Skip to content

fix(deps): bump the talos group across 1 directory with 3 updates - #8045

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/talos-dcfa38a3c3
Open

dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/go_modules/talos-dcfa38a3c3

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

Bumps the talos group with 3 updates in the / directory: github.com/siderolabs/omni/client, github.com/siderolabs/talos and github.com/siderolabs/talos/pkg/machinery.

Updates github.com/siderolabs/omni/client from 1.9.1 to 1.12.4

Release notes

Sourced from github.com/siderolabs/omni/client's releases.

v1.12.4

Omni 1.12.4 (2026-10-07)

Welcome to the v1.12.4 release of Omni!

Please try out the release binaries and report any issues at https://github.com/siderolabs/omni/issues.

Local Resource Service Removal

The local resource service, which served Omni resources on a local listener, is removed. Consumers should reach Omni through its regular API with a service account instead. Its services.localResourceService settings and flags have no effect.

Contributors

  • Utku Ozdemir
  • Oguz Kilcan
  • Artem Chernyshev
  • Andy Longwill
  • immanuwell

Changes

  • f9d1743a5 release(v1.12.4): prepare release
  • a1265ba7a fix: return only the unauthenticated error for an unsigned request
  • 69c79f273 fix: redact config secrets and clear the stored OIDC client secret
  • 3b0446c85 fix: forward only known headers to the Kubernetes apiserver
  • 4dfee714f fix: remove conflicting join token renew alias
  • 6eddd8c08 fix: require a confirmed key for workload proxy access
  • 18ac5ee9d fix: make a resource's cluster label agree with its target
  • 3b2a95383 fix: extract the cluster ID from label query terms correctly
  • 42a6dd708 feat: allow upgrading one deprecated Talos to another one in maintenance
  • 999446893 fix: do not allocate machines with outdated schematics into a cluster
  • 3526d6614 fix: reject unknown Talos versions on the talosctl downloads endpoint
  • 7d5c9bf5c feat: remove the local resource service
  • 33d8d5b7e fix: resolve node headers only for the runtime that uses them
  • d9e69d606 fix: read local resource server stream metadata from its own context
  • dcfa43a27 fix: verify the caller before reporting a resolution failure
  • 29958ee1a fix: check access before rejecting a request that names several nodes
  • e38d71c06 fix: record the outcome of Talos access in the audit log
  • 6f7d8c83e fix: parse the role of a public key request before any lookup
  • 2982aa994 fix: return only the access error for a denied request
  • fcf4c8568 fix: return the same error for a missing and an inaccessible target
  • 668469919 chore: bump otel libraries to close a vuln
  • 47322b255 fix(frontend): add v prefix to installer image tag

... (truncated)

Commits
  • f9d1743 release(v1.12.4): prepare release
  • a1265ba fix: return only the unauthenticated error for an unsigned request
  • 69c79f2 fix: redact config secrets and clear the stored OIDC client secret
  • 3b0446c fix: forward only known headers to the Kubernetes apiserver
  • 4dfee71 fix: remove conflicting join token renew alias
  • 6eddd8c fix: require a confirmed key for workload proxy access
  • 18ac5ee fix: make a resource's cluster label agree with its target
  • 3b2a953 fix: extract the cluster ID from label query terms correctly
  • 42a6dd7 feat: allow upgrading one deprecated Talos to another one in maintenance
  • 9994468 fix: do not allocate machines with outdated schematics into a cluster
  • Additional commits viewable in compare view

Updates github.com/siderolabs/talos from 1.14.0-alpha.2 to 1.14.1-0.20260903103040-09681e895fe6

Release notes

Sourced from github.com/siderolabs/talos's releases.

v1.14.0

Talos 1.14.0 (2026-09-03)

Welcome to the v1.14.0 release of Talos!

Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.

DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution. These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic. The DNS protocol can be configured on a per-name server basis in the ResolverConfig document, allowing for flexible configuration of DNS resolution.

