containerd-app (2.2.1-0ubuntu1~24.04.3) noble-security; urgency=high

  * SECURITY UPDATE: HTTP/2 SETTINGS frame infinite loop (vendored
    golang.org/x/net)
    - debian/patches/CVE-2026-33814.patch: move s.Valid() check before
      switch in ForeachSetting callback
    - CVE-2026-33814
  * SECURITY UPDATE: Uncontrolled Resource Consumption via unbounded
    group parsing
    - debian/patches/CVE-2026-47262.patch: bound user-database file
      reads in openUserFile, reject non-regular files
    - CVE-2026-47262
  * SECURITY UPDATE: Insufficient Verification of Data Authenticity in
    CRI checkpoint import
    - debian/patches/CVE-2026-50195.patch: remove re-tagging of restored
      checkpoint base images
    - CVE-2026-50195
  * SECURITY UPDATE: Reserved label propagation from image configs
    - debian/patches/CVE-2026-53488.patch: filter containerd.io/ and
      io.cri-containerd labels from image config
    - CVE-2026-53488
  * SECURITY UPDATE: UNIX Symbolic Link Following in CRI checkpoint
    restore
    - debian/patches/CVE-2026-53489.patch: add copyNoFollow,
      checkpointArchiveEntryAllowed, assertCheckpointDirSafe; use
      dedicated restore subdirectory
    - CVE-2026-53489
  * SECURITY UPDATE: Improper Input Validation of CDI annotations in
    checkpoint restore
    - debian/patches/CVE-2026-53492.patch: filter cdi.k8s.io
      annotations on checkpoint restore
    - CVE-2026-53492

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Mon, 22 Jun 2026 18:09:32 +0200

containerd-app (2.2.1-0ubuntu1~24.04.2) noble; urgency=medium

  * d/t/basic-smoke: use systemctl to start the service (LP: #2118738)

 -- Athos Ribeiro <athos@ubuntu.com>  Tue, 31 Mar 2026 10:12:37 -0300

containerd-app (2.2.1-0ubuntu1~24.04.1) noble; urgency=medium

  * New upstream version 2.2.1 (LP: #2127661)
  * d/containerd.docs: update notice file
  * d/copyright: update copyright data
  * d/rules: fix path of containerd commands
  * d/p/0001-Skip-test-failing-on-riscv64.patch: refresh patch
  * d/p/0002-Skip-tests-*-privileg.patch: refresh patch

 -- Athos Ribeiro <athos@ubuntu.com>  Wed, 25 Feb 2026 08:33:14 -0300

containerd-app (1.7.30-0ubuntu1~24.04.1) noble; urgency=medium

  * New upstream version 1.7.30
  * d/p/0001-Skip-test-failing-on-riscv64.patch: refresh patch
  * d/p/CVE-2024-25621.patch: drop patch applied upstream
  * d/p/CVE-2025-64329.patch: drop patch applied upstream
  * d/control: build with golang 1.24
  * d/rules: add golang 1.24 to PATH
  * d/copyright: update copyright data

 -- Athos Ribeiro <athos@ubuntu.com>  Fri, 20 Feb 2026 18:01:16 -0300

containerd-app (1.7.28-0ubuntu1~24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: local priv escalation vulnerability
    - debian/patches/CVE-2024-25621.patch: Fix directory permissions
    - CVE-2024-25621
  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2025-64329.patch: fix goroutine leak of container
      attach
    - CVE-2025-64329

 -- Nishit Majithia <nishit.majithia@canonical.com>  Wed, 28 Jan 2026 10:37:51 +0530

containerd-app (1.7.28-0ubuntu1~24.04.1) noble; urgency=medium

  * New upstream version 1.7.28 (LP: #2112523)
  * Build with Go 1.23.
    - d/control: b-d on golang-1.23-go instead of golang-1.22-go
    - d/rules: add Go 1.23 to $PATH

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 11 Sep 2025 13:55:37 -0300

containerd-app (1.7.27-0ubuntu1~24.04.1) noble; urgency=medium

  * New upstream version 1.7.27. (LP: #2085187)
  * d/p/CVE-2024-40635.patch: drop patch applied upstream

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 03 Apr 2025 13:12:09 -0300

containerd-app (1.7.24-0ubuntu1~24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: Integer overflow.
    - debian/patches/CVE-2024-40635.patch: Add maxUserID and maxGroupID with
      limitations in ./oci/spec_opts.go.
    - CVE-2024-40635

