chore(deps): bump github.com/containerd/containerd/v2 from 2.3.5 to 2.3.6

[dependabot]

Bumps github.com/containerd/containerd/v2 from 2.3.5 to 2.3.6.

Release notes

Sourced from github.com/containerd/containerd/v2's releases.

containerd 2.3.6

Welcome to the v2.3.6 release of containerd!

The sixth patch release for containerd 2.3 contains various fixes and updates including a security patch.

Security Updates

• containerd
  • CVE-2026-53493

Highlights

Container Runtime Interface (CRI)

• Fix bug where container creation failed when SELinux relabeling was unsupported by the filesystem (#14211)
• Enable mount manager for image mounts in CRI (#14147)

Image Storage

• Ensure all layers are fetched when multiple manifests in an index share a config descriptor (#14139)

Runtime

• Avoid unexpected mutation of mount options in mount helpers (#14192)
• Mask /proc/interrupts and CPU thermal throttle sysfs paths in Linux containers by default (#14144)

Please try out the release binaries and report any issues at https://github.com/containerd/containerd/issues.

Contributors

• Paweł Gronowski
• Samuel Karp
• Chris Henzie
• Maksym Pavlenko
• Wei Fu
• Gao Xiang
• Nan Liu

Changes

• 086fc0d40e Prepare release notes for v2.3.6
• 3e3b3daabc Merge commit from fork
• 03fbef37da Bound Walk references
• bfe167214b Bound Dispatch concurrency and references
• Fix input mutation in mount option helpers (#14192)
  • 5f17a29a9b core/mount: Keep lazy copy for filtered options

... (truncated)

Commits

• ee27353 Merge pull request #14226 from samuelkarp/prepare-release-2.3.6
• 086fc0d Prepare release notes for v2.3.6
• 3e3b3da Merge commit from fork
• 92e6694 Merge pull request #14192 from vvoland/13433-release/2.3
• f7ae0f2 Merge pull request #14211 from k8s-infra-cherrypick-robot/cherry-pick-14207-t...
• 7fd198f cri: tolerate wrapped ENOTSUP during relabel
• 03fbef3 Bound Walk references
• bfe1672 Bound Dispatch concurrency and references
• 5f17a29 core/mount: Keep lazy copy for filtered options
• 4979657 core/mount: Return copied filtered mount options
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  You can disable automated security fix PRs for this repo from the Security Alerts page.

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

The PR includes an unrelated change to the module's required Go version, which may break builds using the previously supported toolchain and should be resolved before merging.

The acceptance criteria lack demonstrated build/test and dependency-resolution validation. Codacy reports the analysis is up to standards, with no new issues or coverage findings.

About this PR

• The dependency-only update does not include validation demonstrating that existing builds/tests remain compatible or that dependency resolution selects containerd/v2 2.3.6.

Test suggestions

• Verify the project builds and existing tests pass with containerd/v2 2.3.6.
• Verify dependency resolution uses containerd/v2 2.3.6 rather than 2.3.5.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify the project builds and existing tests pass with containerd/v2 2.3.6.
2. Verify dependency resolution uses containerd/v2 2.3.6 rather than 2.3.5.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

Raising the go directive to 1.26.8 changes the build requirement and may break consumers or CI pinned to the previous toolchain. Keep the existing directive unless this version is explicitly required.

Suggested change

	go 1.26.8
	go 1.26.3