[elastic-renovate-prod]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/Microsoft/hcsshim	v0.15.0-rc.4 → v0.15.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

Microsoft/hcsshim (github.com/Microsoft/hcsshim)

v0.15.0

Compare Source

What's Changed

• Fix/Disable failing CI tests by @​ambarve in microsoft#2506
• Allow overriding UVM start timeout. by @​ambarve in microsoft#2501
• Omnibus dependency update by @​helsaawy in microsoft#2481
• Support for starting confidential containers by @​ambarve in microsoft#2495
• add support for resource partitions by @​anmaxvl in microsoft#2482
• Invoke fsformatter for container scratch by @​kiashok in microsoft#2498
• Minor bug fixes for CWCOW by @​ambarve in microsoft#2514
• Enable SNP for WCOW by @​takuro-sato in microsoft#2507
• guest/spec, rego, rego_test: Fix GetUserInfo by @​micromaomao in microsoft#2465
• oc/exporter: Include the name of a span in the message by @​micromaomao in microsoft#2470
• guest/storage/scsi: Print log warning if GetDevicePath blocks due to wait by @​micromaomao in microsoft#2471
• Host data validation by @​takuro-sato in microsoft#2518
• C-WCOW: SecurityPolicy implementation and tests by @​MahatiC in microsoft#2508
• Disable video console in SNP mode by @​ambarve in microsoft#2528
• fix: close handle when DeviceIoControl fails by @​anmaxvl in microsoft#2462
• Support for mounting verified merged CIMs by @​ambarve in microsoft#2530
• Add annotation flag to uvmboot by @​helsaawy in microsoft#2521
• Fix panic in HasConfidentialPolicy for LCOW. by @​ambarve in microsoft#2537
• added HCN subnet flags support by @​daschott in microsoft#2525
• gcs: do not trigger container shutdown when signaling init process by @​anmaxvl in microsoft#2538
• Support tmpfs backed sandbox mount for LCOW containers by @​jiechen0826 in microsoft#2533
• Organize Makefile variables and fix Go flags bug by @​helsaawy in microsoft#2520
• Bump actions/upload-artifact from 4 to 5 by @​dependabot[bot] in microsoft#2543
• Remove the standard JSON enforcer and the JSON policy parsing in the Rego enforcer by @​micromaomao in microsoft#2539
• Allow writable /var and /etc directories by @​helsaawy in microsoft#2522
• Set disk identifier for confidential UVM's scratch and Pass UVM measurement info to sidecar GCS by @​ambarve in microsoft#2545
• Initial multipod support by @​helsaawy in microsoft#2546
• Add LCOW logpath within uVM by @​helsaawy in microsoft#2511
• Bump golangci/golangci-lint-action from 8 to 9 by @​dependabot[bot] in microsoft#2555
• Only Reset non-nil fields. by @​helsaawy in microsoft#2558
• Security Policy: Move fragment extraction by @​MahatiC in microsoft#2542
• C-WCOW: SecurityPolicy and sidecar fixes by @​MahatiC in microsoft#2527
• fix imports in internal/gcs-sidecar/host.go by @​anmaxvl in microsoft#2567
• Adding support for WCOW UVM log forward service by @​marma-dev in microsoft#2524
• vsmb share redirector start and bind to vmbus by @​pomahade in microsoft#2560
• cwcow: Use the right VM version by @​sunilmut in microsoft#2568
• Bump actions/checkout from 5 to 6 by @​dependabot[bot] in microsoft#2565
• Bump golang.org/x/crypto from 0.41.0 to 0.45.0 in /test by @​dependabot[bot] in microsoft#2564
• Log final LCOW OCI spec; always call go in Makefile by @​helsaawy in microsoft#2570
• add EVD support for LCOW by @​anmaxvl in microsoft#2554
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in microsoft#2532
• Bump github.com/opencontainers/runc from 1.3.0 to 1.3.3 in /test by @​dependabot[bot] in microsoft#2550
• Restore runc kill all behavior for init processes by @​helsaawy in microsoft#2573
• Verify runc error from log file by @​helsaawy in microsoft#2577
• C-WCOW: Unify data structures and reuse for C-LCOW and C-WCOW by @​MahatiC in microsoft#2544