Apply Configuration Modes

The '--mode=reboot' option has been removed from the talosctl apply-config command; by default, configuration is applied without a reboot. Most configuration changes don't require a reboot; the documentation lists the changes that do.

Native BGP

Talos now supports running native BGP routing instances on the host via embedded GoBGP servers, configured with BGPInstanceConfig documents. This removes the need to ship FRR as a system extension for the common fabric-facing use case.

List of changes:

  • Added repeatable, named BGPInstanceConfig documents to configure local ASN, router-id, optional Linux VRF, advertised interfaces, neighbors, and per-route preferred source (routeSource).
  • Peer hold-time and BFD behavior are configured inline on each concrete neighbor, which selects either an address or a link.
  • Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
  • Neighbor-local ASN overrides and passive sessions are supported. ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering.
  • BFD is currently supported only by the instance in the default routing domain; GoBGP's embedded BFD listener is not VRF-aware.
  • Each instance owns an isolated BGP RIB and, by default, installs learned routes into its default or VRF routing table through the existing route controllers. Set installRoutes: false to retain learned routes in the BGP RIB without installing them into the Linux routing table.
  • Instances can selectively import best neighbor-learned routes from other named instances with importRoutes prefix selectors. Imports are one-way, preserve path attributes, and do not recursively import locally originated or previously imported paths.
  • Peer state is observable via instance-qualified BGPPeerStatus resources (talosctl get bgppeerstatus).
  • RouteSpec/RouteStatus now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.

Btrfs Support

Talos now supports mounting and provisioning btrfs filesystem for user volumes and existing volumes.

Support for btrfs is enabled by installing btrfs system extension.

Unified --namespace Flag

... (truncated)

Commits

Updates github.com/siderolabs/talos/pkg/machinery from 1.14.0-alpha.2 to 1.15.0-alpha.0.0.20260908133727-5c5fd29e95f7

Release notes

Sourced from github.com/siderolabs/talos/pkg/machinery's releases.

v1.15.0-alpha.2

Talos 1.15.0-alpha.2 (2026-10-27)

Welcome to the v1.15.0-alpha.2 release of Talos!
This is a pre-release of Talos

Please try out the release binaries and report any issues at https://github.com/siderolabs/talos/issues.

Boot Partition Wait

Talos now waits for the partition it was booted from to be discovered before declaring the system volumes (META, STATE) missing and entering maintenance mode, so that disks enumerated late (SD cards, USB, some RAID controllers) are not mistaken for a fresh machine.

On UEFI systems booted via systemd-boot the boot partition comes from the LoaderDevicePartUUID EFI variable, while the GRUB configuration now passes the talos.boot.partuuid=<UUID> kernel argument (probed by GRUB at boot). The detected boot partition is published as the bootpartition resource.

Container Swap Limit

ContainerConfig documents can now cap the swap a container may use, independently of its memory limit:

apiVersion: v1alpha1
kind: ContainerConfig
name: collector
image: ghcr.io/example/collector:v1.0.0
resources:
  limits:
    swap: "0"

The value maps onto cgroup v2 memory.swap.max. Zero keeps the container out of swap entirely, so its memory ceiling is enforced by the OOM killer rather than by swapping; unset leaves the node's swap available to it.

containerd Configuration Version 4

Talos now generates containerd configuration with version = 4 (previously version = 3).

containerd only migrates configuration from older versions, so any custom CRI configuration provided via CRICustomizationConfig documents (or shipped by system extensions) is now interpreted as version 4, and settings which moved in version 4 are silently ignored (only a Ignoring unknown key in TOML warning is logged by containerd).

