chore(deps): update module github.com/microsoft/hcsshim to v0.15.0 (main)

[elastic-renovate-prod]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/Microsoft/hcsshim	v0.15.0-rc.4 → v0.15.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

Microsoft/hcsshim (github.com/Microsoft/hcsshim)

v0.15.0

Compare Source

What's Changed

• Fix/Disable failing CI tests by @​ambarve in microsoft#2506
• Allow overriding UVM start timeout. by @​ambarve in microsoft#2501
• Omnibus dependency update by @​helsaawy in microsoft#2481
• Support for starting confidential containers by @​ambarve in microsoft#2495
• add support for resource partitions by @​anmaxvl in microsoft#2482
• Invoke fsformatter for container scratch by @​kiashok in microsoft#2498
• Minor bug fixes for CWCOW by @​ambarve in microsoft#2514
• Enable SNP for WCOW by @​takuro-sato in microsoft#2507
• guest/spec, rego, rego_test: Fix GetUserInfo by @​micromaomao in microsoft#2465
• oc/exporter: Include the name of a span in the message by @​micromaomao in microsoft#2470
• guest/storage/scsi: Print log warning if GetDevicePath blocks due to wait by @​micromaomao in microsoft#2471
• Host data validation by @​takuro-sato in microsoft#2518
• C-WCOW: SecurityPolicy implementation and tests by @​MahatiC in microsoft#2508
• Disable video console in SNP mode by @​ambarve in microsoft#2528
• fix: close handle when DeviceIoControl fails by @​anmaxvl in microsoft#2462
• Support for mounting verified merged CIMs by @​ambarve in microsoft#2530
• Add annotation flag to uvmboot by @​helsaawy in microsoft#2521
• Fix panic in HasConfidentialPolicy for LCOW. by @​ambarve in microsoft#2537
• added HCN subnet flags support by @​daschott in microsoft#2525
• gcs: do not trigger container shutdown when signaling init process by @​anmaxvl in microsoft#2538
• Support tmpfs backed sandbox mount for LCOW containers by @​jiechen0826 in microsoft#2533
• Organize Makefile variables and fix Go flags bug by @​helsaawy in microsoft#2520
• Bump actions/upload-artifact from 4 to 5 by @​dependabot[bot] in microsoft#2543
• Remove the standard JSON enforcer and the JSON policy parsing in the Rego enforcer by @​micromaomao in microsoft#2539
• Allow writable /var and /etc directories by @​helsaawy in microsoft#2522
• Set disk identifier for confidential UVM's scratch and Pass UVM measurement info to sidecar GCS by @​ambarve in microsoft#2545
• Initial multipod support by @​helsaawy in microsoft#2546
• Add LCOW logpath within uVM by @​helsaawy in microsoft#2511
• Bump golangci/golangci-lint-action from 8 to 9 by @​dependabot[bot] in microsoft#2555
• Only Reset non-nil fields. by @​helsaawy in microsoft#2558
• Security Policy: Move fragment extraction by @​MahatiC in microsoft#2542
• C-WCOW: SecurityPolicy and sidecar fixes by @​MahatiC in microsoft#2527
• fix imports in internal/gcs-sidecar/host.go by @​anmaxvl in microsoft#2567
• Adding support for WCOW UVM log forward service by @​marma-dev in microsoft#2524
• vsmb share redirector start and bind to vmbus by @​pomahade in microsoft#2560
• cwcow: Use the right VM version by @​sunilmut in microsoft#2568
• Bump actions/checkout from 5 to 6 by @​dependabot[bot] in microsoft#2565
• Bump golang.org/x/crypto from 0.41.0 to 0.45.0 in /test by @​dependabot[bot] in microsoft#2564
• Log final LCOW OCI spec; always call go in Makefile by @​helsaawy in microsoft#2570
• add EVD support for LCOW by @​anmaxvl in microsoft#2554
• Bump github/codeql-action from 3 to 4 by @​dependabot[bot] in microsoft#2532
• Bump github.com/opencontainers/runc from 1.3.0 to 1.3.3 in /test by @​dependabot[bot] in microsoft#2550
• Restore runc kill all behavior for init processes by @​helsaawy in microsoft#2573
• Verify runc error from log file by @​helsaawy in microsoft#2577