• switch to CimWriter.dll and regenerate syscalls by @​anmaxvl in microsoft#2578
• CWCOW: Handle container remove request by @​MahatiC in microsoft#2569
• Bump actions/upload-artifact from 5 to 6 by @​dependabot[bot] in microsoft#2575
• Enforcing cgroup resource limits at the pod level within guest by @​rawahars in microsoft#2586
• rego: Allow sending SIGTERM and SIGKILL to the container init process in old policies by @​micromaomao in microsoft#2540
• Use tool directives in go.mod by @​helsaawy in microsoft#2576
• Move common confidential options for LCOW and WCOW by @​MahatiC in microsoft#2582
• Add LCOW assigned device logs; increase timeout by @​helsaawy in microsoft#2589
• remove unused remote vm implementation by @​rawahars in microsoft#2592
• CWCOW: Unmount CIM volume by @​MahatiC in microsoft#2588
• VSMB fix bugcheck by keeping handle open to empty default share by @​pomahade in microsoft#2591
• C-WCOW: Enforce hashes on already mounted CIMs by @​MahatiC in microsoft#2556
• CWCOW: roothash and graceful timeout fixes by @​MahatiC in microsoft#2593
• Fix LCOW DNS search bug by @​helsaawy in microsoft#2594
• WCOW: restore support for client-mounted roots with process-isolated containers by @​corhere in microsoft#2595
• Vendor containerd sandbox/v1 API by @​rawahars in microsoft#2599
• [forwardport]populate resolv conf from right location for multipod by @​helsaawy in microsoft#2604
• Adds VM Manager interfaces + implementation for UVM by @​rawahars in microsoft#2597
• support both cimfs and cimwriter dlls by @​anmaxvl in microsoft#2587
• refactor common uvm code into vmutils package by @​rawahars in microsoft#2607
• add and patch containerd/pkg/shim to be used with new Windows shims by @​rawahars in microsoft#2601
• adds guest manager interfaces + implementation for guest operations by @​rawahars in microsoft#2598
• CWCOW: Misc fixes by @​MahatiC in microsoft#2605
• Bump actions/upload-artifact from 6 to 7 by @​dependabot[bot] in microsoft#2610
• Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 in /test by @​dependabot[bot] in microsoft#2614
• Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 by @​dependabot[bot] in microsoft#2615
• use CimGetVerificationInformation from cimwriter.dll by @​anmaxvl in microsoft#2608
• Bump github.com/docker/cli from 24.0.0+incompatible to 29.2.0+incompatible in /test by @​dependabot[bot] in microsoft#2623
• Bump github.com/docker/cli from 24.0.0+incompatible to 29.2.0+incompatible by @​dependabot[bot] in microsoft#2624
• shim: skip SandboxPlatform validation when platform is not explicitly set by @​rzlink in microsoft#2620
• added the VM sandbox spec used by shim to generate the HCS document for sandbox by @​rawahars in microsoft#2609
• add vmmem process lookup functionality + windows API abstraction by @​rawahars in microsoft#2613
• Refactor GCS logging and guest management for reusability by @​rawahars in microsoft#2612
• Block cim create and mount check update by @​pomahade in microsoft#2621
• jobcontainers: wire Windows CPU affinity to JobObject limits by @​wenyang in microsoft#2603
• added LCOW Builder to generate final HCS document from annotations and options by @​rawahars in microsoft#2616
• CWCOW: Include merged layer hash by @​MahatiC in microsoft#2618
• vmutils: add unit tests for allProcessEntries & LookupVMMEM by @​shreyanshjain7174 in microsoft#2628
• Embedding ETW Name-GUID Mapping for Log Forward Service by @​marma-dev in microsoft#2617
• CWCOW: Enforce registry entries on containers by @​MahatiC in microsoft#2611
• Bump google.golang.org/grpc from 1.75.0 to 1.79.3 in /test by @​dependabot[bot] in microsoft#2636
• [LCOW Builder] fix CPUGroup, VPMEM controller and StorageQoS parsing by @​rawahars in microsoft#2630
