Skip to content

chore(deps): update ⬆️ mise-packages - #1058

Open
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/mise-packages
Open

chore(deps): update ⬆️ mise-packages#1058
renovate[bot] wants to merge 2 commits into
mainfrom
renovate/mise-packages

Conversation

@renovate

@renovate renovate Bot commented Sep 8, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change Pending Age Adoption Passing Confidence
aqua:astral-sh/ruff tools patch 0.16.50.16.6 age adoption passing confidence
aqua:cli/cli tools minor 2.99.02.100.0 age adoption passing confidence
aqua:dprint/dprint tools patch 0.57.00.57.1 0.57.4 (+2) age adoption passing confidence
aqua:editorconfig-checker/editorconfig-checker tools patch 3.11.23.11.3 age adoption passing confidence
aqua:google/go-containerregistry tools patch 0.22.00.22.1 age adoption passing confidence
aqua:openai/codex tools minor rust-v0.152.1rust-v0.153.2 rust-v0.153.4 (+1) age adoption passing confidence
aqua:siderolabs/talos tools minor 1.13.91.14.0 age adoption passing confidence
aqua:sst/opencode tools patch 1.18.261.18.27 1.18.29 (+1) age adoption passing confidence
droid (source) minor 0.211.00.212.1 0.213.0 age adoption passing confidence
github:agavra/tuicr tools minor v0.24.0v0.25.0 age adoption passing confidence
github:anthropics/claude-code tools patch v2.1.258v2.1.260 v2.1.263 (+1) age adoption passing confidence
github:backnotprop/plannotator tools patch v0.27.11v0.27.12 age adoption passing confidence
github:github/gh-stack tools patch v0.1.0v0.1.1 age adoption passing confidence
github:janosmiko/lfk tools patch v0.18.6v0.18.7 v0.18.8 age adoption passing confidence
github:kitlangton/ghui tools patch v0.9.0v0.9.1 age adoption passing confidence
github:modem-dev/hunk tools minor v0.20.1v0.21.0 v0.21.1 age adoption passing confidence
github:schpet/linear-cli tools minor v2.5.0v2.6.0 age adoption passing confidence
npm:cspell (source) tools patch 10.2.010.2.2 age adoption passing confidence
npm:ctx7 (source) tools patch 0.5.90.5.10 age adoption passing confidence
npm:socket tools patch 1.1.1661.1.167 1.1.169 (+1) age adoption passing confidence
npm:stylelint (source) tools minor 17.14.117.15.0 age adoption passing confidence
rust (source, changelog) tools patch 1.98.01.98.1 age adoption passing confidence

Release notes are maintained in a PR comment by the renovate-release-notes-comment workflow.


Configuration

📅 Schedule: (in timezone America/Los_Angeles)

  • Branch creation
    • Between 03:00 AM and 05:59 AM (* 3-5 * * *)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@renovate
renovate Bot requested a review from scottames as a code owner September 8, 2026 00:45
@renovate renovate Bot added the dependencies label Sep 8, 2026
@renovate
renovate Bot enabled auto-merge (squash) September 8, 2026 00:45
@scottames-github-bot

Copy link
Copy Markdown
Contributor

Renovate Release Notes

Generated from Renovate's update table by the renovate-release-notes-comment workflow.

Packages that cannot be summarized from GitHub releases are listed explicitly below.

astral-sh/ruff (aqua:astral-sh/ruff)

0.16.6: 0.16.6

Compare Source

Release Notes

Released on 2026-09-03.

Preview features

  • Move pytest-fixture-autouse to the restriction category (#28219)
  • [flake8-pytest-style] Add an autofix for PT020 (#27993)
  • [flake8-tidy-imports] Prevent fix loop between TID254 and TID255 (#28262)
  • [isort] Exclude pragma comments from line length calculation (I001) (#27313)

Bug fixes

  • Validate unary expressions when parsing (#28233)
  • [flake8-async, pylint] Recognize builtins.open (ASYNC230, PLW1514) (#28021)
  • [flake8-bugbear] Fix panic on match subjects (B031) (#27781)
  • [flake8-datetimez] Reject tzinfo=None for datetime bounds (DTZ901) (#28022)
  • [flake8-pytest-style] Avoid duplicate PT017 diagnostics (#27918)
  • [ruff] Remove lint.external hint for Ruff-specific suppressions (RUF102) (#27923)

Rule changes

  • [flake8-use-pathlib] Add display-only fix for os.listdir (PTH208) (#28027)

Documentation

  • Add another example and glob reference for lint.per-file-ignores (#28106)
  • Add duplicate work guidance (#28229)
  • [flake8-async] Document thread offloading (ASYNC240) (#28008)
  • [pyupgrade] Clarify default encoding argument handling (UP012) (#27315)

Other changes

  • Allow unary plus in match patterns on Python 3.15 (#28231)

Contributors

Install ruff 0.16.6

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://releases.astral.sh/github/ruff/releases/download/0.16.6/ruff-installer.sh | sh

Install prebuilt binaries via powershell script

powershell -ExecutionPolicy Bypass -c "irm https://releases.astral.sh/github/ruff/releases/download/0.16.6/ruff-installer.ps1 | iex"

Download ruff 0.16.6

File Platform Checksum
ruff-aarch64-apple-darwin.tar.gz Apple Silicon macOS checksum
ruff-x86_64-apple-darwin.tar.gz Intel macOS checksum
ruff-aarch64-pc-windows-msvc.zip ARM64 Windows checksum
ruff-i686-pc-windows-msvc.zip x86 Windows checksum
ruff-x86_64-pc-windows-msvc.zip x64 Windows checksum
ruff-aarch64-unknown-linux-gnu.tar.gz ARM64 Linux checksum
ruff-i686-unknown-linux-gnu.tar.gz x86 Linux checksum
ruff-powerpc64-unknown-linux-gnu.tar.gz PPC64 Linux checksum
ruff-powerpc64le-unknown-linux-gnu.tar.gz PPC64LE Linux checksum
ruff-riscv64gc-unknown-linux-gnu.tar.gz RISCV Linux checksum
ruff-s390x-unknown-linux-gnu.tar.gz S390x Linux checksum
ruff-x86_64-unknown-linux-gnu.tar.gz x64 Linux checksum
ruff-armv7-unknown-linux-gnueabihf.tar.gz ARMv7 Linux checksum
ruff-aarch64-unknown-linux-musl.tar.gz ARM64 MUSL Linux checksum
ruff-i686-unknown-linux-musl.tar.gz x86 MUSL Linux checksum
ruff-x86_64-unknown-linux-musl.tar.gz x64 MUSL Linux checksum
ruff-arm-unknown-linux-musleabihf.tar.gz ARMv6 MUSL Linux (Hardfloat) checksum
ruff-armv7-unknown-linux-musleabihf.tar.gz ARMv7 MUSL Linux checksum

Verifying GitHub Artifact Attestations

The artifacts in this release have attestations generated with GitHub Artifact Attestations. These can be verified by using the GitHub CLI:

gh attestation verify <file-path of downloaded artifact> --repo astral-sh/ruff

You can also download the attestation from GitHub and verify against that directly:

gh attestation verify <file-path of downloaded artifact> --bundle <file-path of downloaded attestation>
cli/cli (aqua:cli/cli)

v2.100.0: GitHub CLI 2.100.0

Compare Source

Experimental: Route GitHub API traffic through a custom host

Organizations can now route a GitHub host's API traffic through a gateway using the new per-host api_host configuration:

# Route API traffic for github.com through a gateway
gh config set api_host gh-gateway.example.com --host github.com

# Read the configured API host
gh config get api_host --host github.com

The original host remains in use for authentication, Git remotes, and browser URLs.

[!NOTE]
api_host is experimental and is not a security boundary. Requests may still reach the original host.

What's Changed

✨ Features

  • Honor per-host api_host routing across GitHub API requests by @​williammartin in #14104
  • Expose api_host through gh config get and gh config set by @​williammartin in #14332
  • Add webhook as an official extension by @​williammartin in #14326
  • Print full command help after command misuse when gh is invoked by a coding agent by @​niik in #14198

🐛 Fixes

  • fix(api): disable telemetry for unauthenticated GHES requests using absolute hostnames by @​williammartin in #14337

📚 Docs & Chores

  • Fix discussion acceptance test flags by @​williammartin in #14321
  • Clarify supported GHES versions by @​williammartin in #14324
  • Improve automated issue triage analysis by @​sergiou87 in #14318
  • Record attachment counts in telemetry by @​BagToad in #14327

:dependabot: Dependencies

  • chore(deps): bump golang.org/x/crypto from 0.55.0 to 0.56.0 by @​babakks in #14331
  • chore(deps): bump Go toolchain from 1.26.7 to 1.26.8 by @​babakks in #14330
  • chore(deps): bump github.com/cli/go-gh/v2 from 2.15.0 to 2.16.0 by @​williammartin in #14338

Full Changelog: cli/cli@v2.99.0...v2.100.0

dprint/dprint (aqua:dprint/dprint)

0.57.1: 0.57.1

Compare Source

Changes

  • fix: scan hidden directories with dprint init (#1240)
  • fix: recommend --minimum-dependency-age=0 when an older version is selected (#1238)
  • fix: accept --minimum-release-age as an alias of --minimum-dependency-age (#1239)
  • ci: generate GitHub artifact attestations (#1067)

Install

Run dprint upgrade or see https://dprint.dev/install/

Verification

These artifacts have build provenance attestations.
Verify a download with the GitHub CLI:

gh attestation verify dprint-x86_64-unknown-linux-gnu.zip --repo dprint/dprint

Checksums

Artifact SHA-256 Checksum
dprint-x86_64-apple-darwin.zip f1529d394126ebf0104af12290345b662196f8b9604d2d578cef91a8b6057f9d
dprint-aarch64-apple-darwin.zip 3113fb58a126df96c95653638f068fe430f342623dfdf08e3fa32d4e704194ea
dprint-x86_64-pc-windows-msvc.zip 28aa22ea2b009a3d49f9c570bc2a1697af8dff9117cd1cbb7c39deab9f5d5269
dprint-x86_64-pc-windows-msvc-installer.exe 8e10f452e73abed2d25769fc23ec0d17a45cf84931cf04a6c2afd77361bb945d
dprint-aarch64-pc-windows-msvc.zip 08b93837ea90488dbb23ab115fffd3699427b8917013b3b33bd7aedda5b07ca5
dprint-x86_64-unknown-linux-gnu.zip 4117443cc5fade617dd5f4850cc2fa6b2902136052ef313ee20947036c3554cc
dprint-x86_64-unknown-linux-musl.zip d956144fa8d873dc43c37d1811b3f8c42701f74bb0be7c25c543b189ab53d6c0
dprint-aarch64-unknown-linux-gnu.zip a73695f6407c6c36adef5971053f81ccef13b0a04b6b1da98312ae0ee5332edd
dprint-aarch64-unknown-linux-musl.zip 371b63109cbd7b34e179fc3af0815f65a5d9f3a560d2a245a78ef99ec71b3f9e
dprint-riscv64gc-unknown-linux-gnu.zip 1dcf69d277c044e1e52afdb23fa0fb5152678955b41952721d801d3407d3ddaa
dprint-loongarch64-unknown-linux-gnu.zip 147ca90b1348036344c9e4e45f0985acb37c18f36a9d3a1f37d4f553ebb80d58
dprint-loongarch64-unknown-linux-musl.zip 5f61c6898dfb3db8e54f9405727d168eb512a403d941ddd5b725c328bb8d5bc6
dprint-powerpc64le-unknown-linux-gnu.zip a7d21498b38598c9898e61b1dc8a37cdaab15499c58390bbf9100da1864342f7
dprint-powerpc64le-unknown-linux-musl.zip b9f1d4f89b51f3d291d2be61132f81f451d06e9a3e33aab2510b69564a8d3648
dprint-aarch64-linux-android.zip bc8b058ab2d4df47b0e04ddbae47d522569ba744372cd2e399df30cf20783fc1
dprint-x86_64-linux-android.zip ccdf05807e50256dd1ffbb13a8ec101042e654680e2713ff58fe1b2b6855c0c0
editorconfig-checker/editorconfig-checker (aqua:editorconfig-checker/editorconfig-checker)

v3.11.3: v3.11.3

Compare Source

editorconfig-checker v3.11.3 (2026-09-03T20:47:05Z)

Welcome to this new release of editorconfig-checker!

Changelog

Others

  • 8d927e9944e58ac188c2d3a705a432157983113f: fix: setup one last v3 patch release, for the people who cannot instantly upgrade (@​klaernie)

Thanks!

Those were the changes on v3.11.3!

google/go-containerregistry (aqua:google/go-containerregistry)

v0.22.1: v0.22.1

Compare Source

What's Changed

New Contributors

Full Changelog: google/go-containerregistry@v0.22.0...v0.22.1

openai/codex (aqua:openai/codex)

rust-v0.153.2: 0.153.2

Compare Source

Bug Fixes

  • Corrected the GPT-6-Astra Fast tier description to say “2x speed, increased usage” instead of “1.5x.” This changes only the displayed text, not how requests run. (#42632)

Changelog

Full Changelog: openai/codex@rust-v0.153.1...rust-v0.153.2

  • #42632 Fix GPT-6-Astra Fast tier description for 0.153.2 @​anp-oai

@scottames-github-bot

Copy link
Copy Markdown
Contributor
siderolabs/talos (aqua:siderolabs/talos) - part 1 of 3

v1.14.0: v1.14.0

Compare Source

Talos 1.14.0 (2026-09-03)

Welcome to the v1.14.0 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

DNS over TLS (DoT) and DNS over HTTPS (DoH) Support

Talos now supports DNS over TLS (DoT) and DNS over HTTPS (DoH) for secure DNS resolution.
These features allow Talos to encrypt DNS queries and responses, enhancing privacy and security for DNS traffic.
The DNS protocol can be configured on a per-name server basis in the ResolverConfig document, allowing for flexible configuration of DNS resolution.

Apply Configuration Modes

The '--mode=reboot' option has been removed from the talosctl apply-config command; by default, configuration is applied without a reboot.
Most configuration changes don't require a reboot; the documentation lists the changes that do.

Native BGP

Talos now supports running native BGP routing instances on the host via embedded GoBGP servers, configured with BGPInstanceConfig documents.
This removes the need to ship FRR as a system extension for the common fabric-facing use case.

List of changes:

  • Added repeatable, named BGPInstanceConfig documents to configure local ASN, router-id, optional Linux VRF, advertised interfaces, neighbors, and per-route preferred source (routeSource).
  • Peer hold-time and BFD behavior are configured inline on each concrete neighbor, which selects either an address or a link.
  • Numbered and unnumbered (IPv6 link-local, RFC 8950 extended next-hop) peering are supported, including IPv4 prefixes learned over an IPv6 link-local next-hop.
  • Neighbor-local ASN overrides and passive sessions are supported. ECMP (multipath) and BFD (fast failure detection) are supported for fabric peering.
  • BFD is currently supported only by the instance in the default routing domain; GoBGP's embedded BFD listener is not VRF-aware.
  • Each instance owns an isolated BGP RIB and, by default, installs learned routes into its default or VRF routing table through the existing route controllers. Set installRoutes: false to retain learned routes in the BGP RIB without installing them into the Linux routing table.
  • Instances can selectively import best neighbor-learned routes from other named instances with importRoutes prefix selectors. Imports are one-way, preserve path attributes, and do not recursively import locally originated or previously imported paths.
  • Peer state is observable via instance-qualified BGPPeerStatus resources (talosctl get bgppeerstatus).
  • RouteSpec/RouteStatus now carry a multipath next-hop list to support ECMP and cross-family (RFC 8950) next-hops.

Btrfs Support

Talos now supports mounting and provisioning btrfs filesystem for user volumes and existing volumes.

Support for btrfs is enabled by installing btrfs system extension.

Unified --namespace Flag

talosctl containers, logs, stats and restart now select the containerd namespace through the same --namespace flag and vocabulary already used by talosctl image and talosctl debug: system (the default), cri for Kubernetes workloads, and taloscontainers for containers declared via a ContainerConfig document.

The --kubernetes/-k flag is deprecated in favor of --namespace cri.

talosctl image list also supports --namespace taloscontainers, to inspect images pulled for ContainerConfig containers. talosctl debug does not support the taloscontainers namespace.

CRI Base Runtime Specification Configuration

Talos now supports overriding the default OCI runtime specification for CRI containers with a
CRIBaseRuntimeSpecConfig document:

apiVersion: v1alpha1
kind: CRIBaseRuntimeSpecConfig
overrides:
  process:
    rlimits:
      - type: RLIMIT_NOFILE
        hard: 1024
        soft: 1024

The .machine.baseRuntimeSpecOverrides field is deprecated and remains supported during the deprecation
period. It is mutually exclusive with CRIBaseRuntimeSpecConfig; configurations containing both are rejected.

Applying, updating, or removing either source regenerates the base runtime specification and restarts CRI
automatically. A machine reboot is no longer required.

CRI Customization Configuration

Talos now supports customizing the CRI containerd configuration with named CRICustomizationConfig
documents. Each document contains a TOML fragment; fragments are merged in lexicographical order by name.
Applying, updating, or removing these documents updates the generated CRI configuration and restarts CRI
automatically.

The legacy /etc/cri/conf.d/20-customization.part machine-file configuration remains supported during the
deprecation period and is exposed under the reserved name customization. A CRICustomizationConfig document
cannot use that name.

NOTE: a machine reboot is no longer required to apply changes to CRI configuration.

Containerd NRI

Talos no longer disables NRI (Node Resource Interface) for the CRI containerd instance by default, so NRI is available
to use without any machine config patches.

To bring back the old behavior of NRI disabled by default, add the following machine configuration document:

apiVersion: v1alpha1
kind: CRICustomizationConfig
name: disable-nri
content: |
  [plugins]
    [plugins."io.containerd.nri.v1.nri"]
       disable = true

Default Installer Image

The default installer image has been updated to use the Image Factory.
The ghcr.io/siderolabs/installer image is no longer published with releases; use the Image Factory installer image instead.

DHCP

DHCPv4 search domains are now applied to the resolver configuration.

DHCPv4 configuration now supports ignoreRoutes option to ignore routes provided by DHCPv4 servers.

Cluster Discovery

Talos introduces support for configuring multiple discovery service endpoints.
Talos introduces new document for configuring the cluster discovery identity.

List of changes:

  • Deprecated .cluster.discovery in the v1alpha1 config; use the DiscoveryServiceConfig document for discovery service configuration. The v1alpha1 config and DiscoveryServiceConfig are mutually exclusive.
  • Deprecated .cluster.secret and cluster.id in the v1alpha1 config; use the DiscoveryIdentityConfig document for discovery identity configuration. The v1alpha1 config and DiscoveryIdentityConfig are mutually exclusive.
  • Changed cluster ID encoding in the generated secret bundle, from base64.URLEncoding to base64.StdEncoding. This aligns the encoding with the rest of Talos.

Encryption Discards

Volume encryption now supports an allowDiscards option (disabled by default) which passes TRIM/discard requests
through to the underlying device when the encrypted volume is opened.

This only enables passing discards through to the underlying device; Talos does not perform any fstrim/discard operation by itself.

etcd

Talos is now compatible with etcd v3.6.x only (the default etcd version was 3.6.x since Talos v1.11).
The default version is 3.7.0+ now.

etcd now serves its HTTP-only endpoints (/metrics, /health, the gRPC-gateway JSON API) on a dedicated
listener on port 2383, while the client port 2379 serves gRPC only. This keeps gRPC off Go's net/http
HTTP/2 server, avoiding watch-stream starvation under TLS (see etcd-io/etcd#15402, golang/go#58804,
etcd-io/etcd#21605).

Upgrade note: etcd metrics and the HTTP health endpoint are no longer reachable on 2379; scrape them on
port 2383 instead (same client mTLS as before). etcd gRPC clients and the Talos health check are unaffected.

Firewall might need to be adjusted to block the port 2383 if previously 2379 was blocked.

If --listen-metrics-urls was customized, the metrics should not move.

EtcFileConfig

Talos now supports managing user-owned files under /etc with the new EtcFileConfig multi-document
configuration kind. The document name is the path relative to /etc, and each document owns the complete
file contents and mode.

This can be used to configure files such as /etc/nfsmount.conf or /etc/multipath.conf. Talos-managed
paths, including resolv.conf, hosts, machine-id, CRI and Kubernetes configuration, trust bundles, and
identity files, are rejected to prevent overriding files owned by Talos.

Extension Service Configuration

ExtensionServiceConfig is supported only for extension services whose service manifest explicitly declares a configuration dependency:

depends:
  - configuration: true

Using ExtensionServiceConfig with a service that does not declare this dependency is unsupported and has undefined startup behavior.
The service might start before its configuration is rendered, leaving config files or environment variables unavailable until a later service restart.
Extension authors must declare the dependency before documenting ExtensionServiceConfig support.

Filesystem Trim

Talos can now periodically trim (the equivalent of the fstrim command) mounted filesystems which support trimming,
discarding unused blocks. This is useful for SSDs and thin-provisioned storage.

Trimming is opt-in via a new FilesystemTrimConfig document which sets the global trim interval:

apiVersion: v1alpha1
kind: FilesystemTrimConfig
interval: 168h0m0s # one week

The default machine configuration for Talos 1.14+ includes a FilesystemTrimConfig document with a default trim interval of one week,
so trimming is enabled by default for eligible filesystems. For cluster which were upgraded from older versions, the FilesystemTrimConfig document will be missing,
so trimming will be disabled by default until the document is added.

When the document is present, Talos builds a stable schedule (hashed by node ID and volume ID, so trims are spread out
across volumes and across nodes in a cluster) and trims eligible volumes (ready disk/partition volumes with a
trim-capable filesystem; for encrypted volumes only when allowDiscards is set).

