Bumps [containerd/project-checks](https://github.com/containerd/project-checks) from 1.1.0 to 1.2.1.
- [Commits](containerd/project-checks@434a071...800740a)

---
updated-dependencies:
- dependency-name: containerd/project-checks
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <[email protected]>
(cherry picked from commit 69c0d7f)
Signed-off-by: Akhil Mohan <[email protected]>

[release/2.0] build(deps): bump containerd/project-checks from 1.1.0 to 1.2.1

use the shim bundled with cri-cni-containerd tar rather than using
the shim present on the host machine for running e2e

Signed-off-by: Akhil Mohan <[email protected]>

We changed the default setting for `enable_unprivileged_ports` and
`enable_unprivileged_icmp` in the CRI plugin in
#9348, but missed including
this change in the release notes.

Signed-off-by: Samuel Karp <[email protected]>

…-11489-to-release/2.0

[release/2.0] e2e: use the shim bundled with containerd artifact

…-11502-to-release/2.0

[release/2.0] docs: include note about unprivileged sysctls

- go1.23.7 (released 2025-03-04) includes security fixes to the net/http
package, as well as bug fixes to cgo, the compiler, and the reflect,
runtime, and syscall packages. See the Go 1.23.7 milestone on our issue
tracker for details

- go1.24.1 (released 2025-03-04) includes security fixes to the net/http
package, as well as bug fixes to cgo, the compiler, the go command, and
the reflect, runtime, and syscall packages. See the Go 1.24.1 milestone
on our issue tracker for details.

Signed-off-by: Akhil Mohan <[email protected]>

[release/2.0] update build to go1.23.7, test go1.24.1

Signed-off-by: ningmingxiao <[email protected]>

[release/2.0] Fix incorrect runtime name being passed to NRI

Fix the gRPC client dialer not using the timeout passed by the
containerd client timeout option.

Commit 63b4688 replaced the usage of deprecated `grpc.DialContext`
with `grpc.NewClient`.

However, the `dialer.ContextDialer` relied on the context deadline to
propagate the timeout:

https://github.com/containerd/containerd/blob/388fb336b0a458e2cf64212072743e622a3f44c7/vendor/google.golang.org/grpc/clientconn.go#L216

This assumption is now broken, because `grpc.NewClient` doesn't do any
initial connection and defers it to the first RPC usage.

This commit passes the timeout via the `MinConnectTimeout` grpc
connection param, which will be applied to **every** connection attempt
(not just the first).

Signed-off-by: Paweł Gronowski <[email protected]>

Before this patch, calling `image.Children` on an image built with
BuildKit would produce unnecessary `encountered unknown type
application/vnd.in-toto+json; children may not be fetched` debug logs,
because the media type is neither a known layer or config type.

Make the `image.Children` aware of the attestation layers and don't
attempt to traverse them.

Signed-off-by: Paweł Gronowski <[email protected]>

Don't produce `reference for unknown type: application/vnd.in-toto+json`
warning logs when pushing/fetching an image containing the attestation
manifests.

Signed-off-by: Paweł Gronowski <[email protected]>

…-11327-to-release/2.0

[release/2.0] Update image type checks to avoid unnecessary logs for attestations

…-11508-to-release/2.0

[release/2.0] Respect `client.WithTimeout` option on connect

Signed-off-by: Derek McGowan <[email protected]>

[release/2.0] Prepare release notes for v2.0.4

[release 2.0] validate uid/gid