Migrate Renovate config

[renovate]

The Renovate config in this repository needs migrating. Typically this is because one or more configuration options you are using have been renamed.

You don't need to merge this PR right away, because Renovate will continue to migrate these fields internally each time it runs. But later some of these fields may be fully deprecated and the migrations removed. So it's a good idea to merge this migration PR soon.

🔕 Ignore: Close this PR and you won't be reminded about config migration again, but one day your current config may no longer be valid.

❓ Got questions? Does something look wrong to you? Please don't hesitate to request help here.

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

Trivy Security Scan

cnb/lifecycle/launcher

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-33818	encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-39821	golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH	stdlib	v1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-39836	net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH	stdlib	v1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	v1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH	stdlib	v1.26.2	1.26.6, 1.27.0-rc.3	CVE-2026-46600	golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56853	net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56858	html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56859	encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56860	net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH	stdlib	v1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56862	crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-33818	encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-39821	golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH	stdlib	1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH	stdlib	1.26.2	1.26.6, 1.27.0-rc.3	CVE-2026-46600	golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56853	net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56858	html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56859	encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56860	net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56862	crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity	Package	Installed	Fixed	CVE	Title
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-27145	crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33811	net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-33814	net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-33818	encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39820	net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-39821	golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH	stdlib	1.26.2	1.25.12, 1.26.5, 1.27.0-rc.2	CVE-2026-39822	golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-39836	net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH	stdlib	1.26.2	1.25.10, 1.26.3	CVE-2026-42499	net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH	stdlib	1.26.2	1.25.11, 1.26.4	CVE-2026-42504	mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH	stdlib	1.26.2	1.26.6, 1.27.0-rc.3	CVE-2026-46600	golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56853	net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56858	html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56859	encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56860	net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH	stdlib	1.26.2	1.25.13, 1.26.6, 1.27.0-rc.3	CVE-2026-56862	crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages