[1.3] Release 1.3.4

[lifubang]

[1.3.4] - 2025-11-27

Take me to your heart, take me to your soul.

Fixed

• libct: fix mips compilation. (Fails to build on mips64le #4962, [1.3] libct: fix mips compilation #4966)
• When configuring a tmpfs mount, only set the mode= argument if the
  target path already existed. This fixes a regression introduced in our
  CVE-2025-52881 mitigation patches. (Recent security update changed default permissions of tmpfs #4971, [1.4] rootfs: only set mode= for tmpfs mount if target already existed #4976)
• Fix various file descriptor leaks and add additional tests to detect them as
  comprehensively as possible. ([v1.3.3] Error response from daemon: failed to create task for container #5007, [1.2.8] runc appears to apply rlimits to itself prior to validating device nodes #5021, [1.4] fix fd leaks and detect them as comprehensively as possible #5034)

Changed

• Downgrade github.com/cyphar/filepath-securejoin dependency to v0.5.2,
  which should make it easier for some downstreams to import runc without
  pulling in too many extra packages. ([1.3] fix fd leaks and detect them as comprehensively as possible  #5028)

[lifubang]

So, we need #5042 to be merged to pass the ci.

[tianon]

FWIW, tomorrow is Thanksgiving in the US, so this may not be the best week for releases 😅

[lifubang]

FWIW, tomorrow is Thanksgiving in the US, so this may not be the best week for releases 😅

Good point! I guess we should all be thinking about turkey and pumpkin pie instead of releases.

[rata]

Jobs still failing, restarted the failing ones

[rata]

LGTM