containerd v1.7.35

v1.7.35

containerd 1.7.35

Changed 1
  • Enable log scrubbing by default on Windows
Fixed 2
  • Cancel ExecSync IO drain on context cancellation in CRI
  • Skip redundant opaque whiteout walks in archive
Security 3
  • Apply hardening to strip sensitive authentication headers when fetching descriptor URLs
  • Address CVE-2026-53495
  • Address GHSA-rp3h-jf77-q9p4

From containerd

Welcome to the v1.7.35 release of containerd!

The thirty-fifth patch release for containerd 1.7 contains various fixes and updates including security patches.

Security Updates
Highlights
Image Distribution
  • Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#14046)
Runtime
  • Enable log scrubbing by default on Windows (#13889)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors
  • Samuel Karp
  • Oleh Konko
  • Chris Henzie
  • Maksym Pavlenko
  • Phil Estes
  • XlabAI
Changes
  • 05aa78da3 Prepare release notes for v1.7.35
  • 3bd79bb36 Merge commit from fork
  • 5a2a3a759 cri: cancel ExecSync IO drain on context cancellation
  • 323e148f2 Merge commit from fork
  • 9205b1903 archive: skip redundant opaque whiteout walks
  • docker fetcher: strip sensitive headers on descriptor URLs (#14046)
    • b01d66349 core/remotes/docker: normalize descriptor URL origins
    • b5d936dca core/remotes/docker: strip sensitive headers on desc.urls fetch
  • Use ScrubLogs by default on Windows (#13889)
    • cff94ea40 ctr: add --scrub-logs flag for Windows
    • 544e4657d cri/config: use ScrubLogs by default on Windows
  • ci: bound Go fuzzing by execution count (#13788)
    • 71e00ba9c ci: bound Go fuzzing by execution count
Dependency Changes

This release has no dependency changes

Previous release can be found at v1.7.34

View original

Upgraded? How did it go?

Discussion