• C-WCOW: Unify data structures and reuse for C-LCOW and C-WCOW by @​MahatiC in microsoft#2544
• switch to CimWriter.dll and regenerate syscalls by @​anmaxvl in microsoft#2578
• CWCOW: Handle container remove request by @​MahatiC in microsoft#2569
• Bump actions/upload-artifact from 5 to 6 by @​dependabot[bot] in microsoft#2575
• Enforcing cgroup resource limits at the pod level within guest by @​rawahars in microsoft#2586
• rego: Allow sending SIGTERM and SIGKILL to the container init process in old policies by @​micromaomao in microsoft#2540
• Use tool directives in go.mod by @​helsaawy in microsoft#2576
• Move common confidential options for LCOW and WCOW by @​MahatiC in microsoft#2582
• Add LCOW assigned device logs; increase timeout by @​helsaawy in microsoft#2589
• remove unused remote vm implementation by @​rawahars in microsoft#2592
• CWCOW: Unmount CIM volume by @​MahatiC in microsoft#2588
• VSMB fix bugcheck by keeping handle open to empty default share by @​pomahade in microsoft#2591
• C-WCOW: Enforce hashes on already mounted CIMs by @​MahatiC in microsoft#2556
• CWCOW: roothash and graceful timeout fixes by @​MahatiC in microsoft#2593
• Fix LCOW DNS search bug by @​helsaawy in microsoft#2594
• WCOW: restore support for client-mounted roots with process-isolated containers by @​corhere in microsoft#2595
• Vendor containerd sandbox/v1 API by @​rawahars in microsoft#2599
• [forwardport]populate resolv conf from right location for multipod by @​helsaawy in microsoft#2604
• Adds VM Manager interfaces + implementation for UVM by @​rawahars in microsoft#2597
• support both cimfs and cimwriter dlls by @​anmaxvl in microsoft#2587
• refactor common uvm code into vmutils package by @​rawahars in microsoft#2607
• add and patch containerd/pkg/shim to be used with new Windows shims by @​rawahars in microsoft#2601
• adds guest manager interfaces + implementation for guest operations by @​rawahars in microsoft#2598
• CWCOW: Misc fixes by @​MahatiC in microsoft#2605
• Bump actions/upload-artifact from 6 to 7 by @​dependabot[bot] in microsoft#2610
• Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 in /test by @​dependabot[bot] in microsoft#2614
• Bump go.opentelemetry.io/otel/sdk from 1.37.0 to 1.40.0 by @​dependabot[bot] in microsoft#2615
• use CimGetVerificationInformation from cimwriter.dll by @​anmaxvl in microsoft#2608
• Bump github.com/docker/cli from 24.0.0+incompatible to 29.2.0+incompatible in /test by @​dependabot[bot] in microsoft#2623
• Bump github.com/docker/cli from 24.0.0+incompatible to 29.2.0+incompatible by @​dependabot[bot] in microsoft#2624
• shim: skip SandboxPlatform validation when platform is not explicitly set by @​rzlink in microsoft#2620
• added the VM sandbox spec used by shim to generate the HCS document for sandbox by @​rawahars in microsoft#2609
• add vmmem process lookup functionality + windows API abstraction by @​rawahars in microsoft#2613
• Refactor GCS logging and guest management for reusability by @​rawahars in microsoft#2612
• Block cim create and mount check update by @​pomahade in microsoft#2621
• jobcontainers: wire Windows CPU affinity to JobObject limits by @​wenyang in microsoft#2603
• added LCOW Builder to generate final HCS document from annotations and options by @​rawahars in microsoft#2616
• CWCOW: Include merged layer hash by @​MahatiC in microsoft#2618
• vmutils: add unit tests for allProcessEntries & LookupVMMEM by @​shreyanshjain7174 in microsoft#2628
• Embedding ETW Name-GUID Mapping for Log Forward Service by @​marma-dev in microsoft#2617
• CWCOW: Enforce registry entries on containers by @​MahatiC in microsoft#2611
• Bump google.golang.org/grpc from 1.75.0 to 1.79.3 in /test by @​dependabot[bot] in microsoft#2636
