fix(deps): update module github.com/containerd/containerd/v2 to v2.2.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/containerd/containerd/v2	v2.2.2 → v2.2.3

---

Release Notes

containerd/containerd (github.com/containerd/containerd/v2)

v2.2.3: containerd 2.2.3

Compare Source

Welcome to the v2.2.3 release of containerd!

The third patch release for containerd 2.2 contains various fixes
and updates including a security patch.

Security Updates

• spdystream
  • CVE-2026-35469

Highlights

Container Runtime Interface (CRI)

• Preserve cgroup mount options for privileged containers (#​13120)
• Ensure UpdatePodSandbox returns Unimplemented instead of a generic error (#​13023)

Go client

• Handle absolute symlinks in rootfs user lookup to fix regressions when using Go 1.24 (#​13015)

Image Distribution

• Enable mount manager in diff walking to fix layer extraction errors with some snapshotters (e.g., EROFS) (#​13198)
• Apply hardening to prevent TOCTOU race during tar extraction (#​12971)

Runtime

• Restore support for client-mounted roots in Windows containers using process isolation (#​13195)
• Update runc to v1.3.5 (#​13061)
• Apply absolute symlink resolution to /etc/group in OCI spec to fix lookups on NixOS-style systems (#​13019)
• Handle absolute symlinks in rootfs user lookup to fix regressions when using Go 1.24 (#​13015)

Snapshotters

• Fix bug that caused whiteouts to be ignored when parallel unpack was used (#​13125)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Sebastiaan van Stijn
• Maksym Pavlenko
• Chris Henzie
• Derek McGowan
• Paulo Oliveira
• Henry Wang
• Phil Estes
• Wei Fu
• Akihiro Suda
• Gao Xiang
• Ricardo Branco
• Shachar Tal

Changes

40 commits

• Prepare release notes for v2.2.3 (#​13224)
  • 8a0f4ed5d Prepare release notes for v2.2.3
• update github.com/moby/spdystream v0.5.1 (#​13217)
  • 31bd34a06 update github.com/moby/spdystream v0.5.1
• vendor: github.com/klauspost/compress v1.18.5 (#​13197)
  • 1336f6c45 vendor: github.com/klauspost/compress v1.18.5
• diff/walking: enable mount manager (#​13198)
  • 409f75be8 diff/walking: enable mount manager
• update runhcs to v0.14.1 (#​13195)
  • 3f33146c1 update runhcs to v0.14.1
• vendor: github.com/Microsoft/hcsshim v0.14.1 (#​13196)
  • 8bd1b74e5 vendor: github.com/Microsoft/hcsshim v0.14.1
  • c6b0be8e1 vendor: github.com/Microsoft/hcsshim v0.14.0
• update to Go 1.25.9, 1.26.2 (#​13190)
  • 2ecde8cfe update to Go 1.25.9, 1.26.2
• Skip TestExportAndImportMultiLayer on s390x (#​13154)
  • be554f478 Skip TestExportAndImportMultiLayer on s390x
• Tweak mount info for overlayfs in case of parallel unpack (#​13125)
  • 660de195b Tweak mount info for overlayfs in case of parallel unpack
  • bc9274a4b Add integration test for issue 13030
• Preserve cgroup mount options for privileged containers (#​13120)
  • c387890b5 Add integration test for privileged container cgroup mounts
  • 047a335a6 Forward RUNC_FLAVOR env var down to integration tests
  • 9b2d72ee0 Preserve host cgroup mount options for privileged containers
  • 5b66cd6a0 Move cgroup namespace placement higher in spec builder
• update runc binary to v1.3.5 (#​13061)
  • 584205c2f [release/2.2] update runc binary to v1.3.5
• Fix vagrant on CI (#​13066)
  • 77c6886df Ignore NOCHANGE error
• Fix TOCTOU race bug in tar extraction (#​12971)
  • fbed68b8f Fix TOCTOU race bug in tar extraction
• cri: UpdatePodSandbox should return Unimplemented (#​13023)
  • a83510103 cri: UpdatePodSandbox should return Unimplemented
• fix(oci): apply absolute symlink resolution to /etc/group (#​13019)
  • ee4179e52 fix(oci): apply absolute symlink resolution to /etc/group
• fix(oci): handle absolute symlinks in rootfs user lookup (#​13015)
  • fd061b848 test(oci): use fstest and mock fs for better symlink coverage
  • 5d44d2c22 fix(oci): handle absolute symlinks in rootfs user lookup
• update to go1.25.8, test go1.26.1 (#​13011)
  • 00c776f07 update to go1.25.8, test go1.26.1

Dependency Changes

• github.com/Microsoft/hcsshim v0.14.0-rc.1 -> v0.14.1
• github.com/klauspost/compress v1.18.1 -> v1.18.5
• github.com/moby/spdystream v0.5.0 -> v0.5.1

Previous release can be found at v2.2.2

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/moby/spdystream	v0.5.0 -> v0.5.1

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.04%. Comparing base (12b3174) to head (184aa5b).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1459   +/-   ##
=======================================
  Coverage   91.04%   91.04%           
=======================================
  Files          40       40           
  Lines        1920     1920           
=======================================
  Hits         1748     1748           
  Misses        110      110           
  Partials       62       62           

Flag	Coverage Δ
unittests	91.04% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.