chore(deps): update dependency talos to v1.12.7#12
Open
renovate[bot] wants to merge 1 commit intomainfrom
Open
chore(deps): update dependency talos to v1.12.7#12renovate[bot] wants to merge 1 commit intomainfrom
renovate[bot] wants to merge 1 commit intomainfrom
Conversation
1a8c50b to
f2a4c96
Compare
882a125 to
7891b40
Compare
7891b40 to
bf83e5f
Compare
bf83e5f to
b32ff15
Compare
b32ff15 to
6fcbbfd
Compare
6fcbbfd to
cc6fd44
Compare
cc6fd44 to
a6ee647
Compare
a6ee647 to
64901ae
Compare
64901ae to
1d0aaab
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v1.11.3→v1.12.7Warning
Some dependencies could not be looked up. Check the Dependency Dashboard for more information.
Release Notes
siderolabs/talos (TALOS)
v1.12.7Compare Source
v1.12.6Compare Source
Talos 1.12.6 (2026-03-19)
Welcome to the v1.12.6 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.18.18
runc: 1.3.5
Talos is built with Go 1.25.8.
Contributors
Changes
21 commits
a1b8bd6release(v1.12.6): prepare release72bd570feat: update Linux to 6.18.189d5638ffix: accept image cache volume encryption config0f018bffix: panic in hardware.SystemInfoControllerc46b898fix: validate missing apiVersion in config document decoderc47cad9fix: pull in a fix for dmesg timestamps190336afix: prevent stale discovered volumes reads217e9bbfix: bring in new version of go-cmd and go-blockdeviced7779a5fix: stop pulling wrong platform for imageseb6eb66fix(machined): support USERDATA legacy fallback in OpenNebula driverba20c7cfeat(machined): add ONEGATE proxy route and deterministic interface iteration for OpenNebula739f664feat(machined): inherit IP6_METHOD from METHOD in OpenNebula driver93878c0fix(machined): align OpenNebula hostname precedence with reference9718d73feat(machined): add IPv6 alias address support for OpenNebula (ETH_ALIAS_IP6)b649fb4feat(machined): support ETH*_IP6_METHOD (static/dhcp/auto/disable) for OpenNebulac81df6frefactor(machined): extract per-interface IPv4 helper in OpenNebula driver501924efix(machined): use ParseFQDN for hostname parsing in OpenNebulae9331b2feat(machined): support per-interface route metric for OpenNebula (ETH*_METRIC)6e78afbfeat(machined): add network alias support for OpenNebula (ETH_ALIAS)9f648b4feat(machined): merge global and per-interface DNS for OpenNebula04fba03feat(machined): add static routes support via ETH*_ROUTES for OpenNebulaChanges from siderolabs/go-cmd
2 commits
5f31ba9chore: rekres and updatefff5698feat: allow capturing full output to stdout, modernize APIChanges from siderolabs/go-kmsg
3 commits
b53b36dchore: rekres and update6f7d20bfeat: calculate boot time correctly if the time jumps47655eefeat: support PRINTK_CALLER kmsg logsChanges from siderolabs/pkgs
4 commits
a92bed5feat: enable AMD GPU peer-to-peer DMA09e87a9feat: backportable deps updateeb965e2feat(kernel): enable CONFIG_USB_UHCI_HCD on amd646804ebdfeat: update Linux 6.18.16, NVIDIA, ZFSDependency Changes
Previous release can be found at v1.12.5
Images
v1.12.5Compare Source
Talos 1.12.5 (2026-03-09)
Welcome to the v1.12.5 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.18.15
Kubernetes: 1.35.2
etcd: 3.6.8
Talos is built with Go 1.25.8.