• [LCOW Builder] fix CPUGroup, VPMEM controller and StorageQoS parsing by @​rawahars in microsoft#2630
• adds containerd-shim-lcow-v2 shim by @​rawahars in microsoft#2627
• Bump google.golang.org/grpc from 1.75.0 to 1.79.3 by @​dependabot[bot] in microsoft#2637
• parity: add LCOW HCS document parity tests between legacy and v2 builders by @​shreyanshjain7174 in microsoft#2629
• [shimV2] Implements the VM SCSI Controller by @​jterry75 in microsoft#2651
• [shimV2] Implements the VM VPMem Controller by @​jterry75 in microsoft#2652
• fix: plumbing security policy fragments by @​anmaxvl in microsoft#2642
• Merge various fixes for C-LCOW since conf-aci/0.2.5 (part 1) by @​micromaomao in microsoft#2581
• Add the internal/computecore package by @​jterry75 in microsoft#2654
• Fixes the go fmt for internal/hcs/schema2 by @​jterry75 in microsoft#2657
• Add cgroup v2 support while maintaining v1 compatibility by @​jiechen0826 in microsoft#2632
• init: Add Ubuntu support for module loading and entropy initialization by @​jiechen0826 in microsoft#2650
• Adding support for ARM64 LCOW by @​marma-dev in microsoft#2606
• [shimV2] Introduce locking at guestmanager layer by @​rawahars in microsoft#2638
• [shimV2] adds vpci device controller by @​rawahars in microsoft#2643
• [shimV2] added network controller implementation by @​rawahars in microsoft#2633
• [shimV2] refactor scsi device controller to V2 template by @​rawahars in microsoft#2660
• Update setup-go version; lint build tags by @​helsaawy in microsoft#2670
• [shimV2] refactor SCSI package to unify the interfaces with build tagged files by @​rawahars in microsoft#2666
• Bump github.com/opencontainers/selinux from 1.12.0 to 1.13.0 in /test by @​dependabot[bot] in microsoft#2557
• Bug fix for leaked LCOW resources; expand logs by @​helsaawy in microsoft#2655
• add functional tests for cgroup v2 in gcs by @​jiechen0826 in microsoft#2664
• Omnibus dependency updates; switch to pointer field for LinuxPids.Limit by @​helsaawy in microsoft#2682
• Log cimwriter.dll version on load by @​anmaxvl in microsoft#2684
• [shimV2] add plan9 device controller by @​rawahars in microsoft#2641
• [shimV2] [VM controller] refactor + adds Update + Device controllers by @​rawahars in microsoft#2663
• [shimV2] refactor VM controller + network controller by @​rawahars in microsoft#2690
• guest: use OCIBundlePath as sandbox root source of truth by @​shreyanshjain7174 in microsoft#2653
• Adds live migration ttrpc service definition by @​rawahars in microsoft#2691
• adds HCS live migration APIs by @​rawahars in microsoft#2686
• [live-migration] replace event/error strings with structured MigrationNotification by @​rawahars in microsoft#2697
• [shimV2] adds core pod, container and process controllers by @​rawahars in microsoft#2674
• [shimV2] implements task, shimdiag service and wires up pod/container controllers by @​rawahars in microsoft#2685
• [live-migration]: add sandbox_id to ImportSandboxRequest rpc by @​rawahars in microsoft#2702
• [live-migration] deliver structured live migration notifications end to end by @​rawahars in microsoft#2696
• [shimV2] Remove vpmem controller and related config from V2 shim code paths by @​rawahars in microsoft#2703
• [shimV2] Refactor V2 shim for platform consistency and remove vPMem support in v2 LCOW by @​rawahars in microsoft#2701
• [live-migration] add live migration annotations by @​rawahars in microsoft#2704
• Use VS SDK to create syso file from Manifest by @​helsaawy in microsoft#2694
• [live-migration] remove compatibility info from options proto by @​rawahars in microsoft#2708
• bridge: add guest-side reconnect loop for live migration by @​shreyanshjain7174 in microsoft#2698
• C-WCOW: Add mounted_cim check in enforcement by @​MahatiC in microsoft#2692
