chore: update dependencies #68
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Update Request | Renovate Bot
This PR contains the following updates:
v1.9.5->v1.11.3v1.9.2->v1.11.3v0.32.0->v0.37.0v0.29.0->v0.37.0Release Notes
siderolabs/talos (github.com/siderolabs/talos/pkg/machinery)
v1.11.3Compare Source
Talos 1.11.3 (2025-10-15)
Welcome to the v1.11.3 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
runc: 1.3.2
Kubernetes: 1.34.1
Linux: 6.12.52
linux-firmware:
2025101CoreDNS: 1.12.4
etcd: 3.6.5
Flannel: 0.27.4
Talos is built with Go 1.24.9.
Contributors
Changes
11 commits
a0243efrelease(v1.11.3): prepare release560241cfix: make Akamai platform usable1b23cadfix: cherry-pick of commit0fbb0b0from #11959876719afix: cherry-pick of commitcd9fb27from #119439a30ab6feat: bump go, kernel and runc0fbb0b0fix: provide nocloud metadata with missing network config0dad328feat: update Flannel to v0.27.449182b3fix: support secure HTTP proxy with gRPC diala460f57feat: update etcd 3.6.5, CoreDNS 1.12.448ee858fix: don't set broadcast for /31 and /32 addresses7668c52fix: provide refreshing CA pool (resolvers)Changes from siderolabs/pkgs
5 commits
c316374feat: bump go to 1.24.9769a799feat: update linux-firmware to202510199ddfd5feat: update runc to 1.3.24fecfebfeat: bump kernel to 6.12.52934783ffeat: bump goChanges from siderolabs/tools
2 commits
05ee846feat: bump goefbbe9dfeat: bump goDependency Changes
Previous release can be found at v1.11.2
Images
v1.11.2Compare Source
Talos 1.11.2 (2025-09-25)
Welcome to the v1.11.2 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
runc: 1.3.1
Kubernetes: 1.34.1
Linux: 6.12.48
linux-firmware:
2025091Talos is built with Go 1.24.6.
Contributors
Changes
17 commits
511b4d2release(v1.11.2): prepare releaseac45257fix: default gateway as string7cec0e0fix: uefi boot entry handling logic637154edocs: drop invalid v1.12 docsa6d2f65chore(ci): rekres to use new runner groupscd82ee2refactor: efivarfs mock and tests996d97dchore: update pkgsbbf860cdocs: update component updates24c1bcefix: bump trustd memory limit56d6d6fchore: pass in github token to imager682df89fix: use correct order to determine SideroV1 keys directory patha838881fix: trim zero bytes in the DHCP host & domain response9c962aefix: re-create cgroups when restarting runnersde243f9test: fix flakiness in RawVolumes testec8fde5feat: update Kubernetes to 1.34.1797897dtest: improve test stability9827366feat: update runc to 1.3.1Changes from siderolabs/pkgs
3 commits
f95c679chore: update kernel to 6.12.480bd4cb9chore: update linuxfirmware and rekres0c8a195feat: update runc to 1.3.1Dependency Changes
Previous release can be found at v1.11.1
Images
v1.11.1Compare Source
Talos 1.11.1 (2025-09-08)
Welcome to the v1.11.1 release of Talos!
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Component Updates
Linux: 6.12.45
CoreDNS: 1.12.3
Talos is built with Go 1.24.6.
Contributors
Changes
7 commits
8e85c83release(v1.11.1): prepare releaseff8644cfix: correctly handle status-code 2047d5fe2dfeat: update Linux kernel (memcg_v1, ublk)9e310a9fix: enable support for VMWare arm64f7620f0feat: update CoreDNS to 1.12.301bf2f6feat: add SOCKS5 proxy support to dynamic proxy dialer8a578bcfeat: update Linux to 6.12.45Changes from siderolabs/pkgs
3 commits
1a25681feat: enable ublk support95f0be4fix: enable memcg v1e1c333cfeat: update Linux to 6.12.45Dependency Changes
Previous release can be found at v1.11.0
Images
v1.11.0Compare Source
Welcome to the v1.12.0-alpha.2 release of Talos!
This is a pre-release of Talos
Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.
