diff --git a/.github/workflows/build-test-images.yml b/.github/workflows/build-test-images.yml
index 22acc2c5b..1e6210780 100644
--- a/.github/workflows/build-test-images.yml
+++ b/.github/workflows/build-test-images.yml
@@ -43,7 +43,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: '1.19.2'
+          go-version: "1.19.3"
 
       - uses: actions/checkout@v3
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f112f7ebe..453948668 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,9 +12,9 @@ on:
 env:
   # Go version we currently use to build containerd across all CI.
   # Note: don't forget to update `Binaries` step, as it contains the matrix of all supported Go versions.
-  GO_VERSION: "1.19.2"
+  GO_VERSION: "1.19.3"
 
-permissions:  # added using https://github.com/step-security/secure-workflows
+permissions: # added using https://github.com/step-security/secure-workflows
   contents: read
 
 jobs:
@@ -23,8 +23,8 @@ jobs:
   #
   linters:
     permissions:
-      contents: read  # for actions/checkout to fetch code
-      pull-requests: read  # for golangci/golangci-lint-action to fetch pull requests
+      contents: read # for actions/checkout to fetch code
+      pull-requests: read # for golangci/golangci-lint-action to fetch pull requests
     name: Linters
     runs-on: ${{ matrix.os }}
     timeout-minutes: 10
@@ -231,7 +231,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-20.04, macos-12, windows-2019, windows-2022]
-        go-version: ["1.19.2", "1.18.7"]
+        go-version: ["1.19.3", "1.18.8"]
     steps:
       - name: Install dependencies
         if: matrix.os == 'ubuntu-20.04'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 456208a12..6aecfab14 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -4,49 +4,47 @@ on:
   push:
     branches:
       - main
-      - 'release/**'
+      - "release/**"
   pull_request:
     branches:
       - main
-      - 'release/**'
+      - "release/**"
 
-permissions:  # added using https://github.com/step-security/secure-workflows
+permissions: # added using https://github.com/step-security/secure-workflows
   contents: read
 
 jobs:
   CodeQL-Build:
-
     permissions:
-      actions: read  # for github/codeql-action/init to get workflow details
-      contents: read  # for actions/checkout to fetch code
-      security-events: write  # for github/codeql-action/analyze to upload SARIF results
+      actions: read # for github/codeql-action/init to get workflow details
+      contents: read # for actions/checkout to fetch code
+      security-events: write # for github/codeql-action/analyze to upload SARIF results
     strategy:
       fail-fast: false
 
-
     # CodeQL runs on ubuntu-latest, windows-latest, and macos-latest
     runs-on: ubuntu-latest
 
     timeout-minutes: 30
 
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
+      - name: Checkout repository
+        uses: actions/checkout@v3
 
-    - uses: actions/setup-go@v3
-      with:
-        go-version: 1.19.2
+      - uses: actions/setup-go@v3
+        with:
+          go-version: 1.19.3
 
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      # Override language selection by uncommenting this and choosing your languages
-      # with:
-      #   languages: go, javascript, csharp, python, cpp, java
+      # Initializes the CodeQL tools for scanning.
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v2
+        # Override language selection by uncommenting this and choosing your languages
+        # with:
+        #   languages: go, javascript, csharp, python, cpp, java
 
-    - run: |
-        sudo apt-get install -y libseccomp-dev libbtrfs-dev
-        make
+      - run: |
+          sudo apt-get install -y libseccomp-dev libbtrfs-dev
+          make
 
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v2
diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
index a4192e753..f9502e725 100644
--- a/.github/workflows/images.yml
+++ b/.github/workflows/images.yml
@@ -9,7 +9,7 @@ on:
       image:
         description: "Target image name (override)"
 
-permissions:  # added using https://github.com/step-security/secure-workflows
+permissions: # added using https://github.com/step-security/secure-workflows
   contents: read
 
 jobs:
@@ -28,7 +28,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: '1.19.2'
+          go-version: "1.19.3"
 
       - uses: actions/checkout@v3
         with:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 8cf731be5..ef9aeac02 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -1,15 +1,15 @@
 name: Nightly
 on:
   schedule:
-    - cron: '0 0 * * *' # Every day at midnight
+    - cron: "0 0 * * *" # Every day at midnight
   pull_request:
     paths:
-      - '.github/workflows/nightly.yml'
+      - ".github/workflows/nightly.yml"
 
 env:
-  GO_VERSION: '1.19.2'
+  GO_VERSION: "1.19.3"
 
-permissions:  # added using https://github.com/step-security/secure-workflows
+permissions: # added using https://github.com/step-security/secure-workflows
   contents: read
 
 jobs:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 526d752b1..1cd2d2902 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,14 +1,14 @@
 on:
   push:
     tags:
-      - 'v*' # Push events to matching v*, i.e. v1.0, v20.15.10
+      - "v*" # Push events to matching v*, i.e. v1.0, v20.15.10
 
 name: Containerd Release
 
 env:
-  GO_VERSION: '1.19.2'
+  GO_VERSION: "1.19.3"
 
