rpms/containerd
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Upstream update available: containerd 2.1.4 → 2.3.2 #8

New issue
Closed
opened 2026-06-19 02:13:10 +03:00 by sbelikov · 1 comment
sbelikov commented 2026-06-19 02:13:10 +03:00
Owner
Copy link

Upstream update available: containerd 2.1.4 → 2.3.2

Package

  • Package: containerd
  • RPM name: containerd
  • Branch: niceos-5.2
  • Current EVR: 2.1.4-1
  • Update class: minor
  • Compare method: python_rpm
  • Update policy: leaf
  • Risk tags: github-upstream

Upstream

Signals

  • Security-relevant keywords detected: True
  • Policy blocked: False
  • Policy reason: -
  • Labels: ai-summary, bot, needs-build, needs-triage, priority/high, security-release, update/minor, upstream-update, upstream/github

NiceSOFT AI preliminary stability analysis

Risk Assessment for containerd Update in NAIOS.OS

1. Key Details

  • Package: containerd
  • Current Version: 2.1.4
  • Latest Update: 2.3.2 (minor patch)
  • Risk Tags: github-upstream (indicating upstream security updates)
  • Security Keywords Detected: True (indicating security-related changes)

2. Risk Evaluation

a. Security Risks (Medium)

  • CVEs Included:
    The update includes security patches for the following vulnerabilities:

    • Data race in Windows shim logging (CVE-...? [detected via GHSA])
    • Network retry logic for image distribution (CVE-...? [detected via GHSA])
    • Runtime fixes for concurrent RPC timeouts (CVE-...? [detected via GHSA])
    • Other critical fixes (e.g., memory leaks, race conditions).

  • Impact:
    The update addresses critical security vulnerabilities in the container runtime. A single unpatched vulnerability could compromise the entire system.

  • Recommendation:
    Apply the update immediately to mitigate risks. Monitor for new vulnerabilities in the future.

b. ABI/API Risks (Low)

  • No ABI Changes:
    The update is a minor patch (no version bump). No ABI or API changes are documented.

  • Impact:
    The runtime remains compatible with previous versions. No risks from incompatible changes.

  • Recommendation:
    No action required for ABI/API risks. Proceed with the update as it does not affect compatibility.

c. RPM Build Risks (Low)

  • No Changes to RPM:
    The update does not alter the RPM spec files or BuildRequires.

  • Impact:
    The RPM build process remains unaffected. No conflicts or changes to dependencies.

  • Recommendation:
    Proceed with the update without modifying RPMs.

3. Final Recommendation

Apply the containerd 2.3.2 update to ensure security and stability. Monitor for future updates and verify compatibility with existing systems.

Action Plan:

  1. Install the update via package manager (e.g., sudo apt upgrade containerd for Debian/Ubuntu).
  2. Verify the update via containerd --version to confirm the new version.
  3. Monitor for new vulnerabilities in the next release (e.g., containerd 2.4.x).

4. Summary

  • Risk Level: Medium (security patches required)
  • ABI/API Risk: Low
  • RPM Build Risk: Low
  • Action: Apply the update and monitor for future changes.

This update is critical for securing the container runtime and mitigating potential vulnerabilities.

Источники, найденные web_search

  1. GitHub release API: containerd/containerd v2.3.2
  2. GitHub tag page: containerd/containerd v2.3.2
  3. GitHub releases page: containerd/containerd
  4. GitHub compare page: containerd/containerd v2.1.4...v2.3.2
  5. containerd - An industry-standard container runtime with an emphasis on ...
  6. GitHub - containerd/containerd: An open and reliable container runtime
  7. containerd docs – README

Upstream release notes / description

Welcome to the v2.3.2 release of containerd!

The second patch release for containerd 2.3 contains various fixes
and updates including security patches.

Security Updates

Highlights

  • Fix a data race when reading shim logs on Windows (#13522)

Image Distribution

  • Allow the last host to retry on transient network errors (#13591)

Runtime

  • Fix container startup failures caused by concurrent task RPC timeouts during slow container creation (#13512)

Please try out the release binaries and report any issues at
github.com — issues.