Disk Encryption
Talos versions prior to v1.12 used the state of PCR 7 and signed policies locked to PCR 11 for TPM based disk encryption.
Talos now supports configuring which PCRs states are to be used for TPM based disk encryption via the
options.pcrsfield in the
tpmsection of the disk encryption configuration.If user doesn't specify any options Talos defaults to using PCR 7 for backwards compatibility with existing installations.
This change was made to improve compatibility with systems that may have varying states in PCR 7 due to UEFI Secure Boot configurations
and users may wish to disable locking to PCR 7 state entirely.
Signed PCR policies will still be bound to PCR 11.
The currently used PCR's can be seen with
talosctl get volumestatus <volume> -o yamlcommand.Embedded Config
Talos Linux now supports embedding the machine configuration directly into the boot image.
etcd
etcd container image is now pulled from
registry.k8s.io/etcdinstead ofgcr.io/etcd-development/etcd.Ethernet Configuration
The Ethernet configuration now includes a
wakeOnLANfield to enable Wake-on-LAN (WOL) support.This field can be set to enable WOL and specify the desired WOL modes.
Extra Binaries
Talos Linux now ships with
nftbinary in the rootfs to support CNIs which shell out tonftcommand.Feature Lock
Talos now ignores the following machine configuration fields:
machine.features.rbac(locked to true)machine.features.apidCheckExtKeyUsage(locked to true)cluster.apiServer.disablePodSecurityPolicy(locked to false)These fields were removed from the default machine configuration schema in v1.12 and are now always set to the locked values above.
GRUB
Talos Linux introduces new machine configuration option
.machine.install.grubUseUKICmdlineto control whether GRUB should use the kernel command lineprovided by the boot assets (UKI) or to use the command line constructed by Talos itself (legacy behavior).
This option defaults to
truefor new installations, which means that GRUB will use the command line from the UKI, making it easier to customize kernel parameters via boot asset generation.For existing installations upgrading to v1.12, this option will default to
falseto preserve the legacy behavior.Kernel Module
Talos now supports optionally disabling kernel module signature verification by setting
module.sig_enforce=0kernel parameter.By default module signature verification is enabled (
module.sig_enforce=1).When using Factory or Imager supply as
-module.sig_enfore module.sig_enforce=0kernel parameters to disable module signature enforcement.Kernel Security Posture Profile (KSPP)
Talos now enables a stricter set of KSPP sysctl settings by default.
The list of overridden settings is available with
talosctl get kernelparamstatuscommand.Encrypted Volumes
Talos Linux now consistently provides mapped names for encrypted volumes in the format
/dev/mapper/luks2-<volume-id>.This change should not affect system or user volumes, but might allow easier identification of encrypted volumes,
and specifically for raw encrypted volumes.
talosctl image cache-serve
talosctlincludes new subcommandimage cache-serve.It allows serving the created OCI image registry over HTTP/HTTPS.
It is a read-only registry, meaning images cannot be pushed to it, but the backing storage can be updated by re-running the
cache-createcommand;Additionally
talosctl image cache-createhas some changes:--layout:oci(default),flat:ocipreserves current behavior;flatdoes not repack artifact layer, but moves it to a destination directory, allowing it to be served bytalosctl image cache-serve;--platform: now can accept multiple os/arch combinations:--platform=linux/amd64,linux/arm64);--platform=linux/amd64 --platform=linux/arm64);Component Updates
Linux: 6.17.5
Kubernetes: 1.35.0-alpha.2
CNI Plugins: 1.8.0
cryptsetup: 2.8.1
LVM2: 2_03_34
systemd-udevd: 257.8
runc: 1.3.2
CoreDNS: 1.13.0
etcd: 3.6.5
Flannel: 0.27.4
Flannel CNI plugin: v1.8.0-flannel1
Talos is built with Go 1.25.3.