The trim interval can be overridden or disabled per-volume via a trim block on the volume documents
(VolumeConfig, UserVolumeConfig, ExistingVolumeConfig, ExternalVolumeConfig):

trim:
  enabled: true
  interval: 24h0m0s

Flannel CNI

Talos now configures Flannel with the EnableNFTables option enabled, which uses nftables native backend instead of iptables-nft compatibility layer.

FlexVolume Host Path Removed

Talos no longer provisions the deprecated FlexVolume executable host path at
/usr/libexec/kubernetes. FlexVolume has been deprecated since Kubernetes 1.23.
Modern CSI plugin paths under /var/lib/kubelet are unaffected.

Host DNS Configuration

HostDNS configuration was moved from the v1alpha1 config .machine.features.hostDNS field to the new hostDNS in the ResolverConfig document.

HTTP Probe Support

Talos now supports HTTP network probes, allowing for monitoring of HTTP endpoints.
HTTP responses with status 200-399 are considered successful, while connection and transport errors are treated as failures.

Image Cache Configuration

Talos now supports a new ImageCacheConfig document for configuring the Image Cache feature, replacing the old machine.features.imageCache field in the v1alpha1 config.
Old configuration is still supported for backwards compatibility.

Kernel Multi-document Configuration

Talos introduces new multi-document configuration for kernel parameters (sysctl and sysfs settings), replacing the old v1alpha1 config fields.
The old configuration is still supported for backwards compatibility, but new deployments should use the new documents.

If both old and new configuration sources are used, the new multi-document configuration takes precedence over the old v1alpha1 config on conflicting fields.

List of changes:

  • Deprecated .machine.sysctls in the v1alpha1 config; use the SysctlConfig document for kernel sysctl configuration.
  • Deprecated .machine.sysfs in the v1alpha1 config; use the SysfsConfig document for sysfs configuration.
  • Deprecated .machine.kernel in the v1alpha1 config; use the KernelModuleConfig document for kernel module configuration.

Kernel Module Status

Talos now reports the status of both dynamically loaded, and built-in kernel modules.

The LoadedKernelModule resource has been deprecated and superseded by the new KernelModuleStatus resource.

In-tree Volume Plugins Deprecated

Because the kubelet now runs inside the sandbox namespace (see the workload isolation note), the in-tree
Kubernetes volume plugins that require the kubelet to reach host-level daemons no longer work. In particular
the in-tree iscsi volume plugin, which drives the kubelet's iscsiadm wrapper to talk to the host iscsid,
can no longer locate it across the sandbox PID namespace boundary.

Use CSI drivers instead — a CSI node plugin performs the attach/mount itself in its own privileged pod and is
unaffected by the sandbox. For iSCSI, kubernetes-csi/csi-driver-iscsi (or democratic-csi) consumes a
target the same way. All in-tree (non-CSI) volume plugins are deprecated for the kubelet and support for them
may be removed in a later release.

Kubernetes Multi-document Configuration

Talos introduces new multi-document Kubernetes configuration, which allows for more flexible and modular configuration of Kubernetes components.
Talos still supports the old v1alpha1 config for backwards compatibility, but new features and fields will only be available in the new multi-document format.
The kube-proxy is now using configuration to manage its settings instead of command line arguments (with new KubeProxyConfig document).

List of changes:

  • Deprecated .cluster.secretboxEncryptionSecret in the v1alpha1 config; use the KubeEtcdEncryptionConfig document for full etcd encryption configuration.
  • Deprecated .cluster.apiServer in the v1alpha1 config; use the KubeAPIServerConfig, KubeAdmissionControlConfig, KubeAuditPolicyConfig, KubeAuthenticationConfig and KubeAuthorizerConfig documents for kube-apiserver configuration.
  • Deprecated .cluster.ca, .cluster.acceptedCAs and .cluster.aggregatorCA in the v1alpha1 config; use the KubeAPIServerCAConfig, KubeAggregatorCAConfig documents.
  • Deprecated .cluster.controllerManager in the v1alpha1 config; use the KubeControllerManagerConfig document for kube-controller-manager configuration.
  • Deprecated .cluster.scheduler in the v1alpha1 config; use the KubeSchedulerConfig document for kube-scheduler configuration.
  • Deprecated .cluster.proxy in the v1alpha1 config; use the KubeProxyConfig document for kube-proxy configuration.
  • Deprecated .cluster.network in the v1alpha1 config; use the KubeNetworkConfig document for Kubernetes network configuration; Flannel can be configured using the KubeFlannelCNIConfig document.
  • Deprecated .cluster.coreDNS in the v1alpha1 config; use the KubeCoreDNSConfig document for CoreDNS configuration.
  • Deprecated .cluster.name and .cluster.controlPlane.endpoint in the v1alpha1 config; use the KubeClusterConfig` document for cluster name and control plane endpoint configuration.
  • Deprecated the following list of fields, all of them moved into `KubeNodeConfig:
    • .cluster.allowSchedulingOnControlPlanes
    • .machine.kubelet.skipNodeRegistration
    • .machine.kubelet.registerWithFQDN
    • .machine.kubelet.nodeIP
    • .machine.nodeLabels
    • .machine.nodeAnnotations
    • .machine.nodeTaints
  • The default NoSchedule taint for controlplane and label are now explicitly listed in KubeNodeConfig.
  • Deprecated the rest of .machine.kubelet fields in the v1alpha1 config; use the KubeNodeConfig and KubeCredentialProviderConfig documents for kubelet configuration.
  • Deprecated .machine.pods in the v1alpha1 config; use the KubeStaticPodConfig document for static pod configuration.
  • Deprecated .machine.files in the v1alpha1 config; use dedicated configuration documents such as EtcFileConfig and CRICustomizationConfig instead.
  • Deprecated .machine.baseRuntimeSpecOverrides in the v1alpha1 config; use the CRIBaseRuntimeSpecConfig document for base runtimespec overrides.
  • Deprecated .cluster.inlineManifests in the v1alpha1 config; use the KubeInlineManifestConfig document for inline manifests.
  • Deprecated .cluster.extraManifests and .cluster.extraManifestHeaders in the v1alpha1 config; use the KubeExternalManifestConfig document for external manifests.
  • Deprecated .machine.features.kubePrism; use the KubePrismConfig document for KubePrism configuration (or remove it to disable KubePrism).
  • Deprecated .machine.features.kubernetesTalosAPIAccess; use the KubeTalosAPIAccessConfig document instead.
  • Added nodeCIDRMaskSizeIPv4 (default 24) and nodeCIDRMaskSizeIPv6 (default 64) settings to the KubeNetworkConfig document to control the per-node pod CIDR mask size and validate the pod and service subnet sizes.

Secure Boot images no longer have lockdown=confidentiality enabled by default

Secure Boot images no longer have lockdown=confidentiality enabled by default.
This change was made to improve compatibility with eBPF tooling under default schematic.
This means that Secure Boot images will now have lockdown=integrity enabled by default (implicitly), which is the recommended setting for most users.
Users can override it by adding lockdown=confidentiality to the kernel command line through Image Factory if they require it.

LVM Logical Volume Creation

Logical volumes can now be declared with a new LVMLogicalVolumeConfig multi-doc config kind. Each document
names a logical volume, its parent volumeGroup, a type (linear, raid0, raid1 or raid10) and a
maxSize (absolute, e.g. 50GiB, or a percentage of the volume group, e.g. 80%). RAID layouts accept
optional mirrors (raid1/raid10, default 1) and stripes (raid0/raid10, default: all available physical
volumes) fields. Once the volume group is assembled the logical volume is created via lvcreate.

Raising maxSize grows an existing logical volume via lvextend; percentage-sized volumes also grow when
their volume group is extended. Shrinking is never performed (it risks data loss) - a request to reduce the
size surfaces an LVMValidationError instead. Removal stays an explicit operation via the LVMService LV
remove RPC (talosctl wipe lv).

LVM Status

Talos now provides detailed LVM status information, allowing for better monitoring and management of LVM volumes.
New resources LVMPhysicalVolumeStatus, LVMVolumeGroupStatus, and LVMLogicalVolumeStatus expose PV, VG, and LV details.
DiscoveredVolume resources for logical volumes are listed by their kernel name (e.g. dm-0). To resolve the <vg>/<lv> for a given device, use the Disks or BlockSymlinks resources, which carry the udev-managed symlinks (e.g. /dev/disk/by-id/dm-name-<vg>-<lv>).

LVM Volume Group Creation

Talos can now create and grow LVM Volume Groups declaratively through a new LVMVolumeGroupConfig multi-doc
config kind. Each document names a Volume Group and a CEL volumeSelector over the disk inventory; matched
disks are initialised as Physical Volumes (pvcreate) and aggregated into the requested VG (vgcreate).
Newly matched disks added to an existing VG are attached via vgextend.

Reconciliation is strictly additive and safe-by-default.

LVM Wipe

Talos now provides the ability to securely wipe LVM metadata from logical volumes, volume groups, and physical volumes.
This feature allows for selective wiping of logical volumes, volume groups, and physical volumes.

With talosctl wipe lv/vg/pv <name>, users can wipe LVM metadata from a specific logical volume, volume group, or physical volume.

Multipath Configuration

The multipath-tools system extension now reads /etc/multipath.conf from the Talos host instead of using ExtensionServiceConfig.
The multipathd service waits for this file and bind-mounts it read-only into its service container.

Before updating the extension, apply a machine config patch that deletes the existing ExtensionServiceConfig document and adds an EtcFileConfig document:

apiVersion: v1alpha1
kind: ExtensionServiceConfig
name: multipathd
$patch: delete
---
apiVersion: v1alpha1
kind: EtcFileConfig
name: multipath.conf
mode: 0o644
contents: |
  defaults {
      user_friendly_names yes
      find_multipaths no
      path_selector "round-robin 0"
  }

The extension does not provide a default configuration, so multipathd remains waiting until /etc/multipath.conf is present.

NTS for Time Synchronization

Talos now supports Network Time Security (NTS) for secure time synchronization.
This feature enhances the security of NTP by providing cryptographic authentication of time sources.

NTS is enabled by default (without any configuration sources) for the default time.cloudflare.com time server
NTS can be enabled for custom time servers via the new useNTS field in the TimeServerConfig document.

RAID Array Creation

Talos can now create and grow Linux MD (software RAID) arrays declaratively through a new RAIDArrayConfig
multi-doc config kind. Each document names an array, its level (raid1) and a CEL volumeSelector over
the disk inventory; matched disks are assembled into the requested array with mdadm and exposed at the stable
/dev/disk/by-id/md-name-<name> path. New matching disks added to an existing array are attached automatically.

Reconciliation is strictly additive and safe-by-default. Arrays are never destroyed by removing the config;
removal stays an explicit operation via talosctl wipe md <device>. The new MDArrayStatus resource reports the
assembled array, level, device path, and members.

Booting from a RAID Array

Talos can now be installed onto and boot from a Linux MD (software RAID) array. Define a RAIDArrayConfig for the
array and point the install disk selector (UnattendedInstallConfig) at the resulting /dev/disk/by-id/md-name-<name>
device.

Only raid1 arrays with metadata: "1.0" can be used for booting: the 1.0 format keeps its superblock at the end of
each member, so the partition table written to the array stays visible at the start of every disk, allowing the
firmware to boot from any member. metadata defaults to 1.0; other levels and metadata formats are not bootable.

Workload Isolation (sandboxd)

The container runtime plane — CRI containerd, the kubelet, and all pods — now runs inside a dedicated PID and
mount namespace anchored by a new sandboxd service, instead of sharing machined's namespaces.

sandboxd runs in its own least-privilege SELinux domain (sandboxd_t). if it dies the kernel tears down the
namespace and Talos recreates it — relaunching CRI, the kubelet, and pods — without rebooting the node.
Its logs are available via talosctl logs sandboxd.

Workload isolation is controlled by the workloadIsolation field of the new SecurityProfileConfig document.
talosctl gen config emits it with workloadIsolation: true for Talos 1.14+, so new clusters are isolated by
default
. Clusters upgraded from older versions do not have this document and therefore keep the previous
(non-isolated) behavior until it is added — upgrades change nothing on their own. To enable on an existing
cluster, add the document:

apiVersion: v1alpha1
kind: SecurityProfileConfig
workloadIsolation: true

NOTE: With workload isolation enabled, the deprecated in-tree Kubernetes iSCSI volume plugin does not work
(the kubelet cannot reach the host iscsid across the sandbox); use a CSI driver instead. See the in-tree
volume plugin deprecation note.

ICMP send_redirects Disabled by Default

Talos now sets net.ipv4.conf.all.send_redirects=0 and net.ipv4.conf.default.send_redirects=0 by default,
preventing the node from emitting ICMP redirect messages. This aligns with CIS Benchmark recommendations and
does not affect normal Kubernetes pod or service traffic. Nodes that deliberately act as L3 gateways relying
on ICMP redirects can override this via machine.sysctls.

Support Bundle Encryption

The talosctl support command now encrypts support bundles using the age encryption tool, enhancing the security of support data.
The default set of recipients includes the 'siderolabs' GitHub organization members, but it can be overridden with custom recipients.

Dedicated System Volumes

The ETCD, CRI, KUBELET and LOG system volumes (/var/lib/etcd, /var/lib/containerd, /var/lib/kubelet and /var/log)
can now be placed on dedicated partitions via a VolumeConfig document with provisioning set (optionally encrypted).
By default they remain directories under the EPHEMERAL volume.

ETCD and LOG volumes are mounted with noexec in addition to nosuid and nodev when secure: true is set.

apiVersion: v1alpha1
kind: VolumeConfig
name: ETCD
provisioning:
  minSize: 1GB
  maxSize: 2GB

The backing (directory vs. dedicated partition) is fixed at cluster creation: switching an already-provisioned node between the two is rejected.

A dedicated partition has its own mount, so the mount.secure option (nosuid/nodev, enabled by default) can be set per volume; directory-backed volumes inherit the EPHEMERAL mount options. Talos additionally applies noexec to dedicated ETCD and LOG volumes, while CRI and KUBELET remain executable.

Note that with ETCD on a dedicated partition, etcd data no longer lives under EPHEMERAL. Resetting a control plane node with only the EPHEMERAL partition wiped will not clear etcd data; wipe the ETCD volume to reset etcd.

TLS 1.3 Minimum Version

Talos now runs etcd and kube-apiserver with a minimum TLS version of 1.3, improving security by leveraging the latest TLS features and cipher suites.
Custom settings for cipher suites have been removed, as they are ignored when TLS 1.3 is used, which simplifies configuration and ensures the use of modern, secure defaults.

Udev Rules Multi-document Configuration

Talos introduces new multi-document configuration UdevRulesConfig document for configuring custom udev rules.
The old v1alpha1 .machine.udev.rules field is still supported for backwards compatibility, but new deployments should use the new document.

If both old and new configuration sources are used, UdevRulesConfig takes precedence.

List of changes:

  • Deprecated .machine.udev.rules in the v1alpha1 config; use the UdevRulesConfig document for custom udev rules.

Unattended Install Configuration

Talos introduces a new UnattendedInstall multi-document config kind which replaces the deprecated .machine.install
section of the v1alpha1 config. The document carries the installer image and a provisioning section with a CEL
volumeSelector to match the install disk, plus a wipe option.

When the UnattendedInstall document is present, the install is driven by the new UnattendedInstallController
(exposing an UnattendedInstallStatus resource) instead of the legacy install sequence.

talosctl gen config and talosctl cluster create now generate the UnattendedInstall document by default.
The .machine.install field remains supported for backwards compatibility and is still used for older version contracts.

Component Updates

Linux: 6.18.48
Kubernetes: 1.37.0
containerd: 2.3.4
etcd: 3.7.1
Flannel: 0.28.9
runc: 1.5.1
CoreDNS: 1.14.7

Talos is built with Go 1.26.7.

Virtual Ethernet Pairs

Talos now supports declarative virtual Ethernet (veth) pairs through the new VethConfig multi-document
configuration kind. Both endpoints are created in the host network namespace and support the common link settings,
addresses, routes, and multicast configuration.

For example, the following configuration creates a pair named veth-host and veth-router with an address on each
endpoint:

apiVersion: v1alpha1
kind: VethConfig
name: veth-host
addresses:
  - address: 10.3.0.1/30
peer:
  name: veth-router
  addresses:
    - address: 10.3.0.2/30

XFS Allocation Group Geometry

On non-rotational devices mkfs.xfs sizes the allocation group count to the number of CPUs, bounding the
allocation group size from below at 4 GiB only. On machines with many cores and a modest disk this produces
hundreds of tiny allocation groups, which squeezes the AG-local reflink/rmap metadata (leading to spurious
ENOSPC on reflink-heavy workloads while the filesystem still has plenty of free space) and inflates the
journal at the same time.

Talos now keeps XFS allocation groups at 64 GiB or above when it formats a volume. The bound can be changed
per volume, and setting it to zero restores the stock mkfs.xfs behavior:

apiVersion: v1alpha1
kind: VolumeConfig
name: EPHEMERAL
filesystem:
  xfs:
    minAllocationGroupSize: 128GiB

The same filesystem.xfs.minAllocationGroupSize setting is available for UserVolumeConfig.

Note: allocation group geometry is fixed when the filesystem is created, so this only affects volumes
formatted by Talos 1.14 or later. Existing volumes keep their current geometry until they are wiped and
re-created (e.g. talosctl reset --system-labels-to-wipe=EPHEMERAL).

XFS scrub

Talos now supports automatically running background online filesystem maintenance tasks. Currently,
only XFS using xfs_scrub tool is supported.

This behavior can be enabled globally using a FilesystemScrubConfig document, or on per-volume
basis using a field in corresponding VolumeConfig documents.

Contributors

  • Andrey Smirnov
  • Noel Georgi
  • Mateusz Urbanek
  • Maja Bojarska
  • Utku Ozdemir
  • Dmitrii Sharshakov
  • Orzelius
  • Erwan Leboucher
  • Kevin Tijssen
  • Lukasz Raczylo
  • Mickaël Canévet
  • Oguz Kilcan
  • Dmitriy Matrenichev
  • Edward Sammut Alessi
  • Max Makarov
  • Rokoucha
  • buckaroo
  • immanuwell
  • kastakhov
  • Aleksei Sviridkin
  • Andras Elso
  • Ansgar Dahlen
  • Artem Chernyshev
  • Benoît Knecht
  • Calin
  • Christian A. Jacobsen
  • Christian Korneck
  • Christopher Barnes
  • Dario Emerson
  • David Donchez
  • David Orman
  • Dharsan Baskar
  • Dima Aratin
  • Dmitry Sharshakov
  • Evan Champion
  • Filip Boye-Kofi
  • Fritz Schaal
  • Immanuel Tikhonov
  • Ivan Demchuk
  • Jaakko Sirén
  • Jonny
  • Justin Garrison
  • Konstantin Nesterov
  • Loki San
  • Mario Cole
  • Mark Glants
  • Maxime Bertin
  • Nico Berlee
  • Noel
  • Oscar Wieman
  • Pranav Patil
  • Sacha Weatherstone
  • Spencer Smith
  • YANG JOO WOONG
  • Zadkiel AHARONIAN
  • appkins
  • ctr49
  • dadbravo
  • imusmanmalik
  • scmtble

