(s) from Grype. For further details, see: https://github.com/buildpacks/pack/actions/runs/24017089382

[jjbustamante]

Locally I get this, but we added a rule to ignore these CVEs based on what we already do in lifecycle

grype docker.io/buildpacksio/pack:0.40.3
 ✔ Vulnerability DB                [updated]  
 ✔ Loaded image                                                                                                                                    index.docker.io/buildpacksio/pack:0.40.3 
 ✔ Parsed image                                                                                                     sha256:998455d449a2c551a02535cff5de7f62a9634d31d50ea12e30599653e0becc95 
 ✔ Cataloged contents                                                                                                      81e45c7eb7d94d2ef76fe5b60339ef9771d6a9f19e41bfb35f4a27ffb30869bb 
   ├── ✔ Packages                        [137 packages]  
   ├── ✔ Executables                     [1 executables]  
   ├── ✔ File metadata                   [934 locations]  
   └── ✔ File digests                    [934 files]  
 ✔ Scanned for vulnerabilities     [2 vulnerability matches]  
   ├── by severity: 0 critical, 1 high, 1 medium, 0 low, 0 negligible
   └── by status:   0 fixed, 2 not-fixed, 0 ignored 
NAME                      INSTALLED             TYPE       VULNERABILITY        SEVERITY  EPSS          RISK   
github.com/docker/docker  v28.5.2+incompatible  go-module  GHSA-pxq6-2prw-chj9  Medium    < 0.1% (3rd)  < 0.1  
github.com/docker/docker  v28.5.2+incompatible  go-module  GHSA-x744-4wpc-v9h2  High      < 0.1% (0th)  < 0.1
A newer version of grype is available for download: 0.111.1 (installed version is 0.109.0)