In version 4, the top-level server sections moved into plugin configuration blocks, so the following patches need to be adjusted:

version 3 version 4
[metrics] address [plugins."io.containerd.server.v1.metrics"] address

... (truncated)

Commits

@ksail-bot
ksail-bot Bot enabled auto-merge (squash) October 28, 2026 17:28
@github-actions

github-actions Bot commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

✅⚠️MegaLinter analysis: Success with warnings

⚠️ BASH / bash-exec - 1 error
Results of bash-exec linter (version 5.3.9)
See documentation on https://megalinter.io/10.1.0/descriptors/bash_bash_exec/
-----------------------------------------------

✅ [SUCCESS] .github/actions/cleanup-hetzner/cleanup-hetzner.sh
✅ [SUCCESS] .github/actions/cleanup-hetzner/cleanup-hetzner.test.sh
✅ [SUCCESS] .github/actions/free-disk-space/free-disk-space.sh
✅ [SUCCESS] .github/actions/ksail-cluster/hetzner-inventory-config.sh
✅ [SUCCESS] .github/actions/ksail-system-test/autoscaler-audit-trial.sh
✅ [SUCCESS] .github/actions/ksail-system-test/calico-migration.sh
✅ [SUCCESS] .github/actions/ksail-system-test/calico-migration.test.sh
✅ [SUCCESS] .github/actions/ksail-system-test/chart-values-drift.sh
✅ [SUCCESS] .github/actions/ksail-system-test/helm-values-precedence.sh
✅ [SUCCESS] .github/actions/ksail-system-test/offline-ecr-upstream.sh
✅ [SUCCESS] .github/actions/ksail-system-test/offline-ecr-upstream.test.sh
✅ [SUCCESS] .github/actions/ksail-system-test/talos-kubernetes-upgrade.sh
✅ [SUCCESS] .github/actions/ksail-system-test/verify-offline-ecr-pull.sh
✅ [SUCCESS] .github/actions/ksail-system-test/verify-offline-ecr-pull.test.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/install-with-recovery.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/install-with-recovery.test.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/reject-remote-kustomize-resources.sh
✅ [SUCCESS] .github/actions/ksail-test-workload/remote-resource-guard.test.sh
✅ [SUCCESS] .github/actions/pull-registry-image/pull-registry-image.sh
✅ [SUCCESS] .github/actions/rate-limit-gate/wait-for-rate-limit.sh
✅ [SUCCESS] .github/actions/rate-limit-gate/wait-for-rate-limit.test.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/cache-validation.test.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/mirror-artifact.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/pull-helper-image.sh
✅ [SUCCESS] .github/actions/warm-mirror-cache/pull-helper-image.test.sh
✅ [SUCCESS] .github/scripts/assert-gitops-deployed.sh
✅ [SUCCESS] .github/scripts/assert-gitops-deployed.test.sh
✅ [SUCCESS] .github/scripts/assert-k3k-server-creator.sh
✅ [SUCCESS] .github/scripts/assert-k3k-server-creator.test.sh
✅ [SUCCESS] .github/scripts/build-calico-migration-baseline.sh
✅ [SUCCESS] .github/scripts/cask-pr-handoff-workflow.test.sh
✅ [SUCCESS] .github/scripts/cask-rendering.test.sh
✅ [SUCCESS] .github/scripts/check-eks-capacity.sh
✅ [SUCCESS] .github/scripts/check-eks-capacity.test.sh
✅ [SUCCESS] .github/scripts/codeql-autobuild-prepare.sh
✅ [SUCCESS] .github/scripts/codeql-autobuild-prepare.test.sh
✅ [SUCCESS] .github/scripts/codeql-source.sh
✅ [SUCCESS] .github/scripts/collect-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/collect-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/delete-eks-smoke-cluster.sh
✅ [SUCCESS] .github/scripts/delete-eks-smoke-cluster.test.sh
✅ [SUCCESS] .github/scripts/delete-old-workflow-runs.sh
✅ [SUCCESS] .github/scripts/delete-old-workflow-runs.test.sh
✅ [SUCCESS] .github/scripts/download-go-modules.sh
✅ [SUCCESS] .github/scripts/eks-report-test-lib.sh
✅ [SUCCESS] .github/scripts/find-merged-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/find-merged-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/finish-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/finish-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/install-release.test.sh
✅ [SUCCESS] .github/scripts/list-link-check-files.sh
✅ [SUCCESS] .github/scripts/profile-codeql-cohort.sh
✅ [SUCCESS] .github/scripts/profile-codeql-compare.sh
✅ [SUCCESS] .github/scripts/profile-codeql-compare.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-files.sh
✅ [SUCCESS] .github/scripts/profile-codeql-files.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-go.sh
✅ [SUCCESS] .github/scripts/profile-codeql-go.test.sh
✅ [SUCCESS] .github/scripts/profile-codeql-swap.sh
✅ [SUCCESS] .github/scripts/profile-codeql-swap.test.sh
✅ [SUCCESS] .github/scripts/publish-mcp-registry.sh
✅ [SUCCESS] .github/scripts/publish-mcp-registry.test.sh
✅ [SUCCESS] .github/scripts/publish-operator-chart.sh
✅ [SUCCESS] .github/scripts/redraft-evergreen-cask-prs.sh
✅ [SUCCESS] .github/scripts/redraft-evergreen-cask-prs.test.sh
✅ [SUCCESS] .github/scripts/report-eks-account-capacity.sh
✅ [SUCCESS] .github/scripts/report-eks-account-capacity.test.sh
✅ [SUCCESS] .github/scripts/report-eks-create-failure.sh
✅ [SUCCESS] .github/scripts/report-eks-create-failure.test.sh
✅ [SUCCESS] .github/scripts/resolve-cask-publication.sh
✅ [SUCCESS] .github/scripts/resolve-cask-publication.test.sh
✅ [SUCCESS] .github/scripts/resolve-release-publish-state.sh
✅ [SUCCESS] .github/scripts/resolve-release-publish-state.test.sh
❌ [ERROR] .github/scripts/resolve-release-replay.sh
    Error: File:[.github/scripts/resolve-release-replay.sh] is not executable