• adds containerd-shim-lcow-v2 shim by @​rawahars in microsoft#2627
• Bump google.golang.org/grpc from 1.75.0 to 1.79.3 by @​dependabot[bot] in microsoft#2637
• parity: add LCOW HCS document parity tests between legacy and v2 builders by @​shreyanshjain7174 in microsoft#2629
• [shimV2] Implements the VM SCSI Controller by @​jterry75 in microsoft#2651
• [shimV2] Implements the VM VPMem Controller by @​jterry75 in microsoft#2652
• fix: plumbing security policy fragments by @​anmaxvl in microsoft#2642
• Merge various fixes for C-LCOW since conf-aci/0.2.5 (part 1) by @​micromaomao in microsoft#2581
• Add the internal/computecore package by @​jterry75 in microsoft#2654
• Fixes the go fmt for internal/hcs/schema2 by @​jterry75 in microsoft#2657
• Add cgroup v2 support while maintaining v1 compatibility by @​jiechen0826 in microsoft#2632
• init: Add Ubuntu support for module loading and entropy initialization by @​jiechen0826 in microsoft#2650
• Adding support for ARM64 LCOW by @​marma-dev in microsoft#2606
• [shimV2] Introduce locking at guestmanager layer by @​rawahars in microsoft#2638
• [shimV2] adds vpci device controller by @​rawahars in microsoft#2643
• [shimV2] added network controller implementation by @​rawahars in microsoft#2633
• [shimV2] refactor scsi device controller to V2 template by @​rawahars in microsoft#2660
• Update setup-go version; lint build tags by @​helsaawy in microsoft#2670
• [shimV2] refactor SCSI package to unify the interfaces with build tagged files by @​rawahars in microsoft#2666
• Bump github.com/opencontainers/selinux from 1.12.0 to 1.13.0 in /test by @​dependabot[bot] in microsoft#2557
• Bug fix for leaked LCOW resources; expand logs by @​helsaawy in microsoft#2655
• add functional tests for cgroup v2 in gcs by @​jiechen0826 in microsoft#2664
• Omnibus dependency updates; switch to pointer field for LinuxPids.Limit by @​helsaawy in microsoft#2682
• Log cimwriter.dll version on load by @​anmaxvl in microsoft#2684
• [shimV2] add plan9 device controller by @​rawahars in microsoft#2641
• [shimV2] [VM controller] refactor + adds Update + Device controllers by @​rawahars in microsoft#2663
• [shimV2] refactor VM controller + network controller by @​rawahars in microsoft#2690
• guest: use OCIBundlePath as sandbox root source of truth by @​shreyanshjain7174 in microsoft#2653
• Adds live migration ttrpc service definition by @​rawahars in microsoft#2691
• adds HCS live migration APIs by @​rawahars in microsoft#2686
• [live-migration] replace event/error strings with structured MigrationNotification by @​rawahars in microsoft#2697
• [shimV2] adds core pod, container and process controllers by @​rawahars in microsoft#2674
• [shimV2] implements task, shimdiag service and wires up pod/container controllers by @​rawahars in microsoft#2685
• [live-migration]: add sandbox_id to ImportSandboxRequest rpc by @​rawahars in microsoft#2702
• [live-migration] deliver structured live migration notifications end to end by @​rawahars in microsoft#2696
• [shimV2] Remove vpmem controller and related config from V2 shim code paths by @​rawahars in microsoft#2703
• [shimV2] Refactor V2 shim for platform consistency and remove vPMem support in v2 LCOW by @​rawahars in microsoft#2701
• [live-migration] add live migration annotations by @​rawahars in microsoft#2704
• Use VS SDK to create syso file from Manifest by @​helsaawy in microsoft#2694
• [live-migration] remove compatibility info from options proto by @​rawahars in microsoft#2708
• bridge: add guest-side reconnect loop for live migration by @​shreyanshjain7174 in microsoft#2698
• C-WCOW: Add mounted_cim check in enforcement by @​MahatiC in microsoft#2692
• controller/network: add unit tests for network controller by @​shreyanshjain7174 in microsoft#2647
