CRI-O v1.30.14

CRI-O v1.30.14

The release notes have been generated for the commit range v1.30.13…7479376 on Fri, 06 Mar 2026 18:48:05 UTC.

Downloads

Download one of our static release bundles via our Google Cloud Bucket:

To verify the artifact signatures via cosign, run:

> export COSIGN_EXPERIMENTAL=1
> cosign verify-blob cri-o.amd64.747937623732070a3b940edd479061025c889cae.tar.gz \
    --certificate-identity https://github.com/cri-o/cri-o/.github/workflows/test.yml@refs/tags/747937623732070a3b940edd479061025c889cae \
    --certificate-oidc-issuer https://token.actions.githubusercontent.com \
    --certificate-github-workflow-repository cri-o/cri-o \
    --certificate-github-workflow-ref refs/tags/747937623732070a3b940edd479061025c889cae \
    --signature cri-o.amd64.747937623732070a3b940edd479061025c889cae.tar.gz.sig \
    --certificate cri-o.amd64.747937623732070a3b940edd479061025c889cae.tar.gz.cert

To verify the bill of materials (SBOM) in SPDX format using the bom tool, run:

> tar xfz cri-o.amd64.747937623732070a3b940edd479061025c889cae.tar.gz
> bom validate -e cri-o.amd64.747937623732070a3b940edd479061025c889cae.tar.gz.spdx -d cri-o

Changelog since v1.30.13

Changes by Kind

Bug or Regression

Fixed CVE-2025-58183: Updated tar-split to v0.12.2 to fix unbounded memory allocation vulnerability when parsing malicious container images with GNU sparse tar files. (#9594, @saschagrunert)

Uncategorized

Disabled pull-progress-timeout per default. (#9144, @openshift-cherrypick-robot)
Fix a potential deadlock when an infra container is taking a long time to exit and the sandbox’s readiness is blocked on the infra container’s opLock (#9310, @openshift-cherrypick-robot)
Fix the bug that pod can’t be terminated when the process is uninterruptible sleep for a while. (#9330, @bitoku)
Respect user specified selinux label for systemd or init container. (#9727, @openshift-cherrypick-robot)

Dependencies

Added

Nothing has changed.

Changed

github.com/containers/storage: e1bc50e → 8c625df
github.com/vbatts/tar-split: v0.11.7 → v0.12.2

Removed

Nothing has changed.