chore(deps): update containerd (9.4)

[elastic-renovate-prod]

This PR contains the following updates:

Package	Type	Update	Change
github.com/containerd/containerd	indirect	patch	v1.7.30 -> v1.7.31
github.com/containerd/containerd/api	indirect	minor	v1.10.0 -> v1.11.0
github.com/containerd/containerd/v2	indirect	minor	v2.2.3 -> v2.3.0
github.com/containerd/continuity	indirect	minor	v0.4.5 -> v0.5.0
github.com/containerd/plugin	indirect	minor	v1.0.0 -> v1.1.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

containerd/containerd (github.com/containerd/containerd)

v1.7.31: containerd 1.7.31

Compare Source

Welcome to the v1.7.31 release of containerd!

The thirty-first patch release for containerd 1.7 contains various fixes
and updates including a security patch.

Security Updates

• spdystream
  • CVE-2026-35469

Highlights

Container Runtime Interface (CRI)

• Fix CNI issue where DEL is never executed after a restart (#​12931)
• Sanitize error before gRPC return to prevent possible credential leak in pod events (#​12805)
• Improve error message and add warning when concurrent container creation is detected (#​12744)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Maksym Pavlenko
• Akhil Mohan
• Phil Estes
• Sebastiaan van Stijn
• Wei Fu
• Akihiro Suda
• Alex Chernyakhovsky
• Chris Henzie
• Michael Zappa
• Ricardo Branco
• Shachar Tal
• ningmingxiao
• yashsingh74

Changes

37 commits

• Prepare release notes for v1.7.31 (#​13221)
  • 7d2662653 Prepare release notes for v1.7.31
• update github.com/moby/spdystream v0.5.1 (#​13220)
  • 3f795c02a update github.com/moby/spdystream v0.5.1
• update to Go 1.25.9, 1.26.2 (#​13200)
  • 7b1e1b17b update to Go 1.25.9, 1.26.2
  • b673f2d42 update golangci-lint to v2.9.0 with go1.26 support
  • d88d8513a remove windows/arm from cross build
  • a763407b5 Ignore warnings for golangci-lint bump
  • 03dcd8360 ci: bump golangci from 6.5.2 to 7.0.0
• Update github.com/moby/spdystream v0.2.0->v0.5.0 (#​13176)
  • c08711218 Update github.com/moby/spdystream v0.2.0->v0.5.0
• Skip TestExportAndImportMultiLayer on s390x (#​13152)
  • 043548f6d Skip TestExportAndImportMultiLayer on s390x
• update runc binary to v1.3.5 (#​13059)
  • e99bd6050 [release/1.7] update runc binary to v1.3.5
• CODEOWNERS: mark Sam and Chris as owners for 1.7 (#​13069)
  • 3a3103aaf CODEOWNERS: mark Sam and Chris as owners for 1.7
• Fix vagrant on CI (#​13064)
  • 9b4cfa271 Ignore NOCHANGE error
• ci: modprobe xt_comment on almalinux (#​12959)
  • 53e9e73f0 ci: modprobe xt_comment on almalinux
• Fix TOCTOU race bug in tar extraction (#​12970)
  • 61c2733fd Fix TOCTOU race bug in tar extraction
• Fix CNI issue where CNI DEL is never executed (#​12931)
  • f854c1890 fix issue where cni del is never executed
• apparmor: explicitly set abi/3.0 (#​12899)
  • 5c091d92e apparmor: explicitly set abi/3.0
• backport: integration: Fix TestImageLoad() failure on CI (#​12908)
  • 177ac10fe integration: Fix TestImageLoad() failure on CI
• update to go1.24.13, go1.25.7 (#​12873)
  • 56da43d0f update to go1.24.13, go1.25.7
  • 5cb3cb9ba ci: bump go 1.24.12, 1.25.6
• fix: sanitize error before gRPC return to prevent credential leak in pod events (#​12805)
  • b1fa03843 fix: sanitize error before gRPC return to prevent credential leak in pod events
• cri: emit warning for concurrent CreateContainer (#​12744)
  • e2c93a42c cri: emit warning for concurrent CreateContainer