• Remove unused fields from LCOW SandboxOptions by @​rawahars with @​Copilot in microsoft#2719
• parity: add LCOW document permutation tests by @​shreyanshjain7174 in microsoft#2631
• Fix builds: Remove vpmem multimapping annotation from parity tests by @​rawahars in microsoft#2722
• Document the LCOW V2 containerd shim in README by @​rawahars with @​Copilot in microsoft#2720
• cgroup: add BPF probe for v1 fallback and improve GCS error diagnostic by @​jiechen0826 in microsoft#2716
• [shimV2] bind GCS/host hvsock listeners before starting the UVM by @​rawahars in microsoft#2723
• plumb ResourcePartitionId to HCS by @​anmaxvl in microsoft#2712
• update hcs.Start to use HCS V1 API by @​rawahars in microsoft#2729
• Enable log scrubbing by default by @​ryankeithster in microsoft#2725
• guest: unify pod model for V1, virtual pod, and V2 shim support by @​shreyanshjain7174 in microsoft#2699
• [shimV2] order container teardown so the UVM can reap bundle dirs by @​rawahars in microsoft#2737
• guest/spec: remove VirtualPod path helpers and dead code by @​shreyanshjain7174 in microsoft#2736
• uvm: omit default WCIFS FilterType for older GCS compatibility by @​rawahars in microsoft#2739
• Bump google.golang.org/grpc from 1.80.0 to 1.81.1 in /test by @​dependabot[bot] in microsoft#2740
• [shimV2] Fix guest/VM exit on their own by @​rawahars in microsoft#2743
• gcs: fix flaky test on bridge teardown race by @​shreyanshjain7174 in microsoft#2744
• test/util: add arm64 to aarch64 translation in translateGOARCH by @​AdityaMittal1306 in microsoft#2746
• HostProcess containers with Hypervisor Isolation by @​rawahars in microsoft#2531
• [cherry-pick] Update CgroupsPath to include container ID for sandbox container by @​rawahars in microsoft#2754
• jobobject,jobcontainers,hcsoci: add CPU group affinity support for job-object containers by @​wenyang in microsoft#2693
• pkg/securitypolicy: Trim whitespaces from version_{api,framework} to allow trailing newlines by @​micromaomao in microsoft#2761
• always set SecurityPolicyEnabled when policy is present by @​anmaxvl in microsoft#2748
• [tooling]: add SIGKILL and SIGTERM to pause container signals by @​anmaxvl in microsoft#2750
• ensure consistent error message as V1 shim by @​rawahars in microsoft#2767
• fix: enlighten lcow uvmboot with dm-verity boot by @​anmaxvl in microsoft#2766
• Bypass default encryption policy when expanding sandbox vhdx by @​mendsley in microsoft#2572
• rego: Introduce metadata rollback and enhance handling of mount failures in C-LCOW by @​micromaomao in microsoft#2768
• hcsoci,hcs,shim: honor CPU affinity for Argon containers by @​zylxjtu in microsoft#2764
• [internal/hcs] Migrate package from HCS V1 to V2 by @​rawahars in microsoft#2735
• Plumb hash_envelope_reference_info.cose by @​anmaxvl in microsoft#2622
• Fix pause container of a privileged pod unable to start due to /sys mount option mismatch by @​micromaomao in microsoft#2760
• [live-migration] adds the saved state proto for the controllers by @​rawahars in microsoft#2711
• Omnibus dependency update by @​helsaawy in microsoft#2769
• [internal/wclayer]: fix import temp dir leak on layer extract failure by @​anmaxvl in microsoft#2778
• [live-migration] disable log listener for migratable UVMs by @​rawahars in microsoft#2715
• gcs: keep bridge alive across live-migration transport swap by @​rawahars in microsoft#2771
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in microsoft#2782
• [internal/wclayer]: clear currentIsDir in reset deferred cleanup by @​anmaxvl in microsoft#2787
• [live-migration] adds the paths for enabling save/restore by @​rawahars in microsoft#2709
• gcs-sidecar: mark gcs-sidecar as a critical process by @​anmaxvl in microsoft#2770
• [internal/wclayer]: harden reset dir-state cleanup by @​anmaxvl in microsoft#2788
