containerd-app (2.2.1-0ubuntu1~22.04.2) jammy-security; urgency=high

  * SECURITY UPDATE: HTTP/2 SETTINGS frame infinite loop (vendored
    golang.org/x/net)
    - debian/patches/CVE-2026-33814.patch: move s.Valid() check before
      switch in ForeachSetting callback
    - CVE-2026-33814
  * SECURITY UPDATE: Uncontrolled Resource Consumption via unbounded
    group parsing
    - debian/patches/CVE-2026-47262.patch: bound user-database file
      reads in openUserFile, reject non-regular files
    - CVE-2026-47262
  * SECURITY UPDATE: Insufficient Verification of Data Authenticity in
    CRI checkpoint import
    - debian/patches/CVE-2026-50195.patch: remove re-tagging of restored
      checkpoint base images
    - CVE-2026-50195
  * SECURITY UPDATE: Reserved label propagation from image configs
    - debian/patches/CVE-2026-53488.patch: filter containerd.io/ and
      io.cri-containerd labels from image config
    - CVE-2026-53488
  * SECURITY UPDATE: UNIX Symbolic Link Following in CRI checkpoint
    restore
    - debian/patches/CVE-2026-53489.patch: add copyNoFollow,
      checkpointArchiveEntryAllowed, assertCheckpointDirSafe; use
      dedicated restore subdirectory
    - CVE-2026-53489
  * SECURITY UPDATE: Improper Input Validation of CDI annotations in
    checkpoint restore
    - debian/patches/CVE-2026-53492.patch: filter cdi.k8s.io
      annotations on checkpoint restore
    - CVE-2026-53492

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Mon, 22 Jun 2026 18:09:30 +0200

containerd-app (2.2.1-0ubuntu1~22.04.1) jammy; urgency=medium

  * New upstream version 2.2.1 (LP: #2127661)
  * d/containerd.docs: update notice file
  * d/copyright: update copyright data
  * d/rules: fix path of containerd commands
  * d/p/0001-Skip-test-failing-on-riscv64.patch: refresh patch
  * d/p/0002-Skip-tests-*-privileg.patch: refresh patch

 -- Athos Ribeiro <athos@ubuntu.com>  Wed, 25 Feb 2026 08:55:18 -0300

containerd-app (1.7.30-0ubuntu1~22.04.1) jammy; urgency=medium

  * New upstream version 1.7.30
  * d/p/0001-Skip-test-failing-on-riscv64.patch: refresh patch
  * d/control: build with golang 1.24
  * d/rules: add golang 1.24 to PATH
  * d/copyright: update copyright data

 -- Athos Ribeiro <athos@ubuntu.com>  Tue, 24 Feb 2026 17:56:02 -0300

containerd-app (1.7.28-0ubuntu1~22.04.1) jammy; urgency=medium

  * New upstream version 1.7.28 (LP: #2112523)
  * Build with Go 1.23.
    - d/control: b-d on golang-1.23-go instead of golang-1.22-go
    - d/rules: add Go 1.23 to $PATH

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 11 Sep 2025 13:59:47 -0300

containerd-app (1.7.27-0ubuntu1~22.04.1) jammy; urgency=medium

  * New upstream version 1.7.27. (LP: #2085187)
  * d/p/CVE-2024-40635.patch: drop patch applied upstream

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 03 Apr 2025 13:13:56 -0300

containerd-app (1.7.24-0ubuntu1~22.04.2) jammy-security; urgency=medium

  * SECURITY UPDATE: Integer overflow.
    - debian/patches/CVE-2024-40635.patch: Add maxUserID and maxGroupID with
      limitations in ./oci/spec_opts.go.
    - CVE-2024-40635

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Mon, 24 Mar 2025 17:51:42 -0230

containerd-app (1.7.24-0ubuntu1~22.04.1) jammy; urgency=medium

  * Backport version 1.7.19-0ubuntu3 from plucky to jammy. (LP: #2040461)
  * New 1.7.24 upstream version. (LP: #2089704)
  * d/rules: fix path of the containerd systemd service file.
  * d/p/{0001-...,0002-...}: restore the version of these patches which
    applies to 1.7.x.
  * d/rules: revert path of containerd commands

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Fri, 11 Oct 2024 16:30:33 -0300

containerd-app (1.7.19-0ubuntu3) plucky; urgency=medium

  * d/copyright: remove orphan entry from copyright. The entry was added back
    in Lunar due to a vendored runc file copyright (cloned_binary.c). That
    file was later removed from runc but the d/copyright entry for it was only
    partially removed. These changes were not documented in d/changelog back
    then.
  * d/control: remove Uploaders field. It makes little to no sense in Ubuntu
    and this is a Ubuntu specific package.

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 18 Nov 2024 21:42:18 -0300

containerd-app (1.7.19-0ubuntu2) plucky; urgency=medium

  * d/p/0002-Skip-tests-which-require-a-certain-level-of-privileg.patch: drop
    bogus entry.
  * d/rules: do not skip pkg/cri/server tests. These were being skipped due to
    a bogus entry in d/patches.

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 31 Oct 2024 13:16:12 -0300

containerd-app (1.7.19-0ubuntu1) oracular; urgency=medium

  * New upstream release.
  * d/t/basic-smoke: set proxy environment variables.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Wed, 03 Jul 2024 18:52:03 -0300

# For older changelog entries, run 'apt-get changelog containerd'
