Heroku-22 and Heroku-24 stacks updated

Change effective on 10 March 2026

We updated the heroku-22 and heroku-24 stacks to pick up security fixes in upstream packages. The new base images for each stack roll out automatically to the Common Runtime over the next 48 hours, followed by Private Spaces.

If you use Heroku’s default buildpack-powered build system/stacks, you don’t need to redeploy your app to include these changes. We automatically restart any running dynos as we roll out the new base images for each stack. For Cedar-generation apps, each time a dyno starts, the slug applies on top of the most recent base image. For Fir-generation apps, the built image gets rebased on top of the most recent base image.

If your app uses Heroku’s container stack (most don’t), you must rebuild your app’s Docker image to pick up updates in the base image specified in your Dockerfile.

See this Dev Center article for an overview of the packages available in each stack’s base image.

Changelog of packages

Stack: heroku-22

• Updated curl from version 7.81.0-1ubuntu1.21 to 7.81.0-1ubuntu1.22
• Updated gcc-12-base from version 12.3.0-1ubuntu1~22.04.2 to 12.3.0-1ubuntu1~22.04.3
• Updated git from version 1:2.34.1-1ubuntu1.15 to 1:2.34.1-1ubuntu1.17
• Updated git-man from version 1:2.34.1-1ubuntu1.15 to 1:2.34.1-1ubuntu1.17
• Updated libatomic1 from version 12.3.0-1ubuntu1~22.04.2 to 12.3.0-1ubuntu1~22.04.3
• Updated libcc1-0 from version 12.3.0-1ubuntu1~22.04.2 to 12.3.0-1ubuntu1~22.04.3
• Updated libcurl3-gnutls from version 7.81.0-1ubuntu1.21 to 7.81.0-1ubuntu1.22
• Updated libcurl4 from version 7.81.0-1ubuntu1.21 to 7.81.0-1ubuntu1.22
• Updated libdjvulibre-text from version 3.5.28-2ubuntu0.22.04.1 to 3.5.28-2ubuntu0.22.04.2
• Updated libdjvulibre21 from version 3.5.28-2ubuntu0.22.04.1 to 3.5.28-2ubuntu0.22.04.2
• Updated libgcc-s1 from version 12.3.0-1ubuntu1~22.04.2 to 12.3.0-1ubuntu1~22.04.3
• Updated libgomp1 from version 12.3.0-1ubuntu1~22.04.2 to 12.3.0-1ubuntu1~22.04.3
• Updated libitm1 from version 12.3.0-1ubuntu1~22.04.2 to 12.3.0-1ubuntu1~22.04.3
• Updated liblsan0 from version 12.3.0-1ubuntu1~22.04.2 to 12.3.0-1ubuntu1~22.04.3
• Updated libnss3 from version 2:3.98-0ubuntu0.22.04.2 to 2:3.98-0ubuntu0.22.04.3
• Updated libpq5 from version 18.2-1.pgdg22.04+1 to 18.3-1.pgdg22.04+1
• Updated libpython3.10-minimal from version 3.10.12-1~22.04.14 to 3.10.12-1~22.04.15
• Updated libpython3.10-stdlib from version 3.10.12-1~22.04.14 to 3.10.12-1~22.04.15
• Updated libquadmath0 from version 12.3.0-1ubuntu1~22.04.2 to 12.3.0-1ubuntu1~22.04.3
• Updated libssh-4 from version 0.9.6-2ubuntu0.22.04.5 to 0.9.6-2ubuntu0.22.04.6
• Updated libstdc++6 from version 12.3.0-1ubuntu1~22.04.2 to 12.3.0-1ubuntu1~22.04.3
• Updated libubsan1 from version 12.3.0-1ubuntu1~22.04.2 to 12.3.0-1ubuntu1~22.04.3
• Updated libvpx7 from version 1.11.0-2ubuntu2.4 to 1.11.0-2ubuntu2.5
• Updated linux-libc-dev from version 5.15.0-170.180 to 5.15.0-171.181
• Updated postgresql-client-17 from version 17.8-1.pgdg22.04+1 to 17.9-1.pgdg22.04+1
• Updated postgresql-client-common from version 289.pgdg22.04+1 to 290.pgdg22.04+1
• Updated python3.10 from version 3.10.12-1~22.04.14 to 3.10.12-1~22.04.15
• Updated python3.10-minimal from version 3.10.12-1~22.04.14 to 3.10.12-1~22.04.15