• Roll back github.com/opencontainers/selinux version by @​helsaawy in microsoft#2794
• Merge various fixes for C-LCOW since conf-aci/0.2.5 (part 3) by @​micromaomao in microsoft#2559
• service: add unit tests for LCOW v2 shim service layer by @​shreyanshjain7174 in microsoft#2649
• [live-migration] add Cancel and Cleanup RPC methods for live migration management by @​rawahars in microsoft#2798
• Makefile: Support usr-merged root filesystems by @​micromaomao in microsoft#2781
• securitypolicy: Add enforcement point for blockdev mounts by @​micromaomao in microsoft#2762
• gcs-sidecar/bridge: Do not enforce MaxMsgSize on incoming messages by @​micromaomao in microsoft#2786
• Add annotation for additional GCS args by @​helsaawy in microsoft#2805
• Add ProviderAddress Network Policy by @​daschott in microsoft#2801
• securitypolicy: Handle SCITT envelope and transparent fragments by @​micromaomao in microsoft#2779
• Bump github.com/containerd/containerd/v2 from 2.2.4 to 2.2.5 by @​dependabot[bot] in microsoft#2785
• gcs-sidecar: stage amdsnppspapi.dll into CWCOW container security-context dir by @​anmaxvl in microsoft#2802
• Add confidential WCOW debug mode and boot files overrides by @​anmaxvl in microsoft#2799
• Add Dependabot Tidy workflow for managing Go module dependencies by @​rawahars in microsoft#2810
• Add LCOW live migration support across the controller stacks by @​rawahars in microsoft#2790
• Bumps github.com/opencontainers/runc from 1.4.2 to 1.4.3 by @​jterry75 in microsoft#2814
• Bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @​dependabot[bot] in microsoft#2809
• Update open-policy-agent/opa by @​jterry75 in microsoft#2813
• Bump go.etcd.io/bbolt from 1.4.3 to 1.5.0 by @​dependabot[bot] in microsoft#2796
• build(deps): bump github.com/open-policy-agent/opa from 1.4.0 to 1.18.2 by @​dependabot[bot] in microsoft#2808
• test: fix race in TestBridge_FullReconnectCycle by @​anmaxvl in microsoft#2822
• rego: Fragment specialization by @​micromaomao in microsoft#2789
• test: use k8s.io/cri-client util for GetAddressAndDialer by @​anmaxvl in microsoft#2821
• build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by @​dependabot[bot] in microsoft#2819
• build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by @​dependabot[bot] in microsoft#2820
• build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 by @​dependabot[bot] in microsoft#2818
• Replace OpenCensus with OpenTelemetry by @​pink-milk in microsoft#2828
• [guest] back container bundle with scratch so sandbox mounts are on disk by @​rawahars in microsoft#2835
• fix(lcow/v2): report physically backed VM stats by @​shreyanshjain7174 in microsoft#2834
• rego: Platform rules support by @​micromaomao in microsoft#2792
• build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @​dependabot[bot] in microsoft#2838
• [live-migration] Preserve host-side GCS logging across migration by @​rawahars in microsoft#2826
• Add LCOW live migration source and destination APIs by @​rawahars in microsoft#2803
• minor fixes to internal otel exporter by @​anmaxvl in microsoft#2841
• cmd/containerd-shim-runhcs-v1: serialize confidential container bring-up by @​EmanuelOprea in microsoft#2804
• [bug]Message fields incorrectly deleted from GCS logs by @​helsaawy in microsoft#2844
• build(deps): bump github/codeql-action from 4 to 4.37.3 by @​dependabot[bot] in microsoft#2847
• [live-migration] Renegotiate GCS version on restore and drop Plan9 from HCS Document by @​rawahars in microsoft#2845
• build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by @​dependabot[bot] in microsoft#2850
• [live-migration] wire cancel to the HcsCancelLiveMigration API by @​rawahars in microsoft#2843
• gcs: zero-extend HRESULT codes in rpcError.Unwrap by @​rawahars in microsoft#2849