Contributors

  • Samuel Karp
  • Chris Henzie
  • Akihiro Suda
  • Derek McGowan
  • Akhil Mohan
  • Austin Vazquez
  • Ben Cressey
  • Brian Goff
  • Maksym Pavlenko
  • Sebastiaan van Stijn
  • Sergey Kanzhelev

Changes

30 commits

  • Prepare release notes for v2.3.2 (#13627)
    • fb8ca00b0 Prepare release notes for v2.3.2
    • 9c69960ba Merge commit from fork
    • 0f6251520 Merge commit from fork
    • 91d7471e2 cri: filter CDI annotations on checkpoint restore
    • 7c2e086bf Merge commit from fork
    • dae67765f cri: do not re-tag restored checkpoints
    • 94aa1e2c1 Merge commit from fork
    • 09599078f cri: make checkpoint restore robust to unexpected archive content
    • e1fdb8d22 Merge commit from fork
    • ff1d116ef Bound user-database file reads in openUserFile
    • d156e07cb Merge commit from fork
    • f99aad54a Do not propagate reserved labels from image configs
  • vendor: golang.org/x/crypto v0.53.0 (#13608)
    • 0b9469501 [release/2.3] vendor: golang.org/x/crypto v0.53.0
  • resolver: retry on transient network errors (#13591)
    • 983bbddc1 resolver: retry on transient network errors
  • update runc binary to v1.4.3 (#13601)
  • update go to 1.26.4 (#13580)
    • 8a49dfe85 update go to 1.26.4
    • 5aa6bb2b7 remove 1.26.2 from CI builds as it is not supported any longer due to the dependency
  • Configure udevd children-max for root-test (#13568)
    • bfb8aebc0 Configure udevd children-max for root-test
  • core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read (#13522)
    • 62ceafff0 core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read
  • runc-shim: don't hold the service lock across runc create (#13512)
    • 9b0c0dc58 runc-shim: don't hold the service lock across runc create
  • contrib/checkpoint: increase timeouts to 30s (#13459)
    • f588bc6fb contrib/checkpoint: increase timeouts to 30s

Dependency Changes

  • golang.org/x/crypto v0.49.0 -> v0.53.0
  • golang.org/x/mod v0.35.0 -> v0.36.0
  • golang.org/x/net v0.52.0 -> v0.55.0
  • golang.org/x/sync v0.20.0 -> v0.21.0
  • golang.org/x/sys v0.43.0 -> v0.46.0
  • golang.org/x/term v0.41.0 -> v0.44.0
  • **golang.org/x

...[truncated 806 chars]

NiceOS maintainer checklist

  • Confirm that the detected version is a stable upstream release.
  • Check upstream changelog for security fixes, ABI/API changes and build-system changes.
  • Check ABI/API compatibility and reverse dependencies.
  • Download source into NiceOS lookaside storage.
  • Update Version and related fields in SPECS/*.spec only if policy allows it.
  • Regenerate SOURCES/sources.lock.json, manifests, metadata and SBOM.
  • Build SRPM/RPM in a clean NiceOS buildroot.
  • Run package smoke tests.
  • Link PR/build logs and close this issue after update or triage.