Changes

623 commits

  • siderolabs/talos@​9abd05af4 release(v1.14.0): prepare release
  • siderolabs/talos@​ff772d64f chore: mark release as stable
  • siderolabs/talos@​5424dac73 test: relax OOM test conditions
  • siderolabs/talos@​9f6719422 fix: normalize image reference when passing to image verification flow
  • siderolabs/talos@​6ce58d308 fix: name diskSelector in UnattendedInstallConfig validation errors
  • siderolabs/talos@​af4e11b50 test: isolate base OCI spec test in BGP CLOS runs
  • siderolabs/talos@​ff56b6d66 chore: update tools and pkgs
  • siderolabs/talos@​8c8b9b45f fix: filter the output in talosctl
  • siderolabs/talos@​9777a1bb4 feat: talos containers run with imagegccontroller
  • siderolabs/talos@​dd566c9c7 fix: container mount rshared propagation
  • siderolabs/talos@​2f8931768 refactor: don't skip container tests in short mode
  • siderolabs/talos@​2f0fdd11e fix: ctr machinedaccss allowed roles
  • siderolabs/talos@​64aef9053 feat: containers can connect to machined
  • siderolabs/talos@​ce2148aa0 feat: impl. container mount controller
  • siderolabs/talos@​9105c5e1e feat: talos containers support for talosctl
  • siderolabs/talos@​36fd44677 feat: impl. container runtime controller
  • siderolabs/talos@​afc09d418 refactor: make runner.runner context-native
  • siderolabs/talos@​eff936cf0 feat: impl ContainerInstanceController
  • siderolabs/talos@​95abc8bff fix: filter out passed metadata in API proxying
  • siderolabs/talos@​10c4f1a8b fix: treat desired roles empty as error in Talos API access
  • siderolabs/talos@​807b692a1 fix: allow CSI volumes to be mounted with an SELinux context
  • siderolabs/talos@​6249f3f4e test: skip filemap heap test under race detector
  • siderolabs/talos@​87a031b7f test: libvirtd extensions
  • siderolabs/talos@​e8b376365 fix: validate received kubeconfig
  • siderolabs/talos@​abce4c937 fix: use os.Root in the talosctl extract path
  • siderolabs/talos@​1deae73dd fix: escape output in the talosctl dashboard
  • siderolabs/talos@​5b153233c chore: speed up unit-tests
  • siderolabs/talos@​3715ce908 fix: add checks for meta key in the API path
  • siderolabs/talos@​138958053 feat: update COSI to 1.16.3
  • siderolabs/talos@​bdc7f3053 fix: preserve shared libs symlinks
  • siderolabs/talos@​7366edc90 chore: reduce verbosity of the grype scan
  • siderolabs/talos@​c027a947f fix: exclude scheduler config from apiserver config version
  • siderolabs/talos@​544fc52cb feat: add host extension pre-shutdown hooks
  • siderolabs/talos@​1d911581d fix: route creation churning every 100ms
  • siderolabs/talos@​baca68d0d fix: drop dead legacy registries init from worker generation
  • siderolabs/talos@​dec9dc3dc chore: bump sigstore/rekor to v1.5.4
  • siderolabs/talos@​dc9e7fea9 chore: add SPD5118 driver to squashfs
  • siderolabs/talos@​ae4d8228e fix: keep the time sync boot timeout across a syncer restart
  • siderolabs/talos@​755900fcc fix: preserve special modes when extracting files
  • siderolabs/talos@​6c927a0ff fix: hostns etc mount
  • siderolabs/talos@​3cdd0e748 feat: bump kubernetes to 1.37.0
  • siderolabs/talos@​03c567929 refactor: log filter stays enabled on enter press
  • siderolabs/talos@​b690b7ad5 fix: write the uploaded etcd snapshot atomically
  • siderolabs/talos@​25a366162 chore: update multipath notes
  • siderolabs/talos@​866db94f1 fix: drop gRPC client keepalive aggressive settings in the tracker
  • siderolabs/talos@​74e88bd57 feat: support host extension services
  • siderolabs/talos@​e828fe80a fix: skip selinux label for read-only/detached/external mounts
  • siderolabs/talos@​1be6787a5 fix: capture packets correctly on VLANs
  • siderolabs/talos@​d16d765f7 docs: update CRI customization example
  • siderolabs/talos@​1b31e1213 fix: use os.Root in the untar path
  • siderolabs/talos@​91a6af032 fix: enable additional SELinux permissions for Cilium
  • siderolabs/talos@​322de8bf2 fix: cache filemap layers on disk
  • siderolabs/talos@​414a1d463 release(v1.14.0-rc.2): prepare release
  • siderolabs/talos@​a740329b9 feat: bump kernel, containerd and go
  • siderolabs/talos@​0048cd3f4 chore: bump vulncheck dates
  • siderolabs/talos@​acc89cbef fix: use default terminal theme colors in talosctl dashboard
  • siderolabs/talos@​d78c61c82 fix: don't create new client in dry-run mode
  • siderolabs/talos@​7276d54ef fix: preserve selected sd-boot entry on upgrade
  • siderolabs/talos@​68a436656 fix: use the UKI command line when the config has no install section
  • siderolabs/talos@​e32a266d9 fix: persist in-memory meta on fresh install
  • siderolabs/talos@​35c8f172c fix: drop lockdown=confidentiality default for 1.14+
  • siderolabs/talos@​977199548 fix: reduce stalls in the etcd member promotion cycle
  • siderolabs/talos@​4c381dfae feat: update CoreDNS to 1.14.7
  • siderolabs/talos@​95135f804 feat: update Kubernetes to 1.37.0-rc.1
  • siderolabs/talos@​7ac3cad5e fix: watch IPv6 route changes in RouteSpecController
  • siderolabs/talos@​d31a66599 fix: enable SELinux to work with overlays
  • siderolabs/talos@​3cc04997f fix: move the spike information field of the time.Status resource
  • siderolabs/talos@​52e874785 feat: log peer address in gRPC request log
  • siderolabs/talos@​5f0005c25 feat: talosctl dashboard log filtering
  • siderolabs/talos@​5d13cc0e7 fix: truncate files replaced by system extensions
  • siderolabs/talos@​afc8d952d fix: skip target settings for external volume mounts
  • siderolabs/talos@​6e83aece4 test: use tiny hostns debug image
  • siderolabs/talos@​2f371abd5 fix: support try mode apply without prior config
  • siderolabs/talos@​d3544c2e3 fix: adjust cluster size for VFAT on ISO
  • siderolabs/talos@​3909ca9b2 feat: impl ContainerImageController
  • siderolabs/talos@​c563615ed test: add cachefilesd to the test matrix
  • siderolabs/talos@​d36a20e84 fix: apply directory user volume mount security
  • siderolabs/talos@​78efbb413 fix: install conntrack handler in accept ingress firewall mode
  • siderolabs/talos@​7a84d742b release(v1.14.0-rc.1): prepare release
  • siderolabs/talos@​89ea1af12 chore: ci uses extensions release-1.14
  • siderolabs/talos@​b881ccee1 chore: backport go 1.26.6
  • siderolabs/talos@​38a88d7a5 fix: share IPC namespace with the host for extension services
  • siderolabs/talos@​26d4d389e fix: use v1.13 config to test downgrade failure
  • siderolabs/talos@​6b6a4cc01 fix: provide read-only random seed in the ISO
  • siderolabs/talos@​250865dec chore: bump go deps
  • siderolabs/talos@​c0613dfe0 chore: rekres
  • siderolabs/talos@​18e26bbb0 chore: bump tools and pkgs to v1.14.0
  • siderolabs/talos@​b2262db3b fix: respect authentication-config extra arg for legacy config
  • siderolabs/talos@​1407a242e test: restore Talos 1.13 ephemeral policy skip
  • siderolabs/talos@​16a147dc7 feat: allow passing extra QEMU arguments per node
  • siderolabs/talos@​d6db2fd44 fix: render absolute CRI registry TLS paths
  • siderolabs/talos@​ee18fb424 fix: data race in Never condition closures
  • siderolabs/talos@​dc77862dc fix: show installer output on upgrade failure
  • siderolabs/talos@​7fbe57f8c fix: build native custom linter for lint targets
  • siderolabs/talos@​51f96d6bb fix: rework bootloader install and image generation
  • siderolabs/talos@​82fe416a4 test: fix ephemeral check for talos < 1.14
  • siderolabs/talos@​c96fdc764 chore: dependency updates 2026-08-11
  • siderolabs/talos@​f86ad4d77 chore: bump flannel to 0.28.9
  • siderolabs/talos@​a23c6b9f5 test: retry k8s node discovery
  • siderolabs/talos@​2666f13dc fix: flag all devices backing system disk, not just top one
  • siderolabs/talos@​c166e8863 feat: run full md boot integration suite
  • siderolabs/talos@​a81e32c97 feat: add alibabacloud platform
  • siderolabs/talos@​c14b43a9b fix: use less memory on the install path
  • siderolabs/talos@​87bfa703b fix: size the receive/send buffers for nftables netlink
  • siderolabs/talos@​83c132e6a docs: update volume mount secure options
  • siderolabs/talos@​cd0359d94 feat: impl ContainerConfigController
  • siderolabs/talos@​54b11fd9c test: fix the flakiness in image pull in provision-3 pipeline
  • siderolabs/talos@​0303f3181 fix: preserve connected prefixes in BGP advertisements
  • siderolabs/talos@​6fa811a0d fix: drop noexec for KUBELET, EPHEMERAL and CRI
  • siderolabs/talos@​25d8c0a51 feat: update Kubernetes to 1.37.0-rc.0
  • siderolabs/talos@​63ef4df99 fix: keep host DNS enabled for partial machine config
  • siderolabs/talos@​b00c06b35 fix: support image factory URLs with explicit port
  • siderolabs/talos@​825844afd chore: build custom-gcl for the host OS/arch
  • siderolabs/talos@​54673711f feat: tag published cloud images with a build type
  • siderolabs/talos@​3abe89e00 fix: avoid small panics
  • siderolabs/talos@​c75361127 test: wait for CRI runtime spec overrides
  • siderolabs/talos@​b0b77bcae fix: recover router advertisement sender panics
  • siderolabs/talos@​6e3d0c55c fix: image pull via the API should not have timeout or retries
  • siderolabs/talos@​a150503d5 fix: collapse machined/apid logs with authz messages
  • siderolabs/talos@​30ae29b1b test: skip iptables compatibility test in enforcing
  • siderolabs/talos@​8ad52d6dd fix: wait for router advertisement senders on shutdown
  • siderolabs/talos@​a0b021e36 chore: update go-talos-support to 0.3.1
  • siderolabs/talos@​85e97a55f fix: panic when KubeProxy is disabled without image override
  • siderolabs/talos@​969098c91 fix: bring in fixed Linux kernel with iptables xt modules
  • siderolabs/talos@​7d01fc936 fix: ignore unmanaged address flags in AddressSpecController
  • siderolabs/talos@​9ffa772ba feat: support experimental k8s-less and etcd-less mode
  • siderolabs/talos@​aab940f6a chore: update kernel to 6.18.42
  • siderolabs/talos@​6e45d0520 fix: ignore HostDNS IPv6 address in node addresses
  • siderolabs/talos@​4b89c911f feat: add support for static VLAN configuration to the dashboard
  • siderolabs/talos@​e225ff060 fix: keep host dns enabled during bootstrap
  • siderolabs/talos@​02c87ba96 fix: record PID properly when under sandboxd
  • siderolabs/talos@​fe2b5b430 test: apply correctly hydrophone timeouts
  • siderolabs/talos@​ab42416e0 test: use new multi-doc external manifest
  • siderolabs/talos@​f3974dc4b fix: a condition when unattended install status can flip to installed
  • siderolabs/talos@​e20509bae test: update airgapped patches
  • siderolabs/talos@​0d1f6e576 release(v1.14.0-beta.1): prepare release
  • siderolabs/talos@​1ab88f743 fix: load the raid1 module for configured MD arrays
  • siderolabs/talos@​9e8568d26 fix: use inmem containerd for installs/upgrades
  • siderolabs/talos@​8cf28da5f fix: preserve kmsg reconciliation after config changes
  • siderolabs/talos@​311b6fde9 fix: make reset during boot phase more robust
  • siderolabs/talos@​945d1cdab feat: bump kernel to 6.18.41
  • siderolabs/talos@​4e77d40e8 fix: restore the systemd-timesync best-sample check in spike detection
  • siderolabs/talos@​4444a187d test: inspect host mount state from the current thread
  • siderolabs/talos@​b7c0497b0 fix: race between vol.cfg. and vol.mgr. ctrl
  • siderolabs/talos@​ef9a091ec feat: allow attaching extra disks to controlplane machines
  • siderolabs/talos@​a418c0e1e test: fix CRI restart event assertion race
  • siderolabs/talos@​a9bfdbdd4 fix: ignore insecure-only imager assets
  • siderolabs/talos@​54e3b20e8 fix: hold the darwin vmnet bridge open for the network lifetime
  • siderolabs/talos@​bc59389fa fix: drop the OOM config rule about overall system memory PSI
  • siderolabs/talos@​69be56ea9 chore: add some initial set of libvirt SELinux policies
  • siderolabs/talos@​6170ad8b9 fix: validate kubespan & discovery config correctly for multi-doc
  • siderolabs/talos@​6e58c6d5a test: fix ded. vol. plumbing in integration tests
  • siderolabs/talos@​b644d1640 fix: allow directory-backed volumes in reset api
  • siderolabs/talos@​28e7a8742 feat: bump etcd to v3.7.1
  • siderolabs/talos@​2c657c224 feat: bump kernel to 6.18.40
  • siderolabs/talos@​b1bdc8c07 test: restart qemu process several times on startup failures
  • siderolabs/talos@​7533057a7 feat: support route imports between BGP instances
  • siderolabs/talos@​a94783704 docs: remove duplicated docs in the markdown for CLI
  • siderolabs/talos@​6f17c5033 fix: verify the public key signed images correctly
  • siderolabs/talos@​570fe34f0 fix: generate backwards compatible etcd encryption config
  • siderolabs/talos@​f7790816e fix: use context without cancelation for etcd locks
  • siderolabs/talos@​67e61ef30 feat: add the fs_scrub controller
  • siderolabs/talos@​1c156458a fix: override DHCP search domains via explicit ResolverConfig domains
  • siderolabs/talos@​fd8dbd8a1 fix: skip pod check if desired number of pods is zero
  • siderolabs/talos@​9aede5429 feat: add kubeimportlinter for versioned k8s imports
  • siderolabs/talos@​ae93d1462 fix: redact resource specs in the merge controllers
  • siderolabs/talos@​fc5743cd0 feat: add GrubUseUKICmdline install option
  • siderolabs/talos@​6bba77724 feat: add named native BGP instances
  • siderolabs/talos@​c5ab22f1d feat: move Talos API access from Kubernetes config to multi-doc
  • siderolabs/talos@​b1abd9c03 fix: split the up/finished service events
  • siderolabs/talos@​644ecbc66 feat: add discovered volumes status controller
  • siderolabs/talos@​6be2b1384 feat: add veth pair support
  • siderolabs/talos@​7514401de fix: drop the controlplane static pod change
  • siderolabs/talos@​9a521f667 fix: preserve container tasks across CRI restarts
  • siderolabs/talos@​9048d4157 fix: fix a nil-map assignment panic in configpatcher
  • siderolabs/talos@​45eaf2037 release(v1.14.0-beta.0): prepare release
  • siderolabs/talos@​7e58e0442 feat: add dedicated CRI configuration documents
  • siderolabs/talos@​076c38136 fix: race with PCR extensions and volume unlock
  • siderolabs/talos@​88884194c fix: teardown ephemeral mount request during reset
  • siderolabs/talos@​c793bcbf5 fix: configure bonds during initial link creation
  • siderolabs/talos@​9b3bf6e51 fix(talosctl): prevent duplicate QEMU config server ports
  • siderolabs/talos@​fa6cd1ca8 fix(machined): preserve health when services reach running
  • siderolabs/talos@​9d5554e69 fix(machined): wait for host namespace commands through reaper
  • siderolabs/talos@​fc08533bf chore: update dependencies
  • siderolabs/talos@​c08863cdd feat: provide different heuristics for xfs allocation groups
  • siderolabs/talos@​e955d9bd7 feat: update CoreDNS to 1.14.6
  • siderolabs/talos@​c3f757f9e feat: update Flannel to 0.28.8
  • siderolabs/talos@​fada0d960 fix: provide non-sensitive KubeletStatus resource
  • siderolabs/talos@​c68085286 fix: volume mount race (third attempt) around service restart
  • siderolabs/talos@​b185752e5 feat: refactor KubePrism config into multidoc
  • siderolabs/talos@​499d4ebf9 test: update Calico in canal reset test
  • siderolabs/talos@​5b6ed0068 test: add a test for kata-qemu runtime class
  • siderolabs/talos@​1a075383a feat: allow "duplicate" kinds in the config patches
  • siderolabs/talos@​06943be9e feat: update Kubernetes to 1.37.0-beta.0
  • siderolabs/talos@​01f2a1423 fix: preserve trailing rate-limited trigger events
  • siderolabs/talos@​46fab8057 test: stabilize AWS readiness and Talos 1.13 QEMU config
  • siderolabs/talos@​a26ac746d feat: move static pods and manifests into multi-doc
  • siderolabs/talos@​67464cbef fix: update the vulnerability dates and description
  • siderolabs/talos@​4920ee06f feat: update Linux to 6.18.39
  • siderolabs/talos@​286fa8006 feat: include CA into kube-apiserver serving certificate
  • siderolabs/talos@​6d65e223b feat: drop kubernetes flexvolume mounts
  • siderolabs/talos@​4935e9452 feat: refactor kubelet's config into KubeletConfig
  • siderolabs/talos@​241bd0ff1 feat: custom cfg for system volumes (cri, kubelet, etcd)
  • siderolabs/talos@​ea9557816 fix: talosctl build
  • siderolabs/talos@​c2b763608 feat: add UFSHC and some other modules
  • siderolabs/talos@​2193b5781 feat: native BGP support via embedded GoBGP
  • siderolabs/talos@​2e42c5900 fix: add ca-certificates to talosctl
  • siderolabs/talos@​0f55e1f05 feat: refactor Kubernetes configs into KubeNodeConfig
  • siderolabs/talos@​6efdc8f71 fix: zero MD superblock via block wipe on destroy
  • siderolabs/talos@​f78f5e5a1 fix: vrf sorting
  • siderolabs/talos@​77385181a fix: oom podruntime protection
  • siderolabs/talos@​c1184d38e feat: update to runc 1.5.1
  • siderolabs/talos@​4bff7eb90 feat: support reboot and sync for remote provisioner
  • siderolabs/talos@​c791fa8c0 feat: add host-namespace debug profile
  • siderolabs/talos@​e370e40b7 feat: implement KubeClusterConfig
  • siderolabs/talos@​37c78bfc0 fix(ci): skip ephemeral noexec test on 1.13
  • siderolabs/talos@​0ab6695e6 feat: update Kubernetes to 1.37.0-alpha.3
  • siderolabs/talos@​443ca17e1 test: bump test dependencies
  • siderolabs/talos@​c4242088b fix: enable noexec for EPHEMERAL only for new machines
  • siderolabs/talos@​fc9f72648 feat: bump CoreDNS, Flannel
  • siderolabs/talos@​352b1bdeb fix: use symlinks for init aliases
  • siderolabs/talos@​883775a9e fix: move sandboxd into a separate cgroup
  • siderolabs/talos@​099a2ceda fix: remote provisioner name
  • siderolabs/talos@​ff67aaf32 feat: bump go dependencies
  • siderolabs/talos@​79c0c5414 feat: add iommufd as a kernel module
  • siderolabs/talos@​f34e93fe2 fix: do proper backoff for NTP Kiss-of-Death responses
  • siderolabs/talos@​a3e644d8d chore: bump tools and pkgs
  • siderolabs/talos@​efa88f2f6 fix: flaky tests
  • siderolabs/talos@​17a134711 feat: add ignoreRoutes option to DHCPv4 config document
  • siderolabs/talos@​2519bf231 fix: make audit restartable
  • siderolabs/talos@​54b4bbc03 fix: provide correct handler for Ctrl-Alt-Delete sequence
  • siderolabs/talos@​87e126ab7 feat: isolate cri, kubelet and pods in a sandbox namespace
  • siderolabs/talos@​3fb8f4e9e fix: avoid image cache mount request churn
  • siderolabs/talos@​9753fc27f fix: e2e test flakes
  • siderolabs/talos@​f756ff232 feat: kubenetworkconfig supports per-node pod cidr configuration
  • siderolabs/talos@​b42c42976 fix(ci): fix more flaky tests
  • siderolabs/talos@​5d97eccdf feat: bring in ifb.ko module
  • siderolabs/talos@​6769a1d5c fix: terminate log persistence a bit harder
  • siderolabs/talos@​98cce792f fix(ci): extensions test
  • siderolabs/talos@​057d554d2 test: assert dm transport for device-mapper disks
  • siderolabs/talos@​9fd16a21e feat: bump etcd to 3.7.0
  • siderolabs/talos@​3048eeb23 feat: support booting from MD RAID1 array
  • siderolabs/talos@​e1fc7a4a1 fix: do not block volume lifecycle teardown on failed user volumes
  • siderolabs/talos@​147dea148 feat: add --no-reboot flag to upgrade cmd
  • siderolabs/talos@​1b23b11fc chore: update pkgs and tools
  • siderolabs/talos@​bfa9fb4e8 fix: flaky tests
  • siderolabs/talos@​a1ede48cb test: fix testremovemember etcd integration flake
  • siderolabs/talos@​ea90e690d feat: add MD RAID gRPC service and reconcile controllers
  • siderolabs/talos@​74486ef6d chore: update deps
  • siderolabs/talos@​f59c3ccad feat: implement service account configuration
  • siderolabs/talos@​baff2d3f9 test: fix some test flakiness
  • siderolabs/talos@​5450ec303 fix: use a forked version of secure-io/siv-go
  • siderolabs/talos@​33fac3f85 test: stabilize netapp trident csi fio runs
  • siderolabs/talos@​afdde2a8f chore(ci): add netapp trident csi integration tests
  • siderolabs/talos@​21eca156f fix: print link status changes
  • siderolabs/talos@​210f4e369 fix: shutdown/reboot via usermode helpers
  • siderolabs/talos@​d193f278d test: fix cilium test config patching
  • siderolabs/talos@​e06898069 fix: flaky tests
  • siderolabs/talos@​b7398ec00 feat: move kernel module config into multi-doc
  • siderolabs/talos@​55bc643af fix: flaky serviceaccount suite test
  • siderolabs/talos@​dced7d570 fix: correctly treat guaranteed QoS pods in the OOM handler
  • siderolabs/talos@​f783f6636 feat: implement controlplane only config validation
  • siderolabs/talos@​d0291bb0b feat: extract Kubernetes CA config into a separate document
  • siderolabs/talos@​97ed958a8 chore: use lefthook globs to skip noop jobs
  • siderolabs/talos@​a145c6356 chore: lefthook USERNAME env, post-commit hook
  • siderolabs/talos@​f836707ad fix: use UnattendedInstallConfig for extensions
  • siderolabs/talos@​67293c809 chore: add lefthook.yml
  • siderolabs/talos@​726ea8fc2 chore: switch v1alpha1 validation to use cluster config struct
  • siderolabs/talos@​d1d848022 feat: add mdadm tooling and udev rules
  • siderolabs/talos@​020de3f51 chore: update go dependencies
  • siderolabs/talos@​ae84f56a0 chore: remove orphaned unattendedinstall.md
  • siderolabs/talos@​416073748 feat: add UnattendedInstall config and controller
  • siderolabs/talos@​4e5b4c6a7 feat: extract clusterid and clustersecret to discoveryidentityconfig
  • siderolabs/talos@​0a641f268 refactor: simplify device status controller
  • siderolabs/talos@​99da7f27f fix: data race in manifest sync
  • siderolabs/talos@​54ac1cbd6 fix: provide cooldown period for the QoS trigger
  • siderolabs/talos@​788562586 feat: udevd controller and udev rules config document
  • siderolabs/talos@​6e34da25c feat: delegate drain ops to go-kubernetes/nodedrain
  • siderolabs/talos@​e9e027c63 fix: kubelet stuck restarting
  • siderolabs/talos@​6f481b420 fix: decode extraArgs list values correctly
  • siderolabs/talos@​c8bdcc252 feat: update runc to 1.5.0
  • siderolabs/talos@​eae11ab0c feat: allow user managed etc files
  • siderolabs/talos@​47d4bd87e feat: set user-agent for Kubernetes client
  • siderolabs/talos@​ba926c6ce chore: update golangcilint config
  • siderolabs/talos@​45497bd5b feat: bring systemd 261.1
  • siderolabs/talos@​8d9ecec93 refactor: improve stability for process_test.go
  • siderolabs/talos@​31221e7ee refactor: talosctl running tasks are yellow
  • siderolabs/talos@​b268a6b08 feat: refactor CoreDNS config into multi-doc
  • siderolabs/talos@​416d5fe4b fix: race in etcd member add
  • siderolabs/talos@​c244e4c46 fix: building integration test binary on darwin
  • siderolabs/talos@​b15a64b31 chore: bump rekor for GHSA-47q9-m4ww-924m
  • siderolabs/talos@​cd8b0fe39 release(v1.14.0-alpha.2): prepare release
  • siderolabs/talos@​917820cb3 chore: sync pkgs/tools
  • siderolabs/talos@​b34be14e9 fix: cli.md codeblock generation
  • siderolabs/talos@​25abcc6b5 docs: update kubespanconfig to match discoveryserviceconfig
  • siderolabs/talos@​742589f50 feat: support multiple discovery service configs
  • siderolabs/talos@​fc3f27d79 chore: enrich the SBOM with Go module licenses
  • siderolabs/talos@​47d5c3351 fix: handle image cache being disabled
  • siderolabs/talos@​1a965aec3 test: disable LongHorn ublk test and add more cores
  • siderolabs/talos@​6d03b3f61 fix: align documented image cache partition label
  • siderolabs/talos@​6447d854f fix(talosctl): use aio threads on darwin
  • siderolabs/talos@​f856d1808 fix: image verification with referrers
  • siderolabs/talos@​11a7fbe4c feat: extract kube-apiserver config into multi-doc configs
  • siderolabs/talos@​337654d2b test: fix rook-ceph tests
  • siderolabs/talos@​e33a86825 feat: add AMD XGBE driver to initramfs
  • siderolabs/talos@​bd2d6242a fix: revert coredns to 1.14.2
  • siderolabs/talos@​7c4e644f8 feat: update Linux to 6.18.36
  • siderolabs/talos@​6e23a5c2f chore: refactor bare opentree_clone into a mount helper
  • siderolabs/talos@​dfbd30959 fix(talosctl): prevent appending type 11 smbios values on restart
  • siderolabs/talos@​5926dd70d test: support running integration test against remote provisioner
  • siderolabs/talos@​f146c6a18 feat: refactor /etc mounts
  • siderolabs/talos@​ebe364117 chore: bump containerd to 2.3.2
  • siderolabs/talos@​bc30c61a1 chore: bump deps (go, k8s, docker)
  • siderolabs/talos@​00d739d0a test: skip fstrim default schedule on cloud tests
  • siderolabs/talos@​d9c6edf01 fix: bump number of open files for etcd
  • siderolabs/talos@​990c5395c chore: update tools and pkgs 2026-06-17
  • siderolabs/talos@​325be7cd8 refactor: config generate uses multi-doc sysctlconfig
  • siderolabs/talos@​d6930633b fix: clean up and overhaul mount ops
  • siderolabs/talos@​a0219404d fix: cgroups cleanup
  • siderolabs/talos@​58d8b71c4 fix: stop the log persistence and close all files on shutdown
  • siderolabs/talos@​4b32ebc17 refactor: simplify trustd/apid rootfs setup
  • siderolabs/talos@​dc98e3553 feat: implement filesystem trim support
  • siderolabs/talos@​897bef633 feat: introduce KubeProxyConfig multi-doc
  • siderolabs/talos@​ebde543cf feat: introduce BootID resource
  • siderolabs/talos@​cd178b9f3 fix: ensure consistent manifest apply order
  • siderolabs/talos@​19fac6151 feat: remote provisioner
  • siderolabs/talos@​b6412e031 fix: drop one more reference to removed 'nodes'
  • siderolabs/talos@​be7f7a7db feat: add human-readable size fields to LVM resources
  • siderolabs/talos@​d4e0ca1ba fix: make LVM reconciliation robust and idempotent
  • siderolabs/talos@​0dbc1e529 chore(ci): fix flaky test
  • siderolabs/talos@​b687a47ab feat: implement an option to allow discards on encrypted volumes
  • siderolabs/talos@​3fc981c57 fix: improve security of scheduler/controller-manager
  • siderolabs/talos@​5d4af9f33 fix: gracefully stop node containers before removal
  • siderolabs/talos@​c1593d8a3 fix: honor FailurePauseTimeout when pausing before reboot
  • siderolabs/talos@​506dc1323 feat: add imager flag to set the SecureBoot key enrollment mode
  • siderolabs/talos@​5d4ba702e refactor: generate pod definitions in k8stemplates
  • siderolabs/talos@​995bc30d5 feat: drop apply config method reboot
  • siderolabs/talos@​18f6cb4d0 fix: increment time epoch on wall-clock jump when time sync is disabled
  • siderolabs/talos@​755a8c8eb feat: update etcd to 3.7.0-rc.0
  • siderolabs/talos@​a0c76fad1 feat(talosctl): implement cluster logs
  • siderolabs/talos@​db052165c feat(talosctl): support rebooting cluster nodes
  • siderolabs/talos@​0a04f463a feat(talosctl): use gateway dns for cluster
  • siderolabs/talos@​cf3eb1cad chore(talosctl): disable kexec for cluster create on arm64
  • siderolabs/talos@​180182b0f fix: correct the link alias condition
  • siderolabs/talos@​ac9014f05 fix: introduce pull attempt stall detection for image pull

