build(deps): bump github.com/containerd/nerdctl/v2 from 2.2.2 to 2.3.3

[dependabot]

Bumps github.com/containerd/nerdctl/v2 from 2.2.2 to 2.3.3.

Release notes

Sourced from github.com/containerd/nerdctl/v2's releases.

v2.3.3

Changes

• nerdctl compose run:

  • Honor --workdir (#4986, thanks to @​immanuwell)

• nerdctl network inspect:

  • Support pseudo networks (#4953, thanks to @​immanuwell)

• nerdctl container inspect:

  • Suppress warning message on a stopped container (#4967, thanks to @​haytok)

• Misc:

  • Remove duplicated defaults from help output (#4972, thanks to @​immanuwell)

• go.mod:

  • Update containerd library to v2.3.2 and use the new WithImageConfigLabels function (#4985, #4982)
    • Fixes CVE-2026-53488 "image-config LABEL flows to host-root command execution from an image pull" (affected nerdctl as well as CRI)

• nerdctl-full:

  • Update containerd to v2.3.2 (#4976)
    • Fixes CVE-2026-50195, CVE-2026-53488, CVE-2026-53492, CVE-2026-53489, CVE-2026-47262
  • Update BuildKit to v0.31.0 (#4983)

Full changes: https://github.com/containerd/nerdctl/milestone/63?closed=1 Thanks to @​haytok @​immanuwell @​opjt

Compatible containerd versions

This release of nerdctl is expected to be used with containerd v1.7, v2.0, v2.1, v2.2, or v2.3. Some features may not work with other releases of containerd.

About the binaries

• Minimal (nerdctl-2.3.3-linux-amd64.tar.gz): nerdctl only
• Full (nerdctl-full-2.3.3-linux-amd64.tar.gz): Includes dependencies such as containerd, runc, and CNI

Minimal

Extract the archive to a path like /usr/local/bin or ~/bin .

-rwxr-xr-x root/root  31322274 2026-06-19 10:30 nerdctl
-rwxr-xr-x root/root     23381 2026-06-19 10:29 containerd-rootless-setuptool.sh
-rwxr-xr-x root/root      8639 2026-06-19 10:29 containerd-rootless.sh

Full

Extract the archive to a path like /usr/local or ~/.local .

... (truncated)

Commits

• b4c5feb Merge pull request #4982 from AkihiroSuda/go-mod-containerd-2.3.2
• 7782b30 Merge pull request #4986 from immanuwell/fix-compose-run-workdir
• c512f0f Merge pull request #4964 from opjt/4613_container_run_test
• 188f20f fix: honor --workdir in compose run
• 97e5145 test: refactor container_run_test.go to use Tigron
• 2254f8e Use client.WithImageConfigLabels for image config labels
• 2b47b0c Merge pull request #4976 from AkihiroSuda/dev
• d3ef27f Merge pull request #4985 from containerd/dependabot/go_modules/github.com/con...
• f6a11f2 Merge pull request #4984 from AkihiroSuda/mark-TestIPFSAddrWithKubo-flaky
• 366a10b update containerd (2.3.2)
• Additional commits viewable in compare view

[dependabot]

Superseded by #1774.