microsoft · SeanDougherty · Sep 29, 2026
@@ -0,0 +1,56 @@
+From aa41752dc2dee0ba84d5d521dc9db78120f2b777 Mon Sep 17 00:00:00 2001
+From: AllSpark <allspark@microsoft.com>
+Date: Tue, 8 Sep 2026 16:42:52 +0000
+Subject: [PATCH] Add WithDisableHTTPMethodOverride ServeMux option
+
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: AI Backport of https://github.com/grpc-ecosystem/grpc-gateway/commit/72123cd4f32545f6e1376873f412dcdcbcf29acc.patch
+---
+ .../grpc-gateway/v2/runtime/mux.go               | 16 +++++++++++++++-
+ 1 file changed, 15 insertions(+), 1 deletion(-)
+
+diff --git a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go
+index 19255ec..4b36cb0 100644
+--- a/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go
++++ b/vendor/github.com/grpc-ecosystem/grpc-gateway/v2/runtime/mux.go
+@@ -71,7 +71,8 @@ type ServeMux struct {
+ 	streamErrorHandler        StreamErrorHandlerFunc
+ 	routingErrorHandler       RoutingErrorHandlerFunc
+ 	disablePathLengthFallback bool
++	disableHTTPMethodOverride bool
+ 	unescapingMode            UnescapingMode
+ 	writeContentLength        bool
+ 	disableChunkedEncoding    bool
+ }
+@@ -259,6 +260,19 @@ func WithDisablePathLengthFallback() ServeMuxOption {
+ 	}
+ }
+
++// WithDisableHTTPMethodOverride returns a ServeMuxOption that disables the
++// X-HTTP-Method-Override header handling.
++//
++// When this option is used, the mux will no longer allow POST requests with
++// the X-HTTP-Method-Override header to override the HTTP method. The path
++// length fallback (POST with application/x-www-form-urlencoded falling back
++// to a matching GET handler) is not affected by this option.
++func WithDisableHTTPMethodOverride() ServeMuxOption {
++	return func(serveMux *ServeMux) {
++		serveMux.disableHTTPMethodOverride = true
++	}
++}
++
+ // WithWriteContentLength returns a ServeMuxOption to enable writing content length on non-streaming responses
+ func WithWriteContentLength() ServeMuxOption {
+ 	return func(serveMux *ServeMux) {
+@@ -386,7 +400,7 @@ func (s *ServeMux) ServeHTTP(w http.ResponseWriter, r *http.Request) {
+ 		path = r.URL.RawPath
+ 	}
+
+-	if override := r.Header.Get("X-HTTP-Method-Override"); override != "" && s.isPathLengthFallback(r) {
++	if override := r.Header.Get("X-HTTP-Method-Override"); override != "" && !s.disableHTTPMethodOverride && s.isPathLengthFallback(r) {
+ 		if err := r.ParseForm(); err != nil {
+ 			_, outboundMarshaler := MarshalerForRequest(s, r)
+ 			sterr := status.Error(codes.InvalidArgument, err.Error())
+-- 
+2.45.4
+
@@ -0,0 +1,167 @@
+From 2a1a9cb1b8f98a13dd94f4165925ec862e8fd452 Mon Sep 17 00:00:00 2001
+From: Damien Neil <dneil@google.com>
+Date: Wed, 15 Apr 2026 01:46:24 +0000
+Subject: [PATCH] unicode/norm: avoid infinite loop on invalid input
+
+Upstream-reference: https://github.com/golang/text/commit/5ae8e578e495731553eddba11b2d0e86c91a00ce.patch
+---
+ .../x/text/unicode/norm/forminfo.go           |  9 ++++++++-
+ vendor/golang.org/x/text/unicode/norm/iter.go |  8 ++------
+ .../x/text/unicode/norm/normalize.go          | 20 +++++++++----------
+ 3 files changed, 20 insertions(+), 17 deletions(-)
+
+diff --git a/vendor/golang.org/x/text/unicode/norm/forminfo.go b/vendor/golang.org/x/text/unicode/norm/forminfo.go
+index f3a234e..b3cf5d9 100644
+--- a/vendor/golang.org/x/text/unicode/norm/forminfo.go
++++ b/vendor/golang.org/x/text/unicode/norm/forminfo.go
+@@ -121,8 +121,12 @@ func (p Properties) BoundaryAfter() bool {
+ //
+ // When all 6 bits are zero, the character is inert, meaning it is never
+ // influenced by normalization.