@scottames-github-bot

Copy link
Copy Markdown
Contributor
siderolabs/talos (aqua:siderolabs/talos) - part 2 of 3
  • siderolabs/talos@​f2286d616 fix: move Flannel netpol patch to the controlplane
  • siderolabs/talos@​9986c0b16 feat: bump kernel to 6.18.35
  • siderolabs/talos@​e8845fba6 fix: route ProxyURL test via reachable endpoint
  • siderolabs/talos@​44acedf30 feat: add declarative LVM logical volume provisioning
  • siderolabs/talos@​f6058a11b feat: grab support bundle via client factory
  • siderolabs/talos@​cdd719773 feat: add CPUCores resource
  • siderolabs/talos@​8e41eb1bd feat: verify go.mod tidiness in generate target
  • siderolabs/talos@​b19e2ea42 feat: add kube-apiserver probes
  • siderolabs/talos@​a321a1dcc feat: support proxy-url in talosconfig context
  • siderolabs/talos@​bb2ac7546 feat: parse schematic info out of extension status
  • siderolabs/talos@​0c02a5a07 fix: align flannel MTU with kubespan to avoid permanent fragmentation
  • siderolabs/talos@​3d5fd822c feat: expose disk firmware and BIOS version
  • siderolabs/talos@​30115981c fix: relax LUKS header validation
  • siderolabs/talos@​5923199fb refactor: use ClientFactory for the action tracker
  • siderolabs/talos@​72c0ced3c refactor: deprecate sysfs and sysctl in machineconfig
  • siderolabs/talos@​ee74a41fb fix: handle cluster-scoped resources with a namespace correctly
  • siderolabs/talos@​9df5a647a feat: allow to disable access time for EPHEMERAL partition
  • siderolabs/talos@​9b667dbde chore: fix lint error in test
  • siderolabs/talos@​311378386 test: increase resource inmem buffer to stabilize the tests
  • siderolabs/talos@​6f85ce3d2 docs: hack/release.toml explains kernelmodulestatus
  • siderolabs/talos@​9bb0a5d01 fix(talosctl): add scrolling to dashboard footer node list
  • siderolabs/talos@​4c029c2d6 fix: machine configuration schemas
  • siderolabs/talos@​c3052e845 feat: move CNI config out of v1alpha1 config
  • siderolabs/talos@​1d2f1208c feat: add declarative LVM volume group provisioning
  • siderolabs/talos@​85f1d428f chore: refactor tests to use debug api
  • siderolabs/talos@​c901d47a5 refactor: talosctl streaming commands and more fixes
  • siderolabs/talos@​166854959 fix: mark more resources as sensitive
  • siderolabs/talos@​58adf2e00 fix: classify installer and imager exits
  • siderolabs/talos@​9549930ff feat: update Flannel to v0.28.5
  • siderolabs/talos@​27362d18e refactor: replace the callback strategy for most commands
  • siderolabs/talos@​cb42d9d9a feat: implement support bundle encryption
  • siderolabs/talos@​9ae260b55 feat: enable NRI by default
  • siderolabs/talos@​d1d5847b0 fix: flaky test
  • siderolabs/talos@​0f2331586 feat: support external secureboot and pcr signers
  • siderolabs/talos@​b349d919d feat: enforce strict QoS ordering in OOM victim selection
  • siderolabs/talos@​76d9b49bd fix(ci): aws nvidia tests
  • siderolabs/talos@​3131826cd fix: provide NTS sync with bad initial clock state
  • siderolabs/talos@​89e307e58 fix: etcd client leak in the (legacy) Upgrade API
  • siderolabs/talos@​476c4d050 fix: recreate dns server and listeners on host DNS runner restart
  • siderolabs/talos@​9a283d9b1 feat: bump Go to 1.26.4
  • siderolabs/talos@​4759dc246 chore: bump dependencies
  • siderolabs/talos@​26a25a073 chore(ci): drop homebrew workflow
  • siderolabs/talos@​fa8a55192 feat: update etcd to v3.6.12
  • siderolabs/talos@​41fcab476 feat: update kernel to 6.18.34
  • siderolabs/talos@​8ba00612b feat: update dependencies
  • siderolabs/talos@​6e2dec1ea refactor: update talosctl commands to stop using WithNodes
  • siderolabs/talos@​f9ad63a35 feat: add custom logging convention linter
  • siderolabs/talos@​30dbce03f chore: make oci images reproducible
  • siderolabs/talos@​38244fd5b feat: add sbom builder
  • siderolabs/talos@​5177c50e2 refactor: deprecate loadedkernelmodule
  • siderolabs/talos@​c2eef3645 fix: health request server-side
  • siderolabs/talos@​d6eff8eff refactor: drop multi-nodes proxying for the dashboard
  • siderolabs/talos@​2e547a964 refactor: deprecate multi-node proxying
  • siderolabs/talos@​ddcc519e1 fix: add --fail to image-signer curl download
  • siderolabs/talos@​e5b0b1dde fix: normalize log fields
  • siderolabs/talos@​d8e95c396 fix: drop installer from bundle
  • siderolabs/talos@​7aad9ec81 feat: update pkgs, tools, Go dependencies
  • siderolabs/talos@​b50ee396f fix: fix trace fix to also lookup release branches
  • siderolabs/talos@​027c93d25 release(v1.14.0-alpha.1): prepare release
  • siderolabs/talos@​4eb862d09 feat: add LVMService for VG/LV/PV removal
  • siderolabs/talos@​b88f16a52 fix: use POSIX shell idioms for error propagation
  • siderolabs/talos@​5290eb374 fix: suppress ICMP redirects by default
  • siderolabs/talos@​7b4aba2e5 fix: marshal kube-scheduler config correctly with int types
  • siderolabs/talos@​894be9bf5 fix: touch rootfs files with SOURCE_DATE_EPOCH
  • siderolabs/talos@​cde82224e fix: ignore cgroups with zero rank in OOM handler
  • siderolabs/talos@​bc0372411 fix: bring in a change to BCM2712_MIP
  • siderolabs/talos@​f572c33f1 chore: fail on makefile error
  • siderolabs/talos@​e317d4b47 fix: drop modprobe path and enforce usermode helper
  • siderolabs/talos@​89e53f610 fix(machined): make built-in mod state always 'permanent'
  • siderolabs/talos@​cfbec9bd5 test: skip UEFI vars wipe if TPM is enabled
  • siderolabs/talos@​1e31deda3 fix: create parent directories when extracting tar archives
  • siderolabs/talos@​14dc188bd chore: verify go-containerregistry preserves symlinks
  • siderolabs/talos@​951922dfb fix: guard apply config API call
  • siderolabs/talos@​3e173adf4 feat: move kube-controller-manager config to multi-doc
  • siderolabs/talos@​b5cda3438 fix: reset QEMU UEFI variable store when disk is wiped
  • siderolabs/talos@​4a17ac6ac chore: script for tracking fixes made in upstream toolchain/tools/pkgs
  • siderolabs/talos@​d71edeead feat: add LVM status resource definitions
  • siderolabs/talos@​4aeba1cde fix: perform backwards-compatible kernel args cleanup
  • siderolabs/talos@​9b7b2bf36 feat: implement support for btrfs user volumes
  • siderolabs/talos@​03ee8ee3a feat(machined): support instance tags on Akamai
  • siderolabs/talos@​d19f9ade0 fix: memorymodules resource reporting
  • siderolabs/talos@​a6edcf6f3 chore: move out adv library
  • siderolabs/talos@​40e66eac7 fix: bump Go golang.org/x modules
  • siderolabs/talos@​e23ca4a0a chore(ci): add upgrade tests for trustedboot
  • siderolabs/talos@​e3003c0ec chore: bump tpm nonce size to match the algorithm used
  • siderolabs/talos@​8fd04da1f feat: add bnxt_re module to the rootfs
  • siderolabs/talos@​1cfab00f1 fix: update etcd experimental args
  • siderolabs/talos@​ad96fc6ae fix: relax hostname config validation
  • siderolabs/talos@​efd735334 chore(ci): add missing labels, move release metadata check to job
  • siderolabs/talos@​9ec045059 feat: update containerd to 2.3.1
  • siderolabs/talos@​42f4144a1 feat: introduce new KubeSchedulerConfig
  • siderolabs/talos@​f2b7f39db refactor: move Args type out of config/v1alpha1
  • siderolabs/talos@​b959dcb3e fix: bump Kubernetes to 1.36.1 in one more place
  • siderolabs/talos@​8ecc77f1a feat: update default Kubernetes version to 1.36.1
  • siderolabs/talos@​cbd9c3745 chore: rekres to secure slack workflows
  • siderolabs/talos@​6a92fc653 test: update Canal version used in the tests
  • siderolabs/talos@​be12d3d08 feat: support 4k sector size disk images
  • siderolabs/talos@​a7e8f4c28 chore(ci): fix cloud image upload job name
  • siderolabs/talos@​4319399f6 feat: introduce more modular Linux kernel
  • siderolabs/talos@​ed5df89f6 feat(ci): rotate credentials
  • siderolabs/talos@​a6a984ff7 chore(ci): fix the job conditions
  • siderolabs/talos@​ecb7d4588 feat: enable Flannel nftables mode
  • siderolabs/talos@​9919ff781 feat: update Linux to 6.18.32
  • siderolabs/talos@​1a7d136e4 feat: add Azure Secure Boot imager profile
  • siderolabs/talos@​df68e7391 feat: implement kernel module status resource
  • siderolabs/talos@​e98ee99d4 fix: streamline config validation flow
  • siderolabs/talos@​d7f0a2fd4 feat: update Linux to 6.18.31
  • siderolabs/talos@​2b66e25a5 chore: update image signer
  • siderolabs/talos@​5aa1795f9 chore: drop e2e step dependencies
  • siderolabs/talos@​d42b3b396 feat: update Linux to 6.18.30
  • siderolabs/talos@​c3f6f3507 feat: implement static host resolving via host DNS
  • siderolabs/talos@​2f06a68ef refactor: split host DNS handler
  • siderolabs/talos@​e99c5be5a feat: implement DNS over HTTP(S)
  • siderolabs/talos@​cf6065238 chore: stop publishing installer to ghcr
  • siderolabs/talos@​0edabd29c fix: restore some shared (and some lower tier slave) mount propagation
  • siderolabs/talos@​f1578dc63 fix: image verification issue with registry.k8s.io
  • siderolabs/talos@​46b1f8a24 fix: rework how scheduler config is marshaled
  • siderolabs/talos@​820a9fa59 chore: fix typos in comments
  • siderolabs/talos@​649a384a9 feat: move more kernel stuff to modules
  • siderolabs/talos@​4f3ab2012 chore(ci): try fixing homebrew action
  • siderolabs/talos@​600c0ab5d feat(ci): validate that extensions PKGS and TOOLS sync with talos
  • siderolabs/talos@​76080416b feat: redact more machine config secrets and audit redactors
  • siderolabs/talos@​aabf63957 docs: drop controlplane endpoint examples
  • siderolabs/talos@​b48a2bef4 test: relax kernel-default routing rule assertion
  • siderolabs/talos@​d2208b034 refactor(talosctl): propagate command context throughout, handle interrupts
  • siderolabs/talos@​0760b5c28 fix: normalize source name for syft consistency
  • siderolabs/talos@​c49ac0ec2 docs: document release policy
  • siderolabs/talos@​ec7e6ef9f feat: bump in-toto indirect dependency
  • siderolabs/talos@​21858a674 feat: update kernel to 6.18.29
  • siderolabs/talos@​5a49dc61d feat: migrate Image Cache config to multi-doc
  • siderolabs/talos@​574298ec1 fix: handle empty GCP operation errors
  • siderolabs/talos@​366b10b79 feat: dockerfile improvements
  • siderolabs/talos@​9a1d9d0af feat: bump go 1.26.3
  • siderolabs/talos@​6eec1c229 feat: support DNS over TLS for upstream resolvers
  • siderolabs/talos@​dee139aef feat: revert update CoreDNS to 1.14.3
  • siderolabs/talos@​087bc4c18 chore: lint packages under tools
  • siderolabs/talos@​9e7516fae fix: clarify documentation for image verification pattern
  • siderolabs/talos@​41c8e9dc4 feat: bump dependencies
  • siderolabs/talos@​2b6c06ef5 feat: update CoreDNS to 1.14.3
  • siderolabs/talos@​6b6f7978b feat: update containerd to 2.3.0
  • siderolabs/talos@​f9c4f90da feat(ci): longhorn v2 ublk tests
  • siderolabs/talos@​84d169c62 fix: make dnsd retry listening
  • siderolabs/talos@​689974bd5 fix: volume mount permissions
  • siderolabs/talos@​ff0f66bdf fix: skip reserved routing rule priorities
  • siderolabs/talos@​850e2c754 feat: drop fakeroot, use go helper
  • siderolabs/talos@​0c1bd701a feat: add golangci-lint fmt target
  • siderolabs/talos@​53bd66956 feat: support conditional start of IPv6 dns servers
  • siderolabs/talos@​b31d93e0d feat: auto-enroll SecureBoot keys for disk images
  • siderolabs/talos@​849a68006 test: update pkgs to test new extensions
  • siderolabs/talos@​c30a6dfcb fix: preserve DHCP DNS servers
  • siderolabs/talos@​5b81b20d3 feat: apply DHCP search domains
  • siderolabs/talos@​4e5ff8fa2 fix(ci): zfs test
  • siderolabs/talos@​14abe5140 fix: handle gateways which are not on-link routes in dhcp4
  • siderolabs/talos@​e1f759af8 chore: fix lint issues automatically
  • siderolabs/talos@​664c5f643 chore: update tools
  • siderolabs/talos@​c64df2b61 fix: add missing kernel modules in rootfs
  • siderolabs/talos@​f73c24594 feat: run depmod with verification on rootfs build
  • siderolabs/talos@​1371596d7 fix: provide proper AWS platform metadata
  • siderolabs/talos@​4f11f021d feat: implement etcd encryption config (kube-apiserver)
  • siderolabs/talos@​876f83643 feat: add support for HTTP Probes
  • siderolabs/talos@​9b776d598 feat: update etcd to 3.6.11
  • siderolabs/talos@​631a1bc5e fix: bring in hardened kernel
  • siderolabs/talos@​a349dac03 fix: stale discovered volume children
  • siderolabs/talos@​13ce01879 fix: re-enable kexec on arm64
  • siderolabs/talos@​32539d4ac fix: deadlock in the makefs ext4 with populated source
  • siderolabs/talos@​0f3e1966a fix: panic in Kubernetes manifest sync
  • siderolabs/talos@​3bae01ac1 fix: do not pick up a system disk from a loop device
  • siderolabs/talos@​dedb7a96c fix(talosctl): protect k8sNames map writes with mutex
  • siderolabs/talos@​cc2be213a fix: drop explicit platform matcher
  • siderolabs/talos@​1dffebaf2 fix: mount throws EPERM on virtiofs with SELinux
  • siderolabs/talos@​48a481c29 fix: replace Canal manifest with a more recent one
  • siderolabs/talos@​6a445406e fix: make lacp active nilable
  • siderolabs/talos@​0d1d95c7d fix: bump go-kmsg to fix the timestamp drift
  • siderolabs/talos@​bd344fd53 fix: reset the ticker when the KubeSpan is disabled/enabled
  • siderolabs/talos@​462015bcd release(v1.14.0-alpha.0): prepare release
  • siderolabs/talos@​8a037a56e test: fix flaky tests
  • siderolabs/talos@​08c81d838 feat: bump kernel to 6.18.25
  • siderolabs/talos@​fe40b6e58 fix(ci): fetch empty pr labels
  • siderolabs/talos@​837a9ed07 feat: move host DNS config into ResolverConfig
  • siderolabs/talos@​96a8ecd1e feat: default to factory installer image
  • siderolabs/talos@​f19eef78b fix: revert add extraArgs from service-account-issuer
  • siderolabs/talos@​6821225b6 fix: revert use append instead of prepend in service-account-issuer
  • siderolabs/talos@​b43c3a124 feat: add quirk for talosctl factory downloads
  • siderolabs/talos@​df0b9a8da refactor: make all controller unit-test follow modern patterns
  • siderolabs/talos@​c2948cef2 feat: support auth for Image Factory in cluster create
  • siderolabs/talos@​560bcf0ca feat: enforce TLS 1.3 minmum version for Kubernetes components
  • siderolabs/talos@​3db14309e fix(talosctl): ensure uncordon runs after reboot/upgrade errors
  • siderolabs/talos@​ecf2fa855 feat: update Kubernetes to v1.36.0
  • siderolabs/talos@​71557eadd fix(ci): skip misc jobs not on pull request
  • siderolabs/talos@​026313b7c docs: rename security-insights.yml to lowercase for LFX detection
  • siderolabs/talos@​dc4ffd490 fix(ci): fix jobs not interpolating matrix due to condition
  • siderolabs/talos@​25e2f37e2 chore: generate comments for fields in resource proto
  • siderolabs/talos@​149592fa5 fix: watch kubelet's kubeconfig and time out for cache sync
  • siderolabs/talos@​1f315e6e9 feat: update Linux to 6.18.23
  • siderolabs/talos@​0198eedc2 feat: add NTS (Network Time Security) support for NTP time sync
  • siderolabs/talos@​6830a8b97 fix(ci): matrix jobs cleanups
  • siderolabs/talos@​71aeb347f test: fix OOM test flake
  • siderolabs/talos@​9b9542cc5 test: fix a flake in the manifest sync test
  • siderolabs/talos@​863d882b6 test: add image verification for factory.talos.dev
  • siderolabs/talos@​bba0b4aee chore(ci): nvidia update helm values
  • siderolabs/talos@​3399ff4de fix: propagate route table down to the resource
  • siderolabs/talos@​c684ec60e chore: prepare for Talos 1.14 release
  • siderolabs/talos@​ed9545d0d chore(ci): bump gpu operator version
  • siderolabs/talos@​4de3e4393 fix(ci): cron triggered workflows
  • siderolabs/talos@​212182e6f chore: bump container registry library
  • siderolabs/talos@​c028db0b8 fix: do not flip machine stage to rebooting during shutdown
  • siderolabs/talos@​6ce62d9e8 fix(ci): workflow runs with workflow_run
  • siderolabs/talos@​509cd9733 fix: boot entry detection
  • siderolabs/talos@​5e3f30188 feat(ci): rework to schedule daily runs after a cron
  • siderolabs/talos@​7fa4d3919 fix: zfs extensions test
  • siderolabs/talos@​1ef8e630a test: allow more tests to run in FIPS strict mode
  • siderolabs/talos@​bdcc9321b fix: reduce memory dashboard usage
  • siderolabs/talos@​2d177af82 chore: update Syft to v1.42.4+patches
  • siderolabs/talos@​0d8362119 fix: return failed precondition on upgrade when not installed
  • siderolabs/talos@​be58eafab fix: wrong slot of encryption key was logged
  • siderolabs/talos@​015081c76 feat: update dependencies
  • siderolabs/talos@​9fbb7c95d fix: audit trustd code for security
  • siderolabs/talos@​986e97fc7 feat: update Flannel to 0.28.4
  • siderolabs/talos@​f3817d1d1 chore: update sign images to support image name suffix
  • siderolabs/talos@​e776721f3 feat: update Kubernetes 1.36.0-rc.1
  • siderolabs/talos@​f6e7346fa fix: encode extra args fields in resources with new id
  • siderolabs/talos@​3c7bb80ba chore: bump tools
  • siderolabs/talos@​3ba35c9b9 chore(ci): nvidia try UKI boot
  • siderolabs/talos@​e3e8f01ca chore: bump tools
  • siderolabs/talos@​181584a5f fix: handle boot failure
  • siderolabs/talos@​c464c7e88 fix: upgrade API in maintenance mode (legacy)
  • siderolabs/talos@​b7512d912 feat: update Kubernetes to 1.36.0-rc.0
  • siderolabs/talos@​4ba11156f refactor: allow overriding out image name suffix
  • siderolabs/talos@​c81aa125c fix: panic in reading PCR values
  • siderolabs/talos@​6a3ab87c5 feat(ci): add nvidia arm64 matrix
  • siderolabs/talos@​21f459aab fix(talosctl): always use default GRPC dial options
  • siderolabs/talos@​ca208e514 fix: validate hostDNS forwarding requires hostDNS to be enabled
  • siderolabs/talos@​9fcb9e05b feat: bump go to 1.26.2
  • siderolabs/talos@​0bfdf7f70 fix: create correct blackhole routes for IPv4
  • siderolabs/talos@​52b920032 feat: add client-side Kubernetes node drain to reboot and upgrade commands
  • siderolabs/talos@​968ec1e0c refactor: propagate NAME properly, allow to set on build
  • siderolabs/talos@​acc69c346 fix: set the minimum TLS version to 1.3
  • siderolabs/talos@​0cfa6e302 chore: bump some tool dependencies
  • siderolabs/talos@​4229bb9d2 feat: add dis-vulncheck tool
  • siderolabs/talos@​d697f5538 fix: don't set xattrs while decompressing extensions
  • siderolabs/talos@​34fb2cbe5 refactor: remove manual shell completion and replace with cobra completion
  • siderolabs/talos@​79fa2e300 feat: allow more nvidia and nvme files from extensions
  • siderolabs/talos@​414f78a29 feat: allow glibc ld files in etc
  • siderolabs/talos@​1bbba4301 feat: update Flannel to v0.28.2
  • siderolabs/talos@​55815e0fa fix: handle ISOs with zeroes in volume labels
  • siderolabs/talos@​7b6ab0c1c feat: add flag to force fallback to legacy upgrade
  • siderolabs/talos@​5e24d5265 feat: add resource view to talosctl dashboard
  • siderolabs/talos@​649ab7fe4 fix: add os:meta:writer role to the dashboard
  • siderolabs/talos@​10cdfa909 fix: drop talosctl install
  • siderolabs/talos@​087ced85f fix: unseal with "slow" TPM
  • siderolabs/talos@​11ab0a8c5 fix: drop unused type from ExternalVolume schema
  • siderolabs/talos@​e2df0f6ce fix: always grow disks
  • siderolabs/talos@​919d8c365 chore: drop debug shell
  • siderolabs/talos@​783a35851 fix: add metal-agent mode to runtime capabilities
  • siderolabs/talos@​37b2221cc docs: add SECURITY-INSIGHTS.yml for OSPS Baseline QA-04.01
  • siderolabs/talos@​bed2bd414 feat: add graceful power off support to QEMU VM launcher
  • siderolabs/talos@​3400059cc fix: incorrect route source for on-link routes
  • siderolabs/talos@​b3dfbf743 feat: bump musl to 1.2.6
  • siderolabs/talos@​4227921b3 test: fix the PKI mismatch test flake
  • siderolabs/talos@​f2bc2dcc6 feat: update NVIDIA production drivers to 595.58.03
  • siderolabs/talos@​aa5946dd3 test: fix cron failures for provision-1 & provision-2
  • siderolabs/talos@​1dd701efa fix: allow blockdevice wipe in maintenance mode
  • siderolabs/talos@​786bf00ab feat: add --platform=all support to image cache-create
  • siderolabs/talos@​e1f645e3c feat: validate luks headers for tampering
  • siderolabs/talos@​ad72c7300 test: improve maintenance API provision tests
  • siderolabs/talos@​70cefab6a test: fix the flakes in tests with trusted roots
  • siderolabs/talos@​aacff17f4 test: bump memory for Flannel netpolicy tests
  • siderolabs/talos@​9c3459114 feat: update Linux to 6.18.19, CNI to 1.9.1
  • siderolabs/talos@​038cb8735 feat: enforce PID check on connections to services over file sockets
  • siderolabs/talos@​e2b2dd3ea chore: update go-kubernetes library
  • siderolabs/talos@​9597714f6 fix: add symlinks nvidia-ctk and nvidia-cdi-hook in /usr/bin
  • siderolabs/talos@​8ac47d677 fix: unset rlimits for extension services
  • siderolabs/talos@​b1a02f368 feat: update Kubernetes to 1.36.0-beta.0
  • siderolabs/talos@​362fdc9ec feat: update etcd to 3.6.9
  • siderolabs/talos@​0a47f40b3 fix(machined): clear stale bond ARP/NS targets on decode
  • siderolabs/talos@​86344639f fix: update diff library to v1.0.1
  • siderolabs/talos@​eff89d1ed fix: panics in diff algorithms
  • siderolabs/talos@​8e1c8a7a9 test: fix the apid test against AWS/GCP

