containerd-app (2.2.1-0ubuntu1~25.10.2) questing-security; urgency=high

  * SECURITY UPDATE: HTTP/2 SETTINGS frame infinite loop (vendored
    golang.org/x/net)
    - debian/patches/CVE-2026-33814.patch: move s.Valid() check before
      switch in ForeachSetting callback
    - CVE-2026-33814
  * SECURITY UPDATE: Uncontrolled Resource Consumption via unbounded
    group parsing
    - debian/patches/CVE-2026-47262.patch: bound user-database file
      reads in openUserFile, reject non-regular files
    - CVE-2026-47262
  * SECURITY UPDATE: Insufficient Verification of Data Authenticity in
    CRI checkpoint import
    - debian/patches/CVE-2026-50195.patch: remove re-tagging of restored
      checkpoint base images
    - CVE-2026-50195
  * SECURITY UPDATE: Reserved label propagation from image configs
    - debian/patches/CVE-2026-53488.patch: filter containerd.io/ and
      io.cri-containerd labels from image config
    - CVE-2026-53488
  * SECURITY UPDATE: UNIX Symbolic Link Following in CRI checkpoint
    restore
    - debian/patches/CVE-2026-53489.patch: add copyNoFollow,
      checkpointArchiveEntryAllowed, assertCheckpointDirSafe; use
      dedicated restore subdirectory
    - CVE-2026-53489
  * SECURITY UPDATE: Improper Input Validation of CDI annotations in
    checkpoint restore
    - debian/patches/CVE-2026-53492.patch: filter cdi.k8s.io
      annotations on checkpoint restore
    - CVE-2026-53492

 -- Eduardo Barretto <eduardo.barretto@canonical.com>  Mon, 22 Jun 2026 18:09:34 +0200

containerd-app (2.2.1-0ubuntu1~25.10.1) questing; urgency=medium

  * Backport from resolute to questing (LP: #2127661)
  * Drop patches applied upstream:
    - d/p/CVE-2024-25621.patch
    - d/p/CVE-2025-64329.patch

 -- Athos Ribeiro <athos@ubuntu.com>  Fri, 20 Feb 2026 16:34:24 -0300

containerd-app (2.2.1-0ubuntu1) resolute; urgency=medium

  * New upstream version 2.2.1
  * d/containerd.docs: update NOTICE files
  * d/copyright: update copyright data
  * d/s/lintian-overrides: ignore long lines

 -- Athos Ribeiro <athos@ubuntu.com>  Tue, 13 Jan 2026 10:58:22 -0300

containerd-app (2.1.3-0ubuntu3) questing; urgency=medium

  * d/control: adjust for new containerd-stable package in the archive
    - Conflics/Replaces containerd
    - Update package description

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Fri, 29 Aug 2025 15:01:05 -0300

containerd-app (2.1.3-0ubuntu2) questing; urgency=medium

  * d/t/basic-smoke: use systemctl to start the service (LP: #2118738)

 -- Andreas Hasenack <andreas@canonical.com>  Tue, 05 Aug 2025 10:16:03 -0300

containerd-app (2.1.3-0ubuntu1) questing; urgency=medium

  * New upstream version 2.1.3
  * d/containerd.docs: update NOTICE files
  * d/copyright: update copyright data

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 03 Jul 2025 11:25:51 -0300

containerd-app (2.0.5-0ubuntu1) questing; urgency=medium

  * d/t/basic-smoke: remove shell's -u option
  * New upstream version 2.0.5
  * d/p/CVE-2024-40635.patch: drop patch applied upstream
  * d/copyright: remove unused license text
  * d/control:
    - Replace pkg-config with pkgconf
    - Bump Standards-Version

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 06 May 2025 19:50:35 -0300

containerd-app (2.0.2-0ubuntu2) plucky; urgency=medium

  * SECURITY UPDATE: Integer overflow.
    - debian/patches/CVE-2024-40635.patch: Add maxUserID and maxGroupID with
      limitations in ./pkg/oci/spec_opts.go.
    - CVE-2024-40635

 -- Hlib Korzhynskyy <hlib.korzhynskyy@canonical.com>  Tue, 25 Mar 2025 14:31:52 -0230

containerd-app (2.0.2-0ubuntu1) plucky; urgency=medium

  * New upstream version 2.0.2 (LP: #2085187, #2076166)
  * d/control:
    - build with golang 1.24 (LP: #2098664)
    - add missing B-D on procps
  * d/rules: add golang 1.24 to PATH
  * d/copyright: update copyright data