-permissions:  # added using https://github.com/step-security/secure-workflows
+permissions: # added using https://github.com/step-security/secure-workflows
   contents: read
 
 jobs:
diff --git a/Vagrantfile b/Vagrantfile
index f3430bd01..b39007f19 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -99,7 +99,7 @@ EOF
   config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
     sh.upload_path = "/tmp/vagrant-install-golang"
     sh.env = {
-        'GO_VERSION': ENV['GO_VERSION'] || "1.19.2",
+        'GO_VERSION': ENV['GO_VERSION'] || "1.19.3",
     }
     sh.inline = <<~SHELL
         #!/usr/bin/env bash
diff --git a/contrib/Dockerfile.test b/contrib/Dockerfile.test
index dd8a11003..2363c0836 100644
--- a/contrib/Dockerfile.test
+++ b/contrib/Dockerfile.test
@@ -10,7 +10,7 @@
 #
 # docker build -t containerd-test --build-arg RUNC_VERSION=v1.0.0-rc94 -f Dockerfile.test ../
 
-ARG GOLANG_VERSION=1.19.2
+ARG GOLANG_VERSION=1.19.3
 ARG GOLANG_IMAGE=golang
 
 FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang
@@ -19,7 +19,7 @@ FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang
 FROM golang AS runc
 RUN apt-get update && apt-get install -y --no-install-recommends \
     libseccomp-dev \
- && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/*
 
 COPY script/setup/runc-version script/setup/install-runc ./
 # Allow overriding the version of runc to install through build-args
@@ -34,7 +34,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     btrfs-progs \
     libseccomp-dev \
     xfsprogs \
- && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/*
 RUN mkdir -p /go/src/github.com/containerd/containerd
 WORKDIR /go/src/github.com/containerd/containerd
 
@@ -62,7 +62,7 @@ RUN make BUILDTAGS="no_btrfs no_devmapper" binaries install
 FROM build-env AS cri-in-userns
 RUN apt-get update && apt-get install -y --no-install-recommends \
     iptables \
- && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/*
 COPY contrib/Dockerfile.test.d/cri-in-userns/etc_containerd_config.toml /etc/containerd/config.toml
 COPY contrib/Dockerfile.test.d/cri-in-userns/docker-entrypoint.sh       /docker-entrypoint.sh
 COPY --from=runc       /build/ /
@@ -85,13 +85,13 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     g++ \
     libtool \
     unzip \
- && rm -rf /var/lib/apt/lists/*
+    && rm -rf /var/lib/apt/lists/*
 
 COPY script/setup/install-protobuf install-protobuf
 RUN ./install-protobuf \
- && mkdir -p $DESTDIR/usr/local/bin $DESTDIR/usr/local/include \
- && mv /usr/local/bin/protoc $DESTDIR/usr/local/bin/protoc \
- && mv /usr/local/include/google $DESTDIR/usr/local/include/google
+    && mkdir -p $DESTDIR/usr/local/bin $DESTDIR/usr/local/include \
+    && mv /usr/local/bin/protoc $DESTDIR/usr/local/bin/protoc \
+    && mv /usr/local/include/google $DESTDIR/usr/local/include/google
 
 FROM build-env AS dev
 COPY --from=proto3 /build/ /
diff --git a/contrib/fuzz/oss_fuzz_build.sh b/contrib/fuzz/oss_fuzz_build.sh
index 2208b9049..e004f18d8 100755
--- a/contrib/fuzz/oss_fuzz_build.sh
+++ b/contrib/fuzz/oss_fuzz_build.sh
@@ -25,8 +25,7 @@ compile_fuzzers() {
     local compile_fuzzer=$2
     local blocklist=$3
 
-    for line in $(git grep --full-name "$regex" | grep -v -E "$blocklist")
-    do
+    for line in $(git grep --full-name "$regex" | grep -v -E "$blocklist"); do
         if [[ "$line" =~ (.*)/.*:.*(Fuzz[A-Za-z0-9]+) ]]; then
             local pkg=${BASH_REMATCH[1]}
             local func=${BASH_REMATCH[2]}
@@ -44,11 +43,11 @@ go run main.go $SRC/containerd/images
 
 apt-get update && apt-get install -y wget
 cd $SRC
-wget --quiet https://go.dev/dl/go1.19.2.linux-amd64.tar.gz
+wget --quiet https://go.dev/dl/go1.19.3.linux-amd64.tar.gz
 
 mkdir temp-go
 rm -rf /root/.go/*
-tar -C temp-go/ -xzf go1.19.2.linux-amd64.tar.gz
+tar -C temp-go/ -xzf go1.19.3.linux-amd64.tar.gz
 mv temp-go/go/* /root/.go/
 cd $SRC/containerd
 
diff --git a/script/setup/prepare_env_windows.ps1 b/script/setup/prepare_env_windows.ps1
index b8ee1304b..c577fd99a 100644
--- a/script/setup/prepare_env_windows.ps1
+++ b/script/setup/prepare_env_windows.ps1
@@ -5,7 +5,7 @@
 # lived test environment.
 Set-MpPreference -DisableRealtimeMonitoring:$true
 
-$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.19.2"; make = ""; nssm = "" }
+$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.19.3"; make = ""; nssm = "" }
 
 Write-Host "Downloading chocolatey package"
 curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'