Changes since v1.14.0-rc.2

52 commits

  • siderolabs/talos@​9abd05af4 release(v1.14.0): prepare release
  • siderolabs/talos@​ff772d64f chore: mark release as stable
  • siderolabs/talos@​5424dac73 test: relax OOM test conditions
  • siderolabs/talos@​9f6719422 fix: normalize image reference when passing to image verification flow
  • siderolabs/talos@​6ce58d308 fix: name diskSelector in UnattendedInstallConfig validation errors
  • siderolabs/talos@​af4e11b50 test: isolate base OCI spec test in BGP CLOS runs
  • siderolabs/talos@​ff56b6d66 chore: update tools and pkgs
  • siderolabs/talos@​8c8b9b45f fix: filter the output in talosctl
  • siderolabs/talos@​9777a1bb4 feat: talos containers run with imagegccontroller
  • siderolabs/talos@​dd566c9c7 fix: container mount rshared propagation
  • siderolabs/talos@​2f8931768 refactor: don't skip container tests in short mode
  • siderolabs/talos@​2f0fdd11e fix: ctr machinedaccss allowed roles
  • siderolabs/talos@​64aef9053 feat: containers can connect to machined
  • siderolabs/talos@​ce2148aa0 feat: impl. container mount controller
  • siderolabs/talos@​9105c5e1e feat: talos containers support for talosctl
  • siderolabs/talos@​36fd44677 feat: impl. container runtime controller
  • siderolabs/talos@​afc09d418 refactor: make runner.runner context-native
  • siderolabs/talos@​eff936cf0 feat: impl ContainerInstanceController
  • siderolabs/talos@​95abc8bff fix: filter out passed metadata in API proxying
  • siderolabs/talos@​10c4f1a8b fix: treat desired roles empty as error in Talos API access
  • siderolabs/talos@​807b692a1 fix: allow CSI volumes to be mounted with an SELinux context
  • siderolabs/talos@​6249f3f4e test: skip filemap heap test under race detector
  • siderolabs/talos@​87a031b7f test: libvirtd extensions
  • siderolabs/talos@​e8b376365 fix: validate received kubeconfig
  • siderolabs/talos@​abce4c937 fix: use os.Root in the talosctl extract path
  • siderolabs/talos@​1deae73dd fix: escape output in the talosctl dashboard
  • siderolabs/talos@​5b153233c chore: speed up unit-tests
  • siderolabs/talos@​3715ce908 fix: add checks for meta key in the API path
  • siderolabs/talos@​138958053 feat: update COSI to 1.16.3
  • siderolabs/talos@​bdc7f3053 fix: preserve shared libs symlinks
  • siderolabs/talos@​7366edc90 chore: reduce verbosity of the grype scan
  • siderolabs/talos@​c027a947f fix: exclude scheduler config from apiserver config version
  • siderolabs/talos@​544fc52cb feat: add host extension pre-shutdown hooks
  • siderolabs/talos@​1d911581d fix: route creation churning every 100ms
  • siderolabs/talos@​baca68d0d fix: drop dead legacy registries init from worker generation
  • siderolabs/talos@​dec9dc3dc chore: bump sigstore/rekor to v1.5.4
  • siderolabs/talos@​dc9e7fea9 chore: add SPD5118 driver to squashfs
  • siderolabs/talos@​ae4d8228e fix: keep the time sync boot timeout across a syncer restart
  • siderolabs/talos@​755900fcc fix: preserve special modes when extracting files
  • siderolabs/talos@​6c927a0ff fix: hostns etc mount
  • siderolabs/talos@​3cdd0e748 feat: bump kubernetes to 1.37.0
  • siderolabs/talos@​03c567929 refactor: log filter stays enabled on enter press
  • siderolabs/talos@​b690b7ad5 fix: write the uploaded etcd snapshot atomically
  • siderolabs/talos@​25a366162 chore: update multipath notes
  • siderolabs/talos@​866db94f1 fix: drop gRPC client keepalive aggressive settings in the tracker
  • siderolabs/talos@​74e88bd57 feat: support host extension services
  • siderolabs/talos@​e828fe80a fix: skip selinux label for read-only/detached/external mounts
  • siderolabs/talos@​1be6787a5 fix: capture packets correctly on VLANs
  • siderolabs/talos@​d16d765f7 docs: update CRI customization example
  • siderolabs/talos@​1b31e1213 fix: use os.Root in the untar path
  • siderolabs/talos@​91a6af032 fix: enable additional SELinux permissions for Cilium
  • siderolabs/talos@​322de8bf2 fix: cache filemap layers on disk

Changes from siderolabs/gen

1 commit

  • siderolabs/gen@​c526410 fix: skip unknown-key check for types with custom YAML unmarshaler

Changes from siderolabs/go-adv

2 commits

  • siderolabs/go-adv@​3818a65 feat: initial implementation
  • siderolabs/go-adv@​95e583c Initial commit

Changes from siderolabs/go-cmd

2 commits

  • siderolabs/go-cmd@​a2a31d3 chore: run rekres
  • siderolabs/go-cmd@​584337b feat: add StartWithOptions for streaming long-running processes

Changes from siderolabs/go-kmsg

1 commit

  • siderolabs/go-kmsg@​65e97cb fix: boot time offset calculation

Changes from siderolabs/go-kubeconfig

2 commits

  • siderolabs/go-kubeconfig@​d0b8f82 chore: rekres and bump deps
  • siderolabs/go-kubeconfig@​c356eeb fix: fix context conflict detection add New() constructor

Changes from siderolabs/go-kubernetes

7 commits

  • siderolabs/go-kubernetes@​0caf1f2 feat: add Kubernetes 1.37 compatibility
  • siderolabs/go-kubernetes@​822b7a2 feat: add nodedrain package for client-side cordon and drain
  • siderolabs/go-kubernetes@​260bc0a fix: update authorization config apiVersion for K8s >= 1.32
  • siderolabs/go-kubernetes@​cc8c2c9 fix: return the apply results in a consistent order
  • siderolabs/go-kubernetes@​131a2bd fix: handle cluster-scoped resources with a ns correctly
  • siderolabs/go-kubernetes@​38c182f fix: normalize the changeset to be keyed without apiVersion
  • siderolabs/go-kubernetes@​ca35008 feat: update k8s api to 0.36.0

Changes from siderolabs/go-smbios

1 commit

  • siderolabs/go-smbios@​063f5dc chore: rekres + new testdata

Changes from siderolabs/go-talos-support

3 commits

  • siderolabs/go-talos-support@​18af7d6 feat: update dependencies and support recipients
  • siderolabs/go-talos-support@​59d47af feat: rewrite support bundle library around client provider
  • siderolabs/go-talos-support@​8dd4326 feat: support encryption of the support bundle using age

Changes from siderolabs/grpc-proxy

3 commits

  • siderolabs/grpc-proxy@​d670c42 chore: bump dependencies
  • siderolabs/grpc-proxy@​8614c71 chore: bump deps
  • siderolabs/grpc-proxy@​80677e0 fix: propagate the headers before the message