++//
++// We set flags to 0x80 (high bit 7 unused in quick check data) to indicate an invalid rune.
+ type qcInfo uint8
+
++func (p Properties) isInvalid() bool { return p.flags == 0x80 }
++
+ func (p Properties) isYesC() bool { return p.flags&0x10 == 0 }
+ func (p Properties) isYesD() bool { return p.flags&0x4 == 0 }
+
+@@ -247,6 +251,9 @@ func (f Form) PropertiesString(s string) Properties {
+ // to a Properties.  See the comment at the top of the file
+ // for more information on the format.
+ func compInfo(v uint16, sz int) Properties {
++	if sz == 0 {
++		return Properties{flags: 0x80, size: 1}
++	}
+ 	if v == 0 {
+ 		return Properties{size: uint8(sz)}
+ 	} else if v >= 0x8000 {
+@@ -254,7 +261,7 @@ func compInfo(v uint16, sz int) Properties {
+ 			size:  uint8(sz),
+ 			ccc:   uint8(v),
+ 			tccc:  uint8(v),
+-			flags: qcInfo(v >> 8),
++			flags: qcInfo(v>>8) & 0x3f,
+ 		}
+ 		if p.ccc > 0 || p.combinesBackward() {
+ 			p.nLead = uint8(p.flags & 0x3)
+diff --git a/vendor/golang.org/x/text/unicode/norm/iter.go b/vendor/golang.org/x/text/unicode/norm/iter.go
+index 417c6b2..3cc0592 100644
+--- a/vendor/golang.org/x/text/unicode/norm/iter.go
++++ b/vendor/golang.org/x/text/unicode/norm/iter.go
+@@ -376,16 +376,12 @@ func nextComposed(i *Iter) []byte {
+ 			goto doNorm
+ 		}
+ 		prevCC = i.info.tccc
+-		sz := int(i.info.size)
+-		if sz == 0 {
+-			sz = 1 // illegal rune: copy byte-by-byte
+-		}
+-		p := outp + sz
++		p := outp + int(i.info.size)
+ 		if p > len(i.buf) {
+ 			break
+ 		}
+ 		outp = p
+-		i.p += sz
++		i.p += int(i.info.size)
+ 		if i.p >= i.rb.nsrc {
+ 			i.setDone()
+ 			break
+diff --git a/vendor/golang.org/x/text/unicode/norm/normalize.go b/vendor/golang.org/x/text/unicode/norm/normalize.go
+index 4747ad0..60b1511 100644
+--- a/vendor/golang.org/x/text/unicode/norm/normalize.go
++++ b/vendor/golang.org/x/text/unicode/norm/normalize.go
+@@ -148,7 +148,7 @@ func (f Form) IsNormalString(s string) bool {
+ // patched buffer and whether the decomposition is still in progress.
+ func patchTail(rb *reorderBuffer) bool {
+ 	info, p := lastRuneStart(&rb.f, rb.out)
+-	if p == -1 || info.size == 0 {
++	if p == -1 || info.isInvalid() {
+ 		return true
+ 	}
+ 	end := p + int(info.size)
+@@ -225,7 +225,7 @@ func doAppend(rb *reorderBuffer, out []byte, p int) []byte {
+ 	}
+ 	fd := &rb.f
+ 	if doMerge {
+-		var info Properties
++		info := Properties{flags: 0x80, size: 1} // invalid rune
+ 		if p < n {
+ 			info = fd.info(src, p)
+ 			if !info.BoundaryBefore() || info.nLeadingNonStarters() > 0 {
+@@ -235,7 +235,7 @@ func doAppend(rb *reorderBuffer, out []byte, p int) []byte {
+ 				p = decomposeSegment(rb, p, true)
+ 			}
+ 		}
+-		if info.size == 0 {
++		if info.isInvalid() {
+ 			rb.doFlush()
+ 			// Append incomplete UTF-8 encoding.