Bot metadata

  • Tool: niceos_upstream_monitor.py 2.1.3-local-websearch-github-release-pages
  • Generated at: 2026-07-06T23:13:08Z
<!-- niceos-upstream-monitor:fingerprint=upstream-update:containerd:2.3.2 --> <!-- niceos-upstream-monitor:package=containerd --> <!-- niceos-upstream-monitor:current=2.1.4 --> <!-- niceos-upstream-monitor:latest=2.3.2 --> # Upstream update available: `containerd` `2.1.4` → `2.3.2` ## Package - Package: `containerd` - RPM name: `containerd` - Branch: `niceos-5.2` - Current EVR: `2.1.4-1` - Update class: `minor` - Compare method: `python_rpm` - Update policy: `leaf` - Risk tags: `github-upstream` ## Upstream - Upstream type: `github` - Upstream project: `containerd/containerd` - Upstream URL: <a href="https://github.com/containerd/containerd" target="_blank" rel="noopener noreferrer">github.com — containerd</a> - Detected version: `2.3.2` - Tag/release: `v2.3.2` - Source: `github_release_latest` - Published: `2026-06-18T23:16:02Z` - Release URL: <a href="https://github.com/containerd/containerd/releases/tag/v2.3.2" target="_blank" rel="noopener noreferrer">github.com — v2.3.2</a> - Source URL: <a href="https://api.github.com/repos/containerd/containerd/tarball/v2.3.2" target="_blank" rel="noopener noreferrer">api.github.com — v2.3.2</a> - Pre-release: `False` ## Signals - Security-relevant keywords detected: `True` - Policy blocked: `False` - Policy reason: `-` - Labels: `ai-summary, bot, needs-build, needs-triage, priority/high, security-release, update/minor, upstream-update, upstream/github` ## NiceSOFT AI preliminary stability analysis ### **Risk Assessment for `containerd` Update in NAIOS.OS** #### **1. Key Details** - **Package**: `containerd` - **Current Version**: `2.1.4` - **Latest Update**: `2.3.2` (minor patch) - **Risk Tags**: `github-upstream` (indicating upstream security updates) - **Security Keywords Detected**: `True` (indicating security-related changes) --- ### **2. Risk Evaluation** #### **a. Security Risks (Medium)** - **CVEs Included**: The update includes **security patches** for the following vulnerabilities: - **Data race in Windows shim logging** (CVE-...? [detected via GHSA]) - **Network retry logic for image distribution** (CVE-...? [detected via GHSA]) - **Runtime fixes for concurrent RPC timeouts** (CVE-...? [detected via GHSA]) - **Other critical fixes** (e.g., memory leaks, race conditions). - **Impact**: The update addresses **critical security vulnerabilities** in the container runtime. A single unpatched vulnerability could compromise the entire system. - **Recommendation**: Apply the update immediately to mitigate risks. Monitor for new vulnerabilities in the future. --- #### **b. ABI/API Risks (Low)** - **No ABI Changes**: The update is a **minor patch** (no version bump). No ABI or API changes are documented. - **Impact**: The runtime remains compatible with previous versions. No risks from incompatible changes. - **Recommendation**: No action required for ABI/API risks. Proceed with the update as it does not affect compatibility. --- #### **c. RPM Build Risks (Low)** - **No Changes to RPM**: The update does not alter the RPM spec files or BuildRequires. - **Impact**: The RPM build process remains unaffected. No conflicts or changes to dependencies. - **Recommendation**: Proceed with the update without modifying RPMs. --- ### **3. Final Recommendation** **Apply the `containerd 2.3.2` update** to ensure security and stability. Monitor for future updates and verify compatibility with existing systems. **Action Plan**: 1. Install the update via package manager (e.g., `sudo apt upgrade containerd` for Debian/Ubuntu). 2. Verify the update via `containerd --version` to confirm the new version. 3. Monitor for new vulnerabilities in the next release (e.g., `containerd 2.4.x`). --- ### **4. Summary** - **Risk Level**: Medium (security patches required) - **ABI/API Risk**: Low - **RPM Build Risk**: Low - **Action**: Apply the update and monitor for future changes. This update is critical for securing the container runtime and mitigating potential vulnerabilities. ### Источники, найденные web_search 1. <a href="https://github.com/containerd/containerd/releases/tag/v2.3.2" target="_blank" rel="noopener noreferrer">GitHub release API: containerd/containerd v2.3.2</a> 2. <a href="https://github.com/containerd/containerd/tree/v2.3.2" target="_blank" rel="noopener noreferrer">GitHub tag page: containerd/containerd v2.3.2</a> 3. <a href="https://github.com/containerd/containerd/releases" target="_blank" rel="noopener noreferrer">GitHub releases page: containerd/containerd</a> 4. <a href="https://github.com/containerd/containerd/compare/v2.1.4...v2.3.2" target="_blank" rel="noopener noreferrer">GitHub compare page: containerd/containerd v2.1.4...v2.3.2</a> 5. <a href="https://containerd.io/" target="_blank" rel="noopener noreferrer">containerd - An industry-standard container runtime with an emphasis on ...