Update module github.com/containerd/containerd/v2 to v2.4.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/containerd/containerd/v2	v2.4.0 → v2.4.1

---

Release Notes

containerd/containerd (github.com/containerd/containerd/v2)

v2.4.1: containerd 2.4.1

Compare Source

Welcome to the v2.4.1 release of containerd!

The first patch release for containerd 2.4 contains various fixes
and updates including a security patch.

Security Updates

• containerd
  • CVE-2026-53493

Highlights

Container Runtime Interface (CRI)

• Fix bug where failed container start cleanup leaked tasks and prevented container removal (#​14223)
• Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem (#​14212)

Image Distribution

• Fix content upload failures when retrying fetch content after reaching EOF (#​14197)

Snapshotters

• Apply hardening to filter ID-mapping labels from image annotations during unpack (#​14200)

ctr development tool

• Fix bug where arguments following "-" were dropped in "ctr images export" (#​14219)
• Fix bug where container command arguments were parsed as flags in "ctr run", "ctr containers create", "ctr tasks exec", and "containerd oci-hook" (#​14215)
• Fix bug where comma-separated flag values were incorrectly split in ctr subcommands (#​14188)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Aysha Afrah Ziya
• Chris Henzie
• CrazyMax
• Maksym Pavlenko
• Nan Liu
• Sebastiaan van Stijn

Changes

23 commits

• 9f7f70fc31 Prepare release notes for v2.4.1
• 98e88f2afe Merge commit from fork
• e0c8eed120 Bound Walk references
• ddf544326a Bound Dispatch concurrency and references
• cri: don't leak task when StartContainer cleanup fails to delete task (#​14223)
  • 9e8abe0405 cri: fix process leak when start cleanup fails to delete task
• ctr: preserve args after "-" in images export (#​14219)
  • acbdd57f0d ctr: preserve args after "-" in images export
• ctr: fix flag parsing issues in run, containers create, tasks exec, and oci-hook (#​14215)
  • a2e9a5196e cmd/containerd: stop flag parsing on oci-hook
  • 2d0e53474d ctr: stop flag parsing before container command
• cri: tolerate wrapped ENOTSUP during relabel (#​14212)
  • eb2dfa125d cri: tolerate wrapped ENOTSUP during relabel
• core/unpack: don't honor id-mapping labels from image annotations (#​14200)
  • 429f317b55 core/unpack: tighten comments around id-mapping label filtering
  • cc1b8a2dc5 core/unpack: don't honor id-mapping labels from image annotations
• remotes: revert closing fetch readers at EOF (#​14197)
  • d265baec5a remotes: test fetch retries and HTTP reader lifetime
  • 9e8507bea8 Revert "remotes: close fetch reader immediately on EOF"
• ctr: disable slice flag separator on commands (#​14188)
  • 2543d23905 ctr: disable slice flag separator on commands
• vendor: github.com/fxamacker/cbor/v2 v2.9.4 (#​14179)
  • f00dd7552e vendor: github.com/fxamacker/cbor/v2 v2.9.4

Dependency Changes

• github.com/fxamacker/cbor/v2 v2.9.1 -> v2.9.4

Previous release can be found at v2.4.0

Which file should I download?

• containerd-<VERSION>-<OS>-<ARCH>.tar.gz: ✅Recommended. Dynamically linked with glibc 2.35 (Ubuntu 22.04).
• containerd-static-<VERSION>-<OS>-<ARCH>.tar.gz: Statically linked. Expected to be used on Linux distributions that do not use glibc >= 2.35. Not position-independent.

In addition to containerd, typically you will have to install runc
and CNI plugins from their official sites too.

See also the Getting Started documentation.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 1 additional dependency was updated

Details:

Package	Change
github.com/fxamacker/cbor/v2	v2.9.1 -> v2.9.4

[github-actions]

➡️ Go test coverage stayed the same at 80.1% compared to 16831d2 (6 ignored files)

No change in coverage for any package.

View coverage for all packages

# Package Name                                          | Coverage
+ code.cloudfoundry.org/k8s-garden-client/pkg/k8sgarden |    80.9%
+ code.cloudfoundry.org/k8s-garden-client/pkg/kubelet   |    66.7%
+ code.cloudfoundry.org/k8s-garden-client/pkg/log       |   100.0%