containerd v2.1.9

A critical security release focusing on fixing five CVEs and hardening the Container Runtime Interface (CRI) against malicious checkpoint data. It also includes stability fixes for label propagation and resource usage during user file processing.

Critical Security Patches (Multiple CVEs) — This patch addresses five critical security vulnerabilities (CVEs) that could compromise host or container integrity. Updating is essential to maintain the security posture of your container clusters.

Hardened CRI Checkpoint Restore Logic — Prevents malicious or malformed container checkpoints from compromising the containerd daemon during restore operations, and ensures CDI (Container Device Interface) annotations are handled correctly.