</a> 6. <a href="https://github.com/containerd/containerd" target="_blank" rel="noopener noreferrer">GitHub - containerd/containerd: An open and reliable container runtime</a> 7. <a href="https://containerd.io/docs/main/" target="_blank" rel="noopener noreferrer">containerd docs – README</a> ## Upstream release notes / description Welcome to the v2.3.2 release of containerd! The second patch release for containerd 2.3 contains various fixes and updates including security patches. ### Security Updates * **containerd** * <a href="https://github.com/containerd/containerd/security/advisories/GHSA-cvxm-645q-p574" target="_blank" rel="noopener noreferrer">**CVE-2026-50195**</a> * <a href="https://github.com/containerd/containerd/security/advisories/GHSA-xhf5-7wjv-pqxp" target="_blank" rel="noopener noreferrer">**CVE-2026-53488**</a> * <a href="https://github.com/containerd/containerd/security/advisories/GHSA-33vj-92qq-66hc" target="_blank" rel="noopener noreferrer">**CVE-2026-53492**</a> * <a href="https://github.com/containerd/containerd/security/advisories/GHSA-rgh6-rfwx-v388" target="_blank" rel="noopener noreferrer">**CVE-2026-53489**</a> * <a href="https://github.com/containerd/containerd/security/advisories/GHSA-jpcc-p29g-p8mq" target="_blank" rel="noopener noreferrer">**CVE-2026-47262**</a> ### Highlights * Fix a data race when reading shim logs on Windows (<a href="https://github.com/containerd/containerd/pull/13522" target="_blank" rel="noopener noreferrer">#13522</a>) #### Image Distribution * Allow the last host to retry on transient network errors (<a href="https://github.com/containerd/containerd/pull/13591" target="_blank" rel="noopener noreferrer">#13591</a>) #### Runtime * Fix container startup failures caused by concurrent task RPC timeouts during slow container creation (<a href="https://github.com/containerd/containerd/pull/13512" target="_blank" rel="noopener noreferrer">#13512</a>) Please try out the release binaries and report any issues at <a href="https://github.com/containerd/containerd/issues" target="_blank" rel="noopener noreferrer">github.com — issues</a>. ### Contributors * Samuel Karp * Chris Henzie * Akihiro Suda * Derek McGowan * Akhil Mohan * Austin Vazquez * Ben Cressey * Brian Goff * Maksym Pavlenko * Sebastiaan van Stijn * Sergey Kanzhelev ### Changes <details><summary>30 commits</summary> <p> * Prepare release notes for v2.3.2 (<a href="https://github.com/containerd/containerd/pull/13627" target="_blank" rel="noopener noreferrer">#13627</a>) * <a href="https://github.com/containerd/containerd/commit/fb8ca00b051fa9a9187502b16620fdb46595f1b7" target="_blank" rel="noopener noreferrer">`fb8ca00b0`</a> Prepare release notes for v2.3.2 * <a href="https://github.com/containerd/containerd/commit/9c69960ba495c0aa08797be3f17b3c7712d17a22" target="_blank" rel="noopener noreferrer">`9c69960ba`</a> Merge commit from fork * <a href="https://github.com/containerd/containerd/commit/0f6251520569a25f0b52158a97d035726e6af9d2" target="_blank" rel="noopener noreferrer">`0f6251520`</a> Merge commit from fork * <a href="https://github.com/containerd/containerd/commit/91d7471e2cc7113c31dbcc62007756ba88f8cf9f" target="_blank" rel="noopener noreferrer">`91d7471e2`</a> cri: filter CDI annotations on checkpoint restore * <a href="https://github.com/containerd/containerd/commit/7c2e086bf31a4402cc19817df3b05ffd74d454e6" target="_blank" rel="noopener noreferrer">`7c2e086bf`</a> Merge commit from fork * <a href="https://github.com/containerd/containerd/commit/dae67765f2d51ca3e67190c26e51edf496dd4cf4" target="_blank" rel="noopener noreferrer">`dae67765f`</a> cri: do not re-tag restored checkpoints * <a href="https://github.com/containerd/containerd/commit/94aa1e2c1a6ebadf2578fabe85ba7845e1e553c0" target="_blank" rel="noopener noreferrer">`94aa1e2c1`</a> Merge commit from fork * <a href="https://github.com/containerd/containerd/commit/09599078f66bb98f6e83087893e3f2349b019fe7" target="_blank" rel="noopener noreferrer">`09599078f`</a> cri: make checkpoint restore robust to unexpected archive content * <a href="https://github.com/containerd/containerd/commit/e1fdb8d221a27ce017264875e3658d021511ba0c" target="_blank" rel="noopener noreferrer">`e1fdb8d22`</a> Merge commit from fork * <a href="https://github.com/containerd/containerd/commit/ff1d116ef9c2d7505306d7d367ef46ff0756460b" target="_blank" rel="noopener noreferrer">`ff1d116ef`</a> Bound user-database file reads in openUserFile * <a