chore(deps): bump github.com/containerd/containerd from 1.7.30 to 1.7.33

[dependabot]

Bumps github.com/containerd/containerd from 1.7.30 to 1.7.33.

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.33

Welcome to the v1.7.33 release of containerd!

The thirty-third patch release for containerd 1.7 contains various fixes and updates including security patches.

Security Updates

• containerd

  • CVE-2026-53488
  • CVE-2026-47262

• go-jose

  • CVE-2026-34986

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Chris Henzie
• Akihiro Suda
• Akhil Mohan
• Ben Cressey
• Davanum Srinivas
• Sopho Merkviladze

Changes

• Prepare release notes for v1.7.33 (#13631)
  • 7517e6737 Prepare release notes for v1.7.33
  • ab306518a Merge commit from fork
  • d34cdafda Merge commit from fork
  • 9ab2b7a89 Bound user-database file reads in openBoundedUserFile
  • 1e9806f90 Merge commit from fork
  • 4d8ba4d23 Do not propagate reserved labels from image configs
• update runc binary to v1.3.6 (#13615)
  • 74c728c13 update runc binary to v1.3.6
• update go to 1.26.4/1.25.11 (#13579)
  • 947caa4b7 update go to 1.26.4/1.25.11
• Configure udevd children-max for root-test (#13564)
  • e884e964e Configure udevd children-max for root-test
• Clean up disk space in node e2e workflow (#13552)
  • b9e756888 Clean up disk space in node e2e workflow
• Bump go-jose/go-jose/v3 to v3.0.5 to fix GHSA-78h2-9frx-2jm8 (#13467)
  • 4dfc1844e Bump go-jose to v3.0.5 to address CVE-2026-34986

... (truncated)

Commits

• e8b1a9b Merge pull request #13631 from samuelkarp/prepare-1.7.33
• 7517e67 Prepare release notes for v1.7.33
• ab30651 Merge commit from fork
• 0962898 Merge pull request #13615 from k8s-infra-cherrypick-robot/cherry-pick-13606-t...
• 74c728c update runc binary to v1.3.6
• d34cdaf Merge commit from fork
• 1e9806f Merge commit from fork
• 9ab2b7a Bound user-database file reads in openBoundedUserFile
• d805d96 Merge pull request #13579 from akhilerm/1.7-go1.26.4
• 947caa4 update go to 1.26.4/1.25.11
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 duplication

Metric	Results
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The update to github.com/containerd/containerd to address known vulnerabilities is appropriate. However, analysis of the go.mod file reveals additional high-severity security risks that remain unmitigated. Vulnerabilities involving certificate hostname verification (CVE-2026-27145) and improper HTML parsing (CVE-2026-42506, CVE-2026-42502) have been identified. These issues should be resolved to prevent potential Man-in-the-Middle (MITM) attacks and execution risks before concluding the dependency maintenance.

2 comments outside of the diff

go.mod

_{line 3 🔴 HIGH RISK}
The environment configuration is susceptible to a security vulnerability (CVE-2026-27145) related to VerifyHostname, which may allow certificate hostname verification bypass and increase the risk of Man-in-the-Middle (MITM) attacks.

_{line 375 🔴 HIGH RISK}
The golang.org/x/net dependency is associated with security vulnerabilities (CVE-2026-42506, CVE-2026-42502) involving improper HTML parsing and rendering. Addressing these risks is necessary for secure operation.

Test suggestions

• Verify that the project build and integration tests pass with the updated containerd dependency.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify that the project build and integration tests pass with the updated containerd dependency.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}