Contributors
Changes
19 commits
da6c6e4release(v1.12.5): prepare release4f978a7fix: correctly calculate end ranges for nftables sets8d52e2dfeat: add trusted roots generation to stdpatches6284877fix: use correct dhcp option for unicast dhcp renewaldcf23befix: ignore image digest when doing upgrade-k8sf8a2a9bfix(machined): opennebula: process ETH*_ vars regardless of NETWORK context flagdb9ff23fix: patch with delete for LinkConfigse0c38e2fix: update path handling on talosctl cgroupsca2d4c1fix: stop Kubernetes client from dynamically reloading the certs70ae2f2refactor: split locate and provisionc3b0484fix: hold user volumes root mountpointd935420fix: handle raw encryption keys with\nproperly7fe1a47fix: remove stale endpoints3ea0888fix: allow static hosts in/etc/hostswithout hostname5ebb00ffix: switch to better Myers algorithm implementation2b40379feat: update etcd to v3.6.81ce9328fix: disks flag parsing and handling in create qemu command1f989dffix: read multi-doc machine config with newer talosctl40ba6e3feat: update Linux 6.18.15, Go 1.25.8Changes from siderolabs/go-debug
1 commit
47fce68feat: support Go 1.26, rekresChanges from siderolabs/pkgs
7 commits
e695c74feat: update Linux to 6.18.157d4ef68feat: update Linux to 6.18.14300cd60feat: update Linux firmware to202602265f9fd3feat: update Linux to 6.18.1396fc8e3feat: enable MLX5 Scalable Functions and TC offload in kernelf31edf1feat: add patch for Cilium BPF verifier rejection by the kernel8b4b129feat: update Go to 1.25.8Changes from siderolabs/tools
1 commit
57916cbfeat: update Go to 1.25.8Dependency Changes
Previous release can be found at v1.12.4
Images
v1.12.4Compare Source
Talos 1.12.4 (2026-02-13)
Welcome to the v1.12.4 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
KubeSpan Advertised Network Filters
KubeSpan now supports filtering of advertised networks using the
excludeAdvertisedNetworksfield in theKubeSpanConfigdocument.This allows users to specify a list of CIDRs to exclude from the advertised networks. Please note that routing must be symmetric for any
pair of peers, so if one peer excludes a certain network, the other peer must also exclude it. In other words, for any given pair of peers,
and any pair of their addresses, the traffic should either go through KubeSpan or not, but not one way or the other.
Component Updates
Linux: 6.18.9
Talos is built with Go 1.25.7.
Contributors
Changes
9 commits
fc8e600release(v1.12.4): prepare release14dde14feat: add filter for KubeSpan advertised networksc277d01fix: ignore volumes in wave calculation without provisioningf90af88fix: use node podCIDRs for kubespan advertiseKubernetesNetworksa025ea4feat: add IPv6 GRE support9241254fix: typo with rpi_5 profile name64f4985fix: swap volume configuration for min/max size19354abfeat: update Linux to 6.18.9639c1c9fix: mismerge of nft with json supportChanges from siderolabs/discovery-api
2 commits
9c06846feat: change the way excluded addresses are specifiedf71a14afeat: add advertised filters to discovery dataChanges from siderolabs/pkgs
4 commits
b1fc4c6feat: update NVIDIA LTS to 580.126.16f7a8163feat: update Linux to 6.18.932290fffeat: enable ip6_greda46073feat: enable NFT_BRIDGE configDependency Changes
Previous release can be found at v1.12.3
Images
v1.12.3Compare Source
Talos 1.12.3 (2026-02-07)
Welcome to the v1.12.3 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.18.8
Talos is built with Go 1.25.7.
