Heroku-22, Heroku-24 and Heroku-26 stacks updated

Change effective on 13 July 2026

We updated the heroku-22, heroku-24 and heroku-26 stacks to pick up security fixes in upstream packages. The new base images for each stack roll out automatically to the Common Runtime over the next 48 hours, followed by Private Spaces.

If you use Heroku’s default buildpack-powered build system/stacks, you don’t need to redeploy your app to include these changes. We automatically restart any running dynos as we roll out the new base images for each stack. For Cedar-generation apps, each time a dyno starts, the slug applies on top of the most recent base image. For Fir-generation apps, the built image gets rebased on top of the most recent base image.

If your app uses Heroku’s container stack (most don’t), you must rebuild your app’s Docker image to pick up updates in the base image specified in your Dockerfile.

See this Dev Center article for an overview of the packages available in each stack’s base image.

The Heroku-22 stack is deprecated and will reach end-of-life on April 30th, 2027. Upgrade to a newer stack as soon as possible. See the Heroku-22 End-Of-Life FAQ for more details.

Changelog of packages

Stack: heroku-22

  • Updated curl from version 7.81.0-1ubuntu1.24 to 7.81.0-1ubuntu1.25
  • Updated gzip from version 1.10-4ubuntu4.1 to 1.10-4ubuntu4.2
  • Updated iproute2 from version 5.15.0-1ubuntu2.1 to 5.15.0-1ubuntu2.2
  • Updated libcurl3-gnutls from version 7.81.0-1ubuntu1.24 to 7.81.0-1ubuntu1.25
  • Updated libcurl4 from version 7.81.0-1ubuntu1.24 to 7.81.0-1ubuntu1.25
  • Updated libidn12 from version 1.38-4ubuntu1 to 1.38-4ubuntu1.1
  • Updated libncurses6 from version 6.3-2ubuntu0.1 to 6.3-2ubuntu0.2
  • Updated libncursesw6 from version 6.3-2ubuntu0.1 to 6.3-2ubuntu0.2
  • Updated libnghttp2-14 from version 1.43.0-1ubuntu0.3 to 1.43.0-1ubuntu0.4
  • Updated libpython3.10-minimal from version 3.10.12-1~22.04.15 to 3.10.12-1~22.04.16
  • Updated libpython3.10-stdlib from version 3.10.12-1~22.04.15 to 3.10.12-1~22.04.16
  • Updated libtinfo6 from version 6.3-2ubuntu0.1 to 6.3-2ubuntu0.2
  • Updated ncurses-base from version 6.3-2ubuntu0.1 to 6.3-2ubuntu0.2
  • Updated ncurses-bin from version 6.3-2ubuntu0.1 to 6.3-2ubuntu0.2
  • Updated python3.10 from version 3.10.12-1~22.04.15 to 3.10.12-1~22.04.16
  • Updated python3.10-minimal from version 3.10.12-1~22.04.15 to 3.10.12-1~22.04.16
  • Updated tar from version 1.34+dfsg-1ubuntu0.1.22.04.3 to 1.34+dfsg-1ubuntu0.1.22.04.4
  • Updated tzdata from version 2026a-0ubuntu0.22.04.1 to 2026b-0ubuntu0.22.04.1

Updates to packages available at build time only

  • Updated libcurl4-openssl-dev from version 7.81.0-1ubuntu1.24 to 7.81.0-1ubuntu1.25
  • Updated libidn-dev from version 1.38-4ubuntu1 to 1.38-4ubuntu1.1
  • Updated libidn11-dev from version 1.38-4ubuntu1 to 1.38-4ubuntu1.1
  • Updated libncurses-dev from version 6.3-2ubuntu0.1 to 6.3-2ubuntu0.2
  • Updated libncurses5-dev from version 6.3-2ubuntu0.1 to 6.3-2ubuntu0.2
  • Updated libncursesw5-dev from version 6.3-2ubuntu0.1 to 6.3-2ubuntu0.2
  • Updated libpython3.10 from version 3.10.12-1~22.04.15 to 3.10.12-1~22.04.16
  • Updated libpython3.10-dev from version 3.10.12-1~22.04.15 to 3.10.12-1~22.04.16
  • Updated python3.10-dev from version 3.10.12-1~22.04.15 to 3.10.12-1~22.04.16

