What's Changed

• Use multi-error for annotation processing by @helsaawy in #2419
• Add rootfs.exe tool to merge tar image layers by @helsaawy in #2424
• Support for querying disks based on LUN by @ambarve in #2421
• Tool for extracting UtilityVM files from a container layer into a CIM by @ambarve in #2423
• Add uvm:// mount support for LCOW by @helsaawy in #2430
• Bump google.golang.org/grpc from 1.69.0 to 1.72.1 in /test by @dependabot[bot] in #2432
• Bump golang.org/x/sync from 0.13.0 to 0.14.0 in /test by @dependabot[bot] in #2433
• Store extraction error for LazyImageLayers by @helsaawy in #2429
• Switch to golangci-lint v2 by @helsaawy in #2440
• SecurityPolicy: Add leading and trailing checks for env variables by @MahatiC in #2431
• Trim LCOW GetProperties response by @helsaawy in #2458
• Swap EvalSymlinks with ResolvePath by @helsaawy in #2455
• Bug: when searching for LinuxBootFiles by @helsaawy in #2454
• Organize annotations; change annotation expansions by @helsaawy in #2449
• Omnibus dependabot update by @helsaawy in #2442
• lcow: disable virtio-vsock init by @anmaxvl in #2461
• Initial support for verified CIMs by @ambarve in #2448
• Move hcsshim/main to containerd v2.1.2 and update CIs to WS2025 by @kiashok in #2425
• Validate runhcs sandbox isolation and platform by @helsaawy in #2473
• log mkfs.ext4 stderr output by @anmaxvl in #2474
• Bump golang.org/x/sys from 0.33.0 to 0.34.0 in /test by @dependabot[bot] in #2480
• Remove WS2025 from CIs by @kiashok in #2483
• Gcs sidecar framework by @kiashok in #2422
• Support for importing verified block CIM layers by @ambarve in #2456
• Warn on incomplete vNUMA setting, clarify field names by @helsaawy in #2466
• Fix CUDA for non-privileged containers by @helsaawy in #2492
• fixes to uvmboot by @ambarve in #2494
• Bump actions/checkout from 4 to 5 by @dependabot[bot] in #2499

Full Changelog: v0.13.0...v0.14.0-rc.1