Updates to packages available at build time only

• Updated libcurl4-openssl-dev from version 7.81.0-1ubuntu1.21 to 7.81.0-1ubuntu1.22
• Updated libdjvulibre-dev from version 3.5.28-2ubuntu0.22.04.1 to 3.5.28-2ubuntu0.22.04.2
• Updated libpq-dev from version 18.2-1.pgdg22.04+1 to 18.3-1.pgdg22.04+1
• Updated libpython3.10 from version 3.10.12-1~22.04.14 to 3.10.12-1~22.04.15
• Updated libpython3.10-dev from version 3.10.12-1~22.04.14 to 3.10.12-1~22.04.15
• Updated libvpx-dev from version 1.11.0-2ubuntu2.4 to 1.11.0-2ubuntu2.5
• Updated python3.10-dev from version 3.10.12-1~22.04.14 to 3.10.12-1~22.04.15

Stack: heroku-24

• Updated curl from version 8.5.0-2ubuntu10.6 to 8.5.0-2ubuntu10.7
• Updated libcurl3t64-gnutls from version 8.5.0-2ubuntu10.6 to 8.5.0-2ubuntu10.7
• Updated libcurl4t64 from version 8.5.0-2ubuntu10.6 to 8.5.0-2ubuntu10.7
• Updated libdjvulibre-text from version 3.5.28-2ubuntu0.24.04.1 to 3.5.28-2ubuntu0.24.04.2
• Updated libdjvulibre21 from version 3.5.28-2ubuntu0.24.04.1 to 3.5.28-2ubuntu0.24.04.2
• Updated libnss3 from version 2:3.98-1build1 to 2:3.98-1ubuntu0.1
• Updated libpq5 from version 18.2-1.pgdg24.04+1 to 18.3-1.pgdg24.04+1
• Updated libssh-4 from version 0.10.6-2ubuntu0.2 to 0.10.6-2ubuntu0.3
• Updated libvpx9 from version 1.14.0-1ubuntu2.2 to 1.14.0-1ubuntu2.3
• Updated postgresql-client-17 from version 17.8-1.pgdg24.04+1 to 17.9-1.pgdg24.04+1
• Updated postgresql-client-common from version 289.pgdg24.04+1 to 290.pgdg24.04+1

Updates to packages available at build time only

• Updated libcurl4-openssl-dev from version 8.5.0-2ubuntu10.6 to 8.5.0-2ubuntu10.7
• Updated libdjvulibre-dev from version 3.5.28-2ubuntu0.24.04.1 to 3.5.28-2ubuntu0.24.04.2
• Updated libpq-dev from version 18.2-1.pgdg24.04+1 to 18.3-1.pgdg24.04+1
• Updated libpython3.12-minimal from version 3.12.3-1ubuntu0.11 to 3.12.3-1ubuntu0.12
• Updated libpython3.12-stdlib from version 3.12.3-1ubuntu0.11 to 3.12.3-1ubuntu0.12
• Updated libvpx-dev from version 1.14.0-1ubuntu2.2 to 1.14.0-1ubuntu2.3
• Updated linux-libc-dev from version 6.8.0-100.100 to 6.8.0-101.101
• Updated python3.12 from version 3.12.3-1ubuntu0.11 to 3.12.3-1ubuntu0.12
• Updated python3.12-minimal from version 3.12.3-1ubuntu0.11 to 3.12.3-1ubuntu0.12