Changes from siderolabs/pkgs

150 commits

  • siderolabs/pkgs@​2f03590 chore: update tools
  • siderolabs/pkgs@​2638a41 fix: preserve symlinks for libudev
  • siderolabs/pkgs@​d72f498 feat: update kernel to 6.18.48
  • siderolabs/pkgs@​3a3fc4d feat: bump kernel to 6.18.47
  • siderolabs/pkgs@​8a1612e feat: expose more software as pkgs
  • siderolabs/pkgs@​13c7afc chore: update OpenZFS to 2.4.4
  • siderolabs/pkgs@​7cf25e7 feat: bump kernel to 6.18.46
  • siderolabs/pkgs@​84c1b87 feat: backport aes256k support (Ceph)
  • siderolabs/pkgs@​9e069b7 feat: enable SPD5118 sensor driver
  • siderolabs/pkgs@​fe419a4 feat: enable IPSec offload and dma-buf heaps
  • siderolabs/pkgs@​02ae809 feat: update Linux to 6.18.45
  • siderolabs/pkgs@​2b995f1 feat(kernel): enable CONFIG_MLX5_VFIO_PCI
  • siderolabs/pkgs@​fc35614 feat: update containerd to 2.3.4
  • siderolabs/pkgs@​e708524 feat: update toolchain/tools
  • siderolabs/pkgs@​effed43 chore: bump tools and toolchain
  • siderolabs/pkgs@​fd81ac7 chore: bump qemu to 11.1.0
  • siderolabs/pkgs@​7cf62fb chore: bump pxe_fuse_ref to 3b3f794
  • siderolabs/pkgs@​797450a chore: bump ipxe_ref to e6d0a97c
  • siderolabs/pkgs@​de9b576 chore: rekres
  • siderolabs/pkgs@​74b0cb6 chore: bump deps 2026-08-12
  • siderolabs/pkgs@​bcdabd9 feat: update Linux firmware to 20260810
  • siderolabs/pkgs@​7d8b87b chore: dependency updates 2026-08-10
  • siderolabs/pkgs@​0cc868b feat(kernel): enable CONFIG_FS_ENCRYPTION
  • siderolabs/pkgs@​e5b0a80 feat: bump kernel to 6.18.44
  • siderolabs/pkgs@​6f77a30 feat: enable CONFIG_FSCACHE and CONFIG_NFS_FSCACHE
  • siderolabs/pkgs@​b0a7e99 feat: bump kernel to 6.18.43
  • siderolabs/pkgs@​f489e70 feat: update backportable dependencies
  • siderolabs/pkgs@​4c14c73 feat: support confiuring gnu mirror urls
  • siderolabs/pkgs@​445e180 fix: iptables with Cilium
  • siderolabs/pkgs@​b256af1 chore: update kernel
  • siderolabs/pkgs@​1181429 fix: backport macb IEEE 802.3az EEE support for Raspberry Pi 5 RP1
  • siderolabs/pkgs@​aa8d7d6 feat: bump kernel to 6.18.41
  • siderolabs/pkgs@​b253464 feat: enable PCF8523 RTC support for arm64
  • siderolabs/pkgs@​0383b09 feat: bump kernel to 6.18.40
  • siderolabs/pkgs@​37184f0 feat: enable CONFIG_NFT_SOCKET in the kernel
  • siderolabs/pkgs@​f78e3dc feat: update cryptsetup to 2.8.7
  • siderolabs/pkgs@​8c5831c feat: update dependencies
  • siderolabs/pkgs@​0de2a61 feat: update Linux to 6.18.39
  • siderolabs/pkgs@​c652074 feat: enable UFSHC and some other options
  • siderolabs/pkgs@​c4b550c feat: bump dependencies
  • siderolabs/pkgs@​de07964 feat: enable CONFIG_IOMMUFD and CONFIG_VFIO_DEVICE_CDEV
  • siderolabs/pkgs@​6a9c40c chore: bump tools 2026-07-14
  • siderolabs/pkgs@​61e3ed9 chore: bump bldr to v0.6.1
  • siderolabs/pkgs@​981029e chore: bump nvidia to 580.167.08
  • siderolabs/pkgs@​ff9a355 chore: bump deps (minor)
  • siderolabs/pkgs@​0b2474e chore: bump deps (patch)
  • siderolabs/pkgs@​94a16ef chore: bump toolchain
  • siderolabs/pkgs@​6dcf355 feat: enable devmapper plugin in containerd build
  • siderolabs/pkgs@​03534a5 fix: enable CONFIG_IFB as a module
  • siderolabs/pkgs@​a264237 feat: update DRBD to 9.3.3
  • siderolabs/pkgs@​3f09c0c chore: update toolchain and tools
  • siderolabs/pkgs@​6c08c46 feat: bump kernel to 6.18.38
  • siderolabs/pkgs@​7c4fe92 feat: build runs with libpathrs (only amd64)
  • siderolabs/pkgs@​8922b6d fix: correct finalize destination path
  • siderolabs/pkgs@​ae0d701 fix: use non-conflicting name for mdadm
  • siderolabs/pkgs@​5186a65 feat: add mdadm package for software RAID
  • siderolabs/pkgs@​e09f9fb feat: bump kernel 6.18.37
  • siderolabs/pkgs@​8d23631 feat: update Linux firmware to 20260622
  • siderolabs/pkgs@​0343557 feat: update runc to 1.5.0
  • siderolabs/pkgs@​55d3676 feat: bump dependencies
  • siderolabs/pkgs@​ea48e8b fix: patch Linux kernel for tunnel metadata buffer overflow
  • siderolabs/pkgs@​ff80d88 feat: add support for AMD XGBE driver
  • siderolabs/pkgs@​9f8ab22 feat: enable NF_TABLES_ARP option
  • siderolabs/pkgs@​bedfbeb feat: update Linux to 6.18.36
  • siderolabs/pkgs@​a9f2bb3 chore: bump containerd to 2.3.2
  • siderolabs/pkgs@​73e76f8 chore: upgrade runc to 1.5.0-rc.3
  • siderolabs/pkgs@​28db1ca chore: update nvidia driver lts to 580.167.08
  • siderolabs/pkgs@​5df1a44 chore: update zfs to 2.4.3
  • siderolabs/pkgs@​cd77c4f chore: update dependencies 2026-06-16
  • siderolabs/pkgs@​0f27ecc feat: bump runc
  • siderolabs/pkgs@​d213ff5 feat: bump OpenSSL to 3.6.3
  • siderolabs/pkgs@​cb713ae feat: bump kernel to 6.18.35
  • siderolabs/pkgs@​09cb04e fix: avoid page_table_check BUG on time namespace VVAR page
  • siderolabs/pkgs@​bfb88f6 feat: add nvidia-fs kernel module
  • siderolabs/pkgs@​f2850d1 feat: enable USB hiddev for apcupsd support
  • siderolabs/pkgs@​55aa64f feat: bump go to 1.26.4
  • siderolabs/pkgs@​f27dbe1 feat: bump kernel to 6.18.34
  • siderolabs/pkgs@​aa9fe00 feat: add DVB USB Modules
  • siderolabs/pkgs@​0870a4b feat: bump dependencies
  • siderolabs/pkgs@​f9134e5 fix: enable CONFIG_BCM2712_MIP as built-in in arm64 kernel config
  • siderolabs/pkgs@​285c6ae fix: set usermode static helper to machine
  • siderolabs/pkgs@​bd2a754 feat: pre-generate drbd patches using spatch out of tree
  • siderolabs/pkgs@​898844e feat: update Linux to 6.18.33
  • siderolabs/pkgs@​a8dfbf7 fix: disable kernel modprobe path
  • siderolabs/pkgs@​c542950 fix: pull in tools with zstd sbom
  • siderolabs/pkgs@​c0ec8f3 feat: enable PPP and INFINIBAND_BNXT_RE
  • siderolabs/pkgs@​c62c4e1 feat: update containerd to 2.3.1
  • siderolabs/pkgs@​270f9f8 chore: update deps
  • siderolabs/pkgs@​4f7feb4 feat: enable more options for CRI-U checkpoint/restore
  • siderolabs/pkgs@​87994f7 feat: move autoloadable stuff as modules
  • siderolabs/pkgs@​80c27f3 fix: drop legacy network protocols
  • siderolabs/pkgs@​fbb7360 feat: drop legacy iptables/ebtables support
  • siderolabs/pkgs@​eac5f86 feat: bump kernel 6.18.32
  • siderolabs/pkgs@​d616f6c feat: update Linux to 6.18.31
  • siderolabs/pkgs@​02bcfce fix: macb silent TX stall on BCM2712/RP1 (v2 patches from netdev)
  • siderolabs/pkgs@​12ca698 feat: update ZFS & NVIDIA LTS
  • siderolabs/pkgs@​9fff943 feat: update Linux to 6.18.30
  • siderolabs/pkgs@​c5a1685 feat: move HWMON as modules
  • siderolabs/pkgs@​b2a45fb feat: move CONFIG_INTEL_IOATDMA as a module
  • siderolabs/pkgs@​ea8d35f feat: move ACPI device drivers as modules
  • siderolabs/pkgs@​501ba58 feat: move HID quirks as modules
  • siderolabs/pkgs@​b35312c feat: move PS/2 mouse drivers as modules
  • siderolabs/pkgs@​3a5d9d7 feat: move IPMI driver to be a module
  • siderolabs/pkgs@​792a69a feat: disable AGP drivers
  • siderolabs/pkgs@​99990b4 feat: move Hyper-V drivers as modules
  • siderolabs/pkgs@​fb697d6 feat: move Xen frontend drivers as modules
  • siderolabs/pkgs@​1df1713 feat: move ATA / MMC controllers as modules
  • siderolabs/pkgs@​f7f9341 feat: move USB class drivers as modules
  • siderolabs/pkgs@​ba873e9 feat: move USB host controllers as modules
  • siderolabs/pkgs@​8f25baa feat: move virtio bus stuff as modules
  • siderolabs/pkgs@​d0c5480 feat: bump kernel to 6.18.29
  • siderolabs/pkgs@​dfb09f0 feat: bump kernel 6.18.28
  • siderolabs/pkgs@​c97bc24 feat: update Go to 1.26.3
  • siderolabs/pkgs@​dfe8926 feat: add btrfsprogs
  • siderolabs/pkgs@​06ff9dc feat: update Linux to 6.18.27
  • siderolabs/pkgs@​2265fc9 feat(kernel): backport two PCI bridge realloc fixes from v6.19
  • siderolabs/pkgs@​5a21d99 feat: bump dependencies
  • siderolabs/pkgs@​cb3f406 feat: update containerd to 2.3.0
  • siderolabs/pkgs@​e192574 feat: update Linux to 6.18.26
  • siderolabs/pkgs@​e5e6cb8 feat: update DRBD to 9.3.2
  • siderolabs/pkgs@​77538b1 feat: update NVIDIA drivers
  • siderolabs/pkgs@​adeaafc feat: preserve System.map on kernel builds
  • siderolabs/pkgs@​c77f985 fix: disable legacy framebuffer drivers
  • siderolabs/pkgs@​8f3ef77 fix: enable safesetid LSM
  • siderolabs/pkgs@​f82d3af fix: disable CONFIG_DEVPORT
  • siderolabs/pkgs@​b189a96 fix: disable crypto user API
  • siderolabs/pkgs@​9a718f6 docs: list net macb silent TX stall fixes in kernel/build/patches/README.md
  • siderolabs/pkgs@​ca3599f fix: macb silent TX stall on BCM2712/RP1 (RFC patches from netdev)
  • siderolabs/pkgs@​6a53a93 feat: bump kernel to 6.18.25
  • siderolabs/pkgs@​f567bce feat: disable more stuff in Kconfig
  • siderolabs/pkgs@​ffd9790 feat: bump kernel to 6.18.24
  • siderolabs/pkgs@​b7c709a feat: bump deps
  • siderolabs/pkgs@​e5e5b3c feat: update Linux to 6.18.23
  • siderolabs/pkgs@​1a4cd20 fix: renovate config
  • siderolabs/pkgs@​d0ed6ed feat: update dependencies
  • siderolabs/pkgs@​6ea49c7 fix: support disabling module signature verification
  • siderolabs/pkgs@​6520ec4 feat: update containerd to 2.2.3
  • siderolabs/pkgs@​37ce992 feat: enable CONFIG_UHID and CONFIG_INPUT_JOYDEV as modules
  • siderolabs/pkgs@​cddd934 feat: update backportable dependencies
  • siderolabs/pkgs@​32e4077 feat: update OpenSSL
  • siderolabs/pkgs@​2d241e7 feat: update Go to 1.26.2 and small deps updates
  • siderolabs/pkgs@​7f540ce feat: disable dynamic SCS
  • siderolabs/pkgs@​3bef043 feat: update runc to 1.4.2
  • siderolabs/pkgs@​c6e6f10 feat: update Linux to 6.18.21
  • siderolabs/pkgs@​a9e8afa fix: libarchive install prefix
  • siderolabs/pkgs@​e4d0113 feat: update for musl 1.2.6
  • siderolabs/pkgs@​9142603 feat: update NVIDIA production to 595.58.03
  • siderolabs/pkgs@​22fa669 feat: update Linux to 6.18.19
  • siderolabs/pkgs@​03680ae feat: update containerd patch verifier role
  • siderolabs/pkgs@​bdc239e feat: enable CHECKPOINT_RESTORE option

Changes from siderolabs/proto-codec

1 commit

  • siderolabs/proto-codec@​9b8a14e chore: bump dependencies

Changes from siderolabs/siderolink

1 commit

  • siderolabs/siderolink@​0a1933c chore: bump dependencies

Changes from siderolabs/tools

39 commits

  • siderolabs/tools@​87316ca fix: update OpenSSL to 3.6.4
  • siderolabs/tools@​2c8cf5a feat: move more packages into separate images
  • siderolabs/tools@​c1145d3 feat: update Go to 1.26.7
  • siderolabs/tools@​83caedf chore: update bldr (v0.6.2), rekres
  • siderolabs/tools@​c2fcfb2 chore: bump toolchain to bring in Go 1.26.6
  • siderolabs/tools@​dcf177c chore: update deps 2026-08-12
  • siderolabs/tools@​7c77e8c chore: update toolchain to v1.14.0
  • siderolabs/tools@​cf1a7ae chore: update perl to 5.44.0
  • siderolabs/tools@​89e4a00 chore: dependency updates 2026-08-10
  • siderolabs/tools@​80fd6eb feat: add python pyyaml tools
  • siderolabs/tools@​c59cce5 feat: enable static libs for pcre2
  • siderolabs/tools@​da6e92a feat: use kernel gnu mirrors
  • siderolabs/tools@​08071b1 feat: update dependencies
  • siderolabs/tools@​2723c06 chore: bump pkgfile bldr to v0.6.1
  • siderolabs/tools@​d333b32 chore: bump toolchain to latest
  • siderolabs/tools@​c7494c6 chore: deps 2026-07-13 (major bumps only)
  • siderolabs/tools@​57a0183 chore: deps 2026-07-13 (minor bumps only)
  • siderolabs/tools@​21db13e chore: deps 2026-07-13 (patch only)
  • siderolabs/tools@​7079a8a chore: bump toolchain
  • siderolabs/tools@​5326524 feat: build LLVM as cross-compiling
  • siderolabs/tools@​878f1db feat: bump dependencies
  • siderolabs/tools@​0f1c859 chore: make rekres
  • siderolabs/tools@​5c0c9be chore: update dependencies 2026-06-16
  • siderolabs/tools@​b88d99c feat: bump OpenSSL to 3.6.3
  • siderolabs/tools@​42c59b9 feat: bump toolchain to bring in Go 1.26.4
  • siderolabs/tools@​206a4c0 feat: update dependencies, rework LLVM build
  • siderolabs/tools@​f9f37df fix: add proper name for zlib-ng sbom
  • siderolabs/tools@​aa45c41 fix: add SBOM for zstd library
  • siderolabs/tools@​808f34f feat: update Go to 1.26.3
  • siderolabs/tools@​5dfe83d feat: drop fakeroot and policycoreutils
  • siderolabs/tools@​618fd20 feat: add Python wheel package
  • siderolabs/tools@​df3c1b7 feat: bump dependencies
  • siderolabs/tools@​44ad18c feat: bump deps
  • siderolabs/tools@​f3d0dd9 fix: renovate configs
  • siderolabs/tools@​4ac4449 feat: update dependencies
  • siderolabs/tools@​027744f feat: bump OpenSSL to 3.6.2
  • siderolabs/tools@​7067f1f feat: update util-linux to 2.41.4
  • siderolabs/tools@​6cb3e56 feat: update Go to 1.26.2
  • siderolabs/tools@​9186c5f feat: update musl to 1.2.6

Dependency Changes

  • codeberg.org/miekg/dns v0.6.90 new
  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 -> v1.22.0
  • github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 -> v1.14.0
  • github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates v1.4.0 -> v1.5.0
  • github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.4.0 -> v1.5.0
  • github.com/aws/aws-sdk-go-v2 v1.43.4 new
  • github.com/aws/aws-sdk-go-v2/config v1.32.12 -> v1.32.35
  • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 -> v1.18.35
  • github.com/aws/aws-sdk-go-v2/service/acm v1.37.22 -> v1.43.4
  • github.com/aws/aws-sdk-go-v2/service/kms v1.50.3 -> v1.55.4
  • github.com/aws/smithy-go v1.24.2 -> v1.27.7
  • github.com/beevik/nts v0.3.1 new
  • github.com/containerd/containerd/api v1.10.0 -> v1.11.1
  • github.com/containerd/containerd/v2 v2.2.2 -> v2.3.4
  • github.com/containerd/platforms v1.0.0-rc.2 -> v1.0.0-rc.4
  • github.com/containerd/typeurl/v2 v2.2.3 -> v2.3.0
  • github.com/cosi-project/runtime v1.14.1 -> v1.16.3
  • github.com/docker/cli v29.4.0 -> v29.7.2
  • github.com/fatih/color v1.18.0 -> v1.19.0
  • github.com/florianl/go-tc v0.4.7 -> v0.4.8
  • github.com/fsnotify/fsnotify v1.9.0 -> v1.10.1
  • github.com/gdamore/tcell/v2 v2.13.8 -> v2.13.10
  • github.com/google/cadvisor/lib v0.60.5 new
  • github.com/google/cel-go v0.28.0 -> v0.31.0
  • github.com/google/go-containerregistry v0.21.5 -> v0.21.9
  • github.com/gopacket/gopacket v1.5.0 -> v1.7.1
  • github.com/hetznercloud/hcloud-go/v2 v2.36.0 -> v2.47.0
  • github.com/insomniacslk/dhcp 5adc3eb26f91 -> c308df0fdcef
  • github.com/jsimonetti/rtnetlink/v2 310581b9c6ac -> 43bafec815b3
  • github.com/klauspost/compress v1.18.5 -> v1.19.2
  • github.com/klauspost/cpuid/v2 v2.3.0 -> v2.4.0
  • github.com/linode/go-metadata v0.2.4 -> v0.3.0
  • github.com/mattn/go-isatty v0.0.20 -> v0.0.24
  • github.com/mdlayher/arp 6706a2966875 -> 93566ba168e9
  • github.com/mdlayher/ethtool v0.5.1 -> v0.6.1
  • github.com/mdlayher/genetlink v1.3.2 -> v1.4.0
  • github.com/mdlayher/ndp v1.1.0 new
  • github.com/mdlayher/netlink v1.9.0 -> v1.11.2
  • github.com/moby/moby/api v1.54.1 -> v1.55.0
  • github.com/moby/moby/client v0.4.0 -> v0.5.1
  • github.com/navidys/tvxwidgets v0.13.0 -> v0.14.0
  • github.com/osrg/gobgp/v4 v4.8.0 new
  • github.com/pelletier/go-toml/v2 v2.2.4 -> v2.4.3
  • github.com/planetscale/vtprotobuf 8ae5a48058df new
  • github.com/prometheus/procfs v0.20.1 -> v0.21.1
  • github.com/scaleway/scaleway-sdk-go v1.0.0-beta.36 -> v1.0.0-beta.37
  • github.com/siderolabs/gen v0.8.6 -> v0.8.7
  • github.com/siderolabs/go-adv v1.0.0 new
  • github.com/siderolabs/go-blockdevice/v2 v2.0.28 -> v2.0.32
  • github.com/siderolabs/go-cmd v0.2.0 -> v0.2.1
  • github.com/siderolabs/go-kmsg v0.1.5 -> v0.1.6
  • github.com/siderolabs/go-kubeconfig v0.1.1 -> v0.1.2
  • github.com/siderolabs/go-kubernetes v0.2.36 -> v0.2.41
  • github.com/siderolabs/go-smbios v0.3.3 -> v0.3.4
  • github.com/siderolabs/go-talos-support v0.2.1 -> v0.3.1
  • github.com/siderolabs/grpc-proxy v0.5.1 -> v0.5.2
  • github.com/siderolabs/pkgs v1.13.0 -> v1.14.0-15-g2f03590
  • github.com/siderolabs/proto-codec v0.1.3 -> v0.1.4
  • github.com/siderolabs/siderolink v0.3.15 -> v0.3.16
  • github.com/siderolabs/talos/pkg/machinery v1.13.0 -> v1.14.0
  • github.com/siderolabs/tools v1.13.0 -> v1.14.0-5-g87316ca
  • github.com/sigstore/cosign/v3 v3.0.5 -> v3.1.3
  • github.com/sigstore/sigstore v1.10.5 -> v1.10.9
  • github.com/sigstore/sigstore-go v1.1.4 -> v1.3.0
  • github.com/stretchr/testify v1.11.1 -> v1.12.1
  • github.com/theupdateframework/go-tuf/v2 v2.4.1 -> v2.4.2
  • github.com/ulikunitz/xz v0.5.15 -> v0.5.16
  • go.etcd.io/etcd/api/v3 v3.6.9 -> v3.7.1
  • go.etcd.io/etcd/client/pkg/v3 v3.6.9 -> v3.7.1
  • go.etcd.io/etcd/client/v3 v3.6.9 -> v3.7.1
  • go.etcd.io/etcd/etcdutl/v3 v3.6.9 -> v3.7.1
  • go.uber.org/zap v1.27.1 -> v1.28.0
  • go.uber.org/zap/exp v0.3.0 new
  • go.yaml.in/yaml/v4 v4.0.0-rc.4 -> v4.0.0-rc.6
  • golang.org/x/net v0.53.0 -> v0.58.0
  • golang.org/x/sync v0.20.0 -> v0.22.0
  • golang.org/x/sys v0.43.0 -> v0.47.0
  • golang.org/x/term v0.42.0 -> v0.45.0
  • golang.org/x/text v0.36.0 -> v0.41.0
  • google.golang.org/grpc v1.79.3 -> v1.83.2
  • google.golang.org/protobuf f2248ac996af -> v1.36.12
  • k8s.io/api v0.35.3 -> v0.37.0
  • k8s.io/apiextensions-apiserver v0.35.3 -> v0.37.0
  • k8s.io/apimachinery v0.35.3 -> v0.37.0
  • k8s.io/apiserver v0.35.3 -> v0.37.0
  • k8s.io/client-go v0.35.3 -> v0.37.0
  • k8s.io/component-base v0.35.3 -> v0.37.0
  • k8s.io/cri-api v0.35.3 -> v0.37.0
  • k8s.io/kube-proxy v0.37.0 new
  • k8s.io/kube-scheduler v0.35.3 -> v0.37.0
  • k8s.io/kubectl v0.35.3 -> v0.37.0
  • k8s.io/kubelet v0.35.3 -> v0.37.0
  • k8s.io/pod-security-admission v0.35.3 -> v0.37.0
  • kernel.org/pub/linux/libs/security/libcap/cap v1.2.77 -> v1.2.78
  • sigs.k8s.io/yaml v1.6.0 new

Previous release can be found at v1.13.0

Images

ghcr.io/siderolabs/flannel:0.28.9
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:3.7.1
registry.k8s.io/pause:3.10.2
registry.k8s.io/kube-apiserver:v1.37.0
registry.k8s.io/kube-controller-manager:v1.37.0
registry.k8s.io/kube-scheduler:v1.37.0
registry.k8s.io/kube-proxy:v1.37.0
ghcr.io/siderolabs/kubelet:v1.37.0
registry.k8s.io/networking/kube-network-policies:v1.1.1
ghcr.io/siderolabs/installer-base:v1.14.0
ghcr.io/siderolabs/imager:v1.14.0
ghcr.io/siderolabs/talos:v1.14.0
ghcr.io/siderolabs/talosctl-all:v1.14.0
ghcr.io/siderolabs/overlays:v1.14.0
ghcr.io/siderolabs/extensions:v1.14.0

@scottames-github-bot

Copy link
Copy Markdown
Contributor
siderolabs/talos (aqua:siderolabs/talos) - part 3 of 3

v1.13.10: v1.13.10

Compare Source

Talos 1.13.10 (2026-09-03)

Welcome to the v1.13.10 release of Talos!

Please try out the release binaries and report any issues at
https://github.com/siderolabs/talos/issues.