Contributors
Changes
245 commits
3d811a4c8release(v1.12.0-alpha.2): prepare releasefb4bfe851chore: fix LVM testf4ee0d112chore: disable VIP operator test288f63872feat: bump depsb66482c52feat: allow disabling injection of extra cmdline in cluster create704b5f99efeat: update Kubernetes to 1.35.0-alpha.21dffa5d99feat: implement virtual IP operator config43b1d7537fix: validate provisioner when destroying local clustersb494c54c8fix: talos import on non-linux61e95cb4bfeat: support bootloader option for ISOd11072726fix: provide offset for partitions in discovered volumes39eeae963feat: update dependencies9890a9a31test: fix OOM testc0772b8edfeat: add airgapped mode to QEMU backed talosac60a9e27fix: update test for PCI driver rebind/IOMMU6c98f4cdbfeat: implement new DHCP network configurationda92a756dfix: drop 'ro' falg from defaults28fd2390cfix: imager build on arm644e12df8c5test: integration test for OOM controller7e498fabafeat: use image signereccb21dd3feat: add presets to the 'cluster create qemu' commandec0a813fafeat: unify cmdline handling GRUB/systemd-boot37e4c40c6fix: skip module signature tests on docker provisioner only8124efb42fix: cache e2e4adcda0f5fix: reserve the apid and trustd ports from the ephemeral port rangeced57b047feat: support optionally disabling module sig verification1e5c4ed64fix: build talosctl image cache-serve non-linuxdbdd2b237feat: add static registry to talosctl77d8cc7c5chore: pushlatesttag only on main59d9b1c75feat: update dependenciesbf6ad5171feat: add back install scriptda451c5bachore: drop documentation except for fresh reference2f23fedebfix: file leak in reading cgroupsb412ffdbcdocs: update README.md for docs link8dc51bae7feat: add drm_gpuvm and drm_gpusvm_helper modules4ca58aeb8fix: make Akamai platform usable061f8e76ffeat: bump pkgsa9fa852dafeat: update uefi image to talos linux logo04753ba69feat: update go to 1.25.29a42b05bdfeat: implement link aliasingd732bd0bechore(ci): run only nvidia tests for NVIDIA workflows8d1468209fix: stop populating apiserver cert SANs02473244cfix: wait for mount status to be proper mode825622d90fix: resource proto definitions2c6003e79docs: add Project Calico installation in two mode4fb4c8678feat: add disk.EnableUUID to generated ova33fb48f8ffix: add dashboard spinner053fd0bd4feat: update Linux to 6.1734e107e1bdocs: fix broken linkdfbece56bdocs: update the kubespan docs8b041a72cdocs: update scaleway.md435dcbf82fix: provide nocloud metadata with missing network configec3bd878frefactor: remove the go-blockdevice v1 completely33544bde9fix: minor improvements to fsfd2eebf7ffeat: create merge patch from diff of two machine configseadbdda94fix: uefi boot order settingcd9fb2743fix: support secure HTTP proxy with gRPC dialadf87b4b9feat: update Flannel to v0.27.45dfb7e1fefeat: serve etcd image from registry.k8s.io5ca841804fix: nftables flaky testa940e45a7feat: generate list of images required to build talos3472d6e79fix: revert "chore: use new mount/v3 package in efivarfs"42c0bdbf3feat: add provisioner flag to images default command6bc0b1bcffeat: drop and lock deprecated features362a8e63bfix: change the compression format6e58f58aafix: mkdir artifacts path3165a2b84release(v1.12.0-alpha.1): prepare releasee455c7ea9chore: use testing/synctest in tests7f048e962feat: update dependenciesfe36b3d32fix: stop returning EINVAL on remount of detached mountsc6279e04cchore: use new mount/v3 package in efivarfsd5197effbfeat: update etcd 3.6.5, CoreDNS 1.12.433714b715feat: release cloud image using factoryd10a2747edocs: deprecate JSON6902 patches and interactive installer1e604cbf5fix: don't set broadcast for /31 and /32 addresses65a66097arefactor: split cluster create logic into smaller partsab847310efix: provide refreshing CA pool (resolvers)d63c3ed7ddocs: update secureboot docs493f7ed9dfeat: support embedded config251df70f6feat: add a userspace OOM controller7bae5b40bfeat: implement link configuration724857decfix(ci): skip