Draft until #5161 and #5162 are merged (or we can drop them from the changelog/milestone).

Copy-paste from CHANGELOG.md:

1.4.1 - 2026-03-12

La guerre n'est pas une aventure. La guerre est une maladie. Comme le typhus.

Deprecated

• libcontainer/configs.MPOL_* constants added in runc [1.4.0][]. ([1.4] assorted small backports #5110, libct/configs: mark MPOL_* constants as deprecated #5055)

Added

• Preliminary loong64 support. ([1.4] Add loong64 support in seccomp and PIE #5062, Add loong64 support in seccomp and PIE #4938)

Fixed

• libct: fix panic in initSystemdProps when processing certain systemd
  properties in the OCI spec. ([1.4] libct/specconv: fix panic in initSystemdProps #5161, libct/specconv: fix panic in initSystemdProps #5133)
• libct: fix several file descriptor leaks on error paths. ([1.4] Close fds on error #5168, Close fds on error #5009)
• Remove unnecessary crypto/tls dependency by open-coding the systemd socket
  activation logic, allowing us to more easily avoid false positive CVE
  warnings. (build(deps): bump github.com/coreos/go-systemd/v22 from 22.6.0 to 22.7.0 #5093, Copy go-systemd/activation.Files code to avoid bringing in crypto/tls #5057)
• Remove legacy os.Is* error usage, improving error type detection to make
  our error fallback paths more robust. ([1.4] Handle os.Is* wrapped errors correctly #5162, Handle os.Is* wrapped errors correctly #5061)
• Go 1.26 has started enforcing a restriction of os/exec.Cmd which caused
  issues with our usage of CLONE_INTO_CGROUP (on newer kernels). This has now
  been resolved. ([1.4] Fix runc exec vs go1.26 + older kernel #5116, Fix runc exec vs go1.26 + older kernel #5091)
• Recursive atime-related mount flags (rrelatime et al.) are now applied
  properly. ([1.4] libct/specconv: fix partial clear of atime mount flags #5114, libct/specconv: always clear entire MOUNT_ATTR__ATIME field when updating atime mode #5098)
• Fix a regression in runc exec due to CLONE_INTO_CGROUP in the
  (inadvisable) scenario where a container is configured without cgroup
  namespaces and with /sys/fs/cgroup mounted rw. ([1.4] libct: prepareCgroupFD: fall back to container init cgroup #5117, libct: prepareCgroupFD: fall back to container init cgroup #5101)
• On machines with more than 1024 CPU cores, our logic for resetting the CPU
  affinity will now correctly reset the affinity onto all available cores
  (not just the first 1024). ([1.4] libct: fix resetting CPU affinity #5149, libct: fix resetting CPU affinity #5025)
• PR Preventing containers from being unable to be deleted #4757 caused a regression that resulted in spurious cannot start a container that has stopped errors when running runc create and has thus been
  reverted. ([1.4] Revert "Preventing containers from being unable to be deleted" #5157, Revert "Preventing containers from being unable to be deleted" #5153, "cannot start a container that has stopped" in F-43 #5151, Add creating status to ensure state.json exists when runc kill. #4645, Preventing containers from being unable to be deleted #4757)

Changed

• Previously we made an attempt to make our runc.armhf release binaries work
  with ARMv6 (which would allow runc to work on the original Raspberry Pi).
  Unfortunately, this has effectively always been broken (because we
  cross-compile libseccomp within a Debian container and statically link to
  it) and so we are now officially matching the Debian definition of armhf
  (that is, ARMv7). ([1.4] *: libpathrs cherry-picks #5167, build: use libpathrs by default #5103)
• Minor signing keyring updates. ([1.4] keyring fixes #5147, keyring: remove asarai@suse.de key #5139, keyring: validate: allow maintainers to have no keys #5144, keyring: update AkihiroSuda's key #5148)