• controller/network: add unit tests for network controller by @​shreyanshjain7174 in microsoft#2647
• Remove unused fields from LCOW SandboxOptions by @​rawahars with @​Copilot in microsoft#2719
• parity: add LCOW document permutation tests by @​shreyanshjain7174 in microsoft#2631
• Fix builds: Remove vpmem multimapping annotation from parity tests by @​rawahars in microsoft#2722
• Document the LCOW V2 containerd shim in README by @​rawahars with @​Copilot in microsoft#2720
• cgroup: add BPF probe for v1 fallback and improve GCS error diagnostic by @​jiechen0826 in microsoft#2716
• [shimV2] bind GCS/host hvsock listeners before starting the UVM by @​rawahars in microsoft#2723
• plumb ResourcePartitionId to HCS by @​anmaxvl in microsoft#2712
• update hcs.Start to use HCS V1 API by @​rawahars in microsoft#2729
• Enable log scrubbing by default by @​ryankeithster in microsoft#2725
• guest: unify pod model for V1, virtual pod, and V2 shim support by @​shreyanshjain7174 in microsoft#2699
• [shimV2] order container teardown so the UVM can reap bundle dirs by @​rawahars in microsoft#2737
• guest/spec: remove VirtualPod path helpers and dead code by @​shreyanshjain7174 in microsoft#2736
• uvm: omit default WCIFS FilterType for older GCS compatibility by @​rawahars in microsoft#2739
• Bump google.golang.org/grpc from 1.80.0 to 1.81.1 in /test by @​dependabot[bot] in microsoft#2740
• [shimV2] Fix guest/VM exit on their own by @​rawahars in microsoft#2743
• gcs: fix flaky test on bridge teardown race by @​shreyanshjain7174 in microsoft#2744
• test/util: add arm64 to aarch64 translation in translateGOARCH by @​AdityaMittal1306 in microsoft#2746
• HostProcess containers with Hypervisor Isolation by @​rawahars in microsoft#2531
• [cherry-pick] Update CgroupsPath to include container ID for sandbox container by @​rawahars in microsoft#2754
• jobobject,jobcontainers,hcsoci: add CPU group affinity support for job-object containers by @​wenyang in microsoft#2693
• pkg/securitypolicy: Trim whitespaces from version_{api,framework} to allow trailing newlines by @​micromaomao in microsoft#2761
• always set SecurityPolicyEnabled when policy is present by @​anmaxvl in microsoft#2748
• [tooling]: add SIGKILL and SIGTERM to pause container signals by @​anmaxvl in microsoft#2750
• ensure consistent error message as V1 shim by @​rawahars in microsoft#2767
• fix: enlighten lcow uvmboot with dm-verity boot by @​anmaxvl in microsoft#2766
• Bypass default encryption policy when expanding sandbox vhdx by @​mendsley in microsoft#2572
• rego: Introduce metadata rollback and enhance handling of mount failures in C-LCOW by @​micromaomao in microsoft#2768
• hcsoci,hcs,shim: honor CPU affinity for Argon containers by @​zylxjtu in microsoft#2764
• [internal/hcs] Migrate package from HCS V1 to V2 by @​rawahars in microsoft#2735
• Plumb hash_envelope_reference_info.cose by @​anmaxvl in microsoft#2622
• Fix pause container of a privileged pod unable to start due to /sys mount option mismatch by @​micromaomao in microsoft#2760
• [live-migration] adds the saved state proto for the controllers by @​rawahars in microsoft#2711
• Omnibus dependency update by @​helsaawy in microsoft#2769
• [internal/wclayer]: fix import temp dir leak on layer extract failure by @​anmaxvl in microsoft#2778
• [live-migration] disable log listener for migratable UVMs by @​rawahars in microsoft#2715
• gcs: keep bridge alive across live-migration transport swap by @​rawahars in microsoft#2771
• Bump actions/checkout from 6 to 7 by @​dependabot[bot] in microsoft#2782
• [internal/wclayer]: clear currentIsDir in reset deferred cleanup by @​anmaxvl in microsoft#2787
• [live-migration] adds the paths for enabling save/restore by @​rawahars in microsoft#2709
• gcs-sidecar: mark gcs-sidecar as a critical process by @​anmaxvl in microsoft#2770
• [internal/wclayer]: harden reset dir-state cleanup by @​anmaxvl in microsoft#2788
• Roll back github.com/opencontainers/selinux version by @​helsaawy in microsoft#2794
• Merge various fixes for C-LCOW since conf-aci/0.2.5 (part 3) by @​micromaomao in microsoft#2559
• service: add unit tests for LCOW v2 shim service layer by @​shreyanshjain7174 in microsoft#2649
• [live-migration] add Cancel and Cleanup RPC methods for live migration management by @​rawahars in microsoft#2798
• Makefile: Support usr-merged root filesystems by @​micromaomao in microsoft#2781
• securitypolicy: Add enforcement point for blockdev mounts by @​micromaomao in microsoft#2762
• gcs-sidecar/bridge: Do not enforce MaxMsgSize on incoming messages by @​micromaomao in microsoft#2786
• Add annotation for additional GCS args by @​helsaawy in microsoft#2805
• Add ProviderAddress Network Policy by @​daschott in microsoft#2801
• securitypolicy: Handle SCITT envelope and transparent fragments by @​micromaomao in microsoft#2779
• Bump github.com/containerd/containerd/v2 from 2.2.4 to 2.2.5 by @​dependabot[bot] in microsoft#2785
• gcs-sidecar: stage amdsnppspapi.dll into CWCOW container security-context dir by @​anmaxvl in microsoft#2802
• Add confidential WCOW debug mode and boot files overrides by @​anmaxvl in microsoft#2799
• Add Dependabot Tidy workflow for managing Go module dependencies by @​rawahars in microsoft#2810
• Add LCOW live migration support across the controller stacks by @​rawahars in microsoft#2790
• Bumps github.com/opencontainers/runc from 1.4.2 to 1.4.3 by @​jterry75 in microsoft#2814
• Bump google.golang.org/grpc from 1.81.1 to 1.82.0 by @​dependabot[bot] in microsoft#2809
• Update open-policy-agent/opa by @​jterry75 in microsoft#2813
• Bump go.etcd.io/bbolt from 1.4.3 to 1.5.0 by @​dependabot[bot] in microsoft#2796
• build(deps): bump github.com/open-policy-agent/opa from 1.4.0 to 1.18.2 by @​dependabot[bot] in microsoft#2808
• test: fix race in TestBridge_FullReconnectCycle by @​anmaxvl in microsoft#2822
• rego: Fragment specialization by @​micromaomao in microsoft#2789
• test: use k8s.io/cri-client util for GetAddressAndDialer by @​anmaxvl in microsoft#2821
• build(deps): bump golang.org/x/sync from 0.21.0 to 0.22.0 by @​dependabot[bot] in microsoft#2819
• build(deps): bump golang.org/x/sys from 0.46.0 to 0.47.0 by @​dependabot[bot] in microsoft#2820
• build(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 by @​dependabot[bot] in microsoft#2818
• Replace OpenCensus with OpenTelemetry by @​pink-milk in microsoft#2828
• [guest] back container bundle with scratch so sandbox mounts are on disk by @​rawahars in microsoft#2835
• fix(lcow/v2): report physically backed VM stats by @​shreyanshjain7174 in microsoft#2834
• rego: Platform rules support by @​micromaomao in microsoft#2792
• build(deps): bump google.golang.org/grpc from 1.82.0 to 1.82.1 by @​dependabot[bot] in microsoft#2838
• [live-migration] Preserve host-side GCS logging across migration by @​rawahars in microsoft#2826
• Add LCOW live migration source and destination APIs by @​rawahars in microsoft#2803
• minor fixes to internal otel exporter by @​anmaxvl in microsoft#2841
• cmd/containerd-shim-runhcs-v1: serialize confidential container bring-up by @​EmanuelOprea in microsoft#2804
• [bug]Message fields incorrectly deleted from GCS logs by @​helsaawy in microsoft#2844
• build(deps): bump github/codeql-action from 4 to 4.37.3 by @​dependabot[bot] in microsoft#2847
• [live-migration] Renegotiate GCS version on restore and drop Plan9 from HCS Document by @​rawahars in microsoft#2845
• build(deps): bump github/codeql-action from 4.37.3 to 4.37.4 by @​dependabot[bot] in microsoft#2850
• [live-migration] wire cancel to the HcsCancelLiveMigration API by @​rawahars in microsoft#2843
• gcs: zero-extend HRESULT codes in rpcError.Unwrap by @​rawahars in microsoft#2849
• update Go version to 1.26.0 by @​rawahars in microsoft#2853
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.60.0 to 0.69.0 by @​dependabot[bot] in microsoft#2840
• securitypolicy_options: Add {tcb,platform}-reference-info to security-context, populated from a special fragment by @​micromaomao in microsoft#2836
• Add LCOWHostNetwork annotation for host network namespace sharing by @​takuro-sato in microsoft#2851
• gcs-sidecar, resource_wcow: Don't use UVM exec to create sandbox mount sources by @​micromaomao in microsoft#2806
• migration: allow resume finalize on cancelled destination by @​rawahars in microsoft#2852
• build(deps): bump github/codeql-action from 4.37.4 to 4.37.6 by @​dependabot[bot] in microsoft#2856
• build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.0 by @​dependabot[bot] in microsoft#2865
• build(deps): bump go.opentelemetry.io/otel/trace from 1.44.0 to 1.45.0 by @​dependabot[bot] in microsoft#2863
• build(deps): bump github.com/open-policy-agent/opa from 1.18.2 to 1.19.0 by @​dependabot[bot] in microsoft#2860
• build(deps): bump go.opentelemetry.io/otel/sdk from 1.44.0 to 1.45.0 by @​dependabot[bot] in microsoft#2862
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.69.0 to 0.70.0 by @​dependabot[bot] in microsoft#2864
• build(deps): bump k8s.io/cri-client from 0.34.1 to 0.36.3 in /test by @​dependabot[bot] in microsoft#2839
• CWCOW: Logging enforcement by @​takuro-sato in microsoft#2763
• GCS: periodically update cgroup limits by @​ryankeithster in microsoft#2827
• Refine the log statement in CancelMigration to include the next state by @​rawahars in microsoft#2869
• rego: Upgrade to OPA v1 by @​micromaomao in microsoft#2815
• Adopt containerd shim bootstrap protocol for options by @​rawahars in microsoft#2868
• build(deps): bump github.com/containerd/containerd/v2 from 2.3.1 to 2.3.2 by @​dependabot[bot] in microsoft#2872
• [live-migration] reconnect init stdout/stderr relay from guest on host disconnect by @​rawahars in microsoft#2867
• [live-migration] Fix source resume hang when cancelled before blackout by @​rawahars in microsoft#2871
• c-wcow policy tooling by @​anmaxvl in microsoft#2870
• add dependabot automation for updating Windows base images in Dockerfiles by @​rawahars in microsoft#2873
• build(deps): bump the microsoft_docker_images group across 4 directories with 2 updates by @​dependabot[bot] in microsoft#2874
• [live-migration] harden resume against stdio and exit wait loss by @​rawahars in microsoft#2866
• re-export PolicyWindowsContainersFromConfigs in test package by @​anmaxvl in microsoft#2875
• build(deps): bump github/codeql-action from 4.37.6 to 4.37.7 by @​dependabot[bot] in microsoft#2878
• build(deps): bump golang.org/x/net from 0.57.0 to 0.58.0 by @​dependabot[bot] in microsoft#2877
• build(deps): bump github.com/cilium/ebpf from 0.17.3 to 0.22.0 by @​dependabot[bot] in microsoft#2881
• remove deprecated pkg/octtrpc by @​rawahars in microsoft#2879
• Pin GitHub Actions to full-length commit SHAs by @​danfiedler-msft in microsoft#2882
• build(deps): bump github.com/sirupsen/logrus from 1.9.4 to 1.10.0 by @​dependabot[bot] in microsoft#2884
• fix leaked layer reader which results in deadlock by @​anmaxvl in microsoft#2876
• add dependabot golang base image updates and pin lint to the go.mod Go version by @​rawahars in microsoft#2890
• build(deps): bump the microsoft_docker_images group across 2 directories with 1 update by @​dependabot[bot] in microsoft#2891
• build(deps): bump github.com/containerd/platforms from 1.0.0-rc.4 to 1.0.0-rc.5 by @​dependabot[bot] in microsoft#2887
• build(deps): bump github.com/opencontainers/cgroups from 0.0.6 to 0.1.0 by @​dependabot[bot] in microsoft#2886
• build(deps): bump advanced-security/filter-sarif from 1.0.1 to 1.1 by @​dependabot[bot] in microsoft#2885
• log all the forwarded migration notifications by @​rawahars in microsoft#2892
• build(deps): bump github.com/google/go-containerregistry from 0.21.6 to 0.22.0 by @​dependabot[bot] in microsoft#2904
• build(deps): bump k8s.io/cri-client from 0.36.3 to 0.37.0 in /test by @​dependabot[bot] in microsoft#2896
• build(deps): bump go.opentelemetry.io/otel/trace from 1.45.0 to 1.46.0 by @​dependabot[bot] in microsoft#2903
• build(deps): bump go.opentelemetry.io/otel from 1.45.0 to 1.46.0 by @​dependabot[bot] in microsoft#2901
• build(deps): bump go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc from 0.70.0 to 0.71.0 by @​dependabot[bot] in microsoft#2902
• bridge: validate inbound message length by @​anmaxvl in microsoft#2908
• dmverity: validate salt size by @​anmaxvl in microsoft#2909
• group github/codeql-action/* dependabot updates into one PR by @​rawahars with @​Copilot in microsoft#2914
• build(deps): bump the codeql-action group with 3 updates by @​dependabot[bot] in microsoft#2919
• containerd-shim-lcow-v2: Fix shimManager.Stop not correctly getting the context by @​micromaomao in microsoft#2920
• hcsv2: allowlist NVIDIA GPU capability annotation values by @​anmaxvl in microsoft#2915
• gcs-sidecar: reject application name overrides by @​anmaxvl in microsoft#2917
• build(deps): bump github.com/open-policy-agent/opa from 1.19.0 to 1.20.1 by @​dependabot[bot] in microsoft#2918
• winapi: add CIM verification and block info bindings by @​anmaxvl in microsoft#2916
• Misc. containerd-shim-lcow-v2 fixes for confidential by @​micromaomao in microsoft#2906
• build(deps): bump the microsoft_docker_images group across 4 directories with 2 updates by @​dependabot[bot] in microsoft#2924
• build(deps): bump github.com/containerd/containerd/v2 from 2.3.2 to 2.3.5 by @​dependabot[bot] in microsoft#2925
• build(deps): bump golang.org/x/net from 0.58.0 to 0.59.0 by @​dependabot[bot] in microsoft#2929
• securitypolicy tool: don't add the pause container to open-door policies by @​veerun14 in microsoft#2933
• Add RPM files by @​helsaawy in microsoft#2932
• guest: pre-create nested mount points under read-only mounts by @​jiechen0826 in microsoft#2848
• build(deps): bump the codeql-action group with 3 updates by @​dependabot[bot] in microsoft#2934
• wclayer: fix sparse file logical size by @​rzlink in microsoft#2926
• build(deps): bump github.com/cyphar/filepath-securejoin from 0.6.1 to 0.7.0 by @​dependabot[bot] in microsoft#2938
• build(deps): bump github.com/Microsoft/cosesign1go from 1.6.0 to 1.7.0 by @​dependabot[bot] in microsoft#2937
• deps: update go-winio for sparse layer exports by @​rzlink in microsoft#2936
• cimfs: correct CimCloseStream return type by @​veerun14 in microsoft#2941
• build(deps): bump github.com/containerd/containerd/v2 from 2.3.5 to 2.3.6 by @​dependabot[bot] in microsoft#2944
• build(deps): bump the codeql-action group with 3 updates by @​dependabot[bot] in microsoft#2942
• build(deps): bump google.golang.org/grpc from 1.83.2 to 1.84.0 by @​dependabot[bot] in microsoft#2946
• plan9: allow distinct Plan9 share configurations for the same host path by @​rawahars in microsoft#2939
• [live-migration] surface task exits through migration notifications by @​rawahars in [microsoft#2940](https://redirect.github.com/mic

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 01:00 AM and 01:59 AM, Monday through Friday (* 1 * * 1-5)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[elastic-renovate-prod]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

go: go.mod requires go >= 1.27.2 (running go 1.27.1; GOTOOLCHAIN=local)