Contributors
Changes
14 commits
6d6471frelease(v1.12.3): prepare release6578200feat: update Linux kernel with dm-integrityb8f8245fix: add hostname to endpoints624f9b5chore: update deps3aa1539fix: implement merger for PercentageSizef17d07cfeat: add a helper module to generate standard patches4a3385dfix: undo CRLF on Windows (talosctl edit)a842775feat: add RPi5 to the list of supported SBCsb8cdb61fix(talosctl): pass --k8s-endpoint flag to rotate-ca kubernetes rotation27cbe29fix: skip empty documents on config decoding8f49dd2fix: open the filesystem as read-onlyb2a83d1fix: always set advertised peer URLs249acdbfix: fallback to /proc/meminfo for memory modulesbc56bdffix: add warnings to 802.3ad bondChanges from siderolabs/pkgs
3 commits
15d5d78chore: update deps4469bd7chore: update kernel51108e5feat: enable dm-integrityChanges from siderolabs/tools
2 commits
dc37e09chore: update deps36fb49afeat: update OpenSSL to 3.6.1Dependency Changes
Previous release can be found at v1.12.2
Images
v1.12.2Compare Source
Talos 1.12.2 (2026-01-22)
Welcome to the v1.12.2 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
talosctl images talos-bundlecan ignore reaching to the registryThe
talosctl images talos-bundlecommand now accepts optional--ovelaysand--extensionsflags.If those are set to
false, the command will not attempt to reach out to the container registry to fetch the latest versions and digests of the overlays and extensions.Component Updates
Linux: 6.18.5
Talos is built with Go 1.25.6.
Contributors
Changes
21 commits
54e5b43release(v1.12.2): prepare release30da0bcfix: oracle platform file format7ddb37bfix: make OOM expression a bit less sensitivee438ec2fix: marshal of FailOverMac property717ed72fix: check if the device is not mounted when wipingc95c9fdfix: wipe the first/last 1MiB in addition to wiping by signatures52bed35fix: add talos version to Hetzner Cloud client user agent0e447a4fix: make OOM controller more precise by considering separate cgroup PSI3b974b9fix: sort mirrors and tls configs when generating the machine config8b16fe5feat: add VLAN support to OpenStack platformeb8480cfix: panic in configpatcher when the whole section is missing4d44306fix: wipe disk by signaturescca4cd2feat: add it87 hwmon moduled9480eefix: resolve SideroLink Wireguard endpoint on reconnecte16c2d5fix: handle correctly incomplete RegistryTLSConfigdedd273fix: bond config via platformf527cfffix: allow HostnameConfig to be used with incomplete machine config1091813fix: lock down etcd listen address to IPv4 localhost9f8d938fix: print talosctl images to release notes95433c1fix: update VIP config example919394ffeat: update Go to 1.25.6Changes from siderolabs/pkgs
7 commits
4f8efaffix: enable pinctrl for Raspberry Pi 53a36a01feat: update NVIDIA LTS and production driver versionsd364d04feat: update Linux to 6.18.5a3d6cc4feat: update Linux firmware to202601140fa324feat: enable IT87 hwmon module8b8f314feat: enable IPV6_MROUTE3571127feat: update Go to 1.25.6Changes from siderolabs/tools
1 commit
31959f4feat: update Go to 1.25.6Dependency Changes
Previous release can be found at v1.12.1
Images
v1.12.1Compare Source
Talos 1.12.1 (2026-01-05)
Welcome to the v1.12.1 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.18.2
Talos is built with Go 1.25.5.
Contributors
Changes
7 commits
7ea2ef7release(v1.12.1): prepare release78a7856chore: run rekres and update dependenciesc310671fix: disable swap for system servicesa7e8426test: skip the source bundle on exact tag9439841fix: probe small images correctly42df716fix: invalid versions check in talos-bundlea3e90e4fix: make upgrade work with SELinux enforcing=1Changes from siderolabs/pkgs
2 commits
90ff196chore: run rekres and update dependencies2b30517feat: update Linux to 6.18.2Changes from siderolabs/tools
1 commit
5df8baechore: run rekres and update dependenciesDependency Changes
Previous release can be found at v1.12.0
Images
v1.12.0Compare Source
Welcome to the v1.13.0-alpha.2 release of Talos!
