chore(deps): update containerd (8.19)

[elastic-renovate-prod]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/containerd/containerd/v2	v2.3.1 → v2.3.3
github.com/containerd/ttrpc	v1.2.8 → v1.2.9

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

containerd/containerd (github.com/containerd/containerd/v2)

v2.3.3: containerd 2.3.3

Compare Source

Welcome to the v2.3.3 release of containerd!

The third patch release for containerd 2.3 contains various fixes and updates.

Highlights

• Set SystemTemp environment variable on Windows so temp directory overrides work for SYSTEM services (#​13694)

Container Runtime Interface (CRI)

• Fix nil pointer dereference in NRI GetIPs during pod sandbox teardown or container exit (#​13697)
• Reject CreateContainer calls when the target sandbox is not running (#​13668)
• Ensure sandbox shutdown on RunPodSandbox hook failures to avoid mount leaks (#​13645)

Image Distribution

• Surface OCI error bodies in registry 403 responses by falling back to GET requests (#​13738)

Snapshotters

• Align default 4K mkfs block size for EROFS across all platforms (#​13632)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Maksym Pavlenko
• Samuel Karp
• Chris Henzie
• Phil Estes
• Sebastiaan van Stijn
• Akihiro Suda
• Austin Vazquez
• Chris Crone
• Derek McGowan
• Maksim An
• crawfordxx
• cshung
• lauralorenz

Changes

14 commits

• Prepare release notes for v2.3.3 (#​13750)
  • 7f6cee02a Prepare release notes for v2.3.3
• CI: migrate Vagrant to Lima (#​13744)
  • 7316210ce CI: migrate Vagrant to Lima
• remotes: surface OCI error body in registry 4xx responses (#​13738)
  • 457fba3a3 remotes: surface OCI error body on HEAD 403 via GET fallback
• Update go to 1.26.5 (#​13732)
  • dc2df934e Update go to 1.26.5
• ci: pin fog-json to resolve gem conflict (#​13711)
  • 5be0495df ci: pin fog-json to resolve gem conflict
• Fix nil pointer dereference in NRI GetIPs (#​13697)
  • 36c713971 Fix nil pointer dereference in NRI GetIPs
• Set SystemTemp env var to config temp on Windows (#​13694)
  • 26dce170d Set SystemTemp env var to config temp on Windows
• update runhcs to v0.15.0-rc.3 (#​13693)
  • 9bc2c2349 update runhcs to v0.15.0-rc.3
• Update to current setup-go version (#​13686)
  • 3e97edeb7 Update to current setup-go version
• cri: reject CreateContainer when sandbox is not running (#​13668)
  • 8856b0f9c cri: reject CreateContainer when sandbox is not running
• update runhcs to v0.15.0-rc.2 (#​13666)
  • ae796cec5 update runhcs to v0.15.0-rc.2
• test: fix flaky image timestamp check on coarse clocks (#​13643)
  • 168d56783 test: fix flaky image timestamp check on coarse clocks
• Add defer in event of mid-function failures in RunPodSandbox to avoid mount leaks (#​13645)
  • d1db61db8 Add deferred call to ShutdownSandbox to avoid leaks
• erofs: align default mkfs block size across platforms (#​13632)
  • 01b0f03f6 erofs: align default mkfs block size across platforms

Dependency Changes

This release has no dependency changes

Previous release can be found at v2.3.2

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

v2.3.2: containerd 2.3.2

Compare Source

Welcome to the v2.3.2 release of containerd!

The second patch release for containerd 2.3 contains various fixes
and updates including security patches.