Dependency Changes

• github.com/moby/spdystream v0.2.0 -> v0.5.1

Previous release can be found at v1.7.30

containerd/continuity (github.com/containerd/continuity)

v0.5.0

Compare Source

What's Changed

• Bump CI runner image to macOS 13 by @​austinvazquez in https://github.com/containerd/continuity/pull/264
• Bump golangci-lint to v1.62.0 by @​austinvazquez in https://github.com/containerd/continuity/pull/265
• Enable dependabot updates for GitHub Actions packages by @​austinvazquez in https://github.com/containerd/continuity/pull/263
• build(deps): bump containerd/project-checks from 1.1.0 to 1.2.2 by @​dependabot[bot] inhttps://github.com/containerd/continuity/pull/2666
• build(deps): bump actions/checkout from 3 to 4 by @​dependabot[bot] inhttps://github.com/containerd/continuity/pull/2688
• build(deps): bump actions/setup-go from 3 to 5 by @​dependabot[bot] inhttps://github.com/containerd/continuity/pull/2677
• Update CI to use latest versions by @​dmcgowan in https://github.com/containerd/continuity/pull/279
• build(deps): bump actions/setup-go from 5 to 6 by @​dependabot[bot] inhttps://github.com/containerd/continuity/pull/2711
• build(deps): bump actions/checkout from 4 to 6 by @​dependabot[bot] inhttps://github.com/containerd/continuity/pull/2733
• build(deps): bump github/codeql-action from 3.35.1 to 4.35.1 by @​dependabot[bot] inhttps://github.com/containerd/continuity/pull/2822
• Add native Go ext4 filesystem image creator by @​dmcgowan in https://github.com/containerd/continuity/pull/280
• Linux: Make copyFile sparse aware by @​dcantah in https://github.com/containerd/continuity/pull/276
• build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @​dependabot[bot] inhttps://github.com/containerd/continuity/pull/2833
• Fix error message on group ownership verification by @​eldondev in https://github.com/containerd/continuity/pull/269
• fs: handle ENOTSUP error in compareCapabilities function by @​jellor in https://github.com/containerd/continuity/pull/274

New Contributors

• @​dcantah made their first contribution in https://github.com/containerd/continuity/pull/276
• @​eldondev made their first contribution in https://github.com/containerd/continuity/pull/269
• @​jellor made their first contribution in https://github.com/containerd/continuity/pull/274

Full Changelog: containerd/continuity@v0.4.5...v0.5.0

containerd/plugin (github.com/containerd/plugin)

v1.1.0

Compare Source

What's Changed

• Update github actions by @​dmcgowan in https://github.com/containerd/plugin/pull/9
• Bump actions/checkout from 4 to 6 by @​dependabot[bot] inhttps://github.com/containerd/plugin/pull/111
• Bump actions/setup-go from 5 to 6 by @​dependabot[bot] inhttps://github.com/containerd/plugin/pull/122
• Add benchmark and optimize performance of common functions by @​dmcgowan in https://github.com/containerd/plugin/pull/8
• Bump golangci lint version and minimum go version by @​dmcgowan in https://github.com/containerd/plugin/pull/14
• Update GHA runner versions by @​dmcgowan in https://github.com/containerd/plugin/pull/15
• Update graph logic and add further tests by @​dmcgowan in https://github.com/containerd/plugin/pull/13
• ci: bump golangci-lint to v2.7.2 by @​austinvazquez in https://github.com/containerd/plugin/pull/17
• ci: use Go stable by @​austinvazquez in https://github.com/containerd/plugin/pull/16

Full Changelog: containerd/plugin@v1.0.0...v1.1.0

---

Configuration

📅 Schedule: Branch creation - "* 1 * * 1-5" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[olegsu]

@renovatebot rebase

[elastic-renovate-prod]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 3 additional dependencies were updated

Details:

Package	Change
github.com/Microsoft/go-winio	v0.6.2 -> v0.6.3-0.20251027160822-ad3df93bed29
github.com/Microsoft/hcsshim	v0.14.1 -> v0.15.0-rc.1
k8s.io/utils	v0.0.0-20260210185600-b8788abfbbc2 -> v0.0.0-20260319190234-28399d86e0b5