fix(deps): update module github.com/containernetworking/plugins to v1.9.0

[renovate-bot]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/containernetworking/plugins	v1.3.0 → v1.9.0

---

Release Notes

containernetworking/plugins (github.com/containernetworking/plugins)

v1.9.0: CNI plugins v1.9.0

Compare Source

What's Changed

This release fixes CVE-2025-67499, a bug in the nftables backend for the portmap plugin that can cause traffic to be unexpectedly intercepted.

Bugs

• portmap: ensure nftables backend only intercept local traffic by @​champtar in #​1210.

Other changes

• Fix file exists errro in dummy cni by @​liuyuan10 in #​1205
• Ignore settling with down state since it would never settle by @​bn222 in #​1207

Full Changelog: containernetworking/plugins@v1.8.0...v1.9.0

v1.8.0: CNI plugins v1.8.0

Compare Source

The Bridge CNI plugin has removed limitations on VLAN trunk implementation. This aligns with recommended access and trunk port configurations, ensuring proper VLAN isolation and enhanced usability.

What's Changed

• Allow vlan parameter to set native vlan on trunk ports by @​mlguerrero12 in #​1180
• Set default value of PreserveDefaultVlan to False by @​mlguerrero12 in #​1181
• remove duplicate route.Table and route.Scope assignments by @​runsisi in #​1192
• Set value of gw to nil for opt121 routes in DHCP by @​omartin2010 in #​1187

New Contributors

• @​runsisi made their first contribution in #​1192
• @​omartin2010 made their first contribution in #​1187

Full Changelog: containernetworking/plugins@v1.7.0...v1.8.0

v1.7.1: CNI plugins v1.7.1

Compare Source

What's Changed

(Administrative note: the GitHub release v1.7.0 somehow got split in to two immutable releases. v1.7.1 is a re-release that corrects the issue. Apologies for the trouble).

New features / options

• bridge: Add option to enable port isolation by @​ormergi in #​1141
• Add a new firewall ingress-policy "isolated" by @​swagatbora90 in #​1140

Other improvements

• host-device: Return interface name in result by @​sriramy in #​1147
• Add retries for netlink calls that may return a EINTR by @​adrianmoisey in #​1154
• Enable KeepAddrOnDown for ipv6 addresses by @​mlguerrero12 in #​1155
• Implement exponential backoff in vrf plugin by @​mlguerrero12 in #​1156

Bug fixes

• DHCP lease maintenance should terminate when interface no longer exists. by @​dougbtv in #​1143
• Fix addresses and routes reinserted to the VRF by @​mlguerrero12 in #​1151
• Check error returned by ipv6 SettleAddresses by @​mlguerrero12 in #​1168

New Contributors

• @​sriramy made their first contribution in #​1147
• @​swagatbora90 made their first contribution in #​1140
• @​dougbtv made their first contribution in #​1143
• @​adrianmoisey made their first contribution in #​1154

Full Changelog: containernetworking/plugins@v1.6.2...v1.7.1

v1.7.0

Compare Source

v1.6.2

Compare Source

(administrative note: release v1.6.1 was somehow double-created in GitHub; v1.6.2 is identical but fixes the duplication.)

What's Changed

• portmap: fix nftables backend by @​champtar in #​1116
• ipmasq: fix nftables backend by @​champtar in #​1120
• portmap: fix iptables conditions detection by @​champtar in #​1117

Full Changelog: containernetworking/plugins@v1.6.0...v1.6.2

v1.6.1

Compare Source

v1.6.0: CNI plugins v1.6.0

Compare Source

This is the v1.6.0 release of the CNI community plugins.

Changelog

Important

• revert htb changes due to ongoing issues and missing maintainer by @​h0nIg in #​1105. This reverts the (undocumented) feature added in v1.5 where traffic from a specific CIDR would be exempted from bandwidth shaping. Unfortunately the implementation was lacking. We hope to re-add this feature in the future.