Component Updates

Linux: 6.18.48
CoreDNS: 1.14.7

Talos is built with Go 1.26.7

Contributors

  • Andrey Smirnov
  • Mateusz Urbanek
  • Noel Georgi
  • Dima Aratin
  • Ivan Demchuk
  • Maja Bojarska
  • Max Makarov
  • Utku Ozdemir
  • immanuwell

Changes

28 commits

  • siderolabs/talos@​00ca4c987 release(v1.13.10): prepare release
  • siderolabs/talos@​271ce0dc8 fix: update DHCP library
  • siderolabs/talos@​3c70f4054 fix: harden the code around kubelet's client certificate handling
  • siderolabs/talos@​40d7de4c0 fix: normalize image reference when passing to image verification flow
  • siderolabs/talos@​cf30d6df4 fix: filter out passed metadata in API proxying
  • siderolabs/talos@​cc556d9ce fix: treat desired roles empty as error in Talos API access
  • siderolabs/talos@​0d7a47305 fix: allow CSI volumes to be mounted with an SELinux context
  • siderolabs/talos@​17ab196fe fix: validate received kubeconfig
  • siderolabs/talos@​934ae8a2b chore: update etcd to v3.6.14
  • siderolabs/talos@​df9b82dce chore: update pkgs and tools
  • siderolabs/talos@​591c53aac fix: use os.Root in the talosctl extract path
  • siderolabs/talos@​c36d99001 fix: escape output in the talosctl dashboard
  • siderolabs/talos@​fc355dcd3 fix: add checks for meta key in the API path
  • siderolabs/talos@​e950f655e feat: update COSI to 1.16.3
  • siderolabs/talos@​20cafbdb3 fix: route creation churning every 100ms
  • siderolabs/talos@​c6fe78c61 chore: reduce verbosity of the grype scan
  • siderolabs/talos@​b9696f9d7 fix: preserve special modes when extracting files
  • siderolabs/talos@​865aaec80 fix: use os.Root in the untar path
  • siderolabs/talos@​097fa184e fix: create parent directories when extracting tar archives
  • siderolabs/talos@​c6edc3911 chore: bump sigstore/rekor to v1.5.4
  • siderolabs/talos@​6d062e13b fix: write the uploaded etcd snapshot atomically
  • siderolabs/talos@​f6b795970 fix: skip selinux label for read-only/detached/external mounts
  • siderolabs/talos@​bea850ac3 fix: persist in-memory meta on fresh install
  • siderolabs/talos@​dcf46c11e fix: reduce stalls in the etcd member promotion cycle
  • siderolabs/talos@​0f4d08a1f feat: update CoreDNS to 1.14.7
  • siderolabs/talos@​e0916388e fix: watch IPv6 route changes in RouteSpecController
  • siderolabs/talos@​92614ca8a fix: truncate files replaced by system extensions
  • siderolabs/talos@​b7b27ec29 fix: skip target settings for external volume mounts

Changes from siderolabs/pkgs

5 commits

  • siderolabs/pkgs@​9b044c5 feat: update kernel to 6.18.48
  • siderolabs/pkgs@​de74a50 feat: bump kernel to 6.18.47
  • siderolabs/pkgs@​bb15c62 chore: update toolchain and tools
  • siderolabs/pkgs@​49c50f7 feat: bump kernel to 6.18.46
  • siderolabs/pkgs@​2da2cdc feat: backport aes256k support (Ceph)

Changes from siderolabs/tools

3 commits

  • siderolabs/tools@​c70be08 chore: update toolchain
  • siderolabs/tools@​7791f48 feat: use kernel gnu mirrors
  • siderolabs/tools@​d908dc0 fix: update OpenSSL to 3.6.4

Dependency Changes

  • github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.1 -> v1.22.0
  • github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.13.1 -> v1.14.0
  • github.com/aws/aws-sdk-go-v2 v1.41.7 -> v1.43.0
  • github.com/aws/aws-sdk-go-v2/config v1.32.17 -> v1.32.31
  • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.23 -> v1.18.31
  • github.com/aws/aws-sdk-go-v2/service/kms v1.52.0 -> v1.55.0
  • github.com/aws/smithy-go v1.25.1 -> v1.27.3
  • github.com/cosi-project/runtime v1.14.1 -> v1.16.3
  • github.com/docker/cli v29.4.3 -> v29.5.3
  • github.com/fatih/color v1.18.0 -> v1.19.0
  • github.com/google/go-containerregistry v0.21.6 -> v0.21.7
  • github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.3 -> v2.3.4
  • github.com/insomniacslk/dhcp 5adc3eb26f91 -> 234b97448fae
  • github.com/klauspost/compress v1.18.7 -> v1.19.2
  • github.com/mattn/go-isatty v0.0.20 -> v0.0.24
  • github.com/prometheus/procfs v0.20.1 -> v0.22.0
  • github.com/siderolabs/pkgs v1.13.0-60-gf541ca4 -> v1.13.0-65-g9b044c5
  • github.com/siderolabs/talos/pkg/machinery v1.13.9 -> v1.13.10
  • github.com/siderolabs/tools v1.13.0-9-ga201d19 -> v1.13.0-12-gc70be08
  • github.com/sigstore/sigstore v1.10.8 -> v1.10.9
  • github.com/sirupsen/logrus v1.9.4 -> v1.10.2
  • github.com/stretchr/testify v1.11.1 -> v1.12.1
  • go.etcd.io/etcd/api/v3 v3.6.12 -> v3.6.14
  • go.etcd.io/etcd/client/pkg/v3 v3.6.12 -> v3.6.14
  • go.etcd.io/etcd/client/v3 v3.6.12 -> v3.6.14
  • go.etcd.io/etcd/etcdutl/v3 v3.6.12 -> v3.6.14
  • go.yaml.in/yaml/v4 v4.0.0-rc.4 -> v4.0.0-rc.6
  • google.golang.org/grpc v1.82.1 -> v1.83.2
  • google.golang.org/protobuf f2248ac996af -> v1.36.12

Previous release can be found at v1.13.9

Images

ghcr.io/siderolabs/flannel:0.28.8
registry.k8s.io/coredns/coredns:v1.14.7
registry.k8s.io/etcd:v3.6.14
registry.k8s.io/pause:3.10.1
registry.k8s.io/kube-apiserver:v1.36.3
registry.k8s.io/kube-controller-manager:v1.36.3
registry.k8s.io/kube-scheduler:v1.36.3
registry.k8s.io/kube-proxy:v1.36.3
ghcr.io/siderolabs/kubelet:v1.36.3
registry.k8s.io/networking/kube-network-policies:v1.1.0
ghcr.io/siderolabs/installer:v1.13.10
ghcr.io/siderolabs/installer-base:v1.13.10
ghcr.io/siderolabs/imager:v1.13.10
ghcr.io/siderolabs/talos:v1.13.10
ghcr.io/siderolabs/talosctl-all:v1.13.10
ghcr.io/siderolabs/overlays:v1.13.10
ghcr.io/siderolabs/extensions:v1.13.10
sst/opencode (aqua:sst/opencode)

v1.18.27: v1.18.27

Compare Source

Core

Bugfixes

  • Default provider header timeouts to five minutes so slow model startups fail less often.
  • Default streamed chunk timeouts to five minutes, with false supported to disable them.
  • Let Anthropic thinking.blockBinding opt out via config when you need to keep the provider default. (@​dkindlund)
  • Limit Anthropic thinking block binding to Claude 5.1+ models so older deployments do not reject requests.
  • Avoid unhandled errors when canceling timed-out SSE reads. (@​AlexanderWillner)

Thank you to 2 community contributors:

  • @​AlexanderWillner:
    • fix(provider): handle SSE reader cancel rejections (#44944)
  • @​dkindlund:
    • fix(opencode): let config opt out of Anthropic thinking blockBinding (#46820)
agavra/tuicr (github:agavra/tuicr)

v0.25.0: v0.25.0

Compare Source

What's Changed

New Contributors

Full Changelog: agavra/tuicr@v0.24.0...v0.25.0

anthropics/claude-code (github:anthropics/claude-code)

v2.1.260: v2.1.260

Compare Source

What's changed

  • Added a diff panel that opens beside the conversation in fullscreen mode and shows your uncommitted changes as Claude edits; toggle it with /diff
  • Added a likely cause for prompt-cache misses (e.g. tool definitions or system prompt changed, idle past the TTL) to /cost and the status line's prompt_cache field
  • Added /reload-plugins to headless sessions, so it appears in the Claude Code Desktop and SDK command lists
  • Added a text form of /advisor (/advisor, /advisor <model>, /advisor off) for the desktop app, Remote Control, and other headless (-p/Agent SDK) sessions
  • Added oidc.scope_on_refresh to the Claude apps gateway for IdPs that return an id_token on refresh only when asked for openid again
  • Added Claude apps gateway support for newer Claude Desktop keys in desktop policy blocks, including userPluginMarketplacesEnabled and userPluginUploadsEnabled
  • Fixed Edit/Write/Read permission rules whose path contains parentheses being dropped as invalid or ignored by the Bash sandbox, which left "read-only" folders writable
  • Fixed one file permission rule with an uncompilable pattern (e.g. an unclosed [) making every file edit fail with Invalid regular expression; such a deny rule now guards the literal path it spells
  • Fixed Bash permission checks auto-approving zsh commands that hide a command substitution in a REPORTTIME, REPORTMEMORY or DIRSTACKSIZE assignment; these now prompt for approval
  • Fixed Bedrock model discovery, token counting and AWS SSO/STS credential calls failing with "unable to get local issuer certificate" when the corporate root CA is only in the OS certificate store
  • Fixed permissions.blockReadsOutsideWorkingDirectories on macOS hiding the user's git config from sandboxed git and hiding a worktree-isolated sub-agent's own checkout
  • Fixed managed settings not loading for claude.ai Enterprise/Team users who also had a leftover API key from an earlier /login
  • Fixed /status listing a signed-in claude.ai account and a configured API key as if both were in effect; the credential not in use is now marked
  • Fixed managed skillOverrides entries keyed on a bundled skill's alias (e.g. checkup for /doctor) not applying, and Skill(name) deny rules not covering a nested skill listed as <dir>:name
  • Fixed model: fable agents ignoring the [1m] tag on an ANTHROPIC_DEFAULT_FABLE_MODEL pin and silently running with a 200K context window
  • Fixed the /model picker not showing Fable 5.1 for organizations that can use it, which was only accepted when typed as /model claude-fable-5-1
  • Fixed prompt caching on Claude Fable 5.1 not covering the context attached after tool results, so it was re-sent as uncached input on every tool-call turn
  • Fixed model switching staying blocked for the rest of the session after a plugin hook load failure; each switch now re-checks and the refusal names the cause
  • Fixed model switching being blocked for the session when an organization-managed plugin's marketplace could not be loaded
  • Fixed SDK-provided MCP servers (e.g. Desktop connectors) sometimes missing from the first turn and only appearing on the next one
  • Fixed Claude in Chrome tools failing with "Not connected" mid-task in cloud-hosted claude.ai sessions when a connector was added or removed
  • Fixed flags, joined emoji and accented letters splitting across wrapped lines, and stale text staying on screen when a flag or joined emoji falls in the terminal's last two columns (now shown as )
  • Fixed Remote Control accepting a model pick that is not a valid model name; it is now refused with an error instead of failing on the next message
  • Fixed /rewind and --rewind-files reporting success when checkpoint backup files were missing and nothing was actually restored
  • Fixed /rewind leaving stale file-read tracking from the rewound-away turns, which caused "File unchanged since last read" stubs and full-file re-injection after external edits
  • Fixed -p --resume/--continue (as used by the desktop app) failing on every retry once a session's worktree directory lost its git metadata; it now fails once, then resumes without the worktree
  • Fixed a subagent that resumed another agent via SendMessage never being woken by that agent's completion (the notification went to the main conversation instead)
  • Fixed agent teams: an in-process teammate's transcript losing messages, or going blank, during long API retry waits (e.g. under CLAUDE_CODE_RETRY_WATCHDOG) as retry notices evicted real messages
  • Fixed a session that moved to the background appearing twice in ListAgents (once as a phantom "interactive" twin with the same name) and receiving SendMessage deliveries in the viewer
  • Fixed intermittent "task output swap refused" errors when many sessions share a project directory
  • Fixed Ctrl+Z in fullscreen leaving the shell on the alternate screen, drawn over the paused interface
  • Fixed Workflow tool subagents being restarted as stalled while a long context compaction was still in progress
  • Fixed plugins from a URL marketplace failing to install with "marketplace entry path does not stay inside the marketplace directory" when a host app (e.g. Claude Desktop) stores it as a directory
  • Fixed an extra browser tab opening when an artifact is published in a session you're driving from claude.ai, the desktop app, or mobile (Remote Control)
  • Fixed the Artifact tool's first call failing with an "Invalid tool parameters" validation error in some Cowork sessions
  • Fixed IDE line selections being dropped when running a skill or slash command (the "N lines selected" context now reaches Claude)
  • Fixed repository detection for GitLab projects in nested subgroups (e.g. gitlab.com/group/subgroup/project)
  • Fixed owner/repo#123 issue references in rendered output linking to github.com when working in a GitLab repository; they now link to the gitlab.com issue
  • Glob/Grep: Fixed the search path being probed on disk before the permission check; a missing path is now reported after permission is decided, as Read does
  • Reverted the 2.1.259 change applying Read() deny rules to Bash arguments; it denied npm run build under a Read(./**/build/**) rule in every mode and made cd … && grep prompt even in auto mode
  • Improved structured output: Workflow agent({schema}) rejects a JSON Schema that can never be satisfied up front, and retry-cap errors now include the last validation failure
  • Improved deleting a background session whose worktree has unpushed commits: the message now names the branch and commit count, and deleting again discards the worktree
  • Improved the Claude apps gateway's refresh-failure log to name the step that failed
  • Improved idle CPU usage of non-interactive (-p / SDK) sessions
  • Improved the Claude apps gateway on Amazon Bedrock: input tokens for an aborted request are now counted with AWS's free CountTokens API (grant bedrock:CountTokens) instead of a one-token request
  • Improved the settings error for rules such as Edit(C:\dir\(name)\**), where \( is read as an escaped parenthesis rather than a path separator, to suggest an unambiguous spelling
  • Improved auto-compact for 1M-context models: Opus and Fable sessions now compact shortly before the 1M-token limit, and recovery compaction on very large contexts no longer times out at 10 minutes
  • Improved /ultrareview and claude ultrareview to wait up to 45 minutes (previously 30) for long-running cloud reviews
  • Improved /effort on Claude Fable 5.1 so changing effort mid-session no longer invalidates the prompt cache
  • Updated the bundled claude-api skill so its Go, Java, and C# samples use current-generation model IDs, and clarified that cheaper worker or sub-agent models should be current-generation too
  • Changed ctrl+l / cmd+k in fullscreen mode to clear the transcript view like a terminal clear; scroll up to see earlier messages
  • Changed permission rules with text after the closing parenthesis (e.g. Bash(ls) x), which never matched anything, to be reported as invalid settings instead of being silently ignored
  • Changed server-managed settings so a managed CLAUDE.md (claudeMd) no longer triggers the security approval dialog; hooks, shell-command, sandbox, and unsafe env settings still require approval
  • Changed Claude in Chrome to follow your organization's Claude in Chrome admin setting; when an admin turns it off, --chrome, /chrome and the browser tools are unavailable
  • Changed Claude apps gateway to send orgPluginSettings in the list form read by Claude Desktop 1.15200.0 and later; older desktops ignore it
  • Changed Claude apps gateway to also refuse to start, naming the field, when a desktop policy misspells a field in a nested object of a managedMcpServers or orgPluginSettings entry
  • Changed commands typed at the ! bash-mode prompt to run outside the sandbox even when strict sandbox mode (sandbox.allowUnsandboxedCommands: false) is on, like typing into your own terminal
  • Changed self-hosted runner --kill-session-after-min to release a session that is only waiting on its user (paused, resumable on the next message) instead of killing it and reporting a failure
  • Removed the one-hour time limit on background commands started by subagents; they now run until they exit or are stopped, matching the main session
  • [VSCode] Added the selected effort level to the footer model pill, fixed a stale effort level after switching models, and returned the footer pills to their earlier compact size
  • [VSCode] Added Open and Closed to the session list's status filter menu
  • [VSCode] Fixed the welcome screen disappearing in a new session when Remote Control turns on automatically
  • [VSCode] Fixed the session history picker loading a session a second time when it is already open in another tab; it now switches to that tab
  • [VSCode] Fixed the session tab's Rename command silently doing nothing while the tab's view was reloading; it now always applies
  • [VSCode] Fixed a half-finished message, an empty tool card or an extra "Thought for" line staying on screen after Claude Code retried a dropped response
  • [VSCode] Fixed "Enable Remote Control for all sessions" not applying to a session tab that was still starting when the toggle was flipped

v2.1.259: v2.1.259

Compare Source

What's changed

  • Added managedMcpServers managed setting: organizations can provide HTTP/SSE MCP servers to every user (same entry shape as .mcp.json); entries that name a command to run are skipped
  • Added --permission-prompts none for unattended headless hosts: anything that would prompt is denied automatically while the active permission mode (including auto mode) keeps deciding
  • Added recognition of glab mr create/merge/close/reopen/note/update so GitLab merge requests show as MR !N in the collapsed tool summary and refresh the footer MR badge
  • Added --json to claude plugin validate for a machine-readable validation report
  • Fixed concurrent sessions silently reverting each other's ~/.claude.json changes — workspace trust no longer resets and MCP/project state is no longer lost when running many sessions at once
  • Fixed a conversation whose thinking was rejected once being rejected again on every later turn
  • Fixed Bash Read() deny rules not covering files given as option values (--ignore-revs-file=.env, -f.env, @&#8203;file), git diff/git grep file operands, or cd DIR && cat FILE compounds; grep -r/cp -r over a directory holding a denied file now asks
  • Fixed the prompt cache being invalidated when the OAuth token refreshed in sessions with telemetry disabled
  • Fixed fullscreen mode showing a blank conversation after a long turn with hundreds of tool calls
  • Fixed auto mode running a turn on a model it doesn't support when a command or skill's frontmatter model: named one; the turn now keeps the session model
  • Fixed CLAUDE_CODE_MAX_CONTEXT_TOKENS being ignored for Vertex-style model IDs (@&#8203;YYYYMMDD suffix) of model versions Claude Code doesn't recognize
  • Fixed the live output preview of a running shell command hiding its newest lines when an earlier line wrapped
  • Fixed a background GitHub connection check that ran on every launch for claude.ai users; the result is now remembered across launches
  • Fixed --resume failing (and --continue opening an empty conversation) when a saved session contains an attachment entry with no payload
  • Fixed frontmatter model: on custom commands and skills being ignored in interactive sessions
  • Fixed Artifact publishing failing once with an "unexpected parameter note" error in conversations continued from an older version
  • Fixed managed forceRemoteSettingsRefresh being ignored at startup when a policy helper configured by MDM or the managed settings file had already run
  • Fixed worktree isolation refusing hook-created worktrees on machines where git rev-parse fails with a message other than "not a git repository"
  • Fixed OpenTelemetry metrics and events from cloud sessions missing the user.email, organization.id, and user.account_uuid attributes
  • Fixed MCP servers that disconnect while their tools are being listed at startup showing as connected with no tools instead of reporting the error
  • Fixed the file edit permission dialog sometimes showing a changed line cut short with no indication
  • Fixed repository detection dropping a known repo identity after a transient git probe failure
  • Fixed managed settings silently going unenforced when the managed-settings file, a drop-in, the MDM plist, or the HKLM value cannot be parsed: Claude Code now refuses to start and names the source
  • Fixed Stop not actually stopping background agents and workflows in remote-control sessions: killed tasks now stay visible and re-stoppable until their processes exit
  • Fixed resuming a workflow run while its previous stopped run was still exiting, which could run duplicate copies of its agents
  • Fixed marketplace repo URLs on github.com with a trailing slash or dangling ?/# producing an unusable .git clone URL
  • Fixed blocking Stop hooks causing the turn after a block to lose the model's reasoning from that turn and, on some models, miss the prompt cache
  • Fixed remote (claude.ai) sessions taking 60 seconds to start a turn after a browser-hosted MCP server's page had gone away
  • Fixed worktree-isolated sessions refusing common Bash loops, xargs pipelines and launcher-wrapped commands that cannot reach the main checkout
  • Improved terminal resize and first-render performance for long responses by reusing text measurements
  • Improved /workflows agent detail: JSON outcomes are pretty-printed with syntax colors and real line breaks, and long outcomes fold behind an expand toggle
  • Improved headless/SDK session start: the first turn begins up to 50 ms sooner when MCP servers finish connecting
  • Improved /install-github-app to explain it is GitHub-only and point to the GitLab CI/CD docs when run inside a GitLab repository
  • Improved nested background subagent results to be saved in the parent subagent's transcript, so resumed subagents keep them and shared transcripts show the delivery
  • Changed allowedMcpServers to govern only servers users add: a literal managed-mcp.json server your allowlist used to filter out now loads on upgrade; use deniedMcpServers to keep it off
  • [VSCode] Added an Active quick filter and a status filter menu (Needs input, Working, Completed) to the session list sidebar
  • Fixed remote and scheduled sessions doing nothing after a connector-tool permission prompt was approved while the session was paused
backnotprop/plannotator (github:backnotprop/plannotator)

v0.27.12: v0.27.12

Compare Source

Follow @​plannotator on X for updates

Missed recent releases?
Release Highlights
v0.27.11 OpenCode server leak fix, durable local feedback archive, unknown-subcommand fix
v0.27.10 Auto-viewed files on scroll, annotation undo/redo, OpenCode 2 slash commands restored, npm 12 agent terminal fix
v0.27.9 WebMCP browser-agent tools, HTML refresh from disk, host seams, lazy renderers, Windows uninstall fix
v0.27.8 Pi keeps its prompt cache across plan transitions, thumbs-up returns to HTML annotation, embed picker seam
v0.27.7 Pi host crash fix on Windows, Call Flow tree cap, jj fork-point base, plannotator knowledge skill + llms.txt
v0.27.6 Live app annotation lands on Pi, one interaction model for HTML pages
v0.27.5 Annotate your running app, Agent TUI placement, collapsed lockfiles, VS Code theme fix
v0.27.4 Portable Guided Review exports, guides.show share links, guide CLI, jj Call Flow
v0.27.3 Folder watcher freeze fix on large repos, first SBOM-attested release pipeline
v0.27.2 Mobile plan and code review, Codex CLI 0.147 fix, configurable markdown extensions
v0.27.1 Open-in-editor launch fix, file headers respect Viewed/Git-add visibility toggles
v0.27.0 Call Flow analysis, --tailscale remote reviews, Pi rebuild, focus-mode shortcut

What's New in v0.27.12

The largest release of the 0.27 line: seven pull requests, two of them from community contributors, one a first-time contribution. The headline is a rebuilt decision header across every review surface, alongside a new hover card for code symbols and a set of community fixes. Every change went through independent adversarial review, and the release was gated by a 26-agent QA sweep before tagging.

One decision control across every surface

The header buttons for finishing a review grew organically over the years and ended up inconsistent: annotate showed different buttons than code review, approve sat next to send feedback where a stray click could pick the wrong one, and some finishing actions only existed as keyboard shortcuts. This release replaces all of it with a single adaptive control.

Every annotate surface and both code review destinations now show one primary action that reflects your session: Done (or Approve where approval is real) when there is nothing to send, Send Feedback with a count once there is. The alternate decisions live behind a caret: send with a note (the menu morphs into a composer in place), request changes with overall feedback, and an explicit discard path behind a single confirmation. Approve and send feedback never render side by side anywhere. Cmd+Enter always fires exactly what the visible primary says.

Approving with notes now actually works. Previously, notes attached to an approval were silently discarded by every runtime. Approvals that carry notes are delivered to your agent with clear framing that they are non-blocking guidance, not a change request. The capability is advertised by the server, so older components fail closed instead of dropping your words. The review sidebar also gains a "+ General comment" button for review-level comments that are not tied to a line, and the local feedback archive now records whether a comment was review-level or line-level.

A few behavior changes worth knowing: bare approvals no longer send the old "LGTM - no changes requested." placeholder text, approving despite open annotations is now an explicit two-step (caret, then confirm) instead of a dimmed one-click button, and pressing Escape on an open header menu closes just the menu instead of also triggering whatever Escape used to do underneath.

The design came directly from community feedback asking for overall review comments, an integrated global comment field, and a fast "that's fine" path for message annotation. #1458

Hover cards for code symbols

Rest your pointer on an identifier in a code review diff and Plannotator shows a card: the symbol's kind, a best-effort signature, its doc comment, where it is defined, and a sample of references, each linking into the References panel. Everything is powered by the same ripgrep search that backs Cmd+click, so there is nothing to install and nothing indexes your repo. If ripgrep is missing or the answer is weak, the card simply does not appear.