This is a pre-release of Talos
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Clang built kernel and ThinLTO
Talos now uses a kernel built using Clang compiler, and optimized using ThinLTO. This should bring a small performance improvement,
alongside some hardening features, such as BTI on supported ARM systems.
talosctl debug
Talos Linux now provides a way to run and attach to the privileged debug container with a user-provided container image.
The debug container might be used for troubleshooting and debugging purposes.
Environment Configuration Document
A new
EnvironmentConfigdocument has been introduced to allow users to specify environment variables for Talos components.It replaces and deprecates the previous method of setting environment variables via the
.machine.envfield.Multiple values for the same environment variable will replace previous values, with the last one taking precedence.
To remove an environment variable, remove it from the
EnvironmentConfigdocument and restart the node.External Volumes
Talos now supports virtiofs-based external volumes via the new
ExternalVolumeConfig
document.
These virtiofs external volumes are not supported when SELinux is running
in enforcing mode.
Extra Arguments accept slices in addition to strings
Several Talos configuration fields that previously accepted single string values for extra arguments have been updated to accept slices of strings as well.
This includes fields such as
.cluster.apiServer.extraArgs.BREAKING: If you were relying on the resources EtcdConfigs, KubeletConfigs, ControllerManagerConfigs, SchedulerConfigs or APIServerConfigs, the protobuf format has changed from
map<string,string>tomap<string,message>.Talos Imager Enhancements
Talos imager now supports running rootless.
--privilegedand-v /dev:/devare no longer required.Image APIs Updated
Talos Linux provides new APIs to manage container images on the node: listing, pulling, importing and removing images.
The new pull APIs provides pull progress notifications.
The CLI commands
talosctl image pull,talosctl image listandtalosctl image removehave been updated to interact with the new APIs.Talosctl images k8s-bundle subcommand accepts version parameter
The
talosctl images k8s-bundlecommand now accepts an optional version overrides arguments.Kubernetes server-side apply
Talos now uses inventory backed server-side apply when applying bootsrap manifests (including
extraManifestsandinlineManifests).Purging of unneeded manifests is automatically performed.
The switch and inventory backfill is automatic and no action is needed from the user.
KubeSpan Configuration
A new
KubeSpanConfigdocument has been introduced to configure KubeSpan settings.It replaces and deprecates the previous method of configuring KubeSpan via the
.machine.network.kubespanfield.The old configuration field will continue to work for backward compatibility.
KubeSpan Advertised Network Filters
KubeSpan now supports filtering of advertised networks using the
excludeAdvertisedNetworksfield in theKubeSpanConfigdocument.This allows users to specify a list of CIDRs to exclude from the advertised networks. Please note that routing must be symmetric for any
pair of peers, so if one peer excludes a certain network, the other peer must also exclude it. In other words, for any given pair of peers,
and any pair of their addresses, the traffic should either go through KubeSpan or not, but not one way or the other.
LinkAliasConfig Pattern-Based Multi-Alias
LinkAliasConfignow supports pattern-based alias names using%dformat verb (e.g.net%d).When the alias name contains a
%dformat verb, the selector is allowed to match multiple links.Each matched link receives a sequential alias (e.g.
net0,net1, ...) based on hardware address orderof the links. Links already aliased by a previous config are automatically skipped.
This enables creating stable aliases from any N links using a single config document,
useful for
BondConfigandBridgeConfigmember interfaces on varying hardware.Negative Max Volume Size
Negative max size represents the amount of space to be left free on the device, rather than the size the volume should consume.
For example:
* a max size of "-10GiB" means the volume can grow to the available space minus 10GiB.
* a max size of "-25%" means the volume can grow to the available space minus 25%.
Flannel CNI with Network Policy Support
Talos Linux now supports optionally deploying Flannel CNI with network policy support enabled.
The network policy implementation is kube-network-policies.
To enable Flannel CNI with network policy support, use the following machine configuration patch:
(If the cluster is already running, sync the bootstrap manifests after applying the patch to deploy the new CNI configuration.)
