Signed-off-by: Sopho Merkviladze <smerkviladze@mirantis.com>

[release/1.7] Bump go-jose/go-jose/v3 to v3.0.5 to fix GHSA-78h2-9frx-2jm8

Add disk cleanup step before checking out repositories in node e2e
workflow. GitHub Actions ubuntu-24.04 runners come preloaded with large
toolchains that exhaust disk space during compilation of Kubernetes test
binaries and containerd binaries. Cleaning up unused toolchains avoids
kubelet DiskPressure condition and subsequent pod eviction failures.

This change isolates and backports the workflow disk cleanup step
originally introduced to main in commit
9d5ee65.

Co-authored-by: Chris Henzie <chrishenzie@gmail.com>
Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>

…-13548-to-release/1.7

[release/1.7] Clean up disk space in node e2e workflow

GHA runners occasionally experience I/O constraints during root-test
test execution. While concurrent tests rapidly allocate loopback
devices, background udev probing stalls. This quickly exhausts
systemd-udevd's default worker pool ceiling (20 children max), stalling
netlink uevent processing so device-mapper device nodes are never
created for subsequent dm-verity test execution.

Logging cgroups v2 pids.peak telemetry confirmed peak in-flight udev
workers accumulate to 325 during test execution. Raising the
children-max limit to 500 provides comfortable buffer room so udevd
freely spawns worker processes without entering event lockup or causing
test timeouts.

Assisted-by: Antigravity
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>

…-13562-to-release/1.7

[release/1.7] Configure udevd children-max for root-test

Image config labels are copied onto the container by both the CRI
plugin (BuildLabels) and the client's WithImageConfigLabels option
used by `ctr run`. Labels in the containerd.io/* namespace are
interpreted by containerd itself and labels in the io.cri-containerd*
namespace are interpreted by the CRI plugin. An image config is not a
trusted source for labels in either namespace.

Skip labels in both reserved namespaces when copying labels from an
image config to a container, and warn about each label skipped: an
image that tries to set them may be attempting to alter containerd
behavior. Oversized image labels are already skipped this way by
the CRI plugin.

Labels set explicitly by clients, for example via `ctr run --label`
or in the CRI request, are unaffected.

Verified with the CRI plugin and with `ctr run` against an image
whose config carries labels like these: the labels are no longer
present on the created container and a warning is logged for each.

Assisted-by: Claude Code
Signed-off-by: Ben Cressey <ben@cressey.org>
Signed-off-by: Samuel Karp <samuelkarp@google.com>
(cherry picked from commit 0ec1af4)
Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Signed-off-by: Samuel Karp <samuelkarp@google.com>

- go1.26.4 includes security fixes to the crypto/x509, mime, and
net/textproto packages, as well as bug fixes to the compiler, the
runtime, the go fix command, and the crypto/fips140 package

- go1.25.11 includes security fixes to the crypto/x509, mime, and
net/textproto packages, as well as bug fixes to the compiler and the
runtime.

Signed-off-by: Akhil Mohan <akhilerm@gmail.com>

[release/1.7] update go to 1.26.4/1.25.11

Port of 7b05ec4 to the release/1.7 call shape, which reads user
databases via path-based user.ParsePasswdFile* / ParseGroupFile*
helpers rather than the fs.FS-based openUserFile wrapper introduced
later on main.

UserFromPath, GIDFromPath, getSupplementalGroupsFromPath, and the
setAdditionalGids closure in WithAppendAdditionalGroups now open
/etc/passwd or /etc/group via openBoundedUserFile, which stats the
resolved path, refuses anything that is not a regular file, and
returns an io.ReadCloser that caps reads at maxUserFileBytes (10
MiB). The reader is consumed by the user.ParsePasswdFilter /
ParseGroupFilter / ParseGroup variants. All four call sites read
either etc/passwd or etc/group; both are regular files on real
systems, well under the cap.

The cap and the regular-file check together bound parser memory use
when reading user-database files of unexpected shape or size.

Adds tests for the cap and for the non-regular file rejection. The
cap test covers three boundary points: a small pad (trailing entry
parsed), a pad placing the entry's last byte exactly on the cap
(still parsed), and a pad past the cap (read returns an "exceeds"
error). The non-regular test verifies a FIFO at etc/group is
rejected before any read is attempted.

Updates TestWithAppendAdditionalGroupsNoEtcGroup to expect "stat
... no such file or directory" instead of "open ...". The
soft-on-missing behavior of WithAppendAdditionalGroups is unchanged.

(cherry picked from commit 7b05ec4)
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>
Signed-off-by: Brian Goff <cpuguy83@gmail.com>
Signed-off-by: Chris Henzie <chrishenzie@gmail.com>

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>

…-13606-to-release/1.7

[release/1.7] update runc binary to v1.3.6

Signed-off-by: Samuel Karp <samuelkarp@google.com>

[release/1.7] Prepare release notes for v1.7.33