• update Go version to 1.26.0 by @​rawahars in microsoft#2853
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.60.0 to 0.69.0 by @​dependabot[bot] in microsoft#2840
• securitypolicy_options: Add {tcb,platform}-reference-info to security-context, populated from a special fragment by @​micromaomao in microsoft#2836
• Add LCOWHostNetwork annotation for host network namespace sharing by @​takuro-sato in microsoft#2851
• gcs-sidecar, resource_wcow: Don't use UVM exec to create sandbox mount sources by @​micromaomao in microsoft#2806
• migration: allow resume finalize on cancelled destination by @​rawahars in microsoft#2852
• build(deps): bump github/codeql-action from 4.37.4 to 4.37.6 by @​dependabot[bot] in microsoft#2856
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @​dependabot[bot] in microsoft#2865
• build(deps): bump go.opentelemetry.io/otel/trace from 1.44.0 to 1.45.0 by @​dependabot[bot] in microsoft#2863
• build(deps): bump github.com/open-policy-agent/opa from 1.18.2 to 1.19.0 by @​dependabot[bot] in microsoft#2860
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 by @​dependabot[bot] in microsoft#2862
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.69.0 to 0.70.0 by @​dependabot[bot] in microsoft#2864
• build(deps): bump k8s.io/cri-client from 0.34.1 to 0.36.3 in /test by @​dependabot[bot] in microsoft#2839
• CWCOW: Logging enforcement by @​takuro-sato in microsoft#2763
• GCS: periodically update cgroup limits by @​ryankeithster in microsoft#2827
• Refine the log statement in CancelMigration to include the next state by @​rawahars in microsoft#2869
• rego: Upgrade to OPA v1 by @​micromaomao in microsoft#2815
• Adopt containerd shim bootstrap protocol for options by @​rawahars in microsoft#2868
• build(deps): bump github.com/containerd/containerd/v2 from 2.3.1 to 2.3.2 by @​dependabot[bot] in microsoft#2872
• [live-migration] reconnect init stdout/stderr relay from guest on host disconnect by @​rawahars in microsoft#2867
• [live-migration] Fix source resume hang when cancelled before blackout by @​rawahars in microsoft#2871
• c-wcow policy tooling by @​anmaxvl in microsoft#2870
• add dependabot automation for updating Windows base images in Dockerfiles by @​rawahars in microsoft#2873
• build(deps): bump the microsoft_docker_images group across 4 directories with 2 updates by @​dependabot[bot] in microsoft#2874
• [live-migration] harden resume against stdio and exit wait loss by @​rawahars in microsoft#2866
• re-export PolicyWindowsContainersFromConfigs in test package by @​anmaxvl in microsoft#2875
• build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @​dependabot[bot] in microsoft#2878
• build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 by @​dependabot[bot] in microsoft#2877
• build(deps): bump github.com/cilium/ebpf from 0.17.3 to 0.22.0 by @​dependabot[bot] in microsoft#2881
• remove deprecated pkg/octtrpc by @​rawahars in microsoft#2879
• Pin GitHub Actions to full-length commit SHAs by @​danfiedler-msft in microsoft#2882
• build(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 by @​dependabot[bot] in microsoft#2884
• fix leaked layer reader which results in deadlock by @​anmaxvl in microsoft#2876
• add dependabot golang base image updates and pin lint to the go.mod Go version by @​rawahars in microsoft#2890
• build(deps): bump the microsoft_docker_images group across 2 directories with 1 update by @​dependabot[bot] in microsoft#2891
• build(deps): bump github.com/containerd/platforms from 1.0.0-rc.4 to 1.0.0-rc.5 by @​dependabot[bot] in microsoft#2887
• build(deps): bump github.com/opencontainers/cgroups from 0.0.6 to 0.1.0 by @​dependabot[bot] in microsoft#2886
• build(deps): bump advanced-security/filter-sarif from 1.0.1 to 1.1 by @​dependabot[bot] in microsoft#2885