✅ [SUCCESS] .github/scripts/strict-link-transport.sh
✅ [SUCCESS] .github/scripts/strict-link-transport.test.sh
✅ [SUCCESS] .github/scripts/style-clean-cask-branch.sh
✅ [SUCCESS] .github/scripts/style-clean-cask-branch.test.sh
✅ [SUCCESS] .github/scripts/upload-release-assets.sh
✅ [SUCCESS] .github/scripts/upload-release-assets.test.sh
✅ [SUCCESS] .github/scripts/validate-cask-pr-handoff.sh
✅ [SUCCESS] .github/scripts/validate-cask-pr-handoff.test.sh
✅ [SUCCESS] .github/scripts/validate-release-ref.sh
✅ [SUCCESS] .github/scripts/validate-release-ref.test.sh
✅ [SUCCESS] .github/scripts/verify-desktop-codeql.sh
✅ [SUCCESS] .github/scripts/verify-desktop-codeql.test.sh
✅ [SUCCESS] .github/scripts/verify-go-archive-parity.sh
✅ [SUCCESS] .github/scripts/verify-go-archive-parity.test.sh
✅ [SUCCESS] .github/scripts/verify-otelzap-parity.sh
✅ [SUCCESS] .github/scripts/verify-otelzap-parity.test.sh
✅ [SUCCESS] .github/scripts/verify-vendored-comment-scan.sh
✅ [SUCCESS] .github/scripts/wait-for-github-api-budget.sh
✅ [SUCCESS] .github/scripts/wait-for-github-api-budget.test.sh
✅ [SUCCESS] desktop/scripts/make-icns.sh
✅ [SUCCESS] desktop/scripts/make-info-plist.sh
✅ [SUCCESS] desktop/scripts/make-macos-app.sh
✅ [SUCCESS] docs/demos/render.sh
✅ [SUCCESS] images/ksail-analysis-runner/smoke.sh
✅ [SUCCESS] install.sh
✅ [SUCCESS] internal/ciharness/testdata/schematic_fake_ksail.sh
✅ [SUCCESS] pkg/svc/provisioner/cluster/vcluster/containerd_registry_hosts.sh
✅ [SUCCESS] scripts/stage-webui.sh

