Bump github.com/opencontainers/runc from 1.3.3 to 1.3.4

[dependabot]

Bumps github.com/opencontainers/runc from 1.3.3 to 1.3.4.

Changelog

Sourced from github.com/opencontainers/runc's changelog.

[1.3.4] - 2025-11-27

Take me to your heart, take me to your soul.

Fixed

• libct: fix mips compilation. (#4962, #4966)
• When configuring a tmpfs mount, only set the mode= argument if the target path already existed. This fixes a regression introduced in our CVE-2025-52881 mitigation patches. (#4971, #4976)
• Fix various file descriptor leaks and add additional tests to detect them as comprehensively as possible. (#5007, #5021, #5034)

Changed

• Downgrade github.com/cyphar/filepath-securejoin dependency to v0.5.2, which should make it easier for some downstreams to import runc without pulling in too many extra packages. (#5028)

[1.2.9] - 2025-11-27

Stars hide your fires, let me rest tonight.

Fixed

• libct: fix mips compilation. (#4962, #4965)
• When configuring a tmpfs mount, only set the mode= argument if the target path already existed. This fixes a regression introduced in our CVE-2025-52881 mitigation patches. (#4971, #4974)
• Fix various file descriptor leaks and add additional tests to detect them as comprehensively as possible. (#5007, #5021, #5027)

Changed

• Downgrade github.com/cyphar/filepath-securejoin dependency to v0.5.2, which should make it easier for some downstreams to import runc without pulling in too many extra packages. (#5027)

[1.4.0-rc.3] - 2025-11-05

その日、人類は思い出した。

Security

This release includes fixes for the following high-severity security issues:

• [CVE-2025-31133][] exploits an issue with how masked paths are implemented in runc. When masking files, runc will bind-mount the container's /dev/null inode on top of the file. However, if an attacker can replace /dev/null with a symlink to some other procfs file, runc will instead bind-mount the

... (truncated)

Commits

• d6d73eb VERSION: release 1.3.4
• 2e68e04 Merge pull request #5042 from lifubang/backport-5014-fd-leaks-flake-1.3
• e1a6adc libct/int: TestFdLeaks: deflake
• cef8c32 Merge pull request #5028 from lifubang/ci-detect-fdleak-try-best-1.3
• ebea1f8 integration: verify syscall compatibility after seccomp enforcement
• 34e8458 downgrade github.com/cyphar/filepath-securejoin from v0.6.0 to v0.5.2
• ae8839a bump github.com/opencontainers/s
• 52192a8 libct: add a defer fd close in createDeviceNode
• 98dc593 libct: always close m.dstFile in mountToRootfs
• 167fa3f ci: detect file descriptor leaks as comprehensively as possible
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[elezar]

@dependabot rebase

[elezar]

/ok-to-test da33d3b

[coveralls]

Pull Request Test Coverage Report for Build 19896217309

Details

• 0 of 0 changed or added relevant lines in 0 files are covered.
• No unchanged relevant lines lost coverage.
• Overall coverage remained the same at 37.861%

---

Totals
Change from base Build 19859258189:	0.0%
Covered Lines:	5157
Relevant Lines:	13621

---

💛 - Coveralls