• log all the forwarded migration notifications by @​rawahars in microsoft#2892
• build(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.22.0 by @​dependabot[bot] in microsoft#2904
• build(deps): bump k8s.io/cri-client from 0.36.3 to 0.37.0 in /test by @​dependabot[bot] in microsoft#2896
• build(deps): bump go.opentelemetry.io/otel/trace from 1.45.0 to 1.46.0 by @​dependabot[bot] in microsoft#2903
• build(deps): bump go.opentelemetry.io/otel from 1.45.0 to 1.46.0 by @​dependabot[bot] in microsoft#2901
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.70.0 to 0.71.0 by @​dependabot[bot] in microsoft#2902
• bridge: validate inbound message length by @​anmaxvl in microsoft#2908
• dmverity: validate salt size by @​anmaxvl in microsoft#2909
• group github/codeql-action/* dependabot updates into one PR by @​rawahars with @​Copilot in microsoft#2914
• build(deps): bump the codeql-action group with 3 updates by @​dependabot[bot] in microsoft#2919
• containerd-shim-lcow-v2: Fix shimManager.Stop not correctly getting the context by @​micromaomao in microsoft#2920
• hcsv2: allowlist NVIDIA GPU capability annotation values by @​anmaxvl in microsoft#2915
• gcs-sidecar: reject application name overrides by @​anmaxvl in microsoft#2917
• build(deps): bump github.com/open-policy-agent/opa from 1.19.0 to 1.20.1 by @​dependabot[bot] in microsoft#2918
• winapi: add CIM verification and block info bindings by @​anmaxvl in microsoft#2916
• Misc. containerd-shim-lcow-v2 fixes for confidential by @​micromaomao in microsoft#2906
• build(deps): bump the microsoft_docker_images group across 4 directories with 2 updates by @​dependabot[bot] in microsoft#2924
• build(deps): bump github.com/containerd/containerd/v2 from 2.3.2 to 2.3.5 by @​dependabot[bot] in microsoft#2925
• build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0 by @​dependabot[bot] in microsoft#2929
• securitypolicy tool: don't add the pause container to open-door policies by @​veerun14 in microsoft#2933
• Add RPM files by @​helsaawy in microsoft#2932
• guest: pre-create nested mount points under read-only mounts by @​jiechen0826 in microsoft#2848
• build(deps): bump the codeql-action group with 3 updates by @​dependabot[bot] in microsoft#2934
• wclayer: fix sparse file logical size by @​rzlink in microsoft#2926
• build(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0 by @​dependabot[bot] in microsoft#2938
• build(deps): bump github.com/Microsoft/cosesign1go from 1.6.0 to 1.7.0 by @​dependabot[bot] in microsoft#2937
• deps: update go-winio for sparse layer exports by @​rzlink in microsoft#2936
• cimfs: correct CimCloseStream return type by @​veerun14 in microsoft#2941
• build(deps): bump github.com/containerd/containerd/v2 from 2.3.5 to 2.3.6 by @​dependabot[bot] in microsoft#2944
• build(deps): bump the codeql-action group with 3 updates by @​dependabot[bot] in microsoft#2942
• build(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @​dependabot[bot] in microsoft#2946
• plan9: allow distinct Plan9 share configurations for the same host path by @​rawahars in microsoft#2939
• [live-migration] surface task exits through migration notifications by @​rawahars in [microsoft#2940](https://redirect.github.com/mic

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 01:00 AM and 01:59 AM, Monday through Friday (* 1 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[elastic-renovate-prod]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• The go directive was updated for compatibility reasons

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=2 days

Details:

Package	Change
go	1.26.6 -> 1.26.8

[elastic-renovate-prod]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (v0.15.0). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.