✅ Linters with no issues

actionlint, git_diff, hadolint, jscpd, jsonlint, lychee, markdown-table-formatter, markdownlint, prettier, prettier, shellcheck, shfmt, stylelint, syft, trivy-sbom, trufflehog, v8r, v8r, yamllint

See detailed reports in MegaLinter artifacts

MegaLinter is provided by OX Security
Show us your support by starring ⭐ the repository

@devantler

devantler commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

🤖 Generated by the Agentic Engineer

Blocker: #7259 | upstream | last-verified 2026-10-28: Head 9f26a11 fails the Build job 40734462790/job/122985137534: the Talos machinery update removes ClusterConfig.Name and MachineConfig.Kubelet, which KSail still uses, and it selects Kubernetes v0.37.0, whose k8s.io/api no longer compiles against the apimachinery version vcluster and Kyverno keep in the graph (MarkShortCircuit undefined). This is the same incompatibility that parked ksail#8029. Re-enter after a compatible coordinated graph and fresh native validation; no unchanged retry or dependency override.

Refreshed 2026-11-01: #7259 is still open. The head is now af3ca3d. It conflicts with main and its Build and dependency contract checks fail. The cause above was read at 9f26a11 and was not re-read at this head.

@dependabot
dependabot Bot force-pushed the dependabot/go_modules/talos-dcfa38a3c3 branch from 9f26a11 to 277595e Compare October 29, 2026 17:15
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/talos-dcfa38a3c3 branch from 277595e to 1eaea25 Compare October 29, 2026 21:22
Bumps the talos group with 3 updates in the / directory: [github.com/siderolabs/omni/client](https://github.com/siderolabs/omni), [github.com/siderolabs/talos](https://github.com/siderolabs/talos) and [github.com/siderolabs/talos/pkg/machinery](https://github.com/siderolabs/talos).


Updates `github.com/siderolabs/omni/client` from 1.9.1 to 1.12.4
- [Release notes](https://github.com/siderolabs/omni/releases)
- [Commits](siderolabs/omni@v1.9.1...v1.12.4)

Updates `github.com/siderolabs/talos` from 1.14.0-alpha.2 to 1.14.1-0.20260903103040-09681e895fe6
- [Release notes](https://github.com/siderolabs/talos/releases)
- [Changelog](https://github.com/siderolabs/talos/blob/main/RELEASE.md)
- [Commits](https://github.com/siderolabs/talos/commits)

Updates `github.com/siderolabs/talos/pkg/machinery` from 1.14.0-alpha.2 to 1.15.0-alpha.0.0.20260908133727-5c5fd29e95f7
- [Release notes](https://github.com/siderolabs/talos/releases)
- [Changelog](https://github.com/siderolabs/talos/blob/main/RELEASE.md)
- [Commits](https://github.com/siderolabs/talos/commits)

---
updated-dependencies:
- dependency-name: github.com/siderolabs/omni/client
  dependency-version: 1.12.4
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: talos
- dependency-name: github.com/siderolabs/talos
  dependency-version: 1.14.1-0.20260903103040-09681e895fe6
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: talos
- dependency-name: github.com/siderolabs/talos/pkg/machinery
  dependency-version: 1.15.0-alpha.0.0.20260908133727-5c5fd29e95f7
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: talos
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/go_modules/talos-dcfa38a3c3 branch from 1eaea25 to af3ca3d Compare October 30, 2026 17:16

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: 🫴 Ready

Development

Successfully merging this pull request may close these issues.

1 participant