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Mon, 24 Mar 2025 14:34:54 -0230

containerd-app (1.7.24-0ubuntu1~24.04.1) noble; urgency=medium

  * Backport version 1.7.19-0ubuntu3 from plucky to noble. (LP: #2040461)
  * New 1.7.24 upstream version. (LP #2089704)
  * d/containerd.postinst: notify that a reboot is required to reload the
    AppArmor profile. (LP #2065423)
  * d/p/{0001-...,0002-...}: restore the version of these patches which
    applies to 1.7.x.
  * d/rules: revert path of containerd commands

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Fri, 11 Oct 2024 16:19:07 -0300

containerd-app (1.7.19-0ubuntu3) plucky; urgency=medium

  * d/copyright: remove orphan entry from copyright. The entry was added back
    in Lunar due to a vendored runc file copyright (cloned_binary.c). That
    file was later removed from runc but the d/copyright entry for it was only
    partially removed. These changes were not documented in d/changelog back
    then.
  * d/control: remove Uploaders field. It makes little to no sense in Ubuntu
    and this is a Ubuntu specific package.

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 18 Nov 2024 21:42:18 -0300

containerd-app (1.7.19-0ubuntu2) plucky; urgency=medium

  * d/p/0002-Skip-tests-which-require-a-certain-level-of-privileg.patch: drop
    bogus entry.
  * d/rules: do not skip pkg/cri/server tests. These were being skipped due to
    a bogus entry in d/patches.

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 31 Oct 2024 13:16:12 -0300

containerd-app (1.7.19-0ubuntu1) oracular; urgency=medium

  * New upstream release.
  * d/t/basic-smoke: set proxy environment variables.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Wed, 03 Jul 2024 18:52:03 -0300

containerd-app (1.7.17-0ubuntu1) oracular; urgency=medium

  * New upstream release.
    - Update AppArmor template to allow confined runc to kill containers
      (LP: #2065423).
  * Refresh patches.
    - d/p/{0006-Skip-test-setting-OOM-score-to-negative-number-in-un,
      0007-seccomp-apparmor-add-go-noinline}.patch: removed, applied by
      upstream.
  * d/rules: skip cri server tests.
  * d/rules: fix path of containerd commands.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Tue, 04 Jun 2024 17:24:22 -0300

containerd-app (1.7.12-0ubuntu4) noble; urgency=medium

  * Build with Go 1.22.
    - d/control: b-d on golang-1.22-go instead of golang-1.21-go
    - d/rules: add Go 1.22 to $PATH

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Wed, 17 Apr 2024 17:01:35 -0300

containerd-app (1.7.12-0ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- William Grant <wgrant@ubuntu.com>  Mon, 01 Apr 2024 16:39:10 +1100

containerd-app (1.7.12-0ubuntu2) noble; urgency=medium

  * Build with Go 1.21 (LP: #2056154)
    - d/control: b-d on golang-1.21-go instead of golang-1.20-go
    - d/rules: add Go 1.21 to $PATH

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Tue, 12 Mar 2024 11:46:44 -0300

containerd-app (1.7.12-0ubuntu1) noble; urgency=medium

  * New upstream release.
  * Build with Go 1.20.
  * d/p/0002-Skip-tests-which-require-a-certain-level-of-privileg.patch:
    refresh.
  * d/containerd.docs: remove NOTICE from vendored runc.
  * d/rules: fix path of the containerd systemd service file.
  * d/rules: do no pass removed commands to dh_golang before dh_gencontrol.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Mon, 15 Jan 2024 18:39:58 -0300

containerd-app (1.7.2-0ubuntu2) mantic; urgency=medium

  * Drop patches for -dev packages
    + 0004-disable-windows-support-in-ctr-metric.patch
    + 0005-Revert-Use-insecure.NewCredentials-instead-of-grpc.W.patch
  * Backport patch for Go1.21 (LP: #2032754)
    + 0007-seccomp-apparmor-add-go-noinline.patch

 -- Shengjing Zhu <shengjing.zhu@canonical.com>  Wed, 23 Aug 2023 15:04:29 +0800

containerd-app (1.7.2-0ubuntu1) mantic; urgency=medium

  * Initial release. See LP #2022390.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Tue, 20 Jun 2023 16:20:38 -0300