New features

• nftables support for ipmasq and portmap by @​danwinship in #​935
• dhcp: Add priority option to dhcp. by @​lisongmin in #​1091

CNI v1.1 support

• Use of Scope for routes in IPAM by @​LionelJouin in #​1087
• Pass status along ipam update by @​LionelJouin in #​1082

Other improvements

• macvlan: add bcqueuelen setting by @​champtar in #​1074
• SBR: option to pass the table id by @​LionelJouin in #​1088
• host-device: use temp network namespace for rename by @​champtar in #​1073

Fixes

• Fix unnecessary retrying when the link is down in dhcp by @​lisongmin in #​1076
• Fix inadvertent txqueuelen being set to zero by @​gudmundur in #​1100
• VRF: Wait for the local/host routes to be added by @​LionelJouin in #​1104
• fix(dhcp): can not renew an ip address by @​lisongmin in #​1092

Misc / CI

• Change chown to change current dir as well by @​s1061123 in #​1058
• ci, go.mod: bump to go 1.23 by @​squeed in #​1094
• Ignore link-local routes in SBR tests by @​LionelJouin in #​1102

New Contributors

• @​lisongmin made their first contribution in #​1076
• @​LionelJouin made their first contribution in #​1088
• @​gudmundur made their first contribution in #​1100
• @​h0nIg made their first contribution in #​1105

Full Changelog: containernetworking/plugins@v1.5.1...v1.6.0

v1.5.1

Compare Source

What's Changed

• Fix release tar images' owner to root by @​s1061123 in #​1054

Full Changelog: containernetworking/plugins@v1.5.0...v1.5.1

v1.5.0: CNI Plugins v1.5.0

Compare Source

What's Changed

New Features:

• Support DeviceID on Auxiliary Bus by @​adrianchiris in #​1003
• Dev/exclude subnets from traffic shaping by @​oOraph in #​921

Fixes:

• Fix release script in github action by @​s1061123 in #​1037.
• Use temporary name for netdevice when moving in/out of NS by @​adrianchiris in #​1002

New Contributors

• @​oOraph made their first contribution in #​921
• @​samuelkarp made their first contribution in #​1029
• @​testwill made their first contribution in #​1034

Full Changelog: containernetworking/plugins@v1.4.1...v1.5.0

v1.4.1

Compare Source

v1.4.0: CNI Plugins v1.4.0

Compare Source

New features:

• (#​832). tap: allow for a tap device to be created as a bridge port
• (#​914). [tuning] add ability to set tx queue len

Improvements:

• (#​969). Add CNI_NETNS_OVERRIDE
• (#​979). Add ndisc_notify in ipvlan for ipv6 ndp
• (#​974). macvlan: enable ipv6 ndisc_notify
• (#​950). Create IPAM files with 0600 permissions
• (#​924). More efficient iptables usage.
• (#​902). spoofcheck: Make use of go-nft's ApplyConfigEcho(). This is much faster
• (#​874). Add routes propagation for VRF plugin

Build:

• (#​982). Bump to golang:1.21-alpine
• (#​948). build: Use POSIX sh for shell scripts

Bug fixes:

• (#​954). macvlan cmdDel: handle deletion when master has been deleted
• (#​927). vrf: fix route filter to use output iface

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[google-oss-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: renovate-bot
Once this PR has been reviewed and has the lgtm label, please assign mrhohn for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[forking-renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 10 additional dependencies were updated

Details:

Package	Change
github.com/coreos/go-iptables	v0.7.0 -> v0.8.0
github.com/vishvananda/netlink	v1.2.1-beta.2 -> v1.3.1
github.com/vishvananda/netns	v0.0.4 -> v0.0.5
github.com/containernetworking/cni	v1.1.2 -> v1.3.0
github.com/go-logr/logr	v1.4.2 -> v1.4.3
github.com/safchain/ethtool	v0.3.0 -> v0.6.2
golang.org/x/net	v0.38.0 -> v0.43.0
golang.org/x/term	v0.30.0 -> v0.34.0
golang.org/x/text	v0.23.0 -> v0.28.0
google.golang.org/protobuf	v1.36.5 -> v1.36.7

[forking-renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 10 additional dependencies were updated

Details:

Package	Change
github.com/coreos/go-iptables	v0.7.0 -> v0.8.0
github.com/vishvananda/netlink	v1.2.1-beta.2 -> v1.3.1
github.com/vishvananda/netns	v0.0.4 -> v0.0.5
github.com/containernetworking/cni	v1.1.2 -> v1.3.0
github.com/go-logr/logr	v1.4.2 -> v1.4.3
github.com/safchain/ethtool	v0.3.0 -> v0.6.2
golang.org/x/net	v0.38.0 -> v0.43.0
golang.org/x/term	v0.30.0 -> v0.34.0
golang.org/x/text	v0.23.0 -> v0.28.0
google.golang.org/protobuf	v1.36.5 -> v1.36.7