[release/1.6] Prepare release notes for v1.6.18

[dmcgowan]

Generated release notes

---

containerd 1.6.18

Welcome to the v1.6.18 release of containerd!

The eighteenth patch release for containerd 1.6 includes fixes for CVE-2023-25153 and CVE-2023-25173
along with a security update for Go.

Notable Updates

• Fix OCI image importer memory exhaustion (GHSA-259w-8hf6-59c2)
• Fix supplementary groups not being set up properly (GHSA-hmfx-3pcx-653p)
• Revert removal of /sbin/apparmor_parser check (#8087)
• Update Go to 1.19.6 (#8111)

See the changelog for complete list of changes

Please try out the release binaries and report any issues at
https://github.com/containerd/containerd/issues.

Contributors

• Akihiro Suda
• Ye Sijun
• Derek McGowan
• Samuel Karp
• Bjorn Neergaard
• Wei Fu
• Brian Goff
• Iceber Gu
• Kazuyoshi Kato
• Phil Estes
• Swagat Bora

Changes

23 commits

• 44e61d764 Add release notes for v1.6.18
• Github Security Advisory GHSA-hmfx-3pcx-653p
  • 286a01f35 oci: fix additional GIDs
  • 301823453 oci: fix loop iterator aliasing
  • 0070ab70f oci: skip checking gid for WithAppendAdditionalGroups
  • 16d52de64 refactor: reduce duplicate code
  • b45e30292 add WithAdditionalGIDs test
  • 0a06c284a add WithAppendAdditionalGroups helper
• Github Security Advisory GHSA-259w-8hf6-59c2
  • 84936fd1f importer: stream oci-layout and manifest.json
• [1.6] Add fallback for windows platforms without osversion (#8106)
  • b327af6a4 Add fallback for windows platforms without osversion
• [release/1.6] Go 1.19.6 (#8111)
  • 54ead5b7b Go 1.19.6
• [release/1.6] ctr/run: flags --detach and --rm cannot be specified together (#8094)
  • 2b4b35ab4 ctr/run: flags --detach and --rm cannot be specified together
• [release/1.6] Fix retry logic within devmapper device deactivation (#8088)
  • d5284157b Fix retry logic within devmapper device deactivation
• [release/1.6 backport] Revert apparmor_parser regression (#8087)
  • 624ff636b pkg/apparmor: clarify Godoc
  • 3a0a35b36 Revert "Don't check for apparmor_parser to be present"
• [release/1.6] CI: skip some jobs when repo != containerd/containerd (#8083)
  • 664a938a3 CI: skip some jobs when repo != containerd/containerd

Dependency Changes

This release has no dependency changes

Previous release can be found at v1.6.17

[thaJeztah]

Oh! I keep forgetting to ask; is there a reason we always use "+unknown" for the actual released tag? Should it be without (and the +unknown added back after that?)

[estesp]

I always assumed this was to clearly show a binary that was built outside the Makefile process (e.g. go install?) so that you can differentiate it from an official build via the Makefile; if you build via the Makefile then this whole string is replaced with:

VERSION ?= $(shell git describe --match 'v[0-9]*' --dirty='.m' --always)

[thaJeztah]

I wasn't sure what the reason was; I know runc uses +dev after releasing (release PR contains 2 commits, and the first one is tagged).

Currently, I think code using containerd as a dependency gets the +unknown (which made me look a few times if I was actually using the tagged relese), which also is included in the user agent (as default, that is)

[thaJeztah]

LGTM