netbird extension for testse06a08698fix: default gateway as string7ed07412efix: uefi boot entry handling logicea4ed165arefactor: efivarfs mock and tests1fca111e2feat: support setting wake-on-lan for Ethernet94f78dbe7docs: add a documentation for running Talos in KVM46902f8fddocs: add TrueFullstaq to adoptersa28e5cbd5chore: update pkgs and tools7cf403db8docs: step-by-step scaleway documentation to get an image687285fa2docs: remove 'curl' in wget command9db6dc06cfeat: stop mounting state partition53ce93aaetest: try to clear connection refused more aggressively51db5279cfix: bump trustd memory limit25204dc8afix(machined): changeconstants.MinimumGOAMD64Levelusing build tag9cd2d794dfeat: ship nft binary with Talos rootfsb1416c9fefeat: record last log the failed service0b129f9effeat: enforce more KSPP and hardening sysctls11872643cchore: drop docs folderd30fdcd88chore: pass in github token to imagerb88f27d80chore: make reset test code a bit better1cde53d01test: fix several issues with tests16cd127a0docs: add docs on updating image cachec3ae92b14fix: build kernel checks only on linux2120904ecfeat: create detached tmpfs6bbee6de5docs: remove 'ceph-data' from volume examples/docs07acb3bd2fix: use correct order to determine SideroV1 keys directory path2d57fa002fix: trim zero bytes in the DHCP host & domain response451cb5f78docs: clarify disk partition confusiona2122ee5cfeat: implement HostConfig multi-doc69ab076b4fix: re-create cgroups when restarting runners297b5cc28docs: add docs on node labelse168512ddfix: apply 'ro' flag to iso9660 filesystems7f7acfbb9docs: fix typo in docd57882b18feat: update Kubernetes to 1.34.1f85f82f32test: fix flakiness in RawVolumes test82569e319feat: update Linux 6.16.62fd2ab4e4fix: remove CoreDNS cpu limitce9bc32a0chore(ci): rekres to use new runner groups8b64f68f6test: improve test stability272cb860dchore: drop the --input-dir flag from the cluster create command1b6533675docs: add note about ca-signed certs for securebootd3f88f50cdocs: document talos vip failover behavior005fc8bd5docs: add docs on syncing configs after a kube upgrade4d876d9affeat: update Go to 1.25.12b556cd22feat: implement multi-doc StaticHostConfiga7b776842docs: replace Raspberry Pi 5 links with Talos buildera349b20eddocs: clarify that talos does not support intermediate ca895133de9feat: support configuring PCR states to bind disk encryptionc1360103bdocs: fix command for uploading image on Hetzner43b5b9d89fix: correctly handle status-code 204feeb0d312feat: update runc to 1.3.1421634a14docs: add docs on multihoming41af2d230refactor: clean up internal cluster creation code3000d9e43fix: don't bootstrap talos cluster if there's no config present79cb871d0feat: use the id of the volume in the mapped luks2 name6c322710dchore: refactor mount packageced7186e2refactor: update COSI to 1.11.0de2e24fcddocs: clarify that install-cni image is deprecatedbef8ef509docs: add docs on cilium's compatibility with kubespane5acb10fcfeat: update pkgsc4c1daf0edocs: add info about br_netfilter5c52ecac3docs: clarify interactive dashboard resolution control15ecb02a4feat: update Linux kernel (memcg_v1, ublk)53f18c2f6fix: enable support for VMWare arm643bbe1c0dadocs: add docs on grow flagb9fb09dcdrelease(v1.12.0-alpha.0): prepare release6a389cad3chore: update dependencies9d98c2e89feat: add a cgroup preset for PSI and --skip-cri-resolve072f77b16chore: prepare for future Talos 1.12-alpha.0 release96f41ce88docs: update qemu and docker docsa751cd6b7docs: activate Talos v1.11 docs by defaulte8f1ec1c5docs: fix broken create qemu command v1.11 docs639f0dfddfeat: update Linux to 6.16.48aa7b3933fix: bring back linux/armv7 build and update xz9cae7ba6bfeat: update CoreDNS to 1.12.3cfef3ad45fix: drop linux/armv7 build42ea2ac50fix: update xz module (security)4fcfd35b9docs: fix module name example50824599achore: update some toolsbcd297490feat: allowEd25119in FIPS mode5992138bbtest: ignore one