+ 			return src.appendSlice(rb.out, p, n)
+@@ -314,7 +314,7 @@ func (f *formInfo) quickSpan(src input, i, end int, atEOF bool) (n int, ok bool)
+ 			continue
+ 		}
+ 		info := f.info(src, i)
+-		if info.size == 0 {
++		if info.isInvalid() {
+ 			if atEOF {
+ 				// include incomplete runes
+ 				return n, true
+@@ -379,7 +379,7 @@ func (f Form) firstBoundary(src input, nsrc int) int {
+ 	// CGJ insertion points correctly. Luckily it doesn't have to.
+ 	for {
+ 		info := fd.info(src, i)
+-		if info.size == 0 {
++		if info.isInvalid() {
+ 			return -1
+ 		}
+ 		if s := ss.next(info); s != ssSuccess {
+@@ -424,7 +424,7 @@ func (f Form) nextBoundary(src input, nsrc int, atEOF bool) int {
+ 	}
+ 	fd := formTable[f]
+ 	info := fd.info(src, 0)
+-	if info.size == 0 {
++	if info.isInvalid() {
+ 		if atEOF {
+ 			return 1
+ 		}
+@@ -435,7 +435,7 @@ func (f Form) nextBoundary(src input, nsrc int, atEOF bool) int {
+
+ 	for i := int(info.size); i < nsrc; i += int(info.size) {
+ 		info = fd.info(src, i)
+-		if info.size == 0 {
++		if info.isInvalid() {
+ 			if atEOF {
+ 				return i
+ 			}
+@@ -465,7 +465,7 @@ func lastBoundary(fd *formInfo, b []byte) int {
+ 	if p == -1 {
+ 		return -1
+ 	}
+-	if info.size == 0 { // ends with incomplete rune
++	if info.isInvalid() { // ends with incomplete rune
+ 		if p == 0 { // starts with incomplete rune
+ 			return -1
+ 		}
+@@ -504,7 +504,7 @@ func lastBoundary(fd *formInfo, b []byte) int {
+ func decomposeSegment(rb *reorderBuffer, sp int, atEOF bool) int {
+ 	// Force one character to be consumed.
+ 	info := rb.f.info(rb.src, sp)
+-	if info.size == 0 {
++	if info.isInvalid() {
+ 		return 0
+ 	}
+ 	if s := rb.ss.next(info); s == ssStarter {
+@@ -528,7 +528,7 @@ func decomposeSegment(rb *reorderBuffer, sp int, atEOF bool) int {
+ 			break
+ 		}
+ 		info = rb.f.info(rb.src, sp)
+-		if info.size == 0 {
++		if info.isInvalid() {
+ 			if !atEOF {
+ 				return int(iShortSrc)
+ 			}
+-- 
+2.52.0
@@ -0,0 +1,15 @@
+[Unit]
+Description=containerd container runtime
+Documentation=https://containerd.io
+After=network.target
+
+[Service]
+ExecStartPre=/sbin/modprobe overlay
+ExecStart=/usr/bin/containerd
+Restart=always
+Delegate=yes
+KillMode=process
+OOMScoreAdjust=-999
+
+[Install]
+WantedBy=multi-user.target
@@ -0,0 +1,9 @@
+version = 2
+[plugins]
+  [plugins."io.containerd.grpc.v1.cri"]
+   [plugins."io.containerd.grpc.v1.cri".containerd]
+      [plugins."io.containerd.grpc.v1.cri".containerd.runtimes]
+        [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc]
+          runtime_type = "io.containerd.runc.v2"
+          [plugins."io.containerd.grpc.v1.cri".containerd.runtimes.runc.options]
+            SystemdCgroup = true
@@ -0,0 +1,7 @@
+{
+ "Signatures": {
+  "containerd.service": "a07bfcf412669b06673190b0779f48e652c9adcf1758289e849a00802804eec8",
+  "containerd.toml": "5b3821236f09b4c858e0e098bbe1400f4dbbb47d360e39d21c61858b088c2896",
+  "containerd-2.3.4.tar.gz": "175bbf57d637c987fa742f846b43b1b8ba2c61af6a9eaec619c625e4a8a19b69"
+ }
+}