Container Image Decompression
Talos now ships with
igzip(amd64) andpigz(arm64) to speed up container image decompression.ProbeConfig
The TCPProbeConfig configuration document allows to configure TCP probes for network reachability checks.
This allows to define a custom connectivity condition.
/proc/PID/mem Access Hardening
A new kernel parameter
proc_mem.force_override=neverhas been introduced by default to enhance system securityby preventing unwanted writes to protected process memory via
/proc/PID/mem.If the kernel parameter is removed, default behavior is restored, allowing access only if the process is traced.
Reproducible Disk Images
Talos disk images are now reproducible. Building the same version of Talos multiple times will yield
identical disk images.
Note: VHD and VMDK (Azure and VMware) images are not currently reproducible due to limitations in the underlying image creation tools.
Users verifying reproducible images should use raw images, verify checksums, and convert them to VHD/VMDK as needed.
ResolverConfig
The nameservers configuration in machine configuration now overwrites any previous layers (defaults, platform, etc.) when specified.
Previously a smart merge was performed to keep IPv4/IPv6 nameservers from lower layers if the machine configuration specified only one type.
Service Account Issuer configuration
In API Server, passing extra args with
service-account-issuerwill append them after default value.This allows easy migration, e.g. by changing
.cluster.controlPlane.endpointto new value, and keeping the old value in.cluster.apiServer.extraArgs["service-account-issuer"].talosctl images talos-bundlecan ignore reaching to the registryThe
talosctl images talos-bundlecommand now accepts optional--overlaysand--extensionsflags.If those are set to
false, the command will not attempt to reach out to the container registry to fetch the latest versions and digests of the overlays and extensions.Component Updates
Linux: 6.18.13
containerd: 2.2.1
etcd: 3.6.8
CoreDNS: 1.14.1
Kubernetes: 1.36.0-alpha.1
Flannel CNI plugin: v1.9.0-flannel1
Flannel: 0.28.1
LVM2: 2_03_38
runc: 1.4.0
systemd: 259.1
cryptsetup: 2.8.3
Tenstorrent: 2.7.0
iptables: 1.8.12
Talos is built with Go 1.26.0.
VM Hot-Add Support
Talos now includes udev rules to support hot-adding of CPUs in virtualized environments.
Contributors
Changes
221 commits
009f0d6cachore: update pkgsba56b0295feat: include hid-multitouch.ko kernel module in rootfsae29a0dccfeat: update Linux to 6.18.137cf1de279fix: bring in new version of go-cmd and go-blockdevicec8800b41efix: update path handling on talosctl cgroups0a7b6eb2cchore: test extensions8b1c974a2refactor: drop termui-widgets library5baa0028efix: add owning inventory annotation to talos manifestsd3e793d14fix: stop Kubernetes client from dynamically reloading the certs6a5a0e3bdfeat: support pattern link aliases9758bd4fefeat: update Go to 1.26e00aed0f6feat: update Kubernetes v1.36.0-alpha.1f20445ad0chore: improve logging of disk encryption handlingf018fbe7bfix: handle raw encryption keys with\nproperlye5b0eb017fix: hold user volumes root mountpoint8a0e79774refactor: split locate and provisiona59db0e92fix: improve OpenStack bare metal network configuration reliability659009ad8fix: remove stale endpointsdab0d4783fix: allow static hosts in/etc/hostswithout hostname45f214154feat: update go-kubernetes to use new Myers diff35ad0448cfix: switch to better Myers algorithm implementation0048464befeat: update etcd to v3.6.85df10f260fix: use mcopy instead of diskfs to populate VFATce53ffa90fix: disks flag parsing and handling in create qemu command3bd3dd7cafix: memory overuse in imager VFATf118ee47efix: read multi-doc machine config with newer talosctl70c6c2154feat: add filter for KubeSpan advertised networksdaf18abf4fix: fix talosctl debug in enforcing mode33b5b2565fix: ignore volumes in wave calculation without provisioninga16392559feat: add explicit service account support to Talos client4d531884echore: update dependencies406b8c83cfeat: update doc links to docs.siderolabs.com87615f551feat: implement network policies with Flannel CNI6995bc1b1chore: update homebrew formula on release7942d5a98fix: image gc controller config52e8727d0feat: add IPv6 GRE support9690dbad0chore: bump tools (including linter)2628eb2ecfix: typo with rpi_5 profile named5ebcd7cafix: stop building talosctl debug on Windows8b85c7c63chore: update depsd905035b5fix: swap volume configuration for min/max sized43a01ccbfeat: implementtalosctl debug34a31c979feat: add mount options support for existing volumes1bf95eed1feat: improve dashboard uptime display055add7aerelease(v1.13.0-alpha.1): prepare release900516e68chore: update image signer938de566efeat: bump kernel388cec727feat(overlays): add new overlays9f2dd6312refactor: api testsa90783146feat: add a helper module to generate standard patches1fec5b23dfix: implement merger for PercentageSize8b245b8f2feat: implement new image service APIsd90c775b8chore: rename internaltalosctl debug air-gapped2165280d0refactor: change the way one2many proxying is pickedb1b703dbechore: move sync logging code to go-kubernetes packagee48c6d7abfix: allow to expose a port multiple times in Docker410d8cb57fix: undo CRLF on Windows (talosctl edit)859d3f03cfeat: add RPi5 to the list of supported SBCs0bd48bbc6fix(talosctl): pass --k8s-endpoint flag to rotate-ca kubernetes rotationb9e27ebe7feat: update Linux kernel with dm-integrity6aa9b0677fix: skip empty documents on config decoding494492489fix: always set advertised peer URLs782cc507dfix: open the filesystem as read-only28e61a740fix: set GRUB prefix correctly on arm64a4f1c5239feat: update GRUB to 2.14562920701fix: use node podCIDRs for kubespan advertiseKubernetesNetworks39460365cfeat: implement layering for ProbeSpecb5c760f70feat: add ProbeConfig for network connectivity probes4b274f761feat: support aws cert manager in imager417209512fix: fallback to /proc/meminfo for memory modules7f1147bedfix: add warnings to 802.3ad bondddd6b186erefactor: generate GRUB imagesc7aa266eafix: overwrite resolver config with machine configcf70f05fafix: oracle platform file format8c7b8f5b7feat: add support for negative max size77bc3d21ffix: marshal of FailOverMac property38e280c93fix: make OOM expression a bit less sensitive3d1301640fix: wipe the first/last 1MiB in addition to wiping by signatures1aa6528adfix: make OOM controller more precise by considering separate cgroup PSIf7072c050fix: check if the device is not mounted when wiping743c3b94bfix: use correct containerd import pathf2dd08594feat: report image pull progress in the console72fe98a06fix: boot with GRUBd4ed13d93fix: add talos version to Hetzner Cloud client user agent150c41c30feat: update Linux to 6.18.501a367891fix: use append instead of prepend in service-account-issuerd1954278afeat: add extraArgs from service-account-issuer91b88f7f9feat: support multiple values for extraArgs96e604874fix: add hostname to endpoints7033275a7refactor: move BootloaderKind into machinery71adaf0eafix: sort mirrors and tls configs when generating the machine config34f09a300feat: add VLAN support to OpenStack platform5127ef7c2fix: wipe disk by signatures415bfaedbfix: panic in configpatcher when the whole section is missinge5aca71cdfix: fix healthcheck timeout634b71e2ddocs: move talosctl pcap example to Example Block818492731feat: implement KubeSpan multi-document configuration4d0604b9dchore: remove unrelated machineconfige36863470feat: add it87 hwmon module308c75090fix: resolve SideroLink Wireguard endpoint on reconnecte4ef494defix: drop the persist config flag from gen configc3176adcffeat: add EnvironmentConfiguration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.