Because hover affordances are personal, the first review after updating shows a one-time introduction with a live try-it: hover the demo token inside the dialog and the real card opens against it. Choose your trigger right there: on hover (the default, matching the VS Code hover delay of 300ms), only while holding Cmd (Ctrl on Windows and Linux), or off. A delay setting offers faster and more relaxed dwell times. Everything lives in Settings under the Editor tab, and anyone who had turned the earlier experimental toggle off stays off without seeing the dialog.

The References panel also moved: Cmd+click and card links now open it beside the diff instead of splitting below it, so it stops stealing vertical room from the code you are reading. #1461, #1462, #1465

Compare your local branch with its remote

A new "Local vs remote branch" diff type answers the question "what would I push right now?": local commits the remote does not have, staged and unstaged edits, and untracked files, all compared against the branch's configured remote-tracking ref from your last fetch. It resolves the upstream properly rather than assuming an origin branch of the same name, only appears when the branch actually has an upstream, and shows a clear empty state when local and remote match. It never touches the network; fetching mid-review raises the existing refresh banner.

Contributed by @​leoreisdias, whose implementation carried both server runtimes, the settings integration, and a genuinely thorough test suite including a real bare-remote integration test. #1451

OpenCode: the session URL notice can no longer burn a model turn

On recent OpenCode 2 betas, the "Plannotator session ready" notice posted into the transcript could wake a model turn on its own, burning tokens while the reviewer was still annotating, with the real feedback then queued behind that spurious turn. The notice is now sent with explicit queue delivery, the same mechanism feedback already uses, so it renders in the transcript and waits for a genuinely user-initiated turn no matter how the host behaves.

Reported by @​Naasha with an unusually well-researched diagnosis that correctly identified the upstream mechanics, closing #1459. #1460

Additional Changes

  • Skill fix for file approval: the installed agent skills now instruct agents to use --gate --json when a user asks to approve a saved plan or document, so an agent can no longer promise an Approve button that plain annotate does not render. Contributed by @​zhangjinzan1 in their first contribution, complete with a freshness test that keeps the guidance from drifting. #1453
  • Insecure-context fix: note and comment ids are minted through a fallback-safe generator, so remote-mode sessions served over plain http can no longer lose a typed note to a missing crypto.randomUUID.
  • Escape discipline: header menus and popovers consume the Escape that dismisses them, and vim navigation defers to open popovers, so one keypress does one thing.

Install / Update

macOS / Linux:

curl -fsSL https://plannotator.ai/install.sh | bash

Windows:

irm https://plannotator.ai/install.ps1 | iex

Claude Code Plugin: Run /plugin in Claude Code, find plannotator, and click "Update now".

Pi: Update @&#8203;plannotator/pi-extension to 0.27.12 and restart Pi.

OpenCode: Clear cache and restart:

rm -rf ~/.bun/install/cache/@&#8203;plannotator

What's Changed

  • feat: unified decision control across annotate and code review in #1458
  • feat(review): token hover cards, Tier 0 in #1461
  • feat(review): hover card trigger settings and first-run introduction in #1462
  • feat(review): compare local branch with remote by @​leoreisdias in #1451
  • fix(opencode): queue-deliver the session URL notice by report from @​Naasha in #1460
  • fix(review): open the References panel beside the diff in #1465
  • docs(skills): require gate for file approval by @​zhangjinzan1 in #1453

New Contributors

  • @​zhangjinzan1 made their first contribution in #1453

Community

@​leoreisdias returned with the local-vs-remote diff mode, an implementation clean enough that our adversarial review's only required change was a regenerated build manifest, and they fixed the review's optional suggestions before we finished writing them up. @​zhangjinzan1 caught a real footgun in the installed skills, diagnosed exactly why an agent following them would promise an approval it could not deliver, and shipped the fix with a drift-proof test in a first contribution that merged as written. @​Naasha filed one of the best bug reports this project has received, tracing a token-burning notice on OpenCode 2 betas down to the exact upstream wake semantics.

The unified decision control itself is community-driven: it exists because users kept asking for overall review comments, an integrated global comment field, and a faster way to say "that's fine" - and because one of you told us you never wanted to see Approve sitting next to Send Feedback again.

Thank you. Plannotator gets better because you tell us where it falls short.

Full Changelog: backnotprop/plannotator@v0.27.11...v0.27.12

github/gh-stack (github:github/gh-stack)

v0.1.1: v0.1.1

Compare Source

gh-stack is a GitHub CLI extension for managing stacked branches and pull requests. Learn more about GitHub Stacked PRs here.

View the Quick Start guide to get started.

Install the extension with:

gh extension install github/gh-stack

Or upgrade to the latest version with:

gh extension upgrade stack

What's new in v0.1.1

Added

  • Vim-style j / k navigation: The interactive view, checkout, and switch pickers now accept j / k to move down and up, alongside the existing arrow keys (the modify and merge TUIs already supported them). Navigation hints now read ↓↑/jk. submit is intentionally left on arrow keys, since its auto-focused text fields need literal j and k input.
  • gh stack checkout finds stacks on GitHub: Running checkout with no argument now detects when your current branch isn't part of a local stack but belongs to an active stack on GitHub, and offers to check that stack out. And gh stack checkout <branch> now resolves a branch name against active remote stacks when it isn't tracked locally, importing the match through the existing PR checkout flow. Both are best-effort — network failures, no or multiple matches, or a declined prompt fall through to the existing behavior, and fully merged stacks are ignored.
  • gh stack add can initialize a stack: Running add from a branch that isn't part of a stack now offers to initialize a new stack — using your explicit or auto-generated branch name as the first layer — instead of failing. init also now restores a missing local trunk from the selected remote before creating branches, covering repositories where the default branch was renamed locally.

Changed

  • Leaner agent skill: The bundled gh-stack agent skill is restructured into a concise core plus references that load only when needed, cutting SKILL.md from ~891 lines / ~10.8K tokens to ~183 lines / ~2.1K tokens (an 81% reduction) and correcting stale guidance. In evaluations across two models it passed every tested workflow while using fewer tool calls and ~34% fewer input tokens than the previous skill.
  • Taller gh stack checkout picker: The stack picker now expands to use the available terminal height when more than 10 stacks are available, instead of always capping the list at 10 rows, while staying compact for smaller result sets.
  • $EDITOR fallback in the submit TUI: When no editor is configured, the submit TUI's external description editor now falls back to vi (when available on PATH); configured editors keep their existing precedence.

Fixed

  • PR links were unusable without OSC 8 hyperlink support: On terminals that don't support OSC 8 hyperlinks (tmux, screen, Apple Terminal, Konsole, non-TTY output, and unknown terminals), gh stack view --short and other non-TUI status output now print the full PR URL as #N (URL) instead of an unclickable reference. Set GH_STACK_HYPERLINKS=1 to force hyperlinks or GH_STACK_HYPERLINKS=0 to force full URLs. TUI and JSON output are unchanged.

Changelog

Full Diff: github/gh-stack@v0.1.0...v0.1.1

janosmiko/lfk (github:janosmiko/lfk)

v0.18.7: v0.18.7

Compare Source

0.18.7 (2026-09-03)

Bug Fixes

  • keep the right-sizing overlay loading after a picker press mid-fetch (#722) (47ce657), closes #705
  • refresh the nix vendorHash and fail CI when it goes stale (#720) (a0e7a77)
kitlangton/ghui (github:kitlangton/ghui)

v0.9.1: v0.9.1

Compare Source

Fixes

  • Restore branch, review, and check details in copied pull request metadata, plus comment counts and labels in copied issue metadata. #58
  • Fix merges into branches with a merge queue by omitting the rejected branch-deletion flag. Queue requests keep the PR open and refresh its status instead of reporting a completed merge; explicit admin merges still bypass the queue. Merge confirmation is blocked after lookup failures. #59

Full changelog

@scottames-github-bot

Copy link
Copy Markdown
Contributor
modem-dev/hunk (github:modem-dev/hunk)

v0.21.0: v0.21.0

Compare Source

Hunk 0.21 — secure sessions, threaded reviews, richer comparisons

Upgrade for threaded agent conversations, safer live sessions across restarts and upgrades, and exact revision or file comparisons across Git, Jujutsu, and Sapling.

# Existing managed installs
hunk update 0.21.0

# npm installs
npm install -g hunkdiff@&#8203;0.21.0

Threaded reviews and safer live sessions

Inline notes are now editable conversations: continue a discussion with nested replies, edit notes, use mouse or keyboard actions, and dismiss agent notes that no longer need attention. Session clients can also navigate straight to a comment by ID. #925 #845

The local session broker now authenticates producers and CLI controls, bounds unauthenticated work, and prevents stale connections from regaining authority. When an incompatible older daemon becomes idle, open Hunk windows reconnect automatically instead of trusting or force-killing it. #932 #933 #955

Compare the exact changes you mean

hunk diff <from> <to> now performs backend-native two-revision reviews across Git, Jujutsu, and Sapling. Use hunk diff --files <left> <right> for an explicit two-file comparison; source expansion stays pinned to the selected endpoints instead of leaking in working-copy state. Jujutsu reviews also gain unchanged-context expansion. #938 #890

Faster reviews at every terminal size

The files sidebar now grows from a compact projection into a full tree as space becomes available, while panes resize without giving up split review. The stream fills immediately on first paint, and large reviews recover responsive scrolling. Diff accents and word highlights are also more faithful across roughly 25 bundled themes. #921 #924 #922 #942 #825 #828

Navigation is steadier too: explicit top and bottom jumps now win over pending reveals, and Ctrl-D/Ctrl-U provide familiar half-page movement. #928 #855

For extension authors

Extensions can register generic top-level CLI command trees, react to hunk_viewed and note_changed, follow the current source line, handle pane activation, size panes fractionally, and select syntax highlighting by filename or glob—so commands and panes can stay synchronized with the active review. #888 #939 #940 #965 #851

Compatibility notes

  • npm users: installation now requires Node.js 22 or newer. Standalone Hunk binaries still run without Node.js. #917
  • Bun/watch-mode users: watch mode refuses Bun versions older than 1.3.14 because those runtimes can deadlock during filesystem-watcher cleanup. #902
  • OpenTUI embedders: reusable component consumers must use @&#8203;opentui/core and @&#8203;opentui/react 0.5.6 or newer. #914
  • curl-installer users: installation now refuses conflicting Hunk binaries unless explicitly forced and explains how to remove the competing install. #960
  • Extension authors: API generations 12 and 14 add fractional pane sizing and structured rangeEndpoints. These are additive capabilities, not required migrations. #924 #938

Community contributors

All merged pull requests

PRs #889, #893, and #894 were also released in v0.20.1 through the 0.20.x maintenance branch.

  • fix(ui): exit when the terminal hosting a review disconnects by @​NiqhtFire in #724
  • docs: trim redundant agent guidance by @​benvinegar in #854
  • feat(ui): add Ctrl-D and Ctrl-U scrolling aliases by @​benvinegar in #855
  • feat(extensions): match file languages by filename or glob by @​benvinegar in #851
  • refactor(cli): split session command dispatch by @​benvinegar in #857
  • refactor(ui): unify clipboard line clipping by @​benvinegar in #860
  • refactor(ui): simplify copy-selection row ranges by @​benvinegar in #859
  • refactor(ui): isolate theme selector state by @​benvinegar in #864
  • refactor(ui): isolate view preference quit flow by @​benvinegar in #863
  • refactor(ui): isolate extension workspace controls by @​benvinegar in #862
  • fix(ui): keep wrapped code-row geometry aligned by @​benvinegar in #858
  • refactor(ui): isolate user note composition by @​benvinegar in #871
  • refactor(ui): extract styled span layout by @​benvinegar in #868
  • refactor(ui): extract code row layout by @​benvinegar in #869
  • refactor(ui): consolidate timed notices by @​benvinegar in #872
  • refactor(ui): extract planned row text projection by @​benvinegar in #874
  • refactor(ui): isolate current review refresh by @​benvinegar in #873
  • refactor(ui): extract code cell painting by @​benvinegar in #875
  • refactor(ui): split mounted diff row views by @​benvinegar in #877
  • fix(commands): construct complete synthetic key events by @​nightcityblade in #774
  • Add hunk-git-lite to hunk-extension marketplace by @​benvinegar in #883
  • Add hunk-mark-as-reviewed to hunk-extension marketplace by @​benvinegar in #856
  • test: stabilize Windows CI suites by @​benvinegar in #885
  • refactor(ui): isolate extension trust controller by @​benvinegar in #876
  • fix(ui): prevent highlight cache identity collisions by @​benvinegar in #889 (also released in v0.20.1)
  • refactor(ui): commit extension runtime authority by @​benvinegar in #891
  • fix(session): refuse option-like VCS ranges in session reloads by @​benvinegar in #894 (also released in v0.20.1)
  • fix(ui): stabilize rapid theme previews by @​benvinegar in #893 (also released in v0.20.1)
  • Add hunk-file-order to hunk-extension marketplace by @​benvinegar in #849
  • Themes: Fix washed-out diff accents and invisible word highlighting by @​masonmcelvain in #825
  • feat(ui): make file and hunk spacing configurable by @​Ajay-Satish-01 in #865
  • Themes: Harvest bundled diff accents from real VS Code tokens by @​masonmcelvain in #828
  • feat(session): navigate to comments by id by @​Yuki9814 in #845
  • docs(session): define broker SDK contract by @​benvinegar in #895
  • test(pty): observe highlight input responsiveness by @​benvinegar in #899
  • fix(watch): refuse deadlocking Bun runtimes by @​benvinegar in #902
  • fix(session): bind broker state to peer ownership by @​benvinegar in #898
  • refactor(session): canonicalize comment navigation by @​benvinegar in #896
  • feat(session): add signed broker authorization by @​benvinegar in #901
  • feat(extensions): add generic CLI commands by @​benvinegar in #888
  • fix(jj): enable unchanged-context expansion by @​samuela in #890
  • fix(packaging): avoid mandatory Bun in prebuilt installs by @​benvinegar in #908
  • feat(extensions): support dim tone in line highlighters (chore(deps): update ⬆️ aqua-packages #852) by @​benvinegar in #909
  • docs(readme): add Discord community badge by @​benvinegar in #911
  • chore(deps): update Zod to 4.4.3 by @​benvinegar in #910
  • fix(session): validate broker runtime boundaries by @​benvinegar in #903
  • chore: update license copyright owner by @​benvinegar in #913
  • chore(deps): upgrade OpenTUI to 0.5.6 by @​benvinegar in #914
  • fix(session): bound broker scheduling and transport by @​benvinegar in #918
  • chore(packaging)!: require Node.js 22 for npm installs by @​benvinegar in #917
  • feat(website): add tabbed install selector by @​benvinegar in #919
  • Add hunk-commit to hunk-extension marketplace by @​benvinegar in #916
  • feat(ui): add adaptive file tree sidebar by @​benvinegar in #921
  • feat(ui): add responsive pane sizing by @​benvinegar in #924
  • fix(ui): fill the review stream on first paint by @​benvinegar in #922
  • feat(review): add threaded inline comments by @​benvinegar in #925
  • fix(ui): let edge jumps supersede pending reveals by @​benvinegar in #928
  • feat(cli): add pacman silent install source by @​marmitar in #850
  • chore(test): upgrade tuistory by @​benvinegar in #930
  • fix(session): accept native terminal identifiers by @​benvinegar in #936
  • fix(session): accept dim highlight commands by @​benvinegar in #937
  • feat(session-broker): authenticate local peers by @​benvinegar in #932
  • feat(session): migrate incompatible daemons safely by @​benvinegar in #933
  • test(install-vm): cover authenticated daemon upgrades by @​benvinegar in #934
  • feat(cli): compare two revisions explicitly by @​benvinegar in #938
  • feat(extensions): add hunk_viewed and note_changed events by @​benvinegar in #939
  • feat(extensions): give panes the current line's source address by @​benvinegar in #940
  • fix(ui): restore review stream responsiveness by @​benvinegar in #942
  • docs(release): require editorial GitHub notes by @​benvinegar in #946
  • fix(extensions): prioritize focused pane editors by @​benvinegar in #954
  • fix(install): refuse conflicting Hunk installs by @​benvinegar in #960
  • feat(website): publish prerelease changelogs by @​benvinegar in #961
  • fix(install): deduplicate binary aliases by @​benvinegar in #963
  • test(session): characterize lifecycle interleavings by @​benvinegar in #949
  • fix(session): recover from socket startup failures by @​benvinegar in #950
  • refactor(session): model startup lifecycle states by @​benvinegar in #952
  • refactor(session): inject a lifecycle clock by @​benvinegar in #953
  • fix(session): fence late lifecycle settlements by @​benvinegar in #955
  • test(session): retain runtime exit fixtures by @​benvinegar in #956
  • feat(extensions): add pane activation callback by @​benvinegar in #965
  • chore(release): prepare v0.21.0-beta.1 by @​benvinegar in #967
  • feat(website): add comparison pages for other diff tools by @​benvinegar in #968
  • chore(release): prepare v0.21.0 by @​benvinegar in #972

Release notes: https://hunk.dev/changelog/0.21/
Full changelog: modem-dev/hunk@v0.20.1...v0.21.0

schpet/linear-cli (github:schpet/linear-cli)

v2.6.0: 2.6.0 - 2026-09-02

Compare Source

Release Notes

Added

  • team members --json and user list --json now include each member's canonical Linear url, so callers can create real Markdown mentions without guessing profile slugs
  • issue pr accepts --template/-T <file> to start the pull request body from a template file, with a pr_template config option (LINEAR_PR_TEMPLATE) as a per-project default and --no-template to skip that default for one invocation. The Linear issue URL is appended after the template, so the pull request stays linked to its issue (#266; thanks @​maparent)
  • issue comment list --json now exposes stable author identity: user.id, externalUser.id, and a botActor object (id, name, type, subType) for comments posted by integrations. Display names are editable and can collide across a workspace — an external user's display name can even match a real member's — so programs consuming the JSON previously had nothing reliable to attribute a comment with (#268; thanks @​leonardsellem)
  • issue comment list --json now includes editedAt, which is set only when a comment's author revised it. updatedAt also moves for unrelated backend churn, so it could not answer "has this been changed since it was written?" (#268; thanks @​leonardsellem)
  • LINEAR_IGNORE_ENV_FILE=1 skips .env loading entirely, for repositories whose .env is not dotenv-shaped

Changed

  • CLI help now explains how to create real Linear Markdown mentions and collapsible sections, so an agent driving the CLI without the bundled skill still gets it right. The ten commands that take a Markdown body carry the rule inline (@&#8203;name mentions nobody; a plain Linear URL does) and point at a new linear markdown reference, and team members --json / user list --json say what the url field is for
  • issue mine, issue query, issue start, and team states now group statuses in the same order as the Linear app: by workflow state type, then by the team's configured position within that type. Issue listings previously ran the order backwards (canceled and done first), and every status list sorted on raw position alone, which stranded a late-positioned status such as an "In Review" at position 1002 after "Duplicate" instead of beside "In Progress"
  • when --limit truncates an issue listing, the retained issues are now the most actionable rather than the most recently closed. The Linear API cannot sort by a team's configured positions, so it still selects which issues are fetched; that selection changed from closed-first to open-first. A status this build does not recognize sorts after all known ones
  • an unquoted $VAR reference in a LINEAR_/GH_/GITHUB_ value is now skipped with a warning rather than expanded. Expansion of an unset variable silently produced the string "undefined", and a self-referential one hung. Quoted values are unaffected, since dotenv never expanded those
  • issue query no longer prints the "using default team" note when the team comes from the project's own linear.toml or .env. The note exists to flag ambient defaults — a global config file or an exported LINEAR_TEAM_ID — silently narrowing a query; explicit, directory-scoped project configuration is not ambient, so the reminder was just noise on every query

Fixed

  • linear no longer crashes on startup when .env is a directory rather than a file, and no longer hangs forever on a .env written to be sourced by a shell (a self-referential value such as export PATH=$PATH:/opt/bin spun the dotenv expander's loop indefinitely). An unusable .env is now reported as a warning on stderr and skipped, and the repository-root .env is still consulted as a fallback (#265; thanks @​jackarch-2 for the fix and the report in #264)
  • issue comment list showed @&#8203;Unknown for every comment posted by an integration or bot, because the query never asked for botActor; those comments now render the bot's name (falling back to its type)
  • issue comment add --id now rejects a value that is not a v4 UUID (the format Linear documents for the field) with an actionable error, instead of forwarding it and surfacing a raw API error

Install linear 2.6.0

Install prebuilt binaries via shell script

curl --proto '=https' --tlsv1.2 -LsSf https://github.com/schpet/linear-cli/releases/download/v2.6.0/linear-installer.sh | sh

Install prebuilt binaries via Homebrew

brew install schpet/tap/linear

Install prebuilt binaries into your npm project

npm install @&#8203;schpet/linear-cli@&#8203;2.6.0

Download linear 2.6.0

File Platform Checksum
linear-aarch64-apple-darwin.tar.xz Apple Silicon macOS checksum
linear-x86_64-apple-darwin.tar.xz Intel macOS checksum
linear-x86_64-pc-windows-msvc.zip x64 Windows checksum
linear-aarch64-unknown-linux-gnu.tar.xz ARM64 Linux checksum
linear-x86_64-unknown-linux-gnu.tar.xz x64 Linux checksum
SocketDev/socket-cli (npm:socket)

v1.1.167: v1.1.167

Compare Source

What's Changed

Full Changelog: SocketDev/socket-cli@v1.1.166...v1.1.167

Skipped Packages

Non-GitHub Sources

GitHub Release Notes Unavailable

  • droid: No GitHub release was found for 0.212.1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants