Bump github.com/containerd/containerd from 1.7.33 to 1.7.35

[dependabot]

Bumps github.com/containerd/containerd from 1.7.33 to 1.7.35.

Release notes

Sourced from github.com/containerd/containerd's releases.

containerd 1.7.35

Welcome to the v1.7.35 release of containerd!

The thirty-fifth patch release for containerd 1.7 contains various fixes and updates including security patches.

Security Updates

• containerd
  • CVE-2026-53495
  • GHSA-rp3h-jf77-q9p4

Highlights

Image Distribution

• Apply hardening to strip sensitive authentication headers when fetching descriptor URLs (#14046)

Runtime

• Enable log scrubbing by default on Windows (#13889)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Samuel Karp
• Oleh Konko
• Chris Henzie
• Maksym Pavlenko
• Phil Estes
• XlabAI

Changes

• 05aa78da3 Prepare release notes for v1.7.35
• 3bd79bb36 Merge commit from fork
• 5a2a3a759 cri: cancel ExecSync IO drain on context cancellation
• 323e148f2 Merge commit from fork
• 9205b1903 archive: skip redundant opaque whiteout walks
• docker fetcher: strip sensitive headers on descriptor URLs (#14046)
  • b01d66349 core/remotes/docker: normalize descriptor URL origins
  • b5d936dca core/remotes/docker: strip sensitive headers on desc.urls fetch
• Use ScrubLogs by default on Windows (#13889)
  • cff94ea40 ctr: add --scrub-logs flag for Windows
  • 544e4657d cri/config: use ScrubLogs by default on Windows
• ci: bound Go fuzzing by execution count (#13788)

... (truncated)

Commits

• 0fab6e1 Merge pull request #14099 from samuelkarp/prepare-release-1.7.35
• e5ae3c7 Prepare release notes for v1.7.35
• 3bd79bb Merge commit from fork
• 323e148 Merge commit from fork
• 5a2a3a7 cri: cancel ExecSync IO drain on context cancellation
• 9205b19 archive: skip redundant opaque whiteout walks
• 994fd09 Merge pull request #14046 from samuelkarp/cherry-pick-12889-to-release/1.7
• b01d663 core/remotes/docker: normalize descriptor URL origins
• b5d936d core/remotes/docker: strip sensitive headers on desc.urls fetch
• fd2d9b6 Merge pull request #13889 from samuelkarp/hcsshim-scrub-logs-1.7
• Additional commits viewable in compare view

[ai-collaboration-app]

Independent review at 5d02d81d013cbf4e01be874a15ee5dd045f42052: source and CI correction required. OTel status's go mod tidy -diff fails on an unused google.golang.org/genproto checksum while the default module passes. Reconcile the OTel manifest changes with the repository sync/tidy procedure. Workspace and standalone tests pass; containerd release graphs and the cancellation regression are correct, but packaged binaries remain unverified.

All three exact-head workflows still fail; empty registry credentials block prerequisites. Restore the authorized CI credential path and reconcile the held writer claim before source work, then obtain green checks, architecture-specific artifact evidence and independent review of the changed head. Reviewer and exact tidy diff; coordination. Critical curl work and #511's human disposition remain separate.