Security Updates

• containerd
  • CVE-2026-50195
  • CVE-2026-53488
  • CVE-2026-53492
  • CVE-2026-53489
  • CVE-2026-47262

Highlights

• Fix a data race when reading shim logs on Windows (#​13522)

Image Distribution

• Allow the last host to retry on transient network errors (#​13591)

Runtime

• Fix container startup failures caused by concurrent task RPC timeouts during slow container creation (#​13512)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Chris Henzie
• Akihiro Suda
• Derek McGowan
• Akhil Mohan
• Austin Vazquez
• Ben Cressey
• Brian Goff
• Maksym Pavlenko
• Sebastiaan van Stijn
• Sergey Kanzhelev

Changes

30 commits

• Prepare release notes for v2.3.2 (#​13627)
  • fb8ca00b0 Prepare release notes for v2.3.2
  • 9c69960ba Merge commit from fork
  • 0f6251520 Merge commit from fork
  • 91d7471e2 cri: filter CDI annotations on checkpoint restore
  • 7c2e086bf Merge commit from fork
  • dae67765f cri: do not re-tag restored checkpoints
  • 94aa1e2c1 Merge commit from fork
  • 09599078f cri: make checkpoint restore robust to unexpected archive content
  • e1fdb8d22 Merge commit from fork
  • ff1d116ef Bound user-database file reads in openUserFile
  • d156e07cb Merge commit from fork
  • f99aad54a Do not propagate reserved labels from image configs
• vendor: golang.org/x/crypto v0.53.0 (#​13608)
  • 0b9469501 [release/2.3] vendor: golang.org/x/crypto v0.53.0
• resolver: retry on transient network errors (#​13591)
  • 983bbddc1 resolver: retry on transient network errors
• update runc binary to v1.4.3 (#​13601)
  • 3f76f2dc1 update runc binary to v1.4.3
• update go to 1.26.4 (#​13580)
  • 8a49dfe85 update go to 1.26.4
  • 5aa6bb2b7 remove 1.26.2 from CI builds as it is not supported any longer due to the dependency
• Configure udevd children-max for root-test (#​13568)
  • bfb8aebc0 Configure udevd children-max for root-test
• core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read (#​13522)
  • 62ceafff0 core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read
• runc-shim: don't hold the service lock across runc create (#​13512)
  • 9b0c0dc58 runc-shim: don't hold the service lock across runc create
• contrib/checkpoint: increase timeouts to 30s (#​13459)
  • f588bc6fb contrib/checkpoint: increase timeouts to 30s

Dependency Changes

• golang.org/x/crypto v0.49.0 -> v0.53.0
• golang.org/x/mod v0.35.0 -> v0.36.0
• golang.org/x/net v0.52.0 -> v0.55.0
• golang.org/x/sync v0.20.0 -> v0.21.0
• golang.org/x/sys v0.43.0 -> v0.46.0
• golang.org/x/term v0.41.0 -> v0.44.0
• golang.org/x/text v0.35.0 -> v0.38.0

Previous release can be found at v2.3.1

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

containerd/ttrpc (github.com/containerd/ttrpc)

v1.2.9

Compare Source

What's Changed

• Migrate from protobuild to buf by @​kzys in #​226
• build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 by @​dependabot[bot] in #​228
• Fix proto generation by @​dmcgowan in #​232
• Set buf version from file and match dev version by @​dmcgowan in #​233
• server: cancel per-stream context when handler returns by @​eginez in #​231
• Fix deadlock when stream is not consumed by @​dmcgowan in #​229
• Remove gogo vanity command and gogo dependency by @​liggitt in #​239
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​240
• build(deps): bump golangci/golangci-lint-action from 9.2.0 to 9.2.1 by @​dependabot[bot] in #​238
• build(deps): bump google.golang.org/grpc from 1.69.2 to 1.81.1 by @​dependabot[bot] in #​237
• build(deps): bump golang.org/x/sys from 0.42.0 to 0.46.0 in the golang-x group across 1 directory by @​dependabot[bot] in #​215

New Contributors

• @​eginez made their first contribution in #​231

Full Changelog: containerd/ttrpc@v1.2.8...v1.2.9

---

Configuration

📅 Schedule: Branch creation - Between 01:00 AM and 01:59 AM, Monday through Friday ( * 1 * * 1-5 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/8.19-containerd upstream/renovate/8.19-containerd
git merge upstream/8.19
git push upstream renovate/8.19-containerd

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/8.19-containerd upstream/renovate/8.19-containerd
git merge upstream/8.19
git push upstream renovate/8.19-containerd

[mergify]

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b renovate/8.19-containerd upstream/renovate/8.19-containerd
git merge upstream/8.19
git push upstream renovate/8.19-containerd

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request