[rpms/pack] epel10.3: Update to 0.40.9 - fixes CVE-2026-41178

[rpms/pack] epel10.3: Update to 0.40.9 - fixes CVE-2026-41178

[Lokesh Mandvekar]

            A new commit has been pushed.

            Repo   : rpms/pack
            Branch : epel10.3
            Commit : 36f9d1dece13bee9732583b74dbfc3b8d2a5782a
            Author : Lokesh Mandvekar <lsm5@redhat.com>
            Date   : 2026-08-13T16:01:08-04:00
            Stats  : +3/-1 in 3 file(s)
            URL    : https://src.fedoraproject.org/rpms/pack/c/36f9d1dece13bee9732583b74dbfc3b8d2a5782a?branch=epel10.3

            Log:
            Update to 0.40.9 - fixes CVE-2026-41178

Fixes CVE-2026-41178: DoS via oversized OpenTelemetry baggage headers
Updates bundled go.opentelemetry.io/otel from v1.43.0 to v1.44.0

Resolves: rhbz#2515142

---
diff --git a/.gitignore b/.gitignore
index f1cbd13..60dcce5 100644
--- a/.gitignore
+++ b/.gitignore
@@ -26,3 +26,4 @@
 /v0.40.5-vendor.tar.gz
 /v0.40.7-vendor.tar.gz
 /v0.40.8-vendor.tar.gz
+/v0.40.9-vendor.tar.gz

diff --git a/pack.spec b/pack.spec
index e55faa5..f03b9c2 100644
--- a/pack.spec
+++ b/pack.spec
@@ -12,7 +12,7 @@
 %global import_path %{provider}.%{provider_tld}/%{project}/%{repo}
 
 Name: pack
-Version: 0.40.8
+Version: 0.40.9
 Release: %autorelease
 Summary: Convert code into runnable images
 License: Apache-2.0 and BSD-2-Clause and BSD-3-Clause and ISC and MIT

diff --git a/sources b/sources
index a81ba7e..09741b1 100644
--- a/sources
+++ b/sources
@@ -1 +1,2 @@
 SHA512 (v0.40.8-vendor.tar.gz) = a785076357ebad3e51f824dc9fc3bb8b5fc9f94a81395095dca188134f91147e99d8835bd2b268598ec04bc434a2f3d7ee2c1670b02a11ff97359187a47b5035
+SHA512 (v0.40.9-vendor.tar.gz) = 7db8ea6fb0685f6e65a06fd665ba2b40d315f28a76741832ae2ec3736972fa10b92cf4a2b521eb7dedf3a7da4373e4e4eb30a046869360e315d9df61f3627295