containerd-app (2.2.1-0ubuntu1~24.04.3) noble-security; urgency=high

  * SECURITY UPDATE: HTTP/2 SETTINGS frame infinite loop (vendored
    golang.org/x/net)
    - debian/patches/CVE-2026-33814.patch: move s.Valid() check before
      switch in ForeachSetting callback
    - CVE-2026-33814
  * SECURITY UPDATE: Uncontrolled Resource Consumption via unbounded
    group parsing
    - debian/patches/CVE-2026-47262.patch: bound user-database file
      reads in openUserFile, reject non-regular files
    - CVE-2026-47262
  * SECURITY UPDATE: Insufficient Verification of Data Authenticity in
    CRI checkpoint import
    - debian/patches/CVE-2026-50195.patch: remove re-tagging of restored
      checkpoint base images
    - CVE-2026-50195
  * SECURITY UPDATE: Reserved label propagation from image configs
    - debian/patches/CVE-2026-53488.patch: filter containerd.io/ and
      io.cri-containerd labels from image config
    - CVE-2026-53488
  * SECURITY UPDATE: UNIX Symbolic Link Following in CRI checkpoint
    restore
    - debian/patches/CVE-2026-53489.patch: add copyNoFollow,
      checkpointArchiveEntryAllowed, assertCheckpointDirSafe; use
      dedicated restore subdirectory
    - CVE-2026-53489
  * SECURITY UPDATE: Improper Input Validation of CDI annotations in
    checkpoint restore
    - debian/patches/CVE-2026-53492.patch: filter cdi.k8s.io
      annotations on checkpoint restore
    - CVE-2026-53492

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Mon, 22 Jun 2026 18:09:32 +0200

containerd-app (2.2.1-0ubuntu1~24.04.2) noble; urgency=medium

  * d/t/basic-smoke: use systemctl to start the service (LP: #2118738)

 -- Athos Ribeiro <athos@ubuntu.com>  Tue, 31 Mar 2026 10:12:37 -0300

containerd-app (2.2.1-0ubuntu1~24.04.1) noble; urgency=medium

  * New upstream version 2.2.1 (LP: #2127661)
  * d/containerd.docs: update notice file
  * d/copyright: update copyright data
  * d/rules: fix path of containerd commands
  * d/p/0001-Skip-test-failing-on-riscv64.patch: refresh patch
  * d/p/0002-Skip-tests-*-privileg.patch: refresh patch

 -- Athos Ribeiro <athos@ubuntu.com>  Wed, 25 Feb 2026 08:33:14 -0300

containerd-app (1.7.30-0ubuntu1~24.04.1) noble; urgency=medium

  * New upstream version 1.7.30
  * d/p/0001-Skip-test-failing-on-riscv64.patch: refresh patch
  * d/p/CVE-2024-25621.patch: drop patch applied upstream
  * d/p/CVE-2025-64329.patch: drop patch applied upstream
  * d/control: build with golang 1.24
  * d/rules: add golang 1.24 to PATH
  * d/copyright: update copyright data

 -- Athos Ribeiro <athos@ubuntu.com>  Fri, 20 Feb 2026 18:01:16 -0300

containerd-app (1.7.28-0ubuntu1~24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: local priv escalation vulnerability
    - debian/patches/CVE-2024-25621.patch: Fix directory permissions
    - CVE-2024-25621
  * SECURITY UPDATE: denial of service
    - debian/patches/CVE-2025-64329.patch: fix goroutine leak of container
      attach
    - CVE-2025-64329

 -- Nishit Majithia <nishit.majithia@canonical.com>  Wed, 28 Jan 2026 10:37:51 +0530

containerd-app (1.7.28-0ubuntu1~24.04.1) noble; urgency=medium

  * New upstream version 1.7.28 (LP: #2112523)
  * Build with Go 1.23.
    - d/control: b-d on golang-1.23-go instead of golang-1.22-go
    - d/rules: add Go 1.23 to $PATH

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 11 Sep 2025 13:55:37 -0300

containerd-app (1.7.27-0ubuntu1~24.04.1) noble; urgency=medium

  * New upstream version 1.7.27. (LP: #2085187)
  * d/p/CVE-2024-40635.patch: drop patch applied upstream

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 03 Apr 2025 13:12:09 -0300

containerd-app (1.7.24-0ubuntu1~24.04.2) noble-security; urgency=medium

  * SECURITY UPDATE: Integer overflow.
    - debian/patches/CVE-2024-40635.patch: Add maxUserID and maxGroupID with
      limitations in ./oci/spec_opts.go.
    - CVE-2024-40635

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Mon, 24 Mar 2025 14:34:54 -0230

containerd-app (1.7.24-0ubuntu1~24.04.1) noble; urgency=medium

  * Backport version 1.7.19-0ubuntu3 from plucky to noble. (LP: #2040461)
  * New 1.7.24 upstream version. (LP #2089704)
  * d/containerd.postinst: notify that a reboot is required to reload the
    AppArmor profile. (LP #2065423)
  * d/p/{0001-...,0002-...}: restore the version of these patches which
    applies to 1.7.x.
  * d/rules: revert path of containerd commands

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Fri, 11 Oct 2024 16:19:07 -0300

containerd-app (1.7.19-0ubuntu3) plucky; urgency=medium

  * d/copyright: remove orphan entry from copyright. The entry was added back
    in Lunar due to a vendored runc file copyright (cloned_binary.c). That
    file was later removed from runc but the d/copyright entry for it was only
    partially removed. These changes were not documented in d/changelog back
    then.
  * d/control: remove Uploaders field. It makes little to no sense in Ubuntu
    and this is a Ubuntu specific package.

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 18 Nov 2024 21:42:18 -0300

# For older changelog entries, run 'apt-get changelog containerd'