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 17 Feb 2025 10:52:33 -0300

containerd-app (2.0.0-0ubuntu1) plucky; urgency=medium

  * New upstream version 2.0.0. (LP: #2089704)

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Tue, 26 Nov 2024 21:03:03 -0300

containerd-app (1.7.19-0ubuntu3) plucky; urgency=medium

  * d/copyright: remove orphan entry from copyright. The entry was added back
    in Lunar due to a vendored runc file copyright (cloned_binary.c). That
    file was later removed from runc but the d/copyright entry for it was only
    partially removed. These changes were not documented in d/changelog back
    then.
  * d/control: remove Uploaders field. It makes little to no sense in Ubuntu
    and this is a Ubuntu specific package.

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Mon, 18 Nov 2024 21:42:18 -0300

containerd-app (1.7.19-0ubuntu2) plucky; urgency=medium

  * d/p/0002-Skip-tests-which-require-a-certain-level-of-privileg.patch: drop
    bogus entry.
  * d/rules: do not skip pkg/cri/server tests. These were being skipped due to
    a bogus entry in d/patches.

 -- Athos Ribeiro <athos.ribeiro@canonical.com>  Thu, 31 Oct 2024 13:16:12 -0300

containerd-app (1.7.19-0ubuntu1) oracular; urgency=medium

  * New upstream release.
  * d/t/basic-smoke: set proxy environment variables.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Wed, 03 Jul 2024 18:52:03 -0300

containerd-app (1.7.17-0ubuntu1) oracular; urgency=medium

  * New upstream release.
    - Update AppArmor template to allow confined runc to kill containers
      (LP: #2065423).
  * Refresh patches.
    - d/p/{0006-Skip-test-setting-OOM-score-to-negative-number-in-un,
      0007-seccomp-apparmor-add-go-noinline}.patch: removed, applied by
      upstream.
  * d/rules: skip cri server tests.
  * d/rules: fix path of containerd commands.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Tue, 04 Jun 2024 17:24:22 -0300

containerd-app (1.7.12-0ubuntu4) noble; urgency=medium

  * Build with Go 1.22.
    - d/control: b-d on golang-1.22-go instead of golang-1.21-go
    - d/rules: add Go 1.22 to $PATH

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Wed, 17 Apr 2024 17:01:35 -0300

containerd-app (1.7.12-0ubuntu3) noble; urgency=medium

  * No-change rebuild for CVE-2024-3094

 -- William Grant <wgrant@ubuntu.com>  Mon, 01 Apr 2024 16:39:10 +1100

containerd-app (1.7.12-0ubuntu2) noble; urgency=medium

  * Build with Go 1.21 (LP: #2056154)
    - d/control: b-d on golang-1.21-go instead of golang-1.20-go
    - d/rules: add Go 1.21 to $PATH

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Tue, 12 Mar 2024 11:46:44 -0300

containerd-app (1.7.12-0ubuntu1) noble; urgency=medium

  * New upstream release.
  * Build with Go 1.20.
  * d/p/0002-Skip-tests-which-require-a-certain-level-of-privileg.patch:
    refresh.
  * d/containerd.docs: remove NOTICE from vendored runc.
  * d/rules: fix path of the containerd systemd service file.
  * d/rules: do no pass removed commands to dh_golang before dh_gencontrol.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Mon, 15 Jan 2024 18:39:58 -0300

containerd-app (1.7.2-0ubuntu2) mantic; urgency=medium

  * Drop patches for -dev packages
    + 0004-disable-windows-support-in-ctr-metric.patch
    + 0005-Revert-Use-insecure.NewCredentials-instead-of-grpc.W.patch
  * Backport patch for Go1.21 (LP: #2032754)
    + 0007-seccomp-apparmor-add-go-noinline.patch

 -- Shengjing Zhu <shengjing.zhu@canonical.com>  Wed, 23 Aug 2023 15:04:29 +0800

containerd-app (1.7.2-0ubuntu1) mantic; urgency=medium

  * Initial release. See LP #2022390.

 -- Lucas Kanashiro <kanashiro@ubuntu.com>  Tue, 20 Jun 2023 16:20:38 -0300
