chore(deps): update containerd (main)

[elastic-renovate-prod]

This PR contains the following updates:

Package	Type	Update	Change
github.com/containerd/containerd	indirect	patch	v1.7.31 -> v1.7.32
github.com/containerd/containerd/api	indirect	patch	v1.11.0 -> v1.11.1
github.com/containerd/containerd/v2	indirect	patch	v2.3.0 -> v2.3.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

containerd/containerd (github.com/containerd/containerd)

v1.7.32: containerd 1.7.32

Compare Source

Welcome to the v1.7.32 release of containerd!

The thirty-second patch release for containerd 1.7 contains various fixes
and updates including a security patch.

• containerd

  • CVE-2026-46680

• Allow hosts.toml to contain only root-level fields without an explicit [host] section (#​10028)

• Fix handling of out-of-range USER values in OCI spec to avoid unexpected username/group lookups (#​13450)

• Apply hardening to block AF_ALG in default socket policy (#​13406)

• Support both "volatile" and "fsync=volatile" mount options for volatile snapshotter (#​13299)

• Set AppArmor abi conditionally to support versions < 3.0 (#​13273)

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

• Maksym Pavlenko
• Chris Henzie
• Derek McGowan
• Paweł Gronowski
• Samuel Karp
• Wei Fu
• Brad Davidson
• Brian Goff
• LEI WANG
• Phil Estes

17 commits

• bc87d865c Prepare release notes for v1.7.32
• oci: return explicit error for out-of-range USER values (#​13450)
  • 503f47946 oci: return explicit error for out-of-range USER values
• seccomp: Block AF_ALG in default socket policy (#​13406)
  • e55b747d3 seccomp: Block AF_ALG in default socket policy
  • 4627a65f8 seccomp: Document socket rule scope and socketcall limitation
• Fix issue with empty host tree in hosts.toml (#​10028)
  • 24007441d Fix error parsing hosts.toml without any host tree
• Support both styles of volatile mount option (#​13299)
  • 940733149 Support both styles of volatile mount option
• apparmor: Set abi conditionally (#​13273)
  • 2b732c892 apparmor: Set abi conditionally
• Add GitHub Action for k8s node e2e tests (#​13258)
  • 0db1e143a Add GitHub Action for k8s node e2e tests
• Update release process after 1.7 (#​13236)
  • 3223a75c2 Update for latest updates to release tool
  • 1b30082eb Update release process after 1.7

This release has no dependency changes

Previous release can be found at v1.7.31

---

Configuration

📅 Schedule: Branch creation - "* 1 * * 1-5" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.