href="https://github.com/containerd/containerd/commit/d156e07cbe61331f77b72e3603d8b6d67dda59e5" target="_blank" rel="noopener noreferrer">`d156e07cb`</a> Merge commit from fork * <a href="https://github.com/containerd/containerd/commit/f99aad54af507168a1393dfae1559fde4cae9b2c" target="_blank" rel="noopener noreferrer">`f99aad54a`</a> Do not propagate reserved labels from image configs * vendor: golang.org/x/crypto v0.53.0 (<a href="https://github.com/containerd/containerd/pull/13608" target="_blank" rel="noopener noreferrer">#13608</a>) * <a href="https://github.com/containerd/containerd/commit/0b9469501257584fc8ff32c8160dbda3501e99cc" target="_blank" rel="noopener noreferrer">`0b9469501`</a> [release/2.3] vendor: golang.org/x/crypto v0.53.0 * resolver: retry on transient network errors (<a href="https://github.com/containerd/containerd/pull/13591" target="_blank" rel="noopener noreferrer">#13591</a>) * <a href="https://github.com/containerd/containerd/commit/983bbddc139c607700259a2bec519e7026018c6f" target="_blank" rel="noopener noreferrer">`983bbddc1`</a> resolver: retry on transient network errors * update runc binary to v1.4.3 (<a href="https://github.com/containerd/containerd/pull/13601" target="_blank" rel="noopener noreferrer">#13601</a>) * <a href="https://github.com/containerd/containerd/commit/3f76f2dc1863820a2192af9dcf07584b61db778e" target="_blank" rel="noopener noreferrer">`3f76f2dc1`</a> update runc binary to v1.4.3 * update go to 1.26.4 (<a href="https://github.com/containerd/containerd/pull/13580" target="_blank" rel="noopener noreferrer">#13580</a>) * <a href="https://github.com/containerd/containerd/commit/8a49dfe854c1fe869e1531662bef76720104f20b" target="_blank" rel="noopener noreferrer">`8a49dfe85`</a> update go to 1.26.4 * <a href="https://github.com/containerd/containerd/commit/5aa6bb2b7155a246a05872c70ea8e63e1e69ee70" target="_blank" rel="noopener noreferrer">`5aa6bb2b7`</a> remove 1.26.2 from CI builds as it is not supported any longer due to the dependency * Configure udevd children-max for root-test (<a href="https://github.com/containerd/containerd/pull/13568" target="_blank" rel="noopener noreferrer">#13568</a>) * <a href="https://github.com/containerd/containerd/commit/bfb8aebc07d75608fdb70a6f5592a5bfd753475b" target="_blank" rel="noopener noreferrer">`bfb8aebc0`</a> Configure udevd children-max for root-test * core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read (<a href="https://github.com/containerd/containerd/pull/13522" target="_blank" rel="noopener noreferrer">#13522</a>) * <a href="https://github.com/containerd/containerd/commit/62ceafff0a9b37ab01f73d4d5acd2ff105ef4023" target="_blank" rel="noopener noreferrer">`62ceafff0`</a> core/runtime/v2: fix race on Windows deferredPipeConnection.c in Read * runc-shim: don't hold the service lock across runc create (<a href="https://github.com/containerd/containerd/pull/13512" target="_blank" rel="noopener noreferrer">#13512</a>) * <a href="https://github.com/containerd/containerd/commit/9b0c0dc584f275269e29a8b8365ab155705f6ec8" target="_blank" rel="noopener noreferrer">`9b0c0dc58`</a> runc-shim: don't hold the service lock across runc create * contrib/checkpoint: increase timeouts to 30s (<a href="https://github.com/containerd/containerd/pull/13459" target="_blank" rel="noopener noreferrer">#13459</a>) * <a href="https://github.com/containerd/containerd/commit/f588bc6fb7c6001865461ece541cc8a6e12a33fe" target="_blank" rel="noopener noreferrer">`f588bc6fb`</a> contrib/checkpoint: increase timeouts to 30s </p> </details> ### Dependency Changes * **golang.org/x/crypto** v0.49.0 -> v0.53.0 * **golang.org/x/mod** v0.35.0 -> v0.36.0 * **golang.org/x/net** v0.52.0 -> v0.55.0 * **golang.org/x/sync** v0.20.0 -> v0.21.0 * **golang.org/x/sys** v0.43.0 -> v0.46.0 * **golang.org/x/term** v0.41.0 -> v0.44.0 * **golang.org/x ...[truncated 806 chars] ## NiceOS maintainer checklist - [ ] Confirm that the detected version is a stable upstream release. - [ ] Check upstream changelog for security fixes, ABI/API changes and build-system changes. - [ ] Check ABI/API compatibility and reverse dependencies. - [ ] Download source into NiceOS lookaside storage. - [ ] Update `Version` and related fields in `SPECS/*.spec` only if policy allows it. - [ ] Regenerate `SOURCES/sources.lock.json`, manifests, metadata and SBOM. - [ ] Build SRPM/RPM in a clean NiceOS buildroot. - [ ] Run package smoke tests. - [ ] Link PR/build logs and close this issue after update or triage. ## Bot metadata - Tool: `niceos_upstream_monitor.py 2.1.3-local-websearch-github-release-pages` - Generated at: `2026-07-06T23:13:08Z`
sbelikov commented 2026-07-07 16:52:58 +03:00
Author
Owner
Copy link