Stack: heroku-24

  • Updated curl from version 8.5.0-2ubuntu10.9 to 8.5.0-2ubuntu10.11
  • Updated gzip from version 1.12-1ubuntu3.1 to 1.12-1ubuntu3.2
  • Updated iproute2 from version 6.1.0-1ubuntu6.3 to 6.1.0-1ubuntu6.4
  • Updated libcurl3t64-gnutls from version 8.5.0-2ubuntu10.9 to 8.5.0-2ubuntu10.11
  • Updated libcurl4t64 from version 8.5.0-2ubuntu10.9 to 8.5.0-2ubuntu10.11
  • Updated libheif-plugin-aomdec from version 1.17.6-1ubuntu4.4 to 1.17.6-1ubuntu4.5
  • Updated libheif-plugin-libde265 from version 1.17.6-1ubuntu4.4 to 1.17.6-1ubuntu4.5
  • Updated libheif1 from version 1.17.6-1ubuntu4.4 to 1.17.6-1ubuntu4.5
  • Updated libidn12 from version 1.42-1build1 to 1.42-1ubuntu0.1
  • Updated libncurses6 from version 6.4+20240113-1ubuntu2 to 6.4+20240113-1ubuntu2.1
  • Updated libncursesw6 from version 6.4+20240113-1ubuntu2 to 6.4+20240113-1ubuntu2.1
  • Updated libnghttp2-14 from version 1.59.0-1ubuntu0.3 to 1.59.0-1ubuntu0.4
  • Updated libraw23t64 from version 0.21.2-2.1ubuntu0.24.04.1 to 0.21.2-2.1ubuntu0.24.04.2
  • Updated libtinfo6 from version 6.4+20240113-1ubuntu2 to 6.4+20240113-1ubuntu2.1
  • Updated ncurses-base from version 6.4+20240113-1ubuntu2 to 6.4+20240113-1ubuntu2.1
  • Updated ncurses-bin from version 6.4+20240113-1ubuntu2 to 6.4+20240113-1ubuntu2.1
  • Updated socat from version 1.8.0.0-4build3 to 1.8.0.0-4ubuntu0.1
  • Updated tar from version 1.35+dfsg-3ubuntu0.1 to 1.35+dfsg-3ubuntu0.2
  • Updated tzdata from version 2026a-0ubuntu0.24.04.1 to 2026b-0ubuntu0.24.04.1

Updates to packages available at build time only

  • Updated libcurl4-openssl-dev from version 8.5.0-2ubuntu10.9 to 8.5.0-2ubuntu10.11
  • Updated libheif-dev from version 1.17.6-1ubuntu4.4 to 1.17.6-1ubuntu4.5
  • Updated libidn-dev from version 1.42-1build1 to 1.42-1ubuntu0.1
  • Updated libpython3.12-minimal from version 3.12.3-1ubuntu0.13 to 3.12.3-1ubuntu0.15
  • Updated libpython3.12-stdlib from version 3.12.3-1ubuntu0.13 to 3.12.3-1ubuntu0.15
  • Updated linux-libc-dev from version 6.8.0-124.124 to 6.8.0-134.134
  • Updated python3.12 from version 3.12.3-1ubuntu0.13 to 3.12.3-1ubuntu0.15
  • Updated python3.12-minimal from version 3.12.3-1ubuntu0.13 to 3.12.3-1ubuntu0.15

Stack: heroku-26

  • Updated curl from version 8.18.0-1ubuntu2.1 to 8.18.0-1ubuntu2.3
  • Updated gzip from version 1.14-1~exp2ubuntu1 to 1.14-1~exp2ubuntu1.1
  • Updated iproute2 from version 6.19.0-1ubuntu1 to 6.19.0-1ubuntu1.1
  • Updated libcurl3t64-gnutls from version 8.18.0-1ubuntu2.1 to 8.18.0-1ubuntu2.3
  • Updated libcurl4t64 from version 8.18.0-1ubuntu2.1 to 8.18.0-1ubuntu2.3
  • Updated libgcrypt20 from version 1.12.0-2ubuntu0.1 to 1.12.0-2ubuntu1
  • Updated libheif-plugin-aomdec from version 1.21.2-3ubuntu0.2 to 1.21.2-3ubuntu0.3
  • Updated libheif1 from version 1.21.2-3ubuntu0.2 to 1.21.2-3ubuntu0.3
  • Updated libidn12 from version 1.43-2build1 to 1.43-2ubuntu0.26.04.1
  • Updated libnghttp2-14 from version 1.68.0-2ubuntu0.1 to 1.68.0-2ubuntu0.2
  • Updated libraw23t64 from version 0.21.5b-1ubuntu1 to 0.21.5b-1ubuntu1.1
  • Updated libssh2-1t64 from version 1.11.1-1ubuntu0.26.04.1 to 1.11.1-1ubuntu0.26.04.2
  • Updated socat from version 1.8.1.1-1 to 1.8.1.1-1ubuntu0.1
  • Updated tar from version 1.35+dfsg-4ubuntu0.1 to 1.35+dfsg-4ubuntu0.2
  • Updated tzdata from version 2026a-3ubuntu1 to 2026b-0ubuntu0.26.04.1

Updates to packages available at build time only

  • Updated libcurl4-openssl-dev from version 8.18.0-1ubuntu2.1 to 8.18.0-1ubuntu2.3
  • Updated libheif-dev from version 1.21.2-3ubuntu0.2 to 1.21.2-3ubuntu0.3
  • Updated libidn-dev from version 1.43-2build1 to 1.43-2ubuntu0.26.04.1
  • Updated libnghttp2-dev from version 1.68.0-2ubuntu0.1 to 1.68.0-2ubuntu0.2
  • Updated libpython3.14-minimal from version 3.14.4-1 to 3.14.4-1ubuntu0.1
  • Updated libpython3.14-stdlib from version 3.14.4-1 to 3.14.4-1ubuntu0.1
  • Updated libssh2-1-dev from version 1.11.1-1ubuntu0.26.04.1 to 1.11.1-1ubuntu0.26.04.2
  • Updated python3.14 from version 3.14.4-1 to 3.14.4-1ubuntu0.1
  • Updated python3.14-minimal from version 3.14.4-1 to 3.14.4-1ubuntu0.1