containerd 2.3.5

[BrewTestBot]

Created by brew bump

---

Created with brew bump-formula-pr.

Details

release notes

Welcome to the v2.3.5 release of containerd!
The fifth patch release for containerd 2.3 contains various fixes

and updates including security patches.
Security Updates

containerd

CVE-2026-53495
GHSA-rp3h-jf77-q9p4



Highlights
Image Distribution

Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#14030)

Runtime

Avoid hangs and data races when streaming container standard I/O in CRI (#14094)
Fix missing error messages in OpenTelemetry trace attributes (#14049)
Fix user and group lookup failures in container rootfs containing symlinked /etc/passwd or /etc/group (#13999)
Fix configuration loading error when drop-in configuration files have a higher version than the root configuration (#13995)
Avoid containerd startup hangs when loading shims (#13983)
Add context to error when shim delete times out (#13921)
Fix Windows Server 2022 container compatibility on host builds newer than the latest LTSC (containerd/platforms#34)

Snapshotters

Fix unpack failure for EROFS images containing the erofs OS feature (#14062)

Please try out the release binaries and report any issues at

https://github.com/containerd/containerd/issues.
Contributors

Phil Estes
Samuel Karp
Derek McGowan
Sebastiaan van Stijn
Akhil Mohan
Maksym Pavlenko
Wei Fu
Oleh Konko
Austin Vazquez
Jing Chen
Martín Fernández
Paco Xu
XlabAI
Yuanliang Zhang

Changes
33 commits


934efa5e0 Prepare release notes for v2.3.5
be419b070 Merge commit from fork
9ec55f024 cri: cancel ExecSync IO drain on context cancellation
84ea25bc1 Merge commit from fork
c53577965 archive: skip redundant opaque whiteout walks
Fix data races and a deadlock in the byte stream helpers (#14094)

9f6be869c Fix data races and a deadlock in the byte stream helpers


plugins: remove some stray logrus imports (#14063)

6c59399bf plugins: remove some stray logrus imports


snapshots/erofs: advertise the erofs OS feature from the snapshotter plugin (#14062)

f65732115 snapshots/erofs: test the advertised erofs feature platform
5ffc2bbda erofs: advertise the erofs OS feature platform from the snapshotter


update runc to v1.5.1 (#14059)

af445ea0a update runc to v1.5.1
c077e43bd update runc to v1.5.0


vendor: github.com/containerd/platforms v1.0.0-rc.5 (#14048)

676a64cad vendor: github.com/containerd/platforms v1.0.0-rc.5


pkg/tracing: handle error and typed-nil Stringer attributes (#14049)

c7ffd8b00 pkg/tracing: handle error and typed-nil Stringer attributes


docker fetcher: strip sensitive headers on descriptor URLs (#14030)

58fb846d5 core/remotes/docker: normalize descriptor URL origins
c7625a1ff core/remotes/docker: strip sensitive headers on desc.urls fetch


update runhcs to v0.15.0-rc.4 (#13990)

6fbb92c33 update runhcs to v0.15.0-rc.4


pkg/oci: resolve rootfs symlinks for user lookup (#13999)

53bf030ea pkg/oci: resolve rootfs symlinks for user lookup


Revert "add check on version of drop in configs" (#13995)

7790c4c21 ensure that the final config version is the higest in the config list
1125b053f Revert "add check on version of drop in configs"


fix(runtime): apply load timeout to load shim (#13983)

460c47b28 fix(runtime): bound shim loading with the load timeout


Add more context to the shim delete error (#13921)

7f97bc122 Add more context to the shim delete error





Changes from containerd/platforms
2 commits


Fix WS2022 compat on hosts past the latest LTSC (containerd/platforms#34)

bacc690 Fix WS2022 compat on hosts past the latest LTSC





Dependency Changes

github.com/containerd/platforms  v1.0.0-rc.4 -> v1.0.0-rc.5

Previous release can be found at v2.3.4
Which file should I download?

containerd-<VERSION>-<OS>-<ARCH>.tar.gz:         ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz:  Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc

and CNI plugins from their official sites too.
See also the Getting Started documentation.

View the full release notes at https://github.com/containerd/containerd/releases/tag/v2.3.5.

---

[github-actions]

🤖 An automated task has requested bottles to be published to this PR.

Caution

Please do not push to this PR branch before the bottle commits have been pushed, as this results in a state that is difficult to recover from. If you need to resolve a merge conflict, please use a merge commit. Do not force-push to this PR branch.