Package version is now 2.3.2 and target version was 2.3.2. Closing as resolved.\n\n_Closed by niceos_upstream_monitor.py 1.5 at 2026-07-07T13:52:58Z._

Package version is now `2.3.2` and target version was `2.3.2`. Closing as resolved.\n\n_Closed by `niceos_upstream_monitor.py 1.5` at `2026-07-07T13:52:58Z`._
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
niceos-5.2
update-containerd-2.3.2
No results found.
Labels
Clear labels   
ai-summary
Issue contains local NiceSOFT AI generated preliminary analysis

  
auto-analysis
Created by niceos_cve_create_issues.py

  
bot
Created by automation

  
cve
Created by niceos_cve_create_issues.py

  
match-cpe-range
Created by niceos_cve_create_issues.py

  
needs-build
Needs build verification

  
needs-triage
Needs maintainer triage

  
priority/high
High priority

  
priority/medium
Medium priority

  
security
Created by niceos_cve_create_issues.py

  
security-release
Release notes mention security fixes or CVE

  
severity-high
Created by niceos_cve_create_issues.py

  
source-niceos-scan
Created by niceos_cve_create_issues.py

  
source-nvd
Created by niceos_cve_create_issues.py

  
update/minor
Minor update

  
update/patch
Patch-level update

  
upstream-update
New upstream version is available

  
upstream/github
GitHub upstream

No labels
ai-summary
auto-analysis
bot
cve
match-cpe-range
needs-build
needs-triage
priority/high
priority/medium
security
security-release
severity-high
source-niceos-scan
source-nvd
update/minor
update/patch
upstream-update
upstream/github
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
rpms/containerd#8
No description provided.