leaking goroutined155326c1docs: add sbc unofficial ports docs285fa7d22docs: add the deploy application docs527791f09feat: update Kubernetes to 1.34.0a1c0e237dfeat: update Linux to 6.15.11, Go to 1.254d7fc25f8docs: switch order of wipe disk command7368a994dfeat: add SOCKS5 proxy support to dynamic proxy dialerd63591069chore: silence linter warnings07eb4d7ecfix: set default ram unit to MiB instead of MB6b732adc4feat: update Linux to 6.12.43b6410914ffeat: add human readable byte size cli flagsec70cef99feat: update NVIDIA drivers and kernel0879efa69feat: update Kubernetes default to v1.34.0-rc.2f504639dffeat: add a user-facing create qemu command558e0b09atest: fix the Image Factory PXE boot testd73f0a2e5docs: make readme badges consistentf1369af98chore: use new filesystem api on STATE partition366cedbe7docs: link to kubernetes linux swap tuning2f5a16f5efix: make --with-uuid-hostnames functionality available to qemu provider70612c1f9refactor: split the PlatformConfigController511748339docs: add system extension tier documentation009fb1540test: don't run nvidia tests on integration/aws99674ef20docs: apply fixes for what is new92db677b5fix: image cache lockup on a missing volume9c97ed886fix: version contract parsing in encryption keys handling1fc670a08fix: dial with proxy18447d0affeat: update Linux to 6.12.41f65f39b78fix: provide mitigation CVE-1999-05248817cc60cfix: actually use SIDEROV1_KEYS_DIR env var if it's providedb08b20a10feat: use key provider with fallback option for auth type SideroV17a52d7489fix: kubernetes upgrade options for kubeletea8289f55feat: add a user facing docker command54ad64765chore: re-enable vulncheck26bbddea9fix: darwin buildb5d5ef79efix: set secs field in DHCPv4 packetsc07911933chore: refactor how tools are being installed34f25815cdocs: fork docs for v1.12b66b995d3feat: update default Kubernetes to v1.34.0-rc.1b967c587ddocs: fix clone URL to include.gitb72c68398docs: edit the insecure, etcd-metrics, inline and extramanifestse5b9c1fffdocs: remov RAS Syndrome701fe774bdocs: fix cilium links and bump to 1.18.0d306713a1feat: update Go to 1.24.6721595a00chore: add deadcode elimination linterdc4865915refactor: stop usingtext/templateinmachinedcode paths545be55edfeat: add a pause function to dashboard06a6c0fe3refactor: fix deadcode elimination with godbus2dce8f8d4refactor: replace containerd/containerd/v2 module for proper DCE9b11d8608chore: rekres to configure slack notify workflow for CI failures5ce6a660fdocs: augment the pod security docsada51ff69fix: unmarshal encryption STATE from METAb9e9b2e07docs: add what is new notes for 1.1153055bdf4docs: fix typo in kubevirt page8d12db480fix: one more attempt to fix volume mount race on restart34d37a268chore: rekres to use correct slack channel for slack-notify326a00538feat: implementtalos.config.earlycommand line arga5f3000f2feat: implement encryption locking to STATEc1e65a342docs: remove talos API flags from mgmt commands181d0bbf5feat: bootedentry resource7ad439ac3fix: enforce minimum size on user volumes if not set explicitly50e37aefdfix: live reload of TLS client config for discovery client87efd75effeat: update containerd to 2.1.4724b9de6dfeat: addF71808Ewatchdog driver8af96f7afdocs: add ETCD downgrade documentation44edd205ddocs: add remark about 'exclude-from-external-load-balancers' label727101926fix(ci): use a random suffix for ami namesd621ce372fix: grype scand62e255c2fix: issues with reading GPT5d0883e14feat: update PCI DB module to v0.3.23751c8ccftest: wait for service account test job longera592eb9f9feat: update Linux to 6.12.404c40e6d3ffeat: update etcd to 3.6.42bc37bd2cdocs: fix error in kernel module guidebfc57fb86chore: tag aws snapshots created via ci with the image name06ef7108afix: issue with volume remount on service restart03efbff18docsConfiguration
📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
This PR was generated by Mend Renovate. View the repository job log.