containerd v2.2.5

The v2.2.5 release is a critical security-focused update for containerd. It primary centers on resolving five CVEs while hardening the CRI checkpoint/restore mechanism and refining how labels are handled during image management. It also includes routine updates to the underlying Go runtime and runc to ensure continued reliability and support.

Critical Security Patch Bundle (v2.2.5) — This release addresses five distinct vulnerabilities (CVEs), providing critical protection against potential exploits. Upgrading is essential to maintain the security posture of your container host and orchestrated workloads.

Robustness Improvements for CRI Checkpoint and Restore — Users utilizing CRI-based checkpoint and restore features will benefit from a more stable process. The fixes prevent unexpected archive contents from crashing the process and ensure CDI annotations and image tags are handled correctly during restoration.

Prevent Reserved Label Propagation from Image Configs — This ensures that internal system labels aren't accidentally applied to containers based on their source image metadata, preventing potential configuration conflicts or security bypasses involving restricted labels.